Apple has published a detailed explanation of how Apple Reference Image works on iPhone 18 Pro and iPhone 18 Pro Max. The opt-in camera mode is designed to make a photo verifiable as a capture from an iPhone sensor at a specific time.
Apple says Reference Image starts with the supported Main camera sensor, not every camera on the phone. The feature reboots that sensor into its reference-capture mode, where the sensor signs the pixel data and embedded metadata. Apple says the Secure Enclave signs certain information that originates outside the sensor, such as camera-system metadata.
The company also describes two timestamp tokens, one obtained before capture and another after it, to create a verifiable time window. These are implementation details from Apple, rather than independent certification of the system. Apple’s paper is the authoritative source for what it says the mode does, its limitations and the security properties it intends to provide.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
In a new Security Research post, Apple says the camera sensor signs pixel data immediately after capture in a specialized mode. The system then creates what Apple calls a secure digital negative, including signed sensor information and cryptographic time bounds.
When a user develops that negative into a Reference Image, Apple says the processing runs in Private Cloud Compute. Apple says its design is intended to protect the image contents from Apple itself, prevent public links between photos from the same device, and allow fraudulent images or a compromised sensor to be revoked. The final reference image uses a combined classical and post-quantum signature, according to Apple.
This does not mean every photograph is automatically true in every sense. The feature is Apple’s technical claim about provenance: that a Reference Image corresponds to what the supported sensor captured. Our earlier explainer covers who the feature may help, while our availability coverage details its regional limits.
Discussion