Hacker News Reader

Comment by sixothree | Hacker News Reader

I think it would be nice if all cameras digitally signed pictures. You could prove the photo was real.

If C2PA and similar signature systems ever become a meaningful authenticity signal, they will create huge incentives for someone (potentially a state actor) to hack at least one camera in order to sign images of arbitrary provenance with its private keys. This will in turn inevitably lead to the same game of cat-and-mouse we have seen play out with video DRM schemes, where keys are regularly extracted from exploitable devices and used to decrypt as much content as possible before the device gets blacklisted entirely (harming all legitimate owners in the process).

I've done this btw. I went for the Pixel Camera app since they were the ones bragging the hardest about their "security". Writeup + PoC should be dropping some time tomorrow. Despite 90+ days from initial report, it remains unpatched.

Some proof: https://verify.contentauthenticity.org/?source=https://retr0...

I could also paste a privkey + cert chain in here but el goog's lawyers might not like that.

Published: https://www.da.vidbuchanan.co.uk/blog/android-c2pa.html

I don't think that that's a good idea, because it implies trust when there actually isn't any.

Being signed with something just means that whoever has that key could've done that. That might be the owner of a specific camera, but it might also be the camera manufacturer, anyone else in the supply chain, or anyone who dumped the key.

Imagine fake evidence signed with the same key as your camera uses being used in court against you. And the court believes it because it has this signature attached and those computers are very secure and all.

Exactly that will happen. Not widespread, of course, but it will.

What would prevent someone from applying the same algorithm on a computer to sign arbitrary images?

Presumably the OP is proposing something like a TPM attached to the image sensor that signs the sensor output or something like that. You can’t sign it because you can’t get the key out. The key could be per-camera and be a published list.

I suppose a dedicated fraudster could still stage an appropriate scene. An appropriately lit matte image might even suffice.

Please note: A well-funded organization, like a government, can derive the keys from the TPM hardware using an electron microscope.

Also note that there are plenty of viable attack methods that don't even require key extraction, such as asking the TPM to sign arbitrary data.

That's assuming they don't just have a backdoor inserted expressly for this purpose. Now only the rich or powerful can produce an "authentic" recording of an event and the same system can be used to hunt down whistleblowers and political enemies by looking up who bought the camera.

At the very least there is always the analog hole where you point the camera at a sufficiently high quality screen. The sensor can't tell whether the light it receives was emitted by sunlight reflecting (and refracting) from someone's face or by a bunch of LEDs pointed at the sensor.

Keys could be stored in something like TPM on Camera, and could sign the image. The key could then be verified from the camera itself to prove the authenticity of the image.

If we as a society deemed it necessary, the camera manufacturer could also provide a list of keys for devices they have manufactured. And an image/key could be provided, and the manufacturer could verify the authenticity that way.

The TPM signing could be tied into the sensor hardware itself, making it difficult, but not impossible, to sign arbitrary images with the TPM.

If I steal your camera while you're on vacation, do I then gain proof of ownership of your photos?

If I need to reset TPM, how do I reclaim photos I took previously?

The point of the key (as the for some reason dead comment points out), is not to prove who took the photo, but what device took the photo. Just as if someone stole a hardware token with a PGP key on could impersonate the owner. The key itself doesn't prove a person, just a device.

If a key was reset, a revocation of the original key could be issued, showing that the key was associated with the device for this particular time span. And then the new key registered.

This is ripe for abuse though, so resetting a TPM might not be accepted for this use case. I'm not certain in which case you'd want to reset a TPM for this use case though. Unless you took enough photos with the device to risk a birthday attack if you were using something like ECDSA.

Some problems with this particular system:

If the TPM signs the original image taken by the camera, then even the slightest image processing on another device would invalidate the signature. Routine changes like cropping, scaling, converting between image formats / quality levels, or applying image filters would invalidate the signature.

An adversary can manipulate the date/time settings on the camera and forge evidence to frame someone. "This cryptographically signed photo, with timestamp, proves that you were here at this time!"

