Cryptography and Defences
Every defence on this page has a specific, understandable reason it works, and understanding why is what turns "use a strong password" from advice you're told into something you can actually calculate for yourself.
The Caesar cipher
The simplest possible cipher: shift every letter along the alphabet by a fixed amount. Type a message and pick a shift.
Shift amount: 7
Why the Caesar cipher is trivially weak
There are only 25 possible shifts, ever. That means a computer (or even a patient human) can just try every single one and instantly spot which one reads as real English.
Controls
This message was encoded with a secret shift. Find it.
Frequency analysis: cracking a harder cipher
A substitution cipher (each letter mapped to a completely different, random letter) has 26! possible keys, brute force genuinely is not realistic here. But English letters are not used equally often, and that pattern survives encryption.
Letter frequency: ciphertext (blue) vs typical English (green)
Controls
Password strength: the maths made concrete
This is exactly the same combinatorics idea from earlier work, applied to something you actually use every day. Pick a password style and watch worst-case crack time explode.
Assumed attack speed
1 billion guesses per second, realistic for modern password-cracking hardware.
Exam tips
- Length matters more than most people expect, adding characters multiplies the keyspace, it doesn't just add to it.
- A longer, simpler password (like a random phrase) can genuinely beat a shorter, complex one.
Symmetric encryption: one key, both directions
This is a real, working cipher, not an analogy. It uses XOR, the same logic gate from earlier, applied byte by byte between your message and a key. Type both in and watch it actually encrypt, then watch the exact same key decrypt it straight back.
Encrypted (shown as hex byte values, since XOR output isn't printable text)
Decrypted, using the exact same key
The problem this creates
Symmetric encryption is fast and simple, but both sides need the identical secret key before they can communicate at all. If you've never met the other person, for example buying something from a website you've never visited before, how do you agree on a secret key over a connection that might itself be intercepted? Sending the key itself would be exactly as risky as sending the unencrypted message. This exact problem is what asymmetric encryption solves.
Why real symmetric keys are so much longer
The toy XOR cipher above uses a short, guessable key. Real symmetric encryption (AES) uses 128 or 256-bit keys instead, using the exact same keyspace idea from the password section: a 256-bit key has 2256 possible values, so large that brute-forcing it would take vastly longer than the age of the universe, even at trillions of guesses per second.
Asymmetric encryption: two different keys
The padlock analogy: imagine an open padlock anyone can snap shut (the public key), but only one specific physical key can open it again (the private key). You can hand out copies of the open padlock to the entire world. Nobody needs a shared secret in advance, they just lock their message with your public padlock, and only you can unlock it.
A real, working toy example (small numbers, so you can follow every step)
Proof of asymmetry
Exam tips
- Symmetric: one shared key, fast, but requires safely exchanging that key first.
- Asymmetric: two mathematically linked keys, solves the exchange problem, but is significantly slower to compute.
- In practice HTTPS uses both: asymmetric encryption just to safely exchange a one-time symmetric key, then fast symmetric encryption for the actual data, the best of each.
- Real RSA uses primes hundreds of digits long specifically so factoring n back into p and q is computationally infeasible, unlike this toy example where n=187 factors easily by hand.
Other defences
Cryptography is one layer. Real systems combine several defences, because no single one covers every threat from the previous page.