> Lesson 1 of PKI in 90 minutes: how one shared secret key encrypts data, and why delivering that key safely does not scale to the internet. Source: https://pkizerotohero.com/course/secrets-and-sharing/ · Last reviewed: 2026-10-20 # Secrets and the sharing problem About 8 minutesCrash course **In one sentence:** One shared secret key can encrypt anything strongly, but getting that key safely to everyone who needs it does not scale, and that is the problem PKI exists to solve. ## The situation Your finance team emails an encrypted spreadsheet to an outside auditor. Then someone asks: “How do we send the password?” One person suggests a second email. Another suggests a text message. A third says to read it out on a call. That small, awkward moment is the oldest problem in cryptography. It is also the reason PKI exists. ## What is going on **Encryption** scrambles data so that only someone with the right key can turn it back. A [key](https://pkizerotohero.com/handbook/glossary/#key) is simply a large random number. The scrambled result is called [ciphertext](https://pkizerotohero.com/handbook/glossary/#ciphertext): anyone may see it, but without the key it is useless. In [symmetric encryption](https://pkizerotohero.com/handbook/glossary/#symmetric-encryption), the same key locks and unlocks. Modern symmetric ciphers such as [AES](https://pkizerotohero.com/handbook/glossary/#aes) are fast and very strong. Guessing a 128-bit key by trying every possible value would take any computer that exists far longer than the age of the universe. So the weak point is almost never the mathematics. It is the key. ### Why the key is the hard part Your message does not travel straight to the other person. It passes through Wi-Fi routers, mail servers and internet providers, and any of them could keep a copy. Encryption makes that copy worthless, unless the key travelled the same way. Both sides need the same key before they can talk privately. People try three ways to share it: - **Send it over the same channel.** Anyone who copied the ciphertext can copy the key too. - **Send it over a second channel**, such as a text message or a phone call. Better, but now you must trust that channel as well, and a person has to do it every time. - **Meet in person.** Safe, but it does not scale. *Diagram: You and an auditor each hold the same secret key K. Only ciphertext crosses the network, where others can copy it. A dashed arrow asks how key K gets to the auditor safely. Below, the number of keys needed grows from 1 key for 2 people to 45 keys for 10 people and 499,500 keys for 1,000 people.* Encryption protects the data in transit. The key still has to reach the other side, and every pair needs its own. Scale is what really breaks it. Every pair of people who want to talk privately needs their own key; otherwise one person could read messages meant for another. With *n* people that is *n* × (*n* − 1) ÷ 2 keys: 45 keys for 10 people and 499,500 for 1,000. Each key must be delivered secretly, stored safely and replaced if it leaks. The web has it worse. Your browser talks to sites it has never met before, thousands of them, and there is no time to meet anyone. This is the [key-distribution problem](https://pkizerotohero.com/handbook/glossary/#key-distribution). Symmetric encryption is not wrong: it still protects almost all data on the internet, including inside HTTPS. What is missing is a safe way to agree on a key with a stranger, and to know who that stranger is. Lessons 2 to 4 build both. Common mistake Encrypted does not mean safe from everything Encryption keeps the content secret from people without the key. On its own it does not tell you who is on the other end. A perfectly encrypted conversation with the wrong person is still a leak. Why it matters to the business Ask your team Where do we still send passwords, API keys or encryption keys by email or chat? If one shared key leaked today, which systems and partners would have to change it, and who would do it? ## Try it No tool needed for this one. Take two minutes for a thought exercise. 1. **Count the keys.** List the outside parties your team exchanges confidential files with. Add your own team. If every party must be able to talk privately to every other party, how many secret keys is that? Use *n* × (*n* − 1) ÷ 2. 2. **Trace one key.** Pick one of those keys and write down how it reaches the other side today. If the honest answer is “by email” or “in the same chat”, that key travels the same way as the data it protects. ## Check Check yourself Your team encrypts a file with AES and emails it. A second email carries the password. Why is the file not well protected? 1. Anyone who can read the mailbox, or copy the traffic, gets both the file and the key 2. AES is too weak for modern computers 3. Large files cannot be encrypted safely Show answer Answer A Anyone who can read the mailbox, or copy the traffic, gets both the file and the key What happened Anyone with access to that mailbox or that traffic receives the ciphertext and the key, and simply decrypts. Why Encryption is only as private as its key. The strength of AES does not help once the key travels the same way as the data. The rule Never send a key over the same channel as the data it protects. Check yourself Twenty people must each be able to talk privately to every other person, using only shared secret keys. How many keys is that? 1. 20 2. 190 3. 400 Show answer Answer B 190 What happened Each pair needs its own key: 20 × 19 ÷ 2 = 190. Why One group key would let every member read every other member's messages. Separate keys per pair keep conversations private, but their number grows roughly with the square of the group. The rule With n people, pairwise secret keys number n × (n − 1) ÷ 2, which is why shared secrets alone cannot scale to the internet. Check yourself Which statement about symmetric encryption is true today? 1. Public-key encryption has replaced it on the web 2. It is only used to store passwords 3. It still encrypts almost all data in transit, including HTTPS; the hard part is agreeing the key Show answer Answer C It still encrypts almost all data in transit, including HTTPS; the hard part is agreeing the key What happened Symmetric ciphers such as AES still do the bulk of the work, including inside every HTTPS connection. Why They are fast and strong. Public-key cryptography is used to agree on the symmetric key and to prove identity, not to replace it. The rule Symmetric encryption moves the data; public-key cryptography and PKI let strangers agree on a key and know who they are talking to. ## Takeaways - One shared secret key both encrypts and decrypts. The mathematics is strong, so the key is the weak point. - Every pair needs its own key and a safe way to deliver it, and that does not scale to millions of strangers. - Public-key cryptography and PKI exist so that strangers can agree on keys and know who is on the other end. ## Go further - Handbook: [Symmetric encryption: one shared key](https://pkizerotohero.com/handbook/symmetric-encryption/) - Handbook: [The key-distribution problem](https://pkizerotohero.com/handbook/key-distribution/) - Next lesson: [Two keys](https://pkizerotohero.com/course/two-keys/) **Early edition.** Checked against the standards; an independent expert review is in progress. Found a mistake? [Tell us](https://pkizerotohero.com/contact/?topic=content-error&page=/course/secrets-and-sharing/). Last reviewed 20 October 2026Edition 0.9 ## Go deeper in the handbook - [Chapter 1: Symmetric encryption: one shared key](https://pkizerotohero.com/handbook/symmetric-encryption/) - [Chapter 2: The key-distribution problem](https://pkizerotohero.com/handbook/key-distribution/)