%-------------------------------------------------------------------------------
% Sequent Calculus
%-------------------------------------------------------------------------------

\section{Sequent Calculus}

We now attempt to describe proof search for LF.
Given a type $A$, we seek to determine whether $A$
is inhabited. The backbone of our method will be sequent calculi.

\renewcommand{\PiTyp}[3]{\Pi #1 : #2.\ #3}
\renewcommand{\Lam}[2]{\lambda #1.\ #2}

\subsection{Backward sequent calculus}
For our sequent calculi, we distinguish between $\Pi$ types
that refer to their argument.  We write types
$\PiTyp{x}{A}{B}$ where $x$ is not free in $B$ as
$A \LFArr B$.  The sequents have two regions in the antecedent:

\newcommand{\Sequent}[4][]{#2\ ;\ #3 \SeqArr_{#1} #4}

$$
\begin{array}{llll}
\mathbf{Sequents} & S & ::= & \Sequent[\Sigma]{\Delta}{\Gamma}{A} \\
\end{array}
$$

\noindent
where $\Sigma$ refers to the signature (and is usually omitted),
$\Gamma$ is a context, and $\Delta$ is a list of parameters.
This stratification is the basis of the operational semantics
of Twelf, and is described in \incomplete{Where is this described?}
A sequent $\Sequent{\Delta}{\Gamma}{A}$
can be interpreted as ``from parameters $\Delta$ and hypotheses
and derivations $\Gamma$ we can show $A$''.

$$
\begin{array}{c}
\infer[init]{\Sequent{\Delta}{\Gamma,A}{A}}{} \\\\
\infer[\LFArr_R]{\Sequent{\Delta}{\Gamma}{A\LFArr B}}
                {\Sequent{\Delta}{\Gamma,A}{B}} \\\\
\infer[\LFArr_L]{\Sequent{\Delta}{\Gamma,A\LFArr B}{C}}
                {\Sequent{\Delta}{\Gamma,A\LFArr B}{A} &
                 \Sequent{\Delta}{\Gamma,A\LFArr B,B}{C}}\\\\
\infer[\Pi_R]{\Sequent{\Delta}{\Gamma}{\PiTyp{x}{A}{B}}}
             {\Sequent{\Delta,x:A}{\Gamma}{B}} \\\\
\infer[\Pi_L]{\Sequent{\Delta}{\Gamma,\PiTyp{x}{A}{B}}{C}}
             {\Sequent{\Delta}{\Gamma,\PiTyp{x}{A}{B},\HSub{M}{x}{A}{B}}{C} &
              \Gamma \vdash M : A}
\end{array}
$$

\subsection{Proof terms for backward sequent calculus}

  We can attach proof terms in the following manner, giving
witnesses of inhabitation.

$$
\begin{array}{c}
\infer[init]{\Sequent{\Delta}{\Gamma,x:A}{x:A}}{} \\\\
\infer[\LFArr_R]{\Sequent{\Delta}{\Gamma}{\Lam{x}{M} : A\LFArr B}}
                {\Sequent{\Delta}{\Gamma,x:A}{M:B}} \\\\
\infer[\LFArr_L]{\Sequent{\Delta}{\Gamma,x:A\LFArr B}{\HSub{x\ M}{y}{B}{C}}}
                {\Sequent{\Delta}{\Gamma,x:A\LFArr B}{M:A} &
                 \Sequent{\Delta}{\Gamma,x:A\LFArr B,y:B}{C}}\\\\
\infer[\Pi_R]{\Sequent{\Delta}{\Gamma}{\PiTyp{x}{A}{M}:\PiTyp{x}{A}{B}}}
             {\Sequent{\Delta,x:A}{\Gamma}{M:B}} \\\\
\infer[\Pi_L]{\Sequent{\Delta}{\Gamma,y : \PiTyp{x}{A}{B}}{[y\ M/z] C}}
             {\Sequent{\Delta}{\Gamma,y : \PiTyp{x}{A}{B},z : \HSub{M}{x}{A}{B}}{C} &
              \Gamma \vdash M : A}
\end{array}
$$

\subsection{Forward sequent calculus}

The backward rules defined above lead to a backward style search
of the space of proof terms.
 In some cases, it is preferable to
search forward from the program, rather than backwards from the
goal.

\renewcommand{\Sequent}[4][]{#2\ ;\ #3 \longrightarrow_{#1} #4}

$$
\begin{array}{llll}
\mathbf{Sequents} & S & ::= & \Sequent[\Sigma]{\Delta}{\Gamma}{A} \\
\end{array}
$$

 This is formalized in the following sequent, which in contrast
to the backward case, is read as ``from parameters $\Delta$,
using \emph{all} the hypotheses in $\Gamma$ we can show $A$''.
We correspondingly read the rules from top to bottom, rather
than from bottom to top.

$$
\begin{array}{c}
\infer[init]{\Sequent{\cdot}{A}{A}}{} \\\\
\infer[\LFArr_{R1}]{\Sequent{\Delta}{\Gamma}{A\LFArr B}}
                  {\Sequent{\Delta}{\Gamma,A}{B}} \\\\
\infer[\LFArr_{R2}]{\Sequent{\Delta}{\Gamma}{A\LFArr B}}
                  {\Sequent{\Delta}{\Gamma}{B}} \\\\
\infer[\LFArr_L]{\Sequent{\Delta}{\Gamma_1\cup\Gamma_2,A\LFArr B}{C}}
                {\Sequent{\Delta}{\Gamma_1}{A} &
                 \Sequent{\Delta}{\Gamma_2,B}{C}}\\\\
\infer[\Pi_R]{\Sequent{\Delta}{\Gamma}{\PiTyp{x}{A}{B}}}
             {\Sequent{\Delta,x:A}{\Gamma}{B}} \\\\
\infer[\Pi_L]{\Sequent{\Delta}{\Gamma,\PiTyp{x}{A}{B}}{C}}
             {\Sequent{\Delta}{\Gamma,\HSub{M}{x}{A}{B}}{C} &
              \Gamma \vdash M : A}
\end{array}
$$

\subsection{ProoF Terms for Forward Sequent Calculus}

Proof terms in the forward direction are complicated by the
$\LFArr_L$ rule, where the hypotheses are split and joined.
We can handle this in one of two ways: either we can
track which hypotheses are used where and create proof terms
at each step, or we can maintain some kind of minimal information
that allows us to construct a backward-style/natural deduction
proof term when search is complete.  We have yet to experiment
with these options, and thus leave this section incomplete.

\subsection{The Subformula Property}

LF has a straightforward subformula property:

$$
\begin{array}{llll}
\mathbf{Positive} & E^+ & ::= & P^+ \Spb A_1^- \LFArr A_2^+ \Spb \PiTyp{x}{A^-}{B^+}\\
\mathbf{Negative} & E^+ & ::= & P^- \Spb A_1^+ \LFArr A_2^- \Spb \PiTyp{x}{A^+}{B^-}\\
\end{array}
$$


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\chapter{Higher-Rank Type Inference Algorithm with Type Promotion}
\label{chap:Promotion}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Designing type inference algorithms is challenging. In particular, while a
declarative type system can \textit{guess} a type (e.g., the type of
\lstinline{x} in \lstinline{\x. e}) and can even be \textit{non-deterministic}
in the guessing (e.g., multiple possible types for \lstinline{x} in
\lstinline{\x. x}), an type inference algorithm needs to be deterministic, and
thus has to deal with many low-level details including \textit{unification}. At the
same time we expect an type inference algorithm to retain desirable properties
like \textit{inference of principal types}, as well as \textit{soundness} and
\textit{completeness} with respect to the declarative type system. An algorithm
is sound and complete, if it accepts and only accepts programs that are
well-typed in the declarative type system.

In this chapter, we focus on the design of type inference algorithms in the
presence of higher-rank polymorphism. Compared to type inference for simple
types, type inference for higher-rank polymorphism needs to further take care of
scoping and dependency issues between different kinds of variables. We propose a
strategy called \textit{promotion} that helps resolve the dependency of
unification variables in the framework of \textit{type inference in
  context}~\citep{gundry2010type}. To illustrate the key idea,
\Cref{sec:pr:unif} applies promotion to the unification algorithm for the simply
typed lambda calculus. \Cref{sec:pr:subtypin} then proposes \textit{polymorphic
  promotion} to deal with subtyping for higher-rank polymorphism, which leads to
an arguably simpler type inference algorithm for higher-rank polymorphism.
Finally, we briefly discuss how promotion can be further applied to other
advanced features like dependent types and gradual types in
\Cref{sec:pr:discussion}. This chapter also sets up the stage for
\Cref{chap:kindinference}, where promotion is used in a more complex setting.

\input{Gen/Promotion/introduction}
\input{Gen/Promotion/unification}
\input{Gen/Promotion/subtyping}
\input{Gen/Promotion/discussion}

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "../Thesis"
%%% org-ref-default-bibliography: "../Thesis.bib"
%%% End:


\chapter{Random Forests}
\label{ch:random_forests}

\begin{wrapfigure}{o}{0.85\textwidth}
    \vspace{-0.5cm}
    \includegraphics[scale=0.4]{workflow.png}
\end{wrapfigure}

Random forests, a modeling technique introduced in 2001, is still one of the best performing classification and regression techniques. Instead of building a tree by always choosing the one feature that seems to separate best at that time, it builds many trees in slightly random ways. Therefore the induced trees are different. For the final prediction the trees vote for the best class.

\begin{figure}[h]
    \centering
    \includegraphics[scale=0.35]{pythagorean.png}
    \caption{The \widget{Pythagorean Forest} widget shows us how random the trees are. If we select a tree, we can observe it in a \widget{Tree Viewer}.}
\end{figure}

There are two sources of randomness: (1) training data is sampled with replacement, and (2) the best feature for a split is chosen among a subset of randomly chosen features.

Which features are the most important? The creators of random forests also defined a procedure for computing feature importances from random forests. In Orange, you can use it with the \widget{Rank} widget.

\begin{figure}[h]
    \centering
    \includegraphics[scale=0.35]{rank.png}
    \caption{Feature importance according to two univariate measures (gain ratio and gini index) and random forests. Random forests also consider combinations of features when evaluating their importance. }
\end{figure}


The \mf Time-Varying Hydraulic Conductivity (TVK) and Time-Varying Storage (TVS) packages allow hydraulic conductivity, specific storage and specific yield properties of model cells to be varied transiently throughout a simulation. This can be useful for modeling caved rock, void and spoil in mining applications, or for other physical changes to a system that can reasonably be represented by changing material properties.

Changes are made on a cell-by-cell basis in TVK and TVS package input files by specifying new values for elements of NPF package arrays K, K22 and K33, and STO package arrays SS and SY. New values may be applied at the start of each stress period, or alternatively interpolated via time series to determine new values at each time step. Changes are only made to those model cells explicitly specified in the TVK and TVS package input files; other cells retain their original NPF and STO values. Additionally, a change may be made to a cell's value for one property independently without affecting other property values at the same cell, e.g. SS may be changed for a cell without affecting SY, if desired.

Where a property value change is given by a time series, the value continues to change at each time step until the last entry in the time series is reached. Otherwise, once a cell property value has been changed, it remains at its new value until subsequently changed in the TVK or TVS files for a later period, or until the end of the simulation if no further changes are enacted.

By default, when the TVS package is used to change SS or SY values, the \mf storage formulation is modified to integrate these changes such that the head solution correctly reflects changes in pressure due to the corresponding increase or decrease in stored water volume. The modifications are described in the \hyperref[sec:sci-ss]{``Storage Change Integration: Specific Storage''} and \hyperref[sec:sci-sy]{``Storage Change Integration: Specific Yield''} sections below. If this functionality is not desired, storage change integration may be disabled by activating the DISABLE\_STORAGE\_CHANGE\_INTEGRATION option in the TVS package input file.

\subsection{Storage Change Integration: Specific Storage} \label{sec:sci-ss}

Revisiting the derivation of the revised storage formulation in the \hyperref[ch:sto-mod]{Storage Package Modifications chapter}, changes in specific storage are introduced by first separating equation~\ref{eqn:storage-ss-final} into two separate equations:

\begin{equation}
	\label{eqn:tvs-vss-old}
	V_{SS}^\told = SC1^\told \, S_F^\told \left( h^\told - BOT - \frac{\Delta z}{2} S_F^\told \right) ,
\end{equation}

\noindent giving the volume of water in compressible storage at time $\told$, and

\begin{equation}
	\label{eqn:tvs-vss-new}
	V_{SS}^t = SC1^t \, S_F^t \left( h^t - BOT - \frac{\Delta z}{2} S_F^t \right) ,
\end{equation}

\noindent giving the volume of water in compressible storage at time $t$. The volumetric flow rate from compressible storage taking into account changes in specific storage is then

\begin{equation}
	\label{eqn:tvs-qss}
	\begin{aligned}
	Q_{SS} = & \frac{V_{SS}^\told - V_{SS}^t}{\Delta t} \\
	       = & \frac{SC1^\told}{\Delta t} \, S_F^\told \left( h^\told - BOT - \frac{\Delta z}{2} S_F^\told \right) - \frac{SC1^t}{\Delta t} \, S_F^t \left( h^t - BOT - \frac{\Delta z}{2} S_F^t \right) .
	\end{aligned}
\end{equation}

\subsubsection{Standard Formulation}

Following the same process used to arrive at equation~\ref{eqn:STOeq-rev-fd} in the \hyperref[ch:sto-mod]{Storage Package Modifications chapter}, equation~\ref{eqn:tvs-qss} leads to the following additions to the left- and right-hand sides of the discretized groundwater flow equation:

\begin{equation}
	\label{eqn:tvs-Ab-std}
	\begin{aligned}
		A_{n,n} \leftarrow & A_{n,n} - \frac{SC1_n^t}{\Delta t} S_{F_n}^\kmo \\
		b_n \leftarrow & b_n - \frac{SC1_n^\told}{\Delta t} \, S_{F_n}^\told \left( h_n^\told - BOT_n - \frac{\Delta z_n}{2} S_{F_n}^\told \right) + \frac{SC1_n^t}{\Delta t} \, S_{F_n}^\kmo \left( BOT_n + \frac{\Delta z_n}{2} S_{F_n}^\kmo \right) .
	\end{aligned}
\end{equation}

\noindent In the absence of specific storage changes, i.e. for $SC1_n^\told = SC1_n^t = SC1_n$, equation~\ref{eqn:tvs-Ab-std} simplifies to equation~\ref{eqn:STOeq-rev-fd}.

