MASTER'S THESIS. Steganography in Reed-Solomon Codes. Peter Hanzlik. Master program Master of Science in Information Security

Transcription

1 MASTER'S THESIS Steganography in Reed-Solomon Codes Peter Hanzlik Master program Master of Science in Information Security Luleå University of Technology Department of Business Administration, Technology and Social Sciences

2 Abstract In the thesis is described a steganographic system that embeds hidden data into communication channel that utilizes Reed-Solomon error-correction codes. A formal model of Reed-Solomon covert channel is proposed by stating requirements that are laid on such technique. The model was validated by eperimental research methods. Findings indicate that the proposed model satisfies the primary attributes of steganography: capacity, imperceptibility and robustness. The research provides a stand base for further researches in the wide range of applications of Reed-Solomon codes.

3 Table of Contents 1 Introduction Problem Description Digital Watermarking Message Hiding Video Stream Resynchronization Steganographic File System Research Problem Research Design Data Collection and Visualization Scope... 8 Coding Theory Hamming Distance Types of Codes Errors Galois Fields Arithmetic in Finite Field Construction of Finite Field GF( 3 ) Reed-Solomon Codes Characteristics of Reed-Solomon codes Encoding Reed-Solomon Codes Decoding Reed-Solomon Codes Syndrome Computation Determination of the Error-locator Polynomial Finding roots of error-locator polynomial Calculation of Error Values... 30

4 4 Steganography in Reed-Solomon Codes General Steganography System Model of Reed-Solomon Covert Channel Requirements for a Steganographic Technique over RS Codes Specific Steganographic Technique over RS Codes Validation Methodology of the Validation Findings Simulation of Individual Errors Simulation of Burst Errors Result Possible Areas of Application Digital Watermarking Message Hiding Video Stream Resynchronization Steganographic File System Conclusion and Discussion References... 58

5 Table of Figures Figure 1: Error-correction Process... 5 Figure : Rise of Errors... 1 Figure 3: Reed-Solomon Coder/Decoder Figure 4: Reed-Solomon Codeword Figure 5: Decoding Process... 3 Figure 6: A Generic Steganography System Figure 7: Inserting Steganographic Data into Error-correction Figure 8: Model of Reed-Solomon Covert Channel Figure 9: Steganographic Algorithm over Reed-Solomon Codes Figure 10: Flow Chart of the Steganographic Technique... 4 Figure 11: Class Diagram Figure 1: Pilot Study - Test Repetitions Figure 13: Individual Error Distribution Figure 14: Steganographic Locations Distribution Figure 15: Burst Error Distribution Figure 16: Steganographic Locations Distribution List of Tables Table 1: Basic Operations in GF() Table : Elements of GF( 3 ) Table 3: Pilot Study - Standard Deviation of Error Location Frequency Table 4: Pilot Study - Successful Decoding Comparison Table 5: Ratio of Successful Decoding of the Information Table 6: Ratio of Successful Decoding of the Steganographic Information Table 7: Ratio of Successful Decoding of the Information (Burst Error)... 5 Table 8: Ratio of Successful Decoding of the Steganographic Information (Burst Error)... 5 Table 9: Theoretical Steganographic Capacity of Blu-ray Disc... 54

6 1 Introduction Information hiding is a general term encompassing many sub-disciplines, from which this thesis focuses on steganography and watermarking. Steganography is the science of hidden communication. The aim of steganography is to hide a message in such a way that no one ecept the sender and intended recipient knows about the eistence of the message. Hidden information does not attract attention and is not eposed to attacks. This approach is different from cryptography which goal is to make information unreadable. Page 1 Digital watermarking is a sub-field of copyright making and its aim is to protect intellectual property rights. Watermarks may be imperceptible or visible depending on whether steganographic or nonsteganographic system is used. In this work concentration is paid to steganographic systems. Interest in steganography significantly increased after the 9/11 terrorist attacks, when it became clear that information hiding is likely to be used for criminal activities. 1.1 Problem Description There are many techniques of steganography. In ancient times there were two main techniques used: writing under the wa of wa tablets and tattooing shaved heads of slaves and waiting for hairs to grow. From the more modern techniques may be mentioned invisible ink, microdots or hiding information into images or other multimedia files. Developing new theories utilizing steganography brings new possibilities for steganography application (Information Hiding, 00). Some of the applications to which this thesis sheds new light on are digital watermarking, message hiding, video stream resynchronization and steganographic file system Digital Watermarking Copyright infringement represents a serious issue in the field of software and multimedia. According Business Software Alliance (Corbin, 009), in the 008 software industry lost $53 Billion due to piracy. Institute for Policy Innovation concludes in its analysis (Siwek, 007) that piracy in U.S. on sound recording represents an overall annual loss of $1.501 Billion. Piracy of motion pictures results in $0.5 Billion annual loss among all U.S. industries. Recording and software companies try constantly to develop new robust watermarking techniques against digital piracy. Digital watermarking is relatively new discipline in steganography, introduced at

7 the end of the 0 th century (Houmansadr et al., 006). There were lots of researches performed in this field. Most of them are dedicated to image watermarking, as for instance JPEG format (Suhail et al, 003; Lai and Wu, 009; Singhal et al., 009). As mentioned, the most losses in piracy are nowadays in the motion pictures business. Authors Ye, D. et al (010) researched watermarking in video on demand, specifically MPEG format. There were performed many researches proposing watermarking techniques for various video formats, as for instance AVS (Wang et al., 009), H.64/AVC (Wu et al., 010) and many others. An in-depth overview of digital watermarking in video files is provided by authors Doerr and Dugelay (003). Authors conclude their research by call for new researches in the video watermarking domain: New applications have to be considered, specific challenges have to be taken up and video-driven approaches have to be investigated. (Doerr and Dugelay, 003, p. 63). Nearly all methods modify the original multimedia file when adding watermark and thus are file format dependent. A watermarking system independent of the multimedia file format would bring much more fleibility for recording companies in the fight with copyright piracy. Page 1.1. Message Hiding Federal Plan for Cyber Security and Information Assurance Research and Development (006, p.9) states that immediate concerns also include the use of cyberspace for covert communications, particularly by terrorists but also by foreign intelligence services and the research topics include also detection of hidden information and covert information flows. The plan considers steganography as a potential risk: International interest in R&D for steganographic technologies and their commercialization and application has eploded in recent years. These technologies pose a potential threat to U.S. national security. Because steganography secretly embeds additional, and nearly undetectable, information content in digital products, the potential for covert dissemination of malicious software, mobile code, or information is great. The threat posed by steganography has been documented in numerous intelligence reports. (Interagency Working Group on Cyber Security and Information Assurance, 006, p. 41). Governments realized the risk represented by steganography misuse and therefore developed controversial systems for intelligence monitoring such as Echelon or Carnivore (Nabbali and Perry, 003; Sloan, 001). There is a strong suspicion that terrorists use steganographic covert channels for communicating with each other, by placing hidden messages into images available on the Internet (Kelley, 001). Steganalysis research (Provos, 001) analyzed 3 millions of images from ebay and USENET

