C2PA Specification

The core of C2PA is the ingredient architecture. A final asset is composed of a series of assertions (metadata statements) and ingredients (source files). Each editing step creates a new manifest that cryptographically references its parent ingredients via a Merkle tree structure. This creates a verifiable, directed acyclic graph of provenance. Any attempt to alter a single pixel or metadata field retroactively breaks the hash chain, making the manipulation immediately detectable by validators.

C2PA achieves hard-binding between the manifest and the asset content. The specification uses SHA-256 hashing to generate a unique digital fingerprint of the final image or video. This hash is then signed and embedded directly into the file's metadata (e.g., JUMBF box for JPEG). This differs from soft-binding, where a link merely points to an external server. Hard-binding ensures the provenance data survives file copying and remains inseparable from the content itself, enabling offline verification.

To prevent backdating, C2PA integrates with trusted timestamping authorities (TSA) that conform to RFC 3161. The manifest includes a signed timestamp that cryptographically proves the content existed before a specific moment. Furthermore, the signer's identity is validated through standard X.509 certificate chains linked to a root Certificate Authority (CA). This allows validators to answer not just 'has this been altered?' but also 'who created it and when?' without relying on a centralized blockchain.

C2PA v2.1+ introduces specific assertion types for generative AI. A c2pa.actions assertion can declare that a model was used to generate or inpaint content. Crucially, the training-mining assertion allows content creators to explicitly state whether their asset can be used for AI model training. This machine-readable flag is a critical technical control for enforcing data provenance verification and respecting opt-out signals, bridging the gap between content creation and retrieval-bot access management.

Recognizing privacy and security concerns, C2PA supports manifest redaction. A processor can generate a new, valid manifest that replaces sensitive information (like a photographer's GPS coordinates or a whistleblower's identity) with a cryptographic zero-knowledge placeholder. This allows the chain of custody to remain verifiable while protecting private data. The redaction is itself a signed action, ensuring transparency about the modification without exposing the underlying secret.

C2PA aligns with the W3C Verifiable Credentials (VC) data model. This allows manifests to contain cryptographically signed claims from trusted third parties. For example, a news agency can issue a VC attesting that a specific camera captured a photo at a specific location, and this VC can be embedded directly into the C2PA manifest. This interoperability ensures that C2PA provenance data can be consumed by broader decentralized identity ecosystems and enterprise governance tools.

The chronological, auditable documentation trail that C2PA manifests encode. Each link in the chain represents a state transition where an actor performed an action on the content. The chain records:

• The identity of each actor (creator, editor, publisher)
• The specific action taken (capture, crop, AI generation)
• The cryptographic hash of the asset at that point in the workflow
• The signature binding the actor's claim to the state

This creates a forensically verifiable lineage that can be audited by any relying party, from social media platforms to news organizations validating source material.