--- title: How to Hack Time, With C2PA | daily.dev description: A researcher demonstrates a practical attack against C2PA content authenticity metadata, showing how a malicious signer can exclude an entire file's bytes from... canonical: https://daily.dev/posts/how-to-hack-time-with-c2pa-mp4yajqwa twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How to Hack Time, With C2PA | daily.dev og:description: A researcher demonstrates a practical attack against C2PA content authenticity metadata, showing how a malicious signer can exclude an entire file's bytes from... og:url: https://daily.dev/posts/how-to-hack-time-with-c2pa-mp4yajqwa og:image: https://api.daily.dev/og/posts/mP4yAJQWa.png og:image:alt: How to Hack Time, With C2PA og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How to Hack Time, With C2PA **[Lobsters](https://daily.dev/sources/lobsters)** · 5 min read · 0 upvotes · 0 comments ## Summary A researcher demonstrates a practical attack against C2PA content authenticity metadata, showing how a malicious signer can exclude an entire file's bytes from signature calculation while still producing a valid claim signature and a valid trusted timestamp from a Time Stamp Authority. This lets someone photograph a lottery ticket, get it cryptographically timestamped before the draw, then photoshop in the winning numbers afterward without invalidating any signatures. The flaw stems from C2PA's spec-sanctioned 'exclusions' feature, previously flagged by another researcher, and the author argues the fix requires strictly defining which byte ranges can legitimately be excluded per file format, since some exclusions (like PNG CRC32 checksums) are structurally necessary. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can someone forge a C2PA trusted timestamp to make a photoshopped image look like it was captured before an event happened? By abusing the C2PA spec's 'exclusions' feature, which lets a signer mark byte ranges as excluded from signature calculation. Setting the exclusion range to cover the entire file produces a valid signature over an empty string hash, so the file can be edited afterward, including by a trusted timestamp authority via RFC 3161, without invalidating any signature. _Anyone building or verifying content-provenance systems should track exploits like this one on daily.dev before trusting a timestamp._ ### What is the exclusions feature in the C2PA specification and why does it exist? Exclusions are byte ranges within a signed file that are deliberately left out of signature calculations. They exist because some file formats, such as PNG, need to recompute checksums like CRC32 after a signature is embedded, which would create a circular dependency if those bytes were included in the hash. Without careful scoping, this same mechanism lets attackers exclude arbitrary or even entire file content from verification. _Developers evaluating provenance or signing formats can follow spec-level gotchas like this through daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 12 comments across lobsters, hackernews (as of 2026-10-04). **TL;DR:** The discussion is largely critical, treating the exclusions flaw as both a technically absurd design choice and a symptom of deeper conceptual problems with using cryptographic signatures to prove 'authenticity' of AI or edited content. **Sentiment:** 0% positive · 15% mixed · 85% skeptical **The pushback** - The exclusions mechanism is compared to past standards failures like SAML's signature-wrapping bugs. - Signing raw encoded bytes rather than decoded/semantic content is seen as pointless since byte-level signatures don't guarantee the actual rendered output is unchanged. - C2PA conflates proving an image wasn't edited after creation with proving AI wasn't involved at all, which the mechanism doesn't actually achieve. - Real-world implementations (e.g. Google's) are criticized as poor compared to other vendors' handling of similar failures. - Mandating C2PA via regulation (e.g. the EU AI Act) before these flaws were resolved is seen as premature. **By community** - lobsters (skeptical): Commenters mock the premise of preserving 'semantic integrity' via byte-level signatures and question why raw bits matter at all for AI-generated content. - hackernews (skeptical): Commenters pile on criticism, comparing the flaw to past standards failures and arguing C2PA fundamentally can't prove what it claims to prove. **Open questions** - Can C2PA be fixed by strictly defining legitimate exclusions per file format, or is the whole approach of signing encoded bytes rather than semantic/decoded content fundamentally flawed? - Should regulation have mandated C2PA manifests before these spec-level flaws were resolved? **Highlights** > C2PA is never a good standard for AI. In traditional provence use case, you want to prove the image have never edited after it was created from the source. When signature mismatch, it is considered invalid. For AI use case, you want to proof the image have never touched with AI. C2PA only (kind of) proof the last touch wasn't from AI.. > — [j16sdiz on hackernews · 1 