Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is a very interesting puzzle on the Programming Puzzles and Code Golf site to Rearrange pixels in an image so it can't be recognized and then get it back. I understand that this is not cryptography, but I wonder how effectively a message could be hidden in such an image and then securely transferred and retrieved.

Consider Alice and Bob who have conspired beforehand to use one of the solutions to the puzzle for Alice to transmit to Bob images of text. The TLA* is tasked with breaking their ad hoc "encryption" (obfuscation), but do not know about Stack Exchange sites. The TLA does not have access to Alice, as she is outside their jurisdiction. Furthermore, being images of text, the whole image is in greyscale.

If the TLA were to intercept an image 'encoded' with one of the solutions to the Code Golf contest, what steps would they take to decrypt it?

* TLA: Hypothetical government agency with access to the network.

share|improve this question
Questions like these are a much better fit for the new Cryptography Stackexchange site which is currently in beta. – Philipp Jul 28 '14 at 7:48
Thank you Philipp. As this is not really cryptography (rather obfuscation) I don't see it as a good fit for that site, but I will certainly examine that site for interesting and relevant information. Thanks! – dotancohen Jul 28 '14 at 7:50
So what does the TLA acronym stand for in this case? Totally Legit Agency? Trolls and Leprechauns Association? (I know, I know, Three-Letter Acronym) – TildalWave Jul 28 '14 at 9:51
I'd assume it stands for Three Letter Agency. That covers most of them. – aslum Jul 28 '14 at 14:35
Definitely not crypto. Seems about the same value as ROT-13. Any additional perceived benefit is just security by obscurity. – Aaronaught Jul 28 '14 at 16:16
up vote 13 down vote accepted

Basically this is a transposition cipher. What you would do is looking for pattern and rearrange like with this text example:

Your example with grey scale text would be easier as the picture on code golf because you could see very easy what is a correct solution.

share|improve this answer
Thanks, this looks to be the correct technical term for what is happening. Now that I know what it is called, I'll review the literature. Thank you. – dotancohen Jul 28 '14 at 10:35

The Code Golf is essentially to create an unkeyed 1:1 function to transform images. As such, it's highly vulnerable to chosen-plaintext attacks: if an attacker can convince Alice or Bob to transmit a carefully-crafted image, they can build up a map of what pixels get moved to where for that image size.

Further, if the images being transmitted have predictable features (eg. an image of a newspaper clipping will always have a white border), statistical analysis can be used to build up a map without needing to know the details of the images.

share|improve this answer
Thank you Mark. I have updated the answer addressing your concerns. I am actually interested in passive decryption, as if the TLA had access to influence the sender then they have methods outside the scope of this site. – dotancohen Jul 28 '14 at 7:49
@dotancohen: The influence required for a chosen-plaintext attack can be very low. Defending against them is expected of modern cryptosystems and well within the scope of this site. – user2357112 Jul 28 '14 at 12:41
I'm also interested in this question, since that popularity contest is mine question) I believe that if algorithm is not known to third person, he has only encoded image, it will be difficult for him to reveal original image, or at least get something resembling original image? – Somnium Jul 28 '14 at 17:06
Is it really unkeyed? Several of those methods rely on a PRNG started from a specific seed, which in essence is a key there; and such transformation can easily be made through an one time pad, making it secure. – Peteris Jul 28 '14 at 20:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.