8 archives and up to now, the project did not decode any hidden message yet. Steganalysis techniques are not yet developed at the same level as steganography. Steganalysis techniques may be divided into two main groups- specific and universal techniques (Nissar and Mir, 010). Specific techniques try to attack a specific embedding technique or its slight variation. Deep knowledge about the embedding technique is needed in order to design such attack. Universal techniques apply neural networks and other artificial intelligence concepts to determine steganographic files. The disadvantage is that such system needs an etensive training period with all types of embedding techniques; otherwise the determination of new techniques is limited. The really universal algorithms do not eist (Nissar and Mir, 010). Therefore every new embedding algorithm has to be described in order to be later utilized in steganalysis techniques to prevent terrorist messages to propagate on the Internet. Page Video Stream Resynchronization Video streaming is subjected to errors during its transmission because of low bandwidth, low processing power, poor quality channel or any other cause. Once such disruption in data stream occurs, the decoder has to quickly resynchronize. Even a single bit error causes a defect on group of pictures (Robie and Mersereau, 00). By embedding steganographic data into video streams, decoder may quicker resynchronize the stream and the eperience of watching the video is significantly improved. As the resynchronization data are encoded steganographically, such modified video file is compatible with the original decoders. Decoders with the implemented feature are able to utilize the resynchronization information; old decoders just skip it. Authors Robie and Mersereau (00) proposed such resynchronization technique designed for MPEG- standard. Also more powerful codecs were presented, however, as are not compliant with standard ones, their wide application is not probable (Yilmaz and Alatan, 003; Puri et al., 001). Review of error concealment techniques for video communication may be found in the work of Wang and Zhu (1998). Developing a technique that may be applied for range of video codecs with backwards compatibility with the old decoders represents a challenging task for the researchers. Currently such techniques lack in this field and therefore new researches have to be performed Steganographic File System The steganographic file system was firstly proposed by Anderson et al in Steganographic file system hides the eistence of the data and does not attract adversaries to perform attacks. Attacker does not know whether hidden data eists that provides another layer of security above the

9 cryptography. The motivation behind the steganographic file systems is to protect users through plausible deniability, such as in legal disputes. The novel approach of Anderson (1998) resides in the fact that hidden data were encoded directly into disk volumes rather than to cover data (images, audio or video files). He proposed two techniques how to perform steganographic file system. First is to generate random cover files in which hidden data are encoded. Second proposal is to encrypt blocks of hidden files and write them to random absolute disk addresses. There were also proposed a model for steganographic file system together with a practical implementation on local machines and its etended version designed for open network platforms, such SAN, DataGrid or PP (Zhou, 005). Distributed steganographic file system was presented by Giefer and Letchner (004). Unfortunately, there are not many researches in this field and as authors admit, nearly all developed models were tested just in theory. All researches more or less enhance the models of Anderson (1998) that are vulnerable to traffic analysis attacks (Troncoso, 007; Diaz et al., 008). Authors conclude their research by stating that more sophisticated mechanisms are required in order to design a traffic analysis resistant steganographic file system; developing such mechanisms is left as an open problem (Troncoso, 007, p. 3). Therefore a new impulse has to be brought in this field of steganography. Page 4 1. Research Problem As described in the section Problem Description, steganography has a wide range of applications with possibilities for improvements. There are two ways how to implement steganography- either to develop an application-specific solution that utilizes specific features of the application; or solution that utilizes the communication channel for the steganography and thus might be used on wider range of applications. I have decided to contribute to the field of steganography by proposing an adaptable method for information hiding in a specific communication channel. Researchers have concentrated on various communication channels so far. One of the most discussed topics is embedding data into TCP/IP protocols as TCP/IP packet architecture allows inserting steganographic data into unused or optional locations within the packet. By etracting specific bits out of packets, recipient may reassemble the hidden message. Murdoch and Lewis (005) developed tests to detect steganographic data in the TCP/IP headers and furthermore describe new, as they claim undetectable technique. Chakinala (007) generalized the concept of TCP/IP communication channel for steganographic purposes and in his research "Steganographic Communication in Ordered Channels

10 presented a formal model for transmitting hidden information by packet-reordering. Lucena et al (004) described her approach to application layer protocol steganography and furthermore introduced the notions of synta and semantics to ensure conformity. Many researches concentrated their work on other than TCP/IP communication channels. Westfeld and Wolf (1998) described a steganographic system which embeds secret messages into a video stream, i.e. into a not ordered channel. Not ordered channels are mainly used in real-time systems where waiting for delayed packets is not preferable. In these applications often noise that modifies information during the transmission process occurs. Korjik and Morales-Luna (001) described scenario of information hiding through noisy channels. Practical application of hiding information with respect to channel noise presented Westfeld (006) in his research "Steganography for Radio Amateurs A DSSS Based Approach for Slow Scan Television". Page 5 To one of the latest communication medium that was invented belongs quantum channel. Keye (007) introduced in his research a scheme for a steganographic communication hidden in the quantum key distribution protocol BB84. Focus of researchers has however missed one type of communication channel- transmission channel with error-correction capability. By adding redundant information, error-correction codes are capable of recovering damaged message at the destination (Figure 1). Figure 1: Error-correction Process Researchers have so far studied the utilization of error-correction code in steganography in the contet of reducing distortion during the embedding process (Fontain and Galand, 008; Zhang et al., 009; Schönfeld and Winkler, 006). These techniques apply syndrome coding of error-correction codes to communication channels that are however not based on error-correction codes. Research of

11 steganography within error-correction codes might reveal new ways of steganography techniques. The potential hidden in error-correction codes motivated me in performing research in this field. As this area of research has not been targeted by any research yet in a way that I intend to, I have decided to propose and describe a model on hiding steganographic information into error-correction channels. There is a wide range of error-correction codes. For my research I have selected the Reed-Solomon error-correction codes that are widely used in technologies such as CD, DVD, Blu-ray, DVB or DSL which makes them an ideal candidate for my research. Broad scope of Reed-Solomon codes provides etensive possibilities for setting up a research that should result in improvement of common steganographic applications, such as those described in the previous section. Page 6 Research problem is formulated as: Propose and describe a model for steganography over Reed-Solomon error-correction covert channel. The overall research question is formulated as: How Reed-Solomon codes might be utilized for steganography purposes? Hypothesis answering the research question is stated as: Steganography over Reed-Solomon transmission channel may be performed by eploiting the error-correction capability of the channel by encoding hidden bits as errors in transmitted messages. To answer the overall research question, I have to answer also the subordinate question: What are the requirements laid on a technique utilizing the steganography model in the Reed- Solomon covert channel? 1.3 Research Design The research design used in the thesis is the eperimental design. Eperimental design is concerned with the analysis of data generated from eperiments (Easton and McColl, 1997). Eperimental design enables researcher to test his hypothesis by reaching valid conclusions about relationships between independent and dependent variables (Key, 1997). The purpose of eperimental design is to provide a framework within which the eperiment is performed.

