blocks|key|3132873|text|Here's+an+excellent+breakdown+by+Raymond+Chen|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3132874|entityMap|0|LINK|mutability|MUTABLE|url|https://devblogs.microsoft.com/oldnewthing/20080627-00/?p=21823^0|0|19|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

<a href="https://devblogs.microsoft.com/oldnewthing/20080627-00/?p=21823" rel="nofollow noreferrer">Here's an excellent breakdown by Raymond Chen</a>

blocks|key|3345757|text|没有固定长度的值可以保证100%25是唯一的(只要调用它足够的次数，给或取宇宙的结束;-p)+-但它可能是非常，非常，非常不可能的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3345758|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

No fixed-length value can ever guarantee to be 100% unique (just call it enough times, give or take the universe ending ;-p) - but it can be very, very, very unlikely to duplicate.

blocks|key|3345795|text|我不能说序列号的可预测性，但它将是独一无二的。不过，我认为使用System.Security.Cryptography的随机数生成器会更好。将一个随机数与一个单调递增的值(时间)捆绑在一起，以生成您的唯一密钥，您可以确保它是唯一的且不可预测。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3345796|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

I can't speak to the predictability of sequential numbers but it will be unique. I think you'd be better off using a random number generator from System.Security.Cryptography, though. Tie a random number with a monotonically increasing value (time) to generate your unique key and you can be sure that it is unique and not predictable.

blocks|key|3345929|text|System.Guid.NewGuid()的文档没有保证随机性，所以虽然目前的实现是基于随机数生成器(它是算法的版本4，它是在使用MAC地址的版本1引起隐私问题后设计的；其他系统，如苹果的OS仍然使用版本1的算法)。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3345930|因此，尽管System.Guid.NewGuid()生成唯一值的概率非常高，但您不能对其可预测性做出任何假设，因为文档中没有对此进行说明。|3345931|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

The documentation for System.Guid.NewGuid() makes no guarantees for randomness, so while the current implementation is based on a random number generator (it's version 4 of the algorithm, which was devised after privacy concerns arose from version 1 which used the MAC address; other system's like Apple's OS X still use version 1 of the algorithm). 

So while you have a very high probabilty of System.Guid.NewGuid() generating a unique value, you can't make any assumptions about its predictability because that's not specified by the documentation.

blocks|key|3132981|text|我不知道.NET，但是UUID+algorithm的定义是相当精确的。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3132982|编辑:如果您查看适当的位(请参阅维基百科条目)，这应该可以解释正在使用的UUID的版本。|3132983|编辑2:您使用“安全”一词的危险信号，这告诉我您最好使用定义良好的加密方法。例如，在服务器上生成会话IP时，为什么不简单地将MD5散列应用于以下各项的适当子集的连接：{客户端机器IP地址、按顺序递增的计数器、您选择的固定秘密常量、您选择的随机数生成器的输出等。}|3132984|entityMap|0|LINK|mutability|MUTABLE|url|http://en.wikipedia.org/wiki/UUID^0|B|E|0|0|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@]|9|@$A|Q|B|R|1|S]]|C|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@]|C|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@]|C|$]]|$1|H|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|I|$J|$5|K|L|M|C|$N|O]]]]

I dunno about .NET, but the <a href="http://en.wikipedia.org/wiki/UUID" rel="nofollow noreferrer">UUID algorithm</a> is defined fairly precisely. 

edit: if you look at the appropriate bits (see wikipedia entry), that should explain which version of UUID is being used.

edit 2: a red flag for your use of the word "secure", which tells me you're better off using a well-defined cryptographic method. For example, when generating session IDs on a server, why just not do something simple like apply an MD5 hash to the concatenation of an appropriate subset of the following: {client machine IP address, sequentially incremented counter, fixed secret constant of your choice, output from random number generator of your choice, etc.} ?

blocks|key|351552|text|假设System.Guid.NewGuid使用CoCreateGuid，那么它根本不是随机的。过去，用于创建guids的算法是将来自网络适配器的MAC地址与时间等其他内容合并在一起。我不确定算法是否改变了。虽然它肯定不是随机的，但它肯定是唯一的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|351553|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Assuming that System.Guid.NewGuid uses CoCreateGuid, it is not random at all. Historically, the algorithm used for creating guids was to incorporate the MAC address from a network adapter, in addition to some other things like the time. I'm not sure if the algorithm has changed. While it certainly is not random, it is guaranteed to be unique.

