# Cryptographic Secrecy Analysis of Adaptive Steganographic Syndrome-Trellis Codes

Authors: Hansong Du; Jiufen Liu; Yuguo Tian; Xiangyang Luo
Journal: Security and Communication Networks
 (2021)

---

## Abstract

Compared with traditional steganography, adaptive steganography based on STC (Syndrome-Trellis Codes) has extremely high antidetection ability and has been a mainstream and hot research direction in the field of information hiding over the past decades. However, it is noted, in specific scenarios, that a small number of methods can extract data from STC-based adaptive steganography, indicating security risks related to such algorithms. In this manuscript, the cryptographic secrecy of this kind of steganography is analyzed, on condition of two common attacks: stego-only attack and known-cover attack, respectively, from three perspectives: steganographic key equivocation, message equivocation, and unicity distance of the steganographic key. Focusing on the special layout characteristics of the parity-check matrix of STC, under the two attack conditions, the theoretical boundaries of the steganographic key equivocation function, the message equivocation function, and the unicity distance of the steganographic key are separately obtained, showing the impact of the three elements: the submatrix size, the randomness of the data, and the cover object on the cryptographic secrecy of the STC-based adaptive steganography, resulting in a theoretical reference to accurately judge the cryptographic secrecy of such steganography and design more secure steganography methods.


---

## Body

## 1. Introduction

Digital steganography ensures data security by embedding data into multimedia files such as digital images, audio, videos, etc., for transmission [1]. This kind of communication conceals the fact that “communication is happening” and is highly deceptive, which has become a main method of covert communication and a research hotspot in the field of information security in recent years [2]. The security of steganography includes covert security and cryptographic secrecy. The covert security refers to antidetection performance of data, and the cryptographic secrecy refers to antiextraction performance of data [3]. At present, there have been a lot of research studies [4–6] on the antidetection performance, while relatively few research studies [7] on the antiextraction performance. The adaptive steganography based on STC (Syndrome-Trellis Codes) [8] has a high antidetection performance by embedding data into complex texture areas that are difficult to model and has been a mainstream direction in the field of information hiding in recent years. At present, many STC-based adaptive steganography algorithms [9–13] have been proposed. However, there have been a few studies [14–16] that could extract data from STC-based adaptive steganography in specific scenarios, indicating that such algorithms may have hidden security risks. Therefore, carrying out a comprehensive and in-depth cryptographic secrecy analysis of such steganography has important research value for judging the security of such steganography and designing more secure steganography methods.Early studies on steganographic security mainly focused on the covert security. Cachin [17] was the first to study the covert security from the perspective of communication. He defined the active attacker and the passive attacker by the information theory model and distinguished the concepts of perfect concealment and perfect confidentiality for the first time. Hopper [18] studied the problem of covert security from the perspective of cryptography and defined covert security from the perspective of computational complexity under the assumption of passive aggression. As the problem of data extraction was put forward, some scholars [3, 9–12] pointed out that steganography should not only have covert security but also have cryptographic secrecy.Data extraction essentially is a kind of cryptanalysis [3]. Provos and Honeyman [19] first studied the cryptographic secrecy of steganography and proposed a general model for attacking random steganography, that is, simultaneously exhausting the encryption key and steganography key space. The computational complexity of the attack algorithm is OK×E where K represents the steganographic key space and E represents the encryption key space. Fridrich et al. [20, 21] analyzed the cryptographic secrecy for the first time from the perspective of computational complexity and pointed out that if an attacker could independently extract the data, the attack complexity of restoring plaintext could be reduced from OK×E to OmaxK,E. Zhang and Li [3] gave a measurement method of cryptographic secrecy and the relationship among cryptographic secrecy, information transmission rate, and key rate by drawing on Shannon’s definition of the confidentiality system. In addition, he pointed out that the cryptographic secrecy brought by steganography was essentially a cryptographic feature. Further, Zhang and Li pointed out in [22] that even if the data embedded through steganography was unencrypted, it was still relatively secure in the sense of cryptography as long as the steganography itself had strong cryptographic secrecy.With the proposal of a large number of steganography algorithms [23–25] based on matrix coding [26], the research on cryptographic secrecy has shifted to cryptographic secrecy of steganographic matrix coding. Regalia [27] used the information theory method to study the cryptographic secrecy of steganographic matrix coding under the condition of stego-only attack. The upper bound of the steganographic key equivocation function and the relationship among message equivocation function, cover entropy, and data entropy under different steganographic key models were separately obtained in [27]. In addition, Regalia demonstrated that the perfect secrecy defined by Shannon can be progressively achieved using wet paper coding. Chen et al. [28] studied the cryptographic secrecy of matrix coding under different attack conditions. In the condition of stego-only attack, the theoretical bound of unicity distance of the steganographic key was given, which supplemented the research results of Regalia. Under the condition of known-cover attack, the upper bounds of the steganographic key equivocation function and message equivocation function of matrix encoding-based steganography were given.In recent years, STC-based adaptive steganography has become a research hotspot in the field of information hiding with high covert security [29]. This type of coding makes the data embedding related to all the elements of the image, resulting in a decrease in the correlation between the steganographic key and stego object, and has extremely high resistance to detection. However, in the existing literatures [14–16], there have been a small number of data extraction methods, which could extract data from STC-based adaptive steganography under specific conditions. Liu et al. [14] presented a “column grouping” method for extracting the data under the conditions of “chosen-stego-object” and “data-retransmission,” respectively. These methods were based on the time-invariant property of the convolutional codes, and they could reduce the steganographic key space to a very small candidate set for arbitrary relative payload without exhaustive searches. In our previous research [15, 16], we presented a method for extracting data, respectively, in two cases where embedded data was plaintext and part of plaintext was known. Aiming at the case that embedded data was plaintext, Luo et al. [15] proposed an extraction method based on the parameter identification of STC. Based on the randomness difference between plaintext and ciphertext, the method first exhausted the submatrices and then judged whether the submatrix was correct or not according to the randomness of the data extracted from different submatrices. Under the condition that part of plaintext was known, Gan et al. [16] proposed a data extraction method based on the identity transformation of the decoding equation. This method used the identity deformation of the parity-check matrix operation to simplify the decoding equation, then converted the unknown and relatively complex parity-check matrix into a column vector that was easy to solve, and finally eliminated the impossible parity-check matrix based on the code judgment standard. The above research studies show that, in some cases, STC-based adaptive steganography may have hidden confidential dangers, and it is necessary for us to carry out research on the cryptographic secrecy of STC-based adaptive steganography. However, unlike general matrix coding, there are few research results on the cryptographic secrecy of STC-based adaptive steganography, and the element affecting the cryptographic secrecy is not clear yet. We still need to conduct in-depth analysis on the cryptographic secrecy of such algorithm to measure the cryptographic secrecy of such algorithms is related to what element and how are they related. To be specific, what are the upper bounds of the amount of data information and steganographic key information that can be leaked from stego objects and cover objects? What elements are the upper bounds relate to and in what relation? What is the lower bound of the amount of information an attacker needs to recover the steganographic key? What elements are this lower bound relate to and in what relation?For this reason, this manuscript carries out the cryptographic secrecy research on STC-based adaptive steganography. Benchmarking the related theories in classical cryptography, this manuscript analyzes the cryptographic secrecy of steganography from three aspects, namely, the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key, under two attack conditions of stego-only and known-cover, respectively. The main work of this manuscript is as follows:(1)
Under the condition of stego-only attack, the cryptographic secrecy of STC-based adaptive steganography algorithm is studied from three aspects: the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key. More specifically, under the condition of stego-only attack and based on the special structure of the STC parity-check matrix, we obtain the upper bound of the amount of steganographic key information and data information leaked from the stego object, the lower bound of the amount of information an attacker needs to recover the steganographic key, and the quantitative relationship between these theoretical bounds and submatrices, data, and cover objects. It can be seen from the obtained quantitative relationship: the better the randomness of the data and the cover object and the larger the scale of the STC submatrices, correspondingly the stronger the cryptographic secrecy.(2)
Under the condition of known-cover attack, the cryptographic secrecy of the STC-based adaptive steganography algorithm is studied from three aspects: the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key. More specifically, under the condition of known-cover attack and based on the special structure of the STC parity-check matrix, we obtain the upper bound of the amount of steganographic key information and data information leaked from the stego object and cover object, the lower bound of the amount of information an attacker needs to recover the steganographic key, and the quantitative relationship between these theoretical bounds and submatrices, data, and cover objects. It can be seen from the obtained quantitative relationship: the better the randomness of the data and the cover object and the larger the scale of the STC submatrices, correspondingly the stronger the cryptographic secrecy.The structure of this manuscript is as follows: Section 2 is a description of the problem, which introduces the notation used in this manuscript, analyzes the STC encoding and decoding principle, and puts forward the problems to be studied in this manuscript. This manuscript intends to study the cryptographic secrecy of STC-based adaptive steganography from three aspects: the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key. Section 3 studies the theoretical bound of the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key under the stego-only attack. Section 4 studies the theoretical bound of the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key under known-cover attack. Section 5 is the discussion and conclusion of this manuscript.


## 2. Problem Setup

In this section, we will introduce the notation used in this manuscript, analyze the principle of STC encoding and decoding, and put forward the problems to be studied in this manuscript.


