Adding a digital signature, backed by Apple’s cloud service, is supposed to give you confidence that the final photo is legitimate. But how can you be sure the signature is legitimate?
Apple points out that someone could, in theory, replace or modify a camera image before it is marked as authentic. Reference Image mode is designed to protect against this by adding its first digital signature inside the camera sensor itself.
The sensor has its own private cryptographic key, which is generated when the phone is manufactured and kept inside, to create a signature linked to the image data it captures. It is a digital tamper-evident seal. No other phone has this key, and if anyone else changes the data, it will no longer pass signature check. Apple certifies the corresponding public key during manufacturing so that its cloud service can verify the sensor signature.
Reference mode is optional for the main camera of the iPhone 18 Pro or Pro Max, so it will not be activated by default. To turn it on you will need to press Settings > Camera > Reference Imagethen touch Add a reference modebefore following the on-screen instructions. To use it, open your camera, then swipe to select Reference mode. When you take a photo while it’s on, the camera’s sensor converts the light it captures into digital image data and signs it using its own unique cryptographic key. This mode also prevents the sensor firmware from modifying the captured data (again, unlikely, but covering another potential attack area).
During manufacturing, Apple records which camera sensor belongs to which phone. The phone’s sensor and security processor each have their own digital key, which they use to sign portions of the capture record for each photo. Apple’s cloud service then verifies these signatures and confirms that the sensor and security processor go hand in hand. This is designed, in theory, as a safeguard to prevent someone from removing a real sensor and using it elsewhere to pass off fake photos.
Evidence is stored in a popular RAW format called a digital negative or DNG. It is linked to the final photo produced by your camera. Before development, you can keep it indefinitely or share it for someone else to develop later. You’ll see both in the Photos app to compare and contrast. After developing, the negative is moved to your deleted photos folder and is automatically deleted after 30 days unless you recover it.
