StegPony 1.0.0 RC3

Release candidate 3 for StegPony Android 1.0.0. This is a test build, not a release. StegPony has no network permission and never checks for updates, so new RCs are announced here and on stegpony.app/rc.

In this RC

Everything in RC2, plus two hardware key fixes brought over from PGPony Android:

• Over USB, StegPony reads every block of a reply that the key splits up. A Nitrokey 3 splits any reply longer than one USB packet. RC2 read only the first block, so reading the key failed with a meaningless status. PGPony has had this fix since 4.6.4.
• Over NFC, a key that won't open its OpenPGP app gets a plain message saying so, which asks you to plug it in over USB. A Nitrokey 3 does this, because its OpenPGP app is switched off over NFC. RC2 showed a raw status or "Response too short".

From RC2, the first test build:

• Hide text or a file in a photo, under a passphrase, a contact's key or one of your own keys. A JPEG cover stays a JPEG with the camera's own compression, and a PNG cover stays lossless. Take the cover with the in-app camera or pick one.
• An optional decoy: a second message under a second passphrase.
• A capacity meter that rates how detectable the result would be (low, medium or high), measured against a steganalysis baseline on real phone photos.
• A warning before a cover photo is used a second time, and when a cover looks like a download or a messenger copy.
• Hide in text when a photo can't be sent, as a run of ordinary words or as invisible characters inside a message you write. Invisible characters are the weaker choice, since many apps strip them.
• Reveal with a passphrase, your saved keys, a pasted secret key, or an OpenPGP hardware key over NFC or USB. Share an image or text into StegPony, or open an image with it, to land on Reveal.
• Keys: age-compatible keys, import of age identities and of Curve25519 OpenPGP keys from PGPony or GnuPG, and contacts by paste, file, QR code or share.
• Telegram photo from an iPhone (experimental), on Hide. StegPony first makes a copy of the cover the way Telegram on an iPhone encodes photos, then hides in that copy. Sent from the iPhone's Telegram gallery, copies made this way came through with everything hidden intact in testing here. It is not verified beyond that.
• No network permission, location and other metadata removed by default, app lock, screenshots blocked, clipboard cleared after a minute, and an optional launcher disguise.

Known limits

• A photo sent through WhatsApp, Signal or Telegram on Android loses what's hidden, because those apps recompress it. So does an image attached in Telegram on an iPhone with Attach, then File. Email, USB, RelayPony and cloud storage that keeps files unchanged all deliver the file as is, which works. A mode that survives WhatsApp, Signal and Telegram on Android is planned for 1.0 and is not in this RC.
• Hardware keys need a Curve25519 (cv25519) decryption key. RSA keys can't be used. Hardware-key reveal is tested on a Token2 PIN+. The Nitrokey 3 fixes are the same code PGPony ships, but StegPony hasn't been tried on a Nitrokey 3 yet.
• The format can still change before 1.0. Keep the original of anything you hide with this build, and don't count on a later build opening it.

What to test

• On a Nitrokey 3 with a cv25519 decryption key: plug it in over USB (with an OTG adapter for a USB-A key) and reveal an image hidden to that key. Then hold it to the phone over NFC and check that StegPony asks for USB.
• Hide a message in a JPEG and in a PNG, with a passphrase and with a key, and reveal each one.
• Import a Curve25519 key from PGPony or GnuPG, hide to its public key, and reveal with the secret key.
• Hide with a decoy and check that each passphrase opens its own message.
• Hide in text, send it through a messenger, and reveal what comes back.
• If you have an iPhone with Telegram: hide with "Telegram photo from an iPhone", move the image to the iPhone, save it to Photos, and send it from Telegram's gallery in standard quality (not HD), one per message. Save it on the other end and reveal it.

Source

Built from commit d2b02df with the signed tag v1.0.0-rc3. The tag pins StegPonyCore at commit 05f4f8398a7e0ecde98e4e396317d76d3ee9fce3, the same as RC2. The APK was built in a clean clone of the tag, with the unit tests passing, and signed in that clone. StegPony has no reproducibility gate yet, so this build was made once. The gate comes before 1.0 and the F-Droid listing.

It has versionCode 3 and is signed with StegPony's own release key, the same as RC2, so it installs over RC2, and later RCs and the 1.0 release install over it.

Verify this build

Whole-file SHA-256:

d79eb6db592548d73359b0daaa867e14c4f6d1a1c1a25186743c4a94a5309dec

APK signing certificate SHA-256:

5f1a484df08945fff27451d5a55a070714ad4e8ef61f4c1ab8846fcfaab6be82

The detached signature is made with the NorseHorse release key (A0CBC8F65AACE56F1C5B767753F9798E4919DE62), the same key that signs PGPony releases. It is attached to this pre-release, along with the armored release key (NorseHorse-release-key.asc) and StegPony-1.0.0-rc3-signing-keys.txt with the OpenPGP fingerprint and the APK signing certificate's SHA-256. Check the fingerprint against a source GitHub doesn't control: stegpony.app, pgpony.app, keys.openpgp.org or keys.pgpony.app. The same APK and signature are mirrored at stegpony.app/rc/.