comments](https://news.ycombinator.com/item?id=49953313) > > C2PA only (kind of) proof the last touch wasn't from AI.. Given how bad Google's implementation is, the only thing Google's implementation proves is that someone somewhere on earth owns a Pixel phone... and we'll probably learn that it doesn't even prove that. I like to contrast how Google has responded to the failure of their implementation with how Nikon responded to the very same sort of failures. (Search for "Nikon" here [0], but -IMO- the whole post is worth reading.) [0] > — [simoncion on hackernews](https://news.ycombinator.com/item?id=49953493) > > C2PA allows for arbitrary "exclusions". These are byte ranges within the file which are excluded from signature calculations Glad to see we learned from the mistakes of SAML. > — [bawolff on hackernews · 1 comments](https://news.ycombinator.com/item?id=49948443) > This is utterly absurd, but also given that all of this is based on preserving the "semantic integrity" of the content (or some similar nonsense) then why are the raw bits relevant anyway? Surely the decoded data is what matters? e.g. a signature over the encoded data doesn't give you anything a signature over the actual output. This ignores the obvious idiocy of having some AI slop machine determine the semantics of the image: what is the semantic meaning of which people are in a picture or video? Well, AI has a well established model of saying random black people are in fact a different black person, with a warrant, or is a shoplifter, etc. Those AIs would not interpret swapping a black person's face as a semantic change. Hooray! > — [olliej on lobsters · 1 points, 1 comments](https://lobste.rs/s/u8uvlr/how_hack_time_with_c2pa#c_ravo1j) **Source threads** - [lobsters](https://lobste.rs/s/u8uvlr/how_hack_time_with_c2pa) · 17 points · 2 comments - [hackernews](https://news.ycombinator.com/item?id=49946707) · 35 points · 10 comments ## Similar posts on daily.dev - [Forgery of C2PA on a Pixel 10](https://daily.dev/posts/forgery-of-c2pa-on-a-pixel-10-0xxz4rfmq) · Lobsters · 0 upvotes · 0 comments - [C2PA only works if everything is signed](https://daily.dev/posts/c2pa-only-works-if-everything-is-signed-mrgmzs3k9) · sean goedecke · 2 upvotes · 0 comments - [C2PA Cameras Do Not Survive Contact With Reality](https://daily.dev/posts/c2pa-cameras-do-not-survive-contact-with-reality-ihlzsaqlv) · Lobsters · 0 upvotes · 0 comments - [\#Pixnapping: Android Timing Attack Sends Google Back to the Drawing Board](https://daily.dev/posts/pixnapping-android-timing-attack-sends-google-back-to-the-drawing-board-iynbkdbkk) · Security Boulevard · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/how-to-hack-time-with-c2pa-mp4yajqwa) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How to Hack Time, With C2PA","url":"https://daily.dev/posts/how-to-hack-time-with-c2pa-mp4yajqwa","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-to-hack-time-with-c2pa-mp4yajqwa"},"datePublished":"2026-10-04T08:47:56.860Z","dateModified":"2026-10-04T13:48:45.713Z","description":"A researcher demonstrates a practical attack against C2PA content authenticity metadata, showing how a malicious signer can exclude an entire file's bytes from...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/600e7b7c20e5d149808a356b7a2e98a9?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/600e7b7c20e5d149808a356b7a2e98a9?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-to-hack-time-with-c2pa-mp4yajqwa","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,cryptography","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"How to Hack Time, With C2PA"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-to-hack-time-with-c2pa-mp4yajqwa#faq","mainEntity":[{"@type":"Question","name":"How can someone forge a C2PA trusted timestamp to make a photoshopped image look like it was captured before an event happened?","acceptedAnswer":{"@type":"Answer","text":"By abusing the C2PA spec's 'exclusions' feature, which lets a signer mark byte ranges as excluded from signature calculation. Setting the exclusion range to cover the entire file produces a valid signature over an empty string hash, so the file can be edited afterward, including by a trusted timestamp authority via RFC 3161, without invalidating any signature. Anyone building or verifying content-provenance systems should track exploits like this one on daily.dev before trusting a timestamp."}},{"@type":"Question","name":"What is the exclusions feature in the C2PA specification and why does it exist?","acceptedAnswer":{"@type":"Answer","text":"Exclusions are byte ranges within a signed file that are deliberately left out of signature calculations. They exist because some file formats, such as PNG, need to recompute checksums like CRC32 after a signature is embedded, which would create a circular dependency if those bytes were included in the hash. Without careful scoping, this same mechanism lets attackers exclude arbitrary or even entire file content from verification. Developers evaluating provenance or signing formats can follow spec-level gotchas like this through daily.dev."}}]} ```