I need a GUID. Really just any number that is likely to be unique. However I prefer not to leak time and other things as a GUID may leak. What should i use as a cryptographic replacement? I was thinking maybe i could use PBKDF2 using a GUID + salt/pepper but maybe thats overkill or not what i want?
It sounds like you want a "version 4 UUID",
as generated by the Python function
As defined in RFC 4122, version 4 UUIDs have 6 fixed bits (that indicate this is a "version 4 UUID") and 122 randomly generated bits.
(For your application, it may be simpler and therefore better to grab a full 128 random bits, and use them directly, as David Schwartz suggested).
Version 4 UUIDs are generally internally stored as a raw array of 128 bits, and typically displayed in a format something like:
where x is any (randomly chosen) hexadecimal digit and y is (randomly chosen from) one of 8, 9, a, or b.
Since the 6 fixed bits are the same for every UUID (no matter what machine created them, or what time it was created), and the remaining 122 bits are randomly generated, there is no information in a version 4 UUID that can identify what machine created it or when it was created.
The "randomly chosen" values are preferably from a cryptographically secure pseudorandom number generator, such as /dev/random, a hardware random number generator, or etc.
These "randomly chosen" values are preferably not from a "insecure" source of random numbers, such as the Python function random(), the Basic function rand(), the C stdlib function rand(), or etc.
I don't think you can do any better than the best random number you can generate.