System.Guid.NewGuid() 的随机性如何？
我知道这听起来像是一个毫无意义的问题，但听我说……
我基本上想知道我是否可以信任 GUID 生成一个 100% 时间唯一且无法预测的值。
我基本上正在滚动网站的登录系统，并想知道 GUID 对于会话 cookie 是否足够安全。
在评估答案时，我们将非常感谢有关如何生成 GUID 的任何背景知识。
感谢您提供重复问题的链接，但是，我的问题特定于 .Net 框架。
I know this may sounds like a pointless question, but hear me out...
I basically want to know if I can trust the GUID to generate a value which will be unique 100% of the time and impossible to predict.
I'm basically rolling my on login system for a website and want to know if the GUID is secure enough for session cookies.
Any background on how the GUID is generated would be much appreciated in evaluating the answers.
Thanks for the links to duplicate questions, however, my question is specific to the .Net framework.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（8）
这是 Raymond Chen 的精彩分析
Here's an excellent breakdown by Raymond Chen
没有任何固定长度值可以保证 100% 唯一（只需调用它足够多的次数，给出或采用宇宙结尾;-p） - 但它可能非常非常不可能重复。
No fixed-length value can ever guarantee to be 100% unique (just call it enough times, give or take the universe ending ;-p) - but it can be very, very, very unlikely to duplicate.
我无法谈论连续数字的可预测性，但它将是独一无二的。 不过，我认为您最好使用 System.Security.Cryptography 中的随机数生成器。 将一个随机数与单调递增的值（时间）联系起来以生成您的唯一密钥，您可以确定它是唯一的且不可预测。
I can't speak to the predictability of sequential numbers but it will be unique. I think you'd be better off using a random number generator from System.Security.Cryptography, though. Tie a random number with a monotonically increasing value (time) to generate your unique key and you can be sure that it is unique and not predictable.
System.Guid.NewGuid() 的文档不保证随机性，因此虽然当前的实现基于随机数生成器（它是算法的版本 4，是在使用 MAC 的版本 1 出现隐私问题后设计的）地址；其他系统（例如 Apple 的 OS X）仍然使用该算法的版本 1）。
因此，虽然 System.Guid.NewGuid() 生成唯一值的可能性非常高，但您不能对其可预测性做出任何假设，因为文档中没有指定这一点。
The documentation for System.Guid.NewGuid() makes no guarantees for randomness, so while the current implementation is based on a random number generator (it's version 4 of the algorithm, which was devised after privacy concerns arose from version 1 which used the MAC address; other system's like Apple's OS X still use version 1 of the algorithm).
So while you have a very high probabilty of System.Guid.NewGuid() generating a unique value, you can't make any assumptions about its predictability because that's not specified by the documentation.
简短的回答：一点也不。 需要注意的是，唯一和随机是完全不同的。 如果您有一个通用计数器（例如在熟食店取号），这些数字是唯一的，但完全可以预测。
正如 Bochu 上面指出的，Raymond 的帖子对此进行了讨论：
https://devblogs.microsoft.com/oldnewthing/20120523-00/? p=7553
对于安全的随机数，您需要一个加密安全的随机数生成器。
顺便说一句，“滚动我自己的登录系统”是一个安全危险信号——如果我没有指出这一点，那就是我的失职。
Short answer: not at all. It's important to note that unique and random are completely different. If you had a universal counter (like taking a number at a deli), those numbers are unique, but completely predictable.
As Bochu notes above, Raymond's post here talks about it:
https://devblogs.microsoft.com/oldnewthing/20120523-00/?p=7553
For secure random numbers, you need a crytographically secure random number generator.
By the way, "rolling my own login system" is a security red flag -- I would be remiss if I didn't point that out.
假设System.Guid.NewGuid使用CoCreateGuid，它根本不是随机的。 从历史上看，用于创建 guid 的算法是合并网络适配器的 MAC 地址以及时间等其他信息。 我不确定算法是否已经改变。 虽然它肯定不是随机的，但它保证是唯一的。
Assuming that System.Guid.NewGuid uses CoCreateGuid, it is not random at all. Historically, the algorithm used for creating guids was to incorporate the MAC address from a network adapter, in addition to some other things like the time. I'm not sure if the algorithm has changed. While it certainly is not random, it is guaranteed to be unique.
我不知道 .NET，但是 UUID 算法 的定义相当精确。
编辑：如果您查看相应的位（请参阅维基百科条目），那应该可以解释正在使用哪个版本的 UUID。
编辑2：您使用“安全”一词的危险信号，它告诉我您最好使用定义明确的加密方法。 例如，当在服务器上生成会话 ID 时，为什么不做一些简单的事情，例如将 MD5 哈希应用于以下适当子集的串联：{客户端计算机 IP 地址、顺序递增的计数器、您选择的固定秘密常量、您选择的随机数生成器的输出等}？
I dunno about .NET, but the UUID algorithm is defined fairly precisely.
edit: if you look at the appropriate bits (see wikipedia entry), that should explain which version of UUID is being used.
edit 2: a red flag for your use of the word "secure", which tells me you're better off using a well-defined cryptographic method. For example, when generating session IDs on a server, why just not do something simple like apply an MD5 hash to the concatenation of an appropriate subset of the following: {client machine IP address, sequentially incremented counter, fixed secret constant of your choice, output from random number generator of your choice, etc.} ?
根据定义，GUID 在所有方面都是唯一的。 曾几何时，有一些 GUID0 生成例程可以生成连续的 GUID，但我认为这些都是 Win98 中的问题，并且已被 Microsoft 修复。
您应该能够相信生成的 GUID 是唯一的并且不会重复或重新生成。
（编辑：话虽如此，我们都知道，如果字符串长度固定，则字母数字字符的字符串具有固定数量的排列。但在 GUID 的情况下，排列的数量是经济的*。）
（*该死的，提议的“天文”数字不够大的 XKCD 在哪里？）
GUIDs are, by definition, unique in all regards. There were, once upon a time, some GUID0-generation routines that were generating sequential GUIDs, but those were problems in... Win98, I think, and were hotfixed by Microsoft.
You should be able to trust a generated GUID to be unique and never repeated or regenerated.
(EDIT: Having said that, we all understand that a string of alphanumeric characters has a fixed number of permutations, if the string is fixed in length. But in the case of a GUID the number of permutations is economical*.)
(* Dammit, where's that XKCD where the proposes "astronomic" numbers aren't large enough?)