تحقق
طلب شهادة
XENLOOK C2PAتحقق

تجريبي · مراجعة C2PA · كوريا مارس 2027 · اليابان يونيو 2027

حقوق النشر C-2026-036487 · طلب براءة 10-2026-0100026 (غير مسجّل بعد)

قانوني وسياسات →
Course contents
Chapter 4 of 10

Chapter 4A signature tells you who made it

In this chapter you attach a credential to a file in the practice setting, then open it again to check that it attached properly. You also learn what a signature tells you and what it does not.

  • Official session name · First check of C2PA signing and verification in a sandbox
  • 6 practice steps
  • Some steps need you to sign in
What you will learn in this chapter
  • You know what the secret key (private key) and the public key each do.
  • You know how the check result differs for a signed file and an unsigned file.
  • You can write “what was confirmed” and “what was not confirmed” separately.

The idea in plain words

It works like a personal seal and a tamper tape
Only the owner has a personal seal, so the mark it leaves tells you who stamped it. A tamper tape shows when it has been peeled off. A digital signature combines the two. But a real seal does not make the paper's content true.

A signature uses a pair of two keys. The secret key (private key) is held only by the person who signs. The public key can be seen by anyone.

To sign, you lock the file's hash (chapter 2) with the secret key. That lock is the signature. To check, you open the signature with the public key, calculate the file's hash again, and see whether the two match.

If they match, it means “the owner of this key signed it, and the file has not changed since.” If they do not match, the integrity check fails. That means the file changed after signing, or the signature was damaged.

A signature only tells you who signed. It does not tell you whether the scene in the photo really happened. People say this in short as “a signature is not the truth of the pixels.”

If a secret key is lost, anyone can sign in that name. So a real signing key is kept offline or in a dedicated security device (an HSM). Learners never touch the secret key.

See the picture

  1. Calculate the hashthe file's fingerprint
  2. Lock it with the secret keymake the signature
  3. Attach it to the filemanifest + signature
  4. Check with the public keycompare the hashes
A signature is the hash locked with a secret key. A check opens it with the public key and compares the hashes.

Try it yourself

Work from the top, one step at a time. After each step, check that your screen matches “What you should see.”
  1. On the verify page, in the box “Drop in a file and check it now,” select “Signed sample.” The file never goes to a server; it is checked inside your browser.
    What you should see “The signature is valid and nothing changed after signing” appears, and the “Signed by” row shows the signer's name.
    Open the verify pageNo sign-in
  2. In the same box, select “Photo with no record” and compare the result.
    What you should see “This file has no C2PA record” appears, with a note that no record does not mean fake.
    No sign-in
  3. (Optional) Download the public sample photo and drag it into the same box, or add it with “Choose a file.”
    What you should see “The signature is valid and nothing changed after signing” appears, and the “Trust list” row says it is a pilot certificate that is not on the official list yet.
    Download the sample photoNo sign-in
  4. On the practice signing page, open the Sign tab, select “Sign sample now,” and download the signed file.
    What you should see A result says signing is done, and a Download button appears.
    Open the practice signing pageSign-in needed
  5. Switch to the Verify tab, add the file you just downloaded, and select “Verify uploaded file.”
    What you should see The signature information you just attached appears in the check result. A passing result reads “c2patool verify PASS — manifest embedded, signature and hash valid.”
    Open the Verify tabSign-in needed
  6. Look at the results and write “what was confirmed” and “what was not confirmed” separately. For example: confirmed = the signer, and no change since signing. Not confirmed = whether the scene is true.
    What you should see Each of the two boxes holds at least two items.
    No sign-in
The part you do with your mentor · Your PKI mentor explains why a real signing key sits in a dedicated security device (an HSM), and what happens if a key is lost.

Check your work

If you can answer “yes” to everything below, you have finished this chapter.
  • Can you say who holds the secret key and who holds the public key?
  • Can you explain the difference between “The signature is valid and nothing changed after signing” and “This file has no C2PA record”?
  • Have you written “what was confirmed” and “what was not confirmed” separately?

Easy to mix up

  • Common misunderstandingIf the signature is valid, the scene in the photo is true too.
    What is actually trueA signature only tells you who signed and that nothing changed afterwards. Whether the scene is true has to be checked separately.
  • Common misunderstanding“No C2PA record” means someone tampered with the file.
    What is actually trueIt only means there is no signature. The file may never have been signed, or the signature may have been wiped on its way to you.
  • Common misunderstandingWith just the public key, you can sign in someone else's name.
    What is actually trueOnly the secret key can make a signature. The public key can only check one.

Review questions

  1. Question 1Which key do you use to make a signature?Show answerHide answer
    The secret key (private key). To check a signature, you use the public key.
  2. Question 2A check says “The signature is valid and nothing changed after signing.” What can and can't you learn from that result?Show answerHide answer
    You can learn who signed and that the file has not changed since. You cannot learn whether the content is true.
  3. Question 3Why is a real signing key kept in a dedicated security device (an HSM)?Show answerHide answer
    If the secret key leaks, anyone can sign in that name.

Key terms

Digital signature
A mark made with a secret key. It tells you who signed and whether the file has changed.
Private key
The secret key that only the signer holds.
Public key
A key anyone can see. It is used to check a signature.
Integrity
The quality of a file not having changed since it was signed.
HSMhardware security module
A dedicated security device that keeps a secret key safe.

Practice log

Print it and write by hand, or copy the same items into a document. Once your mentor has checked it, you are done.
Chapter 4 practice logA signature tells you who made it
Practice date
Written by
Mentor check
  1. The result for “Signed sample” (result sentence, signed by, trust list)
  2. The result for “Photo with no record”
  3. Practice signing, then download, then the check result
  4. What was confirmed (two or more)
  5. What was not confirmed (two or more)
  6. A short summary of the HSM explanation from your mentor