{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2021:E64K5W253C4UGS6S6WF7NVKB6H","short_pith_number":"pith:E64K5W25","canonical_record":{"source":{"id":"2107.04940","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-07-11T02:09:52Z","cross_cats_sorted":[],"title_canon_sha256":"c28eadd10fa027b3e315bb91a453b8f61aec4bab27426b3a00e0ecefb3e5cf06","abstract_canon_sha256":"1b435b80570b2981753090a75ff6a157b3f3f6f221e3b60456a0dbcf9bd6f04c"},"schema_version":"1.0"},"canonical_sha256":"27b8aedb5dd8b9434bd2f58bf6d541f1f0e064ca34a1d65b008a11609f1cb4c6","source":{"kind":"arxiv","id":"2107.04940","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2107.04940","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"arxiv_version","alias_value":"2107.04940v1","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2107.04940","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"pith_short_12","alias_value":"E64K5W253C4U","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"pith_short_16","alias_value":"E64K5W253C4UGS6S","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"pith_short_8","alias_value":"E64K5W25","created_at":"2026-07-05T02:56:44Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2021:E64K5W253C4UGS6S6WF7NVKB6H","target":"record","payload":{"canonical_record":{"source":{"id":"2107.04940","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-07-11T02:09:52Z","cross_cats_sorted":[],"title_canon_sha256":"c28eadd10fa027b3e315bb91a453b8f61aec4bab27426b3a00e0ecefb3e5cf06","abstract_canon_sha256":"1b435b80570b2981753090a75ff6a157b3f3f6f221e3b60456a0dbcf9bd6f04c"},"schema_version":"1.0"},"canonical_sha256":"27b8aedb5dd8b9434bd2f58bf6d541f1f0e064ca34a1d65b008a11609f1cb4c6","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T02:56:44.521608Z","signature_b64":"gD6v7cbKfGNSnIkerQZ9BwjlFSKUPln4p9IHLN+YVt+EEiZH1G/3kI43CDQGLHkz+xbVvXsCHI7iiEDbV1sPDw==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"27b8aedb5dd8b9434bd2f58bf6d541f1f0e064ca34a1d65b008a11609f1cb4c6","last_reissued_at":"2026-07-05T02:56:44.521191Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T02:56:44.521191Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2107.04940","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:56:44Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"c4w1y6U3DsNHxo/BL2eks590UoVtDzM6bPTqQEbPUPCz2VYa8JuCYsZVp2spQHr6zFHPbnG4+ra7OQ7CBicODw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T10:29:39.406530Z"},"content_sha256":"823ff2ce4e5471b6ed903073bf32297e6b5d45618a611cf131cdd8dc05852152","schema_version":"1.0","event_id":"sha256:823ff2ce4e5471b6ed903073bf32297e6b5d45618a611cf131cdd8dc05852152"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2021:E64K5W253C4UGS6S6WF7NVKB6H","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"You Really Shouldn't Roll Your Own Crypto: An Empirical Study of Vulnerabilities in Cryptographic Libraries","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Daniel J. Weitzner, Jenny Blessing, Michael A. Specter","submitted_at":"2021-07-11T02:09:52Z","abstract_excerpt":"The security of the Internet rests on a small number of open-source cryptographic libraries: a vulnerability in any one of them threatens to compromise a significant percentage of web traffic. Despite this potential for security impact, the characteristics and causes of vulnerabilities in cryptographic software are not well understood. In this work, we conduct the first comprehensive analysis of cryptographic libraries and the vulnerabilities affecting them. We collect data from the National Vulnerability Database, individual project repositories and mailing lists, and other relevant sources f"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2107.04940","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2107.04940/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T02:56:44Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"uQ8QHF297w/iJxAQ49kfMMs839N4GOafDmYX1uLfBQQioWr/QG49nzI1sW2lo05t/kv3HMYOH9XBhnTXZ3m9AA==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-01T10:29:39.407076Z"},"content_sha256":"3a5e191d55feaf10e12871149eebc192ec0e8dbc48403aad0accd55b74b12ec0","schema_version":"1.0","event_id":"sha256:3a5e191d55feaf10e12871149eebc192ec0e8dbc48403aad0accd55b74b12ec0"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/E64K5W253C4UGS6S6WF7NVKB6H/bundle.json","state_url":"https://pith.science