How Secrets Have Been Kept

The notebook page I opened today held a single word.

Secret

The best way to keep a secret is settled. You write it down nowhere and keep it only in your head. Paper gets stolen and files leak, but a thought you never spoke cannot be pulled out of you.

The trouble is that this rarely works in real life. Memory fades, people fall ill, and one day they are gone. Above all, most secrets are not made to be kept alone. A general has to tell the officers the plan, a bank has to show me my balance, and I have to send my password to a server. A secret becomes useful only when it reaches someone else. And the moment it travels, someone can listen in.

So for more than 2,500 years people have been wrestling with the same problem: how do I make sure only the person I'm talking to can read what I send? Today I follow how the answers have changed. From an age of hiding to an age of scrambling, from scrambling to proving, and now to an age in which quantum computers are shaking the scrambling itself.

Hide It, or Scramble It

There are two broad ways to pass on a secret. You can hide the fact that a message exists at all, or you can let the message be seen but make it unreadable. The first is called steganography; the second, cryptography.

An old example of hiding appears in Herodotus's Histories. In the 5th century BC, Histiaeus of Miletus shaved the head of a trusted slave, tattooed a message on his scalp, waited for the hair to grow back and sent him off. The recipient shaved the head again and read it. Slow, but sure. However thoroughly a guard searched the slave's bags, no message would turn up. But the moment someone thought to shave that head, the whole secret was out. Hiding is safe only as long as nobody finds it.

Scrambling is about being safe even when you're found. The Spartans wrapped a strip of leather around a rod called a scytale and wrote along it. Unwound, the strip was a jumble of letters; it only read properly when wound around a rod of the same thickness. Suetonius wrote that Caesar shifted each letter of his letters three places along the alphabet, so A became D and B became E. The basic structure of a cipher is already all there: a rule for scrambling (the algorithm), and a key that unlocks the rule (the thickness of the rod, the number of places to shift).

Frequency Gives the Secret Away

Caesar's method has a big weakness. There are only twenty-five keys, so you can simply try them all. So people moved on to swapping each letter for another chosen at random. That gives 26! possibilities, more than 4×10²⁶. Trying them all is impossible.

In 9th-century Baghdad, the scholar al-Kindi got past that wall. He noticed that in Arabic text, letters appear with different frequencies. In English, E is the most common, followed by T, A and O. However you swap the letters, those frequencies remain. The most common letter in the ciphertext is probably E. Once you have a few letters, you can fill in the rest from the shapes of words. This is frequency analysis, and it was the first demonstration that, however many possibilities there are, the habits of a language leak the secret.

One person paid for this technique with her life. In 1586, Mary, Queen of Scots, held captive in England, wrote an enciphered letter agreeing to Anthony Babington's plot to kill Elizabeth I. Her letters went in and out hidden in the stoppers of beer barrels, but that channel had been set up by Elizabeth's spymaster, Walsingham. The codebreaker Thomas Phelippes read the letter by frequency analysis, and it became evidence at her trial. Mary was executed in 1587 (British Library). She both hid and scrambled her secret, and it still was not kept.

The contest between makers and breakers went on. The Vigenère cipher, which turns one letter into several different letters, was called "the indecipherable cipher" for close to 300 years, until Babbage and Kasiski worked out in the 19th century how to find the length of its repeating key and make frequency analysis work again.

Secrets on the Airwaves

In the 20th century the problem grew. Radio. A letter has to be intercepted to be read, but radio waves are scattered across the sky. Anyone with a receiver hears exactly what you send. So secrets in the radio age leaned almost entirely on cryptography.

In January 1917, German Foreign Secretary Arthur Zimmermann sent an enciphered telegram to Mexico. If the United States entered the war, Mexico would side with Germany and in return win back Texas, New Mexico and Arizona. The British naval intelligence unit known as Room 40 intercepted and broke it, and the published telegram became one of the reasons the US joined the First World War (US National Archives).

In the Second World War, machines did the scrambling. Germany's Enigma used several rotors that turned with every keystroke, rewiring the machine as it went. Type the same A twice and you got different letters. Frequency analysis no longer worked as it was. The first to crack the machine was the Polish mathematician Marian Rejewski in 1932; when war came his work passed to Bletchley Park in Britain and led to Alan Turing's codebreaking machine, the Bombe. What broke was not the mathematics but the operation. Weather reports that began the same way every morning, keys that operators chose out of habit: human habits gave the way in.

The US military went the other way and used a human language as a code. On the Pacific front, around 400 Navajo soldiers served as code talkers, handling radio traffic. Navajo had no written form and a complex structure, so an outsider listening to a recording could make nothing of it. Military terms were coined from Navajo words: a submarine became an "iron fish," a bomber a "buzzard," bombs "eggs." The code is said never to have been broken.