### 2.1. Symbols

In this manuscript, random variables are denoted by uppercase italic letters, with lowercase bold letters denoting particular realizations. Decorated letters denote the set. We treat all signals as vectors of bits (each 0 or 1), using componentwise modulo-2 addition over the Galois fieldF2. In particular, X is the cover sequence of length n, Y is the stego sequence of length n, and M is the data of length of q, in which q<n.Entropy is denoted byH⋅, as in(1)HX=−∑x∈Xpxlog2px.The entropy is used to describe the average uncertainty of random variables. AssumingX1,X2,…,Xn are random variables, the joint entropy satisfies the chain rule:(2)HX1,X2,…,Xn=∑i=1nHXi|Xi−1,…,X1.Conditional entropy is denoted byHX|Y, as in(3)HX|Y=∑y∈YpyHX|Y=y=−∑x∈X∑y∈Ypx,ylog2py|x.The conditional entropy is used to describe the average uncertainty of random variableY under the condition of known random variable X.Average mutual information is denoted byIX;Y, as in(4)IM;Y=HM−HM|Y=∑m∈M∑y∈Ypm,ylog2pm,ypmpy.The average mutual information is used to describe how much uncertainty about random variableX can be eliminated when random variable Y is known.


### 2.2. Analysis of STC Encoding and Decoding Principle

This section will briefly analyze the principle of STC encoding and decoding in adaptive steganography. Before the analysis, we first introduce the basic process of STC-based adaptive steganography.We begin with the basic setup of Figure1. A binary cover sequence x is first extracted from a cover object (image, audio, videos, etc.) by a bit-assignment function which is commonly assumed publicly known. Thus, for simplicity, the cover sequence and stego sequence can be thought as the cover and stego object in our analysis. Assume that both sides of communication want to transfer data mm∈F2q with q bits, using a binary cover sequence yy∈F2n whose length is n, where q<n. Usually, the data is encrypted ciphertext. The sender first permutes the binary cover sequence into the permuted cover sequence, then calculates the embedding distortion in different locations of the cover image, and finally uses STC to select the modifying positions adaptively according to the calculated distortion and embed data with minimum embedding distortion. After the sender inversely permuting the corresponding stego sequence, the stego sequence can be obtained.Figure 1
The data embedding process of STC-based adaptive steganography.In the above process, the STC is the most important. The following is an analysis of the STC encoding and decoding principle.The cover object and stego object are denoted asx=x1,x2,…,xnandy=y1,y2,…,yn∈F2n, respectively, where the embedded data is denoted as m. The STC encoding and decoding processes can be realized by equations (5) and (6), respectively:(5)y=Embx,m=argy∈CmminDx,y,(6)m=Exty=ky,where Dx,y is an embedding distortion function, kandk∈F2q×n is the STC parity-check matrix, and Cm=z∈F2n|kz=m is the coset corresponding to syndrome. From equation (5), we can see that the purpose of STC encoding is to find the optimal y subjected to equation (6) to minimize embedding distortion Dx,y.The parity-check matrixk is composed of a small submatrix k1 of size h×w, as shown in Figure 2. The submatrices are placed next to each other and shifted down by one row. The values of the elements in the submatrix denote the encoding content parameters. The width w is dictated by the relative payload α. If the relative payload α is equal to 1/k for some k∈Z+ (Z+ represents the positive integer), then select w=k; otherwise, if 1/k+1<α<1/k, then the parity-check matrix k will contain a mix of submatrices of widths k and k+1.Figure 2
The structure of STC parity-check matrix.For example, suppose the relative payloadα=0.5, then the parity-check matrix k is composed of one submatrix k1. If the submatrix k1 is selected as 1001, then parity-check matrix k can be shown as(7)100110011001⋱100110.If the relative payloadα=0.4, then the parity-check matrix k is composed of two different submatrices. For example, if the submatrices are selected as 1001 and 111011, then parity-check matrix k will be formed as(8)10011110111001⋱11101110.As shown in Figure1, the binary cover sequence is usually permuted into the permuted cover sequence before embedding the data in the actual covert communication based on adaptive steganography. Then, the sender uses STC encoding to embed the data into the permuted cover sequence to generate the corresponding stego sequence. Finally, perform the inverse permutation operation on the corresponding stego sequence to generate the stego sequence and send it to the receivers. The receivers extract the data through the preappointed submatrices and permutation process. For attackers to obtain the content of covert communication, his task is to extract the embedded data from the intercepted stego objects. As long as the correct parity-check matrices and the process of permutation are obtained, the attackers can extract embedded data from STC-based adaptive steganography such as receivers. It is worth noting that the permutation process is mostly determined by the length of the data. As the same time, the length of the data is exactly the height of the parity-check matrix. In sum, if attackers obtain the correct parity-check matrices, he can be the same as the receivers and extract the data from STC-based adaptive steganography. Therefore, the extraction of data from STC-based adaptive steganography is equivalent to the recovery of parity-check matrices. From this perspective, we can regard the parity-check matrices as the steganographic key in the covert communication process.Shannon [30] pointed out that “breaking a good cryptographic system” is equivalent to solving a complex equation that contains a large number of unknowns. However, it can be seen from the above analysis that the decoding system of STC is a system of linear equations, whose form is simple (the parity-check matrix is simply rearranged of the submatrices in the main diagonal direction of the parity-check matrix) and vulnerable to attack.In this manuscript, cryptographic secrecy of STC-based adaptive steganography is analyzed under two common attack conditions: stego-only and known-cover. The stego-only attack refers to the steganographic key recovery under the condition that only the stego object is obtained; the known-cover attack refers to the steganographic key recovery under the condition that the stego object and cover object are obtained. From Figure1, we can see that the parity-check matrix, distortion function, data, and cover object are the four elements in the embedding process of STC-based adaptive steganography. What is the relationship between the cryptographic secrecy of STC-based adaptive steganography and submatrix, distortion function, data, stego object, and cover object? More specifically, under the two conditions, what is the upper bound of the amount of steganographic key information and data information leaked from the stego object and cover object? What does this upper bound have to do with the submatrix, distortion function, data, stego object, and cover object? What is the lower bound of the information required by the attacker to recover the steganographic key under these attack conditions? What does this lower bound have to do with the submatrix, distortion function, data, stego object, and cover object? These are the questions to be studied in this manuscript.


## 2.1. Symbols

In this manuscript, random variables are denoted by uppercase italic letters, with lowercase bold letters denoting particular realizations. Decorated letters denote the set. We treat all signals as vectors of bits (each 0 or 1), using componentwise modulo-2 addition over the Galois fieldF2. In particular, X is the cover sequence of length n, Y is the stego sequence of length n, and M is the data of length of q, in which q<n.Entropy is denoted byH⋅, as in(1)HX=−∑x∈Xpxlog2px.The entropy is used to describe the average uncertainty of random variables. AssumingX1,X2,…,Xn are random variables, the joint entropy satisfies the chain rule:(2)HX1,X2,…,Xn=∑i=1nHXi|Xi−1,…,X1.Conditional entropy is denoted byHX|Y, as in(3)HX|Y=∑y∈YpyHX|Y=y=−∑x∈X∑y∈Ypx,ylog2py|x.The conditional entropy is used to describe the average uncertainty of random variableY under the condition of known random variable X.Average mutual information is denoted byIX;Y, as in(4)IM;Y=HM−HM|Y=∑m∈M∑y∈Ypm,ylog2pm,ypmpy.The average mutual information is used to describe how much uncertainty about random variableX can be eliminated when random variable Y is known.


