{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:7DGETFWFVA6UDJXYINVQRHPHIY","short_pith_number":"pith:7DGETFWF","canonical_record":{"source":{"id":"2608.06508","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-06T18:47:32Z","cross_cats_sorted":[],"title_canon_sha256":"7789c0eaa80dfb80b0f1257b8e713facfa97b8fc2f9d65181ff9759a0b43bb70","abstract_canon_sha256":"a1c03a2eca78255842fa5d8a5bddfed0dbf57e1a6e3c84e581b192624817f9fb"},"schema_version":"1.0"},"canonical_sha256":"f8cc4996c5a83d41a6f8436b089de7460514262ff14a721a7b271a13371b668b","source":{"kind":"arxiv","id":"2608.06508","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.06508","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"arxiv_version","alias_value":"2608.06508v1","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.06508","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"pith_short_12","alias_value":"7DGETFWFVA6U","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"pith_short_16","alias_value":"7DGETFWFVA6UDJXY","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"pith_short_8","alias_value":"7DGETFWF","created_at":"2026-08-10T01:10:53Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:7DGETFWFVA6UDJXYINVQRHPHIY","target":"record","payload":{"canonical_record":{"source":{"id":"2608.06508","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-06T18:47:32Z","cross_cats_sorted":[],"title_canon_sha256":"7789c0eaa80dfb80b0f1257b8e713facfa97b8fc2f9d65181ff9759a0b43bb70","abstract_canon_sha256":"a1c03a2eca78255842fa5d8a5bddfed0dbf57e1a6e3c84e581b192624817f9fb"},"schema_version":"1.0"},"canonical_sha256":"f8cc4996c5a83d41a6f8436b089de7460514262ff14a721a7b271a13371b668b","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-08-10T01:10:53.206165Z","signature_b64":"o/qIz+Zim5ma6rJFmMvw609Rq1YxA55g0mGa2nTPbTuAddG+3jPCGW7enjKYjabkon/RhLIDw6aB1rpoxsrIDQ==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"f8cc4996c5a83d41a6f8436b089de7460514262ff14a721a7b271a13371b668b","last_reissued_at":"2026-08-10T01:10:53.203791Z","signature_status":"signed_v1","first_computed_at":"2026-08-10T01:10:53.203791Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2608.06508","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-10T01:10:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"9P3s6B64WqWUe+HCk6LC0sH8ykBUHSV72oJezs380uBXsPdsJ/XXFxq/8/gX+3+/Zo1icIbeyfBvdmPinjyCBw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T07:34:42.078001Z"},"content_sha256":"29e39afd861d56da30a4ee4bdf44b751cb81865e8a07785e86a58ad9e65a9c79","schema_version":"1.0","event_id":"sha256:29e39afd861d56da30a4ee4bdf44b751cb81865e8a07785e86a58ad9e65a9c79"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:7DGETFWFVA6UDJXYINVQRHPHIY","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Canonicalization Failures as a Recurring Vulnerability Class: Representation Divergence in Cryptographic Systems and Its Avoidance","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Arslan Br\\\"omme","submitted_at":"2026-08-06T18:47:32Z","abstract_excerpt":"Cryptographic systems operate on bytes but mean semantic objects. The translation between the two is rarely unique. Where this uniqueness is not enforced, an attack surface opens up as soon as a hash, a signature, replay protection, or consensus identity depends on the representation. The same class of failure has been discovered independently and named locally across many ecosystems, as transaction malleability, non-deterministic value encoding, message malleability, or hash chain malleability, without its common root being tracked as a cross-ecosystem grid. This work organizes the scattered "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.06508","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2608.06508/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-08-10T01:10:53Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"qyD/BFSHrNtjTcCtqynXi4kcIQ/49VIvv4zU97rSYRSzZvGYYXIP0FAQxGpdZ9YC0DxBNxJtEiI0SgeZiU8uCw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-11T07:34:42.078525Z"},"content_sha256":"a7157ff55aecb7fd89d03cca16dfba34d9584553f2d94d19a288b31c24ff18fc","schema_version":"1.0","event_id":"sha256:a7157ff55aecb7fd89d03cca16dfba34d9584553f2d94d19a288b31c24ff18fc"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/7DGETFWFVA6UDJXYINVQRHPHIY/bundle.json","state_url":"https