Talib AliCybersecurity Study Guide & Portfolio

Study Guide

Cryptography Foundations: Ciphers, Keys and Encoding

The vocabulary of cryptography from the beginning: plaintext, ciphertext, ciphers and keys, why encoding is not encryption, what the Caesar cipher and Enigma teach, Kerckhoffs's principle, and why key length decides how long a brute-force attack takes.

Lesson 6.1 Cryptography & PKI

Cryptography is how information is kept secret and trustworthy when other people can see it. This lesson works out the basic idea and its vocabulary, why some things that look secret are not, and what makes a cipher strong or weak.

Think

A locker padlock

Think it through

Everyone can buy the same model of combination padlock for a school locker, and everyone knows how it works. What actually keeps your locker shut?

Show what happens

The combination. The lock is the same for everybody; only the combination is secret. Protecting information works the same way: the method can be public, and the secret is something else.

Think it through

You write a message in which every letter is swapped for a number, using a table printed in the back of every exercise book. Is the message secret?
Show the answer

Answer: C. No: the table is public.

No. Anyone with the table can reverse it. Changing how a message looks, with nothing secret involved, is not the same as keeping it secret.

Explain

The idea

Cryptography protects information by transforming it, so that only the intended people can read it or trust it.

Start with a message that anyone could read. It is called plaintext. A cipher is a method, an algorithm, that scrambles the plaintext into ciphertext, which looks like nonsense. A key is a secret value that controls exactly how the cipher scrambles. Turning plaintext into ciphertext is encryption; turning it back with the right key is decryption.

An everyday comparison is a combination padlock. Everyone knows how a combination padlock works, and anyone can buy the same model. What keeps your locker shut is the combination. The lock is the cipher; the combination is the key.

Encryption is the main technical way of providing confidentiality: data that falls into the wrong hands is useless without the key. Other techniques in this module provide integrity (showing that data has not changed) and authentication (showing where it came from). Almost every security product relies on them, so the vocabulary here is used throughout security work.

Check your understanding

In the padlock comparison, which part is the key?
Show the answer

Answer: A. The combination

The combination: the lock is the cipher, and the combination is the key.

Three words that sound alike

  • Cryptography is the practice of protecting information by transforming it.
  • Cryptanalysis is the study of breaking that protection: finding the plaintext or the key without being given it.
  • Cryptology is the whole field, covering both.

The people who design ciphers and the people who attack them are doing two halves of one job. A cipher is trusted only after skilled cryptanalysts have tried to break it and failed.

Predict

Encoding is not encryption

This is the confusion most worth removing early.

Think it through

A program turns “Meet at noon” into TWVldCBhdCBub29u, using a published scheme and no secret. Is the message now protected?
Show the answer

Answer: B. No: anyone can reverse it.

No. With no secret involved, anyone who knows the published scheme can turn it straight back.

Encoding changes how data is represented so that another system can handle it. It uses a public, published scheme and no key. Anyone can reverse it. Its purpose is compatibility, not secrecy.

Encryption changes data so that it cannot be read without a secret key.

Base64 is an encoding that turns any data into letters, digits and a few symbols, so that it can travel through systems that only handle text.

The text Meet at noon in Base64 is TWVldCBhdCBub29u.

That looks scrambled, and it is tempting to call it encrypted. It is not. No key was used. Any Base64 decoder, including free websites and built-in operating system tools, turns it straight back into Meet at noon. A password or an access token “protected” with Base64 is not protected at all.

Check your understanding

A developer stores an access token “protected” with Base64. What protection does that give?
Show the answer

Answer: C. None: anyone can decode it.

None: Base64 is an encoding, and any decoder turns the token straight back.

Encoding and encryption

Key?Encoding
No key. A public scheme changes how data is represented, and anyone can reverse it.Base64, hexadecimal, URL encoding.
Key?Encryption
A secret key is needed to reverse it. Without the key, the data cannot be read.AES, covered in the next lesson.

A third idea, hashing, cannot be reversed by anyone, with or without a key. It has its own lesson.

Predict

A cipher you can break yourself

The Caesar cipher is one of the oldest ciphers known, named after Julius Caesar, who is said to have used it. It replaces each letter with the letter a fixed number of places further along the alphabet. The number of places is the key.

Think it through

If every letter moves three places along the alphabet, what does “dog” become? And how would the receiver turn it back?

