I want to put some parts of my secret data into specific file with Steganography method. Is this method as safe as other encryption methods like RSA or SHA?
-
1"Is this method as safe as other encryption methods like RSA or SHA?" SHA-something is not an encryption method. It is a hashing function.– curiousguyCommented Jun 27, 2012 at 14:35
Add a comment
|
8 Answers
NO, it isn't safe at all and steganography is not encryption!
Encryption means that the method is known, but that's not a problem, the data can't be decrypted without a key. Bad luck for interceptors when a strong method and a strong key have been used. The message is useless for them.
Steganography means hiding data in other data and it relies on the method used to hide the data being unknown to interceptors! It isn't encryption at all, but it can be combined with encryption. Simple/public domain steganography techniques can be detected quite easily, if the interceptor expects a hidden message.
Pure steganography (just the hiding process) is security by obscurity, which is a bad practice. However, sometimes the combination of steganography and cryptography can be desirable, for example when you don't want anyone to know that a secret message has been sent at all. Interceptors won't be able to prove it, when they can't break the encryption.
-
2-1 because it's simply not true that all steganographic methods can have the message discovered just by knowing the method. There are some where you have to know a key in order to be able to determine whether a hidden message is present or not.– Michael BorgwardtCommented Jul 28, 2011 at 7:48
-
9@Michael: But that's a combination of steganography and encryption and not pure steganography anymore.– FalconCommented Jul 28, 2011 at 7:49
-
2@Falcon: There are methods of steganography that do not rely on the payload having high entropy for evading detection. I cannot see why those would not be considered "pure steganography".– Michael BorgwardtCommented Jul 28, 2011 at 8:11
-
8@Michael Borwardt: The common definition clearly separates cryptography (making unreadable) from steganography (hiding). We just have a communication problem here. Of course, in practice, both are combined (they should be in some cases!).– FalconCommented Jul 28, 2011 at 8:50
-
2Simple schemes are trivial to detect, but this answer does not address secure methods of steganography, which are built on solid methods. The bold "NO" is misleading. Obviously, users of steganography need to be careful, but that's true for everything about security.– DanBealeCommented Aug 5, 2011 at 10:54
The answers by @Falcon are technically accurate, however answering this question is impossible without knowing some more details. Who are you protecting the data from and for how long, your 6yo kid brother or the NSA. What are you protecting and what's its value to your attacker (i.e. NSA could, but won't crack an email home telling mummy what a great holiday you are having, unless you are on their watch list...). Where will you store you private keys for your RSA, are they "safe", how will you know if some has seen them?
I suggest you read Bruce Schneier's works before going too much further, particularly Secrets and Lies, followed by Applied Cryptography for some light bed time reading.
-
1Actually, as it happens, @Falcon's answer is not accurate; see my comments on his answer.– D.W.Commented Aug 18, 2011 at 22:15
Steganography is the practice of hiding some data within other data. It can be as simple as selecting the 3rd word of every sentence to determine the real text, or as complex as a keyed pattern (similar to an encryption method).
RSA is a public / private key system. That means that one what is done with one key requires the other key to reverse.
SHA is a hashing algorithm. That means that any amount of data can always be mapped to a fixed-size representation. It is not reversible.
Detecting steganography is principally related to the ratio of inert data to hidden data. Patterns in the hidden data are also relevant. Encrypting your hidden data first can greatly increase the chance of avoiding detection. There are many methods of steganography, so this is a general rule rather than a hard and fast rule.
Another general rule: encrypt any data that you do not want read. Use steganography AFTER encryption to hide the existence of that data.
How "safe" this will be depends on what threats you're attempting to guard against.
answered Jul 29, 2011 at 12:48
That depends entirely on the steganography method. Some rely on security through obscurity while others have a solid cryptographic background, i.e. an attacker would have to find a weakness in the algorithm to be able to detect the presence of the data, and then it would/should still be encrypted using regular encryption method.
But that kind of Steganography tends to require a very low payload/carrier ratio, i.e. you can fit very little data into a file unless it is very large.
Rory is right that it depends on what you are tyring to protect and who might try to get it.
Steganography is a method of protecting the confidentiality of data by keeping the existance of the data secret.
Cryptography is a method of protecting the confidentiality of data by transforming data with a algorithm and key, and keeping the value of the key secret.
With cryptography you are effectivly announcing that you have valuable data, with steganography you are concealing the fact you have valueable data. The protection they provide for data is not directly compareable. There may be situations where steganography is a better choice, such as in countries where encryption is banned or repressive regimes where encrypting data will get you arrested and tortured.
Steganography requires other data to hide in. As alluded to in some comments you need a significantly larger about of unimportant data to hide your data in. A common choice is graphic images in jpg, png, and gif formats. Given a large enought graphic there is sufficient space to hide your data in the graphic.
-
3I'm no lawyer, but as far as the courts go, they'll probably count stenography as cryptography, in fact if you translate the actual Greek cryptography literally means hidden writing/drawing. And as far as a judge goes it could probably be argued as such.– ewanm89Commented Jul 29, 2011 at 10:39
Steganography is provably secure for hiding data, with some important considerations. The cover text (the stuff you're hiding your data in) has to be very large, and the hidden text has to be pretty small. You need to avoid trivially easy hiding patterns such as Least Significant Bit. You need to avoid silly choices for cover data, such as gif image files.
You need to encrypt the hidden data before hiding it, to make it "more random". (Really, to make it harder to detect using pattern analysis.)
You must make sure the cover data is not compressed before doing the hiding. This is to make sure it has enough redundancy to hide the data from statistical analysis.
So, preparing the hidden data is tricky; preparing the cover data is tricky; and some implementations of steganography are hopelessly broken.
Here's some refs:
Provably Secure Steganography http://eprint.iacr.org/2002/137
Usenet Discussion https://groups.google.com/group/sci.crypt/browse_thread/thread/68bd62328afbed0c?hl=en&tvc=2&q=%2Bclayton+%2Bsteganography&fwc=1#
-
"You must make sure the cover data is not compressed before doing the hiding." you certainly mean lossy compressed. Commented Jun 27, 2012 at 14:40
-
Re-reading it it doesn't make much sense. Maybe "compress first and then encrypt, before steganography"?– DanBealeCommented Jul 11, 2012 at 21:09
Another aspect not fully addressed here is how fragile is the final product - i.e. the object/image/file containing the secret information. Simple free steganography programs are fun, and some even let you hide a file in one file, then hide that file in another - great! Trouble arises, however, if you accidentally make any changes to your master file, as it may destroy the reversability of the process. Contrasting this tenuous method, versus a robust encryption system, and the weaknesses are obvious. The latter is a digital mystery which can be transmitted, stored, copied, etc. with no damage or loss, while the steganographic image/file is easily lost or made useless, even by the crudest attack, unless protected from modification, deletion, etc. by some security method! Hiding your fortune in the woods is fine, until you come back and all the trees have grown, or fallen, and the landmarks aren't familiar anymore. My practical approach for securing normal computer info is by using the free KeePass with long, complex password, then using its built-in file-storing ability to attach files within its secure framework; once saved, only I can open it, and the little program so far seems hardy and crash-resistant. Just remember to make backup data files to other machines or by email.
In plain words, just using Steganography is not enough if you wish your information to be safe. It will definitely help as it won't attract attention, but if you have to be sure of your confidential data, you need to first encrypt the data and then use Steganography prior to storage/transmission.
