I want to put some parts of my secret data into specific file with Steganography method. Is this method as safe as other encryption methods like RSA or SHA?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
||||
|
migrated from programmers.stackexchange.com Jul 28 '11 at 9:12
|
NO, it isn't safe at all and steganography is not encryption! Encryption means that the method is known, but that's not a problem, the data can't be decrypted without a key. Bad luck for interceptors when a strong method and a strong key have been used. The message is useless for them. Steganography means hiding data in other data and it relies on the method used to hide the data being unknown to interceptors! It isn't encryption at all, but it can be combined with encryption. Simple/public domain steganography techniques can be detected quite easily, if the interceptor expects a hidden message. Pure steganography (just the hiding process) is security by obscurity, which is a bad practice. However, sometimes the combination of steganography and cryptography can be desirable, for example when you don't want anyone to know that a secret message has been sent at all. Interceptors won't be able to prove it, when they can't break the encryption. |
|||||||||||||||||||||
|
|
The answers by @Falcon are technically accurate, however answering this question is impossible without knowing some more details. Who are you protecting the data from and for how long, your 6yo kid brother or the NSA. What are you protecting and what's its value to your attacker (i.e. NSA could, but won't crack an email home telling mummy what a great holiday you are having, unless you are on their watch list...). Where will you store you private keys for your RSA, are they "safe", how will you know if some has seen them? I suggest you read Bruce Schneier's works before going too much further, particularly Secrets and Lies, followed by Applied Cryptography for some light bed time reading. |
|||||
|
|
That depends entirely on the steganography method. Some rely on security through obscurity while others have a solid cryptographic background, i.e. an attacker would have to find a weakness in the algorithm to be able to detect the presence of the data, and then it would/should still be encrypted using regular encryption method. But that kind of Steganography tends to require a very low payload/carrier ratio, i.e. you can fit very little data into a file unless it is very large. |
|||
|
|
|
Steganography is the practice of hiding some data within other data. It can be as simple as selecting the 3rd word of every sentence to determine the real text, or as complex as a keyed pattern (similar to an encryption method). RSA is a public / private key system. That means that one what is done with one key requires the other key to reverse. SHA is a hashing algorithm. That means that any amount of data can always be mapped to a fixed-size representation. It is not reversible. Detecting steganography is principally related to the ratio of inert data to hidden data. Patterns in the hidden data are also relevant. Encrypting your hidden data first can greatly increase the chance of avoiding detection. There are many methods of steganography, so this is a general rule rather than a hard and fast rule. Another general rule: encrypt any data that you do not want read. Use steganography AFTER encryption to hide the existence of that data. How "safe" this will be depends on what threats you're attempting to guard against. |
|||
|
|
|
Rory is right that it depends on what you are tyring to protect and who might try to get it. Steganography is a method of protecting the confidentiality of data by keeping the existance of the data secret. Cryptography is a method of protecting the confidentiality of data by transforming data with a algorithm and key, and keeping the value of the key secret. With cryptography you are effectivly announcing that you have valuable data, with steganography you are concealing the fact you have valueable data. The protection they provide for data is not directly compareable. There may be situations where steganography is a better choice, such as in countries where encryption is banned or repressive regimes where encrypting data will get you arrested and tortured. Steganography requires other data to hide in. As alluded to in some comments you need a significantly larger about of unimportant data to hide your data in. A common choice is graphic images in jpg, png, and gif formats. Given a large enought graphic there is sufficient space to hide your data in the graphic. |
|||||
|
|
Steganography is provably secure for hiding data, with some important considerations. The cover text (the stuff you're hiding your data in) has to be very large, and the hidden text has to be pretty small. You need to avoid trivially easy hiding patterns such as Least Significant Bit. You need to avoid silly choices for cover data, such as gif image files. You need to encrypt the hidden data before hiding it, to make it "more random". (Really, to make it harder to detect using pattern analysis.) You must make sure the cover data is not compressed before doing the hiding. This is to make sure it has enough redundancy to hide the data from statistical analysis. So, preparing the hidden data is tricky; preparing the cover data is tricky; and some implementations of steganography are hopelessly broken. Here's some refs: Provably Secure Steganography http://eprint.iacr.org/2002/137 Usenet Discussion https://groups.google.com/group/sci.crypt/browse_thread/thread/68bd62328afbed0c?hl=en&tvc=2&q=%2Bclayton+%2Bsteganography&fwc=1# |
|||||
|
