- cypherpunks-legacy@lists.ogf.org

HIDE: embedding msgs into snd & graphics
by The Phantom 11 Mar '93

11 Mar '93

writes uri(a)watson.ibm.com: ---- Yes, a very valid point. But it seems to me, that Random Data claim is the best, with the highest chances to keep one out of trouble (if anything can :-). The algorithm? Oh, sorry, but it's a HARDWARE random data generator! And if it's truly good random gen, there are no patterns to track... One can use it to create huge one-time pads, BTW... "Salt" some of the encrypted (or plaintext :-) messages with those... ---- Yes? Hardware? Well, then, where is the piece of hardware you used, then? It seems this falls to the Big Brother 'where is the algorithm' test even harder, as it is a physical piece of equipment. It seems to me that if I were an agent and I were looking for transmissions from an individual and I saw him sending out 10 copies of the `Rocky & Bullwinkle Show' intro per week, I'd look into those, even though they seem normal enough. When I checksummed them and they didn't match, I'd be more than suspicious: I'd start stripping the lower bits off. If I knew that the suspect used PGP and RIPEM, I'd most certainly try and push the output through them, if they weren't plainly recognizable. Seems to me that the best thing to hide pgp in would be a low-quality host-medium (lots of noise!) that changes frequently, so the checksumming cannot occur against the same message. The low quality could also be attained by pushing more of your message into the host; maybe alternating between the 8th bit and another bit. In any case, I don't think that the host should be a stable one (frequently used) or one that can be easily compared to the original. Matt Matt Thomlinson University of Washington, Seattle, Washington. Internet: phantom(a)u.washington.edu phone: (206) 528-5732 PGP 2.2 key available via email or finger phantom(a)hardy.u.washington.edu