12 We may identify four main eperimental design approaches (Ross and Morrison, 004): True Eperiments, Repeated Measures, Quasi-eperimental designs, Time series designs. True eperiments are considered as the ideal design that maimizes the internal validity and this approach is used in the thesis. The major advantage of true eperiments is the random assignment of subjects that eliminates any systematic error (Ross and Morrison, 004). Page 7 In the eperimental design we have to consider the validity threats that have the potential to bias the results. Eperimenter has to take into account the threats by evaluating the results and try to limit their impacts on the eperiments. One of the possible validity threat influencing eperiments in this thesis is represented by the artificially generated subjects of the eperiments that provide ideal laboratory instead of real-life conditions for the eperiment. Validity threats in randomized eperiments are discussed in several papers (Conrad and Conrad, 1994; Borg, 1984) that will be considered by the evaluation of the results in the thesis. Conducting an eperimental research is a difficult process where the phases have to be carried out in sequence in the right order. Ross and Morrison (004) developed a model representing a sequence of logical steps for planning and conducting eperimental research: 1. Select a Topic. Identify the Research Problem 3. Conduct a Literature Search 4. State the Research Questions (or Hypotheses) 5. Determine the Research Design 6. Determine Methods 7. Determine Data Analysis Techniques This thesis follows the proposed model that is considered as a research strategy for this research. In order to identify possible problems that may arise in the major study, I decided to conduct a pilot study. A pilot study can greatly improve the proposed study design and methodology. Testing instruments and making adjustments before instigating a major study helps to ensure that data collection is efficient and successful (Monsen and Horn, 008).

13 Conducting a pilot study brings certain advantages to the research [Woken, 010]: 1. Permits preliminary testing of the hypothesis and its possible change in the major study. Provides researchers with ideas and clues that may improve the findings in the main study 3. Permits a thorough check of the planned procedures Page 8 4. Reduces the number of unanticipated problems 5. May save a lot of time, money and effort 6. Gives possibility to try out a number of alternative measures and then select the most appropriate one Pilot study is performed as a sample size calculation on the best available data (Lancaster et al., 00). Performing pilot study before conducting a true eperiment I consider inevitable otherwise the major study may easily miss its aim. In order not to eceed the etent of the thesis, the pilot study will not be fully documented, only references to it will be provided. 1.4 Data Collection and Visualization The research problem lies on the intersection of two theories- steganography and error correction. Therefore these two concepts have to be described sufficiently. I collect information from the literature, documents from conferences and research papers. The theory is described in tet, supported by schemas and eamples. Used schemas visually present the idea and logic behind the presented theory. Particular care is paid to the eamples which I find very effective when eplaining a difficult topic. I attach eamples after each section so as in this way to make the topics much easier for a reader to understand. Data collection is represented by series of eperiments that validate the proposed model. I have developed an application utilizing the concepts presented in the thesis. Data gathered from the application was statistically analyzed and presented in form of charts and tables. 1.5 Scope The thesis focuses on steganography in Reed-Solomon error-correction codes. Description of the steganography technique over other error-correction codes is out of scope of this thesis. Concrete

14 algorithms for practical applications of the model are out of the scope as well. The research acts as an enabler for further researches. Page 9

15 Coding Theory According Hoffman (1991, p. 1), coding theory is the study of methods for efficient and accurate transfer of information from one place to another. From mathematical point of view (Prause, 001), coding is injection that assigns to every symbol of the set a symbol from the set. In this way a codeword is created. Code is a set of all codewords. Codewords are represented by a -tuple sequence, where every of objects may be assigned states. The length of the code is the number of codewords. This length for binary codes is defined by the relation. Page 10.1 Hamming Distance The main idea with coding is that all codewords have to be differentiable with each other. For this aim the coding theory introduced the concept of distance among codewords. As long as two codewords are to be compared with each other, they have to have the same distance. Definition.1 (Morelos-Zaragoza, 006): Let be an error correcting code with binary elements. is a subset of the -dimensional binary vector space { }, such that its elements are as far apart as possible. In the binary space is the distance defined as the number of elements in which the vectors differ. Let and be vectors from. Then the Hamming distance between and, denoted,is defined as { } (.1) Definition. (Morelos-Zaragoza, 006): Minimum Hamming distance of the code is defined as the smallest Hamming distance among all possible distinct pairs of codewords in :. Types of Codes There are several aspects according which codes may be divided. { } (.) According the way of adding redundancy (Moreira and Farrell, 006): 1. Systematic codes: from the information bits are derived redundancy bits (, where is the length of codeword). The codeword consists of the information bits followed by the

16 redundancy bits. Information bits of the message are separated from the redundancy bits during the transmission. Systematic codes are denoted as codes.. Non-systematic codes: information bits are replaced with sequences of bits with higher rate of redundancy. By the transmission process it is not possible to differentiate redundancy bits from the information bits. Page 11 According the way of correction of errors (Prause, 001): 1. Detection codes: errors are only identified and not corrected right away. Correction may be performed by requesting to repeat the transmission of the faulty segment.. Correction codes: errors are indentified and corrected straight away without the need of backward channel. Computational compleity as well as capabilities of the correction is defined by the error-correction code and its specifications. There are two groups of codes (Gao, 007): 1. Source coding (entropy coding): is the process of compressing source data in order to gain higher effectiveness of transmission.. Channel coding (forward error correction): is the process of adding redundant bits to the message in order to ensure resistance against communication noise. Algebraic code theory distinguishes two classes of error correction codes (Morelos-Zaragoza, 006): 1. Linear block codes. Convolutional codes Linear block codes process the message on a block-by-block basis. Each block is independent of the other blocks, i.e. block codes do not have memory. The property of linearity means that sum as well as scalar product of any two codewords yields another codeword (Shah et al., 001). Linear block code is denoted as triple where: is the number of symbols of the codeword is the number of information symbols that should be encoded

17 is the minimum Hamming distance of the code. Convolutional codes, in contrast to linear block codes, depend not only on the current input information, but also on previous inputs and outputs on block-by-block or bit-by-bit basis. For this purpose the convolutional encoder has memory and thus represents a finite-state machine. The status of the encoder is determined by the content of its memory. Decoding process is performed by Viterbi algorithm. Page 1.3 Errors The main goal of coding is to prevent errors to arise in the transmitted message. Transmission channel provides transmission of a message between sender and recipient. Figure illustrates places where errors may arise due to distortion and noise. Transmission Data Source Trasnsmitter Receiver Data Recipient Channel distortion noise distortion attenuation noise distortion noise Figure : Rise of Errors In coding we recognize these two classes of errors (Moon, 005): 1. Single bit errors (independent errors): they are caused by noise that affects only one signal element. Various static characteristic are determined in order to describe their properties. In the sequence of bits only one is fault. Multiple errors may occur that means that in the sequence of bits eist more independent errors. Number of independent errors is denoted by the letter.. Burst errors: are sequences of transmitted signal elements in which the frequency of fault elements is higher than the frequency of correctly transmitted elements. Length of the burst error is..4 Galois Fields In the coding theory is used arithmetic of finite fields. Finite fields were studied by a French mathematician Evariste Galois and therefore they are referred to as Galois fields. Finite field is an algebraic structure in which eist basic mathematical operations such as addition, subtraction, multiplication and division among its elements. For all elements of holds that the result of any

18 operation is an element of the field. Finite fields consist of finite number of elements (Moreira and Farrell, 006). Finite field is denoted by, where is the order of the field and epresses the number of field elements. In general,, where is a prime number, called characteristic of the field and is an positive integer. Page 13 Definition.3 (Vlcek, 004): is a set of all polynomials of arbitrary degree with coefficients { } from finite field. Definition.4 (Vlcek, 004): A polynomial defined over is said to be irreducible, if has no factor polynomials of degree higher than zero and lower than. Definition.5 (Vlcek, 004): An irreducible polynomial of degree over is said to be primitive if the lowest positive integer, for which is a factor of, is. Reed-Solomon codes utilize etensions of binary field called. Finite field contains two elements { }. In is a primitive root, with which all the other elements of may be epressed as power of, besides the zero element (binary zero), that is denoted as. Definition.6: Let be a finite field. If eists an element such that every element of is its power, then this finite field is called cyclic finite field and element is generator of this field. Finite field contains elements { }, in which represents binary 1 and all other elements we compute by equation (.3) where is a primitive polynomial for and. It is possible to generate with power higher than. These only copy the pattern according (.4) so, and so on.

