\chapter{Vibration Signal Analysis}\label{VibrationSignalAnalysis}
\section{Data Collection and Processing}
The most important measurement to be made in order to perform significant rotordynamic analysis is the Vibration Signal, $ V $ or $ W $. Other important measurements include Spin Speed, $ \Omega $, of the rotating shaft (especially important if during a start-up or run-down), and a Reference Signal, $ R $, that indicates a rotational position of the shaft. Orthogonal vibration signals (meaning two independent directions), $ V\ \&\ W $, measuring the position of the shaft centerline can help in characterizing anisotropic systems. Sampling Rates, $ f_s $ of the signals mentioned thus far must be high enough to measure the vibration of interest, typically this is at least several times the highest expected spin speed of the shaft. It is important to note that these signals can come from an experiment or a theoretical model. In the case of a theoretical model, the sampling rate is inversely proportional to the time interval of the differential equation solver. Or, if a closed form solution exists, the time interval of the time vector chosen to express the solution within.\par
There are four variables deduced from the above signals that form the basis for the majority of rotordynamic figures and analysis. These are: Amplitude of Vibration, $ A[m,mils] $; Amplitude Spectrum, $ \tilde{A}(\omega)[m,mils] $; Phase of Vibration, $ \beta[\deg,Rad] $; and Spin Speed, $ \Omega[Hz,Rad/s,RPM] $. Amplitude Spectrum is actually a two dimensional variable where the variable, $ \omega[Hz,Rad/s,RPM] $, represents the Frequency of Vibration (often called Whirl Speed if its in units of rotation). Figures to be presented in this work are varying combinations of these four variables. The Bode diagram plots $ A $ against $ \Omega $ alongside $ \beta $  against $ \Omega $. A Spectrum figure plots the absolute value of $ \tilde{A}(\omega) $. An extension of this is the Cascade which adds the third dimension of $ \Omega $. Orbit plots represent one cycle of the time domain signals $ V\ \&\ W $. Lastly, 3D Orbits are formed by plotting the orbit ($ V,W $) against $ \Omega $. Explanations of the importance and methods in producing these plots are to follow. \par
A difficulty to rotordynamic analysis arises in the continuous change of $ \Omega $ causing a continuous change in time of its dependent variables $ A,\ \tilde{A}(\omega),\ \&\ \beta $. A visualization of these changes is given in Figure \ref{fig:PosOverTime}. This transient nature poses difficulty because the techniques used to produce $ A,\ \tilde{A}(\omega),\ \&\ \beta $ from $ V,\ W\&\ R $ rely on a span of subsequent rotations. A solution to this dilemma utilized in this work is the discretization of signals $ V,\ W,\ R\ \&\ \Omega $ into windows in time. Window width will be represented by the variable $ nspw[samples] $ and total number of samples divided by $ nspw $ will give the number of windows in the signals, $ NW $. There is a trade off between resolution in time, and resolution in frequency of variables as $ nspw $ is changed. This trade off will be elaborated on in \S\ref{Resolution}.\par
\begin{figure}
	\centering
	\includegraphics[width=\linewidth]{./figures/Pos_Over_Time.eps}
	\caption{Position of the rotor shaft over a period in time.}
	\label{fig:PosOverTime}
\end{figure}
The windowing approach is visually depicted using $ \Omega $ in figure \ref{fig:SpeedWindow} as it changes over time. When the width of the window is small enough, such as in Figure \ref{fig:FreqSpanWindow}, the change in the dependent variable becomes vanishingly small. Other continuous variables such as $ A,\ \tilde{A}(\omega),\ \&\ \beta $ are expected to behave similarily, in that their value may be approximated by a single number, or in the case of $ \tilde{A}(\omega) $ as a single spectrum, inside the window despite the change in that variable throughout the entire length of time.
\begin{figure}
	\begin{subfigure}{.5\textwidth}
	\centering
	\includegraphics[]{./figures/FrequencySpan.eps}
	\caption{Rotor speed change over time during a ramp up.}
	\label{fig:FreqSpanOverTime}
\end{subfigure}
\begin{subfigure}{.5\textwidth}
	\centering
	\includegraphics{./figures/FrequencyWindow.eps}
	\caption{Rotor speed change over time during a ramp up.}
	\label{fig:FreqSpanWindow}
\end{subfigure}
\caption{Rotor Spin Speed Windowing effect.}
\label{fig:SpeedWindow}
\end{figure}
\begin{figure}
	\centering
	\includegraphics{./figures/SSTime.eps}
	\caption{A window in time of the transient vibration signals for a window, $ N $, with nspw of $ 2048 $[samples].}
	\label{fig:WindowedData}
\end{figure}
The variables $ V(t) $, $ W(t) $\& $ R(t) $ will now take the form $ V(n) $, $ W(n) $\& $ R(n) $ inside the window (fig. \ref{fig:WindowedData}), where $ n $ is sample number. Spin Speed is simply taken as an average in the window, $ \Omega(N)=avg(\Omega(0:nspw)) $, where $ N $ is the current window index. Therefore, no further explanation is given for its determination. Amplitude, Phase, Amplitude Spectrum, and Spin Speed must be calculated in each window, for a series of windows that cover the entire length of signals. Then a vector of each variable will exist where the length is equal to the number of windows, $ NW $, and is given by
\begin{equation*}
NW = \frac{length(signals)}{nspw}
\end{equation*}\par
The calculation of each of the variables inside the window, at some $ N $, is given in the following sections. A useful visual representation of the windowed signals $ V(n)\ \& W(n) $ are presented in Figure \ref{fig:WindowedData} to aid in understanding the sections to follow.
\subsection{Amplitude}
Amplitude calculation is fairly straightforward within the window. One approach to calculate the peak to peak amplitude is to take the average over the whole window, $ A_v(N) = max(V(0:nspw))-min(V(0:nspw)) $. Another is to use a peak-finding algorithm to determine the height of each peak and average them all over the sample length. General computer code packages, such as MATLAB,  will contain a peak finding algorithm, the details of which are out of the scope of this work.
\subsection{Spectrum}
The frequency spectrum of the signal is calculated inside the window using a Fourier Transform. Influence for this representation of complex amplitude spectrum comes from \cite{craig2006fundamentals}. In MATLAB the Fast Fourier Transform (fft) has been preprogrammed allowing easy working between time and frequency domains.
\begin{equation}\label{eq:FFTReal}
\tilde{A}_V(n) = \frac{\text{fft}(V(n))}{nspw},\ \&\ \tilde{A}_W(n) = \frac{\text{fft}(W(n))}{nspw}
\end{equation}\par
A useful way to represent the data is using a complex variable to compact the two orthogonal displacements $ V\ \&\ W $ as
\begin{equation}\label{eq:ComplexDisplacement}
Z(n) = V(n) + iW(n)
\end{equation}
now the spectrum of this complex value represents both equation planes of vibration in one equation:
\begin{equation}\label{eq:FFTComplex}
\tilde{A}_\pm(n) = \frac{\text{fft}(Z(n))}{nspw}
\end{equation}\par
Thus far, the frequency spectrum in the real coordinates and in the complex is in terms of samples on the independent axis. The frequency vector to which the fft() corresponds must be calculated--this is the whirl speed, $ \omega $. It is known that the slope of $ \omega $ is $ d\omega=f_s/nspw $. This value is also called the frequency resolution, $ f_{res} $. It is also known that the frequency vector is the same length as the time domain signal
\begin{equation*}
f=d\omega(0:nspw-1)
\end{equation*}
and to center the spectrum at a frequency of 0
\begin{equation*}
\begin{array}{c}
Q=ceiling((nspw+1)/2)\\
f_Q=d\omega(Q-1)\\
\omega_j=f-f_Q
\end{array}
\end{equation*}
where $ \omega_j $, here in $ Hz $, is the variable that pairs with the real or complex Amplitude spectrum and the subscript $ j $ is a reminder that $ \omega $ is a discrete variable that ranges $ 1<j<nspw $. Now the complex amplitude spectrums can be represented as $ \tilde{A}_V(\omega),\ \tilde{A}_W(\omega),\ \&\ \tilde{A}_\pm(\omega) $. The Amplitude spectrum in real coordinates\eqref{eq:FFTReal} is symmetric for positive and negative $ \omega $, so typically when the spectrum of a single signal is presented in a spectrum plot or in a cascade it is only on the positive frequency side. On the other hand, the complex representation of the amplitude spectrum\eqref{eq:FFTComplex} is not symmetric on the positive and negative sides of $ \omega $. Understanding why this is the case stems from realizing the form of the Fourier transform as the summation of circles in the complex plane, $ Z(n) = \sum_{j=1}^{j=nspw}\tilde{A_\pm}(\omega_j)e^{i\omega_j t} $. When $ \omega_j $ is positive this represents a positive rotation, and when negative represents a negative rotation. For a given whirl speed, $ \omega_j $, the positive of that value will be represented by $ +\omega $ and the negative as $ -\omega $. These two representations of $ \omega $ correspond to two separate indexes $ j $ as $ \omega_j $ is symmetric about $ j=nspw/2 $. This results in the sum of a positively rotating circle of amplitude, $ \tilde{A}(+\omega) $ and a negatively rotating circle of amplitude $ \tilde{A}(-\omega) $. The ellipse formed by this summation is the orbit of the shaft centerline at this specific speed\cite{goldman1999application},\cite{bently2003fundamentals}. With the understanding of contributions of $ \tilde{A}(\omega) $ and $ \tilde{A}(-\omega) $, we realize that the resulting ellipse will rotate in the counterclockwise direction if $ \tilde{A}(\omega)> \tilde{A}(-\omega) $ and in the clockwise direction otherwise. This rotation is in reference to the positive rotation about the z axis defined by the right hand rule from the y-z plane. Since the same coordinate system is used to represent the sign of $ \Omega $, the whirl can be interpreted as in or opposed to the direction of spin. For a positive $ \Omega $, a negative $ \omega $ corresponds with an opposing whirl, and vice-versa for a positive $ \omega $.
\subsection{Phase}
\subsubsection{Time Domain Approach}
A rather direct way of calculating the phase angle comes from an inspection of the time domain signal. If some once-per-turn reference is available, then a zero-crossing, peak-finding, or threshold algorithm can be employed to locate a specific reference angle of the shaft rotation. In the case that the vibration signal is mostly synchronous (vibrating at the same frequency as the rotation of the shaft) then a peak-finding or zero-crossing algorithm can be used to determine the number of samples from the shaft reference angle to the peak of the vibration. Comparison of this sample distance to the sample distance of an entire cycle of the reference signal will reveal the amount a signal lags the reference angle as a portion of a full rotation. In terms of samples this can be represented by the equation\par
\begin{equation}\label{eq:PhaseAngleTimeDomain}
\beta_k = 2\pi\frac{\#ref_k-\#peak_k}{\#ref_k-\#ref_{k-1}}
\end{equation}
where $ \beta_k $ is the phase lag of the signal of interest from the reference signal at the $ k $th reference cycle, $ \#ref_k $ is the sample number of the reference trigger, and $ \#peak_i $ is the sample number of the peak of the signal of interest. One large advantage to this brute force method is that it can run continuously and provide phase information on just the last rotation of the shaft. In the application to the window of vibration data, fig. \ref{fig:WindowedData}, the measurements of each cycle would be averaged across the window as $ \beta(\omega)=avg(\beta_k) $. This would be done for however many indexes $ k $ were found in the window. In the case of windowed data in Figure \ref{fig:WindowedData} $ k=7[rotations] $.\par
\subsubsection{Frequency Domain Approach}
Alternatively, the phase angle can be determined using the frequency domain representation of the signals.
If the speed of the rotor is known and the time domain signals $ V\ \&\ W $ are known to be synchronous, or filtered to synchronous, then the spectrums of the signals of interest can be used to calculate the phase delay. For any frequency, $ \omega $, the angle is calculated using the equation
\begin{equation*}
\beta(\omega)=angle(\tilde{A}(\omega))-angle(\tilde{K}(\omega))
\end{equation*}
where, $ \tilde{K} = \frac{\text{fft}(K)}{nspw} $ is the frequency domain representation of the reference signal. Either $ \tilde{A}_V $, or $ \tilde{A}_W $ is used to find the phase delay of the $ V $ or $ W $ time domain vibration in reference to the once per turn reference of $ K $. It is also possible to find the delay of any time domain signals in reference to any other time domain signal at a specific frequency using the above equation, though the common practice is to compute the $ \beta $ angle of both signals and subtract one from another. In synchronous vibration, $ \omega=\Omega $.\par
\section{Rotordynamic Figures}\label{ExperimentalPlots}
In the previous section Amplitude, Phase, and Amplitude Spectrum were calculated for the interior of a window of index $ N $. Each of these variables then need to be indexed, as all of the windows are processed until the entire signal has been exhausted. The total number of windows can be realized in the equation $ NW=\frac{length(X)}{nspw} $ where $ X $ is a placeholder for any time domain signal. After all windows have been exhausted, vectors for $ A(N),\ \beta(N)\ \&\ \Omega(N) $ will all be of length $ NW $, and $ \tilde{A}(N,\omega) $ is a matrix of size $ (NW,nspw) $.\par
For visualization of the plots, experimental data from a overhung rotor system, with one disk supported by two bushings, will used to demonstrate the figures in use. Data was taken during this experiment with two orthogonal position sensors, and a reference sensor providing shaft angle and speed information. The experiment consisted of a ramp-up from 1000[RPM] to 2000[RPM].\par
\subsection{Bode}
The Bode diagram for the example overhung rotor system is given in Figure \ref{fig:ExpExampleBode}. By looking at the amplitude portion of the plot it is evident that the $ V $ signal undergoes a natural frequency before the $ W $ signal, because the peak for $ A_V $ occurs before $ A_W $. This idea is also supported through the inspection of the phase lag portion of the plot, as two seperate transitions are evident. Having two seperate peaks is an indication of high stiffness anisotropy in the system. By observing the phase lag of each signal, it is evident that the orbit direction is opposite the spin speed between speeds ~ 1280-1350[RPM]. If normally W lags V with a positive counterclockwise rotation of the shaft (as is suggested by the phase angles in sub-synchronous and super-synchronous range), then during the critical speed, the orbit is reversed since V begins to lag W.\par
Bode diagrams are extremely useful in diagnosing system unbalance through inspection of phase lag information. If the shaft was perfectly straight before any deformation due to rotating unbalance, then the phase lag just before the first natural frequency is the angle of the unbalance vector. This is due to the fact that before the first natural frequency, the unbalance vector is aligned with the vibration radially out from the center of rotation. Furthermore, natural frequencies can be detected through the use of the phase lag information. Phase lag typically shifts $ 180[\deg] $ after completely passing through a natural frequency, and is at $ 90[\deg] $ during a natural frequency.
\begin{figure}
	\centering
	\includegraphics[]{./figures/ExpExampleBode.eps}
	\caption{Bode diagram of the experimental example overhung system. Signals are filtered to synchronous speed.}
	\label{fig:ExpExampleBode}
\end{figure}
\subsection{Full Spectrum and Full Spectrum Cascade}
A single Complex Amplitude Spectrum at a specific speed, $ \tilde{A}_\pm(1500[RPM],\omega) $ is shown as Figure \ref{fig:ExpExampleSpectrum}. This complex representation of the spectrum is referred to as the ``Full Spectrum'' of the time domain signal because it contains both positive and negative frequencies. This figure tells us that the orbit at this speed is in the positive whirl direction at the dominant frequency, since the positive amplitude, $ \tilde{A}_\pm(+\omega)=9.13[mils] $ at its peak is greater than $ \tilde{A}_\pm(-\omega)=3.47[mils] $. Also, there is minimal amplitude in the spectrum other than this single frequency of $ \pm23.7[Hz] $ indicating the vibration is highly synchronous.\par
\begin{figure}
	\centering
	\includegraphics[]{./figures/ExpExampleSpectrum.eps}
	\caption{Example Full Spectrum of experimental example system at $ \Omega=1500 $[RPM].}
	\label{fig:ExpExampleSpectrum}
\end{figure}
A Cascade plot is demonstrated with the experimental system described in \S\ref{ExperimentalPlots}, as Figure \ref{fig:ExpExampleCascade}. Using this figure it is easy to detect the portion of the start-up in which the orbit is whirling opposite the spin speed. A sharp dip in positive amplitude, $ \tilde{A}_\pm(\omega) $, correlated with a sharp rise in negative amplitude, $ \tilde{A}_\pm(-\omega) $, at around 1320[RPM] leads to this phenomena.\par
The Cascade plot is particularly useful in characterizing non-synchronous vibration. Slightly evident in the example cascade and spectrum of figures \ref{fig:ExpExampleCascade}, \& \ref{fig:ExpExampleSpectrum} respectively, is the super-synchronous vibration at twice the spin speed, this is often called the 2X vibration. Similarly to the 2X vibration, other non-synchronous whirl speeds can be referenced as nX where n is the multiple of synchronous. The cascade plot is an indispensable tool for the analysis of fluid film bearing, for example, as they are characterized by sub-synchronous whirl that is difficult to identify in other diagnostic diagrams. The cascade provides an overview of all system whirling at all spin speeds allowing identification of various multiples of synchronous speed. These super- or sub-synchronous whirl speeds of the form nX can then be used to filter the time domain signals, allowing isolation of specific dynamic phenomena.\par
\begin{figure}
	\centering
	\includegraphics[width=\linewidth]{./figures/ExpExampleCascade.png}
	\caption{Cascade of the experimental system described in \S\ref{ExperimentalPlots}.}
	\label{fig:ExpExampleCascade}
\end{figure}
\subsection{Orbit}
In the time domain, the actual orbit or trace of the centerline of the shaft is observed. In this work, the orbit is visualized in two ways: as a path in 2D space at a specific spin speed, or as a 3D orbit with a cascade of orbits as spin speed is increased. The 3D Orbit allows for the visualization of complicated phenomena in a simple intuitive way. Figure \ref{fig:ExpExample3DOrbit} 3D Orbit is given for the experimental example described in \S\ref{ExperimentalPlots}. Appearing, once again is evidence of the negative whirl in the critical speed range. In the 3D orbit a collapsing of the shape can be seen between the speeds of 1200-1400[RPM] indicating the orbit has reversed its direction. Looking at independent orbits of specific speeds should explicitly demonstrate the orbit collapsing to a line, and turning negative. In Figure \ref{fig:ExpExampleOrbits} at speed $ 1194[RPM] $ the orbit is clearly whirling in the positive direction. As speed increases the orbit collapses into a line between speeds $ 1203\ \&\ 1206[RPM] $ and begins whirling in the negative direction until the process is reversed by speed $ 1289[RPM] $. Therefore, it can be confirmed that the orbit is whirling backward between the speeds ~1205-~1280[RPM].\par
\begin{figure}
	\centering

	\includegraphics[width=\linewidth]{./figures/ExpExampleOrbit3D.png}
	\caption{3D Orbit of the experimental system described in \S\ref{ExperimentalPlots}. Lighter colors indicate larger vibration.}
	\label{fig:ExpExample3DOrbit}
\end{figure}
\begin{figure}
		\def\cs{0.18}
	\def\ss{0.73}
\begin{subfigure}{\cs\textwidth}
	\def\width{\ss\textwidth}
	\pgfplotsset{every picture/.style={scale=1},every axis/.style={title style={yshift=-.8em}}}%, every axis/.style={hide axis}}%
	\centering
	\import{figures/}{ExpExampleOrbit1194.tex}
	\label{fig:ExpExampleOrbit1194}
\end{subfigure}
\begin{subfigure}{\cs\textwidth}
	\def\width{\ss\textwidth}
	\pgfplotsset{every picture/.style={scale=1},every axis/.style={title style={yshift=-.8em}}}%, every axis/.style={hide axis}}%
	\centering
	\import{figures/}{ExpExampleOrbit1203.tex}
	\label{fig:ExpExampleOrbit1203}
\end{subfigure}\vspace{-2em}
\begin{subfigure}{\cs\textwidth}
	\def\width{\ss\textwidth}
	\pgfplotsset{every picture/.style={scale=1},every axis/.style={title style={yshift=-.8em}}}%, every axis/.style={hide axis}}%
	\centering
	\import{figures/}{ExpExampleOrbit1206.tex}
	\label{fig:ExpExampleOrbit1206}
\end{subfigure}
\begin{subfigure}{\cs\textwidth}
	\def\width{\ss\textwidth}
	\pgfplotsset{every picture/.style={scale=1},every axis/.style={title style={yshift=-.8em}}}%, every axis/.style={hide axis}}%
	\centering
	\import{figures/}{ExpExampleOrbit1222.tex}
	\label{fig:ExpExampleOrbit1222}
\end{subfigure}
\begin{subfigure}{\cs\textwidth}
	\def\width{\ss\textwidth}
	\pgfplotsset{every picture/.style={scale=1},every axis/.style={title style={yshift=-.8em}}}%, every axis/.style={hide axis}}%
	\centering
	\import{figures/}{ExpExampleOrbit1289.tex}
	\label{fig:ExpExampleOrbit1289}
\end{subfigure}
\caption{Orbits of the experimental example. Spin speed is counterclockwise. Dots indicate the reference position of the shaft, and the beginning of each orbit.}
\label{fig:ExpExampleOrbits}
\end{figure}

