- Published on
How to hack time, with C2PA
- Authors
- Name
- DeepHorus
Security researcher David Buchanan, who operates under the handle retr0id, published a proof of concept on 2 October 2026 demonstrating that C2PA content provenance metadata can be manipulated to appear to prove events occurred before they actually happened. Dubbed "time hacking," the technique lets an attacker attach a cryptographically valid, independently timestamped signature to a file and then alter that file afterwards without invalidating the proof. To demonstrate, Buchanan produced an image of a Euro Millions lottery ticket displaying the winning numbers for the 28 August 2026 draw, timestamped hours before the draw took place. The image is visibly edited, and Buchanan says he has no intention of committing actual lottery fraud.
A typical C2PA manifest carries two signatures. The first is the "claim" signature, usually generated by camera software to assert facts such as capture time and GPS coordinates; in a previous article Buchanan showed it is approximately worthless, since arbitrary claims can be signed, including in flagship implementations like the Google Pixel Camera app. The second comes from a remote Time Stamp Authority consulted via the RFC 3161 protocol, which attests "I saw this hash at this timestamp." Because devices are not trusted to set their own clocks, the TSA serves as an independent witness that the signed data existed at or before a given time.
Buchanan's attack does not break the TSA; he assumes it functions as advertised. Instead it exploits what he calls a spec footgun: the C2PA specification permits arbitrary exclusions, byte ranges within a file omitted from signature calculations. A malicious signer can simply exclude the entire file, producing a fully valid signature over an empty string. In his proof of concept the exclusion spans 3,995,383 bytes, matching the file length, and the signed hash equals the SHA-256 digest of /dev/null: 47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=.
The flaw is not entirely new: Dr. Neal Krawertz flagged large exclusion ranges in his "Big Bulleted List" of C2PA weaknesses published in June 2025, noting that excluded bytes can be altered without detection. Buchanan's contribution is showing a deliberate, malicious use of that allowance rather than an incidental one. His workflow was straightforward: photograph a genuine lottery ticket, sign it with a valid C2PA manifest and trusted timestamp, exclude the whole file, then edit the numbers after the draw. Dumping the manifest with c2patool -d reveals the empty-string hash at the heart of the exploit.
The implications matter because C2PA is positioned as a trust layer for digital media, backed by camera makers and platforms seeking to combat misinformation. If the timestamp component can be decoupled from the content it purports to vouch for, verification sites such as verify.contentauthenticity.org could report a clean, trusted result for an altered file. That weakens the core promise that a manifest proves what existed and when.
Looking ahead, mitigations may follow; Buchanan himself notes that readers checking the verification service later may find it has been patched. He has not yet evaluated Google's new on-device trusted time-stamp on the Pixel 10 and says he is highly sceptical of it. The most likely fix is a specification change restricting or eliminating large exclusions.
