# Fundamentals of Cryptography Week 12

Week 12 Agenda

Week 12 Overview

Discussion Question

Quiz

Steganography

2

Discussion Question 9

3

Peer Response(s):  Peer Response(s) are due by Sunday, November 19th (11:59:59pm ET)

Primary Response: Primary Discussion Response is due by Wednesday, November 15th (11:59:59pm Eastern Time Zone (ET))

Symposium Reflectin

After attending the Symposium this past weekend, what do you know now that you did not know before you attended? How will this knowledge help you meet your educational or career goals?

If you were unable to attend the symposium, please share what knowledge you expect to gain during the symposium make-up session.

Discussion Question 9

4

Peer Response

– Remember, a response that simply states that their post was good or that you liked it is not considered substantive and will not earn credit.

– You should contribute to the learning via your posts and responses.

– Be sure to acknowledge any outside sources you use.

Week 12 Overview

Reading – Chapter 8 in our text

Discussion Question 9 – Symposium Reflection

Quiz 7

5

What is Stegonagraphy?

The word stenography is derived from the Greek words ‘steganos meaning “covered or protected,” and graphei meaning “writing.”

It is the art of hiding stuff so that others can’t see your stuff

Steganography is the practice of hiding data in other data in an effort to keep third parties from knowing that the intended message is even there!

This is encryption’s ugly brother!

It has art aspects since human judgement is involved.

It is different than cryptography:

Cryptography prepares a message in such a way that unauthorized parties are not able to understand it while as stenography embeds the secret messages within seemingly innocent carriers such that unauthorized parties are unaware of the communication.

Cryptography provides privacy. Steganography is intended to provide secrecy.

Steganography

Hide without altering

Obfuscates the fact of communication, not the data

Preventative – deters attacks

Cryptography

Alters without hiding

Obfuscates the data, not the fact of the communication

Curative – defends attacks

Two ancient Greek examples:

A spy warned the Greeks of an upcoming Persian invasion by writing a message on a wooden table and then covering the table with wax.

A Greek man shaved his slave’s head, tattooed a message on top of his head, waited for his hair to grow back, and then sent him to deliver the message

6

Terminology

Covertext is the formal name for the file that acts as the means of delivering a hidden message or payload.

Covert channel transmitting hidden information inside of normal network traffic.

Stego-key is the encrypting of plaintext using either symmetric or asymmetric encryption.

7

History of steganography

Dates back to 400 BC when Histaeus sent a message by shaving the head of his most trusted slave, then tattooed a message on the slave’s scalp to his friend Aristagorus, urging revolt against the Persians.

Demaratus tells Athens of Persia’s attack plans by writing the secret message on a tablet, and covers it with wax.

Chinese wrote messages on silk and encased them in balls of wax. The wax ball ‘la wan,’ could then be hidden in the messenger

A more subtle method, nearly as old, is the use of invisible ink (lemon juice, milk, or urine, all of which turn dark when held over a flame.)

In 12th century Japan, the warlords sent secret message by using invisible ink on boiled eggs.

During the American Revolutionary War, the Americans used lemon juice for invisible ink. Heat brought out the message.

Microdots used by Germany in WWII documents shrunk to the size of a dot and embedded within an innocent letter. Dots smaller than human eyes can see.

In World War 2, the allies used microdots in newspaper articles. These dots were visible under special lights.

Hidden in photographs

Embedding files in executable, video, or audio files

The first book on stegonagraphy was entitled “Steganogrpahis” written by Johannes Trithemus in the XVI century.

8

The Prisoner’s Problem

In 1984 Gustavus Simmons formulated this problem

Two accomplices are arrested in separate cells and are allowed to communicate via the warden who can look into the contents of their communication

The prisoners are to agree on an escape plan without raising suspicion of the warden.

The solution is to create a subliminal channel (communicate secretly in normal looking communication over an insecure channel.

9

Steganography in Written Text

Covert text can be imbedded in printed matter or in text.

Embedding can also be by means of altering the appearance of text by:

Skewing

Altering space

Offsetting

Font color alterations

10

Example in Industry

In 2004 it was revealed that several printer manufacturers use steganography to hide information about printer serial numbers and the manufacturing code to track counterfeits

Brother, Canon, Dell, Epson, HP, IBM, Konica Minolta, Kyocera, Lanier, Lexmark, Ricoh, Toshiba, and Xerox.

