Security does not rest on the secrecy of the algorithm

Security through obscurity, a trap

Contrary to Kerckhoffs's principle, one temptation keeps coming back to hurried designers: keeping the algorithm secret in the hope that "no one will guess how it works." This is called security through obscurity.

What it is

Security through obscurity consists of making the protection of a system rest on the secrecy of how it works rather than on the secrecy of a key. It bets on the attacker's ignorance: as long as they do not know the recipe, they will be unable to do anything.

This is exactly what Kerckhoffs's principle forbids.

Why it always fails

The history of cryptography is a graveyard of secret algorithms. Three reasons explain these failures.

The secret always ends up leaking. Software can be decompiled, a chip can be reverse-engineered, an employee talks, a document is stolen. An algorithm deployed on a large scale never stays secret for long.
The lack of auditing hides flaws. An algorithm that no one examines is no more secure: it is simply full of flaws that no one has yet fixed. Secrecy does not eliminate defects, it conceals them until the fatal day.
Total collapse. The day the secret is revealed, there is no protection left at all. Everything collapses at once, and everything has to be rebuilt.

Let us compare the two approaches:

+---------------------+----------------------+----------------------+
|                     | Securite par la CLE  | Securite par         |
|                     | (Kerckhoffs)         | l'OBSCURITE          |
+---------------------+----------------------+----------------------+
| Algorithme          | public, audite       | secret, non audite   |
| Ce qu'on protege    | la cle seule         | tout le mecanisme    |
| Si le secret fuite  | on change la cle     | tout s'effondre      |
| Failles cachees     | traquees par tous    | ignorees jusqu'au    |
|                     |                      | jour de la fuite     |
| Verdict             | solide               | illusoire            |
+---------------------+----------------------+----------------------+

Some very real examples

GSM's A5/1. The algorithm that encrypted mobile phone communications was designed in secret in the 1980s. Once disclosed through reverse engineering, it turned out to be riddled with weaknesses and was broken, exposing millions of conversations.
Proprietary ciphers. Many "homemade" systems kept secret (access badges, consoles, DVDs) were broken within weeks as soon as researchers got their hands on them. Secrecy had only delayed the inevitable.

The nuance to remember

Obscurity is not entirely useless: hiding the version of a piece of software or the internal structure of a network can slow an attacker down. But it is an additional layer, a bonus, never the foundation. A system whose entire security rests on obscurity is a system with no security.

In summary