CODEWITHSUNDEEP
language-agnosticguid
sharptooth
sharptooth

Reputation: 170489

Are there any inobvious ways of abusing GUIDs?

GUIDs are typically used for uniquely identifying all kinds of entities - requests from external systems, files, whatever. Work like magic - you call a "GiveMeGuid()" (UuidCreate() on Windows) function - and a fresh new GUID is here at your service.

Given my code really calls that "GiveMeGuid()" function each time I need a new GUID is there any not so obvious way to misuse it?

Upvotes: 4

Views: 567

Answers (5)

jldupont
jldupont

Reputation: 96746

Maybe the entropy could be manipulated by playing with some parameters used to generate the GUIDs in the first place (e.g. interface identifiers).

Upvotes: 1

Rubens Farias
Rubens Farias

Reputation: 57956

Just found an answer to an old question: How deterministic Are .Net GUIDs?. Requoting it:

It's not a complete answer, but I can tell you that the 13th hex digit is always 4 because it denotes the version of the algorithm used to generate the GUID (id est, v4); also, and I quote Wikipedia:

Cryptanalysis of the WinAPI GUID generator shows that, since the sequence of V4 GUIDs is pseudo-random, given the initial state one can predict up to the next 250 000 GUIDs returned by the function UuidCreate. This is why GUIDs should not be used in cryptography, e.g., as random keys.

So, if you got lucky and get same seed, you'll break 250k mirrors in sequence. To quote another Wikipedia piece:

While each generated GUID is not guaranteed to be unique, the total number of unique keys (2128 or 3.4×1038) is so large that the probability of the same number being generated twice is extremely small.

Bottom line: maybe a misuse form it's to consider GUID always unique.

Upvotes: 4

DanDan
DanDan

Reputation: 10562

It depends. Some implementations of GUID generation are time dependant, so calling CreateGuid in quick succession MAY create clashing GUIDs.

edit: I now remember the problem. I was once working on some php code where the GUID generating function was reseeding the RNG with the system time each call. Don't do this.

Upvotes: 2

dj_segfault
dj_segfault

Reputation: 12429

Some GUIDs include some identifier of the machine it was generated on, so it can be used in client/server environments, but some can't. Be sure if yours doesn't to not use them in, for instance, a database multiple clients access.

Upvotes: 1

Fredrik Mörk
Fredrik Mörk

Reputation: 158319

The only way I can see of misusing a Guid is trying to interpret the value in some logical manner. Not that it really invites you to do so, which is one of the characteristics around Guid's that I really like.

Upvotes: 1

Related Questions