Re: Steganography and Steganalysis

[gnu (John Gilmore)]

Someone is probably doing steganography in netnews and/or mailing
lists right now!  (Besides cypherpunks, I mean.)  How would we find them?

Someone with a news feed and some CPU time and hacking time on their
hands could come up with some analysis tools that scan news or email
articles, looking for unusual patterns.  You can debug them on
something with a small flow, then gradually speed and smarten them up
to be able to run across the whole netnews flow (at multiple sites).

If nothing else, such a package would provide a way to winnow signal
from noise on Usenet, by tweaking the parameters until they kicked out a
reasonable number of messages per day.  E.g. "give me the ten messages
from rec.books that use the most varied vocabulary", or "locate C source
code with lots of comments for my friend who's learning C".

And, if some of us work on ways to hide information in the flow, and
others work on ways to locate and extract it, the two efforts will
complement each other.  Think of it as "quality assurance" or
"testing" for the information-hiding effort.  We certainly won't be
the only people looking!  So let's see what NSA, KGB, etc are finding...

Bill Tuthill's "hum" (humanities department support) package from
comp.sources may give you some ideas.  It's not 100% useful for this,
but it's there:

    A new package of programs for literary and linguistic computing is
    available, emphasizing the preparation of concordances and supporting
    documents.  Both keyword in context and keyword and line generators
    are provided, as well as exclusion routines, a reverse concordance
    module, formatting programs, a dictionary maker, and lemmatization
    facilities.  There are also word, character, and digraph frequency
    counting programs, word length tabulation routines, a cross reference
    generator, and other related utilities.  The programs are written in
    the C programming language, and implemented on several Version 7 Unix
    systems at Berkeley.

hum/Part01: v10i27:  Bull Tuthill's "hum" text concordance package, Part01/03
hum/Part02: v10i28:  Bull Tuthill's "hum" text concordance package, Part02/03
hum/Part03: v10i29:  Bull Tuthill's "hum" text concordance package, Part03/03
hum.pch:    v11i065:  Hum concordance package update kit

in ftp.uu.net:/usenet/comp.sources.unix/volume10 and volume11.

John Gilmore                gnu@toad.com  --  gnu@cygnus.com  --  gnu@eff.org
Creating freedom, rather than longer chains, bigger cages, better meals, . . .