5 ms·

Or how about we call it the lock. There's the (private) key, and it fits the lock (public key). You can pass the lock around, but you need the (private) key to

Or how about we call it the lock. There's the (private) key, and it fits the lock (public key). You can pass the lock around, but you need the (private) key to be useful.

danw1979 1mo ago
I dunno if that works or is any less confusing, to be honest. I don’t think there’s any process or entity in the physical world that is reasonably familiar to most people that is even remotely suitable as an analogy to public key cryptography.
- tialaramex 1mo ago
  I think this is worth highlighting. Public Key Cryptography is a surprising idea. Like Computation, if you'd told a 19th century mathematician about this, they might buy it as a concept but deem it unlikely to ever happen in practice or be of any significance, in the 20th century these were both realised and caused a massive change to our society. These are not analogs to things ordinary people had already seen. For Computation we just got used to it being everywhere and so we don't need to explain it so much.
- raddan 1mo ago
  For what it’s worth, it’s the analogy I use, and for the twenty or so college sophomores I taught on Tuesday, the analogy is sufficiently understandable that they were able to generate and use SSH key pairs to do their homework. I think the reason we (the HN crowd) don’t like it is that the analogy starts to break down when you start thinking through all of the operations you can do with public keys. But this does not matter much for somebody learning to use them for the first time. I’ve had to grow comfortable with the idea of giving people imperfect explanations so that they can build an intuition. Once that happens I can return with the mathematics so that they can really understand what is going on.
  - faxmeyourcode 1mo ago
    This analogy is exactly what made it click when I was a teenager.
Reubachi 1mo ago
More people being exposed to asymetric keys probably leads to some confusion when imagining the public keys roll as lock in a symetric system. IE; the existence of the asymetry allows for the public key to function more than just a "lock", but a much more easy to rationalize "signer attestation.
TeMPOraL 1mo ago
Except it makes no sense if you look at the thing, because then you realize that the "lock" and "key" are literally the same thing. In the real world, the lock and the key are completely different objects - there's no way to confuse which is which (and there's no way for one to act as the other if you use them in opposite order, either). The analogy doesn't make sense because it's skipping the existence of the third thing that's the actual (pad)lock - the encryption/decryption software. And it does that because it wants to talk about data as having the property of being "locked", which makes no sense in the first place, but that one isn't immediately obvious. The whole analogy of locks and keys fundamentally makes no sense when talking about data, because locks are external devices, attached to or directly containing the protected thing, while encryption is the process of scrambling the very thing being protected. All confusion stems from this bad choice of analogy, trying to "make it simple" for the normies.

Or how about we call it the lock. There's the (private) key, and it fits the lock (public key). You can pass the lock around, but you need the (private) key to be useful.

danw1979 1mo ago

I dunno if that works or is any less confusing, to be honest. I don’t think there’s any process or entity in the physical world that is reasonably familiar to most people that is even remotely suitable as an analogy to public key cryptography.

tialaramex 1mo ago
I think this is worth highlighting. Public Key Cryptography is a surprising idea. Like Computation, if you'd told a 19th century mathematician about this, they might buy it as a concept but deem it unlikely to ever happen in practice or be of any significance, in the 20th century these were both realised and caused a massive change to our society. These are not analogs to things ordinary people had already seen. For Computation we just got used to it being everywhere and so we don't need to explain it so much.
raddan 1mo ago
For what it’s worth, it’s the analogy I use, and for the twenty or so college sophomores I taught on Tuesday, the analogy is sufficiently understandable that they were able to generate and use SSH key pairs to do their homework. I think the reason we (the HN crowd) don’t like it is that the analogy starts to break down when you start thinking through all of the operations you can do with public keys. But this does not matter much for somebody learning to use them for the first time. I’ve had to grow comfortable with the idea of giving people imperfect explanations so that they can build an intuition. Once that happens I can return with the mathematics so that they can really understand what is going on.
- faxmeyourcode 1mo ago
  This analogy is exactly what made it click when I was a teenager.

Reubachi 1mo ago

More people being exposed to asymetric keys probably leads to some confusion when imagining the public keys roll as lock in a symetric system. IE; the existence of the asymetry allows for the public key to function more than just a "lock", but a much more easy to rationalize "signer attestation.

TeMPOraL 1mo ago

Except it makes no sense if you look at the thing, because then you realize that the "lock" and "key" are literally the same thing. In the real world, the lock and the key are completely different objects - there's no way to confuse which is which (and there's no way for one to act as the other if you use them in opposite order, either). The analogy doesn't make sense because it's skipping the existence of the third thing that's the actual (pad)lock - the encryption/decryption software. And it does that because it wants to talk about data as having the property of being "locked", which makes no sense in the first place, but that one isn't immediately obvious. The whole analogy of locks and keys fundamentally makes no sense when talking about data, because locks are external devices, attached to or directly containing the protected thing, while encryption is the process of scrambling the very thing being protected. All confusion stems from this bad choice of analogy, trying to "make it simple" for the normies.