I need to connect to a REST API using a WSSE header for authentication. Since WSSE still uses the weak SHA1 I believe a good nonce is important.
I found very different implementations: * http://www.orocrm.com/documentation/index/current/cookbook/how-to-use-wsse-authentication * https://gist.github.com/borisguery/3792855 * https://dev.emarsys.com/suite/get_started/authentication_php.html * https://stackoverflow.com/questions/18117695/how-to-calculate-wsse-nonce
$nonce = 'd36e316282959a9ed4c89851497a717f';
$nonce = uniqid();
$nonce = base64_encode( hash_hmac('sha512', uniqid(null, true), uniqid(), true) );
$nonce = base64_encode( substr( md5( uniqid( gethostname() . '_', true)), 0, 16));
What do you think would be a good choice?