{"id":"https://openalex.org/W7202111007","doi":"https://doi.org/10.48550/arxiv.2608.06508","title":"Canonicalization Failures as a Recurring Vulnerability Class: Representation Divergence in Cryptographic Systems and Its Avoidance","display_name":"Canonicalization Failures as a Recurring Vulnerability Class: Representation Divergence in Cryptographic Systems and Its Avoidance","publication_year":2026,"publication_date":"2026-08-06","ids":{"openalex":"https://openalex.org/W7202111007","doi":"https://doi.org/10.48550/arxiv.2608.06508"},"language":null,"primary_location":{"id":"pmh:oai:arXiv.org:2608.06508","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.06508","pdf_url":"https://arxiv.org/pdf/2608.06508","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2608.06508","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5057385912","display_name":"Arslan Br\u00f6mme","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Br\u00f6mme, Arslan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":["https://openalex.org/A5057385912"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.9634000062942505,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10951","display_name":"Cryptographic Implementations and Security","score":0.9634000062942505,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.010499999858438969,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10237","display_name":"Cryptography and Data Security","score":0.007199999876320362,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/canonicalization","display_name":"canonicalization","score":0.859000027179718},{"id":"https://openalex.org/keywords/cryptographic-vulnerabilities","display_name":"cryptographic vulnerabilities","score":0.6679999828338623},{"id":"https://openalex.org/keywords/vulnerability-classification","display_name":"vulnerability classification","score":0.5370000004768372},{"id":"https://openalex.org/keywords/semantic-encoding","display_name":"semantic encoding","score":0.30300000309944153},{"id":"https://openalex.org/keywords/replay-protection","display_name":"replay protection","score":0.5099999904632568}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6952999830245972},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.5584999918937683},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.5386000275611877},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.5364999771118164},{"id":"https://openalex.org/C2776359362","wikidata":"https://www.wikidata.org/wiki/Q2145286","display_name":"Representation (politics)","level":3,"score":0.512499988079071},{"id":"https://openalex.org/C99138194","wikidata":"https://www.wikidata.org/wiki/Q183427","display_name":"Hash function","level":2,"score":0.5026000142097473},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5013999938964844},{"id":"https://openalex.org/C2781238097","wikidata":"https://www.wikidata.org/wiki/Q175026","display_name":"Object (grammar)","level":2,"score":0.48539999127388},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.46160000562667847},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.450300008058548},{"id":"https://openalex.org/C33884865","wikidata":"https://www.wikidata.org/wiki/Q1254335","display_name":"Cryptographic protocol","level":3,"score":0.44269999861717224},{"id":"https://openalex.org/C2777021972","wikidata":"https://www.wikidata.org/wiki/Q22976830","display_name":"Uniqueness","level":2,"score":0.43540000915527344},{"id":"https://openalex.org/C154504017","wikidata":"https://www.wikidata.org/wiki/Q853614","display_name":"Identifier","level":2,"score":0.3871000111103058},{"id":"https://openalex.org/C15927051","wikidata":"https://www.wikidata.org/wiki/Q246593","display_name":"Cryptographic primitive","level":4,"score":0.38109999895095825},{"id":"https://openalex.org/C75949130","wikidata":"https://www.wikidata.org/wiki/Q848010","display_name":"Database transaction","level":2,"score":0.35040000081062317},{"id":"https://openalex.org/C2778355321","wikidata":"https://www.wikidata.org/wiki/Q17079427","display_name":"Identity (music)","level":2,"score":0.3384000062942505},{"id":"https://openalex.org/C62354387","wikidata":"https://www.wikidata.org/wiki/Q875399","display_name":"Boundary (topology)","level":2,"score":0.3361000120639801},{"id":"https://openalex.org/C25810664","wikidata":"https://www.wikidata.org/wiki/Q44325","display_name":"Ontology","level":2,"score":0.33000001311302185},{"id":"https://openalex.org/C2778112365","wikidata":"https://www.wikidata.org/wiki/Q3511065","display_name":"Sequence (biology)","level":2,"score":0.31290000677108765},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.30219998955726624},{"id":"https://openalex.org/C2776291640","wikidata":"https://www.wikidata.org/wiki/Q2912517","display_name":"Value (mathematics)","level":2,"score":0.29179999232292175},{"id":"https://openalex.org/C149364088","wikidata":"https://www.wikidata.org/wiki/Q185917","display_name":"Translation (biology)","level":4,"score":0.27790001034736633},{"id":"https://openalex.org/C9996903","wikidata":"https://www.wikidata.org/wiki/Q1749235","display_name":"Cryptographic nonce","level":3,"score":0.2736000120639801},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.2612000107765198},{"id":"https://openalex.org/C7608002","wikidata":"https://www.wikidata.org/wiki/Q477202","display_name":"Cryptographic hash function","level":3,"score":0.2533999979496002},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.25099998712539673}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2608.06508","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.06508","pdf_url":"https://arxiv.org/pdf/2608.06508","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2608.06508","doi":"https://doi.org/10.48550/arxiv.2608.06508","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2608.06508","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2608.06508","doi":null,"is_oa":true,"landing_page_url":"https://arxiv.org/abs/2608.06508","pdf_url":"https://arxiv.org/pdf/2608.06508","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7202111007.pdf","grobid_xml":"https://content.openalex.org/works/W7202111007.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Cryptographic":[0],"systems":[1],"operate":[2],"on":[3,41],"bytes":[4],"but":[5,131,224],"mean":[6],"semantic":[7,119],"objects.":[8],"The":[9,44,121],"translation":[10,158],"between":[11,146],"the":[12,42,84,126,129,134,144,157,183,191,208,218,239],"two":[13,100],"is":[14,20,123,132,212],"rarely":[15],"unique.":[16],"Where":[17],"this":[18],"uniqueness":[19,97,215],"not":[21,125,202],"enforced,":[22],"an":[23,160,177],"attack":[24],"surface":[25],"opens":[26],"up":[27],"as":[28,30,59,77],"soon":[29],"a":[31,33,78,151,168,173,221],"hash,":[32],"signature,":[34],"replay":[35],"protection,":[36],"or":[37,67,112,231],"consensus":[38],"identity":[39],"depends":[40],"representation.":[43],"same":[45],"class":[46,192],"of":[47,94,128,170,220],"failure":[48,222],"has":[49],"been":[50],"discovered":[51],"independently":[52],"and":[53,150,153,156,176,205],"named":[54],"locally":[55],"across":[56],"many":[57],"ecosystems,":[58],"transaction":[60],"malleability,":[61,66,70],"non-deterministic":[62],"value":[63],"encoding,":[64],"message":[65],"hash":[68],"chain":[69],"without":[71],"its":[72],"common":[73],"root":[74],"being":[75],"tracked":[76],"cross-ecosystem":[79],"grid.":[80],"This":[81],"work":[82],"organizes":[83],"scattered":[85],"findings":[86],"systematically:":[87],"it":[88,197,225],"shows":[89],"that":[90,200],"they":[91],"are":[92,201],"instances":[93],"one":[95,107,113],"violated":[96],"condition,":[98],"along":[99],"basic":[101],"directions:":[102],"multiple":[103,110,116],"valid":[104],"codes":[105],"for":[106,115],"object":[108],"(object-side":[109],"representation)":[111],"code":[114],"objects":[117],"(code-side":[118],"collapse).":[120],"contribution":[122],"explicitly":[124],"discovery":[127],"phenomenon,":[130],"threefold:":[133],"systematization":[135],"by":[136,141],"representation":[137,203],"mechanism":[138],"rather":[139],"than":[140],"affected":[142],"system,":[143],"bridge":[145],"classical":[147],"canonicalization":[148,165],"security":[149,237],"representation-":[152],"computability-theoretic":[154],"foundation,":[155],"into":[159],"applicable":[161],"review":[162,171],"procedure":[163],"(a":[164],"obligation":[166],"with":[167,181,193],"sequence":[169],"steps,":[172],"field-type":[174],"classification,":[175],"operational":[178],"boundary":[179],"model)":[180],"which":[182],"risk":[184],"can":[185,216],"be":[186],"recognized":[187],"preventively.":[188],"We":[189],"substantiate":[190],"worked-out":[194],"cases,":[195],"delimit":[196],"against":[198],"incidents":[199],"problems,":[204],"deliberately":[206],"keep":[207],"claims":[209],"to":[210],"what":[211],"demonstrable:":[213],"enforced":[214],"reduce":[217],"exploitability":[219],"class,":[223],"neither":[226],"replaces":[227],"further":[228],"protective":[229],"measures":[230],"makes":[232],"any":[233],"statement":[234],"about":[235],"cryptographic":[236],"in":[238],"narrower":[240],"sense":[241]},"counts_by_year":[],"updated_date":"2026-09-25T08:18:29.962427","created_date":"2026-08-11T00:00:00"}