Perfectly secure steganography: Hiding information in the quantum noise of a photograph

We show that it is possible to hide information perfectly within a photograph. The proposed protocol works by selecting each pixel value from two images that differ only by shot noise. Pixel values are never modified, but only selected, making the resulting stego image provably indistinguishable from an untampered image, and the protocol provably secure. We demonstrate that a perfect steganographic protocol is also a perfectly secure cryptographic protocol, and therefore has at least the same requirements: a truly random key as long as the message. In our system, we use a second image as the key, satisfying length requirements, and the randomness is provided by the naturally occurring quantum noise which is dominant in images taken with modern sensors. We conclude that, given a photograph, it is impossible to tell whether it contains any hidden information.

Figure 1

Illustration of a generic image steganography protocol:. Alice embeds the cleartext in a photograph to form a stego image. This image is published where Bob can find it. Bob then extracts the cleartext from the image.

Figure 2

Histogram of the pixel values of a homogenous area of a photograph (a) and the obvious effects of encoding encrypted data on the Least significant bit of each pixel (b). The effect is visible even if the probability of the least significant digit being 1 is exactly 0.5.

Figure 3

Illustration of the proposed protocol. First, Alice and Bob meet. Alice takes two “identical” photographs $K$ and $C$ and gives a copy of $K$ to Bob as a key. They then separate. At a later date, Alice encodes her cleartext with the help of the key image $K$ and the cover image $C$ into a stego image $S$. She then published this stego image where Bob can retrieve it. With $K$ and $S$ in hand, Bob is able to extract the cleartext from $S$.

Figure 4

Illustration of the full algorithm. The original text (1) is Reed-Solomon encoded (2). Each character is placed at a pseudorandom position in the image with a mixing step (3). The data are converted to binary and padded as to fit the image extents (4). All these steps are “preprocessing”; we consider the binary string obtained after step (4) as being the cleartext. Step (5) shows steganographic encoding by choosing each pixel of the stego image $S$ from either $K$ or $C$ depending on the cleartext value being 0 or 1, respectively. The following steps are performed by Bob. He compares $S$ with his key image $K$, to recover the cleartext $T^{*}$ (6). Note that step (5) cannot be fully reversed by step (6), due to the probability that $K_i=C_i$. The extracted $T^{*}$ therefore contains errors, which are recovered during a Reed-Solomon step (9) to yield the original text (10).

Figure 5

The three actual photographs as used in the proof-of-principle experiment. A printed circuit board was chosen as it goes towards satisfying our assumption of a static subject and presents a high-contrast image with some saturated pixels, which will therefore have the same value in pictures $K$ and $A$, and test the error-correction code.

Figure 6

Bayer pattern, used in most color image sensors. Each pixel only measures a single color channel, its full RGB value is extrapolated from adjacent pixels (“debayering”), however, the value of its own color channel is not modified by the algorithm, e.g., the $R$ value of a red pixel is not affected by debarring.

Figure 7

Illustration of how the protocol might work for JPEG-compressed images. Instead of using the images pixel by pixel, the protocol would use blocks of $16\times 16$ pixels, corresponding to the native JPEG processing size. Alice would choose a RAW block either from RAW data $K$ or $C$, to encode a “0” or a “1,” respectively. To decode the message, Bob would compare the image to his key image (also JPEG) block by block.

Figure 8

Autocorrelation between adjacent pixels. “Pixel lag” is the distance between pixels. Here, the autocorrelation is calculated over the subtraction of two consecutive images, to cancel out any static image feature. The curve labeled “theory” represents the same process applied to images generated using a pseudorandom Poisson distribution, and are used to evaluate the finite sample effects.

Figure 9

Representation of the mean difference between corresponding pixels of two consecutive images, normalized to the expected quantum deviation, which is the square root of the photon number absorbed by the pixel. The mean normalized deviation is $1.05\pm 0.1$.