2
$\begingroup$

I need advice as to whether it is worth the extra "security" and processing of an AES encrypted text string to be hidden in a PNG image as opposed to an AES encrypted text string to be saved in a read-only text file. Both the PNG image and Text file would serve as publicly available AES placeholders that would be decoded via password in a web application. I gather that any hex editor or similar software could access the AES string anyhow, so, would there be any practical benefit security-wise in hiding the AES string in a PNG?

$\endgroup$
  • $\begingroup$ What aspect of security are you talking about? Are you concerned about someone decrypting the encrypted string? Or, are you concerned that someone would detect that there was an encrypted string there? $\endgroup$ – poncho Oct 8 '15 at 14:34
  • $\begingroup$ Thx for input. I am only concerned about someone decrypting the encrypted string. $\endgroup$ – DaNCh Oct 8 '15 at 14:36
  • 2
    $\begingroup$ No, you do not increase security level hiding your ciphertext. It is proven to stand the state of the art attack that usually model quite stronger attackers. $\endgroup$ – ddddavidee Oct 8 '15 at 15:32
1
$\begingroup$

This is called steganography and while the example you give is not significantly better than just having the AES in a "text file" (because it would not look like an actual PNG file), there are algorithms for hiding information in a "cover" file.

However, if you do not mean to hide the fact that you have encrypted something, using AES alone is normally sufficient. There are no known practical attacks on properly implemented AES encryption, so as far as we know your message will remain as secure as your key.

A potential issue is the password. Human chosen passwords are not usually very secure and even if you use proper password hashing, very weak passwords remain weak. If you had good steganography in addition, it might resist cryptanalysis better, but secure steganography is also dependent on strong keys.

| improve this answer | |
$\endgroup$
  • $\begingroup$ You're right about password/key protection, that's the weakest link. I am currently seeking some pure javascript solution for encoding and decoding PNG chunks of the type zTXt. I haven't found anything on the web so far as a pure javascript solution, bummer. I've also tried to Blob my way with fileReader, but that appears to destroy the AES encryption algo I am currently using. My kingdom for a zTXt ! $\endgroup$ – DaNCh Oct 9 '15 at 3:30
1
$\begingroup$

"Hiding" content in an image (or other medium, it's a general technique called steganography) can be done either in a very obvious way (a dedicated data block, called ancillary chunk, which does not form part of the image), or it can be more effectively hidden in the low order bits of the image, thus very subtly degrading the picture.

Both methods can be discovered by a dedicated analyst, there are even automated tools which can flag images if some telltale statistical anomalies are detected.

This method doesn't add any extra security for the secret message - which is already encrypted anyway. The only thing it provides is a very weak protection of the fact that a secret message existed at all.

| improve this answer | |
$\endgroup$
  • $\begingroup$ I've tried steganography.js which deals with png alpha channel and works great, but because I had a lot of dynamic data to hide this made my png image size grow too big to handle, even after some lzw compression, so I had to ditch that idea because I will deal with very long strings. $\endgroup$ – DaNCh Oct 9 '15 at 3:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.