← Secret messages

Breaking a Caesar cipher

A Caesar cipher has only 25 useful keys, so trying them all breaks it in moments. Seeing why is how you learn what a strong key needs.

People who design codes spend their time breaking them. A code is only trusted once many people have tried hard to break it and failed.

Last lesson you built a cipher. Now you find out how strong it is, by breaking messages that you are given. This is how codes are tested: the people who build them try to break them first.

The program below tries a key each time you press A: it decrypts a secret message with key 1, then 2, then 3, and so on. A person reads each attempt and spots the one that makes sense.

WidthMore contexts, same idea.
PredictRead the code and say what it will do before you run anything. A wrong guess is fine: it shows you what to look for.

Predict

The program as blocks
Show as code
crack.ts
let ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
let guess = 0
let secret = "KHOOR"
function shift(letter: string, key: number): string {
    let place = ALPHABET.indexOf(letter)
    if (place < 0) {
        return letter
    }
    return ALPHABET.charAt((place + key) % 26)
}
function encrypt(message: string, key: number): string {
    let result = ""
    for (let i = 0; i < message.length; i++) {
        result = result + shift(message.charAt(i), key)
    }
    return result
}
function decrypt(message: string, key: number): string {
    return encrypt(message, 26 - key)
}
input.onButtonPressed(Button.A, function () {
    guess += 1
    if (guess > 25) {
        guess = 1
    }
    basic.showNumber(guess)
    basic.showString(decrypt(secret, guess))
})
The secret is KHOOR. You press A three times. What does the micro:bit show after the third press?

RunRun it and compare the result with your prediction.

Run

The program as blocks
Show as code
crack.ts
let ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
let guess = 0
let secret = "KHOOR"
function shift(letter: string, key: number): string {
    let place = ALPHABET.indexOf(letter)
    if (place < 0) {
        return letter
    }
    return ALPHABET.charAt((place + key) % 26)
}
function encrypt(message: string, key: number): string {
    let result = ""
    for (let i = 0; i < message.length; i++) {
        result = result + shift(message.charAt(i), key)
    }
    return result
}
function decrypt(message: string, key: number): string {
    return encrypt(message, 26 - key)
}
input.onButtonPressed(Button.A, function () {
    guess += 1
    if (guess > 25) {
        guess = 1
    }
    basic.showNumber(guess)
    basic.showString(decrypt(secret, guess))
})
Try it yourselfYour edits are saved in this browser.
It takes a few seconds to load. Your work in this step is kept.

InvestigateTrace how each line of code connects to what you see.

Investigate

The program as blocks
Show as code
crack.ts
let ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
let guess = 0
let secret = "KHOOR"
function shift(letter: string, key: number): string {
    let place = ALPHABET.indexOf(letter)
    if (place < 0) {
        return letter
    }
    return ALPHABET.charAt((place + key) % 26)
}
function encrypt(message: string, key: number): string {
    let result = ""
    for (let i = 0; i < message.length; i++) {
        result = result + shift(message.charAt(i), key)
    }
    return result
}
function decrypt(message: string, key: number): string {
    return encrypt(message, 26 - key)
}
input.onButtonPressed(Button.A, function () {
    guess += 1
    if (guess > 25) {
        guess = 1
    }
    basic.showNumber(guess)
    basic.showString(decrypt(secret, guess))
})

At most, how many different keys do you have to try to break any Caesar cipher message? (Key 0 changes nothing.)

In English, the most common letter is E. In a long cipher text the most common letter is L. What is the likely key?

Lee says: 'If I use a 100-letter message instead of a 5-letter one, it is harder to break.' Is that right for a Caesar cipher?

ModifyChange the code on purpose and check the result.

Modify

Count how many keys you try: B shows the number of tries so far.

Try it yourselfYour edits are saved in this browser.
It takes a few seconds to load. Your work in this step is kept.
Need a hint?

Add a variable tries, add one to it each time A is pressed, and show it when B is pressed.

B shows how many keys you have tried so far.

This ticks by itself when your blocks do what is asked.

Make TypicalBuild something new using what you have learned. Expect a few tries; that is normal.

Capture the flag

Your first flag. A flag is a secret answer that proves you solved a puzzle. Use the program (it already holds the cipher text) to find the message, then type the flag in the exact form: WP{ + the message in lower case + }.

For example, a message HELLO THERE would give the flag WP{hello there}.

Try it yourselfYour edits are saved in this browser.
It takes a few seconds to load. Your work in this step is kept.

This cipher text was encrypted with a Caesar key: RLFZ THAALY. Decrypt it. The flag is WP{ then the message in lower case, then }.

For teachers

Students break Caesar ciphers by trying every key, learn that the number of possible keys decides strength, and capture their first flag. About 40 minutes.

Open the teacher guide: answers, solutions, slides and a worksheet.

Students will be able to

Before class

The idea: a cipher's strength comes from how many keys there are to try and how little the cipher text gives away. The Caesar cipher has 25. A computer tries them all in a blink; a person with the program tries them in a minute.

Framing for students: this is how codes are tested. Everyone here is breaking messages given to them, as a code designer does before trusting a code. We are not breaking anyone's private messages.

Letter counts: in English E is the most common letter, then T, A, O. In a long Caesar cipher text the most common letter is probably E shifted by the key. Do the Investigate task on the board together.

Flags: a flag is the answer to a puzzle in a fixed form, WP{...}. The page stores only a scrambled fingerprint (a hash) of the right answer, so view source does not give it away. The answer is below in the notes: WP{keys matter}.

Running the lesson

  1. Predict: most do not see that press 3 undoes key 3. Replay it slowly.
  2. Investigate: ask whether any letter other than E could be most common in a very short message.

The hard part (on purpose)

Trying every key systematically and spotting readable text. Ask how many keys there are and how they'll know which one is right.

When students get stuck

Stretch and support

Stretch: Add a third button that tries the next key by itself every second and stops when you press it.

Support: Tell students to read each attempt aloud and say 'sense or nonsense'.

Where it leads

Next: a cipher with a much bigger key.

What each step is for

Now you can
Next lesson5. One key to lock and unlockXOR mixes a number with a key. Doing it again with the same key brings the number back, so one shared key works in both directions.