10 ms·
Encryption Lava Lamps (2017)
- Uhhrrr 6y agoShould have a reference to the original concept: https://en.wikipedia.org/wiki/Lavarand https://en.wikipedia.org/wiki/Lavarand
- jandrewrogers 6y agoI've seen the original Lavarand lamps, which are currently decorating an apartment in Seattle. It was a gift from Landon Noll.
- terinjokes 6y agoThere's a plaque on the wall next to the lava lamps that explains the connection.
- Uhhrrr 6y agoI mean the article should mention it!
- tmabraham 6y agoA Tom Scott video on this: https://www.youtube.com/watch?v=1cUUfMeOijg https://www.youtube.com/watch?v=1cUUfMeOijg
- mrkwse 6y agoCloudflare themselves have gone into significantly more detail in a blog if you're interested beyond the curio in the main link: https://www.cloudflare.com/en-gb/learning/ssl/lava-lamp-encryption/ https://www.cloudflare.com/en-gb/learning/ssl/lava-lamp-encr...
- folkhack 6y agoYeah - they admit that they're mixing it with two other sources of entropy... All I could think when I saw this was "not enough entropy - what the heck..." My guess is they have a couple of quantum HRNGs in those "Linux systems" they discuss that are actually doing the majority of the entropy. Cool gimmick though.
- tptacek 6y agoOr they could just use stock Intel or ARM boards and SOCs and just use getrandom, which works and scales just fine.
- BelenusMordred 6y agoThe throughput for RDRAND isn't that great and often getting worse as mitigations get rolled out. For cloudflare scale using dedicated hardware makes a lot of sense. https://www.phoronix.com/scan.php?page=news_item&px=Linux-RdRand-Sanity-Check https://www.phoronix.com/scan.php?page=news_item&px=Linux-Rd... https://www.reddit.com/r/crypto/comments/h07u2q/rdrand_performance_as_bad_as_3_original_speed/ https://www.reddit.com/r/crypto/comments/h07u2q/rdrand_perfo...
- tptacek 6y agoIn what sense do you need RDRAND to scale? You seed an RNG infrequently, and spool off arbitrary amounts of random bytes from it in each interval.
- BelenusMordred 6y ago> In what sense do you need RDRAND to scale? Personally? Not at all, I do it for fun. On windows it's all you have because adding anything to the entropy pool BCryptGenRandom draws from is a no go, it was possible ten years ago, a simpler time. Now you have to do it yourself and xor different sources at the application layer if so concerned. On Linux it's trivial. Cloudflare? Well, besides their obvious immediate needs, they are openly positioning themselves as an entropy provider for high security purposes, which requires good sources and throughput. What Intel or AMD is offering out of the box is not going to cut it by itself. Not saying they're broken, they work fine for nearly all purposes, instead here positing that if your entire existence and everything you owned depended on it would you truly just use the inbuilt CPU RNG on your computer and call it day? It's a small amount of time to add additional sources and not lose your shirt/dignity. https://www.cloudflare.com/en-gb/leagueofentropy/ https://www.cloudflare.com/en-gb/leagueofentropy/
- henriquez 6y agoYou can look all over the universe for entropy. Lava lamps make for a cool PR showpiece, and apparently easy fodder for fluff pieces like this article. I just hope none of my relatives read it and ask me about it. The reality is much more interesting but would probably bore most people to death.
- jdc 6y agoWhat's the best entropy bang--for-your-buck < $100?
- pmiller2 6y agoMaybe this? https://www.amazon.com/dp/B01ENG4UX4/ https://www.amazon.com/dp/B01ENG4UX4/
- amenghra 6y agoFlip a penny twice, if you get heads followed by tails, write down 0. If you get tails, followed by heads, write down 1. Otherwise ignore the two flips. Rinse and repeat until you have enough bits. The purpose of flipping twice is that it offsets any potential static bias (caused eg by weight difference) between the two sides.
- amenghra 6y agoCommon ways to generate entropy in a way that’s friendly to computers include: measuring noise from a zener (or other electronic component), delta between two or more oscillators, or timing between external events (eg keystrokes, packets, etc). These are all super cheap to manufacture (~$1). If you want to go high end, you can spent ~$1000 and get a generator based on some quantum property (photon spin or background radiation detector). Computers will typically combine two or more sources of entropy. In newer tls version handshakes, the entropy from both, the server and client comes into play. So there’s ways to build defense in depth.
