Rand:bytes/1 vs crypto:strong_rand_bytes/1 for UUIDs

Your Libraries & OS Mentoring Seeking Feedback
, , , , ,
1

I’m working on a UUID/TypeID library for Erlang and am wondering what peoples opinions are on rand:bytes/1 vs crypto:strong_rand_bytes/?

Do you prefer one over the other? Which should be the default? Would like to have an option to select it or is it better to just have a proper hard-coded default and let people roll their own if they really need speed/security? What tradeoffs exist regarding collision risk or security considerations (which of course depends very much on the use case)?

2 Likes
2

I’m generally a fan of “secure by default.” crypto:strong_rand_bytes/1 should be fast enough for most uses, and it’s about as safe as you can get with regards to collision risk, predictability, etc. If it it’s too slow the affected users will notice and raise an issue, at which point you can add a knob for tuning speed/security.

3 Likes