What is Kerckhoff's Principle, and why is it fundamental to modern cryptography?

"Everything about a cryptosystem is public knowledge except the key." — Auguste Kerckhoff, 1883.

This means:

• The algorithm is assumed to be known to the attacker
• The key is the only secret
• Security must rely entirely on the key, never on secrecy of the algorithm

Why this matters:

• "Security through obscurity" fails — algorithms get reverse-engineered, leaked, or published
• Public algorithms can be scrutinized by the entire cryptographic community
• AES was selected through a public competition — every detail is known, yet it remains secure

In cryptanalysis context: When defining attacks, we always assume the attacker knows the algorithm. The question is: what else does the attacker know? This leads to the hierarchy of attack types (ciphertext-only, known-plaintext, chosen-plaintext).

Go deeper:

• Kerckhoffs's principle (Wikipedia) — the 1883 maxim and why we assume 'the enemy knows the system.'