Steganography — hiding data inside other data — sounds like a spy movie concept. But secure document embedding has real practical applications: whistleblower protection, watermarking, chain-of-custody verification for sensitive files. The Stego project was my final-year defence, but I built it as if it were going into production.
Why a Hybrid DCT-LSB Approach?
Pure LSB (Least Significant Bit) steganography is the simplest approach: replace the last bit of each pixel's colour value with a bit from your secret payload. It's nearly invisible, but it's also fragile — lossless compression and image reprocessing will destroy your hidden data.
DCT (Discrete Cosine Transform) domain steganography works differently: it embeds data in the frequency coefficients of an image, the same domain JPEG compression operates in. This makes the hidden data more resilient to compression, but at higher visual cost.
The hybrid approach I implemented works in two stages:
- DCT embedding for the encryption key metadata and file header
- LSB embedding for the actual payload (using the DCT-embedded key for addressing)
This gives the system JPEG resilience for the critical routing information while maintaining high payload capacity for the actual content.
The AES-256 Layer
The payload is encrypted with AES-256 in CBC mode before embedding. The key is derived from a user passphrase using PBKDF2 with a random salt. The salt is embedded in the image header using the DCT layer.
This means even if steganographic analysis detects that an image carries hidden data, decrypting it without the passphrase is computationally infeasible.
The PySide6 Interface
The GUI was built with PySide6 for cross-platform desktop operation. The interface has two modes:
- Embed mode — select a carrier image, select a file to hide, enter a passphrase, output is a modified image visually identical to the original
- Extract mode — select a modified image, enter the passphrase, recover the original file
The capacity indicator calculates how many bytes the carrier image can hold and warns the user if the payload is too large before they start the embedding process.
What the Defence Panel Said
The panel was most interested in the hybrid architecture decision — specifically why I chose to split the payload between DCT and LSB layers rather than using one approach consistently. The answer: because real-world images get reprocessed, shared on WhatsApp (which recompresses), printed and scanned. The critical routing data needed to survive that. The payload data just needed to survive the first transmission.
The project was awarded a distinction. More importantly, the system actually worked under conditions specifically designed to defeat it — compression, resampling, and colour space conversion.
Security systems should be designed for adversarial conditions, not optimal ones. That's the only test that matters.