中文（繁體）
中文（简体）
English
DSE ICT | Network Security and Encryption Lesson-Prep Guide (Tutor Edition) | RSA Parameters, Key Counts and TLS
Students can say encryption means safe, yet cannot say why HTTPS needs two kinds of key. This lesson turns security into countable costs.
Objectives — Students can: (1) distinguish symmetric from asymmetric encryption and compute n(n-1)/2 keys for ten users; (2) derive n = 3233 and phi = 3120 from p and q, and verify that e = 17 and d = 2753 are inverses modulo phi; (3) explain what hashing, digital signatures and certificates each do in a TLS handshake, and why 2^56 keys take 2.28 years at a billion tries per second.
01 Prerequisites (3-minute check)
If any of these fails, fix it before the lesson starts.
| Skill | Quick check | Pass mark |
|---|---|---|
| Prime numbers | Are 61 and 53 prime | Yes, each divides only by 1 and itself |
| Modular arithmetic | What is 17 x 2753 modulo 3120 | 1 |
| Powers of two | Roughly how large is 2^10 | 1024, about one thousand |
02 Lesson flow (60 minutes)
| Time | Stage | Tutor does | Student does |
|---|---|---|---|
| 0-10 min | Three keys, three problems | Confidentiality, integrity, authentication | One failure example each |
| 10-22 min | Symmetric encryption | One key, n(n-1)/2 keys in a group | Compute 45 keys |
| 22-34 min | Asymmetric and RSA | p, q, n, phi, e and d | Compute 3233 and 3120 |
| 34-44 min | Hashing and signatures | One-way digest, signature with private key | Separate the two ideas |
| 44-54 min | TLS handshake | Verify identity, negotiate, exchange, switch | Put four steps in order |
| 54-60 min | Exit check | Three questions marked on the spot | All three right |
03 Teaching script (read it out)
Scene 1: Symmetric and asymmetric are two kinds of cost
Symmetric encryption such as AES uses one key for both directions. It is fast and suits bulk data, but key distribution does not scale: ten users communicating pairwise need 10 x 9 / 2 = 45 distinct keys; a hundred users need 4,950.
Asymmetric encryption such as RSA uses a public key to encrypt and a private key to decrypt, so n users need only 2n keys, but the arithmetic is orders of magnitude slower, which is why it only opens the conversation.
RSA parameters: p = 61 and q = 53 give n = 3233 and phi = 60 x 52 = 3120. Choose e = 17, coprime with phi, then d = 2753, because 17 x 2753 = 46,801 leaves remainder 1 modulo 3120.
Publish (n, e) and keep d. The numbers only demonstrate the mechanism: real systems use 2048 bits or more, since 3233 factors in an evening.
Asymmetric encryption such as RSA uses a public key to encrypt and a private key to decrypt, so n users need only 2n keys, but the arithmetic is orders of magnitude slower, which is why it only opens the conversation.
RSA parameters: p = 61 and q = 53 give n = 3233 and phi = 60 x 52 = 3120. Choose e = 17, coprime with phi, then d = 2753, because 17 x 2753 = 46,801 leaves remainder 1 modulo 3120.
Publish (n, e) and keep d. The numbers only demonstrate the mechanism: real systems use 2048 bits or more, since 3233 factors in an evening.
Ask students: why ten users need 45 symmetric keys but only 20 asymmetric ones (one public and one private key each).
Scene 2: Hashing proves integrity, signatures prove identity
A hash such as SHA-256 compresses any input into a fixed 256-bit digest. It is one-way, so the digest cannot be reversed, and changing one character changes everything. It provides no secrecy, only proof that nothing changed.
A digital signature encrypts that digest with the sender private key. The receiver decrypts with the sender public key and compares digests: a match proves both integrity and identity.
Key length sets the cost of brute force: 2^56 keys at a billion attempts per second take about 2.28 years; 2^128 is beyond reach.
A certificate (X.509) answers whether a public key really belongs to that domain, because a trusted certificate authority signs the binding. Without it, a man in the middle simply substitutes a key.
A digital signature encrypts that digest with the sender private key. The receiver decrypts with the sender public key and compares digests: a match proves both integrity and identity.
Key length sets the cost of brute force: 2^56 keys at a billion attempts per second take about 2.28 years; 2^128 is beyond reach.
A certificate (X.509) answers whether a public key really belongs to that domain, because a trusted certificate authority signs the binding. Without it, a man in the middle simply substitutes a key.
Ask students: the biggest difference between a hash and encryption (irreversible and not secret, versus reversible and secret).
Scene 3: The TLS handshake stitches the two methods together
Step one, the client sends ClientHello with supported versions, cipher suites and a random number. Step two, the server replies with ServerHello, its certificate and another random number. Step three, the client verifies the signature and the domain, then encrypts a pre-master secret with the public key in the certificate. Step four, both sides derive the same session key from the three random values and switch to symmetric encryption for the actual data.
The design logic is therefore: slow asymmetric cryptography solves key distribution, fast symmetric cryptography carries the data.
Subnetting example: 192.168.10.0/26 has 2^(32-26) = 64 addresses, 62 usable hosts, so one /24 splits into 4 such subnets. Firewall rules should be written per subnet, not per machine.
A common error is treating HTTPS as proof of safety: expired certificates, unknown issuers or a vulnerable site all still show a padlock.
The design logic is therefore: slow asymmetric cryptography solves key distribution, fast symmetric cryptography carries the data.
Subnetting example: 192.168.10.0/26 has 2^(32-26) = 64 addresses, 62 usable hosts, so one /24 splits into 4 such subnets. Firewall rules should be written per subnet, not per machine.
A common error is treating HTTPS as proof of safety: expired certificates, unknown issuers or a vulnerable site all still show a padlock.
Ask students: why not encrypt everything asymmetrically (too slow), and why not everything symmetrically (no safe way to distribute keys).
04 Question types and worked steps
| Type | Example | Steps | Answer |
|---|---|---|---|
| Calculation | Number of symmetric keys | n(n – 1) / 2 | 45 for ten users |
| Calculation | RSA parameters | n = p x q, phi = (p-1)(q-1), e x d mod phi = 1 | 3233, 3120, 2753 |
| Calculation | Brute-force time | keys / attempts per second / seconds in a year | 2.28 years |
| Explanation | Purpose of each TLS step | Verify, negotiate, exchange, switch | Order matters |
Sanity check (teach this): n is the product of two primes while phi is (p-1)(q-1); confusing them ruins the whole question.
e must be coprime with phi, otherwise no inverse exists.
The test for d is e x d mod phi = 1, not e x d = phi.
A hash is one-way, so a digest cannot be decrypted; any claim that it can is wrong.
A /26 has 62 usable hosts, not 64, because the network and broadcast addresses are reserved.
e must be coprime with phi, otherwise no inverse exists.
The test for d is e x d mod phi = 1, not e x d = phi.
A hash is one-way, so a digest cannot be decrypted; any claim that it can is wrong.
A /26 has 62 usable hosts, not 64, because the network and broadcast addresses are reserved.
05 Independent practice (3 questions)
| Question | Answer | What to watch |
|---|---|---|
| Symmetric keys needed by ten users | 45 keys | 10 x 9 / 2 |
| n and phi when p = 61 and q = 53 | 3233 and 3120 | 61 x 53 and 60 x 52 |
| Usable hosts in 192.168.10.0/26 | 62 | 64 – 2 |
06 Common mistakes and what to say
| Mistake | Student writes | Say this |
|---|---|---|
| Using n where phi belongs | Answering that phi is 3233 | phi is (p-1)(q-1) = 3120; n is p x q. |
| Believing a hash can be reversed | Answering that a hash is decrypted with a password | A hash is one-way and only supports comparison. |
| Signing with the public key | Answering that the sender signs with the public key | Sign with the private key and verify with the public key; reversed means no signature. |
| Equating HTTPS with safety | Answering that a padlock proves a site is safe | Check the issuer, the expiry date and the site itself. |
07 Homework (paper, section and question numbers)
- Secondary ICT chapter index — All chapters and practice
- Secondary lesson-prep overview — Compare other subjects
08 Exit check (last 5 minutes)
| Question | Answer | Decision |
|---|---|---|
| Symmetric keys for ten users | 45 | All three right means move to protocols |
| phi when p = 61 and q = 53 | 3120 | One wrong means redo phi |
| What TLS step three does | Encrypt the pre-master secret | Two wrong means repeat act three |
09 Tutor FAQ
Must students reproduce the RSA proof?
No. They must compute n and phi, verify e x d mod phi = 1, and explain the one-way function.
Is AES safer than RSA?
They have different security models. AES is fast and RSA solves key distribution, so practice uses both.
Will quantum computers break RSA?
They threaten factoring, which is why post-quantum schemes are being deployed; DSE only needs the direction of risk.
Find a tutor — freeTutor Registration →
A TutorZone lesson-prep guide. Written by the TutorZone team; questions and lesson flow are original and are not taken from any school or publisher material.
