验证
申请证书
XENLOOK C2PA验证

试点·C2PA 审核中 · 韩国 2027.03 · 日本 2027.06 · 模范法为韩国法

版权 C-2026-036487 · 专利申请 10-2026-0100026（尚未注册）

法律与政策 →
Course contents
Chapter 8 of 10

Chapter 8How other people check your file

Anyone who receives a file can look up its certificate by serial number, without logging in. In this chapter you look one up yourself, then see what the check says when a file has been changed a little.

  • Official session name · Public certificate verification and documenting the verification results
  • 6 practice steps
  • You can follow along without signing in
What you will learn in this chapter
  • You can look up a certificate publicly by its serial number.
  • You can tell apart the results you get after a file is changed (no record / integrity failure).
  • You can sort a certificate check into “what was confirmed” and “what was not confirmed.”

The idea in plain words

Like looking up a payment by the number on a receipt
If you give the card company the number at the bottom of a receipt, it can tell you whether the payment really happened. It cannot tell you whether what you bought was any good. A certificate lookup likewise tells you only “is there an issuance record, and is the file unchanged.”

A third party checks in two ways: looking up the issuance record by serial number, and opening the file itself in a C2PA verifier.

A public lookup shows three results separately: whether it is in the issuance record (registry match), whether the file is unchanged (integrity), and whether the signing authority is on the official list (trust level). The technical score is shown too, but it is not part of the verification result.

If you change a file in an editing app and save it again, the whole C2PA record is usually wiped and you get “This file has no C2PA record” (no record). That is not proof of tampering; it means the record is gone.

If the record is still there but the file's content changed a little, you get “This file changed after it was signed” (integrity failure). It means something changed after signing.

What can be confirmed: the issuance record, whether the file changed after signing, and the signer with the tool and time recorded. What cannot: whether the content is true, what happened before it was signed, and where a file came from once its record is wiped.

See the picture

  1. Serial lookuppublic verify page
  2. Registry matchis it in the record?
  3. Integrityis the file unchanged?
  4. Trust levelis it on the official list?
The three results are independent. One can be right while another is wrong.

Try it yourself

Work from the top, one step at a time. After each step, check that your screen matches “What you should see.”
  1. On the public verify page, look up the demo serial number XPC-2026-000001-D4A644D8.
    What you should see The registry matches but the integrity does not, so you get “Verification FAIL / partial.” The technical score is A+ and the trust level is pilot (not on the Trust List).
    Look up the demo serialNo sign-in
  2. On the same page, enter the SAMPLE serial (XPC-DEMO-…) you wrote down in chapter 2 and press “Verify.”
    What you should see You get “This number is not in the issuance registry.” That is expected, because SAMPLE certificates are not registered.
    Open public verificationNo sign-in
  3. Download the signed sample video, trim a little off the start in an editing app and save it again. Then put it into the verify page.
    What you should see Most of the time you get “This file has no C2PA record,” because the editing app wiped the record when it saved again.
    Download the sample videoOpen the verify pageNo sign-in
  4. In the same box, select “Sample with 1 byte changed.” It is a copy that keeps the record but has one byte of content changed.
    What you should see You get “This file changed after it was signed.” Change a single byte and the fingerprint no longer matches, so it shows at once.
    No sign-in
  5. In the same box, select “Sample with an outside ingredient.” Write down the result exactly, and ask your mentor why it came out that way.
    What you should see You get “This file's signature is valid, but an ingredient record has a problem.” It is a hard case that mixes an ingredient signed by someone else with an expired certificate.
    No sign-inWith your mentor
  6. Write your certificate check summary. For each number and file you checked, write “what was confirmed” and “what was not confirmed” separately.
    What you should see Both columns are filled for every result, and the technical score is written down on its own.
    No sign-in
The part you do with your mentor · You see an integrity failure with the “Sample with 1 byte changed” on the verify page. Files under review and evidence are never changed; this is done only on practice copies. Your mentor walks you through why the ingredient record is a problem.

Check your work

If you can answer “yes” to everything below, you have finished this chapter.
  • Can you tell apart the three results of a public lookup (registry, integrity, trust level)?
  • Can you explain the difference between “no record” and “integrity failure”?
  • Did you write your certificate check summary?

Easy to mix up

  • Common misunderstandingIf you see an A+, the check passed too.
    What is actually trueAs with the demo serial, a file can show A+ and still FAIL verification. The score, the verification result and the trust level are separate things.
  • Common misunderstandingIf an edited file has no C2PA record, someone tampered with it.
    What is actually trueMost of the time the editing app wiped the record when it saved again. This result alone cannot tell you whether anyone tampered with it.
  • Common misunderstandingIf the lookup finds no such number, the certificate is forged.
    What is actually trueIt may be a number that was never registered in the first place, like a SAMPLE. You can only say “no registration record.”

Review questions

  1. Question 1What are the three results you read separately in a public lookup?Show answerHide answer
    Registry match (the issuance record), integrity (whether the file is unchanged) and trust level (whether it is on the official list).
  2. Question 2What do “no record” and “integrity failure” each mean?Show answerHide answer
    No record means there is no C2PA record at all. Integrity failure means there is a record, but the file changed after signing.
  3. Question 3Name two things a certificate lookup cannot confirm.Show answerHide answer
    Whether the content is true, and what happened before it was signed.

Key terms

Third-party verification
Someone other than the maker checking where a file came from.
Registry match
The serial number is in the issuance record.
Integrity failure
The file changed after signing, or the signature is damaged.
Ingredient
Another file used to make this one. Its record can be carried inside too.

Practice log

Print it and write by hand, or copy the same items into a document. Once your mentor has checked it, you are done.
Chapter 8 practice logHow other people check your file
Practice date
Written by
Mentor check
  1. The demo serial lookup result (registry, integrity, technical score, trust level)
  2. The SAMPLE serial lookup result
  3. The verification result of the video you edited and saved again
  4. The result for “Sample with 1 byte changed”
  5. The result for “Sample with an outside ingredient” and your mentor's explanation
  6. Your certificate check summary (confirmed / not confirmed)