\subsubsection{Newton-Raphson Formulation}

Evaluating equation~\ref{eqn:tvs-qss} cellwise with subscript ``$n$'' and applying quadratically smoothed cell saturations $S_F^*$ results in

\begin{equation}
	\label{eqn:tvs-qss-n}
	Q_{SS_n} = \frac{SC1_n^\told}{\Delta t} \, S_{F_n}^\stold \left( h_n^\told - BOT_n - \frac{\Delta z_n}{2} S_{F_n}^\stold \right) - \frac{SC1_n^t}{\Delta t} \left[ S_{F_n}^\st \left( h_n^t - BOT_n \right) + \frac{\Delta z_n}{2} \left( S_{F_n}^\st \right)^2 \right] .
\end{equation}

\noindent Upon differentiation of equation~\ref{eqn:tvs-qss-n} with respect to $h_n^t$, all terms involving $SC1_n^\told$ disappear. The result is equivalent to equation~\ref{eqn:STOeq-rev-derv-simp} with $SC1_n = SC1_n^t$:

\begin{equation}
	\label{eqn:tvs-qss-nr-deriv}
	\frac{\partial Q_{SS_n}}{\partial h_n} = -\frac{SC1_n^t}{\Delta t} S_{F_n}^\st - \frac{SC1_n^t}{\Delta t} \frac{\partial S_{F_n}^\st}{\partial h_n} \left( h_n^t - BOT_n \right) + \frac{SC1_n^t}{\Delta t} \Delta z_n S_{F_n}^\st  \frac{\partial S_{F_n}^\st}{\partial h_n} .
\end{equation}

\noindent where the superscript ``$t$'' has been omitted from $h_n^t$ in the derivatives for clarity. Replacement of $h_n^t$ and $S_{F_n}^\st$ by their previous iterates, $h_n^\kmo$ and $S_{F_n}^\skmo$, in equations~\ref{eqn:tvs-qss-n} and~\ref{eqn:tvs-qss-nr-deriv} and substitution of those equations into equation~\ref{eqn:STOeq-nr} yields the following contributions to $A_{n,n}$ and $b_n$:

\begin{equation}
	\label{eqn:tvs-Ab-nr}
	\begin{aligned}
		A_{n,n} \leftarrow & A_{n,n} + \biggl[ - \frac{SC1_n^t}{\Delta t} S_{F_n}^\skmo - \frac{SC1_n^t}{\Delta t} \frac{\partial S_{F_n}^\skmo}{\partial h_n} \left( h_n^\kmo - BOT_n \right) + \frac{SC1_n^t}{\Delta t} \Delta z_n S_{F_n}^\skmo  \frac{\partial S_{F_n}^\skmo}{\partial h_n} \biggr] \\
		b_n \leftarrow & b_n - \frac{SC1_n^\told}{\Delta t} \, S_{F_n}^\told \left( h_n^\told - BOT_n - \frac{\Delta z_n}{2} S_{F_n}^\told \right) + \frac{SC1_n^t}{\Delta t} \, S_{F_n}^\skmo \left( BOT_n + \frac{\Delta z_n}{2} S_{F_n}^\skmo \right) \\
		& \phantom{b_n} + \biggl[ - \frac{SC1_n^t}{\Delta t} \frac{\partial S_{F_n}^\skmo}{\partial h_n} \left( h_n^\kmo - BOT_n \right) + \frac{SC1_n^t}{\Delta t} \Delta z_n S_{F_n}^\skmo  \frac{\partial S_{F_n}^\skmo}{\partial h_n} \biggr] h_n^\kmo .
	\end{aligned}
\end{equation}

\noindent In the absence of storage changes ($SC1_n^\told = SC1_n^t = SC1_n$), equation~\ref{eqn:tvs-Ab-nr} simplifies to equation~\ref{eqn:STOeq-rev-nr-simp}.

\subsection{Storage Change Integration: Specific Yield} \label{sec:sci-sy}

For constant specific yield, \mf calculates the specific yield contribution to groundwater flow \citep[eq. 5--10]{modflow6gwf} as

\begin{equation}
	\label{eqn:tvs-qsy-original}
	Q_{Sy_n} = \frac{SC2_n \, \Delta z_n}{\Delta t} \left( S_{F_n}^\told - S_{F_n}^t \right) ,
\end{equation}

\noindent where $Q_{Sy_n}$ is the volumetric flow rate from specific yield ($L^3/T$) and $SC2_n = Sy_n \cdot A_n$ is the secondary storage capacity for cell $n$ with specific yield $Sy_n$ and horizontal cell area $A_n$.

When specific yield changes transiently, the secondary storage capacity term is expressed in terms of its new value $SC2_n^t$ and its old value $SC2_n^\told$, resulting in

\begin{equation}
	\label{eqn:tvs-qsy-new}
	Q_{Sy_n} = \frac{SC2_n^\told \, \Delta z_n}{\Delta t} \, S_{F_n}^\told - \frac{SC2_n^t \, \Delta z_n}{\Delta t} \, S_{F_n}^t .
\end{equation}

\subsubsection{Standard Formulation}

Rearranging equation~\ref{eqn:tvs-qsy-new} for solution at the current iteration $k$ in terms of $h_n^k$ instead of saturation $S_{F_n}^t$ gives

\begin{equation}
	\label{eqn:tvs-qsy-new-k}
	Q_{Sy_n}^k = \frac{SC2_n^\told \, \Delta z_n}{\Delta t} \, S_{F_n}^\told - \frac{SC2_n^t \, \Delta z_n}{\Delta t} \frac{h_n^k - BOT_n}{\Delta z_n} ,
\end{equation}

\noindent which results in the following contributions to $A_{n,n}$ and $b_n$:

\begin{equation}
	\label{eqn:tvs-sy-Ab-std}
	\begin{aligned}
		A_{n,n} \leftarrow & A_{n,n} - \frac{SC2_n^t}{\Delta t} \\
		b_n \leftarrow & b_n - \frac{SC2_n^\told}{\Delta t} \, \Delta z_n \, S_{F_n}^\told - \frac{SC2_n^t}{\Delta t} \, BOT_n .
	\end{aligned}
\end{equation}

\noindent As in the base formulation \citep[Chapter 5]{modflow6gwf}, for cells where the head at the end of the time step is at or above the top of the cell, $S_{F_n}^t = 1$ and the specific yield contribution is known. In these cases, no terms are added to $A_{n,n}$ and the right-hand side contribution instead becomes

\begin{equation}
	\label{eqn:tvs-sy-b-fullsat}
	b_n \leftarrow b_n - \frac{SC2_n^\told}{\Delta t} \, \Delta z_n \, S_{F_n}^\told + \frac{SC2_n^t}{\Delta t} \, \Delta z_n .
\end{equation}

\subsubsection{Newton-Raphson Formulation}

As all $SC2_n^\told$ terms are eliminated by differentiation, the derivative of equation~\ref{eqn:tvs-qsy-new} at iteration $k$, and with quadratically smoothed cell saturations $S_F^*$ applied, is equivalent to that of the base formulation \citep[eq. 5--14]{modflow6gwf} with $SC2_n = SC2_n^t$:

\begin{equation}
	\label{eqn:tvs-qsy-nr-deriv}
	\frac{\partial Q_{Sy_n}}{\partial h_n} = - \frac{SC2_n^t \, \Delta z_n}{\Delta t} \frac{\partial S_{F_n}^\skmo}{\partial h_n} .
\end{equation}

\noindent The fully implicit Newton-Raphson formulation for specific yield storage contribution in cell $n$ is

\begin{equation}
	\label{eqn:tvs-sy-nr}
	\frac{\partial Q_{Sy_n}}{\partial h_n} h_n^k = -Q_{Sy_n}^k + \frac{\partial Q_{Sy_n}}{\partial h_n} h_n^\kmo .
\end{equation}

\noindent Substitution of equations~\ref{eqn:tvs-qsy-new} and~\ref{eqn:tvs-qsy-nr-deriv} into equation~\ref{eqn:tvs-sy-nr} results in the following general expression of the Newton-Raphson formulation for the contribution of specific yield storage to cell $n$:

\begin{equation}
	\label{eqn:tvs-sy-nr-expanded}
	\begin{aligned}
		\biggl[ - \frac{SC2_n^t \, \Delta z_n}{\Delta t} \frac{\partial S_{F_n}^\skmo}{\partial h_n} \biggr] h_n^k =
		& - \biggl[ \frac{SC2_n^\told \, \Delta z_n}{\Delta t} \, S_{F_n}^\stold - \frac{SC2_n^t \, \Delta z_n}{\Delta t} \, S_{F_n}^\skmo \biggr] \\
		& + \biggl[ - \frac{SC2_n^t \, \Delta z_n}{\Delta t} \frac{\partial S_{F_n}^\skmo}{\partial h_n} \biggr] h_n^\kmo ,
	\end{aligned}
\end{equation}

\noindent which yields the following contributions to $A_{n,n}$ and $b_n$:

\begin{equation}
	\label{eqn:tvs-sy-Ab-std}
	\begin{aligned}
		A_{n,n} \leftarrow & A_{n,n} - \frac{SC2_n^t \, \Delta z_n}{\Delta t} \frac{\partial S_{F_n}^\skmo}{\partial h_n} \\
		b_n \leftarrow & b_n - \frac{SC2_n^\told \, \Delta z_n}{\Delta t} \, S_{F_n}^\stold + \frac{SC2_n^t \, \Delta z_n}{\Delta t} \, S_{F_n}^\skmo - \frac{SC2_n^t \, \Delta z_n}{\Delta t} \frac{\partial S_{F_n}^\skmo}{\partial h_n} h_n^\kmo .
	\end{aligned}
\end{equation}

\noindent For cells where the head at the end of the time step is at or above the top of the cell, the derivative is zero. In these cases, no terms are added to $A_{n,n}$ and the right-hand side contribution reverts to the standard formulation in equation~\ref{eqn:tvs-sy-b-fullsat}.


