\section{Threshold Analysis}\label{sec:threshold_analysis}

In the previous sections, we have described two separate voting phases in the
decentralized software update lifecycle (figure \ref{lifecycle}), namely
Ideation and Approval, where a proposal can be approved or rejected by the
community. Moreover, during the Activation phase the community, or more
accurately, the participants in the blockchain consensus protocol, signal
\emph{upgrade readiness} by endorsing a new version of the protocol. Both of
these processes are based on a \emph{threshold} of stake percent, against
which,
the gathered votes/signals are compared. Although the voting of a proposal
compared to the activation of a proposal have different end-goals, there
are still a lot of commons from a social dynamics perspective. In this section,
we present an analysis towards a unified approach for defining an appropriate
threshold for both of these two processes.

Lets assume that $H$ is the percent of honest stake and $T$ is the percent of
adversarial stake that actively participate in the voting (or activation)
process. We assume
also that
\begin{equation}\label{eq:H_plus_T}
	H+T=100
\end{equation}
%Moreover, the stake considered during the tally is the stake that the voters
%have at that moment. That is, we only consider the stake of the voters at the
%moment of the tally, without taking into account the stake that the voters had
%in the moment that the votes were casted. In other words, the calculation of
%the voting result corresponds to the stake distribution at the same time and
%not to some previous historic moment. This way, the result better represents
%the current situation at the moment of the tally.

We consider two types of possible attacks relevant to both processes:
\paragraph{Voting process}
\begin{itemize}
	\item \textbf{Malicious Proposal Attack}: The
	adversary manages with its own stake to approve a malicious proposal.
	\item \textbf{Denial of Approval Attack}: The adversary manages to block a
	good
	proposal approved by the honest stake.
\end{itemize}

\paragraph{Activation process}
\begin{itemize}
	\item \textbf{Rushing Adversary Attack}: The adversary rushes, by using its
	own stake, to signal upgrade readiness and cause the activation of the
	changes, in order to take over the control of the updated blockchain,
	before enough honest parties manage to upgrade.
	\item \textbf{Denial of Activation Attack}: The
	adversary manages to block the activation of a change signaled by the
	honest stake.
\end{itemize}

With respect to the two said attacks for each process, we define next, the
notion of a secure voting (or activation) protocol:
\begin{definition}\label{def:liveness_safety_voting}
	A voting protocol is secure, if it enjoys both the safety
	and liveness properties.

	\begin{itemize}
		\item \textbf{Safety property for voting:} a software update that has
		achieved
		only the adversary stake approval, will never be approved.

		\item \textbf{Liveness property for voting:} a software update that has
		achieved
		sufficient honest stake $L_b$ approval, will be eventually approved,
		i.e., cannot be blocked by the adversary stake.
	\end{itemize}
\end{definition}

\begin{definition}\label{def:liveness_safety_activation}
	An activation protocol is secure, if it enjoys both the safety
	and liveness properties.

	\begin{itemize}
		\item \textbf{Safety property for activation:} a software update that
		has not received signals of sufficient  stake w.r.t. the
		security assumption of the upgraded protocol (see section
		\ref{secureupdate}), will never be activated.

		\item \textbf{Liveness property for activation:} a software update that
		has received
		signals of sufficient honest stake $L_b$, will be eventually activated,
		i.e., cannot be blocked by the adversary stake.
	\end{itemize}
\end{definition}

Clearly, the safety property protects us from the malicious approval/rushing
adversary attack,
while the liveness property protects us from the denial of approval/activation
attack.

Our goal, is to define an appropriate voting/adoption threshold $\tau$, such
as the two said properties hold.
\begin{definition}
	A voting threshold $\tau_V$ (see section \ref{appxvoting}) is an amount of
	stake such that any stake $p
	> \tau_V$ of positive votes can approve a proposal and any stake $n >
	\tau_V$ of 	negative votes can reject a proposal.
\end{definition}
Similarly,
\begin{definition}
	An adoption threshold $\tau_A$ (see section \ref{secureupdate}) is
	an amount of stake such that any stake $p
	> \tau_A$ of signals can activate a proposal.
\end{definition}

%In our analysis, we will need two boundary
%values:
%\begin{inparaenum}[\itshape a)\upshape]
%	\item a minimum of honest stake that should control the result and
%	\item a maximum of adversary stake that should not be able to control the
%	result.
%\end{inparaenum} We define them both next.
%
%\begin{definition}\label{def:liveness-bound}
%	We define as \emph{liveness bound} $L_b$ the minimum percent of
%	stake that our voting (or activation) protocol allows to control the
%	result,
%	i.e., the minimum amount of stake required for a result not to be
%	blocked.
%\end{definition}
%
%\begin{definition}\label{def:safety-bound}
%	We define as \emph{safety bound} $S_b$ the maximum percent of
%	stake that our voting (or activation) protocol prevents from controlling
%	the
%	result.
%\end{definition}
%
%Intuitively, we would like $L_b$ to correspond to some amount of the honest
%stake, i.e., $0 \leq L_b \leq H$ that we wish not to be blocked when voting
%for
%(or signaling for)
%a proposal and $S_b$ to correspond to some amount of the
%adversary stake, i.e., $0 \leq S_b \leq T$ that we want to prevent from
%approving (or activating) a proposal. The following theorem defines the
%necessary and
%sufficient condition that the threshold $\tau$ should satisfy, in order both
%the safety and liveness properties to hold.

Next we define the sufficient and necessary condition for the voting threshold
and the adoption threshold in order for safety and liveness to hold
\begin{theorem}\label{th:safety_and_liveness_condition_voting}
	For each voting protocol with a threshold $\tau_V$
	both the safety and liveness properties hold iff:
	\begin{align*}
		T < \tau_V < H
	\end{align*}
	\begin{proof}
		Since $T < \tau$, any malicious proposal that is voted positively by
		the adversarial stake $T$, but by no honest stake at all, cannot be
		approved, because the condition for approval is $[positive\ stake] >
		\tau$. Therefore, the safety property holds. Inversely, if the safety
		property holds, then no proposal that has no positive votes from the
		honest stake can be approved even if the adversary stake $T$ has
		voted in favor, which means that the positive votes must be below the
		voting threshold; thus $T < \tau$.

		Similarly, since $\tau < H$, any proposal that has
		received $L_b$, or more, positive votes from the honest stake, where $
		\tau_V < L_b \leq H$ will be
		approved, because the condition for approval is $[positive\ stake] >
		\tau$. Inversely, if the liveness condition holds, then any proposal
		that has received at least $L_b$ positive votes from the honest stake
		will be approved, which means that the following
		condition should hold $\tau < L_b$.
	\end{proof}
\end{theorem}

The adoption threshold $\tau_A$ should ensure that the required percent of
stake that has signaled upgrade readiness, will guarantee that
the new blockchain will kick off with sufficient honest stake, determined by
the
security assumption of the upgraded consensus protocol. It is easy to
see that in this case, we need $\tau_A \geq \frac{1}{r_{Th}} \times T$, where
$r_{Th}$ corresponds to the theoretical adversary tolerance of the
\emph{upgraded protocol} (potentailly different from the original protocol),
so that for the upgraded stake, the required security property
$\frac{AdversaryStake}{TotalStake_{upgraded}} < r_{Th}$ will still hold and
thus the upgraded blockchain will be secure. Indeed, if we assume that the
total upgraded stake percent is above the adoption threshold minimum value
$\frac{1}{r_{Th}} \times T$ (e.g., $\frac{1}{r_{Th}} \times T + \delta$ where
$\delta > 0$) and that all the adversary stake $T$ has upgraded (so we have $T$
percent of adversaries in the new blockchain too), then if we
substitute, we see that the property
$\frac{AdversaryStake}{TotalStake_{upgraded}} = \frac{T}{\frac{1}{r_{Th}}
\times T + \delta} < r_{Th}$ holds for the upgraded protocol. So
$\frac{1}{r_{Th}} T$ is the appropriate lower bound for the adoption threshold,
in order to ensure safety. Here is the respective theorem for the adoption
threshold.

\begin{theorem}\label{th:safety_and_liveness_condition_activation}
	For each activation protocol with a threshold $\tau_A$
	both the safety and liveness properties hold iff:
	\begin{align*}
		\frac{1}{r_{Th}}T < \tau_A < H
	\end{align*}
	where $r_{Th}$ is the
	theoretical
	adversary tolerance of our consensus protocol.
	\begin{proof}
		Since $\frac{1}{r_{Th}}T < \tau$, signals of any stake not sufficient
		w.r.t. the security assumption of the upgraded protocol (see section
		\ref{secureupdate}), cannot cause the activation of the changes,
		because the condition for activation is $[signals'\ stake] >
		\tau_A$. Therefore, the safety property holds. Inversely, if the safety
		property holds, then any proposal that has not sufficient stake
		signaled cannot be activated, which means that $\frac{1}{r_{Th}}T <
		\tau$.

		Similarly, since $\tau < H$, any proposal that has
		received signals of stake $L_b$ or more, from the honest stake, where $
		\tau_A < L_b \leq H$ will be
		activated, because the condition for approval is $[signals'\ stake] >
		\tau_A$. Inversely, if the liveness condition holds, then any proposal
		that has received signals of stake  at least $L_b$ from the honest
		stake
		will be activated, which means that the following
		condition should hold $\tau_A < L_b$.
	\end{proof}
\end{theorem}
%\begin{theorem}\label{th:safety_and_liveness_condition}
%	For each voting (or activation) protocol with a voting threshold $\tau_V$
%	both the safety
%	and liveness properties hold iff:
%	\begin{align*}
%		T < \tau_V < \frac{H}{2} + \mu,\ where\ 0 < \mu \leq \frac{H}{2}
%		% &T < \tau_V < \frac{H}{2} + \mu\ \ \ \ \land\\
%		% &T < \frac{H}{2} \overset{eq. \ref{eq:H_plus_T}}{\iff} T <
%		%\frac{1}{3} \times 100,\\
%		% &where\ 0 < \mu \leq \frac{H}{2}
%	\end{align*}
%	\begin{proof}
%		Since $T < \tau_V$, any malicious proposal that is voted positively by
%		all adversarial stake T, but by no honest stake at all, cannot be
%		approved, because the condition for approval is $[positive\ stake] >
%		\tau_V$. Therefore, the safety property holds. Inversely, if the safety
%		property holds, then no proposal that has no positive votes from the
%		honest stake can be approved even if the whole adversary stake has
%		voted in favor, which means that the positive votes must be below the
%		voting threshold; thus $T < \tau_V$.
%
%		Similarly, since $\tau_V < \frac{H}{2} + \mu$, any proposal that has
%		received $\frac{H}{2}+\mu$ positive votes, where $0 < \mu \leq
%		\frac{H}{2}$ from the honest stake will be approved, because the
%		condition for approval is $[positive\ stake] > \tau_V$. Inversely, if
%		the liveness condition holds, then any proposal that has received
%		$\frac{H}{2}+\mu$ positive votes, where $0 < \mu \leq \frac{H}{2}$ from
%		the honest stake will be approved, which means that the following
%		condition should hold $\tau_V < \frac{H}{2} + \mu$.
%	\end{proof}
%\end{theorem}

In the following, we propose a threshold function $\tau(\gamma)$, which depends
on a
parameter $\gamma$ that we call the \emph{safety strength} and adjusts the
threshold towards liveness or safety. We provide also the
sufficient conditions, in order for both safety and liveness properties to
hold. Intuitively,   if we increase the threshold, we increase the required
amount of honest-stake positive votes required (or signals), in order to
approve (or activate) a proposal. This means that we decrease liveness, but at
the same time we increase safety, since it becomes more difficult for a
malicious proposal to be approved (or for activation without a sufficient
amount of stake to take place). The definition of the threshold function
includes also
a fixed amount of honest stake $H_{min}$, which is the minimum value that we
want our threshold to have and essentially determines the minimum amount of
honest stake that we wish not to be blocked (either for voting or activation),
i.e., it determines the minimum amount of honest stake that we wish the
liveness property to hold.

Although the threshold function definition is common for both voting and
activation, since they differ on the required constraint, we present them in
two separate theorems:
\begin{theorem}\label{th:proposed_voting_threshold}
	If the threshold $\tau$ of a voting protocol is
	defined as:
	\begin{align*}
		&\tau(\gamma) = H_{min} + \gamma,\ where\ 0 \leq \gamma < H-H_{min} \\
		&\land\\
		&T < H_{min}\\
	\end{align*}
,where  $0 \leq H_{min} \leq H$,
then both the safety and liveness properties hold for any amount of honest
stake $L_b$ such that $H_{min} + \gamma < L_b \leq H$.
	\begin{proof}
		Since
		\begin{align*}
			&T < H_{min} \iff\\
			&T < H_{min} + \gamma \iff\\
			&T < \tau(\gamma)
		\end{align*}
		Also, since $H_{min} + \gamma < L_b \leq H$, then we have $\tau(\gamma)
		< H$.
		Therefore we have proved that $T < \tau(\gamma) < H$ and thus
		based on theorem \ref{th:safety_and_liveness_condition_voting} both
		safety
		and
		liveness properties hold.
	\end{proof}
\end{theorem}

\begin{theorem}\label{th:proposed_adoption_threshold}
	If the threshold $\tau$ of an activation protocol is
	defined as:
	\begin{align*}
		&\tau(\gamma) = H_{min} + \gamma,\ where\ 0 \leq \gamma < H-H_{min} \\
		&\land\\
		&\frac{1}{r_{Th}}T < H_{min}\\
	\end{align*}
	,where $0 \leq H_{min} \leq H$,
	then both the safety and liveness properties hold for any amount of honest
	stake $L_b$ such that $H_{min} + \gamma < L_b \leq H$.
	\begin{proof}
		Since
		\begin{align*}
			&\frac{1}{r_{Th}}T < H_{min} \iff\\
			&\frac{1}{r_{Th}}T < H_{min} + \gamma \iff\\
			&\frac{1}{r_{Th}}T < \tau(\gamma)
		\end{align*}
		Also, since $H_{min} + \gamma < L_b \leq H$, then we have $\tau(\gamma)
		< H$.
		Therefore we have proved that $\frac{1}{r_{Th}}T < \tau(\gamma) < H$
		and thus
		based on theorem \ref{th:safety_and_liveness_condition_activation} both
		safety
		and
		liveness properties hold.
	\end{proof}
\end{theorem}

%From section \ref{secureupdate}, we have seen that the appropriate choice for
%$S_b$ during the activation phase is $S_b = \frac{1}{r_{Th}}\times T$. This is
%in order to ensure that the amount of stake that has signaled upgrade
%readiness
%guarantees that the security assumption of the updated protocol will hold and
%that the adversary cannot take over of the updated blockchain. In addition,
%for
%a voting process the appropriate choice for $S_b$ is $S_b = T$, in order to
%ensure that the malicious approval attack cannot take place.
%
%The $H_{min}$ can take any value in the range $0 \leq H_{min} \leq H$, as long
%as
%the condition $S_b < H_{min}$ holds. The $H_{min}$ corresponds to the lowest
%value
%that we are willing to give to the liveness bound $L_b$. Therefore, it is the
%minimum of honest stake that we wish to be able to approve a result. A typical
%value for
%$H_{min}$ could
%be $H_{min} = \frac{H}{2}$, which means that we require that any result
%approved by the honest stake majority should not be blocked. In this case, and
%for
%$S_b = T$, the condition $S_b < H_{min}$ becomes $T < \frac{H}{2}$, which
%translates to $r < 1/3$, where $r$ is the adversary ratio.

The $\gamma$ parameter (safety strength) allows us to adjust the threshold
towards liveness, or
safety. This is depicted in figure \ref{fig:gamma_parameter}. Low gamma values
provide thresholds with a greater liveness, but reduced safety and inversely,
high $\gamma$ values enable higher safety, but less liveness. This applies to
both the voting and the activation processes and this figure corresponds to
both.

\begin{figure}[h!] %[H]
	\centering
	\includegraphics[width=0.6\columnwidth,
	keepaspectratio]{figures/gamma.png}
	\caption{The $\gamma$ parameter versus liveness and safety for either
	voting or activation.}
	\label{fig:gamma_parameter}
\end{figure}

This parametric definition of the threshold gives us the ability to adjust the
threshold based on the context of each individual proposal and not follow a one
size fits all approach. For example, for a very critical update we might
require a higher $\gamma$ value in order to ensure a greater safety for the
result by sacrificing some of the liveness and demanding a stronger consent
from the community.

Table \ref{table:threshold_examples} shows some examples of different
threshold functions $\tau(\gamma)$, expressed by means of
the adversary stake ratio $r$, $r = \frac{Adversary\ Stake}{Total\ Stake} =
\frac{T}{T+H} = \frac{T}{100}$, along with the corresponding constraint on $r$,
derived from the $T < H_{min}$ constraint and $\frac{1}{r_{Th}}T < H_{min}$
constraint for voting and activation respectively. The choice of $H_{min}$
recorded on the second column determines the resulting threshold function, as
well as the required constraint, appearing in the respective columns. Our
analysis is based on the assumption
that we can have an estimation of the adversary ratio $r$. From Garay et. al.
in \cite{sok}, we know that the
ratio $r$ is always upper bounded by the
theoretical
adversary tolerance $r_{Th}$ of our consensus protocol, i.e., $r < r_{Th}$
(e.g., $r < 1/2 =
r_{Th}$, or $r < 1/3 = r_{Th}$ etc.).

\begin{table}[h!]
	\centering
	\begin{tabular}{ | c | c | c | c |}
		\hline
		\textbf{Process} & $H_{min}$ & \makecell[c]{\textbf{Threshold}\\
		$\tau(\gamma) =
		H_{min} + \gamma$,\\ where $0 \leq \gamma < H-H_{min}$} &
		\makecell[c]{\textbf{Constraint}\\$T < H_{min}$ (for voting)\\
		$\frac{1}{r_{Th}T} < H_{min}$
		(for activation)} \\
		\hline
		\multirow{2}{*}{Voting} & $\frac{H}{2}$ &
		$50(1-r)+\gamma$ & $r < 1/3$
		 \\
		 & $T+1$ & $100r + 1 +\gamma$ & Any $r < r_{Th}$ \\
		\hline
		\multirow{2}{*}{Activation} & $\frac{H}{2}$ &
		$50(1-r)+\gamma$ &
		\makecell[c]{$r < \frac{r_{Th}}{2+r_{Th}}$ \\ ($r < 1/5$ for
		$r_{Th} = 1/2$)}
		\\
		 & $\frac{1}{r_{Th}}T + 1$ &
		$\frac{100r}{r_{Th}} + 1 + \gamma$ & Any $r < r_{Th}$ \\
		\hline
	\end{tabular}
	\caption{Examples of different threshold definitions.}
	\label{table:threshold_examples}
\end{table}

In table \ref{table:examples}, we provide examples of threshold
values for different values of $\gamma$ and different adversary ratios r for a
specific choice of the $\tau(\gamma)$ function and a constraint relevant to the
voting process. In particular, for the function $\tau(\gamma) = H/2 + \gamma =
50(1-r)+\gamma$ and $r < 1/3$ (i.e., $H_{min} =
\frac{H}{2}$ and $T < \frac{H}{2}$). For a specific adversary ratio r, as we
increase $\gamma$, we
require stronger honest stake majority, in order to avoid the denial of
approval attack, however this provides us with more safety. In this particular
case of $\tau(\gamma)$, the
allowed $\gamma$ values lie in the range $0 \leq \gamma < H/2$.  So in the
table
we have chosen the lowest possible $\gamma$ value ($\gamma=0$), the maximum
$\gamma$ value ($\gamma = \frac{H}{2} - 1$) (assuming for the sake of the
example that $\gamma$ takes integer values) and an intermediate value $\gamma =
T$.

So for instance, in the line where $r=0.1$, we can see that the allowed range
of values for the threshold is $[45\%, 89\%]$. As long as the threshold is
in this range, we can have both liveness and safety (assuming $r=0.1$).We
observe that for low values of $\gamma$ ($\gamma = 0$), $H/2$ of honest stake
is
enough to have liveness. In contrast, for high values of $\gamma$ ($\gamma =
H/2 -1$), we essentially require honest stake unanimity in order to have
liveness.
%Looking
%at the columns we can see that the voting threshold gradually decreases when r
%increases for a fixed value of $\gamma = 0$. While this is not the case in the
%$\gamma = T$ column, where the threshold increases since it is linearly
%depended on T ($\tau = 50 + \frac{T}{2}$). Finally, in the last column, the
%threshold decreases because it is linearly depended on H ($\tau = H - 1$) and
%H decreases as r increases.

\begin{table}[h!]
	\centering
	\begin{tabular}{ | c | c | c | c |}
		\hline
		Adversary ratio r ($r < 1/3 \approx 0.33$) & $\gamma = 0$ & $\gamma =
		T$ & $\gamma = \frac{H}{2} - 1$ \\
		\hline
		$0.1$ & $45\%$ & $55\%$ & $89\%$ \\
		$0.2$ & $40\%$ & $60\%$ & $79\%$ \\
		$0.3$ & $35\%$ & $65\%$ & $69\%$ \\
		\hline
	\end{tabular}
	\caption{Threshold values for different $\gamma$ and adversary
		ratios for a specific choice of $\tau(\gamma)$ ($\tau(\gamma) =
		50(1-r)+\gamma$), relevant to the voting
		process.}
	\label{table:examples}
\end{table}

