OpenPuff
Encyclopedia
OpenPuff Steganography and Watermarking, sometimes abbreviated OpenPuff or Puff, is a freeware
steganography tool for Microsoft Windows
created by Cosimo Oliboni and still maintained as independent software. The program is notable for being the first steganography tool
(version 1.01 released on December 2004) that:
Last revision supports a wide range of carrier formats
The advantage of steganography
, over cryptography alone, is that messages do not attract attention to themselves. Plainly visible encrypted messages — no matter how unbreakable — will arouse suspicion, and may in themselves be incriminating in countries where encryption is illegal. Therefore, whereas cryptography protects the contents of a message, steganography can be said to protect both messages and communicating parties.
Watermarking
is the action of signing a file with an ID or copyright mark. OpenPuff does it in an invisible steganographic way, applied to any supported carrier. The invisible mark, being not password protected, is accessible by everyone (using the program).
Cryptograhpic algorithms (16 taken from AES
, NESSIE
and CRYPTREC
) are joined into a unique multi-cryptography algorithm:
1. Choosing the cryptography algorithm for data block i
f [ i ] = rand ( Oracle )
2. Applying cryptography to data block i
Cipher ( D [ i ] ) = f [ i ] ( D [ i ] )
are conflicting trade-offs.
[Security vs. Performance]: Whitening
[Security vs. Steganalysis]: Cryptography + Whitening
Data, before carrier injection, is encrypted and whitened: a small amount of hidden data turns into a big chunk of pseudorandom "suspicious data". Carrier injection encodes it using a non linear covering function that takes also original carrier bits as input. Modified carriers will need much less change (Con1) and, lowering their random-like statistical response, deceive many steganalysis tests (Con2).
want to keep confidential, and reveal it to the attacker, claiming that this is all there is.
Freeware
Freeware is computer software that is available for use at no cost or for an optional fee, but usually with one or more restricted usage rights. Freeware is in contrast to commercial software, which is typically sold for profit, but might be distributed for a business or commercial purpose in the...
steganography tool for Microsoft Windows
Microsoft Windows
Microsoft Windows is a series of operating systems produced by Microsoft.Microsoft introduced an operating environment named Windows on November 20, 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces . Microsoft Windows came to dominate the world's personal...
created by Cosimo Oliboni and still maintained as independent software. The program is notable for being the first steganography tool
Steganography tools
A steganography software tool implements a subset of the most general digital steganography process, allowing users to insert and extract hidden data into and from carrier files.-Architecture:...
(version 1.01 released on December 2004) that:
- lets users hide data in more than a single carrier file. When hidden data are split among a set of carrier files you get a carrier chain, with no enforced hidden data theoretical size limit (256MB, 512MB, ... depending only on the implementation)
- implements 3 layers of hidden data obfuscationObfuscationObfuscation is the hiding of intended meaning in communication, making communication confusing, wilfully ambiguous, and harder to interpret.- Background :Obfuscation may be used for many purposes...
(cryptographyCryptographyCryptography is the practice and study of techniques for secure communication in the presence of third parties...
, whiteningDecorrelationDecorrelation is a general term for any process that is used to reduce autocorrelation within a signal, or cross-correlation within a set of signals, while preserving other aspects of the signal. A frequently used method of decorrelation is the use of a matched linear filter to reduce the...
and encoding) - extends deniable cryptographyDeniable encryptionIn cryptography and steganography, deniable encryption is encryption that allows its users to convincingly deny that the data is encrypted, or that they are able to decrypt it. Such convincing denials may or may not be genuine. For example, although suspicions might exist that the data is...
into deniable steganography
Last revision supports a wide range of carrier formats
- Images BmpWindows bitmapThe BMP File Format, also known as Bitmap Image File or Device Independent Bitmap file format or simply a Bitmap, is a Raster graphics image file format used to store bitmap digital images, independently of the display device , especially on Microsoft Windows and OS/2 operating systems.The BMP...
