Comments
Vipul • May 24, 2018 7:02 AM
Last sentence spelling mistake. Stenography? Or Steganography as it is with the post title.
echo • May 24, 2018 8:03 AM
I suppose if font stenography was used as part of a wider scheme adopted by everyone a message would be undetectable? I don’t expect pseudo-randomised font glyphs will become standard but in theory they could be. Page 10 of this paper notes thatthe scheme can contain a basic encryption scheme so even if discovered the message will be secure. I don’t suppose why in theory a protocol couldn’t contain a hidden message container like the now abandoned Truecrypt?
Similar could apply to images if an image standard contained a similar cryptographic protocol? This is very far flung but I also wonder if photographs could use a stenography scheme based on the idea that all camera sensors contain flaws.
In some senses this font scheme if it became standard is almost a reverse of banknote detection.
With line of sight this scheme could also be used for exfiltration via a display or perhaps even a document carried out by a trusted unknowing third party like a reverse Stuxnet?
Frank • May 24, 2018 8:16 AM
@echo
“This is very far flung but I also wonder if photographs could use a stenography scheme based on the idea that all camera sensors contain flaws.”
What if a major photo or graphic program imbedded in all images an empty encrypted container. Then the container could be used to hide messages, as no one would know which containers were actually empty. You would need a very popular program, probably one given away for free, with millions of users, but it could be done.
Eric • May 24, 2018 8:26 AM
This is called a biliteral cipher, and the idea has been around for a long, long time. In fact, studying a supposed biliteral cipher in Shakespeare is what got Elizebeth Friedman (then Smith, the mother of modern cryptography) into cryptography in the first place.
Recommended reading: The Woman Who Smashed Codes by Jason Fagone.
Mailman • May 24, 2018 10:06 AM
The video in the Wired article gives tangible examples of how this could be a promising development. Usually in talks about steganography, the intended use is to evade detection: spying, data leakage, etc.
But what I read into here is that ultimately, the purpose of this could be not to conceal the existence of a secret message in a document, but to embed metadata in a transparent, non-obtrusive way. Main applications, as the video shows: hyperlinks embedded in paper documents (in replacement of QR codes which occupy a lot of space), or digital signature of the document itself.
Stenogra Steganogra • May 24, 2018 10:23 AM
We keep in the typing pool a special double-key-decker Smith Corona for just these purposes.
Santa Claus • May 24, 2018 11:04 AM
When I had to distribute my survey for my MS degree (someone else did it for me so I could not tell who got it by name – and thus know who was in which audience) and get back the answers anonymously I used two different fonts so I tell which of the two audiences I got the answer back from. Then I used MANCOVA to analyze the results. I suppose that was Steganography of a sorts since it communicated information via font.
MikeA • May 24, 2018 11:06 AM
1) I love the smell of Bacon in the morning.
2) It looks like most commenters have just given up the battle against spelling mis-correction in their browsers.
Sergey Babkin • May 24, 2018 12:04 PM
I’d say that it should be relatively easy to detect in the PDF or other electronic documents: to get the multiple shapes of each letter, they must use either multiple similarly-looking fonts or one font with multiple letter shapes and an unusual encoding. Switching the fonts on each letter in a document should be fairly easy to detect. Detecting the fonts with unusual encodings would be more difficult (you could for example map the multiple shapes of Latin letters over the Unicode range for Chinese glyphs) but still can be done, for example using the character usage statistics. And I guess an easy way to protect the secrets would be to forbid the documents with the embedded custom fonts.
Another variation of this theme I can think of would be to slightly vary the size of the characters that have a rounded element at the top. Normally they’re made a little higher than the ones with the flat elements at the top, but varying them between being a little higher than and even with the flat-top characters would allow to encode a message. However it would still be detectable in the same way, since the normal text don’t vary the font size on each letter.
RockLobster • May 24, 2018 12:08 PM
I think my idea is better than that, to convert already encrypted data into a random image.
The raw encrypted data looks like noise when converted to an image format.
A reversable algorithm is then applied to the noise image to create an aesthetically pleasing image.
There are of course many fully reversable ways to manipulate images that would result in an innocuous image that could be posted anywhere and only the intended recipients would know to copy paste it to the application that reverses the process.
The random data produced can then be decrypted.
killbot • May 24, 2018 3:17 PM
On a related note:
https://github.com/PlanetRenox/in0sight
More background here:
echo • May 24, 2018 3:29 PM
@RockLobster
This is workable but… meta data? I would also add any stenographic standard may be a problem for fine artists so this needs to be considered too.
David Leppik • May 24, 2018 3:41 PM
@me: the whole point of steganography is to be subtle enough that nobody bothers to look.
@RockLobster: that’s pretty much the definition of steganography. There are lots of ways to do it.
In the 1990s, Xerox PARC came up with a technology for embedding data in grey areas of laser printed documents, such as photos, logos, or fancy borders. The halftoning was in a crosshatch pattern, where the left-to-right and right-to-left diagonals were not symmetrical, and the data was encoded by the difference between the diagonals.
They tried to commercialize it, not as a form of steganography, but as the equivalent of a QR code, only without the ugly QR code. You’d print it on a Xerox laser printer and then read it with a Xerox scanner. Because of the high resolution, you could store a lot of data (so long as you had enough gray area) even if you set the error correction really high. With high error correction, you could crumple the paper up, photo copy it, crumple the photocopy, and then scan it and still get your data back.
echo • May 24, 2018 3:56 PM
@David Leppik
Maybe the time travellers skipped Stephen Hawkings party because they were busy briefing the staff at Xerox? Huh huh. That’s me. Not so dumb, huh?
@echo • May 24, 2018 9:40 PM
@echo
Can you explain your comment about metadata?
RockLobster • May 24, 2018 9:57 PM
In case anyone is interested, a developer friend of mine created a nice proof of concept of the image steganography I described for Windows including one implementation that creates a transparent image. There are a lot of possibilities, the last time I spoke to him he said he was planning to develop the idea further.
echo • May 25, 2018 4:08 AM
Could you not place “@myname” in the name field please?
herman • May 26, 2018 4:28 AM
The Matroska and MPEG-2 TS video streams have metadata channels. It is perfectly possible to put encrypted data in there. Ordinary video players will not be able to play it and most people will not bother to look for it. So one could have a standards compliant secure side channel in a video stream, hidden in plain sight.
echo • May 26, 2018 6:03 AM
I suppose it’s also possible for watermarking to contain a hidden encryption layer? I have no idea if the maths works for this though so may be talking rubbish.
MikeA • May 26, 2018 10:03 AM
It seems quite a few people have missed the intended goal of this. Or maybe I have misinterpreted it. As I read it, the goal is to encode metadata (e.g. a machine-readable but unobtrusive “link” for more information). Clearly, this could be used in conjunction with a suborned (or poorly coded) app for tracking etc., but I pictured it as more like what Brad Templeton (rec.humor.funny) did to encode additional styling info in trailing whitespace.
https://www.templetons.com/tech/oob.html
Just be careful to never encode U+FDD0 if any user may have an inappropriately configured browser. https://www.xkcd.com/380/
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
me • May 24, 2018 6:46 AM
“FontCode could be more difficult to weaponize, since anyone could potentially use machine learning algorithms—like those that generate FontCode tweaks—to check text documents against font standards”
So this is NOT stenography as it can be detected by the fact that the letter has not it’s standard shape.