When did Kerckhoffs's principle become fully accepted in design and practice of modern ciphers?

Question

Kerckhoffs's principle is named after a publication over 130 years old. Yet it is still something that is commonly misunderstood and challenged by newcomers to cryptography. This question from Open Source Stack Exchange seems typical, and one answer to it implies that at some point, cryptographers in general "got it" and it has become a cornerstone of modern cipher design.

This seemed interesting to me - was the principle for Kerckhoffs's original paper (originally design principle 2 from a list of 6 according to Wikipedia) broadly accepted from the moment of publishing, or has it taken time, specific events and/or the failure of many electronic designs before attaining its current importance?

I searched for "violations of Kerckhoffs's principle" and found a few modern examples (e.g. MiFare being hacked), where essentially the cipher was weak - and easily understood to be weak at the time it was made - but kept secret in the vain hope that reverse-engineering it would be too much of a challenge. However, I didn't find anything I could relate to history such as a series of "secret" ciphers failing badly in the 1990s for instance. So I'm starting to think the principle really has been well-understood ever since it was published, just not followed in practice by some institutions that should have known better had they asked any cryptanalyst. Therefore one way re-framing my question might be "Has there ever been a time in modern (computer-based) cryptographic practice where Kerckhoffs's principle was not considered as important as it is today?"

---

I tried to use Google ngrams to get a sense of when terms may have become popular, and didn't notice any spiking, but a steady rise in term frequency for e.g. "security through obscurity" from 1970's to present day. Does that point to use of Kerckhoff's principle as a norm (or even just as a label), due to increased academic study of cryptography? This has been suggested in comments. Is there better evidence for that than my ad-hoc searching?

Answer 1

As I noted in another answer, Auguste Kerckhoffs published his principles in the scientific/academic journal “Journal des sciences militaires, vol. IX, pp. 5–38 in his article "II. DESIDERATA DE LA CRYPTOGRAPHIE MILITAIRE.", Jan. 1883.

So, when you ask since when academics and cryptographers “might” have been accepting (and even applying) those rules, the answer would be: Since the publication of those principles in a scientific journal in 1883, while they gradually gained importance and acceptance during the past 132 years.

Yet, that might be a bit too short and easy as an answer… so let’s dive into some more detail.

From my personal point of view, the statement

…at some point, cryptographers in general "got it"…

is wrong for two reasons:

1. As with most innovations and/or publications, “general acceptance” is something which is hard to pin-point. When it comes to Kerckhoffs principles, this is something that happened over time.

   It should be remembered that Kerckhoffs was a Dutch linguist, cryptographer, and professor of languages at the École des Hautes Études Commerciales in Paris at the beginning of the 19th century.

   Back in his days, “education” was not accessible as it is today and not many of his (more commercially interested) students focussed on cryptography. One could almost say that, generally, people didn’t care about cryptography in a way we do today. So – at first – Kerckhoffs principles were more of military and (limited) academical interest, but not general interest.

   There was no point in time where cryptographers suddenly “got it”.

   What can be observed is that – while time progressed – people who were involved with cryptography slowly but steadily started to recognize the importance of Kerckhoffs publication.

   What can also be observed, is how – at the same time – the cryptographic community slowly shifted from a minority of military strategists and academically interested people, to a rather broad, general public (as we nowadays call it).

   Yet, all that spans the past 132 years!

   For example: when you dive into crypto-history, you will discover that there are examples of WWI cryptography that actively respected most of his principles.

   Same goes for WWII cryptography… even though the most famous WWII crypto device – the Enigma – is a prime counter-example which shows what happens if you ignore Kerckhoffs advice. Nevertheless, we shouldn’t ignore the influence of both world wars in this context.

   Also, factors like the electronic revolution, up to the invention of a world wide network we now call “the internet”, definitely added to the general acceptance of some of Kerckhoffs principles (especially, the 2nd one).

   No matter which individual influence we pick, they all point at a simple fact: there was no “ugh, Kerckhoffs was correct so let’s all follow his principle(s)” moment in history. Instead, there were several independent points in history which added to the acceptance of his publication and the general acknowledgement of his (eg) 2nd principle.

2. Let’s talk about the term “cryptographers” in general.

   Generally talking about “cryptographers” in this context is pretty misleading, if not wrong all together. The reason is simple: it lacks specific definition. Over 100 years ago, you would be talking about academics and the military. Today, you could be talking about an amateur cryptographer without academic or military background.

   We shouldn’t forget that nowadays, everyone can fire up a random search engine and learn about cryptography. 132 years ago, it was not common for “average Joe” to even be able to read.

   Also – today, an interested amateur could use his computer at home to find (eg) bias in a cipher like RC4. But you can’t simply compare that to 100 years ago.

   Expecting early-1900 “average Joe” to look at (and understand) cryptography is something which can not be expected or even generalized. That evolved just like the knowledge and study of Kerckhoffs principles: during a 132-year timespan, where ideas like “education for everyone” were given birth to.

TL;DR

Wrapping it up: there is no one-time-event that would mark a point where Kerckhoffs principles suddenly got accepted by most cryptographers. At least, history does not show any related ”Eureka” moment.

The knowledge and acceptance of Kerckhoffs’ principles goes hand-in-hand with the (not only academic) study of cryptography; which grew over time thanks to evolving technologies (reaching one of its many highs in the 1970’) and the general progress of modern civilisation during the past 132 years.

I’ld say that – in the broadest sense of possible interpretation – your

So I'm starting to think the principle really has been well-understood ever since it was published, just not followed in practice by some institutions that should have known better had they asked any cryptanalyst.

is a close-to-correct^[*] conclusion.

---

_{^[*] The reason I wrote “close-to-correct“ is that I personally would’ve avoided using terms like “institutions”. There were ample times where there was no institution, but rather some country’s military, involved. Also, 132 years is a rather long timespan, during which (eg) the job-description “cryptanalyst” didn’t always exist.}