Defend the door lock

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

• Slides Download Copy address for Prepare Present from the browser, or export to PowerPoint or PDF.
• Worksheet Download Copy address for Prepare Print the student copy; the Teacher edition has the answers.

Students will be able to

• I can audit a system and name its weaknesses.
• I can match each weakness with a tool that fixes it.
• I can build a lock that is private, notices changes and cannot be reused.

Timing

Predict and Run 8 min · Audit 10 min · Milestone 1 10 min · Milestones 2 and 3 25 min · Report 5 min

Before class

The idea: the course's three tools answer three different questions: who can read it (a cipher), was it changed (a checksum with a key) and is this a fresh message from someone who has the key (challenge and response). A secure system usually needs all three.

Framing: this is the defender's job. Students audit and harden their own system. The lesson does not have them attack each other's locks. If students want to test each other, run it as 'pass the pair': swap pairs' final locks, and try the real key against the lock; the lock should open for the key and refuse everything else.

The final system: the key micro:bit knocks with a keyed checksum; the lock checks it, sends a random challenge, the key answers using the secret key, and the lock opens only on the right answer. The secret key never crosses the air.

Limits to say aloud: these are classroom versions. The XOR step reveals the key if someone knows both a locked and an unlocked value; the answer function is not a one-way function; keys have to be shared safely first (the key exchange lesson). Real systems use proven tools, not ones we invented.

Challenge milestones: Milestone 1 has most of the code; milestone 2 outlines; milestone 3 gives goals only. Students who finish quickly can add the lockout from the Challenge–response lesson.

Running the lesson

1. Audit: ask students to say each weakness in their own words before they pick the tool.
2. Milestone 3: students must see that the old 'OPEN' code is gone; the answer replaces it.

The hard part (on purpose)

Matching each weakness to its tool and keeping the keys the same on both sides. When the lock fails, ask them to name the weakness each milestone fixes.

When students get stuck

Answers to the checks

1. Predict: A is pressed on the key micro:bit. A third micro:bit in the same radio group is switched on. Which micro:bits can read the door code 4271?
   Every micro:bit in the group. The code goes out as plain text, which is the lesson from the very first lesson in this course.
2. Find the weaknesses: Match each weakness of the door lock with the tool that fixes it.
   The code 4271 goes out as plain text, so every micro:bit in the group can read it → Encrypt it with a shared key; The lock can't tell a damaged or changed message from a real one → Add a checksum with a secret key; The same message opens the lock every time, so one that was heard once works again → Use a challenge and response
3. The key: Which fix needs the key to be agreed beforehand, or by a key exchange?
   All three: each uses the secret key
   The cipher, the keyed checksum and the answer function all use the same secret key, so both ends need it before they start. That is what a key exchange is for.
4. Report: Your final lock fixes three weaknesses. Which one weakness is still there, however well you build it?
   If the secret key is lost or leaked, all three protections fail
   Everything rests on the key. Real systems protect keys carefully, change them regularly, and use much stronger tools than these classroom versions. Security is an ongoing job, not a finish line.

Solutions

One possible solution for each task. Other correct programs are fine.

Milestone 1: lock the code

let secretKey = 7
radio.setGroup(5)
input.onButtonPressed(Button.A, function () {
    radio.sendNumber(4271 ^ secretKey)
})
radio.onReceivedNumber(function (receivedNumber) {
    if ((receivedNumber ^ secretKey) == 4271) {
        basic.showIcon(IconNames.Yes)
    } else {
        basic.showIcon(IconNames.No)
    }
})

Milestones 2 and 3: harden it › Milestone 2: a checksum on the knock

let ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
let secretKey = 7
let challenge = 0
function checksum(message: string): number {
    let total = secretKey
    for (let i = 0; i < message.length; i++) {
        total += ALPHABET.indexOf(message.charAt(i))
    }
    return total % 10
}
function answer(n: number): number {
    return (n * secretKey + 3) % 100
}
radio.setGroup(5)
input.onButtonPressed(Button.A, function () {
    radio.sendValue("KNOCK", checksum("KNOCK"))
})
radio.onReceivedValue(function (name, value) {
    if (name == "KNOCK") {
        if (checksum("KNOCK") == value) {
            basic.showIcon(IconNames.Yes)
        } else {
            basic.showIcon(IconNames.No)
        }
    }
})

Milestones 2 and 3: harden it › Milestone 3: a challenge and response

let ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
let secretKey = 7
let challenge = 0
function checksum(message: string): number {
    let total = secretKey
    for (let i = 0; i < message.length; i++) {
        total += ALPHABET.indexOf(message.charAt(i))
    }
    return total % 10
}
function answer(n: number): number {
    return (n * secretKey + 3) % 100
}
radio.setGroup(5)
input.onButtonPressed(Button.A, function () {
    radio.sendValue("KNOCK", checksum("KNOCK"))
})
radio.onReceivedValue(function (name, value) {
    if (name == "KNOCK") {
        if (checksum("KNOCK") == value) {
            challenge = randint(10, 99)
            radio.sendValue("CHALL", challenge)
        } else {
            basic.showIcon(IconNames.No)
        }
    } else if (name == "CHALL") {
        radio.sendValue("ANSWER", answer(value))
    } else if (name == "ANSWER") {
        if (value == answer(challenge)) {
            basic.showIcon(IconNames.Yes)
        } else {
            basic.showIcon(IconNames.No)
        }
    }
})

Stretch and support

Stretch: Add the lockout after three wrong answers from the Challenge–response lesson.

Support: Share the milestone 2 code and ask students to explain it before they build milestone 3.

Exit ticket

Name the three weaknesses of the starting lock and the fix for each.

Readable by the group: encrypt with a shared key. A changed message can't be told: a keyed checksum. A heard message works again: challenge and response.

What each step is for

• Audit: Each weakness has a matching tool: privacy needs a cipher, a changed message needs a checksum, and a reusable message needs a challenge and response.
• Milestone 1: lock the code: The first fix is the one from the XOR lesson: the lock and the key share a number, and the code travels locked with it.

Where it leads

Where this leads: real systems use proven libraries, long keys, hash functions and certificates. The ideas here are the same.