How deterministic Are .Net GUIDs?

后端 未结 6 1474
甜味超标
甜味超标 2021-02-04 09:14

Yesterday I asked Are GUIDs generated on Windows 2003 safe to use as session IDs? and the answer combined with combined with this article GUIDs are globally unique, but substrin

6条回答
  •  情话喂你
    2021-02-04 10:03

    Some notes:

    1. I doubt that any implementation of GUIDs was designed to be cryptograhpically secure. (And this supposition would be borne out by the article linked for the next item.)
    2. The 13th ASCII character is a signifier of what algorithm was used to generate the GUID.

    If you're really concerned with having strong session IDs, then perhaps a cryptographically secure hash of something that cannot be determined from off-machine would be your best approach. Perhaps generating a one-time pad from some internal document or data source would even work.

提交回复
热议问题