%Theorem \ref{th:proposed_voting_threshold} provides a definition of the voting
%threshold that is sufficient for both the safety and liveness properties to
%hold. This holds only when the adversary stake $T < 1/3 \times 100 \approx
%33.33\%$. The $\gamma$ parameter can essentially take values in the range $0
%\leq \gamma < \frac{H}{2}$ and is always upper bounded by the strength of the
%honest majority result $\mu$. This means that \emph{only} honest majority
%results of strength $\mu > \gamma$ cannot be blocked (i.e., the liveness
%property holds).
%
%For $\gamma = 0$, $\tau_V = \frac{H}{2}$, which means that an honest majority
%result of \emph{any} strength $\mu$ will be approved (i.e., cannot be
%blocked),
%even if the honest majority is marginal, i.e., just $\frac{H}{2} + 1$. On the
%other hand, such a low threshold $\tau_V$, increases the risk of violating the
%safety property, since in the case of a malicious proposal voted in favor by
%the adversary stake T, there are only $\frac{H}{2} - T + 1$ positive votes
%missing for the proposal to be approved. So we could say informally that when
%$\gamma$ values are low, liveness is positively impacted, while safety is
%negatively impacted. Inversely, when $\gamma$ is close to $\frac{H}{2}$, then
%$\tau_V$ increases and becomes very difficult to violate safety. However, we
%know that only stake majority results of strength $\mu>\gamma$ cannot be
%blocked and since $\gamma$ is high valued, the set of results that cannot be
%blocked reduces. So we could say informally that when $\gamma$ values are
%high,
%liveness is negatively impacted, while safety is positively impacted. The
%relation of the $\gamma$ parameter to the safety and liveness properties is
%depicted in figure \ref{fig:gamma_parameter}.
%
%\begin{figure}[h!] %[H]
%	\centering
%	\includegraphics[width=0.6\columnwidth,
%	keepaspectratio]{figures/gamma.png}
%	\caption{The $\gamma$ parameter versus liveness and safety.}
%	\label{fig:gamma_parameter}
%\end{figure}
%
%We see from theorem \ref{th:proposed_voting_threshold} that the proposed
%voting
%threshold is lower bounded by $\frac{H}{2}$. It can be easily proved that it
%could be lower bounded even by $T$, where $T < \frac{H}{2}$. In other words,
%we
%could have chosen $\tau_V(\gamma) = T + \gamma$ where $0 < \gamma < \mu$ and
%still enjoy the properties of safety and liveness. We have chosen to lower
%bound $\tau_V$ by $\frac{H}{2}$, because we want to honor honest stake
%\emph{majority} and not \emph{minority}. For example, if $T=20\%$ ($H=80\%$)
%and we have
%chosen
%$\tau_V = 25\%$, then even a $30\%$ of honest stake positive votes would be
%enough to approve a result, assuming that the rest $50\%$ of
%the honest stake does not vote, or that their votes are split to $25\%$ reject
%and $25\%$ abstain votes. Since we do not want to allow honest minority to
%control the voting result like this we have decided to lower bound $\tau_V$ by
%$\frac{H}{2}$.
%
%Another important observation is that our analysis is based on the assumption
%that we can have an estimation of the adversary ratio $r$. If it is not
%possible to estimate $r$ with some accuracy, then we could take a worst case
%approach for estimating $r$. From Garay et. al. in \cite{sok}, we know that
%the
%ratio $r = \frac{T}{T+H} = \frac{T}{100}$ is always upper bounded by the
%theoretical
%adversary tolerance $r_{Th}$ of our consensus protocol, i.e., $r =
%\frac{AdversaryStake}{TotalStake} = \frac{T}{100} < r_{Th}$ (e.g., $r < 1/2 =
%r_{Th}$, or $r < 1/3 = r_{Th}$ etc.).
%
%In table \ref{table:examples}, we provide some examples of the voting
%threshold
%$\tau_V$ for different values of $\gamma$ and different adversary ratios r.For
%a specific adversary ratio r, as we increase $\gamma$, we require stronger
%honest stake majority, in order to avoid the denial of approval attack.
%Looking
%at the columns we can see that the voting threshold gradually decreases when r
%increases for a fixed value of $\gamma = 0$. While this is not the case in the
%$\gamma = T$ column, where the threshold increases since it is linearly
%depended on T ($\tau_V = 50 + \frac{T}{2}$). Finally, in the last column, the
%threshold decreases because it is linearly depended on H ($\tau_V = H - 1$)
%and
%H decreases as r increases.
%
%\begin{table}[h!]
%	\centering
%	\begin{tabular}{ | c | c | c | c |}
%		\hline
%		Adversary ratio r ($r < 1/3 \approx 0.33$) & $\gamma = 0$ & $\gamma =
%		T$ & $\gamma = \frac{H}{2} - 1$ \\
%		\hline
%		$0.1$ & $45\%$ & $55\%$ & $89\%$ \\
%		$0.2$ & $40\%$ & $60\%$ & $79\%$ \\
%		$0.3$ & $35\%$ & $65\%$ & $69\%$ \\
%		\hline
%	\end{tabular}
%	\caption{Voting threshold values for different $\gamma$ and adversary
%		ratios.}
%	\label{table:examples}
%\end{table}


\subsection{Physics at hadron colliders}
\label{hadroniccollision}

Protons are not elementary particle, but actually consistent of quarks and gluons.
So in proton-proton (pp) collision at the LHC, it is not protons themselves interact but quarks and gluons.
Scattering processes can then be further classified into either \textit{hard} or \textit{soft} processes
according to the momentum transfer during the interaction \cite{Dremin:2005wd}.
QCD, as an underlying theory for both processes, its approach and level of understandings in two cases are quite different.
For hard process, eg. Higgs boson, vector bosons and jets production,
the perturbation theory can be used to precisely predict their rates and properties.
However, for soft processes like total cross-section or the underlying events, the rates and event properties are dominated by non-perturbative QCD effects that are less understood.
For many hard processes, the hard interactions are accompanied by soft ones.
An example of the hadronic collision is illustrated in figure~\ref{fig:C2_had_col}.
\begin{figure}[!htb]
  \centering
  \includegraphics[width=0.7\textwidth]{figures/Theory/hh_collision.png}
  \caption{Schematic of a hadron-hadron collision \cite{Womersley:2000cx}.}
  \label{fig:C2_had_col}
\end{figure}
and the typical features are summarized as below:
\begin{itemize}
	\item \textbf{Parton Distribution Function (PDF)}: $f_{i}\left(x, Q^{2}\right)$ gives the probability of finding a parton with flavor $i$ (quark or gluon), carrying a momentum fraction of $x$ and with the scale of momentum transfer $Q$ in a proton. Parton distribution function cannot be fully calculated by perturbative QCD because of the inherent non-perturbative nature of partons. There are many different sets of PDFs that are determined by fits to data from experimental observables in various processes. As an example, figure~\ref{fig:C2_PDF4LHC15} shows the \textit{PDF4LHC15 NLO PDFs}, which are based on the combination of the \textit{CT14}, \textit{MMHT14} and \textit{NNPDF3.1} NNLO PDF sets \cite{Lin:2017snn}.
	\item \textbf{Fragmentation and hadronization}: The processes to produce final state particles and jets from the partons produced in hard scattering.
	\item \textbf{Initial/Final state radiation}: The incoming and outgoing partons that carry color charge can emit QCD radiation, which gives rise to additional jets. Also the charged incoming and outgoing leptons can emit Quantum Electrodynamics (QED) radiations with photons.
	\item \textbf{Underlying events}: Products from soft processes (not come from the primary hard scattering) as the remnants of scattering interactions.
\end{itemize}
\begin{figure}[!htb]
  \centering
  \includegraphics[width=0.7\textwidth]{figures/Theory/PDF4LHC15.png}
  \caption{The PDF4LHC15 NLO PDFs at a low scale $\mu^{2} = Q^{2} = 4 GeV^{2}$ (left) and at $\mu^{2} = Q^{2} = 100 GeV^{2}$ (right) as a function of x.}
  \label{fig:C2_PDF4LHC15}
\end{figure}

\textbf{Cross section of hard scaterring}

According to \textit{QCD factorization theorems} \cite{Collins:1989gx}, the perturbative calculations can be applied to many important hard processes involving hadrons.
The basic problem addressed by factorization theorems is how to calculate high energy cross sections.
Consider the process of scattering between $A$ and $B$ hadron and producing a final state $X$, the cross section $\sigma$ can be obtained
by summing over all the subprocess cross section $\hat{\sigma}$ \cite{Stirling:1194745}
\begin{equation}
	\sigma_{AB} = \int dx_{a} dx_{b} f_{a/A}\left(x_{a}\right) f_{b/B}\left(x_{b}\right) \hat{\sigma}_{ab\rightarrow X}
\end{equation}
where $f_{q/A}\left(x_{q}\right)$ is the parton distribution functions of parton $q$.
Taking into account the leading order correction:
\begin{equation} \label{eq:xs2}
	\sigma_{AB} = \int dx_{a} dx_{b} f_{a/A}\left(x_{a}Q^{2}\right) f_{b/B}\left(x_{b}Q^{2}\right) \hat{\sigma}_{ab\rightarrow X}
\end{equation}
where $Q^{2}$ represents large momentum scale that characterizes the hard scattering.
Later on, since the finite corrections were not universal and had to be calculated separately for each process,
the perturbative $O\left(\alpha_{S}^{n}\right)$ corrections to the leading logarithm cross section in Eq.~\ref{eq:xs2}
need to be applied, one can get:
\begin{equation}
	\sigma_{AB} = \int dx_{a} dx_{b} f_{a/A}\left(x_{a}\mu_{F}^{2}\right) f_{b/B}\left(x_{b}\mu_{F}^{2}\right) \hat{\sigma}_{ab\rightarrow X}\left(\alpha_{S},\mu_{R},\mu_{F}\right)
\end{equation}
in which $\mu_{F}$ is \textit{factorization scale} representing the scale that separates the long- and short-distance physics,
and $\mu_{R}$ is the \textit{renormalization scale} of QCD running coupling.
$\hat{\sigma}_{ab\rightarrow X}$ is the parton-level hard scattering cross section that can be calculated perturbatively in QCD with the form of
\begin{equation} \label{eq:xs3}
	\hat{\sigma}_{ab\rightarrow X}\left(\alpha_{S},\mu_{R},\mu_{F}\right)
		= \left(\alpha_{S}\right)^{n} \left[ \hat{\sigma}^{(0)}
		+ \left(\alpha_{S}/2\pi\right) \hat{\sigma}^{(1)}\left(\mu_{R},\mu_{F}\right)
		+ \left(\alpha_{S}/2\pi\right)^{2} \hat{\sigma}^{(2)}\left(\mu_{R},\mu_{F}\right)
		+ ... \right]
\end{equation}
where $\hat{\sigma}^{(0)}$ stands for the leading-order partonic cross section,
$\hat{\sigma}^{(1)}$ and $\hat{\sigma}^{(2)}$ are the next-to-leading-order (NLO) and
next-to-next-to-leading-order (NNLO) cross section.

$\mu_{R}$ and $\mu_{F}$ depend on the order of truncation in Eq.~\ref{eq:xs3}.
In principle, if cross section is calculated to all orders, it is invariant under changes in these parameters.
The choices of $\mu_{R}$ and $\mu_{F}$ are arbitrary, and $\mu_{R} = \mu_{F}$ is often assumed.
It is advisable to choose the value of $\mu_{R}$ and $\mu_{F}$ on the order of the typical momentum scales of
the hard scattering process to avoid unnaturally large logarithms appearing in the perturbation series.
For example in Drell–Yan process, the standard choice is that both $\mu_{R}$ and $\mu_{F}$ are set to the invariant mass of di-lepton pair.


