6 ms·

The London office where swinging pendulums keep cyber threats at bay

83 points by mellosouls 3y ago

smusamashah 3y ago
As a layman how does this physical random generation help with security. Can any hacker ever chase any random enough number generated by some algorithm? To me it looks like if there was 0.001 percent chance of guessing a random this technique just reduces that chance in theory. A long enough password is already considered secure, how does this thing make it any more secure in practice?
- yyykk 3y ago
  It doesn't, it's really just an art piece. The same could be achieved electronically with a simple circuit inside their servers, but it wouldn't look quite as good.
  - xLaszlo 3y ago
    Until it turns out that the NSA was involved writing said RNG and explicitly weekend it with a backdoor...
    - rcxdude 3y ago
      These circuits are really simple. Unless the NSA has backdoored solid-state physics it's no greater a risk than this approach. (The NSA very well could backdoor the camera you point at these pendulums).
      - xLaszlo 3y ago
        Hmm, I had to check this and came across this thread on Reddit. NIST has a standard for it, but the exact point is that _that_ can be influenced by them. Also, somewhere in the thread, they mention that it is probably too hard to verify how it is actually implemented in the hardware. https://www.reddit.com/r/crypto/comments/klcx4p/is_true_random_number_generation_in_modern/ https://www.reddit.com/r/crypto/comments/klcx4p/is_true_rand... I guess in security only the paranoid prevails... Or it is indeed just a cool gimmick...
    - deleted 3y ago
      [deleted]
- Legend2440 3y ago
  It's really just for the purpose of looking cool. Modern CPUs include hardware random number generators that work just fine.
  - hbossy 3y ago
    According to their producers. Do you trust them?
    - Legend2440 3y ago
      If your can't trust your CPU, you are screwed - no matter what entropy source you use.
  - JoachimS 3y ago
    Things can be more than one thing. Of course it is a PR piece. But it is also a source of entropy that is hard to manipulate (if we ignore the cameras, image generation etc). And it is a good source, initiator for discussions about entropy, random numbers and why we need them to secure things. This thread on HN shows that it is so. And for 'normal' people probably even more. I'm sure they have a lot of non-geeky visitors that look at the installation, read the sign and start asking questions. And if it was me, starting to jump in front of the installation, waving my arms - to provide my bit of entropy to the pool.
- acatton 3y ago
  Random numbers are used to generate your TLS certificate key or your SSH key. If one can predict how a TLS or SSH key was generated they could impersonate the key holder. Here is an explanation of what was possible when a Debian packager mistakenly introduced a patch which reduced the SSL certificate keyspace in 2008: https://jblevins.org/log/ssh-vulnkey https://jblevins.org/log/ssh-vulnkey The possibilities of keys which were generated by this random number generator was so small, that a brute-force attack on keys was feasible. That being said, for years, random number generators have been using random signals coming to your computer (key strokes, network packets, ...) and feeding them into a sponge function. You don't need lava lamps or pendulums to generate random numbers, it's just for the press. https://www.2uo.de/myths-about-urandom/ https://www.2uo.de/myths-about-urandom/
  - tetha 3y ago
    Speedrunners abuse this in a fun way on older consoles, RNG manipulation [1]. For example the SNES had no actual source of random numbers, so games had to use the inputs as the most unpredictable random source. However, if you do that, people figure out how you can scroll through a menu to force an item to drop or an attack to become great[2] If implemented in full tool assisted speedruns, this can become entirely ridiculous. That rare thing you need to grind hours to find? nope. just press these 18 buttons starting at the right frame and it'll drop first try. 1: https://www.youtube.com/watch?v=MNQaZFwu57E https://www.youtube.com/watch?v=MNQaZFwu57E 2: https://www.youtube.com/watch?v=-sfE8qLCnQY https://www.youtube.com/watch?v=-sfE8qLCnQY
    - tialaramex 3y ago
      Nintendo's relatively modern Mario Maker 2 even deliberately chooses not to have real randomness. "Random" MM2 courses such as "Carlsino" actually rely on subtle differences in player inputs, if you could ensure you don't deviate from a certain series of button presses and timings then the "random" elements would always turn out the same.
