{"bundle_type":"pith_open_graph_bundle","bundle_version":"1.0","pith_number":"pith:2016:PUKQNTIPXYGJFVPXTCXCFJAOXW","short_pith_number":"pith:PUKQNTIP","canonical_record":{"source":{"id":"1607.06709","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-07-22T15:22:03Z","cross_cats_sorted":["cs.NI"],"title_canon_sha256":"c7bdf33b1575692658990e0f49e69fedcdf4268e6c138be1dd178d6b21fd34cf","abstract_canon_sha256":"eb523aa09a60ebb3c5f881b686fa7bb407473a1a875aa64ff09da1547a632605"},"schema_version":"1.0"},"canonical_sha256":"7d1506cd0fbe0c92d5f798ae22a40ebda9f415098faef98a6b6edba5087644a2","source":{"kind":"arxiv","id":"1607.06709","version":1},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1607.06709","created_at":"2026-05-18T01:10:39Z"},{"alias_kind":"arxiv_version","alias_value":"1607.06709v1","created_at":"2026-05-18T01:10:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1607.06709","created_at":"2026-05-18T01:10:39Z"},{"alias_kind":"pith_short_12","alias_value":"PUKQNTIPXYGJ","created_at":"2026-05-18T12:30:39Z"},{"alias_kind":"pith_short_16","alias_value":"PUKQNTIPXYGJFVPX","created_at":"2026-05-18T12:30:39Z"},{"alias_kind":"pith_short_8","alias_value":"PUKQNTIP","created_at":"2026-05-18T12:30:39Z"}],"events":[{"event_type":"record_created","subject_pith_number":"pith:2016:PUKQNTIPXYGJFVPXTCXCFJAOXW","target":"record","payload":{"canonical_record":{"source":{"id":"1607.06709","kind":"arxiv","version":1},"metadata":{"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-07-22T15:22:03Z","cross_cats_sorted":["cs.NI"],"title_canon_sha256":"c7bdf33b1575692658990e0f49e69fedcdf4268e6c138be1dd178d6b21fd34cf","abstract_canon_sha256":"eb523aa09a60ebb3c5f881b686fa7bb407473a1a875aa64ff09da1547a632605"},"schema_version":"1.0"},"canonical_sha256":"7d1506cd0fbe0c92d5f798ae22a40ebda9f415098faef98a6b6edba5087644a2","receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-05-18T01:10:39.247475Z","signature_b64":"kvoIx+7OmEn/DSihSEABW+nwTZqUojCcOcvPjsNqQJNYZQv2tVPCDL5nKR8nsSnNJi98jhA7JfzSdbnKeQBCAA==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"7d1506cd0fbe0c92d5f798ae22a40ebda9f415098faef98a6b6edba5087644a2","last_reissued_at":"2026-05-18T01:10:39.247066Z","signature_status":"signed_v1","first_computed_at":"2026-05-18T01:10:39.247066Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"source_kind":"arxiv","source_id":"1607.06709","source_version":1,"attestation_state":"computed"},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T01:10:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"yv5aT+cVq4bnvkYuB2IqwEYTpXoBiqDnus0DbslI8lxojx89zUSLrsd+qaWokH0cSMp3YdDuEb/8q5KtO7/vDg==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-25T22:47:49.141524Z"},"content_sha256":"83314aca1601f7955a4b7daf9e3519ff3dd2b3d70b42747b2e4c64832831ef13","schema_version":"1.0","event_id":"sha256:83314aca1601f7955a4b7daf9e3519ff3dd2b3d70b42747b2e4c64832831ef13"},{"event_type":"graph_snapshot","subject_pith_number":"pith:2016:PUKQNTIPXYGJFVPXTCXCFJAOXW","target":"graph","payload":{"graph_snapshot":{"paper":{"title":"An initial study of the effect of pipelining in hiding HTTP/2.0 response sizes","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","headline":"","cross_cats":["cs.NI"],"primary_cat":"cs.CR","authors_text":"Ricardo Morla","submitted_at":"2016-07-22T15:22:03Z","abstract_excerpt":"HTTP response size is a well-known side channel attack. With the