Security wise how do i use GUID properly?

Question

I read an answer about guid and it was fairly interesting. It seems that GUID is based on time and v1 uses a MAC address with v4 using a RNG.

From the wiki

Cryptanalysis of the WinAPI GUID generator shows that, since the sequence of V4 GUIDs is pseudo-random; given full knowledge of the internal state, it is possible to predict previous and subsequent values.

Do i need to worry about this? say when generating cookie data for users? or password reset keys?

My question is how do i use GUID properly and how do i prevent creating the same GUID (say via two threads on same machine created during same millisecond) and how do i use it in a way it wont reveal previous keys. I switch from using async RNG to sync RNG (locking between threads) to GUID and now i think there may be a problem with this.

Answer 1

The answer is to use the random number based GUI.

The eaerlier schemes are effectly broken. Increases in processer speed you can now generate several hunded GUIDs based on the same millsecond tick. Virtualisation means you could be sharing the same MAC address with several insances of the OS. The rise of multiprocessor machines means two processes can be generating GUIDs on the same machine in the same clock tick.

While its still possible to generate duplicates using the random number based scheme the odds are about the same as winning the lottery on a particular planet in another galaxy.

Answer 2

You don't need to worry about this.

You will not generate duplicate Guids with .Net.

If it was possible you would here complaints all over the place. All around the world people are churning out new Guids in .Net at unfathomable rates, speeds that you or I will never approach, and none of them have generated duplicates.

No need to worry about threading either. The Guid.NewGuid() call is guaranteed to be thread safe. Multi-core won't make a difference. Generate them as fast as you can on the fastest server you can find and you still won't have a problem.

Seriously, its just not something to worry about.