      - tetha 3y ago
        Aye. It is a very interesting question if you need or even want full randomness in a game. If you have something that's geared towards speed running, fast execution and mastering, being deterministic is actually a good thing. Otherwise, the player has to re-roll a hundred times to get the "good seed" to get a good run - that's very frustrating. Look at some of the kings quest speedruns for this kinda frustration. Or in a similar direction - tetris with a true random piece selection can result in very frustrating and unwinnable piece sequences (which bastard tetris is dialing to 12). Instead, quite a few modern implementations choose some set of tetrimonios and fill a bag with 3-5 repetitions of this set and choose from that. This limits the possibility and length of possibly frustrating pieces.
- defrost 3y ago
  A single random password simply isn't enough - Cloudflare deals in millions (actually many many more) of secure handshakes per second. Each has to be secure with a unique unpredictable element. One way (of many) is to use complex PRNG's - Psuedo Random Number Generators, but these can (theorectically) be sequence guessed and then are predictable (or least have a greatly reduced "guess space"). A hybrid way is to regularly reseed a PRNG with a "truly random" starting point, milk that for a few hundred values, and then kick it again with a new random seed. These particular pendulums have "simple" mechanics that are similar to the dynamic systems represented by Lorenz's Butterfly [1] (not exactly but with similar properties) and thus move in chaotic unpredicable ways (such as the timing between the last crossbar changing directions) - these can be "driven" (the base rocked | vibrated) by a small motor) so they continuusly move and yet the path through phase space is still unpredictable. So, without knowing for certain whether this is what Cloudflare is doing here, that is one way in which many many truly random numbers can be generated to feed into secure handshakes; using unpredictable seeds to feed into twisted PRNGs. [1] https://en.wikipedia.org/wiki/Lorenz_system https://en.wikipedia.org/wiki/Lorenz_system
  - zelphirkalt 3y ago
    Seemingly chaotic does not equal random. But unless someone figures out a way to make the chaotic seem no longer chaotic, it will be good enough for our purposes.
- GuB-42 3y ago
  There are many algorithms where instead of transferring data using a computationally expensive (usually public key, like RSA) algorithm, the data is encrypted with a much faster (usually symmetrical, like AES) algorithm using a random key and then the key is transferred using the expensive algorithm. If you can guess how the random key is generated, then you can decrypt the message without breaking either encryption algorithm. That's why it is important to have really unpredictable random data, and physical randomness is the best for that. In practice, that wall of pendulums is unlikely to make a difference compared to the more mundane techniques used in most computers these days, that rely on some CSPRNG combined with various hard to predict system events (ex: interrupt timing), but it looks way cooler.
- moritonal 3y ago
  Fun fact, Hackernews itself was "hacked" by a user doing exactly this. A user realised they could successfully guess the key-space the server used to encrypt it's user cookies. Had it had a greater source of random it wouldn't have been possible. https://news.ycombinator.com/item?id=639976 https://news.ycombinator.com/item?id=639976
  - jgrahamc 3y ago
    Amusingly, I had pointed out that HN was vulnerable to such an attack about a month before that user did it. And I was also involved into setting up Cloudflare's Lava Lamps. https://news.ycombinator.com/item?id=640213 https://news.ycombinator.com/item?id=640213
- astura 3y ago
  Here's an (old) example of poor random number generation leading to an exploit - https://www.developer.com/guides/how-we-learned-to-cheat-at-online-poker-a-study-in-software-security/ https://www.developer.com/guides/how-we-learned-to-cheat-at-...
bell-cot 3y ago