1 0

Re: Hiding Encrypted Messages
by covin＠cs.uchicago.edu 11 Mar '93

11 Mar '93

>Please... I said: "It's as cumbersome, as one-time pad, but >without one-time pad security." Yes, it can be made as >secure as PGP, but it's still less safe, than >one-time pad. I thought the point of hiding the message in a sound or picture file was to *hide* it, not to gain additional encryption. Any encryption you want to do on the message is a separate issue. Hiding the bits is just supposed to keep anyone from *trying* to decrypt it in the first place, and/or to allow you to claim if the message is intercepted that you weren't *really* sending encrypted messages. I suspect that if someone manages to decrypt the message, you just flat-out lose on the "plausible deniability" question. At least, if the message is fairly long, coherent, grammatical, etc. It's just too unlikely that a long coherent message will be hidden in any regular way in an otherwise random sequence of bits. A little statistical analysis might allow some happy government cryptographers to tell you exactly *how* unlikely it is that they'd find a message in your data by chance... As another way to muddy the waters, you might try making the original plaintext a bit muddled, ungrammatical, semi-incoherent, rife with misspellings, etc... :) -David ure that are ahead of the mainstream, oriented towards the near-future. This includes all realms of what is commonly called "new edge", "technoculture", or "cyberculture" -- a mishmash of postmodernism, psychedelics, hacking, raves, cyberspace, industrial music, cyberpunk fiction and realities, etc., that are proving to be important constructs in the evolution of world culture. The file continues to grow and morph, and the initial response to it prompted me to begin the FutureCulture E-List. Those who share an interest in the topics discussed in the file can participate in in-depth or light-hearted discussions via the FutureCulture E-list, which has proven to be an interesting and unique addition to the vastness of cyberspace. Readers and participants in FutureCulture have included at one time or another a wide variety of sociologists and anthropoligists, authors and writers, hackers, scientists, students, and prominent "cyber-" oriented figures. For a long time, I have dismissed print media in wake of the interaction I saw occuring via e-media, such as the FutureCulture list, and I would be one of those to shun society's love affair with paper in wake of advancing computer and networking technologies. Yet through a seemingly unending discussion regarding the scope of the popular phrase "information wants to be free", I have found my love affair with e-media to in fact be quite out of date. That may seem contradictory to some, yet if we are truly to arrive at an infoculture of global real-time interaction via cyberspace, we must first look at the world in which we currently inhabit. We live in a world where paper and television are the informational messangers of choice to the masses. Thus, in an attempt to further propagate information to as wide an audience as possible, I have begun [the] Infinite Edge zine. The zine will be printed in black & white and 8 1/2 x 11", using Macintoshes and laserprinters. Below follows a basic text outline of what [the] Infinite Edge will look like sans graphics and design, of course. I am looking for submissions and assistance with this project from all angles: fiction writers, essayists, ranters, graphic designers, artists, poets, etc. Submissions are welcome in any form, in any style, in any tone, though that is not a guarantee that everything I receive will be printed. I am looking for submisison as soon as possible, but feel free to send them in whenever you like. For first issue, send them in by the end of March. Due to lack of available resources, I am unable as of yet to reward monetarily those who contribute to [the] Infinite Edge. I have little money, and my primary interest is producing the highest-quality zine possible, containg an immense spectrum of information. If you would like to contribute to [the] Infinite Edge in any way, shape, or form, please send all queries, submissions, tips, words of wisdom, etc., to me on the Internet at: ahawks(a)nyx.cs.du.edu If you do not have Internet access, please send mail to: Andy Hawks 4290 South Mobile Cir. #D Aurora, CO 80013 USA By the way, I am looking at offering [the] Infinite Edge at a cost of $3 per issue. The first issue is not completed yet, but if you are anxious, please contact me via email or snail mail. Groovy. [the] Infinite Edge ___________________ Focusing on the Edges of Culture, examining the Fringes of Reason and the Reasons of Fringe, the Here and Now and Soon-to-Be, via unstrcutured Tones that Ebb and Flow from In-Form Information to Formless Rants of Altered States. [the] Infinite Edge is Divided into the following sections: GENESYS Notes from the Editor, Leters from those that Grep and/or Grok the Infinite Edge. 32-BIT Soundbytes of the World, Unite and Take Over. Blurbs pertaining to interesting news and products, quotes, technology, factoids, etc. MODERN Cultural Commentary - Realizing, Focusing, and Morphing the PostModern World. Rants, Essays, Theses, Observations, Predictions, Analyses, Streams and Rivers of Consciousness. -SUB The Depths of the Underground Subcultures. Rants, Essays, Theses, Observations, Predicions, Analyses, and Information. E+ The Virtual World. News, Notes, Notables and Quotables, Rants, Essays, Theses, Observations, Predictions, Analyses, Communication, Teknologies. VILLAGE VIEWS Interviews (I-Views) and E-Views with those who Surf, Ride, Make and Break the Edges of Culture. STREAMZ Fiction on The Edge: Transreal, Hyperreal, SlipStream, Cyberpunk, Post-Cyberpunk, [insert_any_word_here], etc. MEDI8 Reviewing, Analyzing, and Commentary regarding Popular and Underground Media: Books, Magazines, Zines, E-Zines, E-Books, Hypertext, Music, Film, Video, Television, Software, etc. MOBIUS One Last Informational Fix, Closing Words, Late-Crashing News, etc. If you would like to contribute to [the] Infinite Edge in any way, shape, or form, please send all queries, submissions, tips, words of wisdom, etc., to me on the Internet at: ahawks(a)nyx.cs.du.edu If you do not have Internet access, please send mail to: Andy Hawks 4290 South Mobile Cir. #D Aurora, CO 80013 USA