19 Similarly it is possible to transform element according: with negative power to an element with positive power (.5) Not every polynomial over is a primitive polynomial. Valid are only those that form with not repeated elements. For finding a primitive polynomial with degree it is needed to generate all polynomials with degree and test them by generating whereby the has to satisfy the rule of not repeated elements. There are possible polynomials, however, as the primitive polynomial in the binary form starts and finishes with binary 1, the search is reduced to half. Page Arithmetic in Finite Field All mathematical operations over are followed by. For eample, in,. Special case occurs in, where operations of addition and subtraction are identical and are represented by operation XOR. Addition of element to itself yields a zero element (binary zero). Operation of multiplication is represented by operation AND. Multiplication and division is easier to perform in non-binary form, as for eample. When multiplying, powers are summed, by division are subtracted as in ordinary arithmetic. If the result does not belong to the, then has to be added or subtracted according Equation (.4). Table 1: Basic Operations in GF() a -a a a) addition b) multiplication c) inversion Eample.1: Let have defined polynomials and over. Then: Addition: f ( ) g( ) ( ) Subtraction: f ( ) g( ) ( 3 1 1)

20 Page 15 Multiplication: 1 1 1) ( 1) ( ) ( ) ( g f Division: 1 ) ( 1 ) ( 1) ( : 1) ( ) ( ) ( g f Arithmetic in has the same rules as in, i.e., just when by multiplication of two polynomials the resulting polynomial is of higher degree than, then this polynomial is factored by the irreducible primitive polynomial. Eample.: Let have defined polynomials and from the Eample.1. Then mathematical operations of addition and multiplication over with primitive polynomial are: As the degree of is higher than 7 ( ), it is needed to reduce the result by. 1 ) ( 1 ) ( 1) ( 1) : ( So.

21 .4. Construction of Finite Field GF( 3 ) In case of, the primitive polynomial of degree 3 that generated all elements of the field may be. Primitive polynomial is polynomial over, since coefficients of its variables are elements of { }. Let be primitive root of. As is the root of it holds that and Page 16 Equation (.3) shows how to generate elements of as powers of. Elements of the field may be represented also as polynomials over of degree less or equal than (in general ). Mathematical operation of addition is then in this case a sum of coefficients of field elements. Binary notation is a direct consequence of the polynomial one, where coefficients of the polynomial form binary number based on the corresponding power of variable. Multiplication of two field elements means sum of powers of, in general. For eample,. According Equation (.4), higher powers copy the pattern, so, and so on. The finite field is in Table. Table : Elements of GF( 3 ) Eponential notation Polynomial notation Binary notation

22 3 Reed-Solomon Codes Reed-Solomon codes are codes for forward-error correction that are used in data transmission vulnerable to channel noise. Reed-Solomon codes are block codes that by adding redundant data before transmission are capable of detection and correction of errors within the block of data (Shah et al., 001). Reed-Solomon codes are non-binary codes, i.e. signal elements are represented by group of bits. Typical eample of Reed-Solomon codes application is illustrated on Figure 3. Page 17 noise Transmission Channel Data Source RS Encoder RS Decoder Data Recipient Medium Figure 3: Reed-Solomon Coder/Decoder Reed-Solomon codes were invented in 1960 by scientists Irving S. Reed and Gustave Solomon, members of Massachusetts Institute of Technology. In the time of publishing the concept, digital technology was not advanced enough for its implantation. Application of Reed-Solomon codes happen after inventing efficient decoding algorithm by Elwyn Berlekamp in 1968 and its modification by James Massey a year later (Reed and Solomon, 1960; Berlekamp, 1968; Massey, 1969). Today, Reed-Solomon codes have found numerous applications in the field of digital storage and communication systems to correct burst errors. Firstly Reed-Solomon codes were used by NASA for transmission of digital pictures from space missions, such as Voyager, Mars Pathfinder, Galileo, Cassini and others (Gao, 007). The first application of Reed-Solomon codes in mass production was in Compact Disks where the code can deal with error burst of length of 4000 consecutive bits (Hulpke, 1993). Similar schemes are included also in DVDs. Application of Reed-Solomon codes may be found also in latest technologies, such as digital terrestrial and satellite television (DVB), DSL technologies, Blu-ray disks, microwave and satellite transmission (Morelos-Zaragoza, 006; Wicker and Bhargava, 1994). 3.1 Characteristics of Reed-Solomon codes Reed-Solomon codes are block error-correction codes. Input consists of blocks of data to which the encoder adds redundant (parity) data. Redundant data are utilized to recover the damaged data caused

23 by noise during the communication transfer. Number and type of errors that might be corrected depends on the Reed-Solomon code characteristics. Reed-Solomon codes are non-binary subfamily of the BCH codes (Moreira and Farrell, 006). They are denoted by with -bit symbols, where is number of information symbols with length of bits. To information symbols encoder adds parity symbols, the output of which is a codeword of length symbols. The number of parity symbols is, therefore,, each of length bits. Non-binary means that a symbol is composed of more than one bit. Reed-Solomon decoder allows to correct up to symbols in a codeword, where. The number of parity symbols is directly proportional to the strength and number of symbols, which is the code able to correct. Page 18 Figure 4 is a diagram illustrating a typical Reed-Solomon codeword, encoded systematically, i.e. information data is unchanged and parity symbols are attached n Information Symbols k Parity Symbols t Figure 4: Reed-Solomon Codeword Where in Figure 4: denotes the number of symbols from denotes the number of information symbols denotes the number of parity symbols Eample 3.1: Let s have a popular Reed-Solomon code with 8-bit symbols. Every codeword consists of 55 bytes (1 symbol = 1 byte) from which 3 bytes are information and remaining 3 bytes are parity. For this code applies:

