Steganography: The Science of Hidden Information

In 2013, I published a steganography application named Köker GizliBilgi. It concealed entered text inside an image. My first experiment hid the phrase “Ne Mutlu Türküm Diyene” in an image of the Turkish flag.

The initial method caused visible degradation in the image. By applying digital image-processing techniques and optimizing the algorithm, I was able to conceal information without visibly damaging the image and without making the modification perceptible to the human eye. I then adapted the algorithm to audio files and added encryption of the concealed data.

At the time of writing, I was also working on a more unusual file-within-file hiding algorithm. The planned release was intended to include three different concealment techniques.

This topic grew out of Köker GizliBilgi 1.0, a steganography application developed in 2013. It initially hid text in image files; the embedding method was subsequently improved to reduce visible distortion, adapted to audio files, and extended with password protection. The technical framework below places that implementation in the context of digital forensics and modern steganalysis.

Information Hiding in Popular Culture

Steganography was mentioned in the television series Kanıt and the film A Beautiful Mind.

In an episode of Kanıt, Prof. Sevil Atasoy described information-hiding methods used by photocopier manufacturers. These machines print very small marks on each document. The marks can contain information such as the machine serial number and printing date, helping investigators address document forgery.

The word steganography comes from Ancient Greek and means “concealed writing.” It has an important place in digital forensics. Its greatest advantage is that the existence of the hidden information may not be noticed.

Steganography from the Past to the Present

Steganography was used both before and after the development of modern cryptology. In Ancient Greece, messages were written on wooden tablets and covered with wax. The object appeared to be an unused writing tablet, while melting the wax revealed the concealed message.

According to a story recounted by Herodotus, before a Persian attack a warning was written on the shaved scalp of an enslaved messenger. The message was concealed after the hair grew back, allowing it to reach its destination without attracting attention. The hair was then shaved again so the warning could be read.

During the Second World War, an agent named Velvalee Dickinson operated in New York under the cover of a doll dealer. Information about the United States military was hidden in letters that appeared to contain doll orders.

A simple steganography technique can also be implemented with inks and pens that are visible only under ultraviolet light.

Basic Model

A steganographic system has three basic components:

• the message to be concealed,
• the carrier data,
• the embedding and extraction method.

If a key is used, embedding locations or transform parameters can be derived from it. The resulting carrier is commonly called the stego object.

Spatial and Transform Domains

One of the simplest image methods modifies low-order bits of pixel components. This can provide high capacity but is fragile under compression, resizing, and statistical analysis.

With lossy formats such as JPEG, embedding can instead operate on transform coefficients such as DCT values. Audio and video can also use frequency coefficients, phase, echo, or timing. If the method is not compatible with the carrier's encoding chain, an ordinary re-encoding operation can destroy the hidden data.

Capacity, Imperceptibility, and Robustness

Steganographic design balances three objectives:

• capacity: how much information can be carried,
• imperceptibility: how little perceptual or statistical evidence is introduced,
• robustness: how well the hidden information survives transformation and corruption.

Increasing capacity changes more of the carrier distribution. Making a mark more robust can also make it easier to detect. One method rarely maximizes all three objectives simultaneously.

Steganalysis

Steganalysis asks whether a carrier contains concealed information and, when possible, attempts to recover it. File size, metadata, color histograms, low-bit distributions, transform-coefficient statistics, residual noise, and encoder fingerprints can provide evidence.

In digital forensics the first step is not merely to search for a secret message. File provenance, acquisition history, hashes, and re-encoding history should be preserved. An analysis tool that modifies the evidence can compromise the evidential chain.

Security Boundary

Keeping the embedding algorithm secret is not sufficient security. The design should remain resistant when the method is known and the key is not. If the concealed message is also protected by authenticated encryption, exposure of the steganographic channel does not automatically expose plaintext or integrity.

Steganography does not eliminate traffic analysis, endpoint compromise, or key leakage. How the carrier is distributed and the communication pattern around it can still reveal information.

Implementation Notes

A reliable implementation constrains carrier capacity, handles key derivation correctly, validates the output format, and supports deterministic test vectors. Robustness tests should cover realistic transformations such as recompression, scaling, cropping, noise, and format conversion. Claims of invisibility are stronger when supported by measured detectability and extraction error rates rather than visual inspection alone.

Hiding by Carrier Type

In steganography, the carrier determines which modifications can plausibly appear natural. The same embedding rule does not behave equally across different media.

Text: spacing, character choice, line layout, or formatting differences can carry information. Capacity is low and ordinary reformatting can destroy the hidden channel.

Images: low-order bits of pixel components, palette structure, or transform coefficients can be used. Pixel-domain methods are practical in lossless images, whereas lossy formats such as JPEG require the re-encoding behavior to be considered explicitly.

Audio: low-order sample bits, phase, spectral coefficients, or echo-like structures can serve as carriers. Perceptual masking may exploit the fact that the ear is not equally sensitive to every change, but codec conversion or resampling can destroy the embedded structure.

Video: in addition to image and audio channels, temporal relations across frames can carry information. Re-encoding, frame dropping, and scaling constrain robustness.

A regular modification that disturbs the carrier's natural statistics can become a steganalysis feature even when it is not perceptible to a human observer.

Logic of Least-Significant-Bit Embedding

In an eight-bit pixel component, changing the least significant bit alters the numerical value by only one. LSB embedding uses these small changes to distribute message bits across carrier samples.

For example, if a channel value is:

10110110

and its lowest-order bit is changed to 1, the result is:

10110111

The visual difference can be very small, but changing many pixels according to the same rule can leave a statistical trace.

Capacity depends on the number of channels used, the number of modified bits per sample, and the carrier size. Filling every available bit is rarely a good objective. Message length, placement strategy, and the carrier distribution should be considered together.

The same principle can be applied to grayscale and color images with different channel layouts. Keyed pseudo-random placement may leave less regular structure than sequential placement, but security should not depend on keeping the embedding algorithm secret.

Watermarking and Steganography

Digital watermarking and steganography can use similar technical mechanisms, but their objectives differ. Steganography prioritizes concealing the existence of a secret communication. Watermarking associates ownership, provenance, integrity, or tracking information with a carrier, and many applications expect the mark to survive re-encoding or limited editing.

An invisible watermark is therefore not automatically steganography. Evaluation should distinguish whether the mark can be detected, which transformations it survives, and whether the information it carries can be authenticated.

References

• **[1]** Fabien A. P. Petitcolas; Ross J. Anderson; Markus G. Kuhn. (1999). Information Hiding - A Survey. Proceedings of the IEEE, 87(7), 1062-1078. doi:10.1109/5.771065