- cypherpunks-legacy - lists.cpunks.org

Re: HIDE: embeddin msgs into snd & graphics
by Derek Upham 16 Mar '93

16 Mar '93

> I think Eli is right, too, that lossy compression is pretty much out of the > question for this application. It would be too easy to lose the message > that is encoded in the low-order bits. Uh, unless the JPEG FAQ sheet has seriously mislead me, lossy compression would be excellent for this sort of steganography. In the standard JPEG encoding procedure, an image is broken into square blocks of pixels, eight per side. These blocks are run through a 2-D discrete cosine transform, producing a set of cosine waves that are equivalent to the original blocks (within small errors). If the original image was smooth (a natural image, for example), the low- frequency waves will contain all the information necessary for reproducing the block; the high-frequency waves will contain nothing but faint noise. So the JPEG encoder _dumps_ the high-frequency cosine waves. That's how the format gets a lot of its compression. This is where steganography comes in. Take these empty wave slots and stick your data in them. For example, if the wave magnitudes are stored as four-byte integers, store one byte of data in the lowest- order byte in the slot (or go down to four, two, or even one bit per integer, if necessary; floating-point would be wonderful, here). As long as the hidden data representation looks like very tiny values to the JPEG decoder, the data should be completely unnoticeable on display---but the steganographic decoder will know where to look for it and what to do with it. Anyone have honest-to-god practical experience with JPEG/JFIF to assess the feasibility of this technique? Derek Derek Lynn Upham University of British Columbia upham(a)cs.ubc.ca Computer Science Department ============================================================================= "Ha! Your Leaping Tiger Kung Fu is no match for my Frightened Piglet Style!"

1 0

HIDE (Fnord): Targa-24/YUV/D-xxx and headers
by Seth Morris 16 Mar '93

16 Mar '93

W.r.t. the steganography issue and image files (although I think sound files are probably more useful), Targa-24 images are RGB bytes (triples for each pixel, bottom-left to top-right), and seem appropriate for hiding a msg. They are also widely supported for conversion and function as a nice "device independant" image format (The Stone Soup Group's PicLab does a good job on them, IMHO). Does anyone know anything about YUV format? Also, DYUV or some other delta compressed format seems good. If a pixel changes by one more or one less than it "should" the image simply looks like a mediocre scan. Hmmm..... FLI is a delta format... is it appropriate? So... can someone whip up a utility to strip the PGP header and then perfoem some simple filtering (^= with some magic numbers, perhaps, or with some function of the preceeding bytes? Can this eventually help recover a better image, if that could ever be important? I don't think so) and tack on a valid Targa or other header (or correct any headers on images we've slid into). I just started a new job and am swamped, or I'd have written first and posted later ;-) . Seth morris <seth.morris(a)laUNChpad.unc.edu>

1 0

HIDE: embeddin msgs into snd & graphics
by Hal 13 Mar '93

13 Mar '93

The considerations that Eli mentioned make it clear that embedding data in the low bits of an image is not as trivial as it sounds, with commonly-used image formats. In the case of GIF, Eli points out that you may have a 256 entry color table, with each pixel indexing into that table. Flipping the low bit of a pixel may lead to a completely different color. What you could do is to renumber the color table so that, to the extent possible, every even-numbered color has some odd-numbered color that is similar (close in color space), and vice versa. Then rather than just altering the low-order bit of each pixel, you'd change the color of that pixel to be the nearest color of opposite even-odd-ness. For the decode step, though, you could still just check the low-order bit of the (uncompressed) image. That renumbering step sounds like the tricky part. I think Eli is right, too, that lossy compression is pretty much out of the question for this application. It would be too easy to lose the message that is encoded in the low-order bits. Images that would be good candidates for this would be natural, scanned-in pictures. Hand-drawn artworks and most computer-generated images would not have enough natural randomness to allow the message to be slipped in unnoticeably. Fortunately, nudes would fall into the useful category, and they make up a large fraction of the images people exchange. Hal 74076.1041(a)compuserve.com

1 0

Re: Cypherpunks know they're cool
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 13 Mar '93

