Day 3: Cryptography - Codes and Ciphers

CyberQuest Summer Camp - day deck

This is your hands-on companion to the main course deck. The main deck (Interactive_Slides.html) sends you to specific Parts here and to Modules in the notebook, then back. You can also run this deck on its own, top to bottom, with the Next arrow.

Morning Kickoff: Motivation & News (09:00 AM - 09:15 AM)

• Case Profile: The 2023 MGM Resorts Vishing Attack. Threat actors called a corporate helpdesk, used social engineering to trick an operator into resetting authentication codes, and took down hotel systems for days. This shows why human psychological manipulation can bypass technical access controls.

Teaching Session I: Core Lecture (09:15 AM - 11:15 AM)

Cryptographic Data Transformations

• Encoding: Converting data into a public, standardized format for reliable transport across different systems. It uses no secret keys and provides no security (e.g., Base64 formatting conversion).
• Encryption: Transforming clear readable plain text into unreadable ciphertext using a mathematical algorithm and a secret key. It is fully reversible if you possess the proper matching decryption key.
• Hashing: Running data through a one-way mathematical function to produce a unique, fixed-size string called a message digest. Hashing is completely irreversible; you cannot reconstruct the original data from the hash value. It is used to verify data integrity.
• Digital Signatures: Cryptographic tokens produced by hashing a message and using the sender's private key to sign that hash. They provide verification of authenticity, message integrity, and non-repudiation (proving the sender cannot deny sending the message).

Social Engineering Vectors

Social engineering is the practice of manipulating people into performing actions or divulging confidential information. * Phishing: Broad, non-targeted deceptive emails sent to mass audiences to steal access credentials. * Spear Phishing: Highly customized, targeted phishing attacks tailored to a specific individual or organization using personal background details. * Vishing: Voice Phishing; using phone calls to impersonate authority figures and extract internal data details. * Smishing: SMS Phishing; sending malicious exploit download links or fraudulent alerts via text messages. * Pretexting: Creating a fabricated scenario or false identity to trick a target into disclosing sensitive information. * Baiting: Leaving malware-infected physical media (like USB drives) in public areas, waiting for targets to plug them into a corporate computer out of curiosity. * Tailgating / Piggybacking: Following an authorized employee through a secured physical entry door or turnstile without scanning a badge. * Quid Pro Quo: Offering a fake service or technical support assistance in exchange for user access passwords.

Identity Protection Controls

• Password Security: Strength is determined by entropy metrics, which scale with length, character complexity, and avoiding dictionary terms.
• Multi-Factor Authentication (MFA): Requiring multiple independent validation factors before granting access:
  1. Something you know (e.g., a password or personal identification number PIN).
  2. Something you have (e.g., a physical hardware token or authentication app code).
  3. Something you are (e.g., biometric factors like fingerprints or facial scans).

Teaching Session II: Labs & Interactive Tools (11:45 AM - 01:45 PM)

Practical Interactive Tools for Today

1. dcode.fr: Analyze cipher patterns, calculate letter frequencies, and crack classic ciphers like Caesar and Vigenère.
2. CyberChef: Chain operations together to handle advanced data transformations, such as converting text to hex, encoding to Base64, and calculating SHA-256 hashes.

Recap & Tomorrow's Horizon (04:15 PM - 04:30 PM)

• Summary: Today we mapped cryptographic differences, unpacked social engineering vectors, and analyzed multi-factor authentication.
• Tomorrow Preview: We will focus on application layers, investigating SQL Injection web exploits, blockchain ledgers, and AI safety controls.

Your plan for today

6 parts. Press Next to move in order.

1. Part 1. Get oriented - 4 slides
2. Part 2. Learn the basics - 25 slides
3. Part 3. Code along - 1 slide
4. Part 4. Play the free tools - 3 slides
5. Part 5. Test yourself - 4 slides
6. Part 6. Wrap up - 1 slide

PART 1 OF 6

Get oriented

Objectives, key terms, a picture, and the news.

This part is 4 slides. Press Next to begin.