\documentclass[12pt]{article}

\usepackage[english]{babel}
\usepackage[utf8x]{inputenc}
\usepackage[T1]{fontenc}
\usepackage{parskip}
\usepackage{lipsum}
\usepackage[a4paper, total={6in, 8in}]{geometry}
\usepackage{setspace}
\usepackage[superscript]{cite}
\usepackage{xcolor}
\usepackage{hyperref}
\usepackage{enumitem}
\usepackage{listings}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{ifsym}
\usepackage{tikz}

\begin{document}
	\begin{flushright}
		\today
	\end{flushright}
	{\Large \textbf{Assignment 12}}

	{\large Query Optimization}

	\textsc{Ilaria Battiston - 03723403} \\
	\textsc{Mareva Zenelaj - 03736071}

	\rule{\linewidth}{0.5pt}

	\section{First exercise}
	Probability of $0 \leq j \leq 90$ pages being skipped:
	\begin{figure}[h]
		\includegraphics[scale=0.7]{plot_skipped.png}
		\centering
	\end{figure}

	Expected distance between two pages B = 100, b = 10, (10 bits set to 1): computing the distribution of zeros, and the expected number of zeros between two 1s.
	$$\Bar{B}_b^B = \frac{B-b}{b+1} = \frac{100-10}{10_1} = \frac{90}{11} = 8.18$$

	Expected distance between the beginning and the last page to be read:
	$$\Bar{B}_{tot} = \frac{Bb +b}{b+1} = \frac{100*10 + 10}{11} = \frac{1010}{11} = 91.8$$

	Expected distance between the first and the last page
	$$\Bar{B}_{1-span} = \frac{Bb-B+2b}{b+1} = \frac{100 \cdot 10-100+20}{11} = \frac{901}{11} =81.9$$

	\section{Second Exercise}

	The number of elements for which $R.a \geq 55$ holds true:

	$R.a \geq 55$ = $R.a > 55$ + $R.a = 55$

	$\frac{60-40}{4} = 5$

	5 elements $\implies [55, 60) = 1/4$ of total

	0 in the first bucket, 0 in the second, 1 in the third, 2 in the fourth and 0 in the last one. Therefore there are 3 elements.

	\section{Third exercise}
	$R.a = S.b$ \\
	When estimating joins on histograms with non-aligned bucket boundaries, buckets are split, such that boundaries are aligned.

	Since it is impossible to evenly split buckets with odd numbers, when in doubt the element is placed in the bucket on the left.

	\begin{tabular}{c|c|c|c|c|c|c|c}
	     $R.a$ & [0, 10) & [10, 20) & [20, 40) & [40, 50) & [50, 60) & (60, 80] & [80, 100) \\
	     \hline
	     count & 1 & 0 & 3 & 2 & 2 & 2 & 0 \\
	\end{tabular}

	\begin{tabular}{c|c|c|c|c|c|c|c}
		$S.b$ & [0, 10) & [10, 20) & [20, 40) & [40, 50) & [50, 60) & (60, 80] & [80, 100) \\
		\hline
		count & 2 & 4 & 1 & 6 & 1 & 2 & 1 \\
	\end{tabular}

	$$(R.a = R.b) = \frac{1 \cdot 6 + 1 \cdot 3 + 2 \cdot 6 + 4 \cdot 4}{(1+3+2+4) \cdot (6+1+6+4)} = \frac{37}{170} = 0.217\%$$

	$$(R.a = R.b) = \frac{1 \cdot 2 + 4 \cdot 0 + 3 \cdot 1 + 2 \cdot 4 + 2 \cdot 1 + 2 \cdot 1 + 1 \cdot 0}{(1+0+3+2+2+2+0) \cdot (2+4+1+6+1+2+1)} = \frac{17}{170} = 0.1$$

	Selectivity of $(R \Join S) \approx 0.1$
\end{document}


\subsection{Attack on 4.5-step \aead{} without Rate Whitening}

Consider an instance of \aead{} with the rate equal to the capacity (i.e. one of
\aeadversion{128}{128},
\aeadversion{192}{192},
\aeadversion{256}{256}),
which uses the \aCipher{} permutation reduced to 4 steps and has no rate whitening.

Let $y$ be the input to the linear Feistel layer $\M$ in the third step (see~Figure~\ref{fig:mitm4.5nowhit}). We aim to mount a birthday-differential attack with zero-difference in $y$. The parts of the structure with zero difference are marked with purple crosses in the figure. It follows that differences of the observed rate parts can be propagated and connected by independent branches. More formally, let
\begin{align*}
    &\Min' = \MINV (\BBB{1} (\AAA{0} (\Min))),\\
    &\Mout' = \MINV(\R(\Mout)).
\end{align*}
% be values computed for the first encryption, and $\xMin', \xMout'$ be respective values computed for the second encryption. Then
% $$
% \BBB{2}(\Min') \oplus \BBB{2}(\xMin') = \RINV(\AAAINV{3}(\Mout')) \oplus \RINV(\AAAINV{3}(\Mout')).
% $$
Denote the difference in $\Min'$ by $\Delta\Min'$, and the difference in $\Mout'$ by $\Delta\Mout'$.
It follows that the difference $\Delta\Min'$ propagates through $\BBB{2}$ into the same difference as the difference $\Delta\Mout'$ propagates through $\RINV \circ \AAAINV{3}$. Note that they are connected by $\halfbranches$ independent 64-bit branches:
\begin{equation}
\label{eq:mitm-4.5steps-nowhitening}
(\Delta\Min')_i
\xlongrightarrow{\B{2}{i}} \alpha_i
\xlongleftarrow{\AINV{3}{i-1}}
(\Delta\Mout')_{i-1},
\end{equation}
where $\alpha$ is the unknown intermediate difference.

{\FigTex{mitm_4p5steps_nowhitening.tex}}

In order to make the birthday-differential attack, we further strengthen the zero-difference constraint in order to perform an efficient initial filtering. We require that $(\Delta\Min')_i = \alpha_i = (\Delta\Mout')_{i-1} = 0$ for all $i < t$ for an integer $t$, $0 < t < \halfbranches$. This constraints allows us to filter the pairs efficiently by the zero-difference parts of $\Min'$ and $\Mout'$.

The second filtering step is based on checking the possibility of the differential transitions from Equation~\ref{eq:mitm-4.5steps-nowhitening}. This is Problem~2 mentioned in Section~\ref{sec:mitm-arx-assum}.

Similarly to the previous attack, we the final complexity of the attack is estimated by $2^{64(\halfbranches+t)/2+1/2}$ data and $2^{64(\halfbranches-t)}(\soltime + \solratio^{\halfbranches-t} \finalrec)$ time.
Under the assumption of low values of $\solratio,\soltime$ and $\finalrec$, the following attacks are derived:
\begin{enumerate}
    \item \aeadversion{128}{128}: with $t=1$, the attack requires $2^{96.5}$ data, and more than $2^{64}$ time.
    By the precomputation cost of $2^{96+\epsilon}$ time and memory, the data requirement can be reduced to $2^{96-\epsilon}$ for any $\epsilon < 32$.

    \item \aeadversion{192}{192}: with $t=1$, the attack requires $2^{128.5}$ data, and more than $2^{128}$ time.
    By the precomputation cost of $2^{128+\epsilon}$ time and memory, the data requirement can be reduced to $2^{128-\epsilon}$ for any $\epsilon < 64$.

    \item \aeadversion{256}{256}: with $t=1$, the attack requires $2^{160.5}$ data, and more than $2^{192}$ time. By the precomputation cost of $2^{160+\epsilon}$ time and memory, the data requirement can be reduced to $2^{160-\epsilon}$ for any $\epsilon < 96$.
\end{enumerate}


\documentclass{article}

\usepackage[english]{babel}
\usepackage[utf8]{inputenc}
\usepackage{amsmath,amssymb}
\usepackage{parskip}
\usepackage{graphicx}
\usepackage{amsmath}
\usepackage{float}

% Margins
%\usepackage[top=2cm, left=2.5cm, right=2.5cm, bottom=2.5cm]{geometry}
\usepackage[margin=1in]{geometry}
% Colour table cells
\usepackage{sectsty}
\usepackage{textcomp}
\usepackage{mathtools}
\usepackage[most]{tcolorbox}

% Get larger line spacing in table
%\newcommand{\tablespace}{\\[1.25mm]}
%newcommand\Tstrut{\rule{0pt}{2.6ex}}         % = `top' strut
%\newcommand\tstrut{\rule{0pt}{2.0ex}}         % = `top' strut
%\newcommand\Bstrut{\rule[-0.9ex]{0pt}{0pt}}   % = `bottom' strut

\sectionfont{\fontsize{12}{15}\selectfont}

%%%%%%%%%%%%%%%%%
%     Title     %
%%%%%%%%%%%%%%%%%
\title{Information Visualization - Project\vspace{-0.8em}}
\author{Marian Aldescu - MoSIG DS}
\date{\today}

\begin{document}
\maketitle

\textbf{\Large{Design visualizations}}\\

\textbf{\Large{A. Global insights}}\\

\section{What is the CO$_2$ distribution over time? In which period of the year are produced the biggest CO${_2}$ emissions by Westeros missions?}

\large{\textbf{Solution 1}}\\
To answer this question, we want to show how the CO${_2}$ level evolves in time and to identify if there are periods with considerable high or low pollution. After taking a look on the dataset, I observed that the missions take place over a period of 8 years, so since the number is't not big, we can even compare how the CO${_2}$ level changes from one year to another in the same visualization.

For this question, time is not an automatic property, because the entire dataset does not evolve with time, so I will use it as a quantity(\textbf{Q}), and reserve the \textbf{X} axis for it. On the \textbf{Y} axis I will map the level of CO${_2}$ for each mission, which is also a quantity(\textbf{Q}).

On the X axis, I show the data for one year, because it would not be relevant to see all the emissions on the same axis, but overlapped or side by side. Therefore, we need to differentiate the CO${_2}$ over years, and since the years are nominal(\textbf{N}) values, I will use the retinal property(\textbf{R}) color.

