{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2026:H2K6VRDDGSLA3GHNWCMYK7DE52","short_pith_number":"pith:H2K6VRDD","canonical_record":{"source":{"id":"2605.16549","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-15T18:46:15Z","cross_cats_sorted":["cs.CE"],"title_canon_sha256":"4f8fea5c2bf40fbf483310829555736b8b70fd3c1caba8d9a1e2896493a3e303","abstract_canon_sha256":"fcee07af03105c64ac1910c2d59a93ebfb1f96253bf9bca4ee3115a3ad7939a7"},"schema_version":"1.0"},"canonical_sha256":"3e95eac46334960d98edb099857c64ee82625d79d2f52ab98e84b733f2808738","source":{"kind":"arxiv","id":"2605.16549","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.16549","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"arxiv_version","alias_value":"2605.16549v1","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.16549","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"pith_short_12","alias_value":"H2K6VRDDGSLA","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"pith_short_16","alias_value":"H2K6VRDDGSLA3GHN","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"pith_short_8","alias_value":"H2K6VRDD","created_at":"2026-05-20T00:02:28Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2026:H2K6VRDDGSLA3GHNWCMYK7DE52","target":"record","payload":{"canonical_record":{"source":{"id":"2605.16549","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-15T18:46:15Z","cross_cats_sorted":["cs.CE"],"title_canon_sha256":"4f8fea5c2bf40fbf483310829555736b8b70fd3c1caba8d9a1e2896493a3e303","abstract_canon_sha256":"fcee07af03105c64ac1910c2d59a93ebfb1f96253bf9bca4ee3115a3ad7939a7"},"schema_version":"1.0"},"canonical_sha256":"3e95eac46334960d98edb099857c64ee82625d79d2f52ab98e84b733f2808738","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-20T00:02:28.678987Z","signature_b64":"AgqOgE+HpCQhnNUiCQgvPkmHgaYzjJYTvJafzM3key9cudEZR7hhSh9qOm3DTJ6GCYLvvHKAOFqM3LBX7ZUEAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"3e95eac46334960d98edb099857c64ee82625d79d2f52ab98e84b733f2808738","last_reissued_at":"2026-05-20T00:02:28.678087Z","signature_status":"signed_v1","first_computed_at":"2026-05-20T00:02:28.678087Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"2605.16549","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-20T00:02:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"yADrZEA3sD9seuUuVBUyGVsn2p6cKtsWjc4M9Mf8r0ggXgq3qcq0PYyJmYXn43XtkliIUMFW/D56QxSKCKQjAQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-28T03:30:13.415533Z"},"content_sha256":"e939baac4698af93c7b2fbe96419109e623137456435391092a97d7e0b2966a1","schema_version":"1.0","event_id":"sha256:e939baac4698af93c7b2fbe96419109e623137456435391092a97d7e0b2966a1"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2026:H2K6VRDDGSLA3GHNWCMYK7DE52","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Post-Quantum Discovery as a Governance Capability: Evidence-Based Cryptographic Visibility and Exposure Prioritisation in a Critical Service Provider","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.CE"],"primary_cat":"cs.CR","authors_text":"Bart Preneel, Edoardo Pena-Gonzalez, Jaime Gomez Garcia, Jelena Zelenovic, Leila Taghizadeh","submitted_at":"2026-05-15T18:46:15Z","abstract_excerpt":"Post Quantum Cryptography (PQC) readiness is increasingly constrained not by algorithm availability, but by cryptographic visibility, dependency complexity, and fragmented governance. This paper presents an anonymised case study of a large European critical service provider that initiated PQC readiness through a discovery first strategy, utilizing tool supported cryptographic inventorying to establish an evidence based baseline prior to migration planning. The discovery phase revealed systemic challenges, including distributed cryptographic ownership, uneven evidence quality across legacy and "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.16549","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2605.16549/integrity.json","findings":[],"available":true,"detectors_run":[{"name":"claim_evidence","ran_at":"2026-05-19T19:21:56.902910Z","status":"completed","version":"1.0.0","findings_count":0},{"name":"ai_meta_artifact","ran_at":"2026-05-19T18:33:26.634821Z","status":"skipped","version":"1.0.0","findings_count":0}],"snapshot_sha256":"342f5e64c2b74f8b4c3fcc927e9ba175a99b0078737e10c18c08f6ae886d1e77"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-20T00:02:28Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"glrheh04tCzpPdScUs8VNzaGrrij8xJKDoDWJ6a0SWZMGfkoTqOfFobfZgcsBtwk8r3BgD2i0YzYAXdgtxu6Aw==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-05-28T03:30:13.415942Z"},"content_sha256":"8906ac11c3cb3606226bbddeb7c4aff7a89a8656770e3f4d094fc3081e5ddfc3","schema_version":"1.0","event_id":"sha256:8906ac11c3cb3606226bbddeb7c4aff7a89a8656770e3f4d094fc3081e5ddfc3"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/H2K6VRDDGSLA3GHNWCMYK7DE52/bundle.json","state_url":"https://pith.science