According to Kerckhoffs's principle "A cryptosystem should be secure even if everything about the system, except the key, is public knowledge." Now I want to throw in a provoking formula of mine which refutes Kerckhoff's principle which he formulated in 1883, and come up with a new and updated principle for encryption in our 21st century.

My new and provoking principle is formulated as follows:

"No cryptosystem is secure, whether the system is public knowledge or not, unless the amount of time $T$ and the cost/capability $C$ to break the key are too high to maintain for an attacker."

In simple words this means: If it takes a shitload of time, in terms of years and decades, and a great amount of money and effort, in terms of buying fast hardware for brute-force-attacks and employing talented cryptanalysts to crack your secret key, then you can consider your encrypted data temporarily secure.

And that's the catch: temporarily secure only !

Because if some other attacker comes along with a faster hardware and more sophisticated cryptanalysis or hacking method in the future, thus reducing the crack time $T$ and effort $C$ down to a few days and dollar peanuts only, then you are not secure anymore!

Or if some big guy comes along. The most obvious example is the NSA (National Security Agency) which we cryptographers consider our arch opponent. They have an unlimited budget of billions (or perhaps even trillions) of dollars each year to buy the latest and fastest in computer hardware in huge quantities and they likely employ and pay the best cryptanalysts in the world. Today it is known that key lengths below 2048-bit are not sufficient enough anymore to withstand hardcore brute-force attacks performed by the government. And by "hardcore" I mean best and fastest hardware available in the best configuration to crack a key. And from what I have heard, the NSA are currently investing in the research and development of quantum computers (supercomputers) which are going to be so lightning-fast that they may even crack 4096, 8192 and longer bit keys in no time. Good documentaries and reports on quantum computers can be found on Youtube, for instance.

Now you may ask yourselves why my formulated principle stated above is provoking for us cryptographers and crypto developers? I think it is, because it basically means that cryptography is useless for keeping secrets. And THAT is a provoking and strong statement, isn't it!

Because the only thing standing in the way of attackers to crack your keys and read your secret messages or decrypt your secret data is the strength of your keys and how long it takes to break them! But they will be broken anyway sometime! That's my point.

So the question is: Does it all refute Kerckhoffs's principle? What do you think, can any cryptosystem and key be cracked these days with sufficient enough hardware and software resources? And human resources (cryptanalysts) for that matter.

This is a question which can be answered by either Yes or No. And if you do so please eleborate in detail. Don't just give a short Yes/No answer.

P.S. I also like to give my own answer to this question which goes as follows: Yes, the new principle refutes Kerckhoff's outdated principle, because a) Kerckhoff lived in 1883 and didn't know about computing technology and power in 2014 and b) Kerckhoff just assumed that keeping the key secret "should" be enough to keep the cryptosystem secure; and that I think is a wrong design principle or however you want to call it, because it is not enough to make the key secret, you also have to make the key strong enough to withstand fast brute-force-attacks and sophisticated cryptanalysis. And on top of that, the new principle refutes Kerckhoff's principle even further by saying that all cryptosystems and all keys are insecure actually, because the better and faster the computing techniques to break the key the more insecure the keys become! Again, my own answer in short is: Yes, Kerckhoff's principle is refuted by the new principle. But everyone can have his/her own opinion. If someone answers with NO, then okay, I'm fine with that too. It seems that such people have strong illusions about the secrecy of their encryption keys and don't want to admit the power of brute-force and cryptanalysis and thus say such observations would be "irrelevant". I think it is not irrelevant for users out there who used 2048-bit keys for instance, thought or were told that they were secure but still got cracked never the less. Actually I think my topic is highly controversial. ;)

