1

Is this a good idea to make the following text message encryption:

  • accept text from the user 1
  • store the text into a document in the form of some handwritten font
  • convert the document into an image
  • apply noise to the image
  • encrypt the image somehow (hide the fact it is image)
  • send the image to the user 2
  • show the image to the user 2 as image

EDIT. My purposes:

  1. Avoid existing widely used smartphone messaging apps, which could be which can be monitored by law enforcement agencies.
  2. Make a simple own secure messaging application to just text exchange p2p
  3. Be sure (as far as possible) that our messages will not be automatically intercepted by standard means used by law enforcement agencies. I don't know that standard means, and also can never know for sure
  4. Provide greater resistance to interception than existing widely used smartphone messaging apps at the expense of some inconvenience

example: enter image description here

0
3

The cryptography in existing apps is usually strong enough. This means that the focus of attackers (including law enforcement) is not to break the cryptography but to compromise the endpoints to get access to the messages before encryption or after decryption.

Your approach does not actually protect against this main attack vector. Instead you add some obfuscation by using an image and some noise. But this isn't actually sufficient to hide the message against someone who compromised the endpoint - especially if the message is intercepted already before obfuscation or after deobfuscation.

The only other obfuscation is to use an atypical application for communication. But if you are the target of an attacker who was able to compromise your endpoint, then this does not help much either. It is simple to check what applications are installed and then have a closer look at suspicious applications and their activity. This is assuming that your device was compromised since you were an explicit target, this means the attacker is actively looking for something interesting on your device.

In other words: it is probably not a good idea. At least it does not really help you to achieve your ultimate goal, which is to protect your communication from a highly capable attacker like law enforcement.

3
  • "It is simple to check what applications are installed and then have a closer look at suspicious applications and their activity." What chance is that this is ever possible be made automatically? I meant decoding the message automatically this way, not just the check the application installed. – display_info Sep 26 '20 at 19:02
  • And what idea can you suggest as "good" in this case? – display_info Sep 26 '20 at 19:05
  • 2
    @display_info: This is a different question and should not be asked in a comment. But in short: Since the attacker needs to compromise your device first when strong crypto is used, you should focus on a) preventing this and b) detecting this. For prevention it helps to have a device which quickly gets the latest security updates and has only the bare minimum of apps installed and in use to reduce the attack surface. Also switching network (WiFi, mobile, Bluetooth) off most of the time reduces the attack surface and physical security is important too (i.e. prevent physical access by others). – Steffen Ullrich Sep 26 '20 at 19:10
1

What you're looking for is probably something called Stenography and/or alternatively Obfuscation Is that correct? If yes;

then the answer to your question "Is this a good idea" would be, yes and no. It depends how you use Steganography or Obfuscation.

To give a really obvious example of the answer no: If you tell someone to find a hidden message inside of the image.

But what if you don't give any clues, and i.e placing the picture in a folder with lot of other pictures that looks kinda the same(like, same colors, and sizes, but different texts)? Then, it would be more secure. And, "a good idea" is maybe is a bit broad, do you mean cryptographicly secure? that it would be indistinguishable from a normal image?

13
  • Please read the edited version of my post – display_info Sep 26 '20 at 18:27
  • I read it; So it's not obfuscation or steganography you're after? and, " I don't know that standard means, but also cannot know of course." what do you exactly mean here, or is it maybe just me that is confused? If so, I'm sorry. – William Martens Sep 26 '20 at 18:43
  • I meant that no one can know these interception means used by law enforcement for sure – display_info Sep 26 '20 at 18:49
  • You mean so that nobody can eavesdrop? Or know the communication is there at all? (Covert channels or communications?) Sorry , please clarify. – William Martens Sep 26 '20 at 18:51
  • 1
    You're asking a totally different question, and okay I did not know your friend said that. My bad :), I must say that I do believe that widely used, easily availble and free security tools is secure. Because that is for example AES. Everyone can learn how it works, but they still cannot decrypt a message encrypted by AES. And, it's used in HTTPS (Which is unbelievable widely used). AES is used in Bitlocker for encrypting disks in windows. It's used in Luks used in Linux. It's used worldwide. how law enforcmenet agencies can allow that, is another completely different question. – William Martens Sep 26 '20 at 19:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.