Skip to content
←Back to glossaryCyber

Cryptographic provenance

A signature attached to content that attests to its origin and integrity, authenticating the genuine rather than detecting the fake.

Definition

In February 2021, Adobe, Arm, the BBC, Intel, Microsoft and Truepic founded the C2PA (Coalition for Content Provenance and Authenticity), whose signed-metadata specification, Content Credentials, records how a file was made and every later edit. The Leica M11-P, unveiled in October 2023, was the first camera to sign its images this way at capture. Cryptographic provenance covers the techniques that attach a signature to an image, a video or a document, attesting its origin and integrity, so the content can be traced back to its source. Against AI-boosted fraud, it flips the burden of proof: content must be authenticated at creation, instead of someone wearing themselves out proving it fake in a race where the generator stays a step ahead of the detector. The signature proves where the file came from and that it has not changed, nothing more about the scene in the picture, and an image stripped of its metadata proves no fraud. For an insurer, the approach needs shared standards and a trust ecosystem it cannot build alone, plus policyholders who file claims with evidence captured through certified apps.

Its 4 cross-references, woven across the glossary's 18 categories
Cryptographic provenance: Cyber glossary illustration, AlgoPolis
Example

The Coalition for Content Provenance and Authenticity, formed in February 2021 by a group of technology and media companies, published a signed metadata specification describing how a file was made and subsequently modified, since adopted by several camera manufacturers and by distribution platforms.

Read next
Put it to work
Related terms
Related articles
Also known as

content provenance, C2PA, content credentials

Stay informed

Follow the research

One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.

No spam, one-click unsubscribe, no data ever sold.