Overview
- Apple published detailed technical documentation Tuesday describing Reference Image, an opt‑in camera mode on iPhone 18 Pro models that cryptographically records raw sensor pixels at capture to prove a photo was taken by the device and not generated or edited by AI.
- The camera sensor boots into a locked reference mode and signs pixel data immediately after capture with a factory‑generated key pair so the pixels cannot be altered by firmware or the operating system before signing.
- Users store a device-side secure digital negative and choose when to “develop” it; the negative is sent to Apple Private Cloud Compute which verifies signatures and timestamps, renders the final image, and applies a composite RSA‑3072 plus ML‑DSA‑87 post‑quantum signature.
- Apple built privacy and security controls: the Secure Enclave signs non‑sensor metadata, cryptographic timestamps bound capture time, observers cannot link images to a photographer or device, and a confidence score plus revocation list lets Apple invalidate single images or all images from a compromised sensor.
- The company positions Reference Image as a sensor‑level alternative to post‑capture provenance standards like C2PA, but the feature is limited to the iPhone 18 Pro main camera, is opt‑in, and raises practical questions about centralized verification, cross‑platform interoperability, and newsroom integration.