The Mathematics Behind Cryptography
A simple substitution cipher, where each letter is swapped for another, has 26! possible keys. That's about 403,291,461,126,605,635,584,000,000, or 4 × 10²⁶. Trying one key per nanosecond, you'd need more than 12 billion years to test them all.
Yet this cipher was broken more than a thousand years ago by a scholar with nothing but patience and a tally of letters. The lesson that launched modern cryptography: a huge number of keys doesn't make a cipher secure. Only mathematics does.
Security Shouldn't Depend on Secrecy
You might think the safest cipher is one nobody knows about. Cryptographers believe the opposite.
In 1883, Dutch cryptographer Auguste Kerckhoffs set out principles for military ciphers. The most famous is now called Kerckhoffs's principle: a system should remain secure even if everything about it, except the key, is public.
Claude Shannon later restated it as "the enemy knows the system." Every modern standard, from AES to RSA, is published in full and attacked openly by researchers. Security that survives public scrutiny is the only kind anyone trusts.
Era 1: Shift and Substitution Ciphers
The Caesar cipher shifts every letter by a fixed amount. With a shift of 3, A becomes D, B becomes E, and so on. In modern notation it's modular arithmetic:
Encrypt: C = (P + k) mod 26
Decrypt: P = (C − k) mod 26
There are only 25 useful keys, so you can simply try them all. That's a brute-force attack.
A general substitution cipher, with any letter mapped to any other, has 26! keys, far too many to brute-force by hand.
Era 2: Frequency Analysis
In the 9th century, the Arab polymath Al-Kindi wrote A Manuscript on Deciphering Cryptographic Messages, the earliest known description of frequency analysis.
His insight: languages use letters unevenly. In English, E appears about 12.7% of the time, T about 9.1%, and A about 8.2%. A substitution cipher disguises letters but not their frequencies. Count the symbols in the ciphertext, match the most common ones to E, T and A, and the message starts to unravel.
This is statistics as a weapon. It's why security has to come from mathematics that hides patterns completely, not just from a large key space.
Era 3: The Perfect Cipher
Is unbreakable encryption possible? Yes, and it's been mathematically proven.
The one-time pad combines each character of a message with a truly random key character of the same length, used only once. In binary it's the XOR operation:
Ciphertext = Plaintext ⊕ Key
Plaintext = Ciphertext ⊕ Key
In a paper declassified and published in 1949, "Communication Theory of Secrecy Systems," Claude Shannon proved the one-time pad has perfect secrecy: the ciphertext reveals nothing at all about the message. Every plaintext of that length is equally likely.
The catch is practical. The key must be as long as the message, truly random, shared in advance, and never reused. That makes one-time pads unworkable for most internet traffic.
Era 4: Modern Symmetric Ciphers
The Advanced Encryption Standard (AES), adopted by the U.S. National Institute of Standards and Technology in 2001, protects most encrypted data today, from Wi-Fi to disk encryption.
AES works on 128-bit blocks through repeated rounds of substitution, row shifting, column mixing and key addition. Its column mixing step is multiplication in a finite field called GF(2⁸), an arithmetic system with exactly 256 elements.
A 128-bit key has:
2¹²⁸ ≈ 3.4 × 10³⁸ possible keys
At a trillion guesses per second, trying them all would take about 10¹⁹ years, roughly a billion times the age of the universe. You can see how powers of 2 grow on the base 2 to base 10 converter.
Era 5: Public-Key Cryptography
Symmetric ciphers have one big problem: both sides need the same secret key. How do you share it with a website you've never visited?
In 1976, Whitfield Diffie and Martin Hellman showed that two parties could agree on a shared secret over a public channel. In 1977, Ron Rivest, Adi Shamir and Leonard Adleman published RSA, based on the difficulty of factoring the product of two large prime numbers.
Multiplying two primes is easy. Recovering them from the product is extremely hard. A modern 2048-bit RSA modulus has 617 decimal digits. You can feel the asymmetry with the prime factorization tool: small numbers factor instantly, but the difficulty climbs steeply with size.
Two Concepts Worth Knowing
Modular Arithmetic
Modular arithmetic is "clock arithmetic": numbers wrap around after reaching the modulus. 15 mod 12 = 3. Nearly every cipher, from Caesar to RSA, relies on it, because it scrambles values while keeping operations reversible for someone who knows the key.
One-Way Functions
A one-way function is easy to compute but practically impossible to reverse. Multiplying primes, modular exponentiation and cryptographic hashing are all believed to be one-way. No one has proven that true one-way functions exist. Doing so would settle the famous P vs. NP question.
Quick Answer: What Math Is Used in Cryptography?
Cryptography relies on modular arithmetic, number theory (especially prime numbers), probability and statistics, and algebra over finite fields. Symmetric ciphers like AES scramble data with a shared key, while public-key systems like RSA rely on problems such as factoring large numbers that are easy to set up but hard to reverse.
Try Them Yourself
- Prime Numbers: the building blocks of RSA
- Prime Factorization: see why factoring gets hard
- Prime Checker: test whether a number is prime
- Base 2 to Base 10 Converter: how computers store keys
- Number Theory Formulas: modular arithmetic and more
- Alan Turing and the Turing Machine: the codebreaker behind modern computing
Encrypt a short message with a Caesar shift, then count letter frequencies to break it. In a few minutes you'll have repeated Al-Kindi's thousand-year-old discovery.