A One-Time Stegosystem and Applications to Efficient Covert Communication

Aggelos Kiayias; Yona Raekow; Alexander Russell; Narasimha Shashidhar

doi:10.1007/s00145-012-9135-4

Journal of Cryptology

January 2014, Volume 27, Issue 1, pp 23–44 | Cite as

A One-Time Stegosystem and Applications to Efficient Covert Communication

Authors
Authors and affiliations

Aggelos Kiayias
Yona Raekow
Alexander Russell
Narasimha ShashidharEmail author

Article

First Online: 25 October 2012

Received: 05 January 2011

2 Shares
451 Downloads
2 Citations

Abstract

We present the first information-theoretic steganographic protocol with an asymptotically optimal ratio of key length to message length that operates on arbitrary covertext distributions with constant min-entropy. Our results are also applicable to the computational setting: our stegosystem can be composed over a pseudorandom generator to send longer messages in a computationally secure fashion. In this respect our scheme offers a significant improvement in terms of the number of pseudorandom bits generated by the two parties in comparison to previous results known in the computational setting. Central to our approach for improving the overhead for general distributions is the use of combinatorial constructions that have been found to be useful in other contexts for derandomization: almost t-wise independent function families.

Key words

Information hiding Steganography Data hiding Steganalysis Covert communication

This is a preview of subscription content, to check access.

Appendix A. Error-Correcting Codes

In this section, we provide the proof for Theorem 1 from Sect. 2.2.

Theorem 14

(Based on Shannon [11, 12], Forney [3])

For any p∈[1/4,1/2] and any R<1−H(p), there is an efficient (R,p,ϵ)-code for which there is θ∈[0,1],n ₀∈ℕ such that ϵ≤2^−θn/logn for any n≥n ₀. Furthermore, we have θ ⁻¹=Θ(Z ⁻¹) and logn ₀=Θ(Z ⁻²logZ ⁻¹) as Z→0 where Z=1−H(p)−R.

Proof

We provide the details below of the classic construction for such error-correcting codes E based on concatenated codes. In the standard notation used for codes, q stands for the alphabet size, n for the block length, k for the message length (where |C|=q ^k) and d for the minimum distance of the code. A code with the above parameters is called an (n,k,d)_q code and an [n,k,d]_q code if it is linear. Thus, k/n is the rate of the code and d/n is the relative distance.

Here, we take advantage of the concatenation C ₁⋅C ₂ of two codes C ₁ and C ₂, called the “outer” and “inner” code, respectively. The procedure is as follows:

Open image in new window

The alphabet of the outer code is in one-to-one correspondence with the codewords of the inner code. Given a message in Q ^K, first apply C ₁ onto this message to get a string s∈Q ^N. Then, on every symbol of s, viewed as a message in q ^k, apply C ₂ and concatenate the results. The resulting codeword is C ₂(s ₁)⋅C ₂(s ₂)⋯C ₂(s _N) and the resulting code has Q ^K=(q ^k)^K=q ^kK messages. The length of the codewords is nN and the distance of concatenation is at least dD. Hence,

$$C_1\cdot C_2 = (N,K,D)_{q^{k}}\cdot (n,k,d )_q \Rightarrow (nN,kK,dD )_q. $$

This operation was due to Forney [3]. We now show how we implement Forney’s code for constructing an asymptotically good code.

The inner code. In the inner-code schema, we will be transmitting binary strings of length n ₁=c⋅logn over a binary symmetric channel with cross-over probability p∈[1/4,1/2].

The encoding schema uses a set $\mathcal{C}$ of $2^{\lfloor r n_{1} \rfloor}$ random codewords drawn from $\{0,1\}^{n_{1}}$ where r is a parameter to be determined later that corresponds to the rate of the inner code. These codewords are mapped arbitrarily to the elements of $\{0,1\}^{\lfloor r n_{1}\rfloor}$. The decoding procedure is a maximum-likelihood decoder: given a received word, the message corresponding to the codeword closest to it, is determined and returned, with ties broken arbitrarily.

