Zero-knowledge protocols for digital watermarking allow a copyright holder to prove that a signal is hidden in a cover without revealing the signal or where it is. This same approach can be applied outside of watermarking to other problems where anonymity is required, and in particular to secure elections. We outline steganographic zero-knowledge protocols---proving in zero knowledge the existence of a hidden object in a cover---and adapt them to prove that selected ballot values must exist within a volume of anonymized voter receipts. We also improve the space efficiency of such protocols by employing camouflaged elliptic curve cryptography.

A popular method of face identification is the use of local binary pattern (LBP) histograms. In this method, a face image is partitioned into regions, and a histogram of features is produced for each region; faces are compared by measuring the similarity of their histograms through statistics such as chi-square score or K-L divergence. Comparison of histograms, however, is particularly prone to exploitation via a negative-number bug if coded naively. This allows a surprisingly precise and powerful attack: if an adversary can alter a histogram to change a single zero to a negative number of appropriate magnitude, the change will induce a negligible difference in matching under ordinary use, but match an attacker to an intended victim if the attacker briefly displays a printed striped pattern to a camera. This tampering is minor and can be inflicted long before the attack, allowing the insertion of a back door in a face recognition system that will behave normally until the moment of exploitation. We exhibit an example of this bug in the wild, in the OpenCV computer vision library, and illustrate the effectiveness of this attack in impersonating multiple victims.

Supraliminal channels were introduced in 1998 as a means to achieve public key exchange in the presence of an active warden. These channels have content visible to all principals-their content is not concealed or protected by a secret key-but are highly robust to an active warden. It is assumed that this high robustness allows the transmission of key exchange datagrams. In this paper, we provide a theoretical model for supraliminal channels as channels of random data with a constraint on their distribution. We present a surprising result that in such a model, vanishingly small tampering can indefinitely derail key exchange. Unlike traditional communication theory, the specific constraints of steganographic channels prevent the use of redundancy to achieve more reliable transmission, and can even make communication more fragile to an active adversary. This result requires a vigilant adversary, however, and we propose a protocol to increase the probability of successful key exchange in the event of a pause in the warden's tampering.

There has been an explosion of academic literature on steganography and steganalysis in the past two decades. With a few exceptions, such papers address abstractions of the hiding and detection problems, which arguably have become disconnected from the real world. Most published results, including by the authors of this paper, apply "in laboratory conditions" and some are heavily hedged by assumptions and caveats; significant challenges remain unsolved in order to implement good steganography and steganalysis in practice. This position paper sets out some of the important questions which have been left unanswered, as well as highlighting some that have already been addressed successfully, for steganography and steganalysis to be used in the real world.

Robust cryptography provides confidentiality and integrity for information transferred between peers. However, the decrypted plaintext in the memory of a receivers' computer is vulnerable - both to surveillance at the endpoints, and users who choose to forward confidential information. In this paper, we proposed a novel scheme called BLINK, which uses a reconfigurable hardware based decoder which operates on the link between a computer and its display. It moves the decryption outside the computer, preventing plaintext stealing, forwarding, screen capture and printing. Currently we are implementing the BLINK scheme on top of Altera FPGA board with Digital Visual Interface (DVI) ports, the correctness, effectiveness, and the performance will be evaluated through experiment.

In high-tech businesses ranging from Internet service providers to e-commerce websites and music stores like Apple iTun-es, there is considerable potential for collecting personal information about customers, monitoring their usage habits, or even exerting control over their behavior - for example, restricting what can be done with a purchased song. A privacy ceiling is an effective limit to these privacy intrusions, created by the perceived or actual legal liability of possessing too much information or control. As we show in this paper, the risk is not simply that of customer backlash, but liability for a customer's actions, owing to the ability to identify, report, or prevent them from taking those actions. In some cases high-tech businesses have been obligated to divulge their store of personal information or to police their customers at the demand of third parties; this unwanted result derives from the possession of too much information or control for the company's own good. We argue that vicarious infringement liability in particular creates a privacy ceiling, a point beyond which there is no economic incentive to intrude on a user's privacy; and, indeed, there is an incentive to architect one's business so that such intrusions are difficult or impossible.

This paper explains and analyzes the successful attacks submitted by the authors on four audio watermark proposals during a 3-week SDMI public challenge. Our analysis points out some weaknesses in the watermark techniques currently under SDMI consideration and suggests directions for further improvement. The paper also discusses the framework and strategies for analyzing the robustness and security of watermarking systems as well as the difficulty, uniqueness, and unrealistic expectations of the attack setup.

The Secure Digital Music Initiative, or SDMI, held a challenge to test their copy protection technology. In this paper, we describe the HackSDMI challenge and technologies, and several important lessons one can learn regarding the design of copy protection systems.

Digital watermarks have been proposed as a means for copyright protection of multimedia data. We address the capability of invisible watermarking schemes to resolve copyright ownership. We show that, in certain applications, rightful ownership cannot be resolved by current watermarking schemes alone. Specifically, we attack existing techniques by providing counterfeit watermarking schemes that can be performed on a watermarked image to allow multiple claims of rightful ownership. In the absence of standardization and specific requirements imposed on watermarking procedures, anyone can claim ownership of any watermarked image. In order to protect against the counterfeiting techniques that we develop, we examine the properties necessary for resolving ownership via invisible watermarking. We introduce and study invertibility and quasi-invertibility of invisible watermarking techniques. We propose noninvertible watermarking schemes, and subsequently give examples of techniques that we believe to be nonquasi-invertible and hence invulnerable against more sophisticated attacks proposed in the paper. The attacks and results presented in the paper, and the remedies proposed, further imply that we have to carefully reevaluate the current approaches and techniques in invisible watermarking of digital images based on application domains, and rethink the promises, applications and implications of such digital means of copyright protection.

We shall show that non-invertibility is a necessary but not sufficient condition in resolving ownership disputes. We then define quasi-invertible watermarking schemes, and, present analysis that links invertibility and quasi-invertibility to some classes of watermarking techniques with different properties (which may or may not require original versions in watermark decoding), as well as to the different classes of attacks we have developed.