Slashdot Mirror
How Cloudflare Uses Lava Lamps To Encrypt the Internet (zdnet.com)
YouTuber Tom Scott was invited to visit Cloudflare's San Francisco headquarters to check out the company's wall of lava lamps. These decorative novelty items -- while neat to look at -- serve a special purpose for the internet security company. Cloudflare takes pictures and video of the lava lamps to turn them into "a stream of random, unpredictable bytes," which is used to help create the keys that encrypt the traffic that flow through Cloudflare's network. ZDNet reports: Cloudflare is a DNS service which also offers distributed denial-of-service (DDoS) attack protection, security, free SSL, encryption, and domain name services. Cloudflare is known for providing good standards of encryption, but it seems the secret is out -- this reputation is built in part on lava lamps. Roughly 10 percent of the Internet's traffic passes through Cloudflare, and as the firm deals with so much encrypted traffic, many random numbers are required. According to Nick Sullivan, Cloudfare's head of cryptography, this is where the lava lamps shine. Instead of relying on code to generate these numbers for cryptographic purposes, the lava lamps and the random lights, swirling blobs and movements are recorded and photographs are taken. The information is then fed into a data center and Linux kernels which then seed random number generators used to create keys to encrypt traffic. "Every time you take a picture with a camera there's going to be some sort of static, some sort of noise," Sullivan said. "So it's not only just where the bubbles are flowing through the lava lamp; it is the state of the air, the ambient light -- every tiny change impacts the stream of data." Cloudflare also reportedly uses a "chaotic pendulum" in its London office to generate randomness, and in Singapore, they use a radioactive source.
https://en.wikipedia.org/wiki/... Lavarand was a hardware random number generator designed by Silicon Graphics that worked by taking pictures of the patterns made by the floating material in lava lamps, extracting random data from the pictures, and using the result to seed a pseudorandom number generator.[1] Although the secondary part of the random number generation uses a pseudorandom number generator, the full process essentially qualifies as a "true" random number generator due to the random seed that is used. However, its applicability is limited by its low bandwidth.
I mean there is plenty of those off the shelf ?
The universe is full of randomness that's hard to predict. The triumph of digital electronics is that they eliminate the randomness almost completely when abstracted up from electron/hole pairs in semiconductors to the realm of bits and bytes. That means you can't get randomness out of it, no matter how theoretically secure your algorithm--you need to go back to the messiness of physical space for that. Well done.
Have you ever watched a lava lamp for a while? Especially one that's been around for a while? They're incredibly deterministic.
I would think this would be a better source: http://random.irb.hr/
I'm not saying it's a bad idea, but Cloudflare must need a lot. How many bps of entropy can you get per lava lamp?
"Believe me!" -- Donald Trump
Pop Rocks based encryption!
Lava lamps are giant blobs of cohesive good. Unpredictable as they are, their entropy is pretty low.
We had an old slashdotter on here a few years ago who made specialised RNG generating cards. They used unpredicatable random static noise and filters to generate extremely high quality random data. Apparently their cards were so good, they discovered flaws in some kind of "Die Hard" suite of statistical tests. I think the cards retailed for ~$30 IIRC.
That's nerdery. That's going the distance. Using lava lamps? That's hipster shit. Pseudo-nerdery. Someone who, for whatever direction their lives have taken them, thinks they're a nerd, but really they're at best a geek who can follow a cookbook. And most of the internet won't be able to tell the difference.
The real nerds don't get stories written about them anymore.
Is the lava lamp really the source of most of the randomness, or is it kind of a gimmick that people can say and understand? I mean, cmon, the noise in the camera itself is probably already enough, right? They're taking the Nth decimal place of some characteristic of the entire image -- the lava really isn't that important, is it?
Lavarand is the subject of this patent and I wonder if CloudFlare has a license? Insert comments on the frivolity of the patent and of the patent system below.
I suspect that the noise of the camera sensor contributes as much randomness as the lava lamp. And it's thermal or quantum noise, so probably a good random source.
Bruce Perens.
The universe is full of randomness that's hard to predict. The triumph of digital electronics is that they eliminate the randomness almost completely when abstracted up from electron/hole pairs in semiconductors to the realm of bits and bytes. That means you can't get randomness out of it, no matter how theoretically secure your algorithm--you need to go back to the messiness of physical space for that. Well done.
That's what metastability is for. It's how the entropy source in your CPU works and it's a heck of a lot more efficient and fast than a bunch of lava lamps.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
There is a huge amount of randomness in semiconductor noise. The number of idiots on the planet is also a randomly increasing number.
http://dilbert.com/strip/2001-...
