Teacher guide: Secret messages

The idea in plain words

A micro:bit sends a radio message to every other micro:bit in its group. The group is a channel number, not a lock. So anything sent in plain text can be read by anyone who tunes to that group.

A code (a cipher) scrambles a message so a listener can't read it. A scrambling method that only works while it is secret is fragile: methods get copied, written down and guessed. A good code assumes the method is known and depends on a secret key.

Why it matters

Wi-Fi, mobile phones, car keys and bank cards all send messages through the air. Everything in this course is about keeping that traffic private, unchanged and trustworthy.

An everyday picture, and where it breaks

A group is a classroom where everybody talks aloud: whoever is in the room hears everything. Where it breaks: a classroom has walls, but a radio signal passes through them.

Try it yourself (5 minutes)

1. Open Everyone in the group hears and run it.
2. Press A on one simulated micro:bit and watch the other.
3. Change the group on one micro:bit: it no longer hears.

Questions students ask

• "Can't we just use a secret group number?" There are only 256 groups; anyone can try them all.
• "Does the sender hear its own message?" No.

The idea in plain words

A cipher is a method for scrambling a message with a key. The Caesar cipher shifts every letter by the key. It is easy to break because there are only 25 keys to try. XOR mixes a number with a key, and doing it again with the same key undoes it, so one shared key works both ways.

The strength of a cipher comes from how many keys there are and how little the scrambled message gives away. A long message does not make a weak cipher stronger.

Why it matters

Modern ciphers have the same shape: a public method and a secret key, but with keys of 128 bits or more, so trying them all is impossible.

An everyday picture, and where it breaks

A combination padlock: everyone knows how it works; only the number is secret. Where it breaks: a three-digit padlock has 1000 combinations, which can be tried in minutes. That is the Caesar cipher's problem.

Try it yourself (5 minutes)

1. Open The Caesar cipher and run it.
2. Press A: HELLO becomes KHOOR.
3. Open Breaking a Caesar cipher and press A until the text reads as English.

Questions students ask

• "Why is it called Caesar?" Julius Caesar is said to have used a shift of three.
• "What is XOR?" Compare two numbers bit by bit: 1 where they differ, 0 where they match.

The idea in plain words

Three problems remain after a message is scrambled:

• How do both ends get the same key? A key exchange lets two ends agree on a key in public: each mixes a private number with public numbers, swaps the mixes, and mixes again.
• Was the message changed? A checksum is a number worked out from the message and sent with it. Mixing in a secret key stops anyone without the key making a matching number.
• Is this message fresh, from someone with the key? A challenge and response: the receiver sends a random number, and the sender answers using the key. A new challenge means an old answer is useless.

Everyday pictures, and where they break

Key exchange: mixing paint. Each person adds a private colour to a common one and shares the result; adding their own colour to the other's mixture gives both the same final colour. It breaks because numbers can be un-mixed if they are small.

Challenge and response: a bank asking for a random character of your password. It breaks if the question repeats.

Try it yourself (5 minutes)

1. Open Agreeing a key in the open and press A on both simulated micro:bits. Compare the numbers.
2. Open Prove it with a challenge and knock a few times. Watch the challenge and answer change.

Questions students ask

• "If everyone hears the mixes, why is the key safe?" With huge numbers, working back from the mix is far too slow.
• "Is the classroom version real security?" No: the numbers are tiny. It shows the shape of the idea.

The idea in plain words

Security work has two sides: red team (try to find weaknesses) and blue team (defend). This course takes the blue team's side: students audit a system they own and fix each weakness.

A good audit asks three questions about any message: Who can read it? Could it have been changed? Is it fresh and from the right sender? Each has a tool: a cipher, a keyed checksum, a challenge and response. A system is as strong as the weakest of the three.

A capture-the-flag (CTF) contest is a set of puzzles, each with a secret answer, the flag. It is a friendly way to practise.

An everyday picture, and where it breaks

A house: locks on the doors (private), a seal on a parcel (unchanged), asking for the secret word at the door (fresh and from the right person). Where it breaks: a house has an owner who watches. A radio message has no one watching it, so the checks have to live in the message.

Try it yourself (5 minutes)

1. Open Defend the door lock and run the weak lock.
2. Ask: who could read the code, who could tell a damaged message, and what happens to a code heard yesterday?

Questions students ask

• "Is this enough to protect a real door?" No. Real locks use proven tools and well-guarded keys.
• "Can we try breaking each other's locks?" Give the pair-swap in the teacher notes a go: you try your own key on a partner's lock. It should open for the key and no one else.