Outline

• Information Hiding
• HW Problem
• Start Authentication

Information Hiding

• Digital Watermarks
  • Example: Add "invisible" identifier to data
  • Defense against music or software piracy
• Steganography
  • "Secret" communication channel
  • Similar to a covert channel (more on this later)
  • Example: Hide data in image or music file

Watermark

• Add a "mark" to data
• Visibility of watermarks
  • Invisible -- Watermark is not obvious
  • Visible -- Such as TOP SECRET
• Robustness of watermarks
  • Robust -- Readable even if attacked
  • Fragile -- Damaged if attacked

Watermark Examples

• Add robust invisible mark to digital music
  • If pirated music appears on Internet, can trace it back to original source of the leak
• Add fragile invisible mark to audio file
  • If watermark is unreadable, recipient knows that audio has been tampered (integrity)
• Combinations of several types are sometimes used
  • E.g., visible plus robust invisible watermarks

Non-digital Watermark Example

• Non-digital watermark: U.S. currency
• Image embedded in paper on the right hand side -- Hold bill to light to see embedded info

Watermark -- What we'd like

• Add invisible watermark to photo
• Claimed that 1 inch² contains enough info to reconstruct entire photo
• If photo is damaged, watermark can be used to reconstruct it!

Steganography

• According to Herodotus (Greece 440 BC)
  • A Greek General shaved a slave's head
  • Wrote message on head
  • Let hair grow back
  • Sent slave to deliver message
  • Recipient shaved slave's head to expose the message -- warning of Persian invasion
• Historically, steganography used more often than cryptography

Images and Steganography

• Images use 24 bits for color: R G B (if no alpha channel)
• 8 bits for red, 8 for green, 8 for blue
• For example,
  0x7E 0x52 0x90 is this color
  0xFE 0x52 0x90 is this color
• While
  0xAB 0x33 0xF0 is this color
  0xAB 0x33 0xF1 is this color
• Low-order bits don't matter...

Images and Stego

• Given an uncompressed image file... For example, in BMP format
• ... we can insert information into low-order RGB bits
• Since low-order RGB bits don't matter, result will be "invisible" to human eye
• But, computer program can "see" the bits

Stego Example 1

• Left side: plain Alice image
• Right side: Alice with entire Alice in Wonderland (pdf) "hidden" in low order bits in the image

Non-Stego Example

• Walrus.html in web browser
  "The time has come," the Walrus said,
  "To talk of many things:
  Of shoes and ships and sealing wax
  Of cabbages and kings
  And why the sea is boiling hot
  And whether pigs have wings."
  
• "View source" reveals:
  

  <span style="color:#000000">"The time has come," the Walrus said,</span><br />
  <span style="color:#000000">"To talk of many things: </span><br />
  <span style="color:#000000">Of shoes and ships and sealing wax </span><br />
  <span style="color:#000000">Of cabbages and kings </span><br />
  <span style="color:#000000">And why the sea is boiling hot </span><br />
  <span style="color:#000000">And whether pigs have wings."</span><br />
  

Stego Example 2

• stegoWalrus.html in web browser
  "The time has come," the Walrus said,
  "To talk of many things:
  Of shoes and ships and sealing wax
  Of cabbages and kings
  And why the sea is boiling hot
  And whether pigs have wings."
  
• "View Source" Reveals
  

  <span style="color:#000101">"The time has come," the Walrus said,</span><br />
  <span style="color:#000100">"To talk of many things: </span><br />
  <span style="color:#010000">Of shoes and ships and sealing wax </span><br />
  <span style="color:#010000">Of cabbages and kings </span><br />
  <span style="color:#000000">And why the sea is boiling hot </span><br />
  <span style="color:#010001">And whether pigs have wings."</span><br />
  

Steganography

• Some formats (e.g., image files) are more difficult than html for humans to read
  • But easy for computer programs to read...
• Easy to hide info in unimportant bits
• Easy to destroy info in unimportant bits
• To be robust, must use important bits
  • But stored info must not damage data
  • Collusion attacks are another concern (By comparing an orginal image and one with a watermark figure out how it works so can remove in future)
• Robust steganography is tricky!

