Unit 10 · Lessons 9–10

Protecting Data

Encryption, public/private keys, passwords, and multifactor authentication.

Warm Up

Decode the Message

This message was encrypted using a Caesar Cipher, an alphabetic shift. Let's see how fast you can decode it.

serr cvmmn va gur pnsrgrevn
Cipher
Plain

Key: change every letter by 13

free pizza in the cafeteria
Activity

Caesar Cipher

Do This:

  • Navigate to Code.org.
  • Experiment with the tool: click things, poke around, figure out what it is doing.
  • Choose one of the messages from the drop-down menu and try to crack it using the tool.

Notice how shifting the alphabet by a known number produces a predictable, breakable pattern.

Discussion:

How difficult is it to break a Caesar cipher?

Vocabulary

Encryption Terms

Encryption
A process of encoding messages to keep them secret, so only "authorized" parties can read them.
Decryption
A process that reverses encryption, taking a secret message and reproducing the original plain text.
Cipher
The generic term for a technique (or algorithm) that performs encryption.
Caesar's Cipher
A technique for encryption that shifts the alphabet by some number of characters.
Cracking Encryption
When you attempt to decode a secret message without knowing all the specifics of the cipher, you are trying to crack the encryption.
Video

How Does Encryption Work?

AP CSP Cybersecurity

Public / Private
Key Lab

Explore how one key can lock a message, while a different matching key unlocks it.

Concept Setup

Two Keys, Two Jobs

Public Key

A public key is meant to be shared. Other people can use it to encrypt a message for the key owner or verify that the owner signed something.

Private Key

A private key stays secret. The owner uses it to decrypt messages sent to them or create a digital signature.

Lab Model

This solo lab gives you a simulated partner so you can practice both sending and receiving without a classmate. The key tokens, ciphertext, and signatures are simplified for learning, but the process is the same.

Lab Part 1A

Send: Encrypt a Message For Your Partner

You need to send a message securely to your partner.

Encrypted for partner
Key Cards
Your Public Key
Your Private Key
Partner Public Key

Your partner's private key is not a tool you get to use. It is your partner's secret.

Plaintext
Encryption Key
Drag a key card here to use it to encrypt the message. You can also click a key, then click here. Use the key that belongs to the person who should be able to read it.
Sent State
Ciphertext will appear here after encryption.
Lab Part 1B

Receive: Decrypt Your Partner's Message

Your partner sent you a secure response. They used your public key to send you a private message. Choose the key that pairs with the public key your partner used.

Decrypted received message
Key Cards
Your Public Key
Your Private Key
Partner Public Key

Your partner encrypted this for you using your public key. Your job is to open it.

Incoming Ciphertext
Decrypt Received Message
The message was locked with your public key. Which matching key opens it?
Decrypted Plaintext
Plaintext will appear here after decryption.
Lab Part 1C

Practice: Encrypt One More Message

Same key pair, new message. Pick the key that lets your partner read it later.

Encrypted second message
Key Cards
Your Public Key
Your Private Key
Partner Public Key

The receiver's public key locks the message for that receiver.

Plaintext
Encryption Key
Use the public key for the person who should be able to decrypt this.
Sent State
Ciphertext will appear here after encryption.
Lab Part 1D

Practice: Decrypt One More Reply

Your partner sent a second secure response. This time, decide faster: which key opens messages sent to you?

Decrypted second reply
Key Cards
Your Public Key
Your Private Key
Partner Public Key

Your public key can be shared. Your private key is kept just for you.

Incoming Ciphertext
Decrypt Received Message
This was locked with your public key. Use the matching private key.
Decrypted Plaintext
Plaintext will appear here after decryption.
Part 1 Debrief

Why Sharing a Public Key Is Safe

Public keys lock messages

When someone uses your public key, they can create a message intended for you. Sharing that public key does not give them the matching private key.

Private keys unlock messages

The private key is the secret part. If it stays protected, only the owner can decrypt messages that were encrypted with the matching public key.

The math used to encrypt with a public key is a one-way operation: it cannot be reversed using that same key. The public key can only lock a message. It cannot undo its own work and decrypt what it just encrypted. Only the mathematically paired private key can run the reverse operation.

Confidentiality means protecting who can read the message. In asymmetric encryption, you usually encrypt with the receiver's public key so only the receiver's private key can decrypt it.

Lab Part 2

Sign a Message, Then Verify It

First, create a valid signature and verify the original message.

Signed message Verified valid signature
Key Cards
Your Public Key
Your Private Key
Partner Public Key

Your partner's private key stays off the table. You can verify their public messages, but you cannot sign as them.

Message To Sign
Sign Message
Use the key that only you have to prove the message came from you.
Signed State
Signature token will appear here.
Verify Signature
Use the public key that matches the signer.
Lab Part 2B

Verify a Message That Changed

The signature was created for the original message. Now test what happens when the message text is altered after signing.

Tamper failed verification
Key Cards
Your Public Key
Your Private Key
Partner Public Key

A public key can verify a signature, but it should reject a changed message.

Tampered Signed Message
Sign and verify the original message first.
Verify Tampered Message
Use the signer public key again. The key is right; the message is the part being tested.
Tampered Copy
Capstone

Verify and Decrypt a Partner Message

Your partner signed a message, then encrypted it for you. First check who sent it, then open it.

Verified partner signature Decrypted partner message
Key Cards
Your Public Key
Your Private Key
Partner Public Key

Verify that your partner is the person who sent this message. Then decrypt the message that was sent to you.