- faeyanpiraat 6y ago
- daedalus2027 6y ago> It may seem bizarre that Cloudflare would allow average people to affect the video footage, but that’s actually intentional. External disturbances like human movement, static, and changes in lighting from the adjacent windows all work together to make the random code even harder to predict. well what if you show up with a white blanket and putit in front of the camera?
- deleted 6y ago[deleted]
- ogre_codes 6y agoUnless you could hold the blanket perfectly still and prevent outside light from reflecting off of it, it probably makes zero difference. The cameras don't need large amounts of contrast or even big variances in hue, just small amounts of randomness in the ripples in the fabric you are holding up is enough.
- tester756 6y agothen why would they use so many lava lamps?
- ogre_codes 6y agoBecause it looks cool and makes for lots of stories in the media like this one. People have reliably used webcams with the cap on to create entropy suitable for effectively true random numbers.
- xwdv 6y ago...it’s a marketing tactic.
- signa11 6y agofine, black blanket then ?
- halfmatthalfcat 6y ago
- pettycashstash2 6y agoI recall a while back someone was actually being paid to roll dice.
- faeyanpiraat 6y agoAnd record the results on punchcards?
- tptacek 6y agoThis is, of course, all pretty silly. Collecting entropy for a fleet of services is not a real cryptographic engineering challenge, and it would be alarming to learn that Cloudflare actually somehow pipes output from these things into all their systems.
- deleted 6y ago[deleted]
- lordmax 6y agoFar better solution IMHO built after industry discussion of "lava wall" years ago: https://bit.ly/3naYEBP https://bit.ly/3naYEBP Of course, by now we got hardware rng RPi, TrueRNG, security enclave rng - largely a solved problem on most of practical systems. just setup right, seed right and use `/dev/urandom`
- natch 6y agoI’m left wondering how they protect the camera and the data cable coming from the camera.
- mcpherrinm 6y agoIt's done for fun, and not really a critical security measure, so it doesn't matter.
- natch 6y agoWould be even more fun though if it was secure. And fun does matter.
- dang 6y agoDiscussed at the time: https://news.ycombinator.com/item?id=16041295 https://news.ycombinator.com/item?id=16041295
- deleted 6y ago[deleted]
- motohagiography 6y agoI remember using lava lamps for SSH random number generation from the 90's. However, they may have yielded this entire area of security: So-called "physically unclonable functions" https://en.wikipedia.org/wiki/Physical_unclonable_function https://en.wikipedia.org/wiki/Physical_unclonable_function I am immensely skeptical of these, but they have some academic and other obscure traction.
- kennedyjavelin 6y agoBefore anyone else looks into PUFs as a mechanism for generating entropy (like the lava lamps are), they don't. It's kind of the opposite kind of randomness. Lava lamps create new randomness every time whereas a PUF generates the same randomness always.
- motohagiography 6y agoThe skepticism I have of PUFs is that since they don't generate random numbers, they may just be another open loop unfalsifiable concept in security that reduces to "it's complicated, take my word for it." The relationship to lava lamps is PUFs are a physical instead of a logical source of data, conceptually not unlike a quartz crystal in a clock, or radio active decay for random numbers, or even biometrics for authentication. You take something physically natural then sample it at a given interval to get logical data within certain parameters. The security of such a system is not in the mystery of the physical object, but the sampling scheme. Apropos of the news, just like it isn't important so much who people vote for, it's who counts the votes that matters. The security of both lava lamp RNGs and PUFs are subject to an analogous sampling dynamic. So are biometrics.
- numpad0 6y agoThe version of PUF I’ve read about in a decade or so ago was you make a cryptographic chip, except you leave the key field blank, but let manufacturing variances “generate” the key by itself, and mathematically declare that it is so impossibly unlikely that two of its examples end up having the same bit patterns. IIRC major challenges included ensuring and proving randomness, stability of bit patterns over time, and general longevity of the whole chip. The alternative to it is to just generate the key and write it at some point in the chip production line, and that’s generally considered good enough, so...
- smithclay 6y agoThese lava lamps were also a key plot point in an NCIS episode (a popular crime procedural on CBS). [spoiler below] https://twitter.com/ncis_cbs/status/1044751471927947264?lang=en https://twitter.com/ncis_cbs/status/1044751471927947264?lang...
- NiceWayToDoIT 6y agoSo, Hitchhiker's guide to the galaxy, Heart of Gold and Infinite Improbability Drive.
- wankeler 6y agoExactly, all you really need is a fresh cup of really hot tea
- oconnore 6y agoIt seems like you could probably just aim a typical camera at a potato and get enough sensor noise in the pixel data to be a perfectly fine RNG. I doubt anyone could hope to demonstrate a bit for bit match of any two pictures using a modern digital camera (maybe even if the lens is closed).
