Breaking a Caesar cipher

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

• Slides Download Copy address for Prepare Present from the browser, or export to PowerPoint or PDF.
• Worksheet Download Copy address for Prepare Print the student copy; the Teacher edition has the answers.

Students will be able to

• I can break a Caesar cipher by trying every key.
• I can explain why a cipher with only 25 keys is weak.
• I can say why a longer message does not make a Caesar cipher stronger.

Timing

Predict and Run 8 min · Investigate 10 min · Modify 6 min · Flag 10 min (typical)

Before class

The idea: a cipher's strength comes from how many keys there are to try and how little the cipher text gives away. The Caesar cipher has 25. A computer tries them all in a blink; a person with the program tries them in a minute.

Framing for students: this is how codes are tested. Everyone here is breaking messages given to them, as a code designer does before trusting a code. We are not breaking anyone's private messages.

Letter counts: in English E is the most common letter, then T, A, O. In a long Caesar cipher text the most common letter is probably E shifted by the key. Do the Investigate task on the board together.

Flags: a flag is the answer to a puzzle in a fixed form, WP{...}. The page stores only a scrambled fingerprint (a hash) of the right answer, so view source does not give it away. The answer is below in the notes: WP{keys matter}.

Running the lesson

1. Predict: most do not see that press 3 undoes key 3. Replay it slowly.
2. Investigate: ask whether any letter other than E could be most common in a very short message.

The hard part (on purpose)

Trying every key systematically and spotting readable text. Ask how many keys there are and how they'll know which one is right.

When students get stuck

Answers to the checks

1. Predict: The secret is KHOOR. You press A three times. What does the micro:bit show after the third press?
   HELLO. Press 3 tries key 3, which undoes the shift of 3 (K→H, H→E, O→L, O→L, R→O).
2. How many tries: At most, how many different keys do you have to try to break any Caesar cipher message? (Key 0 changes nothing.)
   25
   The shift can be 1 to 25, so 25 tries is the most it can take. On average about 13.
3. Counting letters: In English, the most common letter is E. In a long cipher text the most common letter is L. What is the likely key?
   7
   L is 7 places after E (E→F→G→H→I→J→K→L). So the key is probably 7. Counting letters finds a Caesar key without trying them all.
4. A longer message: Lee says: 'If I use a 100-letter message instead of a 5-letter one, it is harder to break.' Is that right for a Caesar cipher?
   No: a longer message gives more clues, and the key is still one of 25
   Strength comes from how many keys are possible, not how long the message is. A longer message actually makes letter counting work better.
5. Capture the flag: This cipher text was encrypted with a Caesar key: RLFZ THAALY. Decrypt it. The flag is WP{ then the message in lower case, then }.
   A flag (the exact answer is in the teacher notes)
   The key was 7. Letter counting would have found it: the most common letter in the cipher text is L, 7 places after E.

Solutions

One possible solution for each task. Other correct programs are fine.

Modify

let ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
let guess = 0
let secret = "KHOOR"
let tries = 0
function shift(letter: string, key: number): string {
    let place = ALPHABET.indexOf(letter)
    if (place < 0) {
        return letter
    }
    return ALPHABET.charAt((place + key) % 26)
}
function encrypt(message: string, key: number): string {
    let result = ""
    for (let i = 0; i < message.length; i++) {
        result = result + shift(message.charAt(i), key)
    }
    return result
}
function decrypt(message: string, key: number): string {
    return encrypt(message, 26 - key)
}
input.onButtonPressed(Button.A, function () {
    guess += 1
    tries += 1
    if (guess > 25) {
        guess = 1
    }
    basic.showNumber(guess)
    basic.showString(decrypt(secret, guess))
})
input.onButtonPressed(Button.B, function () {
    basic.showNumber(tries)
})

Capture the flag

Open task: any program that does what the step asks.

Stretch and support

Stretch: Add a third button that tries the next key by itself every second and stops when you press it.

Support: Tell students to read each attempt aloud and say 'sense or nonsense'.

Exit ticket

Why can a Caesar cipher be broken so quickly?

There are only 25 keys, so trying them all is quick; letter counts shorten it further.

What each step is for

• Investigate: A Caesar cipher has only 25 keys, so trying them all is quick. Letter counts break it even faster. A strong code needs a huge number of possible keys, and more than that.
• Modify: A person is doing the work of recognising English. A program can count the tries for them.

Where it leads

Next: a cipher with a much bigger key.