\section{Preliminary phases}
The first set of experiments was partially implemented parallel to model development. This choice allowed us to fully understand each part of the model, and to identify and correct some important errors, not discussed in the previous section. Since the beginning, the main project requirement was to work in limit conditions for the system, in order to analyse each result with respect to the worst case, and determine a lower bound for the system performance. \\

% --- Optical bench
The first thing to do, was to build an optical bench. After many attempts, we made a solid support in which we could fix a laser-camera pair, that allowed us to:
  \begin{itemize}
    \item change the distance between the laser and the camera;
    \item change the triangulation angle, defined as the angle between the optical axis of the camera and the baseline;
    \item change the tilt angle of the lens (only with respect to the $y$ axis)
  \end{itemize}
This first setup was made using a couple of aluminum extrusion profiles, rigidly connected to each other, and a protractor to correctly evaluate the angle of the camera. We used a special case for the camera, that allowed us to set the lens tilt, shielding the sensor from the external light. Furthermore, the case lets to add an interferential filter between the lens and the sensor, cutting all unwanted light frequencies. The laser projection defines a plane parallel to the ground, while the camera looks it from the upside. The accuracy in the distance measurement between the various elements is $1 \, mm$ for the linear distances, and $1 \, degree$ for the angles. The characteristics of the camera and of the laser are shown in Table \ref{tab:conf1}.
  \input{./src/chapters/ch5-Analysis/tab-conf1.tex}

% --- The code
\noindent
The second element we needed, was the software. To perform out test, we realized a simple library, written in \textsc{MatLab} \cite{MATLAB:2017}, that implements a calibration algorithm for \acs{SOL} systems, a way to extract the laser from the acquired images, all subpixel filters, described in Section \ref{sec:laser-peaks}, and some scripts to perform our evaluation. Many of these functions were implemented using the \textsc{Image Processing Toolbox}, but many others were implemented from scratch, in order to deeply analyse each operation. The choice to use \textsc{MatLab} was taken for its speed of prototyping and for the type of mathematical operations we are interested in. \\

% --- Calibration process
Once the bench and the software were ready, we had to calibrate the system, and the algorithm we used was Tsai, described in \cite{TsaiTvLenses}. As we  just said, Tsai takes in input a grid of points, both in sensor and in world reference systems, to perform the calibration. To get these points, we tried to use a 2D checkerboard, placed in a plane consistent with the one of the laser. Our idea was to compare the results of Tsai with those of the calibration algorithm in \textsc{MatLab}. So we used two different checkerboards, one with squares size of $9 \, mm$ (shown in Figure \ref{fig:calib1}) and one with squares size of $29 \, mm$. \\
Unfortunately this approach could not work. First of all, the \textsc{Image Processing Toolbox} needed at least two images of the checkerboard, taken in different positions, but it was impossible for us because of the bond on checkerboard position in the laser plane. Furthermore, we observed that, despite our attention in building the system, the laser plane was not completely parallel to the ground one, that means that the checkerboard didn't lie on the same plane of the laser. This introduced another problem: even if we had used Tsai, calibration points would not have met the reality, and our measures will be lost their meanings. Thus, we understood we needed to extend our model, adding laser compensations described with Equations \ref{eq:radial-compensations}, before converting points from the world to the camera. \\

To solve this problem, we decided to use a 3D reference object, of which we know all dimensions, but this type of calibration is pretty different from the previous one. To build the grid of points for Tsai we have to move the target along all the \acs{FOV} of the camera, and to process each acquired frame in order to determine some points of interests. Hence, the target is mounted on a very precise step motor that we move with known steps. In Figure \ref{fig:calib2} we shown a live acquisition of the target: as we can see it is not perpendicular to the optical axis of the camera, that sees something like the one shown in Figure \ref{fig:calib3}. A simple technique to make the grid that we are interested in, is to locate the corner of the holes, as we shown in Figure \ref{fig:calib4}. To detect these points, we need both the frontal and internal profile of the hole: the points will be the intersection of the two line. If we don't have these two information, the diffraction due to laser engraving on the edge of the hole added to many noise to identify the point correctly. Then, if the target was perpendicular to the camera, the inner side wasn't visible. \\
  \begin{figure}[t!]
    \centering
    \begin{minipage}[c]{.48\textwidth}
      \centering
      \includegraphics[angle=270, origin=c, width=\textwidth]{./images/analysis/checker09.jpg}
      \caption{Calibration checker with size of squares of $9 \, mm$.}
      \label{fig:calib1}
    \end{minipage}
    \hfill
    \begin{minipage}[c]{.48\textwidth}
      \centering
      \includegraphics[angle=270, origin=c, width=\textwidth]{./images/analysis/gage.jpg}
      \caption{3D calibration target. \\ ~}
      \label{fig:calib2}
    \end{minipage}
  \end{figure}

