How Encryption Works
A-Level Computer Science Topic 17 13:19 English narration · English + 中文 subtitles burned in
Chapters
Transcript
Look at the padlock in your browser's address bar.
看看你浏览器地址栏里的那把小锁。
You typed your bank's name, and somehow your laptop is now certain it is really talking to the bank — and that nobody in between can read a thing.
你输入了银行的网址，而不知怎么， 你的笔记本此刻已经确信自己真的在和这家银行通话——而且中间没有任何人能读到一个字。
It has never met this server before.
它以前从没见过这台服务器。
No secret was agreed in advance.
事先也没有约定任何秘密。
So how does a stranger on the internet prove who they are, and set up a private conversation, in a fraction of a second?
那么，互联网上的一个陌生人， 是怎么在几分之一秒里证明自己的身份，并建立起一场私密对话的呢？
Encryption, and the machinery built on top of it.
加密，以及建立在它之上的那一整套机制。
Today: symmetric and asymmetric keys, the hybrid trick that makes secure browsing fast, hashing, digital certificates, and digital signatures.
今天我们讲：对称密钥与非对称密钥、 让安全浏览变快的混合技巧、散列、数字证书，以及数字签名。
Let's begin.
让我们开始吧。
Start with the idea itself.
先从这个想法本身说起。
Encryption takes readable plaintext and, using a key and a mathematical operation, turns it into ciphertext — unreadable noise.
加密把可读的明文，用一把密钥和一套数学运算，变成密文—— 一堆读不懂的噪声。
Decryption reverses it, but only with the right key.
解密把它反过来，但只有用对的密钥才行。
Someone who intercepts the message without that key sees only gibberish, because trying every possible key would take impossibly long.
没有那把密钥就截获了消息的人，看到的只有乱码，因为把所有可能的密钥都试一遍， 要花的时间长得离谱。
The secret is not the algorithm — that is usually public knowledge.
秘密不在算法——算法通常是公开的。
The secret is the key.
秘密在于那把密钥。
This is an Enigma machine, used to encrypt German military messages in the Second World War.
这是一台恩尼格玛密码机，第二次世界大战中用来加密德军的军用电文。
It is mechanical, but the idea is exactly the modern one: a maths operation, controlled by a key, that scrambles readable plaintext into unreadable ciphertext.
它是机械的，但思路正是现代的那一套：一个由密钥控制的数学运算， 把可读的明文打乱成不可读的密文。
The rotor settings WERE the key.
转子的设置就是密钥。
Anyone with the same settings could reverse it; anyone without them saw noise.
任何拥有相同设置的人都能把它还原；没有设置的人只能看到杂乱的噪声。
And the security argument is the same one we still use — an attacker who intercepts the ciphertext without the key would have to try every possible key, and that takes far too long to be worth doing.
而安全性的论证也还是我们今天用的那一个—— 拦截到密文却没有密钥的攻击者，只能把每一个可能的密钥都试一遍， 而那要花的时间长到根本不值得去做。
Follow the path.
顺着路径看。
Plaintext goes into an encryption algorithm together with an encryption key, and comes out as ciphertext.
明文和加密密钥一起送入加密算法，出来就是密文。
That ciphertext crosses the internet, where anyone might read it.
密文穿过互联网，路上任何人都可能读到它。
At the far end a decryption algorithm plus a decryption key turns it back into plaintext.
在另一端，解密算法加上解密密钥，把它还原成明文。
Note that the ALGORITHM is usually public — it is published and studied.
注意：算法通常是公开的——它被发表出来，被人研究。
The secret is the key alone, and that is deliberate: a cipher whose security depends on nobody knowing how it works has never stayed secret for long.
唯一的秘密只有密钥，而这是有意为之的： 一种安全性依赖于没人知道它怎么工作的密码，从来没有能长期保密过。
One newer idea worth naming is quantum cryptography, which uses quantum physics to share a key in a way that REVEALS any eavesdropper.
还有一个值得一提的新思路是量子密码学， 它利用量子物理来分发密钥，任何窃听者都会因此暴露。
There are two kinds.
