Python API

Stable, public symbols re-exported by stegx:

stegx.embed(cover_image_path, inner_plaintext, output_image_path, password, options)
Return type:

str

Parameters:
stegx.extract(stego_image_path, password, keyfile_bytes=None, try_adaptive_fallback=True, yubikey_response=None, yubikey_factory=None, allow_v1=False)
Return type:

bytes

Parameters:
class stegx.EmbedOptions(dual_cipher=False, use_matrix_embedding=False, use_adaptive=False, adaptive_cutoff=0.4, adaptive_cost_mode='laplacian', max_fill_ratio=1.0, keyfile_bytes=None, yubikey_response=None, yk_challenge_nonce=None, decoy_file_bytes=None, decoy_filename=None, decoy_password=None, always_split_cover=False, panic_password=None, panic_marker_payload=None, preserve_cover_encoding=True, compression=True, kdf_params=None)[source]

Bases: object

Parameters:

  • dual_cipher (bool)

  • use_matrix_embedding (bool)

  • use_adaptive (bool)

  • adaptive_cutoff (float)

  • adaptive_cost_mode (str)

  • max_fill_ratio (float)

  • keyfile_bytes (bytes | None)

  • yubikey_response (bytes | None)

  • yk_challenge_nonce (bytes | None)

  • decoy_file_bytes (bytes | None)

  • decoy_filename (str | None)

  • decoy_password (str | None)

  • always_split_cover (bool)

  • panic_password (str | None)

  • panic_marker_payload (bytes | None)

  • preserve_cover_encoding (bool)

  • compression (bool)

  • kdf_params (KdfParams)

dual_cipher: bool = False
use_matrix_embedding: bool = False
use_adaptive: bool = False
adaptive_cutoff: float = 0.4
adaptive_cost_mode: str = 'laplacian'
max_fill_ratio: float = 1.0
keyfile_bytes: bytes | None = None
yubikey_response: bytes | None = None
yk_challenge_nonce: bytes | None = None
decoy_file_bytes: bytes | None = None
decoy_filename: str | None = None
decoy_password: str | None = None
always_split_cover: bool = False
panic_password: str | None = None
panic_marker_payload: bytes | None = None
preserve_cover_encoding: bool = True
compression: bool = True
kdf_params: KdfParams = None
stegx.split_secret(secret, k, n)[source]
Return type:

List[bytes]

Parameters:
stegx.combine_shares(shares)[source]
Return type:

bytes

Parameters:

shares (Sequence[bytes])

exception stegx.StegXError[source]

Bases: Exception

stegx.main(argv=None)[source]
Return type:

None

Parameters:

argv (List[str] | None)

stegx.perform_encode(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.perform_decode(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.perform_rewrap(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.perform_shamir_split(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.perform_shamir_combine(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.perform_pick_cover(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.cli

stegx.cli.perform_encode(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.cli.perform_decode(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.cli.perform_shamir_split(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.cli.perform_rewrap(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.cli.perform_pick_cover(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.cli.perform_benchmark(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.cli.perform_shamir_combine(args)[source]
Return type:

bool

Parameters:

args (Namespace)

stegx.cli.main(argv=None)[source]
Return type:

None

Parameters:

argv (List[str] | None)

stegx.crypto

class stegx.crypto.EncryptOptions(kdf_params, dual_cipher=False, keyfile_bytes=None, yubikey_response=None, base_flags=0, yk_challenge_nonce=None, header_salt=None)[source]

Bases: object

Parameters:

  • kdf_params (KdfParams)

  • dual_cipher (bool)

  • keyfile_bytes (bytes | None)

  • yubikey_response (bytes | None)

  • base_flags (int)

  • yk_challenge_nonce (bytes | None)

  • header_salt (bytes | None)

kdf_params: KdfParams
dual_cipher: bool = False
keyfile_bytes: bytes | None = None
yubikey_response: bytes | None = None
base_flags: int = 0
yk_challenge_nonce: bytes | None = None
header_salt: bytes | None = None
classmethod default(dual_cipher=False, keyfile_bytes=None)[source]
Return type:

EncryptOptions

Parameters:

  • dual_cipher (bool)

