GoKawiilResearcher shows C2PA timestamp signatures can be spoofed to fake 'proof' photos
Security researcher David Buchanan demonstrated a technique to forge the Time Stamp Authority signature used in C2PA content provenance metadata, producing an image that appears cryptographically verified as existing hours before it actually was created. He used the trick to generate a fake photo showing winning lottery numbers displayed before the official draw, verifiable via Adobe's Content Authenticity tool. Buchanan says the stunt builds on an earlier finding that the underlying 'claim' signatures in C2PA, including those from flagship camera apps, can already be forged.
GoKawiil's interpretation of the reporting above, not reported fact.
C2PA is promoted as a way to cryptographically prove when and how digital content was created, intended to combat misinformation and deepfakes. If timestamp signatures can be manipulated as Buchanan claims, that undermines a core trust mechanism the standard relies on, potentially allowing fabricated 'proof' of authenticity for manipulated media. The finding suggests implementers and verifiers may need stronger safeguards against Time Stamp Authority manipulation before relying on C2PA credentials as definitive evidence.
- Buchanan forged a C2PA-signed image with a timestamp predating the actual lottery draw.
- The exploit reportedly targets the RFC 3161 Time Stamp Authority signature, not just the device's own 'claim' signature.
- The demonstration follows an earlier finding that C2PA claim signatures could already be forged on devices like Google Pixel.
Source: da.vidbuchanan.co.uk, 2026-10-03
Published there as: “How to hack time, with C2PA”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.