Proof of Provenance

In the coming year, in a coalition of Dutch partners Waag will be working on the Proof of Provenance project. We'll explain what the project is about in five questions.

What is Proof of Provenance?
The Proof of Provenance project investigates how online media expressions can be provided with proof of authenticity. Its name is borrowed from the art world, where it describes the ownership of works of art through time. In the context of Waag's research, however, it is not a question of demonstrating ownership or ancestry, but of confirming that media is authentic with provable attributes of the sender. A characteristic of authenticity is not necessarily traceable to a person. In addition, an important aspect of Proof of Provenance is that it is not used to prove whether information is correct, but only that the source is authentic in some way.

How can it be used?
A system such as Proof of Provenance is in many cases conditional for a proper functioning of the digital 'public space'. It can be used in the form of a digital signature to make participants/authors show that they have certain characteristics, without revealing an exact identity. An example is a forum where girls with anorexia talk to each other anonymously. In order to prevent someone with a different motive from interfering in the conversation, one could demand characteristics of the participants: female, age under 16 years, and possibly an anorexia diagnosis. These characteristics are confirmed through Proof of Provenance by specific authorities in these areas. In this case, this could be the resident registration service, and a doctor. Other uses of Proof of Provenance include an employer indicating that an author is employed by the company, or a ticket seller confirming that a buyer is the rightful owner of a ticket.

Are there comparable systems?
Currently, commercial services such as DocuSign are often used for media signing. However, when using these types of services, there is a risk of data leaks. After all, they involves central management of personal data. In doing so, one relies on a single party for arranging a registration. Another resource that is currently much discussed is non-fungible token (NFT). However, NFT is only a way of demonstrating ownership. NFT could also be used to demonstrate authenticity, but the way in which NFT uses blockchain is an excess. It is not necessary to publicly show on blockchain that media has been signed. It is only a question of the person consulting the media to see that it has been signed.

What are the technical challenges?
No personal data is stored with Proof of Provenance. However, key management is required, whereby cryptographic keys of specific ‘authorities’ must be findable, for signing and for verification of that signature. The IRMA infrastructure and technology will be used within the project. IRMA (I Reveal My Attributes) of the Privacy by Design foundation is an identity platform that enables users to reveal personal properties (attributes) in a secure manner.

What is the scope of the project?
The project has set the first goal that the partners can sign their own content with Proof of Provenance, limited for the time being to browser-based consumption - for example, a blog with a video.