Tiny Book of Simple Cryptography

For the last several years, I have been playing around with simple cryptography. I have made some of results of this available as a free PDF download as a book I call Tiny Book of Simple Cryptography. (TinyCrypto.pdf) I recently put some additional work into it and the latest version is available at the link above.

There are currently a baker’s dozen cryptographic methods described in the book. (List at the bottom of this post) Each write up includes a section on:

• Introduction
• Encrypting
• Decrypting
• Cryptography Issues
• Project Suggestions

If a PDF is not to your liking and you would like an actual book, I have created a book you can order through Amazon.com. Maybe for a classroom or school library? Or maybe because you find books easier to browse through. It’s there. There is also a Kindle version available here.

 

Methods covered

• Caesar Cipher
• Vigenère cipher
• Wheel Cipher
• One Time Pad
• Polybius Square
• PigPen Cipher
• Columnar Transposition Cipher
• Keyword Columnar Transposition Cipher
• Random Block Transposition Cipher
• Steganography
• Bacon’s Cipher
• Book Ciphers
• Playfair cipher

Reading Code For Fun and Learning

For some time I have been writing up information about some historic, and simple compared to modern, cryptonymic algorithms. They are collected in book form (a PDF actually – new release coming soon) that I have made available on my website. One algorithm that I have struggled with has been the Playfair Cipher. I don’t know why but for some reason I’ve had trouble with the algorithm. Mostly, I have struggled with how to code it up. Recently, I decided that I should work on that.

First step was to use something called Notebook LM. More on that in a future post. It’s pretty amazing. In any case, that tool helped me find a coded implementation of the Playfair Cipher. Great! Maybe I can learn from that. It turns out that I can.

The code was in Python and I am not very experienced with Python. Still with well over a dozen languages under my belt, figuring out the code was not hard. After reading the code I feel like I have a better handle on things.

I also learned more than I expected about how Python does things. So double the win. I do believe that reading code is a great way to better understand a programming language. It’s especially valuable if it helps you learn the idiom of the language.

So I now had a console application that worked and that I could play with. Now to me, a console application is so late 20th century that my next step was to convert to C# so I could use Windows Forms. Since I was already using “artificial intelligence” (that’s in quotes because I don’t completely buy that these tools are actually intelligent.) I asked Copilot to convert the Python code into C#. It did so quickly and easily. It wasn’t the way I am used to doing things though. Maybe that is why I was struggling with my own code? It’s a possibility.

The old joke is/was that a good FORTRAN programmer can write a good FORTRAN program in any programming language. Apparently, Copilot can write a good Python program in C#. Yes, the code looked a lot more like the Python code than I had expected. More than I really wanted as well. But along the way I learned that C# could do some things in some ways that I didn’t realize. There have been a lot of changes and updates in the language and I have clearly not kept up with all of them. Well, more learning is a good thing I guess.

Once I had the converted code I built a nice Windows application and have had some fun with it.

I am toying with messing with the C# code to make it look more like what I am comfortable with but that may not be the best use of my time. I might be better off experimenting with the new (to me) features of the language. Either way, learning is a good thing.

High School Cybersecurity Course–What Belongs

The last few years have seen a huge expansion in the number and types of cyber security courses in high schools. Much of this has been driven by a growth in the realization that we, society, governments, businesses, need more help making our systems secure from bad actors. CS ed as career development. Great in career technical schools of course. Yet another CS elective in comprehensive schools as well. Pretty easy to sell to school boards and administrations.

The CollegBoard has jumped on the bandwagon with AP Career Kickstart Cybersecurity Pilots.  I did take a look through that program. To me, the first course looks a lot like a standard IT/Networking course. I guess that makes sense as a prerequisite. After all,step one of a secure network is setting up a network.

The second course looks a lot more like what I think about as cybersecurity. Could be a good course. I hope that some of the pilot teachers will share what they learn while teaching it.

I don’t know that all courses calling themselves cybersecurity are that deep though. From what I have seen, some courses that call themselves cybersecurity are mostly about staying safe on the internet. That’s not a bad thing as long as proper expectations are set.

One related topic I have been thinking about is writing secure code. Is there room for that in high school? On the other hand, are we doing students a disservice by not talking about it at all? That’s the area of cybersecurity I hope to spend some more time thinking about. I’m more of a coder than a network guy.