  \begin{figure}[t!]
    \begin{minipage}[c]{.48\textwidth}
      \centering
      \includegraphics[angle=270, origin=c, width=\textwidth]{./images/analysis/laser_profile_over-gage.jpg}
      \caption{Target profile acquired by the camera.}
      \label{fig:calib3}
    \end{minipage}
    \hfill
    \begin{minipage}[c]{.48\textwidth}
      \centering
      \includegraphics[angle=270, origin=c, width=\textwidth]{./images/analysis/laser_profile_over-gage_corner_det.jpg}
      \caption{Keypoint needed fot the calibration phase.}
      \label{fig:calib4}
    \end{minipage}
  \end{figure}
%    \vfill
%    \begin{minipage}[c]{.48\textwidth}
%      \centering
%      \includegraphics[angle=180, origin=c, width=0.7\textwidth]{./images/analysis/grid.jpg}
%      \caption{Final grid}
%      \label{fig:calib5}
%    \end{minipage}
%    \hfill
%    \begin{minipage}[c]{.48\textwidth}
%      \centering
%      \includegraphics[angle=270, origin=c, width=0.7\textwidth]{./images/analysis/laser_profile_over-gage_fitted.jpg}
%      \caption{Keypoint needed fot the calibration phase.}
%      \label{fig:calib6}
%    \end{minipage}

In the process just described, it is important to consider radial distortion of the lens. What we see in Figure \ref{fig:calib3} is not a straight line, as it is in reality, but because of radial distortion it is a parabola. This mistake leads to the construction of a completely erroneous grid. Another effect of target rotation with respect to the optical axis, is the orientation of the world reference system. This is not a problem, but it is used to apply a correction in order to align the $y$ axis with the \acs{FOV} of the camera, as we assumed in Figure \ref{fig:laser-triang-pdv}. \\

\input{./src/chapters/ch5-Analysis/tab-calib-comparison.tex}
In Table \ref{tab:calib-comparison} we compared the results of our implementation of Tsai, with results of a precise implementation, used in industrial systems. The parameters we are interested in are the intrinsic ones. As we can see, the main difference is done by the principal point: in fact, our implementation does not take into account this optimization, so it assumes that the principal point is located in the image center. This is pretty true along the $x$ axis, but not enough along $y$, accordingly with the other version. Furthermore, the difference in focal length is due to the lack of precision of the \textsc{MatLab} optimization functions. \\
As far as extrinsic parameters, however, they depend on the choice of the world reference system that is arbitrarily, thus the sign differences are negligible. From this quick analysis we can concluded not only that our implementation is precise enough for our purposes, but also that the results that we will reach will be a slack lower bounds, that could be improved in real systems implementations. \\


% Template source: University of Florida Department of Physics, https://www.phys.ufl.edu/courses/phy4803L/sample-paper.zip

\documentclass[aps,twocolumn,secnumarabic,nobalancelastpage,amsmath,amssymb,nofootinbib,floatfix,letterpaper]{revtex4}

% Documentclass Options
    % aps, prl, rmp stand for American Physical Society, Physical Review Letters, and Reviews of Modern Physics, respectively
    % twocolumn permits two columns, of course
    % nobalancelastpage doesn't attempt to equalize the lengths of the two columns on the last page
        % as might be desired in a journal where articles follow one another closely
    % amsmath and amssymb are necessary for the subequations environment among others
    % secnumarabic identifies sections by number to aid electronic review and commentary.
    % nofootinbib forces footnotes to occur on the page where they are first referenced
        % and not in the bibliography
    % REVTeX 4 is a set of macro packages designed to be used with LaTeX 2e.
        % REVTeX is well-suited for preparing manuscripts for submission to APS journals.

