In case you are wondering how it works: it converts 8-bit chunks of data into 10-chars string, with the normal space as the '1' and non-breaking space as the '0' (the remaining two chars are used for control and to mark begin/end of data). The string is then put back into the message.
There are multiple unicode characters that are whitespace. I have a plugin for IntelliJ just to spot these darn things. So you could actually encode more.
Also of course there are multiple .'s and ;'s in unicode so you could encode more data in punctuation characters like them.
Is anyone aware of legally (US and/or British law, specifically) "strong" stenographic techniques? Meaning a court would allow that this object is assigned to this person because of a stenographic key embedded in the object?
I suspect that the common law legal systems would approach this via case law. Unless case law exists already I think that if you wanted to claim ownership of a file you'd need to present your case including expert witnesses and persuade a judge/jury of its validity.
It's been a long time since I read it, but if I recall correctly, the UK government has been encoding the identity of the receiver of highly sensible information in this fashion for a long time. Probably it is SOP by now in most environments where truly important secrets are exchanged.
The author, Stephen Sykes, submitted a program that encodes a message into the whitespace of another file. Since whitespace doesn't matter in C, he encoded the encoder into the source of the decoder and only submitted the source for the decoder. Neat!
Invisible Secrets [http://www.east-tec.com/invisiblesecrets/] has a mode for this that works quite well on HTML source. Rendering is unchanged and you have to be looking at the source and looking at the spacing to even see the difference manually.
Extremely weak under an active attack: 'sed s/\([^ ]\) */\1 /g'
What you want is something that cannot be easily removed from the message without also affecting the meaning of the cover message. I am thinking of some sort of encoding that uses orthographic errors that are not trivial to fix automatically (e.g. substitute words with valid homophones, instead of changing individual characters). That would be still easy to detect, so you probably need a very low bandwidth channel to make it indistinguishable from a typical text with mistakes.
Doing this with multimedia is probably far easier.
16 comments
[ 4.4 ms ] story [ 55.3 ms ] threadTool called Whitespace used to encrypt messages
Also of course there are multiple .'s and ;'s in unicode so you could encode more data in punctuation characters like them.
This could be useful to see who leaked a script, for example.
I suspect that the common law legal systems would approach this via case law. Unless case law exists already I think that if you wanted to claim ownership of a file you'd need to present your case including expert witnesses and persuade a judge/jury of its validity.
It's been a long time since I read it, but if I recall correctly, the UK government has been encoding the identity of the receiver of highly sensible information in this fashion for a long time. Probably it is SOP by now in most environments where truly important secrets are exchanged.
https://github.com/c00kiemon5ter/ioccc-obfuscated-c-contest/...
The author, Stephen Sykes, submitted a program that encodes a message into the whitespace of another file. Since whitespace doesn't matter in C, he encoded the encoder into the source of the decoder and only submitted the source for the decoder. Neat!
Invisible Secrets [http://www.east-tec.com/invisiblesecrets/] has a mode for this that works quite well on HTML source. Rendering is unchanged and you have to be looking at the source and looking at the spacing to even see the difference manually.
http://www.metafilter.com/154087/Zalgo-text-would-be-kinder#...
What you want is something that cannot be easily removed from the message without also affecting the meaning of the cover message. I am thinking of some sort of encoding that uses orthographic errors that are not trivial to fix automatically (e.g. substitute words with valid homophones, instead of changing individual characters). That would be still easy to detect, so you probably need a very low bandwidth channel to make it indistinguishable from a typical text with mistakes.
Doing this with multimedia is probably far easier.