How to Hack Time, With C2PA

A researcher demonstrates a practical attack against C2PA content authenticity metadata, showing how a malicious signer can exclude an entire file's bytes from signature calculation while still producing a valid claim signature and a valid trusted timestamp from a Time Stamp Authority. This lets someone photograph a lottery ticket, get it cryptographically timestamped before the draw, then photoshop in the winning numbers afterward without invalidating any signatures. The flaw stems from C2PA's spec-sanctioned 'exclusions' feature, previously flagged by another researcher, and the author argues the fix requires strictly defining which byte ranges can legitimately be excluded per file format, since some exclusions (like PNG CRC32 checksums) are structurally necessary.

Source: https://www.da.vidbuchanan.co.uk/blog/hacking-time.html. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.