0

I would like to try a Steganograghy program - know of one? How 'heavy' can it be:

1- Can I run the plaintext through a SHA-2 hash, THEN.... 2- Encrypt the digest with my private key (Digital Signature) and attach it to the plaintext, THEN... 3- Encrptyt the plaintext + encryped digest (symetrically) with AES, THEN....... 4- Encryt the symetric key with my private (or recipients public) key (RSA) AND embed it with the ciphertext in the media file

There may be some redundant encrypting going on here too?

Improve this question
7
  • 2
    Okay... I'm no cryptography expert, but I'm not even sure the end result of your suggested process will leave the plaintext legible to anyone - regardless of what keys they have.
    – Iszi
    May 6, 2011 at 19:04
  • Re-reading it, I think I've made some sense. If I'm interpreting it accurately, it seems the digital signature is not properly placed and the symmetric encryption can be done without. Either way, you're not looking for a steganography program - you're looking for a steganography and encryption program.
    – Iszi
    May 6, 2011 at 19:17
  • I am looking for a steganography program that allows me to encrypt the message and add my digital signature.
    – Abdu
    May 7, 2011 at 0:11
  • 3
    Steganography is about hiding information, not encryption. If you really are only interested in a program that does both steganography and encryption (and signatures??) you should edit the question to clarify that and explain why. More background would also help: what assets are you trying to protect from what threats, etc (see the faq).
    – nealmcb
    May 7, 2011 at 2:11
  • Further to what @nealmcb mentioned, why one single program? Steganography and encryption are two seperate problems. Steganography hides the presence of information, whereas encryption protects the confidentiality of information. What may be worthwhile is using an encryption program (GPG or otherwise) and then pass the output to a steagnography program.
    – mdec
    May 7, 2011 at 4:42

1 Answer 1

Reset to default
6

I would say, why not just encrypt & sign using GPG as usual... then put this into your steganography program of choice. That is... unless you want some security by obscurity... but then again, you're already doing some of this by using steganography.

There are many steganography tools available, and many different file formats to choose for embedding your message (ie: png, jpeg, tiff, mp3, avi, mpeg). A list of steganography tools can be found here. The size of the message, or how 'heavy' it can be depends highly on what tool you are using, and the size of the carrier file.

You can hide a lot more data in a larger file without it degrading the quality, or becoming noticeable.

For some simple open source steganography tools, perhaps try out OpenStego or StegHide

EDIT: Do note that depending on the context of the message transmission, a certain file type or a large file may indeed be very noticeable. For example, on a network where small images and HTML pages are predominantly transferred, perhaps a large DVD .vob would stick out like a sore thumb. The purpose of steganography is to conceal the message so it's completely undetectable. Context is everything here.

Improve this answer
3
  • 2
    The purpose of steno is to mainly to conceal the message. The idea being that in an ideal world, and if done well, the message should be almost undetectable. In theory you'd trust in the hidden-ness of the message so much you wouldn't have to encrypt... However, this should not be thoroughly trusted to keep the data secret; there are detection methods, and will be more sophisticated techniques and tools for detecting stenography in the future. Given enough time, the message can potentially be discovered. In essence, steno can then be seen as a form of security by obscurity.
    – TrinitronX
    May 9, 2011 at 8:14
  • What are these stego detection methods you speak of......are they actual applications or just a trained eye?
    – Abdu
    May 10, 2011 at 15:50
  • 1
    Yes, they are actual applications and involve some mathematical analysis methods. Check out outguess. Also, see this paper and this page
    – TrinitronX
    May 10, 2011 at 19:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .