STATE FLORIDA UNIVERSITY COLLEGE OF ARTS AND SCIENCES
INFORMATION HIDING
By TRI VAN LE
A Dissertation submitted to the Department of Computer Science in partial fulllment of the requirements for the degree of Doctor of Philosophy
Degree Awarded: Spring Semester, 2004.
Copyright c 2004 Tri Van Le All Rights Reserved
The members of the Committee approve the dissertation of Tri Van Le defended on April 5, 2004.
Yvo Desmedt Professor Directing Dissertation
Joe Mott Outside Committee Member
Mike Burmester Committee Member
Kyle Gallivan Committee Member
Michael Mascagni Committee Member
The Ofce of Graduate Studies has veried and approved the above named committee members.
ii
ACKNOWLEDGMENTS
I wish to thank my family for their encouragement, wonderful and loving support, especially my wife, Hoang Viet Ha, my daughter, Le Hoang Dieu Minh, and my parent Le Van Thanh and Le Thi Chuyen. I am thankful that I have a chance to work with outstanding researchers of the eld during my PhD program, including (but not limited to) Professors Mike Burmester, Yvo Desmedt, Kaoru Kurosawa and Alex Yasinsac as well as many other faculties in the beautiful landscape of Florida State University. I appreciate the time and support my PhD Program Committee and many other staffs at the University have reserved for me. Last but not least, this dissertation would have been impossible without nancial support of National Science Foundation via NSF grant CCR-9903216.
iii
TABLES OF CONTENTS
List of Figures List of Algorithms Abstract 1 INTRODUCTION Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . History of Modern Steganography . . . . . . . . . . . . . . . . . . . . The Prisoners Problem . . . . . . . . . . . . . . . . . . . . . . . . . . The Steganographic Game . . . . . . . . . . . . . . . . . . . . . . . . Two Approaches to Formal Security . . . . . . . . . . . . . . . . . . . Literature . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Probability Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . Complexity Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . Coding Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . The Steganographic Game Problem . . . . . . . . . . . . . . . . . . . . . . Dissertation Contribution . . . . . . . . . . . . . . . . . . . . . . . . . . . Dissertation Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 PERFECT STEGANOGRAPHY SOLUTIONS Denitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
vi vii viii 1 1 1 1 2 3 5 7 7 15 17 18 20 21 22 23 24
Secrecy versus Hiding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iv
Universal Bounds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Steganographic Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 INVISIBLE STEGANOGRAPHIC SOLUTIONS Binary Invisible Steganographic Schemes . . . . . . . . . . . . . . . . . . . Efcient Invisible Steganographic Scheme . . . . . . . . . . . . . . . . . . Generalized Invisible Steganographic Schemes . . . . . . . . . . . . . . . . 4 STEGANOGRAPHIC CODING SOLUTIONS Steganographic Codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Optimal Steganographic Codes . . . . . . . . . . . . . . . . . . . . . . . . Steganographic Schemes . . . . . . . . . . . . . . . . . . . . . . . . . . . . Steganographic Secret Sharing . . . . . . . . . . . . . . . . . . . . . . . . 5 COMPUTATIONAL COMPLEXITY SOLUTIONS From Unconditional to Conditional Security . . . . . . . . . . . . . . . . . Private Key Steganographic System . . . . . . . . . . . . . . . . . . . From Statistical to Computational Security . . . . . . . . . . . . . . . . . . Private Key Steganographic Systems . . . . . . . . . . . . . . . . . . Public Key Steganographic Systems . . . . . . . . . . . . . . . . . . . Necessary and Sufcient Condition . . . . . . . . . . . . . . . . . . . 6 COVERTEXT GENERATOR SOLUTIONS Denition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Optimality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . REFERENCES BIOGRAPHICAL SKETCH
29 32 40 40 47 49 52 52 53 56 57 59 59 59 61 61 62 64 66 66 67 68 71 75
v
LIST OF FIGURES
1.1 Non-steganographic communications between Alice and Bob. . . . . 1.2 Steganographic communication between Alice and Bob. . . . . . . . 1.3 Detection of steganographic communications by Wendy. . . . . . . . 1.4 Entropy function H(x). . . . . . . . . . . . . . . . . . . . . . . . . . . 1.5 Bounds on H(u) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2 3 9 14
vi
LIST OF ALGORITHMS
1 2 3 4 A general steganographic scheme that is perfect . . . . . . . . . . . . A general invisible steganographic scheme that is perfect . . . . . . . A steganographic encoding algorithm . . . . . . . . . . . . . . . . . 33 41 53 54
A steganographic decoding algorithm . . . . . . . . . . . . . . . . . .
vii
ABSTRACT
The Prisoners Problem can be stated as follows: Two prisoners, Alice and Bob, want to communicate a secret escape plan under the surveillance of a warden, Wendy. To be indiscernible, the communication must appear to Wendy to be innocent. If a traditional cryptographic mechanism (such as encryption) is used to protect their secret plan, Alice and Bob will be caught by Wendy because of the visible randomness of the ciphertexts. Therefore a new approach must be used in which information is hidden, not just encrypted. Information hiding, and more specically steganography deals with such problems. This dissertation investigates the Prisoners Problem in a game theoretic setting in which Alice plays against Wendy. The objective of Alice is to encode her secret messages so that they are indistinguishable from innocent messages. The goal of Wendy is to distinguish Alices messages with concealed information from innocent messages. We study this game theoretic problem in three security models: perfect, statistical and computational security. These models correspond to three adversarial models of Wendy, namely: unbounded; polynomial number of queries; polynomial time. We show that under very general conditions, efcient and secure steganography can be achieved. In each of the three models, we give necessary and sufcient conditions for the existence of secure steganography. Our proofs yield efcient and proven secure steganographic systems. In almost all of the cases, these constructions are also optimal. We then extend these models to introduce the novel concepts of invisible steganography and steganographic secret sharing.
viii
CHAPTER 1 INTRODUCTION
Overview
History of Modern Steganography
According to the Greek historian Herodotus [24, 28], who lived around 474 B.C., Histiaeus of Miletus shaved the head of a slave and tattooed a secret message on his scalp. When the slaves hair grew back, Histiaeus dispatched him to the Greeks, who shaved the slaves head and read the message. During WWII, invisible inks and micro dots were used to embed hidden messages in newspapers, books, etc. [28]. In these examples, using cryptographic operations, such as encryptions or digital signatures, would lead to immediate failure because of their visible randomness or information.
The Prisoners Problem
The Prisoners Problem, introduced rst in the context of subliminal channels (G.J. Simmons [45]), is often used to illustrates steganography (Anderson [4]). It can be stated as follows: Two prisoners, Alice and Bob, want to communicate to each other their secret escape plan under the surveillance of a warden, Wendy. In order to be undetected by Wendy, Alice and Bob must keep their communications as innocent
1
messages
GG
Alice
messages
GG
Bob
GG
messages
Figure 1.1: Non-steganographic communications between Alice and Bob. as possible. In practice, such model is applicable when Alice and Bob wish to communicate privately via a public channel. Another example is when Alice want to hide her digital watermarks or ngerprints from a traitor (Wendy) but not say from a judge (Bob).
The Steganographic Game
We consider steganography as a game theory problem where Alice and Bob play against Wendy. The objective of Alice is to encode her messages to Bob so that they appear innocent to Wendy, while the task of Wendy is to detect whether the communication channel between Alice and Bob has been modied to transmit hidden information. If we call C the original communication channel between Alice and Bob, and C the modied communication channel between Alice and Bob, then Alice and Bobs goal is to make C look identical to C whereas Wendys goal is to distinguish C from C. This is called the steganographic game. Figure 1.1 illustrates a non-steganographic communication between Alice and Bob. There is no hidden information in the messages. When the communication channel is used to cover (hide) steganographic communication, we have a steganographic channel. Setup
encoding key decodingkey
hiddentext
GG
Alice
messages
GG
))
Bob
GG
hiddentext
Figure 1.2: Steganographic communication between Alice and Bob. Figure 1.2 illustrates a steganographic communication between Alice and Bob. Alice hides her secret messages, called hiddentexts, inside other innocent looking 2
messages, called stegotexts. Bob obtains Alices message by extracting it from the stegotext. To ensure their privacy, Alice and Bob share a pair of secret keys, called the encoding and decoding key, shared in the setup stage. Messages that appear in normal non steganographic communications are also called covertexts. stegotext J
covertext
JJ JJ JJ JJ JJ 77 WW ss ss ss s ss ss
OR
text
GG
Wendy
guess
GG
{ 0?1 }
Figure 1.3: Detection of steganographic communications by Wendy. Figure 1.3 illustrates the detection procedure. Wendy detects steganographic communications by deciding whether a given text belongs to a steganographic or non-steganographic channel. Wendy wins if she can tell with a probability better than guessing which case it is, and she loses otherwise. We may allow Wendy to look at more than one texts, in order to improve her chance of success. However, such an extension will not make any difference in the security model if Wendy is limited to taking a polynomial number of samples [20].
Two Approaches to Formal Security
Depending on the computing power of Wendy, there are two security approaches: an information theoretic approach and a computational complexity approach. In the information theoretic security approach, Wendy has unbounded resources. She can calculate every functions at her desire. This is the strongest unconditional security model. In contrast, in the computational complexity approach, Wendy is usually restricted to probabilistic polynomial time. Security in this approach is based on the assumed intractability of certain hard computational problems, such as the RSA problem [42] or the Decision Dife-Hellman (DDH) problem [6]. However these 3
problems are tractable by quantum computing, if such a technology can be developed in the future [44]. In that case, the information theoretic approach is the only one that is provably secure. Nevertheless until then, the computational approach is preferred in practice because the secret keys are reusable. Steganographic Attacks. In the unconditional security setting, there is only one type of attack, namely the chosen hiddentext attack. In this attack, Wendy is allowed to force Alice to send hiddentexts of Wendys choice to Bob. For example, if Wendy is a Prime Minister, who suspects that some of her cabinet members are traitors, and may leak secret documents to news agencies, but isnt sure exactly who the traitors are [4], she may choose secret messages to inform her cabinet and trace the traitors. A traitor Alice who wants to send a secret message to her accomplice Bob will have to use these secret messages chosen by Wendy. In practice, the conditional security setting is much more convenient because the secret keys are reusable. However, reusable keys also open the door for a much more powerful type of attack, namely an (adaptive) chosen stegotext attack. In a non-adaptive chosen stegotext attack, Wendy is allowed to run an additional setup stage, prior to her real attack. In this stage, Wendy can extract hiddentexts from arbitrary stegotexts, but she does not have direct access to the secret key. Wendy can use information obtained in this stage (regarding the secret key) for later detection of steganographic communication (that use the same key). In an adaptive chosen stegotext attack, Wendy can extract hiddentexts from arbitrary stegotexts in both the setup and the attack stages. This means that Wendy can decrypt stegotexts that are related to the text she suspects, except that she cannot decrypt the exact suspected text in question. In practice, Alice will face these two attack modes when Wendy has access to the extraction hardware or capability, but Wendy does not know who uses it. It should be noted that these two types of active attack originate from the strongest chosen ciphertext [37, 39] and adaptive chosen ciphertext attacks [16] in cryptography.
