ISSN 2148-838Xhttp://dx.doi.org/10.13069/jacodesmath.284966 J. Algebra Comb. Discrete Appl. 4(2) • 197–206 Received: 12 June 2015 Accepted: 29 February 2016 Journal of Algebra Combinatorics Discrete Structures and Applications Correspondence between steganographic protocols and error correcting codes Research Article M’hammed Boulagouaz, Mohamed Bouye Abstract: In this work we present a correspondence between the steganographic systems and error correcting codes. We propose a new steganographic protocol based on 3-error-correcting primitive BCH codes. We show that this new protocol has much better parameters than protocols which we get from Hamming codes or from the 2-error-correcting primitive BCH codes, for high levels of incorporation. 2010 MSC: 94A60, 94B29, 94B40 Keywords: Steganographic protocol, Hamming distance, Linear correcting code, Covering radius, Parity matrix, BCH code 1. Introduction The etymology of steganography is composed of two Greek words: "Stego" which means secret and "graphia" writing. Steganography is then the art of secret writing. More generally, we call steganography, the art of hide information in a carrier, so that is hidden information from to furtive eyes of anyone other than the sender and the recipient. The field of information security grows and grows increasingly in recent spent decades. The de- velopment of systems for the protection of information has taken great interest as a subject of scientific research. Cryptographic protocols is the best acknowledged of such systems. However, new ideas emerged with force in recent years. Steganography is an old area that thanks to recent progress begins to play an important role as an alternative and more generally as a complement of cryptography. The advantage of steganography over cryptography is that steganography protects information like cryptography and it protects also communicating sources. Error-correcting codes are important tools for the design of algorithms for steganography. They are used to hide information in an image and also to extract hidden information from the modified image. M’hammed Boulagouaz (Corresponding Author), Mohamed Bouye; King Khalid University, Faculty of Sciences, B.P. 9004, Abha, Saudi Arabia (email: boulag@rocketmail.com, medeni.doc@gmail.com). 197 M. Boulagouaz, M. Bouye / J. Algebra Comb. Discrete Appl. 4(2) (2017) 197–206 This technique is a method of decoding by syndrome, using the theory of error correcting codes, especially linear codes (see [2, 3]). Steganography has taken the concepts associated to error correcting codes and to decoding by syndrome but the use has been reversed. This work is organized as follows. Sections 2 and 3 present the correspondence between the error- correcting codes and steganographic protocols. In section 4, we recall some properties of linear stegano- graphic protocols. We build our approach in section 5. 2. Steganographic protocol Definition 2.1. Let n,k and ρ are three positive integers such that k ≤ n. A steganographic protocol S over an alphabet A to hide messages of length k (secret words) in words of length n (cover words) by modifying at most ρ coordinates(covering radius) is a pair of maps S = (e,r) satisfying: • e : An ×Ak → An, • r : An → Ak, • ∀(x,s) ∈ An ×Ak : r(e(x,s)) = s, • ∀(x,s) ∈ An ×Ak : dH(x,e(x,s)) ≤ ρ, n,k and ρ are the parameters of the steganographic protocol S. Maps e and r are respectively called embedding and extraction maps of the steganographic protocol S. Such a protocol is called a (n,k,ρ)-steganographic protocol S. Example 2.2. Let s and x be the secret word to hide and the cover word respectively. We may suppose that those two words are a sequences of symbols of a finite alphabet A. Let be s = (s1,s2, · · · ,sk) and