title: What is a good way to produce a random "site salt" to be used in creating password retrieval tokens?
body: <p>I would like to create a site-wide hash to be used as salt in creating password retrieval tokens. I have been bouncing around stackoverflow trying to get a sense of the best way to do this. </p>
  
  <p>Here's the reset process:</p>
  
  <p>When a user requests a password reset email the code generates a retrieval token:</p>
  
  <pre><code>$token = hash_hmac('sha256', $reset_hash* , $site_hash)
  </code></pre>
  
  <p>*$reset_hash is a hash created using phpass HashPassword() function, saved in the user table.</p>
  
  <p>I then send the token in a URL to the users email address. They click before the token times out in an hour. I match their submission with the a challenge token generated server-side. If it matches, then they are forced to choose a new password, and then login.</p>
  
  <p>I would like to know the best way to generate the $site_key. I am thinking of using another HMAC hash that is seeded by random numbers:</p>
  
  <pre><code>$site_key = hash_hmac('sha256', MCRYPT_DEV_RANDOM, MCRYPT_DEV_RANDOM);
  </code></pre>
  
  <p>This produces something like this:</p>
  
  <pre><code>98bb403abbe62f5552f03494126a732c3be69b41401673b08cbfefa46d9e8999
  </code></pre>
  
  <p>Will this be a suitably random to be used for this purpose? Am I overcomplicating this, or approaching it the wrong way?</p>
  
  <p><a href="https://stackoverflow.com/questions/401656/secure-hash-and-salt-for-php-passwords/401684#401684">I was inspired to use HMAC by this answer</a></p>
  
  <p><strong>EDIT:</strong> I am trying to avoid a 'secret question' step urged by some of my coworkers, so I would like the reset link to provide a single step to resetting the password. Therefore, my concern is that this process be secure enough to safeguard a system containing sensitive information.</p>
  
  <p><strong>RESOLVED, for now:</strong> I am going to go with a nonce as described by The Rook as the reset token. Thanks everyone for the comments and feedback.</p>