8000 [Uid] make UUIDv6 always return truly random nodes to prevent leaking the MAC of the host by nicolas-grekas · Pull Request #38333 · symfony/symfony · GitHub
[go: up one dir, main page]
Skip to content

[Uid] make UUIDv6 always return truly random nodes to prevent leaking the MAC of the host #38333

8000 New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Sep 29, 2020
Merged

[Uid] make UUIDv6 always return truly random nodes to prevent leaking the MAC of the host #38333

merged 1 commit into from
Sep 29, 2020

Conversation

nicolas-grekas
Copy link
Member
@nicolas-grekas nicolas-grekas commented Sep 28, 2020 •
edited
Loading
Q A
Branch? master
Bug fix? no
New feature? yes
Deprecations? no
Tickets -
License MIT
Doc PR -

As explained in http://gh.peabody.io/uuidv6/, the wording of the UUIDv1 spec suggests that using the MAC of the host is preferred to compute the "node" field of UUIDs. This is what the uuid extension does, and the reason why the 12 last chars of the UUIDv1 it generates are stable. But this is a privacy leak. There are stories in the wild about how knowing the MAC has been abused in the past.

UUIDv6 prefers putting a secure random number there.

So here is the PR to do so.

@nicolas-grekas nicolas-grekas added this to the next milestone Sep 28, 2020
@nicolas-grekas nicolas-grekas force-pushed the uuidv6 branch 2 times, most recently from 9a9604b to 77c7a3b Compare September 28, 2020 15:35
@nicolas-grekas nicolas-grekas changed the title [Uid] make UUIDv6 always return truly random node to prevent leaking the MAC of the host [Uid] make UUIDv6 always return truly random nodes to prevent leaking the MAC of the host Sep 28, 2020
@nicolas-grekas nicolas-grekas force-pushed the uuidv6 branch 3 times, most recently from 006e37b to 86f566e Compare September 29, 2020 05:49
@fabpot
Copy link
Member
fabpot commented Sep 29, 2020

Thank you @nicolas-grekas.

@fabpot fabpot mentioned this pull request Sep 29, 2020
Closed
@fabpot fabpot merged commit 3113fce into symfony:master Sep 29, 2020
@nicolas-grekas nicolas-grekas deleted the uuidv6 branch September 29, 2020 07:33
@nicolas-grekas nicolas-grekas modified the milestones: next, 5.2 Oct 5, 2020
@fabpot fabpot mentioned this pull request Oct 5, 2020
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@fabpot fabpot fabpot approved these changes

Assignees
No one assigned
Labels
Feature Status: Reviewed Uid
Projects
None yet
Milestone
5.2
Development

Successfully merging this pull request may close these issues.
3 participants
@nicolas-grekas @fabpot @carsonbot
0