StegPony 1.0.0 RC2

Release candidate 2 for StegPony Android 1.0.0. This is a test build, not a release. It is the first StegPony build offered for download: RC1 was a development milestone and was never built for testers. StegPony has no network permission and never checks for updates, so new RCs are announced here and on stegpony.app/rc.

In this RC

• Hide text or a file in a photo, under a passphrase, a contact's key or one of your own keys. A JPEG cover stays a JPEG with the camera's own compression, and a PNG cover stays lossless. Take the cover with the in-app camera or pick one.
• An optional decoy: a second message under a second passphrase.
• A capacity meter that rates how detectable the result would be (low, medium or high), measured against a steganalysis baseline on real phone photos.
• A warning before a cover photo is used a second time, and when a cover looks like a download or a messenger copy.
• Hide in text when a photo can't be sent, as a run of ordinary words or as invisible characters inside a message you write. Invisible characters are the weaker choice, since many apps strip them.
• Reveal with a passphrase, your saved keys, a pasted secret key, or an OpenPGP hardware key over NFC or USB. Share an image or text into StegPony, or open an image with it, to land on Reveal.
• Keys: age-compatible keys, import of age identities and of Curve25519 OpenPGP keys from PGPony or GnuPG, and contacts by paste, file, QR code or share.
• Telegram photo from an iPhone (experimental), on Hide. StegPony first makes a copy of the cover the way Telegram on an iPhone encodes photos, then hides in that copy. Sent from the iPhone's Telegram gallery, copies made this way came through with everything hidden intact in testing here. It is not verified beyond that.
• No network permission, location and other metadata removed by default, app lock, screenshots blocked, clipboard cleared after a minute, and an optional launcher disguise.

Known limits

• A photo sent through WhatsApp, Signal or Telegram on Android loses what's hidden, because those apps recompress it. So does an image attached in Telegram on an iPhone with Attach, then File. Email, USB, RelayPony and cloud storage that keeps files unchanged all deliver the file as is, which works. A mode that survives WhatsApp, Signal and Telegram on Android is planned for 1.0 and is not in this RC.
• Hardware keys need a Curve25519 (cv25519) decryption key. RSA keys can't be used. So far hardware-key reveal is tested on a Token2 PIN+. A Nitrokey 3 doesn't work with this build: over USB it splits longer replies into several blocks, which this build doesn't read, and over NFC its OpenPGP app is switched off. RC3 reads the split replies over USB and says plainly when a key won't open OpenPGP over NFC.
• The format can still change before 1.0. Keep the original of anything you hide with this build, and don't count on a later build opening it.

What to test

• Hide a message in a JPEG and in a PNG, with a passphrase and with a key, and reveal each one.
• Import a Curve25519 key from PGPony or GnuPG, hide to its public key, and reveal with the secret key.
• With that key on an OpenPGP card other than a Nitrokey 3, reveal with the card over NFC and over USB.
• Hide with a decoy and check that each passphrase opens its own message.
• Hide in text, send it through a messenger, and reveal what comes back.
• If you have an iPhone with Telegram: hide with "Telegram photo from an iPhone", move the image to the iPhone, save it to Photos, and send it from Telegram's gallery in standard quality (not HD), one per message. Save it on the other end and reveal it.

Source

Built from commit def9b2f with the signed tag v1.0.0-rc2. The tag pins StegPonyCore at commit 05f4f8398a7e0ecde98e4e396317d76d3ee9fce3. The APK was built in a clean clone of the tag, with the unit tests passing, and signed in that clone. StegPony has no reproducibility gate yet, so this build was made once. The gate comes before 1.0 and the F-Droid listing.

It has versionCode 2 and is signed with StegPony's own release key, so later RCs and the 1.0 release install over it.

Verify this build

Whole-file SHA-256:

10458f3075e1a3b9aabe9e74209b524cdcc42645197e5d9276ac4bc1ba1e6a57

APK signing certificate SHA-256:

5f1a484df08945fff27451d5a55a070714ad4e8ef61f4c1ab8846fcfaab6be82

The detached signature is made with the NorseHorse release key (A0CBC8F65AACE56F1C5B767753F9798E4919DE62), the same key that signs PGPony releases. It is attached to this pre-release, along with the armored release key (NorseHorse-release-key.asc) and StegPony-1.0.0-rc2-signing-keys.txt with the OpenPGP fingerprint and the APK signing certificate's SHA-256. Check the fingerprint against a source GitHub doesn't control: stegpony.app, pgpony.app, keys.openpgp.org or keys.pgpony.app. The same APK and signature are mirrored at stegpony.app/rc/.