Has this photo been de-stegoed?

[Bill Stewart]

At 07:12 PM 12/10/2003 -0500, Tyler Durden wrote:
>If you spatially fft a random photo, you'll find that the image detail 
>energy largely occupies certain bands. These are not the bands that stego 
>uses (or so I assume...it really can't be otherwise). The stego-able 
>spectrum will indeed be noise, but this noise will have a certain spectrum.
>
>Stego, done well, will I assume try to mimic this noise, but there may be 
>problems. If the message is encrypted, then merely loading that message 
>into the photo will, I assume, NOT result in a noise spectrum that looks 
>like real noise. So you'll need some kind of chopper or spectrum-spreader 
>I guess.

If you're asking whether something has added stego rather than
original picture noise, and how to detect it, that's one thing.

But if you're asking whether something used to have added stego,
and that stego has now been removed, and how to detect _that_
that's a much harder question.
- There was an original.
- Then there was an original with stegobits added.
- Then there was an original with something different done to the previous 
stego image.

The MITM isn't going to be able to restore the original bits,
but they could replace the stego bits with various kinds of noise,
or with different stego bits using the same stego system,
or using a different stego system, but how can you tell?
If they've replaced the message with a different message
using the same stego system, and the system gives you a method for
determining who a message is from and who it's to,
then maybe you can tell whether the new message is for you or not
and whether it's from whoever you expected it to be from or not, if you knew.

If they've used a different stego system, or if you're using a
stego system that's very good, you're back to the question of
determining whether the message you received was a message
that has somebody else's stego in it.