> That is not part of the threat model, and in any case is basically an out-of-band channel. It may not be the threat model you are interested in but it's part

> That is not part of the threat model, and in any case is basically an out-of-band channel. It may not be the threat model you are interested in but it's part of the usage model of just about anyone capable of actually using a computer with arbitrary software, even in extremely restricted parts of the world. (users who can't run arbitrary software can't really be helped by steg stuff they can't use!) Simplified threat models can be extremely helpful in formalizing security arguments, but taking them too and confusing them for actual usage can be devastating for the users security too. > That has nothing to do with what I was talking about. The "time domain" of the image is where the noise lies and where the bias exists in the bits. Even if it can be encoded in some way that looks uniform, that does not mean that an arbitrary change to the encoded image will have the correct bias when it is decoded. In fact it has everything to do with what you were talking about. One of the advantages of using wet paper codes is that you can arbitrarily preserve the properties of the underlying data while encoding uniformly random information. Even better: only the encoder needs to know about the properties that are being preserved, so it can use information which is unavailable to the attacker or the receiver such as an unquantized or higher resolution original. This is what the PQstego program I linked above does. The encoder has significant freedom to preserve whatever properties it needs to preserve while encoding uniform data. > but the reverse direction is not so straightforward. This is a classic problem with doing ElGamal encryption on elliptic curves You would _very much_ not want to use ElGamal for this (or essentially any application which you didn't need its additive homomophism)-- doing so has terrible performance, terrible security properties, and terrible communications efficiency. If you look back at my message I specifically brought up "elligator" for ECDH -- a bidirectional mapping between curve25519 points and bits. Similar approaches exist for many other curves.