Technology to scramble the voice itself appeared then too. SIGSALY, the secure telephone system Roosevelt and Churchill used from 1943, turned the voice into numbers and then added and subtracted random noise recorded on two identical phonograph records. Each record was used once and destroyed (NSA). A single terminal filled a room, but no one ever broke it.

There are also ways to hide the radio signal. In 1942 the actress Hedy Lamarr and the composer George Antheil received a patent (US 2,292,387) for "frequency hopping": the transmitter and receiver of a torpedo's guidance signal jump together between frequencies in a prearranged order, so it cannot be jammed. The idea reportedly came from player-piano rolls. An eavesdropper does not know which frequency to listen on. The Navy did not use the idea at the time, but the principle of hopping between frequencies by agreement is used in Bluetooth today.

Sometimes the simplest method has lasted longest. A one-time pad uses a string of random numbers as long as the message, once, and then throws it away. Claude Shannon proved that, if the rules are kept, it is impossible to break even in theory. The "numbers stations" on shortwave radio, where a voice reads out strings of digits, work this way. North Korea's Radio Pyongyang, which had stopped its numbers broadcasts after the 2000 inter-Korean summit, started them again in the summer of 2016, after 16 years (38 North). Anyone can hear the numbers, but only the person holding the pad can read them.

Break the rules, though, and that "impossible" collapses. During the war, short of pads, the Soviet Union printed some pages twice. Starting in 1943 the US dug into those duplicated pages and by 1980 had broken some 3,000 Soviet messages (the Venona project), exposing the spies who had passed on atomic bomb secrets (NSA). The mathematics was perfect; people just didn't keep the promise to use each page once.

How Do You Hand Over the Key?

Every cipher so far shares one problem. Sender and receiver must share the same key in advance: the scytale's rod, the day's Enigma settings, the book of pads. If you have a safe channel to deliver the key, you could just send the message that way. So armies ran separate couriers and codebooks for keys, at enormous cost.

In 1976 Whitfield Diffie and Martin Hellman turned the problem on its head. In their paper "New Directions in Cryptography," they showed that two people could create a key only they know just by talking over a public channel. The next year Rivest, Shamir and Adleman published RSA. You hand out a padlock (the public key) to everyone and keep the key that opens it (the private key) to yourself. Anyone can lock a box with your padlock and send it, but only you can open it. RSA's security rests on the fact that multiplying two large primes is easy, while splitting the result back into those two primes is enormously hard. The padlock icon in your browser's address bar that makes you feel safe owes a great deal to those two people and those three.

The fun part is that this, too, was originally a secret. At Britain's intelligence agency GCHQ, James Ellis, Clifford Cocks and Malcolm Williamson reached the same ideas first, in the early 1970s, but that was made public only in 1997. The people who invented the cryptography had to keep their own discovery secret for more than twenty years.

Then there is the question of whether you can trust the machine you hand your keys to. The Swiss company Crypto AG sold cipher machines to more than 120 countries over decades. In 2020 The Washington Post and the German broadcaster ZDF reported that from 1970 the company had been owned by the CIA and West Germany's BND, which deliberately weakened the machines and read their customers' communications (The Washington Post). However sound the mathematics, you also have to ask who built the box it comes in.

Proving Instead of Hiding

So far the story has been about making secrets unreadable. But the digital world has another kind of worry. How do I trust that a record has not been quietly changed later? The date on a contract, the figures in a ledger, the money I sent.

The tool here is the hash. A hash function takes any data and produces a fingerprint of fixed length. Change a single character and the fingerprint is completely different, and you cannot work backward from the fingerprint to the data. In 1991 Stuart Haber and Scott Stornetta proposed chaining each document's fingerprint with the fingerprint of the one before. Tamper with one link and every fingerprint after it stops matching, so you get caught. From 1995, the company they founded printed the latest fingerprint in the chain in the classified ads of The New York Times every week. No one can alter hundreds of thousands of newspapers scattered across the country, so that fingerprint became a kind of notarization.

Three of the eight references in the Bitcoin white paper, published in 2008 under the name Satoshi Nakamoto, are papers by Haber and Stornetta (Bitcoin white paper). Bitcoin bundles transactions into blocks and chains them with hashes. On top of that it adds proof of work. To attach a new block you must find a number that makes its fingerprint start with a certain number of zeros, and the only way to find it is to try over and over, which takes enormous computation. To rewrite a past record you would have to redo all the computation from that block to the present, while everyone else keeps extending the chain. You can't catch up.

There's an interesting reversal here. The Bitcoin ledger is not secret. Anyone can see every transaction. What it protects is not the content but the fact that nothing has been altered. Instead of hiding the secret, it lays everything out for everyone, and because everything is laid out, no one can change it. Certificate Transparency logs, which watch for web certificates being issued behind anyone's back, run on the same idea.

