Cryptography: The Science of Secrets

Imagine you're sending a secret message to your friend. But there's a spy trying to intercept it! Cryptography is the art of writing messages in code so only the intended person can read them. Let's start simple and build up to modern security.

Caesar Cipher: The Oldest Trick in the Book

Julius Caesar used this 2,000 years ago. The idea: shift each letter by a fixed number.

With a shift of 3:
A → D, B → E, C → F, ..., X → A, Y → B, Z → C

Plain text: HELLO
Cipher text: KHOOR

H → K (shift 3)
E → H (shift 3)
L → O (shift 3)
L → O (shift 3)
O → R (shift 3)

def caesar_cipher(text, shift):
 result = ''
 for char in text:
 if char.isalpha():
 ascii_offset = 65 if char.isupper() else 97
 shifted = (ord(char) - ascii_offset + shift) % 26
 result += chr(shifted + ascii_offset)
 else:
 result += char
 return result

plain = 'HELLO WORLD'
encrypted = caesar_cipher(plain, 3)
print(encrypted) /* KHOOR ZRUOG */

/* To decrypt, shift back by -3 */
decrypted = caesar_cipher(encrypted, -3)
print(decrypted) /* HELLO WORLD */

Problem: Only 26 possible shifts. A computer can crack it in milliseconds!

Symmetric Encryption: Same Key for Both

Both sender and receiver have the SAME secret key. Like a lock and key — only you and your friend have the key.

Example: AES (Advanced Encryption Standard)

AES is modern, military-grade encryption. Banks use it. Your encrypted passwords use it. Here's how:

Key: mysecretpassword123
Plain text: 'Transfer 10,000 rupees to Amit'
Encrypted text: (random-looking gibberish)

To decrypt, you need the exact same key.
Without it, it's mathematically impossible (practically) to crack.

Python Example (Using the cryptography library)

from cryptography.fernet import Fernet

/* Generate a key (keep it secret!) */
key = Fernet.generate_key()
print(key) /* Something like b'SomeRandom...Base64EncodedKey' */

cipher = Fernet(key)

/* Encrypt */
plain_text = b'My bank account: 98765432'
encrypted = cipher.encrypt(plain_text)
print(encrypted) /* Random gibberish */

/* Decrypt (only with the original key) */
decrypted = cipher.decrypt(encrypted)
print(decrypted) /* b'My bank account: 98765432' */

/* Without the key, it's unreadable! */
wrong_key = Fernet.generate_key()
wrong_cipher = Fernet(wrong_key)
try:
 wrong_cipher.decrypt(encrypted) /* Fails! */
except:
 print('Wrong key! Cannot decrypt.')

Problem with Symmetric: How do you share the secret key without someone stealing it?

Asymmetric Encryption: Public & Private Keys

Instead of one key, you have TWO:

Public Key: Share freely! Anyone can use it to encrypt messages to you.
Private Key: Keep secret! Only you have it. Used to decrypt messages meant for you.

It's like a mailbox. Anyone can drop letters in (using your public key), but only you with your private key can open and read them.

How RSA Works (Simplified)

1. Generate two prime numbers: p = 61, q = 53
2. Compute n = p * q = 3233 (part of public key)
3. Generate public and private exponents
4. Public key: (n=3233, e=17)
5. Private key: (n=3233, d=2753)

To encrypt:
 cipher = (message ^ e) mod n

To decrypt:
 message = (cipher ^ d) mod n

Without knowing d (the private key), you can't decrypt!

/* Python Example with RSA */
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import hashes

/* Generate key pair */
private_key = rsa.generate_private_key(
 public_exponent=65537,
 key_size=2048,
)
public_key = private_key.public_key()

/* Alice encrypts a message using Bob's public key */
message = b'Secret message for Bob'
encrypted = public_key.encrypt(
 message,
 padding.OAEP(
 mgf=padding.MGF1(algorithm=hashes.SHA256()),
 algorithm=hashes.SHA256(),
 label=None
 )
)

/* Bob decrypts using his private key */
decrypted = private_key.decrypt(
 encrypted,
 padding.OAEP(
 mgf=padding.MGF1(algorithm=hashes.SHA256()),
 algorithm=hashes.SHA256(),
 label=None
 )
)

print(decrypted) /* b'Secret message for Bob' */

Why This is Magic: Alice doesn't need to share a secret with Bob beforehand! She just uses his public key.

Hashing: One-Way Encryption

Unlike encryption, hashing is one-way. You can't decrypt it back to the original. But the same input always produces the same hash.

Use case: Password storage. Websites don't store your password. They store its hash.

Your password: "MySecurePass123"
Stored hash: "a1b2c3d4e5f6..." (using SHA-256)

When you log in:
1. You enter: "MySecurePass123"
2. Website hashes it: "a1b2c3d4e5f6..."
3. Matches stored hash? Login success!

If a hacker steals the hash, they can't reverse it to get your password!

import hashlib

password = 'MySecurePass123'
hashed = hashlib.sha256(password.encode()).hexdigest()
print(hashed)
/* Output: 3a5e... (fixed-length hash) */

/* Same password always produces same hash */
hashed2 = hashlib.sha256(password.encode()).hexdigest()
print(hashed == hashed2) /* True */

/* Different password = completely different hash */
password2 = 'MySecurePass124'
hashed3 = hashlib.sha256(password2.encode()).hexdigest()
print(hashed == hashed3) /* False */

Digital Signatures: Proving It's Really You

RSA can also be used for digital signatures. Proves a message came from you and wasn't tampered with:

1. You hash your message
2. You encrypt the hash with your PRIVATE key (signing)
3. Send: message + encrypted hash
4. Receiver decrypts hash using your PUBLIC key
5. Receiver hashes the message themselves
6. If both hashes match, message is authentic!

Real-World: Aadhaar & Security

India's Aadhaar system uses cryptography to protect 1.3 billion identities:

Data at Rest: Personal data encrypted with AES (symmetric)
Data in Transit: Communication encrypted with HTTPS/TLS
Authentication: RSA digital signatures verify identity
Hashing: Fingerprints hashed for biometric matching

Think About It

If someone steals your Aadhaar data, why can't they just decrypt it and use it to impersonate you? What makes modern encryption so hard to break?

Key Takeaways

• Caesar cipher: simple, easily broken
• Symmetric encryption (AES): same key for encrypt/decrypt, fast but key-sharing challenge
• Asymmetric encryption (RSA): public/private keys, enables secure communication without prior key exchange
• Hashing: one-way, used for passwords and data integrity
• Digital signatures: prove authenticity and non-repudiation
• Modern encryption is practically unbreakable with brute force

Deep Dive: Cryptography: The Science of Secrets

At this level, we stop simplifying and start engaging with the real complexity of Cryptography: The Science of Secrets. In production systems at companies like Flipkart, Razorpay, or Swiggy — all Indian companies processing millions of transactions daily — the concepts in this chapter are not academic exercises. They are engineering decisions that affect system reliability, user experience, and ultimately, business success.

The Indian tech ecosystem is at an inflection point. With initiatives like Digital India and India Stack (Aadhaar, UPI, DigiLocker), the country has built technology infrastructure that is genuinely world-leading. Understanding the technical foundations behind these systems — which is what this chapter covers — positions you to contribute to the next generation of Indian technology innovation.

Whether you are preparing for JEE, GATE, campus placements, or building your own products, the depth of understanding we develop here will serve you well. Let us go beyond surface-level knowledge.

Zero-Trust Architecture and Modern Threat Landscape

Traditional security assumed a trusted internal network ("castle and moat" model). Zero-trust assumes no implicit trust — every request must be verified:

  Traditional (Perimeter-Based):
  ┌─────────────────────────────────────────┐
  │ ████████ FIREWALL ████████              │
  │ ┌─────────────────────────────────────┐ │
  │ │  TRUSTED INTERNAL NETWORK           │ │
  │ │  Everything inside is trusted  ✗    │ │
  │ │  (Lateral movement = game over)     │ │
  │ └─────────────────────────────────────┘ │
  └─────────────────────────────────────────┘

  Zero-Trust Architecture:
  ┌─────────────────────────────────────────┐
  │  Every request verified independently:  │
  │                                         │
  │  User ──▶ [Identity] ──▶ [Device] ──▶  │
  │       ──▶ [Context] ──▶ [Policy] ──▶   │
  │       ──▶ [Access Decision]             │
  │                                         │
  │  Principles:                            │
  │  1. Never trust, always verify          │
  │  2. Least privilege access              │
  │  3. Assume breach                       │
  │  4. Micro-segmentation                  │
  │  5. Continuous monitoring               │
  └─────────────────────────────────────────┘

Modern attacks exploit: supply chain vulnerabilities (SolarWinds), zero-day exploits, social engineering (phishing), and credential stuffing. Defense requires defense-in-depth: WAF (Web Application Firewall), IDS/IPS (Intrusion Detection/Prevention), SIEM (Security Information and Event Management), endpoint detection (EDR), and security orchestration (SOAR). India's CERT-In (Computer Emergency Response Team) coordinates national cybersecurity response and mandates incident reporting within 6 hours of detection.

India's Scale Challenges: Engineering for 1.4 Billion

Building technology for India presents unique engineering challenges that make it one of the most interesting markets in the world. UPI handles 10 billion transactions per month — more than all credit card transactions in the US combined. Aadhaar authenticates 100 million identities daily. Jio's network serves 400 million subscribers across 22 telecom circles. Hotstar streamed IPL to 50 million concurrent viewers — a world record. Each of these systems must handle India's diversity: 22 official languages, 28 states with different regulations, massive urban-rural connectivity gaps, and price-sensitive users expecting everything to work on ₹7,000 smartphones over patchy 4G connections. This is why Indian engineers are globally respected — if you can build systems that work in India, they will work anywhere.

