Security and threat model

What the seal is built from

• Fingerprints: SHA-256 of the original file and of the stamped copy, streamed over every byte.
• Signature: ECDSA P-256 with SHA-256 over the exact bytes of manifest.json, DER-encoded in manifest.sig.
• Key: generated inside the phone’s secure hardware (the Secure Enclave on iPhone; StrongBox or the TEE on Android) and never exported. Where no secure hardware is available, such as a simulator or emulator, a software key is used, and the record says hardwareBacked: false.
• Time: the device clock, plus an offset measured against a well-known HTTPS server’s clock shortly before capture. Offline captures are labelled “Device clock”.
• Verification: standard WebCrypto in the browser, the platform’s crypto libraries in the app, or OpenSSL. No CaptureSeal server is needed to verify.

Attacks the seal detects

Known limits

Staged scenes and photographed screens

The seal records what the camera saw. A photo of a screen, a printout or a staged scene is a genuine capture of a fake. CaptureSeal can’t judge content.

Modified or jailbroken devices

A device under an attacker’s full control can feed false GPS fixes or a false clock to any app. Network-time checks catch a changed clock on a normal device, but not a device that intercepts its own network traffic.

Key attestation

Records don’t yet carry platform attestation (App Attest on iPhone; Key Attestation or Play Integrity on Android), so a signature proves which key signed, not that the key belongs to an unmodified CaptureSeal install. Someone could write their own program to sign convincing-looking records with their own key. The key ID shown on each record is how you tell devices apart. Binding keys to genuine installs is on the roadmap.

Who held the phone

The key identifies a device, not a person. Anyone using the phone can make captures with its key.

Time precision

The network-time check uses an HTTPS server’s Date header, which has one-second resolution, and is accurate to about a second. It isn’t a trusted timestamping authority (RFC 3161).

Verify links are bound to the capturing key

Capture IDs are printed in QR codes, so they aren’t secret, and anyone can sign a record under any ID with a key of their own. The server therefore stores records per (capture ID, key ID), and a capture’s QR code and verify links carry its key ID in the fragment: #<original SHA-256>.<key ID>. The verify page shows only the record signed by that key. If that key hasn’t published, the page says so instead of showing anyone else’s record. A bare link with no key, when several records exist, lists them all with their key IDs and asks the visitor to trust only the sender’s. Withdrawing a record affects only the record whose key signed the request.

The binding is only as strong as the link you were given: someone who controls the message can send you a link that names their own key. Compare the key ID with one you already trust from the same person when it matters.

Verify it yourself with OpenSSL

# 0. A Proof File is a standard zip inside: unpack it (or use the separate demo files)
unzip "CaptureSeal F1E33C32.seal" -d proof && cd proof
# 1. Rebuild the public key from the record (or use key.pem from the package)
KEY=$(python3 -c 'import json,sys; print(json.load(open(sys.argv[1]))["signing"]["publicKey"])' manifest.json)
{ printf '3059301306072a8648ce3d020106082a8648ce3d030107034200' | xxd -r -p; printf '%s' "$KEY" | base64 -d; } \
  | openssl pkey -pubin -inform DER -out key.pem

# 2. Check the signature over the exact bytes of manifest.json
openssl dgst -sha256 -verify key.pem -signature manifest.sig manifest.json
#    → Verified OK

# 3. Check the key ID shown on the stamp's verify page
printf '%s' "$KEY" | base64 -d | openssl dgst -sha256 -r | cut -c1-16 | tr a-f A-F

# 4. Compare the media's fingerprint with "sha256" in manifest.json
#    (the stamped copy is under "sealed", the untouched original under "original")
shasum -a 256 *.jpg

Privacy by design

Media never leaves the phone unless you share it. Publishing a verify link uploads only the signed record, which you can withdraw at any time. Withdrawal wipes the record and keeps only a tombstone so the ID can’t be reused. Verify pages aren’t indexed by search engines. See the privacy policy.

Reporting a vulnerability

Email support@techynar.com with “Security” in the subject. Please give us 90 days to fix an issue before publishing, and don’t access other people’s records. We’ll acknowledge reports within three working days.