How Cloudflare uses lava lamps to encrypt the Internet

Flengo

Level 2
Thread author
Verified
Oct 19, 2017
52
Cloudflare has revealed an interesting way to ensure randomness when generating encryption keys -- lava lamps.
Cloudflare is a DNS service which also offers distributed denial-of-service (DDoS) attack protection, security, free SSL, encryption, and domain name services.
Encryption is a hot topic today. While law enforcement often clashes with technology providers over backdoors and strong encryption getting in the way of cracking criminal cases, online, encryption can keep communication, payments, and accounts secure.
Cloudflare is known for providing good standards of encryption, but it seems the secret is out -- this reputation is built in part on lava lamps.
As first reported by Gizmodo, YouTuber Tom Scott was able to visit the San Francisco headquarters of the company in order to gaze at a wall of 100 lava lamps -- most often found in child bedrooms -- which were mounted at the office.
Roughly 10 percent of the Internet's traffic passes through Cloudflare, and as the firm deals with so much encrypted traffic, many random numbers are required.
According to Nick Sullivan, Cloudfare's head of cryptography, this is where the lava lamps shine.
Instead of relying on code to generate these numbers for cryptographic purposes, the lava lamps and the random lights, swirling blobs and movements are recorded and photographs are taken.
This footage is then turned into a "stream of random, unpredictable bytes," according to Sullivan.
"This unpredictable data is what we use to help create the keys that encrypt the traffic that flows through Cloudflare's network," the executive added.
The information is then fed into a data center and Linux kernels which then seed random number generators used to create keys to encrypt traffic.
"Every time you take a picture with a camera there's going to be some sort of static, some sort of noise," Sullivan said. "So it's not only just where the bubbles are flowing through the lava lamp; it is the state of the air, the ambient light -- every tiny change impacts the stream of data."
This is not the only way that Cloudflare generates randomness. In the firm's London office, there is something called a "chaotic pendulum" which has three components that unpredictably twist and turn together, and in Singapore, the company uses a radioactive source.
Whether or not anything is truly random is up for debate, but the more random a cryptographic key, the more difficult it is to brute-force, guess, or crack -- especially if you use out-of-the-box ideas like lava lamp movements which are almost impossible to replicate.
 

brambedkar59

Level 29
Verified
Top Poster
Well-known
Apr 16, 2017
1,869
Really cool!
Random.org also does same thing except it uses atmospheric noise for it.
RANDOM.ORG uses radio receivers to pick up atmospheric noise, which is then used to generate random numbers. The radios are tuned between stations. A possible attack on the generator is therefore to broadcast on the frequencies that the RANDOM.ORG radios use in order to affect the generator. However, radio frequency attacks of this type would be difficult for a variety of reasons. First, the frequencies that the radios use are not published, so an attacker would have to broadcast across all frequencies of all bands used for FM and AMbroadcasting. Second, this is not an attack that can be launched from anywhere in the world, only reasonably close to the generator. RANDOM.ORG currently has radio receivers in several different countries, which would make it difficult to coordinate this type of attack. Third, if an attacker actually did succeed at broadcasting highly regular signals (e.g., perfect sine waves) at exactly the right frequencies from the right locations, then the RANDOM.ORG real-time statistics would pick up the drop in quality very rapidly. In particular, the Source Purity and Information Entropy tests would start failing dramatically, which would raise an alert
.
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top