In this post, I'll first take issue with Xenon's proposal (though he is of course welcome to pursue what he wishes, natch). And I'll also briefly mention the Cypherpunks FAQ, which I agreed to do at the December meeting--and which is urgently needed, I think. Xenon/Qwerty/Nik(?) writes:

I'm trying to get someone to create alt.steganography, 'cause I'm getting quite a few sci.crypt types asking me, yeah ME, that's who they're asking damn it, in great detail about the qualities of random noise created by various sources such as a microphone or AM radio or a scanner. And about adjusting

...lots of stuff elided.... Cool your jets, Xenon! :-} Things go up and down in popularity. Besides, stegonpgraphy is a branch of cryptology, so sci.crypt is a perfectly fine place to discuss it. Why create a new group that many cryptologists would then be unaware of, when such a good group already exists? And the issue you mention above, the quality of random noise sources, is also an oft-discussed issues here on Cypherpunks and in sci.crypt...it hardly belongs in "alt.stegonagraphy"! In fact, all of these issues *are* what crypto is all about: randomness, padding, traffic analysys, shielding, encryption, number theory, protocols, and on and on. None of these topics needs its very own discussion group. (And why not, by the same logic, also create alt.random.numbers, alt.dining.cryptographers, alt.remailers, alt.digital.money, alt.voice.pgp, and so on? All of these are of about the same importance as stegonography. Probably more so, as stegonagraphy is inherently limited by it being "security through obscurity," which typically doesn't last very long. Like invisible inks and microdots--the two compelling examples of past stegonagraphy--once the secret gets out, the technique rapidly fades in significance.) Stegonography has been with us for a long time, we've debated it many times (cf. my post in 1988 in sci.crypt on the LSB method, reprinted a couple of times), and at least _two_ major stego programs are widely available: - JSTEG, for UNIX, in the cypherpunks archives - Stego, for Macintosh, at various sites, including sumex.stanford.edu Stego, written by Romana Machado several months back, puts arbitrary files (up to some max length) into Mac PICT files. Maybe GIFs, too, though I haven't checked recently. She demoed this at a Cypherpunks meeting in October or thereabouts. (Someone correct me if I'm wrong, but stripping the PGP header and footer blocks off to leave on the "random"-looking stuff should be a fairly trivial exercise, If you know "where" the PGP bits are, isolating them and then adding back the headers and footers should be equally trivial. Stealth PGP may indeed be useful, but many new problems are added. A stealth mode, which strips off the wrapper would be feasible today, but then one would need "out of band" ways of letting the recipient know which bits to decrypt.)

There's quite a few serious programmer types who want to create steganographic software. I've gotten quite a response to my "announcing" Stealth-PGP on Usenet. The person who gets credit for coming up with the name "Stealth" instead of my boring "VGP" says he has changed plans and hopes to offer an external utility to strip and later restore any PGP message. For the newbies, this isn't just removing the "-----BEGIN..." header and footer!

Maybe I'm revealing myself as one of the "newbies," but what do you mean here? Headers and footers all look the same, meaning they are apparently uncorrelated to the contents (carry no information). I agree that not having them introduces other problems (knowing which bits to treat as the PGP message, as above). I'm not sure who your source was, but be advised that the term "Stealth PGP" was in use at least a year ago....I heard Kelly Goen or Phil Zimmermann refer to a future version of PGP with this name. Not that it really matters a lot, but you ought to be aware that the designers of PGP were aware of the issues you have raised recently. Only so much time to get everything done, though.

How 'bout it? At least tell me what the "proper" name should be for the group. sci.steganography will take to long to get approved. alt.steganography is OK, but isn't alt.security.steganography more correct?

I say discuss stego in _this_ group, Cypherpunks, or in sci.crypt or one of the *.security groups (or multiple groups). Too often there's a rush to spawn new groups and lists when the traffic would be welcome on existing groups. The the ne groups die of posting starvation. For example, there was a rush to create a "hardware cypherpunks" mailing list and a "DC-Nets" mailing list...I haven't heard anything from either of these groups recently. Stegonagraphy has its charms, but I doubt that the issues need or justify a separate group. Ditto for the proposal someone had for a group devoted to discussion of hardware random number generators. (Hardware random number generators, TEMPEST shielding, and hiding bits are some of the sub-branches of crypto that seem to be on a 3-month cycle of repetitions.) We really do need a FAQ! (Yes, I'm still working on it. Expect to see something in a month or six weeks. I'll try to have a Rev. 0.8 done by then.) I hate to give the impression of snottiness. And I don't want to sound jaded in the face of Xenon's obvious anxiousness to get rolling. It's just that Romana M., for example, put a _huge_ amount of effort into her Stego program...and it was not met with cymbal crashes of enthusiasm, either by folks on this list or outside. I suspect this is because, when you get down to brass tacks, stegonography is just a backwater of crypto (to mix some methaphors horribly). Once you've played around with it, what do you actually _use_ it for? (I can imagine some real uses, but they're contrived exercise, not reflecting any real need. At least not now.) Exhorting others to write more programs--or to create alt.stegonagraphy--isn't always the most helpful style. Detweiler used to exhort folks to "do more" and, ironically, begged and screamed for "someone, anyone" to create alt.whistleblowers. Someone did (Miron Cuperman, I recall), and now the group is essentially barren. It's not a bad idea to have a whistleblowers group, but its creation was perhaps a bit premature (not Cuperman's fault, as he just created the group to satisfy Detweiler and to shut him up, I suspect). I fear alt.stegonagraphy would similarly wither, once the initial enthusiasm wore off. I happen to agree that transmitting bits in the LSBs of sound and image files gives "plausible deniability" to users of crypto. Work should continute on this. I just don't see much urgency for getting the capability widespread _right now_, especially not when the practical difficulties of using PGP (discussed many times) mean most of us are rarely using it at all! Plenty of higher priority projects, in my opinion. But since we're an anarchy of individualists, those who think stegonagraphy deployment is of high priority should go ahead and pursue it. My advice is to discuss it here, or on sci.crypt. If the volume is consistently high for at least several months, that's the time to think about creating a special group or list for it. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay@netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power:2**859433 | Public Key: PGP and MailSafe available.