Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What's some good advice on eliminating collisions when hashing things? I need a unique identifier for all my users, but I want them to be private. I'm thinking of using ODIN-1 (, a sha1 of different device-specific identifiers; MAC for iOS, AndroidID for Android and DeviceUniqueId for Windows Phone.

However, what's the collision risk on those hashes? Would using another hashing function help? Another input? Platform-specific prefix? I really need every legitimate hash to be unique.

Let's ignore users who fake their hashes for now, since I cannot really do that much about them. Client side security is what it is.

share|improve this question
You need a unique identifier. Why does it have to be derived from anything? Why not a UUID? – Stephen Touset Apr 15 '14 at 7:42
up vote 1 down vote accepted

See Comparison of SHA functions on Wikipedia. As the table shows, a theoretical collision attack with an estimated complexity of ~2^69 exists for SHA-1. See Marc Stevens' presentation for reference.

Since you're concerned about collisions I recommend using SHA-2 instead. You can choose any of the variants, but I suggest you pick one that meets your security and performance requirements.

share|improve this answer
sha256? is that enough to eliminate collisions for a 48bit input? – Filip Haglund Apr 15 '14 at 6:34
According to the Wikipedia article, yes. Collision's don't occur with SHA-2. You could choose any of the variants, but I suggest you pick one that meets your security and performance requirements. – Steven Volckaert Apr 15 '14 at 6:48
Well, hashes are only hashed client-side, once, so by that logic I should use the toughest hash I can come up with? – Filip Haglund Apr 15 '14 at 7:12
You are worrying about a made-up problem. Given a 48-bit input, you nor any of your users are ever going to experience a collision in any of the SHA-2 variants. – Stephen Touset Apr 15 '14 at 7:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.