C2PA Spec Flaw Allows Time-Stamp Forgery via Arbitrary Byte Exclusions

The Vulnerability

A critical flaw in the C2PA (Coalition for Content Provenance and Authenticity) specification allows for the forgery of content provenance and timestamps. The issue stems from the spec's allowance of arbitrary "exclusions"—byte ranges within a file that are omitted from signature calculations. While intended for technical necessities like fixing CRC32 checksums in PNG files, this feature can be exploited to exclude the entire file content from the signature.

By crafting a manifest that excludes the whole file, an attacker can sign an empty string. This results in a valid claim signature and a valid Time Stamp Authority (TSA) signature, as the TSA only verifies that the hash of the claim existed at a specific time. Consequently, the underlying file can be modified after signing without invalidating any cryptographic proofs.

Proof of Concept

David Buchanan demonstrated this by creating a C2PA-signed image with a valid timestamp, then modifying the image content (photoshopping lottery numbers) after the timestamp was recorded. The verification tools, including verify.contentauthenticity.org, accepted the modified file as authentic because the signature technically covered only the empty string, not the actual image data.

The manifest dump reveals the exclusion covers the entire file length (e.g., 3,995,383 bytes), and the hash corresponds to an empty string (47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=).

Mitigation Challenges

Fixing this issue is non-trivial because exclusions are required for certain file formats to avoid circular dependencies during signature embedding. Simply banning full-file exclusions is insufficient, as partial exclusions can still alter critical parts of an image or document. The proposed solution involves explicitly defining and enforcing allowed exclusion ranges for each supported file format, requiring verifiers to strictly adhere to these constraints.