TrustCam: capture-time provenance for photos and video

Project description and technical documentation.

Abstract

As generative models make fabricated photos and videos indistinguishable from real captures, "detecting fakes" is a losing race. TrustCam takes the complementary approach: proving authentic media authentic at the moment of capture. The mobile app hashes media as it is recorded and signs it with an ECDSA P-256 key generated inside the phone's secure hardware (StrongBox / TEE), whose attestation chain proves both the key's hardware protection and the device's integrity. The signed proof is registered with the user's account; a public verifier then lets anyone confirm who recorded a file, when, and that it is byte-for-byte unmodified.

The roadmap extends this to per-segment rolling signatures carried in the video bitstream (ONVIF Media Signing) and a robust invisible watermark (Meta VideoSeal) that survives social-media re-encoding, so provenance can be recovered even after platforms strip metadata — validated in our feasibility experiments below.

Documents

System architecture — the capture pipeline, key management, signature conventions, verification service.
Research background & feasibility — state of the art (C2PA, in-camera signing), key papers, our experimental results, threat model and honest limits.

Claims and non-claims

A valid TrustCam proof asserts: this exact file was produced by this specific device, bound to this account, at this time, and has not been modified since. It deliberately does not assert that the depicted scene is real — no capture-time cryptography can: a trusted camera filming a high-resolution display signs what its sensor sees (the "analog hole"). Systems that overclaim here have failed publicly; we scope claims to what the cryptography actually proves.