\usepackage{chapterbib}    % allows a bibliography for each chapter (each labguide has it's own)
\usepackage{color}         % produces boxes or entire pages with colored backgrounds
\usepackage{graphics}      % standard graphics specifications
\usepackage[pdftex]{graphicx}      % alternative graphics specifications
\usepackage{epsf}          % old package handles encapsulated post script issues
\usepackage{bm}            % special 'bold-math' package
\usepackage{verbatim}			% for comment environment
\usepackage[colorlinks=true]{hyperref}  % this package should be added after all others
                                        % use as follows: \url{https://urldefense.proofpoint.com/v2/url?u=http-3A__web.mit.edu_8.13&d=DwICAg&c=sJ6xIWYx-zLMB3EPkvcnVg&r=D88uS55Tats-jlFQAC1XryFUYq8B7Lk3StFbXzgsiB4&m=Vjrc9Wj5n5rkIDMPJ5VsRj2GyXC3yXmN_zDHey6dVio&s=_byqsJfgO464rVIugNWFPmbBeIYfNiJcGS1fgIwc0m4&e= }

\usepackage{subcaption}
\usepackage{siunitx}
\usepackage{textcomp}
\usepackage{gensymb}
\usepackage{tikz}
\usepackage{multirow}
\usepackage{xcolor}

% Graph stuff
\usepackage[utf8]{inputenc}
\usepackage{pgfplots}
\usepgfplotslibrary{groupplots,dateplot}
\usetikzlibrary{patterns,shapes.arrows}
\pgfplotsset{compat=newest}
\usepackage{shellesc}
\usetikzlibrary{external}
\tikzexternalize

% Define colours
\definecolor{darkgreen}{HTML}{228833}

\usepackage[english]{babel}
\usepackage[autostyle, english=american]{csquotes}
\MakeOuterQuote{"}

%\addtolength\topmargin{-.5\topmargin} %cuts the top margin in half.

%
% And now, begin the document...
% Students should not have to alter anything above this line
%

\begin{document}
\title{Lab 2: Determining the Relationship Between Period and Amplitude}
\author{Tyler Tian}
\noaffiliation
\date{\today}

\begin{abstract}
In this experiment, the relationship between the period and amplitude of the pendulum from Lab 1 is determined. The
peaks of the data are found and processed to extract data of period vs. amplitude. A power series is fit to the
period-amplitude data in order to determine the existence and nature of the relationship between the period and
amplitude.

The final relationship between the period and amplitude is determined to be quadratic in nature:
$T(\theta) = (1.63\si{s} \pm 0.05\si{s}) + (0.111\si{s} \pm 0.003\si{s})\theta^2$ The approximation that the period
is constant ($T = 1.662\si{s}$) is determined to be only valid for $|\theta| < 0.79\si{rad}$ or approximately
$45\degree$.
\end{abstract}

\maketitle

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Introduction}

This experiment seeks to determine whether there exists a relationship between the period and amplitude of a pendulum.
From Lab 1, the damped pendulum is modelled as
\begin{equation}
    \theta(t) = \theta_0 e^{-\frac{t}{\tau}}\cos\left(2\pi\frac{t}{T} + \phi_0\right)
    \label{eqn:model}
\end{equation}
where $\theta(t)$ is the angle of the pendulum in radians at time $t$, $\theta_0$ is the initial amplitude at release,
$\tau$ is the time constant of decay, $T$ is the period and $\phi_0$ is the phase shift.

According to this model, there should be no relationship between the period and amplitude of the pendulum. This lab
seeks to confirm this by collecting amplitude-period data over multiple oscillations and trials, and fitting it to power
series of different degrees:
\begin{equation}
    T(\theta) = T_0 + B\theta + C\theta^2 + D\theta^3 + \cdots
    \label{eqn:power_series}
\end{equation}

Then, the values of $B, C, \cdots$ can be used to determine whether a relationship exists.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Method}

