5 ms·

The Futility of Lava Lamps: What Random Means

77 points by birdculture 6mo ago

geerlingguy 5mo ago
I don't remember their initial post about the lava lamps, but I had assumed that was a marketing gimmick more than anything... a neat visual way to convey what entropy is in a way normal humans can comprehend. It's certainly not a scalable solution for entropy, and there are so many ways for it to fail as a sole source, as well.
- dheera 5mo ago
  I'm dead sure they aren't using them for anything. This is SF. If they were really used for anything, a random dude in a black hoodie and white SUV can just smash the glass and take down the internet, and the SF police wouldn't do a thing.
  - kgeist 5mo ago
    If you look up videos on YouTube, you'll see that they allow visitors to stand between the lava lamps and the cameras (sometimes even entire groups!). And I've always wondered: doesn't that reduce entropy, since people usually wear monotone clothing? And if the lamps are so important, why would they allow that? Maybe the lamps do contribute something, but their system most likely already generates enough entropy with or without the lamps...
    - hekkle 5mo ago
      It also depends on how often samples are taken. If it only occurs every hour, Fred in his white shirt is highly unlikely to be standing in the exact same spot still. Remember, these are only seed values, a pseudorandom number generator will run indefinitely, but from what I understand, CF re-runs these periodically with different seed values, to stop people finding the pattern.
  - AlotOfReading 5mo ago
    Smashing the glass wouldn't make it less effective. The sensor itself has noise, and the camera output is fed into an HMAC with a key based on the current nanosecond before being combined with a traditional entropy source before it ever went anywhere. Even then, it was only used as a seed for the entropy pool on the actual server.
    - dheera 5mo ago
      > and the camera output is fed into snip snip ?
      - TZubiri 5mo ago
        If your attack vector is breaking and entering, that's a pretty effective cybersecurity mechanism. But even if it happened, this is one of many additive entropy mechanism, removing or controlling only one source would not be sufficient for any attack.
      - AlotOfReading 5mo ago
        You still wouldn't be about to distinguish the output from noise unless you know the key or you've broken the cryptography, even if you know every bit of the message. Isn't it neat? And yes, as the other comment points out it's only one source among multiple.
  - Gh0stRAT 5mo ago
    It's been quite a while since I first heard about it, but IIRC they were seeding cryptographic PRNGs with entropy from multiple sources, one of which was allegedly this art installation. Seeding PRNGs with sufficiently unpredictable data was a real security concern for a while. New cloud instances have a small entropy pool space for attackers to enumerate due to lack of a real source of randomness. (See the Debian/OpenSSL issue for what can happen when your entropy pool is too small/predictable) One fun fact about XOR is that anything XOR'd with a uniform random distribution results in a uniform random distribution, so there isn't any harm in mixing additional non-attacker-controlled entropy sources in as long as at least one of them is sufficiently unpredictable. The lava lamps provide a potentially hard-to-predict source of entropy for this, but if it's not available then it certainly doesn't "take down the internet". They'll still use packet arrival timing, interrupt timing, etc to seed their CSPRNGs.
- atoav 5mo ago
  If you want entropy ot is trivial to construct a white noise source that gives you flat white noise over a range of a few MHz using the reverse avalanche breakdown of a zener diode. The harder part is then reading that out in a way that doesn't introduce bias and makes use of the bandwidth, but if tou want random it is right there in electronic quantum processes.
aaron695 5mo ago
[dead]
JKCalhoun 5mo ago
With a one-time pad being, as I understand it, the only really good encryption, I am surprised there is not a market for pairs of matched hard drives—the pair having the same "one time pad" stored on them (how you generate those numbers is left as an exercise for the company marketing them). A simple app could be used by parties on both ends of the message—an app that relies on an associated drive to act as the pad. If you become aware that one of the two matched drives has been compromised (stolen perhaps by an outside party), you destroy its partner. (Perhaps too you can design the drive in such a way as to make it non-trivial to copy—you more or less need possession of the drive itself. That makes it unlikely for there to be a 3rd drive the two parties are unaware of.)
- marshray 5mo ago
  I've heard it said that such systems may be used by militaries, where they have an organizational structure naturally-suited to large keystream distribution. Unlike e-commerce, it's no problem to physically send the proverbial officer handcuffed to a briefcase to the nuclear submarine before it submerges for 6 months. Also the messages to be secured are, um, short and... infrequent.
  - JKCalhoun 5mo ago
    I kind of assumed the "customer" here would in fact be government agencies…
- AgentME 5mo ago
  Conventional symmetric cryptography is already very secure and easy, even in the face of future threats like quantum computers. (Asymmetric cryptography is the type of cryptography that cryptographers spend more time worrying about.) Not that you should do it yourself, but it's relatively easy to whip up a secure symmetric encryption scheme if you have a hash function that meets certain basic security properties (which even hash functions with known weaknesses like MD5 and SHA-1 still meet!). The only real hard part of symmetric cryptography is key management (making sure both ends of each conversation have the matching keys ready to use), and one time pads only make that harder by making the keys very large and stateful. I think there are few use-cases where the potentially increased security makes up for the more difficult key management (especially if it means you're also swearing off all asymmetric cryptography).
Retr0id 5mo ago