x = (x1,x2, · · · ,xn), so s ∈ Ak and x ∈ An. Let consider the two following maps : e : An ×Ak → An and r : An → Ak defined by e((x1,x2, · · · ,xn), (s1,s2, · · · ,sk)) = (x1,x2,x3, · · · ,xn−k,s1,s2, · · · ,sk) and r(x1,x2,x3, · · · ,xn) = (xn−k,x(n−k)+1, · · · ,xn). Then (e,r) is a (n,k,k)-steganographic protocol over A. Definition 2.3. We call radius of a protocol (e,r) the number ρ := max{d(x,e(x,s)),s ∈ Ak,x ∈ An}. Remark 2.4. A good protocol (n,k,ρ)-steganographic (e,r) must satisfies two main requirements: 1. The two maps e and r are effective, 2. (n,k,ρ) are good parameters such that: 198 M. Boulagouaz, M. Bouye / J. Algebra Comb. Discrete Appl. 4(2) (2017) 197–206 • k n is the greatest possible, • ρ n is the smallest possible. Definition 2.5. A good protocol steganographic (e,r) of length n is said to be proper if : the embedding map e is such that: e(x,s) is the nearest element to x belonging to r−1(s) = {y ∈ An/r(y) = s} (with respect to the hamming distance over An, where A denote the alphabet of the protocol). Proposition 2.6. If a steganographic protocol (e,r) is proper then the covering radius ρ is given by: ρ = max{d(x,r−1(s))/s ∈ Ak and x ∈ An}. Proof. Since the protocol is proper then : ∀x ∈ An and ∀s ∈ Ak if e(x,s) = v then dH(x,v) = min{d(x,y)/y ∈ r−1(s)} = d(x,r−1(s)). Since that ρ := max{d(x,e(x,s))/s ∈ Ak,x ∈ An} we have ρ = max{d(x,r−1(s)),s ∈ Ak and x ∈ An}. 2.1. The steganographic protocol F5 The protocol F5 over the Galois field F2 permits to hide messages of length k (secret words) in words (cover words) of length n = 2k − 1 by changing more than one of them (i.e. protocol of type (2k − 1,k, 1) ). Let < m >2 be the binary expression of m with k bits ( so we can consider that < m >2 is in Fk2 ). Conversely, for z ∈ Fk2 let < z >10 be the integer which has z as binary expression, then 1 ≤ < z >10 ≤ 2k − 1. Finally, let ei be the ith vector of the canonical basis of F2 k−1 2 ; e0 = 0. Let consider i) The map γ : F2 k−1 2 ×F k 2 → N (x,s) → γ(x,s) =< s + ∑2k−1 i=1 xi < i >2>10. ii) Maps e and r defined by : e : F2 k−1 2 ×F k 2 → F 2k−1 2 , (x,s) → e(x,s) = x + eγ(x,s). r : F2 k−1 2 → F k 2, x → r(x) = ∑2k−1 i=1 xi < i >2. Let show that (e,r) is a steganographic protocol, or let show that r(e(x,s)) = s, for any s ∈ Fk2 and for any x ∈ F2 k−1 2 . Indeed, 1. r(e(x,s)) = r(x + eγ(x,s)), we put j = γ(x,s) =< s + ∑2k−1 i=1 xi < i >2>10 then < j >2= s + 2k−1∑ i=1 xi < i >2: (∗) 2. r(x+ej) = r(x1,x2, · · · ,xj+1, · · · ,xn) = ∑2k−1 i=1,i6=j xi < i >2 +xj+1 < j >2, changing < j >2 by its expression given in (∗) we obtain : r(x+ej) = s so r(e(x,s)) = s. Therefore F5 is a steganographic protocol. Remark 2.7. • Insert a message s by F5 in a covering x consists to change the coordinate number γ(x,s). • Extraction consists to add all products of each component to the value of the binary expression of the index. i.e : r(x) = ∑2k−1 i=1 xi < i >2 199 M. Boulagouaz, M. Bouye / J. Algebra Comb. Discrete Appl. 4(2) (2017) 197–206 2.2. Example of application for F5 For n = 7, k = 3, how to insert s = 011 in x = 1100101. i.e. How to calculate e(011, 1100101). γ(1100101, 011) =< 011 + ∑7 i=1 xi < i >2>10 =< 011 + (1.(001) + 1.(010) + 1.(101) + 1.(111)) >10=< 010 >10= 2. Since s = 011 and x = 1100101 then to insert s in x consists in changing the position number 2 of x from 1 to 0, i.e. e(x,s) = e(1100101, 011) = 1000101 = v. How to extract the message hidden s in the message v = 1000101? I.e. How to calculate r(1000101). By applying the second point of the previous remark we get that r(v) = r(1000101) = (1.(001) + 1.