-
Notifications
You must be signed in to change notification settings - Fork 0
/
sssteg.1
174 lines (161 loc) · 6.25 KB
/
sssteg.1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
.\"sssteg - hide secrets across multiple files
.\"Copyright (C) 2020 Daniel Bertalan <dani@danielbertalan.dev>
.\"
.\"This program is free software: you can redistribute it and/or modify
.\"it under the terms of the GNU General Public License as published by
.\"the Free Software Foundation, either version 3 of the License, or
.\"(at your option) any later version.
.\"
.\"This program is distributed in the hope that it will be useful,
.\"but WITHOUT ANY WARRANTY; without even the implied warranty of
.\"MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
.\"GNU General Public License for more details.
.\"
.\"You should have received a copy of the GNU General Public License
.\"along with this program. If not, see <http://www.gnu.org/licenses/>.
.\"
.Dd $Mdocdate: June 03 2020 $
.Dt SSSTEG 1
.Os
.Sh NAME
.Nm sssteg
.Nd hide secrets across multiple files
.Sh SYNOPSIS
.Nm
.Cm hide
.Op Fl q
.Op Fl n
.Op Fl p Ar password
.Op Fl s Ar secret | Fl f Ar secret-file
.Op Fl l Ar label
.Op Fl t Ar threshold
.Ar cover-file-1 cover-file-2 ...
.Nm
.Cm restore
.Op Fl q
.Op Fl n
.Op Fl p Ar password
.Op Fl t Ar threshold
.Op Fl o Ar output-file
.Op Fl l Ar label
.Ar stego-file-1 stego-file-2 ...
.Sh DESCRIPTION
.Nm
is a wrapper around
.Xr ssss 1
and
.Xr steghide 1
written in POSIX shell. It splits up to 1024 bits of secret data and embeds it in JPEG files in a way that a specified number
.Po
.Ar threshold
.Pc
of shares are required to recover it. You can further secure the data with a
.Ar password .
For example, you can use it to store a master password or an encryption key. You hand out the cover files out to unsuspecting friends or upload them to online storage. Without the password, it theoretically should not be possible to identify hidden data. Visually, the cover files remain unchanged.
.Ss SUBCOMMANDS
The first argument must specify a subcommand, which is one of these:
.Bl -tag -width Ds
.It Cm hide
Split, encrypt and embed secret data in cover files, thereby creating stego files. The stego files will be placed in a subdirectory named sssteg in the current working directory.
.It Cm restore
Restore the secret data from stego files. By default, the secret will be printed to the terminal.
.It Cm help
Display a short help message. Does not take any arguments.
.It Cm license
Display
.Nm Ap s
license. Does not take any arguments.
.It Cm version
Display
.Nm Ap s
version. Does not take any arguments.
.El
.Ss OPTIONS
The following options are supported by
.R all
subcommands:
.Bl -tag -width Ds
.It Fl q, Fl -quiet
Quiet mode. Silences all messages on stdout, except the command's results. Error messages are still printed to stderr. Automatically enabled when output is being redirected.
.It Fl n, Fl -non-interactive
Non-interactive mode. Aborts script if user input is needed. Automatically enabled if input is being redirected.
.It Fl p, Fl -password Ar password
Symmetrically encrypt/decrypt the hidden data with this
.Ar password .
If you do not specify it, you will be prompted to enter one. If you do not want this protection, pass an empty string as argument. If
.Ar password
is a single dash (\(dq\-\(dq), it will be read from standard input.
.It Fl l, Fl -label Ar label
A short string to describe the hidden data. It is encrypted along with the secret data, so it cannot be read without the password. Helps when dealing with stego files for multiple secrets in one directory. If you do not specify it and stego files for multiple secrets with the same password are in the same directory, you will be asked to choose which secret to recover.
.It Fl t, Fl -threshold Ar threshold
The number of files that are needed to recover the secret. This must be >=2 and not more than the number of cover files. By default, all shares are needed. The same
.Ar threshold
.Sy must
be specified when recovering and hiding, or else the program will output garbage data.
.El
Additionally, the
.Cm hide
subcommand supports these these options:
.Bl -tag -width Ds
.It Fl s, Fl -secret Ar secret
The data that will be encrypted and hidden. If this or
.Fl f
is not specified, you will be prompted to enter the secret.
.It Fl f, Fl -secret-file Ar secret-file
Read the secret from
.Ar secret-file
instead of the command line or interactive input. If you have binary data like an encryption key, this input method is less likely to corrupt it. If
.Ar secret-file
is a single dash (\(dq\-\(dq), the secret data will be read from standard input.
.El
Additionally, the
.Cm recover
subcommand supports these options:
.Bl -tag -width Ds
.It Fl o, Fl -output-file Ar output-file
Name of file to write the recovered secret to. This is especially useful if the secret contains non-printable characters, like an encryption key.
.El
To avoid ambiguous parsing, the grouping of flags
.Po i.e.
.Fl qn
.Pc
is not supported.
.Sh EXAMPLES
Hide an encryption key (like a secure 256-bit Curve25519 key) stored in the file
.Pa secretkey.bin
in 4 images with a threshold of 3:
.Bd -literal -offset Ds
$ sssteg hide \-s secretkey.bin \-t 3 img1.jpg img2.jpg img3.jpg img4.jpg
Choose a password to protect the secrets:
Saved ./sssteg/img1.jpg
Saved ./sssteg/img2.jpg
Saved ./sssteg/img3.jpg
Saved ./sssteg/img4.jpg
Done
.Ed
Restore
.Pa secretkey.bin
from any 3 images:
.Bd -literal -offset Ds
$ sssteg recover \-o secretkey_restored.bin img1.jpg img2.jpg img4.jpg
Enter password:
Saved ./secretkey_restored.bin
Done
.Ed
Check if the secret was restored correctly. Please try this out before relying on
.Nm .
.Bd -literal -offset Ds
$ cmp -s secretkey.bin secretkey_restored.bin && echo \(dqEveryhing is good.\(dq || echo \(dqFile a bug report please.\(dq
Everything is good
.Ed
.Sh AUTHOR
This software was originally written by
.An Daniel Bertalan Aq Mt dani@danielbertalan.dev .
To get involved with development, visit our homepage:
.Lk https://danielbertalan.dev/sssteg.
.Sh SECURITY CONSIDERATIONS
Be sure to disable or clear shell history if you are typing any secrets into the prompt.
Do not store or distribute the cover files along with the originals, as people or automatic scripts might notice what you are doing.
This software may contain bugs and comes with absolutely no warranty. If you do not want to lose access to 10 years of GPG\-encrypted emails, do not use
.Nm
as the only storage method. Paper backups are always a good thing to keep.