, Jpg, Png, TgaTruevision TGATruevision TGA, often referred to as TARGA, is a raster graphics file format created by Truevision Inc. . It was the native format of TARGA and VISTA boards, which were the first graphic cards for IBM-compatible PCs to support Highcolor/truecolor display... - Audios AiffAIFFAudio Interchange File Format is an audio file format standard used for storing sound data for personal computers and other electronic audio devices...
, Mp3MP3MPEG-1 or MPEG-2 Audio Layer III, more commonly referred to as MP3, is a patented digital audio encoding format using a form of lossy data compression...
, WavWAVWaveform Audio File Format , is a Microsoft and IBM audio file format standard for storing an audio bitstream on PCs... - Videos 3gp3GP3GP is a multimedia container format defined by the Third Generation Partnership Project for 3G UMTS multimedia services. It is used on 3G mobile phones but can also be played on some 2G and 4G phones....
, Mp4, Mpeg IMPEG-1MPEG-1 is a standard for lossy compression of video and audio. It is designed to compress VHS-quality raw digital video and CD audio down to 1.5 Mbit/s without excessive quality loss, making video CDs, digital cable/satellite TV and digital audio broadcasting possible.Today, MPEG-1 has become...
, Mpeg IIMPEG-2MPEG-2 is a standard for "the generic coding of moving pictures and associated audio information". It describes a combination of lossy video compression and lossy audio data compression methods which permit storage and transmission of movies using currently available storage media and transmission...
, VobVOBA VOB file is a container format in DVD-Video media. VOB can contain video, audio, subtitle, menu and navigation contents multiplexed together into a stream form. VOB is based on the MPEG program stream format, but with additional limitations and specifications in the private streams... - Flash-Adobe FlvFLVFlash Video is a container file format used to deliver video over the Internet using Adobe Flash Player versions 6–11. Flash Video content may also be embedded within SWF files. There are two different video file formats known as Flash Video: FLV and F4V. The audio and video data within FLV files...
, Pdf, SwfSWFSWF is an Adobe Flash file format used for multimedia, vector graphics and ActionScript. Originating with FutureWave Software, then transferred to Macromedia, and then coming under the control of Adobe, SWF files can contain animations or applets of varying degrees of interactivity and function.,...
Use
OpenPuff is used primarily for anonymous asynchronous data sharing:- the sender hides a hidden stream inside some public available carrier files (password + carrier files + carrier order are the secret key)
- the receiver unhides the hidden stream knowing the secret key
The advantage of steganography
Steganography
Steganography is the art and science of writing hidden messages in such a way that no one, apart from the sender and intended recipient, suspects the existence of the message, a form of security through obscurity...
, over cryptography alone, is that messages do not attract attention to themselves. Plainly visible encrypted messages — no matter how unbreakable — will arouse suspicion, and may in themselves be incriminating in countries where encryption is illegal. Therefore, whereas cryptography protects the contents of a message, steganography can be said to protect both messages and communicating parties.
Watermarking
Digital watermarking
Digital watermarking is the process of embedding information into a digital signal which may be used to verify its authenticity or the identity of its owners, in the same manner as paper bearing a watermark for visible identification. In digital watermarking, the signal may be audio, pictures, or...
is the action of signing a file with an ID or copyright mark. OpenPuff does it in an invisible steganographic way, applied to any supported carrier. The invisible mark, being not password protected, is accessible by everyone (using the program).
Multi-cryptography
OpenPuff is a semi open source program:- cryptography, CSPRNG, hashingCryptographic hash functionA cryptographic hash function is a deterministic procedure that takes an arbitrary block of data and returns a fixed-size bit string, the hash value, such that an accidental or intentional change to the data will change the hash value...
(used in password hexadecimal extension), and scrambling are open source
Cryptograhpic algorithms (16 taken from AES
Advanced Encryption Standard process
The Advanced Encryption Standard , the block cipher ratified as a standard by National Institute of Standards and Technology of the United States , was chosen using a process markedly more open and transparent than its predecessor, the aging Data Encryption Standard...
, NESSIE
NESSIE
NESSIE was a European research project funded from 2000–2003 to identify secure cryptographic primitives. The project was comparable to the NIST AES process and the Japanese Government-sponsored CRYPTREC project, but with notable differences from both...
and CRYPTREC
CRYPTREC
CRYPTREC is the Cryptography Research and Evaluation Committees set up by the Japanese Government to evaluate and recommend cryptographic techniques for government and industrial use...