BGP, Autonomous Systems, and Internet Routing at Scale

The internet is not a single network — it is a network of networks, each called an Autonomous System (AS). BGP (Border Gateway Protocol) is the protocol that makes routing between these systems possible:

  Internet Routing Architecture:

  ┌──────────────┐    BGP    ┌───────────────┐    BGP    ┌──────────────┐
  │  Jio (AS55836)│◀════════▶│ Tata Comm     │◀════════▶│ Google       │
  │  400M users   │          │ (AS4755)      │          │ (AS15169)    │
  │  India's      │          │ Global Tier-1 │          │ YouTube,     │
  │  largest ISP  │          │ transit       │          │ Search, etc. │
  └──────┬────────┘          └───────┬───────┘          └──────────────┘
         │                           │
         │ BGP                       │ BGP
         ▼                           ▼
  ┌──────────────┐           ┌───────────────┐
  │ Airtel       │           │ AWS India     │
  │ (AS9498)     │◀═════════▶│ (AS16509)     │
  │ 350M users   │           │ Mumbai,       │
  │              │           │ Hyderabad DCs │
  └──────────────┘           └───────────────┘

  Each AS announces its IP prefixes via BGP:
  "I own 103.24.0.0/16 — route traffic for these IPs to me"

  BGP path selection considers: AS path length, local preference,
  MED (Multi-Exit Discriminator), community tags, and policies

BGP misconfigurations have caused major outages. In 2024, a BGP route leak caused parts of Indian internet traffic to be routed through China — a security concern that highlighted the importance of RPKI (Resource Public Key Infrastructure) for route validation. Understanding BGP is essential for network engineering roles at ISPs, cloud providers, and CDN companies.

Research Frontiers and Open Problems in Cryptography: The Science of Secrets

Beyond production engineering, cryptography: the science of secrets connects to active research frontiers where fundamental questions remain open. These are problems where your generation of computer scientists will make breakthroughs.

Quantum computing threatens to upend many of our assumptions. Shor's algorithm can factor large numbers efficiently on a quantum computer, which would break RSA encryption — the foundation of internet security. Post-quantum cryptography is an active research area, with NIST standardising new algorithms (CRYSTALS-Kyber, CRYSTALS-Dilithium) that resist quantum attacks. Indian researchers at IISER, IISc, and TIFR are contributing to both quantum computing hardware and post-quantum cryptographic algorithms.

AI safety and alignment is another frontier with direct connections to cryptography: the science of secrets. As AI systems become more capable, ensuring they behave as intended becomes critical. This involves formal verification (mathematically proving system properties), interpretability (understanding WHY a model makes certain decisions), and robustness (ensuring models do not fail catastrophically on edge cases). The Alignment Research Center and organisations like Anthropic are working on these problems, and Indian researchers are increasingly contributing.

Edge computing and the Internet of Things present new challenges: billions of devices with limited compute and connectivity. India's smart city initiatives and agricultural IoT deployments (soil sensors, weather stations, drone imaging) require algorithms that work with intermittent connectivity, limited battery, and constrained memory. This is fundamentally different from cloud computing and requires rethinking many assumptions.

Finally, the ethical dimensions: facial recognition in public spaces (deployed in several Indian cities), algorithmic bias in loan approvals and hiring, deepfakes in political campaigns, and data sovereignty questions about where Indian citizens' data should be stored. These are not just technical problems — they require CS expertise combined with ethics, law, and social science. The best engineers of the future will be those who understand both the technical implementation AND the societal implications. Your study of cryptography: the science of secrets is one step on that path.

Key Vocabulary

Here are important terms from this chapter that you should know:

🏗️ Architecture Challenge

Design the backend for India's election results system. Requirements: 10 lakh (1 million) polling booths reporting simultaneously, results must be accurate (no double-counting), real-time aggregation at constituency and state levels, public dashboard handling 100 million concurrent users, and complete audit trail. Consider: How do you ensure exactly-once delivery of results? (idempotency keys) How do you aggregate in real-time? (stream processing with Apache Flink) How do you serve 100M users? (CDN + read replicas + edge computing) How do you prevent tampering? (digital signatures + blockchain audit log) This is the kind of system design problem that separates senior engineers from staff engineers.

The Frontier

You now have a deep understanding of cryptography: the science of secrets — deep enough to apply it in production systems, discuss tradeoffs in system design interviews, and build upon it for research or entrepreneurship. But technology never stands still. The concepts in this chapter will evolve: quantum computing may change our assumptions about complexity, new architectures may replace current paradigms, and AI may automate parts of what engineers do today.

What will NOT change is the ability to think clearly about complex systems, to reason about tradeoffs, to learn quickly and adapt. These meta-skills are what truly matter. India's position in global technology is only growing stronger — from the India Stack to ISRO to the startup ecosystem to open-source contributions. You are part of this story. What you build next is up to you.

Crafted for Class 10–12 • Security & Encryption • Aligned with NEP 2020 & CBSE Curriculum