1

I've been reading up on GUIDs. According to the Wiki:

Cryptanalysis of the WinAPI GUID generator shows that, since the sequence of V4 GUIDs is pseudo-random, given full knowledge of the internal state, it is possible to predict previous and subsequent values.

Now imagining a server (of which we know little about the internal state) that we can query for millions of GUIDs; would it be possible to use the generated GUIDs to guess the relevant parts of the internal state of the machine, and from there predict subsequent GUIDs?

While my quote mentions WinAPI (hence Windows), I am interested in any widely used implementation.

Improve this question
1
  • yes. every output of a non-cs prng stems from internal state. If that state is determinate (mainly non dynamic), then eventually, knowing enough outputs simply must reveal facts about the input.
    – dandavis
    Jul 26, 2016 at 14:57

1 Answer 1

Reset to default
7

It would depend on the implementation of the GUID/UUID library. Determining the internal state of a pseudo-random number generator varies widely based on which one you're talking about.

Many GUID/UUID libraries utilize a proper cryptographically strong pseudo-random number generator (CSPRNG) when generating v4 UUIDs. In those specific cases, when implemented correctly, I would argue that you would not be able to infer anything about the internal state.

Improve this answer
2
  • In some situations a series of GUIDs are generated sequentially or by date/time.
    – 700 Software
    Jul 26, 2016 at 13:22
  • 5
    @GeorgeBailey true, but those are not v4 GUIDs, which is what the question mentions.
    – John Downey
    Jul 26, 2016 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .