Kerckhoffs' Principle & Threat Models
Why the algorithm is public and only the key is secret, and how to state what a scheme actually promises — the attacker-capability ladder from ciphertext-only to chosen-ciphertext, and the goals from IND-CPA to authenticated encryption.
Before you can call anything secure you have to answer two questions: secure against whom, with what powers and secure meaning what, exactly. Cryptography is unusual among engineering disciplines in that both answers are formalized — an attacker model and a security goal — and a scheme without them stated is not a claim, it's a vibe. This entry is the vocabulary the rest of the domain assumes.
Kerckhoffs' principle #
Auguste Kerckhoffs (1883) laid out six requirements for a field cipher; the second became the foundation of the discipline: the system must not require secrecy, and must be able to fall into enemy hands without inconvenience. Shannon restated it as the design maxim "the enemy knows the system".
The principle is not about openness as a virtue. It is a statement about what can be replaced:
There is a second, harder-won benefit: public designs get attacked by people who will tell you. Secret designs get attacked by people who won't.
Historical violations and what they cost:
- 1987 A5/1 (GSM voice) is designed in secret; reverse-engineered and published in 1999, then broken with rainbow tables. Two billion phones inherited the flaw.
- 1989 GOST 28147-89 is standardized without its S-box values — each deployment supplies its own, so the published "standard" cannot be analyzed as specified.
- 1993 Skipjack (Clipper chip) is classified; NSA asks the public to trust it. Declassified 1998; a flaw in the accompanying LEAF escrow protocol had already been found by Matt Blaze in 1994.
- 1994 RC4 leaks anonymously to Cypherpunks after years as an RSA Security trade secret; the biases that eventually killed it were found only once it was public.
- 2007-13 Dual_EC_DRBG: a NIST-standardized RNG with unexplained constants. Shumow and Ferguson show in 2007 that whoever generated them could hold a backdoor; Snowden documents in 2013 indicate exactly that. NIST withdraws it. The lesson is not "public is enough" but that unexplainable parameters are a defect even inside a public standard.
The modern counterpart is the nothing-up-my-sleeve number: constants derived visibly from π, √2, or the smallest value meeting stated criteria, so there is no room to hide a choice. Blowfish's π-based key schedule, SHA-2's cube roots of primes, and Curve25519's rigid parameters are all this idea.
The attacker-capability ladder #
What the attacker can do determines what you must defend. Each rung strictly contains the previous:
| Model | Attacker has | Realistic when |
|---|---|---|
| Ciphertext-only (COA) | intercepted ciphertexts | passive wiretap |
| Known-plaintext (KPA) | some plaintext/ciphertext pairs | fixed headers, known file formats, protocol greetings |
| Chosen-plaintext (CPA) | can get plaintexts of their choosing encrypted | any system that encrypts attacker-influenced data — a web app encrypting a form field, a VPN carrying attacker-triggered traffic |
| Chosen-ciphertext (CCA) | can additionally submit ciphertexts and learn something about decryption | any system that decrypts attacker-supplied data and behaves observably — i.e. essentially every network service |
| Adaptive CCA (CCA2) | can choose each query based on prior answers | the realistic default for online protocols |
Then there are capabilities that sit outside the classical ladder entirely: side channels (timing, cache, power, EM, acoustic), fault injection, and physical access. A scheme can be information-theoretically perfect and still leak the key through a power trace.
Security goals #
Symmetric encryption goals, weakest to strongest:
- One-wayness — the attacker can't recover the whole plaintext. Far too weak; leaking half the message is a pass.
- Semantic security / IND-CPA — given two plaintexts of equal length and the encryption of one, the attacker can't tell which. This is the real bar for confidentiality, and it forces encryption to be randomized: any deterministic scheme fails immediately, because the attacker just encrypts both candidates and compares. ECB mode fails here; so does textbook RSA.
- IND-CCA2 — the same, with a decryption oracle. Requires that malformed ciphertexts be rejected, which in practice means authentication.
- Authenticated encryption (AE / AEAD) — confidentiality plus integrity: the receiver rejects any ciphertext not produced by the key holder. This is the modern default; see AEAD modes.
Two more properties that protocols must state separately, because encryption alone gives neither:
- Forward secrecy — compromising long-term keys today does not decrypt traffic recorded yesterday. Requires ephemeral key agreement (DHE/ECDHE).
- Post-compromise security (self-healing) — after a compromise ends, future messages become secure again. Signal's Double Ratchet is the canonical construction.
Stating a threat model that is actually useful #
A usable threat model names four things, and the fourth is the one people skip:
- Assets — what specifically must stay confidential, authentic, or available.
- Adversary — capabilities (which ladder rung, which side channels), position (passive wiretap, active MITM, malicious server, compromised client), and budget.
- Guarantees — which of the goals above hold, under which assumptions.
- Explicit non-goals — what you are not defending against.
Finally, the assumption every threat model rests on and almost none state: that the key was generated from real entropy. No security goal survives a predictable key, and no attacker model needs to be clever if the RNG was broken.