TLS & Encryption Basics
The problem
Data traveling over the internet passes through machines you don't control and can't trust — routers, ISPs, anyone on the same network — so without encryption, everything sent in plain HTTP (passwords, personal data) is readable by anyone in the path. TLS makes the connection private and verifies you're actually talking to who you think you are.
Why now
HTTP fundamentals established the request/response conversation, but said nothing about who else can read it. Modular arithmetic already introduced modular exponentiation as the basis of RSA encryption; TLS is where that math gets applied to secure a real conversation, combining it with symmetric encryption for speed.
Mental model
TLS solves two problems at once: proving identity (via a certificate chain rooted in a trusted authority) and establishing a private channel (via a handshake that negotiates a shared secret key, using slow-but-clever public-key math briefly, then switching to fast symmetric encryption for the actual data). HTTPS is just HTTP conducted entirely inside that private, verified channel.
Requires
- HTTP FundamentalsNetworking
TLS's entire purpose in the context of the web is protecting an HTTP conversation; you need to know what's being protected (the request/response exchange) before the protection mechanism is meaningful.
- Modular ArithmeticMathematical Thinking
Public-key cryptography (RSA and friends), used during the TLS handshake to establish a shared secret, is built directly on modular exponentiation — the same operation modular-arithmetic's usedIn already flagged as cryptography's foundation.
Unlocks
Used in
- HTTPS — the padlock icon in every browser address bar
- Certificate authorities and the trust chain that verifies a website's identity
- API authentication tokens, which rely on the transport already being encrypted
- VPNs and secure shell (SSH), which use related public-key handshake concepts
Projects
- Inspect a real website's TLS certificate in the browser and trace its trust chain back to a root certificate authority
- Explain, step by step, what happens during a TLS handshake, from ClientHello to the first encrypted application data
Examples
- A browser rejects a site with an expired or self-signed certificate because the trust chain can't be verified
- TLS switches from slow public-key math (for the handshake) to fast symmetric encryption (for the actual data) purely for performance
Resources
Mastery checklist
- I can explain what problem TLS solves that plain HTTP does not
- I can explain the difference between symmetric and asymmetric encryption and why TLS uses both
- I can inspect a website's certificate and identify its issuing authority
- I can explain why a browser warns about an invalid or expired certificate