Rand guarantees scarcity in a finite dataset, but it doesn't guarantee uniqueness.

Let's not get hung up in the difference between the practical and the theoretical here. :-)

For the purposes stated by the OP using rand() is "good enough." Also based on my own practical use using this method to generate unique session ids for web transactions I have found that it works very well.

When using this method in my own applications I have very deliberately set up trapping logic checking to make sure that a generated session id is not already in use and if it ever happens the logic logs the incident. The log is still empty for one application I use it for and that web application was installed in August of 2001. Over two years now and no collisions. I think that works pretty darn good.

Truly random and unique ids

The one time I needed to generate truly random numbers for an application I wrote (I could tell you what it was but then I'd have to shoot you) :) I decided the best way to do it was taking a page from PGP and GNUpg and use system entropy. Stuff like watching the position of the system disk heads, being influenced by system interrupts (mouse, keyboard, etc.) and stuff like that.

You can make yourself nuts with the whole subject and folks a lot smarter than me have made their academic mark on the world writing papers on the subject and there is even a whole field science dedicated to the subject. For practical purposes you have to make a decision as to what constitutes "random enough" and code accordingly. A random ID of 128 characters is probably going to be random enough for 99% of the uses out there .

But then... we are getting way off topic here...

Also based on my own practical use using this method to generate unique session ids for web transactions I have found that it works very well.

There is a big difference between "works very well" and hasn't broken yet. Using a random number for a unique ID is akin to adding a known but rarely encountered bug. It is a terrible solution to a problem which has known good solutions.

-sauoq
"My two cents aren't worth a dime.";

There is a big difference between "works very well" and hasn't broken yet.
I agree. However "hasn't broken yet" isn't very scientific. Any "random" algorithm is broken over a sufficiently large data set. That is the basis behind Chaos Theory. Random events or data are not very random if you take a large enough data set.

It all boils down to what you consider to be acceptably "broken" and what your exposure is.

---

Peter L. Berghold -- Unix Professional Peter at Berghold dot Net
	Dog trainer, dog agility exhibitor, brewer of fine Belgian style ales. Happiness is a warm, tired, contented dog curled up at your side and a good Belgian ale in your chalice.