An aquarium, a camera, and an experiment with randomness

Why I started

While working on my game, I needed random values for gameplay and started thinking about how they are generated. I also needed secret keys for server requests. Those two uses led me to look more closely at the difference between ordinary randomness and cryptographic randomness.

That research gave me an excuse to involve the fish tank at home. About twenty fish were swimming around in it, and I already had an old camera. Why not try turning the images into input for an experiment?

Random values are not all the same

A pseudorandom generator produces a sequence from its internal state. For gameplay, that can be useful. For secret keys, I would use a cryptographically secure pseudorandom number generator, or CSPRNG, supplied by the platform. In JavaScript, Math.random() is not intended for cryptography; the Web Crypto API provides cryptographic random values.

The video below was one of the things that got me interested in predictable random sequences.

Cloudflare's LavaRand setup also caught my attention. It uses camera footage as an additional source of entropy for cryptographic randomness. My aquarium experiment is much simpler.

The setup at home

I pointed a camera at the tank and placed a plasma globe behind it. The fish, changing light, and camera noise make the images vary. The plasma globe also gave me something moving in the background without leaving the aquarium light on all night. My electricity bill, and my wife, appreciated that part of the plan.

The camera can capture 30 frames per second, but I chose one frame per second for the experiment. I hash each image with SHA-256 to get a 64-character hexadecimal string. For each request, the prototype combines that string with a request ID and server time to produce a seed for the next step.

Changing the seed is not the same as changing the algorithm. A timestamp or counter is not a secret, and hashing an image does not create entropy that was absent from the input.

Try the demo

Pointing the camera at the ceiling still gave me changing hashes because the captured images differed slightly. Covering the camera produced repeated hashes in my test. It was a useful way to see how much the output depends on the input.

I also mapped some results to numbers from 1 to 10. The distribution looked reasonably even in that small sample, but that observation does not establish cryptographic security or prove the absence of bias.

What I took from it

As a home experiment, this was fun and helped me understand entropy more concretely. The fish got an unexpected role in a programming project.

For production secret keys and tokens, I would still use the platform's CSPRNG. This demo shows image-derived values; it is not a validated replacement for cryptographic key generation.