We used UUIDs for every media stream in our media engine. Had to create about 15 per second during prime-time conference hours. It was 40% of our CPU load! So they aren't free.

15 per second for 40% CPU? ಠ_ಠ This is very strange. On my laptop:

   ~ $ python -m timeit -s 'import uuid' 'uuid.uuid4()'
   100000 loops, best of 3: 14.2 usec per loop

Which gives more than 70000 random UUIDs per second.

Yeah we were using some cryptographically secure ones for some reason. Creating them in Java!

Python's uuid4 is cryptographically secure, as far as I know. One UUID needs ~16 random bytes, my laptop's /dev/urandom gives about 14 MB/s (user-space PRNG can be much faster if needed).

Ah, Java...

To be cryptographically secure, it must be unguessable. That's a higher bar than random, because many random number generators are guessable (i.e. completely predictable).

Linux /dev/urandom is cryptographically secure.

The library you are using for creating those UUIDs must have some bug. My guess is they share the same generator for all threads on each machine.

From Wikipedia : "some people claim /dev/urandom as not recommended[who?] for the generation of long-term cryptographic keys"

It's manpage also says the same.

It is a cryptographically secure PRNG, but during a small time in system start up, it may not be correctly seeded.

If you need long term keys, it may be better to get some 256 bits from /dev/random before using /dev/urandom.

That's a bad advice.

http://sockpuppet.org/blog/2014/02/25/safely-generate-random...