> And if it is broken… then you’re screwed, sorry. See, both your encryption and your CSPRNG relies on a cipher. If either is broken, then so is your whole system. Not necessarily. The CSPRNG state could in theory be leaked via sidechannels. Your cipher key could be leaked via sidechannels too, but symmetric encryption keys tend to be shorter lived.
- Retr0id 5mo ago
  Another "why on earth are HN users downvoting this?" moment...
marshray 5mo ago
As far as cryptographic security theater goes, it's hard for me to get angry about lava lamps.
- danparsonson 5mo ago
  They're very calming
the_red_mist 5mo ago
article has a section dedicated to "how to obtain starting seed" with a list of examples and somehow fails to include wall of lava lamps in said list of examples
- p1necone 5mo ago
  They kind of do if you play 6 degrees of wikipedia... The 'hardware random number generator' link in the list in the article goes to https://en.wikipedia.org/wiki/Hardware_random_number_generator https://en.wikipedia.org/wiki/Hardware_random_number_generat..., and then in the see also section on that article there's a link to the page for a different lava lamp wall, with a photo of the cloudflare one: https://en.wikipedia.org/wiki/Lavarand https://en.wikipedia.org/wiki/Lavarand
- jrowen 5mo ago
  [dead]
tptacek 5mo ago
They don't actually do anything, but I think it's hard to tell a story where they make things worse, given that Cloudflare is a cryptographically competent org. It's just getting mixed into the already-secure conventional CSPRNG they're using (almost certainly: just the Linux kernel RNG).
- Terr_ 5mo ago
  > I think it's hard to tell a story where they make things worse [...] mixed into the [...] CSPRNG I think it's easy to tell a story where it's slightly worse. I mean, for any budget of storage bits and CPU cycles, any "inferior" random data necessarily pushes out "better" stuff.
  - tptacek 5mo ago
    It's all hashed together. The whole LRNG design assumes most of its inputs are structured or poorly randomized.
    - Terr_ 5mo ago
      I'm not sure what you mean, deterministic hashing does not create more entropy than you started with. Lower-quality inputs means lower-quality results. You only want to use low-quality sources if the good stuff is too scarce or expensive. Imagine that tomorrow some reaction caused all those lava-lamps to cloud over into pure, constant, and uniform milky white. What effect would that have? It would make the system at least somewhat less secure, no matter how many hash functions were already scattered around the place.
      - tptacek 5mo ago
        In the immortal words of a cryptographic folk hero, if H(x, y) produces a good random number, H(x, y, z) will produce a number at least as good.
        Terr_ 5mo ago
deleted 5mo ago
[deleted]
__MatrixMan__ 5mo ago
Nothing is random enough for an arbitrary audience. There's always the possibility that some alien spaceship will land and some creature will emerge, take a glance at your RNG, and say: "next one's 6598489811, try it" and they'll be right. We can only say that something is random enough given a certain audience's beliefs about what kind of predictions are possible. If it takes lava lamps to convince that audience, well then ok.
- NuclearPM 5mo ago
  Why would beliefs matter?
  - mock-possum 5mo ago
    Because the judgment of what counts as ‘enough’ is tied to beliefs
  - __MatrixMan__ 5mo ago
    Beliefs drive our actions, even when they're about unknowable things. Whether or not something is random is unknowable, so belief is all we have. We may discover tomorrow that events which we previously thought were random, like the timing of a single atom's radioactive decay, are actually perfectly predictable. If we believe that such a discovery is unlikely then we might trust radioactive decay as an entropy source, and if we believe its very likely then we probably won't.
glitchc 5mo ago
I suspect the author hasn't heard of physical unclonable functions.
ticulatedspline 5mo ago
Lotta speculation about it's value but seems cloudflare does legitimately use this source. https://blog.cloudflare.com/lavarand-in-production-the-nitty-gritty-technical-details/ https://blog.cloudflare.com/lavarand-in-production-the-nitty... They even mention it's origins in Lavarand (and LavaRand) the former which has an actual patent: https://patents.google.com/patent/US5732138A/en https://patents.google.com/patent/US5732138A/en Yes there's a bit of theater here, and they admit to using the sensor noise as well, it's also not their only source of physical entropy. While you could do just as much with less interesting sources the wall of lava lamps is a perfectly cromulent source of randomness, also is kinda fun.
- delichon 5mo ago
  Lava lamp entropy embiggens us all.
dherls 5mo ago
Seems needlessly angry about what is ultimately a decent if imperfect source of entropy, and a good illustrative example for the general public
jbritton 5mo ago
The very end of the article says “They can keep them for decoration but servers must generate their own random numbers.” I thought the lava lamps were for this purpose.
ge96 5mo ago
How about electrodes attached to a mushroom
teravor 5mo ago
there is probably more entropy coming from the sensor noise of the camera facing the wall of lava lamps than in the random flow inside them. if you block the camera you will get even more entropy.
bambax 5mo ago
Obligatory Dilbert reference: https://www.americanscientist.org/sites/americanscientist.org/files/20144141249210337-2014-05TechnologueFp170.jpg https://www.americanscientist.org/sites/americanscientist.or...
rini17 5mo ago
> And before you go on objecting that a physical true RNG remains better than a could-theoretically-be-broken CSPRNG, understand that your random output often must have no detectable bias to be secure. That means a distribution so uniform you can’t detect a bias even after analysing 2^64 samples. Why not, actually? I would think simple and trivially auditable HW RNG with, say, only 0.9 bits of entropy per output bit (raw! no whitening) is preferable to "perfect" but fragile algorithm. Anything that requires the randomness in practice has enough overhead so that the 90% good entropy is not a problem. Failures caused by wrong assumptions and complications are.