\subsection{Filtering}
Correlating phase angles between signals can be extremely difficult due to the noise and harmonic frequencies that may disrupt the measurement of a phase lag at a specific frequency. Furthermore, it can be useful to decompose a real signal into specific harmonic components of the spin speed. One such instance is in the analysis of a fluid film bearing. Often, the fluid film bearing will cause an unbalance at the subsynchronous frequency of just under 0.5X. Using a filter, the response of the system to this specific frequency can be extracted, allowing the analysis of phase angle and amplitude directly due to the influence of interest.\par
MATLAB has an extensive library of digital filters that can be adjusted to filter specific frequency ranges with no phase delay, and recall the states from the previous window as to not loose dynamic information from one step to the next. Explanation of filtering in MATLAB has been spared from this work as it is out of the scope.\par
A synchronous filter was applied the experimental example and the cascade plot is shown in Figure \ref{fig:ExpExampleCascade2}. All amplitudes of frequencies other than the synchronous frequencies have been eliminated. This system did not have strong super- or sub-synchronous response, so this filtering does not make an appreciable effect to the Bode plot. But, with many real systems filtering will be necessary to analyze the system.
\begin{figure}
	\centering
	\includegraphics[width=\linewidth]{./figures/ExpExampleCascadeFilt.png}
	\caption{Cascade of the experimental system with a synchronous filter applied.}
	\label{fig:ExpExampleCascade2}
\end{figure}
\subsection{Frequency and Time Resolution}\label{Resolution}
Inherit in the application of the windowing method to the transient data set is some trade off with resolution in time and resolution in frequency content. As mentioned before, the frequency resolution, $ f_{res} $, is equal to the sampling rate, $ f_s $, divided by the number of samples per window, $ nspw $. So given a specific sampling rate, frequency resolution is inversely proportional to the number of samples per window. But, $ nspw $ is also inversely proportional to the number of windows in the signal, $ NW $. The total length of time of the signals is then divided up into $ NW $ windows where. It is often more convenient in rotordynamics to talk about change in speed instead of time, as it is more often the independent variable. Total speed range of $ \Omega $ is divided up into $ NW $ windows, making the speed resolution (the difference in speed from one window to the next) proportional to $ NW $. Therefore, as $ NW $ increases, $ f_{res} $ increases, and $ \Omega_{res} $ decreases. Where Speed resolution is being referenced here by the variable $ \Omega_{res} $.\par
This relationship is easily explored through the use of the Cascade plot since it contains both frequency and speed information. An example of a high $ nspw $, low $ NW $, low $ f_{res} $, \& high $ \Omega_{res} $ is found in Figure \ref{fig:ExpExampleCascadeLowFres}. The result of low $ f_{res} $, at 0.2[Hz], is sharp peaks in whirl speed, but since the amplitude spectrum is changing with speed increase, the spectrum is spread over a large frequency range of $ \Omega_{res}=54[RPM] $. The opposite condition leading to low $ \Omega_{res} $ and high $ f_{res} $ is presented in Figure \ref{fig:ExpExampleCascadeHighFres}. In this plot, the $ f_{res}=2[Hz] $ is so high that the whirl speeds are spread over a large range. On the other hand, the resulting $ \Omega_{res} $ of 5.5[RPM] provides detailed information on the effect of changing spin speed. Also, with such high $ f_{res} $ a ripple effect can be seen in the Amplitude spectrum as the actual dominate whirl speed is between the resolution of 2[Hz] and bleeds into the nearest multiples of 2[Hz]. This effect is not representative of the actual amplitude spectrum of the signal and is avoided by choosing a lower $ f_{res} $. The choice of $ f_{res} $ is dependent on many factors, including: $ f_s $, spin speed ramp rate, and spin speed range.
\begin{figure}
	\centering
	\includegraphics[]{./figures/ExpExampleCascadeLowFres.png}
	\caption{Cascade of the experimental system with an $ f_{res} $ of 0.2[Hz] and a resulting $ \Omega_{res} $ of 54[RPM].}
	\label{fig:ExpExampleCascadeLowFres}
\end{figure}
\begin{figure}
	\centering
	\includegraphics[]{./figures/ExpExampleCascadeHighFres.png}
	\caption{Cascade of the experimental system with an $ f_{res} $ of 2[Hz] and a resulting $ \Omega_{res} $ of 5.5[RPM].}
	\label{fig:ExpExampleCascadeHighFres}
\end{figure}


\section{Iterative Methods}
\label{sec:methods}

In this chapter we provide routines for preconditioners and iterative
methods. The interfaces for Krylov subspace methods are available in
the module \verb|psb_krylov_mod|.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%
%  Krylov Methods driver routine
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\clearpage\subsection{psb\_krylov \label{krylov} --- Krylov Methods Driver
      Routine}

This subroutine is a driver that provides a general interface for all
the Krylov-Subspace family methods implemented in PSBLAS version 2.

The stopping criterion can take the following values:
\begin{description}
\item[1]  normwise backward error  in the infinity
norm;  the iteration is stopped when
\[ err = \frac{\|r_i\|}{(\|A\|\|x_i\|+\|b\|)} < eps \]
\item[2] Relative residual in the 2-norm; the iteration is stopped
when
\[ err = \frac{\|r_i\|}{\|b\|_2} < eps \]
\item[3] Relative residual reduction in the 2-norm; the iteration is stopped
when
\[ err = \frac{\|r_i\|}{\|r_0\|_2} < eps \]
\end{description}
The behaviour is controlled by  the  istop argument (see
later). In the above formulae, $x_i$ is the tentative solution and
$r_i=b-Ax_i$ the corresponding residual at the $i$-th iteration.

\begin{lstlisting}
call psb_krylov(method,a,prec,b,x,eps,desc_a,info,&
     & itmax,iter,err,itrace,irst,istop,cond)
\end{lstlisting}

\begin{description}
\item[Type:] Synchronous.
\item[\bf On Entry]
\item[method] a string that defines the iterative method to be
  used. Supported values are:
  \begin{description}
  \item[CG:] the Conjugate Gradient method;
  \item[CGS:] the Conjugate Gradient Stabilized method;

  \item[GCR:] the Generalized Conjugate Residual method;
  \item[FCG:] the Flexible Conjugate Gradient method\footnote{Note:
      the implementation is for $FCG(1)$.};

  \item[BICG:] the Bi-Conjugate Gradient method;
  \item[BICGSTAB:] the Bi-Conjugate Gradient Stabilized method;
  \item[BICGSTABL:] the Bi-Conjugate Gradient Stabilized method with restarting;
  \item[RGMRES:] the Generalized Minimal Residual method with restarting.
  \end{description}
\item[a] the local portion of global sparse matrix
$A$. \\
Scope: {\bf local} \\
Type: {\bf required}\\
Intent: {\bf in}.\\
Specified as: a structured data of type \spdata.
\item[prec] The data structure containing the preconditioner.\\
Scope: {\bf local} \\
Type: {\bf required}\\
Intent: {\bf in}.\\
Specified as: a structured data of type \precdata.
\item[b] The RHS vector. \\
Scope: {\bf local} \\
Type: {\bf required}\\
Intent: {\bf in}.\\
Specified as:  a rank one array or an object of type \vdata.
\item[x] The initial guess. \\
Scope: {\bf local} \\
Type: {\bf required}\\
Intent: {\bf inout}.\\
Specified as:  a rank one array or an object of type \vdata.
\item[eps] The stopping tolerance. \\
Scope: {\bf global} \\
Type: {\bf required}\\
Intent: {\bf in}.\\
Specified as: a real number.
\item[desc\_a] contains data structures for communications.\\
Scope: {\bf local} \\
Type: {\bf required}\\
Intent: {\bf in}.\\
Specified as: a structured data of type \descdata.
\item[itmax]  The maximum number of iterations to perform.\\
Scope: {\bf global} \\
Type: {\bf optional}\\
Intent: {\bf in}.\\
Default: $itmax = 1000$.\\
Specified as: an integer variable $itmax \ge 1$.
\item[itrace] If $>0$  print out an informational message about
  convergence  every $itrace$ iterations. If $=0$ print a message in
  case of convergence failure.\\
Scope: {\bf global} \\
Type: {\bf optional}\\
Intent: {\bf in}.\\
Default: $itrace = -1$.\\
\item[irst]  An integer specifying the restart parameter.\\
Scope: {\bf global} \\
Type: {\bf optional}.\\
Intent: {\bf in}.\\
Values: $irst>0$. This is employed for the BiCGSTABL or RGMRES
methods, otherwise it is ignored.

\item[istop]  An integer specifying the stopping criterion.\\
Scope: {\bf global} \\
Type: {\bf optional}.\\
Intent: {\bf in}.\\
Values: 1: use the normwise backward error, 2: use the scaled 2-norm
of the residual, 3: use the residual reduction in the 2-norm. Default: 2.
\item[\bf On Return]
\item[x] The computed solution. \\
Scope: {\bf local} \\
Type: {\bf required}\\
Intent: {\bf inout}.\\
Specified as:  a rank one array or an object of type \vdata.
\item[iter]  The number of iterations performed.\\
Scope: {\bf global} \\
Type: {\bf optional}\\
Intent: {\bf out}.\\
Returned  as: an integer variable.
\item[err]  The convergence estimate on exit.\\
Scope: {\bf global} \\
Type: {\bf optional}\\
Intent: {\bf out}.\\
Returned  as: a real number.
\item[cond]  An estimate of the condition number of matrix $A$; only
  available with the $CG$ method on real data.\\
Scope: {\bf global} \\
Type: {\bf optional}\\
Intent: {\bf out}.\\
Returned  as: a real number. A correct result will be greater than or
equal to one; if specified for non-real data, or an error occurred,
zero is returned.
\item[info] Error code.\\
Scope: {\bf local} \\
Type: {\bf required} \\
Intent: {\bf out}.\\
An integer value; 0 means no error has been detected.
\end{description}

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "userguide"
%%% End:


\subsubsection{Zero Coupon Swap}

A Zero Coupon swap is set up as a swap, with one leg of type {\tt ZeroCouponFixed}. Listing \ref{lst:zeroswap} shows an
example. The ZeroCouponFixed leg contains an additional {\tt ZeroCouponFixedLegData} block. See \ref{ss:zerolegdata} for details on the ZeroCouponFixed leg
specification.

\begin{listing}[H]
%\hrule\medskip
\begin{minted}[fontsize=\footnotesize]{xml}
    <SwapData>
      <LegData>
        <LegType>Floating</LegType>
        <Payer>true</Payer>
        ...
      </LegData>
      <LegData>
        <LegType>ZeroCouponFixed</LegType>
        <Payer>false</Payer>
        ...
        <ZeroCouponFixedLegData>
            <Rates>
                <Rate>0.02</Rate>
            </Rates>
            <Compounding>Simple</Compounding>
        </ZeroCouponFixedLegData>
      </LegData>
    </SwapData>
\end{minted}
\caption{Zero Coupon Swap Data}
\label{lst:zeroswap}
\end{listing}


With our implementation we want to answer the following question:
\begin{quote}
  ``Given some differential characteristic, is this characteristic satisfiable?''
\end{quote}
Equivalently is there any boolean assignment within both evaluation instances such that the applied function of the hash algorithm matches the result and the bit conditions do correspond. This question was already raised in section~\ref{sec:diffchar-examples}. This is the same question stated as main difficulty for the attack of SHA-2~\cite[293]{Cry07} when trying to apply automated search.

