3 ms·

"you can use a broadcast channel" That is not part of the threat model, and in any case is basically an out-of-band channel. "like a Linux distro to communica

"you can use a broadcast channel" That is not part of the threat model, and in any case is basically an out-of-band channel. "like a Linux distro to communicate the tools and required knowledge in a way that doesn't give a strong signal that you're using it." Again, the threat model is that the adversary controls the network and can block or modify messages at will. So unless all linux distros included the software, the adversary would simply block those that include the software. The threat model of steganography basically implies that some out of band distribution is needed. "encoded values are a pseudorandom linear combination of a huge number of bits from the image and end up being extremely uniform" That has nothing to do with what I was talking about. The "time domain" of the image is where the noise lies and where the bias exists in the bits. Even if it can be encoded in some way that looks uniform, that does not mean that an arbitrary change to the encoded image will have the correct bias when it is decoded. "you can also remap from them onto any other required distribution in a fairly straight forward way." In the forward direction, but the reverse direction is not so straightforward. This is a classic problem with doing ElGamal encryption on elliptic curves -- some curves do not have an easily invertable map from bit strings to the EC group. I do not know how hard this is to do with images, but when I last looked image stegosystems relied on heuristics and needed relatively short messages to remain secure.

nullc 6y ago
> That is not part of the threat model, and in any case is basically an out-of-band channel. It may not be the threat model you are interested in but it's part of the usage model of just about anyone capable of actually using a computer with arbitrary software, even in extremely restricted parts of the world. (users who can't run arbitrary software can't really be helped by steg stuff they can't use!) Simplified threat models can be extremely helpful in formalizing security arguments, but taking them too and confusing them for actual usage can be devastating for the users security too. > That has nothing to do with what I was talking about. The "time domain" of the image is where the noise lies and where the bias exists in the bits. Even if it can be encoded in some way that looks uniform, that does not mean that an arbitrary change to the encoded image will have the correct bias when it is decoded. In fact it has everything to do with what you were talking about. One of the advantages of using wet paper codes is that you can arbitrarily preserve the properties of the underlying data while encoding uniformly random information. Even better: only the encoder needs to know about the properties that are being preserved, so it can use information which is unavailable to the attacker or the receiver such as an unquantized or higher resolution original. This is what the PQstego program I linked above does. The encoder has significant freedom to preserve whatever properties it needs to preserve while encoding uniform data. > but the reverse direction is not so straightforward. This is a classic problem with doing ElGamal encryption on elliptic curves You would _very much_ not want to use ElGamal for this (or essentially any application which you didn't need its additive homomophism)-- doing so has terrible performance, terrible security properties, and terrible communications efficiency. If you look back at my message I specifically brought up "elligator" for ECDH -- a bidirectional mapping between curve25519 points and bits. Similar approaches exist for many other curves.

nullc 6y ago

> That is not part of the threat model, and in any case is basically an out-of-band channel. It may not be the threat model you are interested in but it's part of the usage model of just about anyone capable of actually using a computer with arbitrary software, even in extremely restricted parts of the world. (users who can't run arbitrary software can't really be helped by steg stuff they can't use!) Simplified threat models can be extremely helpful in formalizing security arguments, but taking them too and confusing them for actual usage can be devastating for the users security too. > That has nothing to do with what I was talking about. The "time domain" of the image is where the noise lies and where the bias exists in the bits. Even if it can be encoded in some way that looks uniform, that does not mean that an arbitrary change to the encoded image will have the correct bias when it is decoded. In fact it has everything to do with what you were talking about. One of the advantages of using wet paper codes is that you can arbitrarily preserve the properties of the underlying data while encoding uniformly random information. Even better: only the encoder needs to know about the properties that are being preserved, so it can use information which is unavailable to the attacker or the receiver such as an unquantized or higher resolution original. This is what the PQstego program I linked above does. The encoder has significant freedom to preserve whatever properties it needs to preserve while encoding uniform data. > but the reverse direction is not so straightforward. This is a classic problem with doing ElGamal encryption on elliptic curves You would _very much_ not want to use ElGamal for this (or essentially any application which you didn't need its additive homomophism)-- doing so has terrible performance, terrible security properties, and terrible communications efficiency. If you look back at my message I specifically brought up "elligator" for ECDH -- a bidirectional mapping between curve25519 points and bits. Similar approaches exist for many other curves.