3 ms·

As far as I know the state of the art in image stego is perturbed quantization with wet paper codes. The essential idea with wet paper codes is that you can us

by nullc 6y ago

As far as I know the state of the art in image stego is perturbed quantization with wet paper codes. The essential idea with wet paper codes is that you can use error correcting codes so that even the recipient need not know which bits contain the data. A simple analogy is that if you wanted to communicate only a single bit you could decide that the xor of all the data in the image decides the bit. Then the encoder can flip the single least distinguishable bit to encode their message. The idea behind perturbed quantization is that when you quantize the data (e.g. while jpeg compressing it) some values will be maximally close to tied between rounding up and rounding down. If you embed your data in those values you'll minimize the embedding noise. Unfortunately most of the work on approaches based on these ideas is academic and has no public implementation, but there is one that I'm aware of https://sourceforge.net/projects/pqstego/ https://sourceforge.net/projects/pqstego/ There is a lot that could be done both with respect to security (e.g. using better models to predict the image to hide the stego noise better, better error correcting codes, and list decoding) and basic engineering, e.g. handling content length encoding better.

jkhdigital 6y ago
Image steganography techniques have indeed reached a level of sophistication that requires significant expertise to implement correctly. A good parallel is compression--most CS undergrads can figure out how to implement Huffman or even LZW compression, but state-of-the-art ANS (asymmetric numeral systems) is pretty dense. I believe a special type of wet paper code called a syndrome-trellis code is at the forefront of image steganography: http://dde.binghamton.edu/filler/pdf/Fill10tifs-stc.pdf http://dde.binghamton.edu/filler/pdf/Fill10tifs-stc.pdf. Good luck parsing that without a solid foundation in information theory. Steganography is the current focus of my PhD research, and from my perspective the greatest security challenges are in systems engineering. Embedding secret messages into your vacation photos is one thing, but who are you sending these messages to? And why? How will they know when and where to go looking for the secret message? Encryption entered its golden age with the advent of public-key cryptography and Diffie-Hellman key exchange, allowing two parties to share the secrets required for secure communication knowing only public information about one another. However, steganographic systems are still dependent upon lots of out-of-band secret sharing, since attempting to share the necessary secrets over public channels tends to reveal the existence of the system and opens up DoS attacks (e.g. Tor and the identity of relays). IMHO, figuring out better solutions to the system security of particular steganographic applications is a much more pressing research problem than improving statistical embedding profiles for image steganography.
- nullc 6y ago
  You can use public key encryption which is indistinguishable from uniform. E.g. using ECDH w/ ellegator and ed25519 for the key agreement. Then the recipient of the stego need only publish the public key. If the encoding software were part of standard linux distributions (even if just specialized security conscious distros), then the sender could obtain it without identifying themselves. I don't think you can tackle the problems in isolation: There isn't much point in making uniform encryption if the embedding gives it away to anyone who's looking. :) > but who are you sending these messages to? One scheme I've been fond of is where the recipient announces their public key and that they'll accept messages in images posted to some moderately high traffic public picture board, like r/naturepics. Then then simply download and process all images submitted there. The sender has an easy and obvious cover story for their posting and can produce as many images they need just by visiting a park with a camera.
  - betterunix2 6y ago
    "the recipient announces their public key" A typical threat model is that there is a "warden" who can selectively block messages, so this would not really work since the warden would block the announcement (in theory the warden is not going to block all messages, although a formal security definition should only focus on whether or not the warden is more likely to block stegomessages than innocent messages, which is trivial if the warden blocks everything). Thus out of band communication is needed to distribute secrets; likewise, the stegosoftware itself has to be distributed out of band. "indistinguishable from uniform" Actually you need to be indistinguishable from the "background noise" (the thermal noise from the camera sensor) of the image, which is not uniform. In fact, the noise is correlated with the camera itself and can be used to identify which camera took a particular photo.
    - nullc 6y ago
      > Thus out of band communication is needed to distribute secrets; likewise, the stegosoftware itself has to be distributed out of band. This is why public key cryptography is so important. Because you can use a broadcast channel -- like a Linux distro to communicate the tools and required knowledge in a way that doesn't give a strong signal that you're using it. > "indistinguishable from uniform" Actually you need to be indistinguishable from the "background noise" (the thermal noise from the camera sensor) of the image This isn't the case for code based encoding. The encoded values are a pseudorandom linear combination of a huge number of bits from the image and end up being extremely uniform. Consider my silly xor example: the xor of all the bits in the image is going to be close to uniform, even if the bits in the image are fairly biased. But also more generally: If you have a way to map encrypted messages onto the space of uniform strings, then you can also remap from them onto any other required distribution in a fairly straight forward way. Having a good error metric is important though, and it's one of the areas that seems a bit under researched.

