Encryption, public/private keys, passwords, and multifactor authentication.
This message was encrypted using a Caesar Cipher, an alphabetic shift. Let's see how fast you can decode it.
Key: change every letter by 13
Notice how shifting the alphabet by a known number produces a predictable, breakable pattern.
How difficult is it to break a Caesar cipher?
Explore how one key can lock a message, while a different matching key unlocks it.
A public key is meant to be shared. Other people can use it to encrypt a message for the key owner or verify that the owner signed something.
A private key stays secret. The owner uses it to decrypt messages sent to them or create a digital signature.
This solo lab gives you a simulated partner so you can practice both sending and receiving without a classmate. The key tokens, ciphertext, and signatures are simplified for learning, but the process is the same.
You need to send a message securely to your partner.
Your partner's private key is not a tool you get to use. It is your partner's secret.
Your partner sent you a secure response. They used your public key to send you a private message. Choose the key that pairs with the public key your partner used.
Your partner encrypted this for you using your public key. Your job is to open it.
Same key pair, new message. Pick the key that lets your partner read it later.
The receiver's public key locks the message for that receiver.
Your partner sent a second secure response. This time, decide faster: which key opens messages sent to you?
Your public key can be shared. Your private key is kept just for you.
When someone uses your public key, they can create a message intended for you. Sharing that public key does not give them the matching private key.
The private key is the secret part. If it stays protected, only the owner can decrypt messages that were encrypted with the matching public key.
The math used to encrypt with a public key is a one-way operation: it cannot be reversed using that same key. The public key can only lock a message. It cannot undo its own work and decrypt what it just encrypted. Only the mathematically paired private key can run the reverse operation.
Confidentiality means protecting who can read the message. In asymmetric encryption, you usually encrypt with the receiver's public key so only the receiver's private key can decrypt it.
First, create a valid signature and verify the original message.
Your partner's private key stays off the table. You can verify their public messages, but you cannot sign as them.
The signature was created for the original message. Now test what happens when the message text is altered after signing.
A public key can verify a signature, but it should reject a changed message.
Your partner signed a message, then encrypted it for you. First check who sent it, then open it.
Verify that your partner is the person who sent this message. Then decrypt the message that was sent to you.
Real cryptography uses carefully designed algorithms, trusted libraries, and secure key management. This activity is a simplified model to make the roles of the keys visible.
What is the difference between symmetric encryption and asymmetric (public key) encryption?
Think about how the keys work in each system and what problems each one solves.
Passwords, multifactor authentication, and keeping your software up to date.
What strategies do you use when creating a good password? Note: do not actually reveal any of your current passwords in your answer!
Think about what makes a password strong and how you keep track of multiple passwords.
A good password is easy to remember, but hard for someone else to guess based on knowledge they have about you.
Use Multifactor Authentication
What is that?!
Single factor authentication relies on just one category of evidence. A password is the most common example: it is something you know. If someone else learns that password, they can access your account.
Two factor authentication requires evidence from two different categories. Even if an attacker steals your password, they still need physical access to your phone to get in.
How do you prove that you possess your phone?
Are there problems with this system? How could it be hacked?
Think about what could go wrong with each factor, and whether an attacker could get around the system.
Multifactor authentication requires at least two categories of evidence. Each additional factor makes it significantly harder for an attacker to impersonate you.
Why is this a better system than Single Factor Authentication? What are the challenges with this system? Is it worth any of the risks?
Consider convenience, cost, accessibility, and realistic attack scenarios.
Use Multifactor Authentication
Update Your Software
What is a computer virus?
A computer virus is a type of malicious software that can copy itself and spread to other computers. It attaches to legitimate programs and files, often causing damage, stealing data, or giving an attacker control over your system.
How can you protect your device from computer viruses?
Antivirus programs continuously scan your device for known malicious software patterns and quarantine or remove threats before they can cause harm.
Software updates regularly patch security vulnerabilities. Attackers often exploit known bugs in outdated software, so keeping everything current closes those doors.
It is important to keep your software up to date and use the best authentication practices you can. Security is not a one-time setup: it requires ongoing attention as new threats emerge.
SSQRP pulls a total of 5 questions from these computational thinking practices.
What data does the innovation collect, store, or use? How is it processed?
What is the innovation designed to do? What are the intended and unintended effects?
How does the innovation help people? What potential harms or risks does it introduce?
What vulnerabilities exist? What privacy or security risks does the innovation create?
Try the Practice SSQRP posted on BUZZ.