Zero-knowledge proofs go a step further. You don't reveal the secret; you prove only that you know it. You prove "I am an adult" without a birth date, or "this transaction stayed within the balance" without the amount. In 2016 Zcash used this to record only that a transaction was valid, while hiding the sender, the recipient and the amount. Today it is widely used on the Ethereum side in "rollups," which bundle many transactions and post just one proof that the computation was correct.

And with Bitcoin, the notebook's first thought comes back. Owning bitcoin means holding a secret called a private key. Many wallets show that key as 12 or 24 English words and tell you to write them down on paper. There was even a fashion for "brain wallets" that you memorize: keys made from a sentence of your own choosing. But sentences easy for people to think of were easy for attackers to think of too. Wallets made from famous lines of poetry or proverbs were emptied the moment money arrived. A secret kept only in memory is safe, but a secret easy for people to remember is also easy for others to guess.

Computing Without Opening

Cryptography long accepted one limit. To use data, you have to decrypt it first. Whether you're analyzing hospital records or handing your photos to an AI, whoever does the computing ends up seeing the original. The moment you hand data to the cloud, your secret sits in someone else's computer memory.

Homomorphic encryption breaks that assumption. Add or multiply ciphertexts, and when you decrypt the result you get the sum or product of the originals. The server does the computation without ever seeing the numbers, and only I, holding the key, see the answer. Picture a jeweler working through the gloves of a sealed glove box. If ordinary encryption is a safe, homomorphic encryption is a safe with glove holes.

The idea is old. In 1978, the year after RSA, Rivest, Adleman and Dertouzos asked whether such "privacy homomorphisms" were possible. RSA itself is in fact homomorphic for multiplication: multiply two ciphertexts and you get a ciphertext of the two plaintexts multiplied. In 1999 the Paillier cryptosystem made addition possible. But "fully homomorphic" encryption, doing both addition and multiplication as many times as you like, stayed out of reach for thirty years. Ciphertexts deliberately carry noise, and every computation made the noise grow until the answer was ruined.

In 2009 Craig Gentry broke through that wall in his PhD thesis, with a method called bootstrapping: before the noise grows too large, you "clean" the ciphertext while it stays encrypted. In early implementations one cleaning took about half an hour; today, depending on the scheme, it takes less than a second.

A Korean name looms large in this story. CKKS, published in 2017 by Professor Cheon Jung Hee's team at Seoul National University, is a homomorphic scheme for approximate arithmetic on real numbers, with decimal points, rather than exact integers (CKKS paper). AI runs far more on approximate numbers than on exact integers, so this opened a wide path to running machine learning on encrypted data. Almost every major homomorphic encryption library now supports CKKS. At MWC in Barcelona in March 2026, LG Uplus showed an AI call app with homomorphic encryption built in, and CryptoLab, the company Cheon founded, promoted its technology there as well (Boan News).

It has already reached everyday life. In 2024, with iOS 18, Apple used homomorphic encryption in Live Caller ID Lookup, which caller-ID apps rely on. When an unknown number calls, the phone encrypts the number and asks the server, and the server answers without knowing which number it was looking up. Apple open-sourced the library (Swift.org). A similar approach lets the Photos app recognize landmarks (Apple Machine Learning Research).

It isn't free, of course. Doing the same computation under encryption is still thousands to millions of times slower than on plaintext, and ciphertexts are much larger than the data. So it isn't used for everything; it's chosen for narrow computations that truly must stay hidden. Other technologies reach similar goals by different means: multi-party computation, where several parties split their data into shares and compute together, and trusted execution environments (TEEs), locked rooms inside a chip where data is decrypted only within. The difference is whether you cut glove holes in the safe, break the safe into pieces, or lock the whole room.

What Quantum Computers Shake

Now for the loudest story of the moment. I said RSA's security rests on how hard it is to split a large number into primes. The elliptic-curve cryptography widely used today rests on a similar kind of hard problem. In 1994 Peter Shor published an algorithm showing that a quantum computer could solve both problems quickly. A calculation that would take today's computers longer than the age of the universe could finish in days on a large enough quantum computer.

Fortunately, not all cryptography is in the same position. For symmetric ciphers like AES, where both sides share one key, Grover's algorithm (1996) only speeds up the key search by a square root. Doubling the key length is enough. What's at risk is the public-key invention I described earlier, the one that solved "how do you hand over the key." Almost every connection on the internet starts by agreeing on a key this way.

