Other Directory Sites: SeekWonder | Directory Owners Forum
The following archive was created by hippie-mail 7.98617-22 on Fri Aug 21 1998 - 17:16:50 ADT
Bill Stewart (bill.stewart@pobox.com)
Sat, 04 Apr 1998 02:36:59 -0800
At 07:49 AM 4/3/98 +0100, Marty Levy wrote:
>I want to distribute .pdf files to various people and have them be
>"watermarked" (traceable to the person I sent them to in a non-
>repudiable fashion). I believe Acrobat uses 40 bit RC4 encryption to
>"protect" the files (which don't contain .gif or .jpg images
>suitable for steganography). My main concern is that I don't
>want the files to be distributed beyond the recipient (such as
>posted on the internet), and I want to be able to trace them
>back to the source if they are.
>Q. Is Acrobat's instantiation of 40b RC4 reasonably difficult to break?
>Q. If not, is there any watermarking method likely to allow me to
>keep traceability?
40-bit RC4 is not hard to break; it does take some time
and computational effort, so if you're dealing with
files that aren't very valuable, it may not be worth the trouble,
but if you're really concerned about security, it's not secure.
Traceability and non-repudiation are different problems.
Suppose you use some steganogaphic method to hide unique data
in the document, such as twiddling words in different copies.
If a version leaks to the net, you can know which copy it was,
but that doesn't make it non-repudiable - you don't have a
way to prove that _you_ didn't leak it yourself and
blame the recipient, or even to prove that the recipient
received the copy. If you get the recipient to sign
the copy (or a hash of it), they can't repudiate receiving it,
but you still can't prove that you didn't leak it.
Non-repudiation is hard enough that you might ask
the folks on the cryptography@c2.net list about research.
As far as techniques for hiding data in PDF files,
the fact that it's PostScript offers some possibilities -
PostScript is a language for making black marks on paper,
and you can shuffle around the order in which you make them,
or play with the spacing between them (e.g. word spacing),
or tweak bounding boxes by a few pixels, as well as
shuffling words around. If your customer knows which
techniques you're using, sometimes he can shuffle some
of them around himself, so you need to put enough in
that it's hard to obscure all the watermarks.
Thanks!
Bill
Bill Stewart, bill.stewart@pobox.com
PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639
The following archive was created by hippie-mail 7.98617-22 on Fri Aug 21 1998 - 17:16:50 ADT