December 2003 - cypherpunks-legacy

dithering, repudiable steganography
by jel＠sutro.SFSU.EDU 17 Dec '03

17 Dec '03

REPUDIABLE STEGANOGRAPHY I have a book (unfortunately not with me now) describing the format of data on music CDs. It seems that there is a kind of objectionable, heard noise in digital recordings called granulation noise. This is peculiar to digital; analog recording doesn't have this problem. Granulation noise manifests itself at low amplitudes, when the signal being represented is just at the resolution of the digital sampling. For example, if the signal is a sinusoid with a peak-to-peak amplitude represented by just a little greater than one bit difference in each sample. The problem is, the sampled sinusoid sounds just like a square wave when it is played back. Input, the signal: +--------------------------------------------------------------------- 2 | | xxx xxx | xx xx xx xx | x x x x 1 | x x x x | x x x x | x x x x | x x x x 0 +x-----------------x-----------------x-----------------x-------------- | x x x | x x x | x x x -1 | x x x x | x x x x | xx xx xx xx | xxx xxx -2 | +--------------------------------------------------------------------- Output, the digitized, sampled signal: +--------------------------------------------------------------------- 2 | | | | xxxxxxxxxxx 1 | xxxxxxxxxxx | | | 0 +xxxx-----------xxxx-----------------xxxx-----------xxxx-------------- | | | -1 | xxxx xxxx xxxx | | | -2 | xxxxxxxxx xxxxxxxxx +--------------------------------------------------------------------- This introduces (would introduce) lots of strong harmonics, making a very quiet flute, say, sound very unflutelike. The people who make commercial CDs get around this problem with a technique called dithering. They add to each sample a number from {-2, -1, 0, 1 2}, picked randomly. I.e., they randomly scramble the low few bits of each sample. The interesting thing about this is that, while it obviously degrades the signal, the result sounds better to human ears! It solves the problem of granulation noise. (The noisy flute sounds better than the clear but mangled squarewave thing the flute sounds like through the granulation noise). Of course there is something like 93 db dynamic range on a CD, so the dither hardly makes a dent in the usual sound quality -- it's only there to solve the granulation noise problem, which is only a problem at very low signal strengths. The only requirement for the dither bits is that they be such that they sound random, like noise. But any random source of bits with this property would work just as well for dithering. In particular, let's suppose you have an encrypted file, represented as a sequence of symbols, each of which has exactly 5 values it can assume. Musically, this would sound exactly like noise :-) . So *this* file could be used to dither an audiofile, instead of the "real" random values currently used. I guess what I really mean to say is that this insures that the low bit in a dithered file is *really* random; hence could be replaced with a bit from your encrypted file. Moreover, such a dithered audio file has some nice steganographic properties. 1) Repudiability. Under the assumption that the encrypted file cannot be cracked without the possession of the key to the file (which the owner of the steganographically-injected audio file has but claims ignorance of), the dither *really does* look like genuine, random dither. She can claim that the file is in fact a recording of the minutes of the last cypherpunks meeting, or a 3 hour concert that she taped off the radio, and no TLA can prove otherwise. Usually, a steganographically hidden datum (a microdot, invisible ink, etc.) doesn't have this property. 2) Zero storage requirements. This follows from 1), really. If you hide data in the unused parts of the last blocks on disk in a disk file, or in a hidden partition, the secrecy of the data (the "steganographic integrity"?) depends on the enemy not knowing or suspecting the existence of the data. PROBLEMS: You wouldn't be able to hide anything in your private copy of Michael Jackson's Thriller; the enemy could simply compare your copy with the standard copy, making the differences (the hidden file) stand out. Unless you were Warner Brothers, in which case you could just steganographically-inject ALL copys of Thriller with the secret file. This would make storage of the hidden file trivial. You could get a copy from the nearest Wherehouse. [I don't know if W.B in fact publishes Thriller; it's just an example] I wonder if CD pulishers know that they could make some money on the side by hiding data for people in their thousands of CDs? Anyway, while I don't know the format for DAT, I suspect there is some point where the sound signal is dithered to mask the granulation noise, and at this point Alice with information to hide could inject her file. Do digital pictures employ dithering to prevent aliasing? I think so. --John. jel(a)sutro.sfsu.edu

