https://github.com/docxology/steganographer

cryptography media-verification open-source python security steganography watermarking
Last synced: about 13 hours ago
JSON representation
Host: GitHub
URL: https://github.com/docxology/steganographer
Owner: docxology
Created: 2026-03-06T17:51:21.000Z (4 months ago)
Default Branch: main
Last Pushed: 2026-03-08T21:05:50.000Z (4 months ago)
Last Synced: 2026-06-11T02:27:50.647Z (19 days ago)
Topics: cryptography, media-verification, open-source, python, security, steganography, watermarking
Language: Rust
Homepage:
Size: 3.97 MB
Stars: 1
Watchers: 0
Forks: 0
Open Issues: 0
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: docs/contributing.md
- Security: docs/security.md
- Roadmap: docs/roadmap.md
- Agents: AGENTS.md
Awesome Lists containing this project

README

          


  



🔒 Steganographer




  Real-time cryptographic watermarking for video & audio — built entirely in Rust





  Getting Started •

  Architecture •

  Cryptography •

  CLI Reference •

  FAQ





  

  

  

  



---

Steganographer embeds **cryptographic signatures** (BLAKE3 + Ed25519) and **visible watermarks** into live media streams using LSB steganography, QR overlays, and GStreamer pipelines. Every video frame and audio chunk is hashed, signed, and verified in real time.

📹 Dashboard Demo — click to expand







The three-tab dashboard: Video encoding/verification, Audio steganography, and in-app Documentation viewer.

---

## ⚡ Quick Start

```bash

git clone https://github.com/docxology/steganographer.git

cd steganographer

cargo build --workspace

cargo test --workspace   # 132 tests, 0 failures

./run.sh                 # Interactive terminal menu

```

> 📖 Full setup guide: [**Getting Started**](docs/getting-started.md) — includes prerequisites, build instructions, and first-run tutorial.

---

## 🏗️ How It Works

```text

  Raw Frame/Audio → BLAKE3 Hash → Ed25519 Sign → LSB Embed → QR Overlay

       ↓                                              ↓

  Tamper-evident media                          Visible provenance

```

Every frame goes through a **four-stage pipeline**:

1. **Hash** — [BLAKE3](docs/cryptography.md#blake3-hashing) computes a 256-bit digest over `frame_index ∥ video_bytes ∥ audio_bytes`

2. **Sign** — [Ed25519 or Ethereum/secp256k1](docs/cryptography.md#ed25519-signing) signs the hash for tamper detection

3. **Embed** — [LSB steganography](docs/algorithms.md#lsb-video-protocol) hides the 104-byte payload in pixel/sample least-significant bits

4. **Overlay** — [QR code + text watermark](docs/algorithms.md#qr--info-bar-overlay) burns visible provenance into the frame

> 🔐 Deep dive: [**Cryptography**](docs/cryptography.md) · [**Algorithms**](docs/algorithms.md) · [**Steganography Theory**](docs/steganography-theory.md) · [**Threat Model**](docs/threat-model.md)

---

## 🖥️ Live Dashboard

A three-tab web GUI for real-time round-trip verification:

| Tab | What it does |

| ----- | ------------- |

| **Video** | Webcam → LSB encode → decode → verify (live). Controls for opacity, LSB bits, sign rate, QR scale, resolution |

| **Audio** | Microphone → PCM capture → LSB embed → extract → verify. Waveform + spectrum visualization, WAV recording |

| **Docs** | Browse all 17 project docs in-dashboard with search and navigation |

🔽 Dashboard screenshots




  

    

    

  

  

    Video: encode + verify + config

    Audio: waveform + LSB verification

  

  

    

    

  

  

    Docs: in-dashboard documentation

    QR overlay with timestamp

  

```bash

# Launch the dashboard

./run.sh    # select 'd' for dashboard, or 'a' for all

# Or directly:

cargo run -p steganographer-cli -- dashboard --port 8080 --backend ed25519

```

> 📖 Full API reference: [**API Reference**](docs/api-reference.md) — all HTTP/WebSocket endpoints, JSON schemas, and configuration payloads.

---

## 🧩 Architecture

Four Rust crates with strict dependency layering:

```text

┌──────────────────────────────────────────────┐

│  steganographer-cli       (binary)           │  Clap CLI: 6 subcommands

├──────────────────────────────────────────────┤

│  steganographer-dashboard (web server)       │  Axum + WebSocket, 3 tabs

│  steganographer-gst       (GStreamer plugin)  │  AppSink/AppSrc pipeline

├──────────────────────────────────────────────┤

│  steganographer-core      (algorithms)       │  Pure Rust, 0 system deps

└──────────────────────────────────────────────┘

```

| Crate | Purpose | Tests | Docs |

| ------- | --------- | ------- | ------ |

| **[steganographer-core](steganographer-core/)** | Crypto, LSB, overlay, config | 114 | [Architecture](docs/architecture.md) |

| **[steganographer-dashboard](steganographer-dashboard/)** | Live web GUI | 12 | [API Reference](docs/api-reference.md) |

| **[steganographer-gst](steganographer-gst/)** | GStreamer integration | 1 | [GStreamer Guide](docs/gstreamer.md) |

| **[steganographer-cli](steganographer-cli/)** | CLI binary | 1 | [CLI Reference](docs/cli-reference.md) |

> 📖 Full breakdown: [**Architecture**](docs/architecture.md) — crate hierarchy, module map, data flow diagrams.

