re subliminal channels in dss may i suggest that any any proposed cipher system having less entropy than the user s key and message can have an embedded subliminal channel as big as the difference in entropies between the entropy of the user input message and the entropy of the output for example take plain des the unsuspecting user inputs a string plaintext to be enciphered he cranks the algorithm which has been hacked by george quisling and comes out with j h d nine char in and nine chars out right the unsepecting user ships the ciphertext to be decrpyted and the message plaintext is produced everything fine right nope imagine the algorithm did a lz compression on plaintext before desing compressing is down to four characters with more entropy wj the opponent now pads the message with his own message also compressed dk before applying des to the concatenated compressed pairs when decrpyted the first compressed message is stripped off and declared sent unbeknowst to the receiver the opponents accomplice collects the remaining message in the bit bucket and uncompresses to kill now and to prevent all such subliminal or covert storage channels you would need to have maximal entropy all the time which is a priori impossible because for example a stereotypical message might be replaced by one bit in the output reserving the rest of the output bits for the long covert message in other words if you opponent get to muck with the algorithm you either have got to muck with it last or concede his possible embedding of covert channels in other words if you present a message to an opponet with less than maximal entropy then you have given him free bits of storage grady netcom com ef e ad d d c f fc ac f d f e f
