Cryptography (Years 10–11) — Computer Science

Why we encrypt data, the Caesar/substitution cipher and the idea of a key, and the difference between symmetric and asymmetric (public-key) encryption as used by HTTPS.

Every message you send across the internet passes through machines you do not own — routers, cables, wireless links. Anyone tapping the wire could copy it. So how does your bank password reach the bank and nobody in between can read it? The answer is thousands of years old: cryptography, the art of scrambling a message so only the right person can unscramble it.

Why this matters: Encryption is what makes the padlock in your browser mean something. It protects passwords, payments and private messages every second of every day — and the ideas behind it are simpler than they look.

The Caesar cipher — the oldest trick

A Caesar cipher shifts every letter along the alphabet by a fixed amount.

The Caesar cipher shifts every letter along the alphabet by a fixed number — the key. With a shift of 3, A becomes D, B becomes E, and so on. So HELLO encrypts to KHOOR. It is a kind of substitution cipher: each letter is swapped for another by a rule. To decrypt, you simply shift back by the same key. Picture two alphabet strips slid three places apart — line them up and you can read straight across.

Term	Meaning
Plaintext	The original, readable message
Ciphertext	The scrambled version
Key	The secret that controls the scrambling (here, the shift)
Encrypt / Decrypt	Lock the message / unlock it again

The key is everything

Encrypt with the key to hide the message; decrypt with the key to reveal it.

Notice what does the real work: the key. The method can be public knowledge — everyone knows how a Caesar shift works — but without the key you cannot easily reverse it. A good cryptosystem stays safe even when the attacker knows the method, as long as the key stays secret. (The Caesar cipher is far too weak for real use: there are only 25 shifts to try. Real systems use huge keys.)

Symmetric vs asymmetric encryption

Symmetric shares one secret key; asymmetric splits it into a public and private pair.

In symmetric encryption the same key both locks and unlocks the message. It is fast — but it has a snag: how do you get that secret key to the other person without an eavesdropper copying it on the way? Asymmetric (public-key) encryption solves this cleverly with a pair of keys. A public key can be handed to anyone and is used to lock; only the matching private key, kept secret, can unlock. Think of a postbox: anyone can drop a letter through the slot (public), but only the owner with the key can open it (private).

How HTTPS uses public keys

The browser padlock: HTTPS uses public-key encryption to keep the connection private.

This is exactly how HTTPS (the padlock in your browser) begins. Your browser gets the website's public key and uses it to lock the data it sends. Only the website, holding the matching private key, can unlock it — so nobody in between can read your password. One last idea to link back: hashing is different again. A hash is one-way — you can scramble a password into a hash but you cannot reverse it — which is why sites store hashes, not your actual password.

Worked example: Encrypt the word CAB with a Caesar cipher, key = 3. — C→F, A→D, B→E, giving FDE. To decrypt FDE, shift each letter back by 3: F→C, D→A, E→B — back to CAB.

Common mistake: In asymmetric encryption you do not use the same key to lock and unlock. The public key locks; only the private key unlocks. Mixing them up is the classic slip.

Tip: symmetric = one shared key (fast, but sharing it is the hard part); asymmetric = public locks, private unlocks (solves the sharing problem, and powers HTTPS). And a hash only goes one way.