We present various encodings and their corresponding algorithms and evaluate their performance.

\section{General architecture}
\label{sec:architecture}
%
% TODO: Introduce SAT condition as an algorithmic object (not from programmer's perspective).
%       Probably makes explanations more beautiful.
%
\subsection{Hash algorithm specification and truth table}
%
At the very beginning we specify a hash algorithm. This specification contains the elementary operations. We consider a simple hash algorithm applying the Sigma operation of the SHA-2 family consisting of XOR operations: We build a differential word of length $4$. We reuse this word three times where each time the word's values are rotated one more time to the right. The last word is the result. We get a differential characteristic of size $4\times 4$. XOR3 is now applied per bitslice.

In the implementation this hash algorithm specification is wrapped by a SAT generation unit. This unit takes a hash algorithm and creates a SAT solver equivalent for it; thus adding clauses to the SAT Solver instance instead of manipulating values in the main memory.

Every operation knows how many parameter it takes. The XOR3 operation takes three input parameters and one output parameter. It returns true if and only if the number of parameters with value true is odd. We retrieve the truth table by applying the operation one time. If the output parameters got modified for the given input, it was inconsistent and thus the entry in the truth table is false; otherwise true. This truth table is created once for every elementary operation and determines which output value is generated for the given input. Be aware that the number of evaluations is exponential to the number of variables. As such the truth table evaluation is a bottleneck in the framework. However a static implementation of the operation which directly adds the clauses can also be provided and the generation is only done once\footnote{In the Init step discussed in section~\ref{sec:nltool}.} when starting the program. Followingly we do not consider this approach as scalability threat.

Using a command line parameter \nltool{} gets to know which hash algorithm to take. At this point in time, it is going to know which parameters (and their relation) are used for this hash algorithm, but not their actual values. At the same time an instance of the SAT solver is instantiated to be used later on.

The following properties are given for the elementary functions and the hash algorithm:
\begin{itemize}
  \item Any pure function using integers as arguments can be transformed into a SAT equivalent.
  \item A truth table is used exploiting exponential behavior, but this truth table generation is only run once. In a future implementation it might also run at compile time.
  \item \texttt{satstep} describes a computational unit of any scale thus allowing to combine elementary operations to advanced algebraic operations, hash algorithm rounds or even whole hash algorithms.
\end{itemize}

\subsection{Clause introduction}
\label{sec:clause-introduction}
%
Constraints to the solution of the SAT solver will be introduced in two places. The actual clauses are defined by some encoding explained in section~\ref{sec:encoding:simple-evaluation}~ff.:
\begin{itemize}
  \item For every bit condition position in the differential characteristic we provide a method such that once the bit condition value is known, the corresponding clauses (specific for this value) are added immediately.
  \item The hash algorithm defines which elementary functions are applied (for example XOR3 was applied bitslice-wise in the previous example). For all those elementary functions we generate the corresponding clauses (specific for the function).
\end{itemize}

\subsection{Structure of encodings}
\label{sec:encoding-structure}
%
A distinction of the \emph{Init} and \emph{Update} step was already defined in section~\ref{sec:nltool}. Those steps are split into several substeps in all encodings:
\begin{enumerate}
  \item Initialization
    \begin{enumerate}
      \item Detect Overlapping bits: Sometimes bit conditions are reused within a hash algorithm. For example one differential word is the rotated version of another differential word as in SHA-2 Sigma. In such a case the two bit conditions connected through rotation must be equivalent. In this step the reuse of bit conditions is detected. See section~\ref{sec:automated-search} for a more detailed discussion of overlapping bits.
      \item Introduce new bit conditions: We initialize bit condition elements in the differential characteristic without knowing their value yet.
      \item Setup encoding: For assumption-based encoding, \textbf{clauses} are added here specific for the definition of the encoding (relation between boolean variables). Request the required boolean variables from the SAT solver for each element of the differential characteristic.
      \item Apply function to bitslices: Elementary functions in \nltool{} are defined per bitslice. In this step the function is applied successively to every bitslice \textbf{adding clauses specific for the function}.
    \end{enumerate}
  \item Update BitCondition
    \begin{enumerate}
      \item Set bit condition value: Take the bit condition value and infer the corresponding \textbf{clauses or assumptions} depending on the encoding.
      \item Run SAT solver: Invoke the SAT solver and return its result as result.
    \end{enumerate}
\end{enumerate}

\newpage
\section{Approach \#1: Simple Evaluation}
\label{sec:encoding:simple-evaluation}
%
The simple evaluation approach uses 2 boolean variables per bit condition. This corresponds to one bit per evaluation instance. We apply the elementary functions to each instance (thus we define the same clauses with both sets of variables). The bit condition defines clauses which are directly derivable for the given bit condition value.

\subsection{Algorithm}
\label{sec:simple-evaluation-algorithm}
%
\begin{description}
  \item[Initialization.] Overlapping bits and the number of bit conditions are known.
    \begin{description}
      \item[Detect Overlapping Bits.] Iterate over all bit conditions and recognize overlapping bits (see section~\ref{sec:automated-search}). Store all their indices for future reference.
      \item[Introduce new bit conditions.] Define the number of bit conditions needed and their position. A bit condition gets skipped, if this is not the first reference to an overlapping bit.
      \item[Setup Encoding.] $2$ boolean variables per bit condition are requested from the SAT solver.
      \item[Apply function to bitslices.] Add all clauses which result from the function definition applied to this differential characteristic.
    \end{description}
  \item[Update BitCondition.] The values of the bit conditions are known.
    \begin{description}
      \item[Set bit condition value.] The clauses resulting from the bit condition value are added. These clauses were already discussed in the paper ``Linear propagation in Efficient Guess-and-Determine Attacks''~\cite[6]{Cry16} and repeated in Table~\ref{tab:simple-eval-clauses}. Some are them are written as XOR clauses, which are only supported by \cmsat{} 2.x and 4.x. If the SAT solver does not provide XOR clauses, you can rewrite them to CNF clauses. Appendix~\ref{appendix:cnf} lists CNF compatible equivalences for the boolean expression.
      \item[Run SAT solver.] If the SAT solver returns satisfiability as result, the differential characteristic is satisfiable.
    \end{description}
\end{description}

Algorithm~\ref{algo:apply-func-se} shows the algorithm to apply the elementary function to the bitslices and retrieve the corresponding clauses. Models are the set of input and output variables. As can be seen in the algorithm we distinguish between both instances with two boolean variables $z$ and $z^*$ and apply the same clause to both instances. The algorithm is called for every application of the elementary function to a set of arguments \texttt{sat\_args}. A clause is represented as a list like $[z_1, \neg z_2, z_3]$ equivalent to $z_1 \lor \neg z_2 \lor z_3$ in the conventional notation. Clauses are conjuncted to conjunctive normal forms.

\subsection{Discussion}
\label{sec:simple-evaluation-discussion}
%
This approach was implemented first, but has a major problem: Assuming the evaluated differential characteristic is satisfiable, a more restrictive bit condition will be used by the automated search at one position. However for the next iteration the SAT solver has to be destroyed and the configuration must be built up again. This takes a long time. We can use the fact that the Initialization step stays the same, but the Update BitCondition step is different. And so we want to use an approach which runs the Initialization step only once and the Update BitCondition is run on every search iteration.

As expected this approach is pretty inefficient and when put into practice this approach solved $0$ iterations per second, which turned out to be the worst performance of all approaches.

For the Update BitCondition step we are going to use SAT solver assumptions. These are assignments to boolean variables which will be discarded after one run of the SAT solver without the loss of the clauses (as discussed in section~\ref{sec:satsolvers-assumptions}). Assignments are not as powerful as clauses and so the encoding has to be designed in such a way that we can use assignments to define the value of a bit condition.

\begin{algorithm}[p]
  \SetKwInOut{Input}{Input}
  \SetKwInOut{Output}{Output}
  \Input{sat\_args, function}
  \Output{a set of clauses}
  result = []\;

  \For{every possible model of elementary function}{
    \If(\tcp*[f]{that would be DNF}){model is valid}{
      continue\;
    }

    clause1 = []\;
    clause2 = []\;

    \For{every variable \textit{var} of the model}{
      \eIf{variable is true}{
        clause1.push($\neg$ sat\_args[var][$z$])\;
        clause2.push($\neg$ sat\_args[var][$z^*$])\;
      }{
        clause1.push(sat\_args[var][$z$])\;
        clause2.push(sat\_args[var][$z^*$])\;
      }
    }

    result.add(clause1)\;
    result.add(clause2)\;
  }
  return result\;
 \caption{Apply function to bitslices algorithm for Simple Evaluation.}
 \label{algo:apply-func-se}
\end{algorithm}
%
\begin{table}[p]
  \begin{center}
    \begin{tabular}{cp{5cm}cl}
      bit condition  & conjunctive normal form &
      bit condition  & conjunctive normal form \\
    \hline
      \bc{\#}        & $(z) \land (\neg z)$ &
      \bc{1}         & $(z) \land (z^*)$ \\

      \bc{0}         & $(\neg z) \land (\neg z^*)$ &
      \bc{-}         & $\neg (z \oplus z^*)$ \\

      \bc{u}         & $(z) \land (\neg z^*)$ &
      \bc{A}         & $(z)$ \\

      \bc{3}         & $(\neg z^*)$ &
      \bc{B}         & $(z \lor \neg z^*)$ \\

      \bc{n}         & $(\neg z) \land (z^*)$ &
      \bc{C}         & $(z^*)$ \\

      \bc{5}         & $(\neg z)$ &
      \bc{D}         & $(\neg z \lor z^*)$ \\

      \bc{x}         & $(z \oplus z^*)$ &
      \bc{E}         & $(z \lor z^*)$ \\

      \bc{7}         & $(\neg z \lor \neg z^*)$ &
      \bc{?}         &  \\
    \end{tabular}
    \caption[Simple Evaluation clauses]{
        Set bit condition value clauses in Simple Evaluation added for a bit condition.
        A bit condition corresponds to two boolean variables $z$ and $z^*$.
    }
    \label{tab:simple-eval-clauses}
  \end{center}
\end{table}

\newpage
\section{Approach \#2: Activation literals}
\label{sec:encoding:activation-literals}
%
This approach uses the concept of \emph{activation literals}. Even though there is no explicit definition of activation literals given in prior work, the concept is used recurrently by the SAT community. One example of such is given in a paper by Niklas Een, Alan Mishchenko and Nina Amla~\cite{Sat30}.

Given a clause $c$ we introduce an activation literal $a$ to activate or deactivate this clause. Activation means that this clause becomes part of the result of the \gls{cnf}. Deactivation means that this
clause becomes true within the conjunction and therefore is not relevant for the result. $a$ is used to distinguish the (de)activation cases.