Book Recommendations for CS People

tl;dr Book recommendations:

• Overnight Code: The Life of Raye Montague, the Woman Who Revolutionized Naval Engineering
• Code Girls: The Untold Story of the American Women Code Breakers of World War II

Overnight Code was recommended to me after I recommended Code Girls on Facebook. Overnight Code is a truly inspiring story of a woman with two strikes against her (female and Black) whose hard work, determination, and talents helped her do some revolutionary work in naval engineering and integrating hardware/software systems.

Debugging code is arguably a lot harder than writing new code. Raye Montague was amazing at debugging code and integrating disparate systems. But also a good person who helped mentor and advance others. She was given tasks that others had said were impossible to complete. Talent and hard work (Raye had a lot of both) allowed her to accomplish beyond expectations.

There is a lot of good career and life advice woven into this story as well. Advice for everyone. I could have benefited from this book early in my career.

"Code Girls: The Untold Story of the American Women Code Breakers of World War II"  was recommended by several people in a Facebook group dealing with a Kindle Challenge that Amazon is running. The idea about code breaking sparked my interest right away. This book was more than just that though.

There were plenty of insights into code breaking but the look into the lives of these amazing women was the highlight. It was a different time and women would not as respected as they should have been. Yet, these women put their considerable talents into working for the war effort and their country.

Code breaking is a fascinating subject in itself of course. I enjoyed reading about the “bombe” machines, how they were created and used. I also found the difference that code breaking made in the conduct of the war (World War II) to be interesting. This is not the sort of thing many history courses cover.

It’s easy to label these books as books for Women’s History Month or the Raye Montague book as being for Black History Month but that would be a mistake. These are books for all year long. I recommend them to anyone interested in the progression of computing in society. Code Girls is a great read for cybersecurity or cryptography students. Overnight Code is a powerful read for anyone not just computer science people. It is just that inspiring.

My Day Two at #CSTA2022

Day two started off great as I connected with several people from my home CSTA Chapter –CSTA New Hampshire. The CS community in New Hampshire is growing and the CSTA Chapter has been a part of that. I’m planning on getting more involved in chapter stuff  in the future.

My first session of the day was about teaching ethics when teaching artificial intelligence. Jeremy Keeshin (a last minute replacement as I understand it) from CodeHS was the presenter.  Seems like some good small group discussions took place. Maybe I was tired but I didn’t get into it very well. My fault. Wasted opportunity. I did get a copy of Jeremy’s book “Read Write Code” which I look forward to reading.

Next up for me was a session on preparing the future developers of the metaverse.  The presenters were from Carnegie Mellon. First I have heard of XR as a generic term to include Augmented Reality, Virtual Reality, and Modified Reality. We had some really interesting discussion of using virtual worlds in school. One school had a virtual birthday party in Minecraft. Minecraft has moved from pure play to an educational platform.

Students are picking different virtual worlds to play in as they age.It occurs to me that younger kids are building things in games like Minecraft and Roblox but older students, especially boys, and moving to games like Call of Duty which are more destructive. Something to think about.

My number one to look more into is Arena XR – An Augmented Reality Edge Network Architecture.

I really enjoyed this session and had some good interactions and learning with my tablemates. Slides for this session are at CSTA2022 NoStudentLeftBehind.pdf - Google Drive

Lunch break and more time in the exhibit hall. I got a close look at the Jacdac devices for use with a Micro:Bit. I may splurge and buy a starter kit. Note that I posted a brief look at Microsoft and other big companies exhibits at Amazon, Google, Meta, and Microsoft at #CSTA2022

First afternoon session was about writing for Hello World magazine. I was proctor and arrived before it started but after most people entered the room. Watching the clock is important as it is so easy to get distracted with so much going on. Anyway, the slides for this talk are available at CSTA_Writing Workshop Presentation.pptx - Google Slides  A lot of good stuff here. I hope this gets more teachers to write for the magazine.

Next up was a session on cryptography with an exercise in creating a Pringles can Enigma machine. We started the session with an brief introduction to Cyber.org and with an introduction to the Pigpen Cipher. (Note that this is one of the ciphers covered in my (PDF) free Tiny Book of Simple Cryptography)  We had some fun creating our mini Enigma machines and working though how they work. We only used one rotor but I brought home some sheets to make a larger one with a larger can when I get home.

