Capture the flag

Students solve three capture-the-flag puzzles (Caesar, XOR, checksum), typing flags that the page checks without storing the answers, then write a puzzle for a partner.

Secret messages · Defend the system · about 45 minutes · Open the student lesson

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

Slides Download Present from the browser, or export to PowerPoint or PDF.
Worksheet Download Print the student copy; the Teacher edition has the answers.

Students will be able to

I can use a Caesar tool, an XOR key and a checksum to solve puzzles.
I can explain what a flag is.
I can write a cipher puzzle for someone else.

Timing

Predict and Run 8 min · Puzzles 22 min · Make 15 min

Before class

What this is: a puzzle session that revisits the course's three tools. Students decrypt messages written for them, as in a puzzle book or a CTF contest. No one is breaking into anything.

How flags work: the page stores only a SHA-256 fingerprint (a hash) of each right answer, so reading the page source does not give the answer away. Answers are checked after trimming spaces and ignoring capitals. Because this repository is public, the flags are also written here for you:

Puzzle 1: WP{never send keys} (Caesar key 4)
Puzzle 2: WP{secret} (XOR key 9, then A is 1)
Puzzle 3: WP{key} (KEY adds to 38, so its checksum is 8)

Pacing: puzzles can be done in any order. Pairs can race; the flag checks give instant feedback so nobody has to wait for you.

Running the lesson

Puzzle 2 is the slowest because of the second step (numbers to letters). Hint: A is 1.
Puzzle 3: ask which message's own checksum disagrees with the number it came with.

The hard part (on purpose)

Choosing the right tool for each puzzle. Ask which weakness the puzzle shows before they reach for code.

When students get stuck

What you will see	A question to ask	The fix
The flag is refused.	Is it WP{ then lower-case letters then }? Are spaces where they should be?	Copy the form exactly; spaces count (the Caesar message has spaces).
Puzzle 2 gives numbers above 26.	Did you use the right XOR key?	The key is 9. Press B once for each number.

Answers to the checks

Predict: The toolkit's checksum adds each letter's place (A is 0) and keeps the last digit. Press A+B on the first message, HELLO. What checksum does it show?
7. H (7) + E (4) + L (11) + L (11) + O (14) = 47, and the last digit is 7.
Puzzle 1: Caesar: Puzzle 1. A Caesar cipher: RIZIV WIRH OICW. Find the message. The flag is WP{ then the message in lower case, then }.
A flag (the exact answer is in the teacher notes)
Key 4. The tool tries every key and one of them reads as English.
Puzzle 2: XOR: Puzzle 2. These numbers were each locked with XOR and the key 9: 26, 12, 10, 27, 12, 29. Unlock them (B does this). Then turn each number into a letter, where 1 is A, 2 is B and so on. The flag is WP{ then the word in lower case, then }.
A flag (the exact answer is in the teacher notes)
XOR with 9 gives 19, 5, 3, 18, 5, 20: S E C R E T.
Puzzle 3: checksum: Puzzle 3. Four messages arrived with their checksums: HELLO 7, MEET 9, KEY 3, LOCK 7. One was damaged on the way. Which? The flag is WP{ then that word in lower case, then }.
A flag (the exact answer is in the teacher notes)
KEY adds to 38, so its checksum should be 8, not 3. The other three match.

Solutions

One possible solution for each task. Other correct programs are fine.

Make

Show as code

let ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
function shift(letter: string, key: number): string {
    let place = ALPHABET.indexOf(letter)
    if (place < 0) {
        return letter
    }
    return ALPHABET.charAt((place + key) % 26)
}
function encrypt(message: string, key: number): string {
    let result = ""
    for (let i = 0; i < message.length; i++) {
        result = result + shift(message.charAt(i), key)
    }
    return result
}
input.onButtonPressed(Button.A, function () {
    basic.showString(encrypt("MEET AT NOON", 5))
})

Stretch and support

Stretch: Write a longer puzzle that uses two steps (Caesar, then XOR).

Support: Share puzzle 1 as a class, then let pairs do the others.

Exit ticket

What is a flag in a capture-the-flag puzzle?

A secret answer in a fixed form that proves you solved the puzzle.

What each step is for

Investigate: Each tool from the course breaks one weakness: Caesar by trying keys, XOR once the key is known, a checksum by recomputing it.

Where it leads

Next: defend a system against all three weaknesses.