Show what happens

It becomes “grj”. The receiver moves each letter three places back. The number of places is the key, used in both directions.

With a shift of 3, A becomes D, B becomes E, and so on, wrapping round at the end so that X becomes A.

  1. C moved three places along the alphabet is F.
  2. A moved three places along is D.
  3. T moved three places along is W.

The plaintext CAT has become the ciphertext FDW. To decrypt it, the receiver moves each letter three places back: F to C, D to A, W to T. The same key, 3, is used in both directions, and anyone who does not know the key sees only FDW.

Experiment

Try it: the Caesar cipher

Try it: the Caesar cipher

Change the message or the shift and watch the ciphertext change. The shift is the key: the same shift, applied backwards, decrypts the message.

Plain alphabet
ABCDEFGHIJKLMNOPQRSTUVWXYZ
Shifted alphabet
DEFGHIJKLMNOPQRSTUVWXYZABC
Plaintext
MEET AT NOON
Ciphertext
PHHW DW QRRQ
Break it: try every key

Someone who intercepts the ciphertext and knows nothing about the key can simply undo each of the 25 possible shifts. Only one line reads as English.

  1. OGGV CV PQQP
  2. NFFU BU OPPO
  3. MEET AT NOON
  4. LDDS ZS MNNM
  5. KCCR YR LMML
  6. JBBQ XQ KLLK
  7. IAAP WP JKKJ
  8. HZZO VO IJJI
  9. GYYN UN HIIH
  10. FXXM TM GHHG
  11. EWWL SL FGGF
  12. DVVK RK EFFE
  13. CUUJ QJ DEED
  14. BTTI PI CDDC
  15. ASSH OH BCCB
  16. ZRRG NG ABBA
  17. YQQF MF ZAAZ
  18. XPPE LE YZZY
  19. WOOD KD XYYX
  20. VNNC JC WXXW
  21. UMMB IB VWWV
  22. TLLA HA UVVU
  23. SKKZ GZ TUUT
  24. RJJY FY STTS
  25. QIIX EX RSSR

The Caesar cipher is a substitution cipher: each letter is substituted by another. It teaches two lessons that still apply.

Think it through

How many different shifts could an attacker try against a Caesar message, and how long would it take?
Show the answer

Answer: C. 25; moments.

Only 25 useful shifts, which can all be tried in moments.

First, a small keyspace is fatal. There are only 25 useful shifts. Someone who intercepts the message can try all 25 in moments, and only one will produce readable text. Open “Break it: try every key” in the panel to see that happen.

Second, patterns survive. A stronger substitution cipher uses a secretly mixed alphabet instead of a shift, which gives a huge number of possible keys. It is still easy to break, because language has patterns. In English, E is the most common letter, and “TH” is a common pair. Whichever symbol replaces E will be the most common symbol in the ciphertext. Counting symbols and comparing them with normal letter frequencies is called frequency analysis, and it breaks simple substitution without trying a single key.

Enigma: a historical example

Enigma was an electromechanical cipher machine used by Germany before and during the Second World War. It also substituted letters, but its rotors turned with every key press, so the substitution changed for each letter of the message. That removed the simple frequency pattern, and the machine could be set up in an enormous number of ways.

It was broken all the same, first by Polish mathematicians and then on a large scale at Bletchley Park in Britain. The breaks relied on weaknesses in the design (a letter could never be encrypted as itself), on mistakes and habits in how it was operated, and on captured material. Two things are worth taking from the story:

  • a very large number of possible settings does not, by itself, make a cipher secure;
  • the people and procedures around a cipher are part of its security.

Predict

Alice, Bob and Mallory

Explanations of cryptography use a conventional cast, so that the roles are clear without long descriptions.

  • Alice and Bob are the two parties who want to communicate securely.
  • Mallory is a malicious attacker who can intercept messages and also change them.

Think it through

One attacker can only listen; another can also change messages. Which needs more protection against, and what extra protection?

Show what happens

The one who can change messages. Against a listener, keeping the content secret is enough; against someone who can alter messages, you also need to detect changes and check who sent them.

You will also meet Eve, an eavesdropper who can only listen. The difference matters: protection against Eve needs confidentiality, while protection against Mallory also needs a way to detect changes and to check who a message really came from. Later lessons in this module use these names.

Predict

Kerckhoffs’s principle

Think it through

Is a cipher safer if the way it works is kept secret?
Show the answer

Answer: C. Not really.