#DeleteFacebook
Can I come stand on it?
Just have me hit a golf ball off the tee - there's no way you can predict where that sucker's gonna land.
#DeleteChrome
it's a heck of a lot more efficient and fast than a bunch of lava lamps.
I made my lava lamp RNG much more efficient by installing LED bulbs in the lamps.
It's also much faster now. No matter how fast I read out bits, I get the same results.
As the OP I was speaking of the one you just plug in, which are either on a board and/or an USB. They are hardware number generator, and certified so, where as the lava lamp trick is not, and you would have no guarantee your own algorithm did not have an error making the end number LESS random than a hardware certified random number generator. That is the type of solution which is good maybe for a hobbyist, but for a cloud center... ? I have to question why this is used as solution.
And as the Wikipedia article states later, this technology dates to 1997, and includes a link to the patent from 1998. So this is not news.
See subject.
Like from Caesium atoms?
It's older than /.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
The lava lamp can’t be backdoored like that hardware can.
But the camera software can, and the image processing software can, etc.
... Apple's Lavarand wall would have both color and IR cameras. ;-)
Are the cameras visible color spectrum or IR? The former could be spoofed with a photo, no need to backdoor the software.
FWIW
Just put a camera in the room.
They probably would have gotten as good randomness just from putting the cameras in a dark room and using the analog noise in the camera sensors.
On the internet, nobody knows you're a lava lamp.
And as the Wikipedia article states later, this technology dates to 1997, and includes a link to the patent from 1998. So this is not news.
Fine, modernize the system. Replace the incandescent light bulb with a GPU mining cryptocurrency. :-)
Makes you wonder if it could detect someone breaking into a video line.
https://www.amazon.com/Million...
Random == An unrecognised pattern
Power failure!
Seed = 00000000000000000000000000000000000000000000000000000
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
In one scene, you see an open panel beneath the Communications Officer's station, and sure enough there is a lava lamp there. Freeze frame and you can see the mounting plate where it says "Crypto Source". OK, I made that up. But it's not as stupid as the starship being teleported by interfacing a crewman's DNA with mushroom spores that connect to the infinite mushverse reality plane. And based on what the writers are obviously smoking, both the spore drive and the lava lamp are at least internally consistent technology and practices.
uses atmospheric noise and has a great set of pages explaining it all, and statistics
If I were a cryptographer, I think I would literally jerk off at the idea of predicting future states of lava lamps to crack a large % of the world's encryption.
I trust the lava lamps to be random more than I trust the CPU.
my opportunity to freely express myself with the potential persecution and hangings and such
Then your trust is misplaced and foolish. You are trusting the CPU to take in all that data and analyze it and extract random data, but you won't trust it to do something they have had in hardware for ages. Serious derp levels going on with this lava lamp nonsense.
If you're going to encrypt lots and lots of connections, you still need quite a lot of random data. Predictable "random" sources are useful enough that the NSA tried and managed to sneak one into a NIST standard. So at least for some people, mucking up other people's randomness sources was worth the risk of being found out. And no, while you can see that it's being all blobby, that doesn't mean you can see that it is being random at all. It looks seductively cool, is all.
So no, this is pure geekery (and not nerdery). Plus that the reporting is atrocious. No, cloudflare doesn't "encrypt the internet", they deal in (severely broken) http front-endery, that means they deal in "world-wide web", not "internet". I say their mucking around with lavalamps doesn't exonerate their transgressions, no matter how many 90s retrohip geekery points it scores.
Finally somebody whom gets it there is no such thing as objective randomness, but there is impractical knowledge just beyond human reasoning.
The former could be spoofed with a photo
No, because even a static photo will still have plenty of sensor noise. You could put the lens cap on, and it would work just as well.
Lights go out, camera goes out, all you get is black. Gimmicky as hell.
"Starfire casemod".
But everything is peecee crap these days, so you can mod all you want, it remains peecee crap. No embarrasingly parallel massively redundant array of lava lamps can change that. And cloudflare just isn't cool enough, no matter what they do. Sorry, not sorry.
They have clearly never heard of computational fluid dynamics, which can pretty accurately (probably to within 0.01%) predict the behavior of a lava lamp.
Are they licensed for US 5732138 A patent usage?
Change is certain; progress is not obligatory.
Silicon Graphics Inc (SGI) did this a long time ago.
They hosted a site called LavaRand for a while.
Basically, point a digital camera at a bunch of lava lamps, do a simple convolution and create, wait for it, a new and genuine random seed.
The essential concept is to involve both an analog process with a digital one to get better seeds.
This was created at an afternoon beer bash at SGI in the early 90's