Students send a message past an eavesdropper and find that binary, hex and base64 hide nothing (public rules) while encryption with a shared key does, then decode stored and layered data and read an encrypted reply with the key word (AC9TDI8K02 node 4). A 5E mission lesson.
Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.
SlidesDownload Present from the browser, or export to PowerPoint or PDF.
WorksheetDownload Print the student copy; the Teacher edition has the answers.
Students will be able to
I can say why binary, hex and base64 don't keep anything secret.
I can say what encryption needs that encoding doesn't.
I can choose encoding, encryption or hashing for a job.
Timing
Engage and Explore 10 min · Explain 8 min · Elaborate 16 min · Evaluate 6 min
Before class
Try the boards yourself. Every message and key word is made up.
The one idea: encoding is a public rule (no key), so it hides nothing; encryption needs a secret key; passwords are stored as hashes.
Simplifications: the board's cipher shifts each character by the letters of the key word (a Vigenère cipher). It stands in for real encryption, such as the AES behind HTTPS, whose keys are far too long to guess; a key word like gears could be guessed. Base64 is used everywhere to carry data safely through email and web pages, which is a good use of it: it was never meant to hide anything.
Links: Networks (Who can see your data?) shows what encryption is for; Secret messages (Code) builds and cracks ciphers; Security and privacy covers hashing.
Running the lesson
Engage: ask what makes something look secret.
Explore: ask why Eve could read the base64.
Explain: sort encoding, encryption and hashing by the test: is there a key?
Elaborate: ask how they knew which rule each layer used.
Evaluate: discuss the account page: what should it do instead?
The hard part (on purpose)
Layers: students expect one decoder to finish the job. Ask them to look at what came out and ask which rule could make that.
When students get stuck
What you will see
A question to ask
The fix
A student thinks hex is secret (Sam's mistake).
Did decoding it need anything secret?
No key, no secret: encoding hides nothing.
A student picks a decoder at random.
Which characters can each rule produce? Binary: 0 and 1. Hex: 0 to 9 and a to f. Base64: letters, digits, + and /, maybe = at the end.
Match the characters to the rule.
Answers to the checks
Engage: does it look safe?: The club app stored its admin password as cm9ib3RzMjAyNg== (base64). Could someone who copies it read the password? Yes. Base64 has no key: anyone can decode it, and it says robots2026.
Base64: Send the meeting message as base64. Can Eve read it?
Yes: Eve tries the base64 decoder, which anyone can use.
Past Eve: Send it so Eve can't read it but Ava can. Ava's key word is gears.
Only Encrypted, with the key word Ava shares, gets past Eve. Binary, hex and base64 are public rules.
Explain: encoding, encryption, hashing: Sam stores the admin password. Click the line where it first goes wrong. line 3 Line 3: hex is a public rule. Anyone who copies the database reads robots. Passwords should be stored as salted hashes.
The stored password: Decode the stored admin password from the hook.
Base64 gives robots2026. The club must change it and store a hash instead.
Which rule?: A message from the club's old app. Which rule was used? Decode it.
Hex: pairs of digits 0 to 9 and a to f. It says meet in room 12.
Two layers: This one was encoded twice. Undo both layers.
Base64, then binary: bring a robot. Two public rules are still public.
Elaborate: Ava's reply: Ava replied with the door code, encrypted with your shared key word. Read it.
With gears it reads the code is 4417. Without the key word, no decoder helps.
The account page: A website says your password is "encrypted" and shows it in base64 on your account page. What's wrong? Base64 isn't encryption: anyone can decode it, and a password shouldn't be shown at all Passwords should be stored as salted hashes and never shown back.
Solutions
One possible solution for each task. Other correct programs are fine.
Elaborate: decode it › The stored password
Open task: any program that does what the step asks.
Elaborate: decode it › Which rule?
Open task: any program that does what the step asks.
Elaborate: decode it › Two layers
Open task: any program that does what the step asks.
Elaborate: Ava's reply
Open task: any program that does what the step asks.
Stretch and support
Stretch: Find base64 in the wild: open an email's raw source (Show original) and spot an attachment written as base64.
Support: A card with the three rules and their characters, and the test: is there a key?
Exit ticket
Your friend says hex keeps a password safe. What do you tell them, and what should be used instead?
Hex is a public rule anyone can undo; store passwords as salted hashes, and encrypt (with a key) what must be read back.
What each step is for
Engage: does it look safe?: Committing to whether scrambled-looking data is safe tests the new move: encoding is a public rule, and only a key keeps data secret.
Explore: get it past Eve: Students try every encoding against an eavesdropper and find only the keyed one works, failing first.
Explain: encoding, encryption, hashing: The teacher models deciding whether a form of data has a key. Sam trusts hex, the misconception planted after the method.
Elaborate: decode it: One change at a time: a single encoding, then layers of them, showing that stacking public rules still hides nothing.
Elaborate: Ava's reply: Reversing the explore: reading an encrypted reply needs the shared key, the one thing an encoding never has.