Kerckhoffs's principle

Kerckhoffs's principle says a cipher must stay secure even if the enemy knows everything about it except the key. The method can be public, the machine can be captured, the algorithm can sit in a textbook, and the only thing that has to stay secret is the key, which you can change. A Dutch-born language teacher in Paris wrote it down in 1883, Claude Shannon restated it in 1949 as "the enemy knows the system", and it's the reason modern cryptographic standards get chosen in public competitions and the reason cipher.ink publishes the code that seals your messages.

Who Kerckhoffs was

Auguste Kerckhoffs was born on January 19, 1835, in Nuth, in the Netherlands, studied at the University of Liège, taught in schools in the Netherlands and France, and became a professor of German at the business school HEC Paris and at the École Arago. He died in Paris on August 9, 1903. In 1885 he became a leading figure in the movement for Volapük, a constructed international language, and directed its academy. People remember him for a single piece of cryptography, a paper in two parts, La cryptographie militaire (military cryptography), published in the Journal des sciences militaires in January and February 1883.

The six requirements

The paper surveyed the ciphers armies used and proposed six conditions a military cipher should meet. In English translation:

1. The system must be practically, if not mathematically, indecipherable.
2. It should not require secrecy, and it should not be a problem if it falls into enemy hands.
3. It must be possible to communicate and remember the key without written notes, and the correspondents must be able to change or modify it at will.
4. It must be applicable to telegraph communications.
5. It must be portable, and should not require several persons to handle or operate.
6. Lastly, given the circumstances in which it is to be used, it must be easy to use and should not require its users to know and follow a long list of rules.

The second one carries the principle. In Kerckhoffs's French: Il faut qu'il n'exige pas le secret, et qu'il puisse sans inconvénient tomber entre les mains de l'ennemi. The system mustn't require secrecy, and it must be able to fall into the enemy's hands without inconvenience. The other five deserve a read too, since he wrote them for telegraph operators in the field. An elegant cipher that a tired clerk can't use correctly is a weak cipher.

Why the argument holds

At first it sounds backwards. Surely hiding the method adds security? Kerckhoffs's reasons are practical, and they've only grown stronger.

• Methods leak and keys can be replaced. Many people use a cipher, on many machines, for many years. Sooner or later a clerk gets bribed, a machine gets captured or a manual gets stolen. If the security rested on the method, the whole system would be lost and every user would need a new one. If it rests on the key, a compromise costs one key, and a new one is cheap to make.
• Public scrutiny finds the flaws. A cipher only its authors have examined has been examined by the people least able to see what they missed. One that thousands of cryptographers have tried and failed to break has earned some confidence. That's why the best-trusted ciphers (AES, ChaCha20) have faced public attack for years.
• The enemy isn't stupid. A system whose strength depends on the enemy failing to work out how it operates is betting on their failure. Cryptanalysts have a record of working out the machines. Mathematics and a few documents were enough to rebuild the early Enigma before the war began (the Enigma page), and Bazeries solved the Great Cipher of the French kings, which they'd treated as secure for two centuries, around 1890 (the Great Cipher page).

Shannon's version

Claude Shannon, in his 1949 paper on the theory of secrecy systems, stated the same idea as a design rule for the cryptographer: one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them. People call this form Shannon's maxim, "the enemy knows the system". It sounds stricter, because it tells the designer what to assume, not what to hope. The background is in the one-time pad and the proof of perfect secrecy that came with it.

What it doesn't say

People often misread Kerckhoffs's principle as "everything must be published", or as a rule against ever keeping anything secret. It says neither.

• It's about what you rely on. Keeping extra details private as an additional layer is fine, as long as the system would stay secure if they were exposed. What the principle forbids is making secrecy of the method a requirement for security.
• It doesn't make a bad key good. The whole weight of security now rests on the key, so the key must be random, long enough, kept secret and replaceable. A cipher with a published design and the word "password" as its key is easy to break.
• It doesn't cover everything. Implementations, key storage, human error and the trust you place in the software aren't the algorithm, and they need their own scrutiny (client-side encryption).

"Security through obscurity" is the label for relying on the secrecy of the design, and it's widely held to be a poor foundation. A 2002 IETF Internet-Draft by Steven Bellovin and Randy Bush was titled Security Through Obscurity Considered Dangerous, and argued that hiding vulnerabilities decreases the likelihood that they'll get repaired.

When the rule was broken

The history of cryptography is full of designs whose strength lay in their secrecy, and of what happened next. The RC4 stream cipher was an RSA Security trade secret until someone posted its description anonymously to the Cypherpunks mailing list in September 1994. The cipher had been in products since 1987, and once people could study it openly they found its weaknesses one by one (RC4). The DES S-boxes, whose design criteria were never published, drew twenty years of suspicion. When differential cryptanalysis turned up in public, the S-boxes proved to resist it, and one of the IBM designers later wrote that they'd been designed to (the history of AES). And the open contests that followed, for AES and later for SHA-3 and the post-quantum algorithms, turned the principle into a process (post-quantum cryptography).

How cipher.ink applies it

The method that seals your message is entirely public. The JavaScript is plain, readable ES2017 with no build step and no minifying, and the code page annotates it section by section. The algorithms are standards (AES-256-GCM, PBKDF2-HMAC-SHA256), the security page lists the parameters, and a table there says exactly what the server sees and keeps. The only secrets are the ones that have to be: your passphrase, or the random key in the link after the # (why the part after # never reaches the server), and the server never receives either. You can change it for every message, because a new passphrase or a new key costs nothing, which is Kerckhoffs's third requirement. One limit remains, and we state it: you trust the server to send you honest JavaScript, a point client-side encryption discusses. Publishing the code makes that trust checkable, which is what the principle asks.