On 19 Nov 2002, Cees de Groot wrote:

> I just posted a fix which makes UUID generation on Linux mostly the same as
> UUID generation with libuuid (random number seeded from /dev/urandom). 

Actually libuuid supports te real UUIDs too. Why not just link in libuuid?  
It's LGPL. (Ned: AFAIK it's not really part of e2fs, only RedHat
packages it this way)

> The MAC-based version doesn't really add much, because it still depends on a
> large random component. IIRC, the original spec (DCE, wasn't it?) called for:
> - Machine address (IP, but MAC would work as well)

MAC is guaranteed to be unique. But many machines have the same IP
address, for example local addresses (192.xxx 10.xx etc).

> - Process ID on machine
> - Timestamp (secs since epoch)
> - Counter (just in case you generate two UUID's in the same second).
> That gives true UUID's. As soon as the biggest component is random, you're
> just hoping for the best (granted, good enough for most cases) and I don't
> think it really matters whether you throw in a MAC for good measure.

You can get the same random number on two machines. It's unlikely, but 
possible. Throwing in MAC solves this easily.

The MAC+Time+PID+Counter+Random strategy is just very robust with some
safety-nets thrown in. Even /dev/random can be buggy (or maliciously
manipulated), right?

-- Bert