Watermarks were discussed in an earlier post as a method of authenticating video images or showing that image alteration has occurred.  Watermarks come with limitations.  A more commonly used method for authenticating digital images is the use of digital signatures whereby digital signatures are generated in an authentication system and stored on a media separate from the digital video evidence that would provide a means of proving digital video authenticity and simultaneously preserving the digital video in an unaltered state.^[i]  One advantage of this approach is that it avoids the superimposition of a watermark.

Beser, N.D., Duerr, T.E., and Staisiunas, G.P. describe digital signatures as follows:

…they provide a method of proving the integrity of binary data based on asymmetric cryptography involving key pairs called public and private keys, where a key is a bit string that is used to encrypt and decrypt data.  The key pairs have the properties that computation of the private key is intractable, even with knowledge of the public key.  Any binary data, such as a DV frame, can be algorithmically combined with a private key to produce a digital signature.  Subsequently, the original data, the digital signature, and the appropriate public key can be combined to prove that the data are unchanged (or, conversely, that the data have been changed).  The digital signature has the properties that it cannot be inverted to derive the original information, and the probability of any two DV frames yielding the same digital signature is extremely remote.

The American Bar Association, in its Digital Signature Guidelines^[ii] describes digital signatures as using public key cryptography and a “hash function” derived from the message itself.  The hash function is an algorithm created from enough of the message data to ensure that it could only be created from those data.  The message and the hash function are then encrypted with the sender’s private encryption key to make a digital signature that is unique.  The receiver decodes the message with a related version of the encryption key previously given to the intended recipient by the sender (or held by a trusted third party).  The message is verified by computing the hash function again and comparing it with the original.

The Canada Evidence Act does not mandate the use of “secure electronic signatures” as part of an authentication scheme.  Section 31.4 allows the Governor in Council to make regulations establishing evidentiary presumptions in respect of such authentication schemes.  Such regulations, entitled the Secure Electronic Signature Regulations, were enacted on February 1, 2005.  Section 2 of the Regulations provides that in order to constitute a “secure electronic signature” such a signature must be a digital signature that results from the completion of a series of listed consecutive operations.  These operations include the following:

• the application of a hash function to the data to generate a message digest
• the application of a private key to encrypt the message digest
• the encrypted message digest must be incorporated in, attached to, or associated with the electronic document
• the electronic document and encrypted message digest must be transmitted with a digital signature certificate or a means of access to the certificate
• after receipt of the electronic document, the encrypted message digest and the digital signature certificate or the means of access to the certificate, the public key contained in the digital signature certificate must be applied to decrypt the encrypted message digest
• a hash function must then be applied to the data contained in the electronic document to generate a new message digest
• there must be verification that the original message digest is identical to the decrypted message digest
• the digital signature certificate must be verified as valid

Because “electronic documents” are defined as including digital video, these Regulations are applicable.

In forensic video analysis, freeware programs such as MD5 Summer and Quickhash are used for authentication purposes.  These programs allow an analyst to generate a hash value for a file or set of files.  After copying, a further hash value is generated.  Provided those hashes match, there is a high statistical probability that the copy is accurate.  While the MD5 and SHA-1 algorithm has been broken in a laboratory setting, the practical application of these programs has remained sound.

Digital signatures are an attractive method of image authentication.  Forensic video analysts should be acquiring the digital signature of the media that is received, copy it and then ensure, via digital signature, that the copy to be analyzed is a faithful replication of the media first received.  For a digital signature system to be most effective at ensuring image authentication, the signatures should be created in real time as the digital video is recorded.

[i] Beser, N.D., Duerr, T.E., and Staisiunas, G.P., Authentication of digital video evidence, presented at SPIE Applications of Digital Image Processing XXVI, San Diego, Ca., August 3-8, 2003.

[ii] http://www.abanet.org/scitech/ec/isc/ds-ms.txt