13 Mar '93

> Hmm..... how is this alike, and how is this different, from a hardliner > NRA saying, "We should ask people to protect themselves by wearing > bulletproof vests, instead of trying to ban guns"? Ted, please don't be a bonehead on purpose. I bet you can see the difference between some bits coming down a wire and a bullet coming at you at 1000 feet per second. It has to do with the level of threat and the feasibility of protecting yourself. > As long as we are really being freedom-loving, there's nothing we can do > (or should _want_ to do) to get people to attend groups that allow > anonymous posters, if they only want to travel in "real person only" > circles. Not true at all! Just because I like freedom doesn't mean I shouldn't try to convince people to act in a way that is more freedom-loving. -- Marc Ringuette (mnr(a)cs.cmu.edu)

2 1

CYPHER: Plain encypher
by Matthew J Miszewski 13 Mar '93

13 Mar '93

In response to all those interested in disguising messages in complicated graphics/sound/random # generators/etc I believe this would unnecessarily defeat the purpose. TLA types become suspicious when they see random pgp type data transmissions flying across their screens. When they get one of these monsters, they of course attempt to decrypt it (assuming its from someone they wish to monitor (All of us?). They also become suspicious when incredibly long plain text transmissions are broadcast. It seems desireable to have a mode of encryption that will encrypt my message and then package it in a short (relatively) plain text message. The NSA/CIA/FBI wont bother trying to decrypt messages that are the equivalent of 'My slide show of my trip to Florida". And even if they were to suspect, or by some miracle decrypt it, you have your Plausible Deniability. Make the message generator sufficiently general that all final messages are plausible real messages. Only those expecting a message that is encrypted in plain text will know they have one. They would have the key to decrypt it. And no one would be the wiser. Matt mjmiski(a)macc.wisc.edu

2 1

Re: HIDE: embedding msgs into snd & graphics
by blojo＠sting.Berkeley.EDU 13 Mar '93

13 Mar '93

> I think color images, as opposed to mapped, would be the way to go > for steganography. More room, and nobody expects them to compress. Yeah; but even if we're talking full 24-bit images, we're going to have problems. Once 24-bit displays become standard, I really doubt that there will be many images stored in a non-lossy format. And once you try to hide data in a lossy encoding scheme, you run into a lot (though not all) of the problems you have with colormaps. It would be a lot easier to hide data in an image if one had a control-image (the original) as well as the altered-image (the one holding the message), but this defeats half the niftiness of trying to do things this way. > Eli ebrandt(a)jarthur.claremont.edu -J.

2 1

An Appeal to Calm
by tcmay＠netcom.com 13 Mar '93

13 Mar '93

Folks, Tempers have flared. Angry words have been sent out to the list. We've all been mail-bombed by an angry member of the list (who wants off--NOW!). I guess this is our first real flame war--now we're a real mailing list! But let's not let the current controversy confuse our very real mission, nor hide the progress we've seen so far (remailers, spread of PGP, experiments with digital cash, etc.). If we let the list self-destruct through a few unfortunate incidents, all hope is lost. * The "unsubscribe" problem will hopefully soon be fixed. Maybe an automatic handler (like "majordomo," someone suggested) can be installed. * Mailing lists like this one characteristically have wildy fluctuating traffic levels. No messages for a couple of days (leading to "Is the list broken?" queries) and then 50 messages in a single day (leading to "Enough already! I can't take the volume." messages). Remember, it is the list membership that is generating the volume, not the list management (such as it is). * Some have said the "cypherpricks" list is generating all noise and no signal. Many of us would disagree. Actual code is being written, deployed, and experimented with. One bunch is helping with PGP, another is writing and deploying remailer programs, another is pursuing steganography (hiding messages). Pretty impressive. Especially for a new mailing list. * And relatively little flaming is going on. The closest we've come to a real act of malice was the mail bombing of the list by a disgruntled member--I won't go into that further. * There are serious issues involving the uses and abuses of these various tools and capabilities. Anonymous postings carry obvious concerns. So does untraceable electronic mail, with the potential for extortion threats and even fully-secure markets for assassinations and other crimes. Some of these issues have been discussed on the list. No doubt some see these debates as "noise." Well, a mailing list cannot of course only cater to one particular set of needs. * If we don't discuss these kinds of issues on this list, who will? The FBI and NSA undoubtedly. So why not we the people? I hope things can calm down a bit. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

3 2

Re: Cypherpunks know they're cool
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 13 Mar '93