77 points by birdculture 6mo ago

I don't remember their initial post about the lava lamps, but I had assumed that was a marketing gimmick more than anything... a neat visual way to convey what entropy is in a way normal humans can comprehend. It's certainly not a scalable solution for entropy, and there are so many ways for it to fail as a sole source, as well.

dheera 5mo ago
I'm dead sure they aren't using them for anything. This is SF. If they were really used for anything, a random dude in a black hoodie and white SUV can just smash the glass and take down the internet, and the SF police wouldn't do a thing.
- kgeist 5mo ago
  If you look up videos on YouTube, you'll see that they allow visitors to stand between the lava lamps and the cameras (sometimes even entire groups!). And I've always wondered: doesn't that reduce entropy, since people usually wear monotone clothing? And if the lamps are so important, why would they allow that? Maybe the lamps do contribute something, but their system most likely already generates enough entropy with or without the lamps...
  - hekkle 5mo ago
    It also depends on how often samples are taken. If it only occurs every hour, Fred in his white shirt is highly unlikely to be standing in the exact same spot still. Remember, these are only seed values, a pseudorandom number generator will run indefinitely, but from what I understand, CF re-runs these periodically with different seed values, to stop people finding the pattern.
- AlotOfReading 5mo ago
  Smashing the glass wouldn't make it less effective. The sensor itself has noise, and the camera output is fed into an HMAC with a key based on the current nanosecond before being combined with a traditional entropy source before it ever went anywhere. Even then, it was only used as a seed for the entropy pool on the actual server.
  - dheera 5mo ago
    > and the camera output is fed into snip snip ?
    - TZubiri 5mo ago
      If your attack vector is breaking and entering, that's a pretty effective cybersecurity mechanism. But even if it happened, this is one of many additive entropy mechanism, removing or controlling only one source would not be sufficient for any attack.
    - AlotOfReading 5mo ago
      You still wouldn't be about to distinguish the output from noise unless you know the key or you've broken the cryptography, even if you know every bit of the message. Isn't it neat? And yes, as the other comment points out it's only one source among multiple.
- Gh0stRAT 5mo ago
  It's been quite a while since I first heard about it, but IIRC they were seeding cryptographic PRNGs with entropy from multiple sources, one of which was allegedly this art installation. Seeding PRNGs with sufficiently unpredictable data was a real security concern for a while. New cloud instances have a small entropy pool space for attackers to enumerate due to lack of a real source of randomness. (See the Debian/OpenSSL issue for what can happen when your entropy pool is too small/predictable) One fun fact about XOR is that anything XOR'd with a uniform random distribution results in a uniform random distribution, so there isn't any harm in mixing additional non-attacker-controlled entropy sources in as long as at least one of them is sufficiently unpredictable. The lava lamps provide a potentially hard-to-predict source of entropy for this, but if it's not available then it certainly doesn't "take down the internet". They'll still use packet arrival timing, interrupt timing, etc to seed their CSPRNGs.
atoav 5mo ago
If you want entropy ot is trivial to construct a white noise source that gives you flat white noise over a range of a few MHz using the reverse avalanche breakdown of a zener diode. The harder part is then reading that out in a way that doesn't introduce bias and makes use of the bandwidth, but if tou want random it is right there in electronic quantum processes.