Learning objectives

• Tell the difference between encoding, encryption, and hashing.
• Encrypt and crack a Caesar cipher.
• Build a decoding pipeline in CyberChef.

Vocabulary (acronyms expanded and defined)

• CTF = Capture The Flag: a cybersecurity game where you solve puzzles to find hidden text called flags.
• ASCII = American Standard Code for Information Interchange: numbers that represent letters (A is 65).
• Base64: a way to write data using 64 safe characters; it is encoding, not secrecy.
• XOR = eXclusive OR: a bitwise operation; apply the same key twice to undo it.
• AES = Advanced Encryption Standard: the strong encryption that protects real data today.
• RSA = Rivest-Shamir-Adleman: a famous encryption method named after its three inventors.
• Hash: a one-way fingerprint of data; you cannot turn it back into the original.

Picture it

  Encoding   : message  -> reformatted (anyone can reverse)     Base64
  Encryption : message + KEY -> scrambled (need key to reverse) AES
  Hashing    : message  -> fingerprint (cannot reverse)         SHA-256

In the news (real and verifiable)

During World War Two, the German military used the Enigma machine to encrypt messages. A team at Bletchley Park, including the mathematician Alan Turing, built machines to break it. Historians estimate this codebreaking helped shorten the war. Cryptography is still one of the most important fields in security today.

PART 2 OF 6

Learn the basics

Now go deeper: the core ideas step by step, with quick knowledge checks.

This part is 25 slides. Press Next to begin.

Three ideas, do not mix them

Encoding vs encryption vs hashing

• Encoding: reformatting anyone can reverse (Base64).
• Encryption: scrambling that needs a secret key (AES).
• Hashing: a one-way fingerprint you cannot reverse (SHA-256).

Knowledge check

Base64 is...

The Caesar cipher

A 2000-year-old code

Shift every letter by a fixed amount. Shift 3 turns A into D.

HELLO  (shift 3)  ->  KHOOR

Only 25 useful shifts, so a computer cracks it instantly.

Knowledge check

Why is the Caesar cipher weak?

Hashing is one-way

Fingerprints for data

A hash turns any input into a fixed fingerprint. Change one letter and the whole fingerprint changes, and you cannot reverse it.

password   -> 5e88489...
Password   -> e7cf3ef...   (totally different)

Knowledge check

A hash is special because...

Why hide information?

The goals of cryptography

Cryptography protects three things: confidentiality (keep it secret), integrity (detect tampering), and authenticity (prove who sent it). The same math powers HTTPS, messaging apps, and payments.

Three ideas side by side

Never mix them up

The Caesar shift

Illustration

Only 25 shifts exist, so a computer breaks it instantly by trying them all.

Frequency analysis

Breaking a cipher without the key

In English, E is the most common letter, then T and A. Counting letters in a scrambled message hints at the shift or substitution. This 1000-year-old technique is built into tools like CyberChef.

The Vigenere cipher

A stronger classic cipher

Vigenere uses a keyword to vary the shift for each letter, which defeats simple frequency analysis. It held up for centuries but is still breakable with enough text. Try it on dcode.fr.

Base64

Encoding, not secrecy

Base64 rewrites any data using 64 safe characters so it survives email and URLs. It is fully reversible by anyone, so it protects nothing. You will spot it by the trailing = signs.

meet at noon  ->  bWVldCBhdCBub29u

XOR

The building block of stream ciphers

XOR combines data with a key one bit at a time. Its magic property: applying the same key twice returns the original. Real stream ciphers generate a long, unpredictable keystream to XOR with.

Knowledge check

A string ends with == and uses letters and digits. What is it likely?

The avalanche effect

Illustration

One changed letter flips the entire fingerprint. That sensitivity detects tampering.

Hashing in the real world

Where you meet hashes

Hashes verify downloads (compare the published hash), store passwords safely (salted), and underpin digital signatures and blockchains. If even one byte changes, the hash changes.

Symmetric vs public-key

Illustration

Symmetric shares one key; public-key uses a pair, solving safe key sharing.

AES

The workhorse of encryption

The Advanced Encryption Standard is fast, trusted symmetric encryption used everywhere from HTTPS to disk encryption. With a strong key it is considered unbreakable by brute force today.