1 0

Re: Hiding Encrypted Messages
by tcmay＠netcom.com 11 Mar '93

11 Mar '93

Uri writes about Thug's LSB method: > >a) This method has essentially the same complexity, as one-time pad, > but without it's strength. > >b) If it's played and recognized - one can trace your source (a CD, a > tape of radio broadcast, whatever) and do a comparison. Then the > file containing of all the LSBs is cryptanalyzed... > >I might be wrong IF those nice LSBs are too hard to track... But then >again, you're facing the need to communicate that one-time pad... I've written several pieces for sci.crypt and for the Cypherpunks list about encrypting messages in the LSBs of music--I doubt I was the first, though my first posting on this was in 1988. (A posting on this is included at the end of this message.) Uri's points: a) The idea is to _hide_ the existence of the message, a la steganography. A Digital Audio Tape carried across a border is a whole less obvious than a one time pad of numbers. b) A nearly essential aspect, one I've emphasized repeatedly, is to _not_ use a digital copy of a CD, but rather to use an _analog_ dub. The noise floor (cables, imperfections in the DACs and ADCs, analog circuits) will be well above the LSB, making the message bits virtually indistinguishable from noise. Sophisticate spectral analysis, and entropy analysis, may reveal the message bits to be other than noise, but this will be quite difficult (and some masssaging of the bits will help make their statistics match that of noise). c) Yes, the method is that of the one-time pad. In fact, it's a way to _transport_ one-time pads. Here's one of my postings on this subject: From: tcmay(a)netcom.com (Timothy C. May) Subject: Messages in the Least Significant Bits To: cypherpunks(a)toad.com Date: Tue, 27 Oct 92 19:03:19 PST Cc: tcmay(a)netcom.com (Timothy C. May) Cypherpunks, Here's a message I just posted to another mailing list. It has rather strict policies against cross-posting, so I've edited out the headers and the initial chunk of text I quoted. That should make me kosher. (This topic also came up in some e-mail with George Gleason.) Forwarded message: >From tcmay Tue Oct 27 18:43:34 1992 xxxx is exactly right on this. Several years ago I posted to sci.crypt my "novel" idea for packing bits into the essentially inaudible "least significant bits" (LSBs) of digital recordings, such as DATs and CDs. Ditto for the LSBs in an 8-bit image or 24-bit color image. I've since seen this idea reinvented _several_ times on sci.crypt and elsewhere...and I'm willing to bet I wasn't the first, either (so I don't claim any credit). A 2-hour DAT contains about 10 Gbits (2 hours x 3600 sec/hr x 2 channels x 16 bits/sample x 44K samples/sec), or about 1.2 Gbytes. A CD contains about half this, i.e., about 700 Mbytes. The LSB of a DAT is 1/16th of the 1.2 Gbytes, or 80 Mbytes. This is a _lot_ of storage! A home-recorded DAT--and I use a Sony D-3 DAT Walkman to make tapes--has so much noise down at the LSB level--noise from the A/D and D/A converters, noise from the microphones (if any), etc.--that the bits are essentially random at this level. (This is a subtle, but important, point: a factory recorded DAT or CD will have predetermined bits at all levels, i.e., the authorities could in principle spot any modifications. But home-recorded, or dubbed, DATs will of course not be subject to this kind of analysis.) Some care might be taken to ensure that the statistical properties of the signal bits resemble what would be expected with "noise" bits, but this will be a minor hurdle. Adobe Photoshop can be used to easily place message bits in the "noise" that dominates things down at the LSB level. The resulting GIF can then be posted to UseNet or e-mailed. Ditto for sound samples, using the ideas I just described (but typically requiring sound sampling boards, etc.). I've done some experiments along these lines. This doesn't mean our problems are solved, of course. Exchanging tapes is cumbersome and vulnerable to stings. But it does help to point out the utter futility of trying to stop the flow of bits. --Tim -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP 2.0 and MailSafe keys by arrangement.

1 0

Re: Hiding Encrypted Messages
by Eric Fogleman 11 Mar '93

11 Mar '93

> > 2. Then take an encrypted PGP file and dispurse it bit-by-bit into the > > LSB (least-significant-bit) of each sample. This wouldn't distort the > > sound sample to any extent noticable by the human ear. Thus each byte > > of PGP file would be dispursed into 8 bytes of sound file. Thus if > > you wanted to send a 20k PGP file, you would have to put it into a > > 160k music file. > > If you're ever forced to explain what that file contains (unlikely, since > > you can always take the Fifth Ammendment) you can just play it on your > > computer and have the NSA/SS/FBI/Whatever listen to James Brown go > > "Hyeeeah... I feel good!" > > a) This method has essentially the same complexity, as one-time pad, > but without it's strength. > Insert pgp-encrypted (not plaintext) into the sound file... It's then no weaker that pgp. > b) If it's played and recognized - one can trace your source (a CD, a > tape of radio broadcast, whatever) and do a comparison. Then the > file containing of all the LSBs is cryptanalyzed... Use a "windows sound system" board and record yourself talking -- No "reference source"... The codec on that board has better than two bits of noise per 16 bit word through the ADC channel... Nice idea, thug! =================================================================== Eric Fogleman eric.fogleman(a)analog.com Analog Devices Semiconductor Voice: (617) 937-2275 804 Woburn Street Fax: (617) 937-2024 Wilmington, MA 01887-3462 ===================================================================

