为什么哈希（不使用盐）随机数？

Question

The following snippet of code is in php but I've seen developers of other web programming languages hash random numbers.

if ($loginValid=='yes') {
    $token = sha256(generateRandomNumber());
    $_SESSION["token"] = $token;
    $_SESSION["userid"] = $id;
    setcookie("authenticationtoken", $token, ...)
}

sha256 is a cryptographic hash function. Since it does not use a salt, whatever input you give it, the same output comes out. Try it out:

http://www.xorbin.com/tools/sha256-hash-calculator

In what context is hashing (without using a salt) a random number considered good practice?

Answer 1

My guess is that it's just a simple way of getting a hash of a known size, independently of the size that generateRandomNumber() returns. Obviously if generateRandomNumber() has a small range, that will be reflected in the number of distinct hashes returned too.