Update recovery code generation

[HaoK]

Per @GrabYourPitchforks request

New format is now 5 by 5 and looks something like: 4KPMY-NK9NK

Valid characters are taken from the set that windows product key uses, and the implementation is copied from https://source.dot.net/#System.Security.Cryptography/System/Security/Cryptography/RandomNumberGenerator.cs,100 but modified for our specific usage (we unfortunately can't just use RNG since identity also targets non netcoreapp)

[sebastienros]

I understand some confusing chars were removed, in OC we also use them as lower-case which I find even more explicit. But I have the feeling upper case is more standard.

[sebastienros]

Just FYI https://vcsjones.dev/csharp-readonly-span-bytes-static/

[HaoK]

Yeah but that looks gross if I have to do it like this

private static byte[] LookupTable => new byte[] {
    (byte)'0', (byte)'1', (byte)'2', (byte)'3', (byte)'4',
    (byte)'5', (byte)'6', (byte)'7', (byte)'8', (byte)'9',
    (byte)'A', (byte)'B', (byte)'C', (byte)'D', (byte)'E',
    (byte)'F',
};

[sebastienros]

Also I am wondering if a char[] is better than a string

private static readonly char[] AllowedChars = "23456789BCDFGHJKMNPQRTVWXY".ToCharArray();

[sebastienros]

Perf doesn't care about gross ;) But it was just FYI, I don't think it matters here

[HaoK]

Yeah, totally agree that the lookup table could be faster, but yeah this is done generally only on user creation, so readability is more important. That said CharArray change seems fine though, do you want me to make that?

[sebastienros]

I'd prefer personally the char array, more common for the usage. And also as a private static field in that case.

[WeihanLi]

Since it's a fixed-length string, maybe we could use char[] instead of StringBuilder?

[sebastienros]

Since the goal is to generate a string, in that case it wouldn't matter much, SB is allocating an array internally and then generates a single string out of it.

[Rand-Random]

@HaoK
Maybe you want to step in:
https://stackoverflow.com/questions/73291844/why-is-randomnumbergenerator-fill-used-instead-of-randomnumbergenerator-getint32

[ghost]

Hi @Rand-Random. It looks like you just commented on a closed PR. The team will most probably miss it. If you'd like to bring something important up to their attention, consider filing a new issue and add enough details to build context.