\par
\subsection{Sorting routines}
\label{subsection:Utilities:proto:sort}
\par
\subsubsection{Validation routines}
\label{subsubsection:Utilities:proto:sort:validate}
\par
%=======================================================================
\begin{enumerate}
%-----------------------------------------------------------------------
\item
\begin{verbatim}
int IVisascending ( int n, int ivec[] ) ;
int IVisdescending ( int n, int ivec[] ) ;
\end{verbatim}
\index{IVisascending@{\tt IVisascending()}}
\index{IVisdescending@{\tt IVisdescending()}}
These methods returns {\tt 1} if the array {\tt ivec[]} is in ascending
or descending order and returns {\tt 0} otherwise.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
int DVisascending ( int n, double dvec[] ) ;
int DVisdescending ( int n, double dvec[] ) ;
\end{verbatim}
\index{DVisascending@{\tt DVisascending()}}
\index{DVisdescending@{\tt DVisdescending()}}
These methods returns {\tt 1} if the array {\tt dvec[]} is in ascending
or descending order and returns {\tt 0} otherwise.
%-----------------------------------------------------------------------
\end{enumerate}
\par
\subsubsection{Insert sort routines}
\label{subsubsection:Utilities:proto:sort:insert}
\par
%=======================================================================
\begin{enumerate}
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IVisortUp ( int n, int ivec[] ) ;
void IVisortDown ( int n, int ivec[] ) ;
\end{verbatim}
\index{IVisortUp@{\tt IVisortUp()}}
\index{IVisortDown@{\tt IVisortDown()}}
These methods sort an {\tt int} array into ascending or descending
order using an insertion sort.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IV2isortUp ( int n, int ivec1[], int ivec2[] ) ;
void IV2isortDown ( int n, int ivec1[], int ivec2[] ) ;
\end{verbatim}
\index{IV2isortUp@{\tt IV2isortUp()}}
\index{IV2isortDown@{\tt IV2isortDown()}}
These methods sort the array {\tt ivec1[]} into ascending or
descending order using an insertion sort and permutes
the {\tt int} companion array {\tt ivec2[]} in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IVDVisortUp ( int n, int ivec[], double dvec[] ) ;
void IVDVisortDown ( int n, int ivec[], double dvec[] ) ;
\end{verbatim}
\index{IVDVisortUp@{\tt IVDVisortUp()}}
\index{IVDVisortDown@{\tt IVDVisortDown()}}
This sorts the array {\tt ivec[]} into ascending or descending order
using an insertion sort and permutes the companion array {\tt dvec[]}
in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IV2DVisortUp ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
void IV2DVisortDown ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
\end{verbatim}
\index{IV2DVisortUp@{\tt IV2DVisortUp()}}
\index{IV2DVisortDown@{\tt IV2DVisortDown()}}
These methods sort the array {\tt ivec1[]} into ascending or
descending order using an insertion sort and permutes
the {\tt int} and {\tt double} companion array
{\tt ivec2[]} and {\tt dvec[]} in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IVZVisortUp ( int n, int ivec[], double dvec[] ) ;
void IVZVisortDown ( int n, int ivec[], double dvec[] ) ;
\end{verbatim}
\index{IVZVisortUp@{\tt IVZVisortUp()}}
\index{IVZVisortDown@{\tt IVZVisortDown()}}
This sorts the array {\tt ivec[]} into ascending or descending order
using an insertion sort and permutes the double precision complex
companion array {\tt dvec[]} in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IV2ZVisortUp ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
void IV2ZVisortDown ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
\end{verbatim}
\index{IV2ZVisortUp@{\tt IV2ZVisortUp()}}
\index{IV2ZVisortDown@{\tt IV2ZVisortDown()}}
These methods sort the array {\tt ivec1[]} into ascending
or descending order
using an insertion sort and permutes the companion arrays
{\tt ivec2[]} and {\tt dvec[]} in the same fashion.
The {\tt dvec[]} array is double precision complex.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void DVisortUp ( int n, double dvec[] ) ;
void DVisortDown ( int n, double dvec[] ) ;
\end{verbatim}
\index{DVisortUp@{\tt DVisortUp()}}
\index{DVisortDown@{\tt DVisortDown()}}
These methods sort a {\tt double} array into ascending
or descending order using an insertion sort.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void DV2isortUp ( int n, double dvec1[], double dvec2[] ) ;
void DV2isortDown ( int n, double dvec1[], double dvec2[] ) ;
\end{verbatim}
\index{DV2isortUp@{\tt DV2isortUp()}}
\index{DV2isortDown@{\tt DV2isortDown()}}
These methods sort the array {\tt dvec1[]} into ascending or
descending order
using an insertion sort and permutes the companion array {\tt dvec2[]}
in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void DVIVisortUp ( int n, double dvec[], int ivec[] ) ;
void DVIVisortDown ( int n, double dvec[], int ivec[] ) ;
\end{verbatim}
\index{DVIVisortUp@{\tt DVIVisortUp()}}
\index{DVIVisortDown@{\tt DVIVisortDown()}}
These methods sort the array {\tt dvec[]} into ascending or
descending order using an insertion sort and permutes
the companion array {\tt ivec[]} in the same fashion.
%-----------------------------------------------------------------------
\end{enumerate}
\par
\subsubsection{Quicksort routines}
\label{subsubsection:Utilities:proto:sort:quicksort}
\par
%=======================================================================
\begin{enumerate}
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IVqsortUp ( int n, int ivec[] ) ;
void IVqsortDown ( int n, int ivec[] ) ;
\end{verbatim}
\index{IVqsortUp@{\tt IVqsortUp()}}
\index{IVqsortDown@{\tt IVqsortDown()}}
These methods sort an {\tt int} array into ascending or descending
order using a quick sort.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IV2qsortUp ( int n, int ivec1[], int ivec2[] ) ;
void IV2qsortDown ( int n, int ivec1[], int ivec2[] ) ;
\end{verbatim}
\index{IV2qsortUp@{\tt IV2qsortUp()}}
\index{IV2qsortDown@{\tt IV2qsortDown()}}
These methods sort the array {\tt ivec1[]} into ascending or
descending order using a quick sort and permutes
the companion array {\tt ivec2[]} in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IVDVqsortUp ( int n, int ivec[], double dvec[] ) ;
void IVDVqsortDown ( int n, int ivec[], double dvec[] ) ;
\end{verbatim}
\index{IVDVqsortUp@{\tt IVDVqsortUp()}}
\index{IVDVqsortDown@{\tt IVDVqsortDown()}}
These methods sort the array {\tt ivec[]} into ascending or
descending order using a quick sort and permutes
the companion array {\tt dvec[]} in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IV2DVqsortUp ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
void IV2DVqsortDown ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
\end{verbatim}
\index{IV2DVqsortUp@{\tt IV2DVqsortUp()}}
\index{IV2DVqsortDown@{\tt IV2DVqsortDown()}}
These methods sort the array {\tt ivec1[]} into ascending
or descending order using a quick sort and permutes the companion arrays
{\tt ivec2[]} and {\tt dvec[]} in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IVZVqsortUp ( int n, int ivec[], double dvec[] ) ;
void IVZVqsortDown ( int n, int ivec[], double dvec[] ) ;
\end{verbatim}
\index{IVZVqsortUp@{\tt IVZVqsortUp()}}
\index{IVZVqsortDown@{\tt IVZVqsortDown()}}
These methods sort the array {\tt ivec[]} into ascending or
descending order using a quick sort and permutes
the double precision complex companion array
{\tt dvec[]} in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void IV2ZVqsortUp ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
void IV2ZVqsortDown ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
\end{verbatim}
\index{IV2ZVqsortUp@{\tt IV2ZVqsortUp()}}
\index{IV2ZVqsortDown@{\tt IV2ZVqsortDown()}}
These methods sort the array {\tt ivec1[]} into ascending
or descending order using a quick sort and permutes the companion arrays
{\tt ivec2[]} and {\tt dvec[]} in the same fashion.
The {\tt dvec[]} array is double precision complex.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void DVqsortUp ( int n, double dvec[] ) ;
void DVqsortDown ( int n, double dvec[] ) ;
\end{verbatim}
\index{DVqsortUp@{\tt DVqsortUp()}}
\index{DVqsortDown@{\tt DVqsortDown()}}
Thes methods sort a {\tt double} array into ascending or
descending order using a quick sort.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void DV2qsortUp ( int n, double dvec1[], double dvec2[] ) ;
void DV2qsortDown ( int n, double dvec1[], double dvec2[] ) ;
\end{verbatim}
\index{DV2qsortUp@{\tt DV2qsortUp()}}
\index{DV2qsortDown@{\tt DV2qsortDown()}}
These methods sort the array {\tt dvec1[]} into ascending or
descending order using a quick sort and permutes
the companion array {\tt dvec2[]} in the same fashion.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
void DVIVqsortUp ( int n, double dvec[], int ivec[] ) ;
void DVIVqsortDown ( int n, double dvec[], int ivec[] ) ;
\end{verbatim}
\index{DVIVqsortUp@{\tt DVIVqsortUp()}}
\index{DVIVqsortDown@{\tt DVIVqsortDown()}}
These methods sort the array {\tt dvec[]} into ascending or
descending order using a quick sort and permutes
the companion array {\tt ivec[]} in the same fashion.
%-----------------------------------------------------------------------
\end{enumerate}
\par
\subsection{Sort and compress routines}
\label{subsection:Utilities:proto:sortAndCompress}
\par
%=======================================================================
\begin{enumerate}
%-----------------------------------------------------------------------
\item
\begin{verbatim}
int IVsortUpAndCompress ( int n, int ivec[] ) ;
\end{verbatim}
\index{IVsortUpAndCompress@{\tt IVsortUpAndCompress()}}
This method sorts {\tt ivec[]} into ascending order,
and removes (compresses) any duplicate entries.
The return value is the number of unique entries
stored in the leading locations of the vector {\tt ivec[]}.
\par \noindent {\it Error checking:}
If {\tt n < 0} or {\tt ivec} is {\tt NULL},
an error message is printed and the program exits.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
int IVDVsortUpAndCompress ( int n, int ivec[], double dvec[] ) ;
\end{verbatim}
\index{IVDVsortUpAndCompress@{\tt IVDVsortUpAndCompress()}}
This method sorts {\tt ivec[]} into ascending order with {\tt dvec[]}
as a companion vector.
It then compresses the pairs, adding the {\tt dvec[]} entries
together when their {\tt ivec[]} values are identical.
The return value is the number of unique entries stored in the
leading locations of the vectors {\tt ivec[]} and {\tt dvec[]}.
\par \noindent {\it Error checking:}
If {\tt n < 0},
or if {\tt ivec} or {\tt dvec} is {\tt NULL},
an error message is printed and the program exits.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
int IVZVsortUpAndCompress ( int n, int ivec[], double dvec[] ) ;
\end{verbatim}
\index{IVZVsortUpAndCompress@{\tt IVZVsortUpAndCompress()}}
This method sorts {\tt ivec[]} into ascending order with the
double precision complex {\tt dvec[]} companion vector.
It then compresses the pairs, adding the complex {\tt dvec[]} entries
together when their {\tt ivec[]} values are identical.
The return value is the number of unique entries stored in the
leading locations of the vectors {\tt ivec[]} and {\tt dvec[]}.
\par \noindent {\it Error checking:}
If {\tt n < 0},
or if {\tt ivec} or {\tt dvec} is {\tt NULL},
an error message is printed and the program exits.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
int IV2sortUpAndCompress ( int n, int ivec1[], int ivec2[] ) ;
\end{verbatim}
\index{IV2sortUpAndCompress@{\tt IV2sortUpAndCompress()}}
This method sorts {\tt ivec1[]} into ascending order
with {\tt ivec2[]} as a companion vector.
It then compresses the pairs, dropping all but one of identical pairs.
The return value is the number of unique entries stored in the
leading locations of the vectors {\tt ivec1[]} and {\tt ivec2[]}.
\par \noindent {\it Error checking:}
If {\tt n < 0},
or if {\tt ivec1} or {\tt ivec2} is {\tt NULL},
an error message is printed and the program exits.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
int IV2DVsortUpAndCompress ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
\end{verbatim}
\index{IV2DVsortUpAndCompress@{\tt IV2DVsortUpAndCompress()}}
This method sorts {\tt ivec1[]} into ascending order
with {\tt ivec2[]} and {\tt dvec[]} as companion vectors.
It then compresses the pairs, summing the {\tt dvec[]} entries for
identical {\tt (ivec1[], ivec2[])} pairs.
The return value is the number of unique entries stored in the
leading locations of the vectors {\tt ivec1[]}, {\tt ivec2[]}
and {\tt dvec[]}.
\par \noindent {\it Error checking:}
If {\tt n < 0},
or if {\tt ivec1}, {\tt ivec2} or {\tt dvec} is {\tt NULL},
an error message is printed and the program exits.
%-----------------------------------------------------------------------
\item
\begin{verbatim}
int IV2ZVsortUpAndCompress ( int n, int ivec1[], int ivec2[], double dvec[] ) ;
\end{verbatim}
\index{IV2ZVsortUpAndCompress@{\tt IV2ZVsortUpAndCompress()}}
This method sorts {\tt ivec1[]} into ascending order
with {\tt ivec2[]} and the double precision {\tt dvec[]}
as companion vectors.
It then compresses the pairs, summing the complex {\tt dvec[]} entries
for identical {\tt (ivec1[], ivec2[])} pairs.
The return value is the number of unique entries stored in the
leading locations of the vectors {\tt ivec1[]}, {\tt ivec2[]}
and {\tt dvec[]}.
\par \noindent {\it Error checking:}
If {\tt n < 0},
or if {\tt ivec1}, {\tt ivec2} or {\tt dvec} is {\tt NULL},
an error message is printed and the program exits.
%-----------------------------------------------------------------------
\end{enumerate}


\documentclass[10pt]{article}
\usepackage{amsfonts}
\usepackage{amssymb, amsmath}
\usepackage{eucal}
\usepackage{amscd}
\usepackage{url}
\usepackage{listings}
\usepackage{algorithmic}
\usepackage{enumerate}
\urlstyle{sf}
\pagestyle{plain}

\newcommand{\Z}{\mathbb{Z}}
\newcommand{\N}{\mathbb{N}}
\newcommand{\Q}{\mathbb{Q}}
\newcommand{\I}{\mathbb{I}}
\newcommand{\C}{\mathbb{C}}
\newcommand{\R}{\mathbb{R}}
\newcommand{\F}{\mathbb{F}}
\newcommand{\Pee}{\mathbb{P}}
\newcommand{\Op}{\mathcal{O}}
\newcommand{\Qbar}{\Opverline{\mathbb{Q}}}
\newcommand{\code}{\lstinline}

\newcommand{\ljk}[2]{\left(\frac{#1}{#2}\right)}
\newcommand{\modulo}[1]{\;\left(\mbox{mod}\;#1\right)}
\newcommand{\fr}{\mathfrak}
\newcommand{\qed}{\square}

\def\notdivides{\mathrel{\kern-3pt\not\!\kern4.5pt\bigm|}}
\def\nmid{\notdivides}
\def\nsubseteq{\mathrel{\kern-3pt\not\!\kern2.5pt\subseteq}}

\newtheorem{theorem}{Theorem}[section]
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{property}[theorem]{Property}

\newenvironment{proof}[1][Proof]{\begin{trivlist}
\item[\hskip \labelsep {\bfseries #1}]}{\end{trivlist}}
\newenvironment{definition}[1][Definition]{\begin{trivlist}
\item[\hskip \labelsep {\bfseries #1}]}{\end{trivlist}}
\newenvironment{example}[1][Example]{\begin{trivlist}
\item[\hskip \labelsep {\bfseries #1}]}{\end{trivlist}}
\newenvironment{remark}[1][Remark]{\begin{trivlist}
\item[\hskip \labelsep {\bfseries #1}]}{\end{trivlist}}

\parindent=0pt
\parskip 4pt plus 2pt minus 2pt

\title{Dedekind domains}

\author{
William B. Hart
}

\begin{document}

\maketitle

\section{Dedekind domains}

In any elementary treatment of algebraic number fields, three important facts about the ring of integers $\Op_K$ of a number field are proved: (i) $\Op_K$ is integrally closed in the number field, (ii) $\Op_K$ is noetherian, (iii) every prime ideal of $\Op_K$ is maximal.

