Wednesday, August 1, 2007

How to do steganography and NORVA Messaging the crypto way

Veering off the topic of SALWISS displays, we are going to examine, and possibly quiz some of you on the CAIRNORVA decryption. Meanwhile, here is a how-to on a neat steganography method that I found on a forum. It is a set of very simple steps:

  • Create a public key;
  • Export the public key;
  • Use Clip Secure, or an equivalent;
  • Set Clip Secure to the OFB mode;
  • Encrypt a short text mesaage with CS in OFB mode, make sure that the cyphertext is no longer than 64 symbols;
  • Copy and paste the cyphertext at the beginning of the public key, then - trim the key so that the whole assembly looks innocent. Make sure the cyphertext is not chopped or altered.


Test:
Load the
key text minus the headers into SC and decrypt. Should be fine.
The public key, however, is corrupted beyond recovery. That is OK.
You post it anonymously to the internet, for example, as a new user of a forum which has an naturally designated slot suitable for a PGP key in user profile, or just into any other area where it is unlikely to arouse suspicion, but render it easy to locate intentionally.

Provided the user's true identity and anonymity has been preserved, it is additionally crucial to ensure that this modified key can be traceable. Now the person for whom it was intended may safely copy it without arousing any suspicion by being aprt of a completely benign traffic of the forum.

The bogus key may arouse suspicion
(which is highly unlikely) only when and if a third party will attempt to use it.

Back to the CAIRNORVA. The encrypted message:

GLENN STAKE THAT FAME THREE FOUR THREE ON BOOK.

BUSH LAKE GATES THREE SEEING MOLD MAKE.

GROVE NOTHING BOOK SEVEN WARMING THE JACK.

Take note of the definite, non-abstract nouns – these are your hints. Of course, this goes without saying, do not go on the wild goose chase analyzing the BOOK being repeated, if you have no previous experience with CAIRNORVA.

I used the simplest lexicon encryption. Almost the one you can find on Spammimic.I think you’ll have no problem unbuttoning this:

Dear Salaryman , Thank-you for your interest in our

letter ! If you are not interested in our publications

and wish to be removed from our lists, simply do NOT

respond and ignore this mail . This mail is being sent

in compliance with Senate bill 1619 ; Title 6 , Section

307 . This is not multi-level marketing . Why work

for somebody else when you can become rich inside 43

MONTHS . Have you ever noticed people will do almost

anything to avoid mailing their bills and more people

than ever are surfing the web . Well, now is your chance

to capitalize on this . WE will help YOU turn your

business into an E-BUSINESS & use credit cards on your

website ! You can begin at absolutely no cost to you

. But don't believe us ! Mrs Anderson who resides in

Arkansas tried us and says "My only problem now is

where to park all my cars" ! This offer is 100% legal

. If not for you then for your loved ones - act now

. Sign up a friend and you'll get a discount of 40%

. Warmest regards .

This rather wordy encryption unbuttons to data relayed , using rancid as the password.

Again, I would remind you that repeat occurrences of nouns can truly throw you a curve ball. That much I can disclose to you.
The beauty of CAIRNORVA is that you can encrypt short messages without a code book or a PC, or a palmtop. An added-on value is that the method would teach you to think clearly, formulate your message into a simple, crisp sentences, and you might just benefit from this process of a collateral benefit – you might become a Hemingway! Send those unbutton messages by e-mail, y’hear?

No comments: