6
$\begingroup$

Can you encrypt an image (with AES) such that you can open it as a png/jpeg?

$\endgroup$
  • $\begingroup$ No. What are you trying to achieve? Prevent modifying image? $\endgroup$ – LightBit Dec 3 '15 at 17:40
  • $\begingroup$ No I am trying to show a visual representation of the image after encrypting.. being able to open as a image (image viewer) $\endgroup$ – JohnAndrews Dec 3 '15 at 17:42
  • $\begingroup$ You can do that. You have to encrypt only contents (pixels) of image. $\endgroup$ – LightBit Dec 3 '15 at 17:45
  • $\begingroup$ @lightbit. How do you do that? Do uou have an example? $\endgroup$ – JohnAndrews Dec 3 '15 at 17:46
  • $\begingroup$ Depends on image format. You can do this by opening image with library which will give you array of pixels or just skip header while encrypting (header might contain checksum which you must replace). $\endgroup$ – LightBit Dec 3 '15 at 17:59
15
$\begingroup$

If you aim to show the effect of the encryption, meaning a scrabled image you have to encrypt only the "image data" and keep the file structure unchaned. A simple tutorial can be found here: https://blog.filippo.io/the-ecb-penguin/. Author uses ppm files, but you can easily adapt to your file format.

# First convert the Tux to PPM with Gimp
# Then take the header apart
head -n 4 Tux.ppm > header.txt  
tail -n +5 Tux.ppm > body.bin  
# Then encrypt with ECB (experiment with some different keys)
openssl enc -aes-128-ecb -nosalt -pass pass:"ANNA" -in body.bin -out body.ecb.bin  
# And finally put the result together and convert to some better format with Gimp
cat header.txt body.ecb.bin > Tux.ecb.ppm 

Here’s an example (using the key “ECB”):

Crypto.SE logo as “ECB penguin” alternative


You actually can. You actually can do even more: encrypt a file format into an other. You need to play with key and IV to get that the message input is "well" transformed by the encryption. If you control the key and the IV and the initial and final file you ave enough freedom to achieve your aim. Ange Albertini made a proof of concept. Ablog post explaining the idea is available here: http://blog.fortinet.com/post/angecryption-at-insomni-hack

Roughly you want that the encryption of the file header (with the magic number, identifying the file type) is encrypted into a valid file header. Then you can play with data chunks and segment to get one image or the other.

The video explanation: https://www.youtube.com/watch?v=wbHkVZfCNuE

An example: https://code.google.com/p/corkami/source/detail?r=1906

Some slides: https://www.blackhat.com/docs/eu-14/materials/eu-14-Apvrille-Hide-Android-Applications-In-Images.pdf (not the same as the op asked but the idea is the very same)

$\endgroup$
  • $\begingroup$ Great example that even encrypted the information is still "easily" extracted. $\endgroup$ – aggsol Dec 16 '16 at 14:53
2
$\begingroup$

Yes, you can if you can carefully choose the key and IV to create a cipher text that forms an image format. This is normally unlikely to happen with a random key and IV.

$\endgroup$
  • $\begingroup$ Is there any method to find such a key? $\endgroup$ – Rakesh Nair Jan 18 '17 at 9:57
  • $\begingroup$ Sorry, I am unaware of any such 'method'. However, I presume that such a method will eventually have to find the key from its cipher which is nothing different than a known plain text attack. $\endgroup$ – vishnuvp Aug 19 '17 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.