GoKawiilFirst look: Apple added a new camera feature to the iPhone 18 Pro and iPhone 18 Pro Max designed to help establish whether a photograph is authentic. Called Apple Reference Image, the opt-in mode creates a cryptographically protected version of a photo when it is captured. Apple says the system is designed to show that an image was captured by an iPhone camera sensor and has not been altered or generated by AI.
When Reference Image is enabled, the camera sensor restarts in a dedicated operating mode. It then signs the pixel data immediately after capture, before the image goes through the usual software-based processing steps.
Apple said that's a key difference from other image-authentication methods. Many systems attach provenance data after an image has passed through the software pipeline. Apple argues that this can leave room for tampering before the photo is signed.
The company describes the resulting file as a "secure digital negative." It is stored on the phone and contains pixel data, sensor metadata, and cryptographic timestamps. The original reference file is not intended to be edited in the same way as a standard photo.
The iPhone's Secure Enclave Processor also signs some capture information from outside the sensor, such as exposure settings, digital zoom, and lens data. Apple said this information is kept separate from the sensor data and cannot change the underlying pixels.
A reference image still needs to be rendered into a usable photograph. When a user decides to develop one, the device sends the original negative to Apple's Private Cloud Compute system.
Private Cloud Compute checks the sensor and Secure Enclave signatures, verifies that the device components are associated with the same iPhone, and confirms that the software handling the image has been approved. It then processes the photo and produces a JPEG.
Apple said the final image receives a composite signature that combines RSA-3072 with ML-DSA-87, a post-quantum cryptographic algorithm. The company said this approach is intended to keep images verifiable over long periods as cryptographic threats evolve.
The system also records a range for the capture time rather than relying on a single timestamp generated by the phone's operating system. The device periodically receives cryptographic time records that provide a lower bound before the photo is taken and an upper bound after capture.
Apple said it can add the upper timestamp later if the iPhone is offline when the image is taken.
... continue reading