blocks|key|3133061|text|我基本上想知道我是否可以信任GUID来生成一个值，它将是唯一的，100%25的时间，并且不可能预测。|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|entityRanges|data|3133062|我想知道GUID对于会话cookie是否足够安全。|3133063|3133064|简短的回答是：根本不是。需要注意的是，唯一性和随机性是完全不同的。如果你有一个通用的计数器(就像在熟食店取数字一样)，这些数字是唯一的，但完全可以预测。|3133065|正如Bochu上面提到的，Raymond的帖子在这里谈到了它：https://blogs.msdn.microsoft.com/oldnewthing/20120523-00/?p=7553/|3133066|3133067|是为实现唯一性而设计的GUID生成算法。它不是为随机性或不可预测性而设计的，实际上，如果你看一下前面的讨论，你会发现所谓的算法1是非随机的，完全可以预测的。，，see，，if，。，事实上，如果你看看之前的讨论，你会发现所谓的算法1是非随机的，完全可以预测的。..。即使是版本4的GUID算法(基本上是说“将版本设置为4，并用随机或伪随机数填充其他所有内容”)也不能保证是不可预测的，因为该算法没有指定随机数生成器的质量。|blockquote|3133068|3133069|3133070|对于安全的随机数，您需要一个加密安全的随机数生成器。|3133071|顺便说一句，“使用我自己的登录系统”是一个安全危险信号--如果我不指出这一点，我将会疏忽。|3133072|entityMap|0|LINK|mutability|MUTABLE|url|https://blogs.msdn.microsoft.com/oldnewthing/20120523-00/?p=7553/^0|S|J|0|0|0|7|4|0|V|1T|0|0|0|27|5|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|14|8|@$9|15|A|16|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|17|8|@]|D|@]|E|$]]|$1|H|3|-4|5|6|7|18|8|@]|D|@]|E|$]]|$1|I|3|J|5|6|7|19|8|@$9|1A|A|1B|B|C]]|D|@]|E|$]]|$1|K|3|L|5|6|7|1C|8|@]|D|@$9|1D|A|1E|1|1F]]|E|$]]|$1|M|3|-4|5|6|7|1G|8|@]|D|@]|E|$]]|$1|N|3|O|5|P|7|1H|8|@$9|1I|A|1J|B|C]]|D|@]|E|$]]|$1|Q|3|-4|5|6|7|1K|8|@]|D|@]|E|$]]|$1|R|3|-4|5|6|7|1L|8|@]|D|@]|E|$]]|$1|S|3|T|5|6|7|1M|8|@]|D|@]|E|$]]|$1|U|3|V|5|6|7|1N|8|@]|D|@]|E|$]]|$1|W|3|-4|5|6|7|1O|8|@]|D|@]|E|$]]]|X|$Y|$5|Z|10|11|E|$12|13]]]]

<blockquote>
 I basically want to know if I can trust the GUID to generate a value
 which will be unique 100% of the time and impossible to predict.
 
 I'm basically rolling my on login system for a website and want to
 know if the GUID is secure enough for session cookies.
</blockquote>

Short answer: not at all. It's important to note that unique and random are completely different. If you had a universal counter (like taking a number at a deli), those numbers are unique, but completely predictable.

As Bochu notes above, Raymond's post here talks about it:
<a href="https://blogs.msdn.microsoft.com/oldnewthing/20120523-00/?p=7553/" rel="nofollow noreferrer">https://blogs.msdn.microsoft.com/oldnewthing/20120523-00/?p=7553/</a>

<blockquote>
 The GUID generation algorithm was designed for uniqueness. It was not designed for randomness or for unpredictability. Indeed, if you look at an earlier discussion, you can see that so-called Algorithm 1 is non-random and totally predictable.
 ...
 Even the Version 4 GUID algorithm (which basically says "set the version to 4 and fill everything else with random or pseudo-random numbers") is not guaranteed to be unpredictable, because the algorithm does not specify the quality of the random number generator. 
</blockquote>

For secure random numbers, you need a crytographically secure random number generator.

By the way, "rolling my own login system" is a security red flag -- I would be remiss if I didn't point that out.

blocks|key|3345743|text|根据定义，GUID在所有方面都是唯一的。曾几何时，有一些生成顺序GUID的GUID0生成例程，但是在...Win98，我想，并且被微软热修复了。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3345744|您应该能够相信生成的GUID是唯一的，并且永远不会重复或重新生成。|3345745|(编辑:话虽如此，我们都知道，如果字符串的长度是固定的，则字母数字字符串具有固定数量的排列。但在GUID的情况下，排列的数量是经济的。)|3345746|(*见鬼，XKCD在哪里提出的“天文”数字还不够大？)|3345747|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

GUIDs are, by definition, unique in all regards. There were, once upon a time, some GUID0-generation routines that were generating sequential GUIDs, but those were problems in... Win98, I think, and were hotfixed by Microsoft.

You should be able to trust a generated GUID to be unique and never repeated or regenerated.

(EDIT: Having said that, we all understand that a string of alphanumeric characters has a fixed number of permutations, if the string is fixed in length. But in the case of a GUID the number of permutations is economical*.)

(* Dammit, where's that XKCD where the proposes "astronomic" numbers aren't large enough?)

I know this may sounds like a pointless question, but hear me out...

I basically want to know if I can trust the GUID to generate a value which will be unique 100% of the time and impossible to predict.

I'm basically rolling my on login system for a website and want to know if the GUID is secure enough for session cookies.

Any background on how the GUID is generated would be much appreciated in evaluating the answers.

Thanks for the links to duplicate questions, however, my question is specific to the .Net framework.

How Random is System.Guid.NewGuid()?

服务器

我知道这听起来像是个无意义的问题，但听我说完...我基本上想知道我是否可以信任GUID来生成一个值，该值在100%的时间内都是唯一的，并且无法预测。我想知道GUID对于会话cookie是否足够安全。在评估答案时，任何关于GUID是如何生成的背景知识都是非常有用的。感谢您提供重复问题的链接，不过，我的问题是针对.Net框架的。

问System.Guid.NewGuid()的随机性如何？
EN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问System.Guid.NewGuid()的随机性如何？EN

回答 8

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问System.Guid.NewGuid()的随机性如何？
EN