Computing Practices Exploring Steganography: …

1 Computing Practices Exploring steganography : seeing the unseen steganography is an ancient art of hiding information. Digital technology gives us new ways to apply steganographic techniques, including one of the most intriguing . that of hiding information in digital images. S. Neil F. Johnson teganography is the art of hiding informa- (with the exception of JPEG images). All color varia- tion in ways that prevent the detection of hid- tions for the pixels are derived from three primary col- Sushil Jajodia den messages. steganography , derived from ors: red, green, and blue.

2 Each primary color is George Mason University Greek, literally means covered writing. represented by 1 byte; 24-bit images use 3 bytes per It includes a vast array of secret communi- pixel to represent a color value. These 3 bytes can be cations methods that conceal the message's very represented as hexadecimal, decimal, and binary val- existence. These methods include invisible inks, ues. In many Web pages, the background color is rep- microdots, character arrangement, digital signatures, resented by a six-digit hexadecimal number actually covert channels, and spread spectrum communica- three pairs representing red, green, and blue.

3 A white tions. background would have the value FFFFFF: 100 per- steganography and cryptography are cousins in the cent red (FF), 100 percent green (FF), and 100 percent spycraft family. Cryptography scrambles a message so blue (FF). Its decimal value is 255, 255, 255, and its it cannot be understood. steganography hides the mes- binary value is 11111111, 11111111, 11111111, sage so it cannot be seen. A message in ciphertext, for which are the three bytes making up white. instance, might arouse suspicion on the part of the This definition of a white background is analogous recipient while an invisible message created with to the color definition of a single pixel in an image.

4 Steganographic methods will not. Pixel representation contributes to file size. For exam- In this article we discuss image files and how to hide ple, suppose we have a 24-bit image 1,024 pixels wide information in them, and we discuss results obtained by 768 pixels high a common resolution for high- from evaluating available steganographic software. resolution graphics. Such an image has more than two For a brief look at how steganography evolved, see the million pixels, each having such a definition, which steganography : Some History sidebar.

5 Would produce a file exceeding 2 Mbytes. Because such 24-bit images are still relatively uncommon on the IMAGE FILES Internet, their size would attract attention during To a computer, an image is an array of numbers that transmission. File compression would thus be benefi- represent light intensities at various points (pixels). cial, if not necessary, to transmit such a file. These pixels make up the image's raster data. A com- mon image size is 640 480 pixels and 256 colors (or File compression 8 bits per pixel). Such an image could contain about Two kinds of compression are lossless and 300 kilobits of data.

6 Both methods save storage space but have different Digital images are typically stored in either 24-bit results, interfering with the hidden information, when or 8-bit files. A 24-bit image provides the most space the information is uncompressed. Lossless compres- for hiding information; however, it can be quite large sion lets us reconstruct the original message exactly;. 26 Computer 0018-9162/98/$ 1998 IEEE.. therefore, it is preferred when the original informa- information to be hidden. A message may be plain tion must remain intact (as with steganographic text, ciphertext, other images, or anything that can be images).

7 Lossless compression is typical of images embedded in a bit stream. When combined, the cover saved as GIF (Graphic Interchange Format) and 8-bit image and the embedded message make a stego- BMP (a Microsoft Windows and OS/2 bitmap file). A stego-key (a type of password) may also be Lossy compression, on the other hand, saves space used to hide, then later decode, the message. but may not maintain the original image's integrity. Most steganography software neither supports nor This method typifies images saved as JPEG (Joint recommends using JPEG images, but recommends Photographic Experts Group).

8 Due to the lossy com- instead the use of lossless 24-bit images such as BMP. pression algorithm, which we discuss later, the JPEG The next-best alternative to 24-bit images is 256-color formats provide close approximations to high-qual- or gray-scale images. The most common of these ity digital photographs but not an exact duplicate. found on the Internet are GIF files. Hence the term lossy compression. In 8-bit color images such as GIF files, each pixel is represented as a single byte, and each pixel merely Embedding data points to a color index table (a palette) with 256 pos- Embedding data, which is to be hidden, into an sible colors.

9 The pixel's value, then, is between 0 and image requires two files. The first is the innocent-look- 255. The software simply paints the indicated color ing image that will hold the hidden information, called on the screen at the selected pixel position. Figure 1a, the cover image. The second file is the message the a red palette, illustrates subtle changes in color varia- steganography : Some History fore sound normal and innocent, the written pages, which permits the transmis- Throughout history, people have hidden suspect communications can be detected sion of large amounts of data, including information by a multitude of methods by mail filters while innocent messages drawings and and ,2 For example, ancient are allowed to flow For exam- With every discovery of a message hid- Greeks wrote text on wax-covered tablets.

10 Ple, the following null-cipher message den with an existing application, a new To pass a hidden message, a person would was actually sent by a German spy in steganographic application is being scrape wax off a tablet, write a message on WWII1: devised. Old methods are given new twists. the underlying wood and again cover the While drawings have often been used to tablet with wax to make it appear blank Apparently neutral's protest is thor- conceal or reveal information, computer and unused. Another ingenious method oughly discounted and ignored.