Symptom

A vendor pitches you an encryption product. The algorithm is proprietary. When you ask for details, they explain that publishing it would help attackers, and that the secrecy of the design is an additional layer of protection.

The claim is not obviously wrong. More secrets sound like more security. But think about what it implies operationally: the design is in the binary you were just given, and in the heads of everyone who built it, and in the patent application. It cannot be changed after a breach without replacing the product. And you cannot evaluate it, which means your decision rests entirely on the vendor’s confidence.

Meanwhile a different question is nagging. If cryptography is always a race between cipher designers and cryptanalysts, is there anything that simply cannot be broken, however much computation an attacker has? Or is every cipher just temporarily ahead?

Statement

Two results, one a design principle and one a theorem, and they turn out to be the same statement about where secrecy lives.

Kerckhoffs’s principle (1883). A cryptosystem should remain secure even if everything about the system, except the key, is public knowledge.

Perfect secrecy (Shannon, 1949). A cipher has perfect secrecy if the ciphertext is statistically independent of the plaintext:

$$\Pr[M = m \mid C = c] = \Pr[M = m]$$

for all $m$ and $c$. Observing the ciphertext gives the adversary no information about the message.

Shannon’s theorem. Perfect secrecy requires $H(K) \geq H(M)$: the key must carry at least as much entropy as the message. The one-time pad achieves the bound and nothing can beat it.

The theorem is what makes the principle more than good manners. If the key must carry all the uncertainty, then the algorithm cannot be carrying any, so keeping the algorithm secret buys nothing you can quantify.

Argument

The one-time pad and why it is perfectly secret. Key $k$ is uniform random, the same length as the message; ciphertext is $c = m \oplus k$. For any fixed ciphertext $c$ and any candidate message $m’$ of the same length, the key $k’ = c \oplus m’$ is exactly as likely as any other. Every plaintext of the right length is equally consistent with the ciphertext. An adversary with unlimited computing power gains nothing, because there is nothing in the ciphertext to gain.

Why the key cannot be shorter, which is the entropy argument. This is T018 applied to secrecy rather than compression.

Suppose perfect secrecy with $|K| < |M|$, so there are fewer keys than messages. Fix a ciphertext $c$. Decrypting $c$ under every key yields at most $|K|$ distinct plaintexts, so there is some message $m^$ not among them. Then $\Pr[M = m^ \mid C = c] = 0 \neq \Pr[M = m^]$, which contradicts perfect secrecy — the adversary has learned that the message was not $m^$.

In entropy terms, perfect secrecy means $I(M;C) = 0$, and since $C$ is determined by $M$ and $K$ we get $H(M) = H(M \mid C) \le H(K \mid C) \le H(K)$. The key must supply at least as much uncertainty as the message contains.

The result is uncomfortable in exactly the right way. Perfect secrecy is achievable and it is priced at one bit of pre-shared, never-reused, uniformly random key per bit of message. If you could ship the key you could have shipped the message.

Why reuse destroys it completely, not gradually. With $c_1 = m_1 \oplus k$ and $c_2 = m_2 \oplus k$, the adversary computes $c_1 \oplus c_2 = m_1 \oplus m_2$ — the key vanishes. Two English plaintexts XORed together are readable by hand with crib dragging, and this is not theoretical: the VENONA project decrypted Soviet traffic for decades because of duplicated pad pages, and Microsoft’s PPTP MS-CHAPv2 reused keystream across directions. “One-time” is the entire specification, and the name is a warning rather than a description.

Unicity distance, the part of Shannon’s paper that gets skipped. For a cipher with key entropy $H(K)$ over a language with redundancy $D$ bits per character, the amount of ciphertext needed before the key is uniquely determined is

$$U = \frac{H(K)}{D}$$

For English, $D \approx 3.2$ bits per character, so a 56-bit DES key has $U \approx 17.5$ characters. After about 18 characters of English ciphertext, exactly one key produces sensible plaintext, and the cipher’s security from then on is purely computational — the answer is unique, it is just expensive to find. The one-time pad has infinite unicity distance because the key entropy grows with the message, and that is precisely the difference between information-theoretic and computational security.

