Is Steganography a safe method to store secret data?

Question

I want to put some parts of my secret data into specific file with Steganography method. Is this method as safe as other encryption methods like RSA or SHA?

"_Is this method as safe as other encryption methods like RSA or SHA?_" SHA-something is *not* an *encryption* method. It is a hashing function. — curiousguy, Jun 27 '12 at 14:35

score 27 · Accepted Answer · edited Jul 29 '11 at 08:00

27

NO, it isn't safe at all and steganography is not encryption!

Encryption means that the method is known, but that's not a problem, the data can't be decrypted without a key. Bad luck for interceptors when a strong method and a strong key have been used. The message is useless for them.

Steganography means hiding data in other data and it relies on the method used to hide the data being unknown to interceptors! It isn't encryption at all, but it can be combined with encryption. Simple/public domain steganography techniques can be detected quite easily, if the interceptor expects a hidden message.

Pure steganography (just the hiding process) is security by obscurity, which is a bad practice. However, sometimes the combination of steganography and cryptography can be desirable, for example when you don't want anyone to know that a secret message has been sent at all. Interceptors won't be able to prove it, when they can't break the encryption.

edited Jul 29 '11 at 08:00

Mark Davidson

9,367
6
43
61

answered Jul 28 '11 at 07:37

Falcon

691
5
7

1

**security by obscurity**, such an aphorism @Falcon. +1 – Jul 28 '11 at 07:38
2

-1 because it's simply not true that all steganographic methods can have the message discovered just by knowing the method. There are some where you have to know a key in order to be able to determine whether a hidden message is present or not. – Jul 28 '11 at 07:48
9

@Michael: But that's a combination of steganography and encryption and not pure steganography anymore. – Jul 28 '11 at 07:49
2

@Falcon: There are methods of steganography that do not rely on the payload having high entropy for evading detection. I cannot see why those would not be considered "pure steganography". – Jul 28 '11 at 08:11
1

@Michael: Where did I state or imply that the payload needs to have a high entropy? I cannot see how this is related to my answer. But if we agree that a message is not encrypted when it's data hasn't been altered and the key is only used to generate the access scheme for the hidden data, then one could consider such methods "pure steganography". Or we could call the generated access scheme an encrypted message, lol. The borders are quite blurry, imho. – Jul 28 '11 at 08:31
1

@Falcon: Encryption usually produces high-entropy payloads and it's true that those are easier to hide. But that can be offset by a lower payload/carrier ratio. And yes, it's certainly true that the borders are blurry and the fields strongly related - which contradicts your statement "steganography is not encryption". Advanced steganography uses many of the same principles as cryptography and is therefore just as safe. – Jul 28 '11 at 08:41
8

@Michael Borwardt: The common definition clearly separates cryptography (making unreadable) from steganography (hiding). We just have a communication problem here. Of course, in practice, both are combined (they should be in some cases!). – Jul 28 '11 at 08:50
there are techniques to detect that there is at least data there still even with key based data placement. – ewanm89 Jul 29 '11 at 10:35
2

Simple schemes are trivial to detect, but this answer does not address secure methods of steganography, which are built on solid methods. The bold "NO" is misleading. Obviously, users of steganography need to be careful, but that's true for everything about security. – DanBeale Aug 05 '11 at 10:54
1

Warning: Falcon's answer is **totally incorrect**. The claim that *"Steganography [..] relies on the method used to hide the data being unknown to interceptors"* is **not correct** -- secure stego algorithms rely upon a secret key. The claim that *"steganography [...] is security by obscurity"* is **not correct** - secure stego algorithms *do not* rely upon security through obscurity. – D.W. Aug 18 '11 at 22:13
1

@D.W.: Tell that wikipedia, too. As stated before, I don't consider this pure steganography. – Falcon Aug 19 '11 at 07:12
1

Falcon: I don't care what Wikipedia does or doesn't say. If wikipedia says that stego is unkeyed, Wikipedia is wrong -- end of story. Wikipedia is not an authoritative source. As for what *you* consider to be "pure steganography", well, "steganography" is a standard term with an accepted meaning in the technical community, and it is unreasonable and confusing to use it in a fashion contrary to its accepted meaning (especially lacking a warning that you're using it idiosyncratically). P.S. In fact, Wikipedia does not say that stego is unkeyed. – D.W. Aug 20 '11 at 01:34
1

@D.W.: I'm tired of discussing this topic with your kind. You know, I don't care what you do or don't say. – Falcon Aug 20 '11 at 06:54
While I don't mean to create drama, @D.W. is correct. The correct (or at least original) definition of steganography involves information theoretic security. Crappy steganography may be security through obscurity, but it is not "true" steganography. – guest Nov 19 '17 at 02:36

score 12 · Answer 2 · edited Jul 28 '11 at 10:10

The answers by @Falcon are technically accurate, however answering this question is impossible without knowing some more details. Who are you protecting the data from and for how long, your 6yo kid brother or the NSA. What are you protecting and what's its value to your attacker (i.e. NSA could, but won't crack an email home telling mummy what a great holiday you are having, unless you are on their watch list...). Where will you store you private keys for your RSA, are they "safe", how will you know if some has seen them?

I suggest you read Bruce Schneier's works before going too much further, particularly Secrets and Lies, followed by Applied Cryptography for some light bed time reading.