These requirements can be implemented using an implication.
\[
  a \implies b
\]

\subsection{Search with activation literals}
\label{sec:activation-literals-search}
%
To evaluate a path in the search tree a generalization of activation literals is required. We apply activation literals to sets of clauses.

Given sets of sets of clauses $S_1, S_2, S_3, \ldots, S_n$ representing nodes of a search tree, evaluate which path of this tree is satisfiable. One node is satisfiable, if all clauses of this node are satisfied. Assume a binary tree of depth 2 with $S_2$ and $S_3$ as children of $S_1$ and $S_4$ and $S_5$ as children of $S_2$ and $S_6$ and $S_7$ as children of $S_3$. The first path is given as the union of $S_1$, $S_2$ and $S_4$: $S_1 \land S_2 \land S_4$. If this path is not satisfiable, replace $S_4$ with $S_2$'s other child $S_5$ giving $S_1 \land S_2 \land S_5$. If this fails again we replace $S_2$ with $S_3$ giving us $S_1 \land S_3 \land S_6$ and $S_1 \land S_3 \land S_7$. With this concept we can evaluate any path of the tree after evaluation which clauses are part of which node.

\begin{figure}[h]
  \begin{center}
    \includegraphics{img/searchtree.pdf}
    \caption{Binary search tree with sets of sets of clauses as nodes.}
    \label{fig:bintree_clauses}
  \end{center}
\end{figure}

This tree traversal can be implemented using activation literals and SAT solver assumption techniques.

If we want to evaluate the path $S_1 \land S_2 \land S_4$, we introduce a new activation literal $a_i$ for each set $S_i$ and use implication to (de)activate the clause:
%
\[
  (a_1 \implies S_1) \land (a_2 \implies S_2) \land (a_4 \implies S_4)
\]

Because each node itself is a conjunctive normal form, a set $S_i$ is the conjunction of its clauses giving us:
%
\[
  (a_1 \implies (c_1 \land c_2 \land c_3 \land \ldots)) \land
    (a_2 \implies (c_{10} \land c_{11} \land c_{12} \land \ldots)) \land
    (a_3 \implies (c_{20} \land c_{21} \land c_{22} \land \ldots)) \land
    \ldots
\]

This can be transformed to conjunctive normal form by resolving the clauses with the law of distributivity. In real-world implementations activation literals are represented as \emph{assumptions} in SAT solvers
to be able to drop their value for evaluation of the next search path (assumptions are described in section~\ref{sec:satsolvers-assumptions}).

For example the conjunctive normal form with boolean variables $v_1$ to $v_8$
%
\[
  (v_1 \lor \neg v_2) \land (\neg v_3 \lor \neg v_4 \lor v_5) \land
    (v_6 \lor v_7 \lor v_8)
\]

with activation literals $a_1$ to $a_3$
\[
  (a_1 \implies (v_1 \lor \neg v_2)) \land
    (a_2 \implies (\neg v_3 \lor \neg v_4 \lor v_5)) \land
    (a_3 \implies (v_6 \lor v_7 \lor v_8))
\]

resolved with the law of distributivity
\[
  (\neg a_1 \lor v_1 \lor \neg v_2) \land
    (\neg a_2 \lor \neg v_3 \lor \neg v_4 \lor v_5) \land
    (\neg a_3 \lor v_6 \lor v_7 \lor v_8)
\]

gives us a boolean expression in CNF.

\newpage
\subsection{Algorithm}
\label{sec:activation-literals-algorithm}
%
We use the algorithm given in section~\ref{sec:simple-evaluation-algorithm}, but the steps \emph{Setup Encoding} and \emph{Set bit condition value} differ:
\begin{description}
%  \item[Initialization.] Overlapping bits and the number of bit conditions are known.
%    \begin{description}
%      \item[Detect Overlapping Bits.] Iterate over all bit conditions and recognize overlapping bits (see section~\ref{sec:automated-search}). Store all their indices for future reference.
%      \item[Introduce new bit conditions.] Define the number of bit conditions needed and their position. A bit condition gets skipped, if this is not the first reference to an overlapping bit.
      \item[Setup Encoding.] $7$ boolean variables per bit condition are requested from the SAT solver. The clauses given in Table~\ref{tab:activation-literals-clauses} are added.
%      \item[Apply function to bitslices.] Add all clauses which result from the function definition applied to this differential characteristic.
%    \end{description}
%  \item[Update BitCondition.] The values of the bit conditions are known.
%    \begin{description}
      \item[Set bit condition value.] The assumptions resulting from the bit condition value are set. They are given in Table~\ref{tab:activation-literals-assumptions}.
%      \item[Run SAT solver.] If the SAT solver returns satisfiability as result, the differential characteristic is satisfiable.
%    \end{description}
\end{description}

\begin{table}[h]
  \begin{center}
    \begin{tabular}{c}
      clause \\
    \hline
      $(\neg a_1 \lor z) \land (\neg a_1 \lor \neg z)$ \\
      $(\neg a_2 \lor \neg z \lor \neg z^*)$ \\
      $(\neg a_3 \lor z \lor \neg z^*)$ \\
      $(\neg a_4 \lor \neg z \lor z^*)$ \\
      $(\neg a_5 \lor z \lor z^*)$ \\
    \end{tabular}
    \caption[Activation literals clauses]%
    {Setup Encoding clauses for every element in the differential characteristic.}
    \label{tab:activation-literals-clauses}
  \end{center}
\end{table}
%
\begin{table}[h]
  \begin{center}
    \begin{tabular}{cll}
      bit condition  & Set bit condition value (assumptions) \\
    \hline
      \bc{\#}        & $a_1 = 1$ \\
      \bc{0}         & $z = 0, z^* = 0$ \\
      \bc{u}         & $z = 1, z^* = 0$ \\
      \bc{3}         & $z^* = 0$ \\
      \bc{n}         & $z = 0, z^* = 1$ \\
      \bc{5}         & $z = 0$ \\
      \bc{x}         & $a_2 = 1, a_5 = 1$ \\
      \bc{7}         & $a_2 = 1$ \\
      \bc{1}         & $z = 1, z^* = 1$ \\
      \bc{-}         & $a_3 = 1, a_4 = 1$ \\
      \bc{A}         & $z = 1$ \\
      \bc{B}         & $a_3 = 1$ \\
      \bc{C}         & $z^* = 1$ \\
      \bc{D}         & $a_4 = 1$ \\
      \bc{E}         & $a_5 = 1$ \\
      \bc{?}         &
    \end{tabular}
    \caption[Activation literals assumptions]{
        Activation literals assumptions.
        Be aware that all activation literals $a_i$ must be set to false,
        if not stated otherwise for a bit condition.
    }
    \label{tab:activation-literals-assumptions}
  \end{center}
\end{table}

\subsection{Discussion}
\label{sec:activation-literals-discussion}
%
The number of activation literals is linear to the number of nodes within the search tree. Every node represents one of sixteen possible bit conditions in worst case. However not every bit condition requires its own activation literal and corresponding clause\footnote{This approach would obviously be possible but is less efficient.}.

The bit conditions \bc{0}, \bc{u}, \bc{3}, \bc{n}, \bc{5}, \bc{1}, \bc{A}, \bc{C} and \bc{?} can directly be represented by assignments. The $5$ bit conditions \bc{\#}, \bc{7}, \bc{B}, \bc{D} and \bc{E} use the $\lor$ operator which has to be designed by explicit clauses. The bit conditions \bc{x} and \bc{-} are represented as combinations of those explicit clauses.

For one additional bit condition we need $7$ variables, $6$ clauses and $5.75$ assumptions ($21$ assumptions from the right column in Table~\ref{tab:activation-literals-assumptions} and $71$ activation literals set to false divided by $16$ bit conditions) in average. Due to the high number of assumptions we initially valued this approach as unlikely successful. The results are provided in section~\ref{sec:results};

\newpage
\section{Approach \#3: Assumption-based encodings}
\label{sec:encoding:assumption-encodings}
%
Like the activation literals approach in section~\ref{sec:encoding:activation-literals}, these approaches use assumptions to enable automated search. They do not use activation literals and only focus on efficient usage of assumptions. Three different approaches are taken which vary in the number of variables, clauses and assumptions.

\subsection{Exhaustive Encoding}
\label{sec:encoding:exhaustive}
%
The Exhaustive encoding consists of $17$ boolean variables per bit condition. Exhaustive refers to the large number of boolean variables. Each differential state gets its own assumption variable except the free bit condition~\bc{?}.

\subsubsection{Algorithm}
\label{sec:exhaustive-encoding-algorithm}
%
We use the algorithm of section~\ref{sec:simple-evaluation-algorithm}, but the steps \emph{Setup Encoding} and \emph{Set bit condition value} differ:
%
\begin{description}
%  \item[Initialization.] Overlapping bits and the number of bit conditions are known.
%    \begin{description}
%      \item[Detect Overlapping Bits.] Iterate over all bit conditions and recognize overlapping bits (see section~\ref{sec:automated-search}). Store all their indices for future reference.
%      \item[Introduce new bit conditions.] Define the number of bit conditions needed and their position. A bit condition gets skipped, if this is not the first reference to an overlapping bit.
      \item[Setup Encoding.] $17$ boolean variables per bit condition are requested from the SAT solver. The clauses given in Table~\ref{tab:exhaustive-encoding-clauses} are added. They correspond exactly to the expressions in Table~\ref{tab:simple-eval-clauses} but define an equivalence relation with an assumption variable $z_{\text{bit condition}}$.
%      \item[Apply function to bitslices.] Add all clauses which result from the function definition applied to this differential characteristic.
%    \end{description}
%  \item[Update BitCondition.] The values of the bit conditions are known.
%    \begin{description}
      \item[Set bit condition value.] Given a bit condition $T$, the corresponding assumption $z_T$ is set to true. For the free variable nothing is set true.
%      \item[Run SAT solver.] If the SAT solver returns satisfiability as result, the differential characteristic is satisfiable.
%    \end{description}
\end{description}

\begin{table}[b]
  \begin{center}
    \begin{tabular}{cp{5cm}cl}
      $z_\#$ & $= \neg z_\#$ &
      $z_1$  & $= z \land z^*$ \\

      $z_0$  & $= \neg z \land \neg z^*$ &
      $z_-$  & $= \neg(z \oplus z^*)$ \\

      $z_u$  & $= z \land \neg z^*$ &
      $z_A$  & $= z$ \\

      $z_3$  & $= \neg z^*$ &
      $z_B$  & $= z \lor \neg z^*$ \\

      $z_n$  & $= \neg z \land z^*$ &
      $z_C$  & $= z^*$ \\

      $z_5$  & $= \neg z$ &
      $z_D$  & $= \neg z \lor z^*$ \\

      $z_X$  & $= z \oplus z^*$ &
      $z_E$  & $= z \lor z^*$ \\

      $z_7$  & $= \neg z \lor \neg z^*$ &
             & \\
    \end{tabular}
    \caption{Exhaustive encoding clauses.}
    \label{tab:exhaustive-encoding-clauses}
  \end{center}
\end{table}

\subsubsection{Discussion}
\label{sec:exhaustive-discussion}
%
For this encoding obviously some reductions can be applied if one bit condition is a superset of another one (as can be seen in the lattice of Figure~\ref{fig:bitconditions-lattice}). Those reductions have been applied in the following encodings. Because this encoding has an extraordinary high number of variables, we assume that this encoding will not perform good in any case. Because no implementation was provided, no statistics are available.

