A Record Built to Outlive You

The record is more fragile than the work

An artwork is a durable object attached to a fragile record. The object can last for centuries. The evidence that it is what it is said to be, made by whom, in what year, and passing through which hands, lives in papers, websites, databases and the memory of people, and every one of those is shorter lived than a sheet of film or a stretched canvas. In four decades of making analogue photographs I have watched the records of artists I knew disappear when a gallery closed, a website lapsed or a domain passed into other hands. The works survived. What they could prove about themselves did not.

ArtFirma is my answer to that problem, built with the developer Sergey Evstegneev of 123Automate, and it launches this month. It began as a tag system I announced in the studio journal five years ago [15], and what launches now is that idea fully formed as a public offering. It is a small red seal carrying an NFC chip, fixed to the frame, mount or stretcher of an artwork and signed by the artist with a key that only the artist holds. A collector holds a phone against the seal and the signature is checked in seconds, with no app and no account, and without needing ArtFirma itself to still exist.

This paper explains why I built it, how it works, what it does not claim, and what it asks of artists, galleries, estates and museums. I am launching it as an artist because the problem belongs to the artist long before it belongs to anyone else, and because the people who inherit an artist's work will one day have to answer a simple question: what, exactly, is this?

The argument behind it is not new to me. I have made it in the studio journal: “Provenance allows an artwork to retain memory.” [16] ArtFirma is the working form of that sentence. It does not try to hold a work's whole biography. It fixes the one thing every other record depends on, which is what the object is and who declared it, in a form that can outlast the people and services that held the rest.

What authenticity has always depended on

Walter Benjamin tied the authenticity of a work to everything transmissible about it from its origin: its physical condition over the years and the changes in its ownership. He observed that the second of these survives only as tradition, a testimony carried from hand to hand [1]. Almost a century later that is still how provenance works. A signature, a dealer's stock number, a label on a stretcher, an exhibition history, a certificate, a catalogue raisonné: each is a witness, and each witness belongs to someone who must still be present, solvent and willing to speak.

Photography sharpens the problem. In the studio journal I wrote: “A photograph can appear complete while much of its history remains invisible.” [16] The image tells us what was recorded. It does not necessarily tell us which object we are holding, when it was printed, by whom, or where it has been. The chain I described there, taking the Museum of Modern Art's record for Moholy-Nagy's EM 2 (Telephone Picture) as its example, runs from artist to estate to collector to museum, and I added a sentence I still hold to: “A reliable record allows those distinctions to survive.” [16] Every link in that chain is a witness, and every witness has to be present when the question is finally asked.

The traditional answer has been the dealer's archive. In my guide to investing in fine art photography I set it out plainly: authentication begins with notations such as stamps, signature, title or date, and “dealers who represent photographers or their estates are likely to have access to primary source material that will be useful in verifying a work.” [21] On how many prints of an image exist, the same guide is candid: “Some photographers, or their estates, have good records of this information; for many, it does not exist.” [21]

The witnesses fail more often than we admit. In October 2011 the Andy Warhol Foundation announced that it would dissolve its Authentication Board, founded in 1995. The board cost about half a million dollars a year to run. It was the legal fees from lawsuits over rejected works, about seven million dollars in a single year, that made it untenable [2]. A body created to protect a legacy could no longer afford to defend its own judgements. In September 2013 a Long Island dealer pleaded guilty to selling more than sixty fakes to two New York galleries, passed as works by Rothko, Pollock, De Kooning and Motherwell. Collectors paid more than eighty million dollars for them [3]. In a market where the record is an assertion made by the seller, a convincing story is enough.

The advice I give collectors leans on the same fragile witnesses. In my long arc of value essay I told them to preserve “all correspondence and proof of purchase” and to “maintain clear documentation for future provenance transfers.” [18] In my archiving essay I wrote that maintaining detailed records of this kind “helps reinforce a work's authenticity and pedigree.” [19] It is sound advice, and it places the whole weight on a filing system. Of digital archives I wrote: “While digital files may seem permanent, they are subject to obsolescence as technologies shift.” [19] Hard drives, cloud services and USB devices, I added, “can fail unexpectedly.” [19] Value follows documentation. “The long-term value of a photograph,” I wrote, “arises from its material truth, its process, and the clarity of its documentation.” [18] Documentation is the part that can be lost.

Neither case is an argument against experts or against galleries. Both are arguments against a single point of failure. A foundation can close, a gallery can fall, a website can lapse, a dealer can be wrong or dishonest. When the record of a work depends on any one of them, it is only as durable as that one. What I wanted was a record that depends on none of them being kind, solvent or alive, and that includes the people who made the system I am about to describe.

I know the problem from the inside. In 2019, after decades of gallery, dealer and advisor relationships, I withdrew from all external representation in order to “regain control of my schedule, pricing, inventory, consignments, press, projects, and generally how my work is seen by the outside world.” [22] I summed up the result in one line: “Scarcity, direct involvement, and provenance now define both my practice and its legacy.” [22] An artist who works this way carries the record alone. Nobody else will keep it, so it has to be made by the artist, and made to last.

The pressure is rising. In the studio journal I wrote that “digital reproduction and AI-generated images become like nano-plastics seen just about everywhere.” [20] When images are everywhere and cost nothing, the object and the declared identity of the object are what stay scarce. A signed record fixed to the work is a modest answer to that, and it is one an artist can make today.

What the seal is, and what a tag proves

The seal is a small red adhesive, tamper proof tag with an NFC chip inside it, the kind of chip found in a contactless card. I fix it to the frame, the mount or the stretcher of a work, or to a provenance document kept with it, and never directly on the canvas or the sheet itself. The chip is an NXP NTAG 424 DNA [10]. It is a standard component that any NFC phone can read, which matters, because nothing special should be needed to ask a work what it is.

To sign a work, the artist installs the free ArtFirma app and creates twelve secret words. From those words the app derives a signing key using the Ed25519 signature scheme [8]. The key never leaves the artist's phone, and ArtFirma never receives the words, which is why not even ArtFirma can sign in an artist's name [4]. For each work the app builds a short record: the title, the size, a hash of the photograph and similar details. A fingerprint of that record is written to the chip, together with the artist's signature over three things: the chip's own identity, the work number and the fingerprint.

A tag therefore proves three things. It proves who signed it, because only the holder of the artist's key could have produced the signature. It proves what the work is, because the fingerprint matches one exact record, and changing a single letter of that record changes the fingerprint and makes the page report that the record differs. And it proves which chip it was made for, because a signature copied onto another chip fails when that chip reports a different identity. None of this depends on ArtFirma's servers. The proof is arithmetic that any copy of the verification page, or about ten lines of code, can repeat [4].

A fourth safeguard concerns copying. On every tap the chip raises a counter and writes a fresh code into the link, computed with a key that never leaves the chip [9, 10]. A link copied onto an ordinary sticker freezes the counter and the code, and the optional online check reports it as a copy. If that check ever disappears, the signature check still works and only this extra warning is lost [4]. The service holds only an encrypted chip code key for each artist, and that key can neither sign a work nor rewrite a tag [4, 5].

There are in fact three signatures in the chain, and only one of them speaks for the work. NXP signs each chip's serial number at the factory, which lets a reader confirm that the chip is a genuine NTAG 424 DNA [11]. ArtFirma signs the serial number when it issues a seal, and that mark is locked into the chip for ever. It says the chip came from us and adds nothing to the artist's signature [11]. The artist's signature is the one that matters, and the artist makes a second one over the published record, so that a copy of the registry can be checked without any tag at all [4, 11]. Even ArtFirma's list of the seals it has issued is published in signed batches on Arweave, where anyone can rebuild it and check the signature [11].

The collector's side is deliberately plain and simple. A phone held to the seal opens a page showing the artist's name, the work, its photograph and whether the signature holds. No account is needed, and nobody records who checks a work or where [5, 6]. The optional online check keeps only the chip's serial number, its latest counter and two timestamps [6]. I have published a worked example using one of my own works, Contact States, Film 137 to 151, with every step shown, from the record's fingerprint to the signature [4].