deployment of HTTP/2.0, response size attacks are generally dismissed with the argument that pipelining and response multiplexing prevent eavesdroppers from finding out response sizes. Yet the extent to which pipelining and response multiplexing actually hide HTTP response sizes has not been adequately investigated. In this paper we set out to help understand the effect of pipelining in hiding the size of web objects on the Internet. We conduct an experiment that provides browser-side HTTP response sizes and network-captured TLS "},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1607.06709","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"verdict_id":null},"signer":{"signer_id":"pith.science","signer_type":"pith_registry","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"created_at":"2026-05-18T01:10:39Z","supersedes":[],"prev_event":null,"signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"wLSHzDgtQLaJ2oJyRzvwziuixuC5LDcwShgxkerLrfBTk9/571ZQkU/PKR5SH2yd9XOSj+TlHMQISedOTs3cDQ==","signed_message":"open_graph_event_sha256_bytes","signed_at":"2026-06-25T22:47:49.141879Z"},"content_sha256":"5e0ab1cda8b91e05494106c553ba64d3056d8d3c4930d258df77032445fcd133","schema_version":"1.0","event_id":"sha256:5e0ab1cda8b91e05494106c553ba64d3056d8d3c4930d258df77032445fcd133"}],"timestamp_proofs":[],"mirror_hints":[{"mirror_type":"https","name":"Pith Resolver","base_url":"https://pith.science","bundle_url":"https://pith.science/pith/PUKQNTIPXYGJFVPXTCXCFJAOXW/bundle.json","state_url":"https://pith.science/pith/PUKQNTIPXYGJFVPXTCXCFJAOXW/state.json","well_known_bundle_url":"https://pith.science/.well-known/pith/PUKQNTIPXYGJFVPXTCXCFJAOXW/bundle.json","status":"primary"}],"public_keys":[{"key_id":"pith-v1-2026-05","algorithm":"ed25519","format":"raw","public_key_b64":"stVStoiQhXFxp4s2pdzPNoqVNBMojDU/fJ2db5S3CbM=","public_key_hex":"b2d552b68890857171a78b36a5dccf368a953413288c353f7c9d9d6f94b709b3","fingerprint_sha256_b32_first128bits":"RVFV5Z2OI2J3ZUO7ERDEBCYNKS","fingerprint_sha256_hex":"8d4b5ee74e4693bcd1df2446408b0d54","rotates_at":null,"url":"https://pith.science/pith-signing-key.json","notes":"Pith uses this Ed25519 key to sign canonical record SHA-256 digests. Verify with: ed25519_verify(public_key, message=canonical_sha256_bytes, signature=base64decode(signature_b64))."}],"merge_version":"pith-open-graph-merge-v1","built_at":"2026-06-25T22:47:49Z","links":{"resolver":"https://pith.science/pith/PUKQNTIPXYGJFVPXTCXCFJAOXW","bundle":"https://pith.science/pith/PUKQNTIPXYGJFVPXTCXCFJAOXW/bundle.json","state":"https://pith.science/pith/PUKQNTIPXYGJFVPXTCXCFJAOXW/state.json","well_known_bundle":"https://pith.science/.well-known/pith/PUKQNTIPXYGJFVPXTCXCFJAOXW/bundle.json"},"state":{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2016:PUKQNTIPXYGJFVPXTCXCFJAOXW","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"eb523aa09a60ebb3c5f881b686fa7bb407473a1a875aa64ff09da1547a632605","cross_cats_sorted":["cs.NI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-07-22T15:22:03Z","title_canon_sha256":"c7bdf33b1575692658990e0f49e69fedcdf4268e6c138be1dd178d6b21fd34cf"},"schema_version":"1.0","source":{"id":"1607.06709","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"1607.06709","created_at":"2026-05-18T01:10:39Z"},{"alias_kind":"arxiv_version","alias_value":"1607.06709v1","created_at":"2026-05-18T01:10:39Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