4
Literature
Fingerprinting and Traitor-Tracing. Steganography is related to traitor-
tracing and digital ngerprinting. Traitor-tracing attempts to embed unique identication information into copies of an object in order to trace traitors who release illegal copies. However, most of the work in ngerprinting currently deals with cryptographic data only. Watermarking on the other hand, embeds the same copyright information into all objects so that they can be identied later [2, 5, 38]. Covert Channels. Covert channels have been studied since 1973 in computer
security [32], where one secretly abuses certain parts of a computer system so as to create an anonymous and secret communication channel. In the area of cryptography, covert channels embedded in cryptographic protocols are called subliminal channels [45], named by Gus Simmons who rst studied them in authentication protocols. He introduced the prisoners problem. One real life example of such a scenario involves the SALT 2 accord between the US and the Soviet Union [46]. Desmedt generalized the concept of subliminal channels to the more general case of cryptographic protocols [13]. These channels allow an insider to send secret side information through cryptographic protocol messages. It is important to prevent such abuses since they allow insider leakage and electronic espionage through cryptographic communication systems [13]. Kleptography. Young and Yung further applied this concept to cryptographic
hardware and software products [48, 49]. They demonstrated that viruses or malwares with cryptographic capabilities can use subliminal channels in a very damaging and undetectable ways to leak information and to destroy data integrity. This suggests that secure cryptosystems should not be built from externally built blackboxes with computer processing capabilities. Even though subliminal channels and kleptography are special cases of information hiding, their objectives are different. With subliminal channels one hides
5
information into cryptographic protocols, which often contain strings that are uniformly random, whereas uniform random messages are generally considered suspicious and unsuitable for use in modern information hiding. Nowadays secret information is hidden in more natural data such as audio, pictures, or video. This difference leads to entirely different methods used for information hiding. Anonymous Communications. In [9], Chaum introduced the concept of
unconditional anonymity, and illustrated this with the dining cryptographers problem. Unconditional anonymity has many applications in electronic voting and payment systems. In its basic form it involves an end-to-end communication network where no one knows who are the real senders and receivers of each message. Other variants of this concept are MIX networks [8, 1], where several layers of servers are used to hide the origin of each messages . Onion routing [40] is a special implementation of MIX networks. Steganography. The Prisoners Problem was considered in the unconditional
security setting by various people, including Cachin [7], Mittelholzer [35], Moulin [36], Zollner et.al. [50] and Ettinger [17]. The computational approach is also considered by [30, 26, 41, 12, 4, 27]. Katzenbeisser and Petitcolas [30], Hopper, Langford and von Ahn [26], Reyzin and Russell [41] formulated the problem using symmetric keys; while Craver [12], Anderson[4], Katzenbeisser and Petitcolas [30] and Hopper and von Ahn [27] applied asymmetric keys. Current results in the literature have several drawbacks: Unsolved Problem: [50, 17, 30] formalized the Prisoners problem using various models, but gave no solutions to this problem. Unproven security: [4, 12] give heuristic solutions but offer no formal proof of security. Similarly, there are many other heuristic schemes proposed but these were broken shortly after their birth, see e.g. [2, 5, 38].
6
Low information rate: [7] has a rate of only one bit per cover, while [26, 27, 41] have even a lower rate of a fraction of bit per cover, regardless of how much entropy the underlying covertext channel carries. Inexible: [35, 36] consider the hiding problem with numerical data tables, however, with independent data items only.
Background
In this section, we review basic concepts and results from probability, computational complexity and coding theory that will be applied later in the dissertation. Readers familiar with these notions should skip this section.
Probability Theory
Probability Distribution. Let S be a set. Denote the power set of S by 2S .
A family of subsets A 2S is called a -eld if: (i) if A A then A = S A A; (ii) if A1 , A2 , . . . , are pairwise disjoint sets in A, that is, Ai Aj = for i = j, then Ai A; (iii) A. For example, 2S is itself a -eld. Each subset A A is i=1 called an event and {a} A is called an elementary event. A probability space is a tuple (S, A, P ) where S is a set, called sample space, A is a -eld, called the set of permissible events, and P : A R is a real function dened on A such that: (i) 0 P (A) 1 for all A A, called the probability
of event A; (ii) if A1 , A2 , . . . are pairwise disjoint subsets in A, then P (
i=1
Ai ) =
P (Ai); (iii) P (S) = 1. P is called a probability distribution.
i=1
Two events A, B A are called independent if P (A B) = P (A)P (B). The conditional probability of A given B is dened by P (A|B) = P (A B)/P (B) for P (B) = 0. When there is no ambiguity, we identify the event a S with {a} S.
7
A discrete probability space is one for which S is countable and the corresponding -eld is the power set of S. The Borel eld on R, denoted by B, is the smallest -eld on R that contains all open intervals (a, b) = {x : a < x < b}. See [31, 34, 22]. Random Variable A random variable X is a function X : S R for which
the preimage X 1 (B) A for all B B, where X 1 (B) = {a S | X(a) B}. The probability P (X 1 (B)) is called the probability of event X B and is denoted by Pr [X B]. The function PX : B R dened by PX (B) = Pr [X B] is called the probability distribution of X. The function FX : R R dened by FX (a) = Pr [X a] is called the cumulative distribution function of random variable X. Let X, Y be two random variables. The multivariate random variable (X, Y ) is dened by parallel application of the two functions X, Y . The expected value of a random variable X is dened by E[X] =
x
Pr [X = x]x.
The conditional expected value of random variable X given Y = y is dened by E[X|Y = y] =
x
Pr [X = x|Y = y]x. The conditional expectation of X given Y is
a function E[X|Y ] on variable Y such that: when Y = y, E[X|Y ] = E[X|Y = y]. We have double expectation rule E[E[X|Y ]] = E[X]. A Bernoulli random variable is a random variable which takes value 1 with probability p, and value 0 with probability q = 1 p. Let PS be a probability distribution over sample space S. We write X PS when X is a random variable over sample space S, whose value is chosen from S accordingly to PS . Denote the uniform probability distribution over S by US . See [31, 34, 22] for more details. Random Process. A random process [19] is a family of random variables
X = {Xt } . The distribution of random variable Xt may depend on the values of t=1 random variables Xi for i < t. Time series, random walks, Markov processes and other random elds are examples of random processes. If the underlying sample space is discrete then the process is called discrete.
8
Hx 0.35 0.3 0.25 0.2 0.15 0.1 0.05 0.2 0.4 0.6 0.8 1 x
Figure 1.4: Entropy function H(x).
Let X be a random process over sample space S. The marginal probability distribution of X is dened by the function PX : S R0 such that, s S n : PX (s) = Pr (X1 , . . . , X|s| ) = s . Entropy. For 0 x 1, dene the entropy function H(x) = x log(x),
where the base of the logarithm is 2 and the unit of entropy is a bit. H(x) is a nonnegative concave function which maximizes at x = 1 . Figure 1.4 is the graph of e H(x). The entropy of an event A is dened by H(A) = log P (A). The entropy of a discrete probability distribution P is dened by H(P ) =
aS
P (a)H(a). The min
entropy of P is dened by Hmin (P ) = min( log P (a)). Clearly,
aS
Hmin (P ) H(P ). Let X, Y, Z be discrete random variables. The entropy of X is dened by H(X) =
x
H(PX (x)) = H(PX ).
9
The joint entropy of X, Y is dened by H(X, Y ) =
x,y
H(PX,Y (x, y)).
The conditional entropy of X given Y is dened by H(X|Y ) =
x,y
Pr [Y = y]H(Pr [X = x|Y = y]) = H(X, Y ) H(Y ).
The entropy function of a discrete random process X is dened by: Ht (X) = H(X1 , . . . , Xt ), where (X1 , . . . , Xt ) is a multivariate random variable. See [11]. Type. Let = {c1 , . . . , c|| } be a nite set, and let x = (x1 , . . . , xn ) n be a
n|| ). n
sample. Dene nk to be the number of occurrences of ck in x. Then n1 + +n|| = n. The type of x is type(x) = ( n1 , . . . , n of c in x. See [11]. Dene the sample entropy of x by: Hsmp (x) =
k:nk
Let f (c, x) be the frequency of occurrences
nk nk log . n n >0
The nth sample entropy of a probability distribution P is
n n Hsmp (P )
=
x i=1
P (xi )Hsmp (x).
n By entropy law for large numbers (Theorem 3, page 12) we have Hsmp (P ) H(P )
in probability.
10
Statistical Difference. over S. Dene:
Let P and Q be two discrete probability distributions
diff(P, Q) =
aS
|P (a) Q(a)|,
to be the difference metric of probability distributions P , Q. Statistical Indistinguishability. A function : N R0 is called negligible
if for all polynomial p(n), (n) < p(n)1 for all large enough n. (n) is also called a sub inverse-polynomial function. For example, (n) = en is negligible. A family of probability distributions {Pn } over is called polynomial n=1 length if the length |x| of each element x support(Pn ) is at most polynomial in n. Two polynomial length families of discrete probability distributions P = {Pn } n=1 and Q = {Qn } are called statistically indistinguishable if diff(Pn , Qn ) is a negligin=1 ble function in n [21, 20]. A function f (n) : Z+ [0, 1] is called overwhelming if 1 f (n) is negligible. Two families of discrete random processes X = {Xn } and Y = {Yn } n=1 n=1 are called statistically indistinguishable if for all t > 0, the two families of probability distributions {P(Xn,1 ,Xn,2 ,...,Xn,t ) } and {P(Yn,1 ,Yn,2 ,...,Yn,t ) } are statistically n=1 n=1 indistinguishable. Theorem 1 (Fanos Inequality). Let X, Y be two random variables over domain D and let Pe = Pr [X = Y ]. Then H(Pe ) + Pe log(|D| 1) H(X|Y ). Proof. See [11]. Theorem 2 (Indistinguishability and Entropy). If {Pn } and {Qn } are statistically indistinguishable then f (n) = H(Pn ) H(Qn ) is a negligible function. Proof. Let Pn = (p1 , . . . , pN ), Qn = (q1 , . . . , qN ) and
n
= diff(Pn , Qn ). Let Dn be the
support of Pn and Qn . Dene two random variables X, Y with the following joint 11
probability distribution: min(pi , qi ), p min(p , q ), i i i Pr [X = i, Y = j] = q min(p , q ), i i i 0, if i = j if j = i + 1 if i = j + 1 if (i > j + 1) or (j > i + 1).
It is not hard to see that PX = Pn and PY = Qn and that Pr [X = Y ] = en . Apply Fanos inequality to X, Y we get: H( n ) + log(|Dn | 1) H(X|Y ) = H(X, Y ) H(Y ) H(X) H(Y ).
n
Reverse the roles of X, Y and apply Fanos inequality again to Y, X we get a double inequality: H( n ) + log(|Dn | 1) |H(X) H(Y )| = |H(Pn ) H(Qn )| (1.1)
n
Since P and Q are polynomial length families, there exist a polynomial p(n) such that Dn p(n) . This means that |Dn | < ||p(n)+1 . Substituting this into (1.1) to get: |H(Pn ) H(Qn )| < H( n ) +
n
log(||p(n)+1 1) <
n
n q(n)
+1
where q(n) = log ||(p(n) + 1) is a polynomial in n. Since is also negligible, which proves the theorem.
is negligible, en q(n) + 1
The Asymptotic Equipartition Property (AEP) states that the sample entropy of a probability distribution approaches its entropy in probability [11]. We prove a stronger theorem, which says that the rate of convergence is exponential. Theorem 3 (Entropy Law for Large Numbers). Let X1 , . . . , Xn be n independent, identically distributed random variables over nite sample space S and have probabiln n ity distribution P . Let Hsmp be the random variable dened by Hsmp = Hsmp (X1 , . . . , Xn ). n Then for all 0 < < 1, Pr Hsmp < H(P ) is a negligible function in n.
