38

I want to create a cryptographically secure GUID (v4) in .NET.

.NET's Guid.NewGuid() function is not cryptographically secure, but .NET does provide the System.Security.Cryptography.RNGCryptoServiceProvider class.

I would like to be able to pass a random number function as a delegate to Guid.NewGuid (or even pass some class that provides a generator interface) but it doesn't look as though that is possible with the default implementation.

Can I create a cryptographically secure GUID by using System.GUID and System.Security.Cryptography.RNGCryptoServiceProvider together?

1
  • 2
    On Windows 10 at least, .NET NewGuid uses Ole32.CoCreateGuid wich uses Rpcrt4.UuidCreate which uses BCryptPrimitives.ProcessPrng (download.microsoft.com/download/1/c/9/…). So I think with recent versions of Windows, Guid.NewGuid does create cryptographically secure GUIDs. Jan 18, 2020 at 10:01

6 Answers 6

58

Yes you can, Guid allows you to create a Guid using a byte array, and RNGCryptoServiceProvider can generate a random byte array, so you can use the output to feed a new Guid:

public Guid CreateCryptographicallySecureGuid() 
{
    using (var provider = new RNGCryptoServiceProvider()) 
    {
        var bytes = new byte[16];
        provider.GetBytes(bytes);

        return new Guid(bytes);
    }
}
12
  • 2
    Wait, is it really this simple? I thought that there was a GUID standard - don't the first few bytes define the version used, while the last few bytes define something else? I thought there was more to a GUID than random bytes, hence the question.
    – user677526
    May 11, 2016 at 18:30
  • 2
    There is a difference between a cryptographically secure GUID and an standarized Guid, if you want the Guid to avoid collision then use the Guid.NewGuid, else use this. Any standarized Guid will not be cryptographically secure as there are rules to generate them as you correctly said, then it's strength would be very low (if you know how 8 of the 16 bytes are generated, you only need to bruteforce these 8 bytes...)
    – Gusman
    May 11, 2016 at 18:32
  • 1
    Well, rules of collision are to avoid collision between machines if I recall it right, it think there are a lot less of chances to have a collision between these guids on the same machine than standarized guids, the chance to get a duplicate is one between 2^128, so it's more probable that our sun explodes on our faces than get a collision XD
    – Gusman
    May 11, 2016 at 18:45
  • 3
    @Gusman For what it's worth, RNGCryptoServiceProvider implements IDisposable, so it should be wrapped in a using statement or a try/finally. Future readers who stumble upon this question may find that useful.
    – user677526
    May 11, 2016 at 20:16
  • 1
    Related article for cross platform considerations with .net core. stackoverflow.com/a/38644970/494635 Apr 5, 2018 at 5:19
17

Read Brad M's answer below: https://stackoverflow.com/a/54132397/113535

If anyone is interested here is the above sample code adjusted for .NET Core 1.0 (DNX)

public Guid CreateCryptographicallySecureGuid()
{
    using (var provider = System.Security.Cryptography.RandomNumberGenerator.Create())
    {
        var bytes = new byte[16];
        provider.GetBytes(bytes);

        return new Guid(bytes);
    }
}
12

https://www.rfc-editor.org/rfc/rfc4122 says there are a few bits that should be fixed in order to indicate that this GUID is a version-4 (random) one. Here is the code altered to set/unset these bits.

