The symmetric walkthrough ended on a catch: Alice & Bob had to meet in person to share a secret. Here’s how asymmetric crypto removes that — three scenes, real bytes. Scroll. 👇
Agree on a secret over Eve’s own wire
No meeting. They’ve never even met — and Eve is watching every byte.
👩Alice🧔Bob🔑🗝️🔑🗝️🟢 🟢 😈Evetaps the wire
😈 sees both public keys — but can’t combine them into the secret ❓
👩 derives =🧔 derives
exchanging…
Each keeps a private key and sends only a public one. Mixing your own private key with the other’s public key lands on the same shared secret at both ends. Eve sees both public keys go by and still can’t compute it — that’s the Diffie–Hellman trick that removes the in-person meeting.
scroll ↓
Seal to someone’s published public key
Bob posts a public key once. Anyone can seal to it — only Bob can open it.
👩Alice🧔Bob🔒🔒😈Evetaps the wire
🔒 Eve’s copy: … — no private key, no message
🧔 Bob’s private key
“ship the plans at dawn”
✓ opened
😈 Eve / wrong key
🔒 rejected
sealed to · encapsulated key
HPKE bundles a fresh one-time key agreement to Bob’s public key with the AES-GCM sealing from the last page. Alice never contacted Bob first; Eve’s tapped copy is junk; a different private key can’t open it. Still no meeting.
Don’t hide it — prove who wrote it
Signatures aren’t about secrecy. Eve can read every word — she just can’t forge it.
👩Alice🧔Bob✉️🔏✉️😈Evetaps the wire
😈 reads it fine — but the stamp is Alice’s. Changing a byte breaks the signature, and Eve can’t make a new valid one without Alice’s private key.
🧔 Bob receives: I,Alice,authorizethetransfer
verifying…
Alice signs with her private key; Bob verifies with her public one. The message travels in the clear — this isn’t secrecy, it’s authenticity + integrity. Flip one byte and the check fails, which closes the last page’s open thread: it’s signatures that stop Eve posing as someone she isn’t.
Put together, that’s the modern handshake
Key agreement makes a shared secret with no meeting; signatures prove you’re agreeing with the right person; HPKE packages sealing to a public key. Chain them and two strangers get a private, authenticated channel over a wire Eve fully controls — the foundation under TLS, Signal, and every “🔒” in your address bar.