1

Is it considered a bad practice to use a secret method to encode data in steganography? We all know that it is a bad practice in cryptography, for at least two reasons:

  1. A public method can be checked by experts so we know it's safe
  2. A secret method is difficult to redesign in case it becomes known

But what about steganography? Some say steganography basically relies on secrecy, so there's probably nothing wrong with a secret method (and that's what I thought too, until now). But others say that there are public algorithms that rely on the secrecy of a key. But does it really matter in the end? Are there public steganography algorithms that are mature and safe enough for any practical purpose? Or is it just a matter of making sure your secret data cannot be detected by any statistical means, which is going to be a tricky task no matter what method you use?

Improve this question
4
  • Encrypt something then you could use any steganography method - since the source data is essentially pure noise/completely random - it will never be found and even if it is, data needs to be decrypted.
    – Artem S. Tashkinov
    Commented Jul 8, 2022 at 21:04
  • @ArtemS.Tashkinov, I'm not sure I agree with that. Encrypted data appears to be random, but it's not, which means that you cannot really hide data in it, because otherwise you will corrupt the file (decryption will fail).
    – reed
    Commented Jul 11, 2022 at 9:31
  • @ArtemS.Tashkinov, I just realized that I might have misinterpreted your comment. I took it to mean that you wanted to hide data inside an already encrypted file (a file that looks like random data). But you probably meant the opposite, hide random data (encrypted data that looks like random data) inside any carrier. Yes, if it was found, it would need to be decrypted. But just the fact that some suspicious data can be found, even if encrypted, would be a failure in steganography.
    – reed
    Commented Jul 11, 2022 at 10:14
  • But just the fact that some suspicious data can be found, even if encrypted, would be a failure in steganography this remains to be seen :-) And I'll continue to claim to encrypted data is indistinguishable from pure randomness/noise. No idea where I got this from but AFAIK it's true in terms of math.
    – Artem S. Tashkinov
    Commented Jul 11, 2022 at 13:00

1 Answer 1

Reset to default
2

I'll try to answer my own question, after thinking a bit more about the actual issue. And the answer seems to be very easy: of course it's best to use a good algorithm that relies on a secret key, like we do for encryption. Compare the following two scenarios:

CASE #1

The algorithm should be very good: it should hide encrypted data inside the noisy part of the carrier, making "noise on noise" indistinguishable from just noise. Of course if you want to make sure a complex algorithm is very good, it cannot be secret. The key of course should be strong enough to avoid bruteforce attacks, and should be kept secret.

In this situation, if the fact that you use steganography software becomes known, it's hard to prove that you have actually used steganography on specific occasions. To extract the encrypted data (which looks like noise) from the noisy part of the carrier, you need the secret key, otherwise it will all just look like plausible noise in the carrier. In other words, with a good algorithm, if the key is secret it is not possible to prove that you have actually used the algorithm.

Case #2

The algorithm is secret, custom made, and all your security depends on its secrecy. The algorithm is probably far from perfect.

In this situation, if the algorithm becomes known, then all your past communications are compromised. With the algorithm, it is possible extract all your secret data from the carriers. Even if your custom algorithm also needed a secret key, the logic would probably be bad enough to allow some kind of statistical analysis that can detect secret data inside a carrier. In other words, if a bad algorithm becomes known, it's probably possible to at least demonstrate that you have used steganography on some specific occasions.

So yeah, like we do for encryption, the Kerckhoffs's principles can be applied to steganography too.

Whether good algorithms exist for steganography though, is another question that would not be in topic here. Encryption has several good algos, unbreakable or currently believed to be practically unbreakable, well-known and analyzed by thousands of mathematicians, etc. I have the impression that steganography algos are more difficult to devise, but I might be wrong.

Improve this answer
1
  • I would just be pragmatic here and apply the Kerckhoffs's principle to steganography too like you said. Despite the fact a standard encryption method could reveal the presence of steganography (i.e. running 'steghide'), I think the value of the encryption algorithms integrity outweighs the secrecy a custom algorithm might provide.
    – Rivesticles
    Commented Jul 11, 2022 at 11:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .