RFC 9562: Universally Unique IDentifiers (UUIDs)
IETF standard defining 128-bit UUIDs, obsoleting RFC 4122 and adding versions 6, 7, and 8 for time-ordered, database-friendly, sortable identifiers with CSPRNG and privacy guidance.
Overview
RFC 9562, “Universally Unique IDentifiers (UUIDs)”, is an IETF Proposed Standard published in May 2024 by K. Davis, B. Peabody, and P. Leach. It obsoletes RFC 4122 (2005) and defines UUIDs as 128-bit (16-octet) values that guarantee uniqueness across space and time without a central registration authority. Its major contribution is standardizing three new versions, UUIDv6, UUIDv7, and UUIDv8, that add time-ordering, database-index locality, and vendor extensibility, alongside modernized guidance on randomness, privacy, and storage.
Key points
- A UUID carries a 4-bit version field (in octet 6) and a 2-3 bit variant field (in octet 8); the canonical text form is
xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx, though the underlying binary value should be stored directly. - Legacy versions carried forward: v1 (Gregorian-epoch time-based, 100-nanosecond ticks), v3 (MD5 name-based), v4 (122 random bits), and v5 (SHA-1 name-based, preferred over v3).
- UUIDv6 reorders v1’s timestamp bits for better database-index locality; UUIDv7 uses a Unix Epoch millisecond timestamp in the most significant bits, making values naturally time-ordered and sortable as opaque raw bytes. The spec recommends v7 over v1 and v6 where possible.
- UUIDv8 reserves 122 bits for implementation-defined or experimental use, fixing only the version and variant bits.
- Implementations SHOULD use a cryptographically secure pseudorandom number generator (CSPRNG), reseeding across process forks, and can add monotonic counters or sub-millisecond precision bits for high-rate generation without collisions.
- MAC addresses SHOULD NOT be embedded in UUIDs for privacy reasons; a 48-bit random node ID (with the multicast bit set) is preferred. UUIDs are opaque values and should not be treated as security capabilities or access tokens.
Relevance to Truestamp
Truestamp assigns UUIDv7 identifiers to most internal records, relying on RFC 9562’s time-ordered layout for chronologically sortable, index-friendly primary keys; the closely related ULID scheme shares the same millisecond-timestamp design goals. See ULID and UUIDv7 identifiers and the UUIDv7 glossary term for how these identifiers are used.
Citations
- RFC 9562: Universally Unique IDentifiers (UUIDs). K. Davis, B. Peabody, P. Leach; IETF, May 2024 (obsoletes RFC 4122).