The padlock, opened at last

Module 4 showed you the padlock and told you what it means, never how it works. Ten modules later, the how arrives.

What is encryption?

EncryptionConcept · lights on your mapencryptionMaking data unreadable to everyone except holders of the right key. The algorithms are the industry’s shared, published machinery, only the key is private, and brute-forcing a proper one outlasts the sun. is scrambling data with a key, so that only someone holding the key can unscramble it.

The key is not a metaphor here. It is a very long random number that the algorithm mixes into the scrambling, and mixes out again on the other side.

Here is the whole operation, on one order.

Now look carefully at what does the protecting, since it is not what most people assume.

The scrambling methods are public, and the algorithms are published, studied, and attacked by academics for sport. The only secret in the entire operation is the key.

That is deliberate, and the logic is worth spelling out. A secret method is just an unaudited one. You cannot know it is strong until thousands of experts have failed to break it, and they can only attack what they can see. And if a method leaks, every system using it breaks at once. If a key leaks, you replace one key.

So security that survives its blueprint being public is the only kind engineers trust.

The ordinary kind: one shared key

The basic form of encryption (called symmetric, a recognition term) uses the same key at both ends, like a house key. I have a copy, you have a copy, the same cut opens the same door.

Symmetric encryption is fast, and it is what actually carries almost all protected traffic, including the page you are reading. Keep that in mind. It explains where this lesson ends up.

At rest and in transit

Where does all this scrambling actually happen? It happens at two different moments, and each moment has its own name.

Encryption in transitConcept · lights on your mapencryption in transitSealing data while it moves between machines. The HTTPS envelope and encrypted database connections are this posture, aimed at anyone listening along the route. protects data on its journeys. Your order travels scrambled as it crosses the café Wi-Fi, and so do the server’s own calls onward to the database. Anyone recording the traffic records only noise.

Encryption at restConcept · lights on your mapencryption at restSealing data where it is stored, on disks and in backups, aimed at hardware that falls into the wrong hands. Auditors expect this posture and its in-transit sibling as a pair. protects data where it sleeps. The database’s drives and Module 7’s backups are scrambled as they sit. A drive that walks out of a data center gives up nothing without the key, and neither does a backup that leaks from a bucket.

Serious systems do both, since each answers a threat the other cannot touch. Compliance checklists ask for both by name, and a pairing that once read as boilerplate now parses on sight.

The bootstrap problem

At rest, shared keys are manageable because your own systems hold them. In transit, a chicken-and-egg problem appears, and it has sat unmentioned inside Module 4’s padlock all along.

Symmetric encryption needs the same key at both ends, but your browser and coffeeapp.com have never met. To share a key, one of you must send it, across the very channel you haven’t secured yet, with every eavesdropper invited to copy it in passing.

It is the lockbox paradox. You can’t mail someone the key to a lockbox inside an unlocked box.

The escape is the century’s most elegant trick.

What are public and private keys?

The public keyConcept · lights on your mappublic keyThe shareable half of the pair. Give it away freely, since it can close a message it cannot reopen, and it can check signatures it could never produce. and the private keyConcept · lights on your mapprivate keyThe guarded half of the pair, and the one that actually opens and signs. All of TLS, certificates, and signed tokens ultimately rest on these staying where they belong. break the same-key assumption. The keys come in mathematically linked pairs, and the pair splits the job. What the public key locks, only the private key opens.

The physical version is an open padlock. You can hand open copies of your padlock to the whole world. Anyone can snap one shut on a box with no key at all, but once shut, only you can open it because only you hold the key it was made for.

So you shout your public key to the planet, and strangers can now seal envelopes only you can open. No prior secret is needed, and no key ever travels. The lockbox paradox dissolves.

And the same math runs backwards.

Locks for strangers and autographs that can’t be forged come from one piece of math. A signature hides nothing, since the message travels in the open beside it. What it proves is who produced the message, and that nobody altered it since.

You have already relied on one. The stamp on last lesson’s token is exactly this trick, which is how any of the twelve instances could verify it without asking anyone. The same math sits underneath TLS and certificates, moments away.

One practical detail completes the picture. The two-key math is slow, far too slow to carry a whole conversation. So in practice it plays a brief, decisive role. Public-key math lets the two strangers safely agree on a fresh shared key, and an eavesdropper can watch every message of that agreement and still not compute the key. Then fast symmetric encryption carries everything after. The trick opens the door, and the house key locks it behind you.

TLS, HTTPS, and the certificate

Now the padlock assembles itself. The protocol is TLSConcept · lights on your mapTLSThe protocol that secures web traffic. Its opening handshake checks who you reached and sets up fresh keys, and every byte after travels sealed. The S in HTTPS reports that this is happening.. TLS, short for Transport Layer Security, does the securing (verify the certificate, agree on keys, then encrypt everything), and HTTPS is just HTTP running inside it. The S you have trusted since Module 4 is this machinery.

One question remains. The trick lets you seal envelopes for a public key. But whose key are you holding? An impostor can generate key pairs too, and sealing a secret with an impostor’s public key is worse than useless.

That is the job of the certificateConcept · lights on your mapcertificateA domain’s proof of identity for the handshake. It bundles the site’s lock with its name under an authority’s signature, and the browser refuses the connection with a red warning when the bundle fails to check out., Module 4’s mystery object, revealed as something wonderfully simple. It is the server’s public key, with a trusted signature on it.

The signature comes from a certificate authority, one of Module 4’s trusted organizations, whose own public keys ship inside your browser. Anyone can generate keys, but only the verified owner of coffeeapp.com gets its keys signed for that domain. A certificate that fails the check is what triggers the browser’s full-screen red warning.

Watch the whole thing happen in the quarter-second before any page loads.

The mental model to remember

Encryption scrambles data with a key, and without the key there is only noise. The methods are public and the key is the only secret. A leaked method breaks everything, while a leaked key gets replaced.

Ordinary symmetric encryption shares one key between both ends. It is fast, and it is what actually carries the traffic.

In transit seals data against eavesdroppers on the path. At rest seals it against hardware leaving your control. Serious systems do both.

Public and private keys solve the how-do-strangers-share-a-key problem. The public key seals what only the private key opens, and (flipped) the private key signs what anyone can verify. In practice the trick’s main job is delivering the shared key that symmetric encryption then uses.

TLS runs that handshake, and HTTPS is HTTP inside it. A certificate is the server’s public key wearing a trusted signature, so you know whose lock you are snapping shut.

You should now be able to look at the padlock in your address bar and narrate the quarter-second that produced it, and answer the question the whole design turns on. With everything public, where does the secrecy actually live?