F5 A Steganographic Algorithm Davang Patel Thomas Schulze

Agenda Introduction Capacity vs. Security JPEG JSTEG F3 F4 F5

steganographical decryption What is Steganography? Steganography is the art and science of embedding hidden messages in a carrier medium such that no one apart from the sender and intended recipient even realizes there is a hidden message. Mediums can include images, video, and audio. Message Carrier steganographical encryption algorithm steganographical decryption Attack Message should be invisible to an aggressor Message should be not readable to an aggressor Steganogram

Steganogram Example The Story Behind the MATLAB Default Image More Info: http://blogs.mathworks.com/steve/2006

Capacity vs. Security F5 algorithm combines BOTH advantages!! e.g. Jsteg Embedding capacity 12 % Secure against visual attacks Weak against statistical attacks First algorithm great Capacity for steganographic messages Weak against attacks (visual or statistic)‏ Second algorithm small Capacity for steganographic messages Strong against attacks (visual or statistic)‏ e.g. MP3Stego Embedding capacity less then 1 % Secure against visual attacks Secure against statistical attacks F5 algorithm combines BOTH advantages!! Great capacity for steganographic messages Strong against statistical and visual attacks 13.4% embedding capacity

Histogram for JPEG coefficient after quantization JPEG Mechanism Histogram for JPEG coefficient after quantization The coefficient’s frequency of occurrence decreases with increasing absolute value. The difference between two bars in the middle of the histogram is greater than the difference between two bars near the ends.

JSTEG Algorithm After quantization, Jsteg replaces (over writes) the least significant bits (LSB) of the frequency coefficient by the secret message. The embedding mechanism skips all coefficient with the value 0 and 1. Resistant against the visual attacks and good capacity with 12.8 % of the steganogram's size, but the secret message is easily detected by statistical attacks. (chi-square test) Jsteg influences pairs of the coefficients frequency of occurrence !!! JSTEG

F3 Algorithm Original F3 Algorithm JSTEG Does not overwrite bits -- Decrement the non-zero coefficient’s absolute value only if the LSB does not match. Zero coefficients are skipped. The LSB of a non-zero coefficient will match the secret message after embedding. Advantage: statistical attack (chi-square test) will not be successful Disadvantage: Less capacity and surplus of even coefficients caused by shrinking. The surplus of even coefficients can be detected by statistical means. Original F3 Algorithm JSTEG

F3 Shrinkage Shrinkage of coefficients causes a decrease in embedding capacity. Since the receiver cannot tell between a skipped zero and a zero that was generated due to shrinkage, repetitive embedding is necessary. -4 -3 -2 -1 0 1 2 3 4

F4 Algorithm Mapping negative coefficients to the inverted steganographic value. Even negative coefficients and odd positive coefficients represent a steganographic one. Even positive coefficients and odd negative coefficients represent a steganographic zero.

F4 embedding example Embed the code “01110” If LSB and message does not match, Increment negative Coefficients Decrement positive coefficients

F5 Algorithm Overall algorithm the same as F4. Extends F4 by adding two distinct features: Permutative straddling Matrix encoding

Permutative Straddling F4 embeds the data into the next available non-zero coefficient. F5 will scatter the entire message throughout the carrier. Uses permutation to equalize the spread of embedded data. F5 F4 carrier permutation carrier carrier+ message permutation + message Inverse permutation Note: treat each pixel as if it was a JPEG coefficient.

Improves the embedding efficiency from 1.5 bit to 3.8 bit per change. Matrix Encoding Improves the embedding efficiency from 1.5 bit to 3.8 bit per change. Embed 1736 bit message 459 changes 1157 changes F4 F5 How does it work? Consider we want to embed x1 and x2 in LSB locations a1, a2, and a3.

F5 encoding process Permutation is generated using user-defined password. Discrete Cosine Transform Quantization Permutation F5 Embedding function Inverse Huffman Encoder Steganogram (JPEG) Bitmap Carrier Message Random Number Generator Password Quality

Resultant Steganogram F5 example Carrier Image F5 Encrypt/Decrypt Program Resultant Steganogram Secret Message

Conclusion F5 has high embedding capacity (>13%) but can be pushed even further. Resistance to both visual and statistical attacks. Uses a common image format (JPEG).

Any Questions?