The reason to trust the record is that it asks for as little trust as possible, and every part of it can be examined. The signature scheme is a public standard, Ed25519, defined in RFC 8032 [8]. The chip's rolling code uses AES-CMAC, defined in RFC 4493 [9], on an NXP part whose security features are documented in its data sheet [10]. The way these are combined is written down in a specification with its own permanent identifier, so that anyone can build a verifier of their own [11]. When I announced my first NFC tags I set the goal as “a future-proof anti-counterfeit system with no third parties involved and no need to download a special app.” [15] I used stronger words then than I would use now, and the first system did not meet that goal, as I explain below. The published specification is how the goal is now made testable by people who owe me nothing.

I wrote that provenance “permits future viewers to distinguish assumption from evidence.” [16] The verification page is built on that distinction. It will take a record from any source, our registry, Arweave, a saved folder or a USB stick, and it accepts the record only if its bytes match the fingerprint signed on the tag. No source has to be trusted [4].

 

A published record never changes, which is what makes it evidence, and the registry refuses different bytes under the same artist key and work number [11]. What can grow is the file around it. The artist can add further photographs or video later as separate signed documents, which the specification calls leaves [11]. I wrote that “an installation photograph made twenty years after acquisition may appear mundane when it is taken,” and that “over time, these documents become evidence in the life of the object.” [16] A leaf lets the artist keep adding to the file in the same spirit, with signed photographs and video, without disturbing the record.

Five layers

I find it useful to think of the system in five layers, in the order I use across the archive: Archive, Structure, Artefact, Evidence and Artwork. The Archive holds the independent public copies. The Structure is the published specification and the verification page. The Artefact is the seal, the Evidence is the signed record, and the Artwork is the reason for all of them.

Key to the five layers

Archive

Independent public copies

Structure

Published specification and verification page

Artefact

Physical seal

Evidence

Signed record

Artwork

The work itself

Layer	What it holds	What keeps it checkable
Archive	Records and photographs on Arweave; page copies on Arweave and Zenodo; seal address on purl.org	ArtFirma can close; the records stay on Arweave and the seal address can be redirected to the archived page
Structure	The published specification and the verification page, one file that checks signatures offline	ArtFirma servers can go: any saved copy of the page, or about ten lines of code, repeats the check
Artefact	The seal: an NXP NTAG 424 DNA chip fixed to the frame, mount or stretcher, or to a provenance document	A lost or dead chip leaves the record and its signature, published by the artist, checkable without the tag
Evidence	The record: title, size, photo hash, its fingerprint, and the signature of the artist over chip and record	Change one letter of the record and the fingerprint no longer matches; the page reports that the record differs
Artwork	The work itself, and the declaration of the artist that this is the work the record describes	A seal can be moved to another object. Always compare the record and the photograph with the work itself.

The drawing shows what keeps a work checkable if one layer is lost. The last row is a reminder and not a guarantee. The work is the one layer that cannot vouch for itself, so the record and the photograph must always be compared with the object.

What a verified seal does not say

A verified seal is a signed declaration by the key holder, joined to a live reading of the chip. That is all it is. It is not an appraisal, an attribution, a valuation or proof of ownership, and ArtFirma does not examine or authenticate physical artworks [5, 6]. I state this early because a provenance tool that overstates itself is worse than none.

The most important limit is physical. A seal can be moved to another object. The safeguards in the chip make copying hard, but they cannot stop a genuine seal being peeled from one work and fixed to another. The answer is the oldest one there is: compare the recorded details and the photograph with the work in front of you [5, 6]. The seal replaces neither the expert eye nor the condition report. It gives both a fixed point to check against.

The other limits concern time. If an artist loses the twelve words, existing seals stay valid, but nobody can sign with that key again, ArtFirma included [5]. If a key is stolen, only its owner can revoke it. A revocation made through a website takes effect after thirty days, because a domain can lapse and be bought by someone else. A seal also carries no date, so works that were genuine but not seen online before a revocation should receive new seals under a new key [5]. A saved copy of the verification page, used offline, cannot know about a revocation made after it was saved [5].