I smell security theater, and a red herring for dim adversaries. OTOH...if I ran Cloudflare's PR Dept., and was responsible for keeping the internet's millions of self-styled experts (who generally know just enough to be really annoying) feeling both informed, and sure of Cloudflare's security virtues - then I'd probably be pushing for more of these setups. And for-sure one of 'em in any Cloudflare office where I or my people might be stuck giving interviews to journalists. Every second of an X-minute interview that was "wasted" by the reporter staring at the Sock Puppets of Randomness would be one happier second in the lives of me and my people... /s?
Karellen 3y ago
ObTomScott: The Lava Lamps That Help Keep The Internet Secure https://www.youtube.com/watch?v=1cUUfMeOijg https://www.youtube.com/watch?v=1cUUfMeOijg (Mention of the London pendulums at 2:39)
- mikerg87 3y ago
  The patent that drives this : Method for seeding a pseudo-random number generator with a cryptographic hash of a digitization of a chaotic system https://patents.google.com/patent/US5732138A/en https://patents.google.com/patent/US5732138A/en
resource_waste 3y ago
I liked lava lamps better. Fluids are less predictable.
- jgrahamc 3y ago
  We use lots of things: https://blog.cloudflare.com/harnessing-office-chaos/ https://blog.cloudflare.com/harnessing-office-chaos/
garyiskidding 3y ago
Australian National University hosts a random number generator based on quantum fluctuations in the vacuum : https://qrng.anu.edu.au/ https://qrng.anu.edu.au/ Question : With respect to breaking cryptography, today's cryptographically secure pseudo random number generators (CSPRNGs) seem capable. What threat scenarios would require true (or near-true) random generators?
- djcannabiz 3y ago
  CSPRNGs still need to be seeded with random numbers.
  - JoachimS 3y ago
    And very importantly, a TRNG is often not cryptographically safe and should never be directly used for security related use cases. Basically only be used to (re)seed a good CSPRNG (DRBG in NIST parlance). Another benefit of a CSPRNG is vastly higher performance than most TRNGs can achieve. A TRNG often provide kbps birate. A CSPRNG can easily deliver Many MBps, even GBps.
    - garyiskidding 3y ago
      thank you.
ot 3y ago
I wish articles like this described the technique for what it is, that is a fun gimmick, or maybe even an art installation, rather than misleading the reader into thinking that this is produces better randomness than any other common entropy source (there is no indication of that). It is misinformation that does not make the reading any more entertaining or informative. "critical to the security of the global internet"? Really?
- yellow_lead 3y ago
  Since they mix it with other entropy sources, it really doesn't matter. At best, you have a cool marketing gimmick. At worst, the extra complexity from this art installation introduces some vulnerability in the future.
moritonal 3y ago
For all the people saying this is security theatre, no, it's one layer of an immense level of paranoia that makes CloudFlare great at what they do. Fun fact, HN itself was "hacked" due to bad random once (https://news.ycombinator.com/item?id=639976 https://news.ycombinator.com/item?id=639976).
- jgrahamc 3y ago
  Random numbers have always worried me. Hence the Lava Lamps etc. at Cloudflare and the fact that I predicted that attack on HN about a month before it happened: https://news.ycombinator.com/item?id=640213 https://news.ycombinator.com/item?id=640213
  - ot 3y ago
    But in the case of HN the RNG was seeded by millisecond-granularity timestamps. This was universally considered bad already in 2009 (it would have been even in 1999). The Debian SSL key scandal happened in 2008. It is quite a leap to say "timestamp-based seeds are insecure, let's upgrade to lava lamps".
  - WirelessGigabit 3y ago
    I'm reading that post, and while fascinating, I don't understand the entropy calculation. The digit chance is easy: For a single digit to appear one needs 1/3 * 1/10 = 1/30. For a single letter to appear one needs 1/3 * 1/26 = 1/78. But the bits of entropy throw me off. 26 + 26 + 10 = 62, which is 2^5.954. But that is for a uniform distribution. The writer states that it actually is 2^5.826, or 1/~56.7. I don't get how they to that number.
    - lukevalenta 3y ago
      Here's how you can get that entropy using the Shannon entropy equation from https://en.wikipedia.org/wiki/Entropy_(information_theory) https://en.wikipedia.org/wiki/Entropy_(information_theory). Like you said, the probability of any digit appearing is 1/30, and there are 10 digits. The probability of a lower- or upper- case letter appearing is 1/78, and there are 26+26 = 52 letters. Plugging that into the formula for Shannon entropy, we get this: - 10 * (1/30) * log_2(1/30) - 52 * (1/78) * log_2(1/78) =~ 5.826