2 1

Hiding Encrypted Messages
by thug＠phantom.com 11 Mar '93

11 Mar '93

I think it would be quite easy to hide encrypted text in music/sound or graphics files. In order to do it with sampled music/sound: 1. Use a SoundBlaster-type card to sample a given amount of music from a radio/tape/cd/whatever using 8-bit samples at some low sampling rate like 11,000 samples/second. This would give you a lot of music for the space used. 2. Then take an encrypted PGP file and dispurse it bit-by-bit into the LSB (least-significant-bit) of each sample. This wouldn't distort the sound sample to any extent noticable by the human ear. Thus each byte of PGP file would be dispursed into 8 bytes of sound file. Thus if you wanted to send a 20k PGP file, you would have to put it into a 160k music file. If you're ever forced to explain what that file contains (unlikely, since you can always take the Fifth Ammendment) you can just play it on your computer and have the NSA/SS/FBI/Whatever listen to James Brown go "Hyeeeah... I feel good!" +---------------+ +-------------------------------------------------+ | ***** ___\!/_ * * * * | Murdering Thug | * __/_ /|\ * * * * * | | * / \ * * * * * | thug(a)phantom.com | * | | * * * * | | * \____/ * * * * | | ***** * * * | +---------------+ +-------------------------------------------------+

2 1

PGP Tutorial Gone.
by nobody＠pmantis.berkeley.edu 11 Mar '93

11 Mar '93

soda.berkeley.edu is supposed to have several files reguarding pgp. The problem is that this site is refusing connections. Could we get an alternative site?

2 1

Re: Hidden encrypted messages
by Alexander Chislenko 11 Mar '93

11 Mar '93

What about encoding a message by chnging spacing between the words? It is surely not the most compact method, but one might be able to transmit a pretty long message hidden in the text of "Alice in Wonderland" that would still be neatly formatted and *word-to-word* indistinguishable from the original. Alex.

1 0

FWEE!: Markoff/NYT/VoiceCrypt
by internaut＠aol.com 11 Mar '93

11 Mar '93

Thanks to everyone who sent John Markoff's name, email address and/or past life animal. I'll let all of you know what transpires when I buzz him about the VoiceCrypt article and get some info for the Whistleblower Project. BTW, Pretty amazing day at CFP today (especially the session on Censorship on the 'net): watch this cyberspace for details next week... Not-Entirely-Unrelated note: to all of you who have asked for a FTP-able version of MacPGP, I will provide that this Sunday (the life of a CFP volunteer!). Hope you can all keep your pants on until then. :) It's worth the wait. dave "It's not the voting that makes Democracy, it's the counting." - T. Stoppard

