Cyphernomicon Index
Cyphernomicon 18.11

Loose Ends and Miscellaneous Topics:
Can Encryption be Detected?


  18.11.1. "Can messages be scanned and checked for encryption?"
           - If the encryption produces _markers_ or other indications,
              then of course. "BEGIN PGP" is a pretty clear beacon. (Such
              markers assists in decryption by the recipient, but are not
              essential. "Stealth" versions of PGP and other encryption
              programs--such as S-Tools for DOS--don't have such
              markers.)
           - If the encryption produces "random-looking" stuff, then
              entropy measures and other statistical tests may or may not
              be able detect such messages reliably. Depends on what non-
              encrypted messages look like, and how the algorithm  works.
           + Steganography:
             - making messages look like normal ones
             - tucking th ebits in with other random-like bits, such as
                in the low-order bits of images or sound files
           - The practical concern depends on one's local political
              environment. In many countries, mere suspicion of using
              crypto could put one in real danger.


Next Page: 18.12 Personal Digital Assistants, Newtons, etc.
Previous Page: 18.10 Duress Switches, Dead Man Switches

By Tim May, see README

HTML by Jonathan Rochkind