## 2.2. Analysis of STC Encoding and Decoding Principle

This section will briefly analyze the principle of STC encoding and decoding in adaptive steganography. Before the analysis, we first introduce the basic process of STC-based adaptive steganography.We begin with the basic setup of Figure1. A binary cover sequence x is first extracted from a cover object (image, audio, videos, etc.) by a bit-assignment function which is commonly assumed publicly known. Thus, for simplicity, the cover sequence and stego sequence can be thought as the cover and stego object in our analysis. Assume that both sides of communication want to transfer data mm∈F2q with q bits, using a binary cover sequence yy∈F2n whose length is n, where q<n. Usually, the data is encrypted ciphertext. The sender first permutes the binary cover sequence into the permuted cover sequence, then calculates the embedding distortion in different locations of the cover image, and finally uses STC to select the modifying positions adaptively according to the calculated distortion and embed data with minimum embedding distortion. After the sender inversely permuting the corresponding stego sequence, the stego sequence can be obtained.Figure 1
The data embedding process of STC-based adaptive steganography.In the above process, the STC is the most important. The following is an analysis of the STC encoding and decoding principle.The cover object and stego object are denoted asx=x1,x2,…,xnandy=y1,y2,…,yn∈F2n, respectively, where the embedded data is denoted as m. The STC encoding and decoding processes can be realized by equations (5) and (6), respectively:(5)y=Embx,m=argy∈CmminDx,y,(6)m=Exty=ky,where Dx,y is an embedding distortion function, kandk∈F2q×n is the STC parity-check matrix, and Cm=z∈F2n|kz=m is the coset corresponding to syndrome. From equation (5), we can see that the purpose of STC encoding is to find the optimal y subjected to equation (6) to minimize embedding distortion Dx,y.The parity-check matrixk is composed of a small submatrix k1 of size h×w, as shown in Figure 2. The submatrices are placed next to each other and shifted down by one row. The values of the elements in the submatrix denote the encoding content parameters. The width w is dictated by the relative payload α. If the relative payload α is equal to 1/k for some k∈Z+ (Z+ represents the positive integer), then select w=k; otherwise, if 1/k+1<α<1/k, then the parity-check matrix k will contain a mix of submatrices of widths k and k+1.Figure 2
The structure of STC parity-check matrix.For example, suppose the relative payloadα=0.5, then the parity-check matrix k is composed of one submatrix k1. If the submatrix k1 is selected as 1001, then parity-check matrix k can be shown as(7)100110011001⋱100110.If the relative payloadα=0.4, then the parity-check matrix k is composed of two different submatrices. For example, if the submatrices are selected as 1001 and 111011, then parity-check matrix k will be formed as(8)10011110111001⋱11101110.As shown in Figure1, the binary cover sequence is usually permuted into the permuted cover sequence before embedding the data in the actual covert communication based on adaptive steganography. Then, the sender uses STC encoding to embed the data into the permuted cover sequence to generate the corresponding stego sequence. Finally, perform the inverse permutation operation on the corresponding stego sequence to generate the stego sequence and send it to the receivers. The receivers extract the data through the preappointed submatrices and permutation process. For attackers to obtain the content of covert communication, his task is to extract the embedded data from the intercepted stego objects. As long as the correct parity-check matrices and the process of permutation are obtained, the attackers can extract embedded data from STC-based adaptive steganography such as receivers. It is worth noting that the permutation process is mostly determined by the length of the data. As the same time, the length of the data is exactly the height of the parity-check matrix. In sum, if attackers obtain the correct parity-check matrices, he can be the same as the receivers and extract the data from STC-based adaptive steganography. Therefore, the extraction of data from STC-based adaptive steganography is equivalent to the recovery of parity-check matrices. From this perspective, we can regard the parity-check matrices as the steganographic key in the covert communication process.Shannon [30] pointed out that “breaking a good cryptographic system” is equivalent to solving a complex equation that contains a large number of unknowns. However, it can be seen from the above analysis that the decoding system of STC is a system of linear equations, whose form is simple (the parity-check matrix is simply rearranged of the submatrices in the main diagonal direction of the parity-check matrix) and vulnerable to attack.In this manuscript, cryptographic secrecy of STC-based adaptive steganography is analyzed under two common attack conditions: stego-only and known-cover. The stego-only attack refers to the steganographic key recovery under the condition that only the stego object is obtained; the known-cover attack refers to the steganographic key recovery under the condition that the stego object and cover object are obtained. From Figure1, we can see that the parity-check matrix, distortion function, data, and cover object are the four elements in the embedding process of STC-based adaptive steganography. What is the relationship between the cryptographic secrecy of STC-based adaptive steganography and submatrix, distortion function, data, stego object, and cover object? More specifically, under the two conditions, what is the upper bound of the amount of steganographic key information and data information leaked from the stego object and cover object? What does this upper bound have to do with the submatrix, distortion function, data, stego object, and cover object? What is the lower bound of the information required by the attacker to recover the steganographic key under these attack conditions? What does this lower bound have to do with the submatrix, distortion function, data, stego object, and cover object? These are the questions to be studied in this manuscript.


## 3. Cryptographic Secrecy of STC under Stego-Only Attack

The most common scenario is that the attacker only obtains the stego object. We call this steganographic key recovery under that condition as the stego-only attack, which is the most difficult and common type of all attacks. In the following, we are concerned about the upper bound of the amount of the steganographic key information and data information that can be leaked by the stego object, and the lower bound of the amount of information required by the attacker to recover the steganographic key under this attack condition.


### 3.1. Steganographic Key Equivocation

Under the stego-only attack, the steganographic key equivocation function is denoted byIK;Y [27] as in(9)IK;Y=∑k∈F2q×n∑y∈F2npk,ylogpk,ypkpy,which measures how much steganographic key information may be revealed from observation of the stego object. The greater the steganographic key equivocation function IK;Y, the more steganographic key information can be obtained by the attacker from the stego object, that is, the easier the attacker can infer the correct steganographic key and the less secure the steganographic system will be. The following theorem gives the upper bound of the steganographic key equivocation function under the stego-only attack, that is, how much steganographic key information can be leaked by the stego object at most.Theorem 1.
Under the stego-only attack, when all cover objects and data equally probable, the key equivocation function is bounded as(10)IK;Y≤q−HM+n−HX,in which q is the length of data M.Proof.
According to the chain rule of the entropy function (equation (2)), we can isolate the joint entropy HX,M,Y,K,T of cover object X, data M, stego object Y, steganographic key K, and distortion function T as follows:(11)HX,M,Y,K,T=HK,M,T,X+HY|K,M,T,X.
According to equation (5), the sender in covert communication can generate a unique stego object Y from the steganographic key K, data M, distortion function T, and cover object X, which implies(12)HY|K,M,T,X=0.
Following equation (11), we have(13)HX,M,Y,K,T=HK,M,T,Y+HY∣K,M,T,X=HK,M,T,X=HK+HM+HT+HX.
The last step is valid since the independence of the steganographic keysK, stego object Y, distortion function T, and cover object X. According to the chain rule of the entropy function (equation (2)), we can isolate the entropy HX,M,Y,K,T in another way:(14)HX,M,Y,K,T=HY+HK∣Y+HM|K,Y+HT∣M,K,Y+HX∣M,K,Y,T.
Combining equations (13) and (14), we get(15)IK;Y=HY−HM−IT;M,K,Y−IX;M,T,Y,K=HY−HM−IT;K,Y−IX;K,Y,T.
According to the relationship between mutual information and entropy (equation (4)), the average mutual information IX;K,Y,T can be isolated as follows:(16)IX;K,Y,T=HX−HX|K,Y,T.
By substituting equation (16) into equation (15), we get(17)HX|K,Y,T=IK;Y+IT;K,Y−HY+HM+HX.
According to equation (2), we can isolate the entropy joint HY,X,T,K,M as follows:(18)HY,X,T,K,M=HX|T,Y,K,M+HM|T,K,Y+HT,K,Y.
The independence between distortion functionT, steganographic key K, and stego object Y means(19)HT,K,Y=HT+HK+HY.
Substitute equation (19) into equation (18), we get(20)HY,X,T,K,M=HX|T,Y,K,M+HM∣T,K,Y+HT+HK+HY=HX|T,Y,K,M++HT+HK+HY.
From equation (6), we know that the data M can be obtained by the steganographic key K and the stego object Y, suggesting HM|T,K,Y=0. As a result, the last step is valid.
We can isolate the entropy jointHY,X,T,K,M in another way:(21)HY,X,T,K,M=HY∣X,T,K,M+HX,T,K,M.
The independence between cover objectX, distortion function T, steganographic key K, and data M means(22)HX,T,K,M=HX+HT+HK+HM.
Substitute equation (22) into equation (21), we get(23)HY,X,T,K,M=HY|X,T,K,M+HX+HT+HK+HM==HX+HT+HK+HM.
From equation (5), we know that the stego object Y can be obtained by the cover object X, distortion function T, steganographic key K, and data M, suggesting HY|X,T,K,M=0. As a result, the last step is valid. Combining equations (20) and (23), we get(24)HX∣T,Y,K,M=HX−HY+HM.
Now, ifHX=n (all cover objects are equally probable) and HM=q (all data are equally probable), then(25)HX|T,Y,K=HX|T,Y,K,M=n+q−HY,in which HX∣T,Y,K,M=HX∣T,Y,K is an application of equation (6). By substituting equation (25) into equation (17), we get(26)IK;Y+IT;K,Y=q−HM+n−HX.
Together with nonnegative of average mutual information, we get the desired result.
Particularly, when all cover objects and data are equally probable, that is,HM=q and HX=n, the following equation is obtained:(27)IK;Y+IT;K,Y=0.
Then, an application of the nonnegative of average mutual information yields(28)IK;Y=0,IT;K,Y=n.
Theorem1 shows that the knowledge of the stego object does not assist in deducing the uncertainty of steganographic key IK;Y=0 when the data is completely random HM=q and cover object is completely random HX=n. This means (1) the choice of cover has an impact on cryptographic secrecy of STC-based adaptive steganography. The better the randomness of cover, the higher the cryptographic secrecy. (2) Compared to the data is plaintext, when the data is encrypted ciphertext, the cryptographic secrecy of STC-based adaptive steganography is higher.
It is worth noting that, as a result of Theorem1, the upper bound on the steganographic key equivocation function is independent of the distortion function, that is, the uncertainty about the steganographic key is independent of the specific distortion function taken by the adaptive steganographic algorithm. However, most of the existing studies on steganographic algorithms are in pursuit of the design of new distortion functions, which may improve the covert security, that is, antidetection, but is not conducive to the enhancement of cryptographic secrecy.