Information Hiding: The Bottom Line

• Not-so-easy to hide digital information
  • "Obvious" approach is not robust
  • Stirmark: tool to make most watermarks in images unreadable without damaging the image
  • Stego/watermarking active research topics
• If information hiding is suspected
  • Attacker may be able to make information/watermark unreadable
  • Attacker may be able to read the information, given the original document (image, audio, etc.)

HW Problem

Problem 5.33 Consider a "2 out of 3" secret sharing scheme.

1. Suppose that Alice's share of the secret is `(4, 10/3)`, Bob's share is `(6,2)`, and Charlie's share is `(5, 8/3)`. What is the secret `S`? What is the equation of the line?
   Answer. Using the first two points, the slope of the line is `frac(10/3 - 2)(4 - 6) = -2/3`. Using point slope, the equation of the line is `y - 2 = -2/3(x-6)`, i.e., `y = -2/3x + 6`. So the secret is `6`.
2. Suppose that the arithmetic is taken modulo `13`, that is, the equation of the line is of the form `ax + by = c (mod 13)`. If Alice's share is `(2,2)`, Bob's share is `(4, 9)`, and Charlie's share is `(6,3)`, what is the secret S? What is the equation of the line mod 13?
   Answer. The slope is `(9-2)(4-2)^(-1)`. `7 = 2^(-1) mod 13`. So this gives the slope is `10 mod 13`. Using the point slope formula, we have `y - 2 = 10(x - 2)`. So `y = 10x - 18 = 10x - 5 = 10x + 8`. So the secret is `8`.

Access Control

We are now going to switch away from crypto are start talking about access control...

• There are two parts to access control...
• Authentication: Are you who you say you are?
  • Determine whether access is allowed
  • Authenticate human to machine
  • Or authenticate machine to machine
• Authorization: Are you allowed to do that?
  • Once you have access, what can you do?
  • Enforces limits on actions
• Note: "access control" often used as synonym for authorization

Are You Who You Say You Are?

• How to authenticate human to use a machine?
• Can be based on...
  • Something you know -- For example, a password
  • Something you have -- For example, a smartcard
  • Something you are -- For example, your fingerprint

Something You Know

• Lots of things act as passwords!
  • PIN
  • Social security number
  • Mother's maiden name
  • Date of birth
  • Name of your pet, etc.

Trouble with Passwords

• "Passwords are one of the biggest practical problems facing security engineers today."
• "Humans are incapable of securely storing high-quality cryptographic keys, and they have unacceptable speed and accuracy when performing cryptographic operations. (They are also large, expensive to maintain, difficult to manage, and they pollute the environment. It is astonishing that these devices continue to be manufactured and deployed.)"

Why Passwords?

• Why is "something you know" more popular than "something you have" and "something you are"?
• Cost: passwords are free
• Convenience: easier for admin to reset password than to issue a new thumb

Keys vs Passwords

• Crypto keys
  • Suppose key is 64 bits
  • Then `2^64` keys
  • Choose key at random...
  • ..then attacker must try about `2^63` keys
• Password
  • Suppose passwords are 8 characters, and 256 different characters
  • Then `256^8 = 2^(64) pwds`
  • Users do not select passwords at random
  • Attacker has far less than `2^(63)` passwords to try (dictionary attack)

Good and Bad Passwords

• Bad passwords

  frank
  Fido
  password
  4444
  Pikachu
  102560
  AustinStamp
  

• Good Passwords?

  jfIej,43j-EmmL+y
  09864376537263
  P0kem0N
  FSa7Yago
  0nceuP0nAt1m8
  PokeGCTall150
  

Password Experiment

• Three groups of users -- each group advised to select passwords as follows

  Group A: At least 6 chars, 1 non-letter
  Group B: Password based on passphrase
  Group C: 8 random characters
  

• Results

  Group A: About 30% of pwds easy to crack
  Group B: About 10% cracked --
     Passwords easy to remember
  Group C: About 10% cracked --
    Passwords hard to remember
  

Password Experiment II

• User compliance hard to achieve
• In each case, 1/3rd did not comply -- and about 1/3rd of those easy to crack!
• Assigned passwords sometimes best
• If passwords not assigned, best advice is...
  • Choose passwords based on passphrase
  • Use pwd cracking tool to test for weak pwds
• Require periodic password changes?