thih9 3y ago
> also the shadows behind them. The alcove is lit by daylight, so the shadows cast by the swinging double-pendulums will change depending on how sunny it is or, more usually in London, how gloomy it is. Wouldn't that result in time based patterns matching the daytime/nighttime cycle? Then again, I guess this would only happen during continuous use over a number of days and perhaps that's not the use case.
- H8crilA 3y ago
  It still adds entropy. You're thinking of uniform entropy vs just entropy, but the former is easy-ish to produce from the latter, for example by using hash functions. Also, it's obviously a stunt - you are probably much better off measuring decay of trace amounts of natural radioactive isotopes. But it is not without merit.
  - sgarland 3y ago
    > measuring decay of trace amounts of natural radioactive isotopes Which is precisely what CF does in their Singapore office.
- Miraltar 3y ago
  Yes there is a day/night cycle but it also depends too much on the weather on a ridiculously tiny scale to be realisticly predictable. And even if it was indeed predictable, it woud still add complexity to the prediction
- quantified 3y ago
  Capturing street-level headlights would add in more randomness at nighttime (so long as car and bus headlights remain a thing).
ggm 3y ago
Funny story I've told on hn before. Post office bond draws were using "ernie" which did randomness from thermionic valves. My dad helped build "icce" at imperial college in the 50s (something like the 5th public computer in the UK, noting many fine secret ones) and wanted to test their RNG. The post office refused to cooperate with a feed from Ernie, concerned imperial would detect non-randomness and undermine the integrity (or PR) of the premium bond draw.
tromp 3y ago
Unfortunately, I couldn't find any video of the cloudflare pendulums in action, but this other one [1] gives some idea, despite being human powered rather than battery powered. Btw, I imagine a camera pointed at a busy intersection with lots of pedestrian traffic (e.g. Times Square) to generate much more entropy. [1] https://www.youtube.com/watch?v=J85gpcjvqzs https://www.youtube.com/watch?v=J85gpcjvqzs
ano-ther 3y ago
Cool. I only knew about the lava lamps. How random are the pendulums and how are they powered? Pendulums are usually quite predictable. Or are these double pendulums? They add randomness by adding daylight. Could you use this for an attack (say, shining light from the outside during the night)?
- luxcem 3y ago
  These are double pendulums, it's a famous chaotic system. Even with a video frame it would be impossible to predict more than a few seconds of the system.
deleted 3y ago
[deleted]
throw0101b 3y ago
There's a (expired) patent on this: > A method for generating a pseudo-random numbers Initially, the state of a chaotic system is digitized to form a binary string. This binary string is then hashed to produce a second binary string. It is this second binary string which is used to seed a pseudo-random number generator. The output from the pseudo-random number generator may be used in forming a password or cryptographic key for use in a security system. * https://patents.google.com/patent/US5732138A/en https://patents.google.com/patent/US5732138A/en Originally filed by SGI in 1996. See also: * https://en.wikipedia.org/wiki/Lavarand https://en.wikipedia.org/wiki/Lavarand * https://www.cloudflare.com/en-ca/learning/ssl/lava-lamp-encryption/ https://www.cloudflare.com/en-ca/learning/ssl/lava-lamp-encr...
dschuetz 3y ago
"They’re not even connected to anything, but their perpetual swinging action is what keeps the internet safe(r) from hackers and protects your online transactions from fraudsters." That sentence triggers me on so many levels. Down below in the article it says that cameras are sampling the motion. So, ultimately the setup is connected to something, and it is being actively used as a quality source of entropy for cryptography. Brilliant, actually, but this is not what "keeps the internet safe". Strong encryption is a source of trust, nothing more. Proper security needs to rely on a few things that we have to assume to be unbreakable. Only then we can build on top of that. Sadly, even unbreakable encryption, if used incorrectly, can bring the whole thing down. I really don´t like articles that sensationalize "neat details" and by that distort the bigger picture.
epalm 3y ago
All that text and all those still images and no gif or short video showing the pendulums swinging!? ;)

