This comes from Kerckhoffs' Principle: a system should be secure even if everything about the system, except the key, is public knowledge.