How Cloudflare uses lava lamps to encrypt the Internet

[Flengo]

Cloudflare has revealed an interesting way to ensure randomness when generating encryption keys -- lava lamps.
Cloudflare is a DNS service which also offers distributed denial-of-service (DDoS) attack protection, security, free SSL, encryption, and domain name services.
Encryption is a hot topic today. While law enforcement often clashes with technology providers over backdoors and strong encryption getting in the way of cracking criminal cases, online, encryption can keep communication, payments, and accounts secure.
Cloudflare is known for providing good standards of encryption, but it seems the secret is out -- this reputation is built in part on lava lamps.
As first reported by Gizmodo, YouTuber Tom Scott was able to visit the San Francisco headquarters of the company in order to gaze at a wall of 100 lava lamps -- most often found in child bedrooms -- which were mounted at the office.
Roughly 10 percent of the Internet's traffic passes through Cloudflare, and as the firm deals with so much encrypted traffic, many random numbers are required.
According to Nick Sullivan, Cloudfare's head of cryptography, this is where the lava lamps shine.
Instead of relying on code to generate these numbers for cryptographic purposes, the lava lamps and the random lights, swirling blobs and movements are recorded and photographs are taken.
This footage is then turned into a "stream of random, unpredictable bytes," according to Sullivan.
"This unpredictable data is what we use to help create the keys that encrypt the traffic that flows through Cloudflare's network," the executive added.
The information is then fed into a data center and Linux kernels which then seed random number generators used to create keys to encrypt traffic.
"Every time you take a picture with a camera there's going to be some sort of static, some sort of noise," Sullivan said. "So it's not only just where the bubbles are flowing through the lava lamp; it is the state of the air, the ambient light -- every tiny change impacts the stream of data."
This is not the only way that Cloudflare generates randomness. In the firm's London office, there is something called a "chaotic pendulum" which has three components that unpredictably twist and turn together, and in Singapore, the company uses a radioactive source.
Whether or not anything is truly random is up for debate, but the more random a cryptographic key, the more difficult it is to brute-force, guess, or crack -- especially if you use out-of-the-box ideas like lava lamp movements which are almost impossible to replicate.

 

[TheJokerz]

That is actually pretty freaken cool! Genius idea, that is one way to get randomness! Thanks for sharing this.

 

[Oxygen]

Never would I have thought that we could be protected by lava lamps.

 

[plat1098]

Very original and ingenious, hitching a ride on a random lava bubble. I love it.

 

[Flengo]

Also, here is the video Tom Scott did on this:

If you haven't checked out Tom Scott's videos before, you really should; most of them are on really interesting topics.

 

[codswollip]

Ahhhh... Cloudflare... that wonderous adventure that endlessly asks me to click on all the street signs, storefronts, cars... before allowing access to my sought after webpage.

 

[brambedkar59]

Really cool!
Random.org also does same thing except it uses atmospheric noise for it.

RANDOM.ORG uses radio receivers to pick up atmospheric noise, which is then used to generate random numbers. The radios are tuned between stations. A possible attack on the generator is therefore to broadcast on the frequencies that the RANDOM.ORG radios use in order to affect the generator. However, radio frequency attacks of this type would be difficult for a variety of reasons. First, the frequencies that the radios use are not published, so an attacker would have to broadcast across all frequencies of all bands used for FM and AMbroadcasting. Second, this is not an attack that can be launched from anywhere in the world, only reasonably close to the generator. RANDOM.ORG currently has radio receivers in several different countries, which would make it difficult to coordinate this type of attack. Third, if an attacker actually did succeed at broadcasting highly regular signals (e.g., perfect sine waves) at exactly the right frequencies from the right locations, then the RANDOM.ORG real-time statistics would pick up the drop in quality very rapidly. In particular, the Source Purity and Information Entropy tests would start failing dramatically, which would raise an alert

.