Passport photos

Someone applies for a new passport. The photo was taken at a photographer around the corner, sent on, and now sits on the screen of the official who will approve the document. One question decides everything: is this still the photo the camera took, unchanged since the shutter closed?

Today, nobody at that desk can answer it alone. The photo has passed through several hands and systems, and any of those handovers is a chance to swap it, retouch it, or replace it with a computer-generated likeness. The official relies on trusting everyone along the way.

This exchange changes that. The camera puts a stamp on the photo at the moment it is taken, one the receiving desk can check against the device and the party operating it, and a receipt of that stamp goes on a public noticeboard that no single party can rewrite. The photo itself never goes anywhere public. Anyone who later receives the photo can check it against the receipt, on their own, without contacting anyone in the chain. Everything from the shutter onward is covered; who stood in front of the lens stays a matter for the photographer's procedures.

The exchange in five steps

1. The camera stamps the photo the moment it is taken, with a digital signature tied to the device and the party operating it.
2. A receipt goes on the public noticeboard. Of the photo itself, only a digital fingerprint is published, never the image, so the noticeboard holds proof, not personal data.
3. The photo travels as it does today, through photographers, systems and desks.
4. The receiving desk checks the stamp against the receipt. No phone calls, no central authority, no trust in the parties in between.
5. A swapped or altered photo fails the check. Either the stamp no longer matches the photo, or it did not come from the party the desk was expecting.

That is the whole idea; the rest of this page adds depth for implementers. Where public bodies are exploring this exchange, they do so as pilots, and nothing here describes a live service.

The problem, from the domain

Identity documents depend on a photograph that was taken of the right person, at a known moment, and has not been changed since. By the time a manipulated image reaches the desk that prints or approves a document, the people involved have no reliable way to tell an original capture from a convincing forgery.

The usual defences are procedural: trusted suppliers, secure transfer, and after-the-fact investigation when something looks wrong. These reduce risk, but they do not let a receiver prove, on its own, that the specific image in front of it is the one the camera produced. This approach moves the point of trust to the moment of capture itself.

Any public body exploring this kind of exchange does so as a pilot or exploration. Nothing here describes a live service, and the problem framing stays generic across the many document chains where a photograph has to be trusted.

What this contrasts with

The status quo is procedural trust: a receiver relies on the reputation of the supplier chain and on secure transfer, and can only investigate after the fact. That approach keeps working right up until an image is substituted somewhere no one is watching. The protocol does not replace suppliers or handling procedures. It adds a check any receiver can run alone, so authenticity no longer depends on trusting every hand the photograph passed through.

How it works technically

A capture device signs a photograph at the moment it is taken, and the holder publishes a content-authenticity claim to a public register, so any receiver can confirm the image later without contacting the party that recorded it. Because the receiver checks the signature against the capture device's pinned key, bound to the holder's mandate, a photo substituted by an untrusted party fails the check, with no central authority in the loop.

This content-authenticity taxonomy is a domain taxonomy on the base protocol. At the moment of capture, a capture device signs the photograph on behalf of a holder, for example a capture operator who controls the signing key. The signature binds the image to the moment and the device that produced it.

The holder then publishes a content-authenticity claim to the protocol's public register. Only a cryptographic commitment to the image is anchored on the public audit layer. The photograph itself is never placed there, so the register carries proof, not personal data.

An identity-document issuer, or any other receiver, verifies the claim independently, with three checks:

1. The capture signature. Was the image signed at the moment of capture, by a key the holder controls?
2. The anchor proof. Does the registered claim correspond to the commitment recorded on the public audit layer?
3. The recomputed commitment. When the receiver legitimately holds the file, does recomputing the commitment from that image match what was anchored?

All three checks pass together, or the claim fails. There is no call back to the recording party and no central authority in the loop.

Relationship to C2PA

C2PA is an open content-provenance standard that specifies an embedded manifest travelling inside the file. This taxonomy is complementary to it. Where C2PA describes the provenance that moves with the image, the taxonomy adds independent anchoring, publication to a public register, and discovery, so a receiver can find and verify a claim even when the file arrives without its manifest.

Where to go deeper

• The normative rules: the content-authenticity spec.
• The exchange patterns: one-to-many and register lookup.
• Common questions: the FAQ.