Secure Steganographic Messaging System

Encryption protects message content but not the fact that a message exists. The interesting question is not whether you can hide bytes in an image (plain LSB embedding does that trivially) but whether a steganalyst can tell. A security toolkit should measure that detectability honestly rather than imply undetectability.

Messages are encrypted with AES-256-GCM using scrypt-derived keys, framed with a length header and embedded in the least significant bits of a lossless PNG carrier. The toolkit then turns the classical steganalysis literature on its own output: the Westfeld–Pfitzmann chi-square attack and Fridrich–Goljan–Du RS analysis estimate the embedding rate, run across a reproducible benchmark that sweeps payload size over a fixed public-domain corpus and multiple seeds with 95% confidence intervals.

• AES-256-GCM authenticated encryption with scrypt key derivation
• Length-prefixed LSB embedding across RGB channels, saved as lossless PNG
• RS analysis (Fridrich, Goljan & Du, 2001) estimating the LSB embedding rate, with a reliability flag at its singular point near a saturated LSB plane
• Chi-square attack (Westfeld & Pfitzmann, 2000) as a coarser block-wise screen
• Distortion and recovery metrics: SSIM, PSNR, bit error rate and round-trip success
• Reproducible payload-size sweep across a scikit-image corpus and several seeds, exported as JSON and CSV with environment metadata
• Deterministic transformation tests: JPEG compression, Gaussian noise, cropping and resizing

• At a 10% payload the stego image sits 61 dB / SSIM 0.9996 from its cover (visually invisible) yet RS analysis recovers an embedding rate of 0.12 against 0.03 for a clean control.
• RS analysis tracks the true embedding rate across the sweep (0.08 at 5%, 0.12 at 10%, 0.25 at 25%, 0.45 at 50%, 0.83 at 90%), with the chi-square attack confirming the trend but carrying a higher, image-dependent baseline on natural images.
• Exact payload recovery holds only on lossless PNG; the deterministic JPEG, noise, crop and resize tests show plain LSB embedding does not survive those transforms, and that failure is reported rather than suppressed.

• Research and educational software. The honest conclusion is the point: encryption protects the content, but sequential LSB embedding does not hide the presence of a payload. Not a production secure-messaging service and not a guarantee of covert or undetectable communication.