Integral domains that have these properties are called Dedekind domains and these can be studied directly rather than study the special case of the ring of integers of a number field.

As well as the ring of integers of a number field there are other important examples of a Dedekind domain. For example instead of number fields, consider finite extensions $K$ of the function field $\mathbb{F}_p(t)$. If we let $k$ be the algebraic closure of $\mathbb{F}_p$ in $K$ then the integral closure of $k[t]$ in $K$ is a Dedekind domain.

On account of these other important examples, it is useful to study Dedekind domains indepedently of number fields, in full generality.

We begin with the formal definition of a Dedekind domain.

\begin{definition}
An integral domain $R$ is a Dedekind domain if
\begin{itemize}
\item $R$ is noetherian
\item $R$ is integrally closed in its field of fractions
\item every prime ideal of $R$ is maximal
\end{itemize}
\end{definition}

\subsection{Integrality}

We begin by giving an overview of the second condition in the definition of a Dedekind domain, namely integral closure.

We begin by recalling the definition.

\begin{definition}
If $R$ is a subring of a commutative ring $S$ then $\alpha \in S$ is said to be \emph{integral} over $R$ if it is a root of a monic polynomial
$$f(x) = x^n + r_{n-1}x^{n-1} + \cdots + r_0,$$
with coefficients $r_i \in R$.
\end{definition}

There are some convenient alternative formulations of integrality.

\begin{theorem}
Let $R$ be a subring of a commutative ring $S$, with $\alpha \in S$. Then the following are equivalent.
\begin{enumerate}
\item $\alpha$ is integral over $R$.
\item The subring $R[\alpha] \subseteq S$ is a finitely generated $R$-module.
\item There exists a finitely generated $R$-module $M$ with an action of $\alpha$ on it making $M$ into an $R[\alpha]$-module such that the only element $r \in R[\alpha]$ for which $rM = 0$ is $r = 0$.
\end{enumerate}
\end{theorem}

\begin{proof}
(1) $\rightarrow$ (2): Since $\alpha^n$ can be written as an $R$-linear combination of $S = \{1, \alpha, \ldots, \alpha^{n-1}\}$ using the relation $f(\alpha) = 0$, it is clear that $R[\alpha]$ is generated by $S$ as an $R$-module.

(2) $\rightarrow$ (3): Suppose $R[\alpha]$ is finitely generated and let $M = R[\alpha]$. If $\alpha M = 0$ then $\alpha = 0$ and $\alpha R = 0$. But the zero of $R$ is unique and so $\alpha = 0$. Thus $M = R[\alpha]$ satisfies (3).

(3) $\rightarrow$ (1): This is Dedekind's argument. Suppose $M$ is generated over $R$ by $\{m_1, m_2, \ldots, m_n\}$. Then we can write each $\alpha m_i$ as an $R$-linear combination of the $m_i$. Writing this as a matrix equation we note that there is a nontrivial solution iff $\alpha$ satisfies a monic polynomial over $R$ of degree at most $n$. $\qed$
\end{proof}

\begin{definition}
An $R$-module $M$ for $rM = 0$ for $r \in R$ iff $r = 0$ is called a \emph{faithful} $R$-module.
\end{definition}

With this definition we can express the third formulation of the theorem as: there exists a faithful $R[\alpha]$-module which is finitely generated as an $R$-module.

From the first part of the theorem, we have the following result.

\begin{corollary}
If $\alpha \in S$ is integral over $R \subseteq S$ then $\alpha$ is integral over any subring $T$ with $R \subseteq T \subseteq S$.
\end{corollary}

\begin{proof}
The coefficients $r_i$ in the first part of the theorem are in $R$ and hence in $T$. $\qed$
\end{proof}

We can also say something about integrality in subrings, by part (2) of the theorem.

\begin{theorem}
If $R \subseteq T \subseteq S$ is a tower of subrings and $\alpha \in S$ is integral over $T$ and $T$ is finitely generated as an $R$-module, then $\alpha$ is also integral over $R$.
\end{theorem}

\begin{proof}
By part (2) of the theorem above, if $\alpha$ is integral over $T$ then $T[\alpha] \subseteq S$ is a finitely generated $T$-module.

But since $T$ is finitely generated as an $R$-module, $T[\alpha]$ is finitely generated over $R$.

Thus again by part (2), $\alpha$ is integral over $R$. $\qed$
\end{proof}

From the part (3) of the theorem above, we have the following result.

\begin{theorem}
If $R$ is a subring of $S$ with $\alpha \in S$ integral over $R$, then any $\beta \in R[\alpha]$ is also integral over $R$.
\end{theorem}

\begin{proof}
As $R[\beta] \subseteq R[\alpha]$, the action of $R[\alpha]$ on a faithful $R[\alpha]$ module $M$ induces an action of $R[\beta]$ on $M$. This makes $M$ into a faithful $R[\beta]$ module. Thus $\beta$ is also integral over $R$. $\qed$
\end{proof}

We recall the following theorem from algebraic number theory. It is now able to be proved more routinely.

\begin{theorem}
If $R$ is a subring of a ring $S$, then the set of all $\alpha \in S$ which are integral over $R$ forms a ring.
\end{theorem}

\begin{proof}
Let $\alpha, \beta \in S$ be integral over $R$. Then $\alpha$ is integral over $R[\beta]$ by the above. Thus any element of $R[\alpha][\beta] = R[\alpha, \beta]$ is integral over $R[\beta]$, by the previous theorem.

As $R[\beta]$ is finitely generated over $R$, we have that every element of $R[\alpha, \beta]$ is integral over $R$, by the above. In particular, $\alpha + \beta$ and $\alpha\beta$ are integral over $R$. $\qed$
\end{proof}

We recall the following definition.

\begin{definition}
If $R$ is a subring of $S$, the ring of all $\alpha \in S$ which are integral over $R$ is called the \emph{integral closure} of $R$ in $S$.
\end{definition}

We also have the following definition.

\begin{definition}
If $R$ is an integral domain with field of fractions $K$, we say that $R$ is \emph{integrally closed} if $R$ is its own integral closure in $K$.
\end{definition}

\subsection{Unique factorisation into prime ideals}

\begin{theorem}
In a Dedekind domain, every ideal contains a product of prime ideals.
\end{theorem}

\begin{proof}
Suppose to the contrary that there exists an ideal in a Dedekind domain $R$ which doesn't contain a product of prime ideals. Let $S$ be the (nonempty) set of all ideals of $R$ which don't contain a product of prime ideals.

As $R$ is a Dedekind domain, it is Noetherian. Thus $S$ has a maximal element, $I$ say.

We see that $I$ cannot be prime, by the definition of $S$. Thus there exists $r, s \in R$ such that $rs \in I$ but $r, s \notin I$. Let $A = I + (r)$ and $B = I + (s)$.

We have that the ideals $A$ and $B$ are both strictly bigger than $I$. Thus $A$ and $B$ both contain a product of prime ideals. But this implies that $AB$ contains a product of prime ideals.

However, as $rs \in I$ we have that $AB = (I + (r))(I + (s)) \subseteq I$. This is a contradiction since now $I$ contains a product of prime ideals. $\qed$
\end{proof}

We will also need the following result. Recall that an ideal of a ring $R$ is said to be proper if it is not the whole ring $R$

\begin{theorem}
Let $I$ be a proper ideal of a Dedekind domain $R$ with field of fractions $K$ (e.g. the ring of integers $R = \mathcal{O}_K$ in a number field $K$). Then there exists a non-integral $\alpha \in K$, i.e. $\alpha \notin R$, such that $\alpha I \subseteq R$.
\end{theorem}

\begin{proof}
Let $a \neq 0$ be an arbitrary element of $I$. By the previous theorem, $(a)$ contains a product of prime ideals.

Let $n$ be the smallest positive integer for which there exist prime ideals $P_i$ for which $P_1P_2\ldots P_n \subseteq (a)$.

Since $I$ is a proper ideal, it is contained in a maximal ideal, and as $R$ is a Dedekind domain, this implies $I$ is contained in a prime ideal, $P$ say.

This implies that $P_1P_2\ldots P_n \subseteq P$. We will show that $P$ contains one of the $P_i$.

If not, then for each $i$ let $a_i \in P_i$ but $a_i \notin P$. Let $p = a_1a_2\ldots a_n$.

But $P$ is prime, and so it must contain one of $a_i$, which is a contradiction. Thus $P$ contains one of the $P_i$ as claimed.

Without loss of generality, suppose that $P_i \subseteq P$.

But $P_i$ is a prime ideal and hence maximal. Therefore $P = P_i$.

If $n = 1$, set $b = 1$, in which case $b \notin (a)$, since $(a) \subseteq I$ and $I$ is a proper ideal.

If $n \neq 1$, by the minimality of $n$, there must exist $b \in (P_2P_3\ldots P_n)$ with $b \notin (a)$.

In either case, if we set $\gamma = b/a$ then $\gamma \in K$ but $\gamma \notin I$ and $bI \subseteq bP = bP_1 \subseteq (a)$. Thus $\gamma I = (b/a)I \subseteq R$. $\qed$
\end{proof}

\begin{theorem}\label{princ}
For any ideal $I$ of a Dedekind domain $R$ there exists a non-zero ideal $J$ such that $IJ$ is principal.
\end{theorem}

\begin{proof}
Let $a \in I$ be nonzero. Let $J = \{b \in R \;|\; bI \subseteq (a)\}$. It is easy to check that the difference of any two elements of $J$ is in $J$, as is the product of any element of $J$ with an element of $R$. Thus $J$ is a nonzero ideal of $R$. Clearly we have $IJ \subseteq (a)$. We will show that in fact $IJ = (a)$.

Let $A = (1/a)IJ$. As $IJ \subseteq (a)$ we have that $A \subseteq R$. As $IJ$ is an ideal of $R$, $A$ must be as well.

If $A = R$ then $IJ = (a)$ and we are done. Otherwise $A$ is a proper ideal of $R$.

By the previous theorem, there exists $\gamma \in K$ with $\gamma \notin R$ such that $\gamma A \subseteq R$.

As $a \in I$ we have $aJ \subseteq IJ$. Thus $J \subseteq (1/a)IJ = A$. Thus $\gamma J \subseteq \gamma A \subseteq R$. As $J$ is an ideal, this implies $\gamma J \subseteq J$.

Suppose $\alpha_1, \ldots, \alpha_m$ are generators of $J$ as an ideal. Then we can write
$$\gamma \left(\begin{array}{c}\alpha_1 \\ \alpha_2 \\ \vdots \\ \alpha_m\end{array}\right) = M\left(\begin{array}{c}\alpha_1 \\ \alpha_2 \\ \vdots \\ \alpha_m\end{array}\right),$$
for some $m\times m$ matrix.

This is only possible if det$(\gamma I_m - M) = 0$. But this makes $\gamma$ a root of a monic polynomial over $R$. Thus $\gamma \in R$ by the fact that $R$ is integrally closed in its field of fractions.

But this is a contradiction. Thus $IJ = (\alpha)$ after all $\qed$.
\end{proof}

We can use this to prove the following cancellation law for ideals.

\begin{theorem}\label{abaclab}
If $A, B, C$ are ideals of a number field $K$ and $AB = AC$ with $A \neq (0)$ then $B = C.$
\end{theorem}

\begin{proof}
Choose an ideal $M$ as per the previous theorem, such that $MA = (a)$ is principal. Then multiplying $AB = AC$ through by $M$ we have that $(a)B = (a)C$, and the result follows by division through by $a$. $\qed$
\end{proof}

We are now also in a position to establish that for ideals, `to divide is to contain', as we already mentioned above.

Recall that we say an ideal $B$ divides an ideal $A$ if there is an ideal $C$ such that $A = BC$. We write $B \;|\; C$.

\begin{theorem}
If $A$ and $B$ are ideals in a Dedekind domain $R$ then $B \;|\; A$ iff $B \supseteq A$.
\end{theorem}

\begin{proof}
If $B \;|\; A$ then $A = BC$ for some ideal $C$. It is then clear that $A \subseteq B$ since $B$ is an ideal and $C \subseteq R$.

Conversely, suppose $A \subseteq B$. By the theorem above, we can find an ideal $J$ such that $BJ = (a)$ for some $a \in R$.

Now $AJ \subseteq BJ = (a)$. Thus $C = (1/a)AJ$ is an ideal in $R$ and $BC = A$. Thus $B \;|\; A$. $\qed$
\end{proof}

For ideals, there is a concept of greatest common divisor, just as for rational integers.

We say that an ideal $G$ is a greatest common divisor of ideals $A$ and $B$ if $G$ divides $A$ and $B$, and any other ideal that divides $A$ and $B$ also divides $G$.

\begin{theorem}
Each pair $A = (\alpha_1, \alpha_2, \ldots, \alpha_k), B = (\beta_1, \beta_2, \ldots, \beta_m)$ of ideals in a Dedekind domain, possesses a greatest common divisor $G = \mbox{gcd}(A,B)$.
It has the form
$$G = (\alpha_1, \alpha_2, \ldots, \alpha_k, \beta_1, \beta_2, \ldots, \beta_m).$$
\end{theorem}

\begin{proof}
Clearly $G$ consists of all elements of the form $\alpha + \beta$ with $\alpha \in A, \beta \in B$.

