Prime Numbers, Padlocks, and Passwords: The Case for Teaching Cryptography in American High Schools

Every day, millions of American students log into school portals, submit homework through cloud platforms, and communicate with teachers over encrypted messaging apps. Behind each of those routine interactions, a branch of mathematics that most of them have never formally encountered is doing the heavy lifting. Number theory — long dismissed in popular imagination as the purest and most impractical corner of mathematics — is, in fact, the structural foundation of the digital security systems that protect nearly every piece of sensitive information transmitted online. The argument for bringing cryptographic literacy into high school math classrooms is not merely academic. It is urgent.

The Surprising Power of Prime Numbers

To understand why cryptography belongs in the curriculum, it helps to understand what cryptography actually does — and why prime numbers are so central to it.

A prime number is any integer greater than one that has no divisors other than itself and one. The sequence begins simply enough: 2, 3, 5, 7, 11, 13. But as numbers grow larger, primes become increasingly sparse and, crucially, increasingly difficult to identify. There is no neat formula that generates them in order. Their distribution across the number line follows patterns that mathematicians have studied for centuries without ever fully taming.

This unpredictability is not a limitation — it is a feature. Modern encryption exploits it deliberately.

Consider what happens when two large prime numbers are multiplied together. Take a pair of primes, each hundreds of digits long, and compute their product. The multiplication itself is straightforward; any computer can perform it in milliseconds. But reverse the process — start with only the product and attempt to recover the original two prime factors — and the problem becomes computationally monstrous. Even the fastest supercomputers currently available would require longer than the age of the universe to factor certain large numbers by brute force. This asymmetry between easy multiplication and hard factoring is the mathematical trapdoor on which much of the internet's security rests.

How RSA Encryption Actually Works

The most widely taught example of this principle in action is RSA encryption, named for its inventors Ron Rivest, Adi Shamir, and Leonard Adleman, who published the algorithm in 1977 while working at MIT. RSA belongs to a family of methods known as public-key cryptography, and its elegance lies in a simple but counterintuitive idea: a person can share a public key openly with the world while keeping a private key secret, and information encrypted with the public key can only be decrypted by someone who holds the private key.

Here is a simplified version of the underlying process. Two large primes, call them p and q, are selected and multiplied to produce a number n. A related value derived from p and q — known as Euler's totient of n — is used to generate the public and private key pair. The public key includes n and an encryption exponent; the private key includes n and a decryption exponent that can only be computed efficiently if you know the prime factors. Once p and q are discarded, recovering the private key from the public key alone requires factoring n — which, for sufficiently large values, is computationally infeasible.

When a student's browser displays a padlock icon and connects to a website over HTTPS, a process descended from these same principles is negotiating a secure channel in the background. The mathematics is not metaphorical. It is operational.

What Students Are Missing

Despite the ubiquity of these systems, American high school mathematics curricula have been slow to incorporate cryptographic concepts in any meaningful way. The Common Core State Standards for Mathematics, adopted in some form by the majority of states, do not include number theory as a required domain at the secondary level. Modular arithmetic — the arithmetic of remainders that underpins RSA and many other cryptographic protocols — rarely appears before college, and then typically only in discrete mathematics or computer science electives.

This is a significant omission. Students who graduate without exposure to these ideas are not simply missing a technical skill. They are missing a conceptual framework for understanding the systems that govern their digital lives. They are also less prepared for an expanding range of careers in cybersecurity, software engineering, and data privacy — fields in which the United States faces well-documented workforce shortages.

The Bureau of Labor Statistics projects that employment in information security analysis will grow by roughly 32 percent over the next decade, far outpacing the average for all occupations. Demand for professionals who can reason about cryptographic systems is not a niche concern. It is a national workforce priority.

Making the Mathematics Accessible

One objection to including cryptography in high school curricula is that the mathematics is too advanced for most students. This concern, while understandable, underestimates both the subject and the students.

Modular arithmetic can be introduced through familiar contexts. Clock arithmetic — the observation that 10 hours after 5 o'clock is 3 o'clock, not 15 o'clock — is a natural entry point. From there, teachers can explore the concept of remainders, then congruences, then the properties of prime numbers that make factoring so difficult. None of this requires calculus. Much of it requires only careful reasoning and comfort with multiplication.

RSA itself can be demonstrated at a small scale using two-digit primes without sacrificing the conceptual integrity of the system. Students can encrypt and decrypt short messages by hand, gaining an intuitive feel for the asymmetry that makes the system work. The experience of doing mathematics that is simultaneously abstract and immediately relevant to their daily lives is precisely the kind of engagement that math educators have long sought to cultivate.

Several pioneering educators and nonprofit organizations have already developed curriculum modules along these lines, demonstrating that cryptographic literacy is teachable at the secondary level when framed appropriately. The resources exist. What has been lacking is the institutional will to incorporate them.

A Curriculum for the Digital Age

The argument for teaching cryptography is not that every student needs to become a security engineer. It is that mathematical literacy in the twenty-first century must include some understanding of the systems that structure digital life. A student who understands, even at a conceptual level, why prime numbers make passwords hard to crack is a student who can reason more clearly about privacy, about trust, and about the limits of the technologies they use every day.

Mathematics education has always served a dual purpose: developing formal reasoning skills and connecting those skills to the world students inhabit. For most of the twentieth century, that connection was made through physics, engineering, and finance. Today, it must also be made through the invisible architecture of the internet — the number theory that stands between sensitive information and those who would exploit it.

Incorporating cryptographic concepts into high school mathematics is not a radical proposal. It is a logical extension of what mathematics education has always tried to do: prepare students to understand and navigate the world as it actually is. That world runs on prime numbers. It is past time for the curriculum to catch up.