/pith/E64K5W253C4UGS6S6WF7NVKB6H/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/E64K5W253C4UGS6S6WF7NVKB6H/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-01T10:29:39Z","links":{"resolver":"https://pith.science/pith/E64K5W253C4UGS6S6WF7NVKB6H","bundle":"https://pith.science/pith/E64K5W253C4UGS6S6WF7NVKB6H/bundle.json","state":"https://pith.science/pith/E64K5W253C4UGS6S6WF7NVKB6H/state.json","well_known_bundle":"https://pith.science/.well-known/pith/E64K5W253C4UGS6S6WF7NVKB6H/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:E64K5W253C4UGS6S6WF7NVKB6H","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"1b435b80570b2981753090a75ff6a157b3f3f6f221e3b60456a0dbcf9bd6f04c","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-07-11T02:09:52Z","title_canon_sha256":"c28eadd10fa027b3e315bb91a453b8f61aec4bab27426b3a00e0ecefb3e5cf06"},"schema_version":"1.0","source":{"id":"2107.04940","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2107.04940","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"arxiv_version","alias_value":"2107.04940v1","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2107.04940","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"pith_short_12","alias_value":"E64K5W253C4U","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"pith_short_16","alias_value":"E64K5W253C4UGS6S","created_at":"2026-07-05T02:56:44Z"},{"alias_kind":"pith_short_8","alias_value":"E64K5W25","created_at":"2026-07-05T02:56:44Z"}],"graph_snapshots":[{"event_id":"sha256:3a5e191d55feaf10e12871149eebc192ec0e8dbc48403aad0accd55b74b12ec0","target":"graph","created_at":"2026-07-05T02:56:44Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2107.04940/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The security of the Internet rests on a small number of open-source cryptographic libraries: a vulnerability in any one of them threatens to compromise a significant percentage of web traffic. Despite this potential for security impact, the characteristics and causes of vulnerabilities in cryptographic software are not well understood. In this work, we conduct the first comprehensive analysis of cryptographic libraries and the vulnerabilities affecting them. We collect data from the National Vulnerability Database, individual project repositories and mailing lists, and other relevant sources f","authors_text":"Daniel J. Weitzner, Jenny Blessing, Michael A. Specter","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-07-11T02:09:52Z","title":"You Really Shouldn't Roll Your Own Crypto: An Empirical Study of Vulnerabilities in Cryptographic Libraries"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2107.04940","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:823ff2ce4e5471b6ed903073bf32297e6b5d45618a611cf131cdd8dc05852152","target":"record","created_at":"2026-07-05T02:56:44Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"1b435b80570b2981753090a75ff6a157b3f3f6f221e3b60456a0dbcf9bd6f04c","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-07-11T02:09:52Z","title_canon_sha256":"c28eadd10fa027b3e315bb91a453b8f61aec4bab27426b3a00e0ecefb3e5cf06"},"schema_version":"1.0","source":{"id":"2107.04940","kind":"arxiv","version":1}},"canonical_sha256":"27b8aedb5dd8b9434bd2f58bf6d541f1f0e064ca34a1d65b008a11609f1cb4c6","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"27b8aedb5dd8b9434bd2f58bf6d541f1f0e064ca34a1d65b008a11609f1cb4c6","first_computed_at":"2026-07-05T02:56:44.521191Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:56:44.521191Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"gD6v7cbKfGNSnIkerQZ9BwjlFSKUPln4p9IHLN+YVt+EEiZH1G/3kI43CDQGLHkz+xbVvXsCHI7iiEDbV1sPDw==","signature_status":"signed_v1","signed_at":"2026-07-05T02:56:44.521608Z","signed_message":"canonical_sha256_bytes"},"source_id":"2107.04940","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:823ff2ce4e5471b6ed903073bf32297e6b5d45618a611cf131cdd8dc05852152","sha256:3a5e191d55feaf10e12871149eebc192ec0e8dbc48403aad0accd55b74b12ec0"],"state_sha256":"4feb3a01c69a2e741ffc6e4928bbe4c916bd189c6c30f42bedb7b332fd492149"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"091zONIePCps6dhBjzzcyoOlutIqRSzPHJkgsjaSx2RkwyMR6lBMdbfahTYObXiVwsuYm29lLCHUULPeU9AzCw==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-01T10:29:39.413580Z","bundle_sha256":"d58a61a7e996315ad0b6c7838405d6a802249c44065af0edcd8e040fc0fece82"}}