feat: Leverage the new math/rand/v2 ChaCha8 CSPRNG
#206
+64
−17
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Background:
In Go 1.22, the package
math/rand/v2was introduced to the standard library: https://go.dev/blog/randv2 and https://go.dev/blog/chacha8rand . The new defaultrand.Uint64()now uses chacha8 and is cryptographically secure and thread safe.Proposal
The UUID package can leverage the new default chacha8 secure random number generator to generate uuids way faster
and with zero allocations. The original implementation used a rand reader from the OS that made os api calls, but the new
standard can be used.
Benchmarks
Current (master)
Using rand v2 (ChaCha8)
Notably,
New()seems to be 10x faster while still 'cryptographically secure' due to the usage of thedefault methods in
math/rand/v2, assuming the defaultrand.Uint64()is cryptographically secure. The proposalalso allows for zero allocation uuid v4 generation