  • $\begingroup$ Please add your answer as an actual answer and removed it from the question. You can see if your argumentation is sound incoming upvotes, downvotes and comments. $\endgroup$ – Artjom B. Dec 24 '14 at 10:55
  • $\begingroup$ No, sorry I can't do that, because I did exactly that in my previous questions and threads in the past and the moderators of this board told me I should not do it and deleted my answers. Therefore I have added my own answer to my own question in the first post here. I also know that stackexchange don't work like usual discussion forums and it still confuses me. I have learned that an author or topic starter is not allowed to post replies to his own thread, thus I don't do it anymore and add the answers to my original question topic itself, just to be on the safe side this time. $\endgroup$ – xorcoder Dec 24 '14 at 11:04
  • $\begingroup$ I should add that as a veteran internet and forum user I don't like stackexchange and its confusing "question-based" posting system. I'm just active here, because crypto.stackexchange.com is currently the most frequently visited site for cryptography. Most crypto forums on the net are hardly active. I also don't like the score system on stackexchange. It appears to me that users care more about their score than about giving reasonable and serious answers to questions. I don't care about these things. For me it's about encryption and not about scoring points on a discussion forum. $\endgroup$ – xorcoder Dec 24 '14 at 11:40
  • 1
    $\begingroup$ @xorcoder Either the moderators who told you that were wrong, or there is more to the story. Do you have a link to where they told you that? I'd love to review it with them, because if they're suggesting you can't answer your own question, that would simply be incorrect. I can only assume they know SE policies, so there must be a piece of the puzzle I'm missing. I'd really appreciate a link if you have one! $\endgroup$ – corsiKa Dec 24 '14 at 16:25
  • 1
    $\begingroup$ Fun counterexample: one-time pads (and other information-theoretically secure cryptosystems). When properly implemented, they cannot be broken without the key, even if the attacker has infinite time and computing power. $\endgroup$ – cpast Dec 24 '14 at 21:49

No. These observations are irrelevant to Kerckhoffs principle. Kerckhoffs principle is a design principle that talks about under which conditions a crypto system should be secure. You are talking about what it means for a crypto system to be secure. The two are orthogonal.

Also the observation that crypto systems can eventually be broken by various means is hardly controversial. It is essentially the point of provable security. We prove the complexity of breaking schemes given certain assumptions. If those assumptions turn out to be wrong or the complexity is within reach of modern computing techniques then it is no surprise if the system is insecure.

  • $\begingroup$ Your answer is useful, I think. If it's not controversial or provoking then fine. I can live with that and it won't change my point. You see, I think Kerckhoff's principle is outdated for our modern times, because Kerckhoff in 1883 naturally didn't know our future computer capabilities to brute-force for keys. There weren't even computers in 1883. Basically Kerckhoff just said: Make the cryptosystem public and the key secret, and you SHOULD be secure. The emphasis is on "should". But the fact is that it's not secure. It is not enough to keep a key secret. You also have to make it strong! $\endgroup$ – xorcoder Dec 24 '14 at 10:09
  • 5
    $\begingroup$ @xorcoder Those capabilities are irrelevant to Kerckhoff's principle, and you don't seem to understand what the principle says. The principle is "for a cryptosystem to be good, it needs to be secure even if the system is known." In other words, "if you have to keep the system secret in order to make it secure, it's not a good choice for a military cipher." It doesn't say "public system + private key = secure," because that would be stupid (counterexample: Caesar cipher). It doesn't say you should disclose the system. It says that if disclosing the system is a problem, it's a bad system. $\endgroup$ – cpast Dec 24 '14 at 22:35

First you should note that Kerckhoff's principle does not state that you should publish everything about your system, except the key. It tells you that you should design your system with the goal that it's secure even if the system is published.

The next problem with your post is that it does not consider the differences between symmetric and asymmetric cryptography.

Let's first consider symmetric cryptography. Brute force of an $n$ bit key costs $2^n$ using a classical computer. A quantum computer effectively halves the keysize, i.e. a quantum brute-force of an $n$ bit key costs $2^{n/2}$. $2^{128}$ work will remain infeasible for several decades even if you make optimistic assumptions about computing power. Barring major changes in our understanding of Physics or Mathematics, $2^{256}$ work will remain infeasible forever. This means that we're at a point where we can easily prevent brute-force attacks against symmetric ciphers.

Next consider asymmetric cryptography. You're right that if quantum computers work as promised, the currently popular algorithms, RSA and (Elliptic curve) Diffie-Hellman, will be dead. To counter that possibility cryptographers are working on systems that resist quantum computers. There are promising candidates, such as McEliece or lattice based cryptography. While these suffer from some issues like large public keys or patents, these inconveniences are nothing compared to the inconveniences of not having public key crypto at all.