According to \cite{mackinlay}, the visual mapping table will look like this:\\

\begin{table}[h!]
\begin{center}
	\begin{tabular}{|c | c | c | c || c | c | c | c | c| c| c || c|}
		\hline
		Name & D & F & D\textquotesingle  & X & Y & Z & T & R & -& [] & CP \\ [0.5ex]
		\hline\hline
		Time  & Q &  &  &  L &   &   &   &   &   &   &   \\ [0.5ex]
		\hline
		CO${_2}$  & Q &  &  &  & L  &   &   &   &   &   &   \\ [0.5ex]
		\hline
		Year  & N &  &  &  &   &   &   & C  &   &   &   \\ [0.5ex]
		\hline
	\end{tabular}
	\caption{CO${_2}$ emissions evolution  over time}
	\label{table:1}
\end{center}
\end{table}

In Figure \ref{fig:positive_selection}, we can see a sketch of a plot using the previous visual mapping. I only drew the first 4/8 plots, normally another 4 would be overlaid. The user can choose to overlap all the plots in one by pressing \textbf{OVERLAP} button. This would help to better compare 2 or more years. Since in total, there are 8 years, the guideline for mapping of Bertin\cite{bertin} is not respected, because he recommends to use maximum 7 colors in order for the eye to do a proper selection of the elements in the visualization, but this issue can be solved  by choosing which year to keep in the plot, by checking the boxes in the right side. By pressing \textbf{EXPAND}, the visualization will be restored to the previous state.

\begin{figure}[H]
	\centering
	\includegraphics[scale=0.23]{img/1.jpg}
	\caption{CO${_2}$ emissions evolution over time }
	\label{fig:positive_selection}
\end{figure}\

\large{\textbf{Solution 2}}\\
Because I chose to plot the CO${_2}$ variation over one year, and a year can be imagined as a cyclic period of 365 days, we can transform the \textbf{X} axis in a circle, by transforming the $n^{th}$ day from the 1$^{st}$ of January in radians, with the following formula:
\begin{eqnarray}
	\theta = \dfrac{ArcLength * \pi}{L}
\end{eqnarray}

where \textit{L} is the length of the circle given in days(365), and \textit{ArcLength} is the number of days since 1$^{st}$ of January until the date of the mission. Both time and CO${_2}$ are quantities(\textbf{Q}) and the level of CO${_2}$ remains mapped on \textbf{Y} axis. In Table \ref{table2} we can see the visual mapping.

\begin{table}[h!]
	\begin{center}
		\begin{tabular}{|c | c | c | c || c | c | c | c | c| c| c || c|}
			\hline
			Name & D & F & D\textquotesingle  & X & Y & Z & T & R & -& [] & CP \\ [0.5ex]
			\hline\hline
			Time  & Q & $\theta$ & Q &  L &   &   &   &   &   &   &   \\ [0.5ex]
			\hline
			CO${_2}$  & Q &  &  &  & L  &   &   &   &   &   &   \\ [0.5ex]
			\hline
			Year  & N &  &  &  &   &   &   & C  &   &   &   \\ [0.5ex]
			\hline
		\end{tabular}
		\caption{CO${_2}$ emissions evolution  over time}
		\label{table2}
	\end{center}
\end{table}

A visualization would look like in Figure \ref{fig:radians_time}. In this case, the user can only choose which year to be displayed in the visualization and compare it with the average of all years. The list of check boxes in the right side is exclusive, so one choice will uncheck the previous one.
\begin{figure}[H]
	\centering
	\includegraphics[scale=0.19]{img/3.jpg}
	\caption{CO${_2}$ emissions evolution over time }
	\label{fig:radians_time}
\end{figure}\

\newpage
\section{Where(countries, continents) do most of the users travel? (Distribution of trips to certain places)}
\large{\textbf{Solution 1}}\\
A possible answer to this question would result by providing a list with the first $n$ favorite destinations. To enhance user perception, these can be sorted by the total number of missions and each element of the list is accompanied by the name of the country. The number of missions is a quantity(\textbf{Q}), therefore we can map it on the \textbf{X} axis. Usually, names(of the countries) are nominal values, but I will sort them, thus they become ordinal(\textbf{O}) values. Also, each country can be colored according to its continent, which is a nominal value(\textbf{N}) and encoded as retinal property(\textbf{R}): color(\textbf{C}). For more information of the percentage of the number of missions we can add a Control Processing(\textbf{CP}) property, which will be mapped on the \textbf{X} axis. In Table \ref{table3} we can see the visual mapping.

\begin{table}[h!]
	\begin{center}
		\begin{tabular}{|c | c | c | c || c | c | c | c | c| c| c || c|}
			\hline
			Name & D & F & D\textquotesingle  & X & Y & Z & T & R & -& [] & CP \\ [0.5ex]
			\hline\hline
			Nb. of missions & Q &  & Q &  L &   &   &   &   &   &   &   \\ [0.5ex]
			\hline
			Country  & N & fs & N &  & P  &   &   &   &   &   &   \\ [0.5ex]
			\hline
			Continent  & N &  & N &  &   &   &   & C  &   &   &   \\ [0.5ex]
			\hline
			Percentage missions  & Q &  & Q & P &   &   &   &   &   &   & tx  \\ [0.5ex]
			\hline

		\end{tabular}
		\caption{Favorite missions destinations(Sol. 1)}
		\label{table3}
	\end{center}
\end{table}

A sketch is designed in Figure \ref{fig:fav_dest}. What the user needs first to perceive from the image is the order of the countries. Then, for each bar, he will associate the quantity of missions with the country name. I did not encoded the country name as Control Processing(\textbf{CP}) property, since in this case it is more a label of the \textbf{Y} axis. Secondary information would be the grouping of the countries into continents by color of the bars. Notices that there are 7 continents, so Bertin rule on colors is respected.
Depending on the length of the bars, we can use a logarithmic scale. This visualization is not intended to be interactive.
\begin{figure}[H]
	\centering
	\includegraphics[scale=0.2]{img/4.jpg}
	\caption{Favorite missions destinations(Sol. 1)}
	\label{fig:fav_dest}
\end{figure}\
\newpage

\large{\textbf{Solution 2}}\\
Keeping in mind that we want to show the favorite destinations, we can put a focus on the continents by mapping the number of missions on each continent in a pie-chart. Each slice will have an opening angle($\theta$) which is directly proportional to the length of the arc represented by the number of missions. For this we can use the transformation in radians: Eq.(1), hence the slice for each continent will be a surface(\textbf{S}):

Q$\rightarrow$\textbf{X}:S, \textbf{Y}:S

All the resulted slices will be sorted by the length of the arc(number of missions).

For each country, we calculate the number of missions(\textbf{Q}) and map it as a line on \textbf{Y} axis.

Q$\rightarrow$\textbf{Y}:L

Countries are nominal(\textbf{N}) values, represented as points on the \textbf{X} axis and sorted inside a continent by the number of missions. Each country is then mapped on the arc which corresponds to the continent to which the country belongs, by using Eq (1).

Continents are differentiated by the retinal property(\textbf{R}): color and all the countries inside a continent with the same color.

In Table \ref{table4} we can see the visual mapping.

\begin{table}[h!]
	\begin{center}
		\begin{tabular}{|c | c | c | c || c | c | c | c | c| c| c || c|}
			\hline
			Name & D & F & D\textquotesingle  & X & Y & Z & T & R & -& [] & CP \\ [0.5ex]
			\hline\hline
			Nb. of missions(continent) & Q &  & Q &  S &  S &   &   &   &   &   &   \\ [0.5ex]
			\hline
			Nb. of missions(country) & Q &  & Q &   &  L &   &   &   &   &   &   \\ [0.5ex]
			\hline
			Country  & N & fs, $\theta$ & N & P &   &   &   &   &   &   &   \\ [0.5ex]
			\hline
			Continent  & N & fs, $\theta$ & N & P &   &   &   & C  &   &   &   \\ [0.5ex]
			\hline

		\end{tabular}
		\caption{Favorite missions destinations(Sol. 2)}
		\label{table4}
	\end{center}
\end{table}
In Figure \ref{fig:fav_dest2} we see the visual representation, which it is not interactive.
\begin{figure}[H]
	\centering
	\includegraphics[scale=0.16]{img/5.jpg}
	\caption{Favorite missions destinations(Sol. 2)}
	\label{fig:fav_dest2}
\end{figure}

\large{\textbf{Solution 3}\\}
Another option would be to visualize the number of missions on the world map.

We know the destination country of each mission, therefore we can find out its positional coordinates(long, lat)(we ca use an external dataset which maps countries to their approximately geographical central point).

\textbf{QXlon}$\rightarrow$\textbf{X}:P\\
\textbf{QYlat}$\rightarrow$\textbf{Y}:P

The number of missions can be calculated for a certain time interval, hence a \textbf{slider} can be added to the visualization, to choose the extremities of the interval. We use the retinal property(\textbf{R}) size(\textbf{S}) to encode the number of missions in the interval. Table \ref{table5} shows the visual mapping just described.

\begin{table}[h!]
	\begin{center}
		\begin{tabular}{|c | c | c | c || c | c | c | c | c| c| c || c|}
			\hline
			Name & D & F & D\textquotesingle  & X & Y & Z & T & R & -& [] & CP \\ [0.5ex]
			\hline\hline
			Long.  & QX lon &  & QX lon &  P &   &   &   &   &   &   &   \\ [0.5ex]
			\hline
			Lat  & QY lat &  & QY lat &  & P  &   &   &   &   &   &   \\ [0.5ex]
			\hline
			Nb. of missions(country)  & Q & sl & Q &  &   &   &   & S  &   &   &   \\ [0.5ex]
			\hline
		\end{tabular}
		\caption{Visual mapping: favorite missions destinations(Sol. 3)}
		\label{table5}
	\end{center}
\end{table}

In Figure \ref{fig:fav_dest_world} we can see how a visualization would look like for the previous visual mapping. The initial map shows all the continents with a red circle on each country, with the diameter directly proportional to the number of missions to that destination. Using the mouse cursor, a rectangle region can be selected to be maximized. Selecting the European continent, the result it's shown in Figure \ref{fig:fav_dest_europe}.

\begin{figure}[H]
	\centering
	\tcbox{\includegraphics[scale=0.18]{img/5_5.png}}
	\caption{Favorite missions destinations(Sol. 3) - Fictive data}
	\label{fig:fav_dest_world}
\end{figure}

\begin{figure}[H]
	\centering
	\tcbox{\includegraphics[scale=0.18]{img/6.png}}
	\caption{Favorite missions destinations(Sol. 3) - Fictive data}
	\label{fig:fav_dest_europe}
\end{figure}

The visualization has a slider attached that is represented in Figure \ref{fig:fav_dest_glider}. For the plot, it will be counted only the missions that started in the desired interval. The user can change the extremities of the interval by moving the red triangles, or can slide it, in this way providing a continuity effect of the evolution of the number of missions in the range.\\

\begin{figure}[H]
	\centering
	\tcbox{\includegraphics[scale=0.2]{img/7.jpg}}
	\caption{Date glider}
	\label{fig:fav_dest_glider}
\end{figure}

\textbf{\Large{B. Focusing on subsets}}\\
\section{Which person, house, region, rank, title, institution pollutes the most?}

Starting from the sample visualization provided in the project, of the CO${_2}$ distribution over people, it is interesting to observe if any of the subsets mentioned in the question is predisposed to higher/lower levels of CO${_2}$ emissions for any of its components.

An example would be to see if people who produce small amounts of CO${_2}$ emissions have lower ranks, or maybe they are part of a certain institutions, or they have a prestigious title.

With this in mind, and considering that a person may be considered a subset of dimension 1, we can design a visualization that shows statistics on all subsets of our dataset and possible correlations between them.

A key point in selecting people who produce large/small amounts of CO${_2}$, is to add a slider in the provided visualization, to take into consideration only a range of users. On the \textbf{X} axis, users are mapped as quantity(\textbf{Q}), and on the \textbf{Y} axis, the volume of CO${_2}$ is mapped also as quantity(\textbf{Q}). We want to have the users sorted by the quantity of CO${_2}$ produced, so we apply a sort function, then a slider in order to select the users from a certain interval. In Table \ref{table6} we have the visual mapping.