### 3.2. Message Equivocation

Under the stego-only attack, the message equivocation function is denoted byIM;Y as in(29)IM;Y=∑m∈F2q∑y∈F2npm,ylogpm,ypmpy,which measures how much data information may be revealed from observation of the stego object. The greater the message equivocation function is, the more data information can be obtained by the attacker from the stego object, that is, the easier the attacker can extract the data, and the less secure the steganographic system will be. The following theorem gives the upper bound of the message equivocation function under the stego-only attack, that is, how much data information can be leaked by the stego object at most.In order to establish a relationship between the upper bound of message equivocation functionIM;Y and the size of the submatrix, we first prove the following lemma.Lemma 1.
When the reciprocal of the relative payloadα is an integer, the STC parity-check matrix consists of a single submatrix with a width of w1; then, the conditional entropy HK|Y is(30)HK|Y=∑j=0w1−1log2h−2−j.When the reciprocal of the relative payloadα is not an integer, the STC parity-check matrix consists of two submatrices with widths w1 and w2. Then, the conditional entropy HK|Y is(31)HK|Y=∑i=12∑j=0wi−1log2h−2−j,in which w1=1/α and w2=1/α+1.Proof.
According to the stego object, we can estimate the relative payloadα. For example, in [31], the rich model is used for quantitative analysis to realize the estimation of relative payload α. The width of the submatrix can be obtained by relative payload α. For a submatrix with height h and width w, the number of all possible submatrices is 2hw. Filler et al. [8] pointed out that a good submatrix should meet the requirements that the first row and the last row are 1 and any two columns are not the same. When the reciprocal of the relative payload is an integer, the parity-check matrix is only composed of a single submatrix, and the size of the steganographic key space is K=A2h−2w, in which Amn=m!/m−n!. Therefore, given the stego object, the average uncertainty of the steganographic key is(32)HK|Y=∑i=1A2h−2w11A2h−2w1log2A2h−2w1=log2A2h−2w1=∑j=0w1−1log22h−2−j.
The penultimate step is valid sincelog2A2h−2w=log22h−2×2h−2−1×⋯2h−2−w+1=∑j=0w−1log22h−2−j.
The parity-check matrix is composed of two submatrices when the reciprocal of the relative payload is not an integer. The size of the steganographic key space is(33)K=A2h−2w1×A2h−2w2.
Thus,(34)HK|Y=∑i=1A2h−2w1×A2h−2w21A2h−2w1×A2h−2w2log2A2h−2w1×A2h−2w2=log2A2h−2w1×A2h−2w2=∑j=0w1−1log22h−2−j+∑j=0w2−1log22h−2−j=∑i=12∑j=0wi−1log22h−2−j,in which w1=1/α and w2=1/α+1. The penultimate step is valid since log2A2h−2w=log22h−2×2h−2−1×⋯2h−2−w+1=∑j=0w−1log22h−2−j.
For example, when the height of the submatrix is fixed at 7, the relationship betweenHK|Y and the relative payload α is shown in Figure 3. When the number of different submatrices is fixed at one (that is, the reciprocal of the relative payload is an integer), the relative payload is taken as 0.05 bpp, 0.1 bpp, 0.2 bpp, 0.25 bpp, and 0.5 bpp. When the number of different submatrices is fixed at two (that is, when the reciprocal of the relative payload is not an integer), the relative payload is taken as 0.06 bpp, 0.15 bpp, 0.24 bpp, 0.35 bpp, and 0.45 bpp. It can be seen from Figure 3 that HK|Y decreases as the relative payload increases when the number of different submatrices is fixed. The relationship between HK|Y and the height of the submatrix is shown in Figure 4. The relative payload is fixed at 0.2 bpp and 0.4 bpp in order. When the relative payload is fixed at 0.2 bpp, the parity-check matrix is composed of one submatrix with width of 5; when the relative payload is fixed at 0.4 bpp, the parity-check matrix is composed of two different submatrices with width of 2 and 3. It can be seen from Figure 4 that HK|Y increases as the height of the submatrix increases when the relative payload is fixed.
Lemma1 indicates the relationship between conditional entropy HK|Y and the size of submatrices. Based on this relationship, we can obtain the relationship between the upper bound of the message equivocation function and the size of the submatrices under the stego-only attack. See the following theorem for details.Figure 3
The relationship betweenHK|Y and α.Figure 4
The relationship betweenHK|Y and h.Theorem 2.
Under the condition of stego-only attack, the message equivocation function is bounded as(35)IM;Y≤HY−HK+HK|Y,in which HK|Y=∑j=0w1−1og2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
Due to the relationship between mutual information and entropy, we have(36)IM;Y=HM−HM|Y.
Combining equations (13) and (14), we get(37)HM=HY+HK|Y+HT|M,K,Y+HX|M,K,Y,T−HK−HT−HX,and substituting (37) into (36), we get(38)IM;Y=HY−HK−HT−HX+HT|M,K,Y+HX|M,K,Y,T+HK|Y−HM|Y.
Due to the chain rule of the entropy function (equation (2)), the joint entropy HM,K,Y can be isolated in two ways:(39)HM,K,Y=HY+HM|Y+HK|M,Y,(40)HM,K,Y=HY+HK|Y+HM|K,Y=HY+HK|Y.
Combining equation (39) with (40), we have(41)HK|Y−HM|Y=HK|M,Y.
Substituting equation (41) into (38), we get(42)IM;Y=HY−HX−HK−HT+HT|M,K,Y+HX|M,K,Y,T+HK|M,Y=HY−IK;M,Y−IX;M,K,Y,T−IT;M,K,Y<HY−IK;M,Y.
The penultimate step is valid because of an application of equation (4), and the last step is valid since mutual information is nonnegative.
Then,IK;M,Y≥IK;Y yields(43)IM;Y≤HY−IK;M,Y=HY−IK;Y=HY−HK+HK|Y,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem2 that the upper bound of the message equivocation function increases as the height of the submatrices increases when the relative payload is fixed. When the number of different submatrices is fixed, the upper bound of the message equivocation function decreases as the relative payload increases. This is because the larger the submatrices size and the larger number of different submatrices mean the more encoding content parameters and harder to extract the data. Therefore, we should choose submatrices with bigger size and a relative payload whose reciprocal is not an integer preferentially. However, the above methods will increase the time consumption of generating stego objects.


### 3.3. The Unicity Distance of the Steganographic Key

The security of a steganographic algorithm is generally only based on the secrecy of the steganographic key. Accordingly, a complete breach of a steganographic algorithm by an attacker means that he can find a way to recover the steganographic key. Therefore, the following is to further analyze the cryptographic secrecy of STC-based adaptive steganography from the perspective of the unicity distance of the steganographic key [3]. Specifically, we consider the minimum amount of data required by the attacker to recover the steganographic key on average. The following theorem gives the relationship between the unicity distance of the steganographic key NK and the size of the submatrix under the stego-only attack.Theorem 3.
Under the stego-only attack, the unicity distance of the steganographic keyNK is bounded as(44)NK≥HK|YHY−HM+IT;K,Y+IX;K,Y,T.,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
DenoteNK groups of stego objects as YNK=Y1,Y2,…YNK. Given NK stego objects, then the set of all the possible steganographic keys KYNK is(45)KYNK=k∈K|∃mi∈M,s.t.prmi>0,kyi=mi,and the expectation of the number of pseudokeys K¯P is(46)K¯P=∑YNKPrYNKKYNK−1=∑YNKPrYNK|KYNK|−1,where KYNK represents the number of elements in set KYNK.
Then, an application of equation (3) yields(47)HK|YNK=∑YNPrYNKHK|YNK=∑YNPrYNKlog2KYNK≤log2∑YNPrYNKKYNK≤logK¯P+1,and with equation (17), this yields(48)HK|YNK=HK+NKHM−HY+IT;K,Y+IX;K,Y,T.
Together with equations (47) and (48), we get(49)logK¯p+1≤HK+NKHM−HY+IT;K,Y+IX;K,Y,T,and the expectation of the number of pseudokeys NK is bounded as(50)K¯p≤2HK+NKHM−HY+IT;K,Y+IX;K,Y,T−1.
On that account, the unicity distance is bounded as(51)NK=HKHY−HM+IT;K,Y+IX;K,Y,T≥HK|YHY−HM+IT;K,Y+IX;K,Y,T,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem6 that when the relative payload is fixed, the lower bound of the unicity distance of the steganographic key NK increases as the height h of the submatrix increases; when the number of different submatrices is fixed, the unicity distance of the steganographic key NK decreases as the relative payload α increases. This is because the larger sizes of submatrices and number of different submatrices mean the more encoding content parameters, that is, the more difficult it is to restore the steganographic key. Therefore, in order to recover the steganographic key, the average amount of information the attacker needs to obtain in advance become more. We should choose submatrices with bigger size and a relative payload whose reciprocal is not an integer preferentially. However, the above method will increase the time consumption of generating stego objects.
In this section, the cryptographic secrecy of the STC-based adaptive steganography algorithm is studied from three aspects: the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key under the known-cover attack. More specifically, we obtain the upper bound of the amount of steganographic key information and data information leaked from the cover object and stego object, the lower bound of the amount of information an attacker needs to recover the steganographic key, and the quantitative relationship between these theoretical bounds and the submatrices, data, and cover object.


