Version: 1
Carrier: PNG/RGB
SECRET = UTF8(secret) K = SHA256(SECRET)
PRNG = ChaCha20( key=K, nonce=00000000000000000000000000000000 )
For each 4-byte PRNG word:
n = UINT32_BE(word)
pos = n % (width * height * 3)
Discard duplicate positions.
Mapping:
pixel = pos // 3
channel = pos % 3
channel 0 = R
channel 1 = G
channel 2 = B
x = pixel % width
y = pixel // width
Read channel LSB.
Pack bits MSB-first.
Payload:
A5 31
UINT32_BE(iterations)
BYTE[16] salt
BYTE[12] nonce
UINT32_BE(ciphertext_length)
BYTE[ciphertext_length] ciphertext
KEY = PBKDF2-HMAC-SHA256( UTF8(password), salt, iterations, 32 )
PLAINTEXT = AES-256-GCM-DECRYPT( key=KEY, nonce=nonce, ciphertext=ciphertext, aad=NULL )
Output PLAINTEXT as UTF-8 only if GCM authentication succeeds.