3 ms·

You can use public key encryption which is indistinguishable from uniform. E.g. using ECDH w/ ellegator and ed25519 for the key agreement. Then the recipient

• betterunix2 6y ago
  "the recipient announces their public key" A typical threat model is that there is a "warden" who can selectively block messages, so this would not really work since the warden would block the announcement (in theory the warden is not going to block all messages, although a formal security definition should only focus on whether or not the warden is more likely to block stegomessages than innocent messages, which is trivial if the warden blocks everything). Thus out of band communication is needed to distribute secrets; likewise, the stegosoftware itself has to be distributed out of band. "indistinguishable from uniform" Actually you need to be indistinguishable from the "background noise" (the thermal noise from the camera sensor) of the image, which is not uniform. In fact, the noise is correlated with the camera itself and can be used to identify which camera took a particular photo.
  • nullc 6y ago
    > Thus out of band communication is needed to distribute secrets; likewise, the stegosoftware itself has to be distributed out of band. This is why public key cryptography is so important. Because you can use a broadcast channel -- like a Linux distro to communicate the tools and required knowledge in a way that doesn't give a strong signal that you're using it. > "indistinguishable from uniform" Actually you need to be indistinguishable from the "background noise" (the thermal noise from the camera sensor) of the image This isn't the case for code based encoding. The encoded values are a pseudorandom linear combination of a huge number of bits from the image and end up being extremely uniform. Consider my silly xor example: the xor of all the bits in the image is going to be close to uniform, even if the bits in the image are fairly biased. But also more generally: If you have a way to map encrypted messages onto the space of uniform strings, then you can also remap from them onto any other required distribution in a fairly straight forward way. Having a good error metric is important though, and it's one of the areas that seems a bit under researched.
    • jkhdigital 6y ago
      > But also more generally: If you have a way to map encrypted messages onto the space of uniform strings, then you can also remap from them onto any other required distribution in a fairly straight forward way. This is true, but it begs the question: where does the “required distribution” come from? Most (all?) steganographic techniques make heuristic arguments about some plausible cover distribution but there is no provable security as with cryptography. There are some theoretical results on how to make steganography provably secure, but they make use of objects (“channel oracles”) which cannot feasibly be instantiated in the real world except in a handful of unique cases.
      • nullc 6y ago
        I was starting to write what I think a useful framework is-- but then realized that it's probably what a channel oracle is. Let me guess: You provide a set of weights along with the cover data, and so long as your weighed error is below some threshold it cannot be distinguished. For some contrived signal models you can clearly construct such a map where you could prove things about the attackers ability to distinguish. For most plausible signals like images-- you cannot make such assurances. -- if you could, stuff like lossy image compression would be a solved problem too. :) I think that is okay: Having a framework that you can prove secure if some isolated sub-part is assumed secure would still be useful. Most cryptography (and essentially all practically useful cryptography) depends on making strong assumptions about some primitive. We can't prove right now that we're not accidentally leaking our passwords to the world through our choice of words in these messages. Practically speaking, we're probably not.
        • jkhdigital 6y ago
          Yes, exactly, perfectly secure steganography would be like a philosopher's stone of perfect compression for the underlying media. If you want to send something steganographically, you just encrypt it and then "decompress" the ciphertext into a cover message. The alternative--the channel oracle concept--is a non-starter for arguing real-world security because it assumes that one can efficiently draw repeated independent samples from some arbitrary "history" of the channel, which is like saying you can pause time and take as many photographs of a particular scene as you want, each with its own random observed quantum states, before deciding which picture to post to facebook. The way around all this, of course, is to just communicate over an encrypted channel, which is exactly what Tor and other censorship circumvention systems do. But even then you have to rely on unprovable statements about the plausibility of the fact that you are using a secure channel under the given circumstances, or about the inevitable leakage from the particular implementation of the channel. This is actually exactly my current line of research: building a better framework for separating the components of real-world steganographic systems into the parts which can be proven secure, and the parts which cannot. Your last statement does a surprisingly good job of capturing why arguing the security of steganography is so hard: information-theoretically, there is no way to prove that some observation in nature has zero mutual information with some other observation. The entire field of machine learning is devoted to finding signals in massive piles of seemingly meaningless noise, and any real instantiation of a stegosystem will inevitably make some noise that could, under the right circumstances, be detectable.