D. Topics in Computer Science · Topics in Computer Science: Sustainability, Emerging Research and CareersCryptography and Security: Keeping Secrets with Mathematics
D2.1About 75 minutes
Learning goals- I can explain plaintext, ciphertext, key, encryption and decryption.
- I can encrypt and decrypt with a Caesar cipher by hand and in Python, and explain why it is easy to break.
- I can explain the difference between symmetric and public-key cryptography and how they protect a website.
- I can describe hashing and current research areas in security, such as post-quantum cryptography.
Words to know
cryptography
The study of methods for keeping information secret and authentic, even when others can see it.
plaintext / ciphertext
The readable message, and its scrambled (encrypted) form.
key
The secret value that controls how a message is encrypted and decrypted.
symmetric encryption
Encryption in which the same secret key locks and unlocks the message.
public-key cryptography
Encryption that uses a pair of keys: a public key anyone can use to lock, and a private key only the owner can use to unlock.
brute-force attack
Breaking a code by trying every possible key.
hash function
A function that turns any input into a fixed-length output; it is easy to compute but practically impossible to reverse.
Secrets in plain sight
Every time you sign in to an account, pay online or send a private message, your information travels across networks that other people can see. Wi-Fi signals pass through walls. Data hops through many routers between you and a server. So how does anything stay private?
The answer is cryptography: mathematics that makes a message unreadable to everyone except the person with the right key. This lesson starts a tour of the emerging areas of computer science research named in the curriculum: cryptography, artificial intelligence, robotics, computer vision, parallel and distributed computing, data mining, security, geographic information systems and human–computer interaction.
The vocabulary
- Plaintext: the readable message, such as
MEET AT NOON. - Encryption: turning plaintext into ciphertext using a key.
- Decryption: turning ciphertext back into plaintext using the key.
- A good cipher is safe even if the attacker knows how it works, as long as they don't know the key.
The Caesar cipher
One of the oldest known ciphers is named after Julius Caesar, who is said to have used it. Each letter moves a fixed number of places along the alphabet. That number is the key. With key 3, A → D, B → E, and at the end the alphabet wraps around: X → A, Y → B, Z → C.
Worked exampleExample 1: Encrypt and decrypt by hand
(a) Encrypt MAPLE with shift 5. (b) The ciphertext FQQ was made with shift 5. Decrypt it.
- (a) Count 5 letters forward for each: M → R, A → F, P → U, L → Q, E → J.
- So MAPLE → RFUQJ.
- (b) Count 5 letters backward: F → A, Q → L, Q → L.
- So FQQ → ALL.
The Caesar cipher in Python
Computers store letters as numbers (you learn about ASCII and Unicode in Programming Basics). In ASCII, A is 65 and a is 97. To shift a capital letter we change it to a position 0 to 25, add the shift, use % 26 to wrap around, and change it back.
def caesar(text, shift):
result = ""
for ch in text:
if ch.isupper():
result += chr((ord(ch) - 65 + shift) % 26 + 65)
elif ch.islower():
result += chr((ord(ch) - 97 + shift) % 26 + 97)
else:
result += ch
return result
secret = caesar("Meet at the rink", 3)
print(secret)
print(caesar(secret, -3))
Encrypting and decrypting with the same function: decrypting is just shifting back. Output (one line each): Phhw dw wkh ulqn / Meet at the rink
Why the Caesar cipher is weak
There are only 25 useful keys. A computer can try all of them in a fraction of a second. This is a brute-force attack.
def caesar(text, shift):
result = ""
for ch in text:
if ch.isupper():
result += chr((ord(ch) - 65 + shift) % 26 + 65)
elif ch.islower():
result += chr((ord(ch) - 97 + shift) % 26 + 97)
else:
result += ch
return result
msg = "Wkh vqrz lv ghhs"
for s in range(26):
guess = caesar(msg, -s)
if " the " in " " + guess.lower() + " ":
print("Shift", s, "->", guess)
A brute-force attack: try every key and look for a common word. Output: Shift 3 -> The snow is deep
A second weakness is frequency analysis: in English, E, T and A are very common letters, so the most common letter in a long ciphertext probably stands for one of them. The Arab scholar al-Kindi described this method in the 800s. Modern ciphers are designed so that neither brute force nor frequency analysis works: they have so many possible keys that trying them all would take longer than the age of the universe.
