Steganography is a way of creating hidden messages so that only the sender and recipient realize there is a message at all - so it's different from encryption because encryption only obscures a message.

We’ll start by using a man with a twice-shaved head to demonstrate the principles of this obscure, but up-and-coming art/science, and to show how steganography differs from encryption.

Suppose you’re a general in ancient Greece and you’re stirring up a rebellion against those dirty ole Persians. You’ve got to get a secret message to a spy in the Persian court. Being a big shot general, you’re not going to do something stupid like travel to Persia yourself, so you get some poor schmuck to carry the message for you.
Your first idea is to write your instructions in a secret code and have poor schmuck carry the message through enemy lines. Here’s the rub. If the enemy captures the guy and finds the message, things could get ugly. Even if the Persians can’t decode the message, the mere presence of a letter saying something like “44lethc *&m=o,e” will raise suspicions. Given enough time, the enemy might even crack your code. Worse yet, they could torture the messenger by making him listen to Queen Latifa CDs until, in a fit of unpronounced agony, he reveals the cipher.

A better approach would be to hide the very existence of the message. So, you sit said poor schmuck on a stool, shave his head, and tattoo the message on his glistening noggin. When his hair grows back, you send him through the enemy lines with the Persians none the wiser. Poor schmuck gets his head mowed again. Your secret message is delivered safely. The good guys win. You get a bonus vacation for two in Cancun.

By the way, the story is true all except the bit about Cancun. The Greek general’s name was Histiaeus, and the poor schmuck was his servant. This was the first recorded use steganography - the art of hiding data.

Tattooed messages on baldheads are one thing (the Germans used the same technique in World War II), but the digital world has given steganography and hiding data a whole new meaning. Large files like digital pictures and music are common vehicles for hidden messages. Let’s hide a message in a simple .BMP image file.

Now You See It

Hiding data in a digital image or audio file uses three principles; large file size, the presence of ‘noise’, and last but not least, the frailties of human perception. You already know large file sizes and digital images go together like Bugs and Elmer. Generally speaking noise is the presence of digital inaccuracies. This occurs because the digitization process cannot make an exact copy of the target. Noise is said to be at an ‘acceptable level’ if the inaccuracies cannot be detected. In a .BMP image noise is in the form of closely packed colors and intensities. ‘Frailties of human perception.’ Oh my. We could devote an entire issue, or lengthy Gin and Tonic session at the Stonleigh P to this subject. When it comes to digital images, we’re talking about the inability of the human eye to pick up very slight alterations of color, contrast, and brightness. These three factors are the foundation of the Least Significant Bit or LSB method of hiding data in an image.


Saint Olga planting the tree of Christianity in Russia.    On the left each pixel is encoded in 24 bits, 8 each for the red, green, and blue intensity of that pixel.  On the right the least significant bit for each color of some number of pixels was used to encode a hidden message – The Gospel of Judas in its English translation by Kasser, Meyer, and Wurst.   The original image size was 500x320 pixels, giving 961,000 bits or about 120,000 bytes for a hidden message and quite more than enough for the short text of 17,845 bytes. The human eye cannot detect any difference between the full 24-bit color of the image on the left from the slightly modified image on the right.  Credit: Michael Leventhal, Senior Director, Tarari in XTech 2006 conference proceedings from May, 2006.

We’ll talk about Least Significant Bit/LSB, but first comes the lingo of steganography:

A cover-object is the data file that will hold the secret message. For spies and lovers, a cover-object is something large but harmless. The embedded-object is the message that will be hidden using a stego-key or algorithm. Depending on the method, the embedded-object could be a graphic, straight text, formatted file, or encrypted message. A stego-object is the new file carrying the embedded-object. Generally speaking, the steganographic process goes like this. A cover-object and embedded-object are selected. Both are submitted to the stego-key, and voila. The process produces a stego-object that appears (don’t forget those human frailties) identical to the cover-object. Now back to our .BMP image and the Least Significant Bit method.

Let say your BMP image uses true color. This means each pixel is describe by three, eight bit bytes. Pixel 456 might look something like this:

01011101 10111010 11011001
Byte #1 Byte #2 Byte #3

The noise range is the cumulative effect on the senses of all bytes contained in the image. Now at a look at the furthest left bit of each byte. This is the least significant bit because changing its value has the smallest affect on the numeric value of the byte. It’s the same with the human eye. Changing the least significant bit will have an imperceptible effect on the image. Here’s where we’ll hide our message.

A LSB stego key takes the digital equivalent of our embedded-object and stores the message across the least significant bits in our digital picture. The new Pixel 456 looks like this:

01011100 10111011 11011000
Byte #1 Byte #2 Byte #3

Of course, depending on the message, the LSB may or may not get changed. In any event, the result is a new digital image (the stego-object) that looks exactly like the original picture (stego-cover). Yes, you’ve fiddled with bit, but the noise range of the new image has not been perceptibly altered. You now have a secret message hidden in an innocent digital picture, all without shaving a single head.

More Steganography Stuff

The sequential LSB stego-key is one of simplest steganography techniques around. It’s easy to detect, because storing a hidden message in sequential LSBs creates a statistical pattern that differs from the unaltered portion of the image. For this reason, stego-geeks have developed other methods for hiding data. Storage of the message can be spread over the entire image using random byte selection. This minimizes storage abnormalities. In palette-based images like JPEG files, both the image and the accompanying palette can be altered. Of course digital pictures aren’t the only vehicles for hidden messages.

Audio and video files have massive levels of imperceptible noise. Changing tone bits and the pause duration between notes are great places to hide a love note to your surreptitious sweety. Data hiding techniques for written text change spacing and the placement of individual characters. Even large hard drives on PCs can be used to hide data. File systems like FAT or NTFS allocated blocks for storage. Most of the time these blocks have unused space where secret messages can be stored.

I could go on and on, but if you want to read the definitive work on hiding information, pick up “Information Hiding: Techniques for Steganography and Digital Watermarking”, edited by Stefan Katzenbeisser and Fabien A.P. Petitcolas. Before you run down to your local Barnes and Noble, let me warn you. List price for this 200-page baby is 85 smackers.