Cryptography and steganography are often confused, but they meet two different needs. Cryptography makes a message unreadable: everyone can see that it exists, but only someone with the key can understand it. Steganography hides the very fact that a message exists: an observer sees an ordinary image, a harmless text, an audio file, without suspecting anything. Knowing the differences helps you understand what each can offer and where it stops.
Two different questions
| Cryptography | Steganography | |
|---|---|---|
| Goal | Prevent the content from being read | Prevent anyone noticing there is content |
| What an observer sees | Unintelligible, obviously encrypted data | An ordinary file |
| If discovered | The content remains protected by the key | The message is exposed, unless it is also encrypted |
| Foundation | Hard mathematical problems | The ability to go unnoticed |
The term comes from Greek and means "covered writing". Cryptography, by contrast, is "hidden writing" in the sense of secret.
An ancient history
Steganography has very old precedents. Herodotus tells of a message tattooed on the shaved head of a servant and sent once the hair had grown back. For centuries invisible inks were used, appearing only when the paper was heated or treated with a chemical. During the Second World War microdots spread: entire pages photographed and shrunk to the size of a typographic full stop, hidden in seemingly mundane letters.
In all these cases security depended on a single thing: that nobody thought to look.
Digital steganography
Digital files offer plenty of room to hide information without human senses noticing.
The least significant bit
The simplest technique concerns images. Each pixel of a colour image is described by numerical values for red, green and blue, typically from 0 to 255. Changing the last bit of these values, for example from 200 to 201, produces a colour change invisible to the eye. By replacing those last bits with the bits of a message, an image of a few megapixels can hold hundreds of kilobytes of hidden data.
Other carriers
- Audio: small variations in sound samples, imperceptible to the ear.
- Text: spaces, invisible characters or nearly identical typographic variants.
- File formats: data inserted into areas that programs ignore, such as the end of a file or metadata fields.
- Network communications: information encoded in the timing between packets or in rarely used protocol fields.
Legitimate uses: digital watermarks
One of the most widespread applications is digital watermarking: information hidden in an image, video or document to identify its owner or the specific copy. If a file distributed as a preview to a few recipients turns up online, a different watermark for each one reveals which copy the leak came from.
Unlike classic steganography, a good watermark must be robust: it must survive compression, resizing and cropping.
Malicious uses and why they matter for defence
Steganography is also used by those who attack systems: to hide instructions or pieces of malicious code inside seemingly innocent images, or to move data out of a corporate network without attracting the attention of monitoring systems. For anyone working in security and digital forensics, knowing these techniques exist means not stopping at the surface of a file.
Steganalysis: uncovering what is hidden
The discipline that tries to detect hidden messages is called steganalysis. It relies on the fact that inserting data alters, however slightly, the statistical properties of a file:
- in natural images the least significant bits have a certain structure; a message, especially an encrypted one, makes them abnormally uniform;
- a file may have a size or characteristics incompatible with its declared format;
- comparison with the original, when available, immediately reveals the differences.
The more data is hidden, the more detectable the change becomes. It is a constant trade-off between capacity and invisibility.
Why use them together
Steganography on its own violates Kerckhoffs's principle: its security depends on keeping the method secret. Once someone suspects the hiding place and knows the technique, the message is exposed.
That is why, when hiding a message, you encrypt it first. Encrypted data has a further advantage: it looks like random noise, which is easier to blend in with an image's small natural variations. If the hiding place is discovered, the content is still protected by the key.
In short
- Cryptography makes a message unreadable; steganography hides the fact that it exists.
- From invisible inks to microdots, steganography has a long history.
- Digitally, data is hidden in the least significant bits of images, audio and files.
- Digital watermarks are a legitimate application for tracing copies and ownership.
- Steganalysis detects statistical anomalies, which is why a message should always be encrypted before it is hidden.
