Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Does your UUID library use a cryptographic safe RNG?


Java's does, and that's the implementation the article discusses.


But this is the point though, UUID is the wrong tool for the job. You want a cryptographically random blob of entropy and you reach for a UUID because it happens to contain some of that in a specific implementation.

UUIDs are for uniqueness and involve implicit trust. Cryptographic libraries are what you need to generate entropy blobs without weakening security/confusing the next developer etc.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: