Kerckhoffs's Principle
A security principle stating that a system should stay secure even if everything about it, except the key, is public knowledge.
Also known as: Kerckhoffs's Law, Kerckhoffs's Desiderata, Shannon's Maxim, The Enemy Knows the System
Category: Principles
Tags: security, cybersecurity, cryptography, encryption, principles, software-design
Explanation
In early 1883, Auguste Kerckhoffs, a professor of German at HEC Paris, published "La cryptographie militaire" in the Journal des sciences militaires. In it, he listed six design rules for military ciphers. The second one is the one everybody remembers: the system "should not require secrecy, and it should not be a problem if it falls into enemy hands".
Claude Shannon later put it even more bluntly: "the enemy knows the system". In that form, it's known as Shannon's maxim.
**What it means**:
Assume attackers will learn everything about your system: the algorithm, the code, the protocol, the hardware. If the security still holds, the design is sound. If it collapses the moment the design leaks, it was never secure in the first place.
The only thing that should stay secret is the key (or the password, or the token). Keys are small, easy to change and easy to protect. A whole system design is none of those things.
**Kerckhoffs's principle vs. security through obscurity**:
Security through obscurity relies on keeping the design secret: a hidden algorithm, an undocumented port, a "secret" URL. It can add a thin extra layer, but it fails badly as the main defense:
- **Secrets leak**: Employees leave, code gets decompiled, documents get shared, devices get stolen
- **You can't rotate a design**: Once a key leaks, you replace it. Once your secret algorithm leaks, you rebuild the system
- **Nobody reviews it**: A hidden design gets no outside scrutiny, so its weaknesses stay in place until an attacker finds them
**Why open designs end up stronger**:
The long history of cryptography shows the same pattern again and again: algorithms that are published and attacked in public get better over time. AES, RSA and TLS are all public. Their strength comes from the keys and from years of public analysis, not from hiding how they work. Homemade, secret ciphers have a much worse track record.
**Beyond cryptography**:
Saltzer and Schroeder turned the same idea into their "open design" principle for secure systems in 1975. It applies to software in general:
- Your security should survive your source code becoming public (open source projects live with this every day)
- Hiding an admin panel behind an unusual URL is not access control
- Configuration secrets belong in a secrets manager, never hardcoded in the code
- Treat obscurity as an extra layer at most, on top of real controls (see defense in depth)
Kerckhoffs's principle is one more case of designing for the worst realistic scenario. Assume the attacker knows everything except the key, and build from there.
Related Concepts
← Back to all concepts