Warning: UUIDs not unique if using a 2023 Hermes JS implementation

[cokron]

Hey folks,

we have generated close to 100.000 uuids in our react native app on our user's iOS and Android phones.

We have had a handful of UUID collisions.

As written in the README and as can be seen in the source code, react-native-uuid is using Math.random() to generate UUIDs.

The quality of the UUIDs hence depends on the quality of the implementation of Math.random().

Trying to understand why we were seeing UUID collisions, I investigated into the implementation of the Hermes JS Engine that is used by default by react native and found this:

facebook/hermes#1169

The author of this bug ticket writes:

As you can see, it uses std::random_device() as seed. It is an unsigned int and therefore there are only about 4B possible values. There is a 71% chance of a single collision if you generate 100k values using the Birthday problem formulation. So many different instances of this will go through the exact same sequence. While this is not used for security, this is also unusable for things like UUID v4 generation since there will be tons of collisions.

This has been improved in commit
facebook/hermes@34f0b2b

which was merged into Hermes on 2023-10-31.

We had been using a Hermes 0.72.4, which is older than that date. Look into ios/Podfile.lock if you want to find out which version you are using.

We have now updated to a more up to date Hermes, which will supposedly solve the issue with duplicate UUIDs.

Thank you very much, Eugene, for writing this easy to use library!

I feel it is important for people using react-native-uuid to be warned about having to update their Hermes version to avoid duplicate uuids. So, please either let this issue live for some time until most people have upgraded or add a note in the README or use an implementation other than Math.random().

[eugenehp]

Great stuff Björn, thanks for sharing. I’m aware of this design nuance. Idea was to keep this library as dependency free library. However for crypto heavy projects we use native implementation of this library that generates the random numbers using vendor’s hardware without JavaScript runtime.

…

On Wed, Oct 16, 2024 at 9:35 AM Björn Grossmann ***@***.***> wrote: Hey folks, we have generated close to 100.000 uuids in our react native app on our user's iOS and Android phones. We have had a handful of UUID collisions. As written in the README and as can be seen in the source code, react-native-uuid is using Math.random() to generate UUIDs. The quality of the UUIDs hence depends on the quality of the implementation of Math.random(). Trying to understand why we were seeing UUID collisions, I investigated into the implementation of the Hermes JS Engine that is used by default by react native and found this: facebook/hermes#1169 <facebook/hermes#1169> The author of this bug ticket writes: As you can see, it uses std::random_device() as seed. It is an unsigned int and therefore there are only about 4B possible values. There is a 71% chance of a single collision if you generate 100k values using the Birthday problem formulation <https://en.wikipedia.org/wiki/Birthday_problem#Approximations>. So many different instances of this will go through the exact same sequence. While this is not used for security, this is also unusable for things like UUID v4 generation since there will be tons of collisions. This has been improved in commit ***@***.*** <facebook/hermes@34f0b2b> which was merged into Hermes on 2023-10-31. We had been using a Hermes 0.72.4, which is older than that date. Look into ios/Podfile.lock if you want to find out which version you are using. We have now updated to a more up to date Hermes, which will supposedly solve the issue with duplicate UUIDs. Thank you very much, Eugene, for writing this easy to use library! I feel it is important for people using react-native-uuid to be warned about having to update their Hermes version to avoid duplicate uuids. So, please either let this issue live for some time until most people have upgraded *or* add a note in the README *or* use an implementation other than Math.random(). — Reply to this email directly, view it on GitHub <#36>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAOFN3YDEZJU6MSAOUCJUNDZ3ZTRDAVCNFSM6AAAAABQBPXYKCVHI2DSMVQWIX3LMV43ASLTON2WKOZSGU4TCOJRGM2TOMI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>