The Foundations of Cryptography
Welcome to the Cybersecurity Workbench. Over the next hour, you will transform from a novice to someone who deeply understands how digital secrets are kept.
What is Cryptography?
Cryptography is the practice of securing communication in the presence of adversaries. The core components are:
- Plaintext: The original, readable message.
- Ciphertext: The scrambled, unreadable output.
- Encryption: The algorithm that turns Plaintext into Ciphertext.
- Decryption: The reverse algorithm.
- Key: A secret piece of information that dictates exactly how the algorithm scrambles the data. Without the key, the algorithm is useless.
The Actors: Alice, Bob, and Eve
In cryptography, we traditionally use characters to explain scenarios:
Alice
Wants to send a secret message to Bob.
Bob
Wants to read Alice's message securely.
Eve
The eavesdropper intercepting the network.
If Alice sends plaintext, Eve reads it. If Alice encrypts it, Eve only sees random noise. The challenge of cryptography is making sure Bob has the key to decrypt it, without Eve ever getting that key.
Your Mission
Go through the sidebar modules one by one. Read the theory, play with the interactive tools, and understand the vulnerabilities.
Once you reach the Capture The Flag section, you will use the tools you've learned to decode hidden messages.
Caesar Cipher
The dawn of cryptography: Substitution Ciphers.
How it works
Used by Julius Caesar in 58 BC, this is a substitution cipher. Every letter in the plaintext is shifted a certain number of places down the alphabet. For example, with a shift of 1, A becomes B, B becomes C, and Z wraps around to A.
The Vulnerability: Frequency Analysis & Brute Force
Since there are only 25 possible shifts, a modern computer (or a bored human) can simply try all 25 until the text makes sense. Furthermore, because it's a direct substitution, the most common letter in the ciphertext will usually correspond to 'E', the most common letter in English.
Brute Force Attacker
Paste intercepted ciphertext here to instantly try all 25 possible keys. Green text indicates english dictionary matches.
Interactive Lab
Vigenère Cipher
The unbreakable cipher of the 16th century: Polyalphabetic Substitution.
How it works
To defeat frequency analysis, Giovan Battista Bellaso invented a cipher that uses a keyword. Instead of shifting the whole message by one number (like Caesar), every letter is shifted by a different amount based on the repeating keyword.
If the keyword is "LEMON", the first letter of plaintext is shifted by 'L' (11), the second by 'E' (4), and so on. The key repeats: LEMONLEMONLEM.
The Vulnerability: Kasiski Examination
It was considered unbreakable ("le chiffre indéchiffrable") for 300 years! In 1863, Friedrich Kasiski published a method. If you find repeating sequences in the ciphertext, the distance between them is likely a multiple of the keyword length. Once you know the key length, you break it down into several standard Caesar ciphers and solve them individually.
Interactive Lab
Symmetric Encryption: AES-GCM
The modern standard for keeping secrets. One key locks and unlocks.
Advanced Encryption Standard
AES is a block cipher established by NIST in 2001. Unlike Caesar or Vigenère, which operate on individual letters, AES operates on blocks of bits using complex mathematical substitutions and permutations.
The Components:
- Password/Key: Used to encrypt. In modern web apps, a human password is fed through a Key Derivation Function (like PBKDF2) to generate a secure 256-bit mathematical key.
- Salt: Random data added to the password before derivation to prevent dictionary attacks.
- IV (Initialization Vector): A random number added to the encryption process. If you encrypt the same message twice with the same password, the IV ensures the ciphertexts look completely different.
- GCM (Galois/Counter Mode): The specific "mode" of AES. GCM not only encrypts the data (Confidentiality) but adds a tag to ensure the data hasn't been tampered with (Integrity).
Interactive Lab (Real WebCrypto API)
Note: This Base64 string actually contains [Salt + IV + Ciphertext] concatenated together.
Asymmetric Encryption: RSA
Public Key Cryptography. Two keys: one to lock, one to unlock.
The Key Exchange Problem
Symmetric encryption (AES) is incredibly fast and secure, but there's a fatal flaw: How does Alice securely get the password to Bob over the internet without Eve stealing it?
The Solution: Asymmetric Encryption
In 1977, Rivest, Shamir, and Adleman (RSA) published a system using prime numbers. Instead of one key, you generate a mathematically linked Key Pair:
- Public Key: You give this to everyone in the world. It can ONLY encrypt data. It is physically impossible for it to decrypt data.
- Private Key: You keep this secret. It is the ONLY thing that can decrypt data encrypted by your Public Key.
Analogy: Bob hands out hundreds of open padlocks (Public Keys). Alice puts her message in a box, snaps Bob's padlock shut, and mails it. Now, NO ONE can open the box—not even Alice! Only Bob, who has the only key (Private Key) to that padlock, can open it.
Your Keys
Interactive Lab
RSA is slow and can only encrypt small amounts of data (usually max ~190 bytes for a 2048-bit key).
Cryptographic Hashing
One-way mathematical fingerprints. Data goes in, it never comes out.
Not Encryption, but Crucial
Encryption is a two-way street: you encrypt to decrypt later. Hashing is a one-way street.
A hash function takes an input of ANY size (a password, a 50GB video file) and mathematically condenses it into a fixed-size string of characters (a "fingerprint").
Properties of a good Hash:
- Deterministic: The same input ALWAYS produces the exact same hash.
- Irreversible: You cannot derive the input from the hash.
- The Avalanche Effect: Changing a single letter or even a single bit of the input changes the entire resulting hash completely.
- Collision Resistant: It is statistically improbable for two different inputs to produce the same hash.
The Avalanche Visualizer
Try changing "password" to "Password" (capital P) and watch how completely different every output becomes.
Capture The Flag
Test your skills. Use the tools in the sidebar to decode these intercepted messages.
Level 1: The Roman General
EasyWe intercepted this message from an amateur hacker group. We suspect they are using the oldest trick in the book. Use the brute force tool to find the flag.
Level 2: Polyalphabetic Panic
MediumThe adversary got slightly smarter. They used a Vigenère cipher. We managed to recover the keyword from their garbage bin: SECURE.
Level 3: Modern Data Extraction
HardThis file was downloaded from a secure server. It's AES-GCM encrypted. A note attached to it said: "The password is the name of our solar system's star, all lowercase."
(Note: To make this workable in this lab, use the text below, which was generated with the actual lab's AES tool using the password "sun")
Completed all challenges? You've proven you understand the fundamentals of Cryptography!