Algorithm

In the OSF-specified algorithm for generating new (V1) GUIDs,the user’s network card MAC address is used as a base for the last group of GUID digits,which means,for example,that a document can be tracked back to the computer that created it. This privacy hole was used when locating the creator of the Melissa worm[2]. Most of the other digits are based on the time while generating the GUID. V1 GUIDs which contain a MAC address and time can be identified by the digit “1” in the first position of the third group of digits,for example {2f1e4fc0-81fd-11da-9156-00036a0f876a}. V4 GUIDs use the later algorithm,which is a pseudo-random number. These have a “4” in the same position,for example {38a52be4-9352-453e-af97-5c3b448652f0}. More specifically,the ‘data3’ bit pattern would be 0001xxxxxxxxxxxx in the first case,and 0100xxxxxxxxxxxx in the second. Cryptanalysis of the WinAPI GUID generator shows that,since the sequence of V4 GUIDs is pseudo-random; given full knowledge of the internal state,it is possible to predict prevIoUs and subsequent values