News for hackers. Stuff that matters.

A comment on Understanding UUIDs, ULIDs and string representations. Parent comment

Re:Understanding UUIDs, ULIDs and string representations by samhw on Wednesday January 05, 2022 @07:04AM (#29807962)
It would be similarly feasible for a competent person to do the same for UUIDs, at least the RFC4122 timestamp-derived UUIDs which many people and libraries use. Of the 128 bit field, several sections are constant over variables like (i) the identity of the machine and (ii) the process, and the RFC describes exactly what those fields are. For the timestamp field, you would then guess at timestamps near to the original UUID's timestamp.

It's not as easy as incremental IDs, without doubt, but it's worth correcting the idea that (most) UUIDs are designed to provide security in this situation, beyond maybe a quarter-layer of defence in depth. In fact, the RFC explicitly says:

> Do not assume that UUIDs are hard to guess; they should not be used as security capabilities (identifiers whose mere possession grants access), for example.

https://datatracker.ietf.org/doc/html/rfc4122#section-6

[ Parent | on HN ]
Re:Understanding UUIDs, ULIDs and string representations by elevader on Wednesday January 05, 2022 @07:15AM (#29808031)
Very true and important to state, UUIDs on their own at most provide obscurity, not security. Can the MAC address of the host that is used for some versions be extracted/read from the UUID or maybe inferred by observing a number of UUIDs?
[ Parent | on HN ]
Re:Understanding UUIDs, ULIDs and string representations by samhw on Wednesday January 05, 2022 @07:19AM (#29808063)
Yup, it can absolutely be extracted. It's not hashed or anything like that, it's just a sequence of fields in the order that the spec gives. It's really not even 'extract', it's more just 'read'.

I think people may be misled by the fact that UUIDs are frequently hex-encoded prior to being sent over the wire (or even, stupidly, in the database). It looks like a hash, but it's very much not one.

Edit: This is all referring to RFC 4122, to be clear. It's entirely possible that there are some other UUID schemes out there which do hash their contents.

[ Parent | on HN ]
Re:Understanding UUIDs, ULIDs and string representations by elevader on Wednesday January 05, 2022 @07:43AM (#29808244)
Definitely didn't know that, thanks for that insight, really appreciate it! I always just assumed they were hashed but never really bothered to check. V4 shouldn't have this problem, right?
[ Parent | on HN ]
Re:Understanding UUIDs, ULIDs and string representations by pqdbr on Wednesday January 05, 2022 @08:02AM (#29808362)
That can't be achieved if UUIDV4 is used.
[ Parent | on HN ]