A wall of lava lamps helps encrypt the internet • Hacker News Board

Re: A wall of lava lamps helps encrypt the internet

#101

Post by kvakil » Sun, Dec 31, 2017, 9:06 PM UTC

foodstances wrote: post #76

bhhaskin wrote: post #74

Earlier quoted context omitted.

WARNING: DO NOT USE BEACON GENERATED VALUES AS SECRET CRYPTOGRAPHIC KEYS. So probably not a good idea.

Using the values directly is not the same thing as feeding the values into a RNG.

No, the reason you aren't supposed to use it to generate cryptographic keys is because it's public: so it effectively provides no (or nearly no) entropy. It's the same reason you shouldn't use the current time as a seed for a PRNG.

NIST Beacon is more intended for things like lottery drawings, where you want to prove that you're generating the random numbers in an unbiased manner.

Re: A wall of lava lamps helps encrypt the internet

#102

Post by notatoad » Sun, Dec 31, 2017, 9:34 PM UTC

jstanley wrote: post #97

meej wrote: post #91

Earlier quoted context omitted.

This is addressed in the last paragraph of the article.

Not really. They say that having random (ha) people in the picture improves the entropy, but they don't address the possibility of people using it to gain information about Cloudflare's entropy pool.

presumably if you set up camp with a camera in their lava lamp room, somebody is going to raise some eyebrows.

Re: A wall of lava lamps helps encrypt the internet

#103

Post by azinman2 » Sun, Dec 31, 2017, 9:35 PM UTC

gregschlom wrote: post #83

Sir_Cmpwn wrote: post #51

Earlier quoted context omitted.

I know I'm nitpicking here - it's a private art installation.

Anyone can visit it though, according to the article.

A private collection doesn’t mean the outside world isn’t allowed to visit. It just means it’s not owned by a public institution.

Re: A wall of lava lamps helps encrypt the internet

#104

Post by stouset » Sun, Dec 31, 2017, 10:06 PM UTC

jstanley wrote: post #87

Operyl wrote: post #75

Earlier quoted context omitted.

You’d have to get a picture in the exact same angle, which is unlikely.

It leaks information at any angle.

Doesn’t really matter. With modern CSPRNGs, even if one input is compromised you’re still as strong as the remaining entropy (as long as those sources are statistically independent from the compromised one).

If this was the only source of randomness it might be a problem, but if they’re `cat`ting it into `/dev/random` as an external source, it can only really improve things. Even if someone were to compromise the feed from the office to the datacenter, it wouldn’t matter since they’d have to know the internal RNG state in order to “negate” its randomness with the lava lamp feed. If they have that, you’re already lost anyway.

Re: A wall of lava lamps helps encrypt the internet

#105

Post by mbesto » Sun, Dec 31, 2017, 10:10 PM UTC

tptacek wrote: post #90

mbesto wrote: post #85

Earlier quoted context omitted.

Yes, the article and the form in which it is exhibited is a PR stunt. However, that doesn't mean it's not practical in any capacity....if you locked this away in a room and never told anyone, it would still hold a utility for the company. Are there alternatives? Sure, but again that doesn't make it impractical. It's also a fairly novel way to explain to people that `random()` isn't truly random.

It is unlikely that it holds any utility, or that it is practical in any capacity.

I think you're confusing the medium with which this achieved versus it's utility.

Surely you're not suggesting PRNG/DRBG isn't completely safe from hacking?

Re: A wall of lava lamps helps encrypt the internet

#106

Post by stouset » Sun, Dec 31, 2017, 10:16 PM UTC

BurningFrog wrote: post #45

samuel wrote: post #17

I might be prejudiced, but this looks like a big PR stunt/done for the cool factor kind of thing. Aren't there simpler/saner alternatives for getting good randomness?

It looks quite simple and sane to me. A big plus over the alternatives I see mentioned is that you can easily see if it's working right now. What bothers me is that at least 80% of the wall is unrandomized wall and lampfeet.

Doesn’t matter. As a simplistic example, if you send the image through SHA-256 it doesn’t matter how many bits are predictable — as long as there are at least 256 bits of entropy in the image, the output will have those 256 bits of entropy smeared across the output evenly (barring breaks in the hash function itself).

Re: A wall of lava lamps helps encrypt the internet

#107

Post by tptacek » Sun, Dec 31, 2017, 10:40 PM UTC

mbesto wrote: post #105

tptacek wrote: post #90

Earlier quoted context omitted.

It is unlikely that it holds any utility, or that it is practical in any capacity.

I think you're confusing the medium with which this achieved versus it's utility. Surely you're not suggesting PRNG/DRBG isn't completely safe from hacking?

I don't even understand this question. Can you reword it?

Re: A wall of lava lamps helps encrypt the internet

#108

Post by scoggs » Sun, Dec 31, 2017, 10:52 PM UTC

jlgaddis wrote: post #69

oppositelock wrote: post #36

We did this exact thing at SGI 20 years ago. https://en.wikipedia.org/wiki/Lavarand I wonder if Cloudflare was inspired by that.

> We're not the first ones to do this. Our LavaRand system was inspired by a similar system first proposed and built by Silicon Graphics and patented in 1996 (the patent has since expired). -- https://blog.cloudflare.com/randomness-101-lavarand-in-produ...

I know that people patent things for various reasons but would people truly expect the holder of that patent to litigate against another company using that method to ensure "more true" randomness in whatever application they were using? I, personally, imagine the patent holder would be glad to see others using their method to ensure true randomness so long as they were using the technology for anything other than evil.

Re: A wall of lava lamps helps encrypt the internet

#109

Post by dboreham » Sun, Dec 31, 2017, 10:54 PM UTC

bhhaskin wrote: post #74

JoeDaDude wrote: post #54

If you can't afford that many lava lamps, NIST provides an alternative, free service: https://beacon.nist.gov/home

WARNING: DO NOT USE BEACON GENERATED VALUES AS SECRET CRYPTOGRAPHIC KEYS. So probably not a good idea.

For a few seconds I was thinking...Bacon.

Re: A wall of lava lamps helps encrypt the internet

#110

Post by gerdesj » Sun, Dec 31, 2017, 10:55 PM UTC

notatoad wrote: post #102

jstanley wrote: post #97

Earlier quoted context omitted.

Not really. They say that having random (ha) people in the picture improves the entropy, but they don't address the possibility of people using it to gain information about Cloudflare's entropy pool.

presumably if you set up camp with a camera in their lava lamp room, somebody is going to raise some eyebrows.

Not only that but your cameras are going to have to be precisely in the same place as theirs, with an identical view and be identical models with identical sensor variation, dust on lens etc etc etc ad nauseam.

As you say, that might raise a few eyebrows.