Cryptoanalysis is harder to predict than computing power. For symmetric crypto there are relatively simple trade-offs between performance and resistance to cryptoanalysis. For example you can increase the number of rounds of a block-cipher or you can combine several encryption algorithms.

Cryptoanalysis against asymmetric crypto is a bigger risk IMO. Asymmetric crypto is based on neat mathematical problems, so one brilliant idea can break a whole family of algorithms. This is made worse by the fact that we have relatively few families of asymmetric algorithms.

What does keeping the system secret buy you? At best it's acting like symmetric encryption, where the the system itself acts as shared key. Note that this "key" needs to be distributed to each user of the system. This implies that all the users must trust each other, which clearly does not apply to an open system like the internet. Keeping the system secret does not work in places where the properties of public key are required.

I am confident that it's possible to design symmetric encryption algorithms that remain secure when published. Increased computational resources are irrelevant, only cryptoanalysis is a threat. Since system secrecy is symmetric, this means Kerckhoffs's principle stands. I'd even say that Kerckhoffs's principle has become more important in the computer age than it was before.

I'm slightly less confident in asymmetric crypto. But even if all asymmetric encryption and key exchange algorithms fall, we can fall back to a combination of symmetric encryption, quantum key exchange and hash signatures. That may be inconvenient, but far less inconvenient and fragile that relying on secret systems.

  • $\begingroup$ Interesting answer. I like it and vote it up actually. So you defend Kerckhoff's principle by basically saying that there are limits to brute-forcing a secret key. I can't disagree with that. I also think that a certain key length, e.g. 8192-bit, prevents brute-force-attacks, thus Kerckhoff's principle can stand to a certain degree. Maybe I'm thinking too sci-fi and too far in the future where everyone owns supercomputers. You know, I'm a Star Trek fan, as seen on my youtube channel. Maybe I should not have such a high fear of the NSA. Maybe there are encryption keys they can't even crack. xD $\endgroup$ – xorcoder Dec 24 '14 at 11:48
  • 1
    $\begingroup$ @xorcoder The limits of brute-force are much lower. Even for 400 bit keys it's quite optimistic. You're underestimating the exponential function. $\endgroup$ – CodesInChaos Dec 24 '14 at 13:04

I think you misunderstand the "should" in Kerckhoffs's principle. It doesn't mean you should be safe in the conditions mentioned, but it does mean that the system is required to be safe in those conditions. It is a requirement of a system instead of a guarantee to the user.

It is hard or impossible to fully implement the requirement, by the reasons you listed, but it should be done as good as possible.


A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

I still think this holds up, regardless of "brute force" capability. What makes a modern day cryptosystem "secure" is still the same, and is defined by the current capabilities for someone to attack said cryptosystem.

This is why we can call RSA-256 "insecure" and RSA-4096 "secure". The first one has proven to be unfit for our modern standards, while the latter still holds up. As time goes on, our definition of what is "secure" will change.

In your example, you have already outlined one possible attack vector. This attack vector is known to work against modern encryption systems with varying success. Time complexity is definitely a factor that we need to take into account when defining a system "secure" or "not secure", but that does not invalidate Kerckhoffs's principle in any way. If anything, it is simply proof that Kerckhoffs's principle still holds up after all this time.

  • $\begingroup$ Yes, time is a very important factor in breaking encryption. If I as a crypto developer can design an encryption algorithm or generate a very tough key which forces an attacker to spend more time for brute-force attack and cryptanalysis then I have automatically made my cryptosystem more secure. The rule of thumb here is: The longer it takes to break the key the more "secure" the cryptosystem is. But all keys will be broken eventually. It's just a matter of time. $\endgroup$ – xorcoder Dec 24 '14 at 17:18
  • $\begingroup$ To a degree, yes. However this principle doesn't state "more secure" or "less secure", it just states "secure". If it takes a hacker the lifetime of the sun, or the lifetime of our modern universe, then it doesn't make much of a difference. It's "secure". $\endgroup$ – Thebluefish Dec 24 '14 at 17:22
  • $\begingroup$ And that's my point exactly. Kerckhoff didn't mention the time factor in his formula. I do. And I also added the money factor to my formula. Look, it is not my intention to say that my principle, as stated above, is better than Kerckhoff's. But it is more precise at least. $\endgroup$ – xorcoder Dec 24 '14 at 17:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.