I NFORMATION H IDING : S TEGANOGRAPHY Dr. Shahriar Bijani Shahed University Sep 2014

S LIDES R EFERENCES Stefan Katzenbeisser & Fabien A. Petitcolas, Information hiding techniques for steganography and digital watermarkin g, 2000, chapter 2. CS 4953, The Hidden Art of Steganography, University of Texas at St Antonio, Sanjay Goel, Watermarking & Steganography, University at Albany, State University of New York. Anastasios Tefas, Information Hiding Content Verification, Dept. of Informatics, Aristotle University of Thessaloniki. 2

T HE P RISONER ’ S P ROBLEM Alice and Bob are in jail and want to device an escape plan. Alice and Bob can communicate, but all their communications pass through Wendy, the warden.

Options for private communication: encryption: Wendy will suspect something is up and frustrate their plan by placing them in solitary confinement. data hiding: Wendy can’t find or prove that there is secret communication, Alice and Bob have a secure channel in which to communicate. T HE P RISONER ’ S P ROBLEM

Yes T HE P RISONERS ’ P ROBLEM M ODEL No Embedding Algorithm Cover Message Stego Message Secret Key Secret Message Message Retrieval Algorithm Secret Message Secret Key Is Stego Message? Suppress Message AliceWendyBob Steganographic algorithms are in general based on replacing noise component of a digital object with a to-be-hidden message.

F RAMEWORKS FOR S ECRET C OMMUNICATION A general model of a cryptographic system has already emerged. Alice randomly chooses a cover c using her private random source r and embeds the message m in c using a key k, creating the stego-object s to pass on to Bob. Bob reconstructs m with the key k he shares with Alice. Key generation facility Cover i Randomness r Alice Bob

T YPES OF I NFORMATION H IDING In the literature there are basically three types of steganosystems (steganographic protocols): Pure : no key is needed for the detection of the secret message. Secret key : the embedding and the detection of the message is done using a secret key. Public key : message embedding using a secret key and detection using a public key. 7

K IRCHOFFOV PRINCIPLE Kirchoffov principle holds also for steganography: Security of the system should not be based on hiding the embedding algorithm, but on hiding the key. 8

S TEGOSYSTEM D EFINITIONS : P URE Pure stegosystem S =  C, M, E, D , where C is the set of possible covers, M is the set of secret messages, | C |  | M |, E : C  M  C is the embedding function and D : C  M, is the extraction function, with the property that D ( E ( c, m )) = m, for all m  M and c  C. Security of the pure stegosystems depends completely on its secrecy (≠ Kirchoffov principle ). On the other hand, security of other two stegosystems depends on the secrecy of the key used. 9

S TEGOSYSTEM D EFINITIONS : S ECRET K EY Secret-key (asymetric) stegosystem S =  C, M, K, E K, D K , where C is the set of possible covers, M is the set of secret messages with | C |  | M |, K is the set of secret keys, E K : C  M  K  C, D K : C  K  M with the property that D K ( E K ( c, m, k ), k ) = m for all m  M, c  C and k  K. 10

11 P UBLIC -K EY S TEGANOGRAPHY Similarly as in case of the public-key cryptography, 2 keys are used: a public-key E for embedding and a private-key D for recovering. It is often useful to combine such a public-key stegosystem with a public-key cryptosystem. For example, in case Alice wants to send a message m to Bob, encode first m using Bob’s public key eB, then make embedding of e B (m) using process E into a cover and sends the resulting stegotext to Bob, who recovers e B (m) using D and then decrypts it, using decryption function d B.

A STEGANOGRAPHIC KEY - EXCHANGE PROTOCOL 12

S TEGANALYSIS : S IMILARITY Similarity function: Let C be a nonempty set. A function sim : C 2  (- , 1] is called similarity function on C, if for x, y  C sim(x,y) =1  x=y sim(x,y) <1  x≠y In the case of digital images or digital sound the correlation between two signals can be used as a similarity function. Therefore, most practical steganographic systems try to fulfil the condition sim(c, E(c, m)) ≈ 1 for all m ∈ M and c ∈ C. Application : a cover can randomly be chosen. Instead, the sender could also look through the database of usable covers and select one that the embedding process will change the least: c= max sim (x,E(x,m)) x  C 13

P ERFECT S ECRECY OF S TEGOSYSTEMS S TEGANALYSIS : : P ERFECT S ECRECY OF S TEGOSYSTEMS A formal information-theoretic definition of the security of steganographic systems (Cachin, 1998). The main idea: the selection of a cover as a random variable C with probability distribution P c In order to define secrecy of a stegosystems we need to consider  probability distribution P C on the set C of covers;  probability distribution P M on the set M of secret messages;  probability distribution P K on the set K of keys; probability distribution P S on the set { E K ( c, m, k), | c  C, m  M, k  K } of stego objects (the set of all stego-objects produced by the steganographic system) The basic related concept is that of the relative entropy D ( P 1 || P 2 ) of two probability distributions P 1 and P 2 defined on a set Q by which measures the inefficiency of assuming that the distribution on Q is P 2 where the true distribution is P 1.

