Hi,
we are developing a HomeKit device which will use Software Tokens for provisioning. In the Software Token Authentication Server Specification, section 3.2.1 we as developers are required to generate a UUID which is linked to a Software Token.
It is required to enforce UUID uniqueness and also that UUIDs which have been used need to be deleted from our server.
How do we enforce UUID uniqueness? Should we just rely on the fact, that the probability of two UUIDs colliding is very small? Or should we check for collisions by comparing a new UUID with all past UUIDs that were issued? For this to be possible, we need to hold all issued UUIDs on our server.