← Back to Labs

Public-Key Operation Map

Switch between legacy RSA transport, modern ECDHE, and digital signatures to see which key does which job, where symmetric crypto takes over, and what later key theft really changes.

Initiatorclient or verifierPublic materialcert or key shareResponderserver or signerPrivate keynever publishedOutcomeshared secret or verdictcertificate public keyModern ECDHENormal trust and key lifecycleIdentity is long-lived. Session secrecy should not be.
Step 1 / 6The server publishes a certificate key, but the upcoming session secret will be ephemeral

The server still needs a long-term public key so the client knows who it is talking to, but that key is not the session secret itself.

primitive
Modern ECDHE
public key job
share + authenticate
private key job
authenticate transcript
forward secrecy
yes

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →