Announcing a new set of curricula for Level Up, aimed at trainers themselves, with lessons on asymmetric encryption, entropy, and hashes.
So much of the actual practice of cybersecurity and digital safety training is rushed. Trainers work to get across a mix of critically important, complex concepts, while leaving enough time for enough engagement and hands-on time to have it sink in just a bit. This means we as trainers often rely on trust and rough high-level explanations of the core concepts underpinning the training topics, be that password hygiene, using tools like Signal or PGP, or verifying downloaded files. There is eternally too much to cover, too much at stake, and too little time. This core problem is why so many trainer support curricula, tools, and guides exist out there, from the best practice and core curricula shared in Level Up, to the more tactical and hands on resources in the Security Education Companion.
One thing I’ve always found missing in these resources, however, were actual explanations of those complicated, but core topics in cryptography for the trainers themselves. This has left us as trainers with some critical gaps and misunderstanding of how these work, which can be passed on into well-meaning but dangerously misleading digital safety advice. As I struggled to find better resources to explain these, as the resources seemed to either be the useful but incomplete metaphors we already have, or full-on expert-level advanced math.
To try to address this gap, I’ve created a curricula module for Level Up, with lessons on asymmetric encryption, entropy, and hashes.
These are targeted at trainers – to run through themselves and use in trainings-of-trainers – and seek to chart a middle path, using simple and fully explained mathematics where needed to mechanically not just describe how these work, but actually, mechanically, go through it.
While not everyone needs to understand how these fundamental concepts really work, for those of us who shoulder the responsibility of training others on digital safety, it is critical we make an effort to understand them. This lets us answer questions (and evaluate tools and lesson plans) more effectively, to ensure we give accurate answers – and more importantly – have real clarity around where our knowledge stops.
Finally - we do ourselves a disservice by presuming these concepts are inherently “hard.” They are not simple, and do not map cleanly with real-world tangible metaphors, and that’s been the challenge we’ve wrestled with in training for years.
While picking up a guide and working through it in a day or two will not prepare you to implement secure cryptographic algorithms (please don’t!), it will give you eternally useful insights into every technical aspect of digital safety. A baseline understanding of asymmetric RSA encryption gives deep insights into PGP key pairs, HTTPS connections, and even S/MIME encryption, as well as helping you evaluate new encryption tools. Understanding “entropy” opens the door to answering challenging questions about real-world password security. Understanding “hashes” not only supports how validation of media and downloads works, but also builds on how PGP signatures work, HTTPS certificates, and gives you a valuable vantage point into the “how” of the tools we use and advise on every day.