Apple Reference Image signs photos inside the sensor

Apple published the technical design of Reference Image on September 15, 2026, and the detail that matters is where the signing happens. The camera sensor itself signs the pixel data, not the software that develops it. That changes what a photo can prove, and it puts a 30-day clock on the file that holds the proof.

The feature was announced a week earlier, on September 9. Apple's security blog is the first document to explain the mechanism.

How the signing chain works

Reference Image is opt-in, and MacRumors reports that the user turns it on by shooting in a separate reference mode. It runs on the iPhone 18 Pro and iPhone 18 Pro Max only.

In that mode, the main camera sensor signs the pixel data it captured, immediately after capture. Apple's post says the sensor and the Secure Enclave both sign using ECDSA P-256, a standard elliptic-curve signature. Hashes are SHA-256.

The outer signature is unusual. Apple pairs ML-DSA-87, a post-quantum signature algorithm, with RSA-3072 in one composite signature. A composite means both must verify. That is a hedge: if one algorithm is broken later, the other still holds.

Private Cloud Compute then develops the signed sensor data into a viewable picture. Developing means demosaicing, tone mapping and compression, the steps that turn raw sensor output into a normal photo. Apple runs those steps in its server environment rather than on the phone, and says the code is publicly inspectable, with production builds recorded in tamper-proof transparency logs.

What lands on the device is a secure digital negative, in the DNG raw format. It holds the pixels, the metadata and the timestamps, and it is linked to the ordinary photo you shot.

The limits Apple states itself

Four constraints in Apple's own description decide whether this is usable for a given job.

Item	What Apple says
Devices	iPhone 18 Pro and iPhone 18 Pro Max, opt-in reference mode
Negative format	DNG, stored on device, linked to the processed photo
Retention	Moved to deleted photos after 30 days
Timestamp	Needs network connectivity, on a 15-minute average heartbeat

The retention window is the one to plan around. A secure negative is not a permanent archive. After 30 days it moves to deleted photos on its own, so anyone who needs the proof later has to copy it somewhere else first.

The timestamp is also not free-standing. Apple bounds it using network connectivity with a heartbeat that averages 15 minutes, which means an offline camera cannot produce the same time guarantee.

Availability is split by region. MacRumors reports the feature is unavailable in China for regulatory reasons. In the European Union, capture is unavailable at launch, though users there can still develop and view existing reference images on iOS 27, iPadOS 27 and macOS 27. Those are the releases that shipped on September 14.

What this means for developers

If you build anything that ingests photos, the practical question is whether you can read these files at all. MacRumors reports Apple is opening APIs across iOS 27, iPadOS 27 and macOS 27 so third-party apps can display reference images. TechCrunch described the reference image as initially viewable only inside Apple's own Photos app while also reporting that developer APIs are coming. Treat the exact API surface as unsettled until you read Apple's documentation.

Plan your storage around the 30-day expiry, not around the photo. If your product makes a provenance claim on a user's behalf, copying the DNG negative out of the photo library is the step that preserves it. A pipeline that keeps only the processed JPEG keeps the picture and loses the proof.

Do not assume this maps onto a standard you already support. The sources read for this article name no C2PA integration, and they describe no public verification tool outside Apple's apps. Apple has said SynthID support is coming in a software update later in 2026, per MacRumors, which is a detection signal for AI-generated content rather than a capture signature. Those two things answer different questions.

Test the offline path deliberately. Because the timestamp depends on a network heartbeat, a user shooting in a basement, on a plane or in the field is a case your error handling has to cover. The same goes for EU users, who can hold and view a negative but cannot make one at launch.

This site flagged the mechanism as an open question when Apple announced the iPhone 18 Pro on September 9. The answer is a sensor-level signature, developed in Private Cloud Compute, rather than a metadata tag added after the fact.