密钥有两种。
Symmetric encryption uses one shared key for both locking and unlocking.
对称加密用同一把共享密钥来上锁和解锁。
It is fast, so it is what we use for bulk data.
它很快，所以我们用它来处理大量数据。
But it has a problem: how do the two sides agree on that key without an eavesdropper hearing it?
但它有个问题：双方怎么在不被窃听者听到的情况下，先约定好那把密钥呢？
That is key distribution.
这就是密钥分发问题。
Asymmetric encryption solves it.
非对称加密解决了它。
Each person has a pair: a public key they publish to the world, and a private key they never share.
每个人都有一对密钥：一把向全世界公开的公钥，和一把从不外传的私钥。
What one key locks, only the other can unlock — so anyone can encrypt to you, but only you can read it.
一把锁上的东西，只有另一把能打开——所以任何人都能加密后发给你，但只有你能读。
The catch is that it is far slower.
代价是，它慢得多。
Symmetric encryption uses the SAME key at both ends, so sender and receiver must both hold the one secret.
对称加密两端使用同一个密钥，所以发送方和接收方都必须持有这一个秘密。
Its strengths are speed and bulk: encrypting a whole disk or a video stream is cheap.
它的优点是快和适合大数据量：加密整块硬盘或一路视频流的开销很小。
Its weakness has a name worth memorising — key distribution.
它的弱点有一个值得记住的名字——密钥分发。
How do you get the secret key to the other person in the first place?
你一开始要怎么把这个秘密密钥交到对方手里？
You cannot send it over the same channel you do not trust, because that is precisely what you are trying to protect.
你不能通过那条你并不信任的通道来发送它， 因为那正是你想要保护的东西。
That single problem is what asymmetric encryption exists to solve.
正是这一个问题，才有了非对称加密的存在。
Asymmetric encryption gives each user a PAIR of mathematically related keys: a public key they publish to anyone, and a private key they never share.
非对称加密给每个用户一对在数学上相关联的密钥： 一个公钥，可以公开给任何人；一个私钥，永远不外传。
The relationship is what makes it work.
起作用的正是这两者之间的关系。
Anything encrypted with the public key can be decrypted only by the matching private key — and the reverse also holds, which is what digital signatures will use later.
用公钥加密的东西， 只有配对的那把私钥才能解开——反过来也成立， 而这正是后面数字签名要用到的。
Publishing your public key costs you nothing, because holding it does not let anyone work out the private one.
公开你的公钥不会让你付出任何代价， 因为拿着公钥并不能让任何人推算出私钥。
Here is the procedure to send a secret message to Alice.
要给爱丽丝发一条秘密消息，步骤是这样的。
Get her published public key, encrypt the message with it, and send it.
取她已公开的公钥， 用它加密消息，然后发出去。
Only Alice can decrypt it, because only she holds the matching private key.
只有爱丽丝能解密， 因为只有她持有配对的那把私钥。
Notice what just disappeared: no prior key exchange was needed.
注意刚刚消失了什么： 不需要事先交换任何密钥。
You and Alice have never met and never shared a secret, and you can still send her something nobody else can read.
你和爱丽丝素未谋面，也从未共享过任何秘密， 你却仍然可以给她发一份别人都读不了的东西。
The trade-off is speed — asymmetric encryption is MUCH slower than symmetric, so it is not used for large amounts of data.
代价是速度——非对称加密比对称加密慢得多， 所以它不用于大量数据。
The whole scheme rests on the private key staying private, so it is sometimes kept on a small piece of hardware like this — a hardware security key.
整套方案的根基在于私钥必须保持私密，所以有时会把它存在这样一小块硬件上—— 硬件安全密钥。
You plug it in or tap it to prove who you are.
你把它插上，或者轻触一下，用来证明你是谁。
The important design detail is that the secret key never LEAVES the device: the computer sends data to the key, the key does the maths inside itself and sends back the result.
重要的设计细节在于：那个秘密密钥永远不会离开这个设备。 计算机把数据发给它，它在内部做完运算，再把结果送回来。
So malware on the computer can misuse the key while it is plugged in, but it cannot copy it.