- faeyanpiraat 6y agoPointing the camera at a lavalamp has the same noise, AND movement aswell. So lava lamps produce higher entropy than a potato everything else being equal.
- ncmncm 6y agoBut the difference is vanishingly unlikely to matter.
- faeyanpiraat 6y agoI know, I just enjoyed having the opportunity to compare lava lamps to potatoes in a somewhat meaningful context.
- saithound 6y agoThe point is that there is no possible scenario where CCD noise alone is inadequate, but CCD noise + lava lamps is adequate.
- bjoli 6y agoWouldn't a plasma lamp (or whatever they are called) provide the same thing at a lower power cost? They work faster as well, meaning you could probably sample more often.
- refactor_master 6y agoRandom fluctuations and butterfly effects aside, couldn’t you actually predict the lava lamp flows from fluid dynamics? Or does it just so happen that the math here is actually harder than breaking the encryption?
- Heliosmaster 6y agoas far as i can tell, true randomness doesn't work except from in the quantum world. Everything else is random insofar as "we don't know it and it's unpractical to predict". Coin tosses are also not random: they all depends on the system initial conditions.
- etiam 6y agoRandom fluctuations, butterfly effects and hairy heat transfer effects with resulting gradients of dynamically changing material properties aside, probably yes. But that's one whopping reservation, and even if, you could only predict exactly to the extent fluid dynamics exactly models interacting particle physics involving mind-boggling numbers (for the scales of interest). Also, I have no background solving complex fluid dynamics problems, but my understanding is that the differential equations involved generally have to be solved with iterated numerical approximations (if anyone here knows more certainly, please do chime in). In the short term that's probably one of the smaller problems, but it is at least somewhat connected to why we don't get get highly reliable 3-week weather forecasts, and possibly never will.
- bmm6o 6y agoIf you assume you can ignore the hard parts, the problem becomes easier, I guess. You still need to know initial conditions to impossible accuracy.
- loup-vaillant 6y agoWell, those lava lamps are cool looking, but that's about their only value. A 256-bit seed is enough to generate all the random bytes you'll ever want: just use Chacha20 with fast key erasure, and you're done. (Fast key erasure crash course: start with an encryption key and a stream cipher. Encrypt 512 bytes worth of zeroes. The first 32 bytes of the ciphertext are your new key. The rest can feed /dev/urandom. Once a byte is served, erase it. Once you run out of bytes, generate 512 more bytes. New generators can be forked off by simply requesting 32 random bytes.) From https://blog.cr.yp.to/20140205-entropy.html https://blog.cr.yp.to/20140205-entropy.html how can anyone simultaneously believe that: - we can't figure out how to deterministically expand one 256-bit secret into an endless stream of unpredictable keys (this is what we need from urandom), but - we _can_ figure out how to use a single key to safely encrypt many messages (this is what we need from SSL, PGP, etc.)? I don't. Those lava lamps are cool looking, but that's about their only value. We don't need that many random bits.
- YesThatTom2 6y agoIt's a shame the article doesn't give credit to the people they copied. They should give credit to LavaRand classic, invented at SGI by Bob Mende & Sanjeev Sisodiya (Mende's passing still feels recent to me https://www.legacy.com/obituaries/dailyrecord/obituary.aspx?n=robert-graham-mende-bob&pid=188060224&fhid=8818 https://www.legacy.com/obituaries/dailyrecord/obituary.aspx?...) or its sequel LavaRnd (https://www.lavarand.org/news/lavadiff.html https://www.lavarand.org/news/lavadiff.html) invented by Landon Curt Noll and Simon Cooper.
- blindm 6y agoI was thinking: instead of using atmospheric noise for entropy, one could use a variety of different things taken directly from the user, like mouse movements (Veracrypt uses the mouse to seed random values for example). You could even use things like the user's timezone, HTML5 Canvas fingerprint, even the order/arrangement of icons on the desktop. There's so many sources!
- ncmncm 6y agoLava lamps optional. Really, the least-significant-bit noise from any camera chip, even pointed at nothing, fed through e.g. SHA-256, gives high-quality cryptographic random numbers at as high a rate as you are likely to want. (If you need better random numbers, you also have no need to read this.) You can get similar quality from hashing the low bits of a mic input. Hashing already-connected noise is actually better than resistor or diode noise, that is tricky to get right -- although feeding output of one of those through a good hash forgives a lot of bias.