Re: Schneier on Stego, Dead Drops, bin Laden
Bruce writes about uses of steganography as digital dead drops. But he also claims that there are no business uses for steganography. I don't think this claim is valid. There are business scenarios where traffic analysis can leak information about potential mergers, investment analysis activity and so on. Steganography is just a valid mechanism to hide traffic as cover traffic. Stego in fact offers marginally higher security against traffic analysis because it will not be evident that the two parties exchanged information, nor even had the opportunity to. The opportunity to have communicated would be evident if they were using just cover traffic. Apart from business uses there are uses for civil rights workers, and generally members of the public who choose to retain association privacy. I don't think we should be giving the press and government ammunition in their arguments to ban various forms of crypto, especially for forms of communication which may help civil rights workers, and which infringe on the tools available to the individual to partially regain his privacy be that confidentiality or of association. Adam On Tue, Sep 25, 2001 at 09:42:53AM -0700, Subcommander Bob wrote:
Monday September 24 01:15 PM EDT
Terrorists and steganography By Bruce Schneier, Special to ZDNet
Why can't businesses use this? The primary reason is that legitimate businesses don't need dead drops. I remember one company talk about a corporation embedding a steganographic message to its salespeople in a photo on the corporate Web page. Why not just send an encrypted e-mail? Because someone might notice the e-mail and know that the salespeople all got an encrypted message. So send a message every day: a real message when you need to, and a dummy message otherwise. This is a traffic analysis problem, and there are other techniques to solve it. Steganography just doesn't apply here.
Schneier has never really cared much for steganography and he seems to take every opportunity to belittle it. In _Secrets and Lies_, he argues that he's never received images in email and so steganography will fail for lack of a channel. In any case, there are plenty of business uses of whatever might be called steganography. The term itself is difficult to pin down because it could include many things that people do without realizing that they're engaged in steganography. Microsoft Office tags documents with the serial number of the document creator. The creator and everyone else who sees the document will never see this number, but it's there. I think the serial number is there to help them track down piracy and copyright infringement. The content creation companies from the music and movie business are also big believers in steganography. They hope the tool will allow them to mix in copyright messages into digital copies. The U.S. government has long explored ways to tag documents, presumably to help track classified information that might fall into the hands of terrorists. U.S. government agents in pursuit of terrorists must often use steganography to communicate with other agents. Hiding the message stream may be the only way they can maintain their cover. Lately the press has been focusing on the unproven possibility that the terrorists may use steganography to communicate. The complete story should include how the technology is used against terrorism and digital piracy.
participants (2)
-
Adam Back -
Peter Wayner