所以计算机上的恶意软件在它插着的时候可以滥用它， 但没办法把它复制走。
So real systems use both — the hybrid approach.
所以真实的系统两种都用——这就是混合方案。
When your browser connects, it invents a fresh random session key.
当你的浏览器连上服务器时， 它会临时生成一把随机的会话密钥。
It encrypts that session key using the server's public key, and sends it over.
它用服务器的公钥把这把会话密钥加密，然后发过去。
Only the server's private key can open it, so only the server learns it.
只有服务器的私钥能打开它，所以只有服务器知道这把密钥。
Now both ends share one secret key, and everything after that is protected with fast symmetric encryption.
现在两端共享了同一把秘密密钥， 之后的一切都用快速的对称加密来保护。
Slow asymmetric crypto is used once, just to hand over the key.
慢的非对称加密只用了一次，仅仅是为了把密钥递过去。
That is how secure browsing works.
安全浏览就是这样工作的。
Real systems use both, and this is how.
真实系统两种都用，方式是这样。
One, the client makes a random session key.
第一，客户端生成一个随机的会话密钥。
Two, it encrypts that session key with the server's PUBLIC key.
第二，它用服务器的公钥加密这个会话密钥。
Three, the server decrypts it with its private key.
第三，服务器用自己的私钥把它解开。
Four, both ends now share the session key and switch to fast symmetric encryption for all the actual data.
第四，两端现在共享了会话密钥，于是切换到快速的对称加密来处理全部实际数据。
Look at what this buys: the slow asymmetric maths runs ONCE, on a key-sized piece of data, purely to solve the key-distribution problem.
看看这样做换来了什么：慢的非对称运算只跑一次， 而且只作用在一份密钥大小的数据上，纯粹是为了解决密钥分发问题。
Everything after that is fast.
在那之后的一切都是快的。
This is how HTTPS and SSH work.
HTTPS 和 SSH 就是这样工作的。
A cryptographic hash takes any input and produces a fixed-size digest.
密码散列函数接受任意输入，产生一个固定长度的摘要。
Three properties matter.
有三条性质很重要。
The same input always gives the same digest.
相同的输入总是给出相同的摘要。
It is infeasible to find two inputs sharing a digest.
要找到两个摘要相同的输入是不可行的。
And a tiny change in the input changes the digest COMPLETELY — look at the picture: hello and hellp differ by one letter and the digests have nothing in common.
而输入上极小的改动会让摘要完全改变——看这幅图： hello 和 hellp 只差一个字母，两个摘要却毫无共同之处。
The key difference from encryption is that hashing is ONE-WAY.
与加密最关键的区别在于，散列是单向的。
There is no key that gets the input back, by design.
按照设计，不存在任何密钥能把原始输入取回来。
That is exactly why it suits password checking, integrity checking, and digital signatures.
这正是它适合用于口令校验、完整性校验和数字签名的原因。
TLS, Transport Layer Security, is the successor to the Secure Socket Layer, SSL, and it does three things at once: encrypts the data in transit, authenticates the server with a certificate, and provides integrity so tampering is detected.
TLS，传输层安全协议，是安全套接层 Secure Socket Layer（SSL）的后继者，它同时做三件事： 加密传输中的数据、用证书认证服务器、以及提供完整性以便发现篡改。
The handshake goes like this.
握手过程是这样的。
The client connects and proposes cipher options.
客户端连接上来，提出可选的加密套件。
The server picks one and sends its digital certificate, containing its public key — issuing and validating these certificates is digital certification.
服务器选定一个，并送出自己的数字证书，其中包含它的公钥——签发并验证这些证书就是数字认证。
The client checks that certificate.
客户端检查这张证书。
The two ends exchange a fresh session key using asymmetric crypto.
两端用非对称加密交换一个新的会话密钥。
And all later traffic uses fast symmetric encryption.
