Slashdot Mirror
How Cloudflare Uses Lava Lamps To Encrypt the Internet (zdnet.com)
YouTuber Tom Scott was invited to visit Cloudflare's San Francisco headquarters to check out the company's wall of lava lamps. These decorative novelty items -- while neat to look at -- serve a special purpose for the internet security company. Cloudflare takes pictures and video of the lava lamps to turn them into "a stream of random, unpredictable bytes," which is used to help create the keys that encrypt the traffic that flow through Cloudflare's network. ZDNet reports: Cloudflare is a DNS service which also offers distributed denial-of-service (DDoS) attack protection, security, free SSL, encryption, and domain name services. Cloudflare is known for providing good standards of encryption, but it seems the secret is out -- this reputation is built in part on lava lamps. Roughly 10 percent of the Internet's traffic passes through Cloudflare, and as the firm deals with so much encrypted traffic, many random numbers are required. According to Nick Sullivan, Cloudfare's head of cryptography, this is where the lava lamps shine. Instead of relying on code to generate these numbers for cryptographic purposes, the lava lamps and the random lights, swirling blobs and movements are recorded and photographs are taken. The information is then fed into a data center and Linux kernels which then seed random number generators used to create keys to encrypt traffic. "Every time you take a picture with a camera there's going to be some sort of static, some sort of noise," Sullivan said. "So it's not only just where the bubbles are flowing through the lava lamp; it is the state of the air, the ambient light -- every tiny change impacts the stream of data." Cloudflare also reportedly uses a "chaotic pendulum" in its London office to generate randomness, and in Singapore, they use a radioactive source.
https://en.wikipedia.org/wiki/... Lavarand was a hardware random number generator designed by Silicon Graphics that worked by taking pictures of the patterns made by the floating material in lava lamps, extracting random data from the pictures, and using the result to seed a pseudorandom number generator.[1] Although the secondary part of the random number generation uses a pseudorandom number generator, the full process essentially qualifies as a "true" random number generator due to the random seed that is used. However, its applicability is limited by its low bandwidth.
The universe is full of randomness that's hard to predict. The triumph of digital electronics is that they eliminate the randomness almost completely when abstracted up from electron/hole pairs in semiconductors to the realm of bits and bytes. That means you can't get randomness out of it, no matter how theoretically secure your algorithm--you need to go back to the messiness of physical space for that. Well done.
Women are completely unpredictable, just use them.
Have you ever watched a lava lamp for a while? Especially one that's been around for a while? They're incredibly deterministic.
I would think this would be a better source: http://random.irb.hr/
I'm not saying it's a bad idea, but Cloudflare must need a lot. How many bps of entropy can you get per lava lamp?
"Believe me!" -- Donald Trump
Pop Rocks based encryption!
Lava lamps are giant blobs of cohesive good. Unpredictable as they are, their entropy is pretty low.
We had an old slashdotter on here a few years ago who made specialised RNG generating cards. They used unpredicatable random static noise and filters to generate extremely high quality random data. Apparently their cards were so good, they discovered flaws in some kind of "Die Hard" suite of statistical tests. I think the cards retailed for ~$30 IIRC.
That's nerdery. That's going the distance. Using lava lamps? That's hipster shit. Pseudo-nerdery. Someone who, for whatever direction their lives have taken them, thinks they're a nerd, but really they're at best a geek who can follow a cookbook. And most of the internet won't be able to tell the difference.
The real nerds don't get stories written about them anymore.
I'd say it's a gimmick, if anything.
Truth is there are other/better/easier sources to generate entropy seeds from.
Is the lava lamp really the source of most of the randomness, or is it kind of a gimmick that people can say and understand? I mean, cmon, the noise in the camera itself is probably already enough, right? They're taking the Nth decimal place of some characteristic of the entire image -- the lava really isn't that important, is it?
Lavarand is the subject of this patent and I wonder if CloudFlare has a license? Insert comments on the frivolity of the patent and of the patent system below.
I suspect that the noise of the camera sensor contributes as much randomness as the lava lamp. And it's thermal or quantum noise, so probably a good random source.
Bruce Perens.
The lava lamp can’t be backdoored like that hardware can.
