# stego-uuid
A generator and verifier for steganographic numbers that look random

The standard use of this package is to generate a 64-bit number and use
this, along with a secret key, as input to the marking function.

Example:

```haskell

secretHi = KeyHi64 12345  -- secret key hi  64 bits
secretLo = KeyLo64 67890  -- secret key low 64 bits

main :: IO ()
main = do

  putStrLn "Is this marked?"
  r  <- randomIO :: IO Word64           -- get 64-bit random number
  let x = mark secretHi secretLo r      -- produce marked 128-bit UUID
  print x                               
  print (isMarked secretHi secretLo x)  -- True
```

## Security considerations
This is a poor man's MAC. We use SHA256 to generate the second half of the UUID from the 64-bit
random looking input and the secret key. The small number of bits limits the security.

We will start getting collisions on the 64-bit random number after about 2^32 numbers are used.
But this just means we will be providing the function with the same input, so the same output
will be produced.

### False Negatives
This is zero. If you produced the number with the `mark` function, this number will always be
detected with `isMarked` as long as you provide the correct key.

### False positives
This is false detection. We worry about a UUID that was *not* generated using `mark` but is
detected as marked by `isMarked`. (A malicious adversary can always replay any UUIDs known as
marked. Thus, we will consider only new UUIDs.)

Assuming SHA256 is a perfect pseudo-random function, its truncated output, i.e. the last 64 bits of
the UUID, does not leak any information about the secret key. Given a fixed secret key, for any
64-bit input (corresponding to the the first half of the UUID), there is a unique 64-bit output
(corresponding to the second half of the UUID). There is only one such output per 64-bit input. So,
the probability of finding such input from a random draw is 2^(-64). The adversary would have more
than a 1/2 chance of finding it after 2^63 guesses.

### Information leakage
The adversary can only know a UUID is marked if it is able to differentiate the output of truncated
SHA256 from a pseudo-random function. I am unaware of any significant results in doing so. The key
is 128-bits in length, so going through all possible values is currently unfeasible.