Who, Who ID? UUID!

by David Wall

June 17, 2002 —

More than a few computing applications call for unique identifiers. The
Media Access Control (MAC) address that's burned into devices -- like
network interface cards (NICs) -- that connect to data networks are an
example. So are the Universally Unique Identifiers (UUIDs) that appear
in Microsoft Windows Registry entries, Universal Description, Discovery,
and Integration (UDDI) data structures, and other software applications.
The two identifiers -- UUIDs and MAC addresses -- have somewhat similar
purposes, but they're arrived at differently.

MAC addresses are allocated by a central authority, which maintains a
list of them and doles them out to network equipment manufacturers as
required. The NIC maker 3Com, for example, secures allocations of MAC
addresses that only it may use, while Intel has its own set to use.
Though mistakes in manufacturing occur and duplicate MAC addresses once
in a while make it onto the market, it's pretty much an ironclad
guarantee that MAC addresses are unique. The cost is fairly high
overhead.

A central authority, on the other hand, does not manage UUIDs. No
official organization has a master list of UUIDs and manages the task of
distributing them to software publishers. That would be pretty
ridiculous, really. A large part of the software industry's character
comes from the ability of every Tom, Dick, and Vijay to write and sell
standards-compliant software without too much hassle. So the mechanism
for deriving UUIDs is not absolutely guaranteed to spawn unique
identifiers, but it comes very, very close, and with a fraction of the
overhead associated with centrally managed systems.

Where do UUIDs come from? They come from a mathematical algorithm
defined by a standards document called ISO/IEC 11578:1996. It takes into
account a number of factors and combines them in a way that would be
very hard to duplicate. The values considered are:

* The current machine time.
* The MAC address of the local network card, if any.
* The local IP address, if any.
* A randomly generated number.

Therefore, on any network (IP or otherwise), you're practically
guaranteed to get a value different from all others on that network.

ITworld