I've been reading up on GUIDs. According to the Wiki:

Cryptanalysis of the WinAPI GUID generator shows that, since the sequence of V4 GUIDs is pseudo-random, given full knowledge of the internal state, it is possible to predict previous and subsequent values.

Now imagining a server (of which we know little about the internal state) that we can query for millions of GUIDs; would it be possible to use the generated GUIDs to guess the relevant parts of the internal state of the machine, and from there predict subsequent GUIDs?

While my quote mentions WinAPI (hence Windows), I am interested in any widely used implementation.

  • yes. every output of a non-cs prng stems from internal state. If that state is determinate (mainly non dynamic), then eventually, knowing enough outputs simply must reveal facts about the input. – dandavis Jul 26 '16 at 14:57

It would depend on the implementation of the GUID/UUID library. Determining the internal state of a pseudo-random number generator varies widely based on which one you're talking about.

Many GUID/UUID libraries utilize a proper cryptographically strong pseudo-random number generator (CSPRNG) when generating v4 UUIDs. In those specific cases, when implemented correctly, I would argue that you would not be able to infer anything about the internal state.

  • In some situations a series of GUIDs are generated sequentially or by date/time. – Bryan Field Jul 26 '16 at 13:22
  • 4
    @GeorgeBailey true, but those are not v4 GUIDs, which is what the question mentions. – John Downey Jul 26 '16 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.