The Lock That Locks Itself
A normal lock uses one key: the key that locks is the key that unlocks. Public-key cryptography breaks that symmetry. You get two keys, a matched pair — and what one of them locks, only the other can open. Publish one to the whole world, keep the other secret, and now anyone can send you a message no one but you can read. Below is a real, working version of the math (RSA), shrunk to toy size so you can watch every number — including the moment you break it.
It sounds impossible the first time you hear it: if the locking key is public, why can't everyone just run it backwards to unlock? The honest answer is the whole subject. The two keys are tied together by a piece of arithmetic that is easy to do forwards and monstrously hard to undo — easy to multiply two big prime numbers, brutally hard to take the product apart again. Don't take that on faith. Make a keypair, use it, then try to break it yourself and watch the difficulty grow.
1. Make a matched pair of keys
RSA builds both keys out of two secret prime numbers. Pick a size and generate
a fresh pair — the public key public is (n, e), safe
to hand out; the private key private is d, the one
thing you never reveal.
Public key — give it away
e = …
Private key — keep it secret
2. Lock with public, unlock with private
Type a message. We encrypt each byte with the public
key — c = mᵉ mod n — turning it into numbers anyone could compute but no one can
read. Then the private key undoes it — m = cᵈ mod n —
and your words come back.
3. Run it the other way — signatures
The pair works in both directions. Lock something with your private key and anyone can check it with your public one. Only you could have made it, so it's a signature: proof a message is really from you, and hasn't been changed by a letter.
4. Why you can't run the public key backwards
Here is the wall the whole thing leans on. The public key gives away n.
The private key d can be computed from n's two secret prime factors —
so cracking RSA is exactly the problem of factoring n. Easy when n
is small. Try it on the key you just made:
press “Break this key”
Trial division — testing every possible divisor — does about √n steps. Doubling
the key's bit-length squares n and so doubles the exponent on the work.
That's why a 40-bit toy key falls in a blink and a real one never does. The table is honest
about the gap, and about the fact that real attackers use a far cleverer method than trial
division:
The check — shown, not asserted
Every number on this page is produced by from-scratch RSA (modular exponentiation, the extended Euclidean algorithm for the private key, Miller–Rabin to find primes) running in your browser — no crypto library. Here it reproduces the canonical textbook worked example, live, right now:
Those are exactly the numbers in the RSA article's worked
example (p=61, q=53, e=17). The reproducible verifier goes further —
it confirms that every message round-trips (all 3,233 residues for that key), that a
foreign private key recovers the message in 0 of 300 trials, that tampering with a
signed message is caught in 300 of 300, and that factoring n recovers d
exactly in 50 of 50 — then times trial division to show the work growing like √n.
Reproduce it all from a clean checkout: node research/public-key-cryptography/verify.mjs — and this very page is re-driven headless by verify-public-key-crypto.mjs.
Four things worth getting straight
The public key is meant to be public.
This is the part that breaks people's intuition. Handing out the locking key gives an
attacker no shortcut to the unlocking key — recovering d from (n, e)
means factoring n, and for a 2048-bit modulus no one on Earth can. So you can
print your public key on a billboard. The whole edifice of secure websites, signed software,
and encrypted messaging rests on publishing one half of the secret openly.
It is not just “a stronger password.”
A password is one shared secret both sides must know in advance. Public-key crypto's trick is that two strangers who have never met and share no secret can still set up a private channel — you encrypt to my published key without either of us agreeing on anything first. That's the problem symmetric ciphers and passwords can't solve on their own, and the reason this was a genuine breakthrough (Diffie–Hellman, 1976; RSA, 1977).
In practice it's only used to hand off a faster key.
RSA is slow and (as you saw) encrypts only small numbers. So real systems almost never encrypt your actual data with it. Instead they use public-key crypto once, to safely agree on a short random symmetric key, then switch to a fast cipher (like AES) for the real traffic. Public-key crypto's job is the handshake — solving “how do we share a secret over a wire everyone can see?” — not the haulage.
“Unbreakable” means “unbroken, so far, by the math we know.”
RSA's security is not proven — it rests on the belief that factoring is hard, a belief no one has overturned despite decades of trying. The best public attack (the general number field sieve) is far faster than the trial division above, yet still leaves 2048-bit keys out of reach: RSA-2048 has never been factored. A large enough quantum computer running Shor's algorithm would break it — which is exactly why “post-quantum” cryptography is being rolled out now. Honesty about what is assumed, versus proven, is the whole game.