Cryptography Reference
In-Depth Information
the easiest solutions.
17.6.2 Re-alignment
One of the simplest yet most efficient approaches for detecting stega-
nographic tweaks is to break up the blocks used during compression.
These are usually
8
8
pixel blocks in the JPEG algorithm, but they
may be larger and more varied in more sophisticated wavelet com-
pression schemes.
The blocks can be broken up by trimming parts of the image.
Jessica J. Fridrich suggests cropping away a margin of 4 pixels on all
sides of a JPEG image. Each block is split into four parts and glued
together with the blocks of the neighbors.
The original and cropped images are compared by looking at the
statistical profiles of both versions of the image. If the original was
only compressed with a pure JPEG algorithm without any stegano-
graphic tweaking, the statistical profile should be the same. The
alignment of the grid with the image shouldn't change anything.
If the original image does have some steganographic tweaking in
the coefficients, then the changes will distort some but not all of the
blocks. When these changes are parceled out according to the new,
redrawn grid, they will be averaged out and diminished. The cropped
image should have a statistical profile that's closer to an unaltered
image than the original.
In comparing the images, Fridrich constructs first- and second-
order histograms of the low-order frequencies. The middle and
higher frequencies are oftenmuch less common and so they become
less significant. “Most steganographic techniques in some sense add
entropy to the array of quantized [JPEG] coefficients and thus are
more likely to increase the variation
×
V
than decrease [it]”, concludes
Fridrich.[Fri04]
17.7 Summary
For every steganographic algorithm, theremay be a formof steganal-
ysis that detects it. Many of the early algorithms were relatively easy
to detect because they left statistical anomalies. The newest algo-
rithms are much more secure, but only time will tell whether they
are able to withstand sophisticated analysis.
A good open question is whether there can be any solid descrip-
tion of which tweaks change which class of statistics. It would be nice
to report that simply swapping the least significant bits will change