83 points by mellosouls 3y ago

As a layman how does this physical random generation help with security. Can any hacker ever chase any random enough number generated by some algorithm? To me it looks like if there was 0.001 percent chance of guessing a random this technique just reduces that chance in theory. A long enough password is already considered secure, how does this thing make it any more secure in practice?

yyykk 3y ago
It doesn't, it's really just an art piece. The same could be achieved electronically with a simple circuit inside their servers, but it wouldn't look quite as good.
- xLaszlo 3y ago
  Until it turns out that the NSA was involved writing said RNG and explicitly weekend it with a backdoor...
  - rcxdude 3y ago
    These circuits are really simple. Unless the NSA has backdoored solid-state physics it's no greater a risk than this approach. (The NSA very well could backdoor the camera you point at these pendulums).
    - xLaszlo 3y ago
      Hmm, I had to check this and came across this thread on Reddit. NIST has a standard for it, but the exact point is that _that_ can be influenced by them. Also, somewhere in the thread, they mention that it is probably too hard to verify how it is actually implemented in the hardware. https://www.reddit.com/r/crypto/comments/klcx4p/is_true_random_number_generation_in_modern/ https://www.reddit.com/r/crypto/comments/klcx4p/is_true_rand... I guess in security only the paranoid prevails... Or it is indeed just a cool gimmick...
  - deleted 3y ago
    [deleted]
Legend2440 3y ago
It's really just for the purpose of looking cool. Modern CPUs include hardware random number generators that work just fine.
- hbossy 3y ago
  According to their producers. Do you trust them?
  - Legend2440 3y ago
    If your can't trust your CPU, you are screwed - no matter what entropy source you use.
- JoachimS 3y ago
  Things can be more than one thing. Of course it is a PR piece. But it is also a source of entropy that is hard to manipulate (if we ignore the cameras, image generation etc). And it is a good source, initiator for discussions about entropy, random numbers and why we need them to secure things. This thread on HN shows that it is so. And for 'normal' people probably even more. I'm sure they have a lot of non-geeky visitors that look at the installation, read the sign and start asking questions. And if it was me, starting to jump in front of the installation, waving my arms - to provide my bit of entropy to the pool.
acatton 3y ago
Random numbers are used to generate your TLS certificate key or your SSH key. If one can predict how a TLS or SSH key was generated they could impersonate the key holder. Here is an explanation of what was possible when a Debian packager mistakenly introduced a patch which reduced the SSL certificate keyspace in 2008: https://jblevins.org/log/ssh-vulnkey https://jblevins.org/log/ssh-vulnkey The possibilities of keys which were generated by this random number generator was so small, that a brute-force attack on keys was feasible. That being said, for years, random number generators have been using random signals coming to your computer (key strokes, network packets, ...) and feeding them into a sponge function. You don't need lava lamps or pendulums to generate random numbers, it's just for the press. https://www.2uo.de/myths-about-urandom/ https://www.2uo.de/myths-about-urandom/
- tetha 3y ago
  Speedrunners abuse this in a fun way on older consoles, RNG manipulation [1]. For example the SNES had no actual source of random numbers, so games had to use the inputs as the most unpredictable random source. However, if you do that, people figure out how you can scroll through a menu to force an item to drop or an attack to become great[2] If implemented in full tool assisted speedruns, this can become entirely ridiculous. That rare thing you need to grind hours to find? nope. just press these 18 buttons starting at the right frame and it'll drop first try. 1: https://www.youtube.com/watch?v=MNQaZFwu57E https://www.youtube.com/watch?v=MNQaZFwu57E 2: https://www.youtube.com/watch?v=-sfE8qLCnQY https://www.youtube.com/watch?v=-sfE8qLCnQY
  - tialaramex 3y ago