  • keyfile_bytes (bytes | None)

exception stegx.crypto.InvalidTag[source]

Bases: Exception

stegx.crypto.decrypt_data(encrypted_stream, password, keyfile_bytes=None, yubikey_response=None)[source]
Return type:

bytes

Parameters:

  • encrypted_stream (bytes)

  • password (str)

  • keyfile_bytes (bytes | None)

  • yubikey_response (bytes | None)

stegx.crypto.decrypt_legacy_v1(encrypted_payload, password)[source]
Return type:

bytes

Parameters:

  • encrypted_payload (bytes)

  • password (str)

stegx.crypto.encrypt_data(inner_plaintext, password, options)[source]
Return type:

bytes

Parameters:

stegx.kdf

class stegx.kdf.KdfParams(kdf_id, time_cost=0, memory_cost_kib=0, parallelism=0, iterations=0)[source]

Bases: object

Parameters:

  • kdf_id (int)

  • time_cost (int)

  • memory_cost_kib (int)

  • parallelism (int)

  • iterations (int)

kdf_id: int
time_cost: int = 0
memory_cost_kib: int = 0
parallelism: int = 0
iterations: int = 0
classmethod default_argon2id()[source]
Return type:

KdfParams

classmethod default_pbkdf2()[source]
Return type:

KdfParams

stegx.kdf.hkdf_extract(salt, ikm)[source]
Return type:

bytes

Parameters:
stegx.kdf.derive_master_key(password, salt, params, keyfile_bytes=None, yubikey_response=None, *, header_salt=None)[source]
Return type:

bytes

Parameters:
stegx.kdf.hkdf_subkey(master_key, info, length=32)[source]
Return type:

bytes

Parameters:
stegx.kdf.seed_int_from_subkey(subkey)[source]
Return type:

int

Parameters:

subkey (bytes)

stegx.kdf.derive_legacy_seed_from_password(password)[source]
Return type:

int

Parameters:

password (str)

stegx.kdf.calibrate_argon2_for_target_ms(target_ms=500)[source]
Return type:

KdfParams

Parameters:

target_ms (int)

stegx.header

class stegx.header.Header(kdf, flags, salt, aes_nonce, chacha_nonce=<factory>, inner_ct_length=0, header_salt=None, yk_challenge_nonce=None, kms_wrap=b'')[source]

Bases: object

Parameters:
kdf: KdfParams
flags: int
salt: bytes
aes_nonce: bytes
chacha_nonce: bytes
inner_ct_length: int = 0
header_salt: bytes | None = None
yk_challenge_nonce: bytes | None = None
kms_wrap: bytes = b''
has(flag)[source]
Return type:

bool

Parameters:

flag (int)

property is_v3: bool
property packed_size: int
pack()[source]
Return type:

bytes

classmethod unpack(buf)[source]
Return type:

Header

Parameters:

buf (bytes)

as_aad()[source]
Return type:

bytes

stegx.steganography

class stegx.steganography.EmbedOptions(dual_cipher=False, use_matrix_embedding=False, use_adaptive=False, adaptive_cutoff=0.4, adaptive_cost_mode='laplacian', max_fill_ratio=1.0, keyfile_bytes=None, yubikey_response=None, yk_challenge_nonce=None, decoy_file_bytes=None, decoy_filename=None, decoy_password=None, always_split_cover=False, panic_password=None, panic_marker_payload=None, preserve_cover_encoding=True, compression=True, kdf_params=None)[source]

Bases: object

Parameters:

  • dual_cipher (bool)

  • use_matrix_embedding (bool)

  • use_adaptive (bool)

  • adaptive_cutoff (float)

  • adaptive_cost_mode (str)

  • max_fill_ratio (float)

  • keyfile_bytes (bytes | None)

  • yubikey_response (bytes | None)

  • yk_challenge_nonce (bytes | None)

  • decoy_file_bytes (bytes | None)

  • decoy_filename (str | None)

  • decoy_password (str | None)

  • always_split_cover (bool)

  • panic_password (str | None)

  • panic_marker_payload (bytes | None)

  • preserve_cover_encoding (bool)

  • compression (bool)

