Browse Definitions :
Definition

Kerckhoff's principle

Contributor(s): Ivy Wigmore

Kerckhoff's principle is the concept that a cryptographic system should be designed to be secure, even if all its details, except for the key, are publicly known. 

The principle, sometimes referred to as Kerckhoff's axiom or law, forms the basis of open security and security by design and contrasts directly with the deprecated security through obscurity model. 

After a message has been subjected to a cryptographic algorithm, it is expected to remain secure even if an intruder has or gains full access to the encrypted message and has knowledge of what algorithm was used. The point is that, even if a system's design and details are not made open to begin with, they may be detected by an unauthorized party and, as such, should be inherently secure. 

Auguste Kerckhoff, a Dutch linguist and cryptographer, published the principle in an 1883 article, La Cryptographie Militaire (Military Cryptography). The mathematician Claude Shannon further refined Kerckhoff’s principle. According to Shannon’s maxim, "one ought to design systems under the assumption that the enemy will immediately gain full familiarity with them."

This was last updated in August 2015

Continue Reading About Kerckhoff's principle

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Implemented correctly, if you are compromised, you can 'just' change the keys. The alternative is security through obscurity, which only works if the value of what you are protecting is so low that you don't /need/ true security anyway ...
Cancel

-ADS BY GOOGLE

File Extensions and File Formats

SearchCompliance

  • risk management

    Risk management is the process of identifying, assessing and controlling threats to an organization's capital and earnings.

  • compliance as a service (CaaS)

    Compliance as a Service (CaaS) is a cloud service service level agreement (SLA) that specified how a managed service provider (...

  • data protection impact assessment (DPIA)

    A data protection impact assessment (DPIA) is a process designed to help organizations determine how data processing systems, ...

SearchSecurity

  • identity provider

    An identity provider is a system component that is able to provide an end user or internet-connected device with a single set of ...

  • firewall

    A firewall is software or firmware that enforces a set of rules about what data packets will be allowed to enter or leave a ...

  • encryption

    Encryption is the method by which information is converted into secret code that hides the information's true meaning. The ...

SearchHealthIT

SearchDisasterRecovery

  • business continuity plan (BCP)

    A business continuity plan (BCP) is a document that consists of the critical information an organization needs to continue ...

  • disaster recovery team

    A disaster recovery team is a group of individuals focused on planning, implementing, maintaining, auditing and testing an ...

  • cloud insurance

    Cloud insurance is any type of financial or data protection obtained by a cloud service provider. 

SearchStorage

Close