computer puzzle - Multilayer Image Steganography

Alice, Bob, Carol, and Dan are playing a card game. After they all show their cards, Bob notes that by exchanging two cards the order of the players would be reversed; that is, the player with the best hand would have the worst hand, and vice versa. Which pair of cards is he thinking of?

---

Since this puzzle is far too easy on its own, I've hidden the four players' cards in this image. I will only give you one hint, so listen up:

In order to complete this challenge, you must verify every step.

^{Download as png (1 477 855 bytes) | tiff (1 512 448 bytes) | bmp (1 513 654 bytes) | ppm (1 512 102 bytes)}

Answer

The final answer is:

The current status is:
South (Flush) > North (Three Aces) > West (Aces and Twos) > East (Two Aces).

Swap the 5 of hearts in West's with the Ace of clubs in the board.

The new status is:
East (Straight) > West (Aces and Twos) > North (Two Aces) > South (Ace high)

The clue "listen" pertains to audio files embedded in the images.

The legend for the blue layer is four cards. The file is an OGG Opus file. The audio is someone saying "If you haven't found any clues yet, here's what you should be looking for" followed by what sounds like a dial up modem (yes I'm that old).

The blue layer contains an SSTV image. I was able to display he image using RX-SSTV but not having speakers headphones don't put out enough volume to make the image clear. It is definitely the picture of the poker game but I can't make out the cards clearly.

The red layer contains the key. It appears to be OGG Opus file http://en.wikipedia.org/wiki/Opus_(audio_format) but I can't play it here. See Quark's Answer for the decryption.

The green layers contains three pieces of information according to the legend.

The green values as noted in the colour histogram by Tryth correspond to the ascii values of letters (except for 0 and 255 of course). I don't have the space to upload the whole text file, but here are the first few lines:

-----BEGIN PGP MESSAGE-----
Version: GnuPG v1.4.12 (GNU/Linux)

hIwDAAAAAAAAAAABBACSYQ99ag0VMUFXZqrBGDRem4eEilmls/7ZvvGAzZqfMsmE
NjX+WuH5gKyVVI1TGECpVxQq8jkFgdmSHxaW3+CPlVp5KbYrOAy39503BXwWQUQC
bmQaM9CKNvcJGwJwO6EP+H3h5YaRmlPLntVnwkyZltODbMRsyCd41RExlRGxhNL/
AAWDQQEUxtxTEahwiwqL0vID7XUVfqEovUk+aho0FPUuSuqU94l/hrh8rTSglQTd
x/1izqHZI0YG4Nir9sy6amtDNpafDN/IQCD8r3qp/gw2bvpKg4v9Df27frSju7Xr

...

The whole PGP stream will be in the greengs.ppm file when this C code is run with img.ppm in the execution folder:

#include 
#include 
using namespace std;

int red[256],green[256],blue[256];

int main() {

    unsigned char * buffer;
    FILE *fin = fopen("img.ppm", "r");
    FILE *fout = fopen("imgverify.ppm", "wb");
    FILE *fred = fopen("red.ppm", "wb");
    FILE *fgreen = fopen("green.ppm", "wb");
    FILE *fblue = fopen("blue.ppm", "wb");
    FILE *fredgs = fopen("redgs.ppm", "wb");
    FILE *fbluegs = fopen("bluegs.ppm", "wb");
    FILE *fgreengs = fopen("greengs.ppm", "wb");


    // Input the data from the ppm file into the buffer
    int lSize;
    fseek(fin, 0, SEEK_END);
    lSize = ftell(fin);
    printf("%d\n", (lSize-15)/3);
    rewind(fin);
    buffer = (unsigned char*) malloc (sizeof(unsigned char)*lSize);
    size_t result = fread (buffer,1,lSize,fin);

    for(int i = 0; i < 15; i++) {

        fprintf(fout,"%c", buffer[i]);
        fprintf(fred,"%c", buffer[i]);
        fprintf(fblue,"%c", buffer[i]);
        fprintf(fgreen,"%c", buffer[i]);
    }

    buffer[1] = '5';
    for(int i = 0; i < 15; i++) {
        fprintf(fredgs,"%c", buffer[i]);
        fprintf(fbluegs,"%c", buffer[i]);

        fprintf(fgreengs,"%c", buffer[i]);
    }


    for(int i = 0, x = 15; i < 785; i++)
        for(int j = 0; j < 630; j++, x += 3) {
            printf("(%d,%d) = (%u %u %u)\n", i, j, buffer[x],buffer[x+1],buffer[x+2]);
            fprintf(fout,"%c%c%c",buffer[x],buffer[x+1],buffer[x+2]);
            fprintf(fred,"%c%c%c",buffer[x],0,0);
            fprintf(fgreen,"%c%c%c",0,buffer[x+1],0);

            fprintf(fblue,"%c%c%c",0,0,buffer[x+2]);
            fprintf(fredgs,"%c",buffer[x]);
            fprintf(fbluegs,"%c",buffer[x+2]);
            fprintf(fgreengs,"%c",buffer[x+1]);

            red[buffer[x]]++;
            green[buffer[x+1]]++;
            blue[buffer[x+2]]++;
        }


    for(int i = 0; i < 256; i++)
        if(green[i])
            printf("%d %d\n", i, green[i]);

    fclose(fin);
    fclose(fout);
    fclose(fred);
    fclose(fblue);
    fclose(fgreen);
    fclose(fredgs);

    fclose(fbluegs);
    fclose(fgreengs);
}

The first clue in the green layer is a lock. That refers to the PGP Encrypted Message. Decrypting it yields the following message:

The second clue is that it needs to be verified. Importing the public key for the fingerprint 0x40842FD6 and decrypting again yields some more interesting information:

We can extract that image using the following options:

gpg --list-options show-photos --fingerprint 0x40842FD6

This yields this final image:

The third part of the green legend is the decrypted file containing the three cat image shells (the hollow squares) and the three card images.