Secure Steganographic Messaging System
A security-focused application that encrypts and hides messages inside images using AES-GCM and PBKDF2, with built-in attack simulations and forensic recovery features.
Category
Web Security
Language
Python
Start Date
December 10, 2025
Designer
Sbusiso Mdingi
Secure Steganographic Messaging System
This project demonstrates how sensitive information can be protected and covertly transmitted using modern cryptography combined with steganography. I designed and built a full end-to-end secure messaging system that encrypts data and invisibly embeds it inside digital images, simulating how organisations could protect intellectual property and confidential communications from unintended exposure.
The project brings together applied cryptography, secure system design, and forensic resilience. Rather than focusing purely on hiding data, the system was designed to behave like a real-world security product: it includes adversarial testing, threat modelling, and recovery logic to evaluate how well hidden information survives tampering.
FROM PROBLEM TO PROTECTION
The unintended leakage of confidential information often happens through seemingly harmless channels like screenshots, shared documents, or compressed media. Traditional encryption protects data during storage and transmission, but it cannot hide the existence of sensitive content. I wanted to explore how organisations could both encrypt information and make its presence invisible.
This project was designed to simulate a real world secure content protection system: a user can write a secret message, protect it using strong cryptography, and embed it into an ordinary image in a way that is visually undetectable. The system also simulates what happens when that image is attacked, compressed, resized, or altered, allowing direct observation of how resilient hidden information truly is in adversarial conditions.
MODELLING AND SECURITY STRATEGY
My approach follows a layered security design rather than relying on a single protection mechanism. First, the plaintext message is secured using modern authenticated encryption to guarantee confidentiality and integrity. Only after the message is cryptographically protected is it embedded into the image using steganographic techniques.
This separation mirrors real world security engineering practice: encryption ensures that even if the data is discovered, it remains unreadable, while steganography reduces the likelihood of detection in the first place.
To make the system realistic and intellectually rigorous, I added an attack simulation layer. The project can apply real world transformations such as JPEG recompression, noise injection, cropping, and resizing to simulate how attackers or platforms unintentionally damage hidden content. The system then attempts recovery, allowing for empirical testing of robustness and failure modes.
TECHNICAL BREAKDOWN
The system was implemented as a modular security application rather than a simple script. The cryptographic core uses password-based key derivation to generate strong encryption keys, and messages are protected using authenticated encryption before embedding.
The steganography layer modifies pixel level data in a controlled way to minimise visual distortion while maintaining payload capacity. A structured metadata system manages cryptographic parameters securely without exposing sensitive content.
I also designed formal engineering artefacts alongside the codebase, including a threat model, architecture documentation, and security control mappings.