Language matters as well. The catalogue wording we suggest is “Accompanied by an ArtFirma seal signed by the artist.” We ask that no one writes “authenticated by ArtFirma,” because we do not examine works [5].

Finally, the design does not ask anyone to trust that ArtFirma will last. If the service ever closes we will give at least six months' notice, and the signatures and the archived records remain checkable without us [6]. I would rather set out every limit myself than leave a registrar to discover one.

For artists

The app is free, on iPhone and Android. An artist registers with a name, a website or profile page where the signing key is confirmed, and the public key. No identity document, home address or phone number is asked for, and the twelve words never leave the phone [6]. A work is signed by sharing its public page to the app, which reads the page the way a visitor would, including pages marked up with schema.org VisualArtwork data, as the artwork pages on this site are [7]. A touch of the seal to the phone and a few taps later the work is sealed. It takes about a minute.

Editions are handled one seal to one print, because each seal is bound to its own chip and cannot be copied to another. I speak as an artist who stopped making them: “the absence of editions in my work, a position I embraced in 2013.” [20] In my practice that means “only one unique print and two artist proofs (each a different size and execution).” [21] A seal binds to a single object, so each of those objects can carry its own. For a unique work the seal is the identity of that one object. As I put it, “owning a one-of-one artwork is a definitive statement of appreciation for provenance, rarity, and authenticity,” [20] and the seal is how that statement becomes checkable. For an edition, trust is the whole currency. Photography carries “the myth of infinite reproducibility,” I wrote, “yet serious artists understand that printing above an edition statement would destroy trust overnight.” [17] Many artists will seal only their more valuable works, and that is sensible. Works already sold with a paper certificate can be sealed today, and the old certificate stays with the work: the seal adds to it and does not replace it [5].

Galleries and auction houses can sign for their artists with a key of their own, confirmed by the gallery's website. The page then reads “Signed by Gallery on behalf of the artist,” with the artist's name as the headline, so a buyer can see exactly who is speaking [5].

The client's privacy is protected by design. Collectors need no account to check a work, buyers' names are never requested or published, and ArtFirma does not track who checks a work or from where [6]. The data of the sale stays between the artist and the client. One consequence needs saying plainly. The record and photograph of each work are public, and thirty days after publication they are copied to a permanent public archive. Until then they can be withdrawn after a complaint. Once archived, a file cannot be deleted [6]. An artist should publish only what they are content to have permanently public.

There is no subscription and no commission on sales. The app, the registry and the verification page are free to use and free to check; the seal itself is what is sold [6]. For my own practice I place the seal on the frame or the mount, and when I deliver a print unframed I attach a designed provenance letter carrying the seal, in an envelope fixed to the back of the frame. The work is never touched by the adhesive.

For estates and heirs

The first thing an estate needs to know is that seals already signed stay valid for ever. Nothing has to be done for them to keep working [5]. The second is that the twelve words are, after the work itself, the most important objects an artist leaves behind. Whoever holds them can carry on the artist's will: sign works the artist left unsigned, sign seals again, and keep the registry and the verification page available. The system cannot tell an heir from anyone else. Who holds the key is whoever has the words.

I have begun to think like my own executor, and the practical advice follows from that. Look for the twelve words in the places an artist keeps what matters: a sheet of paper or a notebook in the studio, a safe, a sealed envelope kept with the will. Do not photograph them. Agree within the estate who keeps them, and store them as you would the artist's other valuables [5]. Of unfinished or “bare” prints in an artist's archive I wrote that “writing down clear directives for their conservation, materials used, recommended display protocols, and contextual notes helps preserve artistic intent,” and that this holds “even posthumously.” [19] The twelve words belong on the same list of instructions.

