Digital Trust in a Quantum Era — Student Pack
Pilot draft v0.1 • October 2026 • For school review
All people, clubs, services and companies in this pack are made up. You never need to share your own passwords, accounts or personal stories. You can always answer by writing, drawing a labelled diagram or explaining to your teacher.
Glossary
- Confidentiality — only the right people can read it.
- Integrity — it has not been changed without permission.
- Authenticity — it really comes from who it says.
- Availability — you can get to it when you need it.
- Public key / private key — a matched pair. The public key can be shared; the private key must stay protected.
- Digital signature — helps check who sent something and whether it changed. It does not hide the message.
- Post-quantum cryptography (PQC) — cryptographic methods (mathematical ways to protect information and check messages) designed to resist attacks from both classical and quantum computers. They run on conventional computers, not through quantum communication. This is a design goal, not a guarantee against every attack.
Baseline and final check — student response sheet
Use a fresh copy before Lesson 1 and after Lesson 3. Your teacher will tell you which check this is. Allow about 10–12 minutes, or agreed extra time. Respond independently without the lesson sheets or glossary. You may write, draw a labelled explanation or respond orally to your teacher, with agreed accessibility or reading support. You may say “not sure”; explain what you are unsure about if you can. This is a learning check, not a diagnosis or certification.
Check: baseline / final (circle one). Date: __________
For each question give your answer and explain your reasoning in your own words. Use the space or extra paper; for an oral response, ask your teacher to record it using the school’s usual process. Keep completed responses with your teacher/school. Do not upload them to QSFS, email them to the site or include passwords or personal stories. This sheet asks for no name or profile; any local matching arrangements remain school-held.
1. Public announcement’s date changes without permission — confidentiality, integrity or neither?
Answer and explanation: ____ ____ ____ ____ ____ ____
2. Signed message sent openly — must contents be secret?
Answer and explanation: ____ ____ ____ ____ ____ ____
3. Public key published by its owner — secret leaked?
Answer and explanation: ____ ____ ____ ____ ____ ____
4. “Quantum computers are faster at every task.”
Do you agree, disagree or feel not sure? Explain your reasoning.
Answer and explanation: ____ ____ ____ ____ ____ ____
5. Can every encrypted message already be read?
Answer and explanation: ____ ____ ____ ____ ____ ____
6. Why plan earlier for a long-lived private record than a public notice?
Answer and explanation: ____ ____ ____ ____ ____ ____
7. Evidence question for “quantum-safe forever”.
Write a question you would ask and explain why it matters.
Answer and explanation: ____ ____ ____ ____ ____ ____
8. Strange login request today — ignore while waiting for upgrades?
Answer and explanation: ____ ____ ____ ____ ____ ____
Lesson 1 — What are we protecting?
Case cards
- A fictional club’s private plan is read by someone who was not meant to receive it. The text is unchanged.
- A public event time is changed from 3 pm to 5 pm on its way to the reader.
- A message claims to come from the club organiser, but it was created by somebody else.
- A genuine organiser sends the correct, signed message to the wrong recipient. The message contains a private fictional note.
- An authentic message is encrypted, but it asks the reader to make an unsafe decision.
- The genuine public timetable cannot be opened when everyone needs it.
Task sheet
A. For each card, write the protection at issue and one sentence explaining why.
B. Draw the public club-announcement journey. Label sender, recipient, message and three possible failures. Choose a protection for each failure. Include one limitation.
C. Complete:
- “A public key can be shared because …”
- “A private key should …”
- “A digital signature is useful for … but it does not …”
D. Correct the claim: “If a message is encrypted, the person sending it must be honest.”
Exit ticket
- Which need is most directly affected when a public timetable is secretly changed?
- Does a digital signature automatically keep a message secret? Explain.
- Give one reason an encrypted message can still be risky.
Lesson 2 — What quantum changes and what it does not
Claim to inspect
“Quantum computers will soon replace every computer and break every password.” Underline the words that need evidence.
Probability activity
Toss a coin 20 times, or use this practice sequence (made up for class, not a real experiment):
H, T, H, H, T, T, H, T, H, H, T, H, T, H, T, H, H, T, H, T
- Count heads: ____ Count tails: ____ Fraction of heads: ____ / 20
- Is 10 heads guaranteed? ____ Does a random-looking result prove something is quantum? ____
Number task (your teacher assigns one)
- Task 1: Calculate 17 × 19 = ____
- Task 2: Find two whole numbers greater than 1 whose product is 437: ____ × ____
Which task was easier? Does this tiny example protect anything real? Complete the chain and say what evidence each step needs:
changed computing ability → changed security assumption → need to review the system
Model limits
“The coin helps us show … but it does not show …” “The number task helps us show … but it does not show …”
Evidence cards — sort into: current evidence/guidance · future conditional risk · unsupported conclusion
- “ASD’s 2026 computing guidance says a cryptographically relevant quantum computer does not yet exist.”
- “A sufficiently capable future quantum computer could compromise commonly used traditional public-key methods.”
- “A company says its product is quantum-safe but provides no named standard, scope or test evidence.”
- “NIST published three principal PQC standards in 2024.”
- “Therefore quantum computers already break every password and encryption system.”
- “Therefore updates, account protection and checking unusual requests no longer matter.”
Correct one unsupported statement in 30 words or fewer.
Optional extension — paper circuit rule card
Start each new run in state 0. H changes 0 to plus, plus to 0, 1 to minus, and minus to 1. Measurement is in the 0/1 basis. Measuring 0 returns 0; measuring 1 returns 1. Measuring plus or minus returns 0 or 1, each with probability one-half. After measurement, the state is the measured result. Do not add extra measurements. State labels are mathematical shorthand.
Predict:
- A: 0 → H → measure
- B: 0 → H → H → measure
- C: 0 → H → measure → H → measure
Why does calling H a “coin toss” fail to predict B?
Exit questions
- Why do the coin and number activities not show quantum codebreaking?
- Does a 50% prediction guarantee exactly 50 zeros in 100 trials?
- What is the relevant future security concern?
- Does PQC require a school to buy a quantum computer?
- Why keep everyday security habits?
“A useful action now is … because … . One claim I would challenge is … because … .”
Lesson 3 — Make a defensible security decision
Scenario: Harbour Youth Science Club (fictional)
You are an advisory learning team. You may recommend questions and actions, but you cannot access or change any system.
- Service A holds a public event timetable. Readers need it to be accurate and genuinely from the club. It changes weekly.
- Service B stores fictional private records that must stay confidential for many years. It uses traditional public-key methods in some data transfers; you don’t know the exact details.
- Service C accepts member logins. Today the organiser received a report of a suspicious login request. Nobody has checked yet whether an account was compromised.
Vendor message 1: “Our platform is quantum-proof forever. You do not need further details.” Vendor message 2: “We have a product-specific PQC transition plan. We can explain which functions it covers, our chosen standards, release/testing dates and who must take action. Some older components still need review.” Vendor message 3: “Just choose a longer password and no future cryptography changes will be necessary.”
Option cards — choose three (one near-term issue, one future-risk inquiry, one evidence request). You may reject any card with a reason.
- A. Report the suspicious login request through the club’s established trusted process and have the authorised organiser investigate.
- B. Ask the service owner and vendor which functions use affected cryptography, what standards-based transition they support and when evidence will be available.
- C. Buy an unspecified “quantum-proof” product immediately because the advertisement sounds confident.
- D. Map how long Service B’s data needs confidentiality and who controls the systems, using category descriptions rather than copying private records.
- E. Stop doing normal account-security checks because quantum is the only important risk.
- F. Ask vendor 2 what its plan covers, what it does not yet cover, and how its readiness will be verified.
- G. Run unauthorised tests against the club’s real accounts to see what happens.
- H. Ask the organiser to include a documented follow-up date and owner for the unresolved future-risk questions.
Timeline
Mark: today · how long Service B must stay private · a “?” for future quantum capability. Why can planning start without an exact date?
Decision brief
- Our most urgent current issue is … because … .
- Our future confidentiality concern is … because … .
- Two specific questions we would ask the authorised owner/vendor are … and … .
- We would reject or qualify the claim … because … .
- We still do not know … . That information could change our choice by … .
- The person authorised to take the next step is … . Our safe role as students is … .
Exit questions
- Why can a future risk matter to data sent today?
- Is a public timetable free from security concerns?
- What makes vendor 2 more useful without proving it is safe?
- What should a student do about a real school-system concern?
Quantum-Safe Futures for Schools Framework (QSFS), founded by Michelle Magalona. Pilot draft v0.1 • October 2026 • For school review. Format: Markdown (.md).