Why Aren’t Encryption Algorithms Secret?

You publish the complete design of the lock — the materials, the mechanism, the number of pins, even the exact manufacturing process.

The only thing you keep secret is the key.

At first, this sounds like a terrible idea.

If an attacker knows exactly how your lock works, shouldn't they be able to break it?

Surprisingly, this is exactly how modern cryptography is designed.

Encryption algorithms are not supposed to be secret. The key is.

But why?

To understand this, let's start with the problem cryptography is trying to solve.

The Basic Problem: Communicating Over an Insecure Channel

Suppose Alice wants to send a message to Bob.

Unfortunately, their communication channel is insecure. An attacker, Eve, can observe everything travelling through it.

Alice has a plaintext message:

HELLO

She encrypts it using an encryption algorithm and a secret key.

The result is ciphertext:

X7#p9

Bob receives the ciphertext and uses the key to decrypt it back into:

HELLO

We can describe this mathematically as:

• X = plaintext
• Y = ciphertext
• E = encryption function
• D = decryption function
• K = secret key

Encryption can be written as:

[ Y = E_K(X) ]

and decryption as:

[ X = D_K(Y) ]

The collection of all possible keys is called the key space, and its size is written as:

[ |K| ]

So where does the security come from?

The obvious answer might be:

"Keep the encryption algorithm secret."

But that's not how modern cryptography works.

Cryptology: Cryptography vs. Cryptanalysis

The broader field is called cryptology, and it is generally divided into two areas:

Cryptography

Cryptography is about designing systems that protect information.

It includes:

• encryption algorithms
• authentication mechanisms
• digital signatures
• cryptographic protocols
• key exchange

Cryptographic algorithms themselves can be divided broadly into:

• Symmetric cryptography
• Asymmetric cryptography

Cryptanalysis

Cryptanalysis is the other side of the game.

Instead of asking:

"How can we protect this message?"

cryptanalysis asks:

"How can we break or analyze this system?"

Cryptanalysts look for weaknesses in algorithms, implementations, protocols, and their usage.

And this leads to an important question.

How Do We Know an Encryption Algorithm Is Secure?

This is actually a surprisingly difficult question.

There is no mathematical test that can simply take a new encryption algorithm and say:

SECURE ✅

or

EASY TO BREAK ❌

In practice, we rely heavily on cryptanalysis and extensive public scrutiny.

A new cryptographic algorithm is studied by researchers around the world. People try to attack it, find weaknesses, and prove properties about it.

That's why a fundamental rule of cryptography is:

Never trust a cryptographic algorithm simply because its design is secret.

A secret algorithm may look incredibly complicated while containing a catastrophic weakness.

An algorithm that has been publicly analyzed for years is generally much more trustworthy.

But why reveal the algorithm in the first place?

This brings us to one of the most important principles in cryptography.

Kerckhoffs's Principle

In 1883, Dutch cryptographer Auguste Kerckhoffs formulated a principle that became fundamental to modern cryptography.

The basic idea is:

A cryptosystem should remain secure even if everything about the system is known to the attacker, except the secret key.

This is sometimes called Kerckhoffs's principle.

And at first, this sounds counterintuitive.

Why would we intentionally tell the attacker how our system works?

Because secrecy of the algorithm is a fragile security mechanism.

Consider what happens if your algorithm itself is secret.

You now have two secrets to protect:

1. The algorithm
2. The key

If the algorithm is leaked, your entire security system may collapse.

With Kerckhoffs's principle, there is only one thing that needs to remain secret:

The key.

The algorithm can be published, reviewed, attacked, implemented by thousands of people, and discussed publicly.

The attacker can know everything about it.

And the system should still be secure.

Let's Break a Simple Cipher

Let's take a historical example: the substitution cipher.

The idea is simple.

Replace every plaintext letter with another letter.

For example, imagine we create this mapping:

A → L
B → D
C → W
...

A → L
B → D
C → W
...

Suppose our plaintext is:

HELLO

HELLO

Using our substitution mapping, we might get something like:

QXYYZ

QXYYZ

The exact mapping is our secret key.

At first, this might seem reasonably secure.

After all, if someone doesn't know our mapping, how can they decrypt the message?

There are several ways an attacker can approach the problem.