We next analyze the probability the decoding procedure fails. In what follows $e \in \{0,1\}^{n_{1}}$ is selected at random such that Pr[e _i=1]=p; we would like to bound the probability Pr[c _i⊕e is closest to c _i] from below. Note that Pr[c _i⊕e is closest to c _i]=Pr[d(c _i⊕e,c _i)<d(c _i⊕e,c _j)] for all c _j with j≠i, where d is the Hamming distance. Without loss of generality, we can let c _i=0 and proceed as follows. Pr[e is closest to 0] = $1 - \Pr[\hbox{Some}\ c\in \mathcal{C}\ \hbox{is closer to}\ \vec{e}\ \hbox{than}\ \mathbf{0}]$. To this end, let us first proceed to upper bound the probability $\Pr[\hbox{Some}\ c\in \mathcal{C}\ \hbox{is closer to}\ \vec{e}\ \hbox{than}\ \vec{0}]$ which is the decoding error probability of the inner code.

Let |B _w(x)| be the set of words y with d(x,y)≤w. The set B _w(x) is called the ball with radius w and center x. $|B_{w}(x)| = \sum_{0 \leq k \leq w} \binom{n_{1}}{k}$. Let α be a constant with 1/2>α>p.

Open image in new window

Here, |B _i(x)| is the set of words y with d(x,y)≤i. Then, for 0≤α≤1/2,

$$\bigl|B_{\alpha n_1}(x)\bigr| = \sum_{0\leq k\leq \alpha n_1} \binom{n_1}{k} \leq 2^{n_1 H(\alpha)}. $$

Thus,

Open image in new window

Here the final inequality follows from the Chernoff bound.¹ The above indicates that as long as we choose α,r such that α>p and r<1−H(α) we see that the error probability of decoding in the inner code is at most ϵ ₁ provided that

$$n_1\geq \max \bigl\{ 3p \ln\bigl(2 \epsilon_1^{-1} \bigr) (\alpha-p)^{-2}, \log\bigl(2 \epsilon_1^{-1} \bigr) \bigl(1-H(\alpha) -r\bigr)^{-1} \bigr\}. $$

The outer code. We next describe the outer code that is a Reed–Solomon code over the binary extension field $\mathit{GF}(2^{n_{1}})$. The code has length $n_{2} < 2^{n_{1}}$ symbols and is of rate κ. We can correct a number of errors up to a rate of (1−κ)/2. We want to ensure that we can correct the message with probability 1−ϵ. Let u be the number of errors of the inner code. The expected value of u is ϵ ₁ n ₂. We would like to bound the probability p′=Pr[u>(1−κ)n ₂/2]. Applying Chernoff bound and setting $\zeta = \epsilon_{1}^{-1} (1-\kappa)/2 -1$ we have $p'< e^{ - \epsilon_{1} n_{2} ( \epsilon_{1}^{-1}(1-\kappa)/2 -1)^{2} / 3 } \leq \epsilon$ provided that

$$n_2 \geq \ln\bigl( \epsilon^{-1} \bigr) \epsilon_1^{-1} \cdot \bigl(\epsilon_1^{-1} (1-\kappa)/2 - 1\bigr)^{-2}. $$

We may decode the Reed–Solomon code using the Berlekamp–Welch algorithm and in the event that the error rate is greater than (1−κ)/2, the output of the decoding procedure will be a failure symbol ⊥.

The concatenation construction. The objective is to transmit with a given transmission rate R<1−H(p) for a transmission length of n bits while having a decoding error probability of ϵ=e ^−θn/logn for suitable θ (which is independent of n). The recovery of the R⋅n bits of message should be achieved in time polynomial in n. Since we employ a concatenated code with inner-code rate r and the outer code rate κ, we can achieve our objective provided that r=1−H(p)−f ₁, κ=1−f ₂ as long as f ₁+f ₂≤Z where Z=1−H(p)−R for some suitably chosen values f ₁,f ₂∈[0,1].