The question is when that large quantum computer will arrive, and the estimates have been shrinking alarmingly every year. In 2019 Google's Craig Gidney and Martin Ekerå calculated that breaking RSA-2048 in eight hours would take 20 million noisy physical qubits (arXiv 1905.09749). In May 2025 Gidney published a new estimate: under the same hardware assumptions, fewer than a million qubits in under a week (arXiv 2505.15917). In 2026 preprints appeared claiming that with different error correction, around 100,000 would do (The Quantum Insider). They are not yet verified, and the run time stretches to about a month, but the direction is clear. The largest quantum computers today have a few thousand physical qubits. Still a long way off. Even so, the number of qubits thought necessary has fallen to about one two-hundredth in seven years, though each estimate assumes different hardware, so they can't be compared directly.

The timing is what's truly frightening. Attackers don't need to wait for a quantum computer. They can store encrypted traffic now and decrypt it later. Because of this "harvest now, decrypt later" strategy, information that must stay secret for ten or twenty years is already at risk. The Canadian cryptographer Michele Mosca summed it up in a simple inequality: if how long the information must stay secret (x) plus how long it takes to switch to new cryptography (y) is longer than the time until a quantum computer arrives (z), you are already late.

So the world is switching. After an eight-year competition, the US National Institute of Standards and Technology (NIST) finalized three post-quantum standards (FIPS 203, 204 and 205) in August 2024, built on mathematical problems believed hard even for quantum computers (NIST). In March 2025 it picked one more, HQC, as a backup. NIST has also put out a draft schedule to deprecate today's RSA and elliptic-curve cryptography from 2030 and disallow them from 2035. In March 2026 Google said it would finish its own migration by 2029, citing faster-than-expected progress in quantum hardware and in factoring estimates (Dark Reading). Messengers have already switched: Signal added post-quantum key exchange in 2023, and Apple's iMessage in 2024.

Korea has been preparing on its own track. In July 2023 the government announced a plan to move the national cryptographic system to post-quantum cryptography by 2035, and in January 2025 the Korean Post-Quantum Cryptography competition (KpqC) selected four final algorithms: SMAUG-T and NTRU+ for key exchange, and HAETAE and AIMer for digital signatures (Byline Network). Cheon's team, the creators of CKKS, worked on SMAUG-T and HAETAE. In 2026, pilot migrations are running in five sectors: telecommunications, defense, finance, space and transport.

Bitcoin is in a tougher spot. Some Bitcoin addresses already have their public keys exposed on the ledger: early-style addresses, and addresses reused after sending funds once. With a large quantum computer, you could compute the private key from the public key and move the coins. Analyses suggest such coins number in the millions, including the roughly one million believed to be Satoshi's. In February 2026 BIP-360, which proposes an address format not exposed to quantum attack, was merged into the official repository as a draft (Forbes), but the debate over what to do with old coins whose owners never move them is fierce. Leave them, and whoever first has a quantum computer takes them; let the network freeze them, and it breaks its own promise that no one can touch your money. And owners who have lost their keys can't move them at all. Secrets kept only in memory, gone along with their owners.

Quantum physics also offers a new way to keep secrets. A quantum state changes the moment it is measured. Using this, you can share a key over a channel where any eavesdropping is bound to leave a trace: quantum key distribution (QKD). In 2017 China used its Micius satellite for a video call between Beijing and Vienna encrypted with quantum keys, and Korean telecom companies have deployed the technology on some links. It entrusts the secret to the laws of physics rather than to hard math. But distance, cost and trust in the equipment remain problems, so most countries are making mathematically based post-quantum cryptography their mainstay and adding QKD only on special links.

Playground: The Secret Lab

Hearing about it only goes so far, so I made four things you can touch. The first tab encrypts a sentence with a letter shift, then cracks it without the key using frequency analysis. The second is a five-block hash chain. Change one letter in a middle block and everything after it turns red; you can see how many tries proof of work takes to reattach it. The third is a homomorphic sum that adds three people's salaries while they stay encrypted. Whoever does the computing never sees a single number. The fourth is a quantum clock built on Mosca's inequality, to check whether your data is already too late.

In the End, People Are the Weakest Link

Looking back over 2,500 years, one thing stands out. When secrets broke, it was surprisingly rare for the mathematics to lose. Mary trusted the channel, Enigma operators chose keys out of habit, the Soviets economized on pads, many countries trusted boxes built by others, and brain-wallet owners picked sentences others could think of. That is also why quantum computers are truly frightening. Not so much because the math breaks, but because people may not replace in time the decades of devices and habits built on trusting that math.

So, back to the notebook's first thought: it is half right. A secret kept only in memory is the safest. But it can't be passed on, and if I forget it, it is gone forever. For 2,500 years people have searched for a balance between those two: hiding, scrambling, laying everything open and proving, even computing without opening. And now, once again, we are changing the locks.

A Page for Today is a series where I open my idea notebook to a random page and lay that day's thoughts on the line I find there. Today a single word became the twenty-third piece. There are no secrets in this one. Everything is laid out, so if you see something to fix, just let me know.