Cryptography Explorables

Every message you send, every website you visit, every payment you make, is kept private and safe by cryptography: a little mathematics, used very carefully. These pages build it up one idea at a time, starting from ciphers simple enough to do with a pencil.

Each page starts from the simplest thing that might work, shows what’s wrong with it, and builds up from there to how it’s really done. Most pages include an attack you carry out yourself: breaking things is the best way to see why the real designs look the way they do. Everything runs in your browser.

Every page

Foundations

What we want from cryptographyAlice, Bob, and Eve and Mallory on the wire: secrecy, integrity and authenticity; changing an encrypted payment without the key; only the key is secret; a guessing game that says what “secure” means; and trying every key, timed in your browser.

Old ciphers, and breaking themCiphers you can work with a pencil, and how each one falls: Caesar's shift by trying all 25, substitution by counting letters (by hand, and by a program that climbs towards English), and Vigenère once its key's length gives it away.

The one-time padThe one cipher that can't be broken: a random key as long as the message, used once. Why it's perfectly secret, why almost nobody uses it, and what using the pad twice gives away, from pictures that show through to two messages you pull apart yourself.

RandomnessEvery key starts as random bits: entropy as counting guesses (timed in your browser), the patterns in pseudo-random generators (an LCG's bits, RANDU's planes), an LFSR keystream broken from a known header, a clock-seeded key found in milliseconds, and what makes a generator fit for keys.

Symmetric ciphers

Stream ciphersThe one-time pad made practical: a short key stretched into a long keystream. RC4 by hand and the bias that lets Eve read a byte sent under 20,000 keys, ChaCha20's add-rotate-XOR rounds, and why a nonce must never repeat.

Finite fieldsArithmetic where adding, subtracting, multiplying and dividing all work on a finite set: clocks with a prime number of hours, bytes as polynomials (added by XOR, multiplied without carries, kept to a byte by AES's polynomial), and why primitive polynomials send an LFSR round every state.

Block ciphersA block cipher is a shuffle of every possible block, picked by the key: a 4-bit one drawn in full, confusion and diffusion, a Feistel network that decrypts by running backwards, AES step by step, and the avalanche of one flipped bit.

Modes of operationA block cipher encrypts 16 bytes; a message is longer. ECB and the picture that shows through it, cutting and pasting blocks to redirect a payment, CBC's chaining and the bits Mallory can still flip, and CTR: AES as a stream cipher, and what a reused nonce gives away.

Breaking a block cipherWhat breaking a cipher means when brute force is hopeless, and one real way to do it: differential cryptanalysis on a toy 16-bit cipher, from one S-box's table of odds to an attack that finds key bits from a few hundred chosen plaintexts.

Integrity

Hash functionsA short fingerprint for any amount of data, that nobody can fake: why a CRC isn't one, the birthday bound (23 people, and collisions found in your browser), SHA-256 block by block and round by round, how MD5 and SHA-1 fell, and SHA-3's sponge.

MACs and authenticated encryptionHow Bob can tell a message wasn't changed: a tag only the key-holder can make. The obvious one falls to length extension; HMAC doesn't; a careless comparison gives a tag away a byte at a time; polynomial MACs must never reuse a key; and AES-GCM refuses every change.

Padding oraclesOne extra bit, whether a decrypted message's padding was good, is enough to read a whole CBC-encrypted message without the key: a server that says too much, one byte found by asking, the whole cookie decrypted live, the real attacks, and the fix (check a MAC first).

PasswordsHow a site should keep passwords and how attackers crack them when it doesn't: a dictionary attack on a leaked table in your browser, salts and rainbow tables, PBKDF2's deliberate slowness, memory-hard hashing, and what makes a password strong.

Famous breaks

EnigmaThe German cipher machine of the Second World War, and how it fell: a key press traced through its rotors, the stepping and the reflector that made a letter never itself, about 10²³ keys, and the cribs, loops and bombes that found the day's settings anyway.

The Debian OpenSSL bugFor two years, every key OpenSSL made on Debian and Ubuntu was one of 32,767: the one removed line that did it, why it looked safe, the attacker's list of every key rebuilt in your browser, and why the broken output still passed every statistical test.