How Random is System.Guid.NewGuid()?

Question

I know this may sounds like a pointless question, but hear me out...

I basically want to know if I can trust the GUID to generate a value which will be unique 100% of the time and impossible to predict.

I'm basically rolling my on login system for a website and want to know if the GUID is secure enough for session cookies.

Any background on how the GUID is generated would be much appreciated in evaluating the answers.

Thanks for the links to duplicate questions, however, my question is specific to the .Net framework.

Answer 1

The documentation for System.Guid.NewGuid() makes no guarantees for randomness, so while the current implementation is based on a random number generator (it's version 4 of the algorithm, which was devised after privacy concerns arose from version 1 which used the MAC address; other system's like Apple's OS X still use version 1 of the algorithm).

So while you have a very high probabilty of System.Guid.NewGuid() generating a unique value, you can't make any assumptions about its predictability because that's not specified by the documentation.

Answer 2

GUIDs are, by definition, unique in all regards. There were, once upon a time, some GUID0-generation routines that were generating sequential GUIDs, but those were problems in... Win98, I think, and were hotfixed by Microsoft.

You should be able to trust a generated GUID to be unique and never repeated or regenerated.

(EDIT: Having said that, we all understand that a string of alphanumeric characters has a fixed number of permutations, if the string is fixed in length. But in the case of a GUID the number of permutations is economical*.)

(* Dammit, where's that XKCD where the proposes "astronomic" numbers aren't large enough?)