Variola wrote...
Well, that the recipient of the message may not be on their own machine (not running "Rubberhose"), etc...What's missing? What part of your threat model didn't they consider?
Stego your activist photos into kiddie porn which is stegoed into >random plaintext cover images. When they discover your thoughtcrime, >they stop looking.I thought about this, but it has some problems in some cases. For one, if I know "they" are looking for (say) a simple text list, and I want them to get their list (so to speak), I will need to "hide" the list in a simple text list, and this doesn't sound very stego-friendly.
In addition, they may not know that there's some stego in that photo NOW, but they'll hold on to the evidence for later. And one day they may have reason to check for more. It's better, then, to have the option of having the data be destroyed if the fake key is used.
Yes, this I think is the rub. Of course, the encrypt and decrypt programs could be different, with the decryption program showing no hint of the fact that two keys could be used for the same message (one of which leading to the false data). But that's only good for non-savvy types....images smuggled out of banana republics and so on.Gotta hide the tools, too, BTW, since you can assume They know how they are used. I don't know if the CIA advised the chinese underground on this re Pink Triangle or whatever. Else mere possession of the thing (like owning a one-hole glass flute with a faucet screen occluding the hole) makes you doubleplus unperson.
I need to dig into my theory, but of course it would be nice if some messages so encrypted were reverse-compatible with existing systems (in other words, if I sent a message so encrypted to old PGP software, both keys will work just fine to decrypt that message). I don't consider this too likely, but I'll have to dig into the nitty-gritty of PGP to see. But if this were possible, it would solve that issue. Nobody would ever know if the user were even aware of this dual encryption.
What the heck is Aerosil? Is that like UBIK?--- Got Aerosil?
_________________________________________________________________
Tired of spam? Get advanced junk mail protection with MSN 8. http://join.msn.com/?page=features/junkmail
