For teachers

You can teach how the internet decides whom to trust in a single lesson, with a few padlocks and envelopes, and you may use everything on this site in your classroom.

Who this page is for: teachers of 12 to 18-year-olds, and teachers in adult education. You do not need to be a security expert. Everything you need for one lesson is on this page: a plan, an unplugged activity, discussion questions, an exit ticket and a worksheet with answers.

Why teach PKI?

Every student has seen the padlock next to a web address. Very few know what it promises, or who checked it. PKI (public key infrastructure) is the answer, and it is a great classroom topic:

• It is everywhere. Banking, messaging, school platforms, games and app updates all rely on it.
• It builds real digital literacy. Students learn what the padlock does mean (this connection is encrypted, and the browser checked the website’s certificate for that name) and what it does not mean (that the website is honest or safe).
• It is a puzzle, not a pile of facts. How do two people who have never met agree on a secret, while anyone can read everything they send? Students can discover the answer themselves.
• It works without computers. The core ideas can be acted out with padlocks, boxes and envelopes.

How can I use the material?

Everything here is free, needs no account and has no ads. Analytics cookies are only set if someone clicks “Allow analytics”, so with a class you can simply choose “No thanks”.

• The crash course, lessons 1 to 4. Short lessons that follow the same path as the plan below: Secrets and the sharing problem, Two keys, Fingerprints and signatures and Whose key is it?. Use them as homework before or after the lesson.
• The handbook’s “The idea” sections. Every handbook chapter opens with a plain-language section written for complete beginners. Parts I and II (chapters 1 to 7) suit most classes.
• The cast. Meet the cast: Ken, Rosa, Eve, Mallory and friends, each with the real role they play in PKI. Eve and Mallory are the names cryptographers really use for an eavesdropper and an impostor, which students enjoy.
• The poster. A printable “PKI on one page” for the classroom wall, as an A3 PDF or a PNG.
• The game. PKI Zero to Hero runs in the browser, with no account needed, and teaches the same ideas level by level. The Royal Exam and Levels 1 and 2 are playable now; the other levels are in development.
• The tools, for older students. The certificate decoder shows what is inside a real certificate. Nothing pasted into it leaves the browser.

You may use the material in class, print it and hand it out, as long as you name the source (“PKI Zero to Hero, pkizerotohero.com”). The terms of use have the details.

A 45-minute lesson: who is behind the padlock?

For: ages 12 to 18, and adult learners (see the variations at the end). Computers: one screen for the last ten minutes; the rest is unplugged.

What will students be able to do?

By the end of the lesson, students can:

1. explain why sharing a secret key is hard when anyone can read the messages on the way;
2. describe a key pair: a public key that anyone may have, and a private key that only the owner keeps;
3. explain what a certificate is: a signed statement that a public key belongs to a name, from an authority the browser already trusts;
4. find, in a browser, whom a website’s certificate was issued to and by.

What do I need?

• 3 or 4 small padlocks with their keys (cheap luggage padlocks work);
• 3 or 4 boxes, zip pouches or pencil cases that a padlock can close;
• slips of paper and pens;
• one printed “certificate card” per group (template below), and a stamp or a sticker that only you have;
• a screen with a browser (optional, for the last part);
• the worksheet below, one per student.

No padlocks? Use envelopes and stickers. The receiver hands out stickers showing an open padlock and their name: these are the public key. Sealing an envelope with someone’s sticker means “only this person may open it”, and the receiver keeps a card with the same mark: the private key. Tell the class this is a game rule, not real protection. Real encryption does not depend on people following rules.

How is the lesson timed?

Activity 1: Pass a secret (7 minutes)

Seat Ken and Rosa at opposite ends of the room. Three students sit between them as the post. Secretly, one of the three is Eve, who reads everything that passes.

1. Ken must send Rosa a secret word. Every note must pass through the post, and anyone in the post may read it.
2. Ken and Rosa may use a simple code, such as shifting every letter by a number. But they have not agreed on the number, and every message that agrees it also passes through the post.
3. Ask the class: how can Ken and Rosa agree on the number without Eve seeing it?

What students discover: with one shared key, the hard part is sharing the key. Name it: this is symmetric encryption, and its weak spot is the key-distribution problem.

Activity 2: Open padlocks (15 minutes)

Rosa now has padlocks, and she keeps every key in her pocket.

1. Rosa hands an open padlock to anyone who asks, including Eve.
2. Ken writes his message, puts it in a box and snaps Rosa’s padlock shut. Anyone can close an open padlock.
3. The box travels through the post. Eve can hold it, shake it and look at it, but she cannot open it.
4. Only Rosa, with her key, opens the box.
5. Ask: did Rosa have to send anyone a secret? (No. The padlocks were public. The key never left her pocket.)
6. Repeat in groups of four or five, each with its own Rosa, Ken and Eve.

Name it: the open padlock is Rosa’s public key, the key in her pocket is her private key, and the two together are a key pair.

Activity 3: Whose padlock is it? (8 minutes)

1. Before this part, secretly give one student the role of Mallory, with her own padlock and key.
2. Mallory hands out her padlocks, saying “this is Rosa’s padlock”.
3. Ken locks a message with it. Mallory opens it and reads it.
4. Ask: what went wrong? (Ken used a padlock without knowing whose it was.)
5. Now you become the certificate authority. Rosa shows you her padlock and proves who she is (for example with her student card). You fill in a certificate card for her padlock and stamp it.
6. New rule: Ken only uses a padlock that comes with a card stamped by you, because the whole class agreed at the start to trust your stamp. Mallory can ask for a card in Rosa’s name, but you check who she is and refuse.

Name it: the card is a certificate: a statement that this public key belongs to this name, signed by an authority everyone already trusts. The class agreeing to trust you is like the trust store that comes with every browser and operating system.

CERTIFICATE
Name:          ____________________
Padlock mark:  ____________________
Valid until:   the end of this lesson
Issued by:     ____________________ (the certificate authority)
Signature:     [stamp]

Back to the browser (6 minutes)

1. On the screen, open a well-known website that uses HTTPS.
2. Click the padlock or the site-information icon next to the address, and open the certificate details. The menus differ between browsers, so try it once before the lesson.
3. Find three things: whom the certificate was issued to, who issued it, and when it expires.
4. Ask: who is the certificate authority here? Why does the browser trust it? (Its certificate is already in the trust store that came with the browser or the operating system.)
5. Return to the hook: the padlock means the connection is encrypted and the browser checked the website’s certificate for that name. It does not mean the website is honest or safe.

No screen? Use the certificate decoder with one of its samples on a single laptop, or skip to the worksheet’s last question as homework.

Questions for discussion

Use two or three, as time allows:

1. Eve could see every box but open none. What could she still learn? (Who talks to whom, when, and how often.)
2. Why is it safe for Rosa to give her open padlock to Eve?
3. What happens if Rosa loses her key? What if someone secretly copies it?
4. Why did we trust the teacher’s stamp? Who plays that role for your browser?
5. Why might a certificate have an expiry date?
6. Does the padlock in the browser mean a website is safe to buy from? Why not?

Exit ticket (4 minutes)

Each student answers on a slip of paper and hands it in on the way out:

1. In one sentence: what is the difference between a public key and a private key?
2. What does a certificate say?
3. One question you still have.

Variations

• Ages 12 to 14: keep the browser part short, and use the cast page to recap who is who.
• Ages 15 to 18: add a follow-up lesson on fingerprints and signatures with lesson 3 of the crash course, and ask how the browser checks the authority’s stamp.
• Adult learners: run Activities 2 and 3 quickly and spend more time in the browser and the certificate decoder. Ask who in their workplace renews certificates, and what happens when one expires.

Printable worksheet: who is behind the padlock?

Print this section for each student. Use your browser’s print function; the answer key stays hidden unless you open it.

Name: ______________________ Class: __________

1. Ken and Rosa want to use one shared secret key. What is the problem with sending that key to each other?
2. Fill in the gaps. A key pair has a ____________ key that anyone may have, and a ____________ key that only the owner keeps.
3. True or false: it is safe to give your public key to an eavesdropper. Explain your answer.
4. True or false: a certificate encrypts the website’s data. Explain your answer.
5. In one sentence: what does a certificate say?
6. Who issues certificates? Why does your browser trust them?
7. Mallory hands out her own padlock and says it is Rosa’s. How does a certificate stop this trick?
8. The padlock in your browser tells you: (a) the website is honest; (b) the connection is encrypted and the browser checked the website’s certificate for that name; (c) the website has no viruses. Circle one.
9. Give one reason why certificates expire.
10. Open a website you use and find its certificate. Write down whom it was issued to, who issued it, and when it expires.

Show the answer key (for teachers)

Can I use this in my classroom?

Yes. You may show, print and hand out the pages, the lesson plan and the worksheet, as long as you name the source (“PKI Zero to Hero, pkizerotohero.com”) and do not sell the material. See the terms of use.

Tell us how it went, or what would help you teach it better: info@pkizerotohero.com. Found a mistake? Report it.

Want to know when new levels of the game are released? Notify me.