Teach & case

Help a near-peer reason through the idea — when you explain it, you understand it best — then read the real decision it comes from.

A real case · you decide

Ivo's 'secret' club cipher

Ivo — a student whose club wants to encrypt its messages so a rival club can't read them

The idea in play: a small keyspace is not security — a 25-shift Caesar cipher is trivially brute-forced.

Ivo's club picks a Caesar cipher — shift every letter by a secret number — and feels safe: "The rival would have to guess our secret shift!" Ivo does the math on how many secrets there actually are.

A Caesar shift can only be 1 through 25 (shift 0 or 26 changes nothing). That's the ENTIRE set of keys — 25 possibilities.

A rival doesn't need to be clever: try all 25 shifts, and read whichever one turns into English. On a phone that's seconds. The "secret" has nowhere to hide.

The club says "but they'd have to GUESS the shift." Does keeping the shift secret make it secure?

Someone suggests: keep the Caesar cipher but ALSO keep the whole method secret ("security through obscurity"). Safe now?

Ivo's verdict: the club's cipher is a fun puzzle, not a lock. That's Ivo's whole point — 25 keys isn't a secret, it's a to-do list a rival finishes in seconds.

Brute-force a cipher yourself →