Who can see your data?

Students send a PIN past an eavesdropper on café Wi-Fi, first in plain text and then encrypted with a shift key, to explain why data must be encrypted in transit and show that encryption is reversible with the key (AC9TDI8K02 nodes 3 and 4).

Networks · Keeping it safe · about 40 minutes · Open the student lesson

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

Slides Download Present from the browser, or export to PowerPoint or PDF.
Worksheet Download Print the student copy; the Teacher edition has the answers.

Students will be able to

I can explain why data needs encrypting when it is sent.
I can encrypt and decrypt a short message with a key.
I can say what makes a key weak.

Timing

Predict and Try 6 min · Worked example 12 min · Vary 10 min · Practise and Make 12 min

Before class

Try the boards yourself.

The kit's chain for node 3: packets leave your device → travel through routers you don't control → anyone along the path can read them → so encryption is necessary. Node 4 (simple encryption) is here as a shift cipher on letters and digits, with the encrypt-decrypt cycle; the Code pathway's Secret messages course is the deeper home of ciphers (Caesar, XOR, cracking, key sharing). For students who have done it, this lesson is the why; for those who haven't, it is a first taste.

Defensive framing: the eavesdropper shows why protection matters; no attack techniques are taught.

Running the lesson

Predict: students who chose "only the bank" hold Sam's misconception; trace the path after the Try.
Try: ask whose Wi-Fi it is, and who else could be on it.
Worked example: have students encrypt their initials with key 3.
Vary: the key 10 task surprises: ask why the digits came through unchanged.
Make: ask what a strong key would need (many possibilities).

The hard part (on purpose)

The shared-path idea: students picture a private tube to the bank. Trace the packets on the board: whose equipment is each one?

When students get stuck

What you will see	A question to ask	The fix
A student says only the receiver sees the message (Sam's mistake).	Which pieces of equipment does the packet pass through?	Every one of them could copy it.
A student shifts the wrong way to decrypt.	Which way did encryption move the letters?	Decrypt by moving back by the same key.

Answers to the checks

who can read it?: You type your PIN into a website on a café's free Wi-Fi. The website has **no encryption**. Who could read the PIN on its way to the bank?
Anyone on the path. Packets cross the café's Wi-Fi and other networks you don't control, and plain text can be read by anyone who copies them.
Try: send it plain: Send the PIN with encryption off. What does Eve see?

Eve copied the packets as they crossed the café Wi-Fi and read the PIN: nothing stopped her.
PIN 4821 with key 3: With key 3, every letter moves 3 along (A → D) and every digit moves 3 along (7 → 0). What does **CAT 12** become?
FDW 45
C→F, A→D, T→W, 1→4, 2→5.
Find the mistake: Sam decides whether it is safe to type a password. Click the line where the reasoning first goes wrong.
line 3
Line 3: the message goes to the bank, but it passes through the café Wi-Fi and other networks first, and anyone there can copy it. Without encryption, they can read it.
Why reversible?: Why must encryption be **reversible**?
The receiver has to turn it back into the real message with the key
Encrypt with the key, decrypt with the key. If it couldn't be reversed, nobody could read the message, including the bank.
Encryption on: Switch encryption on and send.

Eve copied only scrambled text, and the bank, with the key, read the PIN.
Key 0: Set the key to 0 and send. What does Eve see?

A key of 0 moves nothing, so the message is still plain: the key matters as much as the method.
Key 10: Set the key to 10 and send. Look closely at the digits.

Digits wrap round every 10, so a key of 10 leaves the PIN unchanged while the letters change. Eve still gets the PIN: a weak key.
Too few keys: This shift has only 26 different keys. How could Eve break it without knowing the key?
Try every key until the message makes sense
Trying every key (a brute force attack) breaks it in seconds. Real encryption has so many keys that trying them all would take longer than the age of the universe.
What needs encrypting: Which of these most needs encrypting when you send it?
Your bank password
Passwords, card numbers and private messages must be encrypted; public information is less of a worry (though encrypting everything also hides what you are reading).
Decrypt: A message was encrypted with key 3. You receive **KHOOR**. What did it say?
HELLO
Move each letter back 3: K→H, H→E, O→L, O→L, R→O.
The padlock: What does the padlock in a browser's address bar mean?
Data between you and the website is encrypted (HTTPS)
HTTPS encrypts what travels between your browser and that website.
Review: packets: Review: a packet is lost on the way. With TCP, what happens?
The receiver never confirms it, so it is sent again
TCP resends only the packet that was never acknowledged.
a safe key: Encryption is on but the key is 0. Choose a key that scrambles both the letters and the digits, send the PIN, and check the bank still reads it.

Eve copied only scrambled text, digits included, and the bank decrypted it with the key.