Kerckhoffs' Principle

In 1883 Auguste Kerckhoffs wrote two journal articles, La Cryptographie Militaire , in which he stated six axioms of cryptography. Some are no longer relevant given the ability of computers to perform complex encryption, but his second axiom, now known as Kerckhoffs' Principle, is still critically important:

Il faut qu’il n’exige pas le secret, et qu’il puisse sans inconvénient tomber entre les mains de l’ennemi. The method must not need to be kept secret, and having it fall into the enemy's hands should not cause problems.

The same principle is also known as Shannon's Maxim after Claude Shannon who formulated it as "The enemy knows the system."

That is, the security should depend only on the secrecy of the key, not on the secrecy of the methods employed. Keeping keys secret, and changing them from time to time, are reasonable propositions. Keeping your methods &mdash; the design of your cryptographic system &mdash; secret is more difficult, perhaps impossible in the long term against a determined enemy. Changing a deployed system can also be quite difficult. The solution is to design the system assuming the enemy will know how it works, aiming at something that is secure even when the enemy knows everything except the key. If you achieve this, then all you need to manage is keeping the keys secret.

Another English formulation is: "If the method of encipherment becomes known to one's adversary, this should not prevent one from continuing to use the cipher."

Implications for analysis
For purposes of analysing ciphers, Kerckhoffs' Principle neatly divides the design into two components &mdash; a key which can be assumed to be secret for purposes of analysis, and everything else which can be assumed to be known to the opponent and therefore should be revealed to the analyst.

"That the security of a cipher system should depend on the key and not the algorithm has become a truism in the computer era, and this one is the best-remembered of Kerckhoff's dicta. ... Unlike a key, an algorithm can be studied and analyzed by experts to determine if it is likely to be secure. An algorithm that you have invented yourself and kept secret has not had the opportunity for such review."

This distinction allows us to build strong ciphers &mdash; everything except the key is published and analysed, so we can be reasonably confident that it is secure, and keys are very carefully managed so we can reasonably hope they are secret.

Cryptographers will generally dismiss out-of-hand all security claims for a system whose internal details are kept secret. Without analysis, no system should be trusted, and without details, it cannot be properly analysed. If you want your system trusted &mdash; or even just taken seriously &mdash; the first step is to publish all the internal details. Of course, there are some exceptions; if a major national intelligence agency claims that one of their secret systems is secure, the claim will be taken seriously because they have their own cipher-cracking experts. However, no-one else making such a claim is likely to be believed.

Security through obscurity
It is moderately common for companies &mdash; and sometimes even standards bodies as in the case of the CSS encryption on DVDs &mdash; to keep the inner workings of a system secret. Some even claim this security by obscurity makes the product safer. Such claims are utterly bogus; of course keeping the innards secret may improve security in the short term, but in the long run only systems which have been published and analyzed should be trusted.

Steve Bellovin commented:

That is, it is an error to rely on the secrecy of a system. Anyone who claims something is secure (except perhaps in the very short term) because its internals are secret is either clueless or lying, perhaps both. Such claims are one of the common indicators of cryptographic snake oil.

Any serious enemy &mdash; one with strong motives and plentiful resources &mdash; will learn all the other details. In war, the enemy will capture some of your equipment and some of your people, and will use spies. If your method involves software, enemies can do memory dumps, run it under the control of a debugger, and so on. If it is hardware, they can buy or steal some and build whatever programs or gadgets they need to test them, or dismantle them and look at chip details with microscopes. They may bribe, blackmail or threaten your staff or your customers. One way or another, sooner or later they will know exactly how it all works.

From the defender's point of view, using secure cryptography is supposed to replace a difficult problem &mdash; keeping messages secure &mdash; with a much more manageable one &mdash; keeping relatively small keys secure. A system that requires long-term secrecy for something large and complex &mdash; the whole design of a cryptographic system &mdash; obviously cannot achieve that goal. It only replaces one hard problem with another.