aaron695 5mo ago

[dead]

JKCalhoun 5mo ago

With a one-time pad being, as I understand it, the only really good encryption, I am surprised there is not a market for pairs of matched hard drives—the pair having the same "one time pad" stored on them (how you generate those numbers is left as an exercise for the company marketing them). A simple app could be used by parties on both ends of the message—an app that relies on an associated drive to act as the pad. If you become aware that one of the two matched drives has been compromised (stolen perhaps by an outside party), you destroy its partner. (Perhaps too you can design the drive in such a way as to make it non-trivial to copy—you more or less need possession of the drive itself. That makes it unlikely for there to be a 3rd drive the two parties are unaware of.)

marshray 5mo ago
I've heard it said that such systems may be used by militaries, where they have an organizational structure naturally-suited to large keystream distribution. Unlike e-commerce, it's no problem to physically send the proverbial officer handcuffed to a briefcase to the nuclear submarine before it submerges for 6 months. Also the messages to be secured are, um, short and... infrequent.
- JKCalhoun 5mo ago
  I kind of assumed the "customer" here would in fact be government agencies…
AgentME 5mo ago
Conventional symmetric cryptography is already very secure and easy, even in the face of future threats like quantum computers. (Asymmetric cryptography is the type of cryptography that cryptographers spend more time worrying about.) Not that you should do it yourself, but it's relatively easy to whip up a secure symmetric encryption scheme if you have a hash function that meets certain basic security properties (which even hash functions with known weaknesses like MD5 and SHA-1 still meet!). The only real hard part of symmetric cryptography is key management (making sure both ends of each conversation have the matching keys ready to use), and one time pads only make that harder by making the keys very large and stateful. I think there are few use-cases where the potentially increased security makes up for the more difficult key management (especially if it means you're also swearing off all asymmetric cryptography).

Retr0id 5mo ago

> And if it is broken… then you’re screwed, sorry. See, both your encryption and your CSPRNG relies on a cipher. If either is broken, then so is your whole system. Not necessarily. The CSPRNG state could in theory be leaked via sidechannels. Your cipher key could be leaked via sidechannels too, but symmetric encryption keys tend to be shorter lived.

Retr0id 5mo ago
Another "why on earth are HN users downvoting this?" moment...

marshray 5mo ago

As far as cryptographic security theater goes, it's hard for me to get angry about lava lamps.

danparsonson 5mo ago
They're very calming

the_red_mist 5mo ago

article has a section dedicated to "how to obtain starting seed" with a list of examples and somehow fails to include wall of lava lamps in said list of examples

p1necone 5mo ago
They kind of do if you play 6 degrees of wikipedia... The 'hardware random number generator' link in the list in the article goes to https://en.wikipedia.org/wiki/Hardware_random_number_generator https://en.wikipedia.org/wiki/Hardware_random_number_generat..., and then in the see also section on that article there's a link to the page for a different lava lamp wall, with a photo of the cloudflare one: https://en.wikipedia.org/wiki/Lavarand https://en.wikipedia.org/wiki/Lavarand
jrowen 5mo ago
[dead]

tptacek 5mo ago

They don't actually do anything, but I think it's hard to tell a story where they make things worse, given that Cloudflare is a cryptographically competent org. It's just getting mixed into the already-secure conventional CSPRNG they're using (almost certainly: just the Linux kernel RNG).