If the words cannot be found, nothing is lost for the seals already signed. The estate can create words of its own and register its own key, confirmed by the estate's website or by a public profile page that names the estate. Seals it signs then read “Signed by Estate on behalf of the artist,” with the artist's name as the headline, so a collector can see exactly who is speaking [5]. Galleries can do the same for their artists. If the words fall into the wrong hands, the key can be revoked from the app, or without the words by placing a revocation line where the key was confirmed [5].

An estate that wants independence from ArtFirma can have it. It can keep its own copy of the records and photographs, host its own copy of the verification page, which is a single file, and give its seals an address on a domain it controls [6, 11]. The point of building it this way is that a legacy should not depend on any one party continuing to answer the telephone, and that includes ourselves.

For museums and institutions

Museums and estates are where an artist's legacy is built, and they are where the cost of a lost record finally lands. Provenance research on historic works is slow, painstaking and expensive because the record has to be reconstructed from fragments. The Washington Conference Principles of 1998 recognise this directly. They ask that records and archives be open to researchers, that unavoidable gaps in provenance be weighed with understanding, and that central registries be established [13]. For a living artist the situation is different. The record can be made once, at the moment the work leaves the studio, instead of being rebuilt decades later.

For a registrar the practical question is what to keep, so that the evidence survives any outside service. We suggest four things: the printed or PDF result of a check, which lists every technical detail and the date; the record file, its signature and the photograph; a saved copy of the verification page, which is a single file; and the specification [5, 11]. Six fields are worth adding to a collection management system, beside the museum's own accession number: the work number, the signing key, the record fingerprint, the chip identity, the archive identifier and the date checked [5]. The work number belongs to the artist, so both numbers should be kept. If a museum signs works itself, with its own registered key, its accession number can serve as the work number. This follows the logic of the museum record, as I put it in the studio journal: “Museums understand this instinctively. Collection records routinely distinguish medium, dimensions, inscriptions, credit line, accession number, provenance, exhibition history and bibliography because no single field can fully describe an artwork.” [16]

A check can be cited plainly in a condition or appraisal report: on a stated date the seal was read with a phone, the page reported the work number, signing key and record fingerprint, the record and photograph matched the object examined, and a printout is attached. The wording we suggest ends with a sentence that belongs in every such report: this confirms the declaration of the key holder; it is not an attribution [5].

Institutions also think about preservation in the vocabulary of the OAIS reference model [12]. I do not claim conformance with it. The design shares its instinct, which is to keep the information independent of the system that produced it and to keep the means of reading it alongside. The records and photographs are copied to a permanent public archive, Arweave, whose one time payment is designed to fund at least two hundred years of storage. The verification page is preserved on Arweave and at CERN's Zenodo [6, 11]. In my archiving essay I told collectors to keep “at least three copies” on different media. [19] The design follows my own rule for the verification page: two public archives, and a saved copy held by whoever needs one. A museum that wants nothing to depend on us can host its own page and its own copies, and check any seal with the published specification and about ten lines of code [4, 11].

Why a partnership, and what my first attempt taught me

ArtFirma is a partnership between the developer Sergey Evstegneev of 123Automate and me, as the About page of the site says [6]. He brings the secure technology. I bring four decades of life in the art world and, more usefully, a failure.

The four decades are documented, which is the point. The record of one of my works, The Great Leveller, reads as a list of museum shows and publications: Contemporary Still Life at the Guildhall Museum in London in 2017, Vanitas at the Museum of Contemporary Art in Warsaw in 2017, Reinvigorating the Still Life at the Bohuslän Museum in Sweden in 2016, Nature Morte at the Hå Gamle Prestegard Museum in Norway in 2015, a Thames & Hudson publication in 2013 and a Vernon Press book in 2018 [16]. Of such lists I wrote: “Its successive exhibitions and publications form a record of the work's movement through public and institutional contexts over time.” [16] ArtFirma exists so that a record of that kind can be attached to the object, signed, and kept.