by nullc 6y ago

jkhdigital 6y ago

Image steganography techniques have indeed reached a level of sophistication that requires significant expertise to implement correctly. A good parallel is compression--most CS undergrads can figure out how to implement Huffman or even LZW compression, but state-of-the-art ANS (asymmetric numeral systems) is pretty dense. I believe a special type of wet paper code called a syndrome-trellis code is at the forefront of image steganography: http://dde.binghamton.edu/filler/pdf/Fill10tifs-stc.pdf http://dde.binghamton.edu/filler/pdf/Fill10tifs-stc.pdf. Good luck parsing that without a solid foundation in information theory. Steganography is the current focus of my PhD research, and from my perspective the greatest security challenges are in systems engineering. Embedding secret messages into your vacation photos is one thing, but who are you sending these messages to? And why? How will they know when and where to go looking for the secret message? Encryption entered its golden age with the advent of public-key cryptography and Diffie-Hellman key exchange, allowing two parties to share the secrets required for secure communication knowing only public information about one another. However, steganographic systems are still dependent upon lots of out-of-band secret sharing, since attempting to share the necessary secrets over public channels tends to reveal the existence of the system and opens up DoS attacks (e.g. Tor and the identity of relays). IMHO, figuring out better solutions to the system security of particular steganographic applications is a much more pressing research problem than improving statistical embedding profiles for image steganography.

nullc 6y ago
You can use public key encryption which is indistinguishable from uniform. E.g. using ECDH w/ ellegator and ed25519 for the key agreement. Then the recipient of the stego need only publish the public key. If the encoding software were part of standard linux distributions (even if just specialized security conscious distros), then the sender could obtain it without identifying themselves. I don't think you can tackle the problems in isolation: There isn't much point in making uniform encryption if the embedding gives it away to anyone who's looking. :) > but who are you sending these messages to? One scheme I've been fond of is where the recipient announces their public key and that they'll accept messages in images posted to some moderately high traffic public picture board, like r/naturepics. Then then simply download and process all images submitted there. The sender has an easy and obvious cover story for their posting and can produce as many images they need just by visiting a park with a camera.
- betterunix2 6y ago
  "the recipient announces their public key" A typical threat model is that there is a "warden" who can selectively block messages, so this would not really work since the warden would block the announcement (in theory the warden is not going to block all messages, although a formal security definition should only focus on whether or not the warden is more likely to block stegomessages than innocent messages, which is trivial if the warden blocks everything). Thus out of band communication is needed to distribute secrets; likewise, the stegosoftware itself has to be distributed out of band. "indistinguishable from uniform" Actually you need to be indistinguishable from the "background noise" (the thermal noise from the camera sensor) of the image, which is not uniform. In fact, the noise is correlated with the camera itself and can be used to identify which camera took a particular photo.
  - nullc 6y ago
    > Thus out of band communication is needed to distribute secrets; likewise, the stegosoftware itself has to be distributed out of band. This is why public key cryptography is so important. Because you can use a broadcast channel -- like a Linux distro to communicate the tools and required knowledge in a way that doesn't give a strong signal that you're using it. > "indistinguishable from uniform" Actually you need to be indistinguishable from the "background noise" (the thermal noise from the camera sensor) of the image This isn't the case for code based encoding. The encoded values are a pseudorandom linear combination of a huge number of bits from the image and end up being extremely uniform. Consider my silly xor example: the xor of all the bits in the image is going to be close to uniform, even if the bits in the image are fairly biased. But also more generally: If you have a way to map encrypted messages onto the space of uniform strings, then you can also remap from them onto any other required distribution in a fairly straight forward way. Having a good error metric is important though, and it's one of the areas that seems a bit under researched.