3 ms·

Are there any image formats that have a signed hash or similar to know if it's been altered since creation?

morsch 7y ago
JPEG and many other image formats support adding arbitrary metadata, you could easily sign the image data and add it as an Exif tag. I'm not sure if anybody is doing it, though. It seems like a good idea, though, maybe we should start. Here [1] is a paper evaluating the concept. The link to the code examples seems dead, but I bet you could cobble something together in a couple lines of shell script. The only difficult part is signing just the image data as opposed to the whole file (which you're going to modify by appending the signature itself). Obviously, signing the image like that only guarantees that the owner of the key also generated the image. You're going to have to trust them and their sources that they haven't modified it. If the camera itself did the signing in a secure manner, that would be a much stronger guarantee. You could rely on a JPEG or RAW file being generated from a Canon camera by validating Canon's signature. I think some cameras can do the signing part, but not so much the secure manner part[2]. In either case it's obviously trivial to strip the signature. So it doesn't help photographers who want to prevent reproduction of their works without attribution. Finally, here[3]'s a Stack Overflow post on the topic, [1] https://www.sciencedirect.com/science/article/pii/S2210832717300753 https://www.sciencedirect.com/science/article/pii/S221083271... (2018) [2] https://petapixel.com/2010/12/01/russian-software-firm-breaks-canons-authenticity-verification-big-time/ https://petapixel.com/2010/12/01/russian-software-firm-break... [3] https://photo.stackexchange.com/questions/15307/can-digital-cameras-sign-images-to-prove-authenticity https://photo.stackexchange.com/questions/15307/can-digital-...
- mysterydip 7y ago
  Wow, thanks for the detailed reply. My initial thought was you could make sure evidence submitted in court hasn't been edited (ie photoshop someone at a crime scene, or add someone to a pic for an alibi), but there could be a few uses. The problem with exif data is as you say it's trivial to strip, but it might be a stepping point towards another "secure" format (sjpeg?)
  - dfox 7y ago
    If you want truly secure format for these kinds of applications the best thing you can do is to sign the data externally (or wrap the whole file in some signed container, which seems to be the preferred solution for EU's EIdAS and related stuff). On the other hand I have seen totally insecure, but effective hack for formats with embedded metadata: include some kind of value in there that is usually prominently displayed by OS and applications but store it in somewhat broken way such that applications trying to preserve the metadata will break it even more and it would become unreadable.

JPEG and many other image formats support adding arbitrary metadata, you could easily sign the image data and add it as an Exif tag. I'm not sure if anybody is doing it, though. It seems like a good idea, though, maybe we should start. Here [1] is a paper evaluating the concept. The link to the code examples seems dead, but I bet you could cobble something together in a couple lines of shell script. The only difficult part is signing just the image data as opposed to the whole file (which you're going to modify by appending the signature itself). Obviously, signing the image like that only guarantees that the owner of the key also generated the image. You're going to have to trust them and their sources that they haven't modified it. If the camera itself did the signing in a secure manner, that would be a much stronger guarantee. You could rely on a JPEG or RAW file being generated from a Canon camera by validating Canon's signature. I think some cameras can do the signing part, but not so much the secure manner part[2]. In either case it's obviously trivial to strip the signature. So it doesn't help photographers who want to prevent reproduction of their works without attribution. Finally, here[3]'s a Stack Overflow post on the topic, [1] https://www.sciencedirect.com/science/article/pii/S2210832717300753 https://www.sciencedirect.com/science/article/pii/S221083271... (2018) [2] https://petapixel.com/2010/12/01/russian-software-firm-breaks-canons-authenticity-verification-big-time/ https://petapixel.com/2010/12/01/russian-software-firm-break... [3] https://photo.stackexchange.com/questions/15307/can-digital-cameras-sign-images-to-prove-authenticity https://photo.stackexchange.com/questions/15307/can-digital-...

mysterydip 7y ago
Wow, thanks for the detailed reply. My initial thought was you could make sure evidence submitted in court hasn't been edited (ie photoshop someone at a crime scene, or add someone to a pic for an alibi), but there could be a few uses. The problem with exif data is as you say it's trivial to strip, but it might be a stepping point towards another "secure" format (sjpeg?)
- dfox 7y ago
  If you want truly secure format for these kinds of applications the best thing you can do is to sign the data externally (or wrap the whole file in some signed container, which seems to be the preferred solution for EU's EIdAS and related stuff). On the other hand I have seen totally insecure, but effective hack for formats with embedded metadata: include some kind of value in there that is usually prominently displayed by OS and applications but store it in somewhat broken way such that applications trying to preserve the metadata will break it even more and it would become unreadable.