\newpage
\subsection{Reduced Encoding}
\label{sec:encoding:reduced-encoding}
%
The following approach was initially proposed by Martin Schläffer. It takes $9$ variables for each bit condition denoted as $z, z^*, z_A, z_B, z_C, z_D, z_E, z_x$ and $z_1$. Those variables can be split into two sets $\{z, z^*\}$ and $\{z_A, z_B, z_C, z_D, z_E, z_x, z_1\}$ where the first set defines the variables of the two instances and the second set was specifically designed for assumption-based evaluation. As a result the clauses define the relation between an assumption such as $z_A = 1$ and the variables $\{z, z^*\}$.

\subsubsection{Algorithm}
\label{sec:reduced-encoding-algorithm}
%
We use the algorithm of section~\ref{sec:simple-evaluation-algorithm}, but the steps \emph{Setup Encoding} and \emph{Set bit condition value} differ:
%
\begin{description}
%  \item[Initialization.] Overlapping bits and the number of bit conditions are known.
%    \begin{description}
%      \item[Detect Overlapping Bits.] Iterate over all bit conditions and recognize overlapping bits (see section~\ref{sec:automated-search}). Store all their indices for future reference.
%      \item[Introduce new bit conditions.] Define the number of bit conditions needed and their position. A bit condition gets skipped, if this is not the first reference to an overlapping bit.
      \item[Setup Encoding.] $9$ boolean variables per bit condition are requested from the SAT solver. The clauses given in Table~\ref{tab:reduced-encoding-clauses} are added.
%      \item[Apply function to bitslices.] Add all clauses which result from the function definition applied to this differential characteristic.
%    \end{description}
%  \item[Update BitCondition.] The values of the bit conditions are known.
%    \begin{description}
      \item[Set bit condition value.] The assumptions resulting from the bit condition value are set. They are given in Table~\ref{tab:reduced-encoding-assumptions}.
%      \item[Run SAT solver.] If the SAT solver returns satisfiability as result, the differential characteristic is satisfiable.
%    \end{description}
\end{description}

\begin{table}[h]
  \begin{center}
    \begin{tabular}{ll}
      $z_A$ & $= z_1$ \\
      $z_B$ & $= z_1 \lor \neg z_1^*$ \\
      $z_C$ & $= z^*$ \\
      $z_D$ & $= \neg z \lor z^*$ \\
      $z_E$ & $= z \lor z^*$ \\
      $z_X$ & $= z \oplus z^*$ \\
      $z_1$ & $= z \land z^*$
    \end{tabular}
    \caption{Reduced encoding clauses.}
    \label{tab:reduced-encoding-clauses}
  \end{center}
\end{table}
%
\begin{table}[h]
  \begin{center}
    \begin{tabular}{cll}
      bit condition  & Set bit condition value \\
    \hline
      \bc{\#}        & $z_1 = 1, z_x = 1$ \\
      \bc{0}         & $z_A = 0, z_C = 0$ \\
      \bc{u}         & $z_A = 1, z_C = 0$ \\
      \bc{3}         & $z_C = 0$ \\
      \bc{n}         & $z_A = 0, z_C = 0$ \\
      \bc{5}         & $z_A = 0$ \\
      \bc{x}         & $z_X = 1$ \\
      \bc{7}         & $z_1 = 0$ \\
      \bc{1}         & $z_1 = 1$ \\
      \bc{-}         & $z_X = 0$ \\
      \bc{A}         & $z_A = 1$ \\
      \bc{B}         & $z_B = 1$ \\
      \bc{C}         & $z_C = 1$ \\
      \bc{D}         & $z_D = 1$ \\
      \bc{E}         & $z_E = 1$ \\
      \bc{?}         &
    \end{tabular}
    \caption{Assumptions for the Reduced encoding.}
    \label{tab:reduced-encoding-assumptions}
  \end{center}
\end{table}

\subsubsection{Discussion}
\label{sec:reduced-encoding-discussion}
%
One additional bit condition requires $9$ boolean variables, $20$ clauses\footnote{Table~\ref{tab:reduced-encoding-clauses} transformed to CNF using the equivalences of Appendix~\ref{appendix:cnf} gives us 20 clauses.} and $1.1875$ assumptions in average\footnote{19 assumptions if every bit condition occurs once divided by 16 possible bit conditions.}.
This encoding provides a nice tradeoff between a small number of clauses and variables and was the first stable implementation to evaluate differential characteristics with a SAT solver.

\newpage
\subsection{Differential state encoding}
\label{sec:encoding:dse}
%
\subsubsection{Algorithm}
\label{sec:encoding:dse-algorithm}
%
The 4 variables are denoted as $z_0, z_n, z_u$ and $z_1$. They exactly correspond to the cases $(0, 0), (0, 1), (1, 0)$ and $(1, 1)$ for bits in the evaluation instances. We require that only one of the cases is met.

This encoding differs from the other encodings in a sense that the Initialization is very much different and takes up more time whereas the small number of variables is expected to outweigh this performance problem in the Initialization.
%
\begin{description}
  \item[Initialization.] Overlapping bits and the number of bit conditions are known.
    \begin{description}
      \item[Detect Overlapping Bits.] Iterate over all bit conditions and store overlapping bit conditions.
      \item[Introduce new bit conditions.] Define the number of bit conditions needed and their position. A bit condition gets skipped, if this is not the first reference to an overlapping bit.
      \item[Setup Encoding.] $4$ boolean variables per bit condition are requested from the SAT solver. We ensure that only one the four boolean variables becomes true. Table~\ref{tab:dse-clauses} lists the clauses.
      \item[Apply function to bitslices.] See Algorithm~\ref{algo:dse-function}.
    \end{description}
  \item[Update BitCondition.] The values of the bit conditions are known.
    \begin{description}
      \item[Set bit condition value.] The assumptions resulting from the bit condition value are set. They are given in Table~\ref{tab:dse-assumptions}.
      \item[Run SAT solver.] If the SAT solver returns satisfiability as result, the differential characteristic is satisfiable.
    \end{description}
\end{description}

\begin{table}[p]
  \begin{center}
    \begin{alignat*}{4}
      (z_0      & \oplus    z_n & & \oplus    z_u & & \oplus    z_1 & & )\, \land \\
      (z_0      & \lor \neg z_n & & \lor \neg z_u & & \lor \neg z_1 & & )\, \land \\
      (\neg z_0 & \lor      z_n & & \lor \neg z_u & & \lor \neg z_1 & & )\, \land \\
      (\neg z_0 & \lor \neg z_n & & \lor      z_u & & \lor \neg z_1 & & )\, \land \\
      (\neg z_0 & \lor \neg z_n)& & \lor \neg z_u & & \lor      z_1 & & ) \\
    \end{alignat*}
    \caption{Setup Encoding clauses to ensure only one variable is set to true (with 1 XOR clauses) (can be written as 7 CNF clauses).}
    \label{tab:dse-clauses}
  \end{center}
\end{table}
%
\begin{table}[t]
  \begin{center}
    \begin{tabular}{cll}
      bit condition  & Set bit condition value \\
    \hline
      \bc{\#}        & $z_0 = 0, z_n = 0, z_u = 0, z_1 = 0$ \\
      \bc{0}         & $z_0 = 1$ \\
      \bc{u}         & $z_u = 1$ \\
      \bc{3}         & $z_n = 0, z_1 = 0$ \\
      \bc{n}         & $z_n = 1$ \\
      \bc{5}         & $z_u = 0, z_1 = 0$ \\
      \bc{x}         & $z_0 = 0, z_1 = 0$ \\
      \bc{7}         & $z_1 = 0$ \\
      \bc{1}         & $z_1 = 1$ \\
      \bc{-}         & $z_n = 0, z_u = 0$ \\
      \bc{A}         & $z_0 = 0, z_1 = 0$ \\
      \bc{B}         & $z_n = 0$ \\
      \bc{C}         & $z_0 = 0, z_u = 0$ \\
      \bc{D}         & $z_u = 0$ \\
      \bc{E}         & $z_0 = 0$ \\
      \bc{?}         &
    \end{tabular}
    \caption{Assumptions for the Differential State encoding.}
    \label{tab:dse-assumptions}
  \end{center}
\end{table}
%
\begin{algorithm}[p]
  \SetKwInOut{Input}{Input}
  \SetKwInOut{Output}{Output}
  \Input{sat\_args, function}
  \Output{a set of clauses}
  result = []\;

  \For{every possible model $i$ of function}{
    \For{every possible model $j$ of function}{
      \If{model $i$ is valid and model $j$ is valid}{
        continue\;
      }

      clause = []\;

      \For{every variable \textit{var} of any model}{
        \Switch{bit condition corresponding $i[\textit{var}]$ and $j[\textit{var}]$}{
          \Case{0}{clause.push($\neg$ sat\_args[\textit{var}][$z_0$])\;}
          \Case{n}{clause.push($\neg$ sat\_args[\textit{var}][$z_n$])\;}
          \Case{u}{clause.push($\neg$ sat\_args[\textit{var}][$z_u$])\;}
          \Case{1}{clause.push($\neg$ sat\_args[\textit{var}][$z_1$])\;}
        }
      }

      result.push(clause)\;
    }
  }

  return result\;
 \caption[Apply function to bitslices algorithm for DSE]%
   {Apply function to bitslices algorithm for DSE. Recognize the nested
   for loop over models indicating a much worse scalability in the Initialize step.}
 \label{algo:dse-function}
\end{algorithm}

\subsubsection{Discussion}
\label{sec:dse-discussion}
%
This approach was meant to radically reduce the number of variables to achieve better performance as response to Reduced Encoding. As it turns out a small number of variables is not the important speedup measure for CNFs.

One additional bit condition requires $4$ boolean variables, $4$ or $7$ clauses and $1.5$ assumptions in average. The open question is which one is worse: a high number of clauses or a high number of variables. A high number of variables might segment the search space for the SAT solver which leads to fast evaluation. This question was not discussed thoroughly by analyzing the SAT solver, but the results in section~\ref{sec:results} provide an indicator.