) are joined into a unique multi-cryptography algorithm:
- keys and internal static data are initialized for each algorithm f
- each data block D [ i ] (128bit) will be encrypted using a different algorithm f [ i ]
- f [ i ] is chosen with a pseudorandom oracleRandom oracleIn cryptography, a random oracle is an oracle that responds to every query with a random response chosen uniformly from its output domain, except that for any specific query, it responds the same way every time it receives that query...
, seeded with a second independent password
1. Choosing the cryptography algorithm for data block i
f [ i ] = rand ( Oracle )
2. Applying cryptography to data block i
Cipher ( D [ i ] ) = f [ i ] ( D [ i ] )
Statistical resistance
Extensive testing has been performed on the statistical resistance properties of the CSPRNG and multi-cryptography modules, using the ENT, NIST and DIEHARD test suites. Provided results are taken from 64KB, 128KB, ... 256MB samples:- bit entropy test: >7.9999xx / 8.000000
- compressionData compressionIn computer science and information theory, data compression, source coding or bit-rate reduction is the process of encoding information using fewer bits than the original representation would use....
test: 0% size reduction after compression - chi square distributionPearson's chi-squared testPearson's chi-squared test is the best-known of several chi-squared tests – statistical procedures whose results are evaluated by reference to the chi-squared distribution. Its properties were first investigated by Karl Pearson in 1900...
test: 40% < deviation < 60% - mean value test: 127.4x / 127.5
- Monte CarloMonte Carlo methodMonte Carlo methods are a class of computational algorithms that rely on repeated random sampling to compute their results. Monte Carlo methods are often used in computer simulations of physical and mathematical systems...
test: error < 0.01% - serial correlationAutocorrelationAutocorrelation is the cross-correlation of a signal with itself. Informally, it is the similarity between observations as a function of the time separation between them...
test: < 0.0001
Steganalysis resistance
Security, performance and steganalysis resistanceSteganalysis
Steganalysis is the art and science of detecting messages hidden using steganography; this is analogous to cryptanalysis applied to cryptography.- Overview :...
are conflicting trade-offs.
[Security vs. Performance]: Whitening
- Pro: ensures higher data security
- Pro: allows deniable steganography
- Con1: requires a lot of extra carrier bits
[Security vs. Steganalysis]: Cryptography + Whitening
- Pro: ensure higher data security
- Con2: their randomPseudorandom number generatorA pseudorandom number generator , also known as a deterministic random bit generator , is an algorithm for generating a sequence of numbers that approximates the properties of random numbers...
statistical response marks carriers as more "suspicious"
Data, before carrier injection, is encrypted and whitened: a small amount of hidden data turns into a big chunk of pseudorandom "suspicious data". Carrier injection encodes it using a non linear covering function that takes also original carrier bits as input. Modified carriers will need much less change (Con1) and, lowering their random-like statistical response, deceive many steganalysis tests (Con2).
Deniable steganography
There will always be a unnegligible probability of being detected even if your hidden stream behaves like a “natural container” (unpredictable side-effects, you're caught Flagrante delicto, ...). Resisting also these unpredictable attacks is possible, even when you will be enforced (by legal or physical coercion) to provide a valid password. Deniable steganography (a decoy based technique) allows to convincingly deny the fact that sensible data is being hidden. You only have to provide some expendable decoy data, that you would plausiblyPlausible deniability
Plausible deniability is, at root, credible ability to deny a fact or allegation, or to deny previous knowledge of a fact. The term most often refers to the denial of blame in chains of command, where upper rungs quarantine the blame to the lower rungs, and the lower rungs are often inaccessible,...
want to keep confidential, and reveal it to the attacker, claiming that this is all there is.
See also
- Steganography toolsSteganography toolsA steganography software tool implements a subset of the most general digital steganography process, allowing users to insert and extract hidden data into and from carrier files.-Architecture:...
- Portable applicationPortable applicationA portable application , sometimes also called standalone, is a computer software program designed to run independently from an operating system...
- List of portable software