Cloudflare Uses Groovy Lava Lamps To Generate Encryption Keys For Beefy Internet Security

Most people have probably never been to Cloudflare's San Francisco office, but those who have been there would have noticed a large wall of lava lamps in the lobby. It is hard to miss—after all, it is not everyday that you come across dozens of lava lamps arranged on a set of shelves, not even in Spencer's where these groovy items are commonly found. What is not immediately obvious, however, is that the wall of lava lamps is not for decoration. Cloudfare is using them for encryption.

It sounds wild, but for all that computers are capable of doing, the are not that great at picking random numbers. That is a problem, because proper cryptography relies on the ability to generate random digits that are both unpredictable and kept secret from would-be attackers. And that is precisely where the wall of lava lamps, or Entropy Wall, comes into play.


"We can obtain randomness that is unpredictable using one of two approaches. The first produces true randomness, while the second produces pseudorandomness. True randomness is any information learned through the measurement of a physical process. Its unpredictability relies either on the inherent unpredictability of the physical process being measured (e.g., the unpredictability of radioactive decay), or on the inaccuracy inherent in taking precise physical measurements (e.g., the inaccuracy of the least significant digits of some physical measurement such as the measurement of a CPU’s temperature or the timing of keystrokes on a keyboard)," Cloudflare explains.

Granted, the probability is very low that someone would be able predict or modify the output of Cloudflare's production machines, but it is not impossible, and attackers to make efforts to exactly that. By using lava lamps, Cloudflare has created an additional entropy source with numbers that are based on the flow of the liquid, which is "very unpredictable." Called LavaRand, the lava lamp system serves as a secondary source for Cloudflare's production servers.

There are cameras that capture the swirling liquid and colors of the lava lamp wall. Also at play is the sate of the air and ambient lighting, both of which can introduce noise, which only helps the cause. The footage from the cameras is turned into a stream of random, unpredictable bytes, based on everything that is going on.


"Even if we conservatively assume that the camera has a resolution of 100x100 pixels (of course it’s actually much higher) and that an attacker can guess the value of any pixel of that image to within one bit of precision (e.g., they know that a particular pixel has a red value of either 123 or 124, but they aren’t sure which it is), then the total amount of entropy produced by the image is 100x100x3 = 30,000 bits (the x3 is because each pixel comprises three values - a red, a green, and a blue channel). This is orders of magnitude more entropy than we need," Cloudflare says.

We'll never look at lava lamps the same way again.