Lecture 9.5 — Provenance

(a)  a signed photograph meets its editorsThe camera signed the exact pixels: the tag is a (toy) hash of the image bytes, standing in for Signsk(x), and Verify recomputes it. Try the three edits. The tamper fails, as it should — but so do the crop and the recompression, both perfectly legitimate. Ordinary signatures authenticate exact messages: unforgeability itself demands that any changed message be rejected, since accepting it would let anyone authenticate things the signer never saw. This is the gap provenance has to close — carrying authentication through permitted edits without ever handing out the signing key.

–

(b)  authenticated provenance: three checksThe editor published y and claims it descends from a signed source through two permitted edits. The verifier runs the definition: Verify(x, σ) = 1, each edit lies in the permitted family T = {crop, brighten, rotate}, and y really equals f₂(f₁(x)) — recomputed pixel by pixel, live. Flip the failure switches: a paste is not in T, so the second check dies; a doctored y survives the first two checks and is caught only by the recomputation. All three green is exactly the definition met — and note what it does not say: provenance certifies origin and derivation, never that the scene was true or unstaged.

–

(a)  three ways to prove the same statementThe statement never changes: ∃ x, σ, f ∈ T with Verify(x, σ) = 1 and y = f(x). Revealing the witness proves it, but publishes the source and edit history and makes the verifier redo the whole transformation. A succinct proof certifies the same statement with a short π and a fast check — the verifier no longer recomputes f(x). Zero knowledge keeps the compression and additionally guarantees the verifier learns nothing beyond the statement: the source stays sealed. Malleable proofs go one step further — the proof itself can be transformed along with the object — see the tab note.

interface
–

(b)  Apple Reference Image: the pipelineThe claim being authenticated is precise: a viewable image was developed from pixels captured by a real sensor in a bounded time window, through an approved pipeline. The sensor signs the pixel data before the OS can touch it; the Secure Enclave binds the remaining metadata; timestamp tokens bound the capture time from both sides; Private Cloud Compute verifies the certificate chains, the sensor–device binding, the time bounds, and revocation before developing; and the resulting JPEG is signed by a service key. Flip the compromise switch: a revoked device dies at the verification stage, which is the point of revocation. Hover each stage for the real-world problem it answers — end-to-end authenticity, compromise and revocation, privacy and unlinkability. And even then: authenticated capture is not truth.

–