Before conducting top-level trade studies, individual subsystems were
analyzed. Multiple subsystems have key parameters that required reasonable
values before the fully integrated model could return reasonable results.
Prior to running trade studies, optimizations are performed in order to select
values for any of the unknown inputs. The methodology used to perform these
optimizations is discussed in detail in this section. Furthermore, analyses of
individual subsystems can provide critical insight into system level behavior.
The variations in energy consumption, structural costs, and capacity scaling
can be initially observed through these subsystem analyses, then more fully
developed through system level analyses. Subsystem analyses that provide
critical insight to system level behavior are discussed in this section as
they begin to illustrate major conclusions.
\subsection{Structural Subsystem Optimization}
	\subimport{subsystem_analyses_and_optimizations/}{structural_subsystem_optimization}
\subsection{Pod Frequency}
	\subimport{subsystem_analyses_and_optimizations/}{flight_frequency}
\subsection{Boundary Layer Sensitivity}
	\subimport{subsystem_analyses_and_optimizations/}{boundary_layer_sensitivity}


\documentclass{article}
\usepackage[utf8]{inputenc}
\usepackage{amsmath,amssymb,amsthm}
\usepackage{hyperref}

\newcommand{\G}{\mathbb{G}}
\newcommand{\F}{\mathbb{F}}

\title{Zarcanum technical notes}
\author{Cypher Stack\thanks{\url{https://cypherstack.com}}}
\date{\today}

\begin{document}

\maketitle

This document describes technical information relevant to the Zarcanum \cite{zarcanum} preprint\footnote{Specifically, version \texttt{20211108:135703}.} and its underlying algorithms and cryptography.
As with any review, it may be functionally incomplete, and may not reflect all errors or considerations that could arise with any particular implementation or application.
The author asserts no warranty and disclaims liability for its use.
The author further expresses no endorsement of the Zano project or its associated entities.

\section{Introduction}

Zarcanum is a set of protocols intended to enable staking operations in proof-of-stake blockchain assets that provide either amount confidentiality or, additionally, signer ambiguity.
The preprint describes two instantiations of such a protocol: one is intended for use in cases where only amount confidentiality is required, and the other for cases where signer ambiguity is additionally necessary.

The first Zarcanum protocol describes a method for staking a specified output.
This approach provides amount confidentiality, where the staker asserts that the specified output meets the consensus-specified difficulty requirement without revealing its value.
However, it does not provide source ambiguity; that is, the output being staked is explicitly specified in the staking operation.

The second Zarcanum protocol describes a method that extends confidential staking to additionally provide source amgiguity.
In this approach, a set of possible outputs is provided, and one output in the set is staked; amount confidentially is retained as well.

\section{Observations and findings}

In this section, we provide details on observations and findings from an analysis of the Zarcanum protocols.

\subsection{Security model}

The preprint describes confidential staking protocols that have complex interactions between cryptographic constructions and components, and for which parameter and design choices have nontrivial consequences.
For example, Section D describes different mitigations against a trivial staking condition bypass; one requires a particular set of proofs, while the other relies on reasoning about blockchain history.
As another example, Section E describes different mitigations against a brute-force attack by an adversarial sender; one requires careful selection of a scaling parameter in the staking condition, while the other uses a modification to the address and output formats.

While the preprint describes the components, methods, and operations used in the staking operations, and provides arguments for the security of such methods, it does not introduce a formal security model.
Instead, it provides a set of informal criteria and reasons against them.
Because comprehensive security assertions and proofs require a security model against which to reason, it is not possible to make definitive conclusions in this manner.

We strongly recommend extending the ideas and arguments in Zarcanum to a more comprehensive and formal security model, and then proving the security of the protocol and its components in this context.

\subsection{Proposition A.1 and Lemma 1}

We provide an alternate version of the results of Proposition A.1 and Lemma 1 from the preprint, as well as a proof that the resulting proving system is complete, special sound, and special honest-verifier zero knowledge.
This formalizes the ideas in the preprint that require the prover knows discrete logarithm witness elements.
These security properties may be useful for later integration within a broader formal protocol.

Let $\G$ be a finite cyclic group where the discrete logarithm problem is hard, and let $\F$ be its scalar field.
Let $0 \neq G,H \in \G$ be group elements with no efficiently-computable discrete logarithm relation.
We assume that $\G,G,H$ are implicit public parameters where needed.

Consider the relation
$$\mathcal{R}_1 = \{A,A' \in \G ; f,a \in \F : A = aH + fG, A' = fH + aG\}$$
and the following interactive protocol, which we will show is a sigma protocol for $\mathcal{R}_1$:
\begin{enumerate}
	\item The prover samples $r_0,r_1 \in \F$ uniformly at random.
	\item The prover computes $R_0 = r_0 (H + G)$ and $R_1 = r_1 (H - G)$, and sends these values to the verifier.
	\item The verifier samples nonzero $c \in \F$ uniformly at random, and sends this value to the prover.
	\item The prover computes $y_0 = r_0 + c(a + f)$ and $y_1 = r_1 + c(a - f)$, and sends these values to the verifier.
	\item The verifier accepts the proof if and only if the following hold:
		\begin{alignat}{1}
			y_0 (H + G) - c(A + A') &= R_0 \label{eqn:L1_1}\\
			y_1 (H - G) - c(A - A') &= R_1 \label{eqn:L1_2}
		\end{alignat}
\end{enumerate}
This protocol may be made non-interactive via the Fiat-Shamir technique, where the verifier challenge is replaced by a suitable transcript hash.
This technique further allows for binding arbitrary proof context into the transcript.

We show that this construction is complete, special sound, and special honest-verifier zero knowledge as a sigma protocol for the relation $\mathcal{R}_1$.

\begin{proof}
	Completeness follows trivially by inspection.

	We next show that the protocol is $2$-special sound by a standard rewinding argument, where we define an extractor that produces valid witness elements on accepting transcripts using distinct verifier challenges.
	Fix an initial transcript $(A,A',R_0,R_1)$, and let $c \neq c'$ be distinct verifier challenges for this transcript, with corresponding responses $(y_0,y_1)$ and $(y_0',y_1')$.
	We apply Equations \ref{eqn:L1_1} and \ref{eqn:L1_2} to these transcripts to obtain
	\begin{alignat*}{1}
		(y_0 - y_0')(H + G) - (c - c')(A + A') &= 0 \\
		(y_1 - y_1')(H - G) - (c - c')(A - A') &= 0
	\end{alignat*}
	and hence
	\begin{alignat}{1}
		\frac{y_0 - y_0'}{c - c'} (H + G) &= A + A'	\label{eqn:L1_alpha_0} \\
		\frac{y_1 - y_1'}{c - c'} (H - G) &= A - A'. \label{eqn:L1_alpha_1}
	\end{alignat}
	Define $\alpha_0 = (y_0 - y_0')/(c - c')$ and $\alpha_1 = (y_1 - y_1')/(c - c')$, and note that both are well defined since $c \neq c'$.
	Adding and subtracting Equations \ref{eqn:L1_alpha_0} and \ref{eqn:L1_alpha_1}, we obtain the following expressions for $A$ and $A'$:
	\begin{alignat*}{1}
		A &= \frac{\alpha_0 + \alpha_1}{2} H + \frac{\alpha_0 - \alpha_1}{2} G \\
		A' &= \frac{\alpha_0 - \alpha_1}{2} H + \frac{\alpha_0 + \alpha_1}{2} G
	\end{alignat*}
	Hence we define $$a = \frac{\alpha_0 + \alpha_1}{2}$$ and $$f = \frac{\alpha_0 - \alpha_1}{2}$$ as the extracted witnesses, and the protocol is $2$-special sound.
	Observe that $a,f$ must be unique, or this implies a nontrivial discrete logarithm relationship between $G,H$.

	We finally show that the protocol is special honest-verifier zero knowledge.
	To do so, we define a simulator that, on a valid statement and uniformly-sampled verifier challenge, produces transcripts indistinguishable from those of real proofs.
	Fix a valid prover statement $(A,A')$, and sample a nonzero challenge $c \in \F$.
	The simulator samples random $y_0,y_1 \in \F$ and defines $R_0,R_1$ using Equations \ref{eqn:L1_1} and \ref{eqn:L1_2}, respectively.
	The resulting simulated proof will be accepted by an honest verifier.
	Because $G,H$ are independent generators, such a simulated proof is distributed identically to a real proof, and hence the protocol is special honest-verifier zero knowledge.

	This completes the proof.
\end{proof}

\subsection{Lemma 2}
\label{obs:lemma2}

We provide an alternate version of the result of Lemma 2 from the preprint, as well as a proof that the resulting proving system is complete, special sound, and special honest-verifier zero knowledge.
This formalizes the ideas in the preprint that require the prover knows discrete logarithm witness elements.
These security properties may be useful for later integration within a broader formal protocol.

Let $\G$ be a finite cyclic group where the discrete logarithm problem is hard, and let $\F$ be its scalar field.
Let $0 \neq G,H,X \in \G$ be group elements with no efficiently-computable discrete logarithm relation.
We assume that $\G,G,H,X$ are implicit public parameters where needed.

Consider the relation
$$\mathcal{R}_2 = \{C,C' \in \G ; f,a,x,x' \in \F : C = aH + fG + xX, C' = fH + aG + x'X\}$$
and the following interactive protocol, which we will show is a sigma protocol for $\mathcal{R}_2$:
\begin{enumerate}
	\item The prover samples $r_0,r_1,s_0,s_1 \in \F$ uniformly at random.
	\item The prover computes $R_0 = r_0 (H + G) + s_0 X$ and $R_1 = r_1 (H - G) + s_1 X$, and sends these values to the verifier.
	\item The verifier samples nonzero $c \in \F$ uniformly at random, and sends this value to the prover.
	\item The prover computes and sends these values to the verifier:
		\begin{alignat*}{1}
			y_0 &= r_0 + c(a + f) \\
			y_1 &= r_1 + c(a - f) \\
			z_0 &= s_0 + c(x + x') \\
			z_1 &= s_1 + c(x - x')
		\end{alignat*}
	\item The verifier accepts the proof if and only if the following hold:
		\begin{alignat}{1}
			y_0 (H + G) + z_0 X - c(C + C') &= R_0 \label{eqn:L2_1}\\
			y_1 (H - G) + z_1 X - c(C - C') &= R_1 \label{eqn:L2_2}
		\end{alignat}
\end{enumerate}
This protocol may be made non-interactive via the Fiat-Shamir technique, where the verifier challenge is replaced by a suitable transcript hash.
This technique further allows for binding arbitrary proof context into the transcript.

We show that this construction is complete, special sound, and special honest-verifier zero knowledge as a sigma protocol for the relation $\mathcal{R}_2$.

\begin{proof}
	Completeness follows trivially by inspection.

