I think you're on to something, it makes sense to define the 'key' to represents everything that is secret, making "security through obscurity" contradictory.

I think you're on to something, it makes sense to define the 'key' to represents everything that is secret, making "security through obscurity" contradictory. That said, the way you treated the additional information is somewhat disingenuous. It disregards that even though there might be 2^16 options they're not equally likely, assigning the same amount of information to each doesn't really represent the situation well. An alternative method would be to measure the information using the Kullback-Leibler divergence, which represents the information disadvantage a distribution has to the actual distribution. In this case the attacker would believe the key to have a probability distribution, whereas the target knows the key exactly. In which case the expression for the KL-divergence is simply -log(p), where p is the probability the attacker assigns to the actual key. When there are N options, all equally likely this agrees with the usual notion of entropy. However if the attacker assigns a very low probability to some option (i.e. using a different port) then the effective key complexity could become quite high. If the attacker considers the key impossible (i.e. p=0) the the effective key complexity would even be infinite. In the article they gave an example of 18,000 connections vs 5, which would effectively give you 12 extra bits of security (with very little effort). I'm not sure entirely sure what the optimal tactic would be for searching a non-uniformly distributed key space, but from it's definition the KL-divergence does measure the amount of information to determine the 'actual' distribution. I strongly suspect that there is no way to get around this (on average).