12
Proof. Without loss of generality, let us assume that P (s) > 0 for all s S. Let Ts be the number of occurrences of s in X1 , . . . , Xn . Fix an s S and let B1 , . . . , Bn be n Bernoulli random variables dened by: 1, Bi = 0, if xi = s, if xi = s.
Apply Lemma 2 (page 15) to the n random variables B1 , . . . , Bn , whose expected value is P (s), and let get: Pr
+ Ts P (s) P (s) ens + ens , n
= (1 )P (s), where > 0 to be determined. We
where + = D((1 + )P (s), P (s)) and = D((1 )P (s), P (s)). s s Apply Lemma 1 (page 14) to u = P (s) [, 1 ], v = and =
sS, P (s)>0 Ts n
[0, 1], (0, 1)
min
P (s) (0, 1), to get that there exists > 0 such that for all
u [, 1 ] and all v [0, 1]: H(v) < H(u) |v u| u. Thus: Pr H Ts n < H(P (s)) = Pr [H(v) < H(u)] Pr [|v u| u] Ts P (s) P (s) = Pr n ens + ens . This bound is true for all s S so we have: Pr
sS
+
H
Ts n
sS
H(P (s)) |S|(en + en ).
+
where + = min + and = min . Lowering > 0 until (1 )P (s) (0, 1) for s s
sS sS
all s S (lowering does not effect Lemma 1). So we have + > 0 and > 0. Ts + n By denition, we have H(P (s)) = H(P ), H = Hsmp , and |S|(en + n sS sS
n en ) is negligible. Therefore we get Pr Hsmp H(P ) is negligible.
13
H(x)
H(u) H(u2) H(u1) H(u)
0
u1
u
u2
1
x
Figure 1.5: Bounds on H(u)
Lemma 1. For all , (0, 1), there exists > 0 such that for all u [, 1 ] and all v [0, 1]: |u v| u H(v) H(u). Proof. Since H(u) is concave in the range 0 u 1 and H(0) = H(1) = 0, we get for all v [u1 , u] [0, 1], u1 = u: H(v) (1 )H(0) + H(u) = H(u); and for all v [u, u2 ] [0, 1], u2 = u + (1 u): H(v) H(u) + (1 )H(1) = H(u). (1.3) (1.2)
This is illustrated in Figure 1.5. Combining 1.2 and 1.3 we get H(v) H(u)
u u for all v [u1 , u2 ]. Since | u1u | and | u2u | are continuous over the compact range u1 u u2 u u 1 , we have a minimum = min | |, | | 0. Now = 0 u[,1] u u if and only if = 0, or = 1 or u = 1, which are all impossible for u [, 1 ].
14
Therefore we must have > 0. By denition, |u v| < u v [u1 , u2 ] H(v) H(u). Lemma 2 (Chernoffs bound [10, 25]). Let X1 , X2 , . . . , Xn be n independent, identically distributed Bernoulli random variables, with the same expected value p. Then, for any 0 < < 1: 1 n
n
Pr
Xi
i=1 n
enD( ,p)
if
p,
1 Pr n
Xi
i=1
enD( ,p)
if
p,
where D(x, y) = x log( x ) + (1 x) log( 1x ) is a convex nonnegative function over the y 1y domain 0 < x, y < 1. It equals zero only when x equals y.
Complexity Theory
Let by a nite alphabet and let {n , n , , , } be the set of all -sequences whose length is {exactly n, at most n, nite, innite, arbitrary}, respectively. Let x . Denote |x| the length of x. For y , denote x y the concatenation of x and y. We say x is a prex of y, and write x such that y = x z. For i Z+ , denote x[i] and y[i] the ith element of x and y, respectively. For a and x , denote y = x i a the sequence which is identical to x everywhere except at the ith position, where y[i] = a. Let be a special blank symbol. Let
y, if there exists a z
content(x) be the shortest sequence such that x = content(x) such a sequence, and content(x) = x otherwise. Probabilistic Turing Machines.
, if there is
A probabilistic Turing machine PTM is a
tuple (Q, , , , qstart , qhalt ) where: (i) Q is a nite set of states; (ii) and are nite, input and tape, alphabets such that , and ; (iii) :
15
Q {0, 1} Q {+1, 1}2 is a transition function; (iv) qstart , qhalt are start and halt states. [20, 47] A computation C(w, r) of PTM is a sequence {Ci }t such that: (i) w i=0 and r U{0,1} , called the input and random tape input of PTM, respectively; (ii) C0 = (w
, 1, 1, qstart), called the initial conguration; (iii) for all i 1: (a)
Ci = (Wi , hi , hi , qi ) (Z+ )2 Q, called the conguration of PTM at step i, where Wi is the content of the work tape, hi is the position of the work tapes read-write head, hi is the position of the random tapes read-only head, and qi is the state of PTM, (b) for (qi , wi , i , i ) = (qi1 , Wi1 [hi1 ], r[hi1 ]), we have Wi = Wi1 hi1 wi , hi = max{1, hi1 + i } and hi = max{1, hi1 + i }; (iv) qi = qhalt for all i < t; (v) if t < then qt = qhalt . The output of computation C(w, r) is content(Wt ). The time complexity of PTM is the function timePTM : Z+ Z+ dened by: timePTM (n) = max{|C(w, r)| : |w| n, r U{0,1} }. PTM is called a probabilistic polynomial time Turing machine if for some polynomial p(n), timePTM (n) p(n) for all large enough n. Oracle Turing Machine. let A : be any function. An oracle Turing
machine PTMA [47, 21, 20] is a probabilistic Turing machine PTM with an additional oracle work tape and two additional internal oracle query and oracle complete states called qquery and qcomplete . The oracle Turing machine PTMA works as follows. When the PTM is in the qquery state, in a single step, the PTM is transitioned to the qcomplete state, and its oracle work tape content x is replaced by A(x). Computational Indistinguishability. Let P = {P1 , P2 , . . . } and Q = {Q1 , Q2 , . . . }
be two families of probability distributions over some nite sample space S . P and Q are called computationally indistinguishable [21, 20] if for all probabilistic polynomial time Turing machine A with input alphabet , the difference function 16
dAQ (n) = diff(A(Pn ), A(Qn )) is negligible, where A(Pn ) (respectively, A(Qn )) is the P probability distribution of the output of A when its input is chosen randomly accordingly to Pn (respectively, Qn ). Theorem 4. If P and Q are statistically indistinguishable then they are computationally indistinguishable. Proof. Let Pn = A(Pn ) and Qn = A(Qn ). We have Pn (y) = and Qn (y) =
xS xS
Pn (x)Pr [A(x) = y]
Qn (x)Pr [A(x) = y], so:
dAQ (Pn , Qn ) = P
y xS
(Pn (x) Qn (x))Pr [A(x) = y] |Pn (x) Qn (x)| Pr [A(x) = y]
y xS
=
xS
|Pn (x) Qn (x)|
y
Pr [A(x) = y]
=
xS
|Pn (x) Qn (x)| ,
which is negligible. Also see [20].
Coding Theory
Let be a nite alphabet, and M be a nite set. A coding scheme of M over is a pair of two algorithms Encode : M and Decode : M. Scheme is called uniquely decodable if for all m1 = m2 M, we have Encode(m1 ) = Encode(m2 ). The rate of encoding of is dened as: rate() = 1 H(Encode(m)). log |M| mM
For more details, see [11].
17
The Steganographic Game Problem
In this dissertation, we model a communication channel as a random process [19]. Denition 1 (Communication channel). A communication channel C is a discrete random process {Ct } , where Ct is a random variable whose value is the message sent t=1 in channel at time t. The conditional probability distribution of Ct+1 given (C1 , . . . , Ct ) = h is denoted by PC , where h is the sequence of past messages. Furthermore, the set of all messages is denoted by C. Denition 2 (Steganographic System). A steganographic system is a tuple (K, M, C, Setup, Embed, Extract) consisting of the key space K, the hiddentext space M and the covertext space C, together with three probabilistic Turing machines, Setup : {1} K, Embed : K M C and Extract : K C M, such that: if k = Setup(1n ) then for all m M we have Pr [Extract(k, Embed(k, m)) = m] is overwhelming in n, where the probability is taken over the random tape content of Setup, Embed and Extract. Here n is the security parameter. Denition 3 (Chosen Hiddentext Attack). A CHA(n)-attack is a game between two players, Alice and Wendy, who play as follows: 1. Alice generates a secret key k = Setup(1n ). 2. Wendy chooses a hiddentext m M. 3. Alice chooses a secret bit b R {0, 1} and computes c C as follows: (a) If b = 0, then c is chosen randomly according to PC . (b) If b = 1, then c = Embed(k, m). Alice then returns c to Wendy. 4. Wendy makes her guess b of b. 18
Wendy wins the game if b = b and loses otherwise. The advantage of Wendy in a CHA(n, q)-attack is: advcha (n, q) = Pr [b = b] 1 , 2
where the probability is taken over the random tape content of Alice and Wendy. Denition 4 (Adaptive Chosen Stegotexts Attack). An ACS(n, q)-attack is a game between two players, Alice and Wendy, who play as follows: 1. Alice generates a secret key k = Setup(1n ). 2. Alice and Wendy repeat the following steps for i = 1, 2, . . . , q : (a) Wendy chooses a stegotext si C. (b) Alice returns mi = Extract(k, si) to Wendy. 3. Wendy chooses a hiddentext m M. 4. Alice chooses a secret bit b R {0, 1} and computes c C as follows: (a) If b = 0, then c is selected randomly according to PC . (b) If b = 1, then c = Embed(k, m). Alice then returns c to Wendy. 5. Alice and Wendy repeat the following step for j = q + 1, . . . , q: (a) Wendy chooses a stegotext sj C {c}. (b) Alice returns mj = Extract(k, sj ) to Wendy. 6. Wendy makes her guess b of b. Wendy wins the game if b = b and loses otherwise.
19
The advantage of Wendy in an ACS(n, q)-attack is: advacs (n, q) = Pr [b = b] 1 , 2
where the probability is taken over the random tape content of Alice and Wendy. Denition 5 (Unconditional Security). A steganographic system is called statistically secure (against chosen hiddentext attacks) if the advantage advcha (n, q) of Wendy is negligible in n for all Wendy and all polynomially bounded q. Denition 6 (Conditional Security). A steganographic system is called computationally secure (against adaptive chosen stegotext attacks) if the advantage advacs (n, q) of Wendy is negligible for all polynomially bounded q and for every probabilistic polynomial time Turing machine Wendy.
Dissertation Contribution
We show in this dissertation that secure steganography can be achieved in very general conditions. In particular, the minimal entropy in the perfect security model, and the normal entropy in the statistical security model are the necessary and sufcient condition for information theoretically secure steganography. On the other hand, we show that oneway function is necessary and sufcient for computationally secure steganography, modulo the entropy condition. Our resulting schemes are very efcient and in fact optimal for almost all of the cases. Along the way, we introduce two new concepts called invisible steganography and steganographic secret sharing. We provide six solutions to the steganographic game problem, namely: perfect, perfectly invisible, statistical, steganographic secret sharing and computationally secure solutions.
20
Dissertation Organization
The dissertation is organized as follows. Chapters 2, 3, 4 assume unconditional securities and present information theory based approaches. Chapter 5 assumes conditional security and describes an approach based on computational complexity. Finally, chapter 6 applies the previous chapters solutions to the case where a probability distribution is not available, and also to the case where successive covertexts are probabilistically dependent. In each chapter, rst a formal model of semantic security is given, then a lower bound for schemes achieving that security condition, and nally, constructions of scheme achieving these bounds are presented.
