3 ms·
Reading the UUID spec leads me to believe that good entropy is not even a requirement for any version: > Implementations SHOULD utilize a cryptographically sec
by ranger_danger 6mo ago
Reading the UUID spec leads me to believe that good entropy is not even a requirement for any version:
> Implementations SHOULD utilize a cryptographically secure pseudorandom number generator (CSPRNG) to provide values that are both difficult to predict ("unguessable") and have a low likelihood of collision ("unique").
From https://www.rfc-editor.org/rfc/rfc9562.html#unguessability https://www.rfc-editor.org/rfc/rfc9562.html#unguessability
So I don't think technically we can say entropy or random numbers at all are even "required for UUIDv4 to work as advertised."
- toast0 6mo agoAny PRNG, including a CSPRNG is simple to predict if you know its inputs. You need entropy to seed your CSPRNG.
- ranger_danger 6mo agoI think you misunderstood the meaning of the word "SHOULD" in the spec. It means it's not strictly necessary, as in, a PRNG is not a requirement in order to support UUIDs in a compliant way. To me this means UUID itself is not a viable solution if randomness is a requirement for you, because even if one claims they are using a UUID implementation that is compliant with the spec, and it is in fact compliant, that doesn't mean it's actually random at all.