Classic encryption is symmetric: the same key locks and unlocks. AES, the workhorse cipher that protects this very page in transit, works that way — and it's fast and essentially unbreakable with a good key.
But symmetric encryption has a bootstrap problem. Before you and a website can whisper, you both need the same key — and the only channel you share is the public internet, where anyone on the path can read every byte. Mailing keys on paper worked for embassies; it does not scale to your browser opening twenty TLS connections before breakfast.
Asymmetric (public-key) cryptography, invented in the 1970s, dissolves the problem with a strange idea: use two keys. One is public — shout it to the whole room. The other is private — it never leaves your machine. What one key locks, only the other unlocks. Nobody has to deliver a secret to anybody.
The whole trick rests on one-way functions: math that is easy to compute forward and practically impossible to reverse. This page builds that idea up from paint-mixing, through RSA, to the elliptic curves that secure most of today's internet.
The cleanest intuition for public-key agreement is paint. Mixing two colors is easy; un-mixing a blend back into its ingredients is hopeless. That asymmetry is all you need.
Alice and Bob agree — out loud, in public — on a common starter color. Each secretly picks a private color and mixes it into the starter. They swap the resulting blends (also in public), then each stirs their own private color into the blend they received. Both end up holding starter + Alice's secret + Bob's secret — the same final color — yet the eavesdropper only ever saw the starter and the two half-blends.
This is exactly the shape of Diffie–Hellman key exchange (1976) — the first public-key scheme ever published. Real cryptography just replaces paint with a mathematical mixing operation that is provably easy forward and believed intractable backward.
The paint of real Diffie–Hellman is modular exponentiation — raising a number to a power on a "clock" with p positions, keeping only the remainder:
Computing y from x is fast even for 600-digit numbers. But going backward — given y, find the exponent x — is the discrete logarithm problem, and no efficient algorithm for it is known. On a clock, exponentiation doesn't grow smoothly; it teleports.
Notice there's no pattern to ride: going from x to x+1 flings the result anywhere on the clock. With a real 2048-bit p, the clock has more positions than there are atoms in the observable universe — and an attacker who sees y must effectively guess x.
Diffie–Hellman in one breath: Alice publishes ga mod p, Bob publishes gb mod p, each raises the other's number to their own secret, and both land on gab mod p — the same shared key. The paint demo above, with clocks instead of pigments.
Diffie–Hellman lets two parties agree on a key. RSA (Rivest–Shamir–Adleman, 1977) goes further: it gives you a public lock and a private key, so anyone can encrypt a message that only you can read — no conversation needed.
Its one-way street is factoring. Multiplying two primes is instant; recovering them from the product is brutally hard. A key pair is built like this:
Euler's theorem guarantees the round trip: raising to the e-th and then the d-th power is, modulo n, raising to a power that acts like 1. Encryption and decryption are the same operation with different exponents — one public, one private.
Everything public in RSA — n and e — is safe to reveal only because nobody can split n back into p and q. If they could, they'd compute φ(n), derive d, and read everything. So how hard is factoring, really? Feel it:
Each extra pair of digits multiplies the work by ~10. Real algorithms (the general number field sieve) are far cleverer than trial division, but the curve still explodes: factoring a 2048-bit RSA modulus — 617 digits — is estimated to need more energy than boiling the oceans. The current public factoring record is 250 digits, and it took ~2,700 core-years.
Security here isn't a proof — it's a 50-year-old open challenge that the world's mathematicians keep failing at, with billions of dollars riding on their continued failure.
RSA needs enormous keys because factoring, while hard, is not maximally hard — clever algorithms chip away at it. In the 1980s cryptographers found a tougher playground: elliptic curves, the set of points satisfying
The magic is that curve points form a group: there's a geometric way to "add" two points and land on a third. Draw a line through P and Q — it hits the curve at exactly one more spot; reflect that spot across the x-axis and you've got P + Q. (Adding a point to itself uses the tangent line.)
This addition looks arbitrary, but it behaves impeccably — it's associative, has an identity (a "point at infinity" straight up), and every point has an inverse (its mirror image). A full arithmetic, conjured out of geometry.
Smooth curves are lousy for computers — floating point rounds, and secrets can't survive rounding. So cryptography plays the same game modulo a prime: coordinates wrap around like clock arithmetic, and the elegant curve shatters into a cloud of scattered points. The addition law survives verbatim — same formulas, just with mod-p division.
Now pick a base point G and add it to itself k times: 2G, 3G, 4G… The hops look like random teleports around the cloud. Computing kG from k is fast (double-and-add needs only ~log k steps). Recovering k from kG is the elliptic curve discrete logarithm problem — the hardest standard problem per bit that cryptographers know.
Stare at that walk: consecutive multiples of G share no visible relationship. A real curve like Curve25519 does exactly this with p ≈ 2255 — a "grid" with more points than atoms in the universe, where your secret is just how many times G was added.
Replace paint-mixing with point-multiplication and you have elliptic-curve Diffie–Hellman — the key exchange your browser almost certainly performed to fetch this page:
The shared point's x-coordinate gets hashed into an AES key, and from there the fast symmetric machinery takes over. Asymmetric crypto opens the door; symmetric crypto carries the furniture.
Both systems are alive and well, but the economics differ wildly. Because the best attacks on elliptic curves are so much weaker than the best attacks on factoring, ECC buys the same security with drastically smaller keys — smaller certificates, faster handshakes, less battery:
Which is why the modern internet splits the work:
That's the whole machine: a problem easy in one direction, hopeless in the other, and fifty years of increasingly elegant ways to hide a trapdoor in it. Every padlock icon in your browser is one of these demos, scaled up until the sun burns out first.