Thursday, April 17, 2008

Steganography - the Art of Hiding Information

Steganographic techniques have been used since World War I and World War II, Chemicals were developed and used as secret inks that become visible when brought in contact with other chemicals. A brief history of steganography would give us a valuable background.

Greek historian Herodotus recorded the earliest records of steganography. When Histiaeus had to send a secret message to his son-in-law, he shaved the head of a slave and tattooed a message, he waited till the hair had grown before dispatching him in order to avoid detection. Another Greek history was when Demeratus scraped the wax off tablets and wrote messages on the underlying wood he then covered the wood with wax again to conceal the message. The tablets appear to be blank and unused when inspected.

Invisible ink has always been a popular method of steganography. Ancient Romans wrote between lines using invisible inks made from substances like milk, urine and fruit juices. When it is heated, the invisible ink would darken and become legible.

Gaspari Schotti wrote the earliest book on steganography in 1665 called Steganographica. A major development in the field occurred in 1883 with the publication of Auguste Kerckhoffs cryptographie militaire. Although the work was mostly on cryptography, it provides valuable principle in the design of new steganographic systems..

Steganography In Principle

Bruce Schneier describes steganography as follows: Steganography serves to hide secret messages in other messages, such that the secret's very existence is concealed [SCH96]. Another basic definition would simply be the act of hidden communication. Whatever definition you find suitable the fundamental principle should be the same. The message is the information to be hidden and may be an image, audio or anything that can be embedded into a bitstream. The cover and the embedded message create a stego-carrier that may require a stegokey. The stegokey is additional secret information such as a password. A possible formula for the process is represented as follows:

Cover medium + embedded message + stegokey = stego-medium

Hiding information in electronic media requires alterations to the media properties, which may introduce some form of degradation. This degradation can sometimes be visible and point to the signatures of the steganographic methods and tools. These signatures may actually broadcast the existence of the embedded message thereby defeating the purpose of steganography.

Steganographic system is considered broken:

• If the attacker can detect the use of steganography.

• If the attacker can read the embedded message.

Noise: The simplest technique is to replace the noise in a sound or image file with the message. For example, one spot in a picture may have 220units of pink on a scale of 0 to 255. The average eye would not notice if that one spot was converted to 219 units of pink. It is possible to hide volumes of information below the threshold of perception if done systematically.

In this scenario we assume that Alice and Bob are allowed to share a secret key prior to imprisonment. This gives them the opportunity to communicate covertly and defeat an active warden . In all previous discussion, steganography simply encrypts a message in such a way that the ciphertext appears random while embedding the bits of the message in a known subliminal channel.

In the presence of an active warden, it would not be enough to embed a message in a known place. If Alice can alter the bits in an image then the warden can do the same thereby destroying message sent through the subliminal channel. A cryptographically secure pseudo-random generator, seeded by a secret key can be used to pick a subset of pixels in an image to conceal the data. If Wendy makes changes to the image, it would only scramble a small percentage of the channel bit since she does not know where they are. The scrambling can be corrected with an error-correcting code. Sharing keys before imprisonment gives a lot of freedom to Alice and Bob, and the public key can be used to sign the secret message, which provides additional security by preventing impersonation. Having to exchange keys far in advance of covert communication makes it a bit difficult in real life.

No comments: