Verifying Provenance of Digital Media: Security Analysis of C2PA and its Implementation

Generative AI and advanced editing tools enable malicious actorsto create high-quality fake images that can facilitate fraud, attackreputations, and manipulate elections. We analyze security proper-ties of the Coalition for Content Provenance and Authenticity (C2PA)digital provenance system. C2PA binds cryptographic assertionsof provenance to a digital asset, with the goal of assisting usersto judge the asset’s provenance. When generating or modifyinga digital asset, a C2PA claim generator (e.g., camera) creates andsigns provenance data. Using a trusted timestamping authoritythe generator optionally timestamps them and places them into amanifest of claims.We analyze three C2PA components: specifications (Version 2.2),selected claim validator implementations, and conformance pro-gram (Version 0.1). For the specifications, we state the security goalsspecified by C2PA (i.e., tamper-evidence of claims and weak fileintegrity) and identify additional essential goals that should be re-quired (i.e., timestamp agreement, validator consistency, and strongfile integrity). We review major policies (e.g., validation logic, certifi-cate revocation), examine the protocol’s composition with RFC 3161trusted timestamps, and carry out the first formal-methods analysisof the core protocol. For the implementations, we identify securityflaws through validation experiments using public C2PA assets andones we created. For the conformance program, we review avail-able public conformance documents and assess two conformingvalidators: Adobe Inspect and Verifieddit.We show that the C2PA specifications and their conforming im-plementations fail to achieve their claimed security goals. Further-more, they also fail to achieve essential additional goals, which allsuch provenance systems require for trustworthy deployment. First,our formal-methods analysis shows that C2PA claim generators andvalidators fail to agree on the claim signature’s trusted timestamp.Consequently, a claim may exist with competing, fraudulent times-tamps, which cast doubt on the related asset’s provenance. Second,we show that the specification’s inadequate certificate revocationpolicies result in serious vulnerabilities, violating all security goals.As a result, public validators, including Adobe Inspect, accept C2PAmanifests signed by known, compromised Nikon certificates. Third,our experiments reveal inconsistencies among current conformingvalidator implementations. For some assets, implementations fail toproduce the same validation result: users who rely on these imple-mentations may arrive at contradictory conclusions regarding anasset’s provenance. Fourth, we discuss implications of the specifica-tion’s “exclusion range,” which identifies portions of the contentand manifest that are not protected by the cryptographic signature,allowing undetectable alterations which can mislead analysts. Fifth,the C2PA conformance program certifies products without carryingout a technical review of the product, including the source code, andwithout defining security requirements for conforming validators.Our results show that the specifications and the current imple-mented C2PA ecosystem do not yet provide the guarantees requiredfor reliable deployment or standards adoption. We suggest waysto strengthen C2PA, including a verified improvement to the coreprotocol’s timestamping. The Pixel 10 Pro and Version 2.3 of thespecifications implemented some of our suggestions.