benadida / helios-server

Helios server
http://heliosvoting.org
Apache License 2.0
721 stars 343 forks source link

Consider using UUIDv4 instead of UUIDv1 #331

Open RichiH opened 2 years ago

RichiH commented 2 years ago

I was verifying https://vote.heliosvoting.org/helios/elections/bbeab1b8-1406-11ec-b980-eacead3a3158/view and noticed that helios is using UUIDv1: bbeab1b8-1406->>1<<1ec-b980-eacead3a3158

As per https://en.wikipedia.org/wiki/Universally_unique_identifier UUIDv4 leaks date-time and MAC address, while UUIDv4 is truly random. UUIDv4 is considered the better choice in the general case.