SteGo

SteGo is a simple self-hosted (headless) HTTP server written in Go that lets you:

• Embed a secret text into an image using strong encryption + steganography
• Extract the secret text back from the image using the correct password

It’s designed to run on a server (like Debian with no desktop environment) and be used from any laptop/phone browser on your LAN.

---

Features

• ✅ Headless server (no GUI / no desktop needed)
• ✅ Web UI with 2 tabs: Embed / Extract
• ✅ Supports input images: PNG + JPG/JPEG
• ✅ Always outputs PNG (reliable for stego)
• ✅ Large secrets supported (up to 100 KB)
• ✅ Clear errors:
  • Wrong password → Incorrect password or no payload found.
  • No payload → No embedded payload detected.
• ✅ Clipboard copy + save to .txt
• ✅ Cross-platform: Linux + Windows (server binary)

---

How it works (simple)

1. Your secret text is encrypted with your password.
2. The encrypted bytes are hidden inside image pixels using LSB steganography.
3. To extract, you load the image and enter the password.
4. If the password is wrong, decryption fails and nothing is revealed.

If you forget the password, your data is unrecoverable.

---

Security Model (implemented)

• KDF: Argon2id
  • memory: 64 MB
  • time: 3
  • threads: min(runtime.NumCPU(), 4)
  • salt: 16 bytes random
• AEAD: XChaCha20-Poly1305
  • nonce: 24 bytes random
• Encrypted blob includes: salt + nonce + ciphertext
• Ciphertext is authenticated (integrity) by AEAD

---

Steganography model

• Converts the image to RGBA and embeds into RGB LSBs (alpha is ignored)
• Supports:
  • PNG embedding directly
  • JPG/JPEG input is decoded then saved as PNG output
• Embedding positions are shuffled deterministically using a password-derived key
• Capacity (when using 1 LSB per RGB channel):
  • capacity_bits = width * height * 3

---

Payload format (v1)

SteGo embeds a binary payload containing:

• Magic (fixed bytes)
• Version
• Flags
• KDF parameters (memory/time/threads)
• Salt length + salt
• Nonce length + nonce
• Ciphertext length + ciphertext

This makes extraction possible on another machine as long as you have:

• the output PNG image
• the correct password

---

Requirements

• Go 1.22+

Linux packages (Debian/Ubuntu) recommended for building:

sudo apt update
sudo apt install -y build-essential

This project is headless (HTTP server) so it does not require GUI libraries.

---

Run (development)

go mod tidy
go run ./cmd/stego --listen 0.0.0.0:8080

Open in browser:

• http://SERVER_IP:8080

Find your server IP:

hostname -I

Listen options

• Local only:

  go run ./cmd/stego --listen 127.0.0.1:8080

• LAN access:

  go run ./cmd/stego --listen 0.0.0.0:8080

---

Build

Linux

go build -o stego ./cmd/stego
./stego --listen 0.0.0.0:8080

Windows

From PowerShell:

go build -o stego.exe .\cmd\stego
.\stego.exe --listen 0.0.0.0:8080

---

Install as a command (stego) on Linux

go build -o stego ./cmd/stego
sudo install -m 0755 ./stego /usr/local/bin/stego
stego --listen 0.0.0.0:8080

---

Run as a systemd service (optional)

Create:

sudo nano /etc/systemd/system/stego.service

Paste (change User= and WorkingDirectory=):

[Unit]
Description=SteGo HTTP Server
After=network.target

[Service]
Type=simple
User=ciscoanass
WorkingDirectory=/home/ciscoanass/SteGo
ExecStart=/usr/local/bin/stego --listen 0.0.0.0:8080
Restart=on-failure

[Install]
WantedBy=multi-user.target

Enable and start:

sudo systemctl daemon-reload
sudo systemctl enable --now stego
systemctl status stego --no-pager

---

Usage

Embed

1. Choose PNG/JPG
2. Paste secret text (up to 100 KB)
3. Enter password + confirm
4. Click Embed & Save
5. Download the output PNG

Extract

1. Choose the image
2. Enter password
3. Click Extract
4. Copy text or save to file

---

Limitations

• Output is always PNG (even if input is JPG)
• Large secrets require large images (capacity limits)
• If the image is edited (recompressed, resized, filtered), extraction may fail
• If the password is lost, the secret cannot be recovered

---

Security warnings shown in app

• “Steganography is not a replacement for a password manager.”
• “If you forget the password, data is unrecoverable.”
• “Prefer PNG for reliability.”