Kerckhoffs's principle: A cryptosystem should be secure even if everything about the system, except the key, is public knowledge.
Yet the following are three exceptions:-
- NSA Suite A cryptographic algorithms. There is an answer here that implies that the Suite B algorithms are broken therefore can be published so that the NSA can listen in on Suite B users. And by not publishing Suite A, no one knows for sure instead relying on security through obscurity.
- Banks holding my money. They haven't published a security architecture diagram of their network, and probably wouldn't tell me over the phone how they've implemented AES. Perhaps they use ECB mode or even their own Barclay's mode. Banks are civilian organisations, not military like example 1. They're regulated yes, but (even redacted) security reports are not published.
- Windows' Cryptography API. This is used by some people and they unknowingly might be using the dodgy Dual_EC_DRBG, or something even more decrepit. There is no code audit available to prove any particular mode of operation or algorithm. This particular API could easily be published to assuage users fears without revealing the rest of Windows' internals.
It seems to me that whilst Kerckhoff sounds plausible, many organisations ignore it. And get away with it. What are the real world exceptions or rules? Does it for example only apply to amateur cryptography?