← IGCSE Computer Science Paper 1

The risk of sharing a symmetric key

If an attacker intercepts a symmetric key while it is being shared, they can decrypt every message that uses that key, so the encryption is defeated.

Part of: IGCSE Computer Science 0478 — 2.3 Encryption — Module 12, ACARA Digital Technologies Years 7–8 — Networks and Cyber Threats — Module 63, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 133, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 23, WA Computer Science ATAR Year 11 — Cyber Security — Module 76

Understanding The risk of sharing a symmetric key in IGCSE Computer Science Paper 1

What it does: Asymmetric encryption avoids the key-sharing problem because only the public key is sent, and the private key stays secret with the receiver. An intercepted symmetric key lets the attacker run decryption themselves, which shows the encryption is defeated. If the key travels over the same network as the data, an attacker watching the network can capture both. Sending the key this way is a security risk. The same key encrypts and decrypts, so anyone who has it can read all messages protected by it. Having the key is all an attacker needs. Any message encrypted with that key can be decrypted, now or in the future.

Common mistakes: The key was sent over the same network as the cipher, so the attacker has intercepted it. They can decrypt the cipher with it. The line should be attacker: DECRYPT(cipher, key). The sender must ENCRYPT the plaintext msg to make the cipher. DECRYPT is for turning ciphertext back into plaintext.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add The risk of sharing a symmetric key to a class →

This module's key terms are also in a printable crossword (Modules 189–203) and word search (Modules 189–217).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Alice sends her symmetric key to Bob over the same network she uses to send the encrypted messages. Is this safe?
Yes, the key is encrypted by the network automaticallyNo, an attacker could intercept the key as well as the data
Matches
send(key) openly; "The key is safe because the data is encrypted"
↓
Wrong: the key itself is not protected by encrypting the data, so an attacker who intercepts it can still decrypt the messages
Applying
Meanings
Term
key interception
Meaning
If an attacker intercepts a symmetric key while it is being shared, they can decrypt every message that uses that key, so the encryption is defeated.
Practice
sharedKey ← "K7"
Testing
Gaps
ciphertext ← ENCRYPT(message, )
Check Answer
Spots
3SEND(cipher, network)
4attacker: CANNOT READ cipher

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Jellyfish' badge — Flow Controller, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Alice sends her symmetric key to Bob over the same network she uses to send the encrypted messages. Is this safe?
A. Yes, the key is encrypted by the network automatically
B. No, an attacker could intercept the key as well as the data ✓
If the key travels over the same network as the data, an attacker watching the network can capture both. Sending the key this way is a security risk.
2. An attacker intercepts a symmetric key while it is being shared. What can they do?
A. Only decrypt the one message that was sent with the key
B. Decrypt every message that uses that key ✓
The same key encrypts and decrypts, so anyone who has it can read all messages protected by it.
3. Which statement about symmetric encryption is correct?
A. The encryption is defeated if the key is intercepted ✓
B. The encryption stays secure even if the key is intercepted
The security of symmetric encryption depends entirely on the key staying secret. Once an attacker has the key, the encryption no longer protects the data.
4. Why is sharing a symmetric key a weakness?
A. The key must be sent to the receiver, so it could be intercepted ✓
B. The key is too short to be used for encryption
The sender and receiver both need the same key, so it has to be shared somehow. That moment of sharing is when an attacker could intercept it.
5. An attacker has intercepted the shared key but has not yet seen any messages. What happens when messages are sent later?
A. The attacker can decrypt them using the stolen key ✓
B. The attacker cannot read them because they missed the key exchange
Having the key is all an attacker needs. Any message encrypted with that key can be decrypted, now or in the future.

Match the Pairs

send(key) over the same network as the data → The key is sent along the same route as the encrypted messages, so an attacker watching the network could capture both
attacker.copy(key) → An attacker intercepts the shared key, so they can decrypt every message that uses it and the encryption is defeated
The weakness of sharing a symmetric key leads to asymmetric encryption, where the public key can be shared openly → encrypt(message, publicKey)
If the key is intercepted, the attacker can decrypt the intercepted data → plaintext = decrypt(ciphertext, stolenKey)
send(key) openly; "The key is safe because the data is encrypted" → Wrong: the key itself is not protected by encrypting the data, so an attacker who intercepts it can still decrypt the messages
attacker steals key; "Only one message is at risk" → Wrong: the same key is used for every message, so an intercepted key lets the attacker decrypt all of them

Key Term

key interception
If an attacker intercepts a symmetric key while it is being shared, they can decrypt every message that uses that key, so the encryption is defeated.

Fill in the Blanks

1. ciphertext ← ENCRYPT(message, key) SEND key OVER network SEND ciphertext OVER network
Hint: Type the variable holding the shared secret that is used to scramble the message
2. SEND key OVER network attacker ← INTERCEPT(network)
Hint: Type the variable for the connection the attacker is listening in on
3. message ← DECRYPT(ciphertext, stolenKey) OUTPUT message
Hint: Type the function name that turns ciphertext back into readable plaintext
4. IF attackerHasKey = TRUE THEN encryptionDefeated ← TRUE ENDIF
Hint: Type the keyword that starts the block of code run when the condition is true
5. SEND publicKey OVER network KEEP privateKey ON recipientDevice
Hint: Type the name of the key that is never sent over the network, which is why asymmetric encryption avoids the sharing problem

Spot the Error

Question 1
A key ← 'K42'
B SEND(key, network)
C SEND(cipher, network)
D attacker: CANNOT READ cipher
Line D — The key was sent over the same network as the cipher, so the attacker has intercepted it. They can decrypt the cipher with it. The line should be attacker: DECRYPT(cipher, key).
Question 2
A key ← 'K42'
B cipher ← DECRYPT(msg, key)
C SEND(cipher, network)
D SEND(key, network)
Line B — The sender must ENCRYPT the plaintext msg to make the cipher. DECRYPT is for turning ciphertext back into plaintext.
Question 3
A key ← 'K42'
B SEND(key, network)
C attackerKey ← NULL
D OUTPUT attackerKey = key
Line C — The key travels over the network, so an attacker can copy it. The line should be attackerKey ← COPY(network). Setting it to NULL ignores the risk.
Question 4
A sharedKey ← 'K42'
B SEND(sharedKey, network)
C risk ← 'key cannot be seen'
D fix ← 'use asymmetric keys'
Line C — Sending the key over the network means it can be intercepted and copied. That is the risk of sharing a symmetric key. The line should say the key can be copied.
Question 5
A pubKey ← SHARE(network)
B cipher ← ENCRYPT(msg, privKey)
C SEND(cipher, network)
Line B — Asymmetric encryption avoids the key-sharing risk. The sender encrypts with the recipient's public key. The private key is never shared. The line should use pubKey.

Student with a class code? Join your class →