Not really. A secret method has been tested only by its authors, methods leak, and a leaked method cannot be changed as easily as a key.

In the nineteenth century, Auguste Kerckhoffs set out a rule for military ciphers that is still the starting point for modern cryptography.

A system should stay secure even when everything about it, except the key, is public knowledge.

In other words, security should rest on the key, not on keeping the method secret.

This can feel backwards. Surely a secret method is safer than a published one? In practice it is the reverse, for three reasons.

  1. Published designs get tested. Modern algorithms such as AES were chosen after years of public attack by cryptanalysts around the world. A secret design has been examined only by its authors, who are the people least likely to see its flaws.
  2. Methods leak. Software can be taken apart, devices can be captured, and staff change jobs. A design used in millions of products cannot stay secret.
  3. Keys are replaceable. If a key leaks, you change the key. If a secret design leaks, every product that uses it is exposed at once and must be replaced.

Relying on a secret design is often called security through obscurity. Obscurity may slow an attacker down. It should never be the only thing protecting the data.

Check your understanding

In one case a key leaks; in another, a secret cipher design leaks. Which is easier to recover from?
Show the answer

Answer: A. The leaked key.

The leaked key: you change it. A leaked design exposes every product that uses it.

A fictional supplier advertises a file-encryption product as secure “because the algorithm is a closely guarded company secret”.

By Kerckhoffs’s principle this is a warning sign, not a selling point. Nobody outside the company has tested the design, so nobody can say how strong it is. A buyer should prefer a product that uses a published, standard algorithm and should then ask the question that actually matters: how are the keys generated, stored and protected?

Predict

Key length, keyspace and brute force

If the method is public, an attacker’s simplest option is to try every possible key until one works. That is a brute-force attack.

Think it through

Adding one bit to a key: what happens to the number of keys an attacker must try?
Show the answer

Answer: C. It doubles.

It doubles: every possible key now comes in two versions.

The keyspace is the number of possible keys. The Caesar cipher has a keyspace of 25. Modern keys are strings of bits, each 0 or 1, and the number of bits is the key length.

  • A 1-bit key has 2 possible values.
  • A 2-bit key has 4.
  • A 3-bit key has 8.
  • An n-bit key has 2n.

Every extra bit doubles the keyspace, and so doubles the work of a brute-force attack. This is why key length matters so much, and why the numbers grow beyond intuition. A 128-bit key has 2128 possible values: about 340 followed by 36 zeros. Trying a billion billion keys every second, an attacker would need many times the age of the universe to work through them.

Go deeper Why 128 bits is not “twice as strong” as 64 bits

Because each bit doubles the keyspace, 65 bits is twice as strong as 64. A 128-bit key has 264 times as many possibilities as a 64-bit key: about eighteen billion billion times as many.

On average an attacker finds the key after searching half the keyspace, which makes no practical difference at this scale.

Key length is only an upper limit on strength. A cipher with a design flaw can be broken far faster than brute force (as Enigma was), and a key generated from predictable values can be guessed however long it is. Key Management, Cryptographic Hardware and Escrow returns to that second point.

Check your understanding

Against brute force, how many times stronger is a 65-bit key than a 64-bit key?
Show the answer

Answer: A. Twice

Twice: one extra bit doubles the number of keys to try.

One caution for later: key lengths can be compared only between algorithms of the same kind. A 2048-bit key for one kind of algorithm is not stronger than a 256-bit key for another kind. Symmetric, Asymmetric and Hybrid Encryption explains why.

Explain

Security+ terminology

The CompTIA Security+ SY0-701 exam objectives (objective 1.4) list Encryption with the sub-topics level, transport/communication, asymmetric, symmetric, key exchange, algorithms and key length. This lesson supplies the vocabulary behind the last two.

The objectives do not name the Caesar cipher, Enigma or Kerckhoffs’s principle; they are background that makes the listed terms make sense.

Apply

Apply it in a new situation

These questions use the lesson in situations it has not shown. For the strongest test of your understanding, come back to them on another day and answer each one at the first attempt.

Apply it

A supplier says its messaging app uses “military-grade secret encryption we cannot disclose”. What should you ask?
Show the answer

Answer: B. Which standard algorithm?

Which published, standard algorithm it uses, and how its keys are generated and protected. A secret design is a warning sign.