Modern cryptography
Symmetric encryption uses one shared secret key. The widely used standard AES is fast and strong. Its problem is: how do two people who have never met agree on a secret key, when everything they send can be seen?
Public-key cryptography solves that problem. Each person has a public key that anyone may know and a private key that they keep secret. Something locked with the public key can only be unlocked with the private key. Public-key methods were published in the 1970s; one famous example, RSA (1977, named after Rivest, Shamir and Adleman), relies on the fact that multiplying two huge prime numbers is easy, but splitting the product back into its primes is extremely hard.
Hashing: storing passwords safely
A well-run website does not store your password. It stores a hash of it. When you sign in, it hashes what you typed and compares the hashes. If the database is stolen, the attacker gets hashes, not passwords. (Real systems also add a random value called a salt and use deliberately slow hash functions designed for passwords.)
import hashlib
for pw in ["maple", "Maple", "maple1"]:
h = hashlib.sha256(pw.encode()).hexdigest()
print(pw, h[:16])
A hash turns a password into a fixed-length fingerprint (only the first 16 of 64 hex digits are shown). One small change gives a completely different hash. Output (one line each): maple 49ead2b1066bda1e / Maple 18a91bdea286ec72 / maple1 0617c05c6389f061
Research frontiers in cryptography and security
- Post-quantum cryptography. Large quantum computers, if they are built, could break RSA and similar methods. Researchers have designed new methods believed to resist them, and in August 2024 the U.S. National Institute of Standards and Technology (NIST) published its first three post-quantum cryptography standards (FIPS 203, 204 and 205), for encryption and digital signatures.
- Usable security. Research on why people choose weak passwords or fall for phishing, and on better tools such as passkeys and two-factor authentication.
- Privacy-preserving computing. Methods that let computers analyze data without seeing individual people's information.
Cryptography has a famous history too. During the Second World War, codebreakers at Bletchley Park in Britain, including the mathematician Alan Turing, broke messages encrypted by the German Enigma machine. In Canada, the Communications Security Establishment (CSE) is the federal agency responsible for protecting government communications and for signals intelligence.
Just for funROT13 is a Caesar cipher with shift 13. Because the alphabet has 26 letters, encrypting twice with ROT13 gives back the original message.
So if someone sends you a joke in ROT13 and you encrypt it again "for extra security", you just decrypted it. Oops.
Hands-on activityCrack a cipher with frequency analysis
You need: paper, a pencil, and a computer with Python.
- Ask a family member to write a secret message of at least three sentences, in capital letters, and encrypt it with a Caesar cipher using a shift you don't know (they can use the
caesar function). - Count how often each letter appears in the ciphertext. In Python,
text.count("Q") counts the Q's; use a loop over "ABCDEFGHIJKLMNOPQRSTUVWXYZ". - Guess that the most common ciphertext letter stands for E. Work out the shift (for example, if H is most common, the shift is 3).
- Decrypt with that shift. If the result is not English, try T or A for the most common letter instead.
- Write two sentences explaining why this attack would not work on AES.
What to look for: a frequency table, a reasoned guess for the shift, a correct decryption, and the explanation that AES has far too many keys to try and does not keep letter frequencies.
Your turn
1Define plaintext, ciphertext and key.
Plaintext: the readable message. Ciphertext: the encrypted message. Key: the secret value that controls encryption and decryption.
2Encrypt HOCKEY with a Caesar shift of 2.
JQEMGA (H→J, O→Q, C→E, K→M, E→G, Y→A).
3Decrypt ZLQWHU, which used shift 3.