I first tried this five years ago. I announced in the studio journal that “each new work will leave the studio embedded with a digitally and physically signed NFC (near field communication) tag,” [15] and I argued against blockchain verification on grounds of energy: “surely verification of art should not carry such a carbon burden.” [15] The system was developed with 123Automate, and I began placing its tags on works. A change of systems ended the app, and for about a year it was offline. The tags I had already placed could no longer do what I had promised. It is the most useful thing I have learned about provenance. A record is only as strong as every dependency beneath it: the app, the hosting, the domain, the platform, the phone, the person who knows the password.

When I returned to the idea I asked one question before putting my name to it. Would it last two hundred years, not just two? The design is the answer I could accept. A collector needs no app, because the phone reads the seal directly. The verification page is a single file that checks signatures offline. The seal's address uses purl.org, a redirect service created by OCLC in 1995 and operated by the Internet Archive since 2016, so the address can be pointed at a new home if the old one goes. The domain it currently points to is paid for until 2036, and a trusted person holds the account access needed to redirect it if we close [6]. Each of these is a dependency removed, and I would sooner list them than ask for faith.

My objection to the blockchain still stands, in a more exact form. ArtFirma decides nothing with a blockchain. The signature is checked by arithmetic, in a browser, even offline. The twelve words follow the BIP-39 convention from wallet software, and the key is derived with the published SLIP-0010 method [11]. Those are ways of writing down and deriving a key. They involve no chain. The permanent archive, Arweave, holds copies of files so that they outlast us, and the same files can live anywhere else, on our registry or a USB stick, and still be checked [4, 6].

I am also careful about what the partnership means for the artists who use it. There is no subscription, no commission on sales, and no access to a client's data. The only thing ArtFirma sells is the seal.

The launch

What launches now is complete enough to be judged. The app is available on the App Store and on Google Play. The site, in English and Spanish, explains each part of the system, from the verification page to the way a seal is checked, and the tag specification is published with a permanent DOI, so that anyone can build a verifier without our software [4, 11]. The system is made in Spain.

I am beginning with people I have known and worked with for years, artists and institutions among them, because early use is how weaknesses are found and because a provenance system should be introduced by invitation, not by pitch. I would like them to treat it as a colleague treats a new instrument: to try it on a real work, to try to break it, and to tell me where it fails.

As a public offering ArtFirma is new. The idea has five years behind it, but this form has not yet been tested by time, and the only test that finally matters is the one that takes twenty years. What I can offer today is a design that can be examined now, a specification that is public, limits stated in plain words, and a refusal to ask anyone to take any of it on trust. Artists who want to seal their work, estates and institutions who want to read the specification and tell us where it is weak, and registrars who would like to see how a check fits their own records, are all welcome to write to contact@artfirma.com or to follow the project on Instagram at @artfirma.

The seal as evidence

In Water as a Lens I argued that a photograph is the material consequence of an event, and that what survives once the water settles is evidence. Peirce's idea of the index rests on a physical connection, a sign that points because something has actually happened to it [14]. The seal is an index of a quieter event: the moment an artist stands before a finished work and declares that it is theirs, that it is this one, and that it is complete. The chip is physically attached to the object. The signature binds the declaration to the chip by arithmetic. What a registrar or an heir reads years later is the surviving trace of that declaration.

I made a version of this argument about provenance itself. Of a unique work I wrote: “In such a work, provenance and material identity become closely aligned. The record does not simply establish where an image has appeared. It preserves the history of the object in which that image physically exists.” [16] Of the print, in the long arc of value essay, I wrote that it is “an evidentiary document of a specific and irreversible making process.” [18] The seal is where those two ideas meet. It fixes a record to the physical object, and the signature binds the two together.

In “Understanding Provenance in Contemporary Photography” I ended on two sentences I have not been able to improve: “The visible image is therefore only one part of what survives. The rest survives through record.” [16] The five layers drawn above are my attempt to make that second sentence hold for a very long time. The work is the layer that matters and the one that cannot vouch for itself, which is why the other four exist. Each can fail without the others being lost, and that is the whole design.

An artwork is made once. Its record should be made once too, by the person best placed to make it, and then left where it can outlast them, their website and the company that helped them to do it.