Hiding rather than scrambling

Steganography vs cryptography

Cryptography and steganography pursue the same goal — protecting a communication — but by two opposite routes. Confusing them is a classic mistake.

Two opposing strategies

Cryptography makes a message unreadable. It is plain to see that a communication exists, but its content is scrambled: without the key, all you read is a string of unintelligible characters.

Steganography does something else: it hides the very existence of the message. No one suspects that a communication is taking place, because the secret is concealed within an innocuous-looking carrier — a holiday photo, an audio recording, a mundane piece of text.

In Greek, steganos means "covered, hidden" and graphein "to write": literally, hidden writing.

The table to remember

+------------------+---------------------------+---------------------------+
|                  |     Cryptographie         |     Stéganographie        |
+------------------+---------------------------+---------------------------+
| Ce qui est caché | le CONTENU du message     | l'EXISTENCE du message    |
| L'observateur... | voit un message chiffré   | ne voit rien d'anormal    |
| Support typique  | texte chiffré assumé      | image, son, texte anodin  |
| Si on l'intercepte| on sait qu'il y a secret | on ne le soupçonne pas    |
+------------------+---------------------------+---------------------------+

A few historical examples

The idea is very old:

invisible ink (lemon juice, revealed by heat): the message only appears if you know it is there;
the photographic microdots of the 20th century: an entire text reduced to the size of a punctuation mark;
Greek antiquity: Herodotus recounts that Histiaeus had a message tattooed on the shaved scalp of a slave, then waited for the hair to grow back before sending him.

In all these cases, an observer sees nothing: no ciphertext, no sign of communication.

The two are complementary

The opposition should not mislead: in practice, you do not choose one against the other, you combine them.

The right method is to encrypt first, hide afterwards:

you encrypt the message (it becomes unreadable);
you hide this encrypted message in an innocuous carrier (it becomes invisible).

Thus, if the concealment is discovered, the attacker still comes across a ciphertext they cannot read. The two layers reinforce each other: steganography protects the existence, cryptography protects the content.

In summary