    Nintendo's relatively modern Mario Maker 2 even deliberately chooses not to have real randomness. "Random" MM2 courses such as "Carlsino" actually rely on subtle differences in player inputs, if you could ensure you don't deviate from a certain series of button presses and timings then the "random" elements would always turn out the same.
    - tetha 3y ago
      Aye. It is a very interesting question if you need or even want full randomness in a game. If you have something that's geared towards speed running, fast execution and mastering, being deterministic is actually a good thing. Otherwise, the player has to re-roll a hundred times to get the "good seed" to get a good run - that's very frustrating. Look at some of the kings quest speedruns for this kinda frustration. Or in a similar direction - tetris with a true random piece selection can result in very frustrating and unwinnable piece sequences (which bastard tetris is dialing to 12). Instead, quite a few modern implementations choose some set of tetrimonios and fill a bag with 3-5 repetitions of this set and choose from that. This limits the possibility and length of possibly frustrating pieces.
defrost 3y ago
A single random password simply isn't enough - Cloudflare deals in millions (actually many many more) of secure handshakes per second. Each has to be secure with a unique unpredictable element. One way (of many) is to use complex PRNG's - Psuedo Random Number Generators, but these can (theorectically) be sequence guessed and then are predictable (or least have a greatly reduced "guess space"). A hybrid way is to regularly reseed a PRNG with a "truly random" starting point, milk that for a few hundred values, and then kick it again with a new random seed. These particular pendulums have "simple" mechanics that are similar to the dynamic systems represented by Lorenz's Butterfly [1] (not exactly but with similar properties) and thus move in chaotic unpredicable ways (such as the timing between the last crossbar changing directions) - these can be "driven" (the base rocked | vibrated) by a small motor) so they continuusly move and yet the path through phase space is still unpredictable. So, without knowing for certain whether this is what Cloudflare is doing here, that is one way in which many many truly random numbers can be generated to feed into secure handshakes; using unpredictable seeds to feed into twisted PRNGs. [1] https://en.wikipedia.org/wiki/Lorenz_system https://en.wikipedia.org/wiki/Lorenz_system
- zelphirkalt 3y ago
  Seemingly chaotic does not equal random. But unless someone figures out a way to make the chaotic seem no longer chaotic, it will be good enough for our purposes.
GuB-42 3y ago
There are many algorithms where instead of transferring data using a computationally expensive (usually public key, like RSA) algorithm, the data is encrypted with a much faster (usually symmetrical, like AES) algorithm using a random key and then the key is transferred using the expensive algorithm. If you can guess how the random key is generated, then you can decrypt the message without breaking either encryption algorithm. That's why it is important to have really unpredictable random data, and physical randomness is the best for that. In practice, that wall of pendulums is unlikely to make a difference compared to the more mundane techniques used in most computers these days, that rely on some CSPRNG combined with various hard to predict system events (ex: interrupt timing), but it looks way cooler.
moritonal 3y ago
Fun fact, Hackernews itself was "hacked" by a user doing exactly this. A user realised they could successfully guess the key-space the server used to encrypt it's user cookies. Had it had a greater source of random it wouldn't have been possible. https://news.ycombinator.com/item?id=639976 https://news.ycombinator.com/item?id=639976
- jgrahamc 3y ago
  Amusingly, I had pointed out that HN was vulnerable to such an attack about a month before that user did it. And I was also involved into setting up Cloudflare's Lava Lamps. https://news.ycombinator.com/item?id=640213 https://news.ycombinator.com/item?id=640213
astura 3y ago
Here's an (old) example of poor random number generation leading to an exploit - https://www.developer.com/guides/how-we-learned-to-cheat-at-online-poker-a-study-in-software-security/ https://www.developer.com/guides/how-we-learned-to-cheat-at-...

