I am implementing an OAuth 2.0 authorisation server. As part of client registration process I want to generate the unique client identifier for this client.
The method I have chosen is to take all the client registration information and hash it using SHA-512. The client information includes:
- client password (masked using bcrypt)
- client type
- client name
- client web site uri
- application name
- url for logo image
- client description
- redirect uri
- legal terms and conditions acceptance flag
- registration active flag
- create timestamp // when the client registered
- update timestamp
- deactivated timestamp
My question is whether it is safe to include the encrypted password when producing the SHA digest and whether this is a secure way to produce a unique client identifier.