Locked to Brightwater
secret1207 → 2881
Anyone closes it; only its key opens it.
Module 36 · Locks and keys
Anyone can close it, only you can open it
Larkspur Supply Co. orders from Brightwater Fasteners, a supplier it has never met, over a line anyone can watch. Here you mix paint, hand out padlocks and seal invoices.
Read as
The whole idea in one example
One padlock, two jobs
Sealed by Brightwater
genuineseal 1960
Only its key makes it; anyone checks it.
Toy-size numbers from this site’s own maths, small enough to check by hand. Real keys run to thousands of bits.
How it works
Four ideas carry the module
1 A shared key
The key has to travel
NIST SP 800-38D: in AES-GCM, an IV must never be used twice with the same key, and a tag check catches any change to the ciphertext.
Source, checked 25 October 2026
2 Mixing paint
Both ends make the same secret
Whitfield Diffie and Martin Hellman published key agreement over an open line in 1976, in “New Directions in Cryptography”.
Source, checked 25 October 2026
3 An open padlock
Anyone closes it, one key opens it
Ron Rivest, Adi Shamir and Leonard Adleman published RSA in 1978: one key encrypts and signs, the other decrypts and checks.
Source, checked 25 October 2026
4 A seal
A signature runs the other way
FIPS 186-5 (2023) specifies ECDSA signatures, including on the P-256 curve used here.
Source, checked 25 October 2026
The story
A supplier Larkspur has never met
Larkspur Supply Co. orders from Brightwater Fasteners, a supplier it has never met; the team learns that anyone can close your padlock, only your key opens it, and a signature runs the other way. You’re on the team that sets up the line.
- 23
- toy-size: the paint’s numbers are taken mod 23
- 2
- the shared secret both ends reach, never sent
- 2881
- order 1207 in the toy padlock
- 4
- plans keep every message safe in chapter 7
Your path
The chapters
Chapter 4 · done
Sealed with your key
How does a signature prove who wrote a message, and that nobody changed it?
Who it’s for
- Engineers
- Product managers
- Analysts
- No code needed
Anyone who has seen the padlock in a browser bar and wondered what it proves. The maths stays optional: every number is small enough to check by hand.