Cryptography: The Science of Secrets

Imagine you're sending a secret message to your friend. But there's a spy trying to intercept it! Cryptography is the art of writing messages in code so only the intended person can read them. Let's start simple and build up to modern security.

Caesar Cipher: The Oldest Trick in the Book

Julius Caesar used this 2,000 years ago. The idea: shift each letter by a fixed number.

With a shift of 3:
A → D, B → E, C → F, ..., X → A, Y → B, Z → C

Plain text: HELLO
Cipher text: KHOOR

H → K (shift 3)
E → H (shift 3)
L → O (shift 3)
L → O (shift 3)
O → R (shift 3)

def caesar_cipher(text, shift):
 result = ''
 for char in text:
 if char.isalpha():
 ascii_offset = 65 if char.isupper() else 97
 shifted = (ord(char) - ascii_offset + shift) % 26
 result += chr(shifted + ascii_offset)
 else:
 result += char
 return result

plain = 'HELLO WORLD'
encrypted = caesar_cipher(plain, 3)
print(encrypted) /* KHOOR ZRUOG */

/* To decrypt, shift back by -3 */
decrypted = caesar_cipher(encrypted, -3)
print(decrypted) /* HELLO WORLD */

Problem: Only 26 possible shifts. A computer can crack it in milliseconds!

Symmetric Encryption: Same Key for Both

Both sender and receiver have the SAME secret key. Like a lock and key — only you and your friend have the key.

Example: AES (Advanced Encryption Standard)

AES is modern, military-grade encryption. Banks use it. Your encrypted passwords use it. Here's how:

Key: mysecretpassword123
Plain text: 'Transfer 10,000 rupees to Amit'
Encrypted text: (random-looking gibberish)

To decrypt, you need the exact same key.
Without it, it's mathematically impossible (practically) to crack.

Python Example (Using the cryptography library)

from cryptography.fernet import Fernet

/* Generate a key (keep it secret!) */
key = Fernet.generate_key()
print(key) /* Something like b'SomeRandom...Base64EncodedKey' */

cipher = Fernet(key)

/* Encrypt */
plain_text = b'My bank account: 98765432'
encrypted = cipher.encrypt(plain_text)
print(encrypted) /* Random gibberish */

/* Decrypt (only with the original key) */
decrypted = cipher.decrypt(encrypted)
print(decrypted) /* b'My bank account: 98765432' */

/* Without the key, it's unreadable! */
wrong_key = Fernet.generate_key()
wrong_cipher = Fernet(wrong_key)
try:
 wrong_cipher.decrypt(encrypted) /* Fails! */
except:
 print('Wrong key! Cannot decrypt.')

Problem with Symmetric: How do you share the secret key without someone stealing it?

Asymmetric Encryption: Public & Private Keys

Instead of one key, you have TWO:

Public Key: Share freely! Anyone can use it to encrypt messages to you.
Private Key: Keep secret! Only you have it. Used to decrypt messages meant for you.

It's like a mailbox. Anyone can drop letters in (using your public key), but only you with your private key can open and read them.

How RSA Works (Simplified)

1. Generate two prime numbers: p = 61, q = 53
2. Compute n = p * q = 3233 (part of public key)
3. Generate public and private exponents
4. Public key: (n=3233, e=17)
5. Private key: (n=3233, d=2753)

To encrypt:
 cipher = (message ^ e) mod n

To decrypt:
 message = (cipher ^ d) mod n

Without knowing d (the private key), you can't decrypt!

/* Python Example with RSA */
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization
from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import hashes

/* Generate key pair */
private_key = rsa.generate_private_key(
 public_exponent=65537,
 key_size=2048,
)
public_key = private_key.public_key()

/* Alice encrypts a message using Bob's public key */
message = b'Secret message for Bob'
encrypted = public_key.encrypt(
 message,
 padding.OAEP(
 mgf=padding.MGF1(algorithm=hashes.SHA256()),
 algorithm=hashes.SHA256(),
 label=None
 )
)

/* Bob decrypts using his private key */
decrypted = private_key.decrypt(
 encrypted,
 padding.OAEP(
 mgf=padding.MGF1(algorithm=hashes.SHA256()),
 algorithm=hashes.SHA256(),
 label=None
 )
)

print(decrypted) /* b'Secret message for Bob' */

Why This is Magic: Alice doesn't need to share a secret with Bob beforehand! She just uses his public key.

Hashing: One-Way Encryption

Unlike encryption, hashing is one-way. You can't decrypt it back to the original. But the same input always produces the same hash.

Use case: Password storage. Websites don't store your password. They store its hash.