We can interact with the visualization by moving the interval extremities with the cursor. The surface in the interval can be represented with a color different than the one outside the interval.

 \begin{table}[h!]
 	\begin{center}
 		\begin{tabular}{|c | c | c | c || c | c | c | c | c| c| c || c|}
 			\hline
 			Name & D & F & D\textquotesingle  & X & Y & Z & T & R & -& [] & CP \\ [0.5ex]
 			\hline\hline
 			Users  & Q & s,sl & O &  S &   &   &   &   &   &   &   \\ [0.5ex]
 			\hline
 			CO${_2}$  & Q &  & Q &  & S  &   &   &   &   &   &   \\ [0.5ex]
 			\hline
 		\end{tabular}
 		\caption{Visual mapping: CO${_2}$ over users(vis.1 in Figure \ref{fig:subsets} )}
 		\label{table6}
 	\end{center}
 \end{table}

For the: distribution of CO${_2}$ over ranks, titles, regions and institutions, the visualizations are similar. On the \textbf{X} axis, we map the emissions of CO${_2}$ as quantity\textbf{(Q)} and on the \textbf{Y} axis we map the categories mentioned before as points(the order is not taken into account). I will provide the visual mapping only for the rank distribution in Table \ref{table7}, because the others(vis. 4, 5, 6 from Figure \ref{fig:subsets}) are almost identical. It is important to mention that for each title, rank, etc., we compute the average of the CO${_2}$ produced by the users inside each group.

\begin{table}[h!]
	\begin{center}
		\begin{tabular}{|c | c | c | c || c | c | c | c | c| c| c || c|}
			\hline
			Name & D & F & D\textquotesingle  & X & Y & Z & T & R & -& [] & CP \\ [0.5ex]
			\hline\hline
			CO${_2}$ & Q &  & Q &  L &   &   &   &   &   &   &   \\ [0.5ex]
			\hline
			Rank  & Q &  & Q &  & P  &   &   &   &   &   &   \\ [0.5ex]
			\hline

		\end{tabular}
		\caption{CO${_2}$ distribution over ranks(vis.2 in Figure \ref{fig:subsets} )}
		\label{table7}
	\end{center}
\end{table}

Visualization 2 from Figure \ref{fig:subsets} could provide some interesting insight about the emissions of CO${_2}$ inside a house. It is like vis. 1, but instead of having the users on the \textbf{X} axis, we map the houses, and on the \textbf{Y} axis, the average CO${_2}$ quantity produced inside a house, then all the values are sorted, resulting almost an exponential curve. We consider that all the houses are "vertical cylinders" of equal width. By moving the slider extremities in the vis. 1, we keep inside a house just a number of users equal with those that are in the slider range interval. Therefore, some regions in the houses distribution will become whiter in color, if we consider that inside a house, we eliminate randomly the users from a house, its color going from black to gray (if the initial color is black). In Figure \ref{fig:subsets}, vis.2, we can see such an effect.

\begin{figure}[H]
	\centering
	\tcbox{\includegraphics[scale=0.18]{img/8_5.jpg}}
	\caption{CO${_2}$ - subsets statistics}
	\label{fig:subsets}
\end{figure}

%
%\section{How much CO${_2}$ emissions are produced to go to certain places?(Distribution of CO$_2$ over the countries)}
%Solution\\
%This question is very similar to the previous one, this time instead of counting how many missions take place in a country, we count the CO${_2}$ emissions produced to go there, my multiplying the CO${_2}$ quantity released per km with the distance to destination and the number of missions to that place.
%
%We can map the CO${_2}$ emissions on the \textbf{X} axis, since it is a quantity(\textbf{Q}) and on the \textbf{Y} axis we can map the countries in descending order with horizontal bars, showing the amount of CO${_2}$.
%
%The continent is mapped as color and the percentage of emissions for a country as text, thus we will have the visual mapping from Table \ref{table_CO2}.
%
%\begin{table}[h!]
%	\begin{center}
%		\begin{tabular}{|c | c | c | c || c | c | c | c | c| c| c || c|}
%			\hline
%			Name & D & F & D\textquotesingle  & X & Y & Z & T & R & -& [] & CP \\ [0.5ex]
%			\hline\hline
%			CO${_2}$ & Q &  & Q &  L &   &   &   &   &   &   &   \\ [0.5ex]
%			\hline
%			Country  & N & fs & N &  & P  &   &   &   &   &   &   \\ [0.5ex]
%			\hline
%			Continent  & N &  & N &  &   &   &   & C  &   &   &   \\ [0.5ex]
%			\hline
%			Percentage emissions  & Q &  & Q & P &   &   &   &   &   &   & tx  \\ [0.5ex]
%			\hline
%		\end{tabular}
%		\caption{CO${_2}$ emissions over countries}
%		\label{table_CO2}
%	\end{center}
%\end{table}
%
%A sketch would look like the one from Figure \ref{fig:fav_dest}, therefore we can add on it a transition button, to switch between the two distributions.

%	\item Is the mission mode correlated with the distance/country?
%	\item What are the CO${_2}$ emissions for a certain rank/title/house?
%	\item Which rank/title/house spent the most time in missions?
%	\item Which rank/title/house traveled the longest distance?
%	\item Which rank/title/house completed most of the missions?

\newpage

\bibliographystyle{plain}
\bibliography{bibliography}

\end{document}


\renewcommand*\chappic{img/hashalgos.pdf}
\renewcommand*\chapquote{}
\renewcommand*\chapquotesrc{}
%
\chapter{Hash algorithms}
\label{ch:hash}

In this chapter, we will define hash functions and their desired security
properties. In the following, we look at SHA-256 and MD4 as established hash functions.
MD4 unlike SHA-256 is practically broken, but has a comparably small internal state.
It therefore allows a good starting point to devise our attacks.
In a next step, we scaled up to SHA-256 which has an internal state size
at least twice as large.
In Chapter~\ref{ch:enc}, we will represent them with Boolean algebra to allow
to reason about states in those hash functions using SAT solvers.

\section{Preliminaries Redux}
\label{sec:hash-prelim}
%
\index{Hash value}
\index{Preimage}
\index{Hash function}
\begin{defi}[Hash function]
  A \emph{hash function} is a mapping $h: X \to Y$ with $X = \left\{0,1\right\}^*$ and
  $Y = \left\{0,1\right\}^n$ for some fixed $n \in {\symbol{"2115}}_{\geq 1}$.  % FAIL
  \begin{itemize}[noitemsep,topsep=0pt]
    \item Let $x \in X$, then $h(x)$ is called \emph{hash value of $x$}.
    \item Let $h(x) = y \in Y$, then $x$ is called \emph{preimage of $y$}.
  \end{itemize}
\end{defi}

Hash functions are considered as cryptographic primitives
used as building blocks in cryptographic protocols.
A hash function has to satisfy the following security requirements:

\index{Preimage resistance}
\begin{defi}[Preimage resistance]
  Given $y \in Y$,
  a hash function $h$ is \emph{preimage resistant} iff it is computationally infeasible
  to find $x \in X$ such that $h(x) = y$.
\end{defi}

\clearpage
\index{Second-preimage resistance}
\begin{defi}[Second-preimage resistance]
  Given $x \in X$,
  a hash function $h$ is \emph{second-preimage resistant} iff it is computationally infeasible
  to find $x_2 \in X$ with $x \neq x_2$ such that $h(x) = h(x_2)$.
  $x_2$ is called \emph{second preimage}.
\end{defi}

\index{Collision resistance}
\index{Collision}
\begin{defi}[Collision resistance]
  A hash function $h$ is \emph{collision resistant} iff it is computationally infeasible to
  find any two $x \in X$ and $x_2 \in X$ with $x \neq x_2$ such that $h(x) = h(x_2)$.
  Tuple $(x, x_2)$ is called \emph{collision}.
\end{defi}

As far as hash functions accept input strings of arbitrary length, but return a fixed
size output string, existence of collisions is unavoidable~\cite{schlaffer}.
However, good hash functions make it very difficult to find collisions or preimages.

Any digital data can be hashed (i.e. used as input to a hash function) by considering
it in binary representation. The format or encoding is not part of the hash function's
specification.

\subsection{Merkle-Damg\aa{}rd designs}
\label{sec:hash-md}
%
The Merkle-Damg\aa{}rd design is a particular design of hash functions providing the
following security guarantee:

\begin{defi}[Collision resistance inheritance]
  Let $F_0$ be a collision resistant compression function.
  A hash function in Merkle-Damg\aa{}rd design is collision resistant if $F_0$ is collision resistant.
\end{defi}

This motivates thorough research of collisions in compression functions.
The design was found independently by Ralph C. Merkle and Ivan B. Damg\aa{}rd.
It was described by Merkle in his PhD thesis~\cite[p. 13--15]{merkle1979secrecy}
and used in popular hash functions such as MD4, MD5 and the SHA2 hash function family.

The single-pipe design works as follows:
\begin{enumerate}\itemsep0pt
\item Split the input into blocks of uniform block size.
  If necessary, apply padding to the last block to achieve full block size.
\item Compression function $F_0$ is applied iteratively using the output $y_{i-1}$ of
  the previous iteration and the next input block $x_i$, denoted $y_i = F_0(y_{i-1}, x_i)$.
\item An optional postprocessing function is applied.
\end{enumerate}

\subsection{Padding and length extension attacks}
\label{sec:hash-length-ext-attack}
%
Hash functions of single-piped Merkle-Damg\aa{}rd design inherently suffer
from length extension attacks. MD4 and SHA-256 apply padding to their input
to normalize their input size to a multiple of its block size.
The compression function is applied afterwards. This design is vulnerable
to length extensions.

Consider some collision $(x_0, x_1)$ with $F_0(x_0) = y = F_0(x_1)$ where $x_0$ and
$x_1$ have a size of one block. Let $p$ be a suffix with size of one block.
Then also $(x_0 \,\|\, p, x_1 \,\|\, p)$ (where $\|$ denotes concatenation)
represents a collision in single-piped Merkle-Damg\aa{}rd designs, because
it holds that:
\[ F_0(F_0(x_0), p) = F_0(F_0(x_1), p) \iff F_0(y, p) = F_0(y, p) \]
Hence $(x_0 \,\|\, p, x_1 \,\|\, p)$ is a collision as well.
As far as $F_0$ is applied recursively to every block, $p$ can be of arbitrary size
and $(x_0, x_1)$ can be of arbitrary uniform size.

Because of this vulnerability, cryptanalysts focus on finding a collision
in compression functions. In our tests will only consider input of one block
and padding will be neglected due to this vulnerability.

