In October 2026 anyone can produce at home a photograph of a place that does not exist, a video of a politician saying what he never said, or the image of a document with an impeccable seal. The industry’s answer to that problem has not been to guess whether an image is fake, but to make it carry a signed record of where it came from. That is the job of C2PA (Coalition for Content Provenance and Authenticity), the standard behind what is marketed as Content Credentials: a cryptographic signature that travels inside the file itself. The idea has been running in professional cameras for three years, is starting to reach phones, and its 2.4 specification, published this year, already accepts something uncomfortable: the record, on its own, almost never survives the journey.
What exactly gets signed
A Content Credential is not a badge in a corner: it is a data structure embedded in the file. The standard relies on JUMBF (JPEG Universal Metadata Box Format, ISO/IEC 19566-5), a box format that works the same way in JPEG, PNG, HEIF, MP4 or PDF. Inside those boxes sits a manifest with three parts:
- Assertions: statements encoded in CBOR —”captured by this model and serial number”, “generated with this model”, “cropped and adjusted with this tool”. CBOR is serialised deterministically (RFC 8949) for a very concrete reason: those statements are going to be hashed, and two different serialisations of the same data would produce different hashes and break verification.
- The claim, which links those assertions and stores a cryptographic digest of each one.
- The COSE_Sign1 signature over that claim, with an X.509 certificate chain and, if the signer asks for it, a timestamp from an external authority (RFC 3161) proving when the signature was made.
On top of that comes the hard binding: a hash —usually SHA-256— computed over the bytes of the file itself. The interesting detail is that this hash cannot cover the manifest block, because the block would then modify itself as it is inserted; the specification defines excluded byte ranges and the verifier recomputes the hash skipping them. If anyone re-compresses or crops the image, the hash no longer matches and the credential falls.
The key lives inside the chip
What separates an application signature from a capture signature is where the private key sits. When Photoshop or a generative model signs, the key lives in the company’s infrastructure and what is certified is “this tool produced this file”. When a camera signs, the key is provisioned at the factory inside a secure element —the camera’s SPU, a secure enclave, Google’s Titan M2, Samsung’s Knox environment— and never leaves it: the signature is computed inside the chip before the image reaches the memory card. That is why a manufacturer can claim something an application cannot: that those pixels came out of a specific physical sensor.
That model is what gives meaning to the trust list, the equivalent of the web’s certificate authorities but for cameras. It currently holds the devices that sign at the source: the Leica M11-P was the first in 2023 and uses a dedicated chipset; Sony added it by firmware across its Alpha range, with the certificate provisioned from a phone app; Nikon enabled the Z6III in August 2025 through its authenticity service; Canon launched its system in 2026 for the EOS R1 and R5 Mark II; and on phones, Samsung debuted it with the Galaxy S25 while Google ships it in the Pixel 10 camera, signing on-device with Tensor G5 and Titan M2. The iPhone, for now, signs nothing in its camera app.
Signing is not telling the truth
It is worth being explicit about what a credential proves: that a device with a specific certificate produced that file and that nobody has touched it since. It does not prove that what the image shows is true. An authentic camera can photograph a mock-up; and if the key is compromised, it signs lies with all the validity in the world. That is not hypothetical: in 2025 a researcher demonstrated a path to signing manipulated content with a Nikon Z6III, the manufacturer revoked the certificate for those cameras, and for months some validators went on presenting the material as valid. In parallel, other research into the exclusions field showed that byte ranges —even the entire file— can be excluded from the hash while keeping a legitimate signature and timestamp that many verifiers failed to flag.
What breaks when you forward it
The second problem is more mundane: the hard binding does not survive normal use of the internet. Resizing, re-compressing at medium quality, taking a screenshot or sending the image through a platform that rewrites metadata invalidates the hash or removes the block outright. Several 2026 analyses put it at five out of six major platforms stripping the manifest when a file is uploaded. That is why specification 2.1 introduced Durable Content Credentials: besides the hash, the producer computes a perceptual fingerprint —along the lines of the PDQ hashes used in forensics— or embeds an invisible watermark (Google’s SynthID, TrustMark, Digimarc), registers the manifest in a repository and lets the verifier recover it once it no longer travels with the bytes. Version 2.3 added CMAF segment signing for live broadcasts and 2.4 a dedicated soft binding API. With one important warning: a watermark buys durability, not security. Diffusion regeneration attacks erase it, and fingerprints can collide across different images.
What a verifier should say
The practical conclusion is that verification cannot be a true-or-false icon. An honest validator distinguishes at least four states: an embedded, intact credential; a credential recovered through a watermark or fingerprint after a transformation; no credential but a match against a signed original; and nothing found, which is not the same as “it is fake”. That nuance matters because since 2 August 2026 Article 50 of the European AI Act requires machine-readable marking of AI-generated content, and platforms, newsrooms and manufacturers are all looking for somewhere to put the label. The cryptographic part of the problem is reasonably solved; what is fragile is not the signature, but the chain of custody from the sensor to the screen.
