Suppose a totalitarian government (in the name of anti-terrorism / protection of intellectual property):
- has outlawed encryption itself - encryption is only approved for cases where the state has reviewed the design and made sure it can decrypt/inspect the message, and made any unapproved encryption a criminal offense
- has total control over anything in and out of the network at ISP-level, as well as anything that passes through web services
How could two citizens Alice and Bob, using approved (and monitored) instant messaging service to set up a secure line of communication, conceal the fact that the communication is encrypted, i.e. to make it indistinguishable from unencrypted data, or at least, make it computationally- or financially-infeasible to distinguish it from plain text?
For example, no one would assume the following message to be encrypted:
Across the Great Wall, we can reach every corner in the world.
But it would be assumed that the following is:
For the purpose of this question, we assume the following technical details:
- the IM service is text-only, binary data is not allowed (in an IM setting, sending primarily small binary fragments back and forth would probably raise suspicion anyway)
- communication between Alice and the IM service, Bob and the IM service, are both end-to-end encrypted. A government agent Eve has a copy of the decryption key the IM service used
- proof that the message is encrypted is not required. I.e. Eve does not need to know the plain text or the algorithm used to produce the cipher text. She only needs to tell, with a reasonably-low false-positive rate, if a message is the result of an encryption
- the endpoint is secure, no backdoor or malware on the computer/router, etc.
I'd like to know if there are any reliable research on this, is it feasible or not, and if feasible, any existing protocol or algorithm developed for this?
Eve, in case you are watching, I'm asking this for academic purposes only. 😄