rsteg

A minimal-dependency steganography toolkit in Rust — library, CLI, and (soon) full format parity with steghide and stegano-rs. Jump to the live stego demo, benchmarks, feature tracker, or read the algorithm explainers.

What is steganography?

Cryptography hides what a message says. Steganography hides that there is a message at all. rsteg takes a carrier file (image or audio) and tweaks its least-significant bits so they spell out a hidden payload. A copy of the carrier that doesn't use rsteg is indistinguishable from a copy that does — unless you know the scheme.

How LSB embedding works

For each byte of the cover, we overwrite the density low bits with one bit of payload. At density 1, the top 7 bits of a pixel are untouched — a pixel value of 0xA3 = 10100011 becomes 0xA2 = 10100010 to carry a 0 bit. That's a 1/256 change, invisible to the eye. At density 4 you get four times the capacity and the change is ±7 (still perceptually tiny but statistically detectable).

See it in action — Munch hidden in Munch

The left is an ordinary PNG of Munch's Starry Night. The right is the same painting with 328 KB of arbitrary binary data — the full JPG of Munch's The Scream — woven into its least significant bits at density 1, sealed with XChaCha20-Poly1305. To the eye and to diff-style byte comparison of visible pixels, they are indistinguishable. Only the bottom bit of every colour channel has been rewritten.

Reveal the payload that was extracted

Running rsteg extract --in munch_starry_stego.png --password - --out scream.jpg returns a JPG byte-for-byte identical to the one that was embedded (SHA-1 10570e48…):

$ rsteg embed \
    --in  munch_starry.png \
    --payload munch_scream.jpg \
    --out munch_starry_stego.png \
    --password -
embedded 328443B into 2058477B carrier → 2166395B stego (328533 bytes framed)

Benchmarks — rsteg vs steghide vs stegano-rs

Median of 11 iterations after 3 warmups, on macOS aarch64. Full methodology and caveats in bench/README.md.

Feature tracker & comparison

Sources: steghide 0.5.1 source, stegano-rs README, rsteg spec set. Phase labels map to specs/09-roadmap.md: phase 1 is the next PR; phase 2 is after it merges.

Try it locally

git clone https://github.com/OpenHackersClub/rsteg
cd rsteg
cargo run -p rsteg-web
# then open http://127.0.0.1:3456

How rsteg is built

Plugin architecture via Cargo features

rsteg-core has zero runtime deps. Each carrier format and each crypto scheme is a separate crate gated by a Cargo feature. If you only need PNG-LSB, cargo build --no-default-features --features png pulls exactly one transitive dep (miniz_oxide for DEFLATE).

rsteg-cli
  ├── rsteg-core                  (std only)
  ├── rsteg-png        feat: png  (miniz_oxide)
  ├── rsteg-bmp        feat: bmp  (zero deps)
  ├── rsteg-wav        feat: wav  (zero deps)
  ├── rsteg-jpeg       feat: jpeg (zune-jpeg, phase 2)
  └── rsteg-crypto     feat: crypto + compat-steghide

The 32-byte PayloadHeader

Every rsteg-written carrier starts its embedded bit-stream with a 32-byte frame:

magic "RSTG" │ version │ flags │ crypto_fourcc │ scheme_fourcc │ density │ body_len │ body_crc32 │ reserved
  4           │   1     │  1    │      4        │      4        │    1    │    4     │     4       │    8   = 32 bytes

When a payload is encrypted (XChaCha20-Poly1305 + Argon2id KDF — feature landing next), the full header is bound into the AEAD associated data. Tampering with any field — or a rollback to an older scheme — fails Poly1305 tag verification, not the plaintext CRC. The CRC is there only as an integrity hint for unencrypted payloads.

Supply-chain posture

• Every direct dependency is spec-allowlisted before it enters Cargo.toml.
• No serde_derive, thiserror, clap, or any proc-macro — compile-time arbitrary code is the exact attack surface we're shrinking.
• #![deny(unsafe_code)] workspace-wide, with documented per-module opt-outs only for SIMD hot paths.
• Target budget: ≤ 30 transitive crates with default features; ≤ 2 with --no-default-features --features png.

Source: github.com/OpenHackersClub/rsteg. This page is the static deploy of crates/rsteg-web/src/index.html with interactive panels stripped — the live demo ships as a local axum server.