21
CHAPTER 2 PERFECT STEGANOGRAPHY SOLUTIONS
In this chapter we study perfect steganographic schemes in which the stegotext distribution is identical to the covertext distribution and the error decoding probability is zero. We show in this chapter for the rst time that one can do covert communication perfectly with unconditional hiding and unconditional secrecy for all allowable general covertext distributions. We will obtain a result similar to Shannons source coding theorem: the min entropy is the upper bound under which perfect steganography is achievable. We additionally show that perfect hiding implies perfect secrecy. Therefore steganographic schemes can be regarded as special types of general encryption schemes. An issue overlooked in the current research on steganography is that the secret key is often stored on insecure devices such as computers. So, although steganography may make the computer less suspect to computer viruses and worms that are searching for secret keys, the fact that the key is not steganographic makes it easily available to such computer viruses and worms [3]. We extend the concept of steganography to introduce a new concept called steganographic secret sharing, or invisible steganography, in which both the key and the stegotext are hidden. So a computer could just have a set of family pictures, some corresponding to keys, some to ciphertext. We show that such an extension exists, and then show how to construct such a scheme with a good information rate. We show that obtaining the maximum information rate in this extension is NP hard. Finally we show 22
that the more general case when the keys correspond to a given key distribution, independently of the covertext distribution, is also NP hard.
Denitions
In this chapter, we denote random variables by letters in bold face (i.e. k, m, c, . . . ); their sample spaces by the same letter in caligraphic font (i.e. K, M, C, . . . ); and their particular values by the same letter in italic font (i.e. k, m, c, . . . ). The letters k, m, c are reserved for the key, message, and ciphertext, respectively. The meaning of other symbols is summarized in the following: Px is the column vector whose entries are the probabilities Px (a); AT is the transpose of matrix A; A(i, j) is the entry at the i-th row and the j-th column of matrix A; V|k is the k-th entry of vector V; ei is the i-th standard basis vector (ei |i = 1, and ei |j = 0 for j = i); 1n is the column vector of n ones; n-set is a nite set of n elements. Note that the terms stegotext and ciphertext are synonyms. The minimum entropy of a distribution is the corresponding entropy of a symbol of the minimum entropy in this distribution. We shall use letter E for the embedding algorithm and letter D for the extraction algorithm. A perfect information hiding scheme is a steganographic scheme which satises the two conditions, called soundness and perfect hiding, dened below. Denition 7 (Perfect Steganography). We say that an information hiding scheme achieves: Perfect decryptability : If for all k K and m M: D(k, E(k, m)) = m. Perfect hiding: If for each message m M, E(k, m) distributes exactly like the given distribution PC , where k is taken randomly from K according to PK . That is, for all c C: Pr(E(k, m) = c) = PC (c). 23 (2.1)
Perfect secrecy: If m is probabilistically independent of E(k, m). That is: Pr(m | E(k, m)) = Pr(m). (2.2)
An information hiding scheme achieves perfect security if it achieves both perfect secrecy and perfect hiding.
Secrecy versus Hiding
Let A be a perfect information hiding scheme. In this section, we will answer the question concerning hiding versus secrecy of A by studying its characteristic matrices. The characteristic matrices completely determine the properties of A. In later sections, they will also allow us to nd the necessary and sufcient condition for the existence of a perfect information hiding scheme. The characteristic matrices allow us to dramatically simplify our proofs. Denition 8 (Characteristic matrices). We dene the set of characteristic matrices {Am } = {Am | m M} as the probability matrices of k and E(k, m) conditional on m: Am = Am (k, c) = Pr(k = k, E(k, m) = c | m = m) . (2.3)
kK,cC
We now express the perfect decryptability , perfect secrecy, and perfect hiding properties of A in terms of the set of characteristic matrices {Am }. We will show in the next two theorems that perfect information hiding schemes are those that satisfy conditions (2.4, 2.5, 2.10) simultaneously. Theorem 5 (Matrix equivalence for perfect decryptability ). Let [Am ] = {(k, c) | Am (k, c) = 0} be the set of indices of non-zero entries of Am . We have: A. If the tuple (K, C, M, PK , PC , E, D), as described in Denition 7, is an informa24
tion hiding scheme then: m1 , m2 M : m1 = m2 [Am1 ] [Am2 ] = . m M : Am 1|C| = PK . (2.4) (2.5)
B. If conditions (2.4) and (2.5) are satised for a tuple (K, C, M, PK ) and an |M|set of |K||C| matrices Am over the non-negative reals, then the following scheme is a perfect information hiding scheme: Algorithm E: input message m M and key k K. Randomly output c PC , where PC (c) = PK (k)1 Am (k, c). Algorithm D: input ciphertext c C and key k K. Output the unique m such that Am (k, c) = 0. Proof. We prove each part of the theorem separately. A. Let A = (K, C, M, PK , PC , E, D) be an information hiding scheme. From Denition 7, by perfect decryptability , we have that k and E(k, m) uniquely determine m, hence for all keys k: m1 = m2 E(k, m1 ) = E(k, m2 ). On the other hand, from the denition of [Am ] we have: (Pr(k = k, E(k, m) = c | m = m ) = 0) 1 [Am1 ] [Am2 ] = k, c : (Pr(k = k, E(k, m) = c | m = m ) = 0)
2
(2.6)
k, c : c = E(k, m1 ) = E(k, m2 ) k : E(k, m1 ) = E(k, m2 ).
(2.7)
Combine (2.6) and (2.7), by the contrapositive rule to get: m1 = m2 [Am1 ] [Am2 ] = . 25
Hence (2.4) is true. We now show that (2.5) is also true. From (2.3) and the fact that k and m are independent we have: Am (k, c) = Pr(k = k, E(k, m) = c | m = m) = Pr(E(k, m) = c | k = k, m = m) Pr(k = k | m = m) = Pr(E(k, m) = c | k = k, m = m) Pr(k = k). By substituting (2.8) into the left hand side of (2.5) we have: Am 1|C| |k =
cC
(2.8)
Am (k, c) =
cC
Pr(E(k, m) = c | k = k, m = m)Pr(k = k)
= Pr(k = k)
cC
Pr(E(k, m) = c | k = k, m = m) = Pr(k = k) 1
= PK (k). Therefore Am 1|C| = PK . B. Assume that (2.4) and (2.5) are true, and that the tuple (K, C, M, PK , {Am}) satises the conditions stated in the second part of the theorem. First, (2.5) implies that Am (k, c) = 1.
kK cC
(2.9)
Let Am (k, c) correspond to a probability, i.e. Am (k, c) = Pr(k = k, a = c | m = m), where the meaning of a will be explained later. Due to (2.9), this probability is properly dened. We now prove that the probability distribution PK is independent of PM , i.e.,
26
(2.2) is true. From (2.5) we have: Pr(k = k | m = m) =
cC
Pr(k = k, a = c | m = m) Am (k, c) = Am 1|C| |k = Pr(k = k).
cC
=
Hence k is independent of m. Therefore (2.2) is true. We nally prove that (K, M, C, PK , PC , E, D) is an information hiding scheme. If PK (k) = 0 then a complete row of Am is zero, due to (2.5). We prove that a corresponds to E(k, m). Indeed, using elementary probability theory and the fact that k is independent of m, we have Pr(E (k, m) = c0 | k = k, m = m) = Pr(E (k, m) = c0 , k = k | m = m)/Pr(k = k). By the denition of a and E we have that a corresponds to E(k, m). We now use this to prove the perfect decryptability property. Denoting there exists at most one by 1 , we see that (2.4) implies k, c, 1 m : k, c, 1 m : Am (k, c) = 0 E(k, m) = c.
This says that for any given k K, c C, algorithm D can determine at most one m M such that E(k, m) = c. Moreover, from (2.5) we know that for a given m and a given k with PK (k) = 0, there exists at least one c such that Am (k, c) = 0. Combining this with the denition of E we have that if E outputs a c, then Am (k, c) = 0. So for all k K and m M: D(k, E(k, m)) = m. Therefore the scheme is sound. Consequently, A = (K, C, M, PK , PC , E, D) is an information hiding scheme.
When the conditions of the second part of Theorem 5 are satised, we say that the (K, C, M, PK , {Am}) induces algorithms E and D. From now on, whenever we say we construct a scheme, we actually give the matrices {Am } in explicit form.
27
Theorem 6 (Matrix equivalence for perfect security). A given information hiding scheme A achieves perfect secrecy and perfect information hiding if and only if for all m M: AT 1|K| = PC . m Proof. We prove each direction in turn. {} Assume that scheme A achieves perfect security. From (2.2), (2.1) and the denition of Am we have: AT 1|K| |c = m
kK
(2.10)
Am (k, c) =
kK
Pr(k = k, E(k, m) = c | m = m)
= Pr(E(k, m) = c | m = m) = Pr(E(k, m) = c) = PC (c). Therefore (2.10) is true. {} Assume that (2.10) is true. Using the denition of Am (see 2.3 and 2.10), we have: Pr(E(k, m) = c | m = m) = = By (2.11) we now have: Pr(E(k, m) = c) =
m
Pr(k = k, E(k, m) = c | m = m)
kK AT m
1|K| |c = PC (c).
(2.11)
Pr(E(k, m) = c | m = m)Pr(m = m) PC (c)Pr(m = m) = PC (c).
m
=
(2.12)
Combining (2.11) and (2.12) we have that E(k, m) is independent of m, so we have perfect secrecy. Moreover, from (2.12) we see that (2.1) is also true, so we have perfect hiding.
28
We next demonstrate our rst application of the characteristic matrices. We show that the hiding property does imply the secrecy. Corollary 1 (Hiding Implies Secrecy). Let A be an information hiding scheme with perfect hiding, independently of the message distribution. Then A is an information hiding scheme with perfect secrecy, independently of the message distribution. Proof. Assume that scheme A achieves perfect hiding. From (2.1) we have: PC (c) = Pr(E(k, m) = c) =
m
Pr(E(k, m) = c | m = m)Pr(m = m)
=
m k
Pr(k = k, E(k, m) = c | m = m)Pr(m = m) Am (k, c)Pr(m = m) =
m k m
=
Pr(m = m) AT 1|K| |c . m
(2.13)
Using the vector distribution PM = (PM (m1 ), . . . , PM (m|M| )) with PM (m) = 1 and PM (m ) = 0 for all m = m in (2.13), we get PC (c) = AT 1|K| |c . Therefore conm dition (2.10) is satised. By Theorem 6, A is a perfect information hiding scheme, i.e. A achieves perfect secrecy. This result shows us that a perfect steganographic scheme is indeed a perfect encryption scheme. This proves that the common practice of encrypting data before embedding it using steganography for better security, is unnecessary.
