Exceptions to Kerckhoffs's second principle do exist
Background
Kerckhoffs addressed the problem of how to use cryptography in military telegraphy. This was to be a critical issue during World War I (see the German ADFGX and ADFGVX ciphers).
In 1881, Kerckhoffs became professor of German at the Ecole des
Hautes Etudes Commerciales and at the Ecole Arago, both in Paris. It
was during this time that, aged 47, he wrote La Cryptographie
militaire. [1]
What did Auguste Kerckhoffs actually say? We need go back to the original French of La Cryptographie militaire, which is very clearly shown and translated here.
He made two points:
It is necessary to distinguish carefully between a system of
encipherment envisioned for a momentary exchange of letters between
several isolated people and a method of cryptography intended to
govern the correspondence between different army chiefs for an
unlimited time. [Kahn; page 123]
And secondly, that encipherment systems could only be understood from the viewpoint of cryptanalysis.
From these two fundamental principles for selecting usable field
ciphers, Kerckhoffs deduced six specific requirements: (1) the system
should be, if not theoretically unbreakable, unbreakable in practice;
(2) compromise of the system should not inconvenience the correspondents; (3) the key should be rememberable without notes and
should be easily changeable; (4) the cryptograms should be
transmissible by telegraph; (5) the apparatus or documents should be
portable and operable by a single person; (6) the system should be
easy, neither requiring knowledge of a long list of rules nor
involving mental strain. [Kahn; p.123]
What did this really mean in the context of the time? It meant that code books were weak cryptography. It meant that there was an important distinction between key and system. The enemy can know the system, even capture it entire--but security can still be maintained because everything (the cryptographic service of confidentiality) now depends on a secure key.
“I have therefore thought that it would be rendering a service to the
persons who are interested in the future of military cryptography …
to indicate to them the principles which must guide them in the
contrivance or evaluation of every cipher intended for war service." [Kahn]
Kerckhoffs is clearly talking about the design of cryptographic systems, and his main point is about compromise: losing the system should not entail a security disaster. However, he does not advocate publishing the details of one's cipher system.
Claude Shannon Weighs In--or Does He?
Simply quoting Shannon as saying, "the enemy knows the system", can be misleading:
A secrecy system can be visualized mechanically as a machine with one
or more controls on it. A sequence of letters, the message, is fed
into the in-put of the machine and a second series emerges at the
output. The particular setting of the controls corresponds to the
particular key being used. Some statistical method must be prescribed
for choosing the key from all the possible ones. To make the problem
mathematically tractable we shall assume that the enemy knows the
system being used. That is, he knows the family of transformations Ti,
and the probabilities of choosing various keys. [2]
In other words, in order to do cryptanalysis, let's assume we understand the system. If the system were unknown--the structure of the VIC cipher was a mystery to the NSA (from its inception--October 24, 1952) until 1957--cryptanalysis might have to stop. In the case of the VIC cipher it did--until a defector explained the system.
This is the "additional layer of security" that "can be used to provide defense in depth" that Ella Rose mentioned in her response. In other words, it can help provide at least one cryptographic service.
Notice the echo of things military in the phrase "defense in depth".
Argument
Exceptions and non-exceptions to Kerckhoffs's principle must be judged in terms of cryptographic services (authentication, confidentiality, integrity, non-repudiation, etc.), to include how long those services will be needed. But do we really acknowledge all services? In military matters, sometimes the goal is simply to reduce the power of the enemy. This is one way that "defense in depth" functions. The enemy gets weaker because of your defense in depth and therefore may give up. Moreover, because of the high costs, they might be unable to attack another area. The enemy makes contact, uses resources, fails, has to bypass your strongpoint, and then is weaker during their next attack. It is about maximizing costs.
Sometimes it may not matter if you are inconvenienced. What may matter more is that you made the enemy pay. This seems to be a valid cryptographic goal that goes against Kerckhoffs's second principle (at least partially). Besides, forward secrecy may not always be a concern, and side-channel attacks against an unknown system are surely more difficult than those against a studied system whose keys are relied upon completely.
Conclusion
Perhaps reduction should be seen as a valid cryptographic service because adding a layer of obscurity onto a system can be costly for the opposition, and increasing their costs and reducing their resources is surely an intended goal in some cases. Encryption can be designed to increase cryptanalytic costs and target specific collectors. In our current environment of "vulnerability by design" and the appalling way that standardization can assure that cryptography fails--in systems that are too complex, very easy to subvert, and easy for malicious actors to actively and passively control--one might sometimes suffer from doubt as to whether Kerckhoffs's second principle always applies. Yes, let's not utterly lose security if the enemy learns about our system, but what about our system of key generation? Do we want the opponent to hand it to us? Would it not be better if the opponent cryptanalysts had as little information as possible since our system was something they could hardly understand?
Otherwise, the key we use may be worthless because all members of the set of possible systems available to us may have been thoroughly studied and utterly subverted.
by NSA and othersare meant to be read as a grouping. Besides, I also wrote(most of the time)… not always! Using NSA wording: "we can neither confirm nor deny" if any state has build in backdoors or weaknesses in their own crypto. What you point at wasn't meant to be read as being about the US & NSA exclusively. See, there are 200+ other countries and some have alike institutions with alike capabilities. Wanting to prove or disprove none of them contain "options to dismantle" is like trying prove the existence of a deity. – e-sushi Jul 22 '17 at 05:47