Initial verion.

2025-12-27 03:14:32 -05:00
commit 1e77562ec0
18 changed files with 4046 additions and 0 deletions
--- a/README.md
+++ b/README.md
@@ -0,0 +1,149 @@
+# Stegasoo Web Service
+
+A containerized Flask + Bootstrap web UI for hybrid Photo + Day-Phrase + PIN steganography.
+
+![Python](https://img.shields.io/badge/Python-3.11+-blue)
+![Flask](https://img.shields.io/badge/Flask-3.0+-green)
+![Docker](https://img.shields.io/badge/Docker-Ready-blue)
+![Security](https://img.shields.io/badge/Security-AES--256--GCM-red)
+
+## Features
+
+- 🔐 **AES-256-GCM** authenticated encryption
+- 🧠 **Argon2id** memory-hard key derivation (256MB)
+- 🎲 **Pseudo-random pixel selection** defeats steganalysis
+- 📅 **Daily key rotation** with 3-word phrases
+- 🔢 **Static PIN** for additional entropy
+- 🖼️ **Reference photo** as "something you have"
+- 🌐 **Web UI** with Bootstrap 5 dark theme
+
+## Quick Start
+
+### Docker (Recommended)
+
+```bash
+# Build and run
+docker-compose up -d
+
+# Access at http://localhost:5000
+```
+
+### Manual Installation
+
+```bash
+# Create virtual environment
+python -m venv venv
+source venv/bin/activate  # Linux/Mac
+# or: venv\Scripts\activate  # Windows
+
+# Install dependencies
+pip install -r requirements.txt
+
+# Run development server
+python app.py
+
+# Or production with gunicorn
+gunicorn --bind 0.0.0.0:5000 app:app
+```
+
+## Usage
+
+### 1. Generate Credentials
+
+Visit `/generate` to create:
+- **7 three-word phrases** (one per day of week)
+- **1 six-digit PIN** (same every day)
+
+Memorize these! Don't save them.
+
+### 2. Encode a Message
+
+Visit `/encode` and provide:
+- **Reference photo** - A photo both parties have (NOT transmitted)
+- **Carrier image** - The image to hide your message in
+- **Message** - Your secret text
+- **Day phrase** - Today's 3-word phrase
+- **PIN** - Your static 6-digit PIN
+
+Download the stego image and share it through any channel.
+
+### 3. Decode a Message
+
+Visit `/decode` and provide:
+- **Reference photo** - Same photo used for encoding
+- **Stego image** - The image containing the hidden message
+- **Day phrase** - The phrase for the day it was encoded
+- **PIN** - Your static PIN
+
+## Security Model
+
+| Component | Entropy | Purpose |
+|-----------|---------|---------|
+| Reference Photo | ~80-256 bits | Something you have |
+| 3-Word Phrase | ~33 bits | Something you know (rotates daily) |
+| 6-Digit PIN | ~20 bits | Something you know (static) |
+| **Combined** | **133+ bits** | **Beyond brute force** |
+
+### Attack Resistance
+
+| Attack | Result |
+|--------|--------|
+| Brute force | 2^133 combinations = impossible |
+| Rainbow tables | Random salt per message |
+| Steganalysis | Random pixel selection defeats detection |
+| GPU cracking | Argon2 requires 256MB RAM per attempt |
+
+## API Endpoints
+
+| Endpoint | Method | Description |
+|----------|--------|-------------|
+| `/` | GET | Home page |
+| `/generate` | GET/POST | Generate phrase card + PIN |
+| `/encode` | GET/POST | Encode message in image |
+| `/decode` | GET/POST | Decode message from image |
+| `/about` | GET | Security information |
+
+## Configuration
+
+Environment variables:
+
+| Variable | Default | Description |
+|----------|---------|-------------|
+| `FLASK_ENV` | production | Flask environment |
+| `SECRET_KEY` | random | Session secret (auto-generated) |
+
+## Production Deployment
+
+For production, consider:
+
+1. **HTTPS** - Use nginx reverse proxy with SSL
+2. **Rate limiting** - Prevent abuse
+3. **Logging** - Monitor for security events
+4. **Memory** - Allocate at least 512MB (Argon2 needs 256MB)
+
+Example nginx config:
+
+```nginx
+server {
+    listen 443 ssl;
+    server_name stegocrypt.example.com;
+    
+    ssl_certificate /path/to/cert.pem;
+    ssl_certificate_key /path/to/key.pem;
+    
+    location / {
+        proxy_pass http://stegocrypt:5000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        client_max_body_size 50M;
+    }
+}
+```
+
+## License
+
+MIT License - Use responsibly.
+
+## ⚠️ Disclaimer
+
+This tool is for educational and legitimate privacy purposes only. Users are responsible for complying with applicable laws in their jurisdiction.