In our system users are identified by a composite key. We'd like to devise a scheme to deterministically convert this composite key into a UUID.
The obvious first suggestion would be UUIDv5, however:
- It's based on SHA-1, which I understand to be no longer recommended as a hashing algorithm.
- It seems to require one part of the input to be a UUID, but neither part of the composite key is.
The next obvious choice would be to use a SHA-256 hash and "compress" it into 128 bits. This raises 2 questions:
- How to do it? (take the first or second half? XOR first half with second half? some other, better way?)
- Is it bad practice to use all 128 bits of a UUID instead of using the reserved bits for variant and version?