4Why are there only 25 useful Caesar keys?
A shift of 26 (or 0) gives back the original, and shifts repeat every 26, so only 1 to 25 change the message.
5What does caesar("Zoo", 1) return?
"App" (Z wraps to A; o → p).
6In public-key cryptography, which key do you share and which do you keep secret?
Share the public key; keep the private key secret.
7Why do websites store password hashes instead of passwords?
If the database is stolen, attackers get hashes, which can't be reversed into the passwords easily.
More practice: warm-up
Turning plaintext into ciphertext using a key.
2With shift 3, what does A become?
3With shift 3, what does Y become?
4What is a brute-force attack?
Trying every possible key.
5What does AES stand for in this lesson's context?
A widely used symmetric encryption standard (the Advanced Encryption Standard).
More practice: on your own
1Show the arithmetic the Python code does for the letter X with shift 5.
ord('X') = 88; 88 − 65 = 23; 23 + 5 = 28; 28 % 26 = 2; 2 + 65 = 67 = 'C'.
2A message was encrypted twice: first with shift 7, then with shift 10. What single shift would decrypt it?
Total shift 17, so decrypt with shift −17 (or, equivalently, +9).
3Explain frequency analysis and why it works on the Caesar cipher.
Count letter frequencies in the ciphertext and match the most common ones to E, T, A. It works because a Caesar cipher replaces each letter with the same cipher letter every time, so the frequency pattern is kept.
4Why is public-key cryptography needed even though symmetric encryption is faster?
Two parties who have never met need a safe way to agree on a shared symmetric key over an open network; public-key methods let them do that.
5What does the hash example show about changing one letter of a password?
"maple" and "Maple" give completely different hashes, so a hash reveals nothing about how similar two passwords are.
Challenge
1Write a Python function count_letters(text) that returns a list of 26 counts, one per letter A to Z, ignoring case and non-letters. What does count_letters("Abba!")[0:2] return?
def count_letters(text): counts = [0] * 26, for ch in text.upper(): if "A" <= ch <= "Z": counts[ord(ch) - 65] += 1, return counts. For "Abba!" it returns [2, 2] (two A's, two B's).
2A cipher replaces each letter with any other letter (a scrambled alphabet), not just a shift. How many keys are there, and would brute force work? Would frequency analysis?
26! ≈ 4 × 10²⁶ keys, so brute force is hopeless. But frequency analysis still works, because each plaintext letter always maps to the same ciphertext letter. Many keys alone do not make a cipher strong.
3RSA relies on factoring being hard. Factor 391 into two primes and explain why the same task is hard for a number with hundreds of digits.
391 = 17 × 23. For small numbers, trying divisors up to the square root is quick, but for numbers with hundreds of digits there are far too many possibilities and no known fast method on ordinary computers.
Quiz
2. What is GRRU decrypted with a Caesar shift of 3?
3. Why is the Caesar cipher easy to break?
4. In public-key cryptography, who can unlock a message locked with Sam's public key?
5. What does a website store to check passwords safely?
6. What is post-quantum cryptography?
7. In Python, what is (ord("Z") - 65 + 3) % 26 + 65 as a character?
Big idea: Expectation D2.1 asks students to demonstrate an understanding of emerging research areas such as cryptography and security. This lesson builds the core ideas (keys, brute force, public-key methods, hashing) through hands-on ciphers.
How to help: Do the frequency-analysis activity together: write the secret message and let your teen crack it. Ask them to explain the padlock analogy for public-key cryptography in their own words, and talk about your own security habits (password manager, two-factor authentication).
Common difficulties:
- Shifting the wrong way when decrypting. Decrypting means shifting back.
- Forgetting to wrap around from Z to A (the
% 26 in the code). - Thinking a huge number of keys always means strong security. A scrambled-alphabet cipher has huge numbers of keys but falls to frequency analysis.
- Mixing up hashing (one-way) with encryption (reversible with the key).