{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2019:NH6XAWHMUZM5JRU4Y6W435QSO4","short_pith_number":"pith:NH6XAWHM","canonical_record":{"source":{"id":"1905.13737","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-05-31T17:42:50Z","cross_cats_sorted":[],"title_canon_sha256":"90b3360d4429662c5fdd22c72fe24ba939c52d59a3dcad27282fdfe4523cc7a2","abstract_canon_sha256":"5bf7f5e4f453f21c424a7f3a06ab966522263ed3ffb4d494023e3b76bf1c2983"},"schema_version":"1.0"},"canonical_sha256":"69fd7058eca659d4c69cc7adcdf6127718861350b9d95f5c80d933f0413e6cd3","source":{"kind":"arxiv","id":"1905.13737","version":3},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1905.13737","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"arxiv_version","alias_value":"1905.13737v3","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1905.13737","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"pith_short_12","alias_value":"NH6XAWHMUZM5","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"pith_short_16","alias_value":"NH6XAWHMUZM5JRU4","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"pith_short_8","alias_value":"NH6XAWHM","created_at":"2026-07-05T00:02:13Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2019:NH6XAWHMUZM5JRU4Y6W435QSO4","target":"record","payload":{"canonical_record":{"source":{"id":"1905.13737","kind":"arxiv","version":3},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-05-31T17:42:50Z","cross_cats_sorted":[],"title_canon_sha256":"90b3360d4429662c5fdd22c72fe24ba939c52d59a3dcad27282fdfe4523cc7a2","abstract_canon_sha256":"5bf7f5e4f453f21c424a7f3a06ab966522263ed3ffb4d494023e3b76bf1c2983"},"schema_version":"1.0"},"canonical_sha256":"69fd7058eca659d4c69cc7adcdf6127718861350b9d95f5c80d933f0413e6cd3","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T00:02:13.679347Z","signature_b64":"XiBUwFMN6qJJC18KuRp7cbL8BuOi1KkOqSBNhXdHdv/ElkzhCXbiVFiEhnPBxqrvFYetodo3C84iOhERmUaXAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"69fd7058eca659d4c69cc7adcdf6127718861350b9d95f5c80d933f0413e6cd3","last_reissued_at":"2026-07-05T00:02:13.678871Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T00:02:13.678871Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1905.13737","source_version":3,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T00:02:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"FArd0urB0VuH1lncbFE1wUgS8HfhuScTgNn3k5MCswb6rR5CKS1/1Oi0UhyQPfnMqJ5miEpel4oFCf+p656xAg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-20T22:41:17.194447Z"},"content_sha256":"7c5e9920ff5beee5cf39dae0e66302e24b13fff11f8cbabe71f9e373306c75ba","schema_version":"1.0","event_id":"sha256:7c5e9920ff5beee5cf39dae0e66302e24b13fff11f8cbabe71f9e373306c75ba"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2019:NH6XAWHMUZM5JRU4Y6W435QSO4","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"Protocols for Checking Compromised Credentials","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":[],"primary_cat":"cs.CR","authors_text":"Bijeeta Pal, Junade Ali, Lucy Li, Nick Sullivan, Rahul Chatterjee, Thomas Ristenpart","submitted_at":"2019-05-31T17:42:50Z","abstract_excerpt":"To prevent credential stuffing attacks, industry best practice now proactively checks if user credentials are present in known data breaches. Recently, some web services, such as HaveIBeenPwned (HIBP) and Google Password Checkup (GPC), have started providing APIs to check for breached passwords. We refer to such services as compromised credential checking (C3) services. We give the first formal description of C3 services, detailing different settings and operational requirements, and we give relevant threat models.\n  One key security requirement is the secrecy of a user's passwords that are be"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1905.13737","kind":"arxiv","version":3},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/1905.13737/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-07-05T00:02:13Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wDaT7fVQU4x3sSeyBxPKPDFUkAfXoTlLuT0wWaa+VA4VO6SgoeZG4nFBnbobh45bDv1Dgj/82FhVRYDsrDlDDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-08-20T22:41:17.195338Z"},"content_sha256":"7c0a9885ceb03ef4742d483b0d7904277ed30d82cc47d65882db343808ef919d","schema_version":"1.0","event_id":"sha256:7c0a9885ceb03ef4742d483b0d7904277ed30d82cc47d65882db343808ef919d"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/NH6XAWHMUZM5JRU4Y6W435QSO4/bundle.json","state_url":"https://pith.science/pith