(101) + 111) = 011 = s. 3. Codes defined by a steganographic protocol Recall that a correcting code of length n on alphabet A is a subset of An, and the covering radius ρ of a correcting code satisfies ∀x = (x1, ...,xn) ∈ An : dH(x,C) = minc∈CdH(x,c) = minc=(c1,...,cn)∈C|{i : xi 6= ci}|≤ ρ. We denote (n, | C |)ρ the parameters of a such code. When C is linear over Fq of cardinality | C |= qk with k is the dimension of the code, we use the notation [n,k]ρ to say that the parameters of the linear code C are (n,qk)ρ. Let Υ = (e,r) be a steganographic protocol. The protocol Υ define a collection FΥ of correcting codes defined by: FΥ = {Cs := r−1(s),s ∈ Ak} To decode a word x ∈ An according to the code Cs = r−1(s) of the collection FΥ, we proceed in this way: If ρ is the radius of Υ then there exists a word x′ satisfying: d(x,x′) ≤ ρ and r(x′) = s. Then r(e(x,s)) = s which means that e(x,s) is a word decoding x relative to the code Cs. 3.1. Construction of steganographic protocols To build a steganographic protocol of parameters (n,k,ρ) on an alphabet A, one way is to start by building a surjective map r : An → Ak, which map r define a family Fr := {Cs = r−1(s) | s ∈ Ak} of codes on A of length n. Then the embedding map e such that (e,r) is a steganographic protocol of parameters (n,k,ρ) is defined by: For s ∈ Ak denote e(s,−) the decoding map, defined by the nearest word, associated to the code Cs = r −1(s). Then e(x,s) = x′ ∈ Cs, with dH(x,x′) = dH(x,Cs) := min{dH(x,y),y ∈ Cs}. Example 3.1. To build a steganographic protocol of parameters (3, 2, 2) on F2, start with given a sur- jective function r : F32 → F22. If r : F32 → F22 is such that: r−1(00) = {000, 100} r−1(01) = {010, 001} r−1(10) = {110, 100} r−1(11) = {101, 111}, 200 M. Boulagouaz, M. Bouye / J. Algebra Comb. Discrete Appl. 4(2) (2017) 197–206 then C00 = {000, 100}; C01 = {010, 001} ; C10 = {110, 100} ; C11 = {101, 111}. So, C00 = r−1(00) ; C01 = r−1(01) ; C10 = r−1(10) ; C11 = r−1(11). Therefore e(000,−) : F32 → F32 satisfies e(000, 00) = 000, since d(000,x′) = d(000,C00) = 0. More generally: e : F32 ×F22 → F32 (x,s) → e(x,s) = d(x,Cs), if s = 10 and x = 101 then we have d(101,C10) = d(101,{110, 100}) = 2 and x′ can be 110 or 011, since d(110, 101) = 2 and (011, 101) = 2. Proposition 3.2. The best steganographic protocol of parameters (n,k,ρ) and of extraction map r on an alphabet A, is one that has as embedding map the map e defined by: (∀x ∈ An)(∀s ∈ Ak)[e(x,s) = x′ with dH(x,x′) = dH(x,r−1(s))]. Lemma 3.3. A map r : An → Ak is an extraction map of a [n,k]-steganographic protocol if and only if r is surjective. Proof. Indeed if r : An → Ak is an extraction function of a [n,k]-steganographic protocol then for all x ∈ An we have r ◦ e(x,.) = IAk so r is surjective. If r : An → Ak is surjective then from the subsection, Construction of steganographic protocols, there exists an embedding map e such that (e,r) is a steganographic protocol of parameters (n,k,ρ). For all t ∈ IR and for all x0 ∈ An put B(x0, t) = {y ∈ /dH(x0,y) ≤ t}. Lemma 3.4. For all (n,k,ρ)-steganographic protocol (e,r) over an alphabet A and for all x0 ∈ An the map r/B(x0,ρ), the restriction of r to the ball B(x0,ρ), is surjective. or, r/B(x0,ρ) : B(x0,ρ) → Ak y → r(y), is a surjective map. Proof. The map r/B(x0,ρ) is well defined. Let consider s ∈ Ak, since e is the embedding map of the (n,k,ρ)-steganographic protocol (e,r), then d(x0,e(s,x0)) ≤ ρ. Let y = e(x0,s) then d(x0,y) ≤ ρ and r(y) = r(e(x0,s)) = s. That proves the existence of y ∈ B(x0,ρ) such that r/B(x0,ρ)(y) = s. It is know that the cardinal of a ball B(x0,ρ) of An is independent from it’s center x0 and it is often denoted by Vq(n,ρ) if q is the cardinal of the alphabet A. Corollary 3.5. For all (n,k,ρ)-steganographic protocol over an alphabet A with q elements we have : qk ≤ Vq(n,ρ) Proof. The map r/B(x0,ρ) is surjective and then we have Card(Fkq ) ≤ Bn(n,ρ) = Vq(n,ρ). Therefore qk ≤ Vq(n,ρ). 