Steganography
1. Steganography = Hide Existence, Not Content
Cryptography scrambles a message (existence visible, meaning hidden); steganography hides the message's very existence inside an innocent carrier:
Cryptography: ATTACK → LXFOPV (visible gibberish, needs key)
Steganography: ATTACK → cat.jpg (looks untouched, bits carry secret)
Greek steganos (covered) + graphein (writing). Carrier (cover object) + secret + optional stego-key → stego-object. Detection-resistant if carrier statistics barely change; capacity–invisibility–robustness trade off against each other.
2. Classical and Linguistic Methods
- Invisible inks / microdots: lemon-juice writing, WWII microdots (1 page shrunk to 1 mm) — physical hiding.
- Character marking: newspaper pin-pricks over selected letters spelling the message.
- Acrostics / null ciphers: first letters of words ("Alice Took Tea..." → ATT); grille/mask revealing chosen words.
- Type-spread / whitespace tricks: extra spaces after words encode bits (1 vs 2 spaces = 0/1) — ancestor of modern text stego.
All share the weakness: once the method is known, extraction is trivial — Kerckhoffs demands a stego-key (which pixels/words, which order) for real security.
3. Modern Digital Techniques
| Method | How it hides | Capacity / visibility | Breaking it |
|---|---|---|---|
| LSB image stego | Replace least-significant bits of pixels with secret bits | 1 bit/pixel/channel (~3 bits/pixel RGB); invisible to eye | Chi-square / RS steganalysis of LSB statistics; compression destroys it |
| Palette / DCT (JPEG) | Hide in quantized DCT coefficients (JSteg, F5) | Lower capacity, survives JPEG better | Calibration attacks comparing recompressed statistics |
| Audio (LSB/echo/spread-spectrum) | LSB of samples, echo delays, phase coding | High capacity in WAV; MP3 compression kills LSB | Spectral/phase anomaly detectors |
| Video / network | Motion-vector bits, unused header fields, packet timing (covert channel) | Timing channels exfiltrate despite encryption | Traffic-shape analysis |
| Watermarking (cousin) | Robust hidden mark proving ownership (visible logo vs invisible spread mark) | Low capacity, must survive compression/cropping | StirMark-style desync attacks |
Worked LSB example: pixel bytes ...0110100₁, 1001011₀ with secret bits 1, 0: LSBs already match → bytes unchanged; secret 1, 1 flips second LSB → change of ±1 intensity — undetectable visually, caught only statistically over thousands of pixels.
4. Steganography vs Cryptography vs Watermarking
| Point | Steganography | Cryptography | Watermarking |
|---|---|---|---|
| Goal | Hide existence | Hide meaning | Prove ownership |
| Visibility | Must be invisible | Ciphertext openly gibberish | May be visible or hidden |
| Attack | Steganalysis (detect presence) | Cryptanalysis (read content) | Removal/desync |
| Best practice | Encrypt THEN hide (ciphertext looks random, compresses poorly — encrypt first) | — | Robustness over capacity |
Exam Points
- One-line contrast (existence vs meaning) + block diagram (cover + secret + key → stego) — 2-mark opener.
- Classical examples (invisible ink, microdot, acrostic) — 2-mark list.
- LSB mechanism + ±1 invisibility argument + steganalysis names (chi-square/RS) — 5-mark core.
- Encrypt-then-hide ordering justification.