Skip to content

MorSteg CLI v0.2.0 — Cloud-Safe Edition

Latest
Latest

Choose a tag to compare

View all tags
@MoribundMurdoch MoribundMurdoch released this 29 May 08:33
v0.2.0
beee916

MorSteg CLI v0.2.0 — Cloud-Safe Edition

MorSteg is a noob-friendly CLI helper for age-encrypted steganography with steghide.

This release focuses on making the tool easier to use, easier to package, and safer to move through cloud storage without accidentally destroying steghide carrier files.

BTW: Cloud-Safe Edition

This literally just means I have a lazy way to make a bunch of StegHide image files into ZIP files so cloud providers are less likely to compress them and potentially destroy the bytes containing the secret whatnot. The ZIP-file whatnot is no guarantee, though, and there is probably a better, more surefire way to make the files cloud-safe.

What is new

  • Split the CLI flows into cleaner modules.
  • Added a friendlier two-column main menu.
  • Added an age key helper for lazy public/private key workflows.
  • Added automatic public age key file creation.
  • Added post-quantum-capable age recipient workflow.
  • Added cloud-safe .MorSteg.zip packages.
  • Added a separate save location for cloud-safe packages.
  • Added separate save locations for:
    • steghide/output files
    • age key files
    • cloud-safe packages
  • Added optional Bubblewrap sandbox launcher.
  • Cleaned up MorSteg branding.

Security wording

MorSteg is post-quantum-capable when used with a new enough age build and post-quantum age recipient keys.

MorSteg does not implement post-quantum cryptography itself.

The security model is:

age       = encrypts the secret
steghide  = hides the already-encrypted payload
MorSteg   = friendly wrapper and workflow manager

Do not treat steghide itself as post-quantum cryptography. Steghide is the hiding layer. Age is the encryption layer.

Cloud-safe packages

MorSteg can wrap steghide carrier files in .MorSteg.zip packages.

This is for byte preservation, not encryption.

Use cloud-safe packages when uploading steghide carrier files to cloud storage so image/audio recompression does not destroy the hidden payload.

Safe workflow:

1. Hide a secret with MorSteg.
2. Make the steghide output cloud-safe.
3. Upload the .MorSteg.zip package.
4. Download it later.
5. Extract the original carrier file.
6. Open it with MorSteg.
Release verification

Download SHA256SUMS and verify the release files:

sha256sum -c SHA256SUMS

If a signature file is attached, verify it with:

gpg --verify SHA256SUMS.asc SHA256SUMS
Packages

This release may include:

Arch package
DEB package
RPM package
portable Linux tarball
Nix build artifact
Dependencies

MorSteg wraps external tools:

age
steghide

Optional sandboxed mode uses:

bubblewrap
Assets 7
Loading