To account for the fact that the decoding of the inner code is done in a brute-force manner we need that n ₁≤c ₁⋅1/rlogn for some constant c ₁ (as in this case we maintain polynomial-time dependency in n in terms of running time).

Let g ₁<f ₁ be some constant; we set α=H ⁻¹(H(p)+g ₁). Observe that α>p and α<1/2, i.e., this is a valid choice for the selection of α in the inner-code design. Furthermore, we have

$$1-H(\alpha) - r = 1-H(p) -g_1 - \bigl(1 - H(p) - f_1\bigr) = f_1 - g_1\quad \hbox{and}\quad \alpha - p \geq \frac{g_1}{2}. $$

This latter inequality follows from the fact that H(p)+z≥H(p+z/2) for all p∈[1/4,1/2] and z∈[0,1]. Based on the above we may restate the bounds on n ₁ as follows:

$$n_1 \geq \max \bigl\{ 5\cdot \log\bigl(2 \epsilon_1^{-1} \bigr) g_1^{-2}, \log\bigl(2 \epsilon_1^{-1} \bigr) (f_1-g_1)^{-1} \bigr\}. $$

We set g ₁=f ₁/2 and f ₁=Z/2 and we obtain the requirement that $n_{1} = {\varOmega}( Z^{-2}\log \epsilon_{1}^{-1})$. Next observe that (1−κ)/2ϵ ₁−1=f ₂/(2ϵ ₁)−1, by setting f ₂=2ϵ ₁(1+g ₂) for some constant g ₂, the bound on n ₂ can be expressed as

$$n_2 \geq \ln\bigl(\epsilon^{-1}\bigr) \epsilon_1^{-1} g_2^{-2}. $$

Note that assuming f ₂=Z/2 we obtain g ₂=Z/(4ϵ ₁)−1, by setting ϵ ₁=Z/5 we obtain g ₂=1/4. This results in the bound n ₂≥80⋅Z ⁻¹ln(ϵ ⁻¹), i.e., n ₂=Ω(Z ⁻¹log(ϵ ⁻¹)). Combining the above results with the fact that n ₁=O(logn), n=n ₁ n ₂ we find that the error probability is 2^−θn/logn where θ=Θ(Z) assuming that n≥n ₀ where n ₀ is such that logn ₀=Ω(Z ⁻²logZ ⁻¹). □

Appendix B. Lower Bound on Rate Given Upper Bound on Error

Proposition 15

Let 0≤τ<1/4 be a constant. Let R′=1−H(1/2−τ). Then, R′≥τ ². Here, H(⋅) is the Shannon entropy function.

Proof

We want to lower bound the rate R′=1−H(1/2−τ). To this end, let us upper bound H(1/2−τ).

From the definition of Shannon entropy,

$$H\biggl(\frac{1}{2}-\tau\biggr)=- \biggl[ \biggl(\frac{1}{2}-\tau \biggr)\log_{2} \biggl(\frac{1}{2}-\tau \biggr)+ \biggl( \frac{1}{2}+\tau \biggr)\log_{2} \biggl(\frac{1}{2}+\tau \biggr) \biggr]. $$

Rewriting the log terms as below,

Open image in new window

we get

Open image in new window

We now lower bound the terms ln(1+(−2τ)) and ln(1+(2τ)) using the natural logarithm power series:

$$\ln(1+x)=x-\frac{1}{2}x^{2}+\frac{1}{3}x^{3}- \frac{1}{4}x^{4}\ldots\quad (-1<x\leq1). $$

In our case, we have 0≤τ<1/4. So, −1/2<−2τ≤0 and 0≤2τ<1/2.

