How to hack time, with C2PA
David Buchanan demonstrates a C2PA specification vulnerability where arbitrary file exclusions let attackers modify media after signing while keeping cryptographic timestamps valid.
read it It is a concise, insightful security write-up demonstrating a fundamental design flaw in a major media provenance standard.
summary
David Buchanan highlights a critical spec footgun in C2PA known as exclusions, which are byte ranges intentionally omitted from signature calculations. By setting the exclusion range to cover an entire file, a signer can generate a valid signature over an empty string. This allows images to be heavily modified after the fact, such as altering a lottery ticket post-draw, while retaining a valid Timestamp Authority proof. Fixing the issue requires strict, format-specific limitations on exclusions rather than removing them entirely.
key points
- C2PA supports byte-range exclusions to handle file format constraints like checksum updates and metadata injection.
- An attacker can exclude the entire file length, creating a valid signature over an empty string that survives total file modification.
- Current C2PA verification tools fail to flag total-file exclusions as suspicious, accepting the tampered file as authentic.
- Mitigating this requires explicitly restricting allowed exclusion ranges for each supported file format.
who should read it
Security researchers and engineers building or evaluating media provenance systems.
discussion positive
> C2PA allows for arbitrary "exclusions". These are byte ranges within the file which are excluded from signature calculations
Glad to see we learned from the mistakes of SAML.
Draws a parallel to historical security design mistakes made in SAML.
Generated by an LLM from the article and thread. Check the sources before relying on it.