Actually, as it happens, @Falcon's answer is not accurate; see my comments on his answer. — D.W., Aug 18 '11 at 22:15

score 5 · Answer 3 · answered Jul 29 '11 at 12:48

Steganography is the practice of hiding some data within other data. It can be as simple as selecting the 3rd word of every sentence to determine the real text, or as complex as a keyed pattern (similar to an encryption method).

RSA is a public / private key system. That means that one what is done with one key requires the other key to reverse.

SHA is a hashing algorithm. That means that any amount of data can always be mapped to a fixed-size representation. It is not reversible.

Detecting steganography is principally related to the ratio of inert data to hidden data. Patterns in the hidden data are also relevant. Encrypting your hidden data first can greatly increase the chance of avoiding detection. There are many methods of steganography, so this is a general rule rather than a hard and fast rule.

Another general rule: encrypt any data that you do not want read. Use steganography AFTER encryption to hide the existence of that data.

How "safe" this will be depends on what threats you're attempting to guard against.

score 4 · Answer 4 · answered Jul 28 '11 at 07:40

That depends entirely on the steganography method. Some rely on security through obscurity while others have a solid cryptographic background, i.e. an attacker would have to find a weakness in the algorithm to be able to detect the presence of the data, and then it would/should still be encrypted using regular encryption method.

But that kind of Steganography tends to require a very low payload/carrier ratio, i.e. you can fit very little data into a file unless it is very large.

score 3 · Answer 5 · answered Jul 29 '11 at 07:45

Rory is right that it depends on what you are tyring to protect and who might try to get it.

Steganography is a method of protecting the confidentiality of data by keeping the existance of the data secret.

Cryptography is a method of protecting the confidentiality of data by transforming data with a algorithm and key, and keeping the value of the key secret.

With cryptography you are effectivly announcing that you have valuable data, with steganography you are concealing the fact you have valueable data. The protection they provide for data is not directly compareable. There may be situations where steganography is a better choice, such as in countries where encryption is banned or repressive regimes where encrypting data will get you arrested and tortured.

Steganography requires other data to hide in. As alluded to in some comments you need a significantly larger about of unimportant data to hide your data in. A common choice is graphic images in jpg, png, and gif formats. Given a large enought graphic there is sufficient space to hide your data in the graphic.

I'm no lawyer, but as far as the courts go, they'll probably count stenography as cryptography, in fact if you translate the actual Greek cryptography literally means hidden writing/drawing. And as far as a judge goes it could probably be argued as such. — ewanm89, Jul 29 '11 at 10:39

score 2 · Answer 6 · answered Aug 03 '11 at 14:46

Steganography is provably secure for hiding data, with some important considerations. The cover text (the stuff you're hiding your data in) has to be very large, and the hidden text has to be pretty small. You need to avoid trivially easy hiding patterns such as Least Significant Bit. You need to avoid silly choices for cover data, such as gif image files.

You need to encrypt the hidden data before hiding it, to make it "more random". (Really, to make it harder to detect using pattern analysis.)

You must make sure the cover data is not compressed before doing the hiding. This is to make sure it has enough redundancy to hide the data from statistical analysis.

So, preparing the hidden data is tricky; preparing the cover data is tricky; and some implementations of steganography are hopelessly broken.

Here's some refs:

Provably Secure Steganography http://eprint.iacr.org/2002/137

Usenet Discussion https://groups.google.com/group/sci.crypt/browse_thread/thread/68bd62328afbed0c?hl=en&tvc=2&q=%2Bclayton+%2Bsteganography&fwc=1#

"_You must make sure the cover data is not compressed before doing the hiding._" you certainly mean lossy compressed. — curiousguy, Jun 27 '12 at 14:40
Re-reading it it doesn't make much sense. Maybe "compress first and then encrypt, before steganography"? — DanBeale, Jul 11 '12 at 21:09

score 0 · Answer 7 · answered Mar 12 '14 at 01:12

Another aspect not fully addressed here is how fragile is the final product - i.e. the object/image/file containing the secret information. Simple free steganography programs are fun, and some even let you hide a file in one file, then hide that file in another - great! Trouble arises, however, if you accidentally make any changes to your master file, as it may destroy the reversability of the process. Contrasting this tenuous method, versus a robust encryption system, and the weaknesses are obvious. The latter is a digital mystery which can be transmitted, stored, copied, etc. with no damage or loss, while the steganographic image/file is easily lost or made useless, even by the crudest attack, unless protected from modification, deletion, etc. by some security method! Hiding your fortune in the woods is fine, until you come back and all the trees have grown, or fallen, and the landmarks aren't familiar anymore. My practical approach for securing normal computer info is by using the free KeePass with long, complex password, then using its built-in file-storing ability to attach files within its secure framework; once saved, only I can open it, and the little program so far seems hardy and crash-resistant. Just remember to make backup data files to other machines or by email.

score 0 · Answer 8 · answered Mar 12 '14 at 03:47

In plain words, just using Steganography is not enough if you wish your information to be safe. It will definitely help as it won't attract attention, but if you have to be sure of your confidential data, you need to first encrypt the data and then use Steganography prior to storage/transmission.

Is Steganography a safe method to store secret data?

8 Answers8

Linked

Related