Security does not rest on the secrecy of the algorithm

Kerckhoffs's principle

In 1883, a Dutch linguist, Auguste Kerckhoffs, published in a military journal an article that would go on to found all of modern cryptography. In it he stated a principle that seems paradoxical: a good encryption system must remain secure even if the enemy knows everything about how it works.

The statement of the principle

As formulated today, Kerckhoffs's principle says this:

A cryptographic system must remain secure even if everything, except the key, is made public.

In other words, we assume the adversary knows the encryption algorithm down to its smallest details. The only thing they do not know is the secret key. And that alone must be enough to keep them in check.

Security therefore rests entirely on the secrecy of the key, never on the secrecy of the algorithm.

Shannon's corollary

Sixty-five years later, the mathematician Claude Shannon, father of information theory, reformulated the idea into a blunter sentence:

"The enemy knows the system."

This is Shannon's maxim. It invites the engineer to design a system while assuming the worst: the attacker has read the documentation, has the source code, perhaps even owns a copy of the machine. Despite all of that, without the key they must be able to do nothing.

Public or secret?

The following diagram separates what is known to all from what stays hidden:

+------------------------------------------------------+
|                   CONNU DE TOUS                       |
|                                                       |
|   - l'algorithme de chiffrement (AES, RSA...)         |
|   - le protocole, le format des messages              |
|   - le texte chiffré qui circule sur le reseau        |
|                                                       |
+------------------------------------------------------+
                        |
                        |   une seule chose reste cachee
                        v
+------------------------------------------------------+
|                   SECRET ABSOLU                       |
|                                                       |
|                >>>  LA CLE  <<<                        |
|                                                       |
+------------------------------------------------------+

Everything is on the table, except the key. It is the key that makes the difference between a readable text and an unusable stream.

Why it is a good idea

Making the algorithm public is not a weakness, it is a strength:

Community auditing. A published algorithm is analyzed by thousands of researchers. Flaws are found and fixed before they can be exploited. AES was chosen after a public competition lasting several years.
Replacing a key. A compromised key is changed in a few seconds. A compromised secret algorithm, on the other hand, must be entirely redesigned and redeployed everywhere: a disaster.
Trust. We only trust what we can verify. An algorithm that no one is allowed to examine deserves no trust.

In summary