---

## 🔑 Crypto Design

| Component | Algorithm | Details |

| ----------- | ----------- | --------- |

| **Hashing** | BLAKE3 | Parallel 256-bit hash of `frame_index ∥ video_bytes ∥ audio_bytes` |

| **Signing** | Ed25519 | 64-byte EUF-CMA secure signature over the BLAKE3 hash |

| **Payload** | 104 bytes | `frame_index (8) + hash (32) + signature (64)` |

| **Video embed** | Length-prefixed LSB | 1–4 bit replacement with 32-bit length header |

| **Audio embed** | Keyed ChaCha8 PRNG | Pseudo-random sample permutation for scatter embedding |

| **Alt signing** | Ethereum secp256k1 | EIP-191 personal_sign, MetaMask-compatible |

> 📖 Deep dives: [**Cryptography**](docs/cryptography.md) · [**Security Model**](docs/security.md) · [**Threat Model**](docs/threat-model.md)

---

## 🛠️ CLI Usage

```bash

# Generate a key pair

steganographer keygen --output mykey

# Offline encode

steganographer encode --input frame.rgb --output signed.rgb --stego-type lsb_video --bits 1

# Verify

steganographer verify --input signed.rgb --public-key  --stego-type lsb_video --format json

# Live video (GStreamer)

steganographer video --config steganographer.toml

# Live audio

steganographer audio --config steganographer.toml

# Dashboard

steganographer dashboard --port 8080 --backend ed25519

```

> 📖 All commands and options: [**CLI Reference**](docs/cli-reference.md)

---

## ⚙️ Configuration

Two config files, fully documented:

- [`steganographer.toml`](steganographer.toml) — Master configuration (video/audio sources, signing keys, stego modules)

- [`config/example.toml`](config/example.toml) — Minimal annotated example

```toml

[video]

source = "avfvideosrc"

width = 1280

height = 720

[signing]

backend = "ed25519"

[[stego.modules]]

type = "lsb_video"

bits = 2

```

> 📖 Full TOML schema: [**Configuration**](docs/configuration.md) — all fields, template placeholders, module chains.

---

## ✅ Tests

132 tests across 4 crates — all passing:

| Category | Count | Location |

| ---------- | ------- | ---------- |

| Core unit tests | 56 | `steganographer-core/src/*.rs` |

| Core integration tests | 58 | `steganographer-core/tests/integration_tests.rs` |

| Dashboard tests | 12 | `steganographer-dashboard/tests/dashboard_tests.rs` |

| GStreamer + Ethereum | 1 + 5 | Plugin skeleton + feature-gated |

| **Total** | **132** | **0 failures** |

```bash

cargo test --workspace                # All 132 tests

cargo test -p steganographer-core     # Core only (114 tests)

cargo test -p steganographer-dashboard # Dashboard only (12 tests)

```

---

## 🌍 Platform Support

| Platform | Video Source | Audio Source | Docs |

| ---------- | ------------- | ------------- | ------ |

| **macOS** | `avfvideosrc` | `osxaudiosrc` | [Platforms](docs/platforms.md) |

| **Linux** | `v4l2src` | `pulsesrc` / `pipewiresrc` | [Platforms](docs/platforms.md) |

| **Docker** | Headless | Headless | [Platforms](docs/platforms.md) |

> ⚠️ GStreamer is optional. The core crate and offline encode/verify commands work without it.

---

## 📚 Documentation

17 comprehensive guides in [`docs/`](docs/):

| Guide | Description |

| ------- | ------------- |

| [**Getting Started**](docs/getting-started.md) | Prerequisites, build, first-run tutorial |

| [**Architecture**](docs/architecture.md) | Crate hierarchy, module map, data flow |

| [**Cryptography**](docs/cryptography.md) | BLAKE3, Ed25519, Ethereum signing |

| [**Algorithms**](docs/algorithms.md) | LSB protocols, capacity math, QR overlay |

| [**Steganography Theory**](docs/steganography-theory.md) | Information-theoretic security foundations |

| [**Security**](docs/security.md) | Cachin's ε-security, deployment guidance |

| [**Threat Model**](docs/threat-model.md) | Adversary model, attack catalog, mitigations |

| [**CLI Reference**](docs/cli-reference.md) | All 6 commands with examples |

| [**API Reference**](docs/api-reference.md) | HTTP + WebSocket endpoints, JSON schemas |

| [**Configuration**](docs/configuration.md) | Full TOML schema, template variables |

| [**GStreamer**](docs/gstreamer.md) | Pipeline integration, AppSink/AppSrc |

| [**Platforms**](docs/platforms.md) | macOS, Linux, Docker setup |

| [**Contributing**](docs/contributing.md) | Dev workflow, testing, PR checklist |

| [**Roadmap**](docs/roadmap.md) | DCT-domain, ML-DSA, post-quantum plans |

| [**FAQ**](docs/faq.md) | 30+ questions and answers |

---

## 📄 License

MIT — see [LICENSE](LICENSE) for details.
ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/docxology/steganographer

Awesome Lists containing this project

README

🔒 Steganographer
