search

dyne / tomb

the Crypto Undertaker
https://dyne.org/software/tomb
GNU General Public License v3.0
1.32k stars 151 forks source link

are there alternatives to steghide? #493

Closed phytohydra closed 10 months ago

phytohydra commented 10 months ago

"Tomb also supports deniable key storage using steganography. One can tomb bury and tomb exhume keys to and from JPEG images when the utility steghide is installed."

steghide 0.5.1, the current version, hasn't been updated in literally 20 years. The last release was 2003-10-15. There exist steganalysis tools which can reliably detect it.

'Practical attack on Steghide' https://daniellerch.me/stego/aletheia/steghide-attack-en/

Narrat commented 10 months ago

Time flies by... Interesting read. Also the other posts about other steganographic tools. After skimming those and a little bit of searching: Is there even a replacement with a good track record? Some of the known have their own dedicated post :D And in general it seems like the development in that regard is rather dead?

jaromil commented 10 months ago

I wrote this section in known bugs a decade ago or so: https://github.com/dyne/Tomb/blob/master/KNOWN_BUGS.md#issue-affecting-keys-used-in-steganography - tl;dr the presence of a key into an image can indeed be detected, but it is still protected by a password (2nd factor) else cannot be retrieved. Brute forcing may be easier against a steg key.

Limits of steghide are known and declared. There isn't a better alternative, AFAIK.