Is Base64(SHA1(GUID)) still unique like the original GUID?

Question

Basically what the title is; GUIDs are unique by design. If you run the GUID through SHA1 and then Base64 the hash, will the resulting string have the same guaranteed uniqueness as the GUID, or not?

Answer 1

Base64 provides a 1:1 transform from input to output (and back again if desired). So if you take a set of unique items and base64 encode all of them they will all be unique.

So the question becomes if you run a GUID through SHA1, will the resulting hash have the same uniqueness as the GUID?

The answer is practically - yes; theoretically not quite. Multiple inputs to SHA1 map to the same output, but in reality if your GUIDs are unique then there is negligible probability that there will ever be a collision leading to loss of uniqueness.

Answer 2

GUIDs are not guaranteed to be unique. GUIDs are Microsoft's take on UUIDs. Collisions can occur, depending on which type of GUID generator is used. (Though collisions are extremely rare in all cases.)

GUIDs as they are defined have a size of 128 bits. SHA1 is a cryptographic hash function with an output size of 160 bits, larger than the GUID size, and SHA1 is a deterministic function. So to answer your question: Your resulting string has the same level of 'guaranteed uniqueness' as the input GUID has.

However, I wouldn't mix GUIDs and SHA1 that way.

• If you just want a GUID, then just use a GUID -- don't run it through SHA1.

  • If you want a GUID that doesn't leak information about the machine used to generate it, then pick a Type 4 GUID generator, which was made for this purpose.
• If you want a unique identifier which doesn't leak information, and either higher or lower probability of collisions than Type 4 GUIDs give you, then just use a cryptographically secure random number generator (CSPRNG) and generate a sufficiently large random value. (Keep the birthday paradox in mind.)

Answer 3

Assuming no cosmetics, the length of a GUID is 32 bytes so better question would be "What's the collision probability of SHA1 with 32 bytes of input?"

I'm sure someone else will answer with the exact statistics but the answer to your question is yes, it's pretty unique (an attacker has a negligible probability of success). Note that I've completely ignored Base64 because it is reversible.

Edit: This question can provide some more insight