://pith.science/pith/7DGETFWFVA6UDJXYINVQRHPHIY/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/7DGETFWFVA6UDJXYINVQRHPHIY/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-11T07:34:42Z","links":{"resolver":"https://pith.science/pith/7DGETFWFVA6UDJXYINVQRHPHIY","bundle":"https://pith.science/pith/7DGETFWFVA6UDJXYINVQRHPHIY/bundle.json","state":"https://pith.science/pith/7DGETFWFVA6UDJXYINVQRHPHIY/state.json","well_known_bundle":"https://pith.science/.well-known/pith/7DGETFWFVA6UDJXYINVQRHPHIY/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:7DGETFWFVA6UDJXYINVQRHPHIY","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"a1c03a2eca78255842fa5d8a5bddfed0dbf57e1a6e3c84e581b192624817f9fb","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-06T18:47:32Z","title_canon_sha256":"7789c0eaa80dfb80b0f1257b8e713facfa97b8fc2f9d65181ff9759a0b43bb70"},"schema_version":"1.0","source":{"id":"2608.06508","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.06508","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"arxiv_version","alias_value":"2608.06508v1","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.06508","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"pith_short_12","alias_value":"7DGETFWFVA6U","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"pith_short_16","alias_value":"7DGETFWFVA6UDJXY","created_at":"2026-08-10T01:10:53Z"},{"alias_kind":"pith_short_8","alias_value":"7DGETFWF","created_at":"2026-08-10T01:10:53Z"}],"graph_snapshots":[{"event_id":"sha256:a7157ff55aecb7fd89d03cca16dfba34d9584553f2d94d19a288b31c24ff18fc","target":"graph","created_at":"2026-08-10T01:10:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.06508/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Cryptographic systems operate on bytes but mean semantic objects. The translation between the two is rarely unique. Where this uniqueness is not enforced, an attack surface opens up as soon as a hash, a signature, replay protection, or consensus identity depends on the representation. The same class of failure has been discovered independently and named locally across many ecosystems, as transaction malleability, non-deterministic value encoding, message malleability, or hash chain malleability, without its common root being tracked as a cross-ecosystem grid. This work organizes the scattered ","authors_text":"Arslan Br\\\"omme","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-06T18:47:32Z","title":"Canonicalization Failures as a Recurring Vulnerability Class: Representation Divergence in Cryptographic Systems and Its Avoidance"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.06508","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:29e39afd861d56da30a4ee4bdf44b751cb81865e8a07785e86a58ad9e65a9c79","target":"record","created_at":"2026-08-10T01:10:53Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"a1c03a2eca78255842fa5d8a5bddfed0dbf57e1a6e3c84e581b192624817f9fb","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2026-08-06T18:47:32Z","title_canon_sha256":"7789c0eaa80dfb80b0f1257b8e713facfa97b8fc2f9d65181ff9759a0b43bb70"},"schema_version":"1.0","source":{"id":"2608.06508","kind":"arxiv","version":1}},"canonical_sha256":"f8cc4996c5a83d41a6f8436b089de7460514262ff14a721a7b271a13371b668b","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"f8cc4996c5a83d41a6f8436b089de7460514262ff14a721a7b271a13371b668b","first_computed_at":"2026-08-10T01:10:53.203791Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-10T01:10:53.203791Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"o/qIz+Zim5ma6rJFmMvw609Rq1YxA55g0mGa2nTPbTuAddG+3jPCGW7enjKYjabkon/RhLIDw6aB1rpoxsrIDQ==","signature_status":"signed_v1","signed_at":"2026-08-10T01:10:53.206165Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.06508","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:29e39afd861d56da30a4ee4bdf44b751cb81865e8a07785e86a58ad9e65a9c79","sha256:a7157ff55aecb7fd89d03cca16dfba34d9584553f2d94d19a288b31c24ff18fc"],"state_sha256":"e8a560c56a477b1671221b77703c21be0c230f8d842c6a56a63b370bf4cc8566"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"PGd4hBV6rcnF0ZyS5xRKWjem7ylk/5TfnqQNAjqJdOZ7xk+F++942bR0ElHsj/n/evTDUCKeWeIlyFE/PLb4Bw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-11T07:34:42.082605Z","bundle_sha256":"d9714d5dc78185adb966cde2e3fea70e4be93d0e2b13b9901e9093fad3b9c5dc"}}