Is Date epoch a secure unique identifier?

Question

I'm writing a Node API and got a model for which I gotta generate a random number of 15 digits. This must be unique and should not look trivial (I can't get an autoincrement).

I really don't want to generate a number and query against Mongo database for existance checking. I would have to generate some kind of while loop based on promises that way.

I thought about simply using new Date().epoch but, is this going to be unique? could I ever get a duplicate?

Then I also thought on appending something like:

function privateKey (howMany, chars) {
    chars = chars
        || "0123456789";
    var rnd = crypto.randomBytes(howMany)
        , value = new Array(howMany)
        , len = chars.length;

    for (var i = 0; i < howMany; i++) {
        value[i] = chars[rnd[i] % len]
    };

    return parseInt(value.join(''));
}

To include a duplicity avoiding. How should I implement this?

Edit, this should be a number.

I know there's uuid and Mongo ObjectId but they're not only numbers.

epoch is the number of milliseconds since Jan 1, 1970, so if you call it twice within the same millisecond, you will get a duplicate. Other than that scenario, you won't get duplicates. Also see http://stackoverflow.com/questions/105034/create-guid-uuid-in-javascript for generating UUIDs. — Ayush, Jun 25 '15 at 19:04

score 3 · Answer 1 · answered Jun 25 '15 at 19:07

I don't think it's a good idea. One of the reasons is system time skew. Upon synchronizing time with some benchmark server you would get duplicates. In fact this can happen on the runtime every couple of hours. Some servers have serious time drift and they sync time every one in a while. Any time this happens you can get duplicates.

Jaseem Abbas · Accepted Answer · 2015-06-25T19:21:27.420

2

Why not use ObjectId?

According to the MongoDB documentation, ObjectId is a 12-byte BSON type, constructed using:

a 4-byte value representing the seconds since the Unix epoch,
a 3-byte machine identifier,
a 2-byte process id, and
a 3-byte counter, starting with a random value.

ObjectIds are small and fast to generate. MongoDB clients should add an _id field with a unique ObjectId. However, if a client does not add an _id field, mongod will add an _id field that holds an ObjectId.

Edit : You can convert ObjectId to a number of length of your choice using the below code.

var idNum = parseInt(ObjectId.valueOf(), 15);

edited Jun 25 '15 at 19:21

answered Jun 25 '15 at 19:15

Jaseem Abbas

5,028
6
48
73

By converting to a number of length n, how does that ObjectId format to numbers representation would work? Wouldn't that trim the _id with short lengths leading to duplicates? – diegoaguilar Jun 25 '15 at 23:54
And .valueOf gives `NaN` as value – diegoaguilar Jun 26 '15 at 17:37

score 1 · Answer 3 · answered Jun 25 '15 at 19:15

1

Using time for generating unique IDs is not safe. As ak. suggested it you could get duplicates due to bad synchro.

If not having a number is not critical, you should use node-uuid which is based on RFC4122 for unique ID generation.

answered Jun 25 '15 at 19:15

stephane-ruhlmann

153
6

Is Date epoch a secure unique identifier?

Edit, this should be a number.

3 Answers3