此后的全部流量都使用快速的对称加密。
The result is an encrypted, authenticated tunnel that higher protocols like HTTP and SMTP simply run inside — appropriate wherever sensitive information travels: web browsing, banking, payments, email and VPNs.
结果是一条加密的、经过认证的隧道，HTTP、SMTP 这些上层协议直接在里面跑—— 凡是有敏感信息传输的地方都适用：网页浏览、银行、支付、电子邮件和 VPN。
But wait — how do you know that public key really belongs to the bank, and not an impostor?
但等一下——你怎么知道那把公钥真的属于这家银行，而不是一个冒名顶替者？
That is what a digital certificate is for.
这正是数字证书的用处。
The server sends a certificate holding its identity and its public key, signed by a Certificate Authority your browser already trusts.
服务器会发来一张证书，里面装着它的身份和它的公钥， 并由你的浏览器早已信任的一家证书颁发机构签了名。
The browser checks the name matches the site, checks it has not expired, and checks the authority's signature.
浏览器会检查名字是否与网站相符、 是否还没过期，以及那家机构的签名对不对。
All good, and the handshake proceeds.
都没问题，握手就继续。
Something wrong, and you get that "your connection is not private" warning.
有一处不对，你就会看到那句"你的连接不是私密连接"的警告。
A digital certificate binds an identity — a domain or an organisation — to a public key, and is signed by a trusted Certificate Authority.
数字证书把一个身份——一个域名或一个组织——和一把公钥绑定在一起， 并由受信任的证书颁发机构签名。
Follow the picture: the user sends their identity and public key to the CA, the CA VERIFIES that identity, and then issues a signed certificate back.
跟着图看： 用户把自己的身份和公钥送给 CA，CA 核实这个身份， 然后签发一张已签名的证书回去。
Inside it are the subject, the subject's public key, the issuer, a validity period, and the CA's signature over all of it.
证书里面有主体、主体的公钥、颁发者、有效期， 以及 CA 对上述全部内容的签名。
The signature is the load-bearing part — it is what makes the certificate impossible to forge without the CA's private key.
签名是承重的那一部分——正是它使得没有 CA 的私钥就无法伪造这张证书。
Your browser ships with a list of trusted root CAs, and it runs four checks.
你的浏览器内置了一份受信任的根 CA 列表，它会做四项检查。
It checks the expiry dates.
检查有效期。
It checks the subject name matches the URL you actually typed — this is what stops a valid certificate for one site being reused for another.
检查证书中的主体名称与你实际输入的网址一致—— 正是这一条阻止了把某个网站的有效证书拿来冒充另一个网站。
It checks the certificate is signed by a trusted CA, using that CA's public key to verify the signature.
检查这张证书由受信任的 CA 签名，方法是用那个 CA 的公钥去验证签名。
And it follows the certificate chain upward until it reaches a trusted root.
再沿着证书链一路向上，直到到达一个受信任的根。
If anything fails you get "your connection is not private".
任何一项不通过，你就会看到"您的连接不是私密连接"。
When it all passes, the client knows three things: the identity was vetted, the public key really belongs to that identity, and the certificate is current.
全部通过时，客户端就知道了三件事：身份经过核实、 公钥确实属于该身份、并且证书仍在有效期内。
To sign: hash the message to a digest, then encrypt that digest with the sender's PRIVATE key — that encrypted digest IS the signature — and send the message and signature together.
签名的做法：把消息散列成摘要，再用发送方的私钥加密这个摘要—— 这个被加密的摘要就是签名——然后把消息和签名一起发出去。
To verify: hash the received message yourself, decrypt the signature with the sender's PUBLIC key to recover their digest, and compare the two.
验证的做法：自己对收到的消息做散列， 用发送方的公钥解密签名，取回对方的摘要，再比较两者。
A match proves two separate things at once.
两者相符，就同时证明了两件不同的事。
It was signed by whoever holds the private key, which is authentication; and the message has not changed, which is integrity, because any change would alter your hash.
它是由持有私钥的那个人签的，这是身份验证； 而且消息没有被改动过，这是完整性， 因为任何改动都会让你算出的散列值变掉。
Here is the question that catches people.
