Security researcher David Buchanan reported on 2 October 2026 that a signer can produce Content Credentials whose signature and trusted timestamp stay valid but cover none of a file's content.[1] Content Credentials are the provenance format specified by the Coalition for Content Provenance and Authenticity (C2PA). They attach a signed record, called a manifest, that makes claims about a file's origin. Manifests often include a timestamp from an independent time-stamp authority, which attests that the signature existed at a given time.[1]
The method uses exclusion ranges, byte ranges that a signer can leave out of the cryptographic hash that the signature covers. Buchanan set a single exclusion covering the entire file, so the claim signature covers the hash of an empty string. He says he edited the image after signing and that the signature and the timestamp stayed valid.[1] His example is a photo of a lottery ticket. He says it shows the winning numbers of the 28 August 2026 EuroMillions draw but carries a trusted timestamp from hours before the draw. He reports that the C2PA verification tools he could find did not flag anything unusual.[1]
Version 2.4 of the C2PA specification says the software that creates a manifest must limit exclusion ranges to the manifest store or to asset metadata. It also tells validators to reject a manifest when the exclusion range that holds it contains other data, and to report any additional exclusion ranges with an informational code.[2]
Buchanan writes that a whole-file exclusion is easy to detect, but a small one is harder to judge. He adds that exclusions cannot simply be dropped, because some file formats contain checksums that must be updated after signing. He therefore proposes defining which bytes may be excluded in each format and requiring verifiers to enforce those limits.[1]
An April analysis by researchers at the University of Maryland, Baltimore County (UMBC), Hacker Factor and the National Security Agency had already reported that the exclusion range enables undetectable alterations.[3]
Sources
Check or correct this page
Verification record
The digest below shows whether the text you are reading matches the published source. It does not show that the reporting is correct. The build computes it from this page's Markdown source and lists it in the site manifest.
bc81d0a5b162a9737e9bac261e9df7bc23ea4b48d72ccf2adc1a5bff720cb95a
