Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have written an application for Apple's iOS which embeds messages in JPEG files using steganography (see http://en.wikipedia.org/wiki/Steganography). For the purposes of this question lets assume that my steganography algorithm is well known, but I also use random embedding locations (meaning that a key is required to extract the payload).

In my mind this classifies as encryption, but what if I didn't use random embedding (anyone who detected the cover image could extract the payload using raster scan mode)?

This is more for my curiosity, and I will be filling out my application submission to claim encryption functionality regardless because I offer and additional layer of encryption in my application.

share|improve this question

migrated from stackoverflow.com Apr 12 '11 at 4:22

This question came from our site for professional and enthusiast programmers.

3  
What country are you operating in? The US law no longer bans the export of cryptography. –  yan Apr 11 '11 at 17:59
    
I am in the U.S. –  Ben Holland Apr 11 '11 at 18:27
    
However for the sake of discussion I am looking at exporting to all allowed countries. –  Ben Holland Apr 11 '11 at 18:32
    
perfect scope for security stackexchange –  Rory Alsop Apr 11 '11 at 19:30
    
The StackOverflow mods migrated the original question over, so I have merged the two to save confusion –  Rory Alsop Apr 12 '11 at 10:11

4 Answers 4

up vote 7 down vote accepted

Encryption is about keeping some information confidential through a transform which requires knowledge of a "secret convention" to unravel. If there is a key and the key is needed to recover the data, then it is encryption.

In key-less steganography, there is still a "key" but a very short one. Steganography is about hiding data in an innocent-looking medium (e.g. a picture). The "secret convention" is then that your steganography method was applied, and the picture is not "just a picture". This can be viewed as a one-bit key...

I am not, in any way, a lawyer. My view is that of a scientist. In my view, your key-less steganography is not encryption per se, because a "one-bit key" stretches the definition of key a bit too far for my taste.

share|improve this answer
    
In every class dealing with cryptography that I've ever taken there is clear line drawn between stenography and cryptography. So I would be forced to agree with this answer. I'm curious if the law sees it differently. –  Ormis Apr 11 '11 at 21:14
1  
I also have to comment that even with (pseudo) random embedding, the data itself is fundamentally not being changed in any way, so i would not classify it as encryption. –  Ormis Apr 11 '11 at 21:19
    
I would be inclined to agree with this response. I'm curious what side the law would take. bis.doc.gov/encryption/question1.htm has some interesting wording on the classification of cryptographic uses -> "Also note that Category 5, Part 2 includes certain items with Information Security functionality, whether or not the items have encryption functionality." –  Ben Holland Apr 11 '11 at 23:30

For the purposes of this document, your application uses encryption and should be looked at accordingly, starting with the section titled "Is my item classified under Category 5, Part 2 of the EAR?" - there are a lot of categories, but you'll be able to get through them pretty quickly.

If you pop this post over to security stackexchange you'll be likely to get input from some senior crypto folks on this!

share|improve this answer
    
Cool thanks! Will do. –  Ben Holland Apr 11 '11 at 19:58

Steganography will classify as a means to encrypt messages. It actually would be more subject to export law as it is intended to get by without noticing it's an encryption. So yes, you are subject to export law both in the App store and in any software intended to be sold outside of your country. That is all providing your country actually has a cryptography export law

share|improve this answer
    
I would have to agree that Stego is a sense worse than Crypto (at least from the perspective of the jail warden :P). Can you provide any sort of documentation that clearly classifies steganography under export restrictions? –  Ben Holland Apr 11 '11 at 18:30
    
I don't think the EAR allows for value judgements of export control. There are controlled products and uncontrolled products, but no "more controlled" products. –  user185 Apr 12 '11 at 11:36

Encryption is the act of rendering data unintelligible to unauthorised parties.

Steganography is the act of hiding data so that it's undetectable to the uninformed.

There is a very clear difference, from an academic point of view. You are not using encryption! However, export restrictions may nevertheless apply. As in all things of this nature, seek professional legal advice.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.