Steganography: Hide the Message, Not the Meaning

Encryption changes a message so unauthorized readers cannot understand it without the required cryptographic material.

Steganography takes a different approach: it hides the existence or location of information inside another object.

A message might be concealed inside an image, audio file, document, or other carrier.

The important distinction is:

• encryption tries to protect meaning
• steganography tries to conceal presence or location

They can be combined, but they solve different problems.

A file has structure

A digital image is not just what appears on the screen.

A file can contain:

• header information
• image or media data
• metadata
• unused or optional fields
• appended data, depending on format and tool behavior

That means a visual inspection is not always enough to understand the entire artifact.

Metadata can reveal information

A fictional photo may contain metadata such as:

• dimensions
• camera model
• creation timestamp
• software used to edit it
• orientation

Some files can also contain location-related metadata.

For classroom work, use only teacher-provided synthetic files.

Do not analyze personal photos from classmates or staff.

Hidden is not encrypted

Suppose a text message is embedded inside a supplied image.

If anyone who knows the hiding method can extract the message, the message itself may have no confidentiality protection.

Steganography can reduce visibility, but secrecy still depends on the design.

Build the concealment model

Use this sequence:

payload → carrier file → embedding method → stego file → detection/extraction

Define:

• payload: information being hidden
• carrier: file used to hold it
• stego file: resulting file after embedding

Then compare this with:

plaintext → encryption + key → ciphertext → decryption + key → plaintext

Create a side-by-side diagram showing the difference.

File-size clue

A teacher provides two synthetic files:

poster-original.png    412 KB
poster-suspect.png     438 KB

The larger size is a clue, not proof.

Possible explanations include:

• different compression
• metadata
• editing history
• hidden or appended content

A defender should investigate the structure instead of jumping directly to steganography.

Metadata lab

The teacher provides three synthetic media artifacts and a metadata report.

For each artifact, identify:

• file type
• dimensions
• creation or modification information supplied by the lab
• software field, if present
• suspicious or unusual metadata
• what the metadata does not prove

Stego detection is an evidence problem

Possible clues can include:

• unexplained file-size change
• metadata inconsistent with the story
• unexpected data after a normal file structure
• known steganography-tool markers in a classroom artifact
• extracted payload from an approved tool

No single clue should be treated as universal proof.

Build an analyst hypothesis

Use this fictional situation:

Two copies of a school-logo image look identical. One is 28 KB larger. The larger file contains a metadata comment that says archive=week12.

Write:

Observation

What can you actually see in the supplied evidence?

Hypothesis

What might explain the difference?

Alternative explanation

What non-steganographic explanation is still possible?

Next safe test

Which teacher-approved analysis step would help?

Evidence for Lesson 1

Submit:

• encryption-versus-steganography diagram
• three-artifact metadata table
• file-size clue analysis
• analyst hypothesis

Finish with:

Steganography can hide ________, but it does not automatically protect ________.

The lesson is to separate concealment from confidentiality and treat hidden-data claims as something that must be demonstrated with evidence.