## 3.1. Steganographic Key Equivocation

Under the stego-only attack, the steganographic key equivocation function is denoted byIK;Y [27] as in(9)IK;Y=∑k∈F2q×n∑y∈F2npk,ylogpk,ypkpy,which measures how much steganographic key information may be revealed from observation of the stego object. The greater the steganographic key equivocation function IK;Y, the more steganographic key information can be obtained by the attacker from the stego object, that is, the easier the attacker can infer the correct steganographic key and the less secure the steganographic system will be. The following theorem gives the upper bound of the steganographic key equivocation function under the stego-only attack, that is, how much steganographic key information can be leaked by the stego object at most.Theorem 1.
Under the stego-only attack, when all cover objects and data equally probable, the key equivocation function is bounded as(10)IK;Y≤q−HM+n−HX,in which q is the length of data M.Proof.
According to the chain rule of the entropy function (equation (2)), we can isolate the joint entropy HX,M,Y,K,T of cover object X, data M, stego object Y, steganographic key K, and distortion function T as follows:(11)HX,M,Y,K,T=HK,M,T,X+HY|K,M,T,X.
According to equation (5), the sender in covert communication can generate a unique stego object Y from the steganographic key K, data M, distortion function T, and cover object X, which implies(12)HY|K,M,T,X=0.
Following equation (11), we have(13)HX,M,Y,K,T=HK,M,T,Y+HY∣K,M,T,X=HK,M,T,X=HK+HM+HT+HX.
The last step is valid since the independence of the steganographic keysK, stego object Y, distortion function T, and cover object X. According to the chain rule of the entropy function (equation (2)), we can isolate the entropy HX,M,Y,K,T in another way:(14)HX,M,Y,K,T=HY+HK∣Y+HM|K,Y+HT∣M,K,Y+HX∣M,K,Y,T.
Combining equations (13) and (14), we get(15)IK;Y=HY−HM−IT;M,K,Y−IX;M,T,Y,K=HY−HM−IT;K,Y−IX;K,Y,T.
According to the relationship between mutual information and entropy (equation (4)), the average mutual information IX;K,Y,T can be isolated as follows:(16)IX;K,Y,T=HX−HX|K,Y,T.
By substituting equation (16) into equation (15), we get(17)HX|K,Y,T=IK;Y+IT;K,Y−HY+HM+HX.
According to equation (2), we can isolate the entropy joint HY,X,T,K,M as follows:(18)HY,X,T,K,M=HX|T,Y,K,M+HM|T,K,Y+HT,K,Y.
The independence between distortion functionT, steganographic key K, and stego object Y means(19)HT,K,Y=HT+HK+HY.
Substitute equation (19) into equation (18), we get(20)HY,X,T,K,M=HX|T,Y,K,M+HM∣T,K,Y+HT+HK+HY=HX|T,Y,K,M++HT+HK+HY.
From equation (6), we know that the data M can be obtained by the steganographic key K and the stego object Y, suggesting HM|T,K,Y=0. As a result, the last step is valid.
We can isolate the entropy jointHY,X,T,K,M in another way:(21)HY,X,T,K,M=HY∣X,T,K,M+HX,T,K,M.
The independence between cover objectX, distortion function T, steganographic key K, and data M means(22)HX,T,K,M=HX+HT+HK+HM.
Substitute equation (22) into equation (21), we get(23)HY,X,T,K,M=HY|X,T,K,M+HX+HT+HK+HM==HX+HT+HK+HM.
From equation (5), we know that the stego object Y can be obtained by the cover object X, distortion function T, steganographic key K, and data M, suggesting HY|X,T,K,M=0. As a result, the last step is valid. Combining equations (20) and (23), we get(24)HX∣T,Y,K,M=HX−HY+HM.
Now, ifHX=n (all cover objects are equally probable) and HM=q (all data are equally probable), then(25)HX|T,Y,K=HX|T,Y,K,M=n+q−HY,in which HX∣T,Y,K,M=HX∣T,Y,K is an application of equation (6). By substituting equation (25) into equation (17), we get(26)IK;Y+IT;K,Y=q−HM+n−HX.
Together with nonnegative of average mutual information, we get the desired result.
Particularly, when all cover objects and data are equally probable, that is,HM=q and HX=n, the following equation is obtained:(27)IK;Y+IT;K,Y=0.
Then, an application of the nonnegative of average mutual information yields(28)IK;Y=0,IT;K,Y=n.
Theorem1 shows that the knowledge of the stego object does not assist in deducing the uncertainty of steganographic key IK;Y=0 when the data is completely random HM=q and cover object is completely random HX=n. This means (1) the choice of cover has an impact on cryptographic secrecy of STC-based adaptive steganography. The better the randomness of cover, the higher the cryptographic secrecy. (2) Compared to the data is plaintext, when the data is encrypted ciphertext, the cryptographic secrecy of STC-based adaptive steganography is higher.
It is worth noting that, as a result of Theorem1, the upper bound on the steganographic key equivocation function is independent of the distortion function, that is, the uncertainty about the steganographic key is independent of the specific distortion function taken by the adaptive steganographic algorithm. However, most of the existing studies on steganographic algorithms are in pursuit of the design of new distortion functions, which may improve the covert security, that is, antidetection, but is not conducive to the enhancement of cryptographic secrecy.


## 3.2. Message Equivocation

Under the stego-only attack, the message equivocation function is denoted byIM;Y as in(29)IM;Y=∑m∈F2q∑y∈F2npm,ylogpm,ypmpy,which measures how much data information may be revealed from observation of the stego object. The greater the message equivocation function is, the more data information can be obtained by the attacker from the stego object, that is, the easier the attacker can extract the data, and the less secure the steganographic system will be. The following theorem gives the upper bound of the message equivocation function under the stego-only attack, that is, how much data information can be leaked by the stego object at most.In order to establish a relationship between the upper bound of message equivocation functionIM;Y and the size of the submatrix, we first prove the following lemma.Lemma 1.
When the reciprocal of the relative payloadα is an integer, the STC parity-check matrix consists of a single submatrix with a width of w1; then, the conditional entropy HK|Y is(30)HK|Y=∑j=0w1−1log2h−2−j.When the reciprocal of the relative payloadα is not an integer, the STC parity-check matrix consists of two submatrices with widths w1 and w2. Then, the conditional entropy HK|Y is(31)HK|Y=∑i=12∑j=0wi−1log2h−2−j,in which w1=1/α and w2=1/α+1.Proof.
According to the stego object, we can estimate the relative payloadα. For example, in [31], the rich model is used for quantitative analysis to realize the estimation of relative payload α. The width of the submatrix can be obtained by relative payload α. For a submatrix with height h and width w, the number of all possible submatrices is 2hw. Filler et al. [8] pointed out that a good submatrix should meet the requirements that the first row and the last row are 1 and any two columns are not the same. When the reciprocal of the relative payload is an integer, the parity-check matrix is only composed of a single submatrix, and the size of the steganographic key space is K=A2h−2w, in which Amn=m!/m−n!. Therefore, given the stego object, the average uncertainty of the steganographic key is(32)HK|Y=∑i=1A2h−2w11A2h−2w1log2A2h−2w1=log2A2h−2w1=∑j=0w1−1log22h−2−j.
The penultimate step is valid sincelog2A2h−2w=log22h−2×2h−2−1×⋯2h−2−w+1=∑j=0w−1log22h−2−j.
The parity-check matrix is composed of two submatrices when the reciprocal of the relative payload is not an integer. The size of the steganographic key space is(33)K=A2h−2w1×A2h−2w2.
Thus,(34)HK|Y=∑i=1A2h−2w1×A2h−2w21A2h−2w1×A2h−2w2log2A2h−2w1×A2h−2w2=log2A2h−2w1×A2h−2w2=∑j=0w1−1log22h−2−j+∑j=0w2−1log22h−2−j=∑i=12∑j=0wi−1log22h−2−j,in which w1=1/α and w2=1/α+1. The penultimate step is valid since log2A2h−2w=log22h−2×2h−2−1×⋯2h−2−w+1=∑j=0w−1log22h−2−j.
For example, when the height of the submatrix is fixed at 7, the relationship betweenHK|Y and the relative payload α is shown in Figure 3. When the number of different submatrices is fixed at one (that is, the reciprocal of the relative payload is an integer), the relative payload is taken as 0.05 bpp, 0.1 bpp, 0.2 bpp, 0.25 bpp, and 0.5 bpp. When the number of different submatrices is fixed at two (that is, when the reciprocal of the relative payload is not an integer), the relative payload is taken as 0.06 bpp, 0.15 bpp, 0.24 bpp, 0.35 bpp, and 0.45 bpp. It can be seen from Figure 3 that HK|Y decreases as the relative payload increases when the number of different submatrices is fixed. The relationship between HK|Y and the height of the submatrix is shown in Figure 4. The relative payload is fixed at 0.2 bpp and 0.4 bpp in order. When the relative payload is fixed at 0.2 bpp, the parity-check matrix is composed of one submatrix with width of 5; when the relative payload is fixed at 0.4 bpp, the parity-check matrix is composed of two different submatrices with width of 2 and 3. It can be seen from Figure 4 that HK|Y increases as the height of the submatrix increases when the relative payload is fixed.
Lemma1 indicates the relationship between conditional entropy HK|Y and the size of submatrices. Based on this relationship, we can obtain the relationship between the upper bound of the message equivocation function and the size of the submatrices under the stego-only attack. See the following theorem for details.Figure 3
The relationship betweenHK|Y and α.Figure 4
The relationship betweenHK|Y and h.Theorem 2.
Under the condition of stego-only attack, the message equivocation function is bounded as(35)IM;Y≤HY−HK+HK|Y,in which HK|Y=∑j=0w1−1og2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
Due to the relationship between mutual information and entropy, we have(36)IM;Y=HM−HM|Y.
Combining equations (13) and (14), we get(37)HM=HY+HK|Y+HT|M,K,Y+HX|M,K,Y,T−HK−HT−HX,and substituting (37) into (36), we get(38)IM;Y=HY−HK−HT−HX+HT|M,K,Y+HX|M,K,Y,T+HK|Y−HM|Y.
Due to the chain rule of the entropy function (equation (2)), the joint entropy HM,K,Y can be isolated in two ways:(39)HM,K,Y=HY+HM|Y+HK|M,Y,(40)HM,K,Y=HY+HK|Y+HM|K,Y=HY+HK|Y.
Combining equation (39) with (40), we have(41)HK|Y−HM|Y=HK|M,Y.
Substituting equation (41) into (38), we get(42)IM;Y=HY−HX−HK−HT+HT|M,K,Y+HX|M,K,Y,T+HK|M,Y=HY−IK;M,Y−IX;M,K,Y,T−IT;M,K,Y<HY−IK;M,Y.
The penultimate step is valid because of an application of equation (4), and the last step is valid since mutual information is nonnegative.
Then,IK;M,Y≥IK;Y yields(43)IM;Y≤HY−IK;M,Y=HY−IK;Y=HY−HK+HK|Y,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem2 that the upper bound of the message equivocation function increases as the height of the submatrices increases when the relative payload is fixed. When the number of different submatrices is fixed, the upper bound of the message equivocation function decreases as the relative payload increases. This is because the larger the submatrices size and the larger number of different submatrices mean the more encoding content parameters and harder to extract the data. Therefore, we should choose submatrices with bigger size and a relative payload whose reciprocal is not an integer preferentially. However, the above methods will increase the time consumption of generating stego objects.


## 3.3. The Unicity Distance of the Steganographic Key

The security of a steganographic algorithm is generally only based on the secrecy of the steganographic key. Accordingly, a complete breach of a steganographic algorithm by an attacker means that he can find a way to recover the steganographic key. Therefore, the following is to further analyze the cryptographic secrecy of STC-based adaptive steganography from the perspective of the unicity distance of the steganographic key [3]. Specifically, we consider the minimum amount of data required by the attacker to recover the steganographic key on average. The following theorem gives the relationship between the unicity distance of the steganographic key NK and the size of the submatrix under the stego-only attack.Theorem 3.
Under the stego-only attack, the unicity distance of the steganographic keyNK is bounded as(44)NK≥HK|YHY−HM+IT;K,Y+IX;K,Y,T.,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
DenoteNK groups of stego objects as YNK=Y1,Y2,…YNK. Given NK stego objects, then the set of all the possible steganographic keys KYNK is(45)KYNK=k∈K|∃mi∈M,s.t.prmi>0,kyi=mi,and the expectation of the number of pseudokeys K¯P is(46)K¯P=∑YNKPrYNKKYNK−1=∑YNKPrYNK|KYNK|−1,where KYNK represents the number of elements in set KYNK.
Then, an application of equation (3) yields(47)HK|YNK=∑YNPrYNKHK|YNK=∑YNPrYNKlog2KYNK≤log2∑YNPrYNKKYNK≤logK¯P+1,and with equation (17), this yields(48)HK|YNK=HK+NKHM−HY+IT;K,Y+IX;K,Y,T.
Together with equations (47) and (48), we get(49)logK¯p+1≤HK+NKHM−HY+IT;K,Y+IX;K,Y,T,and the expectation of the number of pseudokeys NK is bounded as(50)K¯p≤2HK+NKHM−HY+IT;K,Y+IX;K,Y,T−1.
On that account, the unicity distance is bounded as(51)NK=HKHY−HM+IT;K,Y+IX;K,Y,T≥HK|YHY−HM+IT;K,Y+IX;K,Y,T,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem6 that when the relative payload is fixed, the lower bound of the unicity distance of the steganographic key NK increases as the height h of the submatrix increases; when the number of different submatrices is fixed, the unicity distance of the steganographic key NK decreases as the relative payload α increases. This is because the larger sizes of submatrices and number of different submatrices mean the more encoding content parameters, that is, the more difficult it is to restore the steganographic key. Therefore, in order to recover the steganographic key, the average amount of information the attacker needs to obtain in advance become more. We should choose submatrices with bigger size and a relative payload whose reciprocal is not an integer preferentially. However, the above method will increase the time consumption of generating stego objects.
In this section, the cryptographic secrecy of the STC-based adaptive steganography algorithm is studied from three aspects: the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key under the known-cover attack. More specifically, we obtain the upper bound of the amount of steganographic key information and data information leaked from the cover object and stego object, the lower bound of the amount of information an attacker needs to recover the steganographic key, and the quantitative relationship between these theoretical bounds and the submatrices, data, and cover object.


## 4. Cryptographic Secrecy of STC under Known-Cover Attack

With the development of steganalysis technology, attackers may obtain stronger attack conditions: obtaining the cover object. Attack under this condition is called known-cover attack. Similar to Section3, this section discusses the cryptographic secrecy of STC-based adaptive steganography from three aspects: the steganographic key equivocation function, message equivocation function, and unicity distance of the steganographic key.


### 4.1. Steganographic Key Equivocation

Under the known-cover attack, the steganographic key equivocation function is denoted byIK;X,Y [27] as in(52)IK;X,Y=∑k∈F2q×n∑x,y∈F2npk,x,ylogpk,x,ypkpx,y,which measures how much steganographic key information may be revealed from observations of the cover object and stego object. The greater the steganographic key equivocation function is, the more steganographic key information can be obtained by the attacker from the cover object and stego object, that is, the easier the attacker can infer the steganographic key, and the less secure the steganographic system will be. The following theorem gives the upper bound of the steganographic key equivocation function under the known-cover attack, that is, how much steganographic key information can be leaked by the cover object and stego object at most.Theorem 4.
Under the known-cover attack, the steganographic key equivocation function satisfies(53)IK;X,Y=HY|X−HM−IT;X,Y,K,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
According to the chain rule of entropy function (equation (2)), joint entropy HY,K,M,T,X of the stego object Y, steganographic key K, data M, distortion function T, and cover object X can be isolated as(54)HY,K,M,T,X=HK,M,T,X+HY|K,M,T,X=HK,M,T,X=HK+HM+HX+HT.
The penultimate step is valid because of an application of equation (12). The last step is valid since the independence of the steganographic key K, data M, distortion function T, and cover object X.
At the same time, the joint entropyHY,K,M,T,X can be rearranged as(55)HY,K,M,T,X=HY+HX|Y+HK|X,Y+HM|K,X,Y+HT|K,X,Y,M=HY+HX|Y+HK|X,Y+HT|K,X,Y,M.
The last step is valid since equation (6) suggests HM|K,X,Y=0.
Combining equations (54) and (55), we get(56)HK+HM+HX+HT=HY+HX|Y+HK|X,Y+HT|K,X,Y,M.
That is,(57)HX−HX|Y+HK−HK|X,Y+HT−HT|K,X,Y,M=HY−HM.
According to the relationship between mutual information and entropy (equation (4)), we have(58)IY;X=HX−HX|Y,(59)IK;X,Y=HK−HK|X,Y,(60)IY;X=HX−HX|Y.
Substituting equations (58)–(60) into (57), we have(61)IY;X+IK;Y,X+IT;K,X,Y,M=HY−HM.
That is,(62)IK;X,Y=HY−HM−IY;X−IT;K,X,Y,M=HY|X−HM−IT;K,X,Y,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem4 that when the relative payload is fixed, the steganographic key equivocation function increases as the height of the submatrices increases; when the number of different submatrices is fixed, the steganographic keys’ equivocation function decreases as the relative payload increases. This is because the larger the submatrices size and the more different submatrices number mean the more encoding content parameters and the more difficult to completely restore the steganographic key. Therefore, we should choose submatrices with bigger size, and a relative payload whose reciprocal is not an integer preferentially. However, the above methods will increase the time consumption of generating stego objects.


### 4.2. Message Equivocation

Under the known-cover attack, the message equivocation function is denoted byIM;X,Y [28] as in(63)IM;X,Y=∑m∈F2q∑x,y∈F2npm,x,ylog2pm,x,ypmpx,y,which measures how much data information may be revealed from observations of the cover object and stego object. The greater the message equivocation function IM;X,Y is, the more information about the data M can be obtained by the attacker from the cover object X and stego object Y, that is, the easier the attacker can extract the data, and the less secure the steganographic system will be. The following theorem gives the upper bound of the message equivocation function under the known-cover attack, that is, how much data information can be leaked by the cover object and stego object at most.Theorem 5.
Under the known-cover attack, the message equivocation functionIM;X,Y is bounded as(64)IM;X,Y≤HY|X+HK|Y−HK−IT;X,Y,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
According to the chain rule of entropy function (equation (2)), we can isolate the joint entropy HY,K,M,T,X in two ways:(65)HY,K,M,T,X=HX+HY|X+HM|X,Y+HK|M,X,Y+HT|M,X,Y,K,(66)HY,K,M,T,X=HX+HK+HM+HT.
Combining equations (63) and (64), we have(67)HM−HM|X,Y=HY|X+HK|M,X,Y+HT|M,X,Y,K−HT−HK.
That is,(68)IM;X,Y=HY|X−IK;M,X,Y−IT;M,X,Y,K.
IK;M,X,Y≥IK;X,Y and IT;M,X,Y,K≥IT;X,Y yield(69)IM;X,Y≤HY|X−IK;Y−IT;X,Y=HY|X+HK|Y−HK+IT;X,Y,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem5 that when the relative payload is fixed, the message equivocation function increases as the height of the submatrix increases; when the number of different submatrices is fixed, the message equivocation function decreases as the relative payload increases. This is because the larger the submatrices size and number of different submatrices mean the more encoding content parameters and more difficult to extract the data completely. Therefore, we should choose submatrices with bigger size, and a relative payload whose reciprocal is not an integer preferentially. However, the above methods will increase the time consumption of generating stego objects.