public Guid CreateCryptographicallySecureGuid()
{
    using (var provider = new RNGCryptoServiceProvider())
    {
        var bytes = new byte[16];
        provider.GetBytes(bytes);
        bytes[8] = (byte)(bytes[8] & 0xBF | 0x80);
        bytes[7] = (byte)(bytes[7] & 0x4F | 0x40);
        return new Guid(bytes);
    }
}
6
  • And why is this important? Jun 11, 2018 at 0:58
  • 7
    If an auditor or other IT security expert looks at GUIDs generated and used for secure I'd numbers, he/she will want to know if all those numbers were the kind that is hard to guess. If you randomize the entire GUID (instead of setting the version) some of the GUIDs created will appear to be type 1 or some other insecure type even if they are not. So, setting the version to the most appropriate value will help avoid some confusion. I doubt that any code will stop working if you ignore the standard. But, it's best to comply, for clearity.
    – rlamoni
    Jun 12, 2018 at 16:50
  • 1
    @rlamoni your answer is superb, put me in the right track. However the bitwise operations you are using are a bit off. Here's my updated answer.
    – om-ha
    Dec 26, 2019 at 2:51
  • @om-ha I compared your bitwise operations to rlamoni's and websites like freecodeformat.com/validate-uuid-guid.php and beautifyconverter.com/uuid-validator.php agree with rlamoni
    – Benrobot
    Feb 14, 2020 at 17:37
  • @Benrobot Neither rlamoni nor I were correct. It's because of Endianness. I updated my answer below.
    – om-ha
    Feb 17, 2020 at 13:07
12

If you are using at least c# 7.2 and netcoreapp2.1 (or System.Memory), this is the fastest/most efficient approach.

public static Guid CreateCryptographicallySecureGuid()
{
    Span<byte> bytes = stackalloc byte[16];
    RandomNumberGenerator.Fill(bytes);
    return new Guid(bytes);
}

I created a benchmark comparing this to the accepted answer. I modified it to use a static implementation of RandomNumberGenerator since GetBytes() is thread safe. (although the only guarantee I see is that RNGCryptoServiceProvider has a thread safe implementation...it's possible other implementations do not)

[MemoryDiagnoser]
public class Test
{
    private static readonly RandomNumberGenerator _rng = RandomNumberGenerator.Create();

    [Benchmark]
    public void Heap()
    {
        var bytes = new byte[16];
        _rng.GetBytes(bytes);
        new Guid(bytes);
    }

    [Benchmark]
    public void Fill()
    {
        Span<byte> bytes = stackalloc byte[16];
        RandomNumberGenerator.Fill(bytes);
        new Guid(bytes);
    }
}
| Method |     Mean |     Error |    StdDev | Gen 0/1k Op | Gen 1/1k Op | Gen 2/1k Op | Allocated Memory/Op |
|------- |---------:|----------:|----------:|------------:|------------:|------------:|--------------------:|
|   Heap | 129.4 ns | 0.3074 ns | 0.2725 ns |      0.0093 |           - |           - |                40 B |
|   Fill | 116.5 ns | 0.3440 ns | 0.2872 ns |           - |           - |           - |                   - |
11

2020 Modified Version

I found @rlamoni's answer to be great. Just needs a little bit modifications in its bitwise operations to correctly reflect GUID version 4 identifying bits, to account for both Big Endian and Little Endian architectures.

To be more specific about the corrections in my answer:

  1. The modified bytes should be 7th and 9th.
  2. The bitwise-and operands have been corrected.

Update

As the user Benrobot pointed out, Guid was invalid. I suppose because of his device Endianness being different to mine.

This prompted me to further enhance my answer. In addition to the two corrections I pointed out above in my original answer, here are few more enhancements of my answer:

  1. Accounted for Endianness of the current computer architecture.
  2. Added self-explanatory constant & variable identifiers instead of constant literals.
  3. Used simple using statement that doesn't require braces.
  4. Added some comments and required using directive.
using System;
using System.Security.Cryptography;

/// Generates a cryptographically secure random Guid.
///
/// Characteristics
///     - Variant: RFC 4122
///     - Version: 4
/// RFC
///     https://www.rfc-editor.org/rfc/rfc4122#section-4.1.3
/// Stackoverflow
///     https://stackoverflow.com/a/59437504/10830091
static Guid CreateCryptographicallySecureRandomRFC4122Guid()
{
    using var cryptoProvider = new RNGCryptoServiceProvider();

