The Problem

In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID.


The obvious first suggestion would be UUIDv5, however:

  1. It's based on SHA-1, which I understand to be no longer recommended as a hashing algorithm.
  2. It seems to require one part of the input to be a UUID, but neither part of the composite key is.

The next obvious choice would be to use a SHA-256 hash and "compress" it into 128 bits. This raises 2 questions:

  1. How to do it? (take the first or second half? XOR first half with second half? some other, better way?)
  2. Is it bad practice to use all 128 bits of a UUID instead of using the reserved bits for variant and version?
  • How many bits of unique infirmation does the compisite key hold? You should have at most n/2 Input bits for a hadh function with n output bits to prevent collisions – marstato May 18 '17 at 19:05
  • half of a sha256 should suffice; you don't have enough users to worry about collisions. – dandavis May 19 '17 at 1:17
  • @marstato Technically the "bits of information" is unbounded because they are both opaque Strings. Isn't @dandavis right though? With a good hash function isn't the risk of collision on 128 bits minuscule (the point of UUIDs)? – Alex May 19 '17 at 16:23
  • @Alex If you want a function that transparently converst a bunch of Strings to a UUID you'll have to worry about collisions. Its very likely that you wont get collisions because you have too few users; but from a pure mathematical perspective collisions are an issue if you could have enough users to get collisions. – marstato May 19 '17 at 16:27
  • So I don't know the theory very well, I guess my question is: "Are the odds of a collision 'substantially' higher when UUIDs are generated from hashing pairs of strings vs. generating the UUIDs purely randomly?" Obviously there's a non-zero chance of UUIDv4 collisions but the conventional wisdom is it's so vanishingly unlikely one can just not worry about it. – Alex May 19 '17 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.