At 07:12 PM 12/10/2003 -0500, Tyler Durden wrote:
If you spatially fft a random photo, you'll find that the image detail energy largely occupies certain bands. These are not the bands that stego uses (or so I assume...it really can't be otherwise). The stego-able spectrum will indeed be noise, but this noise will have a certain spectrum.
Stego, done well, will I assume try to mimic this noise, but there may be problems. If the message is encrypted, then merely loading that message into the photo will, I assume, NOT result in a noise spectrum that looks like real noise. So you'll need some kind of chopper or spectrum-spreader I guess.
If you're asking whether something has added stego rather than original picture noise, and how to detect it, that's one thing. But if you're asking whether something used to have added stego, and that stego has now been removed, and how to detect _that_ that's a much harder question. - There was an original. - Then there was an original with stegobits added. - Then there was an original with something different done to the previous stego image. The MITM isn't going to be able to restore the original bits, but they could replace the stego bits with various kinds of noise, or with different stego bits using the same stego system, or using a different stego system, but how can you tell? If they've replaced the message with a different message using the same stego system, and the system gives you a method for determining who a message is from and who it's to, then maybe you can tell whether the new message is for you or not and whether it's from whoever you expected it to be from or not, if you knew. If they've used a different stego system, or if you're using a stego system that's very good, you're back to the question of determining whether the message you received was a message that has somebody else's stego in it.