201 M. Boulagouaz, M. Bouye / J. Algebra Comb. Discrete Appl. 4(2) (2017) 197–206 4. Linear steganographic protocol Definition 4.1. A steganographic protocol Υ = (e,r) is called linear if the extraction map r is linear. Consequence: C0 := ker(r) = r −1(0Fkq ) is a subspace vector of the Fq-space vector F n q . So it is a linear code of length n and its dimension is n−k. C0 is called the principal code associated to the steganographic protocol Υ. So FΥ = {Cs | s ∈ Fkq} = F n q /C0 := {x + C0 | x ∈ F n q}. Definition 4.2. We call an extraction matrix of a steganographic protocol a control matrix of its principal code. Or, an extraction matrix of a steganographic protocol is a matrix associated to the extraction linear map e of this protocol. Proposition 4.3. For each linear steganographic protocol Υ of parameters (n,k,ρ) correspond a linear [n,n−k]-code C(= C0) which has as a control matrix the control matrix of the extraction map of Υ. Proposition 4.4. For each linear code C of, length n, dimension n−k and a control matrix H, correspond an appropriate linear steganographic protocol which has, the mapping r associated to H as an extraction map and (n,k,ρ) as parameters, where ρ denote the covering radius of this code C. Proof. For each a ∈ Fnq the map (translation): τa : Fnq → Fnq x → τa(x) = x + a is a bijection which conserve the Hamming distance (isometry). Indeed it is clear that τa is bijective and that d(x,y) = d(τa(x),τa(y)) = d(x + a,y + a) since the code is linear d(x,y) = wt(x−y). From where d(τa(x),τa(y)) = wt(τa(x)−τa(y)) = wt(x−y) = d(x,y). More r is onto (because its associated matrix is a control matrix of a linear code) therefore Lemma 3.3 implies that there is a [n,k]-linear steganographic protocol Υ which has an extraction map r such that CΥ : C0 = C. It is also true that for all s ∈ Fkq there is ys ∈ Fnq such that Cs = ys + C therefore r(ys) = s. ρ := max{d(x,C) | x ∈ Fnq} = max{d(x,C0) | x ∈ Fnq} = max{d(x + ys,C0 + ys) | x ∈ Fnq} = max{d(τys (x),Cs) | x ∈ Fnq} = max{d(x′,Cs) | x′ ∈ Fnq} = ρs . So ρ(Υ) = maxs∈Fkq ρs = maxρ = ρ. 5. Construction of linear protocols To construct a (n,k) - linear steganographic protocol Υ, just consider a matrix H of type (k × n) and rank k. This matrix H is the extraction matrix of a protocol Υ and at the same time the extraction matrix of the map of this protocol Υ. It is also true that H is the control matrix of the code CΥ associated to the protocol Υ. 5.1. Decoding a linear code by syndrome Let C be a [n,n − k]- linear code of control matrix H ∈ Mk×n(Fq) for each x ∈ Fnq , we define the syndrome of x by the quantity S(x) = x×Ht. The decoding method by syndrome associated to the code C consists to : if y is a received word and if Iy is the word of smallest weight in y + C, then y is decoded by x = y − Iy. 202 M. Boulagouaz, M. Bouye / J. Algebra Comb. Discrete Appl. 4(2) (2017) 197–206 5.2. Embedding algorithm associated to a linear steganographic protocol Let r be the extraction map of a linear steganographic protocol Υ and let CΥ = r−1(0), be "the principal linear code associated to Υ". To calculate e(x,s),(if x is a covering word and s is a message to hide in x) if e denote the embedding map associated to the protocol Υ, one way is : Needed : a coset decoding algorithm: input a syndrome u, output: a coset leader lu. Input : a cover x of size n and a message s of size k. Output : x′ = e(x,s), a steganographic cover of s with distortion d(x,x′) as small as possible. • Compute u := r(x) −s, • set c := x− lu, • e(x,s) := c. Then e is the embedding map of the system Υ. Indeed : r(e(x,s)) = r(c) = r(x− lu) = r(x) −r(lu) = u + s−u = s Remark 5.1. The linear codes which has a fast and effective decoding algorithm, can be used to construct perform embedding algorithm. So these correcting codes are good tools to construct steganographic protocol. The terminals of the parameters of these codes can be translated into terminal parameters of their protocols steganographic associates. All control matrices associated with a linear code give steganographic protocols of same parameters (n,k,ρ). 