Overall, a pretty good day. Some very good sessions, some good conversations at the exhibit hall, and many amazing face to face conversations with friends. I am exceedingly glad to be here this year.

Word Games and Cryptography

My latest discovery, thanks to Doug Peterson, is Crazy Phrase. Crazy Phrase is something of a variation of Wordle except that in Crazy Phrase the player is a phrase to discover. Clues are similar to Wordle with visual clues like green being a letter in the right place, yellow being in the wrong place but in the right word and blue being a good letter for the phrase but placed in the wrong word.

I was a bit intimidated when I first visited this new puzzle. I soon realized that some things involved in decoding cryptograms can be helpful. As with Wordle, looking for common letters is particularly helpful. With phrases we have the added option of looking for common words. This is especially true with two and three letter words. Words like “to”, “on”, “of” and the like can be very helpful in spotting the direction a phrase of going.

There is a proliferation of games on the internet inspired by Wordle these days. They offer a lot of possibilities for teaching problem solving. Creating new versions of games is an obvious programming project. Discussing these as cryptography related is an other possible topic. The use of computers to analyze strings is widely used for many applications so getting students to think about the process as used in games can be very helpful. And fun.

Looking Back on Computer Science Education in 2021

I’ve never felt less prepared to write a look back on CS education than I do today. I’ve been retired from most of the year and the world has been changed a bit because of COVID. I have noticed some things have clearly happened. One is the increase in online development tools which I talked about a year ago. The other is an apparent growth in cyber security education.

I’ve also noticed some increase in virtual reality programming courses as well. How that will go is anyone’s guess. There are two barriers. One is that VR hardware is still expensive. It’s not just devices like the Oculus but also computers capable enough to support VR and its development. A lack of training is also a barrier. Most teachers seem to be learning on their own with help from documentation and videos from companies. That and some support through social media from other teachers.

The Unity Teach Community has well over 2,000 members and is very active. I highly recommend it if you are looking to get involved in teaching VR.

Online teaching and programming tools have really taken off. The code.org courses support this sort of thing but they are far from the only option. CodeHS for example shows up a lot in social media discussions. As does Coding Rooms. And repl.it. I should probably collect a list of them for a future post. Perhaps you could add your favorites as comments and help me out?

Cyber security has also seen a lot of growth. Cyber.org has a lot of materials and provide cyber security professional development. Social media support for teachers coming from teachers has also been growing. I recommend the Cybersecurity Educators Facebook group. Over 1,000 members and active and growing. This field is going to boom as security gets more attention all the time.

Every year I expect  the Internet of Things to take off but it never really does. The pandemic has made doing any sort of physical computing more difficult. But I keep hoping.

Machine learning and artificial intelligence didn’t seem to pick up a great deal but it is growing. AI 4 K12 has a lot of useful resources from teachers and I recommend checking them out. Most of what I see in K-12 AI is units in existing courses and not specific full courses. That’s probably best at the K-12 level. The math and coding involved in creating AI from scratch is intense. Learning how to use existing tools is both useful and age appropriate.

So progress has been made and that’s a good thing. 2022 should be interesting. Hopefully, in a good way.

Playing With Code–Recursion

Recursion was never a big part of my toolbox but I am starting to appreciate it more recently. Regular readers know that I have been writing about and writing code for some older, simpler cryptography systems. For one of them I needed a list of letter in the alphabet without duplicating previous letters.

I needed to take a letter from the alphabet (I had a string of it) and see if it was in a list of used letters. If the letter was used already I wanted to check the next letter. It’s pretty straight forward if you can assume that not two letters in a row are used in the previous string. There is probably a decent iterative way to do this but I was coming up blank. Until it occurred to me that a recursive solution might be just what I needed.

I came up with the following code. It checks of the letter at location k in the alphabet list is in the string to check. If it has not been used it returns the index of the letter to use. If it has been use the same function is called again looking at the next letter index. This continues until we find an unused letter.

private int getNext(int k, string check)
{
     if (check.IndexOf(alpha.Substring(k, 1)) < 0)
         return k;
     else
         return getNext(k + 1, check);
}

I really like this solution because it emulates the way I think about the task. It’s also easy to understand. Recursion is not always hard and confusing. Sometimes it really makes things easier.

