How can I demonstrate SSL/TLS to 10 year olds?

Question

I'm a software engineer with a particular skew on information security and DRM; I have a good understanding of the implementation (and some of the maths).

My son's school are doing about information security and staying safe online at the moment. One of the topics they will cover is http vs. https and his teacher has asked if I can come in and help facilitate. I'd like to find a really simple way of demonstrating key-pair encryption using something like a tin can telephone to demonstrate how easy it is for Eve to listen in on Bob and Alice by just attaching a third tin can to the string, followed by a (very rudimentary) tls handshake over tin can telephone to then send an encrypted message. Ideally they'd encrypt the message in a suitably lo-fi way (pen and paper, calculator).

How might I go about it?

Answer 1

This has no analog in Information Security as far as I know however I always thought it was a cool way to show how something could be delivered to Bob from Alice over an unsecured channel.

Alice puts her message in a box, locks the box and sends it to Bob over an insecure postal system. (The postage system cannot view the contents of the box since Alice has locked it.) Bob receives the box but cant unlock it. Bob then adds his own padlock to the box and sends it back to Alice. Alice then removes her padlock and sends it back to Bob. Now bob can unlock the box without any MITM being able to view the contents.

Answer 2

A lesson or activity on the topic 'HTTP vs HTTPS" for 10 years old is not a lesson about cryptography. It's about privacy and staying "safe" on the web.

The EFF has a good educational material about HTTPS and Tor that you can use as inspiration (Tor is out of scope, but the part about HTTPS is relevant). The point is to explain the threats and how using HTTPS mitigates them.

As a demo, you can set up a wifi network and a laptop with Firesheep or another tool that visually displays HTTP interceptions: You can ask the kids to use their smartphones to browse websites in HTTP and compare with websites in HTTPS.

If you want to go into the details, you can tell that TLS guaranties the confidentiality, authenticity and integrity of the data coming from and to the websites. Explain those 3 words.

If you start talking about encryption keys or maths, you are going to far. But you may try to convince the teachers to do a second talk about the history of cryptography and cryptanalysis (it's usually a good way to introduce the topic).

Answer 3

For authentication it would be easy enough to show -

• Client sends a message to server asking to connect
• Server sending back a piece of paper with its signature also signed by trusted third party (the teacher?).
• Client checks the teachers signature against its own copy. It now trusts the server.

You could then explain a man in the middle. I.e. the server can now sign all of its messages to prove it sent them. But the client has no way to prove its own messages to the server - so [other person] can change the clients message in passage. They can also read the messages from the server.

The best way i've found to describe public/private key cryptography to less technically minded people is to split it into two processes.

• Sending a message to someone encrypted with their public key is like posting a letter through a locked postbox. Anyone can post the letter but only the owner has the keys to open it and read the message.

• Signing a message with a private key is like having a locked display case. Again only the owner has the key. So you know anything in there was put there by them.

With a little woodwork and a couple of sheets of perspex it should be easy enough to throw together the above.

Diffie-Hellman is a bit harder. Unless your son is a mid-teen I imagine you might not want to go into any real detail here.

As for letting them try their own encryption a simple method would be a substitution cipher. Print out maps of characters in advance. If you wanted to demonstrate why these are no longer secure you could use frequency analysis to break a long message in front of them (either by hand or with software).

Answer 4

The lock box analogy

One of the most powerful ways to leave an impression on children is to show them, through demonstration, that an idea which they likely hold as self-evident common sense is completely false. In this case, the idea that all bets are off if you are passing a secret message to someone via a curious or malicious messenger.

I find that many kids and people not generally security-savvy tend to have the hardest problem understanding asymmetric cryptography. It's easy enough to trust that a password can be used to scramble data, but idea that two people can exchange a shared secret in a hostile communication medium is not at all intuitive. An analogy I have used successfully exploits the one-way behavior of common locks (i.e. anyone can lock it, but only those with the corresponding key can unlock it).

A hands-on demonstration

It's useful here to describe how a shared secret can be communicated, using a hands-on approach. I wouldn't make it particular to TLS (as the handshake involves a lot more), but rather general among all asymmetric ciphers. You play Alice, one kid plays Bob, and the other plays Eve. Tell the kid playing Bob that his goal is to communicate with you in secrecy without letting Eve know what you are saying, despite Eve being the one passing the messages along. The demonstration is simple:

• Give an unlocked lock box (but not the key!) to Eve and tell her to pass it to Bob.

• Have Bob write down a secret note, put it in the lock box, and close the lock.

• Have Bob give the lock box back to Eve and ask her to pass it back to you (Alice).

• Use the key to unlock the lock box and look at the note.

• Encrypt a message with a simple substitution cipher, using the note as the key.

• Give the encrypted message to Eve and ask her to pass it to Bob.

• Let Bob decrypt the message. Talk back and forth a few times using the shared secret.

You can skip the substitution cipher part if you're short on time, and instead focus on the fact that you managed to share a secret without Eve being able to figure out what it is, but explaining the basics of symmetric cryptography may still help kids understand the theory behind it better than just telling them to trust that a short secret value can be used to reversibly scramble a larger message.

Man-in-the-middle attacks

If you're lucky, a clever kid might ask why Eve can't just swap the unlocked box with one she owns, in which case you get a useful opportunity to explain MITM attacks and digital signatures. The solution becomes easier to understand when they have a real-life analogy of a trapdoor function: something that is easy to verify, but hard to forge. A written signature fits this perfectly. I don't think there's a need to explain certificates or CAs. Just make it general to all digital signatures, so their understanding will apply equally to TLS, signed executables, or GnuPG.

Perhaps also mention that browsers will give you an indication when this process fails, since a misunderstanding of that is commonly exploited in phishing attempts.

What Eve represents

You may have to explain that connecting to a website requires servers in between to pass the data back and forth. While it may be obvious to us, a 10 year old may think that your computer communicating with any website naturally involves a direct connection, with no entity in between. Explaining that there are computers you may not trust in between you and the destination will let them better understand what Eve represents.

You can expand on this a bit by mentioning that the one passing the messages back and forth isn't necessarily malicious. Eve can very well just be someone snooping on the messenger (sniffing Wi-Fi, or using another person's router, for example).

Stronger cryptography

While it may be out of scope, you could show how such simple substitution ciphers can be broken, and then give them something like sending you an encrypted Solitaire message as homework (or suggesting that to the teacher, if you don't have the authority to distribute homework), so they can see what a cryptographically strong, albeit toy, cipher is like. It can leave a strong impression on a child to know that no one knows how to break a message that they encrypted with their own hands! A sense of power while learning is very appealing to children.

Bonus points for using the names Alice, Bob, and Eve in your discussions. ;)

Answer 5

You might want to cover something the kids can do hands-on, and then segue into SSL/TLS types of encryption. For example, perhaps show them the Cesearan Cypher, then Vigenere, etc. and let them do them by hand. Then cover how a more complex cipher uses a longer key, and so on, to secure their information from anyone by being very hard to guess.

Answer 6

Here is something to consider:

• Give them computers and instruct them to browse a site without SSL / TLS where they have to type some text in a text box and submit the data.

• Show them how you were able to intercept all their data they sent and explain how dangerous that could be if they entered a password.

• Now repeat it again but with an SSL / TLS site. Show how no one is able to view what data they sent - not even the people running the website.

They will now understand that when dealing with sensitive information online, they should always make sure that the website is using HTTPS.