The maths that guards the internet
Why encryption works, why quantum computers threaten it, and what happens next. Five short modules; high-school maths is plenty.
One-way streets
Every padlock you see in your browser is a maths problem. This module is about what kind of problem.
Which sum would you rather do?
13 × 17 = ?
? × ? = 391
(two whole numbers, both bigger than 1)
Same relationship between three numbers. Opposite directions. One is a stroll; the other is a search.
You already know one-way processes
Scramble an egg
Thirty seconds with a fork. Now un-scramble it.
Mix two paints
One stir and they're blended. Now separate the original colours back out.
Multiply two primes
Instant, even for enormous numbers. Now, given only the answer, find the primes.
Easy to do, hard to undo. Mathematicians call these one-way functions, and the third one runs the internet.
"Hard" never means impossible. It means slow.
A computer trying a billion keys every second, running since the Big Bang, would so far have checked roughly 0.000…(nearly 600 more zeros)…1 percent of them. Figures illustrative of a 2,048-bit key.
Hold that thought, because the whole quantum story in Module 5 is about that time gap suddenly closing for some — not all — of these sums.
Prime padlocks
RSA, the original padlock of the internet, is nothing more than a multiplication left half-finished.
Build a padlock in one click
Take two prime numbers. Primes are the atoms of arithmetic: every whole number is built from them in exactly one way.
The product is published to the whole world; that is the point of it. The two primes stay in your pocket. Locking a message uses only the product; unlocking needs the primes.
Now be the attacker
All Eve has is the public number. To break in, she must rediscover the primes: try dividing by 2, by 3, by 5, by 7…
Six digits: a few hundred tries, no trouble at all for a computer. But the search grows brutally with size — every extra digit multiplies the work. Real attackers have far cleverer methods than trial division; they explode too, just a little more slowly. See the next screen for the actual world records.
The world records
These are real, published factoring records — the best that humanity's algorithms and hardware have ever done.
Bars are on a compressed (logarithmic) scale; drawn honestly, the last bar would not fit inside the solar system. Even harnessing every computer on Earth, the best known classical algorithm would not finish a 617-digit number in the lifetime of the universe.
Records: RSA Factoring Challenge; RSA-250 factored by Boudot, Gaudry, Guillevic, Heninger, Thomé & Zimmermann (2020). "Core-year": one processor core running flat-out for one year.
Locking without the key
- Your browser fetches the padlock: 334,003 (really, a 617-digit version)
- It scrambles your message with maths built on that product
- Anyone can lock; that's why it's called a public key
- The unscrambling recipe requires 569 and 587 themselves
- Whoever holds the primes holds the private key
- Everyone else faces the search from the last two screens
Honest simplification: real RSA wraps the primes in a little more machinery (exponents and a theorem of Euler's) to do the locking and unlocking. None of that machinery adds security; the entire secret is that factoring is slow. This scheme is RSA — Rivest, Shamir and Adleman, 1977.
Secrets in public
Alice and Bob have never met. Eve records every word that passes between them. By the end of this module, Alice and Bob will share a secret — and Eve, holding a perfect transcript, won't have it.
First, do it with paint
Alice
Bob
Eve
The trick: mixing paint is a one-way street. Eve can add paint to what she has, but she can never un-stir a tin. Everything she can blend contains too much of the common colour — close, but close is worthless. A key must be exact.
Now do it with numbers: clock arithmetic
A clock with 23 hours. Start at 1 and keep multiplying by 5; whenever you pass 23, wrap around like midnight. Written as maths: 5x mod 23.
Going forward is easy: hop, hop, hop. Going backward — "the marker is on 8; how many hops got it there?" — there's no formula. You count hops until it matches. That reverse problem is called the discrete logarithm.
The Diffie–Hellman exchange, with real numbers
It works because hopping is order-blind: Bob's 15 hops then Alice's 6 lands exactly where Alice's 6 then Bob's 15 lands. Eve can't take a single hop of the journey without a secret count. Published by Whitfield Diffie and Martin Hellman in 1976 — the first public method for creating a secret in full view.
You used this today
Our clock had 23 positions. Eve cracks it in at most 22 tries; your calculator does it before you blink.
Real clocks have a 617-digit number of positions — more positions than there are atoms in the observable universe (about 1080). Counting hops stops being a joke and becomes a heat-death-of-the-universe project.
Every time your browser shows the padlock icon, a handshake like this — agree in public, hop in private — ran before the page even loaded. Modern browsers usually run it on an elliptic curve instead of a clock. That's the next module.
The elliptic curve
A stranger padlock with much smaller keys — built by playing billiards on a curve. This is the one your phone actually uses.
The only move in the game
Pick a starting point P on the curve. To "add" points: draw a straight line through them, see where it strikes the curve a third time, then reflect that strike through the middle. That's it — the whole rulebook.
A line through two points of a curve like this always strikes it at exactly one more — that's what makes the game playable. Mathematicians call the move point addition.
Same trapdoor, new table
- Pick a giant number n — that's the secret
- Hop the point n times: P, 2P, 3P, … nP
- Fast even for astronomical n: double your way up — P, 2P, 4P, 8P… — exactly like the shortcut for 515 on the clock. A trillion hops takes about forty doublings.
- Publish the landing point nP to the world
- Attacker sees start P and finish nP
- To find n, they must retrace the hops — one… by one… by one
Recognise the shape? It's the clock from Module 3 with the clock face swapped for a curve. Forward: instant. Backward: count every hop. On curves, even the cleverest known classical shortcuts barely dent the search.
The real thing wears clock arithmetic
Computers hate the smooth curve's endless decimals, so real systems keep only whole-number points and wrap everything mod a prime — here, 97. The same equation y² = x³ − 2x + 2 shatters into confetti. The addition rule still works perfectly; the visual pattern is simply gone.
97 positions is a toy. The curve in your phone (P-256 or Curve25519) has a hop count with 78 digits — and hopping leaves no trail: 13P sits nowhere near 12P.
Why curves won
For the same level of security — a search no classical computer finishes — compare the key sizes. Bars drawn to true scale, for once.
A twelfth of the size for equal strength (NIST equivalence). Smaller keys mean faster handshakes, longer battery life and cheaper chips — which is why your browser, your phone, Signal and WhatsApp all run their handshakes on curves (X25519, P-256) rather than RSA.
The quantum horizon
Everything in Modules 1–4 is safe from every computer humanity has ever built. The catch: it is not safe from a computer humanity knows how to describe — and is now racing to build.
All three padlocks hide the same weakness: a rhythm
Watch the powers of 2 on a 15-hour clock: 2x mod 15.
1, 2, 4, 8 — then back to 1, forever. The sequence repeats with period 4. Every trapdoor in this walkthrough has a cycle like this buried in it; for real key sizes the cycle is astronomically long, and no classical computer can walk far enough along it to see the rhythm.
The rhythm unlocks the padlock
Here is a padlock being picked. The public number is 15; nobody has told us its primes.
Once you know the rhythm, the factors fall out with high-school arithmetic (gcd is the greatest common divisor — find it by hand). Finding the rhythm is the hard part, and that is exactly what a quantum computer is unnaturally good at: it can explore every position of the cycle in superposition, and interference makes the period readable. Peter Shor proved it in 1994; in 2001 IBM ran this very sum — 15 = 3 × 5 — on a 7-qubit machine. The same period-finding trick also demolishes clock powers and curve hops: one attack, all three padlocks.
What breaks, and what merely bends
- RSA — prime factoring (Module 2)
- Diffie–Hellman — clock powers (Module 3)
- Elliptic curves — curve hops (Module 4)
- Broken outright: the one-way street becomes two-way
- AES — the cipher that scrambles the actual data
- SHA-256 — hashing and integrity
- Quantum search only halves their strength
- Fix: double the key length. AES-256 already did.
Notice the asymmetry: the quantum threat is aimed at the handshake — the public-key step that agrees the secret. But the handshake protects everything that follows, so breaking it breaks the lot.
The attack that already started
This is called harvest now, decrypt later. It means the deadline isn't the day quantum computers arrive — it's already passed for any secret that must still matter then: health records, genomic data, defence and intelligence traffic, cabinet papers, long-term legal and financial records.
Work out your own deadline
Michele Mosca's rule of thumb: you are already in trouble if X + Y > Z. Drag the sliders.
Nobody knows Z; serious estimates range from about a decade to several, and "never" is a minority view you would be betting the archive on. The uncomfortable part of the sum: Z is the only term you don't control.
The official timetable
Sources: NIST FIPS 203/204/205 (August 2024); NIST IR 8547 (transition to post-quantum cryptography); ASD Guidelines for Cryptography / ISM (2024 update, 2030 sunset for approved use of RSA, ECDH, ECDSA and DH).
What organisations have to do about it
1 · Find every padlock
A cryptographic inventory. Most organisations cannot list where their crypto lives — it hides in TLS, VPNs, code signing, backups, badge readers, medical devices. You cannot migrate what you haven't found.
2 · Buy crypto-agility
Any system that will still be running in 2030 must be able to swap algorithms without a rebuild. The question to put to every vendor from now on: "how do I change your cryptography?"
3 · Longest-lived secrets first
Triage by Mosca's X: data that must stay secret for decades gets hybrid post-quantum protection now, because for that data, harvest-now-decrypt-later already applies.
This is why the dates matter to a cyber security student in particular: the refit of every server, browser, bank, hospital and satellite is scheduled for exactly the years your career begins.