    // byte indices
    int versionByteIndex = BitConverter.IsLittleEndian ? 7 : 6;
    const int variantByteIndex = 8;

    // version mask & shift for `Version 4`
    const int versionMask = 0x0F;
    const int versionShift = 0x40;

    // variant mask & shift for `RFC 4122`
    const int variantMask = 0x3F;
    const int variantShift = 0x80;
            
    // get bytes of cryptographically-strong random values
    var bytes = new byte[16];
    cryptoProvider.GetBytes(bytes);

    // Set version bits -- 6th or 7th byte according to Endianness, big or little Endian respectively
    bytes[versionByteIndex] = (byte)(bytes[versionByteIndex] & versionMask | versionShift);

    // Set variant bits -- 9th byte
    bytes[variantByteIndex] = (byte)(bytes[variantByteIndex] & variantMask | variantShift);

    // Initialize Guid from the modified random bytes
    return new Guid(bytes);
}

Online validators

To check for the validity of the generated GUID:

References

8
  • @Benrobot Guid was invalid because of version bits Endianness. Edited my answer accordingly. Checked the GUID with the online validators and it checks out. Let me know of the results on your end.
    – om-ha
    Feb 17, 2020 at 13:00
  • 1
    I can't believe my endianness has been brought into question :). Yes, your updated answer does work for me as well. Thank you for the update.
    – Benrobot
    Feb 17, 2020 at 20:59
  • Glad it worked out for you! This has been an interesting learning experience. Thanks for pointing out there's an invalid GUID case. Most users take what's there without criticizing it.
    – om-ha
    Feb 17, 2020 at 22:30
  • Are GUIDs generated this way guaranteed to be unique? i.e. if two separate servers generate GUIDs can they NEVER be the same, as per regular GUIDs?
    – A X
    Nov 24, 2022 at 21:23
  • @AX valid question, it's very rare to have GUID collision, around 1 in 10^38. Check answers here: stackoverflow.com/questions/184869/are-guid-collisions-possible GUID v1 guarantees randomness. However GUID v4 (this answer) guarantees randomness and unpredictability.
    – om-ha
    Nov 25, 2022 at 11:41
6

The answer from om-ha is terrific. But I wanted to optimize it for .NET 5.0, which doesn't require the RNG crypto provider. My modified version for .NET 5.0 is below:

using System;
using System.Security.Cryptography;

/// Generates a cryptographically secure random Guid.
///
/// Characteristics
///     - GUID Variant: RFC 4122
///     - GUID Version: 4
///     - .NET 5
/// RFC
///     https://tools.ietf.org/html/rfc4122#section-4.1.3
/// Stackoverflow
///     https://stackoverflow.com/a/59437504/10830091
static Guid CreateCryptographicallySecureRandomRFC4122Guid()
{
    // Byte indices
    int versionByteIndex = BitConverter.IsLittleEndian ? 7 : 6;
    const int variantByteIndex = 8;

    // Version mask & shift for `Version 4`
    const int versionMask = 0x0F;
    const int versionShift = 0x40;

    // Variant mask & shift for `RFC 4122`
    const int variantMask = 0x3F;
    const int variantShift = 0x80;

    // Get bytes of cryptographically-strong random values
    var bytes = new byte[16];

    RandomNumberGenerator.Fill(bytes);

    // Set version bits -- 6th or 7th byte according to Endianness, big or little Endian respectively
    bytes[versionByteIndex] = (byte)(bytes[versionByteIndex] & versionMask | versionShift);

    // Set variant bits -- 8th byte
    bytes[variantByteIndex] = (byte)(bytes[variantByteIndex] & variantMask | variantShift);

    // Initialize Guid from the modified random bytes
    return new Guid(bytes);
}

Edit here uses RandomNumberGenerator (Docs), Fill method does the following:

Fills a span with cryptographically strong random bytes

1
  • Thanks for the improvement to my answer!
    – om-ha
    Aug 14, 2021 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.