Kerckhoffs' Legacy: Security and Open Source

Open source is good for security and always has been. This presentation tells the lesser-known history of security and open source, with Kerckhoffs’ principle as a unifying theme. Auguste Kerckhoffs was a 19th century linguist who had an important realization: obscurity doesn’t provide any real security. I’ll begin with an introduction of his principle and explanation of its fundamental importance to the field of cryptography.

Kerckhoffs’ big idea is also relevant beyond the theoretical realm of cryptographic algorithms. I will discuss first-hand experiences and observations from my time as the moderator of the Bugtraq mailing list, a sometimes controversial forum where vulnerabilities, exploits, and patches are shared and discussed openly.

I’ll also cover the important contributions of the security research community, the output of which has directly improved security for everyone. Some of the open source tools developed by these researchers first introduced or prototyped ideas that became commercially viable security technologies, including commercial open source successes.