| Assignment | Required points | Extra points |
|---|---|---|
| DefCon | 5 points | 3 points |
| Timing attack | 5 points | 5 points |
| Steganography/steganalysis | 10 points | 0 points |
| AVAST - part 1 | 2 points | 3 points |
| AVAST - part 2 | 2 points | 3 points |
| Total | 24 points | 14 points |
| Grade | Points |
|---|---|
| A | 21 - 24 |
| B | 18 - 20 |
| C | 15 - 17 |
| D | 13 - 14 |
| F | 0 - 13 |
* Gentle introduction to steganography and steganalysis is here. The proof of Square root law for independent covers can be found here Square root law requires linear key, Andrew D. Ker, 2009.
Implementation of Least Significant Bit Matching. Embedding function has signature function embed(iFileName,message,key,oFileName), extraction function has signature function message=extract(image,key). Script to verify correctness of the solution can be found here.
* Explanation of Fisher Linear Discriminant classifier, Receiver operator characteristics, threshold selection.
Implement Fisher Linear Discriminant as a function v=fld(P,N), where P is the matrix with positive samples (each row corresponds to one sample), N is the matrix with negative samples. Implement function drawing Receiver Operating Characteristics as function roc(P,N,w) (use plot to plot the graph do not forget to label axes).
* Introduction to modern steganalytic features. Paper about SPAM features and their later extensions rich models and PSRM features.
Implement (1st order) SPAM features as a function f=spam(image_name).
* Implement your own detector of LSB matching and use it on images downloaded from [Will be provided soon]. Images for training can be downloaded here covers. Decision of your classifier should be submitted in a column vector, where 1 mean image is stego, 0 mean image is cover. The order should reflect the names (ids) of images.
* Provide the output of your detector on ranking images. The output should be a text file with one column, where every line is the output of the detector on one image, ordered according to image numbers. Zero means image is cover (without a message), whereas one means image is stego (with a message). Accuracy over 70% gives 2 points, below 60% zero.
Demonstrate an attack on timing vulnerability in Google Keyczar library HMAC computation. Your goal is to find the signature of a message without knowing the correct key.
Download the bundle - Keyczar bundle. The bundle contains:
The project should be easy to import to any IDE from Maven model.
Example how to run the HMAC verifier:
Verifier keyCzarVerifier = new Verifier("keys"); //Directory containing a key set - for more info see JavaDoc byte[] message = "Hello world".getBytes(); //original message in plain-text byte[] hMAC = new byte[]{}; //HMAC signature of the message boolean result = keyCzarVerifier.verify(message, hMAC);
Extra points (3 extra points) for performing the attack by interprocess communication (via stdin/out - class cz.cvut.keyczar.homework.VerificationServer) instead of directly calling and timing the verifier.
Allowed relaxations: