# What are the exceptions to Kerckhoffs's principle?

Kerckhoffs's principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

Yet the following are three exceptions:-

1. NSA Suite A cryptographic algorithms. There is an answer here that implies that the Suite B algorithms are broken therefore can be published so that the NSA can listen in on Suite B users. And by not publishing Suite A, no one knows for sure instead relying on security through obscurity.
2. Banks holding my money. They haven't published a security architecture diagram of their network, and probably wouldn't tell me over the phone how they've implemented AES. Perhaps they use ECB mode or even their own Barclay's mode. Banks are civilian organisations, not military like example 1. They're regulated yes, but (even redacted) security reports are not published.
3. Windows' Cryptography API. This is used by some people and they unknowingly might be using the dodgy Dual_EC_DRBG, or something even more decrepit. There is no code audit available to prove any particular mode of operation or algorithm. This particular API could easily be published to assuage users fears without revealing the rest of Windows' internals.

It seems to me that whilst Kerckhoff sounds plausible, many organisations ignore it. And get away with it. What are the real world exceptions or rules? Does it for example only apply to amateur cryptography?

• Your quote only says that the system should still be secure even if it is public - not that it should ALWAYS be public. – Nova Jul 7 '17 at 17:24
• No, it's not implied. We typically advise people to publish their system, in part because most people do not have the resources to adequately review their design for cryptographical weaknesses. I find it plausible, at least in your first example, that the NSA might have the resources in house, and perhaps maybe even used those resources to analyze Suite A. – poncho Jul 7 '17 at 18:16
• I would strongly disagree with the fact that @e-sushi 's answer implies that Suite B crypto is "broken therefore can be published so that the NSA can listen in on Suite B users". There is no evidence this is the case and many smart people have looked very long and hard at this crypto since the 90s and have concluded it is secure. – SEJPM Jul 7 '17 at 18:20
• @PaulUszak That's not paraphrasing but misinterpreting. The words by NSA and others are meant to be read as a grouping. Besides, I also wrote (most of the time)… not always! Using NSA wording: "we can neither confirm nor deny" if any state has build in backdoors or weaknesses in their own crypto. What you point at wasn't meant to be read as being about the US & NSA exclusively. See, there are 200+ other countries and some have alike institutions with alike capabilities. Wanting to prove or disprove none of them contain "options to dismantle" is like trying prove the existence of a deity. – e-sushi Jul 22 '17 at 5:47
• – e-sushi Jul 22 '17 at 6:16

Kerckhoffs's principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.

The principle does not state that it is unconditionally unacceptable to keep your algorithm or system a secret. (This answer provides an image of the original text Kerckhoffs used.)

Just keeping the used algorithm a secret is not itself a violation of the principle - as long as it would be secure even if the algorithm was known. AES would be secure even if it is known that you used it, keeping the fact that you used AES a secret does not hurt anything. In fact, it is possible that it could provide an additional layer of security, and can be used to provide "defense in depth".

NSA suite A/suite B is a good example of this: It is not an exception to Kerckhoffs princpiple, because the system would (most likely) be secure even if you knew what algorithms they were using. It simply adds a theoretical additional layer of difficulty if you don't know what they are using.

As for banks, I am not necessarily qualified to speak about their systems, as I do not know them; However, it is plausible that some of them were created quite a while ago, and consequently may not necessarily utilize all the best practices that we would build a new system with today. "It's in production already" can be hard to argue with.

As for Microsoft, well, you say they "get away with it" - many if not most people are not exactly thrilled about their decisions to keep everything a secret; However, they do that for way more then just the crypto API, and such decisions are probably made from a business perspective, rather then a crypto one.

edit: Apparently, if you are really so inclined and willing to sign stuff, you can view some of Microsofts source code. While that's not exactly "open", it implies that you could find out what they were doing if you really wanted to.

## However...

Sometimes violation of the principle is simply an attempt to compensate for the inadequacy of the algorithm/system by keeping it a secret from the adversary - this is the situation where the principle will end up making a difference.

This has proven itself to be a poor strategy - instead of allowing the problems to become known so that they can be fixed, they chose to cover them up and hope that nobody finds them. When "hope" appears as an factor in your crypto-system, that's a sure sign of a problem.

• Actually, the Windows source is semi-public. If you sign the appropriate NDAs you can review it "no problem", now I'd guess large-scale users (Nations? Really big Companies?) buy-in expertise and review such critical portions of the source for security... – SEJPM Jul 7 '17 at 18:23
• @SEJPM Okay we're making progress. Kerckhoff is now redefined to "... is semi-public knowledge." – Paul Uszak Jul 7 '17 at 18:35
• @SEJPM You forgot to mention (let's just call them) hackers. But then again, it was only "beta" code… ;) – e-sushi Jul 22 '17 at 6:02
• @PaulUszak Kerckhoff is now redefined to "... is semi-public knowledge." Just to be sure: do you really mean Kerckhoffs, or did you want to mock his 2nd principle? Btw: the name is Auguste Kerckhoffs… that's Kerckhoffs with an "s" at the end. – e-sushi Jul 22 '17 at 6:06
• Good answer. That last sentence alone deserves a +1. :) – Ilmari Karonen Jul 22 '17 at 12:11