bell-cot 3y ago

I smell security theater, and a red herring for dim adversaries. OTOH...if I ran Cloudflare's PR Dept., and was responsible for keeping the internet's millions of self-styled experts (who generally know just enough to be really annoying) feeling both informed, and sure of Cloudflare's security virtues - then I'd probably be pushing for more of these setups. And for-sure one of 'em in any Cloudflare office where I or my people might be stuck giving interviews to journalists. Every second of an X-minute interview that was "wasted" by the reporter staring at the Sock Puppets of Randomness would be one happier second in the lives of me and my people... /s?

Karellen 3y ago

ObTomScott: The Lava Lamps That Help Keep The Internet Secure https://www.youtube.com/watch?v=1cUUfMeOijg https://www.youtube.com/watch?v=1cUUfMeOijg (Mention of the London pendulums at 2:39)

mikerg87 3y ago
The patent that drives this : Method for seeding a pseudo-random number generator with a cryptographic hash of a digitization of a chaotic system https://patents.google.com/patent/US5732138A/en https://patents.google.com/patent/US5732138A/en

resource_waste 3y ago

I liked lava lamps better. Fluids are less predictable.

jgrahamc 3y ago
We use lots of things: https://blog.cloudflare.com/harnessing-office-chaos/ https://blog.cloudflare.com/harnessing-office-chaos/

garyiskidding 3y ago

Australian National University hosts a random number generator based on quantum fluctuations in the vacuum : https://qrng.anu.edu.au/ https://qrng.anu.edu.au/ Question : With respect to breaking cryptography, today's cryptographically secure pseudo random number generators (CSPRNGs) seem capable. What threat scenarios would require true (or near-true) random generators?

djcannabiz 3y ago
CSPRNGs still need to be seeded with random numbers.
- JoachimS 3y ago
  And very importantly, a TRNG is often not cryptographically safe and should never be directly used for security related use cases. Basically only be used to (re)seed a good CSPRNG (DRBG in NIST parlance). Another benefit of a CSPRNG is vastly higher performance than most TRNGs can achieve. A TRNG often provide kbps birate. A CSPRNG can easily deliver Many MBps, even GBps.
  - garyiskidding 3y ago
    thank you.

ot 3y ago

I wish articles like this described the technique for what it is, that is a fun gimmick, or maybe even an art installation, rather than misleading the reader into thinking that this is produces better randomness than any other common entropy source (there is no indication of that). It is misinformation that does not make the reading any more entertaining or informative. "critical to the security of the global internet"? Really?

yellow_lead 3y ago
Since they mix it with other entropy sources, it really doesn't matter. At best, you have a cool marketing gimmick. At worst, the extra complexity from this art installation introduces some vulnerability in the future.

moritonal 3y ago

For all the people saying this is security theatre, no, it's one layer of an immense level of paranoia that makes CloudFlare great at what they do. Fun fact, HN itself was "hacked" due to bad random once (https://news.ycombinator.com/item?id=639976 https://news.ycombinator.com/item?id=639976).

jgrahamc 3y ago
Random numbers have always worried me. Hence the Lava Lamps etc. at Cloudflare and the fact that I predicted that attack on HN about a month before it happened: https://news.ycombinator.com/item?id=640213 https://news.ycombinator.com/item?id=640213
- ot 3y ago
  But in the case of HN the RNG was seeded by millisecond-granularity timestamps. This was universally considered bad already in 2009 (it would have been even in 1999). The Debian SSL key scandal happened in 2008. It is quite a leap to say "timestamp-based seeds are insecure, let's upgrade to lava lamps".
- WirelessGigabit 3y ago
  I'm reading that post, and while fascinating, I don't understand the entropy calculation. The digit chance is easy: For a single digit to appear one needs 1/3 * 1/10 = 1/30. For a single letter to appear one needs 1/3 * 1/26 = 1/78. But the bits of entropy throw me off. 26 + 26 + 10 = 62, which is 2^5.954. But that is for a uniform distribution. The writer states that it actually is 2^5.826, or 1/~56.7. I don't get how they to that number.
  - lukevalenta 3y ago
    Here's how you can get that entropy using the Shannon entropy equation from https://en.wikipedia.org/wiki/Entropy_(information_theory) https://en.wikipedia.org/wiki/Entropy_(information_theory). Like you said, the probability of any digit appearing is 1/30, and there are 10 digits. The probability of a lower- or upper- case letter appearing is 1/78, and there are 26+26 = 52 letters. Plugging that into the formula for Shannon entropy, we get this: - 10 * (1/30) * log_2(1/30) - 52 * (1/78) * log_2(1/78) =~ 5.826

thih9 3y ago

> also the shadows behind them. The alcove is lit by daylight, so the shadows cast by the swinging double-pendulums will change depending on how sunny it is or, more usually in London, how gloomy it is. Wouldn't that result in time based patterns matching the daytime/nighttime cycle? Then again, I guess this would only happen during continuous use over a number of days and perhaps that's not the use case.

