What is Steganography?

While we are discussing it in terms of computer security, steganography is really nothing new, as it has been around since the times of ancient Rome and Greece. Steganography is taken from Greek words – στεγανός, ‘steganos’ (means covered or protected) and, γράφειν, ‘graphie’ (means to write). Steganography is the art and science of writing hidden messages in such a way that no one apart of the intended recipient knows of the existence of the message. The hidden message can be plain or can be encrypted using any cryptographic techniques to make it double secure. Steganography makes the cipher text invisible to the unauthorized users by the means of cover. Cover for hiding important data can be of the different file formats of the types – text, image, audio or even video files.

The following formula provides a very generic description of the pieces of the steganographic process:

cover_medium + hidden_data + stego_key = stego_medium

In this context, the cover_medium is the file in which we will hide the hidden_data, which may also be encrypted using the stego_key. The resultant file is the stego_medium (which will, of course. be the same type of file as the cover_medium). The cover_medium (and, thus, the stego_medium) are typically text, image, audio or even video files. 

One can ask, what is it good for? Well, imagine the common situation when you encrypt your important business data. Suddenly robbers capture and torture you into revealing cryptographic keys. As well police power may be abused. They ask you to give them the private keys or you are highly suspicious of committing crime. Next, what if the police are bribed? Would not it be better, if you can plausibly deny the existence of important data? The events of September 11, 2001 catapulted awareness of terrorism to the forefront of every mind in every civilized culture in the world. They have also raised interest in the ways that terrorists may have communicated and planed these events. In a USA Today article (2004), it was suggested that terror groups may be using the Internet to pass information using techniques including e-mail, chat rooms, bulletin boards and other web sites. There is also much speculation that these groups may be using technologies like encryption and steganography to help hide their communications.