How to insert password encryption on steganography

Hi everyone, I wanna ask you how to insert password encryption on steganography, so that before embed process, the user should input the password. Then cover image save message as the stego file. It will do the same when user want to extracting message from stego image: user needs to input the correct password.

Here is the process embed/extract that I use for the program. Please, I need your advice. Thanks.

[Walter Roberson]

You wrote all of that but you do not know how to use inputdlg() to get a string from the user ???

[Bakka]

Hi Mr. Walter, I don't know how to embedding password that user type to image as a key, so when the user need to extract message file (hide in image before), program will ask the previous password that user input on embedding process.

Please need your advice

[ayidh alharbi]

He mans that he answered you , the answer is

inputdlg();

Cheers,

[Walter Roberson]

No, my answer is "Don't do that!"

[Tommy Halim]

Can I get your full code please?

Answer 1

[Image Analyst]

Try this:

thePassword = inputdlg('Enter the password:', 'title Bar', [1 50])

[Bakka]

According from your answer is true, but I need that the codes will save character password in the image, then it will be called by the program at Extracting Process GUI, if the password not same as Embedding Process, the message won't extract correctly. Need your advice

[Image Analyst]

I don't work in steganography/cryptography. You can search here for articles by people who do : http://iris.usc.edu/Vision-Notes/bibliography/contents.html

[Bakka]

thank you for your info, but I didn't get the point yet.

Answer 2

[Walter Roberson]

It seldom works like that. The password does not get embedded in the image, usually. Instead, the password is used to influence how the hidden information is to be written. Then when the end user wants to extract the hidden information, they must supply the password and the password is used to influence how the hidden information gets read back. If they did not supply the right password, the information retrieved will not look correct. If you put in enough error detection coding, you can detect with relatively high probability whether the data was retrieved correctly.

When the password gets embedded in the image, there is a danger that someone could extract the password and then use it to retrieve the hidden information, so instead of putting it in the image, just make it so that if they give you the wrong password that what comes back will be nonsensical.

[Bakka]

would you please give me algorithm for authentication password before decrypt message? so when the user input password (exp. pass123) then they input the wrong password for extraction, the message will show wrong character information. need your advice, many thanks

[Walter Roberson]

Good security would say "Don't do that." Make the attacker spend the time decrypting the message. Let the attacker decide whether the resulting message is the right message or not. If you give an error message before decrypting the message, then 1) The user can quickly switch to another attempt, and do that over and over until you tell them they got the key right; and 2) the user will know they got it right because you didn't complain that they had the wrong key. Best security practice is to make every decryption (whether correct key or not) take exactly the same time so that the attacker cannot tell by analyzing timings whether they got the right answer, and best security practice would to use an encryption algorithm that could in theory present a completely wrong message if the attacker did not know the right key.

There is an encryption method called "One-Time-Pad" in which you distribute a shared key to the person who has to decode the message. To encrypt you perform a simple operation such as XOR'ing the shared key with the message. Upon receive the destination performs the same reversible operation using the shared key, getting the original message. Then both sides throw away that shared key and never use it again. Someone trying to attack the encryption has the problem that if they use the wrong key, they will get a different decrypted message that might look entirely plausible. "ATTACK!!" and "RETREAT!" have exactly the same length so if they attacker uses one wrong key then they will get out "ATTACK!!" and if they use a different wrong key then they will get out "RETREAT!" and if they use a third wrong key they will get out "TEA TIME" and they will have no idea if they were right. One-Time Pad encryption is considered to be the only truly secure encryption -- provided, that is, that the shared key is securely distributed to the person who is intended to decrypt it. And notice that the reason it is considered to be truly secure is that it does not give any feedback as to whether the right key was used for the decryption attempt.