Since every ideal contains 0 then $G \supseteq A$ and $G \supseteq B$. Thus by the previous theorem, $G \mid A$ and $G \mid B$.

The result follows by noting that if $H \mid A$ and $H \mid B$ for some ideal $H$ then $H \supseteq A$ and $H \supseteq B$ and so $H$ must contain every sum of the form $\alpha + \beta$ with $\alpha \in A$ abd $\beta \in B$. In other words, $H \supseteq G$, i.e. $H \mid G$. $\qed$
\end{proof}

From the expression for $G$ in the theorem, and the definition of ideal multiplication, we obtain
immediately

\begin{theorem}
For ideals $A, B$ and $C$
$$C\cdot \mbox{gcd}(A, B) = \mbox{gcd}(CA, CB).$$
\end{theorem}

\begin{definition}
We call an ideal \emph{irreducible} if it is not the product of two nontrivial ideals (we refer to $\Op_K = (1)$ as the trivial ideal).
\end{definition}

\begin{definition}
We say that ideals $A$ and $B$ are \emph{coprime} if their greatest common divisor is the trivial ideal $(1)$.
\end{definition}

\begin{theorem}
If $P$ is an irreducible ideal and $P \mid AB$ for ideals $A$ and $B$ then $P$ divides $A$ or $B$ (or both), i.e. $P$ is a prime ideal.
\end{theorem}

\begin{proof}
If $P \nmid B$ then gcd$(P, B) = (1)$ since $P$ has no
other factors. Thus
$$A = A(1) = A\cdot\mbox{gcd}(P, B) =
\mbox{gcd}(AP, AB),$$
and since $P \mid AB$ this equation says that $P \mid B$. $\qed$
\end{proof}

\begin{theorem}
Each ideal $I$ of a Dedekind domain can be written as a product of finitely many prime ideals.
\end{theorem}

\begin{proof}
Assume to the contrary that there is an ideal $I$ in a Dedekind domain $R$ which cannot be written as a product of finitely many prime ideals.

Let $S$ be the set of proper ideals of $R$ that cannot be written as a product of prime ideals. As $R$ is a Dedekind domain $S$ must contain a maximal element $M$.

We have that $M$ is contained in some maximal, and hence prime ideal $P$, i.e. $P \mid M$. Thus $M = PA$ for some ideal $A$. But now $A \supseteq M$.

In fact, this containment is strict, otherwise we would have $A = M$ which would imply $RM = M = PA = PM$, which by cancellation would imply $R = P$, a contradiction. Thus $A \supset M$.

But since $M$ was maximal amongst the elements of $S$, we must have that $A$ is a product of prime ideals. But then $M = PA$ is also a product of prime ideals, which is a contradiction.

Thus all ideals must be a product of prime ideals after all. $\qed$
\end{proof}

Unique factorisation into prime ideals now follows in precisely the same way as it does for rational integers, from the analogue of Euclid's Lemma above.

\begin{theorem}
Every ideal $A$ of a Dedekind domain has unique factorization into prime ideals, upto order.
\end{theorem}

\begin{proof}
Suppose $P_1P_2\ldots P_r = Q_1Q_2\ldots Q_s$ for prime ideals $P_i$ and $Q_j$.

As $P_1$ divides the left side, it divides the right. By repeated application of Euclid's Lemma we have that it divides one of the $Q_j$. Without loss of generality suppose it divides $Q_1$.

But $P_1$ and $Q_1$ are both prime and hence maximal. Thus $P_1 = Q_1$.

By cancellation, we therefore have
$$P_2P_3\ldots P_r = Q_2Q_3\ldots Q_s.$$

Repeating the argument, we eventually find that each $P_i$ is equal to some $Q_j$ and that $r = s$. Thus the two factorisations are in fact the same up to order of factors. $\qed$
\end{proof}

\subsection{The Chinese Remainder Theorem}

There is also an analogue of the Chinese Remainder Theorem in Dedekind domains. It depends on the following definition.

\begin{definition}
For a prime ideal $P$ in a Dedekind domain, we write $a \equiv b \pmod{P^i}$ for $a, b \in R$ if $a - b \in P^i$.
\end{definition}

\begin{theorem} (Chinese Remainder Theorem)
Let $R$ be a Dedekind domain, and let $P_1, \ldots, P_m$ be mutually coprime ideals in $R$. If $x_1, \ldots, x_m \in R$ are arbitrary elements, then it is possible to find $a \in R$ such that $a \equiv x_i \pmod{P_i}$ for all $i$.
\end{theorem}

\begin{proof}
Let $Q_i = P_1P_2\ldots P_{i-1}P_{i+1}\ldots P_m$. As all the $P_i$ are mutually coprime, we have that $(P_i, Q_i) = (1)$. Thus there exists $p_i \in P_i$ and $q_i \in Q_i$ such that $rp_i + sq_i = 1$ for some $r, s \in R$.

As $rp_i \in P_i$ and $q_i \in Q_i$, we see that $sq_i \equiv 1 \pmod{P_i}$ but $sq_i \equiv 0 \pmod{Q_i}$.

Thus $a = \sum_i x_isq_i$ has the required properties. $\qed$
\end{proof}

With a little work it is possible to use unique factorisation and the Chinese Remainder Theorem to derive the following technical result.

\begin{theorem}\label{abw}
For any given nonzero ideals $A, B$ of a Dedekind domain $R$, there exists an $a \in R$ such that $(a, AB) = A$.
\end{theorem}

\begin{proof}
Write $A = P_1^{r_1}\ldots P_m^{r_m}$ and $AB = P_1^{s_1}\ldots P_m^{s_m}$ for $r_i, s_j \geq 0$.

As $A \mid AB$ we have $s_i \geq r_i$ for all $i$.

For each $i$, let $x_i \in A$ be chosen with $x_i \in P_i^{r_i}$ but $x_i \neq P_i^{r_i + 1}$.

We can then use the Chinese Remainder Theorem for Dedekind domains to find an $a \in R$ such that $a \equiv x_i \pmod{P_i^{r_i}}$ for all $i$.

Now as $a - x_i \in P_i^{r_i}$ and $x_i \in P_i^{r_i}$ but $x_i \notin P_i^{r_i + 1}$, we have that $a \in P_i^{r_i}$ but $a \notin P_i^{r_i + 1}$, for all $i$.

In other words, $(a)$ is divisible by $P_i^{r_i}$ but not any higher power of $P_i$, for all $i$.

Thus $(a, AB) = \mbox{gcd}((a), AB) = A$.
$\qed$
\end{proof}

By letting $B$ be the ideal of Theorem \ref{princ} with $AB = (\beta)$ we obtain the following special case of this result.

\begin{corollary}
Every ideal $A$ of a Dedekind domain $R$ has a representation $A = (\omega, \beta)$ for \emph{two} elements $\omega$ and
$\beta$ of $R$.
\end{corollary}

\subsection{Principal ideal domains}

\begin{theorem}
A principal ideal domain $R$ is a Dedekind domain.
\end{theorem}

\textbf{Proof:}
Recall that a ring in which every ideal is finitely generated is noetherian. This applies to a principal ideal domain since every ideal is generated by one element.

To show that $R$ is integrally closed, suppose that $a, b \in R$ with $b \neq 0$. Suppose that $a/b$ is integral over $R$.

As $R$ is a principal ideal domain, there exists a $d \in R$ such that $(a, b) = (d)$. In particular this means that $a = a'd$ and $b = b'd$ for some $a', b' \in R$. There must also exist $s, t \in R$ such that $as + bt = d$, i.e. $a'ds + b'dt = d$ or $a's + b't = 1$. Thus $a/b = a'/b'$ and $(a', b') = 1$.

Replacing $a$ with $a'$ and $b$ with $b'$ we may suppose that $a/b$ is integral in $R$ with $(a, b) = (1)$.

As $a/b$ is integral we have that
$$(a/b)^n + c_{n-1}(a/b)^{n-1} + \cdots + c_1(a/b) + c_0 = 0$$
for some $c_i \in R$.

Multiplying through by $b^n$ yields
$$a^n = -b(c_{n-1}a^{n-1} + \cdots + c_1ab^{n-2} + c_0b^{n-1}).$$

In particular $b \;|\; a^n$. But $(a, b) = (1)$ and so $(a, b)^n = (1)$. But $(a, b)^n$ is generated by $a^ib^j$ for $i + j = n$, all of which are divisible by $b$. Thus $(b) \;|\; (a, b)^n = (1)$.

This implies that $1 = bb'$ for some $b' \in R$, i.e. $b$ is invertible in $R$ and $a/b \in R$. Thus $R$ is integrally closed.

Finally to show that every prime ideal of $R$ is maximal, consider a prime ideal $(p)$ in $R$. Clearly $p$ must be irreducible, otherwise $p = ab$ for two non-invertible elements $a, b \in R$. But this is impossible since $(p) \supseteq (a)(b)$, and yet if $(p) \supseteq (a)$ for example, then $a = pc$ for some $c \in R$, which would imply that $p = pcb$, i.e. $cb = 1$, which contradicts that $b$ is non-invertible.

Thus $p$ is irreducible. Thus $(p)$ must be maximal. For if $R \supseteq (d) \supseteq (p)$ then $p = dp'$ for some $p' \in R$. As $p$ is irreducible this implies that $p'$ is invertible in $R$ and $(d) = (p)$, proving that $(p)$ is maximal. $\qed$

\subsection{Localisation}

Localisation is a generalisation of the construction of the field of fractions of an integral domain. It can be defined for any commutative ring, but is quite straightforward in the case of an integral domain.

First we need the notion of a multiplicatively closed set.

\begin{definition}
Given a commutative ring $R$, a \emph{multiplicative} subset $S$ of $R$ is a subset containing $1$ and such that $s_1s_2 \in S$ for all $s_1, s_2 \in S$.
\end{definition}

\begin{example}
In the case of an integral domain $R$, the set $S$ of all nonzero elements of $S$ is a multiplicative subset of $S$.
\end{example}

\begin{example}
Given a commutative ring $R$ and an element $r \in R$, the set $S = \{1, r, r^2, \ldots\}$ is a multiplicative subset of $R$.
\end{example}

\begin{definition}
Given an integral domain $R$ and a multiplicative set $S \subseteq R$ consider the set $R^\star = \{r/s \;|\; r \in R, s \in S\}$. We define $S^{-1}R$ to be $R^\star$ modulo equivalence, where equivalence is defined as for the fraction field of $R$. We call $S^{-1}R$ the localisation of $R$ at $S$.
\end{definition}

For general commutative rings the definition is similar except that two elements $r_1/s_1, r_2/s_2$of $R^\star$ are taken to be equivalent if $t(r_1s_2 - r_2s_1)$ for some $t \in S$. However this is not the case of interest in what follows.

An example that will be particularly important to us follows from the following result.

\begin{theorem}
Let $R$ be a commutative ring and $\mathfrak{p}$ a prime ideal of $R$. Let $S = R - \mathfrak{p}$. Then $S$ is a multiplicative subset of $R$.
\end{theorem}

\textbf{Proof:} Clearly $1 \in S$, otherwise we would have $1 \in \mathfrak{p}$ which would make $\mathfrak{p} = R$ which is not a prime ideal.

If $s_1, s_2 \in S$ then $s_1$ and $s_2$ are not in the prime ideal $\mathfrak{p}$. Now suppose that $s_1s_2 \in \mathfrak{p}$. In particular $(s_1R)(s_2R) \subseteq \mathfrak{p}$.

As $\mathfrak{p}$ is a prime ideal we must have that either $s_1R \subseteq \mathfrak{p}$ or $s_2R \subseteq \mathfrak{p}$. But this implies that either $s_1$ or $s_2$ is an element of $\mathfrak{p}$, which is a contradiction.

Thus $s_1s_2 \notin \mathfrak{p}$. $\qed$

\begin{definition}
Let $R$ be a commutative ring and $\mathfrak{p}$ a prime ideal of $R$. If $S = R - \mathfrak{p}$ then $S^{-1}R$ is known as the localisation of $R$ at $\mathfrak{p}$ and is denoted $R_{\mathfrak{p}}$.
\end{definition}

\begin{definition}
A commutative ring $R$ with a unique maximal ideal $\mathfrak{m}$ is called a \emph{local ring}.
\end{definition}

\begin{theorem}
If $R$ is a commutative ring and $\mathfrak{p}$ a prime ideal of $R$ then $R_{\mathfrak{p}}$ is a local ring with maximal ideal $\mathfrak{p}R_{\mathfrak{p}}$.
\end{theorem}

\textbf{Proof:} The units of $R_{\mathfrak{p}}$ are the elements of the form $a/b$ with $a \notin \mathfrak{p}$. Thus the non-units of $R_{\mathfrak{p}}$ are the elements of $\mathfrak{p}R_{\mathfrak{p}}$.

A maximal ideal of $R_{\mathfrak{p}}$ can't contain a unit, so all maximal ideals of $R_{\mathfrak{p}}$ are contained in $\mathfrak{p}R_{\mathfrak{p}}$.

We will show that $\mathfrak{p}R_{\mathfrak{p}}$ is an ideal of $R_{\mathfrak{p}}$. It is certainly an additive subgroup, since if $r_1/s_1, r_2/s_2 \in \mathfrak{p}R_{\mathfrak{p}}$ then $r_1/s_1 - r_2/s_2 = (r_1s_2 - r_2s_1)/(s_1s_2) \in \mathfrak{p}R_{\mathfrak{p}}$ as $r_1, r_2 \in \mathfrak{p}$ and therefore so are $r_1s_2, r_2s_1$ and $r_1s_2 - r_2s_1$. $\mathfrak{p}R_{\mathfrak{p}}$ is also clearly closed under multiplication of elements of $R_{\mathfrak{p}}$.

