Presentation: Cracking a Caesar Cipher with Letter Frequencies

Slide 1 of 7 · Settling starter · Computer Science · Year 9

5 minutes

Cracking a Caesar cipher with letter frequencies

Clwb Codio Conwy is a code club for Year 9 pupils. Two members, Nia and Rhodri, have been sending each other messages scrambled with a Caesar cipher. Another member copied one of their long messages from the club noticeboard, and nobody told him the key. Today you find out whether a Caesar cipher kept the message safe.

While the register is called: write your name, class and date on your worksheet, then read sections 1 to 3 of the stimulus sheet, Clwb Codio Conwy: the intercepted message.

Starter question: Using the alphabet strip in section 3, Y is position 24. With key 3, what letter does Y become?

DCF: Interacting and collaborating → Storing and sharing No computers needed · calculator and ruler

Slide 2 of 7 · Today’s brief and key words · Computer Science · Year 9

3 minutes

Your brief: use a Caesar cipher, break it 2 ways, decide what needs encrypting

You will encrypt and decrypt with a Caesar cipher, break a message by brute force, break a long message by counting letters and comparing them with normal English, work out how long brute force takes a computer, and decide which kinds of data really need strong encryption before they are stored or shared.

Key

The secret that tells you how to encrypt and decrypt. In a Caesar cipher it is how many places each letter moves along the alphabet.

Ciphertext

The scrambled message. Plaintext is the readable message before it is scrambled.

Brute force

Trying every possible key until one works.

Frequency analysis

Counting how often each letter appears and comparing the counts with normal English.

LNF: Numeracy → Interpreting data Encrypt: move forward by the key. Decrypt: move back by the key

Slide 3 of 7 · Steps 1 to 3: encrypt, decrypt, brute force · Computer Science · Year 9

13 minutes

Step 1, Step 2 & Step 3: encrypt with key 5, decrypt with key 4, then brute force

Step 1 (6 min): encrypt LEAVE AT DAWN with key 5 using the alphabet strip; the first letter is done. Then show the MOD working for W. Step 2 (4 min): decrypt Rhodri’s message XLI OIC MW YRHIV XLI QEX by moving each letter back 4, and say why writing “key = 4” on the note makes it useless. Step 3 (6 min): nobody knows the key for Nia’s PHHW DW QRRQ. Try keys on the first word only, moving back, and stop at a real word.

Key tried	PHHW becomes	Real word?
1	OGGV	No
2	NFFU	No

Steps 1, 2 and 3 on your worksheet · 13 minutes Past Z? Carry on from A. Before A? Carry on from Z

Supply teacher script (no subject knowledge needed)

Say aloud: “Finish Step 1, then Step 2, then Step 3. The first 2 rows of the brute force table are on the board. Keep trying keys until the first word becomes a real English word, then use that key on the whole message. Finally answer (c): the greatest number of keys you would ever need to try.”

Quick check, Steps 1 and 2: Step 1 gives QJFAJ FY IFBS. (b) W is position 22, (22 + 5) MOD 26 = 27 MOD 26 = 1, which is B; V also wraps: (21 + 5) MOD 26 = 0, which is A. Pupils who write a symbol or a blank for V or W have not wrapped. Step 2 is THE KEY IS UNDER THE MAT. (b) Anyone who picks up the note gets the ciphertext and the key, so they can decrypt it as easily as Nia can; the key must be shared a different way, for example agreed in person beforehand.

Quick check, Step 3: key 3 gives MEET (yes); key 4 gives LDDS (no). (b) Key 3: MEET AT NOON. (c) 25: there are 26 letters so only 26 possible shifts, and a shift of 0 leaves the message unchanged. Trying 25 keys by hand takes a few minutes; a computer does it in far less than a second.

Slide 4 of 7 · Step 4: frequency analysis · Computer Science · Year 9

20 minutes

Step 4: count, work out percentages, draw, compare and decrypt

The long message in section 4 of the stimulus has a key nobody knows. Instead of trying every key, use data. (a) With your partner, one of you tallies lines 1 and 2, the other lines 3 and 4; then add your counts. (b) The total must be 184. (c) For your 5 most common letters, work out count ÷ 184 × 100 to 1 decimal place. (d) Bar chart, most common first, 1 square = 2%, both axes labelled. (e) Compare with the English chart in section 5: which letter stands for E, and how many places has it moved? (f) Test your key on your 2nd and 3rd letters and the most common word. (g) Decrypt line 1. (h) Why does your E percentage not match 12.7% exactly?

Letter	Count	Working: count ÷ 184 × 100	%
L	33	33 ÷ 184 × 100 = 17.93…	17.9

Step 4 on your worksheet · 20 minutes, in pairs In normal English the most common letters are E, then T, then A; the most common word is THE

Supply teacher script (no subject knowledge needed)

Say aloud: “20 minutes for Step 4, in pairs. Share the counting: one of you tallies lines 1 and 2, the other lines 3 and 4, then add your counts together. Lines 1 and 2 have 94 letters and lines 3 and 4 have 90, so your total must be 184. If it is not, recount the line that is out. The first row of the percentage table is on the board. Then draw your chart, compare it with the English chart, find the key and test it before you decrypt line 1.”