### 4.3. The Unicity Distance of the Steganographic Key

The following theorem gives the relationship between the unicity distance of the steganographic key and the size of the submatrix under the cover-known attack.Theorem 6.
Under the known-cover attack, the unicity distance of the steganographic keyNK is bounded as(70)NK≥HK|YHY|X−HM+IT;Y,X,K,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
DenoteNK groups of covers and stego objects as XNK=X1,X2,…,XNKandYNK=Y1,Y2,…YNK. Given NK pairs of covers and stego objects, then denote the set of all the possible steganographic keys K as KYNK,XNK; then,(71)KYNK,XNK=k∈K|∃mi∈M,s.t.prmi>0,kyi=mi,and the expectation of the number of pseudokeys K¯P is(72)K¯P=∑XNK,YNKPrYNK,XNKKYNK,XNK−1=∑XNK,YNKPrYNK,XNKKYNK,XNK−1,where KYNK,XNK represents the number of elements in set KYNK,XNK.
The application of equation (3) yields(73)HK|XNK,YNK=∑XNK,YNKPrYNK,XNKHK|YNK,XNK=∑XNK,YNKPrYNK,XNKlog2KYNK,XNK≤log2∑XNK,YNKPrYNK,XNKKYNK,XNK≤log2K¯P+1.
Because ofHYNK|K,MNK,TNK,X=0 (it is because the stego object Y can be determined by steganographic key K, data M, distortion function T, and cover object X) and joint entropy HMNK,TNK,XNK,K=NKHX+HM+HT+HK (it is because the independence of steganographic key K, data M, distortion function T, and cover object X), we can isolate the joint entropy HYNK,XNK,MNK,TNK,K as(74)HYNK,XNK,MNK,TNK,K=HXNK,MNK,TNK,K+HYNK|XNK,MNK,TNK,K=HXNK,MNK,TNK,K=NKHX+HM+HT+HK.
According to the chain rule of the joint entropy function (equation (2)), we can rearrange the joint entropy HYNK,XNK,MNK,TNK,K as(75)HYNK,XNK,MNK,TNK,K=HXNK+HYNK|XNK+HK|YNK,XNK+HMNK|YNK,XNK,K+HTNK|MNK,YNK,XNK,K,=NKHX+NKHY|X+HK|XNK,YNK+HTNK|YNK,XNK,MNK,K=NKHX+HY|X+HT−IT;M,X,Y,K+HK|YNK,XNK.
Combining equations (72) and (73), we have(76)HK|YNK,XNK=HK−NKHY|X−HM−IT;M,X,Y,K.
Thus,(77)logK¯p+1≥HK−NKHY|X−HM−IT;M,X,Y,K.
Expectation of the number of pseudosteganographic keyK¯p is bounded as(78)K¯p≥2HK−NKHY|X−HM−IT;M,Y,X,K−1.
As a result, the unicity distanceNK is bounded as(79)NK≥HK|YHY|X−HM+IT;Y,X,K,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem6 that when the relative payload is fixed, the lower bound of the unicity distance of the steganographic key NK increases as the height h of the submatrix increases; when the number of different submatrices is fixed, the unicity distance of the steganographic key NK decreases as the relative payload α increases. This is because the larger sizes of submatrices and number of different submatrices mean the more encoding content parameters, that is, the more difficult it is to completely restore the steganographic key. Therefore, the average amount of data required to recover the steganographic key are more. We should choose submatrices with bigger size and a relative payload whose reciprocal is not an integer preferentially. However, the above method will increase the time consumption of generating stego objects.
In this section, the cryptographic secrecy of the STC-based adaptive steganography algorithm is studied from three aspects: the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key under the known-cover attack. More specifically, we obtain the upper bound of the amount of steganographic key information and data information leaked from the cover object and stego object, the lower bound of the amount of information an attacker needs to recover the steganographic key, and the quantitative relationship between these theoretical bounds and submatrices, data, and cover object.


## 4.1. Steganographic Key Equivocation

Under the known-cover attack, the steganographic key equivocation function is denoted byIK;X,Y [27] as in(52)IK;X,Y=∑k∈F2q×n∑x,y∈F2npk,x,ylogpk,x,ypkpx,y,which measures how much steganographic key information may be revealed from observations of the cover object and stego object. The greater the steganographic key equivocation function is, the more steganographic key information can be obtained by the attacker from the cover object and stego object, that is, the easier the attacker can infer the steganographic key, and the less secure the steganographic system will be. The following theorem gives the upper bound of the steganographic key equivocation function under the known-cover attack, that is, how much steganographic key information can be leaked by the cover object and stego object at most.Theorem 4.
Under the known-cover attack, the steganographic key equivocation function satisfies(53)IK;X,Y=HY|X−HM−IT;X,Y,K,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
According to the chain rule of entropy function (equation (2)), joint entropy HY,K,M,T,X of the stego object Y, steganographic key K, data M, distortion function T, and cover object X can be isolated as(54)HY,K,M,T,X=HK,M,T,X+HY|K,M,T,X=HK,M,T,X=HK+HM+HX+HT.
The penultimate step is valid because of an application of equation (12). The last step is valid since the independence of the steganographic key K, data M, distortion function T, and cover object X.
At the same time, the joint entropyHY,K,M,T,X can be rearranged as(55)HY,K,M,T,X=HY+HX|Y+HK|X,Y+HM|K,X,Y+HT|K,X,Y,M=HY+HX|Y+HK|X,Y+HT|K,X,Y,M.
The last step is valid since equation (6) suggests HM|K,X,Y=0.
Combining equations (54) and (55), we get(56)HK+HM+HX+HT=HY+HX|Y+HK|X,Y+HT|K,X,Y,M.
That is,(57)HX−HX|Y+HK−HK|X,Y+HT−HT|K,X,Y,M=HY−HM.
According to the relationship between mutual information and entropy (equation (4)), we have(58)IY;X=HX−HX|Y,(59)IK;X,Y=HK−HK|X,Y,(60)IY;X=HX−HX|Y.
Substituting equations (58)–(60) into (57), we have(61)IY;X+IK;Y,X+IT;K,X,Y,M=HY−HM.
That is,(62)IK;X,Y=HY−HM−IY;X−IT;K,X,Y,M=HY|X−HM−IT;K,X,Y,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem4 that when the relative payload is fixed, the steganographic key equivocation function increases as the height of the submatrices increases; when the number of different submatrices is fixed, the steganographic keys’ equivocation function decreases as the relative payload increases. This is because the larger the submatrices size and the more different submatrices number mean the more encoding content parameters and the more difficult to completely restore the steganographic key. Therefore, we should choose submatrices with bigger size, and a relative payload whose reciprocal is not an integer preferentially. However, the above methods will increase the time consumption of generating stego objects.


## 4.2. Message Equivocation

Under the known-cover attack, the message equivocation function is denoted byIM;X,Y [28] as in(63)IM;X,Y=∑m∈F2q∑x,y∈F2npm,x,ylog2pm,x,ypmpx,y,which measures how much data information may be revealed from observations of the cover object and stego object. The greater the message equivocation function IM;X,Y is, the more information about the data M can be obtained by the attacker from the cover object X and stego object Y, that is, the easier the attacker can extract the data, and the less secure the steganographic system will be. The following theorem gives the upper bound of the message equivocation function under the known-cover attack, that is, how much data information can be leaked by the cover object and stego object at most.Theorem 5.
Under the known-cover attack, the message equivocation functionIM;X,Y is bounded as(64)IM;X,Y≤HY|X+HK|Y−HK−IT;X,Y,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
According to the chain rule of entropy function (equation (2)), we can isolate the joint entropy HY,K,M,T,X in two ways:(65)HY,K,M,T,X=HX+HY|X+HM|X,Y+HK|M,X,Y+HT|M,X,Y,K,(66)HY,K,M,T,X=HX+HK+HM+HT.
Combining equations (63) and (64), we have(67)HM−HM|X,Y=HY|X+HK|M,X,Y+HT|M,X,Y,K−HT−HK.
That is,(68)IM;X,Y=HY|X−IK;M,X,Y−IT;M,X,Y,K.
IK;M,X,Y≥IK;X,Y and IT;M,X,Y,K≥IT;X,Y yield(69)IM;X,Y≤HY|X−IK;Y−IT;X,Y=HY|X+HK|Y−HK+IT;X,Y,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem5 that when the relative payload is fixed, the message equivocation function increases as the height of the submatrix increases; when the number of different submatrices is fixed, the message equivocation function decreases as the relative payload increases. This is because the larger the submatrices size and number of different submatrices mean the more encoding content parameters and more difficult to extract the data completely. Therefore, we should choose submatrices with bigger size, and a relative payload whose reciprocal is not an integer preferentially. However, the above methods will increase the time consumption of generating stego objects.


