{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:JWD4ZPCMCHWG2F6D5A6QX4LTOW","short_pith_number":"pith:JWD4ZPCM","schema_version":"1.0","canonical_sha256":"4d87ccbc4c11ec6d17c3e83d0bf1737583989526ea931cdecac3e4537e33e7c0","source":{"kind":"arxiv","id":"2509.09331","version":1},"attestation_state":"computed","paper":{"title":"On the Security of SSH Client Signatures","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Fabian B\\\"aumer, J\\\"org Schwenk, Juraj Somorovsky, Marcus Brinkmann, Maximilian Radoy","submitted_at":"2025-09-11T10:32:13Z","abstract_excerpt":"Administrators and developers use SSH client keys and signatures for authentication, for example, to access internet backbone servers or to commit new code on platforms like GitHub. However, unlike servers, SSH clients cannot be measured through internet scans. We close this gap in two steps. First, we collect SSH client public keys. Such keys are regularly published by their owners on open development platforms like GitHub and GitLab. We systematize previous non-academic work by subjecting these keys to various security tests in a longitudinal study. Second, in a series of black-box lab exper"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2509.09331","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2025-09-11T10:32:13Z","cross_cats_sorted":[],"title_canon_sha256":"038603e13517e6ccc88be4d65aaa3e6e9cd12cc97198f6a26c183fb790ea4ff9","abstract_canon_sha256":"52d6c324b3e4edd88406dcd100b182617ab6c5d15574b7df422e7f2713d82ef8"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T12:09:34.231351Z","signature_b64":"DsGYu+LmcrY/juugf9B4jhfM3krupASvzIsGXvVPZr93oW50/f8IsmSML5hkH5hM5/tJVOa9SR3F+f0B/3i4Cg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"4d87ccbc4c11ec6d17c3e83d0bf1737583989526ea931cdecac3e4537e33e7c0","last_reissued_at":"2026-07-05T12:09:34.230816Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T12:09:34.230816Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"On the Security of SSH Client Signatures","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Fabian B\\\"aumer, J\\\"org Schwenk, Juraj Somorovsky, Marcus Brinkmann, Maximilian Radoy","submitted_at":"2025-09-11T10:32:13Z","abstract_excerpt":"Administrators and developers use SSH client keys and signatures for authentication, for example, to access internet backbone servers or to commit new code on platforms like GitHub. However, unlike servers, SSH clients cannot be measured through internet scans. We close this gap in two steps. First, we collect SSH client public keys. Such keys are regularly published by their owners on open development platforms like GitHub and GitLab. We systematize previous non-academic work by subjecting these keys to various security tests in a longitudinal study. Second, in a series of black-box lab exper"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2509.09331","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2509.09331/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2509.09331","created_at":"2026-07-05T12:09:34.230877+00:00"},{"alias_kind":"arxiv_version","alias_value":"2509.09331v1","created_at":"2026-07-05T12:09:34.230877+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2509.09331","created_at":"2026-07-05T12:09:34.230877+00:00"},{"alias_kind":"pith_short_12","alias_value":"JWD4ZPCMCHWG","created_at":"2026-07-05T12:09:34.230877+00:00"},{"alias_kind":"pith_short_16","alias_value":"JWD4ZPCMCHWG2F6D","created_at":"2026-07-05T12:09:34.230877+00:00"},{"alias_kind":"pith_short_8","alias_value":"JWD4ZPCM","created_at":"2026-07-05T12:09:34.230877+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":0,"internal_anchor_count":0,"sample":[]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/JWD4ZPCMCHWG2F6D5A6QX4LTOW","json":"https://pith.science/pith/JWD4ZPCMCHWG2F6D5A6QX4LTOW.json","graph_json":"https://pith.science/api/pith-number/JWD4ZPCMCHWG2F6D5A6QX4LTOW/graph.json","events_json":"https://pith.science/api/pith-number/JWD4ZPCMCHWG2F6D5A6QX4LTOW/events.json","paper":"https://pith.science/paper/JWD4ZPCM"},"agent_actions":{"view_html":"https://pith.science/pith/JWD4ZPCMCHWG2F6D5A6QX4LTOW","download_json":"https://pith.science/pith/JWD4ZPCMCHWG2F6D5A6QX4LTOW.json","view_paper":"https://pith.science/paper/JWD4ZPCM","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2509.09331&json=true","fetch_graph":"https://pith.science/api/pith-number/JWD4ZPCMCHWG2F6D5A6QX4LTOW/graph.json","fetch_events":"https://pith.science/api/pith-number/JWD4ZPCMCHWG2F6D5A6QX4LTOW/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/JWD4ZPCMCHWG2F6D5A6QX4LTOW/action/timestamp_anchor","attest_storage":"https://pith.science/pith/JWD4ZPCMCHWG2F6D5A6QX4LTOW/action/storage_attestation","attest_author":"https://pith.science/pith/JWD4ZPCMCHWG2F6D5A6QX4LTOW/action/author_attestation","sign_citation":"https://pith.science/pith/JWD4ZPCMCHWG2F6D5A6QX4LTOW/action/citation_signature","submit_replication":"https://pith.science/pith/JWD4ZPCMCHWG2F6D5A6QX4LTOW/action/replication_record"}},"created_at":"2026-07-05T12:09:34.230877+00:00","updated_at":"2026-07-05T12:09:34.230877+00:00"}