5.3. The average symbols modified by a protocol Upon embedding a message by steganographic protocol Υ, the number of bits modified in a cover word is bounded but not determined, by the covering radius ρ. Definition 5.2. Let [Υ = (e,r)] be a (n,k)-protocol on an alphabet A of cardinal q with all secret words s and cover words x have the same probability. We call average symbols modified by Υ the umber α(Υ) given by the formula : α(Υ) = 1 qk+n ∑ s∈Ak ∑ x∈An d(x,e(x,s)) Lemma 5.3. Let Υ = (e,r) be an appropriate (n,k)-steganographic protocol on Fq associate to the linear code C then : α(Υ) = 1 qn ∑ x∈Fnq d(x,C) Proof. Since e(x,s) = y then d(x,y) = inf{d(x,c) | c ∈ Cs}. Let ls be a word of smallest weight in Cs then y = x + ls et e(x,s) = x + ls, so d(x,e(x,s)) = d(x,x + ls), and since d(x,x + ls) = d(x,ls + C) then d(x,e(x,s)) = d(x− ls,C), from where ∑ x∈Fnq d(x,ls + C) = ∑ x∈Fnq d(x− ls,C) = ∑ z∈Fnq d(z,C). Therefore α(Υ) = 1 qn+k ∑ s∈Fkq ∑ z∈Fnq d(z,C) = qk qn+k ∑ z∈Fnq d(z,C) = 1 qn ∑ z∈Fnq d(z,C) 203 M. Boulagouaz, M. Bouye / J. Algebra Comb. Discrete Appl. 4(2) (2017) 197–206 Lemma 5.4. Let Υ = (e,r) be a (n,k)-steganographic protocol on Fq associated to a Linear code C. For i = 0, 1, · · · ,n denote αi the number of representatives of the i weight classes compared to the code C then α(Υ) = 1 qk ∑n i=1 i.αi Proof. We have d(x,e(x,s)) = d(x,x + ls) = w(ls) so,∑ s∈Fkq ∑ x∈Fnq d(x,e(x,s)) = ∑ s∈Fkq ∑ x∈Fnq w(ls) = q n ∑ s∈Fkq w(ls), or, 1 qn+k ∑ s∈Fkq ∑ z∈Fnq d(x,e(x,s)) = 1 qk ∑ s∈Fkq w(ls) = 1 qk (w(ls1 ),w(ls2 ), · · · ,w(lsqk )) 6. Comparative tables In this section we present a new family of linear steganographic systems from the family of binary codes, 3-error-correcting primitive BCH codes and we give a comparative study in tables, between the new family, the family of systems presented by C. Manuera in [7] and one studied by A. Westfeld in [8]. A. Westfeldt in [8], studied the family of linear steganographic systems F5, associated to the family of Hamming binary linear error correcting codes. To a code C of this family of codes, the dimension is 2m − m − 1 and a such code is of parameters [2m − 1, 2m − m − 1, 1]. The parameters of a linear steganographic system of this family are of the form (2m − 1, 2m, 3). From where the following table: Table 1. The parameters of F5 [8], ρ = 1, t = 1. code m n k ′ = n − k ρ k ′ n ρ n (n,k ′ ,ρ) Hamming 4 15 4 1 0.266 0.066 (15,4,1) Hamming 5 31 5 1 0.161 0.032 (31,5,1) Hamming 6 63 6 1 0.095 0.015 (63,6,1) Hamming 7 127 7 1 0.055 0.007 (127,7,1) Hamming 8 255 8 1 0.031 0.003 (255,8,1) C. Munuera in [7], presents the family of binary linear error correcting primitive BCH codes, con- sisting of the quasi perfect codes which are 2-correcting and of length n = 2m − 1. Because these codes are quasi-perfect then their radius of coverage is 3. For a code C of this family of codes, its dimension is 2m − 2m− 1 and a such code is of parameters [2m − 1, 2m − 2m− 1, 5]. Thus each code C of this family of codes, is associated with a linear steganographic protocol of parameters (2m − 1, 2m, 3). From where the following table: Table 2. BCH codes [7], ρ = 3, t = 2. code m n k ′ = n − k ρ k ′ n ρ n (n,kk ′ ,ρ) BCH 4 15 8 3 0.533 0.2 (15,8,3) BCH 5 31 10 3 0.322 0.096 (31,10,3) BCH 6 63 12 3 0.190 0.047 (63,12,3) BCH 7 127 14 3 0.11 0.023 (127,14,3) BCH 8 255 16 3 0.062 0.011 (255,16,3) The family of binary linear error correcting