# Reversible and Plausibly Deniable Covert Channels in One-Time Passwords Based on Hash Chains +
## 2 Fundamentals and Related Work
### Fundamentals  
A hash function is a function \(h:U\to R\) that maps a possibly infinite universe, e.g., \(U=\{0,1\}^{\star}\), onto a finite set of hash values, e.g., \(R=\{0,1\}^{m}\)[3]. A cryptographic hash function should have pre-image resistance, i.e., from a hash value \(y\in R\) it is not possible (with reasonable effort) to compute a string \(x\in U\) such that \(h(x)=y\), 2 nd pre-image resistance, i.e., from a given \(x\) with \(h(x)=y\) it is not possible to compute \(x^{\prime}\in U,x^{\prime}\
eq x\) such that \(h(x^{\prime})=y\), and collision resistance, i.e., it is not possible to compute two strings \(x,x^{\prime}\in U,x^{\prime}\
eq x\) such that \(h(x)=h(x^{\prime})\). Examples of cryptographic hash functions are MD5 (message digest 5) [4], now outdated, and SHA-3 (secure hash algorithm 3) [5], the current standard for cryptographic hashing, based on the KECCAK hash function [6]. As \(R\subset U\), a hash function can be applied repeatedly, i.e., for a seed \(x_{0}=s\), we can compute \(x_{i+1}=h(x_{i})\) for \(i=0,1,2,\ldots,n-1\). This sequence is called a hash chain. While it is easy to compute a hash chain in a forward direction, it cannot be computed in a backward direction, starting from \(x_{n}\), because of the pre-image resistance property. A one-time password (OTP) is a password only used once to authenticate an entity. As such, it is secure as long as it is secret and cannot be guessed prior to its use. [PERSON] [2] presented a scheme to generate OTPs from a hash function with pre-image resistance. Entity \(A\) uses a random and secret seed \(s\) to compute a hash chain \(x_{0},\ldots,x_{n}\), and transfers \(x_{n}\) to entity \(B\) via a secure channel. To authenticate, \(A\) sends \(z=x_{n-1}\) over an insecure channel to \(B\). \(B\) checks if \(h(z)=x_{n}\). If yes, the authentication is approved, and \(B\) replaces \(x_{n}\) by \(z=x_{n-1}\). If not, authentication has failed. For the next authentication, \(A\) sends \(z=x_{n-2}\), and so on. Each password is only used once, and by the pre-image resistance, the next password cannot be guessed from the previous password. In addition, \(B\) need not keep \(x_{n}\) secret, as nothing can be inferred from this value. [PERSON]'s S/Key [7] and the TESLA protocol [8] use similar ideas. A covert channel, as one form of steganography, defines a parasitic communication channel nested inside a computing environment that allows at least two different legitimate processes (or nodes) to access a shared resource. The covert channel exploits the legitimate processes in a way that allows the signaling of hidden information via the shared resource. The sender and receiver of a covert channel are called covert sender (CS) and covert receiver (CR), respectively. CS and CR are not necessarily identical with the overt sender and overt receiver (OS and OR) as CS and CR might act in an indirect manner or as a man-in-the-middle. Covert channels inside computer networks follow a set of known hiding patterns [9] to transfer information, e.g., by placing secret data inside unused or reserved header bits of network packets, by modifying header fields with random values, or by modulating the timings between succeeding network packets. Reversible steganography allows the reconstruction of the original carrier message to the state _before_ the steganographic data was embedded. For instance, it would allow _an original image to be completely restored after the extraction of hidden data embedded in a cover image_[10]. In man-in-the-middle scenarios, reversibility enables covert receivers to forward non-modified, i.e., innocent, original data to the overt receiver. As shown by [PERSON] et al., reversibility is feasible for network covert channels: _full_ reversibility refers to covert channels where the original carrier data can be restored completely, while _quasi-reversibility_ refers to those covert channels that allow only the partial reconstruction of the original data [11]. Different categories of reversible data hiding are feasible.