Steganography is the art of hiding information in a
covert channel. Unlike
cryptography, which tries to hide the content of a message, steganography tries to hide the very existance of a message.
There are three basic kinds of modern steganography:
pure steganography,
secret key steganography and
public key steganography. Before talking about the differences, a little
terminology should help.
Cover
A harmless message that won't raise suspicion. Many modern steganography systems use digital pictures or digital audio as covers.
Stego-object
A cover that has a message embedded in it.
Secret Key
This is a key that both parties must have before encoding or decoding a message(just like in
secret key cryptography).
Public Key
A key that can be used to encode a message which can only be decoded with its
private key(just like in
public key cryptography).
Private Key
A key that can be used to decode a message encoded with its
public key(just like in
public key cryptography).
Alice
One of the participants in steganographic exchange(yes, steganography literature makes use of cute names, just like most
cryptography literature).
Bob
The other legitimate participant in the exchange.
Wendy
Wendy is the warden. She is a
passive,
active or
malicious attacker.
Steganography literature often uses the
prisoners' problem to illustrate message exchanges, so I will too. The situation is, Alice and Bob are prisoners kept in seperate cells. They want to talk to each other about an
escape plan, but the only way they can communicate is by giving messages to the warden, Wendy, for delivery to the other person. If Wendy notices anything suspicious, she'll throw both of them into solitary and refuse to relay further messages. So Alice and Bob have to hide their messages in a harmless message(a
cover).
Pure Steganography requires two functions, one to
encode message into a cover and another to
decode. Since it's security lies only in the secrecy of the two functions, it is not very secure in practice(it violates
Kerckhoffs' principle).
Secret key steganography uses a
secret key to encode the message into a cover. This means that even is the warden knows the algorithm being used, she still cannot decode the stego-object until she learns the
key. This makes it much more secure in practice.
Public key steganography uses a
public key to encode the message into a cover and a
private key to decode the message. Just like
public key cryptography, public key steganography is
vulnerable to the "man in the middle" attack. This is where Wendy replaces the
public keys with her own during the key exchange. So when Bob encodes a message for Alice, he is really encoding it using Wendy's
public key. From there, Wendy can either
decode the message and
encode it with Alice's
public key before passing it on, or be malicious and send her own message to Alice, pretending to be Bob.
For more information, check out Katzenbeisser and Petitcolas' excellent book "Information Hiding" or:
http://www.cs.uct.ac.za/courses/CS400W/NIS/papers99/dsellars/stego.html