Encryption basics: locks, keys and secrets
Networking series · Part 3 of 4
In Part 2 we saw strangers can read, change and fake web traffic. To stop them, TLS uses four ideas from cryptography. You'll try each one here:
- Encryption with a shared key: scramble data so only key holders can read it.
- Public and private keys: a lock anyone can close, but only one person can open.
- Signatures: a stamp only one person can make, which anyone can check.
- Hashes: a fingerprint of data that changes if the data changes.
1. Encryption: scramble with a key
Encryption turns a readable message (plaintext) into scrambled nonsense (ciphertext) using a key. Decryption reverses it, and needs the key.
Here is the oldest trick, the Caesar cipher: shift every letter forward by key places. With key 3, A becomes D, B becomes E. Try it.
Scrambled message (what the stranger sees):
Same key to lock and unlock is called symmetric encryption. It's fast, which is why real systems (AES, ChaCha20) use it for all the bulk data.
Caesar is weak: only 25 keys, so a computer tries all in a blink (press the button). Real keys have 2256 possibilities. That's more than the number of atoms in the universe, so guessing is hopeless.
The catch: both sides need the same key. How do you give it to a stranger across the internet? If you send it, someone on the path copies it, and then they can read everything. Locks are easy. Sharing the key safely is the hard part.
2. Public and private keys: the open padlock
The trick that solves it: make a pair of keys that fit together.
- Public key: like an open padlock. Hand copies to everyone. It can only close the lock.
- Private key: the only key that opens it. Never shared.
To send Bella a secret, you snap her public padlock on it. A stranger can see the box and even own the same padlock, but can't open it. Only Bella's private key can.
The demo below uses real public-key math (RSA) with tiny numbers, so you can see it's just arithmetic. Pick a secret number to send:
📢 Public key (everyone has it)
e = 17, n = 3233🔑 Private key (only Bella)
d = 2753, n = 3233Real keys use numbers hundreds of digits long. Working out the private key from the public one is practically impossible at that size.
3. Signatures: the stamp nobody can fake
Public keys can run in reverse. If Bella locks something with her private key, anyone can open it with her public key. Only Bella could have made it. That is a signature: proof that a message came from the key's owner and wasn't changed.
Switch the demo above to Stamp and check. This is what a Certificate Authority does to a website's certificate in Part 4: it signs "this public key belongs to example.com" so that nobody can forge or edit it.
4. Hashes: a fingerprint for data
A hash function turns any data into a short fixed-size fingerprint. Two key properties:
- The same input always gives the same fingerprint.
- Change anything, even one letter, and the fingerprint changes completely. And you can't go backwards from the fingerprint to the data.
This is real SHA-256, running in your browser. Edit the second box by one character:
In practice, signing a big document means hashing it first, then signing the small fingerprint. If anyone edits the document, the fingerprint no longer matches the signature.
How these fit together
| Idea | Plain English | Speed | Used in TLS for |
|---|---|---|---|
| Shared key (symmetric) | One key locks and unlocks | Fast | Encrypting all the real data |
| Public / private keys | Open padlock + one key | Slow | Proving identity, agreeing on the shared key |
| Signature | Stamp made with the private key | Slow | Certificates: "this key belongs to this site" |
| Hash | Fingerprint of data | Very fast | Detecting any change |
The plan: use the slow public-key tools once, at the start, to prove who the server is and to agree on a shared key. Then use the fast shared key for everything else. That's exactly the TLS handshake.