The Caesar cipher, named for and used by the Roman Emperor, is a substitution cipher where every letter of a message is replaced with another letter, by shifting the alphabet over an agreed number (from 1 to 25).

The message HELLO, for example, becomes KHOOR when a shift value of 3 is used as illustrated in Figure 16.11. The encoded message can then be sent through the mail service to Bob, and although Eve may intercept and read the encrypted message, at a glance it appears to be a non-English message. Upon receiving the message, Bob, knowing the secret key, can then transcribe the message back into the original by shifting back by the agreed-to number.

Figure 16.11 Caesar cipher for shift value of 3. HELLO becomes KHOOR

Even without a computer, this cipher is quite vulnerable to attack since there are only 26 possible deciphering possibilities. Even if a more complex version is adopted with each letter switching in one of 26 ways, the frequency of letters (and sets of two and three letters) is well known, as shown in Figure 16.12, so a thorough analysis with these tables can readily be used to break these codes manually. For example, if you noticed the letter J occurring most frequently, it might well be the letter E.

Figure 16.12 Letter frequency in the English alphabet using Oxford English Dictionary summary⁹

Any good cipher must, therefore, try to make the resulting cipher text letter distribution relatively flat so as to remove any trace of the telltale pattern of letter distributions. Simply swapping one letter for another does not do that, necessitating other techniques.

Building on the basic ideas of replacing one character with another and aiming for a flat letter distribution, block ciphers encrypt and decrypt messages using an iterative replacing of a message with another scrambled message using 64 or 128 bits at a time (the block).

The Data Encryption Standard (DES) and its replacement, the Advanced Encryption Standard (AES) are two-block ciphers still used in web encryption today. These ciphers are not only secure, but operate with low memory and computational requirements, making them feasible for all types of computer from the smallest 8-bit devices all the way through to the 64-bit servers you use.

While the details are fascinating to a mathematically inclined reader, the details are not critical to the web developer. What happens in a broad sense is that the message is encrypted in multiple rounds where in each round the message is permuted and shifted using intermediary keys derived from the shared key and substitution boxes. The DES cipher is broadly illustrated in Figure 16.13. Decryption is identical but uses keys in the reverse order.

Figure 16.13 High-level illustration of the DES cipher

Triple DES (perform the DES algorithm three times) is still used for many applications and is considered secure. What’s important is that the resulting letter frequency of the cipher text is almost flat, and thus not vulnerable to classic cryptanalysis.

All of the ciphers we have covered thus far use the same key to encode and decode, so we call them symmetric ciphers. The problem is that we have to have a shared private key. The next set of ciphers do not use a shared private key.

Although the original algorithm is no longer extensively used, the mathematics of the Diffie-Hellman key exchange are accessible to a wide swath of readers, and subsequent algorithms (like RSA) apply similar thinking but with more complicated mathematics.

The algorithm relies on properties of the multiplicative group of integers modulo a prime number (modulo being the term to describe the remainder left when dividing), as illustrated in Figure 16.14, and relies on the power associative rule, which states that:

Figure 16.14 Illustration of a simple Diffie-Hellman Key Exchange for $\text{g}=2$ and $\text{p}=11$

The essence of the key exchange is that this ${\text{g}}^{\text{ab}}$ can be used as a symmetric key for encryption, but since only ${\text{g}}^{\text{a}}$ and ${\text{g}}^{\text{b}}$ are transmitted the symmetric key isn’t intercepted.

To set up the communication, Alice and Bob agree to a prime number p and a generator g for the cyclic group modulo p.

Alice then chooses an integer a, and sends the value ${\text{g}}^{\text{a}}mod$ p to Bob.

Bob also chooses a random integer b and sends ${\text{g}}^{\text{b}}mod$ p back to Alice.

Alice can then calculate $({\text{g}}^{\text{b}}{)}^{\text{a}}mod$ p since she has both a and ${\text{g}}^{\text{b}}$ and Bob can similarly calculate $({\text{g}}^{\text{a}}{)}^{\text{b}}mod$ p. Since ${\text{g}}^{\text{ab}}={\text{g}}^{\text{ba}}$, Bob and Alice now have a shared secret key that can be used for symmetric encryption algorithms such as DES or AES.

Eve, having intercepted every communication, only knows g, p, ${\text{g}}^{\text{a}}mod$ p, and ${\text{g}}^{\text{b}}mod$ p but cannot easily determine a, b, or ${\text{g}}^{\text{ab}}$. Therefore the shared encryption key has been successfully exchanged and secure encryption using that key can begin!

The RSA algorithm, named for its creators Ron Rivest, Adi Shamir, and Leonard Adleman, is the public key algorithm underpinning the HTTPS protocol used today on the web.¹¹ In this public key encryption scheme, much like the Diffie-Hellman system, Alice and Bob exchange a function of their private keys and each, having a private key, determine the common secret used for encryption/decryption. It uses powers and modulo to encode the message and relies on the difficulty of factoring large integers to keep it secure. Its implementation is included in most operating systems and browsers, making it ubiquitous in the modern secure WWW. The algorithm itself would take pages to describe and is left as an exercise for interested readers.