24 Decoder is able to correct 16 fault symbols wherever within the codeword, i.e. in our eample the code may correct up to 16 bytes in the codeword. Computational compleity of encoding and decoding Reed-Solomon codes is directly proportional to the number of parity symbols in codeword. The more parity symbols are attached to the information symbols, the more errors is the code able to correct, but it requires more computing power. Page 19 By defined size of is for Reed-Solomon code the maimal length of codeword. For eample, maimum length of a codeword with 8-bit symbols ( ) is 55 bytes. Reed-Solomon code may be conceptually shortened so that not all information symbols are used. Redundant symbols are computed from all (also zero) informational symbols, however, only the used portion of information symbols is transferred. The decoder adds back the zero information symbols and decodes the message. Eample 3.: code may be reduced to code. Encoder takes block of 168 symbols, conceptually adds 55 zero symbols, and generates (55,3) codeword, but transmits only 168 information symbols and 3 parity symbols. One of the characteristics of Reed-Solomon codes is that a symbol error occurs when either one or all bits within the symbol are corrupted. Code mentioned above with 8-bit symbols is able to correct 16 symbol errors. In the worst case, it means 16 bit errors, when each symbol (byte) is just one bit wrong. In the best case, it is 16 8 bit errors, when all 16 symbols are completely damaged. Therefore Reed-Solomon codes are particularly suitable for correction of burst errors, where consecutive fault bits are received. 3. Encoding Reed-Solomon Codes Reed-Solomon codes are algebraic codes, in which polynomials over represent the message that should be encoded, and the encoded codeword. In other words, input and output data consists of symbols that are elements of { }. These elements are arranged as polynomial coefficients and the power of polynomial variable indicates the order in which the encoder and decoder processes the associated symbol. For instance, information polynomial shows that symbol will be processed by the encoder as first, then symbol and lastly the symbol (Shah et al., 001).

25 Eample 3.3: Let s have code with 4-bit symbols (. Then for encoding and decoding is used Galois field. All symbols are elements of this Galois field, all polynomials are polynomials over and also the arithmetic used for encoding and decoding is for this Galois field. Systematic encoding, as already described in the previous chapter, attaches parity symbols to the information symbols. From the polynomial point of view, information symbols are shifted on higher power coefficients (by ) and after them parity symbols are appended. Parity symbols are calculated as the remainder from division of the shifted information polynomial with the generator polynomial. By this the codeword is created. Page 0 The equation defining the systematic encoding of Reed-Solomon codes is (Shah et al., 001): where: [ ] (3.1) denotes codeword polynomial of degree denotes information polynomial of degree denotes generator polynomial of degree [ ] denotes parity polynomial of degree. In general, generator polynomial for Reed-Solomon codes is (Shah et al., 001): ( ) ( ) ( ) (3.) where may be assigned any integer, however, usually it is assigned value. After applying we get: (3.3) Non-systematic encoding, in comparison to the systematic one, does not resides in division of polynomials, but in multiplication of information polynomial by the generator polynomial: (3.4)

26 The resulting codeword would be valid, since it is dividable by generator polynomial without a remainder. The codeword encoded non-systematically has to be additionally decoded even if the information was not damaged during the transmission. Therefore the main advantage of systematic encoding is that the decoding is necessary to determine whether the received codeword is valid and if so, then the message is included in the first symbols of the codeword. Page 1 It is important to note that all mentioned polynomials, including, are polynomials over. An important characteristic of is that it divides without remainder. Eample 3.4: Let s use the Galois field assembled in the Section.4. with primitive polynomial and. Let the Reed-Solomon code be with 3-bit symbols. This code is able to correct 1 error symbol. Let the message to be transmitted be in the binary form:. Defined Reed-Solomon code processes the message in blocks by 3 bits and to every symbol assigns eponential according the Table from the previous chapter: notation Procedure of encoding of the message is as follows: Into the encoder the message comes sequentially starting with the highest power of variable, so the information polynomial is as follows: Generator polynomial has the form: ( )( ) Since, according the arithmetic rules of, is the generator polynomial of following form: According the formula (3.1), message has to be shifted on higher power coefficients by :

27 Page After information symbols, parity symbols are attached that are computed as the remainder of the division of shifted information polynomial with generator polynomial: ) ( ) ( ) ( ) ( ) ( : Calculated remainder is attached to the shifted information polynomial and assembles final codeword: After transcription into the binary form, we get the encoded message that is the output of the encoder: Highlighted bits make up the parity part of the message. As can be seen, the information is directly involved in the first symbols as the result of the systematic encoding. 3.3 Decoding Reed-Solomon Codes The logic for decoding Reed-Solomon codes is similar to that for binary BCH codes. There eist many algorithms for decoding Reed-Solomon codes. In this section are presented basic general steps of decoding.

28 Algebraic decoding of Reed-Solomon codes consists of the following steps (Moon, 005): 1. Syndrome computation.. Determination of error-locator polynomial, which multiplicative inverse of its roots determine location of the error. There are several algorithms for finding the roots of error-locator polynomial: a. Berlekamp-Massey algorithm b. Euclidean algorithm c. Direct solution 3. Finding the roots of the error-locator polynomial. This step is typically accomplished using Chien search algorithm. 4. Calculation of error values- magnitude of errors. For this purpose is used error-locator polynomial, from which is calculated error-evaluator polynomial and afterward the magnitude of the error. Another usual way of doing it is Forney s algorithm. Page 3 Decoding process may be illustrating by the diagram shown on Figure 5. Determination of error polynomial e() r() Syndrome computation s() Determination of error-locator polynomial s() Determination of error locationsfinding roots of s() Calculation of error values Correction of errors () + e() c() If s() = 0 Figure 5: Decoding Process After encoding a message there is a codeword polynomial (3.5) which is during the transmission eposed to noise disturbance. This modified message is then the input to the decoder and is represented by received polynomial (3.6) Received polynomial is associated with the error polynomial which is the following relation:, between (3.7)

29 Page 4 Let the received polynomial contain non-zero elements, which means that errors occurred during the transmission, residing on positions, where, and. Then form of error polynomial is (3.8) After calculating the coefficients and powers of the error polynomial we get sets { } and { }. First set contains magnitudes of errors, the second one locations of that errors. For binary codes { }. After determining the error polynomial (3.8) follows the correction of errors in the received polynomial according the Equation (3.7). In case of sufficient error correction capability of Reed-Solomon code (defined by its characteristic ), the sum of received polynomial with the error polynomial gives the original codeword polynomial which was the output of the encoder Syndrome Computation Syndromes are the evaluations of the received polynomial for each root of the generator polynomial (Morelos-Zaragoza, 006). Since roots of generator polynomial are also roots of all other polynomials which are its multiple, are also roots of the codeword polynomial. ( ) ( ) ( ) ( ) (3.9) By epanding (3.9) we get a sequence of algebraic syndrome equations j t b j j t b j j t b j t b t j b j j b j j b j b j b j j b j j b j b e e e r S e e e r S e e e r S ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( (3.10) that might be, by use of error-locator polynomial ( ) (3.11) written as a system of linear equations. The roots of the error-locator polynomial are equal to the inverses of the error locations. Then the following relation between the coefficients of and the syndromes eists (Morelos-Zaragoza, 006):

30 S S S 1 S1 S S S S S 3 1 S S S 1 1 s 1 s s1 (3.1) Equation (3.1) is also called the key equation in decoding of Reed-Solomon codes and its solution is computationally etensive operation. Finding the solution of this equation means finding the errorlocalization polynomial. Page 5 If all syndromes are equal to zero, then the codeword has not been altered during the transmission and the decoding algorithm for the given block of data has finished Determination of the Error-locator Polynomial Common methods for solving the Key Equation (3.1) and thus computing the error-locator polynomial are (Morelos-Zaragoza, 006): 1. Berlekamp-Massey algorithm This algorithm, named by its inventors, is computationally effective method of solving key equation in terms of the number of operations in this method implemented in software decoders.. Particularly popular is. Euclidean algorithm This algorithm solves the key equation in polynomial form. For its regular structure, the algorithm is widely used in hardware implementations of BCH and Reed-Solomon codes. 3. Direct solution This method, also called Peterson-Gorenstein-Zierler decoder, directly finds the coefficients of the error-locator polynomial using standard techniques for solving (3.1) as a set of linear equations. The compleity of inverting a matri grows with the cube of the error-correcting capability, and therefore the direct method can only be used for small values of. Since Euclidean algorithm has a regular structure and works with polynomial, in the thesis I focus on its description. Euclidean algorithm is one of the oldest algorithms in the world, named by its inventor.

