SecretSpace
SecretSpace by Andrew Gray is a Win32 steganography program to conceal short messages invisibly within plain text documents. It does this by inserting superfluous spaces in between words; the pattern of spaces stores the message data.
Format information
First of all, to save space the message is encoded in such a way that common characters (such as the letters A-Z) only take up 6 bits of storage space each instead of the usual 8 bits.
The message is then broken up into pairs of bits. (Each pair of bits can have a value between 0 and 3.) These values are then added to the carrier text in the form of spaces in between the words. For example, if the value of a particular pair of bits is 0, one space is included between a pair of words. If the value of the pair of bits is 1, two spaces are included between the pair of words, and so on. In this way, the pairs of bits representing the hidden message are coded into the carrier text.
Each pair of bits is repeated to ensure reliability. E-mail programs such as Outlook often wrap pieces of text automatically by inserting a carriage return in between words, which would destroy the pair of bits stored between those particular words. By repeating each pair of bits, SecretSpace ensures that this type of alteration does not fatally corrupt the message. (You can test this for yourself - if you add a hidden message to a piece of text and then alter the number of spaces between two of the words, the hidden message will probably not be affected. However, if you do this to two or three consecutive words you are likely to corrupt the message.) Spaces at the beginning and ends of lines are not used to store information, since these are often removed or changed by word-processing or e-mail programs.
For example, if the following sequences of pairs of bits...
1032
...was hidden in the following carrier text...
The quick brown fox jumps over the lazy dog
...the pattern of spaces would be as follows (remember that each pair of bits is repeated)...
The··quick··brown·fox·jumps····over····the···lazy···dog
Another way that SecretSpace attempts to ensure reliability is to add an extra pair of bits to the end of the message whose value is the sum of all the preceding pairs of bits, modulo 4 (i.e. the remainder that you get when all the pairs of bits are added up and divided by 4). If one of the pairs of bits gets changed, this value will be wrong, and SecretSpace will know that the message has been corrupted.
In the case of the sequence of pairs of bits above (1032), the value of the extra pair of bits would be 2, because (1 + 0 + 3 + 2) ÷ 4 = 1 remainder 2.
If there is sufficient space, extra information is added to the end of the message storing the date that the message was created, and details of the program used to create it.