Terr_ 5mo ago
> I think it's hard to tell a story where they make things worse [...] mixed into the [...] CSPRNG I think it's easy to tell a story where it's slightly worse. I mean, for any budget of storage bits and CPU cycles, any "inferior" random data necessarily pushes out "better" stuff.
- tptacek 5mo ago
  It's all hashed together. The whole LRNG design assumes most of its inputs are structured or poorly randomized.
  - Terr_ 5mo ago
    I'm not sure what you mean, deterministic hashing does not create more entropy than you started with. Lower-quality inputs means lower-quality results. You only want to use low-quality sources if the good stuff is too scarce or expensive. Imagine that tomorrow some reaction caused all those lava-lamps to cloud over into pure, constant, and uniform milky white. What effect would that have? It would make the system at least somewhat less secure, no matter how many hash functions were already scattered around the place.
    - tptacek 5mo ago
      In the immortal words of a cryptographic folk hero, if H(x, y) produces a good random number, H(x, y, z) will produce a number at least as good.
      - Terr_ 5mo ago

deleted 5mo ago

[deleted]

__MatrixMan__ 5mo ago

Nothing is random enough for an arbitrary audience. There's always the possibility that some alien spaceship will land and some creature will emerge, take a glance at your RNG, and say: "next one's 6598489811, try it" and they'll be right. We can only say that something is random enough given a certain audience's beliefs about what kind of predictions are possible. If it takes lava lamps to convince that audience, well then ok.

NuclearPM 5mo ago
Why would beliefs matter?
- mock-possum 5mo ago
  Because the judgment of what counts as ‘enough’ is tied to beliefs
- __MatrixMan__ 5mo ago
  Beliefs drive our actions, even when they're about unknowable things. Whether or not something is random is unknowable, so belief is all we have. We may discover tomorrow that events which we previously thought were random, like the timing of a single atom's radioactive decay, are actually perfectly predictable. If we believe that such a discovery is unlikely then we might trust radioactive decay as an entropy source, and if we believe its very likely then we probably won't.

glitchc 5mo ago

I suspect the author hasn't heard of physical unclonable functions.

ticulatedspline 5mo ago

Lotta speculation about it's value but seems cloudflare does legitimately use this source. https://blog.cloudflare.com/lavarand-in-production-the-nitty-gritty-technical-details/ https://blog.cloudflare.com/lavarand-in-production-the-nitty... They even mention it's origins in Lavarand (and LavaRand) the former which has an actual patent: https://patents.google.com/patent/US5732138A/en https://patents.google.com/patent/US5732138A/en Yes there's a bit of theater here, and they admit to using the sensor noise as well, it's also not their only source of physical entropy. While you could do just as much with less interesting sources the wall of lava lamps is a perfectly cromulent source of randomness, also is kinda fun.

delichon 5mo ago
Lava lamp entropy embiggens us all.

dherls 5mo ago

Seems needlessly angry about what is ultimately a decent if imperfect source of entropy, and a good illustrative example for the general public

jbritton 5mo ago

The very end of the article says “They can keep them for decoration but servers must generate their own random numbers.” I thought the lava lamps were for this purpose.

ge96 5mo ago

How about electrodes attached to a mushroom

teravor 5mo ago

there is probably more entropy coming from the sensor noise of the camera facing the wall of lava lamps than in the random flow inside them. if you block the camera you will get even more entropy.

bambax 5mo ago

Obligatory Dilbert reference: https://www.americanscientist.org/sites/americanscientist.org/files/20144141249210337-2014-05TechnologueFp170.jpg https://www.americanscientist.org/sites/americanscientist.or...

rini17 5mo ago

> And before you go on objecting that a physical true RNG remains better than a could-theoretically-be-broken CSPRNG, understand that your random output often must have no detectable bias to be secure. That means a distribution so uniform you can’t detect a bias even after analysing 2^64 samples. Why not, actually? I would think simple and trivially auditable HW RNG with, say, only 0.9 bits of entropy per output bit (raw! no whitening) is preferable to "perfect" but fragile algorithm. Anything that requires the randomness in practice has enough overhead so that the 90% good entropy is not a problem. Failures caused by wrong assumptions and complications are.