Open Design and Kerckhoffs's Principle
Open Design is one of the classic secure design principles (from Saltzer and Schroeder) emphasized in the CSSLP Secure Software Concepts domain. It states that the security of a system should not depend on the secrecy of its design or implementation. Instead, the protection mechanisms should be open to public scrutiny, with security relying only on the secrecy of a small, easily changeable element such as a key or password. The underlying idea is that if a design is secret, its flaws remain hidden until an attacker discovers them, whereas an open design can be reviewed, tested, and strengthened by many experts. Open Design is therefore the direct opposite of 'security through obscurity,' an approach the CSSLP body of knowledge consistently discourages because obscurity is fragile: once the secret design leaks, through reverse engineering, insider disclosure, or documentation exposure, all protection collapses. Kerckhoffs's Principle, formulated by Auguste Kerckhoffs in 1883 for military cryptography, is the historical foundation of Open Design. It asserts that a cryptosystem should remain secure even if everything about the system, except the key, is public knowledge. Claude Shannon later restated it as 'the enemy knows the system.' In practice, this means the strength of encryption must reside entirely in the key, and algorithms should be published, peer reviewed, and standardized, which is why CSSLP guidance favors vetted algorithms such as AES or RSA over proprietary, home-grown cryptography. For secure software development, these principles translate into concrete practices: never hard-code secrets or rely on hidden logic for protection, use publicly reviewed cryptographic libraries and protocols, assume attackers can read your source code or decompile binaries, protect and rotate keys through proper key management, and subject architecture and code to open review, threat modeling, and testing. Together, Open Design and Kerckhoffs's Principle teach that durable security comes from robust mechanisms and well-protected keys, not from hoping adversaries never learn how the system works.
Open Design and Kerckhoffs's Principle (ISC2 CSSLP – Secure Software Concepts)
Open Design is one of the classic Saltzer and Schroeder secure design principles, and Kerckhoffs's Principle is its cryptographic ancestor. The CSSLP exam tests these ideas heavily within Domain 1 (Secure Software Concepts) because they shape how security professionals think about where protection should come from. Many real-world breaches stem from products that relied on hidden algorithms, undocumented interfaces, or secret protocols that were eventually reverse-engineered. Understanding Open Design helps you avoid the trap of security through obscurity, evaluate vendor claims, and design systems whose strength survives public scrutiny.
What It Is
Kerckhoffs's Principle (Auguste Kerckhoffs, 1883) states that a cryptosystem should remain secure even if everything about the system, except the key, is public knowledge. Claude Shannon later restated this as "the enemy knows the system." The only thing that must stay secret is the key.
Open Design (Saltzer and Schroeder, 1975) generalizes this to all security mechanisms: the design of a system should not be secret. Security must depend on the possession of specific, easily changeable secrets (keys, passwords, tokens), not on the attacker's ignorance of how the mechanism works.
The opposite philosophy, security through obscurity, assumes that keeping the mechanism hidden provides protection. The CSSLP position is that obscurity may add a minor layer in defense-in-depth, but it must never be the primary or sole control.
How It Works in Practice
1. Separate mechanism from secret. Algorithms, protocols, source code, and architecture can be reviewed publicly; keys and credentials are protected and rotated.
2. Peer review strengthens design. Publicly vetted algorithms such as AES, RSA, and SHA-2 have withstood years of expert cryptanalysis, whereas proprietary ciphers (e.g., the original GSM A5/1, DVD's CSS, Mifare Classic's Crypto-1) were broken once reverse-engineered.
3. Compromise is recoverable. If a key leaks, you issue a new key. If a secret algorithm leaks, every deployment is broken and the fix requires redesign.
4. Open Design does not mean open source. A closed-source product can follow Open Design if its security does not depend on the code remaining secret. Conversely, open-source code can still be insecure. The principle is about dependency, not disclosure.
5. Related CSSLP concepts. Open Design supports Economy of Mechanism (simpler designs are easier to review), Complete Mediation, and Least Common Mechanism. It aligns with using standard, vetted libraries rather than "rolling your own crypto."
Common Misapplications
• Hard-coding keys or passwords into binaries (the "secret" is the code).
• Custom encryption or hashing algorithms.
• Hiding admin URLs or using non-standard ports as the only access control.
• Relying on client-side code obfuscation to protect business logic.
Exam Tips: Answering Questions on Open Design and Kerckhoffs's Principle
• Spot the keyword. If a question mentions "the system should be secure even if the attacker knows the algorithm," the answer is Kerckhoffs's Principle or Open Design.
• "Only the key is secret" is the defining phrase for Kerckhoffs. Memorize it.
• Security through obscurity is almost always the wrong choice when presented as a primary control. If an option relies on hiding the mechanism, eliminate it unless the question explicitly asks for an example of a weak practice.
• Do not confuse Open Design with open source. The exam may try to bait you: a proprietary closed-source product can comply with Open Design, and the principle does not require publishing code.
• Prefer standard, vetted algorithms. When a scenario offers a "custom proprietary cipher" versus AES, choose the publicly reviewed standard; this is Open Design in action.
• Link to the correct author. Kerckhoffs = cryptography (1883); Saltzer and Schroeder = general design principles (1975); Shannon's maxim = "the enemy knows the system."
• Scenario questions: If a vendor refuses to disclose how their encryption works and claims that secrecy is the protection, the correct response is to reject or scrutinize the product, because it violates Open Design.
• Defense in depth nuance. Obscurity may be acceptable as a supplementary layer (e.g., changing a default port), but never as the foundation. Watch for answer options that say "in addition to" versus "instead of."
• Relate to other principles when asked. Open Design pairs naturally with Economy of Mechanism and Psychological Acceptability; recognizing these groupings helps with "which principle is being applied" questions.
Quick Recap
Open Design: the mechanism may be known; security must not depend on its secrecy. Kerckhoffs's Principle: only the key must be secret. Security through obscurity: a weak practice, acceptable only as a minor supplement. On the exam, favor transparency, peer-reviewed standards, and changeable secrets over hidden mechanisms.
Unlock Premium Access
Certified Secure Software Lifecycle Professional
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3032 Superior-grade Certified Secure Software Lifecycle Professional practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CSSLP: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!