Kerckhoffs's Principle
The most important rule in cryptography: assume your adversary knows everything about your system except the key.
Principle (not a cipher)
Why This Matters
Kerckhoffs's Principle — articulated by Dutch linguist Auguste Kerckhoffs in his 1883 paper La Cryptographie Militaire — is the foundational design rule of modern cryptography. It states that a cryptographic system must remain secure even if everything about the system, except the key, is publicly known. The corollary is profound: security through obscurity (hiding the algorithm) is not security at all, because algorithms can be reverse-engineered, leaked, or discovered; only a short, easily changed key needs to remain secret. Every major cipher used today — AES, RSA, the Diffie-Hellman key exchange, TLS — is fully published and open to public scrutiny, with public algorithms and explicit assumptions, while also requiring correct implementations and protocol use.
Kerckhoffs stated six design criteria for military ciphers: (1) the system must be practically, if not mathematically, indecipherable; (2) the system must not require secrecy and can be stolen by the enemy without causing trouble; (3) it must be easy to communicate and remember without written notes; (4) the cipher must be applicable to telegraph correspondence; (5) the apparatus must be portable and operable by a single person; (6) the system must be easy to use. Criterion 2 is what posterity calls "Kerckhoffs's Principle."
Concealing a design can be an additional obstacle, but a robust cryptosystem should not depend on keeping that design secret. Keys can then be replaced without redesigning the whole system. This principle does not require a separate key for every message, and key secrecy alone does not guarantee a flawed algorithm is secure.
Enigma’s design and wiring were important to its analysis, but learning the machine did not automatically reveal every daily key. Captured key material, operator practices, cribs and structural weaknesses all mattered. The lesson is to evaluate security with the design known, rather than equating machine capture with instant decryption.
AES was selected by the US NIST through a public five-year competition (1997–2001). The algorithm was published, attacked by the world's best cryptanalysts, analyzed for weaknesses, and refined through open peer review. The competition's winning algorithm — designed by Joan Daemen and Vincent Rijmen (Belgian) — is widely used in encrypted storage and communications. Its security has been publicly scrutinized for 25 years. This is Kerckhoffs's Principle in action at planetary scale.
| Author | Auguste Kerckhoffs van Nieuwenhof (1835–1903) |
| Published | La Cryptographie Militaire, 1883 |
| Principle | System security must depend only on key secrecy, not system secrecy |
| Shannon equivalent | Shannon's maxim: "the enemy knows the system" |
| Violated by | Systems whose security depends on the algorithm remaining unknown |
| Modern Lesson | Open design allows public scrutiny that defeats hidden flaws |