google / uuid

Go package for UUIDs based on RFC 4122 and DCE 1.1: Authentication and Security Services.
BSD 3-Clause "New" or "Revised" License
5.24k stars 363 forks source link

is generated UUID safe from bruteforce ? #65

Closed batara666 closed 4 years ago

pborman commented 4 years ago

I am not sure what you are asking. UUID version 4 uuids use the crypto/rand package. I was concerned about collisions when I wrote the package so did some research, which you find in a comment:

// The strength of the UUIDs is based on the strength of the crypto/rand // package. // // A note about uniqueness derived from the UUID Wikipedia entry: // // Randomly generated UUIDs have 122 random bits. One's annual risk of being // hit by a meteorite is estimated to be one chance in 17 billion, that // means the probability is about 0.00000000006 (6 × 10−11), // equivalent to the odds of creating a few tens of trillions of UUIDs in a // year and having one duplicate.

Version 1 UUIDs are based on the system ID (MAC address) and current time so they are much more predictable. Version 4 are the default.