How the principle survives the impracticality of the theorem. Since perfect secrecy is unaffordable, real cryptography settles for computational security: the ciphertext may determine the plaintext, but recovering it costs more than any adversary can spend. AES-256 with a 256-bit key encrypts terabytes; the message entropy vastly exceeds the key entropy, so it is not perfectly secret, and it is also not breakable.

Kerckhoffs’s principle applies with more force here, not less. A computationally secure cipher’s strength is a claim about the difficulty of a mathematical problem, and such claims are only credible after sustained public attack. AES was chosen through a five-year open competition; SHA-3 the same; the entire TLS 1.3 design was public through 28 drafts. The reason is not ideology. It is that no design team is large enough to find its own flaws.

The record of the alternative. Ciphers whose security depended on secrecy of design have an essentially unbroken record of failure once exposed. A5/1 in GSM, reverse-engineered and broken. CSS for DVDs, broken with a 40-bit key and a weak cipher. MIFARE Classic’s CRYPTO1, broken after the chip was decapped. RC4 leaked and then fell to statistical biases. In each case the design was recovered — from silicon, from binaries, from leaks — and then broke quickly, because it had never been tested. Obscurity does not fail gracefully; it fails all at once, on someone else’s schedule.

Forbids

Security that depends on the algorithm remaining secret. Algorithms leak, get reverse-engineered, and get decapped off chips. A design that must stay hidden has an expiry date set by your adversary.

Perfect secrecy with a key shorter than the message. Shannon’s bound is information-theoretic and unconditional. Any product claiming unbreakable encryption with a short key is claiming something impossible.

Reusing a one-time pad, ever. The XOR of the ciphertexts is the XOR of the plaintexts. A second use destroys the entire guarantee, not part of it.

Inventing your own cipher for production. Not because you are incapable, but because the only evidence of security is failed public attack, and a private design has no such evidence.

Does not forbid

It does not forbid keeping keys, configurations, and topology secret — this is the misreading that turns the principle into a slogan against all secrecy. Kerckhoffs says the design should survive disclosure, not that nothing should be confidential. Netflix, Google, and every serious security team practice defence in depth, and not publishing your internal network layout is orthogonal to whether your cipher is public.

It does not forbid closed-source implementations. The algorithm must be public; the code need not be. Apple’s iOS crypto implementations are closed while the algorithms are standard, and the Secure Enclave’s design is documented even though its firmware is not.

It does not mean the one-time pad is useless. It is genuinely deployed where key distribution is solvable by other means: diplomatic couriers, the Moscow–Washington hotline historically, and Quantum Key Distribution systems that generate fresh shared key and then use it as a pad. The constraint is logistical, not theoretical.

It does not mean computational security is second best in practice. Perfect secrecy protects only confidentiality of a single message, and provides no integrity at all. A one-time pad ciphertext is trivially malleable — flipping a ciphertext bit flips the plaintext bit — so real systems need a MAC regardless, and AES-GCM gives confidentiality and integrity together.

It does not mean published means secure. Publication is necessary, not sufficient. Dual_EC_DRBG was fully published and standardized by NIST and was almost certainly backdoored, which is the sharpest available reminder that open design enables scrutiny rather than substituting for it.

Boundary

  • Perfect secrecy is a statement about confidentiality only. No integrity, no authentication, no protection against traffic analysis, which frequently leaks more than content.
  • It assumes a uniform random key. A pad from a weak PRNG is not a pad, and this is where most “one-time pad” products fail.
  • Length is not hidden. The ciphertext reveals the message length, which is enough for real attacks on compressed or voice traffic.
  • Computational security rests on unproven assumptions — one-way functions (T076) and specific hardness assumptions, none of which are proved.
  • The principle is about design, not deployment. Public algorithms are routinely deployed with bad key management, and that is where real systems actually break.

The claim to carry: secrecy is a quantity, it lives in the key, and Shannon priced it exactly. Everything else in a cryptosystem is engineering that should be able to survive being read by your adversary, because eventually it will be.