The Secret Message Lab
Eve can copy it. Can she read it?
Your mission
Dani needs to send you a secret across the Internet, and Eve is listening. Lock messages with a key, watch Eve fail to read them, then crack a weak cipher yourself. Find out why two keys can beat one, and watch your browser set up HTTPS step by step.
Explore
Send Dani's secret, see what Eve sees, then tap each part of the picture.
Everything with a dashed circle can be tapped: Dani, the locks, the keys, the Internet and Eve.
Dani wants to tell you where to meet, but the message has to cross the Internet, and Eve is listening in. Press Send it and watch what happens to the message on the way. Then tap each part of the picture.
0 of 6 discoveries made
Experiment
Encrypt your own messages, try the wrong key, let Eve attack, compare one key with two, and run an HTTPS handshake.
- 1Client Hello
- 2Server Response, with its certificate
- 3Agree on a shared key
- 4Encrypted communication
- 5Secure connection
Codebreaker experiments
Try each one. They tick themselves off.
0 of 6 experiments done
Challenge
Six secrets: decrypt and encrypt messages, choose the right key, put TLS in order and explain the padlock.
Cryptographer's notes
- Plaintext → encrypt (key) → ciphertext → decrypt (key) → plaintext
- Symmetric: one shared secret key (e.g. AES)
- Asymmetric: public key locks, private key unlocks (e.g. RSA, ECC)
- TLS: hello → certificate → shared key → encrypted data → padlock
- HTTPS = HTTP + TLS. A padlock doesn't make a website trustworthy
Finish all 6 secrets to finish this stage.
Understand
Here is what the lab was showing you, in the words you need for the exam.
Making data unreadable to others
Encryption protects your information from unwanted access. It doesn't stop others from intercepting data on its way across the Internet; it stops them from understanding it.
- 1Plaintext: readable original data, e.g. MEET ME AT 4 PM.
- 2Encryption uses a key to transform the data into a protected form.
- 3Ciphertext: unreadable data, e.g. X8@LQ#29… This is what travels.
- 4Decryption uses a key to restore the original data.
The letter shift in this game (a Caesar cipher) is only a teaching example: Eve broke it in 25 tries. Real ciphers such as AES use keys so long that trying every one is impossible.
Symmetric encryption: one shared key
The same secret key is used for both encryption and decryption. Only people who have the key can read the original.
Good: fast and efficient, suitable for large amounts of data. Examples: AES, DES, 3DES. Used for encrypted files, secure communication (HTTPS uses it for the data) and Wi-Fi security (WPA2/WPA3).
Problem: the key must be kept secret. If it is lost or stolen, the data can be read by others. Getting the key safely to the receiver is hard: the key distribution problem.
Asymmetric encryption: two related keys
Also called public-key encryption. It uses a pair of keys: a public key to encrypt and a private key to decrypt. Anyone can have the public key, but only the owner has the private key.
Good: very secure, and it solves the key distribution problem. Examples: RSA, ECC. Used for HTTPS, email encryption (S/MIME, PGP), digital signatures and secure key exchange.
Cost: computer-intensive, usually slower than symmetric encryption, so it is often used together with symmetric encryption, as in HTTPS. The private key must be kept secret.
One key or two?
| Symmetric | Asymmetric | |
|---|---|---|
| Keys | One shared secret key for encryption and decryption | Two related keys: public (shared with anyone) and private (kept secret) |
| Strength | Fast; good for large amounts of data | Secure key exchange; authentication |
| Examples | AES, DES, 3DES | RSA, ECC |
How TLS protects your web connection
TLS (Transport Layer Security) protects data travelling between your browser and a website. HTTPS = HTTP communication protected by TLS (older material may call it SSL). TLS uses public-key cryptography to agree on a shared key, and then symmetric encryption to protect the data:
- 1Client Hello: your browser asks to start a secure connection and lists the TLS versions and methods it supports.
- 2Server Response: the server sends its digital certificate to prove it is the real website; your browser checks it with trusted Certificate Authorities (CAs).
- 3Agree on a shared key: a key-agreement method (e.g. ECDHE) creates a session key. The key itself is never sent over the Internet.
- 4Encrypted communication: all data is encrypted with the shared key using fast symmetric encryption (e.g. AES).
- 5Secure connection: the browser shows https:// and a padlock.
Important: HTTPS means your connection is secure. It does not guarantee that the website is trustworthy. Always check the website address and be cautious of suspicious websites, even if they use HTTPS.
Exam tip
Use the four key words in order: plaintext → encryption (with a key) → ciphertext → decryption (with a key). Compare the two types precisely: symmetric = one shared secret key, fast (AES), but the key must be shared safely; asymmetric = public key to encrypt, private key to decrypt (RSA, ECC), solves key distribution but is slower. For HTTPS, say that TLS uses public-key cryptography to agree on a shared key, then symmetric encryption for the data, and that a padlock means a secure connection, not a trustworthy website.