P ERFECT S ECRECY OF S TEGOSYSTEMS S TEGANALYSIS : P ERFECT S ECRECY OF S TEGOSYSTEMS Let S be a stegosystem, P C the probability distribution on covers C and P S the probability distribution of the stego objects and  > 0. S is called  -secure against passive attackers, if D ( P C || P S )  and perfectly secure if  = 0.

A perfectly secure stegosystem can be constructed out of ONE TIME-PAD CRYPTOSYSTEM Theorem Theorem There exist perfectly secure stegosystems. P ERFECT S ECRECY OF S TEGOSYSTEMS S TEGANALYSIS : P ERFECT S ECRECY OF S TEGOSYSTEMS

A perfectly secure stegosystem can be constructed out of ONE TIME-PAD CRYPTOSYSTEM Theorem Theorem There exist perfectly secure stegosystems. Proof. Proof. Let n be an integer, C n = {0,1} n and P C be the uniform distribution on C n, and let m  C n be a secret message. The sender selects randomly c  C n, computes c  m = s. The resulting stego objects are uniformly distributed on C n and therefore P C = P S from what it follows that D ( P Cn || P S ) = 0. In the extraction process, the message m can be extracted from s by computation m = s  c. P ERFECT S ECRECY OF S TEGOSYSTEMS S TEGANALYSIS : P ERFECT S ECRECY OF S TEGOSYSTEMS

P ROBLEMS WITH C ACHIN D EFINITION Problems: In practice, leads to assumption that cover and stego object (e.g. image) is a sequence of independent, identically distributed random variables Works well with random bit streams, but real life cover objects have a rich statistical structure There are examples for which D(X||Y)=0 but other related statistics are non-zero and might enable detection by steganalysis There are some alternative definitions but they have their own set of problems.

S TEGANOGRAPHIC H IDING T ECHNIQUES 19

S TEGANOGRAPHIC H IDING T ECHNIQUES  Substitution techniques Put a message in redundant or noisy parts of a cover  Transform domain techniques Embed information in the transform space of the signal (e.g. in the frequency domain).  Spread spectrum techniques Message is spread across frequency spectrum of cover  Statistical methods Alter some statistical properties of the cover  Distortion techniques Store message by altering the cover slightly and detecting the change from the original  Cover generation methods do not embed messages in randomly chosen cover, but create covers that fit a message.

BASIC SUBSTITUTION TECHNIQUES  LSB substitution: the LSB (Least Significant Bit) of an i -th binary block c ki is replaced by the bit m i of the secret message. The methods differ by techniques how to determine k i for a given i. For example, k i+1 = k i + r i, where r i is a sequence of numbers generated by a pseudo-random generators.  Substitution into parity bits of blocks. If parity bit of the block c ki is m i, then the block c ki is not changed; otherwise one of its bits is changed.  Substitution in binary images. If image c i has more (less) black pixels than white pixels and m i = 1 ( m i = 0), then c i is not changed; otherwise the portion of black and white pixels is changed (by making changes at those pixels that are neighbors of pixels of the opposite color).  Substitution in unused or reserved space in computer systems.

LSB S UBSTITUTION Replaces least significant bits with the message to be encoded Most popular technique when dealing with images Simple, but susceptible to lossy compression and image manipulation

W HY D IGITAL I MAGE AS A C OVER ? It is the most widely used medium being used today Takes advantage of human’s limited visual perception of colors This field is expected to continually grow as computer graphics power also grows Many programs are available to apply steganography

IMAGE ATTRIBUTES Digital images are made up of pixels The arrangement of pixels make the image 8-bit and 24-bit images are common The larger the image size, the more information you can hide. However, larger images may require compression to avoid detection

A N LSB E XAMPLE FOR A 24- BIT P IXEL 25

An Example of Hiding character ‘A’ Red Component Green Component Blue Component pixel pixel pixel Red Component Green Component Blue Component pixel pixel pixel Pixels of a cover image Replacing ‘A’ ( ) as LSBs in the Stego-image

LSB S UBSTITUTION … Best to use a grayscale palette or one with gradual changes in shades Otherwise, it is best to use images with “noisy areas” – areas with ample color variation and without large areas of solid color

G RAYSCALE P ALLETE R ED P ALLETE

“NOISY AREAS” - E XAMPLE Renoir painting

LBS Example Cover image:1336*1753 image (6.07 MB), Secret massage: 1,489,024 characters (1.70 MB)

Cover Image Secret message LBS Example: an image in a cover image

1-bit replacement Stego-image Secret message

Stego image 2-bit replacement Secret message

Stego image 3-bit replacement Secret message

Stego image Secret message 4-bit replacement

Stego image Secret message 5-bit replacement

Stego image Secret message 6-bit replacement

Stego image Secret message 7-bit replacement

LSB - U SES Storing passwords and/or other confidential information Covert communication of sensitive data Speculated uses in terrorist activities Being widely used to hide and/or transfer illegal content

D IFFERENT LSB T ECHNIQUES Different approaches in LSB Change LSB of pixels in a random walk Change LSB of subsets of pixels (i.e. around edges) Increment/decrement the pixel value instead of flipping the LSB 40

LSB: P ROS & C ONS Advantages/Disadvantages Easy to implement Scalability Does not stand up to compression Vulnerable to even small cover modifications. 41