Registration Code Entropy I'm designing a system where a registration code is generated, it is sent to the user, and then the user registers himself/herself based on this registration code into the system.

The registration code has some expiration time, so that if the user doesn't register within the validity period, the registration code will expire a new registration code needs to be generated.

Is there any standard that would suggest what should be the entropy of such a registration code?

On one hand, it should be long enough so that an attacker can't guess it.
On the other hand, it should be short enough so that the user can enter it easily into the system.
There are length recommendations within the HMAC-based One-time Password algorithm, which is simply explained here, and the detail is here.

The important part of this is:-


  The recommendation is made that persistent throttling of HOTP value verification take place, to address their relatively small size and thus vulnerability to brute force attacks. 


Just as a cash machine with a 4 digit PIN. They get angry after 3 bad attempts.  RFC 4226 suggests an increasing delay after each registration failure. If you go with the default 6 digit code, you'd get a tad below 20 bits of entropy. But that's to be viewed in conjunction with throttling.  The code would simply look like 872921. 

Also there are RSA hardware tokens that use 6 digits, but with a validity period of only about a minute. Adjust accordingly...

Note. This form of HOTP does not mathematically link the code to the time. You'd have to implement that check separately. I don't want to dwell too much on the mechanics of generating/accepting the token. I'm focusing on the IETF recommended entropy aspect of the question within a rate limited environment.