When −1/2<x≤0,

Open image in new window

When 0≤x<1/2,

$$\ln (1+x )=x-\frac{1}{2}x^{2}+\frac{1}{3}x^{3}- \frac{1}{4}x^{4}\geq x-\frac{1}{2}x^{2}. $$

Hence, we have

Open image in new window

and

Open image in new window

This gives us

$$R^{\prime} = 1-H \biggl(\frac{1}{2}-\tau \biggr) \geq 1- \bigl(1-1.44\tau^{2} \bigr) \geq \tau^{2}. $$

□

References

[1]
N. Alon, O. Goldreich, J. Håstad, R. Peralta, Simple construction of almost k-wise independent random variables. Random Struct. Algorithms 3(3), 289–304 (1992) CrossRefMATHGoogle Scholar
[2]
C. Cachin, An information-theoretic model for steganography. Inf. Comput. 192(1), 41–56 (2004) CrossRefMATHMathSciNetGoogle Scholar
[3]
G.D. Forney, Jr., Concatenated Codes. Research Monograph, vol. 37 (MIT Press, Cambridge 1966) Google Scholar
[4]
O. Goldreich, S. Goldwasser, S. Micali, How to construct random functions. J. ACM 33(4), 792–807 (1986) CrossRefMathSciNetGoogle Scholar
[5]
N.J. Hopper, J. Langford, L. von Ahn, Provably secure steganography, in CRYPTO (2002), pp. 77–92 Google Scholar
[6]
N.J. Hopper, L. von Ahn, J. Langford, Provably secure steganography. IEEE Trans. Comput. 58(5), 662–676 (2009) CrossRefMathSciNetGoogle Scholar
[7]
A. Kiayias, Y. Raekow, A. Russell, Efficient steganography with provable security guarantees, in Information Hiding, ed. by M. Barni, J. Herrera-Joancomartí, S. Katzenbeisser, F. Pérez-González. Lecture Notes in Computer Science, vol. 3727 (Springer, Berlin, 2005), pp. 118–130. ISBN 3-540-29039-7 CrossRefGoogle Scholar
[8]
T. Mittelholzer, An information-theoretic approach to steganography and watermarking, in Information Hiding (1999), pp. 1–16 Google Scholar
[9]
J. Naor, M. Naor, Small-bias probability spaces: Efficient constructions and applications. SIAM J. Comput. 22(4), 838–856 (1993) CrossRefMATHMathSciNetGoogle Scholar
[10]
M. Naor, O. Reingold, Number-theoretic constructions of efficient pseudo-random functions. J. ACM 51(2), 231–262 (2004) CrossRefMATHMathSciNetGoogle Scholar
[11]
C.E. Shannon, A mathematical theory of communication. Bell Syst. Tech. J. 27, 379–423, July and October (1948), also see pp. 623–656 CrossRefMATHMathSciNetGoogle Scholar
[12]
C.E. Shannon, W. Weaver, The Mathematical Theory of Communication (University of Illinois Press, Urbana, 1949) MATHGoogle Scholar
[13]
G.J. Simmons, The prisoners’ problem and the subliminal channel, in CRYPTO (1983), pp. 51–67 Google Scholar
[14]
L. von Ahn, N.J. Hopper, Public-key steganography, in Advances in Cryptology—Proceedings of Eurocrypt ’04 (Springer, Berlin, 2004), pp. 323–341 CrossRefGoogle Scholar
[15]
J. Zöllner, H. Federrath, H. Klimant, A. Pfitzmann, R. Piotraschke, A. Westfeld, G. Wicke, G. Wolf, Modeling the security of steganographic systems, in Information Hiding (1998), pp. 344–354 CrossRefGoogle Scholar

Copyright information

Authors and Affiliations

Aggelos Kiayias
- 1
Yona Raekow
- 2
Alexander Russell
- 1
Narasimha Shashidhar
- 3
Email author

1.Department of Computer Science and EngineeringUniversity of ConnecticutStorrsUSA
2.Fraunhofer Institute for Algorithms and Scientific ComputingSt. AugustinGermany
3.Department of Computer ScienceSam Houston State UniversityHuntsvilleUSA

A One-Time Stegosystem and Applications to Efficient Covert Communication

Abstract

Key words

References

Copyright information

Authors and Affiliations

Personalised recommendations

Cite article