Steganalysis

No key, so recovering the message is not the attack. Counting the code points that render as nothing is.

CryptanalysisDetectiondemo

Objectives

Detect a zero-width carrier by comparing rendered text with character count.
Recover the hidden bits and decode them without any key.
Explain why hiding must be layered on encryption rather than replace it.

33%

No key, so no security service. The attack is detection, not decryption.

Cover text

Secret

cover text, 24 characters

Nothing to report today.

carrier, 56 characters, and it renders identically

No‌t‌hi‌n‌g ‌to‌ ‌re‌p‌o‌r‌t ‌t‌od‌a‌y.‌‌‌‌

There is no key here, so recovering the message is not the attack. Finding the carrier is, and the count above is the entire find: two strings that render the same and are not the same length.

Count what should not be there

code points that render as nothing

bits

01101101011011110110110001100101

bytes

6D 6F 6C 65

secret

"mole"

Steganalysis counts what should not be there: invisible code points, noise in the low bits, timing that is too regular. None of it needs a key, because none of it was ever protected by one.

Found means broken. Anyone who knows the method reads the message and can change it, so hiding buys concealment of traffic and nothing else. Encrypt first, then hide the ciphertext: then finding the carrier costs the adversary a key they still do not have.

step 1/3

CPE 645 / CS 685

Steganalysis

Breaking a Product Cipher

Score Card