2 1

soundfile stego
by jel＠sutro.SFSU.EDU 17 Dec '03

17 Dec '03

>> Also, I am told that humans have a tough time identifying >> the phase of the frequency components of the sounds they >> identify. So one could hide date in the phase relationships >> among the frequency components of, say, recorded speech. > >This sounds interesting. How about detection, how will some >random phase relationships stand out against normal phase of >various frequencies? I suspect that the unusual phase relationships would stick out, to anyone looking at the speech with,say, an oscilliscope. Eg, a squarewave would look pretty mangled if you shifted its component frequencies by some random amount, even though a human being might not be able to detect the difference between a squarewave, and a component-frequency shifted squarewave. On the other hand, how often does speech over some electronic medeum actually get analyzed this deeply?

1 0

A change of pace
by Anonymous 17 Dec '03

17 Dec '03

Newsgroups: comp.org.eff.talk From: strnlght(a)netcom.com (David Sternlight) Subject: Re: EFF Op-Ed from the NY Times Message-ID: <strnlghtCHBurB.7on(a)netcom.com> Reply-To: david(a)sternlight.com (David Sternlight) Organization: DSI/USCRPAC References: <199311301632.LAA28210(a)eff.org> Date: Tue, 30 Nov 1993 23:04:21 GMT In article <199311301632.LAA28210(a)eff.org>, Stanton McCandlish <mech(a)eff.org> wrote: >From the New York Times Op-Ed Page, Wednesday, November 24, 1993 > >A Superhighway Through the Wasteland? > By Mitchell Kapor and Jerry Berman [Proposal for new laws to regulate the information highway omitted] Like most elitists and autocrats, eff's leaders believe in government intervention for the things they like (this topic) but not for the things they don't (Clipper). They believe in the private sector unrestricted for things they like (cryptography) but not for the things they don't (the information highway). David -- David Sternlight When the mouse laughs at the cat, there is a hole nearby.--Nigerian Proverb

1 0

re: Big Brother/Bank Acco
by Duncan Frissell 17 Dec '03

17 Dec '03

M >Given the material in the WiReD 1.6 article, how likely is it that a M >true anonymous digital cash system would be allowed? I know, I know; M >there's "no way to prevent it"; however, I think that concept is M >based on the premise that the Government proceeds rationally. The East German government did not "proceed rationally" and yet is no longer with us. M >If somebody with an axe to grind gets hold of the "kidnapped baby" M >scenario described in _Applied_Cryptography_, plenty of public M >outrage and indignation could be generated. To what end. We have had the Kiddie Porn Over the Nets story of the Day every day for the last six months in the US and the UK. Have the nets been shut down? With the clearance rate for *murders* in NYC falling down towards 30%, I doubt if we have much to worry about for our minor "crimes." M >Go on, reassure me that "all is well". All is as well as can be extected and much better than we used to fear. DCF "I never expected to live to see the Death of Communism" -- Friedrich Hayek a few months before his death (and a few months after the SU's death. --- WinQwk 2.0b#1165

