C2PA

Security researcher David Buchanan, known online as Retr0id, has published a blog post describing how to hack time within C2PA, the content-credentials standard used to cryptographically attest when and how media was created. The write-up details weaknesses that let signed provenance metadata carry misleading timestamps, raising fresh doubts about the standard's reliability for verifying authentic photos and videos.

Security researcher David Buchanan has published a write-up describing how the C2PA content-provenance standard can be manipulated to forge or misrepresent timestamps, in a piece he calls "How to Hack Time, With C2PA". The post covers cryptographic weaknesses in how signed time claims are handled, sparking discussion among security and cryptography practitioners about the reliability of provenance metadata in media authentication.