Your password: "MySecurePass123"
Stored hash: "a1b2c3d4e5f6..." (using SHA-256)

When you log in:
1. You enter: "MySecurePass123"
2. Website hashes it: "a1b2c3d4e5f6..."
3. Matches stored hash? Login success!

If a hacker steals the hash, they can't reverse it to get your password!

import hashlib

password = 'MySecurePass123'
hashed = hashlib.sha256(password.encode()).hexdigest()
print(hashed)
/* Output: 3a5e... (fixed-length hash) */

/* Same password always produces same hash */
hashed2 = hashlib.sha256(password.encode()).hexdigest()
print(hashed == hashed2) /* True */

/* Different password = completely different hash */
password2 = 'MySecurePass124'
hashed3 = hashlib.sha256(password2.encode()).hexdigest()
print(hashed == hashed3) /* False */

Digital Signatures: Proving It's Really You

RSA can also be used for digital signatures. Proves a message came from you and wasn't tampered with:

1. You hash your message
2. You encrypt the hash with your PRIVATE key (signing)
3. Send: message + encrypted hash
4. Receiver decrypts hash using your PUBLIC key
5. Receiver hashes the message themselves
6. If both hashes match, message is authentic!

Real-World: Aadhaar & Security

India's Aadhaar system uses cryptography to protect 1.3 billion identities:

Data at Rest: Personal data encrypted with AES (symmetric)
Data in Transit: Communication encrypted with HTTPS/TLS
Authentication: RSA digital signatures verify identity
Hashing: Fingerprints hashed for biometric matching

Think About It

If someone steals your Aadhaar data, why can't they just decrypt it and use it to impersonate you? What makes modern encryption so hard to break?

Key Takeaways

• Caesar cipher: simple, easily broken
• Symmetric encryption (AES): same key for encrypt/decrypt, fast but key-sharing challenge
• Asymmetric encryption (RSA): public/private keys, enables secure communication without prior key exchange
• Hashing: one-way, used for passwords and data integrity
• Digital signatures: prove authenticity and non-repudiation
• Modern encryption is practically unbreakable with brute force

From Concept to Reality: Cryptography: The Science of Secrets

In the professional world, the difference between a good engineer and a great one often comes down to understanding fundamentals deeply. Anyone can copy code from Stack Overflow. But when that code breaks at 2 AM and your application is down — affecting millions of users — only someone who truly understands the underlying concepts can diagnose and fix the problem.

Cryptography: The Science of Secrets is one of those fundamentals. Whether you end up working at Google, building your own startup, or applying CS to solve problems in agriculture, healthcare, or education, these concepts will be the foundation everything else is built on. Indian engineers are known globally for their strong fundamentals — this is why companies worldwide recruit from IITs, NITs, IIIT Hyderabad, and BITS Pilani. Let us make sure you have that same strong foundation.

Hashing, Digital Signatures, and Authentication

Hashing is a one-way function: it converts any input into a fixed-length string, but you cannot reverse it to get the original input. This is critical for password storage:

# Password hashing — what websites SHOULD do
import hashlib

password = "MySecurePass@2026"
salt = "random_unique_per_user_string"

# Hash the password (one-way — cannot be reversed)
hashed = hashlib.sha256((salt + password).encode()).hexdigest()
# Result: "a3f2e8c1b4d7..." (64 hex characters)

# When user logs in:
# 1. Take their entered password
# 2. Hash it with the same salt
# 3. Compare hashes — if they match, password is correct!
# 4. The actual password is NEVER stored anywhere

# NEVER do this:
stored_password = "MySecurePass@2026"  # ❌ Plain text!
# If database is hacked, all passwords are exposed!

# Real-world: Use bcrypt or Argon2 (deliberately slow)
# bcrypt adds work factor — takes 100ms instead of 1μs
# This makes brute-force attacks impractical

India's Aadhaar system uses a similar principle for biometric authentication. Your fingerprint is converted into a mathematical template (hash), and only the template is stored — not the raw fingerprint image. When you authenticate, a new template is generated and compared. This is why Aadhaar can verify 1.4 billion identities without storing actual biometric data in a reversible format.

Real-World System Design: Swiggy's Architecture

When you order food on Swiggy, here is what happens behind the scenes in about 2 seconds: your location is geocoded (algorithms), nearby restaurants are queried from a spatial index (data structures), menu prices are pulled from a database (SQL), delivery time is estimated using ML models trained on historical data (AI), the order is placed in a distributed message queue (Kafka), a delivery partner is assigned using a matching algorithm (optimization), and real-time tracking begins using WebSocket connections (networking). EVERY concept in your CS curriculum is being used simultaneously to deliver your biryani.

