Kerckhoffs's principle (1883): the secret is the key

On the shoulders of giants, part one of thirteen.

In 1883, a Dutch-born linguist and teacher named Auguste Kerckhoffs published two articles on military ciphers in a French military journal. Telegraphy had transformed how armies communicated. Messages now travelled quickly over wires that anyone might tap, and the old habit of relying on a secret method of writing was starting to fail.

Kerckhoffs set out a short list of principles that a field cipher should meet. Most were practical: it should be easy to use, it shouldn't need a long set of rules to remember, it should work with the equipment of the day. One of them outlived all the others.

The principle

The system, Kerckhoffs wrote, must not depend on being secret. It should be able to fall into the enemy's hands without causing harm.

In other words, assume the other side knows exactly how your method works. The only thing that should need protecting is the key: the small, changeable piece of information that turns a general method into a particular secret.

It sounds obvious now. In 1883 it ran against centuries of practice, in which the method itself was the guarded secret and its exposure meant starting again from scratch. Codebooks were treated like crown jewels, and the capture of a single copy could compromise a whole network of messengers, diplomats and commanders at once. Kerckhoffs saw that this was a weakness dressed up as a strength.

Why it was right

Kerckhoffs' reasoning was practical rather than philosophical.

• Methods leak. Equipment is captured, people talk, documents are copied. A secret shared by a whole army does not stay secret for long.
• Keys can be changed. If a key is exposed, you replace it. If a method is exposed, you have to replace the method, retrain everyone and re-equip the field.
• Open methods can be checked. A method that has to survive being known can be examined, tested and improved by people other than its designers.
• Secrecy hides weakness too. A method kept from view is also kept from the people who might have spotted its flaws before an enemy did.

How the idea grew

More than sixty years later, Claude Shannon put the same idea even more bluntly, assuming that "the enemy knows the system being used". It became one of the founding assumptions of the modern study of secrecy.

Today the principle runs through how security is judged. The methods that protect online banking, messaging and payments are published in full and examined openly, many of them chosen through public competitions in which anyone could try to break the candidates. Their strength rests on the keys, not on anyone keeping the design to themselves. When a product's protection depends on a method nobody is allowed to see, Kerckhoffs' principle is the first question an expert asks.

What it means today

The principle has a broader lesson for anyone handling sensitive data. Trust that depends on nobody finding out how something works is fragile. Trust that holds even when everything except the key is known is far sturdier. It can be examined, explained to a regulator and relied on by people who were never in the room when it was designed.

Kerckhoffs was writing about soldiers and telegraph wires. The question he asked, "what still holds if the other side knows everything except the key?", is still the right one to put to any system that claims to keep data secure, trusted and under your control.

Next in the series: Vernam and Mauborgne, and the first idea that could never be broken, along with its catch.

To put that question to how your own data is protected, join the waitlist for early access.