From: TO1SITTLER@APSICC.APS.EDU (Kragen Sittler)
Date: Wed, 26 May 93 11:52:16 PDT
To: cypherpunks@toad.com(Those rascals...)
Subject: Re: Steganography and Steganalysis
Message-ID: <930526125012.3b06@APSICC.APS.EDU>
MIME-Version: 1.0
Content-Type: text/plain


Begin quote from gnu@toad.com on Tue, 25 May 1993 15:27:27 -0700
From: gnu@toad.com (John Gilmore)
Message-Id: <9305252227.AA27968@toad.com>
To: kqb@whscad1.att.com, cypherpunks@toad.com, gnu@toad.com
Subject: Re: Steganography and Steganalysis 
In-Reply-To: <9305252149.AA27051@toad.com> 
Date: Tue, 25 May 93 15:27:27 -0700

My favorite scheme was to encode messages in trailing spaces and/or tabs
in netnews messages.  You could also put internal tabs in place of spaces.

In fact, you could do this with news messages that flow "through" your 
site, (if the messages aren't protected with a crypto checksum), so that
you would not be the message's sender (and it wouldn't be addressed to anyone
either -- recipients get very good privacy).

This would be one way for a Unix "worm" program to report back to its
master...and/or receive instructions.

	John Gilmore

PS:  You could put short interesting stuff just in your message-ID's!
Not to mention the low order bits of timestamps (exactly *what* second
did it arrive, now?).
=====================================================================
Trailing spaces, however, are likely to be changed by other sites: padded
or cut.  This might be a good idea if you used mime/PGP's radix-64 or uuencode
or something similar. 

Kragen