Cryptography Reference
In-Depth Information
done by digital cameras. That is, it looks for an estimate of the orig-
inal sensor and measures how much the image in question deviates
from it. This solution will also detect basic doctoring or photoshop-
ping of images as well as steganography.
Their algorithm is necessary because the images are modified
once again by the compression process. This means that the value at
a particular pixel is not the exact value produced by the CFA interpo-
lation. The lossy compression algorithm has added more averaging.
Figure 17.4 shows a picture of a beach with a lifeboat pasted on
the sky. The second image highlights the most suspicious pixels with
darker values. There are a number of grey pixels in the image, but
the darkest are found around the edges of the boat itself. Some parts
of the boat's interior are not colored because the cutting and pasting
didn't move the entire boat. The other objects in the image aren't
changed, but they still suggest that there's some incongruity, an effect
caused by the compression process.
There are some limits to this approach. A smart steganographer
might use the Bayer table to control how information is mixed in the
grid. The first pixel gets additional information added to the blue
component, the second pixel gets it added to the green channel, etc.
Then the results for the other pixels are guessed or interpolated using
the same algorithm that a camera might use. The result looks as if it
came directly from the camera because it is processed with exactly
the same algorithms.
17.6 Statistical Attacks
Much of the study of mathematical statistics is devoted to determin-
ing whether some phenomenon occurs at random. Scientists use
these tools to determine whether their theory does a good job of ex-
plaining the phenomenon. Many of these statistical tools can also
be used to identify images and music with hiddenmessages because
a hidden message is often more random than the information it re-
places. Encrypted information is usually close to random unless it
has been reprocessed to add statistical irregularities.
The simplest statistical test for detecting randomness is the
χ
2
(
Chi-Squared
) test which sums the square of the discrepancies. Let
{e
0
,e
1
,...}
be the number of times that a sequence of events occurs.
In this case, it may be the number of times that a least significant
bit is one or zero. Let
e
i
)
be the expected number of times the
event should occur if the sample was truly random. The amount of
E
(
