Skip to content

feat: Leverage the new math/rand/v2 ChaCha8 CSPRNG#206

Open
eacp wants to merge 4 commits intogoogle:masterfrom
eacp:randv2
Open

feat: Leverage the new math/rand/v2 ChaCha8 CSPRNG#206
eacp wants to merge 4 commits intogoogle:masterfrom
eacp:randv2

Conversation

@eacp
Copy link

@eacp eacp commented Jan 22, 2026

Background:

In Go 1.22, the package math/rand/v2 was introduced to the standard library: https://go.dev/blog/randv2 and https://go.dev/blog/chacha8rand . The new default rand.Uint64() now uses chacha8 and is cryptographically secure and thread safe.

Proposal

The UUID package can leverage the new default chacha8 secure random number generator to generate uuids way faster
and with zero allocations. The original implementation used a rand reader from the OS that made os api calls, but the new
standard can be used.

Benchmarks

Current (master)

goos: darwin
goarch: arm64
pkg: github.com/google/uuid
cpu: Apple M4
BenchmarkUUID_MarshalJSON-10       	12657015	        95.98 ns/op	      96 B/op	       2 allocs/op
BenchmarkUUID_UnmarshalJSON-10     	 3934029	       282.7 ns/op	     216 B/op	       4 allocs/op
BenchmarkParse-10                  	57056253	        21.30 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseBytes-10             	54908913	        21.16 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseBytesUnsafe-10       	56347286	        21.26 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseBytesCopy-10         	39864680	        29.59 ns/op	      48 B/op	       1 allocs/op
BenchmarkNew-10                    	 6022090	       197.7 ns/op	      16 B/op	       1 allocs/op
BenchmarkUUID_String-10            	60293174	        19.68 ns/op	      48 B/op	       1 allocs/op
BenchmarkUUID_URN-10               	59736040	        20.45 ns/op	      48 B/op	       1 allocs/op
BenchmarkParseBadLength-10         	515349265	         2.329 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseLen32Truncated-10    	196863027	         6.101 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseLen36Corrupted-10    	56335933	        21.11 ns/op	       0 B/op	       0 allocs/op
BenchmarkUUID_New-10               	 2420439	       490.8 ns/op	      16 B/op	       1 allocs/op
BenchmarkUUID_NewPooled-10         	13393417	        87.63 ns/op	       0 B/op	       0 allocs/op
BenchmarkUUIDs_Strings-10          	22099090	        53.65 ns/op	     128 B/op	       3 allocs/op
BenchmarkNewV6WithTime-10          	 8837908	       135.3 ns/op	       0 B/op	       0 allocs/op
PASS
coverage: 31.6% of statements

Using rand v2 (ChaCha8)

goos: darwin
goarch: arm64
pkg: github.com/google/uuid
cpu: Apple M4
BenchmarkUUID_MarshalJSON-10       	12710013	        94.76 ns/op	      96 B/op	       2 allocs/op
BenchmarkUUID_UnmarshalJSON-10     	 4293664	       279.2 ns/op	     216 B/op	       4 allocs/op
BenchmarkParse-10                  	55501380	        21.93 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseBytes-10             	56140239	        21.24 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseBytesUnsafe-10       	55231239	        21.78 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseBytesCopy-10         	38862096	        29.30 ns/op	      48 B/op	       1 allocs/op
BenchmarkNew-10                    	96230953	        12.45 ns/op	       0 B/op	       0 allocs/op
BenchmarkUUID_String-10            	62159926	        19.15 ns/op	      48 B/op	       1 allocs/op
BenchmarkUUID_URN-10               	59559139	        20.03 ns/op	      48 B/op	       1 allocs/op
BenchmarkParseBadLength-10         	517937542	         2.306 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseLen32Truncated-10    	196604046	         6.102 ns/op	       0 B/op	       0 allocs/op
BenchmarkParseLen36Corrupted-10    	57532687	        20.68 ns/op	       0 B/op	       0 allocs/op
BenchmarkUUID_New-10               	631763211	         1.904 ns/op	       0 B/op	       0 allocs/op
BenchmarkUUID_NewPooled-10         	624191044	         1.944 ns/op	       0 B/op	       0 allocs/op
BenchmarkUUIDs_Strings-10          	21839292	        53.39 ns/op	     128 B/op	       3 allocs/op
BenchmarkNewV6WithTime-10          	 8800072	       148.1 ns/op	       0 B/op	       0 allocs/op
PASS
coverage: 29.4% of statements
ok  	github.com/google/uuid	22.469s

Notably, New() seems to be 10x faster while still 'cryptographically secure' due to the usage of the
default methods in math/rand/v2, assuming the default rand.Uint64() is cryptographically secure. The proposal
also allows for zero allocation uuid v4 generation

@google-cla
Copy link

google-cla bot commented Jan 22, 2026

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

@eacp eacp marked this pull request as ready for review January 22, 2026 18:47
@eacp eacp requested a review from a team as a code owner January 22, 2026 18:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@eacp