Edu

Cryptography, part 2: steganography

An encrypted message gets noticed. A well-hidden one does not. Steganography through a story from Herodotus: a slave, a shaved head and a revolt.

Istieo e lo schiavo con la testa rasata, illustrazione

This is the second part of our series on cryptography. In the first part we made a message unreadable with Caesar's cipher, but an unreadable message still gets noticed. Here we look at how to hide it altogether.

Hiding the message, not the meaning

Steganography hides the very fact that a message exists, while cryptography hides its content. The name comes from the Greek steganós, “covered”, and graphía, “writing”: covered writing. If nobody suspects anything, nobody looks.

The two techniques do not exclude each other: they help each other. You encrypt the message and then blend it into the background noise of a file, such as an image or an audio recording. A well-encrypted text looks random, and randomness goes unnoticed among noise: for those hunting for hidden messages (steganalysis) it becomes much harder to tell it apart from everything else. Whoever finds it cannot read it and, before that, does not even know it is there. As early as 1998, the computer scientists Neil Johnson and Sushil Jajodia, in an article in the journal IEEE Computer about hiding information in images, pointed out that steganography alone does not guarantee secrecy.

The term first appears in 1499, in the Steganographia by Johannes Trithemius, a treatise on cryptography disguised as a book of magic. The practice is far older, and its best example comes from Herodotus.

The slave with a message on his head

In 499 BC, Histiaeus wanted to push Aristagoras, in Miletus, to rise against the Persians. The problem was getting the order through without the guards intercepting it: a letter, even an encrypted one, would have raised suspicion and could have fallen into enemy hands.

So Histiaeus picked the slave he trusted most and shaved his head. He marked the message on the scalp and waited for the hair to grow back. Then he sent him to Miletus with a single instruction to pass on: “Have your head shaved and look.”

Along the road there was nothing to find: a man with a full head of hair, no letters, no seals, no note to encrypt. For anyone who did not know the trick, the message simply did not exist. Only Aristagoras knew where to look.

Histiaeus’s message was not encrypted: it held out as long as nobody suspected it existed. Once the trick was discovered, the text could be read at once. That is why cryptography, which protects the content, is the natural complement to steganography.

Your turn: two puzzles

Puzzle 1. Put yourself in Aristagoras’s place. The servant has reached Miletus, you have shaved his head and now you look at it from above: a stretch of skin-colored dots. Histiaeus’s message is in there somewhere. Can you read it?

A shaved head seen from above, covered in skin-toned dots of different shades

A hint: move away from the screen or squint, and look for the darker, reddish dots.

Puzzle 2. Histiaeus sends a second message, this time on a papyrus, with two protections at once. He encrypted the text with ROT13, the cipher from the first part, and then hid it among the dots. First find the letters, then decrypt them.

A papyrus covered in sand-colored dots of different shades

A hint: ROT13 shifts every letter by 13 places, and applied twice it brings you back to the original text.

Solutions

Don’t look before you have tried.

  1. The reddish dots spell the word REVOLT, the message Histiaeus wanted to deliver to Aristagoras.
  2. The dark dots spell ZVYRGHF. With ROT13 it becomes MILETUS.

No letter was written on top of the images: the letters are inside them, made of dots almost identical to those in the background. As with the slave, you only need to know where to look.

ROT13, however, is just a game: the encrypted text keeps the letter frequencies of English and does not look like noise. To blend in with noise for real you need a modern cipher, which produces text indistinguishable from random. In the next installment the key takes center stage, with a cipher that no longer falls to frequency analysis.

Sources

CoinBack is a rewards platform, not a financial adviser. CBK is a reward, not an investment: crypto-assets are volatile and can lose all their value. We earn commissions from the merchants listed on this site.