And camera sensors can get damaged and need replacement. But if replacement of the TPM-and-sensor chip is allowed, then you can just as well replace it with a sensor from another camera. In which case a signature from a specific TPM+sensor doesn't prove that a specific camera took the photo, at best it might be evidence that a specific camera model took the photo.

If the manufacturer will happily ship a replacement TPM+sensor for a specific camera, someone can fraudulently claim that their sensor is broken and be given a new TPM+sensor for the same camera. And there will now be multiple TPM+sensors in existence that have the same key. Since this module can be switched between cameras, there could be multiple cameras that signed a given picture.

To ship (identical) replacement TPMs, the manufacturer would also need to know the private keys of all the cameras, so the manufacturer could forge arbitrary signatures at will.

Finally maybe the manufacturer doesn't want to deal with the above problems and decides that repairing the camera's TPM is not allowed after all, or that only the manufacturer is allowed to repair a camera, but then they may be in violation of right-to-repair laws in several jurisdictions.

Or, you know, using the totally-real-picture camera to take a photo of an AI-generated scene?

How exactly would this work?

People take RAW photos. Load it up in a RAW editing tool. Manipulate it. Then load it in Gimp. Manipulate some more.

Will the final result have the signature?

And if it does, what use would it be?

In the imaginary dream world that Adobe, Google et al live in, the final file does indeed have a signature.

Each piece of software in the chain must use TPM-like technologies (yes, even GIMP) to make sure it's running a "legitimate" build of the software, on "legitimate" hardware, and re-sign the file at each step along the way (using keys provisioned during some flavour of remote attestation flow, or using a RA-authenticated remote-signing oracle).

The final file embeds every preceding manifest, so you can "verify" all the way back to the original.

If this all sounds patently unworkable, that's because it is.

OK, but given that GIMP is a general purpose tool, what use is the signature if all of them verify it, when I can drastically change the image to whatever I want it to be?

The manifests at each step can embed a thumbnail (although this is optional, iiuc!), so looking at the thumbnail history it should be obvious that the edit was significant.

Yeah - I totally would not support that!

I can't wait for poking memory of applications running on my computer to become a felony.

It already is.

No it isn't, cheatengine exists, Q.E.D.

If you use cheat engine to inject child porn into an image viewer is it legal?

When I was in photography class in college, I created backplates in photoshop for still life portraits of small trinkets I was photographing. The photos were taken on black and white film and developed in the campus dark room. Led to some impressive photos. In our class's critiques, I explained how it was done. A lot of peers went from impressed to meh'd. The point: the black and white film laundered the new-age manipulation, and a digitally signed photo from a modern camera remains vulnerable to the same premise.

> You could prove the photo was real.

No. You'd only ever be able to show that key material belonging to $specific_camera was used to sign/mark the image.

Was the camera manufacturer breached? Did somebody on the factory floor steal some keys during the provisioning step? Or did somebody build their own photo-sensor simulator and plug _that_ in to the camera's motherboard to feed it a "real" image? Before going _that_ far, just point the unmodified camera at a sufficiently high resolution display...

Well that was fast!

> build their own photo-sensor simulator and plug _that_ in to the camera's motherboard to feed it a "real" image?

Already been done!

https://hackerfactor.com/blog/index.php?/archives/1102-C2PA-...

TL;DR: Strong cryptography over untrusted data does not make the data more trustworthy.

And then some incriminating photo is made with your forged signature. "Not like that, not like that!"

do you believe this should be mandated by regulation, or voluntarily offered by manufacturers as a value-add feature? ("all" implies the former.)

"I think it would be nice if all pens added a unique isotopic tracer signature to their ink. You could tell exactly who wrote everything."

"I think it would be nice if all typewriters had their unique fine-detail type artifacts registered with the government. You could tell exactly who authored a given document."

I think it would be nice if you took these ideas back to Stalinist Russia where they belong.

Stalinist Russia? Stalin would be absolutely dumbfounded by the level of tracking common in the west today.

He would love the image editing though.

Reply on news.ycombinator.com