Encrypting the burden

In reality the techniques used by Steganos are closer to obfuscation than encryption but I will stick with encryption for this discussion.

The problem with the embedding algorithm used is that it is a commonly used technique in steganography, so it might just be possible for a third party to extract the image or text. To overcome this the library can encrpt the image or text before embedding it in the carrier image.

To encrpt the burden the user must supply a pass phrase or password. The embedded burden can only be retrieved if the correct pass phrase is supplied by the user when extracting the burden.

The data is encrypted in three passes for image burdens and two for text burdens. Decryption simply involves reversing the order the passes are performed.

The Merge Channels pass (image only)

In this pass the bits from each of the channels ARGB are interwoven so that we start with

and after merging we get

If the burden inage does not use transparency then the alpha channel is ignored so only the RGB channels are merged to give

The Bit Rotation pass (image and text)

After merging the next phase is to rotate the bits. For an ARGB image all 32 bits are rotated but if the image does not use transparency then only the RGB merged bits are rotated, bits 0-7 are unchanged.

If embedding all 8 bits per channel (bpc) of the burden image would require more than 4 bpc of the carrier image then one or more of the LSBs of the burden image will be omitted.

This shows the bit arrangement after mergibg an RGB image using just 6 bpc.

If this is rotated 4 bits then we get.

For text burdens the string is first converted to UTF-8 and then the data packed into an array of 32 bit integers. The rotation is applied to all 32 bits because the library does not allow for burden bits to be ignored for text burdens.

The SHA-256 encryption algorithm is used on the pass phrase to generate a 32 element integer array. The element values determine the number of bits to rotate each pixel / integer in the burden data and the array elements library cycles over the array.

The XOR pass (image and text)

The final pass uses the exclusive-or (XOR) operator to futher encrypt the burden data. In this pass the SHA-1 encryption algorithm to generate a 17 element integer array. Successive pixels / integers in the burden data are exclusively-ored with an element from the array. Again the library cycles over the array.