Steganography: Hidden Writing

The word steganography comes from the Greek steganos (covered or secret) and -graphy (writing or drawing) and thus means, literally, covered writing. Steganography is usually given as a synonym for cryptography but it is not normally used in that way. Through recent usage, steganography has come to mean hidden writing, i.e., writing that is not readily discernible to the casual observer. For example, the childhood practice of writing messages in 'invisible ink' would qualify as steganography since the writing is hidden in the sense that it is not obvious that it is there unless you know to look for it.

Recent advances in computing power and recent interest in privacy has led to the development of techniques to hide messages in otherwise innocuous computer files such as digital pictures and digitized audio. These techniques are now referred to in the aggregate as steganography. Using these techniques, it is possible to send a secret message to someone in the know and no one else will even know that the message is there.

Note that the hidden messages need not be encrypted to qualify as steganographic messages. The message itself can be in plain everyday English and still be a hidden message. However, if you think your message is sufficiently important to others that you want to hide it inside another file, it is also probably important enough that you would first encrypt the message (using PGP for example) and then hide the encrypted message. That way, even if someone discovers that a hidden message is present, they will still be unable to read it.

Steganography is destined to become more important as more people join the Cyberspace revolution and as the existing governments of the world attempt to regulate or prohibit the use of cryptography for personal privacy purposes. If the government prohibits the use of cryptography, such as currently is the case in France and Russia for example, you can still send encrypted messages by hiding the encrypted message in another innocuous file using steganographic techniques. And thus another statist attempt to control Cyberspace can be thwarted by technology.

Current efforts to provide practical steganographic techniques extend in two basic directions. One, which in my personal opinion is not very effective, is to strip identifying information from encrypted messages. For example, one such program is called Stealth and will process a PGP encrypted message so that it looks like random garbage. The problem with this technique is that a PGP encrypted message is fairly easy to recognize even if the identifying information is removed. While Stealth may provide a modicum of protection, it will not thwart a determined attacker.

The other major direction in steganography is the technique of hiding messages in other files. For example, the least significant bits of a bitmap graphic can be used to hide messages. The message is contained in the least significant bits and changing these bits causes an almost imperceptible change in the bitmap image itself. Without a direct comparison of the original and the processed image, it is practically impossible to tell that anything has been changed. Another type of file that can be used to hide messages is digitized audio files. By encoding the message in the least significant bits of a wav file, for example, the message is hidden and, again, it is almost impossible to detect that anything in the wav file has changed. Another method is to hide messages in the unused sectors of a floppy disk.