13 Mar '93

Ted Ts'o writes, > What I don't understand is, why are people complaining? We're just > seeing people exercise their sacred right to free speech..... all over > this mailing list. After all, isn't this what you were working towards? Heh. I agree with Ted. Try taking the same advice we'd give someone who received a offensive anonymous note: quit your bitching & moaning, you losers! Yeah, yeah, I know, volume attacks are of a different kind than offensive content. But my own belief is, if our software is broken, we shouldn't blame the doofus who comes along and tickles it. If we end up having a problem of volume harrassment, we should expect to have to PROTECT OURSELVES with some half decent mailing list software. For instance, something that accepts mail only from subscribers or that shunts large messages (or excessive number of messages from a single person) to the moderator for review. The fact that we have stupid software is our own fault. To me, this has the same feel to it as the current flap about anonymous newsgroup postings. The right answer, in my opinion, is to use news distribution software which can filter out anonymous postings (and, in order to enable that, and prior to the availability of "real person" cryptographic certificates, to ask that all remailers provide a special header line). What these solutions have in common is that we ask people to protect themselves, rather than requiring everyone else to adhere to their notions of good behavior. Which brings to mind the potential problem that 99% of everybody may choose to participate exclusively in "real person only" groups. Any hints at a solution to that one? How about if we try to convince people to participate in "pay as you go" groups using digital postage? That would solve many of the problems, in a way that is less offensive to the freedom-loving among us. -- Marc Ringuette (mnr(a)cs.cmu.edu)

2 1

Re: UNSUBSCRIBE ME!!!!!
by pmetzger＠snark.shearson.com 12 Mar '93

12 Mar '93

> From: mbrennan(a)netcom.com (Michael Brennan) > > > > > >DAMN!!!!! UNSUBSCRIBE ME ALREADY!!!!! > > >GHABRECH(a)ULTRIX.RAMAPO.EDU > > >ghabrech(a)ultrix.ramapo.edu > > > > You know, if you went down to the local expressway and lay down along one > > of the broken white lines and worked on perfecting your impression of a > > median strip, your problems would soon stop bothering you. > > > > -- > > Lefty (lefty(a)apple.com) > > Please explain to me, lefty, why you insist on flaming someone who simply > wants to unsubscribe from the list. Because, you pathetic asshole, he didn't just want to subscribe to the list; he sent out a goddamn 80k garbage message to everyone. That you cannot see the difference between these two demonstrates a substantial deficit in your capacity for mentation. Perry

1 0

Re: CYPHERPUNKS=EMAIL HARASSEMENT?
by pmetzger＠snark.shearson.com 12 Mar '93

12 Mar '93

> From: mbrennan(a)netcom.com (Michael Brennan) > > You are very wrong! As a matter of fact, I have sent unsubscribe requests > to cypherpunks-request and those requests have been ignored! That's why I > sent this last message of mine to the whole list. I'd be willing to bet > that the individual who sent the 3K file had also attempted initially to > send his request to cypherpunks-request and had his request ignored. In > fact, it's quite possible that MANY of the people who have sent their > "unsubscribe" requests to the whole list have done so because initial > requests sent to cypherpunks-request were ignored! > > Brushing this matter aside as a non-issue and pretending there is no > problem will not make the problem go away! UNSUBSCRIBE REQUESTS SENT TO > CYPHERPUNKS-REQUEST ARE BEING IGNORED!!! You are a whining child, Mr. Brennan. How long have these messages been ignored? Months? Years? I suspect a matter of days. Well, I'm sorry to tell you this, but you aren't paying anyone to maintain this list, and people don't do it full time. Its not a job. Prehaps the moderator went on vacation. Prehaps he has no time for a week. Have you actually waited a reasonable amount of time, which I would define as no less than a week and likely no less than two? I've run mailing lists. Its lots of long and hard work, and sometimes you go on vacation, and when you do lots of whining fools start getting pissed off that you aren't a robot that provides them with instant gratification. Sorry, but no one owes you instant service. You didn't pay for a subscription you know. This is a volunteer effort, and that means that you accept whenever you sign on to any mailing list the possibility that, horror of horrors, people might not process your requests every fifteen minutes. It would not be anything like a big deal to delete the mail for a few more days. Instead, you involve all of us in something that we cannot change. What makes you think that if the moderator is not reading the -request alias that he will read the list itself? In conclusion, get a grip. When the guy behind the counter at the 7-11 is a little slow, do you just take the food you bought without paying? No? Then what in hell are you doing posting obnoxious mail to hundreds of people when you know very well it violates all network custom? Perry Metzger

1 0