What are public
and private keys?

The full narration of the video.

A public key isn't really a key at all. It's a lock. And your phone is hiding the key that matches it. Start with a puzzle. When you pay on your phone, the message passes through lots of strangers' machines before it reaches the bank.

Anyone along the way could take a peek. So agree on a password with the bank first? But you've never met, and the message setting up the password could be seen too. How do you whisper a secret in front of everyone?

Here's the trick. The bank makes lots of identical padlocks, all left open, and hands one to anyone who asks. This lock has an odd rule: anyone can snap it shut, but once it's shut, only one key in the world can open it. The bank keeps that key to itself and never gives it out.

To send a secret, you take one of those open locks, put your message in a box, snap it shut, and send it off. People along the way can grab the box, but even holding the very same lock, they can't open it. Only the bank's key can.

That open lock handed out everywhere has a real name: the public key. The key kept to yourself is the private key. Real ones don't look like locks. They're two long strings of numbers that look like gibberish.

Every time you open a website or pay, your phone uses a pair like this: first it checks the site is real, then it quietly agrees on a password with it. But if the public key goes out to the whole world, why can't anyone work out the private key? Because they're made with multiplication. Pick two huge prime numbers and multiply them.

Multiplying is easy. Sixty-one times fifty-three is three thousand two hundred thirty-three. A minute by hand. Now go backwards. Given only three thousand two hundred thirty-three, which two numbers made it? You have to try them one by one. Real keys use numbers over six hundred digits long. In 2020, researchers cracked one with two hundred fifty digits. On a single computer core, that would have taken twenty-seven hundred years.

The pair also works in reverse. The private key stamps a file, and anyone with the public key can check who really sent it. Before your phone installs an update, it checks that stamp. These locks won't be safe forever. If quantum computers get built, they could break them much faster, so companies are already switching to new locks.

Want to see a real public key? Open a website in a computer browser, click the little icon at the far left of the address bar, and find the certificate. That long jumble is it. Where did you first come across the word "key" used like this?