1 0

F-117A Nighthawk post--Conclusions of Experiment
by tcmay＠netcom.com 11 Mar '93

11 Mar '93

J. Michael Diehl guesses the truth: >Lets assume that the poster was a "good-guy," as opposed to just a prankster. > >Then he has pointed out a serious flaw in the WB system. He has demonstrated >the ability for a person to obtain (bonefied) classified information and >broadcast it worldwide, with out any fear of being caught or censored. I >support anonymity, but I wonder about how it will be "regulated" to keep this >from happening for real. > >Comments? Well, I _hope_ I am a good guy, at least by the standards of this list. I posted the F-117A "revelations" about the Stealth fighter, through a series of 6 or 7 remailers (which I first tested, as I like to do, by pinging them all) in order to examine the reactions of the list to what "whistleblowing" acts are very likely to look like. The reactions have been interesting. Some of you got angry, some even practically foamed at the mouth, calling me a "treasonous fool." Fair enough, as I hoped to see this kind of range of opinions. Some points: 1. Nothing in the posting, as some of you observed, was controversial or classified. I took an article from the book, "Stealth Technology: The Art of Black Magic," J. Jones, Aero Books, 1989, and scanned it and OCRed it. A few "probably"s and "could be"s were deleted, and minor other changes were made (e.g., I converted approximate numbers to precise--though of course wrong--numbers). The speculations about supersonic capability were in the original--I can't say how plausible they are. Likewise, the stuff about "changing color" was also in the original (I was trained as physicist--would I make something like that up?). 2. Ironically, the "Discovery Channel" ran an hour-long program, "Nighthawk: Secrets of the Stealth," which was many times more revealing than my post. "Aviation Week and Space Technology," also known as "Aviation Leak and Spy Technology," has also carried far more detailed information over the years. 3. As both Joe Thomas and J. Michael Diehl pointed out, I was "testing" the nascent "whistleblower" system. I decided it would be interesting to guage the reaction of the list to what might at first glance look like classified information being posted--something we can surely expect to see if the "whistleblower" group really gets going. (That, and deliberate misinformation to discredit the group, flames to drown out the actual whistleblowing, illegal or grossly offensive material to try to get the group taken off the Net, etc.) If you folks really want to set such a thing up, better be prepared for all kinds of weird stuff. Of course, the posting of "classified" documents--ersatz though this one may have been (in the sense of not being classified!)--can happen even without the "whistleblower" connotations...any anonymous remailer will work, naturally. But a whistleblower list (which I support, by the way) is going to attract all kinds of strange postings, once publicity is gotten (as it must, else what's the point?). 4. On the appropriateness of defense information as "whistleblower" material, consider these facts: The most serious cases of whistleblowing in the last few years have been on *defense* issues--coast over-runs, weapons systems that failed to work or were unsafe, bribes to DoD or company officials, and so on. This is the fodder for "60 Minutes" and "20/20," who've all run pieces on defective weapons systems, the Bradley Fighting Vehicle, the Apache Helicopter, the "DIVAD" gun, and so on. (Would my article have been any less offensive to some of the censorious among you if I'd fabricated stuff about the Nighthawk not meeting design goals, not being safe to fly, costing too much, etc.? I suspect not.) 5. In most cases, the DoD has tried to limit the scrutiny on such systems by invoking "national security" as a cloak. This, even though the Soviets already had the info--generally far in advance and in much greater detail. The invocation of national security has generally resulted in Americans being ignorant of malfeasance and chicanery. The whole idea of the whistleblowing list is to allow anonymous, untraceable postings of controversial material like this! Much of what is posted will by necessity contain material that someone thinks should not be released to the public. Q.E.D. (or haven't folks thought this one out?). (So if you whistleblower advocates out there are going to get cold feet when seemingly sensitive materials is sent out, you'd better just quit right now!) 6. Paul Robichaux and Dave Deltorto have opined that posts like this should *not* be posted (and tell me how they'll ever be stopped in the real world?), as they invite the attention of the NSA and other TLAs (Three Letter Acronyms). This seems overly paranoid for even this list, given the megabytes of solid info published by Av Leak and other technical mags. If some defense stuff is going to get us shut down, we'd better stop now. (Actually, the problems with the whistleblower's list or group are sufficiently clear that I'd recommend that nobody be _formally_ affiliated with it. If it just "appears," somehow, probably in the alt heierchy, then people can post to it through anonymous remailers.) 7. Speaking of which, a whistleblowers group will likely face attack on several fronts, depending on whose ox is gored. There may in fact be deliberate postings of truly classified material just to cause the group to be shut down (or to cause Internet sites not to carry it, etc.). Some child porn posted anonymously may get nearly any group pulled. Ditto for Holocause revisionism, racist jokes, extortion demands, etc. Consider my little experiment a very benign little "innoculation," a hint of what to expect. 8. Again, I feel we should all be _using_ anonymous remailers to test, or probe, these various ideas we have. Better that we try out a few ideas related to "whistleblowing" in the safety of our own group before launching it out into the world. Of course, now that I've exposed myself as the originator, this may make you all skeptical of posts from "Anonymous" or "Nobody." And you _should_ be skeptical! That's an important part of the whole process. And don't assume everything from "Anonymous" is from me! Cheers, -"Anonymous" aka, Tim May, Cypherpunk, Crypto Anarchist, and Gadfly -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

2 1

Re: FWEE!: F-117A post considered harmful
by Tony Kidson 11 Mar '93

11 Mar '93

In message <9303091453.AA11794(a)lambda.msfc.nasa.gov.msfc.nasa.gov> you write: > [ disclaimer: I don't work on classified projects anymore. My experience > as an aircraft mechanic is with helicopters. I read a lot. ] > > I believe that the recent anonymous "whistle" purporting to reveal > information about the F-117A aircraft: > thing. Disclosing classified information, however- > especially when it's not relevant to revealing fraud, > waste, or abuse- is probably not a good way to keep > the whisteblower group safe from the Three-Letter Gang. > Perhaps that was the idea??? Tony +-----------------+-------------------------------+--------------------------+ | Tony Kidson | ** PGP 2.1 Key by request ** | Voice +44 81 466 5127 | | Morgan Towers, | The Cat has had to move now | E-Mail(in order) | | Morgan Road, | as I've had to take the top | tony(a)morgan.demon.co.uk | | Bromley, | off of the machine. | tny(a)cix.compulink.co.uk | | England BR1 3QE |Honda ST1100 -=<*>=- DoD# 0801 | 100024.301(a)compuserve.com| +-----------------+-------------------------------+--------------------------+

1 0