RSA rests on one asymmetry: multiplying two primes is instant, and pulling them back apart is not. Everything else is arithmetic you can do here with numbers small enough to read. Nothing below is a simulation — the modular exponentiation is genuinely being computed, just with toy-sized primes.
parameters
p and q must be prime and different. m must be smaller than n, which is why real RSA encrypts a key, not a message.
the key pair
encrypt · decrypt · sign
modular exponentiation, step by step
Nobody computes me and then reduces — the number would be astronomical. Square-and-multiply walks the exponent's bits instead.
break it
The public key hands out n. Recover p and q and the private key falls out.
RSA can encrypt a key, but if the server's private key ever leaks, every past conversation decrypts. Diffie–Hellman fixes that: the two sides build a shared secret out of numbers they throw away afterwards, and the wire never carries it. That property is forward secrecy, and it is why TLS 1.3 dropped RSA key exchange entirely.
parameters
a and b never leave their machines. Real TLS uses elliptic curves for this, which is the same idea with a harder-to-picture group.
the exchange
on the wire
break it
The eavesdropper has p, g, A and B. Finding a from A is the discrete logarithm problem — here it is small enough to brute force.
This page runs the real TLS 1.3 key schedule in your browser using WebCrypto: a genuine P-256 ECDH agreement, then HKDF-Extract and HKDF-Expand-Label exactly as RFC 8446 specifies, ending in an AES-GCM record you can tamper with. Every value below came out of your own machine's crypto.
controls
Flip a bit and the GCM tag stops matching, which is what "authenticated encryption" buys you: a modified record is not decrypted-wrongly, it is refused.
ecdhe
hkdf ladder
a protected record
Now the whole thing in order. Change the settings and the ladder redraws — round trips, what is encrypted, and what someone tapping the wire still gets to see.
connection settings
what a wiretap sees
ladder
notes
Key agreement stops eavesdropping but not impersonation — you would happily agree a key with an attacker. Certificates fix identity: a chain of signatures ending at a root your machine already trusts. The signing below is real ECDSA, done in your browser.
the chain
Tampering changes one byte of the signed data. The CA's signature was over the original, so verification fails — which is the entire mechanism.