The universe is full of randomness that's hard to predict. The triumph of digital electronics is that they eliminate the randomness almost completely when abstracted up from electron/hole pairs in semiconductors to the realm of bits and bytes. That means you can't get randomness out of it, no matter how theoretically secure your algorithm--you need to go back to the messiness of physical space for that. Well done.
That's what metastability is for. It's how the entropy source in your CPU works and it's a heck of a lot more efficient and fast than a bunch of lava lamps.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
http://dilbert.com/strip/2001-...
#DeleteFacebook
Just have me hit a golf ball off the tee - there's no way you can predict where that sucker's gonna land.
#DeleteChrome
it's a heck of a lot more efficient and fast than a bunch of lava lamps.
I made my lava lamp RNG much more efficient by installing LED bulbs in the lamps.
It's also much faster now. No matter how fast I read out bits, I get the same results.
And as the Wikipedia article states later, this technology dates to 1997, and includes a link to the patent from 1998. So this is not news.
See subject.
But ON a shelf. Not OFF the shelf.
But hey! It is working, easy to explain to anyone brighter than a box of darkness and most important: it's a really cool thing to show visitors on a tour through the office.
Come on, how many tech companies would show guests actual production hardware and even if, how often would it be some dull boxes in a Datacenter
bickerdyke
Like from Caesium atoms?
It's older than /.
I do not believe in karma. "Funny"=-6. Do good and forbid evil. Yours, Oft-Offtopic Flamebaiting Troll.
The lava lamp can’t be backdoored like that hardware can.
But the camera software can, and the image processing software can, etc.
... Apple's Lavarand wall would have both color and IR cameras. ;-)
Are the cameras visible color spectrum or IR? The former could be spoofed with a photo, no need to backdoor the software.
FWIW
Truth is there are other/better/easier sources to generate entropy seeds from.
I thought the same thing at first. Then realized that:
1. You really only need to generate a new seed very sporadically.
2. Insiders that can see the damn thing are unlikely to choose this as an attack path since they have so many far better ones.
3. You can actually SEE that the thing is working correctly, unlike a radioactive source.
All in all, it sounds like an OK solution, though it does have a gimmicky sort of look to it.
They probably would have gotten as good randomness just from putting the cameras in a dark room and using the analog noise in the camera sensors.
And as the Wikipedia article states later, this technology dates to 1997, and includes a link to the patent from 1998. So this is not news.
Fine, modernize the system. Replace the incandescent light bulb with a GPU mining cryptocurrency. :-)
Makes you wonder if it could detect someone breaking into a video line.
Because there is no known general analytical solution to the Navier-Stokes equation. It is a hardware rng.
https://www.amazon.com/Million...
You can hear it. It makes a clicking sound. Have you never seen a movie?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Well, it isn't hard to build a simple circuit that generates randomness from semiconductor junction noise, but pointing a video camera at a lava lamp is even easier and more within the skill set of an average software geek.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
Random == An unrecognised pattern
Power failure!
Seed = 00000000000000000000000000000000000000000000000000000
The Russians have won. They have made the world a cesspool of distrust, greed, fear and hate.
Yes, but we're not talking about design. We're talking about re-using existing design.
Only a complete fool would try to gin up his own pseudorandom number generator algorithm; you look a good one up in a book. We're not even talking about that here; we're talking about using somebody else's scheme.
Post may contain irony: discontinue use if experiencing mood swings, nausea or elevated blood pressure.
If I were a cryptographer, I think I would literally jerk off at the idea of predicting future states of lava lamps to crack a large % of the world's encryption.
I trust the lava lamps to be random more than I trust the CPU.
my opportunity to freely express myself with the potential persecution and hangings and such
Then your trust is misplaced and foolish. You are trusting the CPU to take in all that data and analyze it and extract random data, but you won't trust it to do something they have had in hardware for ages. Serious derp levels going on with this lava lamp nonsense.
Think a little about it. Does your camera is at exactly the same place? Did your camera CMOS chip have exactly the same defects as the one they use? Do you take your still images at exactly the same time? And there is so much parameters that make your easy hack not so easy. The easy hack would be to put some kind of spying apparatus behind their camera that send the information back to you, not putting another camera.
The former could be spoofed with a photo
No, because even a static photo will still have plenty of sensor noise. You could put the lens cap on, and it would work just as well.
opinion discarded
From an AC? Now I've seen everything.
Are they licensed for US 5732138 A patent usage?
Change is certain; progress is not obligatory.