Provenance

Verification of a human made image
Unknown origin for AI generated image- verification failed

Inspiration

While AI is bringing us into a new world, we considered how other advancements in tech will bring us into the unexplored. We started by looking at cyber processes and how we can look at cyber in a new light, as well as how we could interpret new worlds, after which we started discussing new worlds in regards to digital identity and deep fakes. We then decided to combine these two concepts as well as how they would safely function in a post-quantum world.

What it does

Provenance proves a photo is real, that it was taken by a real human, and when, in a way that still holds after quantum computers break today’s cryptography.

Every photo is fingerprinted and sealed twice, with today’s signature and a post-quantum one. Face ID binds it to a verified person, and it’s recorded in a tamper-evident log. Anyone viewing it gets a clear verdict: verified, edited or unknown origin.

We also demonstrate how this functions the day quantum computers arrive, showing us the applications of this in the new world: today's RSA seals become forgeable and are flagged, and Provenance photos stay trusted.

How we built it

We created a typescript repo with a shared cryptographic library and two main splits of responsibilities: server and backend crypto logic, and phone side logic and demo building.

The photos are hashed with SHA-255 and signed with both an elliptic key: Ed25519, and ML-DSA-65 for post-quantum resistance, which is NIST's post-quantum standard. We assumed that our web app would be used on all phones, hence face ID was used to approve each photo through a WebAuthn passkey which is bound to that exact image.

The server then simulates a phone maker and an ID authority to issue post-quantum signed certificates. Every photo then goes into a hash-chained log in sqlite, also signed with ML-DSA-65. We also added a verifier that rebuilds the whol hash chain on every view, and decides which signatures still count before and after Q-day (when quantum computers break encryption)

We also built automated tests for six different possible "attacks", as well as a demo visualisation of Q-day itself.