Thus $\mathfrak{p}R_{\mathfrak{p}}$ must in fact be the unique maximal ideal of $R_{\mathfrak{p}}$. $\qed$

\begin{theorem}
Given a commutative ring $R$ with multiplicative subset $S$ the map $f : R \to S^{-1}R$ which sends $r$ to $r/1$ is a ring homomorphism. We call this map the \emph{canonical homomorphism}. If $R$ is an integral domain then the map is injective.
\end{theorem}

\textbf{Proof:} Clearly $f(1) = 1$, $f(a + b) = (a + b)/1 = a/1 + b/1 = f(a) + f(b)$ and $f(ab) = (ab)/1 = (a/1)(b/1) = f(a)f(b)$.

If $R$ is an integral domain and $f(a) = f(b)$ then $a/1 = b/1$, i.e. $a = b$. $\qed$

\begin{theorem}
If $R$ is a commutative ring and $S$ a multiplicative subset then every ideal of $S^{-1}R$ is of the form $S^{-1}I$ for some ideal $I$ of $R$.
\end{theorem}

\textbf{Proof:}
Let $J$ be an ideal of $S^{-1}R$, $f : R \to S^{-1}R$ be the canonical homomorphism and $I = f^{-1}(J)$.

Since $f$ is a ring homomorphism, $I$ is an ideal of $R$.

Let $r/s \in J$. As $J$ is an ideal, $sr/s = r \in J$. Thus $r \in I$. Thus $r/s \in S^{-1}I$.

As $r/s \in J$ was arbitrary we see that $J \subseteq S^{-1}I$.

But $f(I) = J$ by definition, and thus if $r \in I$ then $r/1 \in J$. But $J$ is an ideal of $S^{-1}R$ and so therefore $r/s = (r/1)(1/s) \in J$ for any $s \in S$.

But $r \in I$ was arbitrary and so $r/s \in J$ for any $r/s \in S^{-1}I$, i.e. $S^{-1}I \subseteq J$.

Combining the two inclusions we have that $J = S^{-1}I$. $\qed$

\begin{theorem}
If $R$ is a commutative ring and $S$ a multiplicative subset then the prime ideals of $S^{-1}R$ are of the form $\mathfrak{q}S^{-1}R$ where $\mathfrak{q}$ is a prime ideal of $R$ that doesn't intersect $S$.
\end{theorem}

\textbf{Proof:}
Suppose $\mathfrak{p}$ is a prime ideal of $R$ not intersecting $S$.

Suppose $(r_1/s_1)(r_2/s_2) \in S^{-1}\mathfrak{p}$ for some $r_1/s_1, r_2/s_2 \in S^{-1}R$. Then $t(r_1r_2s - ps_1s_2)$ for some $p \in \mathfrak{p}$ and $s \in S$.

Then $r_1r_2(st) = rtps_1s_2 \in \mathfrak{p}$.

Since $\mathfrak{p}$ doesn't intersect $S$ this implies that $r_1r_2 \in \mathfrak{p}$. But as $\mathfrak{p}$ is a prime ideal, this implies that either $r_1 \in \mathfrak{p}$ or $r_2 \in \mathfrak{p}$.

In other words, we have shown that $S^{-1}\mathfrak{p}$ is a prime ideal.

Recall that if $f : R \to S^{-1}R$ is the map given by $r \mapsto r/1$ then $f^{-1}(S^{-1}\mathfrak{p}) = \mathfrak{p}$. Thus $\mathfrak{p}$ is uniquely determined by $S^{-1}\mathfrak{p}$.

Now suppose that $\mathfrak{q}$ is an arbitrary prime ideal of $S^{-1}R$. Then $\mathfrak{q} = S^{-1}\mathfrak{p}$ where $\mathfrak{p} = f^{-1}(\mathfrak{q})$.

But $f$ is a ring homomorphism, thus $\mathfrak{p} = f^{-1}(\mathfrak{q})$ is a prime ideal.

We must have $\mathfrak{p} \cap S = \emptyset$, since if $s \in S$ were an element of $\mathfrak{p}$ then $f(s) = s/1$ would be an element of $\mathfrak{q}$, which is impossible, since it is a unit in $S^{-1}R$. $\qed$

\begin{corollary}
If $R$ is an integral domain and $\mathfrak{p}$ is a prime ideal of $R$ then the prime ideals of $R_{\mathfrak{p}}$ are of the form $\mathfrak{q}R_{\mathfrak{p}}$ for $\mathfrak{q}$ a prime ideal of $R$ contained in $\mathfrak{p}$.
\end{corollary}

\textbf{Proof:} In this case $S = R - \mathfrak{p}$, so an ideal that doesn't intersect $S$ is an ideal contained in $\mathfrak{p}$. $\qed$

\begin{theorem} \label{locnoeth}
If $R$ is a noetherian ring and $S$ is a multiplicative subset, then $S^{-1}A$ is noetherian.
\end{theorem}

\textbf{Proof:} Suppose $\{S^{-1}I \;|\; I \in T\}$ is a collection of ideals of $S^{-1}R$ for some collection $T$ of ideals $I$ of $R$.

Since $R$ is noetherian any ascending chain of ideals in $T$ stabilises with some $I_0$, the corresponding chain of ideals in $S^{-1}I$ stabilises with $S^{-1}I_0$. $\qed$

\begin{theorem} \label{locintclosed}
If $R$ is an integral domain which is integrally closed, and $\mathfrak{p}$ is a nonzero prime ideal of $R$ then $R_{\mathfrak{p}}$ is integrally closed.
\end{theorem}

\textbf{Proof:}
Let $K$ be the field of fractions of $R$. We can think of $R_{\mathfrak{p}}$ as embedded in $K$.

Suppose $\alpha \in K$ is integral over $R_{\mathfrak{p}}$. That is, $\alpha$ satisfies a minimum polynomial $x^n + a_{n-1}x^{n-1} + \cdots + a_1x + a_0$ for some $a_i \in R_{\mathfrak{p}}$.

Clearing denominators we get an equation $sx^n + a_{n-1}'x^{n-1} + \cdots + a_1'x + a_0' = 0$ for some $s \in R - \mathfrak{p}$ and $a_i' \in R$.

If we multiply through by $s^{n-1}$ we see that $s\alpha$ is integral over $R$.

As $R$ is integrally closed, $s\alpha \in R$. Thus $\alpha \in R_{\mathfrak{p}}$.

As $\alpha$ was arbitrary, this shows that $R_{\mathfrak{p}}$ is integrally closed. $\qed$

\subsection{Valuation rings}

\begin{definition}
A \emph{valuation ring} is an integral domain $R$ such that for every element $x$ of its field of fractions $K$, either $x$ or $1/x$ belongs to $R$.
\end{definition}

\begin{theorem}
Let $R$ be an integral domain with field of fractions $K$. The following are equivalent.
\begin{enumerate}
\item $R$ is a valuation ring
\item The set of principal ideals of $R$ is totally ordered by inclusion
\item The set of ideals of $R$ is totally ordered by inclusion
\item $R$ is a local ring and every finitely generated ideal of $R$ is principal
\end{enumerate}
\end{theorem}

\textbf{Proof:}
(1) implies (2): Suppose $R$ is a valuation ring.

For nonzero elements $r, s \in R$ we can write $r \geq s$ if $r/s \in R$. Since $r/s \in K$ either $r/s \in R$ or $s/r \in R$. Thus either $r \geq s$ or $s \geq r$.

If $r \geq s$ and $s \geq r$ then $r/s \in R$ and $s/r \in R$ so that $r/s$ is invertible in $R$, i.e. $r = su$ for some $u \in R^\star$, i.e. $(r) = (s)$.

Thus there is an ordering on the set of principal ideals of $R$ induced by the ordering on $R$ and this ordering is total.

This ordering is the same as that given by inclusion, since if $r/s \in R$ then $r = st$ for some $t \in R$ so that $(r) \supseteq (s)$.

(2) implies (3): Let $I, J$ be ideals of $R$ with $I$ not contained in $J$. Choose some $r \in I\\J$. Let $b \in J$.

Since $a \notin J$ we have $a \notin (b)$. By assumption this means that $(b) \subseteq (a) \subseteq I$.

But $b$ was arbitrary in $J$, thus $J \subseteq I$.

As $I$ and $J$ were arbitrary ideals of $R$, the ideals of $R$ are totally ordered by inclusion.

(3) implies (4): If the set of ideals of $R$ is totally ordered, there can only be one maximal ideal. Thus $R$ is local.

To show that every finitely generated ideal is principal it is enough to show that any ideal generated by two elements is in fact principal.

But if $I = (r, s)$ then either $(r) \subseteq (s)$ or $(s) \subseteq (r)$, so $I = (r)$ or $I = (s)$.

(4) implies (1): Suppose $r, s \in R$ and $M$ is the maximal ideal of $R$. Let $I = (r, s)$.

It easy to show that if $I$ is a principal ideal and $M$ is a maximal ideal of $R$ then $I/IM$ is an $R/M$-vector space.

If $I = (x)$ then $\bar{x} = x + IM$ spans $I/IM$. We claim $\{\bar{x}\}$ is a basis of $I/IM$.

If not then $I/IM$ is dimension $0$ over $R/M$, which means $I \subseteq IM$, i.e. $x \in xM$ which means that $1 \in M$. This is a contradiction since $M$ is maximal.

Thus $\{\bar{x}\}$ is a basis for $I/IM$ over $R/M$, i.e. $I/IM$ is a $1$-dimensional vector space over $R/M$.

This means that the images of $r$ and $s$ in $I/IM$ are linearly dependent over the field $k = R/M$, i.e. if $\bar{r}$ and $\bar{s}$ are the images of $r$ and $s$ in $I/IM$ there exist $\bar{u}$ and $\bar{v}$ in $R/M$ not both zero such that $\bar{u}\bar{r} + \bar{v}\bar{s} = 0$.

Thus there exist elements $u$ and $v$ of $R$ such that $ur + vs \in IM$ with $u$ and $v$ not both in $M$. Therefore there exist $x, y \in M$ such that $ur + vs = xr + ys$.

We then have $r(u - x) = s(y - v)$.

As $u$ and $v$ are not both in $M$, one of them is a unit in $R$. Suppose for example that $u$ is a unit. Then so is $u - x$. Then $r/s \in R$.

As $r$ and $s$ were chosen arbitrarily in $R$, every element $r/s$ of $K$ is either in $R$ or its inverse is. $\qed$

\subsection{Discrete valuation rings}

\begin{definition}
A \emph{discrete valuation ring} is a principal ideal domain that is a local ring but not a field.
\end{definition}

\begin{theorem} \label{locprimemax}
Suppose that the localisation of an integral domain $R$ at a prime ideal $\mathfrak{p}$ is a discrete valuation ring. Then the maximal ideal of $R_{\mathfrak{p}}$ is its only prime ideal.
\end{theorem}

\begin{proof}
Since a discrete valuation ring is principal, all prime ideals are maximal. $\qed$
\end{proof}

\begin{theorem} \label{localded}
Suppose $R$ is an integral domain. Then the following are equivalent.
\begin{enumerate}
\item $R$ is a noetherian valuation ring
\item $R$ is a discrete valuation ring
\item $R$ is a local, noetherian ring and its maximal ideal is generated by a single element
\item $R$ is a local ring and a Dedekind domain
\end{enumerate}
\end{theorem}

\begin{proof}
(1) imples (2): This follows since every finitely generated ideal is principal in a valuation ring, and a valuation ring is local.

(2) implies (1): We have that every ideal is principal and that $R$ is local. Clearly $R$ is noetherian.

But a local ring is a valuation ring iff every finitely generated ideal is principal. Thus $R$ is a valuation ring.

(2) implies (3): This follows since a principal ideal domain is noetherian.

(3) implies (2): Suppose that the maximal ideal $M$ of $R$ is generated by $\pi$.

Let $I$ be an arbitrary ideal of $R$.

Suppose that $I \subseteq \cap M^i$. Let $0 \neq a \in I$. As $a \in M^i$ then $a = \pi^i a_i$ for some $a_i \in R$.

As $R$ is an integral domain we have that $a_i = \pi a_{i+1}$ for all $i$. Thus $(a_0) \subset (a_1) \subset (a_2) \subset \cdots$ is an ascending chain of ideals which doesn't stabilise.

But this is impossible as $R$ is noetherian. So $a = \pi^n a_n$ for some unit $a_n$ of $R$.

Let $m$ be the minimum such value of $n$ over all the elements $a$ of $I$. Then $(\pi)^m \subseteq I$. Yet every element of $I$ is in $(\pi)^m$ and so the reverse inclusion also holds.

Thus $I = (\pi)^m$. In other words, an arbitrary ideal of $R$ is principal (a power of the maximal ideal, even).

(2) implies (4): This follows since a principal ideal domain is Dedekind.

(4) implies (3): Let $R$ be a local Dedekind domain with maximal ideal $P$. Find $p \in P$ such that $(p) \subseteq P$ is maximal amongst principal ideals contained in $P$. We will show that $(p) = P$.

Suppose to the contrary that $P \neq (p)$. Since $R$ is a Dedekind domain, the ideal $(p)$ contains a product of prime ideals. And since $R$ is a local ring, it must contain a power of $P$. Let $P^r$ be the smallest power of $P$ contained in $(p)$. Thus there exists $a \in P^{r-1}$ with $a \notin (p)$.

