C2PA Specification

A Manifest is the core data structure that binds provenance claims to a specific asset. It contains a set of Assertions (metadata about the asset) and a Claim (a digitally signed hash linking assertions to the asset). The manifest is stored either directly within the file format (e.g., JPEG, PNG, AVIF) via a JUMBF (JPEG Universal Metadata Box Format) container or as an external reference. This structure ensures the provenance data travels with the asset, enabling portable verification.

The specification relies on a chain of trust established through asymmetric cryptography. A Claim Generator creates a claim by hashing the asset and the assertion data, then digitally signs it using a private key linked to a Credential (e.g., an X.509 certificate or a W3C Verifiable Credential). This creates a tamper-evident seal. Any subsequent modification to the asset or metadata invalidates the signature, making unauthorized alterations immediately detectable by a Validator.

To track derivative works, C2PA uses an Ingredient relationship. When an asset is edited (e.g., a photo is cropped or a video is spliced), the new manifest includes a reference to the original asset's manifest as an ingredient. This creates a verifiable Transformation Lineage. The specification supports hard binding, where the hash of the parent ingredient is included in the new claim, creating an unbreakable cryptographic chain from the final published piece back to the original capture device.

C2PA does not mandate a single identity provider but defines how to integrate with existing trust infrastructures. A Trust List allows validators to check if the signer's certificate chains to a trusted root Certificate Authority. The specification supports W3C Verifiable Credentials and Decentralized Identifiers (DIDs) to enable privacy-preserving identity assertions. This allows a news organization to cryptographically prove that a photo came from a specific staff photographer without revealing unnecessary personal data.

The specification defines a strict Validation Model that checks structural integrity, signature validity, and credential revocation status. A critical feature is Assertion Redaction, which allows a downstream editor to remove specific metadata (e.g., GPS coordinates for privacy) without breaking the cryptographic chain. This is achieved by replacing the redacted data with a null value and re-signing the manifest, explicitly marking the redaction event in the provenance log rather than silently stripping the data.

C2PA defines a registry of standardized Assertions to ensure machine-readability across ecosystems:

• Creative Work: Captures author, title, and copyright information.
• Actions: A structured list of edits performed (e.g., c2pa.opened, c2pa.cropped, c2pa.filtered).
• Thumbnail: A secure, low-resolution preview hash-linked to the high-res asset.
• Training & Data Mining: A flag indicating whether the creator prohibits use for AI/ML training. This semantic structure allows platforms to display a human-readable 'nutrition label' for content.

C2PA uses Merkle trees to efficiently bundle and verify multiple assertions within a single content credential. A Merkle tree is a data structure where leaf nodes contain hashes of data blocks, and each non-leaf node contains the hash of its children, culminating in a single root hash. This allows a verifier to check the integrity of a specific assertion without needing to download the entire credential, providing a compact cryptographic proof of inclusion for each edit or attribution in the asset's history.

To establish a definitive chronological order of events, C2PA relies on trusted timestamping. This process securely proves that a specific piece of data existed at a particular moment in time. A Time Stamp Authority (TSA) cryptographically signs a combination of the data's hash and the current time, anchoring the provenance record to a verifiable point on the universal timeline. This prevents backdating of content creation or modification claims.

The cryptographic backbone of C2PA is digital signature verification. When a content credential is created, the asserting entity signs the claim using a private key. Any party can then use the corresponding public key to verify that the credential was created by that specific entity and has not been altered since it was signed. This process ensures non-repudiation of origin, providing mathematically irrefutable proof of authorship and preventing forgery of the provenance chain.