Apply it

A configuration file holds a password written in Base64. A colleague says it is encrypted. What do you say?
Show the answer

Answer: C. No key: it is only encoded.

It is only encoded: there is no key, and anyone can decode it.

Apply it

An attacker on café Wi-Fi alters the amount in a bank transfer as it travels. Is that Eve or Mallory?
Show the answer

Answer: B. Mallory

Mallory: an attacker who can change messages, not only read them.

Check

Check your understanding

These questions come from the approved revision bank. They were approved under owner-authorised delegated review: the site owner authorised the review and did not read each question individually.

  1. A developer at a fictional company stores customer notes in Base64 and tells a colleague that the notes are now encrypted. Which response is accurate?

    Show answer

    Answer: Base64 is encoding: anyone can reverse it, because no key is involved

    Encoding changes how data is represented, using a public scheme and no key, so anyone can reverse it. Base64 therefore gives no confidentiality. It is not weak encryption, because there is no key to lengthen; it is designed to be reversed, so the notes are fully recoverable; and a published scheme cannot be kept private.

    Revision sources: Cryptography Foundations: Ciphers, Keys and Encoding (Supplementary Study Guide explanation)

  2. Which term names the study of breaking cryptographic protection, as opposed to designing it?

    Show answer

    Answer: Cryptanalysis

    Cryptography is the practice of protecting information, cryptanalysis is the study of breaking that protection, and cryptology is the field that covers both. Encoding is a different idea: it changes how data is represented and protects nothing.

    Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Cryptography Foundations: Ciphers, Keys and Encoding (Supplementary Study Guide explanation)

  3. Why is the Caesar cipher easy to break, even without knowing the shift?

    Show answer

    Answer: There are only 25 useful shifts, so every key can be tried

    The Caesar cipher shifts each letter by a fixed number of places, so only 25 shifts give a different message and each can be tried in moments. A public algorithm is not the weakness: by Kerckhoffs’s principle a sound cipher stays secure when its design is known. The cipher keeps the message length, and using one key in both directions is true of strong symmetric ciphers too.

    Revision sources: Cryptography Foundations: Ciphers, Keys and Encoding (Supplementary Study Guide explanation)

  4. An analyst intercepts a long message in which every letter has been replaced, consistently, using a secret mixed alphabet. The analyst has no key. Which approach is most likely to succeed?

    Show answer

    Answer: Compare how often each symbol appears with normal letter frequencies

    Simple substitution with a mixed alphabet falls to letter-frequency analysis: common letters keep their frequencies under any fixed replacement. Trying 25 shifts works only for the Caesar cipher, where the alphabet is shifted and not mixed. Base64 is an encoding and plays no part here, and a mixed alphabet can be arranged in far too many ways to try them one by one.

    Revision sources: Cryptography Foundations: Ciphers, Keys and Encoding (Supplementary Study Guide explanation)

  5. A fictional supplier says its encryption product is secure because the algorithm is a closely guarded company secret. Which principle does this claim conflict with?

    Show answer

    Answer: Kerckhoffs’s principle: security should rest on the key, not on a secret design

    Kerckhoffs’s principle is that a system should stay secure when everything about it except the key is public. A design that nobody outside has examined may hide weaknesses, and a leaked design cannot be replaced as easily as a leaked key. The other three options are real ideas from elsewhere in security, and none says where a cipher’s security should come from.

    Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Cryptography Foundations: Ciphers, Keys and Encoding (Supplementary Study Guide explanation)

  6. What is a brute-force attack on an encryption key?

    Show answer

    Answer: Trying every possible key until one decrypts the data

    The keyspace is the number of possible keys and brute force means working through it, which is why a larger keyspace makes the attack slower. Frequency analysis exploits patterns in language instead of trying keys, deceiving a person is social engineering, and a sound cipher’s published description does not contain its key.

    Revision sources: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions (Classroom session record) · Cryptography Foundations: Ciphers, Keys and Encoding (Supplementary Study Guide explanation)

  7. Adding one bit to a key’s length doubles the number of possible keys.

    Show answer

    Answer: True

    True. A key of n bits has 2 to the power n possible values, so each added bit doubles the keyspace and the work of a brute-force attack. This is why a 128-bit key is not twice as hard to search as a 64-bit key: it is 2 to the power 64 times as hard.

    Revision sources: Cryptography Foundations: Ciphers, Keys and Encoding (Supplementary Study Guide explanation)

  8. Which two statements about encoding and encryption are correct? Select two.

    Show answer

    Answer: Encoded data can be reversed by anyone who knows the public scheme; Encrypted data needs the correct key before it can be read

    Encoding uses a public scheme and no key, so anyone can reverse it, while encryption needs a secret key to reverse. Base64 therefore gives no confidentiality. Encryption is meant to be reversed by the key holder; a transformation that nobody can reverse would be useless for sending a message.

    Revision sources: Cryptography Foundations: Ciphers, Keys and Encoding (Supplementary Study Guide explanation)

Study and revision

Practise through the Cryptography & Data Protection topic. Questions cover the three terms, encoding and encryption, why the Caesar cipher and simple substitution fall, Kerckhoffs’s principle, brute force and how key length sets the keyspace; five flashcards recall the definitions. The questions are learning-only, and the lesson does not establish exam alignment or practical experience. One flashcard, on key length, has been verified against CompTIA Security+ SY0-701 objective 1.4 and is in the Security+ flashcard track.

Consolidate

What to remember

  • Cryptography transforms information so that only the intended people can read or trust it; the cipher is the method, the key the secret.
  • Encoding is not encryption: it uses no key, and anyone can reverse it.
  • A small keyspace is fatal, and patterns in language survive simple substitution.
  • Kerckhoffs’s principle: security should rest on the key, not on a secret method.
  • Every extra bit doubles the keyspace; key lengths compare only between algorithms of the same kind.

Key terms

Cryptography

The practice of protecting information by transforming it, so that only the intended parties can read it or trust it.

Glossary entry

Plaintext

Data in its readable form, before it is encrypted or after it has been decrypted.

Glossary entry

Ciphertext

Data after encryption: unreadable without the key that decrypts it.

Glossary entry

Cipher

An algorithm that turns plaintext into ciphertext, and back again, under the control of a key.

Glossary entry

Cryptographic key

A secret value that controls what a cipher does. The same algorithm with a different key gives a different result.

Glossary entry

Encoding

Changing how data is represented, using a public scheme and no key, so that anyone can reverse it. Base64 is an example.

Glossary entry

Common misunderstandings

Base64 is an encoding. It uses no key, and anyone can reverse it. It gives no confidentiality.

The opposite is usually true. Published algorithms have survived years of expert attack. Security should rest on the key.

A large keyspace only defeats brute force. Simple substitution has an enormous keyspace and falls to frequency analysis; Enigma had a vast number of settings and was still broken.

Adding a single bit doubles it. Doubling the length multiplies the keyspace by itself.

Further reading

Lesson sources and acknowledgements

Sources and scope

  • Covered in Session 9 (see the Session 9 Learning Log): cryptography, cryptanalysis and cryptology; plaintext, ciphertext and ciphers; Alice, Bob and Mallory; Kerckhoffs’s principle; encoding and encryption; the Caesar cipher, substitution and Enigma; and key length, keyspace and brute force. The CyberChef website, which converts between encodings, was among the tutor’s demonstrations; what was shown is not recorded.
  • Accuracy qualifications: encoding is not encryption and gives no confidentiality; a large keyspace does not by itself make a cipher secure; key lengths are comparable only within one kind of algorithm.
  • Independently checked: the definitions of the core terms against the NIST glossary, and the Security+ wording against the published SY0-701 objectives. These are external references, not course evidence.
  • Supplementary explanation: every definition, the padlock comparison, the Base64 example, the CAT worked example, the interactive Caesar panel, frequency analysis, the account of Enigma, Eve, the three reasons behind Kerckhoffs’s principle, the supplier example, the keyspace arithmetic and the misunderstandings. These were developed afterwards and are my explanations, not the tutor’s words. The diagram is original.
  • Guided version (published 1 November 2026, awaiting the site owner’s editorial review): the locker-padlock opening questions, every question asked in the lesson with its feedback and hints, the application questions and the closing summary are supplementary explanation written for the Study Guide. The settings are fictional. The questions in the lesson’s steps are not revision-bank items; those in “Check your understanding” are, unchanged.
  • No practical work is claimed. The supplier is fictional. I have not broken a cipher or assessed an encryption product as part of this lesson.

Taught in classroom sessions

Related lessons

Terms in this lesson

Practise this lesson

Quiz these topicsFlashcards