\subsection{Example usage}
\label{sec:hash-usage}
%
The following list describes application examples:
%
\begin{description}
  \item[Digital signatures.]
    Digital signatures are schemes to guarantee data and origin integrity.
    They are used to verify authenticity of PDF~documents,
    encrypted emails or software distributions. A digital signature
    can be verified, showing that a particular user was involved in the
    signature process. No third party can forge a digital signature.
    Because the document itself might be too large, only its hash value
    is signed.
  \item[Storing passwords.]
    User account data such as passwords are commonly stored in databases.
    Those databases are subject to theft if network breaches take place.
    Hashing and salting
    those passwords with a hash algorithm before storing them in the database
    is a working countermeasure.
  \item[Commitment schemes.]
    Commitment schemes like Zero-Knowledge Proofs use hash algorithms to ensure the
    original message is possessed by a certain party without revealing the document
    itself. Coin-flipping or secure computation also use hash algorithms as
    cryptographic building blocks.
\end{description}

% One example showing the use of hash functions as primitives are JSON Web Tokens (JWT)
% specified in RFC~7519~\cite{rfc7519}. Its application allows web developers to
% represent claims to be transferred between two parties.
%
% Section~8 defines implementation requirements and refers to RFC~7518~\cite{rfc7518},
% which specifies cryptographic algorithms such as \enquote{HMAC SHA-256} to be
% implemented. It is (besides \enquote{none}) the only required signature and MAC algorithm.

\section{MD4}
\label{sec:dc-md4}
%
\index{MD4}
MD4 is a cryptographic hash function originally described in RFC~1186~\cite{rfc1186},
updated in RFC~1320~\cite{rfc1320} and declared obsolete by RFC~6150~\cite{rfc6150}. It was
invented by Ronald Rivest in 1990 with properties given in Table~\ref{tab:md4}.
In 1995~\cite{Dobbertin1998}, successful full-round attacks have been found to break collision resistance.
Three years later, preimage and second-preimage resistance in MD4 got broken as well.
Some of those attacks are described in~\cite{md4-2007} and \cite{cryptoeprint:2005:151}.
We derived a Python~3 implementation based on a Python~2 implementation
and made it available on github~\cite{md4-py3k}.

\begin{table}[h]
  \begin{center}
    \begin{tabular}{lcl}
      block size           & 512 bits       & namely variable \texttt{block} in RFC~1320~\cite{rfc1320} \\
      digest size          & 128 bits       & as per Section~3.5 in RFC~1320~\cite{rfc1320} \\
      internal state size  & 128 bits       & namely variables $A$, $B$, $C$ and $D$ \\
      word size            & 32 bits        & as per Section~2 in RFC~1320~\cite{rfc1320} \\
    \end{tabular}
    \caption{MD4 hash algorithm properties}
    \label{tab:md4}
  \end{center}
\end{table}

MD4 uses three auxiliary Boolean functions:
\begin{defi}
  The Boolean \boolf{IF} function is defined as follows:
  If the first argument is true, the second argument is returned.
  Otherwise the third argument is returned.

  The Boolean \boolf{MAJ} function returns true if the number
  of arguments with Boolean value true is in the majority.
  The Boolean \boolf{XOR} function returns true if the number
  of arguments with Boolean value true is odd.
\end{defi}

Using the logical operators $\land$ (\boolf{AND}), $\lor$ (\boolf{OR})
and $\neg$ (\boolf{NEG}) we can define them as (see Section~\ref{sec:sat-intro}
for a thorough discussion of these operators):
\begin{align}
  \IF(X,Y,Z) &\coloneqq (X \land Y) \lor (\neg X \land Z) \\
  \MAJ(X,Y,Z) &\coloneqq (X \land Y) \lor (X \land Z) \lor (Y \land Z) \\
  \XOR(X,Y,Z) &\coloneqq (X \land \neg Y \land \neg Z) \lor (\neg X \land Y \land \neg Z) \nonumber\\
              &\lor (\neg X \land \neg Y \land Z) \lor (X \land Y \land Z) \nonumber\\
              &\coloneqq (X \oplus Y \oplus Z)
\end{align}

In the following, a brief overview of MD4 is given.

\begin{description}
  \item[Padding and length extension.]
    First of all, padding is applied. A single bit $1$ is appended to the
    input. As long as the input does not reach a length congruent 448 modulo 512,
    bit $0$ is appended.
    Afterwards, length appending takes place.
    Append the first 64 less significant bits of the input length (without the previous modifications)
    represented in binary.
  \item[Initialization.]
    The message is split into 512-bit blocks (i.e. 16 32-bit words).
    State variables $A_{i}$ with $-4 \leq i < 0$ are initialized with these
    hexadecimal values:
    % remark: A_{-4} := A, A_{-1} := B, A_{-2} := C, A_{-3} := D on Wikipedia
    \[
      \begin{array}{cccc}
        A_{-4} = \texttt{01234567} &
        A_{-1} = \texttt{89abcdef} &
        A_{-2} = \texttt{fedcba98} &
        A_{-3} = \texttt{76543210}
      \end{array}
    \]
  \item[Round function and state variable updates.]
    The round function
    is applied in 3 rounds with 16 iterations.
    In every iteration, values $A_{-1}$, $A_{-2}$ and $A_{-3}$ are taken
    as arguments to function $F$. Function $F$ is \boolf{IF} in round~1,
    followed by \boolf{MAJ} for round~2 and \boolf{XOR} for the final round~3.
    The resulting value is added to $A_{-1}$, current message block $M$
    and constant $X$. Finally, the 32-bit sum will be left-rotated by $p$
    positions. Left rotation is formally defined in Definition~\ref{def:shifts}.
    We define $X$ and $p$:

    Let $i$ be the iteration counter between $1$ and $16$ and
    $r$ the round between $1$ and $3$. Then $X$ takes the value
    of the $i$-th column and $r$-th row of matrix $C$.
    $p$ takes the value of row $r$ and column $i \bmod{4}$ of matrix $P$.
    \[
      C = \left(\begin{array}{cccccccccccccccc}
        0 & 1 & 2 & 3 & 4 & 5 & 6 & 7 & 8 & 9 & 10 & 11 & 12 & 13 & 14 & 15 \\
        0 & 4 & 8 & 12 & 1 & 5 & 9 & 13 & 2 & 6 & 10 & 14 & 3 & 7 & 11 & 15 \\
        0 & 8 & 4 & 12 & 2 & 10 & 6 & 14 & 1 & 9 & 5 & 13 & 3 & 11 & 7 & 15
      \end{array}\right)
    \] \[
      P = \begin{pmatrix}
        3 & 7 & 9 & 11 \\
        3 & 5 & 9 & 13 \\
        3 & 9 & 11 & 15
      \end{pmatrix}
    \]
    This round function design is visualized in Figure~\ref{fig:md4-round-function}.
\end{description}

\begin{figure}[!b]
  \begin{center}
    \includegraphics[scale=0.7]{img/md4.pdf}
    \caption{MD4 round function updating state variables}
    \label{fig:md4-round-function}
  \end{center}
\end{figure}

\section{SHA-256}
\label{sec:dc-sha-256}
%
\index{SHA-256}
SHA-256 is a hash function from the SHA-2 family designed by the National Security Agency (NSA)
and published as FIPS PUB 180-4 (originally 2001)~\cite{fips-pub-180-4}.
It uses a Merkle-Damg\aa{}rd construction with a Davies-Meyer compression function.
The best known preimage attack was found in 2011
and breaks preimage resistance for 52~rounds~\cite{bicliques}. The best known collision attack
breaks collision resistance for 31~rounds of SHA-256~\cite{improving} and pseudo-collision
resistance for 46~rounds~\cite{high2011}. The best practical attack is a pseudo-collision
for 38 steps~\cite{mendel2013improving}.