Clearly in the field of fractions of $R$ we have that $a/p \notin R$.

As $a \in P^{r-1}$, we have that $aP \subseteq P^r \subseteq (p)$. Thus $(a/p)P \subseteq R$. It is easy to see that $(a/p)P$ is an ideal of $R$.

There are now two cases. Either $(a/p)P = R$ or $(a/p)P \subseteq P$.

If $(a/p)P = R$ then $1 = ax/p$ for some $x \in P$. But then $(p) \subseteq (x)$. As $(p)$ is maximal amongst principal ideals contained in $P$, we must have $(x) = (p)$. Thus $x = cp$ for some $c \in R$, and so $1 = ax/p = ac$.

But this implies $a$ is a unit and since $aP \subseteq (p)$, we have that $P \subseteq (p)$. As $(p) \subseteq P$ we must have $P = (p)$.

On the other hand, if $(a/p)P \subseteq P$ then $P$ is a finitely generated $R[a/p]$-module. Clearly $(a/p)P \neq 0$, otherwise $aP = 0$, which is impossible, since $a \notin (p)$ and $R$ is an integral domain. Thus $P$ is a faithful, finitely generated $R[a/p]$-module and so $a/p$ is integral over $R$.

But as $a/p \notin R$, this contradicts our assumption that $R$ is integrally closed. Thus $(p) = P$ after all. $\qed$
\end{proof}

\begin{theorem}
If $R$ is a Dedekind domain and $\mathfrak{p}$ is a prime ideal of $R$ then $R_{\mathfrak{p}}$ is a discrete valuation ring.
\end{theorem}

\begin{proof}
We have shown that $R_{\mathfrak{p}}$ must be noetherian (\ref{locnoeth}), integrally closed (\ref{locintclosed}) and the only prime ideal is maximal (\ref{locprimemax}). Thus $R_{\mathfrak{p}}$ is also a Dedekind domain.

But a local domain that is Dedekind is a discrete valuation ring (\ref{localded}). $\qed$
\end{proof}

Discrete valuation domains have an especially simple structure, which means that Dedekind domains can be easily understood locally.

\begin{theorem}
If $R$ is a discrete valuation domain then there exists a prime element $\pi \in R$ such that every element of $R$ can be expressed in the form $u\pi^n$ for some unit $u$.
\end{theorem}

\begin{proof}
As $R$ is a local Dedekind domain and a principal ideal domain, it has a unique prime ideal $P$, which is principal. Let it be generated by $\pi \in R$, say.

Suppose that $p$ generates $\pi$ and that $p \mid ab$ for $a, b \in R$. Then $(p) \mid (a)(b)$, and since $(p) = P$ is a prime ideal, either $(p) \mid (a)$ or $(p) \mid (b)$.

Without loss of generality, suppose $(p) \mid (a)$. Then $(p) \supseteq (a)$ and so $a = pa'$ for some $a' \in R$. Thus $p \mid a$. This shows that $p$ is a prime element of $R$.

Now suppose that $(c)$ is an arbitrary ideal of $R$. By unique factorisation, it is a product of prime ideals, of which there is just one, namely $P$. In other words, $(c) = (p)^k$ for some nonnegative integer $k$.

Thus $c \in (p^k)$, i.e. $c = up^k$ for some unit $u \in R$. $\qed$
\end{proof}

\end{document}


\section{Introduction}
The \textrm{Dusk} network makes use of a decentralized and privacy-oriented digital currency that evolves the CryptoNote protocol\cite{CryptoNote} through the groundbreaking discoveries in the field of Byzantine consensus and pseudo-random functions of world renown cryptographers such as Silvio Micali, Michael Rabin, Alexander Yampolskiy and Evgeniy Dodis. \textrm{Dusk} radically departs from any other blockchain by employing an adaptive consensus mechanism, called Segregated Byzantine Agreement (or SBA{$\large\star$}), which does not require the computational intensity of proof-of-work and is a fairer alternative to proof-of-stake. Built on such consensus algorithm, \textrm{Dusk} is poised to be the first to simultaneously achieve previously conflicting goals of guaranteeing transaction untraceability and unlinkability, safeguarding user privacy, reaching transactional "finality" after a bound number of rounds within a single block election and achieving virtually unbounded user scalability without any significant performance degradation.

The \textrm{Dusk} network requires a heightened security setup designed specifically to:

\begin{enumerate}
\item Obfuscate IP addresses of the communicating peers
\item Prevent linkability and traceability of accounts
\item Guarantee network performance
\item Implement efficient payment mechanism for high QoS applications such as secure and anonymous voice calls
\end{enumerate}

An important difference with CryptoNote, is that \textrm{Dusk} does not make use of proof-of-work mining and therefore drops completely CryptoNight and deviates substantially from the hashing algorithms therein adopted. In particular, \textrm{Dusk} uses what we call \hyperref[sec:SBA]{Segregated Byzantine Agreement} (SBA$\large\star$) protocol which enhances classic BA$\large\star$ by implementing specific measures to protect peer privacy. SBA$\large\star$ has been developed specifically to power the \textrm{Dusk} Blockchain and help meeting the aforementioned requirements. These efforts do not solely relate to the application layer but extend to the networking layer as well. This is why the \textrm{Dusk} protocol makes use of:

\begin{itemize}
\item \textbf{Stealth addresses}: to protect transaction recipient anonymity
\item \textbf{RingCT signature}: to protect transaction sender's identity
\item \textbf{Anonymous Network Layer}: to protect the IP address of the network peers; to provide secure data transfer mechanism; to implement off-line data retrieval strategy; to power the anonymous gossip network for transaction propagation and verification
\item \textbf{Non-Interactive Verifiable Secret Sharing Scheme}: to conceal all but highest priority time-locked transactions from the participants to the Block Generation sortition
\item \textbf{Cryptographically Committed Provisioners}: to protect the information about stake; to implement a division of responsibilities between Block Generators and the electable Block Voters and Verifiers; to boost network efficiency by acting as state channel guarantors; to incentivise participation to the network; to protect the balance information of transacting nodes; to prepare SBA$\large\star$ for future expansion with non-balance and non-payment related weights such as storage contributed to the network (as in proof-of-storage), availability expressed in elapsed time since joining the network (as in proof-of-idle), etc.
\end{itemize}

\section {Preliminaries}

\subsection{Diffie-Hellman Hardness Assumption}

In any group, a discrete logarithm $log_b\space$ a is a number x $\in \mathbb{Z}$ such that $b^x = a$.

Most of the cryptographic building blocks related to this work are linked to the Diffie-Hellman assumption which uses the hardness of discrete logarithms in cyclic groups \cite{CyclicGroup}. Considering a multiplicative cyclic group $\mathbb{G}$ of order $p$ and generator \cite{Generator} $g$, we can formulate the following assumption: given $g^a$ and $g^b$ for uniformly and independently chosen $a$ ,$b$ $\in \mathbb{Z}_p$ then $g^{ab}$ performs like a random element in $\mathbb{G}$ of order $p$.

As a consequence of such assumed randomness, the Decisional Diffie-Hellman (DDH) Problem relates to distinguishing the following two probability distributions:

\begin{itemize}
\item ($g^a, g^b, g^{ab}$) $\forall \space a,b \in \mathbb{Z}\\$ // $\small (g^a, g^b, g^{ab}) \textrm{ are defined as a Diffie-Hellman Tuple}$
\item ($g^a, g^b, g^{c}$) $\forall \space a,b,c \in \mathbb{Z}$
\end{itemize}

\subsection{Hiding Recipients: Stealth Addresses}
Inspired by the CryptoNote white-paper\cite{CryptoNote}, stealth address technology is at the basis of \textrm{Dusk} recipient hiding technique. Already widely tested in other privacy-oriented digital currencies, it is the proven choice for concealing the true recipient address of a transaction while keeping uniqueness within the context of the ledger (meaning no other address can be linked to a stealth address). Additionally, a derivation of an unbound number of receiving addresses is also possible without any of them allowing traceability back to the recipient's main address. As an anonymous key agreement protocol, \textrm{Dusk} uses the Elliptic Curve Diffie-Hellman (ECDH) due to the desired property of allowing two parties to generate a shared secret by solely knowing each other's public key, and the generator point of the Elliptic Curve used in the Twisted Edward equation. Following is a detailed explanation of how \textrm{Dusk} implements Stealth Address technology.

\subsubsection{Elliptic-Curve Cryptography}

The system makes use of Elliptic-Curve Cryptography (ECC), hence approaching public-key cryptography through the algebraic structure of elliptic curves and thus allowing for the creation of smaller and more efficient cryptographic keys. ECC gives the same security levels of, for example, RSA, but using a much smaller security key.

The structure of an elliptic curve is a plane curve satisfying the equation $y^2=x^3+ax+b$, which returns us the graph in Figure \ref{fig:elliptic}.

\begin{figure}
\includegraphics[height=1in, width=1in]{elliptic_bn}
\caption{A generic elliptic curve}
\label{fig:elliptic}
\end{figure}

In ECC, a Galois Field is created by taking the modulo of all points using a large prime number, creating a finite number of values for the used equation. The following axioms are furthermore taken into account:

\begin{enumerate}
\item A point can't be multiplied or divided by another point.
\item Any point on the curve can be added or subtracted to another point (or itself).
\item Adding a point to itself allows for scalar multiplication.
\end{enumerate}

\subsubsection{Private and Public Keys}

The \textrm{Dusk} Blockchain utilizes an \textit{Ed25519} curve, which is a Twisted Edwards curve with the following Elliptic Curve Parameters:

$q$ : a prime number; $q=2^{255}-19$ ; \textit{This is the number of points in the curve.}

$d$ : an element of $\mathbb{F}_q$; $d=-121665/121666$; \textit{Value used in the curve equation below}

$E$ : an elliptic curve equation; $-x^2+y^2=1+dx^2y^2$; \textit{The Twisted Edwards curve/equation we are using}

$G$ : a base point; $G=(x, -4/5)$; \textit{The}\textbf{**generator**} \textit{point. This is a base - starting point used for all Elliptic modulo operations.}

$l$ : a prime order of the base point; \\\space\space\space\space$l=2^{252}+27742317777372353535851937790883648493$ ;\\ \textit{The order of the base point} $G$\textit{. This defines the maximum size of scalars and the maximum number of points that can be used.}

$\mathcal{H}_s$: a cryptographic hash function $\{0,1\}^*\rightarrow\mathbb{F}_q$;

$\mathcal{H}_p$: a deterministic hash function $E(\mathbb{F}_q)\rightarrow E(\mathbb{F}_q)$;

All private and public keys in \textrm{Dusk} will be using 64 hex characters.

\subsubsection{Accounts and Addresses}

The following procedure will be used to create an address.

\begin{enumerate}
\item  We pick a random /textit{private spend key}, by generating 256 random bits, and reducing$\mod l$. We call this $b$.
\item  $b$ is hashed with hashing algorithm $H$(\textit{Keccak\_256}). We interpret the result of the hashing as an integer, reduce it $\mod l$ as before. We call this key $a$.
\item  We generate our public spend and view keys $B=bG$ and $A=aG$
\item  We hash (network prefix (0xEF) + $B$ + $A$) with $H$.
\item  Append the first 4 bytes of this operation to (prefix + $B$ + $A$), obtaining a 69 bytes value (1 + 32 + 32 + 4)
\item  Convert this to \textit{cnBase58}.
\end{enumerate}

We will explain how stealth addresses work by first going trough a brief explanation about key exchanges on an ECC scenario, in the next section.

\subsubsection{The Elliptic Curve Diffie-Hellman}

The Elliptic Curve Diffie-Hellman (ECDH) is an anonymous key agreement protocol, a variant of the Diffie-Hellman protocol adapted to work with Elliptic-Curve Cryptography.

Thanks to ECDH, two parties can generate a shared secret over an unsecured connection only by knowing each other's public keys, and the generator point of the Elliptic Curve used in the ECC equation.

To demonstrate this, we will use Alice (with private key a and public key A=aG) and Bob (with private key b and public key B=bG). (Where G is the generator point)

As previously stated, points on a curve can be added together, and Alice could calculate a point C = A + B, but this could also be potentially done by anyone eavesdropping the conversation, since A and B are publicly available.

Now, let's remember that A and B are points on the elliptical curve, and that we can add a point to itself.

Alice can now calculate a new point D=aB,  and Bob can get D'=bA.

