File Format and Cryptography
Stegodon embeds a compact metadata header followed by the payload. This page documents the header fields, symbol encoding, randomization, and encryption behavior.
Stegodon Header
Every embedded payload begins with a compact binary header.
The header starts with the magic bytes:
SGDNHeader Layout
| Field | Size | Description |
|---|---|---|
| Magic | 4 bytes | ASCII SGDN |
| Version | 1 byte | Format version, currently 1 |
| Header length | 2 bytes | Total header length in bytes |
| Flags | 1 byte | Embedding options and payload type |
| Channel mask | 1 byte | Image channel mask (R/G/B) |
| Payload length | 4 bytes | Payload length in bytes |
| Filename length | 2 bytes | Filename byte length |
| Filename | variable | Present for file payloads |
| Salt | 16 bytes | Present when encryption is enabled |
| IV | 12 bytes | Present when encryption is enabled |
Minimum header length is 15 bytes.
Flags
The flags byte stores:
- encryption enabled
- randomized placement enabled
- file payload enabled
- LSB depth
Encoded meanings
| Flag component | Meaning |
|---|---|
| bit 0 | encryption enabled |
| bit 1 | randomized placement enabled |
| bit 2 | payload is a file |
| bits 3–4 | LSB count minus 1 |
Channel Mask
For images, the channel mask describes which RGB channels were used.
| Bit | Channel |
|---|---|
| 1 | Red |
| 2 | Green |
| 4 | Blue |
Examples:
| Mask | Meaning |
|---|---|
1 | R |
2 | G |
4 | B |
7 | R+G+B |
WAV carriers store 0 here because image channel selection does not apply.
Symbol Encoding
Stegodon converts bytes into embedding symbols according to the selected LSB depth.
1-bit mode
Each bit becomes one symbol.
2-bit mode
Bits are grouped into 2-bit symbols.
These symbols are then written into least significant bits of image channels or WAV samples.
Sequential Header, Optional Randomized Payload
The header is always written sequentially at the beginning of the carrier's embedding positions.
This allows extraction and detection to discover the file format and settings.
The payload may be:
- sequential
- randomized
Randomization
When randomization is enabled:
- Stegodon derives a seed from the passphrase
- It computes SHA-256 over:
STEGO-SEED::<passphrase>- It uses the first 4 bytes as a seed
- It creates an xorshift32 PRNG
- It shuffles the available payload positions with Fisher–Yates
This means the same passphrase is required to reconstruct the payload order during extraction.
Encryption
When encryption is enabled:
- algorithm: AES-GCM
- key size: 256-bit
- key derivation: PBKDF2
- hash: SHA-256
- iterations: 150,000
- salt: 16 bytes
- IV: 12 bytes
The salt and IV are stored in the header so the payload can be decrypted later with the correct passphrase.
File Payload Metadata
If the payload is a file, the original filename is stored in the header and shown again during extraction.
The filename is encoded as UTF-8 bytes.
Carrier-Specific Embedding
Images
Stegodon writes symbols into RGB byte positions in the selected order.
It does not use the alpha channel.
WAV
Stegodon writes symbols into the least significant bits of 8-bit or 16-bit PCM samples.
Output Preservation
Images
Stegodon outputs PNG to preserve hidden bits.
WAV
Stegodon writes the modified WAV byte structure back out directly.
Compatibility Notes
A file can only be reliably extracted if:
- the Stegodon header remains intact
- the carrier format preserves the hidden bits
- the same passphrase is supplied when required
Security Notes
- Encryption protects the payload content
- Randomization obscures placement
- Randomization alone does not encrypt the data
- Encryption alone does not randomize where the data is placed
- A weak passphrase weakens both encrypted and randomized workflows
Ethics
Steganography should only be used for lawful and ethical purposes.
Updated 7 days ago