下面是这道会绊倒人的题。
Alice sends Bob a contract.
爱丽丝给鲍勃发一份合同。
She wants Bob certain it came from her and was unaltered, AND she wants nobody else to be able to read it.
她希望鲍勃确信这份合同来自她本人且未被改动， 同时又希望别人都读不到它。
Which keys, in which direction?
用哪些密钥，朝哪个方向用？
These are two different jobs.
这是两件不同的事。
For the signature, Alice hashes the contract and encrypts the hash with HER OWN private key; Bob checks it with Alice's public key.
对于签名，爱丽丝把合同散列后， 用她自己的私钥加密这个散列值；鲍勃用爱丽丝的公钥来验证。
For confidentiality, Alice encrypts the contract with BOB'S public key, so only Bob's private key opens it.
对于保密，爱丽丝用鲍勃的公钥加密合同本身， 这样只有鲍勃的私钥才能打开它。
One rule keeps all four straight: you sign with your own private key, and you encrypt with the recipient's public key.
一条规则就能把四把密钥都理清：用自己的私钥签名， 用接收方的公钥加密。
And remember a signature does not hide anything — for secrecy as well, you must encrypt AND sign.
还要记住签名并不隐藏任何内容—— 要同时保密，就必须既加密又签名。
Put it all together for one request to a bank's website.
把这一切合起来，看一次访问银行网站的请求。
The server sends its certificate.
服务器送出它的证书。
The client verifies it against its trusted CAs.
客户端用自己信任的 CA 列表去验证它。
The client uses the server's public key to exchange a session key.
客户端用服务器的公钥来交换一个会话密钥。
Then the data flows, encrypted with that session key.
然后数据就用这个会话密钥加密着流动。
Now name what each piece defends against, because that is what the question asks.
现在要说出每一部分各自防的是什么，因为题目问的正是这个。
Encryption stops an eavesdropper reading the traffic.
加密阻止窃听者读到流量。
The certificate proves the server's identity, so you are not talking to an impostor.
证书证明服务器的身份， 使你不会在和冒名者对话。
And the integrity checks stop a man-in-the-middle silently ALTERING the data as it passes.
而完整性校验阻止中间人 在数据经过时悄悄篡改它。
Three different attacks, three different defences.
三种不同的攻击，三种不同的防御。
One more tool: proving who wrote something.
还有一个工具：证明某样东西是谁写的。
First, hashing — a hash function turns any message into a short, fixed-size digest.
先说散列——散列函数把任意长度的消息， 变成一段又短又固定长度的摘要。
It is one-way: you cannot get the message back, and changing a single letter changes the digest completely.
它是单向的：你没法从摘要还原出消息， 而且哪怕只改动一个字母，摘要都会完全不同。
To sign a message, you hash it, then encrypt that digest with your own private key.
要给一条消息签名，你先对它做散列， 再用你自己的私钥把那段摘要加密。
Anyone can decrypt it with your public key and compare it against their own hash of the message.
任何人都能用你的公钥把它解开， 并与他自己算出的消息摘要做比对。
If the two match, it came from you and nobody altered it.
两者一致，就说明消息来自你，而且没有人改动过。
Remember the rule: sign with your private key, encrypt with the recipient's public key.
记住这条规则：用自己的私钥签名，用对方的公钥加密。
Three marks to lock in.
三个要拿稳的分。
First, distinguish symmetric — one shared key, fast — from asymmetric, a public and private pair.
第一，分清对称加密——一把共享密钥、速度快——和非对称加密，也就是一对公钥私钥。
Second, explain the handshake, and why a certificate from a trusted authority proves identity.
第二，讲清楚握手过程，以及为什么一张来自受信任机构的证书能证明身份。
Third, a digital signature is a hash encrypted with the sender's private key — it proves origin and integrity, but it does not hide the message.
第三，数字签名就是用发送方私钥加密的一段散列值——它证明来源和完整性，但它并不隐藏消息内容。
Nail these, and this topic is yours.
掌握这些，这个专题就是你的了。