If the attacker knows everything except the key, can a message still be safe?
Before the part that breaks, the part that does not. A secret needs a key and an open design, a fingerprint needs a one-way function, and both of those, the symmetric cipher and the hash, meet nothing worse than a square root.
In 1883 Auguste Kerckhoffs wrote down the rule that modern standards follow: a system should not need to be secret, and it should be able to fall into the enemy's hands without trouble. Everything about it may be known except one small thing, the key. The reason is practical. An algorithm is used by thousands of people and is eventually captured, reverse-engineered or leaked, and changing it means rebuilding everything. A key can be changed in a second.
That is why the standards that matter here, AES, SHA-256, ML-KEM, are all published down to the last constant, and why a product that says its cipher is secret because nobody has seen it is giving you a reason to worry.
The standard cipher that is safe even against an attacker with unlimited computing power is the one-time pad. Its key is truly random, as long as the message, and used once. Claude Shannon proved in 1949 that any cipher with that guarantee needs a key at least as large as the message space. Everything else is computational security: it is safe because breaking it would take too long, not because the ciphertext lacks the information. That difference is the whole quantum story. A promise of “too much work” can be broken by a cleverer algorithm. A promise of “no information” cannot.
The one-time pad. For an n-bit message m and a uniformly random n-bit key k, the ciphertext is
c = m ⊕ k and m = c ⊕ k
For any fixed m, the ciphertext c is itself uniformly random, so the probability of seeing a given c is 2−n whatever the message was. By Bayes' rule the attacker's belief about m after seeing c is the belief before. For n = 4 this is a table you can check: for each of the 16 ciphertexts, each of the 16 messages is explained by exactly one key (k = m ⊕ c), which the verification script confirms by enumeration.
Shannon's theorem. A cipher has perfect secrecy only if the number of keys is at least the number of messages. With fewer keys than messages some message has no key that explains a given ciphertext, so the attacker has ruled it out, and the pad is the extreme case with exactly as many keys as messages.
Never reuse the pad. If two messages share a key, the key cancels:
c₁ ⊕ c₂ = (m₁ ⊕ k) ⊕ (m₂ ⊕ k) = m₁ ⊕ m₂
and the XOR of two messages is the kind of structure that language and file formats give away. The pad's perfect secrecy is a property of using it exactly once, which is also why it is almost never used: delivering a secret key as long as the message is the same problem as delivering the message.
Almost nothing uses a pad Real systems use computational security, with a short key stretched over gigabytes by a cipher like AES, and rely on the open design that Kerckhoffs asked for: the algorithms in your browser and your phone are public standards that anyone can attack. The attack is the review process.
The one technology that tries to deliver pad-quality keys Quantum key distribution tries to establish a truly random shared key by physics rather than by an unproven hardness assumption. It does not replace the encryption problem this course is about, for reasons set out on the post-quantum page: it needs dedicated hardware, still needs authentication, and is not endorsed by several national agencies for that job.
Why this comes first The rest of the course is about computational security: which assumptions a quantum computer breaks (the ones public-key cryptography rests on) and which it only dents (the ones symmetric ciphers and hashes rest on). The pad is the baseline against which you can say what a weaker promise is worth.
Check yourself
A system's design is published and an attacker has seen every ciphertext. According to Kerckhoffs's principle, what should its safety rest on?
Kerckhoffs asked that a system survive its design falling into enemy hands, so everything but the key may be public. Algorithms leak and are expensive to change; a key can be replaced in a second.