Kerckhoffs's Principle

Cryptography · Axiom Academy

A foundational principle of modern cryptography: security should depend only on the key, not on the secrecy of the system Kerckhoffs's Principle asserts that the security of a cryptosystem must depend entirely on the secrecy of the key , not on the secrecy of the algorithm. This means the encryption algorithm, implementation details, and even source code can be public without compromising security. 2. Why Security Through Obscurity Fails Security through obscurity is the practice of keeping a cryptographic algorithm secret in hopes that attackers won't discover how it works. This approach has several critical flaws: Algorithms can be reverse-engineered No peer review means hidden vulnerabilities Once discovered, entire system is compromised History is filled with examples of "secret" algorithms that were broken once their mechanisms became known. 3. The Modern Cryptographic Approach Following Kerckhoffs's Principle, modern cryptography embraces open design and peer review . Standards like AES, RSA, and elliptic curve cryptography are completely public. Peer Review: Thousands of experts analyze for weaknesses Trust: No hidden backdoors or vulnerabilities Resilience: Security survives algorithm disclosure Standardization: Interoperability across systems The key is what needs protection, not the algorithm. Keys can be easily changed if compromised, but changing an entire cryptographic system is expensive and disruptive.

This is the written version of the interactive lesson above. See the full Cryptography course.