Unique key generation

by

There are only 3 ways to generate unique values, rather they be passwords, user IDs, etc.:

  1. Use an effective GUID generator – these are long and cannot be shrunk. If you only use part you FAIL.
  2. At least part of the number is sequentially generated off of a single sequence. You can add fluff or encoding to make it look less sequential. Advantage is they start short – disadvantage is they require a single source. The work around for the single source limitation is to have numbered sources, so you include the [source #] + [seq #] and then each source can generate its own sequence.
  3. Generate them via some other means and then check them against the single history of previously generated values.

Any other method is not guaranteed. Keep in mind, fundamentally you are generating a binary number (it is a computer), but then you can encode it in Hexadecimal, Decimal, Base64, or a word list. Pick an encoding that fits your usage. Usually for user entered data you want some variation of Base32 (which you hinted at).

Note about GUIDS: They gain their strength of uniqueness from their length and the method used to generate them. Anything less than 128-bits is not secure. Beyond random number generation there are characteristics that go into a GUID to make it more unique. Keep in mind they are only practically unique, not completely unique. It is possible, although practically impossible to have a duplicate.

Updated Note about GUIDS: Since writing this I learned that many GUID generators use a cryptographically secure random number generator (difficult or impossible to predict the next number generated, and a not likely to repeat). There are actually 5 different UUID algorithms. Algorithm 4 is what Microsoft currently uses for the Windows GUID generation API. A GUID is Microsoft’s implementation of the UUID standard.

Update: If you want 7 to 16 characters then you need to use either method 2 or 3.

Bottom line: Frankly there is no such thing as completely unique. Even if you went with a sequential generator you would eventually run out of storage using all the atoms in the universe, thus looping back on yourself and repeating. Your only hope would be the heat death of the universe before reaching that point.

Even the best random number generator has a possibility of repeating equal to the total size of the random number you are generating. Take a quarter for example. It is a completely random bit generator, and its odds of repeating are 1 in 2.

So it all comes down to your threshold of uniqueness. You can have 100% uniqueness in 8 digits for 1,099,511,627,776 numbers by using a sequence and then base32 encoding it. Any other method that does not involve checking against a list of past numbers only has odds equal to n/1,099,511,627,776 (where n=number of previous numbers generated) of not being unique.

More Related Contents:

  1. Secure hash and salt for PHP passwords
  2. How can I store my users’ passwords safely?
  3. Two-way encryption: I need to store passwords that can be retrieved
  4. Generating a random password in php
  5. How to best store user information and user login and password
  6. encrypt and decrypt md5
  7. How to create a laravel hashed password
  8. Many hash iterations: append salt every time?
  9. Is it ever ok to store password in plain text in a php variable or php constant?
  10. a better approach than storing mysql password in plain text in config file?
  11. How Secure Is This Login System? (Using Cookies In PHP)
  12. mcrypt is deprecated, what is the alternative?
  13. Full Secure Image Upload Script
  14. What does it mean to escape a string?
  15. How to retract a salted password from the Database and auth user?
  16. PHP $_SERVER[‘HTTP_HOST’] vs. $_SERVER[‘SERVER_NAME’], am I understanding the man pages correctly?
  17. Are mysql_real_escape_string() and mysql_escape_string() sufficient for app security?
  18. how safe are PDO prepared statements
  19. How can I relax PHP’s open_basedir restriction?
  20. How to run PHP exec() as root?
  21. Hiding true database object ID in url’s
  22. CodeIgniter – why use xss_clean
  23. Codeigniter CSRF – how does it work
  24. How to get info on sent PHP curl request
  25. Regex for password PHP [duplicate]
  26. Change WooCommerce default password security level
  27. Json: PHP to JavaScript safe or not?
  28. Limiting user login attempts in PHP [duplicate]
  29. How to generate random password with PHP?
  30. What encryption algorithm is best for encrypting cookies?

Leave a Comment