H8crilA 3y ago
It still adds entropy. You're thinking of uniform entropy vs just entropy, but the former is easy-ish to produce from the latter, for example by using hash functions. Also, it's obviously a stunt - you are probably much better off measuring decay of trace amounts of natural radioactive isotopes. But it is not without merit.
- sgarland 3y ago
  > measuring decay of trace amounts of natural radioactive isotopes Which is precisely what CF does in their Singapore office.
Miraltar 3y ago
Yes there is a day/night cycle but it also depends too much on the weather on a ridiculously tiny scale to be realisticly predictable. And even if it was indeed predictable, it woud still add complexity to the prediction
quantified 3y ago
Capturing street-level headlights would add in more randomness at nighttime (so long as car and bus headlights remain a thing).

ggm 3y ago

Funny story I've told on hn before. Post office bond draws were using "ernie" which did randomness from thermionic valves. My dad helped build "icce" at imperial college in the 50s (something like the 5th public computer in the UK, noting many fine secret ones) and wanted to test their RNG. The post office refused to cooperate with a feed from Ernie, concerned imperial would detect non-randomness and undermine the integrity (or PR) of the premium bond draw.

tromp 3y ago

Unfortunately, I couldn't find any video of the cloudflare pendulums in action, but this other one [1] gives some idea, despite being human powered rather than battery powered. Btw, I imagine a camera pointed at a busy intersection with lots of pedestrian traffic (e.g. Times Square) to generate much more entropy. [1] https://www.youtube.com/watch?v=J85gpcjvqzs https://www.youtube.com/watch?v=J85gpcjvqzs

ano-ther 3y ago

Cool. I only knew about the lava lamps. How random are the pendulums and how are they powered? Pendulums are usually quite predictable. Or are these double pendulums? They add randomness by adding daylight. Could you use this for an attack (say, shining light from the outside during the night)?

luxcem 3y ago
These are double pendulums, it's a famous chaotic system. Even with a video frame it would be impossible to predict more than a few seconds of the system.

deleted 3y ago

[deleted]

throw0101b 3y ago

There's a (expired) patent on this: > A method for generating a pseudo-random numbers Initially, the state of a chaotic system is digitized to form a binary string. This binary string is then hashed to produce a second binary string. It is this second binary string which is used to seed a pseudo-random number generator. The output from the pseudo-random number generator may be used in forming a password or cryptographic key for use in a security system. * https://patents.google.com/patent/US5732138A/en https://patents.google.com/patent/US5732138A/en Originally filed by SGI in 1996. See also: * https://en.wikipedia.org/wiki/Lavarand https://en.wikipedia.org/wiki/Lavarand * https://www.cloudflare.com/en-ca/learning/ssl/lava-lamp-encryption/ https://www.cloudflare.com/en-ca/learning/ssl/lava-lamp-encr...

dschuetz 3y ago

"They’re not even connected to anything, but their perpetual swinging action is what keeps the internet safe(r) from hackers and protects your online transactions from fraudsters." That sentence triggers me on so many levels. Down below in the article it says that cameras are sampling the motion. So, ultimately the setup is connected to something, and it is being actively used as a quality source of entropy for cryptography. Brilliant, actually, but this is not what "keeps the internet safe". Strong encryption is a source of trust, nothing more. Proper security needs to rely on a few things that we have to assume to be unbreakable. Only then we can build on top of that. Sadly, even unbreakable encryption, if used incorrectly, can bring the whole thing down. I really don´t like articles that sensationalize "neat details" and by that distort the bigger picture.

epalm 3y ago

All that text and all those still images and no gif or short video showing the pendulums swinging!? ;)