Information Hiding & Digital Watermarking Tri Van Le

Outlines Background State of the art Research goals Research plan Our approaches

Background Information hiding –Steganography –Digital watermarking Related work –Covert channels –Anonymous communications

Information Hiding Steganography –Invisible inks –Small dots –Letters Digital watermarking –Copyright information –Tracing information

Information Hiding Main idea –Hide messages in a cover Steganography –Secrecy of messages Watermarking –Authenticity of messages

Covert Channels Leakage information (e.g. viruses) –Disk space –CPU load Subliminal channels –Digital signatures –Encryption schemes –Cryptographic malwares

Covert Computations Computation inside computations –Secret design calculations inside a factoring computation –Secret physics simulations inside a cryptographic software or devices

Anonymous Communications MIX Networks –Electronic voting –Anonymous communication Onion Routings –Limited anonymous communication Blind signatures –Digital cash

Digital Watermarking Secure against known simple attacks –Common lossy compressions JPEG, MPEG, … –Common signal processing operations Band pass, echo, pitch, noise filters, … Crop, scale, move, reshape, … Specialized attacks

Information Hiding (state of the art) Many schemes were proposed –Most of them were broken Use heuristic security –Subjective measurements –Assume very specific enemy

Broken Schemes (I)

Broken Schemes (II)

Broken Schemes (III)

Broken Schemes (IV)

Cryptography in the 80s Beginning time of open research A lot of schemes proposed Most of them soon broken

Broken Cryptosystems (I) Merkle Hellman Iterated Knapsack Lu-Lee Merlke Hellman Merlke Hellman Lu-Lee Adiga Shankar Adigar Shankar Nieder- reiter Neiderreiter Goodman McAuly Goodman McAuly Pieprzyk Pieprzyk Chor Rivest Chor Rivest Okamoto Okamoto Okamoto

Broken Cryptosystems (II) Matsumoto Imai Cade Yagisawa Matsumoto Imai CadeYasigawa TMKIF Tsujii, Itoh Matsumoto Kurosama Fujioka Luccio Mazzone Luccio Mazzone Kravitz Reed Kravitz Reed Rao Nam Rao Nam Low Degree CG 1982 High Degree CG 1988 Rivest Adleman Dertouzos Rivest Adleman Dertouzos Krawczyk Boyar...

Proven Secure Schemes Perfectly secure schemes –Shannon (1949) Computationally secure schemes –Goldwasser and Micali (1982) –Rabin (1981)

Perfectly Secure Cryptosystems Shannon’s work (1949) –Mathematical proof of security –Information theoretic secrecy Enemy with unlimited power –Can compute any desired function

Computationally Secure Cryptosystems Rabin (81), Goldwasser & Micali (82) –Mathematical proof of security –Computational secrecy Enemy with limited time and space –Can run in polynomial time –Can use polynomial space

Research Goals Fundamental way –Systematic approach –Same as Shannon and Goldwasser’s work What are the properties –Hiding –Secrecy –Authenticity

Fundamental Models Unconditional Security –Unlimited enemy Statistical Security –Polynomial number of samples Computational Security –Polynomial time and space

Information Hiding Properties Hiding property –Output must look like the cover Secrecy property –No partial information on input message Authenticity property –Hard to compute valid output

Unconditional Hiding Definition –E: K  M  C, encryption function –K: key set, M: message set, C: cover set –P cover : probability distribution of covers –P c : probability distribution of E(k,m) Requires –P c = P cover

Statistical Hiding Definition –P cover : probability distribution of covers –P c : probability distribution of E(k,m) –n: description length of each cover Requires –|P c - P cover | is negligible. –|P c - P cover | 0 and n>N d.

Computational Hiding Definition –P cover : probability distribution of covers –P c : probability distribution of E(k,m) –n: description length of each cover Requires –P c and P cover are P-time indistinguishable

Computational Hiding P-time indistinguishable –For all P.P.T.M. A, d>0, and n>N d :  Prob(A(P c )=1) - Prob(A(P cover )=1)  < n -d. –Informally speaking No P-time enemy can tell apart P c and P cover

Unconditional Secrecy Ciphertext independence: –Prob(m|E(k,m)) = Prob(m) Informally no information on message given ciphertext

Statistical Secrecy Negligible advantages: –For all m in M, d>0, n>N d : |Prob(m|E(k,m)) - Prob(m)| < n -d –Informally Only negligible amount of information on message leaked when given the ciphertext.

Computational Secrecy Negligible chances: –For all P.P.T.M. A: –For all m in M, d>0, n>N d : |Prob(A(E(k,m))=m)| < n -d –Informally Only negligible chance of output correct m.

Our Approaches Arbitrary key –Steganography, watermarking Restricted key –Protection of key materials Key = Ciphertext –Secret sharing

Our Approaches Arbitrary key distribution –E(k,m) is distributed accordingly to P cover Applications –Steganography –Digital watermarking –Tamper-resistant hardware

Our Approaches Restricted key distribution –c = E(k,m) –k is distributed accordingly to P K –c is distributed accordingly to P cover Applications –No tamper-resistant hardware –Protection of key materials

Our Approaches Key = Ciphertext –S: M  C  C –(k 1,k 2 ) = S(m) Requires –k 1 and k 2 distributed accordingly to P cover Applications –Secret sharing –Robustness

Research Progress To understand information hiding –Perfect hiding (done) Necessary and sufficient conditions Computational complexity results Constructions of prefect secure schemes Constructions of schemes with non-reliability –Computational hiding (under research) Conventional constructions Public key schemes

Perfect Hiding Scheme Condition –P cover (c)  1/|M| Algorithms –Setup: produce |M| matrices A i –Disjoint non-zero entries –Columns sum up to P cover –Rows sum up to the same –Encrypt: –E(k,m) distributes accordingly to row A m (k).

Perfect Hiding Scheme Algorithms –Encrypt: –c=E(k,m) distributes accordingly to row A m (k). –Decrypt: –Output m such that A m (k,c)>0. Message distribution independence –Hiding implies privacy.

Other aspects –Replacing privacy by authenticity –Digital watermarking Extra problem –Robustness against modifications –Simple modifications –General modifications

How to exploit Quadratic residues –n = pq –S 1 = {x 2 |x in Z n * } –S 2 = {x|x in Z n * and J(x)=1} Decision Diffie-Hellman –U 1 = (g, g a, g b, g ab ) mod p –U 2 = (g, g a, g b, g r ) mod p

Conclusion Covert channels –Very special distribution Our work –General distribution –Proven security levels

Thank you Questions?