Image Steganography Tool

Herodotus tells of a man who shaved the head of his most trusted slave, tattooed a message on the scalp, and waited for the hair to grow back before sending him on his way. The message called for a revolt against the Persians. Nothing about the messenger looked like a message, and that was the whole design.

The word for this is steganography, from the Greek for covered writing. Its aim is different from that of a cipher. A cipher makes a message unreadable and does not care who knows a message exists. Steganography tries to conceal that anything was sent at all. The two are easy to confuse, and a great deal of misplaced confidence follows from confusing them.

The modern statement of the problem is a small story told by Gustavus Simmons in 1983. Two prisoners want to plan an escape, and every note between them passes through the warden. If the warden sees anything that looks like a cipher, both go to solitary confinement. So the notes must look innocent to someone who is reading them on purpose. That last clause is where the difficulty lives.

The bits nobody looks at

A digital picture offers an obvious hiding place. In a 24-bit image each pixel holds three numbers from 0 to 255, for red, green and blue. Change one of those numbers by a single step and the color moves by less than the eye can tell. The lowest binary digit of each number, its least significant bit, is therefore spare room. Write the message there, one bit per color value, and the picture looks the same.

The room is generous. Johnson and Jajodia, in a 1998 survey, work it out for a picture 1,024 pixels wide and 768 high: three bits in every pixel come to 2,359,296 bits, or 294,912 bytes.

A smaller case can be checked by hand and then in the tool on this page. Its sample picture is 640 by 480, which is 307,200 pixels. The tool reserves the first 128 pixels for a 48-byte header that records the layout, the length and two checksums. The remaining 307,072 pixels, three color values each, one bit per value, hold 921,216 bits, and dividing by eight gives 115,152 bytes.

Now hide the sentence “Meet me at noon by the old bridge.” with no password. It is 34 bytes. With the header that makes 656 bits written, and on average half of them already agree with the bit that was there, so only 332 color values actually change, each by one step, across 197 pixels. Peak signal-to-noise ratio, the usual measure of such damage, takes the mean of the squared differences over all 921,600 color values and compares it with 255 squared. Here it comes to 82.56 dB. Lossy image compression typically lands between 30 and 50 dB, so by this measure the change is far below anything a viewer would see.

What the eye forgives, arithmetic does not

The trouble is the assumption underneath: that the lowest bits of a picture are noise, so that swapping in other noise changes nothing measurable. In 1999 Andreas Westfeld and Andreas Pfitzmann showed that several popular hiding programs of the day all rested on that mistaken belief. The low bits of a real picture carry structure. Displayed alone as a black and white image, the lowest bit plane often still shows the outline of the scene. Overwrite part of it with a message and the overwritten part turns to uniform static, with a visible edge where the message stops.

Their second observation needs no human judge. Overwriting the lowest bit can only turn a value into its partner: 6 into 7 or 7 into 6, never 6 into 5. They called these partners pairs of values. In an untouched picture the two members of a pair are usually not equally common, because the picture’s histogram rises and falls. Message bits that are evenly mixed, as compressed or encrypted data always is, push every pair toward equal counts while leaving the total of each pair unchanged.

That is a testable prediction. Count how often each value occurs, compute what each pair would look like if its two counts were equal, and ask with a chi-square test how closely the picture matches. The answer is a number between 0 and 1 that the authors describe as roughly the probability of embedding. Run on a growing sample from the top of the picture, it stays near 1 for as long as the sample holds only message-bearing pixels and collapses soon after, which also betrays roughly how long the message is.

The tool runs this test on its own output, and the results are instructive in both directions. On the sample picture the clean cover scores at most 0.048. Fill a tenth of the capacity with encrypted data in row order and the score reaches 0.996. The 34-byte sentence above reaches only 0.62, which is below any sensible alarm level. A short message survives this test simply by being short.

Scattering, and the tests that followed

The obvious repair is to stop writing the bits in a row. Spread them across the whole picture in an order derived from a password, and no region is ever fully overwritten. Westfeld and Pfitzmann said plainly that their simple test was too weak to detect changes spread this way. On the sample picture, a payload scattered over a tenth of the capacity scores 0.24 on the chi-square test, which would pass unnoticed.

It did not stay that way. Within a few years two groups had found statistics that scattered embedding still disturbs. Jessica Fridrich and Miroslav Goljan measured how the smoothness of small pixel groups responds to flipping low bits. Dumitrescu, Wu and Wang looked at pairs of neighboring pixels and counted, among pairs that differ by an odd amount, how often the larger value is even and how often it is odd. In a natural picture the two counts are about equal. Embedding breaks that balance in a way that depends on how much was embedded, and solving one quadratic equation returns an estimate of the message length.

The same scattered payload that passed the chi-square test at 0.24 gets a sample pair estimate of about 0.095, close to the true tenth and far above the 0.018 threshold the paper uses. Drop to one hundredth of the capacity and the estimate falls to 0.007, lost among the values clean pictures produce. Fridrich and Goljan put an experimental number on that floor: their patent recommends 0.005 bits per pixel as the capacity that is safe, because their method cannot reliably detect anything shorter. For the sample picture that is under 200 bytes.

Nor is a quiet result a proof of safety. Christian Cachin’s formal treatment casts the warden’s job as a hypothesis test and measures a scheme’s security by how far the statistics of altered covers drift from those of innocent ones. A method is safe only against every test, including those not yet published, and least significant bit replacement has a long record of losing to the next one.

Fragile by construction

There is a second weakness, and it has nothing to do with adversaries. The message lives in exactly the part of the picture that every lossy process throws away first. PNG is a lossless format: its specification promises that filtering and compression preserve all information, so a PNG carries the low bits intact. JPEG makes no such promise. The JPEG standard classes its discrete cosine transform processes as lossy, trading exactness for size.

The effect is total. Saving the tool’s result once as a JPEG at quality 90 and reading it back leaves 50.0 percent of the low bits different from what was written, which is what coin flips would give. Resizing does the same by averaging neighbors. Any service that recompresses or scales uploaded pictures therefore erases such a message without ever looking for it. Johnson and Jajodia noted that scattering does not help here: a spread message is as vulnerable to lossy compression as one written in a row.

Hiding is not encrypting

A message hidden without a key is protected only by the hope that nobody looks. That hope has a poor record.

Kerckhoffs argued in 1883 that a system’s security must not depend on the method staying secret, and Anderson and Petitcolas carry that assumption straight into steganography: the warden knows the mechanism. Anyone who suspects a picture and has the same program can simply run it.

So the sound practice is to encrypt first and hide second, which is how Johnson and Jajodia put it: steganography supplements cryptography and does not replace it. The tool does this when given a password. It stretches the password with PBKDF2 at the 600,000 iterations OWASP currently lists for HMAC-SHA256, using a random salt of the 128 bits NIST requires, and seals the payload with AES in Galois/Counter Mode, which authenticates as well as encrypts. A wrong password or a single flipped bit then yields a refusal, never a garbled message. A second key, separated from the first by HKDF’s context string, orders the scattering.

Be exact about what that buys. The password protects the content. It does nothing to hide the fact of hiding: the altered bits are still there for the tests above to find, and a recognizable header still marks the file. Encrypted data is also evenly mixed, which is precisely what the chi-square test detects best.

What remains is modest and real. Engineered for robustness instead of secrecy, the same idea became the copyright watermarks and fingerprints that Petitcolas, Anderson and Kuhn survey. It makes good puzzles, and it teaches the difference between looking hidden and being hidden.