A step-by-step series implementing RSA from scratch in Python: the maths, real primes, text encoding and timing side channels.
Key generation works, encryption round-trips, the math is provably right — and an attacker can still recover the private key by timing your decryptions. Here are both defenses, measured, with what they actually cost.
Part 1 used 15-bit primes and only encrypted integers. Making it usable means generating 1024-bit primes and chunking bytes — and the standard way to do the second one silently destroys data on inputs the tests never cover.
Every HTTPS connection you have ever made runs on a 1978 paper. You can build the core of it in about fifty lines of Python — and then see exactly why those fifty lines would get you destroyed in production.
