PHHW DW QLQH looks like a secret. Move every letter three places backward, however, and it becomes MEET AT NINE. The mystery has lasted about as long as it takes to find a pen.
Now consider a modern secure connection. An attacker can know the algorithms, capture the encrypted traffic, and still face a computationally infeasible task—provided the system is designed and used correctly.
The journey between those two situations involved several changes of idea: concealing patterns, managing keys, authenticating messages, and choosing mathematical problems that attackers cannot feasibly solve.
What is the Caesar cipher?
The Caesar cipher is a substitution cipher that moves each letter a fixed number of positions through an alphabet, wrapping around at the end. That shift is the key.
The Roman writer Suetonius describes Caesar’s use of a letter-shifting cipher in confidential correspondence. Our familiar classroom version uses the modern 26-letter A–Z alphabet; it is a teaching convention rather than a reconstruction of every detail of Roman practice.
For a forward shift of three:
| Plaintext | A | B | C | X | Y | Z |
|---|---|---|---|---|---|---|
| Ciphertext | D | E | F | A | B | C |
The same rule turns MEET AT NINE into PHHW DW QLQH. To decrypt, reverse the shift. For this example, spaces are left unchanged.
The algorithm is “shift the alphabet.” The key is “by three positions.” Those are separate things, even in this elementary system.
Our video demonstrates the idea visually:
Watch: What is the Caesar Cipher and how to decipher it
Why a secret shift cannot rescue it
Keeping the shift secret leaves an attacker very little work. With 26 letters there are only 25 non-zero shifts, or 26 possibilities if the unchanged alphabet is included. An attacker can inspect every candidate without needing a clever mathematical breakthrough.
There is another weakness: every occurrence of a letter becomes the same replacement. Repeated letters and word shapes survive, while letter-frequency patterns are relabeled rather than erased. Longer messages provide more clues; very short messages may have several plausible readings.
A useful security question emerges immediately: what information does the ciphertext still give away?
First improvement: keep changing the substitution
Polyalphabetic systems vary the substitution across the message. In the familiar Vigenère cipher, a repeating keyword supplies a sequence of shifts. Using A = 0, the keyword LIME gives shifts of 11, 8, 12, and 4, then repeats. The same plaintext letter can therefore encrypt differently at different positions.
That is an improvement, but the repetition leaves structure. Once an attacker identifies the period, letters encrypted with the same shift can be analyzed together. A declassified cipher-training manual illustrates the underlying repeating-key construction.
Twentieth-century rotor machines mechanized changing substitutions. Enigma’s electrically wired rotors changed the relationship between typed and output letters as the machine operated. Their complexity increased the work, but design properties, procedures, and cryptanalysis still mattered. Polish breakthroughs and later Allied work made reading Enigma traffic possible; a large collection of moving parts did not guarantee security.
Two surprises that changed the rules
The first is that a system should survive disclosure of its design. In 1883, Auguste Kerckhoffs argued that a cipher system should remain usable even if it falls into enemy hands. Modern practice builds on that principle: protect the keys, and subject the design to scrutiny.
The second is more startling: perfect secrecy was already understood before modern computer encryption became commonplace.
A one-time pad combines a message with an independent, uniformly random secret key as long as the message, using that key only once. Under those conditions, the ciphertext reveals no information about the message content. Claude Shannon’s 1949 analysis formalized perfect secrecy.
The price is logistical. Both parties need the secret key material beforehand, in sufficient quantity. Reusing it destroys the guarantee, and the pad alone does not authenticate the message. A mathematically powerful answer can still be awkward to operate at Internet scale.
From letters and rotors to bits and enormous keyspaces
Computers made complex transformations practical—and made attacks faster. The Data Encryption Standard, adopted in 1977, used a 56-bit key. Its keyspace eventually became inadequate against dedicated search hardware; NIST withdrew the DES standard in 2005.
AES became a standard in 2001. AES-128, AES-192, and AES-256 all transform 128-bit blocks; their names indicate different key lengths. AES-128 has 2^128 possible keys—approximately 340 undecillion, compared with Caesar’s handful of shifts.
But keyspace size is only one consideration. Secure encryption also depends on the construction around the cipher, key generation, implementation, and correct use. A strong block cipher used in a pattern-revealing mode can still expose structure.
This remains symmetric encryption: the communicating parties rely on shared secret key material. How should two strangers obtain that secret in the first place?
The breakthrough: establish secrets over a public channel
That problem became central as computers started communicating at scale. Sending a courier with a key before every first conversation was an uncomfortable fit for a connected world.
Diffie and Hellman’s public 1976 paper, New Directions in Cryptography, introduced a major framework for public-key cryptography and described a key-agreement method. Parties could exchange public values and derive a shared secret that a passive observer could not feasibly compute under the scheme’s assumptions.
Public-key encryption, key agreement, and digital signatures perform different jobs. In public-key encryption, someone can encrypt for a recipient using that recipient’s public key, while decryption requires the corresponding private key. Key agreement establishes shared secret material. A signature supports verification of a message’s origin and integrity.
Authentication is essential: an unauthenticated key exchange can be intercepted by someone establishing a separate secret with each participant. Secure communication needs an answer to “who am I talking to?” as well as “who can read this?”
Your browser uses a team of cryptographic tools
A typical certificate-authenticated TLS 1.3 connection combines complementary roles:
- Identity checks: certificate validation and digital signatures help authenticate the server.
- Key establishment: a handshake derives traffic secrets, commonly using ephemeral Diffie–Hellman.
- Traffic protection: symmetric authenticated encryption protects the actual data.
Constructions such as AES-GCM provide confidentiality and an authentication check designed to detect unauthorized alterations. ChaCha20-Poly1305 is another option used in TLS 1.3. Digital signatures are not simply “encrypting the message with the private key.”
Correct handling of a cryptographic nonce matters too. For AES-GCM, reusing a nonce with the same key can seriously compromise confidentiality and authentication. The algorithm’s reputation cannot compensate for breaking its operating rules.
Today’s next challenge: change the mathematical assumptions
A sufficiently capable quantum computer would threaten widely used public-key schemes based on factoring and discrete logarithms, including RSA and elliptic-curve systems. That motivates post-quantum cryptography, designed to run on ordinary computers while resisting known quantum attacks.
In August 2024, NIST published three landmark standards with distinct roles:
| Standard | Algorithm | Job |
|---|---|---|
| FIPS 203 | ML-KEM | Establish shared secret key material |
| FIPS 204 | ML-DSA | Generate and verify digital signatures |
| FIPS 205 | SLH-DSA | Generate and verify digital signatures |
These are part of an ongoing transition. ML-KEM does not replace AES for encrypting a file; it addresses how parties establish a shared secret. The approach changes the public-key mathematics while retaining the need for efficient symmetric protection, authentication, and careful implementation.
Caesar’s cipher remains a wonderful first lesson because its weakness is visible. You can separate the algorithm from the key, try the possibilities, and watch patterns survive.
The larger lesson travels all the way to modern cryptography: security depends on the complete system, the attacker’s capabilities, and the assumptions that still hold. The alphabet was only the beginning.