title: Is the nonce in a HMAC useful to increase the security, to generate a random number based on the seed?
body: <p>To generate a number based on a seed, I written this code:</p>
  
  <pre><code>var crypto = require('crypto'),
  
  //generate the crypto random token
  clientToken = crypto.createHash("sha256").update(crypto.randomBytes(128)).digest('hex')
  serverToken = crypto.createHash("sha256").update(crypto.randomBytes(128)).digest('hex'),
  
  //generate the seed
  hmac = crypto.createHmac('sha512', serverToken);
  hmac.update(clientToken);
  var seed = hmac.digest('hex'),
  
  //generate the random number with a PRNG algorithm
  prng = new require("seedrandom")(seed),
  random = Math.floor(prng() * (100000000 - 10000)) + 10000;
  
  //log the results
  console.log("clientToken: ", clientToken);
  console.log("serverToken: ", serverToken);
  console.log("Seed     :   ", seed);
  console.log("Random number:", random);
  </code></pre>
  
  <p>As you can see, I don't HMAC a nonce value and I would to know if digesting it, will add more security.</p>
  
  <p>This could be the code updated with the nonce implementation added:</p>
  
  <pre><code>//generate the nonce by using a nanosecond timestamp
  var hrtime = process.hrtime(),
  nonce = (hrtime[0] * 1e9 + hrtime[1]).toString();
  nonce = crypto.createHash("sha1").update(nonce).digest('hex');
  
  //generate the seed
  var hmac = crypto.createHmac('sha512', serverToken);
  hmac.update(clientToken);
  hmac.update(nonce);
  var seed = hmac.digest('hex');
  </code></pre>
  
  <p>Adding the nonce, will increase the security ? An user that only knows the client token, could guess the hmac seed ? (With and without the nonce implementation)</p>