Ask Lemmy
A Fediverse community for open-ended, thought provoking questions
Please don't post about US Politics.
Rules: (interactive)
1) Be nice and; have fun
Doxxing, trolling, sealioning, racism, and toxicity are not welcomed in AskLemmy. Remember what your mother said: if you can't say something nice, don't say anything at all. In addition, the site-wide Lemmy.world terms of service also apply here. Please familiarize yourself with them
2) All posts must end with a '?'
This is sort of like Jeopardy. Please phrase all post titles in the form of a proper question ending with ?
3) No spam
Please do not flood the community with nonsense. Actual suspected spammers will be banned on site. No astroturfing.
4) NSFW is okay, within reason
Just remember to tag posts with either a content warning or a [NSFW] tag. Overtly sexual posts are not allowed, please direct them to either [email protected] or [email protected].
NSFW comments should be restricted to posts tagged [NSFW].
5) This is not a support community.
It is not a place for 'how do I?', type questions.
If you have any questions regarding the site itself or would like to report a community, please direct them to Lemmy.world Support or email [email protected]. For other questions check our partnered communities list, or use the search function.
Reminder: The terms of service apply here too.
Partnered Communities:
Logo design credit goes to: tubbadu
view the rest of the comments
I'm sure they're smarter than me but my novice cryptographer brain doesn't understand this.
Isn't the string of numbers representing each pixel rather limited Aren't all those sections of the image that have lava lamps limited to values somewhere in the reddish/blueish spectrum? Isn't the gray background very non-random?
Apparently the camera is accessible in the lobby. They say people walking in front of the camera adds randomness. If I go there and hold a photo in front of the camera which I know the values of, doesn't that compromise everything?
To be fair their site says they take the lava lamp output and combine it with entropy from two servers and probably do a lot of other stuff before actually getting random numbers. But I don't get how the lava lamps photo setup is even close to being random
tried and failed to add image, so here a link: https://www.cloudflare.com/learning/ssl/lava-lamp-encryption/
If you hash the image with a strong algo, even a single different pixel should end up in a wildly different result.
But different doesn't mean random. An attacker could test every possibility for that pixel rather quickly. Even faster if you know a bunch of the pixels are, for example, a shade of gray.
I found an explanation where they bring up the issues I brought up as well as some others.
https://blog.cloudflare.com/lavarand-in-production-the-nitty-gritty-technical-details/
They give an example with one red value for a single pixel. They don't address my point that there are a lot of pixels like that one, maybe not all would be 50/50 like their example but a lot of pixels would have a much narrower range of values than randomness.
But they answer my second point about a hacker putting something in front of the camera with known values and that answer sort of takes care of everything. It boils down to, it doesn't matter because the lava lamp wall output is mixed with other sources that an attacker doesn't have access to.
Surely that can’t be uniform random though
But they’re just using it for a seed, so the output would be impossible to predict, but it feels like a checksum or something would approach a Gaussian distribution (the more numbers you add up, the more Gaussian it would be, since we know an image will have a mean and finite variance).
There are ways to get entropy out of non-uniform data in order to approach if not reach a uniform distribution.
A naïve, but surprisingly effective way to do this would be to put the data through a hashing algorithm of some sort.
Good hashing algorithms are specifically designed to make similar but non-identical inputs hash to values that appear unrelated.
Depending on the data source, there may be more efficient ways of getting an unpredictable sequence of bits out of it. e.g. for image data, an image difference from an average image may be more appealing than using the plain image, but I'm not sure whether that's legitimately "more random" or whether it just feels that way.