Encryption

1. One secret, shared: symmetric encryption

The oldest idea. Both sides hold the same key. The sender scrambles the message with it, the receiver unscrambles with it, and anyone without it sees noise. The modern workhorse is AES, a fixed procedure that turns 16 bytes of input into 16 bytes of output under a key, applied over and over in a mode that stitches blocks together. The mode here is GCM, which does two jobs at once: it encrypts, and it appends a 16-byte tag that changes if anyone alters a single bit. That second job matters as much as the first. Encryption without authentication lets an attacker flip bits in the ciphertext and flip the corresponding bits of your message, without ever knowing what it said.

The catch is the first sentence: both sides hold the same key. How did they come to hold it? If you can send a key safely you could have sent the message the same way. For most of history the answer was couriers and codebooks. The next two ideas are what replaced them.

2. A lock anyone can close, one person can open: asymmetric encryption

In the 1970s it was discovered that some mathematical operations are easy one way and hopeless the other. Multiply two 300-digit primes and you have a 600-digit number in a microsecond; be handed that number and asked for the primes, and every computer on Earth working together would not finish. RSA builds a key pair out of that asymmetry. The public key is the product and a small exponent, and you can hand it to anyone. The private key is the primes. Anything encrypted to the public key can only be undone by the private one.

Two things worth noticing. The public key really is just two numbers, which is why it can sit in a certificate or a DNS record. And RSA is slow and encrypts one small block at a time, so nobody encrypts a video call with it. It is used for the moment that symmetric encryption cannot handle on its own: getting a secret to a stranger.

3. Proof of who wrote it: digital signatures

Run the same asymmetry backwards. If something can only be produced by the private key but checked by the public one, then producing it proves you hold the private key. That is a signature. It is computed over a hash of the exact message, so it vouches for every byte, and unlike an ink signature it cannot be lifted off one document and pasted onto another. This demo uses ECDSA on the P-256 curve, which is what most website certificates and passkeys use today. The private key is one large number; the public key is a point on a curve.

Signatures are what let your browser trust a site it has never seen: the site presents a certificate signed by an authority whose public key shipped with your operating system. They are what makes a software update safe to install, and what an SSH key or a passkey really is. Note that a signature proves origin and integrity, not secrecy. The message itself is still readable by everyone.

4. Agreeing on a secret in public: key exchange

The neatest trick of the four. Alice and Bob each pick a private number, each derive a public value from it, and swap those public values over an open channel. Each then combines their own private number with the other's public value, and by the algebra of the curve they land on the same result. Eve, who saw both public values go past, cannot get there without one of the private numbers. This isDiffie–Hellman, here on an elliptic curve (ECDH).

Put the four together and you have TLS, the protocol behind the padlock. Your browser and the server run a key exchange to agree on a fresh secret for this connection. The server signs its half so you know it was really them. The agreed secret becomes an AES-GCM key, and everything after that, every request and response, is symmetric encryption, because it is fast. Asymmetric cryptography is used once, at the door.

What none of this protects against

• A private key that leaks. The mathematics is only as safe as the file.
• A public key you accepted without checking whose it is. Key exchange resists eavesdropping, not impersonation, which is why the signature step exists.
• Metadata. Who talked to whom, when, and how much stays visible.
• The endpoints. Whatever reads the decrypted message can be compromised like any other program.

On this site none of these primitives are used for the games. The leaderboard's defence against cheating is replaying moves, not encrypting anything. Cryptography would not help there: the client is the adversary, and it holds every key.