TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

Physical Entropy Sources for Randomness Generation

2 posts · Nov 2017 – Mar 2025

What this trail covers

Cloudflare has expanded its LavaRand system to incorporate new physical sources of entropy from its global offices, including wave machines in Lisbon, double pendulums in London, suspended rainbows in Austin, and lava lamps in San Francisco. These new sources, captured via cameras and processed into hashes, contribute to seeding Cryptographically Secure Pseudorandom Number Generators (CSPRNGs) for cryptographic security across Cloudflare's global infrastructure. The system makes this harnessed chaos available via an internal API, enabling developers to use pure randomness for various applications, including Cloudflare Workers and the drand API.

All Cloudflare trails
  1. Chaos in Cloudflare’s Lisbon office: securing the Internet with wave motionThis post details the addition of 50 custom-built wave machines in Cloudflare's Lisbon office as a new source of entropy for the LavaRand system. It describes the engineering challenges in designing and manufacturing these machines for 24/7 operation, the collaboration with an artisan, and the technical specifications of the machines. The post also reiterates the core mechanism of LavaRand: capturing chaotic physical movement via cameras, processing images into hashes, and using these as input for a Key Derivation Function (KDF) to generate new seeds for CSPRNGs. It highlights the integration of this new entropy source into Cloudflare Workers and the drand API.
  2. Harnessing chaos in Cloudflare officesIntroduced new physical entropy sources (double pendulums, rainbow mobiles) to the LavaRand system, expanding beyond lava lamps. Detailed the process of capturing images of these chaotic systems, hashing them into random bytes, and using them to seed CSPRNGs. Discussed the potential applications of this publicly trusted randomness, including timelock encryption and verifiable random draws.
  3. LavaRand in Production: The Nitty-Gritty Technical DetailsThis post details the technical implementation of Cloudflare's LavaRand system, which uses a wall of lava lamps as a physical entropy source for cryptographic randomness. It explains the concepts of true randomness vs. pseudorandomness, the importance of CSPRNGs, and how operating systems manage entropy pools. The LavaRand design involves a camera capturing the lava lamp's visual output, a server mixing this with its own entropy, and a production service further combining it with local entropy sources. The post also outlines potential security attacks against the system and the defense-in-depth strategy employed.