CyberQuest - POGIL Activity

Symmetric Encryption

A guided-inquiry activity for Day 3 (Cryptography). Work in a team of 3 to 4, or on your own. Read each Model, then answer the Critical Thinking Questions in order before peeking at the hints.

Learning objectives

Describe how symmetric encryption uses one shared secret key to both encrypt and decrypt.
Explain why the secrecy must live in the key, not in the algorithm.
Estimate a key space and explain why a longer key resists brute force.

Prerequisites: encoding versus encryption, and the Caesar cipher (Day 3, Module 1).

Team roles

Manager - keeps time, makes sure everyone participates, and keeps the team on task.

Recorder - writes the team's agreed answers and notes any questions to ask.

Presenter - speaks for the team and shares answers with the class.

Reflector - watches how the team works together and suggests one improvement.

Model 1: One key, two directions

In Model 1, how many distinct keys are used, and at which steps?
Check your thinking
One key, K, used at both the encrypt step and the decrypt step. That is what makes it symmetric.
Which value must the sender and receiver agree on and keep secret from everyone else?
Check your thinking
The key K. The plaintext and algorithm can be known; only K must stay secret.
Suppose an attacker knows exactly how the encrypt and decrypt steps work but does not know K. Can they read the ciphertext?
Check your thinking
No. With a strong cipher, knowing the method does not help without the key. This is why we say the secrecy lives in the key, not the algorithm.
In your own words, complete the sentence: The security of symmetric encryption depends on ____.
Check your thinking
Keeping the key secret (and choosing a key large enough that it cannot be guessed).

Model 2: From Caesar to AES

A Caesar cipher shifts each letter by a fixed amount. The shift amount is its key.

plain	A	B	C	D	E
cipher (shift 3)	D	E	F	G	H

A modern symmetric cipher, AES, uses a key that is 128 or 256 bits long.

How many different shift keys does the Caesar cipher have (not counting a shift of 0)? Why does that make it weak?
Check your thinking
25. A computer simply tries all 25 in an instant, which is a brute-force attack.
A 128-bit key has 2 to the power 128 possible values. Is that closer to thousands, or to an unimaginably huge number?
Check your thinking
Unimaginably huge: about 3.4 followed by 38 zeros. No computer can try them all.
Using Model 1 and Model 2 together, explain why AES is safe against brute force but the Caesar cipher is not.
Check your thinking
Both put the secrecy in the key, but AES has an astronomically large key space while Caesar has only 25 keys. Brute force beats a tiny key space, not a huge one.
Name one advantage and one disadvantage of symmetric encryption.
Check your thinking
Advantage: it is fast and efficient for large amounts of data. Disadvantage: both sides must somehow share the same secret key safely first.

Do it now

Open Day3.ipynb and run the Caesar and XOR cells. Then brute-force a Caesar ciphertext by trying all 25 shifts, and watch the key space idea in action. Try the same in CyberChef (cyberchef.org).

Application

Why can a website not simply hide its encryption method to stay safe? Connect your answer to your conclusion from Model 1.

All POGIL activities · Main course deck · Camp home