Is Microsoft's GUID generator cryptographically secure

Question

I have searched multiple resources online, but so far have been unable to find a definitive answer to the question of whether Microsoft's GUID generation mechanism is secure enough to warrant it's use as a unique ID across an application.

To clarify, by 'secure enough', I mean to ask whether the algorithm used to generate the GUID has any known weaknesses or vulnerability that could reduce the effective randomness of the GUID i.e. result in a non-negligible number of collisions. If no, does this mean the GUID is completely unguessable, and if yes, is there some way to seed the GUID generator function to effectively increase the randomness of the generated GUID.

Based on the information specified in MSDN guide here (http://msdn.microsoft.com/en-us/library/system.guid.aspx) is there any indication that the system used to generate the GUID can be relied upon to be sufficiently random.

Thanks!

Answer 1

I'm going to disagree with the accepted answer. While it's generally a bad idea to go against the advice of an RFC, in this case I was able to find MSDN documentation specifying that Microsoft indeed took the obvious, helpful route and tied a cryptographically-secure RNG into the generation of v4 GUIDs:

According to https://msdn.microsoft.com/en-us/library/system.guid.newguid(v=vs.110).aspx, .NET's GUID creation just wraps the Windows functions CoCreateGuid and UuidCreate. And according to http://download.microsoft.com/download/5/0/1/501ED102-E53F-4CE0-AA6B-B0F93629DDC6/Windows/%5BMS-WSO%5D.pdf, since Windows 2000 back in 1999,

"the random bits for all version 4 GUIDs built in Windows are obtained via the Windows CryptGenRandom cryptographic API or the equivalent, the same source that is used for generation of cryptographic keys"

So I'd say you could call them cryptographically secure -- at least to the extent of the 122 bits of entropy they provide.