.1607.06709","created_at":"2026-05-18T01:10:39Z"},{"alias_kind":"pith_short_12","alias_value":"PUKQNTIPXYGJ","created_at":"2026-05-18T12:30:39Z"},{"alias_kind":"pith_short_16","alias_value":"PUKQNTIPXYGJFVPX","created_at":"2026-05-18T12:30:39Z"},{"alias_kind":"pith_short_8","alias_value":"PUKQNTIP","created_at":"2026-05-18T12:30:39Z"}],"graph_snapshots":[{"event_id":"sha256:5e0ab1cda8b91e05494106c553ba64d3056d8d3c4930d258df77032445fcd133","target":"graph","created_at":"2026-05-18T01:10:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"paper":{"abstract_excerpt":"HTTP response size is a well-known side channel attack. With the deployment of HTTP/2.0, response size attacks are generally dismissed with the argument that pipelining and response multiplexing prevent eavesdroppers from finding out response sizes. Yet the extent to which pipelining and response multiplexing actually hide HTTP response sizes has not been adequately investigated. In this paper we set out to help understand the effect of pipelining in hiding the size of web objects on the Internet. We conduct an experiment that provides browser-side HTTP response sizes and network-captured TLS ","authors_text":"Ricardo Morla","cross_cats":["cs.NI"],"headline":"","license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-07-22T15:22:03Z","title":"An initial study of the effect of pipelining in hiding HTTP/2.0 response sizes"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"1607.06709","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:83314aca1601f7955a4b7daf9e3519ff3dd2b3d70b42747b2e4c64832831ef13","target":"record","created_at":"2026-05-18T01:10:39Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"eb523aa09a60ebb3c5f881b686fa7bb407473a1a875aa64ff09da1547a632605","cross_cats_sorted":["cs.NI"],"license":"http://arxiv.org/licenses/nonexclusive-distrib/1.0/","primary_cat":"cs.CR","submitted_at":"2016-07-22T15:22:03Z","title_canon_sha256":"c7bdf33b1575692658990e0f49e69fedcdf4268e6c138be1dd178d6b21fd34cf"},"schema_version":"1.0","source":{"id":"1607.06709","kind":"arxiv","version":1}},"canonical_sha256":"7d1506cd0fbe0c92d5f798ae22a40ebda9f415098faef98a6b6edba5087644a2","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"7d1506cd0fbe0c92d5f798ae22a40ebda9f415098faef98a6b6edba5087644a2","first_computed_at":"2026-05-18T01:10:39.247066Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-05-18T01:10:39.247066Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"kvoIx+7OmEn/DSihSEABW+nwTZqUojCcOcvPjsNqQJNYZQv2tVPCDL5nKR8nsSnNJi98jhA7JfzSdbnKeQBCAA==","signature_status":"signed_v1","signed_at":"2026-05-18T01:10:39.247475Z","signed_message":"canonical_sha256_bytes"},"source_id":"1607.06709","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:83314aca1601f7955a4b7daf9e3519ff3dd2b3d70b42747b2e4c64832831ef13","sha256:5e0ab1cda8b91e05494106c553ba64d3056d8d3c4930d258df77032445fcd133"],"state_sha256":"8dd3d963f9825ee8ba3209be415c4505346c8464ec76bc4ba44a68796331a6f4"},"bundle_signature":{"signature_status":"signed_v1","algorithm":"ed25519","key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signature_b64":"pPGknqDqALbswrNGPCN4XyUEr56Ytn+P4bLwv0rXmTqiWsB7l33D9cEGzJp3VMFVrP65u9hit4f2M1wvlAYEDg==","signed_message":"bundle_sha256_bytes","signed_at":"2026-06-25T22:47:49.143922Z","bundle_sha256":"f54f494568e017148b83d8a3addd8fbd44e5d4b49492899f5ddebeb40d18a865"}}