Subject: [saag] Security of Type-4 UUIDs (RFC 4122)

From: Nightwatch Cybersecurity <[email-masked]>
Date: Thu, 15 Mar 2018 15:36:48 -0400

Hi,

RFC 4122, section 6 states as follows:

>> Do not assume that UUIDs are hard to guess; they should not be used
>> as security capabilities (identifiers whose mere possession grants
>> access), for example.  A predictable random number source will
>> exacerbate the situation.

Is this really true for type-4 UUIDs when used with a
cryptographically-secure RNG? Would that essentially be the same as
using a large random number (122 bits)?

Thanks

---

From: "Salz, Rich" <[email-masked]>
Date: Thu, 15 Mar 2018 19:41:41 +0000

That RFC is twelve years old; 122 bits is not considered a large random number any more.

---

From: Michael StJohns <[email-masked]>
Date: Thu, 15 Mar 2018 21:21:53 +0000

Besides, while you may know how you generated the UUID, never assume the
other guy did too.  Mike

On Thu, Mar 15, 2018 at 15:41 Salz, Rich <[email-masked]> wrote:

> _______________________________________________
> saag mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/saag
>

---

From: Peter Gutmann <[email-masked]>
Date: Fri, 16 Mar 2018 04:30:29 +0000

>That RFC is twelve years old; 122 bits is not considered a large random

Below is a 128-bit data block consisting of 128 bits of zeroes encrypted using
AES keyed with a not-large 122-bit random number.  Let me know when you've
recovered said not large random number, and what its value is:

  34 A9 38 5F E9 BE CE 72 4A 9D F0 A7 36 EB 93 A4

Peter.

---

From: Nightwatch Cybersecurity <[email-masked]>
Date: Fri, 16 Mar 2018 07:43:34 -0400

> That RFC is twelve years old; 122 bits is not considered a large random number any more.

There are 122 bits of entropy in a UUID used with a good RNG. The use
case would be not to use this for cryptography but for things like
session IDs and record IDs, especially in a distributed system where
record IDs may need to be generated by different systems and not run
into a collision. Current guidance from OWASP for session IDs is to
have a 128-bit identifier with 64 bits of entropy:
https://www.owasp.org/index.php/Session_Management_Cheat_Sheet#Session_ID_Properties

My question regarding RFC 4122 is as follows:
- Is the original security guidance based on the fact that UUIDs are
likely to be non-random (non-type-4 or type-4 without a good RNG)?
- Or is the original security guidance based on the fact that the 122
bit space is too small?
- What is the current guidance for such use cases like record IDs and
session IDs, especially when used for things like access tokens or API
tokens?

I do see that type-4 UUIDs are used in existing standard; some
examples are RFC 8182, RFC 6355, RFC 7047, RFC 7989, RFC 7519, etc.

Thank you

---

From: "Salz, Rich" <[email-masked]>
Date: Sat, 17 Mar 2018 00:39:31 +0000

Back then, real crypto-strong RNG's weren't widely available nor on everyone's minds.

Is it okay if the identifier is guessable?  Just use a counter. If not, use something like a DRBG seeded with good randomness. I recommend RAND_bytes in the current master branch of OpenSSL.

Don't waste bits making it look like a UUID.