Skip to content

Clarify that Guid.NewGuid is not intended to be used for security purposes #4910

@GrabYourPitchforks

Description

@GrabYourPitchforks

Ref: https://docs.microsoft.com/en-us/dotnet/api/system.guid.newguid

The Guid.NewGuid() method returns a value that is with overwhelming probability unique compared to every other GUID that has ever been generated. However, the Guid.NewGuid() method is not guaranteed to be unpredictable, nor is it guaranteed to be seeded from a strong source of entropy. That is, somebody who can observe the return value of Guid.NewGuid() might be able to predict the method's future return values.

This behavior makes Guid.NewGuid() inappropriate for callers which need to generate secret values, such as values used as passwords or as cryptographic keys. Callers who need to generate secret data should instead use RandomNumberGenerator.GetBytes.

For the technically minded: "Guid.NewGuid() is not guaranteed to use a cryptographically secure RNG."

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions