Encryption turns readable data into scrambled text so only authorised parties can read it. This set of notes covers the two simplest cipher families, the Caesar Cipher and the Random Substitution Cipher, plus the critical distinction between an encryption algorithm and its key. Both ciphers are forms of symmetric encryption, where the same key locks and unlocks the message.
Difficulty: Beginner | Prerequisites: Basic understanding of the alphabet and simple division. Prior lessons on big data and privacy policies (Unit 10, Lessons 1-8) provide useful context but are not strictly required.
This lesson sits near the end of Unit 10, which has spent the previous eight lessons establishing that your personal data is collected constantly, stored widely, and handed over with a click on "I agree." The natural follow-up question is: how do you protect it? Encryption is the answer, and this is the first of two lessons that build your understanding of it.
You do not need any programming experience for this material. The maths involved (division with remainders) is secondary-school level. By the end you should be able to explain what encryption does, distinguish symmetric from asymmetric encryption, and understand why public key cryptography changed the internet.
Encryption
A process of encoding messages to keep them secret, so only authorised parties can read them. Think of it as locking a message inside a box that only the right key can open.
Decryption
The reverse of encryption: taking a secret (encrypted) message and reproducing the original plain text. In simple terms, this is unlocking the box to read the message inside.
Cipher
The generic term for a technique or algorithm that performs encryption. A cipher is the method, the recipe for scrambling.
Caesar Cipher (aka Caesar shift, shift cipher)
A technique for encryption that shifts every letter of the alphabet by a fixed number of positions. In simple terms, if the shift is 2, A becomes C, B becomes D, and so on.
Random Substitution Cipher (aka simple substitution cipher, cryptogram cipher)
A cipher where each letter of the alphabet is mapped to a different, randomly chosen letter. Unlike the Caesar Cipher, the mapping is not a simple uniform shift.
Symmetric Key Encryption
Encryption that uses one key for both encrypting and decrypting. Think of it as a single house key that both locks and unlocks the same door. The Caesar Cipher and Random Substitution Cipher are both symmetric.
Encryption Algorithm
The method or procedure used to perform encryption. For a Caesar Cipher, the algorithm is "shift the alphabet."
Encryption Key
The specific input that dictates how the algorithm is applied. For a Caesar Cipher, the key is the number of positions shifted. For a random substitution cipher, the key is the full letter-to-letter mapping.
Cracking Encryption
Attempting to decode a secret message without knowing the key. You know (or guess) the algorithm, but you are trying to discover the key that was used.
People have been hiding the contents of messages for thousands of years, long before computers existed. Generals, diplomats, and spies all needed ways to send orders without enemies reading them. The computer science version of this problem is the same problem with faster tools.
The Caesar Cipher dates back to the Roman Empire. It works by shifting every letter in the alphabet by a fixed number of positions.
If the shift (key) is 2, then A becomes C, B becomes D, C becomes E, and so on
The entire alphabet wraps around: with a shift of 2, Y becomes A, Z becomes B
Example from the lesson: "serr cvmmn va gur pnsrgrevn" is encrypted with a shift of 13 (ROT13). Decoded, it reads "free pizza in the cafeteria"
The key is the shift amount. If you know the algorithm is Caesar and you discover the shift, you can decode everything
There are only 25 possible keys (shifts of 1 through 25), which makes this cipher very easy to crack by trying each one
Instead of shifting the whole alphabet uniformly, a random substitution cipher maps each letter to a randomly chosen different letter. This is the kind of puzzle you find in newspaper cryptograms.
The key is the entire mapping table (which letter maps to which)
Far more possible keys than the Caesar Cipher, because any letter can map to any other letter
Tips for cracking random substitution ciphers:
One-letter words are almost always "a" or "I"
Words ending with an apostrophe typically end in 's or 't
Look for common double letters: "oo", "ss", "ll", "ee"
Two-letter words tend to be common function words: "is", "in", "it", "as", "an", "do"
This is a critical concept for the course. The algorithm is the method. The key is the specific input that controls how the method is applied.
Caesar Cipher: the algorithm is "shift the alphabet"; the key is the number of positions
Random substitution: the algorithm is "replace each letter with another"; the key is the full letter-to-letter mapping
Strong encryption does not rely on keeping the algorithm secret. The best encryption methods in use today are publicly known and heavily reviewed. What makes them strong is that the key is extremely hard to guess or compute, even if an attacker knows exactly which algorithm you used
A good rule of thumb from the lesson: always assume your adversary knows the algorithm and has the same tools you do. Security comes from the key, not from secrecy about the method
Caesar Cipher shift formula
Encrypted letter = (original letter position + key) MOD 26
Where each letter's position is A = 0, B = 1, C = 2 ... Z = 25. The MOD 26 wraps the alphabet around so that shifting past Z brings you back to A.
Example with key = 2:
Original | A | B | C | D | E | F | ... | Y | Z |
|---|---|---|---|---|---|---|---|---|---|
Encrypted | C | D | E | F | G | H | ... | A | B |
The Caesar Cipher itself is far too weak for any real security today, but the underlying principle (transforming data so it cannot be read without a key) is the foundation of every secure system on the internet. Every time you see a padlock icon in your browser's address bar, encryption is at work protecting your passwords, bank details, and messages. Substitution-style thinking also appears in encoding schemes used in software development and data transmission.
Students often think a more complicated algorithm automatically means stronger encryption. It does not. Strength comes from the key being hard to guess, not from the method being obscure. Publicly known algorithms reviewed by thousands of experts are typically more secure than secret, proprietary ones.
Students sometimes confuse the algorithm with the key. The Caesar Cipher is an algorithm. The number 13 (the shift amount) is a key. If someone asks "what cipher did you use?" they are asking about the algorithm. If they ask "what is the key?" they want the specific value.
A common mistake is assuming that a random substitution cipher is unbreakable because it has many possible keys. It is crackable through frequency analysis (examining which letters appear most often) because natural language has predictable patterns.
Some students think encryption is only relevant to computers. Encryption predates computers by centuries. The principles are the same whether you are passing notes in class or securing online banking.
⚠️ Know the difference between an encryption algorithm and an encryption key. Exam questions will test whether you can identify which is which in a given scenario.
⚠️ Be able to explain why publicly known algorithms can be more secure than secret ones. The answer centres on community review and the principle that security should rest on the key, not on the secrecy of the method.
⚠️ Understand that the Caesar Cipher has only 25 possible keys, making it trivially crackable. A random substitution cipher has far more possible keys but is still vulnerable to frequency analysis.
⚠️ The lesson explicitly states: "In encryption you should always assume that your enemy knows the encryption algorithm and has access to the same tools that you do." This principle (known as Kerckhoffs's principle in formal cryptography) is exam-relevant.
True or False: The Caesar Cipher uses a different shift value for each letter in the message.
False. Every letter is shifted by the same amount.
Fill in the blank: The specific value that controls how an encryption algorithm is applied is called the ______.
Key.
True or False: A random substitution cipher is a form of symmetric encryption.
True. The same mapping (key) is used to encrypt and decrypt.
True or False: The best encryption algorithms are kept secret from the public.
False. Many of the strongest algorithms are publicly known, which allows the security community to test and verify them.
Fill in the blank: A Caesar Cipher with a shift of 2 would encrypt the letter A as ______.
C.
Q: What is the difference between an encryption algorithm and an encryption key?
A: The algorithm is the method or procedure used to encrypt data (e.g. "shift the alphabet"). The key is the specific input that controls how the algorithm is applied (e.g. "shift by 13"). The same algorithm can produce completely different encrypted outputs depending on the key.
Q: If you intercept a message encrypted with a Caesar Cipher, what is the maximum number of attempts you would need to crack it by brute force?
A: 25. There are only 25 meaningful shift values (1 through 25). A shift of 0 or 26 would leave the message unchanged.
Q: Why is a random substitution cipher harder to crack than a Caesar Cipher, even though both are symmetric?
A: A Caesar Cipher has only 25 possible keys. A random substitution cipher has approximately 26! (26 factorial, roughly 4 x 10^26) possible letter mappings, making brute-force impractical. However, it is still vulnerable to frequency analysis.
Q: Explain why keeping an encryption algorithm secret does not necessarily make it more secure.
A: Publicly known algorithms are reviewed and tested by the wider computer science community, which tends to reveal and fix weaknesses. A secret algorithm has not been stress-tested in the same way. Security should depend on the strength of the key, not on the secrecy of the method.
Q: If random substitution is the algorithm, what is the key?
A: The key is the actual letter-to-letter mapping that was used to encode the message. That same mapping can be used in reverse to decrypt it.
This material connects directly to the next lesson (Protecting Data, Part 2), which covers public key (asymmetric) encryption in greater depth. The algorithm-vs-key distinction introduced here is foundational for understanding how HTTPS, digital signatures, and secure communication protocols work.
The broader Unit 10 theme of data privacy ties back here as well: encryption is the technical mechanism that makes the privacy protections discussed earlier in the unit possible. Without it, every promise a company makes about protecting your data would be hollow.
Encryption, decryption, cipher, Caesar Cipher, Caesar shift, ROT13, shift cipher, substitution cipher, random substitution cipher, cryptogram, symmetric encryption, symmetric key, encryption algorithm, encryption key, cracking encryption, brute force attack, frequency analysis, data protection, data security, AP Computer Science Principles, CSP, Unit 10 Lesson 9