1

An Android app from my organization needs to assign each users an UUID(version 4) when they first launch the app, currently we're using Boost library 1.58.0 for this purpose, our Android app will use JNI to run the code below for generating UUIDv4:

boost::uuids::basic_random_generator<boost::random::lagged_fibonacci44497> generator;
generator(); //generating UUIDv4

The code worked fine for years, now we're deciding to replace it with an API in Java(UUID.randomUUID()). But we think it would be better if we can know about the uniqueness of these two ways before making the change.

My questions:

  1. Does the using of boost::random::lagged_fibonacci44497 reduce the chance of two devices using our app having the same UUID(collision)?
  2. If it is, can we know the probability of collision?
  3. Is that code better than UUID.randomUUID() in terms of uniqueness?
Peter O.
  • 32,158
  • 14
  • 82
  • 96
L.Nam
  • 173
  • 1
  • 7
  • If the documentation of a core Java library says it's using a cryptographically strong random source, as your link does say, then I would trust that it's good enough for your purposes. – Noah Jan 01 '21 at 16:23

1 Answers1

2

The documentation for java.util.randomUUID() says the UUIDs it returns are "generated using a cryptographically strong pseudo random number generator". Thus, each such UUID will be almost certainly "unique" for most purposes (at least in Android versions after 4.3; see this question).

A version 4 UUID consists of 122 randomly chosen bits, so that there are at most 2^122 UUIDs of this kind. However, no randomly chosen value of finite length is guaranteed to be unique by itself.

Roughly speaking, when version 4 UUIDs are generated at random, the chance of accidental collision becomes non-negligible only after about 2^61 UUIDs are generated, which is about 2.7 billion billion (see "Birthday problem" for a precise statement and formulas).

Peter O.
  • 32,158
  • 14
  • 82
  • 96