Everyone can hear the wire
When your phone talks to a bank, the message passes through radio links, cables and routers owned by other people. Any of them could keep a copy. Cryptographers picture this as two people, Alice and Bob, at either end of an open channel, and an eavesdropper, Eve, in the middle who sees everything sent along it.
In the Scene the channel is a glass tube. Each capsule that passes the brass sleeve in the middle is copied down Eve’s tap into her tray. She cannot stop the capsules or change them; she can only read what is inside.
A lock both ends share
The oldest answer is a shared secret key. Alice scrambles her message with it, and only someone holding the same key can unscramble it. This is symmetric encryption, and it is how almost all data is protected today, with ciphers such as AES.
What Eve copies is a row of bytes that looks like noise. Her one general attack is to try every possible key until the message makes sense. A key of n bits has 2ⁿ possible values, so each extra bit doubles her work. An 8-bit key has 256 values, and a machine that tries a trillion keys a second gets through them all in a quarter of a nanosecond. The Data Encryption Standard, adopted in the United States in 1977, used 56 bits. In 1998 a purpose-built machine found a DES key in under three days. A 128-bit key has about 3.4 × 10³⁸ values: at the same trillion a second, trying them all takes about 10¹⁹ years, nearly a billion times the age of the universe.
Try it: press Toy under Key size and read the bottom of Eve’s board, then press DES, 1977 and Today. Watch the pink part of her glass cube, the share of all keys she could try in a lifetime, shrink to nothing.
On average Eve finds the key halfway through, which saves her only one bit. The punched brass card at each end is the key itself: one hole for every 1 in its binary form, so a longer key means more holes.
Mixing paint in public
A shared key raises a harder question. Alice and Bob must agree on it first, and the only way to talk is through Eve’s tube. In 1976 Whitfield Diffie and Martin Hellman published a way to do it in public. Cryptographers at Britain’s GCHQ had found the same idea a few years earlier, but it stayed secret until the 1990s.
The idea is often explained with paint. Everyone, Eve included, knows a public colour, yellow. Alice picks a secret colour, red, and Bob a secret blue. Each mixes the public colour with their own secret and sends the mixture: Alice an orange, Bob a green. Then each adds their own secret to the mixture they received. Alice’s jar holds yellow, blue and red; Bob’s holds yellow, red and blue. Equal parts of the same three paints make the same colour, so both end with an identical brown.
Eve has the yellow, the orange and the green. Pouring the two mixtures together does not help, because that jar has two parts of yellow and comes out too yellow. To get the secret colour she would need to pull red back out of the orange, and paint cannot be unmixed.
The maths underneath
Paint is only an analogy. The real exchange swaps mixing for a calculation that is easy one way and, as far as anyone knows, very hard to undo. Alice and Bob publicly agree on a prime number p and a number g. Alice picks a secret a and sends A = gᵃ mod p; Bob picks a secret b and sends B = gᵇ mod p. “Mod p” means keep only the remainder after dividing by p, like reading a clock with p positions: the dial in the Scene shows where each number lands.
Alice then works out Bᵃ mod p and Bob works out Aᵇ mod p. Both equal gᵃᵇ mod p, the same number s, which becomes their shared key. Eve sees g, p, A and B. To find s she needs a or b, which means solving gˣ mod p = A for x: the discrete logarithm problem. Raising to a power takes a computer a tiny fraction of a second even for numbers hundreds of digits long. Undoing it has no known fast method, so for a large prime Eve is reduced to something like trying exponents one at a time.
At the Toy size the Scene uses p = 227, small enough to check by hand. Every size uses a safe prime just below 2ⁿ (one where (p − 1)/2 is also prime) and a g whose powers reach every non-zero position on the dial. The numbers on the boards and tiles are the real results; long ones are shortened to their first and last digits.
Try it: step Unlock step by step to The maths, press Toy and check that Alice’s and Bob’s keys match. Then press 256-bit and watch the numbers grow to 78 digits while the dial fills with positions too close to draw.
How big is big enough
Brute force is the floor of an attack, not the ceiling. For a symmetric cipher such as AES, no attack known is much better than trying keys, so 128 bits is ample. Discrete logarithms are different: clever algorithms solve them far faster than trying every exponent, so the prime in a real exchange has 2,048 bits or more to give security comparable to a 128-bit key. Modern systems mostly use the same idea on an elliptic curve, where no such shortcut is known and numbers of about 256 bits suffice.
A large quantum computer running Shor’s algorithm could solve discrete logarithms quickly, so new key exchanges built on different hard problems are now being deployed alongside the old ones.
What this model leaves out
Eve here only listens. An eavesdropper who can also change capsules can run one exchange with Alice and another with Bob, and read everything in between. Real protocols such as TLS stop this man-in-the-middle attack by having each side sign its part of the exchange, checked against certificates.
The scrambling in the Scene is a toy stream cipher, not AES, and the guessing rate of a trillion keys a second is an assumption; a very large machine could be a million times faster, which changes 128 bits from about 10¹⁹ years to about 10¹³. Even the 256-bit preset’s prime is far smaller than the 2,048-bit primes real exchanges use: the Scene’s arithmetic is exact, but an exchange over the Today preset’s 128-bit prime would fall to discrete-logarithm algorithms long before Eve’s brute-force count ran out. Real attackers also look for mistakes rather than doing the maths: stolen keys, poor random numbers and leaks through timing or power use break more systems than brute force does.