1 0

Crypto Anarchy, the Gover
by Duncan Frissell 17 Dec '03

17 Dec '03

T >You mean, how likely is that the government will allow a system that T >makes taxation almost impossible, that enables black markets, that T >facilitates the transfer of illegal information, and that basically T >nukes the present arrangement? T > T >I don't think they'll "allow" it. But this doesn't mean it won't T >happen. For all of you who didn't hear my talk at ECFP '93 in London on the 20th (quite a few since there were fewer than 75 there) here is my conclusion which addresses this subject. **** "And what can we call this new form of social organization growing on the nets and in the modern fluid business environment? When two or more people can meet together and communicate freely and privately without interference by outsiders, they can trade -- they can form a market. If this trade on the nets is made free from even the possibility of external regulation, what we have is a free market and a free society." **** Remember kids God fights on the side with the heaviest artillery. Unless the government can come up with a way of blocking the above communication, it is SOOL. T >Imagine this: to get on the Data Superhighway, which will likely be T >the only major lines if the government succeeds in making it the T >mandatory standard, every data packet must have a "license plate." T >Don't laugh! The idea of a license plate on data packets is coming. It T >would provide the kind of traceability that control freaks like T >Detweiler claim to want So what if the car has a license plate if you can't tell what is in the car. No matter what happens telecoms will be cheap. Cheap means you can establish accounts and run a virtual network without disclosing the contents of the network messages or even that the network exists. You can hide your virtual network inside a much larger pseudo network which contains nothing interesting. DCF "The Trader swims in the sea of communications" -- Left out of Mao on Guerrilla Warfare because of editing error. --- WinQwk 2.0b#1165

1 0

Re: Statistics of Low-Order Bits in Images
by kqb＠whscad1.att.com 17 Dec '03

17 Dec '03

Several people are attempting to create an algorithm to mask the presence of a steganized encrypted message in the least significant bits of an image. Don't forget that no matter how fancy your algorithm or how closely you mask your steganography with a model of what the statistics of an ordinary image look like, you have to assume that your opponent also knows your steganization algorithm, including your masking technique. (Otherwise you are just relying on security through obscurity.) This leaves you with three problems: (1) your opponent may have a much better model of an ordinary image than you do, and still be able to discern the existence of masked steganography, (2) since your opponent knows your steganization algorithm, he/she can look for any "signature" that your steganography masking model leaves, and (3) your opponent can "desteganize" all your images and check their statistics for deviations from the statistics for "desteganized" ordinary images. Resolving problems (1) and (2) requires a lot of work constructing good models. Resolving problem (3) requires, I think, a modeling function for steganography that is invertible only with a secret key. (Otherwise, your opponent could desteganize your image and find a uniform random distribution, which indicates an encrypted message.) Since this type of function is, to my knowledge, not well-developed, don't expect it to be secure. Thus, if breaking it could compromise your secret key for desteganization, then don't use the same public/private key pair for both encryption and steganography. Kevin Q. Brown INTERNET kqb(a)whscad1.att.com or kevin_q_brown(a)att.com

1 0

Factor Breakthru!
by Matthew J Miszewski 17 Dec '03

17 Dec '03

'Punks, Just curious as to what would (or will eventually) happen when a shortcut to factoring large numbers is discovered? Do we revert to older less secure conventions or am I missing something? --Matt ______________________________________________________________________________ In defense of liberty, encrypt for all purposes, civil and professional. In defense of privacy, encrypt all correspondence, personal and professional. In defense of sanity, do not encrypt your dry cleaning invoice! ++++++++--------mjmiski(a)macc.wisc.edu (c)1993

