UUID Version 3 (MD5 Name-Based)

UUID Version 3 is the MD5-based counterpart to UUID v5. Like v5, it takes a namespace UUID and a name string as input and always produces the same UUID for the same inputs. The only difference is the hash function: v3 uses MD5 (128-bit output), while v5 uses SHA-1 (160-bit output).

Algorithm:

1. Concatenate the 16 bytes of the namespace UUID with the UTF-8 bytes of the name
2. Compute the MD5 hash (16 bytes output)
3. Set version bits (bits 48-51) to 0011 (3)
4. Set variant bits (bits 64-65) to 10

Because MD5 produces exactly 128 bits and a UUID is 128 bits, the hash output maps directly to the UUID with only 6 bits overwritten (4 version + 2 variant). This means 122 bits of the MD5 hash are preserved. For v5, the SHA-1 output is 160 bits, so 32 bits are discarded before the 6-bit overwrite, giving v5 slightly better distribution properties across the 122 usable bits.

Should you use v3 or v5? RFC 9562 explicitly states: "If backward compatibility is not an issue, SHA-1 is preferred." In practice, choose v5 for new projects. Use v3 only when you must remain compatible with a system that already generates v3 UUIDs. Changing from v3 to v5 for the same namespace+name will produce a different UUID, which can break existing references.

MD5 weakness context: MD5 is considered cryptographically broken for collision resistance (two different inputs can be crafted to produce the same hash). However, for UUID v3, this weakness is largely theoretical. An attacker would need to find a collision specifically within the namespace+name concatenation format, and UUIDs are not used for security verification. That said, v5 eliminates even this theoretical concern.

Code example:

import uuid
id = uuid.uuid3(uuid.NAMESPACE_DNS, "example.com")
# 9073926b-929f-31c2-abc9-fad77ae3e8eb

import java.util.UUID;
UUID id = UUID.nameUUIDFromBytes("example.com".getBytes());
// Note: Java's nameUUIDFromBytes uses MD5 (v3), no namespace

Interesting detail: Java's UUID.nameUUIDFromBytes() method only generates v3 UUIDs and does not accept a namespace parameter. To generate v5 UUIDs in Java, you need a third-party library or a custom implementation.