ICT-Health Understanding encryption by using it

Secret post: unbreakable messages

Enough watching. Now you're going to actually do it: you make a key card, you swap it with a friend, and from then on you send each other messages that no one else can read. Not your parents, not your teacher, not WhatsApp itself. The message just travels over WhatsApp — but what's inside, you only decrypt here, with your card.

Words you might need

Key card
Your key pair from chapter 5, but tangible now. The public key is printed on it to give away; the secret key is a row of 64 characters you keep on paper. Lose your browser, and you type those 64 characters back in and everything is restored.
Add a friend
Storing someone else's public key, along with a name. From then on you can write "to Sam" instead of pasting a key every time.
The link with a #
The encrypted message sits inside a link, after the hash mark. Whatever comes after a # is never sent to a server by a browser. Whoever clicks the link ends up here with the message already filled in — and decrypting happens in their own browser.
Level 1 and level 2
Level 1: you agree on a password (chapter 4). Level 2: you swap key cards, and no password is needed anymore (chapters 5 and 6). Level 2 is the real deal.

Step 1 — Make your key card

Your card

Your keys are made in your browser and stored only there. Nothing goes to a server. Clear this site's data, and your card is gone — unless you have it on paper.

  1. Type your first name. Your friends will see it with your messages.
  2. Click Make my key card. Your browser picks a random 78-digit number (your secret key) and works out the matching point on the curve (your public key). That takes a fraction of a second.
I already have a card on paper — restore it

Step 2 — Add your friends

Friends

  1. Ask your friend to make their key card and send it to you over WhatsApp (the button above, on their side).
  2. Paste what you got below — you can paste the whole message, the site will fish the key out of it.
  3. Give it a name and click Add.

No friends yet. As long as that's the case, you can send messages with an agreed password (level 1).

    Step 3 — Write a secret message

    Writing

    1. Choose who to. A friend with a key card, or someone without — then you agree on a password (not over WhatsApp: whisper it, or write it on a scrap of paper).
    2. Write your message and click Encrypt.
    3. Click Share via WhatsApp, or copy the link and paste it wherever you like.

    Read a secret message

    Reading

    Clicked a shared link? Then the message is already here and already decrypted.

    What's really happening

    1. Your browser takes your secret key and the public key of your friend and mixes them — the paint trick from chapter 5, on the curve from chapter 6. Out comes a shared secret that only the two of you can produce.
    2. From that secret it makes an AES key and encrypts your message (chapter 4), with a wax seal against tampering.
    3. Your public key travels along with the message, so your friend knows who to mix with. That's fine: it's public.
    4. Your friend mixes their secret key with your public one. Same brown colour. Same AES key. Message unlocked.

    WhatsApp sees a link with a long tail. This site's server sees nothing at all: the tail sits behind a #. Whoever intercepts the message has a package of AES ciphertext and one public key — and without either of the two secret keys, that's worthless. Even we can't read it, and that's exactly how it should be.

    Being honest about the limits. This is real cryptography, the same building blocks as Signal and TLS. But it's a learning project, not a product. There's no check that the card you got from "Noor" really is Noor's — if someone else sends you a card with her name on it, you'll be writing to that someone else instead. (That's what certificates are for, chapter 7.) Use this to learn and to play, not for things your life depends on.

    This is math: why the mixing matches in both directions

    Your secret key is a number a, your public key the point a·G. Your friend's: b and b·G. You calculate a·(b·G). They calculate b·(a·G). That's both (a·b)·G — because multiplying numbers is commutative and point addition is associative. Two words from the very first algebra lesson, and together they're the reason you and your friend land on the same secret while an eavesdropper, who only sees a·G and b·G, never can. This is called Diffie–Hellman on an elliptic curve, and it's literally what your browser did when it opened this page.