Quick check: counts A 22, B 1, C 2, D 7, E 1, F 6, G 0, H 16, I 4, J 3, K 7, L 33, M 4, N 5, O 11, P 10, Q 0, R 1, S 8, T 4, U 13, V 8, W 2, X 0, Y 8, Z 8; lines 1 to 4 contain 60, 34, 25 and 65 letters, and slips of 1 or 2 do not change the answer. Top 5: L 17.9%, A 12.0%, H 8.7%, U 7.1%, O 6.0%. (e) L stands for E; E is position 4 and L is 11, so the key is 7. (f) A decrypts to T and H to A, the 2nd and 3rd most common English letters; AOL appears 8 times and decrypts to THE. (g) Line 1: THE TEAM WILL MEET AT THE GATE OF CONWY CASTLE AT SEVEN ON TUESDAY EVENING.

Walk the room: for (h), the English chart averages a huge amount of text but this message has only 184 letters, and it uses THE 8 times and words such as MEET, SEVEN and EVENING, pushing E up to 17.9%. Nia’s message in Step 3 has only 10 letters, far too small a sample for any letter to stand out, so brute force is the better method there.

Slide 5 of 7 · Step 5: how long would brute force take? · Computer Science · Year 9

7 minutes

Step 5: how long would brute force take a computer?

A computer can try about 1,000,000,000 (10⁹) keys every second. There are about 31,500,000 seconds in a year. Divide the number of keys by 1,000,000,000 to get seconds, then give each time in a sensible unit: seconds, minutes or years.

What is being guessed	Number of possible keys	Working	Longest time to try them all
Caesar cipher key	25	25 ÷ 1,000,000,000	0.000000025 s: instant
8 lower-case letters, such as ffrwdlan	26⁸ = 208,827,064,576	?	?
128-bit AES key	about 3.4 × 10³⁸	?	?

Step 5 on your worksheet · 7 minutes Seconds ÷ 60 = minutes · seconds ÷ 31,500,000 = years

Slide 6 of 7 · Step 6 and self check · Computer Science · Year 9

8 minutes

Step 6: when should data be encrypted? Then check your work

(a) For each of the 5 situations, say whether the data should be encrypted when it is stored or sent, with a reason. (b) Write 3 to 5 sentences for a Year 7 pupil: what the padlock and https mean, why modern encryption is safe when a Caesar cipher is not, and 1 thing the padlock does not tell you. Use Steps 4 and 5 as evidence. Then tick the success criteria you have met and correct 1 thing.

I can encrypt and decrypt a message with a Caesar cipher, including letters that wrap round from Z to A.
I can explain why a key must be shared separately from the message, and why 25 keys is far too few.
I can count letters accurately, check my total, and turn counts into percentages.
I can compare my bar chart with a chart of normal English, use it to find the key and check it with more than 1 letter.
I can decide when data should be encrypted before it is stored or shared, and explain what the https padlock does and does not tell me.

DCF: Interacting and collaborating → Storing and sharing Finished early? Encrypt a 2-sentence message and swap with your partner to crack

Supply teacher script (no subject knowledge needed)

Say aloud: “8 minutes for Step 6. Decide yes or no for each situation and give a reason, then write your explanation for a Year 7 pupil. In the last minute, tick the success criteria you have met and correct 1 thing, for example a letter in Step 1 that did not wrap round.”

Quick check (a): 1 medical form: yes, health information is sensitive personal data. 2 concert date: no, it is meant for everyone to read. 3 reports on a USB stick: yes, USB sticks are easily lost and whoever finds it cannot read the data without the key. 4 bank card number: yes, anyone who intercepts it could spend money; only type it into an https page. 5 finished puzzle answer: no, it is no longer secret. (b) a good explanation says https and the padlock mean data is encrypted on the way; a Caesar cipher has only 25 keys and its letter patterns give the key away; AES has about 3.4 × 10³⁸ keys and hides letter patterns; the padlock does not prove the website is honest, a scam website can have one too.

Extension answers: own messages vary; longer messages are easier to crack by frequency analysis. With keys 3, 1, 4 repeating, E becomes H, F or I depending on its place, so the E count is spread across 3 ciphertext letters and no single tall bar appears; you would first have to find the key length and then analyse every 3rd letter separately.

Slide 7 of 7 · Plenary review · Computer Science · Year 9

2 minutes

Quick-check answers before handing in

Check your main answers before your worksheets are collected.

Question	Correct answer
What is LEAVE AT DAWN with key 5?	QJFAJ FY IFBS
What key was used for the long message, and which letter gave it away?	Key 7. L was the most common letter (33 of 184), so it stood for E.
How long would a computer take to try every Caesar key, and every 128-bit AES key?	Caesar: instant (0.000000025 s). AES: about 1.1 × 10²² years.

Check your name and class are on your worksheet Leave stimulus sheets neat on the desk