2 1

Re: Entropy, Randomness, etc.
by collins＠newton.apple.com 17 Dec '03

17 Dec '03

Good questions. >My understanding of a random number is a number is generated from >two or more unrelated events. No. This may be one general category of ways to manufacture random numbers, but specifically a random number is just an arbitrary number typically drawn from a sequence of independent arbitrary numbers. The quality of 'randomness' is a measure of the independence of the elements in the stream. Therefor, there is no such thing as a random number except as an element of a sequence or other context from which to establish independence. >In order for this number to be most useful cryptographically, it needs >a even distribution. No. In order for this number to be cryptographically useful, it must cost more to guess the number (perhaps knowing the numbers that came before) than the reward for guessing it correctly. It happens that non-flat distribution of a sequence is a lever for cheaper guessing, thus flat distribution is natural characteristic of high-quality random sequences. >Does this make this distribution a gaussian distribution? No. Gaussian (a.k.a. 'normal') distribution is the bell curve (and clearly indicates a relation between samples). Math texts describing this distribution often use the phrase 'distribution of some random variable x', by which they in fact mean 'distribution of samples from a varying source'. >Also how are these statistical measurements done? See Knuth, "The Art of Computer Programming", Volume 2: Seminumerical Algorithms, Chapter 3: Random Numbers. >Is it as simple as a histogram? Yes. >Are we talking frequency analysis with FFTs and >more advanced things? Yes. >How do we measure the entropy of a random number, or a series of >random numbers? Ah. Now we're talking. Entropy is closely related but not equal to 'randomness'. Entropy is a measure of information often expressed as the fraction of information-size to data-size. Randomness is a measure of unpredictability. A sufficiently random sequence will be of very high entropy from the perspective of the 'guesser', though not necessarily from the that of the generator (e.g. a PRNG). The best way to measure entropy (if that is what you want to measure), is to build a sufficiently powerful Markov model, or the equivalent, to predict the sequence, and treat it like a compressor. The number of bits output is the entropy of the sequence with respect to that model. If you can't build a model as smart as your presumed attackers (as smart as them, not as smart as any model they might build), then you will have to use more tests to assure yourself of indepence of elements in the sequence (see Knuth, et al). In practice however, most of these methods represent very low bars over which any RNG _must_ jump, and which often poor ones can. Most RNGs are broken by understanding how they work, and exploiting weaknesses in their construction and context (e.g. poor 'seed' selection). >Have people on the list done this, or is this still in the range of >people that do math and number theory for a living? Yes, and Yes. >These topics are probably covered in some of the basic books in the field, >but all of the reference's I've been able to locate don't go into >specifics of how to measure the quality of random numbers. See Knuth. >Unless some measurements are made, you can't really be sure that those >/dev/mem MD5 hashes don't come up the same 10%, 30%, or more of the time. >It seems that a lot of assumptions are being made about what is good and >what isn't. You should be exactly as paranoid as it is cost effective to be. Hope this helps. Scott Collins | "Few people realize what tremendous power there | is in one of these things." -- Willy Wonka ......................|................................................ BUSINESS. voice:408.862.0540 fax:974.6094 collins(a)newton.apple.com Apple Computer, Inc. 5 Infinite Loop, MS 305-2B Cupertino, CA 95014 ....................................................................... PERSONAL. voice/fax:408.257.1746 1024:669687 catalyst(a)netcom.com

1 0

What recipient-end mail filters are available?
by Anthony Garcia 17 Dec '03

17 Dec '03

I'm aware of two mail-filtering systems that operate at the recipient's end, procmail and Elm filter. Are there others? -Anthony Garcia agarcia(a)neosoft.com

3 2

Statistics of Low-Order Bits in Images
by jazz＠hal.com 17 Dec '03

17 Dec '03

>Sounds like the simple solution is for people everywhere to replace >the low order bits of all of their pictures with good random noise. You're kidding, right? Image processing software, and music processing equipment, are designed to get the maximum performance out of the storage medium. I find it pretty unlikely that any developer of image processing tools is going to deliberately drop one bit of precision off each n-bit unit; sheesh, image files are big enough without software deliberately wasting bits. As for introducing noise into the low-order bit of music CDs, definitely not; the trend is towards equipment that can extract the last dribble of information from well-recorded sources, and towards recording equipment that can meaningfully record every bit of every word. Why do you think there are 64x-oversampling players and the like? Eric's right; you'll have to build your own tools to make things noisy, as the trend elsewhere is to make things unnoisy. On the other hand, have you looked at the new mini-disc technology? That stuff already introduces audio compression, and the bits on a minidisc should be pretty high in entropy; of course, twiddling bits in a compressed audio recording may have dramatic effects on sound... Jason

2 1