\subsection{Changes to Data Collection Methods}

As there were no problems identified in the pendulum setup from the last lab, the main structure of the pendulum was
unmodified. However, to accommodate for faster bob velocities, a few changes were made to the rest of the data
collection methods:

\begin{enumerate}
    \item The reflective tape used to marked the pivot was changed into green masking tape. The reflective tape was
          hard to track as it would have a different brightness and colour depending on the viewing and light angle.
          Masking tape allows for more consistent and more accurate tracking due to its uniform colour.
    \item The framerate was increased to 120fps (from 60fps). The larger amplitudes in this lab lead to larger
          velocities and more motion blur, making the tracking less reliable and less accurate. Increasing the framerate
          reduces motion blur and allows for better tracking, leading to smaller time and angle uncertainties.
    \item The light source was changed to a flood light. The previous light source (ceiling light) was not bright or
          focused enough for reliable tracking. A RYOBI ONE+ LED Work Light was used instead of the ceiling light to
          improve tracking.
\end{enumerate}

\begin{figure}[htb]
    \includegraphics[width=0.75\linewidth]{experiment_setup.jpg}
    \caption{The new experiment setup. The red box marks the location of the phone used to record the experiment.}
\end{figure}

The vision tracking program was unmodified (see Appendix \ref{appendix:code}).

\subsection{Data Processing and Fitting}

To convert from raw time-angle data to amplitude-period data required for this lab, a Python program was used to find
the peaks and valleys of the graph, as shown in Figure \ref{fig:rawdata} (see Appendix \ref{appendix:code}).
Since the data was somewhat noisy, multiple peak points were averaged to find the time of each peak, and the
maximum/minimum of these peak points were taken to find the peak amplitude.

Measuring the period by taking the time for multiple oscillations and dividing by the number of oscillations will reduce
the period uncertainty, but increase the amplitude uncertainty as the amplitude decays more over a longer period of
time. Conversely, taking the time for half an oscillation and then multiplying by 2 increases the period uncertainty but
reduces the amplitude uncertainty as there is now less decay.

Because the $Q$ factor determined from Lab 1 experiment is reasonably large (about $140$), the amplitude does not decay
too much between oscillations, so it is not necessary to measure half-oscillations to reduce the amplitude uncertainty.
The final decision was to measure the period directly using the difference in time between adjacent peaks.

\begin{figure}[htb]
    \begin{tikzpicture}
        \begin{axis}[
            title=Collected Data,
            xlabel=Time (s),
            ylabel=Angle (rad),
            legend entries={Raw Data, Min/Max}
        ]
            \addplot+[
                only marks,
                mark size=1pt,
            ] table [x index=0, y index=1] {trial1_rawdata.txt};
            \addplot+[
                only marks,
                mark size=1.5pt,
            ] table [x index=0, y index=1] {trial1_extrema.txt};
        \end{axis}
    \end{tikzpicture}
    \caption{Zoomed-in view of the first 500 raw data points with the peaks marked.}
    \label{fig:rawdata}
\end{figure}

These are the sources of uncertainty resulting from this method:
\begin{enumerate}
    \item Time (period) uncertainty from the camera: The camera can only capture a set number of frames per second and
          has a nonzero shutter speed. The true peak of an oscillation could lie between two data points, creating an
          uncertainty. An upper bound for this uncertainty can be obtained by taking the time between two frames and
          dividing by 2. At 30 data points per second, this results in an uncertainty of \(\pm 0.02\si{s}\).
          (\textit{Note: while the video was recorded in 120fps to reduce motion blur, the actual rate of data
          collection was only 30 data points/second.})
    \item Period uncertainty from noise in the data and inaccuracies in peak finding: Due to noise in the data,
          sometimes the true peak location is not apparent. The code attempts to correct this by taking the mean of all
          peak candidates. The uncertainty of the mean ($\frac{\sigma}{\sqrt{N}}$) of the peak candidates is used as the
          uncertainty, which is computed individually for each data point as it varies.
    \item Amplitude uncertainty caused by the previous two uncertainties: Since the true peak may lie between two data
          points (as per \textcircled{1}) and is influenced by noise (as per \textcircled{2}), this creates an
          uncertainty. As the exact value of this uncertainty is hard to find, it is assumed to be the same in
          percentage as the larger of the two sources above.
    \item Amplitude uncertainty caused by the decay of the pendulum over one oscillation: The pendulum's amplitude
          decays as it swings, creating an uncertainty. By substituting $t = T$ into the pendulum equation, we obtain
          an exponential term of $e^{-\frac{T}{t}} = e^{-\frac{\pi}{Q}}$. In other words, the amplitude decays by a
          factor of $e^{-\frac{\pi}{Q}}$ per oscillation. The relative change in amplitude is then
          $1 - e^{-\frac{\pi}{Q}}$; by substituting in the $Q$ value obtained in the previous lab (about 140), the
          amount of decay is found to be $2.2\%$, so the uncertainty is \(\pm 2\%\).
\end{enumerate}