We can now prove that D=D', and thus Alice and Bob share a secret by operating on ECC and knowing each other's public keys and the generator point G:

\begin{enumerate}
\item Given a common generator point G;
\item Alice has a=5, A=5G (private and public keys)
\item Bob has b=7, B =7G
\item a · b = 35
\item Alice computes D=aB=5B=5·7G=35G
\item Bob computes D'=bA=7A=7·5G=35G
\item D=D'
\end{enumerate}

Point D has a corresponding scalar d, in the example above equal to 35, which is a shared secret between Alice and Bob

\subsubsection{Stealth Addresses}

Let's consider the diagram in Figure \ref{fig:cryptodg} from the CryptoNote whitepaper.

\begin{figure}
\includegraphics[height=1in]{M42G4Fy}
\caption{A \textit{stealth transaction}}
\label{fig:cryptodg}
\end{figure}

The \textit{Dual-key Stealth Address} $P$ is defined as $P=\mathcal{H}_s(rA) \cdot G+B$. The link-ability of the Stealth Address is achieved by using a combination of spend/view-keys, without actually allowing a spending transaction to take place. Let's now assume that Alice has a private \textit{spend-key} $z$ and a private \textit{view-key} $y$. We call her public \textit{spend/view-keys} $Z,Y$. On the other side, Bob's public keys are $A$ and $B$, with Bob's private keys $a$ and $b$ unknown to Alice. In order to build a stealth address, Bob needs to compute $r$ (an arbitrary random scalar chosen by Alice) and $R$ as the corresponding ECC point such as $R=rG$. $r$ is not being shared with anyone and can be discarded after its use - unless Alice wants to prove that she sent a transaction to Bob to an external party. $R$ is added to the transaction so that it can be seen by everyone. A new $r$ is calculated for each transaction, since reusing it in the computation of the Stealth Address, would result in a collision. Therefore, given the equation above: $P=\mathcal{H}_s(rA)G+B$, a Stealth Address can be constructed as follows.

\begin{enumerate}
\item P : the Stealth Address where the funds will be sent
\item $\mathcal{H}_s$ : a Hashing Algorithm returning a scalar value
\item r : the random scalar chosen by Alice
\item A : Bob's public view-key
\item G : The standard Ed25519 base point
\item B : Bob's public spend-key
\end{enumerate}

Alice calculates point D from ECDH using a randomly chosen r and Bob's public key A.

Bob computes D independently from Alice, due to the properties of ECDH.

Alice computes the scalar $f=\mathcal{H}_s(D)$ - (this hashing step creates unlinkability between Bob's address and the new stealth one) and calculates F=fG, and P = F + B (Bob's public spend-key).

Now, in order to check if he is the transaction's recipient, Bob:

\begin{enumerate}
\item Calculates D' using R as propagated with the transaction (The equality D = D'=aR is still unproven).
\item Calculates f'=$\mathcal{H}_s(D')$
\item Calculates F'=f'G
\item Calculates P'=F'+B
\end{enumerate}

If P'=P, then Bob knows the transaction was intended for him, and can retrieve it like this:

(Bob has to compute the secret key associated with the transaction)

\begin{enumerate}
\item Bob knows f' (computed above), and derives xf'+b  (Bob's private spend key)
\item Knowing that P=xG, we got P=xG=(f'+b)G
\item Bob then has to check if the transaction on P is spent, Bob computes a key-image and checks on the blockchain if the image linked to that transaction has been spent. Image I=x$\mathcal{H}_p(P)$
\item Bob can then sign a new transaction using x
\end{enumerate}

\subsection{Obfuscating Sender}

Ring Signatures are an efficient, established way to obfuscate the input of a transaction by making use of a sender's account keys and a number of decoy keys (called \textit{outputs}) taken directly from the blockchain, using a triangular distribution method. The technology finds its roots in the early days of blockchain research, as Satoshi Nakamoto himself was hypothesizing back in 2010:

\blockquote{Crypto may offer "key blinding". I did some research and it was obscure, but there may be something there. "Group signatures" may be related.} \footnote{https://bitcointalk.org/index.php?topic=770.msg9074\#msg9074}

The procedure allows one of the members of the \textit{ring} to sign messages on behalf of the whole group, and by doing so it renders it infeasible to know exactly which member signed. (Figure \ref{fig:ringsig})

\begin{figure}
\includegraphics[scale=0.35]{ringsig}
\caption{A \textit{ring signature transaction}}
\label{fig:ringsig}
\end{figure}

In a group signature procedure, there is no central management or setup - all the signer needs is the public keys of the members she chooses to be part of the ring.

Each signer is associated with a public key $PK_x$ and a corresponding private key $SK_x$. A ring signature scheme is defined by two procedures:

\begin{itemize}
\item $\textrm{ringSign}(M, PK_1, PK_2, ..., PK_r, s, SK_s)$: which is a method for computing the ring signature Q, which gets the message M, the public keys of the ring members, and the private key of the message signer.
\item $\textrm{ringVerify}(M,Q)$: which is a procedure to verify the signature Q, which gets message M and signature Q as arguments, and returns a boolean (correct / not correct) as output.
\end{itemize}

\subsubsection{Signature Generation}

Having a message $m$ and its own private key $SK_s$, together with a sequence of ring member's public keys, signer $A_s$ can create a signature as follows:

\begin{enumerate}
\item Computes a key $k=h(m)$, where $h$ is a collision-resistant hash function.
\item Chooses a random $v$
\item Chooses a random $x_i$ and computes $y_i=g_i(x_i)$
\item Solves for $y_s$ the equation containing the \textit{Combining function} $C_{k,v}(y_1,y_2,...,y_r) = v$
\item Finds $x_s$ knowing its own $SK_s$: $x_s=g_s^{-1}$
\item Creates a ring signature: $v; x_1, x_2, ..., x_r$
\end{enumerate}

\subsubsection{Signature Verification}

A verifier can confirm a ring signature as follows, having the collection of the member's *public keys:*

\begin{enumerate}
\item Compute, for each $x_1$, $y_1=g_i(x_1)$
\item Computes $k=h(m)$
\item Confirms the equation $C_{k,v}(y_1,y_2, ..., y_r)=v$ for values of $y_i$
\item If the equation is correct then the signature is valid, otherwise it's not.
\end{enumerate}

\subsubsection{Ring Confidential Transactions}

Blockchains such as Monero use a particular breed of ring signatures called Ring Signature Confidential Transactions (\textit{RingCT}), where the privacy is taken one step further by not only giving full anonymity at the sender level (as explained above), but also on the amount spent and destination.

The RingCT technology makes the payment virtually unlinkable to the original spender, it is fast, and it also  conceals the amount being transferred. Confidential Transactions include cryptographic proof that, given a set of input amounts, proves that their sum equates the output amounts, without revealing them. In practice, if \textit{Alice} has an output of 15 \textrm{Dusk} and wants to send \textit{Bob} 7 \textrm{Dusk}, she will have to spend the output in its entirety on transaction $T$, and then send the change (8 \textrm{Dusk}) back to herself. (Figure \ref{fig:ringtx})

\begin{figure}
\includegraphics[scale=0.7]{ringtx}
\caption{A \textit{ring stealth transaction}}
\label{fig:ringtx}
\end{figure}

This commitment is represented by the formula:

$R_{ct}=xG + aH(G)$

In the formula, $a$ is the amount sent out in the transaction, $x$ is a computed random value. By publishing the value of $R_{ct}$ to the network as an output, the network will be able to verify the legitimacy of the submitted transaction. This technology goes on top of the already untraceable (Stealth) addresses used by the \textrm{Dusk} blockchain, and anonymous networking used to give full anonymity to the nodes involved.

In the \textrm{Dusk} Network, RingCT is used by default for all transactions except those used to participate to the sortition for Block Generator (which are normally \textit{ring signed}). This is merely a detail, though, considering that an external observer would not be able to tell these two kind of transactions apart from each other.

\subsubsection{Future Development: Bulletproof Transactions}

Initially, non-interactive proof of knowledge based on [Fiat-Shamir heuristic \cite{Shamir} have been taken into consideration in order to conceal transaction information such as sender and amount. However, it quickly appeared that technologies developed on top of its concept such as zk-SNARKs \cite{zcash} require prohibitive computational power and time of processing for transaction generation. Even the more recent zk-STARKS \cite{starks}) proved impractical to integrate in \textrm{Dusk} because of the problematic hurdle of needing extremely bulky verification proof (as big as several hundreds of kilobytes), although solving the problematic reliance on a trusted third-party for system setup and being substantially simpler than zk-SNARKS in terms of cryptographic primitives (they do not make use of Elliptic Curves, nor Public Key cryptography).

The most promising advancement in the field of transaction confidentiality is probably given by the so-called Bulletproof Transactions \cite{bulletproofs}, which would appear to provide a substantial improvement over RingCT in terms of cryptographic proof size. At the time of this writing, first tests show a tenfold reduction in size and verification times (although still not reaching the same level of efficiency if compared to a zk-SNARK proof). Given the "pluggable" nature of \textrm{Dusk} core, the underlying software for transaction generation will be kept flexible through a plugin architecture in order to facilitate the adoption of a future implementation of Bulletproof Transactions as soon as an emerging library proves stable enough for integration.

\subsection{Cryptographic Accumulator}
\label{sec:Cryptographic-Accumulator}
The set of algorithms known as cryptographic accumulators have been developed to allow hashing of a finite and potentially large set of values into a single succinct value, called the Accumulator. The algorithm enables efficient computation of a witness for every accumulated input that proves its membership in the Accumulator. A dynamic Accumulator is a special kind of Accumulator which permits efficient input addition and deletion where the computation costs of these operation is independent on the number of values added or deleted. As such, it is a space and computational time efficient data structure initially developed for testing membership.

Formally, a dynamic Accumulator is a tuple of algorithms defined as follows:

\begin{itemize}
\item  $\textrm{Generate}(1^k)\rightarrow (sk_{acc}, pk_{acc})$: Given a security parameter $k$ return a (private, public) key pair. Notice that the parameter $k$ is sensitive information (trapdoor) which could deterministically recreate the private key
\item  $\textrm{Eval}((sk_{acc}, pk_{acc}), \chi) \rightarrow (acc_\chi, aux)$: Probabilistic algorithm that gets the key pair and a set $\chi$ to be accumulated and returns the Accumulator and some auxiliary data
\item  $\textrm{WitnessCreate}((sk_{acc}, pk_{acc}), acc_\chi, aux, x_i)\rightarrow wit_x \lor \bot$: Creates a witness $wit_x$ if $x_i \in \chi$, $\bot$ otherwise
\item  $\textrm{Verify}(pk_{acc}, acc_\chi, wit_x, x_i)\rightarrow wit_x\space \textrm{is a witness for }x_i$: This is the actual membership verification
\item  $\textrm{Add}(sk_{acc}, pk_{acc}, acc_\chi, aux, y_i)\rightarrow acc_{\chi'} \lor \bot$ : If the element $y_i$ is not already in the set $\chi$, returns the updated Accumulator $acc_{\chi'}$ with $\chi' \leftarrow \chi \space \bigcup \space \{y_i\}$
\item  $\textrm{Delete}(sk_{acc}, pk_{acc}, acc_\chi, aux, y_i)\rightarrow acc_{\chi'} \lor \bot$ : If the element $y_i$ is in the set $\chi$, returns the updated Accumulator $acc_{\chi'}$ with $\chi' \leftarrow \chi \space \backslash \space \{y_i\}$
\item  $\textrm{WitnessUpdate}((sk_{acc}, pk_{acc}), wit_x, aux, x_i)\rightarrow wit'_x \lor \bot$: Updates the witness for $x_i$ in case it has been added or deleted ($aux$ describes which of the two)
\end{itemize}

Different technologies exist that implement Accumulators with different level of computational efficiency and security requirements. Currently, \textrm{Dusk} is experimenting to achieve the best trade-off between a decentralized choice and efficiency of Accumulator technology. Following are the technologies under evaluation.

\subsubsection{RSA Accumulators}

Abundant literature has been developed regarding many different Accumulators, particularly the so-called RSA Accumulators. Considering \textit{strong RSA setting}, RSA Accumulators (e.g. Carmenish's and Lysyanskaya's Dynamic RSA Accumulator \cite{accumulators}) are based on one-way RSA function for a suitably calculated $N =pq$ where $p$ and $q$ are sample primes with polynomial dependence on the security parameter $k$ and therefore are effectively the Accumulator's \textit{trapdoors} which need to be \textbf{destroyed} immediately after parameters are generated. As an alternative, the employment of RSA-2048 could be used to circumvent the need for developers to know the security parameters and act as trusted party, considering that the related security parameter $k$ is claimed to be destroyed and no factoring solution to the RSA-2048 number has been found for the past 25 years \footnote{https://en.wikipedia.org/wiki/RSA\_Factoring\_Challenge}, despite a \$200,000 incentive offered.

$acc_\chi \leftarrow g^{a} mod\space N$ // The set of members $a =\{a_1, .., a_n\}$ is compactly represented by the Accumulator
$acc_\chi = g^{\prod{a \in \chi}}\\wit_i \leftarrow g^{(a_1, .., a_{i-1}, a_{i+1}, .., a_n)} mod\space N$

\subsubsection{Expressive Bilinear Accumulator}

Under such security assumption, dynamic Accumulator schemes from \textit{bilinear pairings} have been developed in the literature. Among those, an expressive \textit{zero-knowledge} set Accumulator has been formalized by Zhang, Katz and Papamanthou \cite{zeroaccum} capable of providing succinct proofs for a large collection of operations over accumulated sets, among which it is of particular interest the $\textrm{SUM}$ operation, which could find application for rapid and zero-knowledge calculation of accumulated \hyperref[sec:Cryptographically-Committed-Provisioners]{Provisioners stakes}.

However, similarly to RSA, bilinear pairing Accumulators present also the drawback of relying on the security parameter $k$.

\subsubsection{Elliptic Curve Multiset Hash}

Shepard, Tibouchi and Aranha \cite{ecmh} teach of a new and efficient method to "\textit{associate a hash value to arbitrary collections of objects (with possible repetitions) in such a way that the hash of the union of two collections is easy to compute from the hashes of the two collections themselves:  it is simply their sum under a suitable group operation}". This association is the basis for an Elliptic Curve Multiset Hash which constructs a homomorphic multiset hashing on top of efficient \textit{BLAKE2} hash function and binary elliptic curve encoding. This allows for incremental/parallel computation of a hashing function for various applications including efficiently testing for subgroup membership. This makes ECMH an appealing alternative to the other known algorithms to construct Accumulators, especially since the method is unencumbered with the necessity of a trusted setup.