Attack #1: Brute Force

The first approach is brute force, also called an exhaustive key search.

The attacker simply tries every possible key.

If the key space contains (N) possible keys, the attacker can try:

[ K_1, K_2, K_3, \ldots, K_N ]

until one produces meaningful plaintext.

This is why the size of the key space matters.

If there are only a few possible keys, brute force is easy.

If there are an enormous number of possible keys, brute force becomes impractical.

For modern cryptographic systems, we deliberately choose key sizes large enough that trying every possible key would require an infeasible amount of computation.

Attack #2: Frequency Analysis

But what if brute force isn't practical?

Historical substitution ciphers have another major weakness:

language has patterns.

Some letters appear much more frequently than others.

In English, for example, letters such as:

• E
• T
• A
• O
• I

appear frequently.

Suppose an attacker intercepts a long ciphertext and notices that one ciphertext symbol appears far more frequently than all the others.

They can make an educated guess:

"Maybe this symbol represents E."

They can then look at common patterns.

For example:

QXYYZ

QXYYZ

If the same ciphertext pattern appears repeatedly, the attacker can begin making guesses about words and letters.

This is called frequency analysis.

The fundamental weakness is that a simple substitution cipher preserves too much structure from the original language.

Most importantly:

The same plaintext letter is always mapped to the same ciphertext letter.

So if:

E → X

E → X

then every E becomes X.

The ciphertext therefore leaks information about the frequency and structure of the plaintext.

The Bigger Lesson

The substitution cipher teaches us something much more important than how to break an old cipher.

It shows why hiding the algorithm is not a good security strategy.

Imagine that we create a new substitution cipher and tell everyone:

"The algorithm is secret. Nobody knows how it works!"

That might make us feel secure.

But once an attacker gets hold of the algorithm, the entire system may be compromised.

Instead, cryptography takes a different approach:

Assume the attacker knows everything about the algorithm. Protect only the key.

This changes the security question completely.

Instead of asking:

"Can the attacker figure out how our algorithm works?"

we ask:

"Even if the attacker knows exactly how our algorithm works, can they still recover the plaintext without knowing the key?"

That's a much stronger standard.

Security Should Depend on the Key, Not the Algorithm

This principle is everywhere in modern cryptography.

Consider a system like AES.

The AES algorithm is publicly known.

Its specifications are publicly available.

Researchers have studied it for years.

There is no expectation that AES's algorithm itself will remain secret.

Yet AES can still be secure because its security depends on the secrecy of the key.

This gives us an important separation:

PUBLIC
 ├── Encryption algorithm
 ├── Protocol
 └── Implementation details
SECRET
 └── Key

PUBLIC
 ├── Encryption algorithm
 ├── Protocol
 └── Implementation details
SECRET
 └── Key

The attacker can know the public information.

The challenge is recovering the secret key.

Why This Is Actually Better

There is another advantage to public algorithms:

Public scrutiny

If an algorithm is public, thousands of researchers can examine it.

They can ask:

• Can we find weaknesses?
• Can we reduce the key search space?
• Are there mathematical attacks?
• Does the algorithm leak information?
• Are there implementation vulnerabilities?

If someone discovers a weakness, the cryptographic community can respond.

With a secret algorithm, weaknesses may remain hidden simply because nobody has been able to inspect the system properly.

This is why cryptography generally prefers:

Open algorithms + secret keys

over:

Secret algorithms + secret keys

The Real Challenge

The beautiful part of cryptography is that the attacker gets an enormous amount of information.

They may know:

• the encryption algorithm
• the ciphertext
• the protocol
• the implementation
• sometimes even some plaintext/ciphertext pairs

And yet the system should remain secure.

The only thing they should not know is the secret key.

That's the challenge cryptographers try to solve.

And that is the reason modern encryption algorithms don't need to be secret.

The algorithm can be public.

The mathematics can be public.

The implementation can be public.

The key is what must remain secret.

And if revealing the algorithm completely destroys the security of the system, then the system was probably never very secure to begin with.

Final Takeaway

The next time you see a cryptographic algorithm whose entire specification is available online, don't think:

"If everyone knows how it works, how can it possibly be secure?"

Think instead:

"Good. Everyone knows how it works. Now let's see whether anyone can break it without the key."

That's the philosophy behind modern cryptography.