{"action":"created","issue":{"url":"https://api.github.com/repos/nats-io/jnats/issues/12","repository_url":"https://api.github.com/repos/nats-io/jnats","labels_url":"https://api.github.com/repos/nats-io/jnats/issues/12/labels{/name}","comments_url":"https://api.github.com/repos/nats-io/jnats/issues/12/comments","events_url":"https://api.github.com/repos/nats-io/jnats/issues/12/events","html_url":"https://github.com/nats-io/jnats/issues/12","id":136943673,"number":12,"title":"NUID generated Id seems guessable","user":{"login":"sachinwalia2k8","id":2308115,"avatar_url":"https://avatars.githubusercontent.com/u/2308115?v=3","gravatar_id":"","url":"https://api.github.com/users/sachinwalia2k8","html_url":"https://github.com/sachinwalia2k8","followers_url":"https://api.github.com/users/sachinwalia2k8/followers","following_url":"https://api.github.com/users/sachinwalia2k8/following{/other_user}","gists_url":"https://api.github.com/users/sachinwalia2k8/gists{/gist_id}","starred_url":"https://api.github.com/users/sachinwalia2k8/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/sachinwalia2k8/subscriptions","organizations_url":"https://api.github.com/users/sachinwalia2k8/orgs","repos_url":"https://api.github.com/users/sachinwalia2k8/repos","events_url":"https://api.github.com/users/sachinwalia2k8/events{/privacy}","received_events_url":"https://api.github.com/users/sachinwalia2k8/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-02-27T17:23:18Z","updated_at":"2016-02-27T19:41:42Z","closed_at":null,"body":"Larry,\r\n\r\nI used one of the classes NUID from snapshot to generate UUID. As per jnats code this is how it is used. I did the same thing:\r\n\r\n`NUID.nextGlobal()\r\n`\r\nHowever when I did the same thing in all the places UUID is needed I found that generated Ids are somewhat guessable. This is the result of consecutive runs:\r\n\r\n```\r\neoy2yjf5z47ye5g32qj3p3\r\neoy2yjf5z47ye5g32qj3qn\r\neoy2yjf5z47ye5g32qj3s7\r\neoy2yjf5z47ye5g32qj3tr\r\neoy2yjf5z47ye5g32qj3vb\r\n\r\n```\r\nIf you see first 20 chars are same. If this an expected output?\r\n\r\nthanks,\r\n\r\nSachin"},"comment":{"url":"https://api.github.com/repos/nats-io/jnats/issues/comments/189711270","html_url":"https://github.com/nats-io/jnats/issues/12#issuecomment-189711270","issue_url":"https://api.github.com/repos/nats-io/jnats/issues/12","id":189711270,"user":{"login":"mcqueary","id":6993964,"avatar_url":"https://avatars.githubusercontent.com/u/6993964?v=3","gravatar_id":"","url":"https://api.github.com/users/mcqueary","html_url":"https://github.com/mcqueary","followers_url":"https://api.github.com/users/mcqueary/followers","following_url":"https://api.github.com/users/mcqueary/following{/other_user}","gists_url":"https://api.github.com/users/mcqueary/gists{/gist_id}","starred_url":"https://api.github.com/users/mcqueary/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mcqueary/subscriptions","organizations_url":"https://api.github.com/users/mcqueary/orgs","repos_url":"https://api.github.com/users/mcqueary/repos","events_url":"https://api.github.com/users/mcqueary/events{/privacy}","received_events_url":"https://api.github.com/users/mcqueary/received_events","type":"User","site_admin":false},"created_at":"2016-02-27T19:41:42Z","updated_at":"2016-02-27T19:41:42Z","body":"@sachinwalia2k8 On further thought, this functions as intended. Each NUID is a base36 string 22 characters in length, with fixed prefix of 12 characters generated from a SecureRandom using SHA1PRNG, and the last 10 characters being an incremental sequence. The increment is a (pseudo-)random number between 33 and 333, and is fixed for each instance of NUID. Considering that the generated strings are base36, and 36^2 is 1296, you will see roughly 3 (~1296/333) to 39 (~1296/33) NUID strings in a row that share the same least-significant 2 bytes.\r\n\r\nIf you have concerns about the predictability of sequential NUID strings, the solution would be to simply construct a fresh NUID instance as frequently as you deem necessary, rather than generating from the global NUID. While this will be less entropy-friendly, it will certainly be less predictable, as the entire string including its increment would change periodically."}}