Signed + Encrypted Package
Verify Partner Signature
Which public key proves this package was signed by your partner?
Decryption
Decrypt Partner Message
After verification, use the key that opens messages encrypted for you.
Plaintext message will appear here after verification and decryption.
Wrap Up

Public / Private Key Takeaways

Your Lab Progress

  • -Encrypted a message for a partner
  • -Decrypted a received message
  • -Encrypted a second message for the partner
  • -Decrypted a second received message
  • -Signed a message with your private key
  • -Verified a valid signature with your public key
  • -Observed tampered-message verification fail
  • -Verified a signed partner message
  • -Decrypted a message sent to you

Remember

  • Encrypt with the receiver's public key to protect confidentiality.
  • Decrypt with the receiver's private key because only the receiver should have it.
  • Sign with your private key to attach proof that the message came from you.
  • Verify with the matching public key to check authenticity and detect changes.

Real cryptography uses carefully designed algorithms, trusted libraries, and secure key management. This activity is a simplified model to make the roles of the keys visible.

FRQ

Symmetric vs. Asymmetric Encryption

What is the difference between symmetric encryption and asymmetric (public key) encryption?

Think about how the keys work in each system and what problems each one solves.

Unit 10 · Lesson 10

Protecting Data
Part 2

Passwords, multifactor authentication, and keeping your software up to date.

FRQ

Password Strategies

What strategies do you use when creating a good password? Note: do not actually reveal any of your current passwords in your answer!

Think about what makes a password strong and how you keep track of multiple passwords.

Takeaway

What Makes a Good Password?

A good password is easy to remember, but hard for someone else to guess based on knowledge they have about you.

Strong passwords tend to:

  • Be long (12+ characters)
  • Mix letters, numbers, and symbols
  • Avoid personal information (names, birthdays)
  • Be unique to each account

Weak passwords often:

  • Use common words or phrases
  • Include obvious personal details
  • Get reused across multiple sites
  • Follow predictable patterns (abc123, password1)
Activity

What can I do to protect my data?

Use Multifactor Authentication

What is that?!

Activity

Single Factor Authentication

Category
Something
you know
Example
Password

Single factor authentication relies on just one category of evidence. A password is the most common example: it is something you know. If someone else learns that password, they can access your account.

Activity

Two Factor Authentication

Category 1
Something
you know
Example
Password
Category 2
Something
you possess
Example
Phone

Two factor authentication requires evidence from two different categories. Even if an attacker steals your password, they still need physical access to your phone to get in.

Discussion:

How do you prove that you possess your phone?

FRQ

Problems with Two Factor Authentication

Are there problems with this system? How could it be hacked?

Think about what could go wrong with each factor, and whether an attacker could get around the system.

Activity

Multifactor Authentication — at least two of these:

Category 1
Something
you know
Example
Password
Category 2
Something
you possess
Example
Phone
Category 3
Something
you are
Example
Fingerprint

Multifactor authentication requires at least two categories of evidence. Each additional factor makes it significantly harder for an attacker to impersonate you.

FRQ

Evaluating Multifactor Authentication

Why is this a better system than Single Factor Authentication? What are the challenges with this system? Is it worth any of the risks?

Consider convenience, cost, accessibility, and realistic attack scenarios.

Activity

What can I do to protect my data?

Use Multifactor Authentication

Update Your Software

Activity

Quick Review

Discussion Question:

What is a computer virus?

A computer virus is a type of malicious software that can copy itself and spread to other computers. It attaches to legitimate programs and files, often causing damage, stealing data, or giving an attacker control over your system.

Activity

How Can You Protect Your Device?

Discussion Prompt:

How can you protect your device from computer viruses?

Virus Scanning Software

Antivirus programs continuously scan your device for known malicious software patterns and quarantine or remove threats before they can cause harm.

Updating System Software

Software updates regularly patch security vulnerabilities. Attackers often exploit known bugs in outdated software, so keeping everything current closes those doors.

Activity

Data protection is a
moving target!

It is important to keep your software up to date and use the best authentication practices you can. Security is not a one-time setup: it requires ongoing attention as new threats emerge.

AP Exam Prep

Single-Select Questions with Reading Passage

What is SSQRP?

  • Shows up on the AP CSP exam.
  • Features a pretend computing innovation with a short explanation.
  • Five multiple choice questions focusing on data, purpose and effect, benefits and harms, and security concerns.
AP Exam Prep

SSQRP — Question Categories

SSQRP pulls a total of 5 questions from these computational thinking practices.

Data

What data does the innovation collect, store, or use? How is it processed?

Purpose and Effect

What is the innovation designed to do? What are the intended and unintended effects?

Benefits and Harms

How does the innovation help people? What potential harms or risks does it introduce?

Security Concerns

What vulnerabilities exist? What privacy or security risks does the innovation create?

Do This:

Try the Practice SSQRP posted on BUZZ.

Wrap Up

Key Vocabulary

Multifactor Authentication
A method of computer access in which a user has to successfully provide evidence in at least two of the following categories: knowledge (something they know), possession (something they have), and inherence (something they are). Each step provides a new layer of security.
Computer Virus Scanning Software
Software that protects a computing system against infection by detecting, quarantining, and removing malicious programs before they can cause harm.
Asymmetric Encryption (Public Key Encryption)
An encryption system that uses a pair of mathematically linked keys: a public key anyone can use to encrypt a message, and a private key only the owner uses to decrypt it.