C2PA

Security researcher David Buchanan, known online as Retr0id, has published a write-up describing how C2PA content provenance metadata, which records when and how digital media was created, can be manipulated to produce misleading timestamps. The post outlines practical attacks on the time component of the standard, raising questions about how reliably C2PA credentials can prove authenticity of photos and videos.

Security researcher David Buchanan has published a write-up describing how the C2PA content-provenance standard can be manipulated to forge or misrepresent timestamps, in a piece he calls "How to Hack Time, With C2PA". The post covers cryptographic weaknesses in how signed time claims are handled, sparking discussion among security and cryptography practitioners about the reliability of provenance metadata in media authentication.