  • kdf_params (KdfParams)

dual_cipher: bool = False
use_matrix_embedding: bool = False
use_adaptive: bool = False
adaptive_cutoff: float = 0.4
adaptive_cost_mode: str = 'laplacian'
max_fill_ratio: float = 1.0
keyfile_bytes: bytes | None = None
yubikey_response: bytes | None = None
yk_challenge_nonce: bytes | None = None
decoy_file_bytes: bytes | None = None
decoy_filename: str | None = None
decoy_password: str | None = None
always_split_cover: bool = False
panic_password: str | None = None
panic_marker_payload: bytes | None = None
preserve_cover_encoding: bool = True
compression: bool = True
kdf_params: KdfParams = None
stegx.steganography.calculate_lsb_capacity(image)[source]
Return type:

int

Parameters:

image (Image)

stegx.steganography.embed_data(cover_image_path, data_to_hide, output_image_path, password)[source]
Return type:

bool

Parameters:

  • cover_image_path (str)

  • data_to_hide (bytes)

  • output_image_path (str)

  • password (str)

stegx.steganography.embed_v2(cover_image_path, inner_plaintext, output_image_path, password, options)[source]
Return type:

str

Parameters:
stegx.steganography.extract_data(stego_image_path, password)[source]
Return type:

bytes

Parameters:

  • stego_image_path (str)

  • password (str)

stegx.steganography.extract_v2(stego_image_path, password, keyfile_bytes=None, try_adaptive_fallback=True, yubikey_response=None, yubikey_factory=None, allow_v1=False)[source]
Return type:

bytes

Parameters:
stegx.steganography.extract_v2_with_region(stego_image_path, password, keyfile_bytes=None, try_adaptive_fallback=True, yubikey_response=None, yubikey_factory=None, allow_v1=False)[source]
Return type:

Tuple[bytes, str]

Parameters:
stegx.steganography.generate_pixel_positions(width, height, channels, password)[source]
Parameters:
stegx.steganography.get_seed_from_password(password)[source]
Return type:

int

Parameters:

password (str)

stegx.shamir

stegx.shamir.gf_mul(a, b)[source]
Return type:

int

Parameters:
stegx.shamir.gf_div(a, b)[source]
Return type:

int

Parameters:
stegx.shamir.split_secret(secret, k, n)[source]
Return type:

List[bytes]

Parameters:
stegx.shamir.combine_shares(shares)[source]
Return type:

bytes

Parameters:

shares (Sequence[bytes])

stegx.shamir.encode_share(share)[source]
Return type:

bytes

Parameters:

share (bytes)

stegx.shamir.decode_share(buf)[source]
Return type:

Tuple[int, int, bytes]

Parameters:

buf (bytes)

stegx.safe_paths

exception stegx.safe_paths.PathValidationError[source]

Bases: ValueError

stegx.safe_paths.validate_user_path(path, *, kind='any', must_exist=None, max_len=4096, allow_empty=False)[source]
Return type:

str

Parameters:

  • path (str | None)

  • kind (str)

  • must_exist (bool | None)

  • max_len (int)

  • allow_empty (bool)

stegx.safe_paths.ensure_under_base(candidate, base)[source]
Return type:

str

Parameters:
stegx.safe_paths.sink_safe_path(path)[source]
Return type:

str

Parameters:

path (str)

stegx.secure_memory

class stegx.secure_memory.SecureBuffer(size=None, *, data=None)[source]

Bases: object

Parameters:

  • size (Optional[int])

  • data (Optional[bytes])

property buffer: bytearray
property locked: bool
close()[source]
Return type:

None

stegx.secure_memory.Zeroizing(buf)[source]
Return type:

Iterator[Union[bytearray, memoryview]]

Parameters:

buf (bytearray | memoryview)

stegx.secure_memory.lock_memory(buf)[source]
Return type:

bool

Parameters:

buf (bytearray)

stegx.secure_memory.to_mutable_bytes(data)[source]
Return type:

bytearray

Parameters:

data (bytes | bytearray | str)

stegx.secure_memory.unlock_memory(buf)[source]
Return type:

None

Parameters:

buf (bytearray)

stegx.secure_memory.zeroize(buf)[source]
Return type:

None

Parameters:

buf (bytearray | memoryview | None)