Hashes and keys

Classroom resources

Load these into Waypoints Prepare: choose Load URL and paste the copied address, or download the file and import it. In Prepare, the worksheet's Teacher edition shows the answers; the student copy hides them.

• Slides Download Copy address for Prepare Present from the browser, or export to PowerPoint or PDF.
• Worksheet Download Copy address for Prepare Print the student copy; the Teacher edition has the answers.

Students will be able to

• I can explain how sites check passwords without storing them.
• I can explain what a salt adds.
• I can explain how a public key and a private key work together.

Timing

Predict and Try 6 min · Worked example 13 min · Vary 12 min · Practise and Make 14 min

Before class

Try the boards yourself. The hash is real SHA-256 (shown short); the passwords in the lesson are practice ones. Tell students never to type a real password into any board.

The kit's typical width: public key cryptography (as in TLS/HTTPS) secures data in transit; hashing secures stored passwords; they address different threats. Simplifications: the padlock is an analogy; HTTPS uses public keys to agree a shared key, then faster encryption for the rest.

Links: Secret messages' key sharing (agreeing a key in public) is the other half of how HTTPS starts.

Running the lesson

1. Predict: students who chose "your password" assume sites keep it.
2. Try: count how many digits changed for one letter.
3. Worked example: ask why the same password must always give the same hash.
4. Vary: ask why two identical hashes in a stolen list would be a giveaway without salt.
5. Make: remind students not to type a real password; it is a made-up passphrase.

The hard part (on purpose)

Hashing is one-way and the public key only locks: both run against intuition. Use the padlock and the meat grinder (you can't un-mince) as anchors.

When students get stuck

Answers to the checks

1. a stolen list: A website is hacked and its list of passwords is stolen. If the site did its job properly, what do the attackers find for your account?
   A hash. The site never kept the password: it stores the hash, and at sign-in hashes what you type and compares.
2. Try: sign in with a hash: The site stores only Sam's hash. Type Sam's password (maple). Then change one letter to a capital. What happens to the hash?
   
   maple matches the stored hash; Maple gives a completely different one. The site can check you without ever storing the password.
3. Two tools: Why can a site check your password without storing it?
   The same password always gives the same hash, so it compares hashes
   Hash what is typed; if it equals the stored hash, the password was right.
4. Find the mistake: Sam explains how Forgot password works. Click the line where it first goes wrong.
   line 3
   Line 3: a hash can't be turned back. That is why sites send a reset link instead; a site that emails you your old password is storing it, which is a warning sign.
5. Padlocks: Bob wants to send Alice a secret. Alice has published her open padlock (public key). Who can open a box Bob locks with it?
   Only Alice, with her private key
   Public key: anyone can lock, only the private key opens. HTTPS uses this to agree a secret key with a website.
6. Salt: Type maple, then switch on the salt. Ana and Ben both use maple. Are their hashes the same?
   
   Different salts, different hashes: a list of pre-hashed common passwords no longer matches, and nobody can tell that two people share a password.
7. Alice's padlock: Bob locks the message with Alice's padlock and sends it.
   
   Eve has the box and even a padlock, but no key: only Alice's private key opens it.
8. Bob's own padlock: Now Bob uses his own padlock. Send it.
   
   Alice can't open it: only Bob has that key. You lock with the receiver's public key.
9. No padlock: Send it with no padlock.
   
   No lock: Eve reads it. That is a site without HTTPS.
10. Emailed passwords: A site emails you your old password when you click Forgot password. What does that tell you?
    It stores your password, not a hash: a bad sign
    A hash can't be reversed, so a well-built site can only send a reset link.
11. Passphrases: Why are long passphrases safer even when sites store hashes?
    Attackers hash lists of common passwords and compare; a long unusual passphrase isn't on those lists
    Guessing still works on common passwords: hash the guess, compare. Length and unusual words defeat the guess lists.
12. Which key?: Which key do you use to send someone a secret?
    Their public key
    Lock with the receiver's public key; only their private key opens it.
13. Review: access: Review: which is authorisation?
    Only teachers may change marks
    Authorisation is what you may do once signed in.
14. a strong passphrase: Make up (don't use a real one) a passphrase of at least four unrelated words and 20 characters. Watch its hash.
    
    Long and unusual: not on any list of common passwords, and still easy to remember.

Solutions

One possible solution for each task. Other correct programs are fine.

Vary: one change at a time › Salt

Open task: any program that does what the step asks.

Vary: one change at a time › Alice's padlock

Open task: any program that does what the step asks.

Vary: one change at a time › Bob's own padlock

Open task: any program that does what the step asks.

Vary: one change at a time › No padlock

Open task: any program that does what the step asks.

a strong passphrase

Open task: any program that does what the step asks.

Stretch and support

Stretch: Why do security experts recommend a password manager? What does it change about using the same password on several sites?

Support: Two cards: Stored → hash (one way). Sent → public key locks, private key opens.

Exit ticket

Why can't attackers read passwords from a list of hashes? Which key locks a message for Alice?

A hash can't be reversed; only guesses can be hashed and compared. Alice's public key; only her private key opens it.

What each step is for

• a stolen list: Committing to what a stolen password list contains tests the new move: sites store hashes, which can be checked but not reversed.
• Try: sign in with a hash: Typing the password and seeing its hash match the stored one settles the prediction: the site checks hashes, never storing the password.
• Worked example: hashes and padlocks: Following a sign-in through hashing, then a message through a public padlock, models both tools. Sam thinks a hash can be turned back, the misconception planted after the method.
• Vary: one change at a time: Each task changes one thing: a salt for the same password, then the lock Bob uses (Alice's, his own, none).
• hashes and keys: Spotting good and bad password storage, choosing the right key, and a review of access control.
• a strong passphrase: Building a passphrase that meets a strength rule reverses the process: students start from what makes a hash hard to guess and make a password to match.

Where it leads

Next: Capture the flag (use everything from this course to find and fix the weaknesses in a school portal).

Links: Secret messages (key sharing, challenge and response).