For quite a time, I was thinking: how does encryption really work?
Like, if I want to send a secret request (like an auth token) to a server, but the network channel is insecure. Thousands of people can see what we are sending.
We can't even share a secret password (key) to each other beforehand. Because if we send the password over the network, everyone else will see it and use it too.
So how on earth do we connect securely?
Then I researched and found out about the legendary minds who solved this. Let's break it down—this is going to be a fun topic.
🎨 The Paint Color Analogy
Imagine you and I want to agree on a secret color, but a spy is watching every single color we pass to each other.
Here is the color theory trick:
- Public Agreement: We openly agree on a starting color, let's say Yellow. The spy hears this.
- Private Secrets: I choose a secret color (Red). You choose a secret color (Blue). We keep these secret in our minds.
- The Mix: I mix my secret Red with the public Yellow to get Orange. You mix your secret Blue with the public Yellow to get Green.
- The Exchange: We send our mixed colors (Orange and Green) to each other. The spy intercepts them. But the spy cannot easily separate the mixed colors to find our private Red or Blue.
- The Match: I take your Green (Blue+Yellow) and add my secret Red to it. You take my Orange (Red+Yellow) and add your secret Blue to it.
Result: Both of us now have the exact same color mixture: Red + Blue + Yellow (Brown).
We just agreed on a shared secret color without ever sending our private secret colors over the network!
🗺️ The Connection Flow
Here is the exact step-by-step lifecycle of how this handshake and data encryption works under the hood:
================================================================================
PHASE 1: THE TLS HANDSHAKE (Color Exchange) - Tunnel Building
Goal: Agree on the "Brown Key" without hackers reading our private colors.
================================================================================
GOLU (Browser) SIA (Web Server)
[Private Color: RED] [Private Color: BLUE]
| |
| ----- 1. ClientHello (Agree on public color: YELLOW) -----> |
| |
| <---- 2. ServerHello (Confirm public color: YELLOW) ------- |
| |
| 3. Golu mixes: |
| RED + YELLOW = ORANGE |
| |
| ----- 4. Golu sends mixed ORANGE -------------------------> |
| |
| 5. Sia mixes: |
| BLUE + YELLOW = GREEN
| |
| <---- 6. Sia sends mixed GREEN ---------------------------- |
| |
| 7. Golu computes key: |
| RED + GREEN (Sia's mix) |
| = BROWN KEY |
| 8. Sia computes key:
| BLUE + ORANGE (Golu's mix)
| = BROWN KEY
| |
================================================================================
RESULT: Both have the same "BROWN KEY". Secure tunnel is OPEN!
================================================================================
| |
| |
================================================================================
PHASE 2: SECURE APPLICATION SESSION (Sending the Auth Token)
Goal: Send the sensitive token encrypted so only Golu & Sia understand it.
================================================================================
GOLU (Browser) SIA (Web Server)
[Token: "XYZ"] [Database Check]
| |
| 1. Encrypt with BROWN KEY: |
| "XYZ" + BROWN = "x&9#p" |
| |
| ----- 2. Sends Encrypted Request ("x&9#p") ---------------> |
| |
| 3. Decrypts with BROWN KEY:
| "x&9#p" + BROWN = "XYZ"
| |
| 4. Database Lookup:
| Is "XYZ" valid? YES!
| |
| <---- 5. Sends Encrypted Status ("Logged In") ------------- |
In computers, we don't mix paint. We use a mathematical trick called Modulo Arithmetic.
Because finding the private key from the public key is mathematically impossible for computers in a reasonable timeframe (known as the Discrete Logarithm Problem), the spy is completely locked out.
🛡️ The Major Limitation: Man-in-the-Middle (MITM)
While Diffie-Hellman is legendary, it has one critical vulnerability: It does not verify identity.
If a hacker sits in the middle of our connection, they can intercept Golu's public key, establish a secure tunnel with Golu pretending to be Sia, and establish another secure tunnel with Sia pretending to be Golu.
This is the Man-in-the-Middle (MITM) attack. Diffie-Hellman encrypts the traffic, but it doesn't prove who you are talking to.
To solve this, modern HTTPS combines Diffie-Hellman with Digital Certificates (SSL). The server must provide a cryptographic certificate signed by a trusted authority to prove that "Sia" is actually Sia, not a hacker in the middle.
💬 What is the single systems concept that blew your mind when you first learned it? Let me know in the comments!
If you liked this simple breakdown, follow me for more interesting systems engineering topics.
— Golu
Top comments (0)