Universal Bounds
In this section, we give some new bounds that are applicable to all perfect information hiding schemes. We nd upper bounds that the key and ciphertext distributions impose on each other in a perfect information hiding scheme. We then derive an upper bound on the message space size. This allows us to estimate in advance the information rate, or how much information can be sent in a steganographic scheme. We will show in later sections that the given bound is in fact tight. 29
Theorem 7 (Necessary conditions). If A is a perfect information hiding scheme then: A. There exists a disjoint M-partition {C1 , C2 , . . . , C|M| } of C such that: min
i cCi
PC (c) max PK (k).
kK
(2.14)
B. There exists a disjoint M-partition {K1 , K2 , . . . , K|M| } of K such that: min
i kKi
PK (k) max PC (c).
cC
(2.15)
Proof. A. Let k K be such that PK (k ) = maxkK PK (k). Since A satises (2.5), we have for all m M: Am (k , c) = PK (k ).
cC
(2.16)
For each mi M, let Ci = {c C | Ami (k , c) = 0}. Since A also satises (2.4), we have for all mi , mj M: mi = mj Ci Cj = . We let Ci = Ci , except that we extend some Ci to include the set = {c C | mi M : Ami (k , c) = 0} so that {C1 , C2 , . . . , C|M| } is indeed a partition of C. Because for each i we have that Ami (k, c) = 0 when c Ci , we can rewrite
30
(2.16) as follows: PK (k ) =
cC
Ami (k , c) =
cCi
Ami (k , c) Pr(k = k, E(k, m) = c | m = mi )
cCi kK
cCi kK
Ami (k, c) =
=
cCi
Pr(E(k, m) = c | m = mi ).
(2.17)
Since A satises (2.2), substituting Pr(E(k, m) = c | m = mi ) = Pr(E(k, m) = c) into (2.17) yields: PK (k )
cCi
Pr(E(k, m) = c) =
cCi
PC (c), using (2.1).
Because the above is true for each i, so is (2.14).
B. Let c C such that PC (c ) = maxcC PC (c). Since A satises (2.10), we
have for all m M: Am (k, c ) = PC (c ).
kK
(2.18)
For each mi M, let Ki = {k K | Ami (k, c ) = 0}. Since A also satises (2.4), we have for all mi , mj M: mi = mj Ki Kj = . We let Ki = Ki , except that we extend some Ki to include the set = {k K | mi M : Ami (k, c ) = 0} so that {K1 , K2 , . . . , K|M| } is indeed a partition of K. Because for each i, Ami (k, c) = 0 when k Ki , we can rewrite (2.18) as follows: PC (c ) =
kK
Ami (k, c ) =
kKi
Ami (k, c ) Pr(k = k, E(k, m) = c | m = mi )
kKi cC
kKi cC
Ami (k, c) = Pr(k = k | m = mi ).
kKi
=
(2.19)
31
Since A satises Denition 7, substituting Pr(k = k | m = mi ) = Pr(k = k) into (2.19) yields: PC (c ) for each i, so is (2.15). Corollary 2. If A is a perfect information hiding scheme then: log |M| min(Hmin (PK ), Hmin (PC )). Proof. From (2.14) in the above theorem we have:
|M| kKi
Pr(k = k) =
kKi
PK (k), Because the above is true
(2.20)
cCi
PC (c) PK (k ). Thus:
1=
cC
PC (c) =
i=1 cCi
PC (c) |M|PK (k ).
Therefore, PK (k ) 1/|M|. Similarly, using (2.15), |M| 1/PC (c ). Hence Corollary 2 is true.
Steganographic Schemes
In this section, we construct a covert communication scheme with unconditional hiding and unconditional secrecy [14]. This scheme can be used when one has a secure store for the key, and therefore the restriction on PK is not needed. This relaxed condition makes the construction of the scheme more efcient. Our scheme have maximum rate, and works with general distributions. The construction of the schemes is given below. Theorem 8. Let c1 , c2 , . . . , cn be n nonnegative rational numbers, and let m and q be positive integers such that i {1 . . . n} : ci
1 , m n i=1 ci
= 1, and qci are integers for
i {1, . . . , n}. Then Algorithm 1, on input (qc1 , qc2 , . . . , qcn ), will produce a perfectly secure information hiding scheme with key space size k, plaintext space size m, and ciphertext distribution PC = (c1 , c2 , . . . , cn ).
32
ALGORITHM 1 A general steganographic scheme that is perfect Require: input integers c1 , c2 , . . . , cn Ensure: output an integer k and m matrices A1 , . . . , Am of size k n if i {1, . . . , n} : ci = 0 then A1 , A2 , . . . , Am empty matrices k0 else Q (c1 + c2 + + cn )/m a permutation of (1, 2, . . . , n) such that c1 c2 cn min(Q cm+1 , cm ) ci ci for i {1, 2, . . . , m} ci ci for i {m + 1, m + 2, . . . , n} A1 , A2 , . . . , Am , k Algorithm 1(c1 , c2 , . . . , cn ) Q (c1 + c2 + + cn )/m k k +m for i = 1 to m do for j = 1 to m do t ((i + j) mod m) + 1 Append row et to Ai end for Ai Ai end for end if
33
To simplify the proof of our theorem, we divide Algorithm 1 in two parts, Reduce and Construct. First we need the following lemma. Lemma 3 (Rational probabilities). Let c1 , c2 , . . . , cn be n nonnegative rational numbers, and let m be positive integers such that i {1 . . . n} : ci
1 , m
and
n i=1 ci
= 1.
Then there exists m matrices A1 , A2, . . . , Am of the same size k n with nonnegative entries such that: i {1 . . . m} : (Ai )T 1k = c, i, j {1 . . . m} : Ai 1n = Aj 1n , i = j {1, . . . , m} : [Ai] [Aj ] = , where k is a positive integer and c = (c1 , c2 , . . . , cn ). Proof. Let Q be the least common multiple of the denominators of c1 , c2 , . . . , cn . If some ci = 0 then its denominator is 1. For all 1 i n let ci = mQci . Then the integers ci satisfy i {1 . . . n} : ci
1 m n i=1 ci
= Q. By taking some ci s to be 0,
one can always assume that n > m. We then consider the following sub-routine (which consists of rst 5 steps of the else part in Algorithm 1): Reduce Input: nonnegative integers c1 , c2 , . . . , cn such that: i {1 . . . n} : ci
1 m n i=1 ci
= Q > 0,
Output: nonnegative integers c1 , c2 , . . . , cn such that: i {1 . . . n} : ci
1 m n i=1 ci
= Q < Q,
i {1 . . . n} : (ci = ci ) (ci = ci + Q Q). 1) Sort c1 , c2 , . . . , cn in descending order to obtain c1 c2 cn . 2) Compute = min(Q cm+1 , cm ). 3) Let ci = ci for i m, and let ci = ci for i > m. 34
Subroutine Reduce. We now show the correctness of this routine. First one can easily verify that the ci are nonnegative. We need to show that i {1 . . . n} : ci
1 m n i=1 ci
= Q < Q.
Because c1 , c2 , . . . , cn were sorted in descending order, c1 , c2 , . . . , cn are partially sorted in two descending runs c1 c2 cm and cm+1 cn . Hence we just need to verify that c1 , cm+1 Q , and that > 0: A. c1 Q because c1 = c1 and c1 Q. B. cm+1 Q because cm+1 = (cm+1 )+ (cm+1 )+(Qcm+1 ) = Q. C. If cm = 0 then cm+1 = = cn = 0, and consequently
1 m m1 i=1 ci 1 m n i=1 ci
=
m1 Q m
< Q, contradicting the input assumption. Therefore
1 m n i=1 ci
cm = 0 is false, i.e. cm > 0. Similarly, if Q cm+1 = 0 then
1 m m+1 i=1 ci
m+1 c m m+1
m+1 Q m
> Q, contradicting the input assumption.
Hence we must have Q cm+1 = 0, i.e. Q cm+1 > 0. This shows that = min(Q cm+1 , cm ) > 0. D. The condition (ci = ci ) (ci = ci + Q Q) is automatically satised since Q = Q . We complete the proof of Lemma 3 by describing the subroutine Construct (see page 36) which constructs A1 , A2, . . . , Am using our sub-routine Reduce above (see page 35) , and pointing out its correctness. Soundness For simplicity, let us assume that (1 , . . . , n ) is (1, . . . , n), i.e. {c1 , . . . , cn }
is sorted in descending order. Then, A. Let (p1 , p2 , . . . , pk ) = At 1n . It is easy to check that i : Ai 1n = (p1 , p2 , . . . , pk , , . . . , )T , where there are m copies of . Note that the pj s are independent of t. 35
Construct Input: nonnegative integers c1 , c2 , . . . , cn such that: i {1 . . . n} : ci 1 m
n
ci = Q.
i=1
Output: m matrices A1 , . . . , Am and a nonnegative integer k such that: i, j {1 . . . m}: Ai 1n = Aj 1n and [Ai] [Aj ] = . i {1 . . . m}: (Ai)T 1k = (c1 , c2 , . . . , cn )T . 1) If i : ci = 0 then let k = 0, and output m empty matrices A1 , A2 , . . . , Am , then stop. 2) Otherwise we have Q = Reduce(c1 , c2 , . . . , cn ). 3) Let Q =
1 m n i=1 ci 1 m n i=1 ci
> 0, so compute (c1 , c2 , . . . , cn ) =
and = Q Q .
4) Compute (A1 , A2, . . . , Am , k ) = Construct(c1 , c2 , . . . , cn ). 5) Let k = k + m and for each i {1 . . . m} let Ai be the result of appending at the bottom to Ai m row vectors vij (1 j m), where each vector vij is of size 1 n and is dened by: vij = (0, . . . , 0, , 0, . . . , 0), so that stands at the (((i+j) mod m)+1) column. Subroutine Construct.
36
B. We have [Ai ] [Aj ] = ([Ai ] [Aj ]) (
m t=1 [vit ]
[vjt ]). For i = j we have
[Ai ] [Aj ] = since [Ai ] [Aj ] = and [vit ] [vjt ] = . C. We also have: (Ai )T 1k = (Ai )T 1k + (, , . . . , , 0, 0, . . . , 0)T = (c1 , c2 , . . . , cn )T . Perfect decryptability follows by Theorem 5. Perfect Security By Theorem 5, part B, our construction algorithm induces a per1 . max(ci ) m j=1 T vij = (c1 , c2 , . . . , cn )T +
fect steganographic scheme with plaintext space size m where m =
1 max(ci )
This
plaintext space size is indeed maximum since by Corollary 2, we have |M| = m. Let l be the maximum bit-length of the numbers ci . After each reduction,
Run time
Q is decreased by = min(Q cm+1 , cm ). Thus we have two cases:
1 A. If Qcm+1 cm , then we have = Qcm+1 Q m+1 Q . m+1 n i=1 ci mQ = Q m+1 =
Therefore Q is at most
m Q. m+1
B. If Q cm+1 > cm , then we have cm = cm = 0. the Therefore number of non-zero elements in (c1 , c2 , . . . , cn ) decreases. Since there are at most n non-zero elements in (c1 , c2 , . . . , cn ), after at most n + t steps, we have Q
t m m+1
Q. Besides, for positive integer m we have 1 +
m m m+1
1 m m
2, therefore after n + m steps, we have Q
Q
Q . 2
Consequently, after at
most n+mlog(Q) steps, we have 0 Q < 1, and hence integer Q as a non-negative integer must be 0. Note that m n and log(Q) l, thus the number of reduction steps in the algorithm is at most O(nl). Therefore the running time of the algorithm is at most O(n4 l).
