Menu
We're using .NET's Guid.NewGuid() to generate activation codes and API keys currently. I wonder if that poses a security problem since their algorithm is open.
.NET Guid uses Win32 CoCreateGuid and I don't know its internals (possibly MAC address + timestamp?). Can someone derive a second GUID out of the first one, or can he hit it with some smart guesses or is the randomness good enough so search space becomes too big?
Generating random keys have the problem of collision, they need a double check before adding to a database. That's why we stuck with GUIDs but I'm unsure about their security for these purposes.
Here are the 4 consecutive UUIDGEN outputs:
c44dc549-5d92-4330-b451-b29a87848993 d56d4c8d-bfba-4b95-8332-e86d7f204c1c 63cdf958-9d5a-4b63-ae65-74e4237888ea 6fd09369-0fbd-456d-9c06-27fef4c8eca5
Here are 4 of them by Guid.NewGuid():
0652b193-64c6-4c5e-ad06-9990e1ee3791 374b6313-34a0-4c28-b336-bb2ecd879d0f 3c5a345f-3865-4420-a62c-1cdfd2defed9 5b09d7dc-8546-4ccf-9c85-de0bf4f43bf0
832
GUIDs are designed for uniqueness, not for security. For example, we saw that substrings of GUIDs are not unique. For example, in the classic v1 algorithm, the first part of the GUID is a timestamp.
GUIDs are guaranteed to be unique and that's about it. Not guaranteed to be be random or difficult to guess.
The random GUIDs you create with the Guid. NewGuid method are not known to be cryptographically secure. Thus, it's theoretically possible for a user to predict a GUID value that you generate for another user or task and use this to exploit weaknesses in your system.
The odds of guessing any one GUID is 1 / 2^128. This assumes that each single byte of the GUID is truly random. To ensure that GUIDs are unique among hosts, most parts of a UUID are actually fixed (e.g. a MAC address).
The generated GUID contains 122 bits of strong entropy. On non-Windows platforms, starting with . NET 6, this function calls the OS's underlying cryptographically secure pseudo-random number generator (CSPRNG) to generate 122 bits of strong entropy. In previous versions of .
Definitely not random. Similarly, the person who wanted to use a GUID for password generation would find that the passwords are totally predictable if you know what time the GUID was generated and which computer generated the GUID (which you can get by looking at the final six bytes from some other password-GUID).
GUIDs are quite random, but they are not intended to be used as random numbers - their sole purpose is to uniquely identify entities, so they can be predictable.
Use System.Security.Cryptography.RandomNumberGenerator instead.
136
Any key has a finite space and a sufficiently determined person/group can and will generate all combinations. What's important is not so much the key but how you organise it's validation and what it authorises. If you are operating the validation/authorisation entirely through the Guid then that's probably not appropriate as potentially all Guids are valid, you'd be better off with something like SeriousBit Elipter. If you are using an authentication mechanism that records that a particular Guid has been issued and that it has now been used for activation then Guid isn't such a bad choice as it's a pretty big key space.
33
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
