Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Fast cryptographically safe GUID generator for Go

github.com

Post reply on HN
Print view View original

11–20 of 43 posts

Re: Fast cryptographically safe GUID generator for Go

#11

Post by sa46 »

amluto wrote: post #4

On an extremely quick review: - This uses global state under the hood. Surprise! Is it thread safe? I’m not a Go expert, but it looks non-thread-safe. - The copying code reminds me of old-school awful C buffer handling code. Maybe it’s right. Maybe it’s wrong. But it’s not obviously right. - The actual meat is a cryptographic randomness cache. This is a subtle thing, and all the best practices are missing. Where’s th…

> This uses global state under the hood.

Looks safe to me. It uses `crypto/rand.Read` which is declared as safe for concurrent use. The cache is accessed via sync.Pool which is thread safe. As a check, I ran the tests with `-race` and it passed.

Re: Fast cryptographically safe GUID generator for Go

#12

Post by maxmcd »

sdrapkin wrote: post #5
throwaway894345 wrote: post #3

Earlier quoted context omitted.

Why is it so much faster than `uuid`?

It generates entropy 4kb-at-a-time (instead of on each call), and uses a cache-pool instead of single cache behind a lock (which is what standard uuid does in "RandPool=ON" mode).

Ah cool, the note here is also interesting: https://pkg.go.dev/github.com/google/uuid#EnableRandPool

Re: Fast cryptographically safe GUID generator for Go

#13

Post by sdrapkin »

deathanatos wrote: post #7

These aren't GUIDs[1]. If it isn't meant to follow the RFC, … just find a new word. (There are plenty of alternate schemes out there, too.) [1]: https://www.rfc-editor.org/rfc/rfc9562.html

IMHO "Guid" is just as well known (Wikipedia agrees: https://en.wikipedia.org/wiki/Universally_unique_identifier), and "UUID" was already taken by Google.

Re: Fast cryptographically safe GUID generator for Go

#16

Post by majewsky »

sdrapkin wrote: post #13
deathanatos wrote: post #7

These aren't GUIDs[1]. If it isn't meant to follow the RFC, … just find a new word. (There are plenty of alternate schemes out there, too.) [1]: https://www.rfc-editor.org/rfc/rfc9562.html

IMHO "Guid" is just as well known (Wikipedia agrees: https://en.wikipedia.org/wiki/Universally_unique_identifier ), and "UUID" was already taken by Google.

> "UUID" was already taken by Google

Your link also says that the term UUID predates the founding of Google by over a decade.

Re: Fast cryptographically safe GUID generator for Go

#17

Post by imiric »

My understanding was that speed is not something you want in a UUID generator, since it makes it more susceptible to brute force attacks. Is this not the case?

I've been using Cuid2[1] in most of my personal projects (this Go implementation[2], actually), which is fast enough, but not "too fast". It's also secure, collision resistant, and has everything I would need from a UUID.

[1]: https://github.com/paralleldrive/cuid2

[2]: https://github.com/nrednav/cuid2

Re: Fast cryptographically safe GUID generator for Go

#18

Post by sdrapkin »

imiric wrote: post #17

My understanding was that speed is not something you want in a UUID generator, since it makes it more susceptible to brute force attacks. Is this not the case? I've been using Cuid2[1] in most of my personal projects (this Go implementation[2], actually), which is fast enough, but not "too fast". It's also secure, collision resistant, and has everything I would need from a UUID. [1]: https://github.com/paralleldrive/…

cuid2 generates variable-length strings. If you want fast cryptographically strong string generation, I recommend https://github.com/sdrapkin/randstring. It will likely be faster than cuid2.

Re: Fast cryptographically safe GUID generator for Go

#19

Post by imiric »

sdrapkin wrote: post #18
imiric wrote: post #17

My understanding was that speed is not something you want in a UUID generator, since it makes it more susceptible to brute force attacks. Is this not the case? I've been using Cuid2[1] in most of my personal projects (this Go implementation[2], actually), which is fast enough, but not "too fast". It's also secure, collision resistant, and has everything I would need from a UUID. [1]: https://github.com/paralleldrive/…

cuid2 generates variable-length strings. If you want fast cryptographically strong string generation, I recommend https://github.com/sdrapkin/randstring . It will likely be faster than cuid2.

That doesn't address what I said. Nor explains why your package is better.

Re: Fast cryptographically safe GUID generator for Go

#20

Post by danbruc »

sdrapkin wrote: post #13
deathanatos wrote: post #7

These aren't GUIDs[1]. If it isn't meant to follow the RFC, … just find a new word. (There are plenty of alternate schemes out there, too.) [1]: https://www.rfc-editor.org/rfc/rfc9562.html

IMHO "Guid" is just as well known (Wikipedia agrees: https://en.wikipedia.org/wiki/Universally_unique_identifier ), and "UUID" was already taken by Google.

I think the point is that this just generates 16 random bytes whereas UUIDs/GUIDs have structure, they at least have a variant fields indicating what kind of UUID/GUID it is. The closest thing to all random bytes would be variant 10xx, version 4 or 8.
Post reply on HN