steghide(1)

NAME
steghide - a steganography tool

SYNOPSIS
steghide [-i --interactive] -w --write --embed | -r --read --extract [-s --space] [-H --stegoheader] [-e --encryption] [-m --mask] [-cf --containerfile] [-sf --stegofile] [-pf --plainfile] [-v --version] [-h --help]

DESCRIPTION
Steghide is a steganography tool which is able to hide data in "container files" and to extract this data again. Steghide is designed to be portable and configurable and features hiding data in bmp, wav and au files, blowfish encryption, MD5 hashing of passphrases to blowfish keys and pseudo-random distribution of hidden bits ("stego bits") in the container data. Steghide can be run in interactive mode or in non-interactive mode. Non-interactive mode simply means that steghide is called from the command line with some arguments. If steghide is started without arguments or with the "-i" argument only, then interactive mode is started. In interactive mode you need not enter all arguments on one line (like you would have to if you would call steghide directly from the command line), but can type one or more arguments, then hit return and type more arguments on another line and so on. In interactive mode, all commands have the same syntax as the arguments on the command line. A stego file (a bmp, wav or au file with embedded data) has a special format: The first three bytes after the "native header(s)" (bmp, wav or au header(s)) contain a value in their least significant bits: the amount of space between two bytes in the stego file that contain an embedded bit of the "stego header". The stego header is a few bytes long and contains the information that is necessary to permit the receiver to extract the plain data from the stego data again. Immediately after the last byte that contains a hidden bit of the stego header is the first byte that contains a hidden bit / hidden bits of the plain data. Steghide is able to encrypt the plain data before embedding it / after extracting it. The encryption process works as follows: The user enters a passphrase that can be of any length. Steghide hashes this passphrase to a 128 bit value using the MD5 algorithm. This 128 bit hash value is passed to blowfish and used as a key for encrypting or decrypting the plain data and/or the stego header. Steghide is able to use bmp, wav and au files as container files. The file format of the container and the stego file is detected automatically. However, there are some restrictions: only Windows 3.1 and later bmp files, OS/2 1.x bmp files; pcm wav files with a bit per sample rate that is a multiple of 8; and all au files can be used. These "sub-"formats are the most common anyway so it will hardly ever happen that steghide refuses to hide data in a file because it does not know its format. If you are in doubt if the file you want to use is in one of the formats mentioned above, just try it.

OPTIONS

-i, --interactive
    If this argument is given or if no arguments are given at all, steghide starts in interactive mode. In interactive mode, all arguments have the same syntax as on the command line, however there are two more commands than on the command line: You can quit steghide (without embedding or extracting data) if you type "quit" or "cancel". If you have finished giving arguments you can embed or extract data if you type "start" or "ok". To get help you can type "help" which prints the same info as "-h" or "--help" but does not quit afterwards.

-w, --write, --embed
    Embed plain data in container data, resulting in stego data.

-r, --read, --extract
    Extract plain data from stego data.

-s, --space
    This argument defines the method that is used to calculate the space between two bytes that contain hidden data ("stego bytes") in the stego file. You can choose among two different methods: a constant space and a pseudo-random space. To use a constant space you have to specify this argument in the following form: "-s cnst <a>", whereas "cnst" tells steghide to use a CoNSTant space and <a> is a decimal number that defines the amount of space between two stego bytes (in bytes). To use a pseudo-random space this argument should be given as follows: "-s linc <a> <b>", whereas "linc" tells steghide to use pseudo-random numbers that are generated using a LINear Congruency generator, <a> is the seed of the generator (<a> can be any positive integer, but will be truncated if its value exceeds 2^32) and <b> is the maximum value that the generator will output and therefor also the maximum space between two stego bytes. This argument ("-s") must always be given if "-w" is activated (if data is embedded) and will be ignored if "-r" is activated.

-H, --stegoheader
    This argument defines how the "stego header" is embedded in the container file. The first argument of -H can be a a value for the constant space (must be between 0-7). This value is also embedded in the container file to make it possible for the receiver to extract the senders message again. If you omit this number, a random number is chosen if -w is enabled. If -r is enabled the number you specify is ignored because the correct value is embedded in the file anyway. The second argument of -H is the encryption algorithm that is used to encrypt the stego header. You have two possibilities: "blowfish" and "none". If you specify "none" the stego header will not be encrypted which is very insecure. If you specify "blowfish" the stego header will be encrypted with the blowfish algorithm. You then have to specify a passphrase as third argument of -H. If this passphrase consists of more than one word, you must enclose it in quotes ("). This will enable the program to recognize the passphrase as one argument. If you specify "none", you - of course - do not need a passphrase. If the -H argument is not given and data is embedded, a random number is used as constant space and no encryption is used. If -H is not given and data is extracted it is supposed that the embedded stego header is not encrypted. Be careful: Steghide can not find out if an embedded stego header is encrypted or not, you have to tell it! It can lead to weird results or error messages if you tell steghide that an embedded and encrypted stego header is not encrypted.

-e, --encryption
    This argument defines if and which encryption is applied to the plain data before embedding it / after extracting it. You have three different possibilities: "blowfish", "sthdr" and "none". If you specify "blowfish", the second argument of -e is a passphrase (use quotes if the passphrase is longer than one word!). If you specify "sthdr", the same encryption (with the same passphrase) that has been applied to the stego header is used on the plain data (this can be blowfish or none). This option is pretty handy if you want to use the same encryption (and the same passphrase) for the stego header and the plain data but do not want to type your 789-character passphrase twice. If you specify "none" then - you guessed it - the plain data is not encrypted.

-m, --mask
    This argument is followed by a decimal number which specifies an 8 bit mask that is used to hide data in the container bytes. If the mask is for example 3 then data is embedded in the least significant and second least significant bit of the container byte. Normally, you do not have to worry about this. The default is 1 which is pretty secure, you should not change it. Note that it can be very insecure to embed data in bits other than the least significant.

-cf, --containerfile
    This argument is followed by a filename. This file will be used as container file (file in which data will be embedded).

-sf, --stegofile
    This argument is followed by a filename. The given file will be used as stego file (file that contains or will contain embedded data).

-pf, --plainfile
    This argument is followed by a filename. This file will be used as plain file (file that contains the data to be embedded / will contain the embedded data).

-v, --version
    Print version information.

-h, --help
    Print short help (usage information).

AUTHOR
Stefan Hetzl <shetzl@teleweb.at>