/pith/H2K6VRDDGSLA3GHNWCMYK7DE52/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/H2K6VRDDGSLA3GHNWCMYK7DE52/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-05-28T03:30:13Z","links":{"resolver":"https://pith.science/pith/H2K6VRDDGSLA3GHNWCMYK7DE52","bundle":"https://pith.science/pith/H2K6VRDDGSLA3GHNWCMYK7DE52/bundle.json","state":"https://pith.science/pith/H2K6VRDDGSLA3GHNWCMYK7DE52/state.json","well_known_bundle":"https://pith.science/.well-known/pith/H2K6VRDDGSLA3GHNWCMYK7DE52/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:H2K6VRDDGSLA3GHNWCMYK7DE52","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"fcee07af03105c64ac1910c2d59a93ebfb1f96253bf9bca4ee3115a3ad7939a7","cross_cats_sorted":["cs.CE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-15T18:46:15Z","title_canon_sha256":"4f8fea5c2bf40fbf483310829555736b8b70fd3c1caba8d9a1e2896493a3e303"},"schema_version":"1.0","source":{"id":"2605.16549","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2605.16549","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"arxiv_version","alias_value":"2605.16549v1","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2605.16549","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"pith_short_12","alias_value":"H2K6VRDDGSLA","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"pith_short_16","alias_value":"H2K6VRDDGSLA3GHN","created_at":"2026-05-20T00:02:28Z"},{"alias_kind":"pith_short_8","alias_value":"H2K6VRDD","created_at":"2026-05-20T00:02:28Z"}],"graph_snapshots":[{"event_id":"sha256:8906ac11c3cb3606226bbddeb7c4aff7a89a8656770e3f4d094fc3081e5ddfc3","target":"graph","created_at":"2026-05-20T00:02:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[{"findings_count":0,"name":"claim_evidence","ran_at":"2026-05-19T19:21:56.902910Z","status":"completed","version":"1.0.0"},{"findings_count":0,"name":"ai_meta_artifact","ran_at":"2026-05-19T18:33:26.634821Z","status":"skipped","version":"1.0.0"}],"endpoint":"/pith/2605.16549/integrity.json","findings":[],"snapshot_sha256":"342f5e64c2b74f8b4c3fcc927e9ba175a99b0078737e10c18c08f6ae886d1e77","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"Post Quantum Cryptography (PQC) readiness is increasingly constrained not by algorithm availability, but by cryptographic visibility, dependency complexity, and fragmented governance. This paper presents an anonymised case study of a large European critical service provider that initiated PQC readiness through a discovery first strategy, utilizing tool supported cryptographic inventorying to establish an evidence based baseline prior to migration planning. The discovery phase revealed systemic challenges, including distributed cryptographic ownership, uneven evidence quality across legacy and ","authors_text":"Bart Preneel, Edoardo Pena-Gonzalez, Jaime Gomez Garcia, Jelena Zelenovic, Leila Taghizadeh","cross_cats":["cs.CE"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-15T18:46:15Z","title":"Post-Quantum Discovery as a Governance Capability: Evidence-Based Cryptographic Visibility and Exposure Prioritisation in a Critical Service Provider"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2605.16549","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:e939baac4698af93c7b2fbe96419109e623137456435391092a97d7e0b2966a1","target":"record","created_at":"2026-05-20T00:02:28Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"fcee07af03105c64ac1910c2d59a93ebfb1f96253bf9bca4ee3115a3ad7939a7","cross_cats_sorted":["cs.CE"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-05-15T18:46:15Z","title_canon_sha256":"4f8fea5c2bf40fbf483310829555736b8b70fd3c1caba8d9a1e2896493a3e303"},"schema_version":"1.0","source":{"id":"2605.16549","kind":"arxiv","version":1}},"canonical_sha256":"3e95eac46334960d98edb099857c64ee82625d79d2f52ab98e84b733f2808738","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"3e95eac46334960d98edb099857c64ee82625d79d2f52ab98e84b733f2808738","first_computed_at":"2026-05-20T00:02:28.678087Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-20T00:02:28.678087Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"AgqOgE+HpCQhnNUiCQgvPkmHgaYzjJYTvJafzM3key9cudEZR7hhSh9qOm3DTJ6GCYLvvHKAOFqM3LBX7ZUEAg==","signature_status":"signed_v1","signed_at":"2026-05-20T00:02:28.678987Z","signed_message":"canonical_sha256_bytes"},"source_id":"2605.16549","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:e939baac4698af93c7b2fbe96419109e623137456435391092a97d7e0b2966a1","sha256:8906ac11c3cb3606226bbddeb7c4aff7a89a8656770e3f4d094fc3081e5ddfc3"],"state_sha256":"d4de6b8236fcb23d77f86ccd7903aef23162a7cb7b200a6d4d1d4c83f46012bb"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"OGNtmpzaW5WWEh+JxZLCZNcScMcSfks8nrEaM6iV6tFNkeVkdNJAPDIv810jJaPSWOcCxC/f1MNF/K6Oi0eEDA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-05-28T03:30:13.418211Z","bundle_sha256":"9a9c1f9b7743c4ef2a51dc64938b21f8bb6ac3c2bdeac372f2cb7acbf92d4dbb"}}