RSA

Public-key math

RSA builds a public and private key from two large primes. Encrypting is easy; reversing it requires factoring a huge number, which is practically impossible. You ran a tiny version in the notebook.

Digital signatures

Ch 2 §2.11 — authentication and non-repudiation

Proving who sent it

Signing hashes a message and uses the sender's private key to produce a signature over that hash. Anyone with the sender's public key can verify the signature, confirming the message is authentic and unchanged.

HTTPS

Crypto you use every day

The padlock in your browser means HTTPS: your traffic is encrypted with TLS, which combines public-key crypto to exchange a key and symmetric crypto for speed. Eavesdroppers see only scrambled bytes.

Knowledge check

Which can you safely share with anyone?

A short history

From Caesar to today

Ciphers evolved from Caesar (ancient Rome) to Vigenere (Renaissance) to the Enigma machine (World War Two, broken at Bletchley Park) to modern AES and RSA. Each break pushed the field forward.

Modular arithmetic

Clock math behind ciphers

Ciphers wrap around like a clock. The % operator gives the remainder, so (25 + 3) % 26 wraps Z back to C. This wrap-around is what keeps shifted letters inside the alphabet.

Crypto in your pocket

Everyday encryption

Messaging apps, web logins, app stores, and payment cards all rely on the ciphers and hashes you studied today. You use cryptography dozens of times a day without noticing.

Frequency analysis: breaking Caesar

Ch 2 §2.2 — why classical ciphers fail

In English, the letter E appears ~12.7% of the time. Caesar just shifts the whole alphabet, so the frequency pattern is preserved — just shifted.

ciphertext = "KHOOR ZRUOG"   # Caesar shift 3
# count letter frequencies, find the most common letter
# most common in ciphertext is probably the shifted E
# if X is most common, key = (ord(X) - ord('E')) % 26

from collections import Counter
text = "KHOOR ZRUOG"
freq = Counter(c for c in text if c.isalpha())
most_common, _ = freq.most_common(1)[0]
key = (ord(most_common) - ord('E')) % 26
print("Guessed key:", key)   # 10... try all 26 to be sure

One-time pad: perfect secrecy

Ch 2 §2.3 — perfect secrecy and XOR

The unbreakable cipher — and its catch

XOR every plaintext bit with a truly random key bit of equal length. If the key is secret and never reused, it is mathematically unbreakable.

msg = b"HELLO"
key = b"XMCKL"   # random, same length, never reused
ct  = bytes(m ^ k for m, k in zip(msg, key))
pt  = bytes(c ^ k for c, k in zip(ct,  key))
print(pt)  # b'HELLO'

Randomness quality matters

Ch 2 §2.4

import random, secrets

# DO NOT use this for passwords
print(random.randint(0, 2**32))  # predictable if seed known

# Use this instead
print(secrets.token_hex(16))     # 32 random hex chars, safe

AES and block cipher modes

Ch 2 §2.5 — ECB vs CBC

AES encrypts 128-bit blocks. The mode of operation determines how blocks relate to each other.

The classic demo: encrypt a bitmap image (like a penguin) with ECB and you can still see the shape — the pattern leaks. CBC produces uniform noise.

The birthday paradox and hash collisions

Ch 2 §2.7 — why MD5 is broken

In a group of 23 people, there is a 50% chance two share a birthday. With hashes the same math applies: you do not need to find a specific collision, just any two inputs with the same output.

RSA step by step

Ch 2 §2.10 — numeric worked example

m, e, d, n = 5, 3, 235, 391
c = pow(m, e, n)    # encrypt: 125
m2 = pow(c, d, n)   # decrypt: 5
print(c, m2)        # 125 5

Digital signatures

Ch 2 §2.11 — authentication and non-repudiation

Proving who sent what

The TLS handshake

Ch 2 §2.14 — how HTTPS works

After step 5, all data is encrypted with AES using the shared session key. This takes under 0.1 seconds on a modern connection.

Knowledge check

Why is ECB mode dangerous for encrypting images?