Sensor Fingerprint Verification

C2PA covers cameras that ship with signing hardware. Almost every camera in the world does not. The sensor fingerprint line exists for those cameras: DSLRs, RAW workflows, and bodies built long before content credentials existed. It proves a photo came from a specific, physical camera using nothing but the sensor itself.

The physics

Every image sensor leaves manufacturing with a fixed pattern of tiny per-pixel sensitivity differences, known as photo-response non-uniformity. The pattern is created by unavoidable variation in the silicon, it never changes, and no two sensors share it, even two sensors of the same model made on the same day. Every photo the camera takes carries a faint copy of it.

That makes it a fingerprint the camera cannot help writing into its own output. Apertrue turns that fingerprint into something a zero-knowledge circuit can check.

Enrolment: once per camera

1. Point the camera at a blank wall. The app captures a short series of flat, evenly lit frames. On iPhone the app does this itself. For DSLRs, the desktop app drives the camera over USB and runs the whole ceremony, including liveness checks that confirm a real sensor is attached and capturing live.
2. The fingerprint is measured. The flat frames are combined to estimate the sensor's pattern, and the most stable bits of that pattern are selected.
3. The fingerprint becomes a key. The stable bits are decoded into a cryptographic key, and only a commitment to that key is registered. The fingerprint itself never leaves the device.

Proving a photo

After enrolment, any photo from that camera can be proved. The photo's residual noise is compared against the enrolled pattern inside a zero-knowledge circuit. The circuit re-derives the key from the photo itself and proves it matches the enrolled commitment. If the photo came from a different camera, even the same model, the derivation fails.

• Nothing to trust but the maths. The proof does not rely on our servers having seen the photo. Verification is a public check anyone can run.
• The fingerprint stays private. Publishing a sensor fingerprint would let others track a camera across the internet. Apertrue never publishes it, and the proof reveals only that the match succeeded.
• Same privacy model as the C2PA line. The proof shows the photo came from an enrolled camera without revealing which one.

Can someone copy the fingerprint?

It is the obvious worry: if every photo carries the pattern, can someone lift it from your published photos and pretend to be your camera, or use it to follow your camera around the internet? The system is built so that neither works:

• The fingerprint is never stored, only a one-way code. The same way a website stores a hash of your password rather than the password, the registry holds a keyed, one-way template derived from the fingerprint. Without the device's key, an attacker cannot recreate it, even from your public photos, and it cannot be run backwards to reveal the pattern. There is nothing on any server worth stealing.
• The credential is replaceable. A fingerprint on your finger is yours for life. This one is not: if a credential is ever compromised, it can be burnt and the camera re-enrolled with a fresh one, and the old credential stops working.
• Enrolment needs the physical camera, live. The ceremony checks that a real sensor is present and capturing in the moment. A folder of someone's photos is not enough to enrol their camera as yours.
• Shared photos can be scrubbed, as an extra layer. When you publish a photo, the app can also strip the sensor pattern and the metadata from the copy you share, so the versions the world sees do not give your camera away.

Why this matters

Signing hardware will take decades to reach most cameras, and it will never reach the ones already made. The sensor line covers that entire installed base today. Together the two roots of trust mean one architecture can verify the newest signing cameras and every camera that came before them.