Search code examples
randomuuidentropy

Are postgres UUID numbers homogeneously random?

Looking at UUIDs generated as primary keys by Postgres defined by RFC 4122, ISO/IEC 9834-8:2005 (source http://www.postgresql.org/docs/9.1/static/datatype-uuid.html). Can we consider that these numbers are homogeneously random on all their length ?

Given this UUID :

a0eebc99-9c0b-4ef8-bb6d-6bb9bd380a11

Can we objectively assume that a0eebc99 and bd380a11 are equally as random ? If not, why ?

Solution

  • UUIDs in general are meant and optimized to be unique. They do not offer a guaranteed randomness. You should not use UUIDs as secrets and/or random number generator.

    There are several versions how UUIDs are generated, most of them are not random, but rather predictable. See the Wikipedia article on UUIDs and the various versions.

    If you want to avoid collisions for IDs, use UUIDs, if you want secrets, use strong cryptographic (P)RNGs.

    Also note, that the variant is encoded in the UUID itself, so at least this part of the UUID is not random at all.

    EDIT: There is an interesting article by Raymond Chen in his famous blog "Old New Thing" about almost exactly this question.