Week 11 · lesson
Caesar Cipher: When a Secret Depends on a Tiny Keyspace
Encryption is designed to protect information so an unauthorized reader cannot understand it without the required secret or key material.
Classical ciphers are not secure enough for modern systems, but they are useful because the mechanism is visible.
The Caesar cipher shifts each letter by a fixed number of positions.
Example with a shift of 3:
A → D
B → E
C → F
So:
ROBOT
becomes:
URERW
Plaintext, ciphertext, and key
Use three terms precisely:
- plaintext: readable original message
- ciphertext: transformed output
- key: value controlling the transformation
For a Caesar cipher, the key is the shift amount.
Encrypt by shifting
Use the alphabet as a circular sequence.
With a shift of 5:
A → F
W → B
X → C
Y → D
Z → E
Letters wrap around the end.
Encrypt these teacher-provided words with shift 5:
CYBERROBOTTRUST
Then decrypt your results by reversing the shift.
Why Caesar is weak
The alphabet has only a small number of possible shifts.
An analyst can try every meaningful shift quickly.
This is a small keyspace problem.
A secret transformation is not strong just because the output looks unreadable.
Brute-force reasoning without automation
Given this teacher-provided ciphertext:
KHOOR
Try likely shifts until readable plaintext appears.
Document:
| Shift tried | Result | Plausible? |
|---|---|---|
| 1 | JGNNQ | No |
| 2 | IFMMP | No |
| 3 | HELLO | Yes |
You are not attacking a real system. You are exploring the size of the toy cipher's keyspace.
Patterns survive substitution
A Caesar cipher changes letters but preserves several language patterns:
- word lengths
- repeated letters
- repeated words
- punctuation and spacing, depending on implementation
Suppose the plaintext contains the same word twice. The ciphertext will contain the same transformed word twice.
That leakage can help an analyst.
Frequency intuition
Natural language does not use every letter equally often.
In a longer substitution-style ciphertext, repeated symbols and common letters can reveal structure.
You do not need a full statistical cryptanalysis method today. The key lesson is that patterns in plaintext can survive weak transformations.
Compare encoding and encryption
Base64 from Week 10 is reversible without a secret key.
Caesar uses a key, but the keyspace is tiny.
Both can produce text that looks unfamiliar.
Only one is even attempting confidentiality.
Create this comparison:
| Property | Base64 | Caesar cipher |
|---|---|---|
| Purpose | Representation | Confidentiality exercise |
| Secret key required? | No | Yes, shift value |
| Easy to reverse? | Yes | Yes, because keyspace is tiny |
| Suitable for modern security? | No confidentiality | No |
Build a cipher wheel model
Create a visual or table showing:
- normal alphabet
- shifted alphabet
- selected key
- one encrypted word
- reverse decryption path
Then explain why the key, not the visual complexity of the ciphertext, is central to the transformation.
Misconception check
Evaluate these claims:
"Nobody can read it because it looks random."
Incorrect. Appearance does not establish cryptographic strength.
"It uses encryption, so it is secure."
Incorrect. Cipher design and keyspace matter.
"If I hide the algorithm, the cipher becomes safe."
Weak reasoning. A security system should not depend only on an attacker being unaware of the basic method.
Evidence for Lesson 1
Submit:
- three Caesar encrypt/decrypt examples
- brute-force shift table
- Base64 versus Caesar comparison
- cipher wheel model
- misconception analysis
Finish with:
The Caesar cipher fails as modern security because ________.
The lesson is not that cryptography is easy to break. It is that keyspace, pattern leakage, and design matter more than whether ciphertext looks mysterious.
decision flow
Web Input Safety in Practice Environments: Defensive Evidence Flow
Authorize
Confirm the classroom boundary and permitted evidence.
Observe
Inspect a provided artifact or isolated system state.
Assess
Connect evidence to risk, limitation, and control.
Defend
Document a safeguard and how it would be safely verified.
Read this concept flow as plain text
- Authorize. Confirm the classroom boundary and permitted evidence.
- Observe. Inspect a provided artifact or isolated system state.
- Assess. Connect evidence to risk, limitation, and control.
- Defend. Document a safeguard and how it would be safely verified.