Public-Key Cryptography

Say you want to pass a note to a friend so that no one else can read it. You could put the note in a box, lock it, and hand it over. The catch is that your friend has to be able to open that box too.

So you'd have to give your friend a copy of the key first. But what if the path you use to hand over that key isn't safe? If someone copies the key along the way, every note after that can be read.

It gets worse as more people join. If you want to swap secret notes with twenty classmates, you'd need to make and keep track of twenty different keys. Handing out keys turns out to be the weakest link.

The internet has the same problem. You've never met a shopping site you're visiting for the first time, so you've never traded keys with it. The idea that solves this is to split the locking key from the unlocking key.

This time, imagine making a padlock and key as a matched pair, then copying only the padlock and handing it out. Anyone can grab one and snap it shut. But the key that opens a snapped padlock stays only in your pocket.

If someone wants to send you a secret note, they lock the box with the padlock you've handed out and send it over. If a stranger grabs the box along the way, they can't open it. Even the person who locked it can't open it again.

The padlock you spread around is called the public key. The key only you hold is called the private key. The two are born as a pair, but they're built so that looking at the padlock won't help anyone figure out the key in any realistic amount of time.

That's why it's fine to send your padlock to anyone. A website hands its padlock to every visitor first thing. One catch: someone in the middle could swap in their own padlock, so there needs to be a separate way to check that the padlock is the real one. Either way, you no longer have to meet in person to share a key beforehand.

The matched pair of keys can do another job too. With your own key (the private key), you can put a stamp on a note that only you can make. Anyone with your padlock (the public key) can check that the stamp is really yours. The note's contents aren't hidden, but the stamp is useful in a different way.

A valid stamp means it was made with your key and the contents haven't changed since. This tool for proving who sent something is called a digital signature. Your private key works as your personal stamp.

There's a downside, though: this method is slow. Putting a big file straight into this kind of padlock takes a long time. So on today's internet, the two sides first use the padlock to confirm the other party is the real thing. Then they swap some values and each computes the same short secret key. The rest of the conversation runs quickly on that one key.

So when you pay at an online store today, both of these are working together. Your browser first checks the site's padlock using a stamp (a certificate) that a trusted certificate authority put on it, to make sure the padlock wasn't swapped out. Then it locks the rest of the conversation with the secret key they agreed on. Locking a message with the padlock is one of the main ways public keys get used.