codes we offer to study is that of the 3- error-correcting primitive BCH codes. Each code of this family is of length n = 2m − 1 for a non-zero integer m, the covering radius of a such code is 5 ( [1], [4] and [5]). Also for a such code C the number of the elements of Fn2 /C is equal to: 204 M. Boulagouaz, M. Bouye / J. Algebra Comb. Discrete Appl. 4(2) (2017) 197–206 - 23m, if m ≥ 5 and then C has [2m − 1, 2m − 1 − 3m, 3] as parameters. - 2 5m 2 if m = 4 and then has [15, 5, 3] as parameters, ( Mac Williams and Sloane [[6], p.262]. Thus for each code C of this family is associated to a linear steganographic protocol of parameters: - (2m − 1, 3m, 5), if m ≥ 5. - (15, 10, 3), if m = 4. From where the following table: Table 3. BCH primitive codes, ρ = 5, t = 3. code m n k ′ = n − k ρ k ′ n ρ n (n,k ′ ,ρ) BCH 4 15 10 5 0.6666 0.333 (15,10,5) BCH 5 31 16 5 0.516 0.161 (31,16,5) BCH 6 63 45 5 0.714 0.079 (63,45,5) BCH 7 127 106 5 0.834 0.039 (127,106,5) BCH 8 255 231 5 0.905 0.119 (255,231,5) 7. Conclusion In this work, we presented a correspondence between the steganographic systems and error-correcting codes, and we have explained that this correspondence is one to one between linear steganographic systems and linear error correcting codes. We gave some relationships between the parameters and concepts associated to linear steganographic systems, and those of the linear error correcting codes to which they correspond (control matrix covering radius, ...). As the error correcting codes are quite well known, we showed that this correspondence can be used to build good steganographic protocols and to study their properties. We also presented a new steganography based on primitive 3-error correcting BCH codes. Our new protocol, shows that we are able to improve some previous results and suggest new sets of parameters for binary linear steganographic systems. In particulary for steganographic systems of high incorporation rate. References [1] E. Assmus, H. Mattson, Some 3–error–correcting BCH codes have covering radius 5, IEEE Trans. Inform. Theory 22(3) (1976) 348–349. [2] R. Crandall, Some notes on steganography, available at http://dde.binghamton.edu/download/ Cran- dall_matrix.pdf, 1998. [3] J. Fridrich, D. Soukal, Matrix embedding for large payloads, IEEE Trans. Inf. Forensics Security 1(3) (2006) 390–395. [4] T. Helleseth, All binary 3–error–correcting BCH codes of length 2m−1 have covering radius 5, IEEE Trans. Inform. Theory 24(2) (1978) 257–258. [5] J. van der Horst, T. Berger, Complete decoding of triple–error–correcting binary BCH Codes, IEEE Trans. Inform. Theory 22(2) (1976) 138–147. [6] F. J. Mac Williams, N. Sloane, The Theory of Error Correcting Codes, Amsterdam, Netherlands, North–Holland, 1966. 205 http://dx.doi.org/10.1109/TIT.1976.1055556 http://dx.doi.org/10.1109/TIT.1976.1055556 http://dde.binghamton.edu/download/Crandall_matrix.pdf http://dde.binghamton.edu/download/Crandall_matrix.pdf http://dx.doi.org/10.1109/TIFS.2006.879281 http://dx.doi.org/10.1109/TIFS.2006.879281 http://dx.doi.org/10.1109/TIT.1978.1055847 http://dx.doi.org/10.1109/TIT.1978.1055847 http://dx.doi.org/10.1109/TIT.1976.1055530 http://dx.doi.org/10.1109/TIT.1976.1055530 M. Boulagouaz, M. Bouye / J. Algebra Comb. Discrete Appl. 4(2) (2017) 197–206 [7] C. Munuera, Steganography and error–correcting codes, Signal Process. 87(6) (2007) 1528–1533. [8] A. Westfeld, F5—A Steganographic Algorithm, Lecture Notes in Comput. Sci. 2137 (2001) 289–302. 206 http://dx.doi.org/10.1016/j.sigpro.2006.12.008 http://dx.doi.org/10.1007/3-540-45496-9_21 Introduction Steganographic protocol Codes defined by a steganographic protocol Linear steganographic protocol Construction of linear protocols Comparative tables Conclusion References