# How to establish if a string contains a message

If you have a string S, then the string can be composed of four things:

1. cleartext
2. 'random' data
3. encrypted data
4. compressed or otherwise non-encrypted, but modified, cleartext

If you want to see if the string is an encrypted message, (3), then you might construct a test for 'randomness', say the test is $T_0$. You'd then expect:

• $T_0(a) \approx T_0(d)$ -- i.e. not interpreting a compression as an encryption because it is ordered
• $T_0(b)$ $\not \approx$ $T_0(c)$ -- i.e. the message is detected

If the message is very well encrypted, then you'd expect:

• $T_0(b) = T_0(c)$ -- that is, the algorithm detects no patterns

Would that be correct?

I'd expect that a watermarked or steganographic image would be revealed as different from standard jpegs by a good $T_0$.

The randomness tests in 'diehard' and 'dieharder' look for specific types of pattern that would not be expected in strings of type (2). Would it not make more sense to structure a $T_0$ on known types of data, so, for example, an apparently normal image file that contained a message would stand out?

• see here for some relevant reading... Nov 27, 2014 at 7:42
• Edited question, but I don't know how to get the ~⩬ operator in TeX format, so if anybody knows how to do that, please don't hesitate. Nov 27, 2014 at 10:36
• I've fixed the TeX - I'd not known you could use TeX so easily - thank you for letting me know. Nov 28, 2014 at 7:33