Program note: The nice people at Feedspot have compiled a Top 20 Computer Science Blogs list. Yes, I made the list but there are a lot of very good blogs on that list. They cover computer science more broadly and many will be worth a follow.

In cryptography news, the NSA Codebreaker Challenge 2021 is now open.

While you are here, I have been regularly updating my Tiny Book of Simple Cryptography. The current list includes:

Caesar Cipher
Vigenère cipher
One Time Pad
Polybius Square
PigPen Cipher
Columnar Transposition Cipher
Keyword Columnar Transposition Cipher
Random Block Transposition Cipher
Steganography
Bacon’s Cipher

Playing with Bacon's Cipher

Bacon's cipher is a fairly well-known and simple cipher. Its considered a form of steganography. Unlike most steganography, the code is hidden in the text and not an image. The format is a 5-bit binary encoding where each letter of the plaintext is replaced by a group of five of the letters 'A' or 'B'. This binary code has A as 00000 or "aaaaa" and Z is 11010 or "bbaba". There are variations and the original version used the same codes for the letters "I" and "J" and for "U" and "V". The usual implementation is to use one type face for "a" and a different type face for "b".

Often this is done with a serif and a sans serif font. Other options, and the first one I use below, uses italics and non-italics.

thequickbrownfoxesjumpedoverthelazy

One other option I have used is mixing upper and lower case letters.

The QUicK brOwn FoXes JUmPed ovER tHe lAZy

The big disadvantage of using mixed case letters is that it is not very subtle. It’s almost obvious that there is something special going on. Italics is less noticeable. Serif and Sans Serif are even more subtle.

One semi-famous example of the use of serif and Sans Serif fonts is the Cipher on the William and Elizebeth Friedman tombstone. The biography of Elizebeth Friedman,The Woman Who Smashed Codes: A True Story of Love, Spies, and the Unlikely Heroine Who Outwitted America's Enemies,is a seriously recommended read BTW.

I’ve been experimenting with coding and decoding using this method using a computer program. The upper/lower case combination is pretty easy both to encode and decode. C# has a nice Char.IsUpper method that was very handy for decoding. Encoding with different font faces was trickier for me. I finally used HTML for output.

Parsing an HTML file is not to bad, though I haven’t coded that at this time. The obviousness of this method still rules this out as a serious method for me. If fact just making a raw HTML file available, no matter what sort of type facing one uses, just feels to obvious for me. I suppose that getting an image of the message and posting that would work pretty well. It doesn’t lend itself to computerized decoding however. Maybe some AI pattern recognition would work well?

Speaking of images, there are examples of using this encoding in pictures of groups of people. Some people facing straight ahead and some turned to the side. Just about any possibility of two different options would work. Its a pretty flexible system.

This is not the sort of encryption that holds up to serious attack but I had some fun playing with it.

I have updated my Tiny Book of Simple Cryptography with a chapter on Bacon's Cipher. This is the seventh chapter with a simple cryptography technique.

Notes on Day Three of #CSTA2021

No morning help desk duty for me today so I watches the whole “Morning Java” session. For those of you not at CSTA, Moring Java was an introduction to the day with our conference chairs and guests. Today.Michelle Lippoli, Senior Operations Manager (Events and Membership) for CSTA, talked about all the work that goes into running a conference like this one. And it is a lot of work! Next year CSTA will be in-person in Chicago. There is a lot of excitement about being able to meet in-person but I hope we have the virtual option as it makes the conference possible for so many more people.

First session of the day for me was Nifty Assignments. Though I was tempted by Python and Micro:bit…on a Calculator? and I will look for the video in the future. Nifty is a conference favorite. The idea started at SIGCSE (See more on that here) and I have used projects from previous sessions at CSTA and SIGCSE.

Michele Lombardi - Unplug the Internet!  9-12
Review internet vocabulary, how messages are sent, and introduce potential cyber attacks using this unplugged internet simulation.

I’ve done something similar but I love the forms she uses and the other information about things to do.

Cindy Gonzalez - Bring your 3D world to life!  K-5
Design a 3D design in Tinkercad, upload your design to Cospace, code your design & enter your 3D world using the DoInk Green Screen app

Talk about making students creators and not just consumers. I love the cross curriculum opportunities.

