Computing · Provenance

The trick that broke C2PA

A valid manifest that said nothing: how a standard feature allowed signing the void — and what it teaches us.

Author: Juan Carlos Euyoque Aguilera · October 7, 2026 · CC BY 4.0

C2PA (Coalition for Content Provenance and Authenticity) is the industry standard for content credentials: signed manifests declaring who created a file and what edits it went through. On October 2, 2026, David Buchanan publicly demonstrated a structural hole in the standard.

This page summarizes the episode with linked sources; nothing here reproduces the original blog's content.

What happened [DATA]

[DATA] The standard allows declaring byte ranges excluded from the hash (meant for legitimate cases like thumbnails or metadata). Nothing prevented excluding the entire file: Buchanan signed a manifest excluding 3,995,383 bytes — the whole file.
[DATA] The resulting signed hash is the SHA-256 of the empty input. The RFC 3161 timestamp remained valid. Result: a "proof" of prior knowledge (EuroMillions numbers) passing every verification while saying nothing about any file.
[DATA] The issue had been known since June 2025 (Neal Krawetz listed it as "Large exclusion range") and was still unmitigated in October 2026.

Source: David Buchanan, "How to Hack Time, With C2PA" (Oct 2, 2026).

The fix on the table [DATA]

Buchanan proposed the obvious, correct thing: explicit, per-format lists of which ranges may be excluded — enforced by verifiers, not declared by the signer. The principle: the verifier must know what is allowed, not just what was declared.

[MYTH] C2PA tells you whether an image is real.

C2PA binds provenance claims to a file; it does not say whether the content is true. And with this hole, not even the claim was guaranteed: the signature was valid over nothing.

Why it matters to us

[DATA] Layer 1 of the Método Origen hashes the content bytes: there is no manifest between the hash and the file, no exclusions. This failure mode does not exist by construction — forging it would require breaking SHA-256, not exploiting a spec feature.
[DATA] The episode made us read our own verifier as adversaries, and we found a soft spot: it warned about unregistered files without failing. It is already on the method's hardening list.

Honest caveats

It does not absolve our layer 3: public OpenTimestamps calendars are third parties, and that dependency stands — hence the plan for our own calendar.
Different scopes: C2PA binds authorship and edits; Origen binds existence and integrity. We do less, but without the hole.
The fix may land: if C2PA adopts explicit lists, the contrast weakens. We say this today, by construction — not as eternal superiority.
We are not looking for war: a claims standard can coexist with a minimal anchoring layer beneath it. We could even anchor the bytes of someone else's C2PA manifest.

Sources: Buchanan (Oct 2026) · c2pa.org (the standard's site).