For a long time I've used the uuid npm package for my v4 uuid needs. It seems in recent versions of node they have introduced a built-in crypto module with the method randomUUID.

Some benchmarks have been done to show crypto.randomUUID is much faster than uuid.v4 (roughly 3x +).

However I can't find any information about how the implementations differ (if at all) in terms of how they choose random numbers for their output UUID. Is one likely to be using a more secure RNG?

UUID Node Module

Node.js Docs for crypto.randomUUID

  • 1
    $\begingroup$ They both implement the same RFC. $\endgroup$
    – tur11ng
    Nov 9, 2021 at 8:26
  • 1
    $\begingroup$ This is so implementation-specific, and with little crypto (there's no key, and indistinguishability from random is not the meat of the question) that it's seems off-topic. What about asking it on security-SE or SO instead? $\endgroup$
    – fgrieu
    Nov 9, 2021 at 9:09
  • $\begingroup$ This is implementation specific for sure. The heart of my question is meant to be which implementation provides the best indistinguishability from random. $\endgroup$ Nov 9, 2021 at 10:05
  • $\begingroup$ Even "random" UUIDs are distinguishable from random bytes, by design. But both should have essentially identical entropy for those parts of the UUID which are randomly chosen, when in random UUID mode (instead of time-based or one other modes specified in the RFC). $\endgroup$ Nov 9, 2021 at 14:48
  • 1
    $\begingroup$ The 3x difference in speed unfortunately doesn't tell you anything. A less secure random number generator is generally much faster than 3x the speed. The difference is probably due to implementation differences or how the randoms are retrieved (e.g. byte-by-byte or word-to-word). This post seems to go a bit deeper into the differences. $\endgroup$
    – Maarten Bodewes
    Nov 9, 2021 at 21:31


Browse other questions tagged or ask your own question.