Roger Jaffe - RSA Encryption Without the Math  9-12
How to teach RSA encryption without having to teach the math

I struggle with teaching public key encryption so this set of resources looks very exciting to me. I can see using this lesson in Advanced Placement Computer Science Principles.

Learn more about CSTA Nifty Assignments at: https://sites.google.com/site/cstaniftyassignments/

After Nifty Assignments, I attended Teach Cybersecurity. Change the Future/ (Slide deck here) Did you know that there are guidelines for what to teach about cyber security? There was a lot of discussion about teaching cyber security in the chat. A lot of teachers are, not unreasonably I think, worried about students misusing the knowledge. The Teach Cyber program, and every other program I have looked at, included ethical thinking integrated into the curriculum. This is a curriculum worth looking into if you are thinking about adding a cyber security course.

Last mini session of the day for me was My CSP Experiment – teaching Advanced Placement CS Principles with two different programming languages at the same time (JavaScript/AppLab and Python) This teacher developed a detailed scope and sequence with dates and time and then mapped the concepts to unites from different curriculum programs (code.org, CodeHS and others) Concepts were taught largely with pseudo code and unplugged activities. That was a lot of work. I really admire her skills. (Slides are here)

Well, that’s a wrap for me. It’s been a great conference and I learned a lot. I’m glad I don’t have to travel for hours to get home.

Looking Forward to 2021 in CS Education

What a strange year it has been. The pandemic and more took a lot of the steam out of what I had hoped to dig deeply into in 2020. Surviving is success in these times I guess. I taught online for the winter/spring semester of 2020 and then retired. Teaching online was not so bad but it didn’t leave me with much time to improve on things. Running as fast as possible to stay in the same place seems to have been the norm for most teachers.

But this is time to look forward not back. One thing that seems to have grown among the teachers I see on social media is cybersecurity. While we have seen cyber security at the CSTA conference the last several years is feels like 2020 was the year teachers started teaching it in larger numbers. I think that is only going to continue.

I see a lot of teachers looking for new courses that are relevant to students and cybersecurity certainly counts as that. We can also fit more of it into other CS courses. Students love it. Well, mostly.

CYBER.ORG (formerly NICERC) is one of several organizations supplying curriculum and professional development. And it is all free.I love that team.  Teach Cyber  is  another group as is TryHackMe There is a pretty active Cybersecurity Educators group on Facebook where a lot of teachers are sharing ideas and resources. I highly recommend that group.

Other than cybersecurity what am I looking to see more of in 2021? Well, online IDEs which really came into their own in 2020 are going to only get better. We’ll probably see more competition there as well. In fact, any option for teaching online will see growth even if, as we all hope, schools all return to in-person learning. Giving access to students outside of computer labs is just too powerful a tool to avoid.

I expect computer science, indeed most, conferences to retain a virtual component in 2021. Will they be mixed with both in-person and virtual aspects? I’m not sure but I see more and more conferences having the ability for people to attend virtually. The cost of that is coming down for the conferences and the ability of teachers to spend money for airfare and hotels is not growing as fast as the need for more teachers. There is also a growing interest in reducing carbon footprints on that part of many people.

Computer science education research has been gaining traction in universities. That’s pretty exciting to me as I think there is still a lot we can learn about how to teach CS more effectively. I am hoping that learning about the results of this research will be more available to teachers as well. We can’t all go to conferences or afford expensive peer reviewed journals. The real value of CS Ed research is getting the knowledge to actual teachers.

I see reason to be optimistic about CS education in 2021. We made it through 2020 and it is all going to get better. I can’t wait to see what happens!

Tiny Book of Simple Cryptography

I've been playing with simple cryptography. Mostly stuff that was solid before computers. Just for fun mostly but some of it may make for interesting projects for students. I've written a little bit about the things I have been playing with.

This is not a big book and it is intended more to spark interest and not to be a real reference book. There are footnotes linking to Wikipedia articles that would be a good next step for learning more.

I have a couple of substitution ciphers and a couple of  transposition ciphers. Added some Steganography. 

http://www.acthompson.net/TinyCrypto.pdf

Comments and gentle criticism welcome. I have coded solutions in C# that are ok. Some of them even have comments.

Updated 5 March 2021 to include a brief chapter on the PigPen Cipher. Also some minor edits in other sections.