title: Generate a valid UDID without Device
body: <p>In a communication between two devices it is a bad idea to use the UDID as secret or identifier linked to an information. Look at following situation:</p>
  
  <ol>
  <li>Alice register at bob with her UDID</li>
  <li>Alice tells bob some informations.</li>
  <li>Alice ends her communication.</li>
  </ol>
  
  <p>After a while</p>
  
  <ol>
  <li>Alice connects with bob and identify herself with her UDID</li>
  <li>Alice ask bob for the informations told before</li>
  </ol>
  
  <p>The attack vector is that a third party can randomly try UDIDs to get the information. The Attacker can narrow the UDID space if he has knowledge about how the UDID is generated.
  Several UDIDs are based on the MAC address of the Device. 
  My question is, how are UDIDs generate by Android? When I search for that I always get answers how to get the UDID of an actual device which I am not interested in. This information is for a thesis in which ich describe a workaround to that small issue, for that I need some information how insecure UDIDs are for the described issue.</p>