	We next show that the protocol is $2$-special sound by a standard rewinding argument, where we define an extractor that produces valid witness elements on accepting transcripts using distinct verifier challenges.
	Fix an initial transcript $(C,C',R_0,R_1)$, and let $c \neq c'$ be distinct verifier challenges for this transcript, with corresponding responses $(y_0,y_1,z_0,z_1)$ and $(y_0',y_1',z_0',z_1')$.
	We apply Equations \ref{eqn:L2_1} and \ref{eqn:L2_2} to these transcripts to obtain
	\begin{alignat*}{1}
		(y_0 - y_0')(H + G) + (z_0 - z_0')X - (c - c')(C + C') &= 0 \\
		(y_1 - y_1')(H - G) + (z_1 - z_1')X - (c - c')(C - C') &= 0
	\end{alignat*}
	and hence
	\begin{alignat}{1}
		\frac{y_0 - y_0'}{c - c'} (H + G) + \frac{z_0 - z_0'}{c - c'} X &= C + C'	\label{eqn:A1_alpha_0} \\
		\frac{y_1 - y_1'}{c - c'} (H - G) + \frac{z_1 - z_1'}{c - c'} X &= C - C'. \label{eqn:A1_alpha_1}
	\end{alignat}
	Define the following:
	\begin{alignat*}{1}
		\alpha_0 &= \frac{y_0 - y_0'}{c - c'} \\
		\alpha_1 &= \frac{y_1 - y_1'}{c - c'} \\
		\beta_0 &= \frac{z_0 - z_0'}{c - c'} \\
		\beta_1 &= \frac{z_1 - z_1'}{c - c'}
	\end{alignat*}
	Note that all are well defined since $c \neq c'$.
	Adding and subtracting Equations \ref{eqn:A1_alpha_0} and \ref{eqn:A1_alpha_1}, we obtain the following expressions for $C$ and $C'$:
	\begin{alignat*}{1}
		C &= \frac{\alpha_0 + \alpha_1}{2} H + \frac{\alpha_0 - \alpha_1}{2} G + \frac{\beta_0 + \beta_1}{2} X \\
		C' &= \frac{\alpha_0 - \alpha_1}{2} H + \frac{\alpha_0 + \alpha_1}{2} G + \frac{\beta_0 - \beta_1}{2} X
	\end{alignat*}
	Hence we define
	\begin{alignat*}{1}
		a &= \frac{\alpha_0 + \alpha_1}{2} \\
		f &= \frac{\alpha_0 - \alpha_1}{2} \\
		x &= \frac{\beta_0 + \beta_1}{2} \\
		x' &= \frac{\beta_0 - \beta_1}{2}
	\end{alignat*}
	as the extracted witnesses, and the protocol is $2$-special sound.
	Observe that $a,f,x,x'$ must be unique, or this implies a nontrivial discrete logarithm relationship between $G,H,X$.

	We finally show that the protocol is special honest-verifier zero knowledge.
	To do so, we define a simulator that, on a valid statement and uniformly-sampled verifier challenge, produces transcripts indistinguishable from those of real proofs.
	Fix a valid prover statement $(C,C')$, and sample a nonzero challenge $c \in \F$.
	The simulator samples random $y_0,y_1,z_0,z_1 \in \F$ and defines $R_0,R_1$ using Equations \ref{eqn:L2_1} and \ref{eqn:L2_2}, respectively.
	The resulting simulated proof will be accepted by an honest verifier.
	Because $G,H,X$ are independent generators, such a simulated proof is distributed identically to a real proof, and hence the protocol is special honest-verifier zero knowledge.

	This completes the proof.
\end{proof}

\subsection{Ring signature extension}

Section 6.1 of the preprint describes a method to extend MLSAG \cite{ringct} signature dimensionality to account for the addition of an ``extended commitment'' $C$ to the same amount as a standard output commitment $A$ and group element $Q$, such that a prover knows some $x \in \F$ such that $C - A - Q = xX$ for a fixed global generator $X \in \G$, and also knows some $q \in \F$ such that $Q = qG$ for a fixed global generator $G \in \G$.
Further, this proof must be ambiguous in the sense that each tuple $(A, Q)$ is contained within a larger cover set.

We note that MLSAG signatures are not proofs of knowledge in the sense that their construction does not appear to readily admit an extractor for the required discrete logarithm witnesses.
However, their use in confidential transaction protocols admits useful security properties relating to multidimensional linkable ring signatures for linkability, anonymity, unforgeability, and the like.
While the MLSAG extension described here would seem to inherit these properties, it is not immediately clear if they are sufficient for the broader Zarcanum protocol, or if a later formal security model would require other properties provided by zero-knowledge proofs of knowledge.

Should a broader protocol's security model require that this modified construction be a zero-knowledge proof of knowledge or otherwise require properties like special soundness or special honest-verifier zero knowledge, it is possible to use other constructions like Triptych \cite{triptych} that provide the same multidimensional linkable ring signature functionality.
However, this comes at the cost of a linking tag definition that differs from the linear key image construction used in MLSAG-based protocols, and may not be suitable for this reason.

Additionally, the use of MLSAG linkable ring signatures in the protocol for staking and spend operations requires careful consideration to ensure that source information is not linked between a staking operation and a later spend.
Existing security models for linkable (and multidimensional linkable) ring signature constructions like MLSAG or CLSAG \cite{clsag} do not specifically address the situation where related signature algorithms (using, in this case, different dimensionality) are used concurrently within a broader protocol.
The use of a suitable zero-knowledge proof of knowledge instead of a witness-indistinguishable construction is likely to minimize this type of risk.

\subsection{Range proof extension}
\label{obs:range}

Section 5.1 of the preprint discusses ways to show that a double-blinded Pedersen commitment is to a value in the range $[0,2^n)$ for some fixed natural number $n$.
It mentions one method is to extend a range proving system like Bulletproofs \cite{bp} or Bulletproofs+ \cite{bp_plus} to account for the added blinding factor.

We note that such an extension for Bulletproofs is straightforward, and is described in a version of the preprint for the Lelantus \cite{lelantus} transaction protocol.
It is likely possible to produce such an extension for the more efficient Bulletproofs+ protocol, but we do not know of any work that has yet done so.

\subsection{Linear composition proof}

Section A.2 of the preprint describes a ``linear composition proof'' intended to show the existence of a representation of a given group element with respect to two specific generators.
This proof is used in several places within the Zarcanum protocol:
\begin{enumerate}
	\item\label{item:mirror} To prove (in step 5 of Section 6.2) that $C$ and $C'$ are mirror commitments.
	\item\label{item:range} To prove (in step 8 of Section 6.2) the validity of the relationship between $E$ and $B$.
	\item To prove (in Section 6.1) the validity of the relationship between $W$ and $C$.
	\item To prove (in Section D.1) that $f + q \neq 0$.
\end{enumerate}

The use of the alternate version of Lemma 2 presented in Observation \ref{obs:lemma2} removes the need for a linear composition proof in item \ref{item:mirror} above.
Further, we note in Observation \ref{obs:range} that the Bulletproofs range proving system (and likely the Bulletproofs+ range proving system) can be used directly with double-blinded commitments, which would remove the need for a linear composition proof in item \ref{item:mirror}.

The presentation of the proof in Section A.2 is somewhat informal.
No conditions are placed on the generators $A,B$ that may be needed for the use cases listed; for example, it may be required that the generators have no efficiently-computable discrete logarithm relationship in order to extract unique witnesses from successful verification.
Further, the given protocol states that successful verification convinces the verifier that a representation of $C$ with respect to the generators $A,B$ exists, but makes no particular claim that the prover knows this representation.
Indeed, since $\G$ is cyclic, such a representation exists for every $C \in \G$.

It may be preferable to define the linear composition proving system more formally, such that it is a zero-knowledge proof of knowledge, and that the resulting representation is unique (for a computationally-bound prover).
Computational uniqueness of the representation, as well as being zero knowledge, requires in particular that $A,B$ have no efficiently-computable discrete logarithm relationship; fortunately, this requirement is satisfied by the generators used in the required use cases.
Note that soundness does not require this constraint.
The proving system may be modified slightly to accommodate a straightforward security proof, which we describe here for completeness.

Let $\G$ be a finite cyclic group where the discrete logarithm problem is hard, and let $\F$ be its scalar field.
Let $0 \neq A,B \in \G$ be group elements with no efficiently-computable discrete logarithm relation.
We assume that $\G,A,B$ are implicit public parameters where needed.

Consider the relation
$$\mathcal{R}_3 = \{C \in \G; a,b \in \F : C = aA + bB\}$$
and the following interactive protocol, which is a sigma protocol for $\mathcal{R}_3$:
\begin{enumerate}
	\item The prover samples $r_0, r_1 \in \F$ uniformly at random.
	\item The prover computes $R = r_0 A + r_1 B$, and sends this value to the verifier.
	\item The verifier samples nonzero $c \in \F$ uniformly at random, and sends this value to the prover.
	\item The prover computes $y_0 = r_0 + ca$ and $y_1 = r_1 + cb$, and sends these values to the verifier.
	\item The verifier accepts the proof if and only if
	\begin{equation}
		\label{eqn:representation}
		y_0 A + y_1 B - cC = R.
	\end{equation}
\end{enumerate}
This protocol may be made non-interactive via the Fiat-Shamir technique, where the verifier challenge is replaced by a suitable transcript hash.
This technique further allows for binding arbitrary proof context into the transcript.

We show that this construction is complete, special sound, and special honest-verifier zero knowledge as a sigma protocol for the relation $\mathcal{R}_3$.

\begin{proof}
	Completeness follows trivially by inspection.

	We next show that the protocol is $2$-special sound by a standard rewinding argument, where we define an extractor that produces valid witness elements on accepting transcript using distinct verifier challenges.
	Fix an initial transcript $(C,R)$, and let $c \neq c'$ be distinct verifier challenges for this transcript, with corresponding responses $(y_0, y_1)$ and $(y_0', y_1')$.
	We apply Equation \ref{eqn:representation} to these transcripts to obtain
	$$(y_0 - y_0')A + (y_1 - y_1')B - (c - c')C = 0$$
	and hence
	$$\frac{y_0 - y_0'}{c - c'} A + \frac{y_1 - y_1'}{c - c'} B = C.$$
	Define $$a = \frac{y_0 - y_0'}{c - c'}$$ and $$b = \frac{y_1 - y_1'}{c - c'}$$ as the extracted witnesses, which are well defined since $c \neq c'$, and the protocol is $2$-special sound.
	Observe that $a,b$ must be unique, or this implies a nontrivial discrete logarithm relationship between $A,B$.

	We finally show that the protocol is special honest-verifier zero knowledge.
	To do so, we define a simulator that, on a valid statement and uniformly-sampled verifier challenge, produces transcripts indistinguishable from those of real proofs.
	Fix a valid prover statement $C$, and sample a nonzero challenge $c \in \F$.
	The simulator samples random $y_0,y_1 \in \F$ and defines $R$ using Equation \ref{eqn:representation},
	The resulting simulated proof will be accepted by an honest verifier.
	Because $A,B$ are independent generators, such a simulated proof is distributed identically to a real proof, and hence the protocol is special honest-verifier zero knowledge.

	This completes the proof.
\end{proof}

\bibliographystyle{plain}
\bibliography{main}

\end{document}