What do a wall of lava lamps in San Francisco, seismic activity in Chile and mouse clicks and network traffic bundled by a University in Lausanne have in common? The short answer is that they all furnish randomness for the newly formed “League of Entropy” – the new consortium behind eight “beacons” dedicated to producing unpredictable strings of long numbers for all; around the clock and around the world.
For those who already see more randomness than Jungian synchronicity in the world, this is not your common or garden variety randomness, but its high entropy cousin (entropy here being, crudely, a measure of unpredictability), manifested as 512-bit strings – typically 155-digit numbers – for public or private consumption that are demanded for causes as diverse as lotteries, elections and cryptography.
When it comes to attempting to predict the generation of these numbers, you might as well predict seismic activity in the Atacama fault zone, the clicks of a bored researcher or the movement of a globule of lava in a lamp in a Cloudflare lobby. And for those demanding a more comprehensive source of randomness than dev/urandom (which harvests environmental noise from device drivers and other sources into an entropy pool in the Linux kernel before spitting out random numbers when it is good and ready) the League of Entropy is likely to be highly welcome.
(With the common bible of a 1948 paper, A Mathematical Theory of Communication, this may be the geekiest superhero league yet).
The League of Entropy: More Randomness, Please
Who?
Participants in the League of Entropy, which launched today, include Cloudflare, Protocol Labs, Random UChile, École polytechnique fédérale de Lausanne, Kudelski Security, Nicolas Gailly, and EPFL researchers, Philipp Jovanovic and Ludovic Barman.
As Cloudflare’s Dina Kozlov explains: “Today, randomness beacons generate numbers for lotteries and election audits — and both affect the lives and fortunes of millions of people. Unfortunately, exploitation of the single point of origin of these beacons created dishonest results that benefited one adversary. To thwart exploitation efforts, Cloudflare and other randomness-beacon providers have joined forces to bring users a quorum of decentralized randomness beacons.”
“Afterall, eight globally distributed beacons are better and more trustworthy than one! Our founding members are contributing their individual high-entropy sources to provide a more random and unpredictable beacon to generate publicly verifiable random values.”
Why?
The need for public randomness is growing; some scientific simulation methods rely on random numbers; clinicians use them in drug trials to assign who gets a treatment or placebo; lotteries to select winners and some electronic voting systems to underpin audits.
Distributed ledgers too. As Kozlov notes: “In Ethereum, and in most chain-based proof-of-work algorithms, there must be a mechanism for random selection in the application layer of decentralized apps. One solution to prevent bias for random selection is to use a distributed randomness beacon that has collaborative validators generate the random value, a system like drand.” (Drand is a distributed randomness beacon daemon project led by Nicolas Gailly and written in Golang: it forms the underlying architecture of the League of Entropy’s global distributed randomness project).
What?
As Cloudflare notes in an earlier piece on its wall of lava lamps, the movement of which is used to generate randomness: “True randomness is any information learned through the measurement of a physical process. Its unpredictability relies either on the inherent unpredictability of the physical process being measured (e.g., the unpredictability of radioactive decay), or on the inaccuracy inherent in taking precise physical measurements (e.g., the inaccuracy of the least significant digits of some physical measurement such as the measurement of a CPU’s temperature or the timing of keystrokes on a keyboard).”
Read this: Cloudflare Announces WireGuard-Based “1.1.1.1” Mobile VPN
“Random values obtained in this manner are unpredictable even to the person measuring them (the person performing the measurement can’t predict what the value will be before they have performed the measurement), and thus are just as unpredictable to an external attacker. All randomness used in cryptographic algorithms begins life as true randomness obtained through physical measurements.
Randomness, in short, is harder to come by than many realise. That just changed. As the League Launches, these are its sources of randomness:
LavaRand: LavaRand sources her high entropy from Cloudflare’s wall of lava lamps at our San Francisco Headquarters. The unpredictable flow of “lava” inside the lamps is used as an input to a camera feed into a CSPRNG (Cryptographically Secure PseudoRandom Number Generator) that generates the random value.
EPFL’s URand: URand’s power comes from the local randomness generator present on every computer at /dev/urandom. The randomness input is collected from inputs such as keyboard presses, mouse clicks, network traffic, etc. URand bundles these random inputs to produce a continuous stream of randomness.
UChile: UChile extracts super verifiable randomness from five sources queried every minute. These sources include: seismic measurements of shakes and earthquakes in Chile; a stream from a local radio station; a selection of Twitter posts; data from the Ethereum blockchain; and their own off-the-shelf RNG card.
ChaChaRand: Kudelski Security’s ChaChaRand uses a CRNG (Cryptographic Random Number Generator) based on the ChaCha20 stream cipher, which expands a 256-bit key into 2^64 randomly accessible streams, each containing 2^64 randomly accessible 64-byte (512 bits) blocks.
Interplanetary Girl: Protocol Labs’ Interplanetary Girl uses the power of entropy to ensure protocol safety across space and time by using environmental noise and the Linux PRNG, supplemented by CPU-sourced randomness.
There are eight total collaborators in the League of Entropy. Users can learn the current round of randomness (or the system’s public key) by querying these beacons on the HTTP endpoints listed here.
https://drand.cloudflare.com:443
https://random.uchile.cl:8080
https://drand.cothority.net:7003
https://drand.kudelskisecurity.com:443
https://drand.lbarman.ch:443
https://drand.nikkolasg.xyz:8888
https://drand.protocol.ai:8080
https://drand.zerobyte.io:8888
As Cloudflare, which has helped drive the project, notes: “The intention is for each of these beacons to generate portions of randomness that can be combined into a single random string that is publicly verifiable. This functionality is achieved using threshold cryptography… The Cloudflare randomness beacon allows you to retrieve the latest random value from the League of Entropy using a simple HTTP request: https://drand.cloudflare.com/api/public.”
To learn more, see leagueofentropy.com
