• Peripheral Literature for C2PA
  • C2PA use case
  • C2PA implementation
  • Image metadata
  • Phone keystore security

Peripheral Literature for C2PA

C2PA use case

• Community story: Pixelstream, CAI, 2022
  • empower individual journalists to compete w/ established media by giving credibility
  • version control: fork image, evolution tree
• How a voice cloning marketplace is using Content Credentials to fight misuse, CAI, 2024
  • they use GlobalSign as certificate authority (CA)
  • want everything to have C2PA just like HTTPS
• How we’re increasing transparency for gen AI content with the C2PA, Google, 2024
  • show C2PA in image search result & ad
• Partnership on AI Unveils New Case Studies from Supporters of Synthetic Media Framework: Meta, Microsoft, Thorn, and Truepic
  • How Truepic used disclosures to help authenticate cultural heritage imagery in conflict zones: Project Providence: gather evidence from image of attacks to Ukraine to prove war crime
    • rotate certificate daily “for granular invalidation”
    • hardware-backed keystore
    • opt-in for various metadata for creator for privacy & safety
    • importance to stay secure & credible
    • future: election monitoring
    • acknowledge C2PA need to be widely adopted & problem of metadata removal
    • policies to come in place to mandate disclosure in AI output
    • need to display info w/o clicking
    • tiered AI content labeling, e.g., AI-generated vs AI-modified
  • How Microsoft and LinkedIn gave users detailed context about media on the professional networking platform:
    • LinkedIn shows “CR” watermark by images with C2PA
    • use “synthetic media detectors” when C2PA is missing
    • technically not verify, but know signer
• Use of C2PA in real-world workflows, Brendan Quinn, Jay Li, David Beaulieu, Jonathan Dupras, Nigel Earnshaw, Charlie Halford, Gavin Peacock, Pia Blumenthal, IPTC Photo Metadata Conference 2022
  • Azure Media Services use C2PA during video encoding (unclear what exactly)
  • CBC/Radio-Canada use C2PA for news
  • BBC JavaScript library to edit/show C2PA
• Ongoing by Tim Bray · C2PA
  • public education of C2PA & attack & defense
• How Wrapt’s end-to-end platform protects creative workflows with Content Credentials
  • platform to sign C2PA for content creator for intellectual right & charge them

C2PA implementation

• Truepic
  • claims to do software-based on-device signing securely on smartphone
    • secure boot & verify device integrity
    • hardware-backed keystore on phone
    • no implementation details
  • need to sign up; ludicrous pricing ($499+/mon)
• Panel 1: AI and Image Authenticity, Leonard Rosenthol, Dennis Walker, Neal Krawetz, Bofu Chen, Adobe, C2PA, Camera Bits, FotoForensics, Numbers Protocol, IPTC, 2024
  • browser extension to find C2PA data from embedded watermark & fingerprint (photo search)
    • disclosed watermark can be easily erased
    • fingerprint can be forged
  • metadata for “do not train”
  • implementation bug: demo changing date w/o invalidating C2PA
  • C2PA agnostic: work w/ cloud & blockchain
  • trust list will include anyone w/ okay implementation
    • How to add a certificate to the list
• How Click Camera App Brings Content Credentials to Phones
  • Click, 👍 free C2PA camera (photo + video) app on Android & iOS by Nodle
  • proprietary app and ContentSign
  • 👎 require Internet to sign, store on Ethereum blockchain
  • 👎 no privacy: no way to choose what metadata to include; associate public key; everything on chain
    • counter argument: no association between person & public key; can use approximate location
  • no defense against photo of photo
  • ❗ can post C2PA photo to public channel ⇒ reservoir of C2PA photo
  • ❗ mention difficulty of scaling PKI & help w/ blockchain
    • lie? blockchain reference does not imply same level of trust as certificate
    • 👎 can verify by default, but cannot verify if using certificate trust list
    • mention joining C2PA working group to integrate blockchain
• Three pillars of provenance that make up durable Content Credentials
  • TrustMark: open-source watermark & removal (useless?)
• simple-c2pa
  • SimpleC2PA Audio Credentials
  • ProofMode app
  • do not use hardware protection for private key
  • self-signed certificate
• Capture Cam app by Numbers Protocol
  • claim to preserve ownership by C2PA + blockchain + NFT
  • company seems hacked up
  • 👎 sign C2PA after capture after request
  • 👎 no privacy: no way to choose what metadata to include; can see all photo of user if know one
  • 👎 require Internet to sign; store on blockchain (their own)
    • probably sign on server bc reuse pubkey
  • active open-source Capacitor app
    • inactive open-source Android app repo
• Starling Lab Framework
  • Stanford EE & USC Shoah Foundation
  • blog from Filecoin Foundation for the Decentralized Web
    • claim to use Numbers Protocol
  • Inside Starling Lab, a moonshot project to preserve the world’s most important information - Fast Company
    • claim blockchain is for preserving data
    • 78 Days archive photo claim to use “Numbers Protocol” but show no C2PA in “verify”
  • all verify link broken

Image metadata

• Secret message sharing using online social media, IEEE CNS, 2014
  • hide message in pixels, survive image manipulation

Phone keystore security

• phones are claimed to have hardware-backed keystore considered secure for private key Android Keystore system  |  Security  |  Android Developers & Keychain data protection - Apple Support