← Back to Vault
🔒

Vault 101

Encryption and certificates explained

🔐 Secret Messages

Imagine you write a note to a friend. You scramble the letters so nobody else can read it. Your friend knows how to unscramble it. That is encryption.

Computers do the same thing. When you send a password or a credit card number, your computer scrambles it first. The website on the other end unscrambles it.

💬
Before Encryption

password123

→
🔒
After Encryption

a7xK9mQ2...

🔑 Keys Make It Work

To scramble and unscramble a message, you need a key. A key is just a long number. Only the right key can unlock the message.

There are two kinds of keys:

  • 🔓Public key — Anyone can use this to lock a message. Think of it as a mailbox slot. Anyone can drop a letter in.
  • 🔒Private key — Only the owner has this. It opens the mailbox. Only they can read the letters inside.
✅ You already use encryption every day. Every time you see the padlock in your browser, your connection is encrypted.

📄 A Digital ID Card

Encryption protects your data, but how do you know who you are talking to? That is what a certificate does.

A certificate is like an ID card for a website. It says: "I am really this website, and here is my public key."

💡 Everyday example
You go to your bank's website. Your browser asks: "Prove you are really this bank." The bank shows its certificate. Your browser checks it and shows the padlock.

✍️ Signatures Prove It Is Real

Anyone could make a fake ID card. So certificates need a stamp of approval. That stamp is called a digital signature.

A signature uses math to prove two things:

  • ✅Who made it — The signature links the certificate to a trusted organization.
  • 🛡️Nobody changed it — If anyone edits the certificate, the signature breaks.

🔗 Who Signs the Certificates?

A Certificate Authority (CA) signs them. A CA is a trusted organization that checks website owners and issues certificates. Your browser has a built-in list of CAs it trusts.

📚 Want to learn more about CAs? See Spork 101 for a full explanation.

⚠️ Today's Math Will Break

Encryption uses math problems that are hard to solve. Today's computers would need billions of years to crack them.

Quantum computers are different. They solve certain math problems much faster. The math behind today's encryption is exactly the kind they are good at.

⚠️ When a powerful enough quantum computer arrives, today's encryption and signatures will no longer protect your data.

💡 New Math Already Exists

NIST (the U.S. standards agency) found new math that quantum computers cannot break. They published the final standards in August 2024. The transition has already begun.

✅ The fix exists. Websites, apps, and CAs just need to switch to it.

📋 What Needs to Change

  • 🔐Encryption keys — New key types that quantum computers cannot crack.
  • ✍️Signatures — New signature math for certificates and documents.
  • 📄Certificates — CAs need to issue certificates using the new math.
📚 Want to understand the new algorithms? See Forge 101 for a plain-English breakdown.