The TCP/IP Protocol Stack

Network communication is organised in layers, each handling a specific responsibility. This layered architecture is what makes the internet work across billions of different devices:

  ┌────────────────────────────────────────────────────┐
  │ APPLICATION LAYER (HTTP, HTTPS, SMTP, DNS, FTP)    │
  │ "I want to view bharath.ai"                        │
  ├────────────────────────────────────────────────────┤
  │ TRANSPORT LAYER (TCP or UDP)                       │
  │ TCP: Reliable, ordered (web pages, emails)         │
  │ UDP: Fast, no guarantees (video calls, gaming)     │
  ├────────────────────────────────────────────────────┤
  │ NETWORK LAYER (IP — Internet Protocol)             │
  │ Addressing + routing: "Send to 76.76.21.9"        │
  ├────────────────────────────────────────────────────┤
  │ LINK LAYER (Ethernet, Wi-Fi, 4G/5G)               │
  │ Physical transmission: electrical signals, radio   │
  └────────────────────────────────────────────────────┘

  Analogy: Sending a letter
  Application = Writing the letter content
  Transport   = Putting it in an envelope, tracking number
  Network     = Address: "123 MG Road, Bangalore 560001"
  Link        = The postman physically walking to deliver it

When you browse a website, your request travels DOWN this stack (application → transport → network → link), crosses the internet, then travels UP the stack on the server side. The response makes the reverse journey. Each layer adds its own header (encapsulation), creating a layered "envelope within envelope" structure. This is the foundation of all internet communication — from Jio's 5G network to ISRO's deep space communication with Chandrayaan.

Production Engineering: Cryptography: The Science of Secrets at Scale

Understanding cryptography: the science of secrets at an academic level is necessary but not sufficient. Let us examine how these concepts manifest in production environments where failure has real consequences.

Consider India's UPI system processing 10+ billion transactions monthly. The architecture must guarantee: atomicity (a transfer either completes fully or not at all — no half-transfers), consistency (balances always add up correctly across all banks), isolation (concurrent transactions on the same account do not interfere), and durability (once confirmed, a transaction survives any failure). These are the ACID properties, and violating any one of them in a payment system would cause financial chaos for millions of people.

At scale, you also face the thundering herd problem: what happens when a million users check their exam results at the same time? (CBSE result day, anyone?) Without rate limiting, connection pooling, caching, and graceful degradation, the system crashes. Good engineering means designing for the worst case while optimising for the common case. Companies like NPCI (the organisation behind UPI) invest heavily in load testing — simulating peak traffic to identify bottlenecks before they affect real users.

Monitoring and observability become critical at scale. You need metrics (how many requests per second? what is the 99th percentile latency?), logs (what happened when something went wrong?), and traces (how did a single request flow through 15 different microservices?). Tools like Prometheus, Grafana, ELK Stack, and Jaeger are standard in Indian tech companies. When Hotstar streams IPL to 50 million concurrent users, their engineering team watches these dashboards in real-time, ready to intervene if any metric goes anomalous.

The career implications are clear: engineers who understand both the theory (from chapters like this one) AND the practice (from building real systems) command the highest salaries and most interesting roles. India's top engineering talent earns ₹50-100+ LPA at companies like Google, Microsoft, and Goldman Sachs, or builds their own startups. The foundation starts here.

Key Vocabulary

Here are important terms from this chapter that you should know:

💡 Interview-Style Problem

Here is a problem that frequently appears in technical interviews at companies like Google, Amazon, and Flipkart: "Design a URL shortener like bit.ly. How would you generate unique short codes? How would you handle millions of redirects per second? What database would you use and why? How would you track click analytics?"

Think about: hash functions for generating short codes, read-heavy workload (99% redirects, 1% creates) suggesting caching, database choice (Redis for cache, PostgreSQL for persistence), and horizontal scaling with consistent hashing. Try sketching the system architecture on paper before looking up solutions. The ability to think through system design problems is the single most valuable skill for senior engineering roles.

Where This Takes You

The knowledge you have gained about cryptography: the science of secrets is directly applicable to: competitive programming (Codeforces, CodeChef — India has the 2nd largest competitive programming community globally), open-source contribution (India is the 2nd largest contributor on GitHub), placement preparation (these concepts form 60% of technical interview questions), and building real products (every startup needs engineers who understand these fundamentals).

India's tech ecosystem offers incredible opportunities. Freshers at top companies earn ₹15-50 LPA; experienced engineers at FAANG companies in India earn ₹50-1 Cr+. But more importantly, the problems being solved in India — digital payments for 1.4 billion people, healthcare AI for rural areas, agricultural tech for 150 million farmers — are some of the most impactful engineering challenges in the world. The fundamentals you are building will be the tools you use to tackle them.

Crafted for Class 7–9 • Security & Encryption • Aligned with NEP 2020 & CBSE Curriculum