/NH6XAWHMUZM5JRU4Y6W435QSO4/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/NH6XAWHMUZM5JRU4Y6W435QSO4/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-08-20T22:41:17Z","links":{"resolver":"https://pith.science/pith/NH6XAWHMUZM5JRU4Y6W435QSO4","bundle":"https://pith.science/pith/NH6XAWHMUZM5JRU4Y6W435QSO4/bundle.json","state":"https://pith.science/pith/NH6XAWHMUZM5JRU4Y6W435QSO4/state.json","well_known_bundle":"https://pith.science/.well-known/pith/NH6XAWHMUZM5JRU4Y6W435QSO4/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2019:NH6XAWHMUZM5JRU4Y6W435QSO4","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"5bf7f5e4f453f21c424a7f3a06ab966522263ed3ffb4d494023e3b76bf1c2983","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-05-31T17:42:50Z","title_canon_sha256":"90b3360d4429662c5fdd22c72fe24ba939c52d59a3dcad27282fdfe4523cc7a2"},"schema_version":"1.0","source":{"id":"1905.13737","kind":"arxiv","version":3}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1905.13737","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"arxiv_version","alias_value":"1905.13737v3","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1905.13737","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"pith_short_12","alias_value":"NH6XAWHMUZM5","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"pith_short_16","alias_value":"NH6XAWHMUZM5JRU4","created_at":"2026-07-05T00:02:13Z"},{"alias_kind":"pith_short_8","alias_value":"NH6XAWHM","created_at":"2026-07-05T00:02:13Z"}],"graph_snapshots":[{"event_id":"sha256:7c0a9885ceb03ef4742d483b0d7904277ed30d82cc47d65882db343808ef919d","target":"graph","created_at":"2026-07-05T00:02:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/1905.13737/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"To prevent credential stuffing attacks, industry best practice now proactively checks if user credentials are present in known data breaches. Recently, some web services, such as HaveIBeenPwned (HIBP) and Google Password Checkup (GPC), have started providing APIs to check for breached passwords. We refer to such services as compromised credential checking (C3) services. We give the first formal description of C3 services, detailing different settings and operational requirements, and we give relevant threat models.\n  One key security requirement is the secrecy of a user's passwords that are be","authors_text":"Bijeeta Pal, Junade Ali, Lucy Li, Nick Sullivan, Rahul Chatterjee, Thomas Ristenpart","cross_cats":[],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-05-31T17:42:50Z","title":"Protocols for Checking Compromised Credentials"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1905.13737","kind":"arxiv","version":3},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:7c5e9920ff5beee5cf39dae0e66302e24b13fff11f8cbabe71f9e373306c75ba","target":"record","created_at":"2026-07-05T00:02:13Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"5bf7f5e4f453f21c424a7f3a06ab966522263ed3ffb4d494023e3b76bf1c2983","cross_cats_sorted":[],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2019-05-31T17:42:50Z","title_canon_sha256":"90b3360d4429662c5fdd22c72fe24ba939c52d59a3dcad27282fdfe4523cc7a2"},"schema_version":"1.0","source":{"id":"1905.13737","kind":"arxiv","version":3}},"canonical_sha256":"69fd7058eca659d4c69cc7adcdf6127718861350b9d95f5c80d933f0413e6cd3","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"69fd7058eca659d4c69cc7adcdf6127718861350b9d95f5c80d933f0413e6cd3","first_computed_at":"2026-07-05T00:02:13.678871Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T00:02:13.678871Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"XiBUwFMN6qJJC18KuRp7cbL8BuOi1KkOqSBNhXdHdv/ElkzhCXbiVFiEhnPBxqrvFYetodo3C84iOhERmUaXAg==","signature_status":"signed_v1","signed_at":"2026-07-05T00:02:13.679347Z","signed_message":"canonical_sha256_bytes"},"source_id":"1905.13737","source_kind":"arxiv","source_version":3}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:7c5e9920ff5beee5cf39dae0e66302e24b13fff11f8cbabe71f9e373306c75ba","sha256:7c0a9885ceb03ef4742d483b0d7904277ed30d82cc47d65882db343808ef919d"],"state_sha256":"c42ff2dd543323ca85b4f2fc80d669dcc6ecdee1bdf4d0f563a2e9969c868eb3"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"jYws8jWsMQ54ZZ0xMTUa/7fS+wGMshAZHlK3IfXLT5vVABiUuBFpMc6Td4Zhqan9j/qyoIFWd/7TmMMV0cwUCA==","signed_message":"bundle_sha256_bytes","signed_at":"2026-08-20T22:41:17.202739Z","bundle_sha256":"b498ece2b50a46194b85a8a490c802a265cc18b89a7ae6240e7d488a5c999d4e"}}