11

More Examples…

12

Modern Steganogrpahy

Hiding one message within another (container)

Most containers are rich media

Images, audio, video are very redundant, can be tweaked without altering the human eye/ear

Copyright notices embedded in digital art

Prove ownership (watermarking)

Serial number embedded to prevent replication

Seek infringements on the web using spiders/crawlers

Digital cameras EXIF (executable image file format) tags

Not secretive but hidden from the eye

Embed into such as camera type, shutter speed, focal length

Similarly, possible to embed messages in invisible part of html pages.

13

Text in Image (2 methods)

14

Does not change the size of the file

Is harder to detect than other steganography techniques

Normally must use the original program to hide and reveal data

If the picture within the hidden information is converted to another format, then the hidden data may be lost

15

Can You Detect the Differences?

16

Image in Image

17

Audio and Video Steganography

Audio

Data is hidden by modifying sample data

Uncompressed audio formats

WAV

BWF

MBWF

Compressed audio formats

Lossy

MP3

Lossless

Free Lossless Audio Codec (FLAC)

Direct Stream Transfer (DST)

Video

Coding still frames – spatial or frequency

Data encoded during refresh

Closed captioning

Visible watermarking

Used by most networks (logo at bottom right)

18

UV Watermarking

Spatial domain watermarking

Bit flipping

Color separation

Frequency domain watermarking

Embed signal in select frequency bands (high frequency areas)

19

Anti-counterfeiting

Putting hidden watermarks on photos that will appear when the image is copied.

Digital Rights Management (DRM) protocols are protocols designed to protect content creators and distributors against piracy.

20

Network Steganogrpahy

Network Steganography

Information hiding techniques which can be utilized to echange steganograms in telecommunication networks

Can be intra-protocol of inter-protocol

IP (type of services, flags, fragment offset, etc)

TCP (sequence number)

LACK (lost Audio Packet Steganography)

Hide information in packet delay

HICCUPS (Hidden Communication System for Corrupted Networks

Disguise information as natural distortion or noise

21

Network Steganogrpahy

Network Steganography

Information hiding techniques which can be utilized to exchange steganograms in telecommunication networks

Can be intra-protocol of inter-protocol

IP (type of services, flags, fragment offset, etc)

TCP (sequence number)

LACK (lost Audio Packet Steganography)

Hide information in packet delay

HICCUPS (Hidden Communication System for Corrupted Networks)

Disguise information as natural distortion or noise

22

Network Steganogrpahy

Operating Systems

Unused memory

Slack space (fragmentation issue)

Unallocated space

Hidden partition

Normally used to hide data from investigators

23

Steganography vs Watermarking

Goal of steganography

Intruder cannot detect message

Primarily 1:1 communication

Goal of Watermarking

Intruder cannot remove or replace the message

Primarily 1:* communication

24

Steganalysis

The art and science of steganalysis is intended to detect or estimate hidden information based on observing some data transfer.

In some cases, just being caught sending a message can bring suspicion or give information to the third party

Why is this person hiding something?

Why all the communication right now?

25

Steganalysis

Steganalysis techniques can be classified in a similar was as cryptoanalysis methods – largely listed on how much prior information is known

Steganography only attack: The steganography medium is the only item available for analysis

Known carrier attack: The carrier and steganography media are both available for analysis

Known message attack: The hidden message is known

Chosen steganography attack: The steganography medium and algorithm are both known

Chose message attack: A known message and steganography algorithm are used to create steganography media for future analysis and comparison

Known steganography attack: The carrier and steganography medium, as well as the steganography algorithm, are known discipline with low articles appearing before the late 1990’s.

26

Why steganography?

Cryptography is great for confidentiality but it is clear to someone that you have something hidden.

With steganography, it is not obvious to analyst that a message is hidden

A disadvantage of using steganography alone would be that if a steganalyst found the embedded plaintext, he would also have the message.

Would there be advantages to using steganography with cryptography?

27

Stenography Tools

Steganos

S-Tools (GIF, BMP)

StegHide (WAV, BMP)

Invisible Secrets (JPEG)

OpenPuff (BMP, JPEG, PNG)

Camouflage

MP3Stego (Open source tools for audio)

OpenStego (Open source tool for images)

28

Timeline

29

Conclusion

Steganography and Stegoanalysis are still at an early stage or research

Although in principle secure schemes exist, practical ones with reasonable capacity are known

Notion for security and capacity for steganography needs to be investigated

No system of data is totally immune to attacks:

Steganography has its place in security

It in no way can replace cryptography

It is intended to supplement it

Watermarking for use in detection of unauthorized, illegally copied material is continually realized and developed.

The growing number of communication protocols, services, and computing environments offers almost unlimited opportunities for displaying a whole spectrum of steganographic methods.

30

Questions?

31