Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm trying to understand the use of GUID and what has always left me wondering is what's so special about them that I should consider using them instead of rolling my own type of unique id. In other words why can't I use a whirlpool hash like:

4bec4b25ff46e09f7d7adb5b4e6842f871d7e9670506d1a65af501cf96ddf194d0132b85e66c1baaeb5319f2030b607121aae2a038458d32b4d4b03dfd46d5ea 

instead of a GUID? or MD5 or SHA2 for the same reason?

I could even tailor the length using substrings of a whirlpool hash and calculate the probability of collision myself instead of being restricted by GUID specification.

share|improve this question
1  
If you used a hash function instead of a GUID, what would you use as the starting value? –  BrianAdkins Apr 12 '13 at 12:30
    
    
A V4 GUID is essentially a random 122 bit value with a specific format. Some other GUID variants are created with hashes, such as MD5. –  CodesInChaos Apr 12 '13 at 12:37
    
I didn't specify the hash on what but I imagine I would use the current time in millisec and my company domain.. After the answer below I've come to the conclusion that except for GUID with method 4 which are random, the others are no different in use to a whirlpool hash with a well defined input –  dendini Apr 12 '13 at 13:30
add comment

1 Answer

First of, a hash function has an input: you hash something. GUID (actually UUID) don't have any input. To generate "unique identifiers" with a hash function, you just don't use a hash function; you have to define what you are actually hashing.

There are several standard methods for generating UUID; all these methods aim at achieving "uniqueness" of the generated identifiers. Method 3 uses the MD5 hash function: you generate the UUID by hashing some data which is already inherently unique worldwide (e.g. a URL), but longer than the 16 bytes of an UUID. This method closely resembles what you suggest, except that it defines clearly what is hashed (or at least, it states in plain words that when hashing, you hash something and your UUID won't be more unique than what you hash). Method 5 is like method 3, but with SHA-1 instead of MD5 (output is truncated to 128 bits).

Other methods use physical or configuration elements of the local machine (e.g. MAC address and current time for method 1). Most method are "cooperative": they ensure uniqueness but new UUID values can be predicted. For many security-related protocols, when you need unique ID, you actually need ID that won't collide with previous ID (or will do so only with negligible probability) and cannot be predicted by attackers; for that, you need "method 4": the 128-bit UUID contains 122 random bits, generated from a cryptographically strong PRNG. This method will provide "strongly unique" identifiers, and is better than any homemade construction.

share|improve this answer
1  
I don't think it's guaranteed that the PRNG used to create V4 GUIDs will be cryptographically secure. –  CodesInChaos Apr 12 '13 at 16:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.