The padlock, opened

In Act I, a padlock appeared in Molly’s address bar, and the card scene left one story for Act IV: the machinery under the seal, and the full anatomy of what a seal does not promise. It is later.

Underneath every promise the audit checks this afternoon is one move: encryptionConcept · lights on your mapencryptionScrambling data with a key so only key-holders can unscramble it. Without the key, the ciphertext is statistically indistinguishable from noise. The protection never depends on hiding the method, the algorithms are public, only the key, and brute-forcing a proper key outlasts the sun.. Not hiding data, which fails the day the hiding place is found, but scrambling it so that possession without the key is possession of static.

The trick with two keys

The elegant machinery under the padlock is a key that splits in half. A public keyConcept · lights on your mappublic keyThe half of the pair you can shout to the world. Whatever it locks, only the matching private key opens, so anyone can seal a message that one party alone can read. It also verifies whatever the private key signs. gets published to anyone who asks, and its partner, the private keyConcept · lights on your mapprivate keyThe half of the pair that is never shared. It alone opens what the public key locked, and what it signs, the public key can verify. The trick underneath TLS, certificates, and signed tokens., never leaves home. Anyone can lock a box only Traversal opens. Traversal can sign a claim anyone can verify. Act I’s certificate was exactly such a signed claim, and the protocol that puts it all in motion is TLSConcept · lights on your mapTLSThe protocol that does the securing: a handshake that verifies the certificate, agrees on keys, and then encrypts everything both directions. HTTPS is simply HTTP running inside TLS.. Verify who you are talking to, agree on a fresh set of keys, and then speak, both directions, in nothing but ciphertext, so that anything listening along the path, from the race-day crowd’s open wifi to the last hop inside the cloud, records only noise. The padlock is the browser reporting that the handshake happened.

Moving and sitting

Data lives two lives. Two locks. encryption in transitConcept · lights on your mapencryption in transitProtecting data as it moves: the HTTPS envelope, connections between services, the link to the database. The answer to an eavesdropper on the path. covered Case’s card number on registration morning and covers every timing event on race morning. Its sibling, encryption at restConcept · lights on your mapencryption at restProtecting data as it sits: encrypted disks, encrypted backups. A stolen disk or backup yields only noise. Serious systems do both kinds, and compliance checklists ask for both by name., guards the other life, and it retroactively blesses Wednesday’s standup. Those separate, faraway backup copies are themselves encrypted, so the nightmare of a stolen backup, 25,000 identities in a briefcase, decrypts to static.

And none of this machinery says a word about intentions. A perfectly sealed connection to a thief is still a connection to a thief, exactly as Act I warned. The seal answers eavesdroppers. Judging the address is still your job.

Both boxes tick. The padlock closes again, understood at last, and the auditors move to the one secret encryption cannot protect: the passwords people type into it.