Music

Music

Music

Music

Music

Music

Alright, so welcome to Multimedia Security.

Last week we started to talk about steganography.

And I'm just going to continue on this today.

So, the goal of steganography is to have a covert channel

through which two parties, A and B, can communicate without being noticed.

So, the difference to cryptography is that in cryptography everyone knows that there is a communication going on.

It's just unreadable.

And in steganography, the communication itself can be encrypted as well,

but the actually important part is to hide the fact that there is a communication going on in the first place.

And this makes sense in scenarios where there is an opponent that is very powerful.

So, the opponent has a lot of control over the whole communication network,

because otherwise if the opponent has less control, then hiding the fact that communication is going on is rather easy.

So, the way to think about steganography is in terms of this prisoner's model.

So, Alice and Bob sit in two cells in prison, and they may exchange stuff, magazines, whatever,

but there's a powerful warden that has nothing to do all day, and he looks at everything that is exchanged.

And if they exchange secret messages, they get in trouble.

So, that is the picture.

Now, thinking about possibilities, like what could be used as a covert channel.

If you think of internet communication, a lot of things come to mind.

For example, if we think of the TCP IP network stack,

then I think it's relatively straightforward to open a covert channel there.

For example, by manipulating this...

What is the name?

Ah, I forgot the term.

There's a counter that shows the packet lifetime.

TLE, total life...

So, in the TCP IP stack, and if you look at the header,

there's the sender IP address, the receiver IP address, and so on and so on.

And there's also a counter that indicates, okay, if this counter is set to zero,

the package should be discarded.

It's part of the routing protocol, because it could be that a package runs in circles.

Do you know what I'm talking about?

TTL, yes, it's time to live, right?

Oh, thank you.

So, you initialize it with something, let's say 200, and then every hop on the network reduces it by one.

And it's part of the protocol that if you actually end up with a zero,

then you should drop the package, because apparently something went wrong.

But typically, how many hops does a package do?

Let's say 10.

So, we could say, if we like to transmit a zero, we initialize our time to live with 100.

If we like to transmit a one, we initialize it with 200.

And then the receiver can see, okay, is the TTL number that I received, is it closer to 100, or is it closer to 200?

And then that is one bit of information.

Things like that.