Cryptographic boundaries

What a valid Shuttermark proof actually means.

A valid Shuttermark photo chains to a Google hardware attestation root pinned by SPKI. The certificate in the file is never used as the trust anchor. Device clocks are claimed capture time only. A server attestation is a Shuttermark receipt time. Local signed capture continues even when cloud allowances are exhausted.

Inspect trust architecture Verify a photo

Hardware root Google StrongBox / TEE SPKI SHA-256 pinned

Signature ECDSA (secp256r1) Non-exportable hardware key

Proof envelope XMP in the JPEG Original bytes are hashed

Time Two clocks Device claim + server receipt

First principles

The 5 foundational trust axioms

Cryptographic guarantees require a strict definition of what hardware isolates and where assumptions end.

Private keys never leave secure hardware

Android Keystore StrongBox or TEE controls the signing key. It is non-exportable.

Tied to original JPEG bytes

Verification hashes the original bytes. A one-bit change fails the signature.

Independently checked against root anchors

Verifiers pin Google hardware root SPKIs. Certificates shipped in the file are never the trust anchor.

Server attestation vs claimed capture

The device clock is claimed capture time. A server attestation is a receipt that the bytes existed by that instant.

What we intentionally do not claim

We guarantee byte integrity and device attestation at the hardware root we pin. We do not claim optical truth, scene context, or judicial notarization.

Demarcation

What it proves vs what it does not prove

Shuttermark enforces verifiable statements. It does not detect “truth.”

What Shuttermark proves

JPEG matches the signed bytes
Re-compression, metadata stripping, or pixel edits break validation.
Hardware-backed key
Private keys are generated in StrongBox or TEE.
App and device attestation
Attestation includes application identity and hardware security level, checked against Google roots.
Independent chain check
Verification does not require Shuttermark cloud services to be online for the cryptographic checks.
Optional server receipt
If notarized, a receipt time means the photo existed no later than that instant.

What it does not prove

Physical scene truthfulness
A signed photo of a screen or a staged scene is still a signed photo.
Perfect GNSS
Location is a device claim and can drift indoors or under reflection.
Trusted device clock
Offline capture time is claimed until a server receipt exists.
A notary or court judgment
This is evidence for a human reviewer, not a licensed notarial act.

Inside the file

JPEG and proof envelope

Provenance sits in the JPEG so ordinary viewers still open the picture. The signature covers the original bytes; the envelope is not the trust anchor.

Start of image

Standard JPEG SOI.

Proof envelope Proof envelope

XMP carries hashes, attestation material, and signature bytes.

EXIF / other metadata

Claimed sensor and time attributes — not independently trusted.

Compressed image data

The pixels you captured. Included in the hashed original.

End of image

Standard JPEG EOI.

Field reliability

Resilience in the field

Offline local signing

Signing happens on the device. Cellular access is not required to produce a signed original.

Burst capture can still be signed locally
Keys stay in Keystore memory
No deferred upload is required to lock bytes

Eviction-free allowances

Published cloud limits govern backup and receipts. They never delete or invalidate signatures already in local JPEGs.

Signatures stay in the local files
Unpaid plans do not retroactively wipe proof
A recipient can still verify the original later

Check a file

Have an evidence photo to test?

Use the public verifier for a real certificate-chain and hash check. This page does not upload your file.

Verify a photo

Use the public verifier for a real certificate-chain and hash check. This page does not upload your file.