01 / Origin
Signing origin
The file was signed in Lens with a key generated for this device.
Secure Enclave·Hardware Key·Local Sign
Trust and Credentials
Content Credentials
Lens attaches verifiable capture evidence to every signed photo and video, so viewers can understand where media came from and whether it changed.
What this means
A Content Credential tells people who captured the file, when it was captured, and whether its integrity still holds. It is your evidence trail, not just metadata.
What the credential records
Each signed capture carries a compact evidence chain. Verification tools can inspect this chain without relying on Lens-specific infrastructure.
02 / Integrity
Integrity
Edits or tampering become detectable through hash validation.
SHA-256·Merkle Hash·Tamper-Evident
03 / Time
Trusted time
When available, a TSA timestamp anchors capture time externally.
RFC 3161·SSL.com TSA·Monotonic Time
04 / Context
Capture context
Optional context such as location and app version supports audits.
EXIF Metadata·App Version·Auditable
Protocol stack
Lens uses open standards and hardware-backed signing so credentials remain portable, inspectable, and tamper-evident.
C2PA Manifest
Open provenance standard that packages capture evidence and assertions into an inspectable manifest.
ES256 + Secure Enclave
Hardware-backed signing key generated and used on-device. The key is non-exportable and bound to your iPhone; the enrollment backend never receives it.
Trusted Timestamp (RFC 3161)
When online, Lens requests an external TSA timestamp to establish trusted capture time in the provenance chain.
NTP Drift Guard
Device time is checked against trusted network sources to prevent spoofed capture times.
SHA-256 Integrity Hash
Hash-based integrity checks make edits or tampering visible to verification tools.
JUMBF Container
Structured metadata container used to embed C2PA manifests directly in media files and generated PDF reports.
Where enrollment and signing happen
Lens keeps the capture signing boundary on your iPhone. Certificate issuance is a separate step.
When CA-signed enrollment is enabled, Secure Enclave generates and retains the non-exportable P-256 key, and Lens signs the certificate signing request locally. The enrollment backend proxies the CSR and limited enrollment metadata to the certificate authority, but it does not receive the private key or your photo/video.
After enrollment, Lens creates the C2PA claim and signs the media on the iPhone at capture. This differs from a remote server-side HSM model where a backend-held key signs uploaded media. An external timestamp authority, when used, provides a separate time signal.
Operational status
Lens is publicly conformant under Conformance Program v0.2 for C2PA Specification v2.4, and production captures verify with a trusted signer and trusted timestamp. Reliability and enrollment testing continue throughout September 2026.
Live today
- C2PA conformant at Max Assurance Level 1, listed as Lens Proof-of-Work on the C2PA Conforming Products List
- On-device claim signing with Secure Enclave hardware key generation (ES256)
- Native HEIC photo, MOV video, and PDF report signing (JPEG fallback on legacy devices)
- Primary RFC 3161 trusted timestamp authority via SSL.com
- Trufo certificate authority for Lens Trust enrollment
- Real-time Guided Trust state signaling in the capture HUD
- Production-trusted HEIC capture verified in a dated sample vector (2026-08-27)
In progress and planned
- Trufo backend fallback path testing (September 2026)
- Enrollment reliability and consistency testing (September 2026)
- Lens Trust public launch (Planned for October 31, 2026)
Product conformance is public and independently verifiable. Production captures verify against SSL.com as the primary TSA, with Trufo serving as the backend-controlled fallback under September testing. Captures verified against legacy trust anchors may temporarily show an Unrecognized Signer status.
How users read credentials
Lens uses three levels of progressive disclosure so viewers can verify authenticity instantly and auditors can inspect complete forensic details when needed.
- L1Capture HUD signal
A clean status indicator in the camera view confirms that hardware signing, time checks, and location locks are active before you press the shutter.
- L2Verification summary
Opening the file presents a clear summary card: key assertions, signer identity, hardware key binding, and trusted timestamp status at a glance.
- L3Manifest inspection
Auditors and forensic tools can drill down into full JUMBF manifest trees, cert chain roots, hashes, and machine-readable cryptographic evidence.