# Reversible and Plausibly Deniable Covert Channels in One-Time Passwords Based on Hash Chains +
## 4 Countermeasures  
Before experimentally evaluating our proposed channel, we first consider a broader set of potential countermeasures.  
Note that in all variants, CR needs no knowledge of \(x_{n}\) stored by \(B\). In the first transmitted password \(x_{n-1}\), no symbol is transmitted. Then CR knows \(x_{n-1}\) when intercepting and forwarding that password, and can refer to it later on, duplicating \(B\)'s work.  
Variants that embed more symbols per password might be detectable more easily on the receiver side, as they encompass more evaluations of \(h\). For example, the variant that embeds one of \(v=m\) symbols by flipping one bit needs \(m/2\) evaluations on average if symbols are equidistributed, which is the case if they are encrypted. This is a notable amount of computation if we consider that \(m\) might be 128 (MD5) or 512 (SHA-3). Yet those variants also have higher steganographic bandwidth.  
Possible countermeasures on the receiver side, i.e., checking for unusual timing or energy due to repeated evaluation of the hash function, have been described in the previous section. However, they apply mostly if CR resides with the overt receiver (a similar scenario for energy-consumption-based covert channel detection has been proven to be feasible by [PERSON] et al. [42]). If we have a man-in-the-middle scenario, only a jitter in transmission time from overt sender to overt receiver might be detectable.  
Countermeasures during transmission are possible if a warden has knowledge of two successive packets with passwords \(x^{\prime}_{i}\) and \(x^{\prime}_{i-1}\), i.e., has some knowledge of the application logic behind the packets. In this case, the warden can check if \(h(x^{\prime}_{i-1})=x^{\prime}_{i}\). If either password has been modified by CS, this equality will most likely not hold because of the hash function's collision resistance properties.  
If the warden has only superficial knowledge of the application, i.e., knows only that the transmitted password must be a random bitstring, the warden can collect some passwords and submit them to a random number test suite such as Diehard [43] or NIST's suite [44]. If embedding of symbols creates artefacts, then the randomness should decrease if a CC is active. However, the test suites require a notable amount of bits to run, which might not be available, or take very long to collect. Thus, this might be an ex post analysis. Furthermore, if the set of code words \(V\) is a randomly chosen subset of \(R\), and/or the symbols to be embedded are chosen in a quasi-random manner, e.g., by using encryption first, then the bitwise exclusive OR of two random bit strings might not be distinguishable.  
Another possible countermeasure would be that \(A\) and \(B\) modify the passwords themselves, in a way that is not foreseeable by CS or CR. When \(A\) is about to send \(x_{i}\), it already has knowledge about the following password \(x_{i-1}\). Let us assume that both \(A\) and \(B\) have knowledge of a hash function \(g:\{0,1\}^{m}\rightarrow\{0,1\}\). If \(g(x_{i-1})=0\), then \(A\) sends \(x_{i}\). If \(g(x_{i-1})=1\), then \(A\) sends \(\overline{x_{i}}\), i.e., \(x_{i}\) with all bits inverted. If \(g\) is a good hash function, then the second possibility will occur half of the time. If \(B\) receives a password \(x_{i}^{\prime}\), then it checks if either \(h(x_{i}^{\prime})\) or \(h(\overline{x_{i}^{\prime}})\) equals \(x_{i+1}\). In the latter case, \(B\) stores \(\overline{x_{i}^{\prime}}\).  
As only two instead of one password value will be accepted, this scheme is still secure. But life is now more complicated for CR. It must now compare the four possible combinations of inverted and non-inverted passwords, i.e., its effort is notably increased, and stealthiness thus reduced. More complicated schemes are possible. Even if they are not preventing this covert channel, they can restrict bandwidth and/or can reduce stealthiness by forcing CR to perform more computation.