## 4.3. The Unicity Distance of the Steganographic Key

The following theorem gives the relationship between the unicity distance of the steganographic key and the size of the submatrix under the cover-known attack.Theorem 6.
Under the known-cover attack, the unicity distance of the steganographic keyNK is bounded as(70)NK≥HK|YHY|X−HM+IT;Y,X,K,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.Proof.
DenoteNK groups of covers and stego objects as XNK=X1,X2,…,XNKandYNK=Y1,Y2,…YNK. Given NK pairs of covers and stego objects, then denote the set of all the possible steganographic keys K as KYNK,XNK; then,(71)KYNK,XNK=k∈K|∃mi∈M,s.t.prmi>0,kyi=mi,and the expectation of the number of pseudokeys K¯P is(72)K¯P=∑XNK,YNKPrYNK,XNKKYNK,XNK−1=∑XNK,YNKPrYNK,XNKKYNK,XNK−1,where KYNK,XNK represents the number of elements in set KYNK,XNK.
The application of equation (3) yields(73)HK|XNK,YNK=∑XNK,YNKPrYNK,XNKHK|YNK,XNK=∑XNK,YNKPrYNK,XNKlog2KYNK,XNK≤log2∑XNK,YNKPrYNK,XNKKYNK,XNK≤log2K¯P+1.
Because ofHYNK|K,MNK,TNK,X=0 (it is because the stego object Y can be determined by steganographic key K, data M, distortion function T, and cover object X) and joint entropy HMNK,TNK,XNK,K=NKHX+HM+HT+HK (it is because the independence of steganographic key K, data M, distortion function T, and cover object X), we can isolate the joint entropy HYNK,XNK,MNK,TNK,K as(74)HYNK,XNK,MNK,TNK,K=HXNK,MNK,TNK,K+HYNK|XNK,MNK,TNK,K=HXNK,MNK,TNK,K=NKHX+HM+HT+HK.
According to the chain rule of the joint entropy function (equation (2)), we can rearrange the joint entropy HYNK,XNK,MNK,TNK,K as(75)HYNK,XNK,MNK,TNK,K=HXNK+HYNK|XNK+HK|YNK,XNK+HMNK|YNK,XNK,K+HTNK|MNK,YNK,XNK,K,=NKHX+NKHY|X+HK|XNK,YNK+HTNK|YNK,XNK,MNK,K=NKHX+HY|X+HT−IT;M,X,Y,K+HK|YNK,XNK.
Combining equations (72) and (73), we have(76)HK|YNK,XNK=HK−NKHY|X−HM−IT;M,X,Y,K.
Thus,(77)logK¯p+1≥HK−NKHY|X−HM−IT;M,X,Y,K.
Expectation of the number of pseudosteganographic keyK¯p is bounded as(78)K¯p≥2HK−NKHY|X−HM−IT;M,Y,X,K−1.
As a result, the unicity distanceNK is bounded as(79)NK≥HK|YHY|X−HM+IT;Y,X,K,in which HK|Y=∑j=0w1−1log2h−2−j when the STC parity-check matrix consists of a single submatrix with a width of w1; HK|Y=∑i=12∑j=0wi−1log2h−2−j when the STC parity-check matrix consists of two submatrices with widths w1 and w2.
It can be seen from Theorem6 that when the relative payload is fixed, the lower bound of the unicity distance of the steganographic key NK increases as the height h of the submatrix increases; when the number of different submatrices is fixed, the unicity distance of the steganographic key NK decreases as the relative payload α increases. This is because the larger sizes of submatrices and number of different submatrices mean the more encoding content parameters, that is, the more difficult it is to completely restore the steganographic key. Therefore, the average amount of data required to recover the steganographic key are more. We should choose submatrices with bigger size and a relative payload whose reciprocal is not an integer preferentially. However, the above method will increase the time consumption of generating stego objects.
In this section, the cryptographic secrecy of the STC-based adaptive steganography algorithm is studied from three aspects: the steganographic key equivocation, the message equivocation, and the unicity distance of the steganographic key under the known-cover attack. More specifically, we obtain the upper bound of the amount of steganographic key information and data information leaked from the cover object and stego object, the lower bound of the amount of information an attacker needs to recover the steganographic key, and the quantitative relationship between these theoretical bounds and submatrices, data, and cover object.


## 5. Discussion and Conclusion

This section mainly uses the results obtained in this manuscript to explain the performance of the data extraction methods proposed in [14–16] and summarizes this manuscript.


### 5.1. Discussion

The research results of this manuscript show that the cryptographic secrecy of the STC-based adaptive steganography algorithm has a quantitative relationship with the submatrix used by STC under the stego-only attack and the known-cover attack. More specifically, when the number of different submatrices is fixed, the larger size of the submatrix, the stronger the cryptographic secrecy. However, when the height of the submatrix is fixed, the smaller the relative payload, the stronger the cryptographic secrecy is not necessarily. For example, when the height of the submatrix is fixed at 7, the cryptographic secrecy at a relative payload of 0.3 bpp is higher than that at a relative payload of 0.2 bpp. This is because when the height of the submatrix is fixed at 7, there are 49 encoding parameters that need to be restored at a relative payload of 0.3 bpp, while 35 encoding parameters need to be restored at a relative payload of 0.2 bpp. In fact, under different attack conditions, [14–16] all have similar conclusions in different attack methods: the more encoding parameters, the greater the time overhead and the lower the recovery rate. This is because STC are a linear structure, and the more unknowns there are, the more difficult it is to solve. Therefore, when the two parties conduct covert communication, they can select submatrices with greater height and width to enhance the cryptographic secrecy of the covert communication according to actual needs. However, the above method will increase the time consumption of generating the stego object. Thus, we need to make a compromise between cryptographic secrecy and time consumption of generating the stego object.The research results of Theorem2 on the steganographic key equivocation in the third section of this manuscript shows that the better the randomness of the embedded data, the smaller the theoretical upper bound of the steganographic key equivocation and the less steganographic key information is obtained from the stego object. This means that, for STC-based adaptive steganography, the randomness of data also has impact on the security of the steganography system. However, the research results of [22] show that even if the data embedded via steganography is unencrypted, as long as the steganography itself has strong cryptographic secrecy, it is still safe in the cryptographic sense. For STC-based adaptive steganography algorithms that use plaintext as data, Luo et al. [15] proposed a data extraction method based on the difference in randomness of the data extracted by correct encoding parameters and the incorrect encoding parameters under the condition of the stego-only attack. When the embedded data is a ciphertext, the random sequence extracted by the incorrect parity-check matrix is indistinguishable from the data extracted by the correct parity-check matrix, which makes the method proposed in [15] invalid. Thus, the sender should encrypt the data when performing covert communication, and the stronger the randomness of the cipher text, the better the cryptographic secrecy of covert communication.


### 5.2. Conclusion

The STC-based adaptive steganography has become the mainstream steganography technology with strong covert security. However, as the problem of data extraction was put forward, researchers have gradually begun to pay attention to the factors related to the antiextraction performance of steganography algorithms and what quantitative relationship they have. In the future, the security of STC-based adaptive steganography will gradually get shocked. This manuscript studies the cryptographic secrecy of the STC-based adaptive steganography algorithm from three aspects: steganographic key equivocation, message equivocation, and unicity distance of the steganographic key under the condition of stego-only attack and known-cover attack. More specifically, based on the special structure of the STC parity-check matrix, we obtain the upper bound of the amount of steganographic key information and data information leaked from the stego object and cover object, the lower bound of the amount of information an attacker needs to recover the steganographic key, and the quantitative relationship between these theoretical bounds and submatrices, data, and cover object. The research results of this manuscript show that the better the randomness of the data and the cover object, the more coding contents parameters of STC, correspondingly the stronger the cryptographic secrecy of the STC-based adaptive steganography algorithm. The research results of this manuscript not only provide precise theoretical guidance for improving the more secure communication based on STC but also provide a theoretical bound of the amount of information required for the attackers to extract data. Next, we will study the data extraction method under the theoretical framework of this manuscript and verify the correctness of the theoretical derivation in this manuscript.


## 5.1. Discussion

The research results of this manuscript show that the cryptographic secrecy of the STC-based adaptive steganography algorithm has a quantitative relationship with the submatrix used by STC under the stego-only attack and the known-cover attack. More specifically, when the number of different submatrices is fixed, the larger size of the submatrix, the stronger the cryptographic secrecy. However, when the height of the submatrix is fixed, the smaller the relative payload, the stronger the cryptographic secrecy is not necessarily. For example, when the height of the submatrix is fixed at 7, the cryptographic secrecy at a relative payload of 0.3 bpp is higher than that at a relative payload of 0.2 bpp. This is because when the height of the submatrix is fixed at 7, there are 49 encoding parameters that need to be restored at a relative payload of 0.3 bpp, while 35 encoding parameters need to be restored at a relative payload of 0.2 bpp. In fact, under different attack conditions, [14–16] all have similar conclusions in different attack methods: the more encoding parameters, the greater the time overhead and the lower the recovery rate. This is because STC are a linear structure, and the more unknowns there are, the more difficult it is to solve. Therefore, when the two parties conduct covert communication, they can select submatrices with greater height and width to enhance the cryptographic secrecy of the covert communication according to actual needs. However, the above method will increase the time consumption of generating the stego object. Thus, we need to make a compromise between cryptographic secrecy and time consumption of generating the stego object.The research results of Theorem2 on the steganographic key equivocation in the third section of this manuscript shows that the better the randomness of the embedded data, the smaller the theoretical upper bound of the steganographic key equivocation and the less steganographic key information is obtained from the stego object. This means that, for STC-based adaptive steganography, the randomness of data also has impact on the security of the steganography system. However, the research results of [22] show that even if the data embedded via steganography is unencrypted, as long as the steganography itself has strong cryptographic secrecy, it is still safe in the cryptographic sense. For STC-based adaptive steganography algorithms that use plaintext as data, Luo et al. [15] proposed a data extraction method based on the difference in randomness of the data extracted by correct encoding parameters and the incorrect encoding parameters under the condition of the stego-only attack. When the embedded data is a ciphertext, the random sequence extracted by the incorrect parity-check matrix is indistinguishable from the data extracted by the correct parity-check matrix, which makes the method proposed in [15] invalid. Thus, the sender should encrypt the data when performing covert communication, and the stronger the randomness of the cipher text, the better the cryptographic secrecy of covert communication.


## 5.2. Conclusion

The STC-based adaptive steganography has become the mainstream steganography technology with strong covert security. However, as the problem of data extraction was put forward, researchers have gradually begun to pay attention to the factors related to the antiextraction performance of steganography algorithms and what quantitative relationship they have. In the future, the security of STC-based adaptive steganography will gradually get shocked. This manuscript studies the cryptographic secrecy of the STC-based adaptive steganography algorithm from three aspects: steganographic key equivocation, message equivocation, and unicity distance of the steganographic key under the condition of stego-only attack and known-cover attack. More specifically, based on the special structure of the STC parity-check matrix, we obtain the upper bound of the amount of steganographic key information and data information leaked from the stego object and cover object, the lower bound of the amount of information an attacker needs to recover the steganographic key, and the quantitative relationship between these theoretical bounds and submatrices, data, and cover object. The research results of this manuscript show that the better the randomness of the data and the cover object, the more coding contents parameters of STC, correspondingly the stronger the cryptographic secrecy of the STC-based adaptive steganography algorithm. The research results of this manuscript not only provide precise theoretical guidance for improving the more secure communication based on STC but also provide a theoretical bound of the amount of information required for the attackers to extract data. Next, we will study the data extraction method under the theoretical framework of this manuscript and verify the correctness of the theoretical derivation in this manuscript.



---

*Source: 5495941-2021-07-28.xml*