31 Originally, it was formulated for finding the greatest common divisor (GCD) of two integers. Later, it was etended also for use with polynomials. Definition 3.1: For numbers; if, then eist integers and, such that: Page 6 For polynomials; if, then eist polynomials and, such that For arbitrary integer holds: For arbitrary polynomial holds: ( ) ( ) In order to be able to use the etended Euclidean algorithm for decoding Reed-Solomon codes, it is necessary to define also following polynomials. Let the syndrome polynomial be defined as (Morelos-Zaragoza, 006) (3.13) and the error-evaluator polynomial defined as (3.14) Problem of decoding may be formulated as finding the error-evaluator polynomial, satisfying the Equation (3.14). This may be performed by the etended Euclidean algorithm for polynomials and, such that if at -th iteration (3.15) with degree, then and. From the decoding point of view, the polynomial is not important.

32 Steps of Euclidean algorithm for (Morelos-Zaragoza, 006): Inputs: [ ] [ ] Initial conditions: Page 7 At iteration, after applying long division to polynomials and and computing [ ] [ ] will the cycle stop at iteration, when [ ] [ ] (3.16) Then ( ), where is the largest non-zero integer such that and. Pseudo code of etended Euclidean algorithm: Let be irreducible polynomial, that defines Galois field. Let be an element of this field, which multiplicative inverse is to be found. Then algorithm for finding the inverse is as follows [Wikipedia, 010]:

33 remainder[1] := f() remainder[] := a() auiliary[1] := 0 auiliary[] := 1 Page 8 i := while remainder[i] > 1 i := i + 1 remainder[i] := remainder(remainder[i-] / remainder[i-1]) quotient[i] := quotient(remainder[i-] / remainder[i-1]) auiliary[i] := -quotient[i] * auiliary[i-1] + auiliary[i-] inverse := auiliary[i] Array auiliary[] in the pseudo code represents polynomial. Eample 3.5: Let be the code over from the Eample 3.4 with primitive polynomial generating and b=1. Let the received polynomial be According Equations (3.10) is the computation of syndromes as follows: Construction of syndrome polynomial according Equation (3.13):

34 Input conditions of Euclidean algorithm: Page 9 Iteration : According the condition (3.16) algorithm stops as [ ] [ ]. Result of Euclidean algorithm is error-locator polynomial It is important to note, that etended Euclidean algorithm also computes and as Finding roots of error-locator polynomial Computation of roots of polynomial with coefficients over Galois field search. It is a method of trial and error, when all non-zero elements polynomial and consequently condition is performed by Chien are appointed to the is tested. Although this method is computationally intensive, Chien algorithm is so far the only way of finding roots of polynomials over Zaragoza, 006). (Morelos- Multiplicative inversions of roots of error-locator polynomial represent positions of errors in received polynomial. Eample 3.6: Let the error-locator polynomial be with coefficients from as in the Eample 3.5.

35 Appointing of all non-zero elements into error-locator polynomial: Page 30 For holds that, which means that is the only root of the error-locator polynomial. Multiplicative inverse of the root is and according Equation (.4) holds, that, i.e. on position of the received polynomial is an error Calculation of Error Values Evaluation of error values (their magnitudes) in positions is done by Forney algorithm. All the previous steps have led to the construction of polynomials needed for the equation (Morelos-Zaragoza, 006): ( ) (3.17) where: denotes error-evaluator polynomial denotes the formal derivative of error-locator polynomial with respect to After construction of the error polynomial according the Equation (3.8), is computed the original codeword polynomial according the Equation (3.7). Original message resides in the first of length bits) in the codeword polynomial. symbols (each Eample 3.7: Let be the same code over with primitive polynomial and as in Eample 3.4. Let be the received polynomial as in the Eample 3.5. As already mentioned, Euclidean algorithm calculates error-locator polynomial at the same time. In the last -th iteration of Euclidean algorithm holds: as well as error-evaluator

36 From Eample 3.5: Page 31 In case of using other than Euclidean algorithm for construction of error-locator polynomial, errorevaluator polynomial has to be computed according the Equation (3.14): It can be seen that the error-evaluator polynomial obtained from the Euclidean algorithm is the same polynomial as the one constructed by the Equation (3.14). It may happen that the error-locator polynomial constructed by the Berlekamp-Massey algorithm or by the direct solution may differ from the one constructed by the Euclidean algorithm by a non-zero constant. Euclidean algorithm finds polynomials and. Since the roots of both polynomials are the same, resulting error polynomial is the same as well. Eample 3.8: Set of error locations calculated in the Eample 3.6 is { is. Then the magnitude of the error is according Equation (3.17) } and derivative of error-locator polynomial and resulting error polynomial is From the received polynomial we calculate the original codeword polynomial according the Equation (3.7):

37 Calculated codeword polynomial is the same polynomial as in the Eample 3.4, meaning that the code has corrected 1 error. The polynomial in the binary notation is and the original message resides in the first 5 symbols ( of length 3 bits of the codeword Page 3 polynomial: After decoding the block of data, decoding algorithm stops.

38 4 Steganography in Reed-Solomon Codes The aim of steganography is to conceal the communication process by embedding the secret message into another innocent looking message. By concealing the eistence of the secret message the communicating parties do not attract attention and thus protect the communication from attacks. Page 33 Data hiding has many areas of applications. Originally, data hiding was designed to enable echanging of private messages through public communication channels. This process is called steganography. Steganography is the practice of undetectably altering the cover message to embed a secret message (Co et al., 008). In steganography the hidden data is important, while the cover not. Later data hiding was used to embed ownership information to the cover. Masters tattooed their slaves in order to claim their possession. This technique is called watermarking and today is widely used in digital copyrighted content to fight against copyright violation. A watermark represents a signature of the author. Watermarking is the practice of imperceptibly altering the cover message to embed a message about the cover (Co et al., 008). The purpose of watermarking is to prove a possession by answering the question Is this cover mine?. Eventually watermarking identifies the possession by answering the question Whose cover is this?. In watermarking the cover is valuable that is the fundamental difference to the steganography. The embedding capacity of hidden data is not as important as its robustness that prevents degradation of the watermark. Fingerprinting is a variation of watermarking where each watermark is unique. Fingerprinting, also called transaction tracking, is used to trace back the source of the illegal copies. By embedding secret serial number in each copy of the cover, the author is able to identify pirate copies. It is said that Margaret Thatcher ordered all word processors of her cabinet ministers to reprogram such that each generated slightly different spaces. Person responsible for the leak was in this way easily identified (Solomon, 005). Another application is tamper-proofing of the cover. Hidden data in the cover reflect any modification to the cover. The purpose of tamper-proofing is to answer the question Has the cover been modified?. Checksums of the cover are embedded so that the modification is detected by comparing new checksum with the one hidden in the cover.

39 4.1 General Steganography System Steganography is the process of embedding secret message, called stego data, into an ordinary item of communication, called cover data. The result of this process is modified cover data. (Brisbane et al., 005). Page 34 A generic steganography system is illustrated in the Figure 6 (Co et al., 008). Cover data I Embedder Modified cover data I Detector Detected steganographic data Steganographic data M Figure 6: A Generic Steganography System Steganography consists of two main processes (Peticolas et al., 1999): 1. Embedding process: Embedding process takes two inputs: steganographic data and cover data to which it is to be embedded. The output of the embedding process is typically transmitted through a public channel. (4.1). Detecting process: Detecting process receives the modified message, etracts the cover data and recovers steganographic data. (4.) There are following primary attributes that a general steganography algorithm has to satisfy (Lenti, 000; Brisbane et al., 005): 1. Capacity: Quantity of the steganographic data that can be embedded into the cover message, compared with the size of the cover message. Embedding capacity (also known as payload) can be measured numerically in

40 units of bit-per-bit (e.g. steganographic algorithm has capacity of hiding 1 bit in 8 cover bits). A steganographic algorithm with high embedding capacity might transfer more hidden data, however with likely higher probability of error and detection in comparison with small capacity algorithm.. Imperceptibility: Page 35 Level of concealment that prevents one from being able to distinguish a modified cover data from the unmodified cover data. Imperceptibility determines the level of detectability of steganography. Some authors (Solomon, 005) differentiate between terms undetectability and invisibility. According them invisibility depends on human perceptions while undetectability is purely linked with statistical properties. By any means, a good steganographic algorithm should not modify statistical properties or visual perception of the cover data. 3. Robustness: Ability to recover steganographic data in case of modifications of the cover data. Watermarking, fingerprinting and all copyright protecting applications demand robust steganographic method, i.e. that the embedded information cannot be removed without serious degradation of the cover data. 4. Model of Reed-Solomon Covert Channel One of the techniques enabling numerous steganography applications is represented by hiding information directly into communication channels, in other words utilizing covert channels. According U.S. Department of Defense publication, covert channel is "any communication channel that can be eploited by a process to transfer information in a manner that violates the system's security policy." (Owens, 00, p. ). Covert channels are of main interest of research community that is also proved by current research themes called by Information Hiding workshops (Information Hiding, 00). The goal of the community dealing with steganography in covert channels is to describe new covert channels, develop theories utilizing steganography in covert channels and techniques for steganalysis in those channels. Reed-Solomon communication channel may also be used as a covert channel for steganographic purposes. The aim of the thesis is to propose such model and describe requirements for algorithms embedding steganographic data into Reed-Solomon covert channel. Amount of redundant data added to the transmitted message by an error-correcting code is generally overestimated and rarely is the full restoration capability needed. The idea of utilizing Reed-Solomon

41 communication channel for steganography purposes is to reduce the error-correction capability of the codes on behalf of inserting steganographic data. Instead of having so much data dedicated to redundancy, we may 'borrow' and select certain locations to insert other data. The intended recipient would be able to read the hidden message from the selected locations, while the not intended recipient will consider them as an error caused by noise during the transmission. The model with systematic Page 36 encoding, defined by the Equation (3.1) is illustrated in the Figure 7. Figure 7: Inserting Steganographic Data into Error-correction The model is designed as a man-in-the-middle encoder/decoder implemented over Reed-Solomon channel without any modification of the Reed-Solomon coder/decoder. The model is illustrated in the Figure 8. Information RS Encoder Codeword c() Steganographic data Stego Encoder Stego Decoder Steganographic data Steganographic codeword c s() noise Transmission channel Received polynomial r() RS Decoder Information Figure 8: Model of Reed-Solomon Covert Channel The steganographic encoder takes as the inputs steganographic data and the codeword generated by the RS encoder. According a certain steganographic algorithm the steganographic encoder calculates locations within the codeword that are used for steganography. Original bits in the determined

42 locations of the codeword are replaced by steganographic data. The output of the steganographic encoder is a modified codeword with steganographic data denoted as. Steganographic encoder may be written as a function: where represents a binary string of the secret message. (4.3) Page 37 Steganographic codeword is transmitted through the error-prone communication channel. Steganographic codeword influenced by the noise on the channel arrives as a received codeword and acts as the input of the Reed-Solomon decoder as well as the steganographic decoder. Reed-Solomon decoder takes the received codeword and corrects errors up to error symbols as described in the Chapter 3.3. Steganographic decoder takes the received codeword, determines the steganographic locations and etracts the steganographic data. Steganographic decoder may be written as a function: ( ) (4.4) Steganography methods may be classified into three groups (Solomon, 005): 1. Naïve steganography: methods where no secret key is used. Secret steganography: methods where a secret key is used 3. Public-key steganography: methods where an asymmetric key is used According the steganography model proposed in the thesis, the steganography technique may utilize any method above. It depends on the specific application of the technique and its requirements. In some applications cryptography is not required while in other is inevitable. The technique is thus independent of the final application and allows to choose the level of security according specific conditions. Technique that determines the steganographic positions within the codeword is the fundamental part of the model. The steganographic model developed in the thesis allows to implement any steganographic technique that satisfies certain requirements described in the following section.

43 4..1 Requirements for a Steganographic Technique over RS Codes Any technique developed for this purpose has to take into account several factors, such as the optimal number and arrangement of 'borrowed' locations based on encoding characteristics, error patterns and error rate in the channel in order not to be detectable. Therefore any steganographic technique has to fulfill following conditions: Page 38 1) Deterministic algorithm ) Not eceeding the error-correction capacity of the code 3) Uniform distribution of steganographic data 4) Equal error patterns of steganographic data and natural errors 1) Deterministic Algorithm Locations of the steganographic bits in the received message have to be eactly determined. Certain steps arranged before the communication have to be performed in order to decode the hidden information. Without knowing the eact sequence of steps the recipient has to be unable to etract the steganographic data. The steps for embedding and etracting the hidden data may be either symmetric or asymmetric. In the first case the sender and the intended recipient perform the same steps when manipulating with the hidden data. In the second case the algorithms differ. In general, location of steganographic data may be determined by the decoder according: a) the actual block of data that is in the decoder (linear block codes) b) the previous inputs (decoder with memory based on convolutional codes) c) independently on the block of data Both types of error-correction codes (a, b) are described in the Section.. Generally, memory included in the convolutional codes brings more complication for the implementation comparing to the linear block codes and requires more computational power to perform the calculations. On the other hand memory represents an enhancement that makes the steganography algorithm harder to be revealed. However, successful breaking of the steganography algorithm does not only depend on the memory. Determination of the steganographic locations within the codewords and may be based independently on the block of data in the encoder or decoder, meaning that steganographic functions defined by Equations (4.3) and (4.4) would take one more parameter that would determine the

