TrustCam: capture-time provenance for photos and video
Project description and technical documentation.
- Proves — this exact file came from this specific device at this time: sealed by the phone's secure hardware, timestamped by a third-party authority, verifiable in any browser with no account.
- Survives — platforms strip metadata on upload; an invisible watermark still points any surviving copy back to its verified original, shown side by side.
- Never claims — that the depicted scene is real, or that a watermark match alone is authentication. The limits are part of the design, and stated.
Abstract
As generative models make fabricated photos and videos indistinguishable from real captures, "detecting fakes" is a losing race. TrustCam takes the complementary approach: proving authentic media authentic at the moment of capture. The mobile app embeds a robust invisible watermark (Meta VideoSeal) into the pixels on the device, then hashes the final file and signs it with an ECDSA P-256 key generated inside the phone's secure hardware (StrongBox / TEE), whose attestation chain binds the key to hardware.
The signed proof travels inside the file itself (a metadata trailer) — there are no accounts and no servers. A fully static, client-side verifier lets anyone confirm who recorded a file, when (anchored by an RFC 3161 trusted timestamp when the capture was online), and that it is byte-for-byte unmodified.
Because the watermark survives social-media re-encoding, provenance can be recovered even after platforms strip metadata (validated in our feasibility experiments). The watermark carries a random 128-bit capture id (BCH-protected): given any surviving copy, the verifier recovers the id, resolves it to the original capture on file, and shows the two side by side — so an edited copy can be told from a merely re-shared one even when the cryptographic seal is long gone.
Videos additionally carry per-segment signatures in the bitstream (one per GOP, in SEI units): a losslessly trimmed clip keeps its intact segments verifiable. Every capture also embeds a C2PA / Content Credentials manifest (development credentials for now). The roadmap adds the cloud registry the capture id points into (devices register at setup, sealed originals upload at capture) and a CA-issued Content Credentials certificate.
Documents
- System architecture — the capture pipeline, key management, signature conventions, verification service.
- Research background & feasibility — state of the art (C2PA, in-camera signing), key papers, our experimental results, threat model and limitations.
- Experiments — sealed originals and their platform copies, including failure cases, downloadable and verifiable.
Claims and non-claims
A valid TrustCam proof asserts: this exact file was produced by this specific device, at this (device-claimed) time, and has not been modified since. It deliberately does not assert that the depicted scene is real — no capture-time cryptography can: a trusted camera filming a high-resolution display signs what its sensor sees (the "analog hole"). Likewise, a watermark-only match is an origin claim, not authentication: the side-by-side comparison with the verified original is evidence for human judgement, but only the signed trailer is cryptographic proof. The proof also assumes an uncompromised device: camera frames reach the app in userspace, so software that defeats the attestation checks can hand the secure element a foreign image to sign — the trust model spells out what key attestation covers and what only a hardware camera pipeline could close. Systems that overclaim here have failed publicly; we scope claims to what the cryptography actually proves.