The Coalition for Content Provenance and Authenticity (C2PA) standard is designed to attach cryptographic signatures to digital media, proving when and how a file was created. A typical C2PA manifest includes two signatures: a “claim” signature that attests to properties of the file (such as creation time) and a second signature from a Time Stamp Authority (TSA) that confirms the claim signature existed at-or-before a specific timestamp. The TSA acts as an independent witness, preventing the device from lying about its own clock. However, the C2PA specification also permits “exclusions”: byte ranges within the file that are omitted from the signature calculations. This feature exists to accommodate formats like PNG, where internal checksums must be updated after the signature is embedded, but it introduces a critical footgun. Because the excluded bytes are not covered by any signature, an attacker can freely modify them after signing without invalidating either the claim signature or the TSA’s timestamp proof. In a blog post published 2 October 2026, David Buchanan (aka retr0id) shows how this can be abused to “hack time.” By crafting a C2PA manifest that excludes the entire file—setting the exclusion range to start at byte 0 with a length equal to the file size—the claim signature is computed over the hash of an empty string. The TSA then signs this claim signature, producing a valid timestamp that asserts the empty‑string hash existed at a chosen moment. The author took a photograph of a blank lottery ticket, applied this manifest, and obtained a trusted timestamp from a TSA. Hours after the actual lottery draw, he edited the image to insert the winning numbers. Because the excluded region covered the whole file, the signatures remained valid, and verification tools did not flag any anomaly. The resulting image displays a timestamp that predates the draw, yet shows the winning numbers, effectively falsifying the provenance. Buchanan notes that fixing this issue is not straightforward. While it is trivial to reject manifests that exclude the entire file, partial exclusions remain dangerous: it is difficult to determine whether a given excluded range is harmless (e.g., a PNG checksum) or could be used to alter semantically important content. He suggests that the solution lies in explicitly defining, for each supported file format, which byte ranges may be excluded, and requiring verifiers to enforce these constraints. Until such mitigations are adopted, the exclusion mechanism remains a viable way to undeniably tamper with C2PA‑signed media while preserving a trusted timestamp. | Evidence from primary source: the description of the claim and TSA signatures, the exclusion footgun, the method of excluding the entire file, the hash of an empty string, and the lottery ticket demonstration. | {