Privacy Policy|How it works

How It Works - Cryptography Behind Content Proof

Introduction

Content Proof uses state-of-the-art cryptographic techniques to ensure the authenticity and integrity of your digital files. This page explains the technical foundation of our service in an accessible way.

Digital Signatures Overview

What Are Digital Signatures?

Digital signatures are mathematical schemes that provide:

Think of a digital signature like a tamper-evident seal on a package, but mathematically unbreakable.

How They Differ from Encryption

Digital Signatures Encryption
Prove authenticity Hide information
Anyone can verify Only intended recipient can read
Detect tampering Prevent unauthorized access
Public verification Private communication

The Ed25519 Algorithm

Why Ed25519?

Content Proof uses Ed25519, a modern elliptic curve digital signature algorithm that offers:

Security Benefits:

Performance Benefits:

Simplicity Benefits:

Ed25519 vs Other Algorithms

Algorithm Signature Size Security Level Speed
Ed25519 64 bytes High Very Fast
RSA-2048 256 bytes Medium Slow
ECDSA P-256 64 bytes High Fast
RSA-4096 512 bytes High Very Slow

SHA-256 File Hashing

What Is a Hash Function?

A cryptographic hash function takes any amount of data and produces a fixed-size "fingerprint" (hash). SHA-256 produces a 256-bit (32-byte) hash that:

Hash Properties in Action

Original file: "Hello, World!"
SHA-256 hash: dffd6021bb2bd5b0af676290809ec3a53191dd81c7f70a4b28688a362182986f

Modified file: "Hello, World?"  (just changed ! to ?)
SHA-256 hash: f5ca38f748a1d6eaf726b8a42fb575c3c71f1864a8143301782de13da2d9202b

Notice how a single character change completely changes the hash.

File Fingerprinting Process

  1. File Upload: Your file is read in your browser
  2. Chunk Processing: Large files are processed in small chunks to maintain performance
  3. Hash Calculation: SHA-256 algorithm processes every byte of your file
  4. Fingerprint Creation: Results in a unique 64-character hexadecimal string

The Signing Process

Step-by-Step Breakdown

  1. File Hashing

    File → SHA-256 → Hash (e.g., "abc123...def789")

  2. Message Construction

    Message = FileHash + ":" + GmailAddress + ":" + Timestamp
Example: "abc123...def789:user@gmail.com:1640995200000"

  3. Signature Generation

    Signature = Ed25519_Sign(PrivateKey, Message)

  4. Package Creation

    SignaturePackage = {
  signature: "base64-encoded-signature",
  publicKey: "base64-encoded-public-key", 
  timestamp: 1640995200000
}

Why This Design?

Including the hash: Ensures the signature is tied to the specific file content Including the email: Cryptographically binds the signature to the signer's identity
Including the timestamp: Prevents replay attacks and provides chronological proof Using colons: Creates unambiguous message structure

The Verification Process

Cryptographic Verification Steps

  1. Signature Decoding

    • Extract signature data from QR code or manual input
    • Decode base64-encoded components

  2. Message Reconstruction

    • Calculate SHA-256 hash of the uploaded file
    • Reconstruct the original signed message: hash:email:timestamp

  3. Mathematical Verification

    • Use Ed25519 verification algorithm
    • Check if signature was created with the private key corresponding to the public key
    • Verify against the reconstructed message

  4. Result Interpretation

    • ✅ Valid: Signature mathematically correct, file unchanged
    • ❌ Invalid: File modified, signature corrupted, or wrong signer

The Mathematics Behind Verification

Ed25519 uses elliptic curve mathematics. Without diving into complex math:

  1. Key Pair Generation: Creates mathematically linked private and public keys
  2. Signing: Uses private key to create signature that proves ownership
  3. Verification: Uses public key to verify signature without revealing private key
If Verify(PublicKey, Message, Signature) = True:
    Then the holder of PrivateKey signed this exact Message
    And the Message has not been modified since signing

Security Model

What We Protect Against

File Tampering

Identity Spoofing

Replay Attacks

Man-in-the-Middle Attacks

Security Assumptions

Our security model assumes:

What We Don't Protect Against

Social Engineering

Quantum Computing (Future)

Legal Disputes

Key Management

Our Key Infrastructure

Server-Side Keys

Key Rotation Strategy

Emergency Procedures

Client-Side Security

Browser Requirements

Local Processing

Interactive Examples

Hash Calculator Demo

Try changing the input text and watch how the hash changes:

Input: [                    ]
SHA-256: [calculating...]

Note: This would be an interactive component on the actual page

Signature Visualization

Here's how a signature looks in different formats:

Raw Signature (Binary)

[64 bytes of binary data - not human readable]

Base64 Encoded

MEUCIQDKyP4VbG8W3X4YZQ7xK5XbVR2pL9mN8zF6wE3QqR7vTgIgH8mPx2nF5C1A6bK9wY2vZ3jE4rS8tU0qW7cX1dN5oGk=

QR Code Content

https://contentproof.app/verify?data=eyJzaWduYXR1cmUiOi...

Comparison with Other Solutions

Content Proof vs C2PA

Feature Content Proof C2PA
Cost Free with Gmail $250+ annually
Setup Instant OAuth Business verification required
Trust Model Gmail identity Certificate authorities
Metadata Survives stripping Often lost in processing
Verification QR code scanning Specialized tools

Content Proof vs Blockchain

Feature Content Proof Blockchain Solutions
Speed Instant Minutes to hours
Cost Free Gas fees required
Environmental Impact Minimal High energy usage
Scalability High Limited throughput
User Experience Simple Complex wallet management

Performance Characteristics

Signing Performance

Verification Performance

Scalability

Current system can handle:

Future Cryptographic Enhancements

Post-Quantum Cryptography

We're monitoring developments in quantum-resistant algorithms:

Advanced Features in Development

Multi-Signature Support

Zero-Knowledge Proofs

Blockchain Integration

Technical Resources

Standards and Specifications

Open Source Libraries

Our implementation uses well-audited libraries:

Security Audits

For technical questions about our cryptographic implementation, contact: crypto@contentproof.app