The whisper code (how a call goes private)

The padlock, the sealed ID card, and the exact timings your own laptop measured today.

Before you start. You already know that no data moves until one full round trip happens first - the TCP handshake, from TCP vs UDP, and the 3-way handshake - and that a round trip is simply how long a message takes to get there and its reply to come back, measured in milliseconds (ms, thousandths of a second), from Reading a book aloud to America. This lesson spends a second round trip on top of that one, and shows you exactly what it buys.

The idea in 30 seconds

Two strangers can agree on a secret while a whole room listens, by splitting a lock into a half anyone can use to lock and a half only its owner can use to unlock.
That splitting trick (a public key) is slow, so it’s used once per visit, only to hand over a fast ordinary secret for the rest of the conversation.
The whole exchange, called TLS, costs one extra round trip - on this line, 35 ms on top of everything that already had to happen.
A public key proves nothing about who owns it until it travels inside a certificate, sealed by an outside certificate authority your laptop already trusts.
In 2011 one certificate authority, DigiNotar, sealed a fake card for google.com, and it silently exposed roughly 300,000 Gmail accounts in Iran before anyone caught it.
Even a perfect lock and a perfect seal still leak the name of the site you’re visiting, in a plaintext field called SNI.

Read the story · Skip to the numbers