44 positions. The parameter is represented by a secret key that is delivered by a separate secure communication channel. The way of determining the steganographic positions should be chosen in respect to the application where the steganographic model over Reed-Solomon codes should be used as each application has its specific requirements. There are several possibilities how to design deterministic techniques on locating the steganographic positions. For the purposes of determining the positions all the techniques may be represented as hash functions in wider meaning. A hash function is a mathematical function that takes strings of arbitrary length as input and efficiently generates a string of fied length as output (Cid, 006). Page 39 A hash function may be mathematically denoted as a function: { } { } (4.5) such that for any binary input the hash function generates a binary output of length. Any function in the mathematical sense satisfies the condition of a deterministic procedure, meaning that for any given input it always generates the same output. Therefore the steganographic technique cannot calculate locations based on pseudo-random number generators, time, memory address or another variable that varies over the time. ) Not eceeding the error-correction capacity of the code Implementation of Reed-Solomon codes is generally designed in a way that their error-correcting capacity is overestimated, i.e. higher than error probability of the communication channel. This feature is the assumption of the steganography over the Reed-Solomon codes. Otherwise, introducing more errors into the codeword than error-correcting capability of symbols would result in inability of decoding the received codeword. It would mean a failure in the transmission not only of the hidden information but also of the cover information. Probability of changing original bit value in the steganographic location is (4.6) With the probability of 50% the original bit of the cover message already has the value that we want to encode as a hidden bit. On one hand this fact improves the undetectability of the steganography, on the other hand theoretically increases the amount of steganography that can be embedded into the cover

45 data by half. Practically, the goal is to find an optimal value between the amount of transmitted hidden data, detectability of the steganography and theoretical maimum capacity of the error-correction code. 3) Uniform distribution of steganographic data A steganographic technique over Reed-Solomon codes has to assure equal distribution of locations used for steganography. Locations chosen for steganography should be calculated with the same probability. Equal distribution may be managed by random bit generator. Page 40 Definition 4.1 (Oppliger, 005): A random bit generator is a device or algorithm that outputs a sequence of statistically independent and unbiased bits. 4) Equal error patterns of steganographic data and natural errors In order to be the steganographic technique undetectable, locations chosen by the technique have to match the pattern of the errors that naturally arise on the communication channel. Any deviation may arise in detecting steganography by steganalysis. Steganalysis is the art and science of detecting secret messages hidden by using steganography. The goal of steganalysis is to detect the hidden message by collecting evidence about its presence and to break the security of its carrier (Nissar and Mir, 010). In comparison with cryptanalysis that is used directly on encrypted data, steganalysis starts by inspecting lot of data without knowing whether hidden data is present or not. If the steganographic technique does not leave any suspicious artifacts on the cover data, the steganalysis technique does not even try to break it. The relation of the Reed-Solomon decoded symbol-error probability, probability may be epressed as (Odenwalder, 1976):, and channel symbol-error ( ) (4.7) Error probability is closely related to the Shannon s theorem describing the maimum information rate at which reliable communication is possible in a certain error probability channel. If the information rate of a given source does not eceed the capacity of a given channel, then there eists a coding technique that makes possible transmission through this unreliable channel with an arbitrarily low error rate (Moreira and Farrel, 006, p. 31).

46 4.. Specific Steganographic Technique over RS Codes By utilizing concepts and requirements of the steganographic model presented in the previous chapter, a specific technique is proposed. The aim of the technique proposed in the following tet is not to improve any specific application, however, to demonstrate and prove that the steganographic model works. The proposed technique utilizes the codeword polynomial in the actual block of data. Powers of in the codeword are used to determine the steganographic locations within the codeword itself. The steganographic technique relies on the fact that the codeword is fully recovered by the Reed- Solomon decoder after the transmission. Thus the same codeword is used to calculate the steganographic locations on the receiver s site as was on the sender s site as long as the codeword was recovered. Page 41 The number of steganographic locations calculated in one codeword is a variable for the algorithm, meaning that the amount of steganographic data may be accommodated to certain conditions of the actual application in order not to eceed the error-correction capacity of the Reed-Solomon code. Powers of from the highest degree downwards determine the symbols into which the steganographic data will be inserted. Powers of from lowest degree upwards determine the locations of the steganographic bit within the symbol. If the computed steganographic location is already used then the consequent unused bit is selected. The technique is illustrated in the Figure 9. Figure 9: Steganographic Algorithm over Reed-Solomon Codes The technique in the form of the flowchart diagram is illustrated in the Figure 10.

47 Start For 0 <= i < length End Page 4 stego_symbol = power_of_alfa(alfa_of_highest_power() - i) +1 stego_bit = power_of_alfa((alfa_of_lowest_power() + i) mod m) +1 stego_locations[i] = (stego_symbol 1)*m + stego_bit While the computed stego_locations[i] already in the array stego_locations[i] = (stego_location[i] mod n) + 1 Figure 10: Flow Chart of the Steganographic Technique Eample 4.1: Let the codeword be the same as in the Eample 3.4, Let the steganographic information in the binary form be As, no more than one symbol may be modified otherwise the modification may result in eceeding the error-correction capability of the Reed-Solomon code. For each steganographic bit the powers of in the codeword determine the position: Symbol Bit within the symbol

48 The nd symbol of the codeword is, in binary representation, according Table in the Chapter, is. The third bit will be used for encoding the steganographic information, resulting in binary, in eponential notation 0. The steganographic codeword would then be Page 43 Powers of in the codeword are related to the actual bits encoded in the codeword. Bits that are going to be transmitted are matched to the eponential notation of powers as described in the Chapter. If transmitted data is diversified enough, it may be assumed that also powers of are spread variously and the requirement of the uniform distribution of steganographic data is satisfied. However, if every block of transmitted data contains the same or just slightly different data then also powers of are the same, resulting in calculating the same steganographic locations. This fact predetermines the algorithm to be used in applications where no repetition schemes are used and steganographic are independently spread throughout the codeword, not grouped one by one.

49 5 Validation The proposed model for steganography in the Reed-Solomon codes is validated by eperimental research methods where series of tests are performed to prove its capabilities. For this purpose an application was developed that consists of Reed-Solomon and Steganographic coders/decoders. The application is developed in the Java programming language utilizing concepts of the object-oriented programming. As can be seen from the class diagram (Figure 11), classes are designed in a way that represent logical concepts in the same way as described in the thesis and thus may be used for educational purposes. All eamples mentioned in the thesis may be calculated by use of the classes. Page 44 Figure 11: Class Diagram 5.1 Methodology of the Validation The application simulates the process of coding and decoding information transmitted through a noisy channel with hidden data embedded into it as described in the Figure 8. As the eperimental design I have chosen the true eperiment, meaning that information as well as steganographic data and errors are generated randomly by use of java.utils.random class. True eperiment maimizes internal validity by eliminating any systematic error.