\begin{table}[!hb]
  \begin{center}
    \begin{tabular}{lcl}
      block size           & 512 bits   & as per Section~1 of the standard~\cite{fips-pub-180-4} \\
      digest size          & 256 bits   & mentioned as Message Digest size~\cite{fips-pub-180-4} \\
      internal state size  & 256 bits   & as per Section~1 of the standard~\cite{fips-pub-180-4} \\
      word size            & 32 bits    & as per Section~1 of the standard~\cite{fips-pub-180-4}
    \end{tabular}
    \caption{SHA-256 hash algorithm properties}
    \label{tab:sha256}
  \end{center}
\end{table}
%
\index{Left-shift}
\index{Right-shift}
\index{Left-rotation}
\index{Right-rotation}
\begin{defi}[Shifts, rotations and a notational remark]
  \label{def:shifts}
  Consider a 32-bit word $X$ with 32 binary values $b_i$ with $0 \leq i \leq 31$.
  $b_0$ refers to the least significant bit. Shifting ($≪$ and $≫$) and
  rotation ($⋘$ and $⋙$) creates a new 32-bit word $Y$ with 32 binary values $a_i$.
  We define the following notations:
  \begin{align*}
    Y \coloneqq X ≪ n  &\iff a_i \coloneqq b_{i-n} \text{ if } 0 \leq i-n < 32 \text{ and } 0 \text{ otherwise } \\
    Y \coloneqq X ≫ n  &\iff a_i \coloneqq b_{i+n} \text{ if } 0 \leq i+n < 32 \text{ and } 0 \text{ otherwise } \\
    Y \coloneqq X ⋘ n  &\iff a_i \coloneqq b_{i-n \bmod{32}} \text{ as used in MD4} \\
    Y \coloneqq X ⋙ n  &\iff a_i \coloneqq b_{i+n \bmod{32}}
  \end{align*}
\end{defi}
%
Besides MD4's \boolf{MAJ} and \boolf{IF},
another four auxiliary functions are defined. Recognize that $\oplus$ denotes
the \boolf{XOR} function whereas $\boxplus$ denotes 32-bit addition.
\[
  \begin{array}{rcccccl}
    \Sigma_0(X) &\coloneqq& (X ⋙ 2) &\oplus& (X ⋙ 13) &\oplus& (X ⋙ 22) \\
    \Sigma_1(X) &\coloneqq& (X ⋙ 6) &\oplus& (X ⋙ 11) &\oplus& (X ⋙ 25) \\
    \sigma_0(X) &\coloneqq& (X ⋙ 7) &\oplus& (X ⋙ 18) &\oplus& (X ≫ 3) \\
    \sigma_1(X) &\coloneqq& (X ⋙ 17) &\oplus& (X ⋙ 19) &\oplus& (X ≫ 10)
  \end{array}
\]
%
\begin{description}
  \item[Padding and length extension.]
    The padding and length extension scheme of MD4 is used also in SHA-256.
    Append bit $1$, followed by a sequence of bit $0$ until the message reaches a length
    of 448 modulo 512 bits. Afterwards the first 64 bits of the binary representation
    of the original input are appended.
  \item[Initialization.]
    In a similar manner to MD4, initialization of internal state variables
    (called \enquote{working variables} in~\cite[Section~6.2.2]{fips-pub-180-4})
    takes place before running the round function. The eight state variables
    are initialized with the following hexadecimal values:
    \[
      \begin{array}{llll}
        A_{-1} = \texttt{6a09e667} &
        A_{-2} = \texttt{bb67ae85} &
        A_{-3} = \texttt{3c6ef372} &
        A_{-4} = \texttt{a54ff53a} \\
        E_{-1} = \texttt{510e527f} &
        E_{-2} = \texttt{9b05688c} &
        E_{-3} = \texttt{1f83d9ab} &
        E_{-4} = \texttt{5be0cd19}
      \end{array}
    \]
    Furthermore SHA-256 uses 64 constant values in its round function.
    We initialize step constants $K_i$ for $0 \leq i < 64$ with the following hexadecimal
    values (which must be read left to right and top to bottom):
    \[
      \begin{array}{cccccc}
        \texttt{428a2f98} & \texttt{71374491} & \texttt{b5c0fbcf} & \texttt{e9b5dba5} & \texttt{3956c25b} & \texttt{59f111f1} \\
        \texttt{923f82a4} & \texttt{ab1c5ed5} & \texttt{d807aa98} & \texttt{12835b01} & \texttt{243185be} & \texttt{550c7dc3} \\
        \texttt{72be5d74} & \texttt{80deb1fe} & \texttt{9bdc06a7} & \texttt{c19bf174} & \texttt{e49b69c1} & \texttt{efbe4786} \\
        \texttt{0fc19dc6} & \texttt{240ca1cc} & \texttt{2de92c6f} & \texttt{4a7484aa} & \texttt{5cb0a9dc} & \texttt{76f988da} \\
        \texttt{983e5152} & \texttt{a831c66d} & \texttt{b00327c8} & \texttt{bf597fc7} & \texttt{c6e00bf3} & \texttt{d5a79147} \\
        \texttt{06ca6351} & \texttt{14292967} & \texttt{27b70a85} & \texttt{2e1b2138} & \texttt{4d2c6dfc} & \texttt{53380d13} \\
        \texttt{650a7354} & \texttt{766a0abb} & \texttt{81c2c92e} & \texttt{92722c85} & \texttt{a2bfe8a1} & \texttt{a81a664b} \\
        \texttt{c24b8b70} & \texttt{c76c51a3} & \texttt{d192e819} & \texttt{d6990624} & \texttt{f40e3585} & \texttt{106aa070} \\
        \texttt{19a4c116} & \texttt{1e376c08} & \texttt{2748774c} & \texttt{34b0bcb5} & \texttt{391c0cb3} & \texttt{4ed8aa4a} \\
        \texttt{5b9cca4f} & \texttt{682e6ff3} & \texttt{748f82ee} & \texttt{78a5636f} & \texttt{84c87814} & \texttt{8cc70208} \\
        \texttt{90befffa} & \texttt{a4506ceb} & \texttt{bef9a3f7} & \texttt{c67178f2}
      \end{array}
    \]
  \item[Precomputation of W.]
    Let $W_i$ for $0 \leq i < 16$ be the sixteen 32-bit words of the padded input message.
    Then compute $W_i$ for $16 \leq i < 64$ the following way:
    \[ W_i \coloneqq \sigT(W_{i-2}) + W_{i-7} + \sigO(W_{i-15}) + W_{i-16} \]
  \item[Round function.]
    For every block of 512~bits, the round function is applied.
    The eight state variables are updated iteratively for $i$ from 0 to 63.
    $W_i$ and $K_i$ refer to the previously initialized values.
    \begin{align*}
      E_i     &\coloneqq A_{i-4} + E_{i-4} + \SigT(E_{i-1}) + \IF{(E_{i-1}, E_{i-2}, E_{i-3})} + K_i + W_i \\
      A_i     &\coloneqq E_i - A_{i-4} + \SigO(A_{i-1}) + \MAJ{(A_{i-1}, A_{i-2}, A_{i-3})}
    \end{align*}
%   \item[Computation of intermediate hash values.]
%     Intermediate hash values for the Davies-Meyer construction are
%     initialized with the following values:
%     \[
%       \begin{array}{cp{10pt}cp{10pt}cp{10pt}c}
%         H_0^{(0)} \coloneqq A_{-1}  & &  H_1^{(0)} \coloneqq A_{-2}  & &  H_2^{(0)} \coloneqq A_{-3}  & &  H_3^{(0)} \coloneqq A_{-4} \\
%         H_4^{(i)} \coloneqq E_{-1}  & &  H_5^{(i)} \coloneqq E_{-2}  & &  H_6^{(i)} \coloneqq E_{-3}  & &  H_7^{(i)} \coloneqq E_{-4} \\
%       \end{array}
%     \]
%     Every block creates its own $E_{i}$ and $A_{i}$ values for $60 \leq i < 64$.
%     These are used to compute the next intermediate values:
%     \[
%       \begin{array}{lp{10pt}r}
%         H_0^{(j)} \coloneqq A_{63} + H_0^{(i-1)}  & &  H_4^{(j)} \coloneqq E_{63} + H_4^{(i-1)} \\
%         H_1^{(j)} \coloneqq A_{62} + H_1^{(i-1)}  & &  H_5^{(j)} \coloneqq E_{62} + H_5^{(i-1)} \\
%         H_2^{(j)} \coloneqq A_{61} + H_2^{(i-1)}  & &  H_6^{(j)} \coloneqq E_{61} + H_6^{(i-1)} \\
%         H_3^{(j)} \coloneqq A_{60} + H_3^{(i-1)}  & &  H_7^{(j)} \coloneqq E_{60} + H_7^{(i-1)}
%       \end{array}
%     \]
%   \item[Finalization.]
%     The final hash digest of size 256 bits is provided as
%     \[
%       H_0^{(N)} \concat
%       H_1^{(N)} \concat
%       H_2^{(N)} \concat
%       H_3^{(N)} \concat
%       H_4^{(N)} \concat
%       H_5^{(N)} \concat
%       H_6^{(N)} \concat
%       H_7^{(N)}
%     \]
%     where $N$ denotes the index of the last block and operator $\|$ denotes
%     concatenation. Hence $H_0^{(N)}$ are the four least significant bytes of the digest.
\end{description}
\begin{figure}[!ht]
  \begin{center}
    \includegraphics[scale=0.7]{img/sha256.pdf}
    \caption{SHA-256 round function~\cite{analysisSHA256}}
    \label{fig:sha256-round-function}
  \end{center}
\end{figure}


\documentclass[main.tex]{subfiles}
\begin{document}

\marginpar{Monday\\ 2020-10-12, \\ compiled \\ \today}

As we saw last time, inflation provides an ``attractor solution'' to the flatness problem.

We must impose
%
\begin{align}
\frac{1 - \Omega _i^{-1}}{1 - \Omega_0^{-1}} \gtrsim 1
\,
\end{align}
%
in order to solve the flatnesss problem.
Since \(( 1- \Omega^{-1}) \rho a^2\) is a constant, this ratio is equal to
%
\begin{align}
\frac{1 - \Omega _i^{-1}}{1 - \Omega_0^{-1}}
=
\frac{\rho_0 a_0^2}{\rho _i a_i^2}
=
\frac{\rho_0 a_0^2}{\rho _{\text{eq}} a _{\text{eq}}^2}
\frac{{\rho _{\text{eq}} a _{\text{eq}}^2}}{\rho _f a_f^2}
\frac{\rho _f a _f^2}{\rho _i a_i^2}
\,,
\end{align}
%
and since \(\rho \propto a^{-3 (1+w)}\) the term we are considering scales like \(\rho a^2 \propto a^{-(1 + 3w)}\).
Substituting this in, accounting for the fact that the first term is in the matter-dominated epoch while the second is in the radiation-dominated one we have
%
\begin{align}
\frac{1 - \Omega _i^{-1}}{1 - \Omega_0^{-1}}
&=
\qty(\frac{a_0 }{ a _{\text{eq}}})^{-1}
\qty(\frac{a _{\text{eq}}}{a_f})^{-2}
\qty(\frac{a_f}{ a_i})^{-(1 + 3 w_f)}
\\
e^{N \abs{1 + 3 w_f}} &= \frac{1 - \Omega_i^{-1}}{1 - \Omega_0^{-1}} X
\,,
\end{align}
%
where \(w_f\) is the equation of state in the inflationary phase, while
%
\begin{align}
X &= \frac{a_0 }{ a _{\text{eq}}}\qty(\frac{a _{\text{eq}}}{a_f})^2 \\
&\approx 10^{\num{60}}
\,.
\end{align}
% correction by Gio

Then,
%
\begin{align}
e^{N \abs{1 + 3 w_f}} &\gtrsim \underbrace{\frac{1 - \Omega _i^{-1}}{1-\Omega_0^{-1}}}_{\gtrsim 1} X \\
N _{\text{min}} &= \frac{\log X}{\abs{1 + 3 w_f }} \approx 60 \divisionsymbol 70
\,,
\end{align}
%
where we assumed \(w_f \sim -1\). There is some model dependence, specifically regarding the transition from inflation to radiation domination.

It is interesting that this is similar to the number of \(e\)-folds needed to solve the horizon problem.

We can also write the expression, defining \(N = p N _{\text{min}}\), as
%
\begin{align}
1 - \Omega_0^{-1} = \frac{1 - \Omega_i^{-1}}{\exp((p -1) N _{\text{min}} (1 + 3 w_f))}
\,,
\end{align}
%
so, taking \(p = 2\) and \(w_i = -1\) we have
%
\begin{align}
1 - \Omega_0^{-1} = (1 - \Omega _i^{-1} ) e^{-2 N _{\text{min}}} = (1-\Omega _i^{-1}) X^{-1}
\,.
\end{align}

Constraining \(\Omega_0\) allows us to constrain \(\Delta N = N - N _{\text{min}}\).
Right now we have \(\abs{1 - \Omega_0 } < \SI{.4}{\percent}\) (at \SI{95}{\percent} CL) we can say \(\Delta N \gtrsim 5\).

\subsection{The flatness problem as an age problem}

Consider the HBB model, at \(t < t _{\text{eq}}\): the radiation-dominated epoch.

The Planck time, the only characteristic time of the universe a priori, is \(t _{\text{Pl}} \approx \SI{e-43}{s}\).
If the universe is spatially closed, then \(t _{\text{collapse}} = 2 t_m\).
We would expect for the time of collapse to be of the order of the Planck time.

If the universe was spatially open, we would expect that for \(t > t_* \sim t _{\text{Pl}}\) we would have curvature domination: \(a (t)/ a(t _*) \sim t / t_* \).

Therefore, we would have \(t_0 = t _{\text{Pl}} T _{\text{Pl}} / T_0 \sim \SI{e-11}{s}\).

In order for this to not happen, we need the energy density term to finely balance the curvature term in the first Friedmann equation.

\subsection{The unwanted relics problem}

This is also known as the ``magnetic monopoles problem''.
Consider a massive particle \(X\), such that \(\Omega_{0X} \gg 1\).

Typically, \(\Omega_{0X} \sim 1 / \sigma _A\).

Historical examples are cosmic topological defects, arising from the SSB of some gauge theory.
Also, we could have cosmic strings: one-dimensional defects, arising from the SSB of \(U(1)\).
Magnetic monopoles could come from a Grand Unified Theory.

Domain walls (which are 2D) arise from the SSB of discrete symmetries, 3D textures arise from the SSB of \(SU(2)\).
% Correction by Gio here

Other examples of unwanted relics are gravitinos (spin \(3/2\) superpartners of gravitons, with \(m \sim \SI{100}{GeV}\)) or spin-0 \emph{moduli} from superstring theory.

We will explore how these can overclose the universe.
We start with SSB in a cosmological context.
SSB means that the ground state has less symmetry than the full theory.
How do we describe it in the context of an expanding universe?

If go back in time to when the temperature was very high, we expect a restoration of the symmetry.

We start with a lot of symmetry, and as the universe expands we lose it. There are \emph{phase transitions} accompanying this change.

\end{document}