In the next theorem, we also give (polynomial time checkable) necessary and sufcient conditions for the general case of arbitrary m-ary steganographic schemes. 37
This is important since given a probability distribution of the ciphertexts, we would like to nd the maximum possible amount of information that can be sent in a scheme with given ciphertext distribution. When these necessary and sufcient conditions are satised, we explicitly construct an optimal scheme. Our construction is also efcient. We rst need the following lemma. Lemma 4 (Real probabilities). Let m be a positive integer. Let c = (c1 , c2 , . . . , cn ) where the ci s are nonnegative real numbers such that:
n
ci = 1 and i {1 . . . n} : ci
i=1
1 . m
Then there exists m matrices A1 , A2, . . . , Am of the same size k n with nonnegative entries such that: i {1 . . . m} : (Ai )T 1k = c, i, j {1 . . . m} : Ai 1n = Aj 1n , i = j {1, . . . , m} : [Ai] [Aj ] = . Proof. Let VC be the space of nonnegative vectors c = (c1 , . . . , cn ) such that there exists m matrices A1 , . . . , Am satisfying the conclusion of the lemma. We rst show that VC is a nite union of n-dimensional polytopes [29]. For each partition I of the set of indices {(i, j) | 1 i, j m} into m disjoint
I parts I1 = [A1 ], . . . , Im = [Am ], the set VC of all nonnegative vectors c = (c1 , . . . , cn )
such that there exists m matrices A1 , . . . , Am satisfying the conclusion of the lemma and for which [Ai ] = Ii , is a polyhedron [29]. In fact, if xjk is the (j, k) entry i of Ai then the nonnegative vectors (c1 , . . . , cn , x11 , . . . , xnn , . . . , x11 , . . . , xnn ) have m m 1 1 to satisfy the relations (Ai)T 1k = c and Ai 1n = Aj 1n . Each of these relations is a linear relation. Hence the set V I of all such nonnegative vectors
I (c1 , . . . , cn , x11 , . . . , xnn , . . . , x11 , . . . , xnn ) is a polyhedron. Therefore VC , the projecm m 1 1
tion of polyhedron V I onto rst n-coordinates, is also a polyhedron. Since each
I ci [0, 1], VC is bounded, hence is a polytope.
38
Therefore VC =
I
I VC is a nite union of polytopes. This shows that VC is n i=1 ci
compact. Let VC = {(c1 , . . . , cn ) Rn |
= 1 and ci
1 }. m
By Lemma 3
and Corollary 2, we have VC Qn = VC Qn , where Qn is the set of all n-tuples (x1 , . . . , xn ) of rational entries. Since VC and VC are both compact, taking the com pactication of both sides of this equality, we get VC = VC , which completes our
proof. We now state and prove our Theorem for the real probability case. Theorem 9 (Perfect steganographic scheme). Let m be a positive integer and let PC be a probability distribution. The necessary and sufcient condition for the existence of a perfect steganographic scheme, whose ciphertext distribution is PC , and whose message space size is m, is that: Hmin (PC ) log m. Proof. {} This is the consequence of Corollary 2. {} This is the conclusion of Lemma 3 and Lemma 4.
Combining Corollary 2 and Theorem 9, we immediately have the following: Corollary 3. The maximum achievable information rate of a perfect steganographic scheme with covertext distribution PC is Hmin (PC ).
39
CHAPTER 3 INVISIBLE STEGANOGRAPHIC SOLUTIONS
In this chapter we study invisible steganographic schemes, which are extensions of steganographic schemes where the keys are also hidden. These schemes are used when the key and the ciphertext are stored on the same type of media, e.g. a oppy or hard disk [3]. Hence both the key and the ciphertext distributions are the same, i.e. PK = PC . We give necessary and sufcient conditions for perfect secrecy and perfect hiding. We also give an efcient construction of a perfect invisible steganographic scheme for a general distribution when the conditions are satised. Denition 9 (Steganographic scheme). An invisible steganographic scheme is an information hiding scheme A = (K, C, M, PK , PC , E, D) with K C and PK PC .
Binary Invisible Steganographic Schemes
A perfect invisible steganographic scheme is a scheme that achieves both perfect hiding and perfect secrecy. Now we state and prove our main result of this section. The result also yields an efcient construction of a perfect information hiding scheme with binary plaintexts. Theorem 10. Algorithm 2 described below will produce a perfect invisible steganographic scheme on input of n non-negative rational numbers (c1 , c2 , . . . , cn ) such that ci
1 2
for i {1, . . . , n}, 40
ALGORITHM 2 A general invisible steganographic scheme that is perfect Require: input n rational numbers c1 , c2 , . . . , cn Ensure: output two matrices A1 , A2 of size n n 1 h min{i | c1 + c2 + + ci } 2 s1 c1 + c2 + + ch1 s2 ch s3 ch+1 + ch+2 + + cn ui 1 for i {1, 2, . . . , h 1} ui 2 for i {h} ui 3 for i {h + 1, h + 2, . . . , n} a min(s1 , s2 , s1 + s3 ) s2 s1 0 0 0 a s1 a 0 s3 s1 + a B0 0 s2 0 , B1 s1 + s2 s3 a 0 0 s3 s3 s2 + a s2 a 0 for all 1 i, j n do A0 (i, j) ci cj B0 (ui, uj )s1 s1 ui uj A1 (i, j) ci cj B1 (ui, uj )s1 s1 ui uj end for Proof. Let PK = (p1 , p2 , . . . , pn ) satisfy the condition of the theorem. If n = 3 then by Lemma 6 there is nothing to show. So let us assume that n > 3. By Lemma 5, there is a disjoint 3-partition of {1, 2, . . . , n} = {S1 , S2 , S3 } such that st =
iSt
pi 1/2
for t = 1, 2, 3. Since s = (s1 , s2 , s3 ) is also a probability distribution satisfying the condition of Lemma 6, we can construct two matrices B0 , B1 such that the conditions (2.4,2.5,2.10) are satised on the probability distribution s, as explained in the proof of Lemma 6. We now consider two matrices {A0 , A1 }, as constructed in Algorithm 2: Am (i, j) = pi pj Bm (ui , uj )(
vSui
pv )1 (
vSuj
pv )1 ,
where m {0, 1}, and (ui , uj ) {1, 2, 3} {1, 2, 3} is the unique pair such that (i, j) Sui Suj . We shall show that {A0, A1 } satises the conditions (2.4), (2.5), (2.10). Indeed: A. If Am (i, j) = 0 then Bm (ui , uj ) = 0, and since the matrices {B0 , B1 } satisfy condition (2.4) (i.e. [B0 ] [B1 ] = ) so does {A0 , A1}, i.e. [A0 ] [A1 ] = . 41
B. We now verify condition (2.5):
n n
Am 1
|C|
|i =
j=1 3
Am (i, j) =
j=1
pi pj Bm (ui , uj )(
vSui
pv )1 (
vSuj
pv )1
=
u=1 jSu 3
pi pj Bm (ui , u)(
vSui
pv )1 (
vSu
pv )1 pv )1
vSu
=
u=1
pi Bm (ui, u)(
vSui 3 1 u=1
pv )1 (
jSu
pj )(
= pi (
vSui
pv )
Bm (ui , u).
(3.1)
Since Bm satises (2.5), this means that Bm 13 = (s1 , s2 , s3 )T . So we obtain:
3 u=1
Bm (ui, u) = sui . By substituting this into the right hand side of equation
(3.1) and using the denition of sui we have: Am 1|C| |i = pi (
vSui
pv )1 sui = pi (
vSui
pv )1 (
vSui
pv ) = pi = PK (i).
Therefore (2.5) is true. C. We verify condition (2.10):
n n
AT m
1
|K|
|j =
i=1 3
Am (i, j) =
i=1
pi pj Bm (ui, uj )(
vSui
pv )1 (
vSuj
pv )1
=
u=1 iSu 3
pi pj Bm (u, uj )(
vSu
pv )1 (
vSuj
pv )1
=
u=1
pj Bm (u, uj )(
vSuj 3
pv )1 (
iSu
pi )(
vSu
pv )1
= pj (
vSuj
pv )
1 u=1
Bm (u, uj ).
(3.2)
Since Bm satises (2.10), this means that (Bm )T 13 = (s1 , s2 , s3 )T . So we obtain:
3 u=1
Bm (u, uj ) = suj . By substituting this into the right hand side of 42
equation (3.2) and using the denition of suj we have: AT 1|K| |j = pj ( m
vSuj
pv )1 suj = pj (
vSuj
pv )1 (
vSuj
pv ) = pj = PK (j).
Therefore (2.10) is true.
We state and prove the following two lemmas. Lemma 5 (Reduction). If S = {s1 , s2 , . . . , sn }, n 3, is a set of positive real numbers such that maxi (si )
1 2
and
n i=1 iSt
si = 1, then there exists a disjoint partition S1 , S2 , S3
1 2
of {1, 2, . . . , n} such that Proof. Consider the set {t |
si
for t = 1, 2, 3.
t i=1
si 1/2}, and let
t
h = min{t |
i=1
si 1/2}.
(3.3)
Since all si 1/2, we have 1 < h < n. Dene S1 = {1, . . . , h 1}, S2 = {h}, and S3 = {h + 1, . . . , n}. We verify that A. B. C.
iS1 iSt
si 1/2 for t = 1, 2, 3 as follows:
si 1/2, otherwise h would not be the minimum t in Equation 3.3. si 1/2, because from our assumption that sh 1/2. si 1/2, because
iS3
iS2
iS3
si = 1
h 1
si 1 1/2 = 1/2.
This proves our lemma. Lemma 6 (Base). If |K| = |C| = 3 then the necessary and sufcient condition for the existence of a perfect steganographic scheme is that: 1 max(PK (k), PC (c)) . kK 2
cC
Proof. 43
{} This is the consequence of Corollary 2 for the case |M| = 2. {} Let PK = PC = (s1 , s2 , s3 )T satisfy the condition 0 < s1 , s2 , s3 1/2. After considering all possible 2-partitions of 9 index-pairs from the set {1, 2, 3} and solving the corresponding linear inequalities, we obtained the following two characteristic matrices A0 (k, c) and A1 (k, c): s1 0 s2 0 0 0 a s1 a
A0 = 0 0
, A 1 = s1 + s2 s3 a 0 0 s3 s1 + a s3 s3 s2 + a s2 a 0
( . 3.4)
where a = min(s1 , s2 , s1 + s2 s3 ). Note that 0 < s1 , s2 , s3 1/2, and s1 + s2 + s3 = 1 so it is easy to verify that a max(0, s1 s3 , s2 s3 ). Then it is straightforward to verify that {A0 , A1} satises conditions (2.4,2.5,2.10) and that the entries are greater than or equal to zero. Hence by Theorem 5, {A0 , A1} with (K, C, M, PK ) induces a perfect steganographic scheme. The construction of this scheme based on its characteristic matrices was given in page 24.
Theorem 11 (Necessary and sufcient conditions). The necessary and sufcient condition for the existence of a perfect steganographic scheme is: Hmin (PC ) 1. Proof. {} is from Corollary 2. {} is implied by Theorem 10. Obtaining Maximum Bit Rate For a given distribution PC , we are now interested (3.5)
in sending information at the maximum bit rate rather than the sub-optimal one. Unfortunately this problem seems to be hard, as we now explain.
44
Theorem 12 (Maximum Bit Rate). Let PK = PC be a given probability distribution whose probabilities are rational numbers. Let n 3 be a xed integer. Deciding if there exist a perfect information hiding scheme A with key distribution PK , ciphertext distribution PC , and whose message space M contains at least n different messages is an NP-complete problem. Proof. We reduce the Integer Partitioning problem [18] to this problem. Note that the symbol n in this proof has been redened (it has different meaning elsewhere). We rst recall the Integer Partitioning problem: Instance: a set of positive integer numbers {x1 , . . . , xl }. Question: Is there a partition of {1, . . . , l} into disjoint S0 , S1 such that:
iS0
xi =
jS1
xj .
