Ask HN: We just had an actual UUID v4 collision...

Re:Ask HN: We just had an actual UUID v4 collision... by ranger_danger on Friday May 08, 2026 @08:34PM (#48070506)

Reading the UUID spec leads me to believe that good entropy is not even a requirement for any version:

> Implementations SHOULD utilize a cryptographically secure pseudorandom number generator (CSPRNG) to provide values that are both difficult to predict ("unguessable") and have a low likelihood of collision ("unique").

From https://www.rfc-editor.org/rfc/rfc9562.html#unguessability

So I don't think technically we can say entropy or random numbers at all are even "required for UUIDv4 to work as advertised."

[ Parent | on HN ]

Re:Ask HN: We just had an actual UUID v4 collision... by toast0 on Saturday May 09, 2026 @10:24AM (#48075232)

Any PRNG, including a CSPRNG is simple to predict if you know its inputs.

You need entropy to seed your CSPRNG.

[ Parent | on HN ]

Re:Ask HN: We just had an actual UUID v4 collision... by ranger_danger on Saturday May 09, 2026 @11:32AM (#48075773)

I think you misunderstood the meaning of the word "SHOULD" in the spec.

It means it's not strictly necessary, as in, a PRNG is not a requirement in order to support UUIDs in a compliant way.

To me this means UUID itself is not a viable solution if randomness is a requirement for you, because even if one claims they are using a UUID implementation that is compliant with the spec, and it is in fact compliant, that doesn't mean it's actually random at all.

[ Parent | on HN ]