Cryptography I (Classical & Symmetric) [Lect 3: Competitive Cybersecurity 101]

This session demystifies the core goals of cryptography—confidentiality, integrity, and authentication—while clarifying the critical distinctions between encoding, encryption, and hashing. Students explore classical ciphers like Caesar and Vigenère, learning to break them using Python modulo arithmetic and automated solvers like CyberChef and dCode.fr. The lecture then transitions to modern symmetric encryption, explaining the mathematical foundation of the XOR operation and the Advanced Encryption Standard (AES) as applied in CTF environments.

1. Competitive Cybersecurity 101 Session 3: Cryptography I (Classical & Symmetric) Kannan Murugapandian July 24, 2026 Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 1 / 18
2. Disclaimer & Ethical Rules Strictly for Educational Purposes All knowledge and tools must only be applied in environments where you have explicit permission. Do not test on systems you do not personally own or lack authorization to assess. Unauthorized access constitutes a criminal offense under the Computer Misuse Act. Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 2 / 18
3. Today’s Agenda Core Concepts: Encoding vs. Encryption vs. Hashing Classical Ciphers: Caesar & Vigenère Symmetric Crypto: The Magic of XOR Modern Standards: AES & CyberChef Hands-On: The Shifted Secret Challenge Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 3 / 18
4. What is Cryptography? The art and science of securing communication. Scrambling data so that only authorized parties can read it. Core Goals: Confidentiality: Keeping secrets secret. Integrity: Proving data hasn’t been tampered with. Authentication: Verifying identities. In CTFs, cryptography challenges usually test your ability to reverse-engineer the scrambling process to find the flag. Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 4 / 18
5. The Golden Rule: Know Your Terms Beginners often confuse these three concepts. In CTFs, the distinction is critical! Encoding: Changing data format for usability. Reversible. No secret key. (e.g., Base64, Hex) Encryption: Scrambling data for security. Reversible. Requires a secret key. (e.g., AES) Hashing: Creating a unique digital fingerprint. One-way. Cannot be reversed. (e.g., SHA-256) Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 5 / 18
6. Classical Ciphers: The Caesar Cipher The Concept: Shift every letter in the alphabet by a fixed number of positions. Example (Shift by 3): A→D B→E Z → C (wraps around) Shift 3 HELLO −−−−→ KHOOR Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 6 / 18
7. Breaking Caesar in CTFs Why is it weak? There are only 25 possible shifts in the English alphabet. We don’t need to be clever; we can just brute-force it! If you see a string of random-looking letters in a CTF, always try all 25 shifts first. CTF Pro-Tip: A Caesar cipher with a shift of 13 is called ROT13. It is incredibly common in beginner challenges. Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 7 / 18
8. Python: The Math Behind the Shift To shift letters in Python, we use ASCII values and Modulo Arithmetic (%). ord(’a’) gives 97. We subtract 97 to get a 0-25 range. We add the shift, then use % 26 to wrap around. We add 97 back and use chr() to get the letter. # The core math for shifting a lowercase letter char = ’x ’ shift = 3 # 120 - 97 = 23. (23 + 3) % 26 = 0. 0 + 97 = 97 ( ’ a ’) new_char = chr (( ord ( char ) - 97 + shift ) % 26 + 97) Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 8 / 18
9. Classical Ciphers: Vigenère The Concept: A Caesar cipher, but the shift changes for every letter based on a secret keyword. Also known as a Polyalphabetic cipher. If the keyword is KEY, the first letter shifts by K, the second by E, the third by Y, then it repeats. Why it matters: It defeats simple letter frequency analysis. For centuries, it was considered ”unbreakable.” Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 9 / 18
10. Breaking Vigenère in CTFs Do not write the math from scratch! Breaking Vigenère requires complex statistical analysis (Kasiski examination, Index of Coincidence). In a timed CTF competition, use existing tools. Your Best Friends: CyberChef: Use the ”Vigenère Decode” recipe. dCode.fr: Has an automated Vigenère solver that will guess the key for you. Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 10 / 18
11. Symmetric Encryption: The Shared Secret The Concept: The same key is used to both encrypt (lock) and decrypt (unlock) the data. Analogy: A physical door key. You use it to lock the door, and the exact same key to unlock it. Pros: Extremely fast and efficient for large amounts of data. Cons: How do you safely share the key with your friend without someone intercepting it? Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 11 / 18
12. The Magic of XOR (Exclusive OR) The Concept: The fundamental building block of modern symmetric encryption. It compares two bits. If they are the same, the result is 0. If they are different, the result is 1. The Magic Property: If A ⊕ B = C , then C ⊕ B = A Data ⊕ Key = Ciphertext Ciphertext ⊕ Key = Data Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 12 / 18
13. Python: XOR in Action In Python, the XOR operator is the caret symbol: ^ # Our secret data and our secret key data = " flag " key = " K " # Encrypting : XOR each character with the key encrypted = " " for char in data : encrypted += chr ( ord ( char ) ^ ord ( key ) ) # Decrypting : XOR the ciphertext with the SAME key decrypted = " " for char in encrypted : decrypted += chr ( ord ( char ) ^ ord ( key ) ) Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 13 / 18
14. Modern Symmetric: AES Advanced Encryption Standard (AES) The global standard for symmetric encryption today. Used by governments, banks, and secure messaging apps (like WhatsApp). It is a Block Cipher: it chops data into fixed-size blocks and scrambles them through multiple complex ”rounds”. CTF Reality Check: You will never be asked to write AES from scratch. You will be given a script that uses AES, and you must find the hidden key or exploit a flaw in how it was implemented. Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 14 / 18
15. CTF Pro-Tip: CyberChef The Swiss Army Knife of CTFs A free, web-based tool created by GCHQ (UK Intelligence). Allows you to drag and drop ”recipes” to decode, decrypt, and analyze data. Always paste weird-looking CTF text into CyberChef first. Use the ”Magic” recipe to let it guess the encoding/encryption! URL: gchq.github.io/CyberChef Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 15 / 18
16. Mini Challenge: The Shifted Secret Task: Decode the intercepted message. Scenario You intercepted this string from a rival team’s chat: FRQJUDWV BRX FUDFNHG WKH VKLIW Your Steps: 1 Identify the cipher type (Hint: Look at the underscores and letter distribution). 2 Use Python or CyberChef to test all 25 shifts. 3 Find the shift that produces readable English words. Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 16 / 18
17. Key Takeaways Know your terms: Encoding ̸= Encryption ̸= Hashing. Classical Ciphers: Caesar and Vigenère are historically important but easily broken with modern tools. Symmetric Crypto: Uses a single shared key. XOR is its mathematical foundation. Work Smart: Use CyberChef and dCode.fr instead of writing complex math from scratch. Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 17 / 18
18. Thank You! Questions? Email: kannan.mp@proton.me Course Hub: kannan.bearblog.dev/ctf-dps/ Next Session: Cryptography II (Asymmetric & Post-Quantum) July 31, 2026 Kannan Murugapandian Competitive Cybersecurity 101 July 24, 2026 18 / 18