Given an instance {x1 , . . . , xl } of the partition problem, we consider the following distributions: PK = PC = (2x1 /nS, 2x2 /nS, . . . , 2xl /nS, 1/n, 1/n, . . . , 1/n), where S =
l i=1
(3.6)
xi , there are n 2 fractions 1/n at the end, and the key and
the ciphertext space is {1, 2, . . . , l + n 2}. We next show that {x1 , x2 , . . . , xl } is a yes instance of the Integer Partitioning problem if and only if there exists a perfect information hiding scheme with |M| = n, whose key and ciphertext distribution is PK . {} Assume that {x1 , x2 , . . . , xl } is a yes instance of the Integer Partitioning problem. Then by denition, there exists two disjoint subsets S0 , S1 of {x1 , x2 , . . . , xl } such that
xi S0
xi =
xi S1
xi = S/2. We dene n matrices {At }, each of
45
size (l + n 2) (l + n 2), for t = 1, 2, . . . , n as follows. At (i, j) i S0 i S1 i>l j S0
t 4xi xj 11 2 nS t 4xi xj 21 nS 2 t 2xj (il+2)1
j S1
t 4xi xj 12 2 nS t 4xi xj 22 nS 2 t 2xj (il+2)2
j>l
t 2xi 1(jl+2)
nS t 2xi 2(jl+2) nS t (il+2)(jl+2) n
nS
nS
t t where uv = 1 if u v + t (mod n), and uv = 0 otherwise. It is not difcult
to verify that the matrices At dened above satisfy conditions (2.4), (2.5), (2.10) of Theorem 5. Hence {At }n together with (K, C, M, PK ) induce a t=1 perfect information hiding scheme. {} Assume that there exists a perfect n-ary information hiding scheme A whose key distribution and ciphertext distribution is PK as dened in (3.6). Let {At | t = 1, 2, . . . , n} be the set of n characteristic matrices of A. For t = 1, 2, . . . , n, let Vt = {c | At (l + n 2, c) = 0}. Since the matrices At satisfy condition (2.4) of Theorem 5 we conclude that the sets Vt (t = 1, 2, . . . , n) are mutually disjoint. We extend some Vt to include the set {c | t : At (l + n 2, c) = 0} so that {V1 , V2 , . . . , Vn } is indeed a disjoint partition of {1, 2, . . . , l + n 2}. Let st =
cVt n
At (l + n 2, c). We have:
n n l+n2
st =
t=1 t=1 cVt n
At (l + n 2, c) =
t=1 n c=1
At (l + n 2, c) (3.7)
=
t=1
PK (l + n 2) =
t=1
1/n = 1.
46
On the other hand:
n n n l+n2 l+n3
st =
t=1 t=1 cVt n
At (l + n 2, c) =
t=1 cVt n l+n3 k=1
At (k, c)
k=1
At (k, c)
=
t=1 cVt n
PK (c)
t=1 cVt k=1 l+n3
At (k, c) At (k, c). (3.8)
= 1
t=1 cVt k=1
Combine (3.7) and (3.8) to get:
n t=1
cVt
l+n3 k=1
At (k, c) = 0. In other
words, k l + n 3, c Vt : At (k, c) = 0. This implies that c Vt :
l+n2 l+n3 l+n3
At (n + l 2, c) =
k=1
At (k, c)
k=1
At (k, c) = PK (c)
k=1
At (k, c) = PK (c).
Therefore we have st =
cVt
At (l + n 2, c) =
cVt
PK (c). This means
that {s1 , s2 , . . . , sn } is an n-partition of {PK (1), PK (2), . . . , PK (l + n 2)} into n disjoint subsets. Furthermore we have for each t: st = 2, c) =
l+n2 A(l c=1 cVt
A(l + n
+ n 2, c) = PK (l + n 2) = 1/n. Since the last n 2
values in (3.6) of PK are 1/n, we have a partition of {2x1 /nS, . . . , 2xl /nS} into two disjoint subsets such that the sum of elements in each subset is 1/n. Equivalently, {x1 , . . . , xl } can be divided into two disjoint subsets such that the sum of elements in each subset is S/2, i.e. {x1 , . . . , xl } is a yes instance of the Integer Partitioning problem.
Efcient Invisible Steganographic Scheme
While one can always divide a long message into bits and send each bit separately without affecting its perfect security, however such approach has low information rate. In this section, we present a perfect invisible steganographic scheme with 47
multi-bit plaintexts. Our construction is recursive. In simulations, the information bit rate is at least 75% of the upper bound implied by Corollary 2. Thus the upper bound and the constructed scheme are very tight. Setup Let PK = PC = (p1 , p2 , . . . , pn ) be the probability distribution of covertexts. Since PK and PC satisfy pi
1 2
for all i, by Lemma 5 we have a disjoint
iSt
partition S1 , S2 , S3 of {1, 2, . . . , n} such that st = (
pi )
1 2
for 1 t 3.
By Theorem 11, let A[0] be the binary invisible steganographic scheme with the ciphertext and key distributions be (s1 , s2 , s3 ), and the ciphertext space be {c1 , c2 , c3 }.
t Case A. Suppose that the induced probability distribution PK = (p1t , . . . , pnt ),
where pit = pi s1 for i St and pit = 0 for all t {1, 2, 3}, i St , satises t the conditions of Theorem 11, and that A[t] is the perfect steganographic scheme produced by Theorem 11 with ciphertext space C and probability
t distribution PK . The secret key of our scheme is (k0 , k1 , k2 , k3 ), where k0
is the secret key of A[0] , and kt is the secret key of A[t] . Case B. Otherwise, the secret key of our scheme is the same as that of A[0] . Encryption Case A. The secret key is (k0 , k1 , k2 , k3 ). Let the plaintext m = (m1 , m2 , . . . , ml ) be a string of bits. Let ct (1 t 3) be the encryption of plaintext m1 with secret key k0 using A[0] , and ci be the encryption of plaintext m = (m2 , . . . , ml ) with secret key kt using A[t] . The nal ciphertext is c = ci . Case B. The secret key is k0 . Then the message is m1 . The ciphertext is the encryption of m1 with secret key k0 using A[0] . Decryption Case A. The secret key is (k0 , k1 , k2 , k3 ). Let 1 t 3 be the unique index such that ciphertext c St . Let m1 be the decryption of ciphertext ct 48
with secret key k0 using A[0] , and let m = (m2 , m3 , . . . , ml ) be the decryption of ciphertext c with secret key kt using A[t] . The plaintext is m = (m1 , m2 , . . . , ml ). Case B. The secret key is k0 . The plaintext is the decryption of c with secret key k0 using A[0] . Since A[0] and A[t] (1 t 3) are perfect invisible steganographic schemes, it is straightforward to see that our scheme is a perfect invisible steganographic scheme. We have simulated our scheme for 100 n 1000 with distribution PK chosen at random. On average, the obtained bandwidth is very high, often in the range of 80% 90% of the upper bound imposed by Corollary 2. This shows that our scheme is quite efcient.
Generalized Invisible Steganographic Schemes
In this section, we extend the invisible steganographic scheme dened in the previous section to include those cases when the key and the ciphertexts are stored in, or sent through different media types, that are insecure. In such cases, both the ciphertexts and the keys need to be protected, and have different distributions. However, as we will now show, this problem is indeed very hard and it is open to further research. Theorem 13 (General Invisible Steganographic Scheme). Suppose that the probability distributions PK and PC are given by vectors of rational numbers. Deciding if there exists a perfect binary information hiding scheme whose key distribution is PK and whose ciphertext distribution is PC is an NP-complete problem. Proof. We prove this theorem by reducing the NP-complete Integer Partitioning problem [18] to the problem of deciding whether a generalized perfect invisible 49
steganographic scheme exists (see the proof of Theorem 12 for a discussion of the Integer Partitioning problem). Given an instance of the Integer Partitioning problem, we consider the following probability distributions: PK = (1/2, 1/2) PC = (x1 S 1 , x2 S 1 , . . . , xn S 1 ), where S =
n i=1
(3.9)
xi . We show that {x1 , x2 , . . . , xn } is a yes instance of the Integer
Partitioning problem if and only if there exist a perfect binary information hiding scheme whose key distribution is PK and whose ciphertext distribution is PC . Note that if a perfect information hiding scheme exists, then a perfect binary information scheme exists. {} Assume that {x1 , x2 , . . . , xn } is a yes instance of Integer Partitioning problem. Let S0 , S1 be the corresponding partition of (1, 2, . . . , n). We dene the following two matrices: Am (k, c) = xc (k Sm (c)) S 1 , m = 0, 1 (3.10)
where k {0, 1}, c {1, 2, . . . , n}, St (c) = 1 if c St and St (c) = 0 if c St , and is the addition mod 2. It is easy to verify that [A0 ] [A1 ] = , At 1n = (1/2, 1/2)T , and that AT 12 = (x1 S 1 , x2 S 1 , . . . , xn S 1 )T . Hence {A0 , A1} t forms a perfect binary information hiding scheme with key distribution PK and ciphertext distribution PC . {} Let A be a perfect binary information hiding scheme, with key distribution is PK , and ciphertext distribution PC . Let {A0, A1 } be the set of characteristic matrices of A. We will show that the Integer Partitioning problem instance {x1 , . . . , xn } is a yes instance. Indeed, let P0 = {i | A0 (0, i) = 0}, and P1 = {1, 2, . . . , n} P0 . Note that for each i P0 , A0 (1, i) = 0, because if there is some i P0 such that A0 (1, i) = 0, then from (2.4) we have A1 (0, i) = 50
A1 (1, i) = 0. Consequently, AT 12 is a column vector whose ith coordinate 1 is 0, i.e. AT 12 = PC . This contradicts (2.10). So we have A0 (1, i) = 0 for 1 i P0 . Similarly we have A1 (0, i) = 0 for i P1 . Combine these with (2.10), (2.5) to get A0 (0, i) = xi S 1 for i P0 , and xi S 1 =
iP0 iP0
(A0 (0, i) + A0 (1, i)) =
iP0
A0 (0, i)
n
=
iP0
A0 (0, i) +
iP0
A0 (0, i) =
i=1
A0 (0, i) = 1/2.
Therefore
iP0
xi =
iP0
xi = S/2, i.e. {x1 , . . . , xn } is a yes instance.
51
CHAPTER 4 STEGANOGRAPHIC CODING SOLUTIONS
In the previous chapter we have considered perfect solutions to the steganographic problem. In this chapter, we consider non-perfect solutions, where the security is statistical or computational and the number of stegotexts required to encode a hiddentext is variable.
Steganographic Codes
A steganographic code is an encoding scheme that encodes uniform probability distribution into a given marginal probability distribution P . Denition 10 (Steganographic Code). A steganographic code is an encoding scheme , whose source alphabet is M and destination alphabet is C, together with a marginal probability distribution P over C such that the probability distribution of Encode (m) is statistically close to P when m is taken uniformly at random from M . This means:
(n)
=
sEncode (M n )
|Pr [Encode (m) = s | m UM n ] P (s)|
is a negligible function in n. It is obvious that the maximum rate for any such steganographic code is H(P ). In the following, we construct steganographic codes that approach this limit. 52
Optimal Steganographic Codes
We present a construction that applies to covertext sequences that may be dependent on each other, while the compression scheme described in [7] must assume that the covertext are independent of each other. Let C = {v1 , v2 , . . . } be nite alphabets and let P be a marginal probability distribution of random process X = {X1 , X2 , . . . }. In this section, we will construct optimal steganographic codes over any nite source alphabet M = {m1 , m2 , . . . }. For each x = mi1 mi2 . . . min M , let x =
n j=1 (ij
1)|M|j1 be the integer
whose M-ary representation is x. For P (h) = 0 and 1 t |C|, dene:
t1 1 i=1
Fh (vt ) = P (h)
P (h vi).
We formally set Fh (v(|C|+1) ) = 1. Clearly Fh is the cumulative probability distribution function of the marginal probability distribution Ph dened by: Ph (v) = P (h v)P (h)1.
ALGORITHM 3 A steganographic encoding algorithm Input: x = (x1 , . . . , xn ) M n . Output: c = (c1 , . . . , cl ) C . 1. let z UM n , r = x z. 2. let a = 0, b = |M|2n , h = . 3. while a/|M|n < b/|M|n do (a) let 1 j |C| be the unique integer such that: Fh (vj ) (r a)/(b a) < Fh (vj+1 ). (b) let (a, b) = (a, a) + (b a)(Fh (vj ), Fh (vj+1)). (c) let h = h|vj . 4. Output c = h.
53
We denote by Encode(x), x M , the output of the encode Algorithm 3. Let x M be the M-ary representation of x Z0 . We denote by Decode(c), c C , the ALGORITHM 4 A steganographic decoding algorithm Input: c = (vj1 , . . . , cjl ) C . Output: x = (x1 , . . . , xn ) M n . 1. let a = 0, b = |M|2n , h = . 2. for i from 1 to l do (a) let (a, b) = (a, a) + (b a)(Fh (vji ), Fh (v(ji +1) )). (b) let h = h|vji . 3. Let r = a|M|n . 4. Output x = r.
output of the decode Algorithm 4. Observe that the encoding rule above resembles to the arithmetic decoding [11] of number x/|M|n in the following sense: each time the encoder outputs a covertext vj , vj contains some information about r. Therefore the range [a, b] which contains r is scaled by a factor of Fh (vj ). The encoder stops when the decoder can completely determine the value x from r, i.e. when the range [a, b] is less than |M|n . Theorem 14. The code presented above is a steganographic code. Proof. Observe that, by induction, the values of a, b, h, j, a , b in the encoding are the same as in the decoding. Due to our choice of j, we have r [a, b) both before and after each iteration. Therefore at the end of the encoding, we obtain a|M|n = b|M|n = x. Because the values of a, b in encoding are the same as in the decoding, is uniquely decodable. Next, we will prove that is also steganographic code. For the sake of argument, let us assume that a, b, r are real numbers. By simple induction we can see that after each iteration 1 i l, the conditional probability
54
distribution of x given the history h = c1 . . . ci, is uniform random over integers in the range [a|M|n , b|M|n ). Consequently, at the beginning of each iteration i, conditioned on the previous history h = c0 . . . ci1 , u = (r a)/(b a) is a uniform random variable with range [0, 1]. Thus vj chosen by the encoder, such that Fh (vj ) u < Fh (vj+1 ), is indeed distributed accordingly to probability distribution Fh (v). However a, b, r are not real numbers, but rather approximations by fractions with denominator |M|n , i.e. with negligible error of at most O(|M|n ). We conclude that x distribute statistically close to uniform on range [a|M|n , b|M|n ). Therefore, vj distributes statistically close to Fh (v). This means is a steganographic code. Theorem 15. The code described above is asymptotically optimal. Proof. Observe that each iteration in the encoding, the range [a, b] containing r is scaled by a factor of Fh (vj ). Therefore we have for all t 1:
t
(bt at )|M|2n =
i=1
Fvj1 ...vji1 (vji ) = P (vj1 . . . vjt ),
where (at , bt ) is the value of a, b after iteration t. However, the encoder only stops when b a < |M|n , so we have bl1 al1 |M|n . Therefore: P (vj1 . . . vjl1 ) = (bl1 al1 )|M|2n |M|n . This implies that H(vj1 . . . vjl1 ) |M|n n. Therefore: H(Encode (x)) = H(vj1 . . . vjl ) |M|n (n + log |C|). Summing over all |M|n possible values of x M = {0, 1}n , we have: rate() = 1 n H(Encode(x))
x{0,1}n
n + log |C| 1 = 1 + log |C|. n n
Since 1 +
1 n
log |C| 1, we get is asymptotically optimal. 55
It is clear that the encoding and decoding algorithms terminate in polynomial time if and only if the probability distribution PC have nonnegligible entropy.
Steganographic Schemes
In this section, we consider an application of steganographic coding to construct unconditionally secure steganographic scheme. Our construction is optimal. Let be a steganographic code whose distribution of code words is statistically close to the marginal probability distribution P (as constructed in Section 4). We view P as the probability distribution of output of some random process X. Our steganographic scheme S is follows. Setup (1n ). Generate secret key k UM n . Embed (k, x). Output c = Encode(x k). Extract (k, c). Output x = Decode (c) k. Theorem 16. The steganographic scheme S is statistically secure. Proof. Since k UM n , we have x k UM n . Therefore by the denition of : for all x M, c distributes statistically close to P . Now consider a CHA(n)-game between Alice, who uses the above steganographic scheme, and Wendy, who tries to detect Alice. Let m be the hiddentext chosen by Wendy. We have shown that regardless of m, Embed(k, m) always distributes statistically close to P . Therefore Wendy cannot distinguish between the two cases: when Alice returns c = Embed(k, m) and when Alice returns c P , with more than negligible advantage. This means that our scheme is statistically secure. Theorem 17. The steganographic scheme S is asymptotically optimal. Proof. This follows immediately from the fact that our scheme does not have additional overhead (over ), and the fact that is already asymptotically optimal. Our
56
scheme runs in polynomial time if the entropy of P is nonnegligible, which is the necessary and sufcient condition for statistically secure steganography.
Steganographic Secret Sharing
In this section, we show how to construct steganographic secret sharing. A (t, n)secret sharing scheme is a scheme to split into n shares in such a way that any t shares can be used to reconstruct the secret, but any t 1 shares contain no information on the secret. A steganographic secret sharing scheme is a secret sharing scheme in which shares distributes statistically close to a given probability distribution, even when up to t 1 shares are known. A generalized steganographic secret sharing scheme is a secret sharing scheme in which each (unexposed) share-i distributes statistically close to ` priory given probability distributions PS , even when up to t 1 other a shares are known by the adversary. Construction. Let S(t, n) be Shamirs (t, n) threshold scheme [43] dened over
t1 i=0 (i)
nite eld Fq , where q = 2m for some integer m such that n 2m . The share of each user i (1 i n) in S(t, n) is si = ft (i), where ft (x) = ai xi is a random
secret polynomial of degree t 1 in Fq [x], and the shared secret is ft (0) = a0 . Let the steganographic share of each user be Si = Encode(si ). Then the shared secret a0 can be reconstructed from si = Decode (Si ) by using Lagranges interpolation [43]. Proof. Observe that even when t 1 users collude, the length t 1 vector, which
consists of their t1 shares si , is a random vector in Fqt1 . The reason for this is that if i1 , . . . , it1 were the colluders then the corresponding shares are (si1 , . . . , sit1 ) = (a0 , . . . , a0 ) + V (i1 , . . . , it1 )(a1 , . . . , at1 )T where V (i1 , . . . , it1 ) is equivalent to a Vandermonde matrix of size t1. Since V (i1 , . . . , it1 ) is invertible and (a1 , . . . , at1 ) is uniformly random, (si1 , . . . , sit1 ) is also a random vector (uniform distributions
57
are preserved by non-degenerate afne transformations). Therefore, the steganographic shares of this scheme are hidden even when t 1 users are corrupted. This generalized steganographic threshold scheme can be used to hide secret keys or data securely in multiple distributed storages. Since the underlying secret sharing scheme and the steganographic code are both optimal, our scheme is also asymptotically optimal.
58
CHAPTER 5 COMPUTATIONAL COMPLEXITY SOLUTIONS
In this chapter, we extends our perfect and statistically secure schemes constructed earlier to obtain computationally secure schemes. The main advantage of these schemes is that a single key can be used for multiple message transmissions.
From Unconditional to Conditional Security
In this section, we construct a computationally secure steganographic system using the perfect invisible steganographic scheme and a uniform pseudorandom generator [14]. Our scheme is computationally secure, i.e. as secure as the pseudorandom generator, and also efcient since Alice and Bob can reuse the key. As a consequence, our scheme implies that pseudo-random generators are sufcient for secure steganography. We also prove later that one-way functions are necessary to secure steganography.
Private Key Steganographic System
Let G be a secure pseudo-random generator. G takes a seed s as input and outputs pseudo-random bit sequence G[s]. Denote State[G s] the current state of G when its input seed was s. This state determines the pseudo-random sequence G[s] completely. Let A=(K, C, M, PK , PC , E, D) be a perfect steganographic scheme. 59
Our computationally secure steganographic scheme A[G] involves the following. Setup Randomly select a seed s from seed space of G, and feed s to G. The shared secret key between Alice and Bob is State[G s]. Encrypt Using G[s] as the random tape, Alice randomly generates a secret subkey k K accordingly to probability distribution PK . Alice sends ciphertext c = E(k, m) to Bob. Decrypt Using G[s] as the random tape, Bob randomly generates a secret subkey k K accordingly to probability distribution PK . Bob decrypts ciphertext c to obtain plaintext m = D(k, c). Note that State[G s] is updated accordingly each time G[s] is being used. It is easy to see that the above scheme is sound, i.e. Bob receives the correct plaintext from Alice. We claim the following. Theorem 18. In the above steganographic scheme, the ciphertext distribution PE(k,m) is computationally indistinguishable from PC . Proof. Assume by contradiction that PE(k,m) is computationally distinguishable from PC . Let T be a Turing machine that distinguishes PE(k,m) from PC . By denition we have =| Pr(T (E(k, m) = 1))Pr(T (x) = 1 | x PC ) | is non-negligible. We show that using T as a subroutine, we can construct a Turing machine TG that can efciently distinguish the output G[s] of G from truly uniform random bit sequences. The machine TG works as follows. TG takes a random string r as input and uses r as the random tape to generate a subkey kr accordingly to distribution PK . Finally, TG outputs T (E(kr , m)) where m is any xed plaintext. Note that TG is polynomial time since T and E are polynomial time. We next show that TG distinguishes G[s] from truly random sequences. Indeed, when the input of TG is taken from G[s], its output is nothing else but T (E(k, m)). On the other hand, when the input of TG is taken from a truly random sequence, the output of TG is T (E(kU , m)), where kU distributes exactly according to PK because kU was generated using truly random sequence. Since A 60
is a perfect invisible steganographic scheme, we have E(kU , m) distributes accordingly to PC . Therefore the difference between the output of TG when its input is taken from G[s] and the output of TG when its input is taken from truly random is | Pr(T (E(k, m)) = 1) Pr(T (E(kU , m)) = 1) | = | Pr(T (E(k, m)) = 1) Pr(T (x) = 1 | x PC ) | = , which is non-negligible. Thus TG distinguishes G[s] from a truly random sequence. This contradicts our assumption that G is a secure pseudorandom generator. Therefore our assumption that PE(k,m) is distinguishable from PC is wrong, i.e. our theorem is proven. A very useful property of our scheme is that we can always use a small plaintext and ciphertext space and still achieve maximum information rate, and yet the parameter size does not effect the security level in perfect schemes.
From Statistical to Computational Security
Our purpose in this section is to construct steganographic systems based on the steganographic coding scheme .
Private Key Steganographic Systems
Let G be a cryptographically secure pseudorandom generator, and k be a shared secret key. In the setup step, k is given...