Additionally, there may be an amplitude uncertainty resulting from imperfect computer vision tracking, but due to the
improved setup, this can be assumed to be much less than the other sources listed above. Plotting the data points and
uncertainties yields Figure \ref{fig:data1}.

\begin{figure}[htb]
    \begin{tikzpicture}
        \begin{axis}[
            title=Period vs. Amplitude,
            xlabel=Amplitude (rad),
            ylabel=Period (s),
            xmin=-2,
            xmax=2,
        ]
            \addplot+[
                only marks,
                mark size=1pt,
                error bars/.cd,
                    x dir=both,
                    y dir=both,
                    x explicit,
                    y explicit,
            ] table [
                x index=0,
                y index=1,
                x error index=2,
                y error index=3,
            ] {data_with_uncertainties.txt};
        \end{axis}
    \end{tikzpicture}
    \caption{Data points collected from one trial, plotted with uncertainty bars.}
    \label{fig:data1}
\end{figure}

After the data is processed, a Python program (see Appendix \ref{appendix:code}) is used to fit power series of various
degrees (Equation \ref{eqn:power_series}) to the data. Results are shown below.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Observations}

Data points collected from all 5 trials are combined for the fit.
Table \ref{table:fit} shows the optimal parameters resulting from fitting power series of various degrees to the data.
Note that the parameter and uncertainty values in Table \ref{table:fit} are unrounded to allow for later analysis;
refer to later sections for properly rounded values.

The uncertainties in Table \ref{table:fit} take into account both the uncertainties created by the fit and the
uncertainties in the period and amplitude data that carries through, by taking the maximum of the two. The maximum
relative uncertainty for any data point was determined to be 2.95\%.

\begin{table}[h]
    \begin{tabular}{c|c|r|r}
        Degree & Param. & \multicolumn{1}{c|}{Value} & \multicolumn{1}{c}{Max Uncertainty} \\
        \hline
        0                  & $T_0$ & 1.662 & \pm 0.0490 \\
        \hline
        \multirow{2}{*}{1} & $T_0$ & 1.662 & \pm 0.0490 \\
                           & $B$ & -0.00298 & \pm 0.00283 \\
        \hline
        \multirow{3}{*}{2} & $T_0$ & 1.633 & \pm 0.0481 \\
                           & $B$ & 0.00257 & \pm 0.00129 \\
                           & $C$ & 0.1109 & \pm 0.00327 \\
        \hline
        \multirow{4}{*}{3} & $T_0$ & 1.633 & \pm 0.0481 \\
                           & $B$ & 0.00323 & \pm 0.00201 \\
                           & $C$ & 0.1108 & \pm 0.00326 \\
                           & $D$ & -0.000788 & \pm 0.00190 \\
        \hline
        \multirow{5}{*}{4} & $T_0$ & 1.634 & \pm 0.0481 \\
                           & $B$ & 0.00283 & \pm 0.00202 \\
                           & $C$ & 0.1041 & \pm 0.00449 \\
                           & $D$ & -0.000177 & \pm 0.00194 \\
                           & $E$ & 0.00431 & \pm 0.00270 \\
    \end{tabular}
    \caption{Optimal parameters from the fit for various degrees. Note the values and uncertainties are unrounded.}
    \label{table:fit}
\end{table}

Graphs of the fit and residuals are shown for degrees 0 to 2 in Figures \ref{fig:fit} to \ref{fig:residuals2}.
Uncertainty bars are omitted for Figure \ref{fig:fit} to keep the graph readable, since there are too many data points.

\begin{figure*}[t]
    \centering
    \begin{subfigure}{\textwidth}
        \begin{tikzpicture}
            \begin{axis}[
                title=Period vs. Amplitude,
                xlabel=Amplitude (rad),
                ylabel=Period (s),
                xmin=-1.8,
                xmax=1.8,
                xtick distance=0.3,
                legend entries={Collected Data, Degree 0 Fit, Degree 1 Fit, Degree 2 Fit},
                legend style={
                    at={(0.5, 0.98)},
                    anchor=north
                },
                width=\textwidth,
                height=0.5\textwidth,
            ]
                \addplot+[
                    black,
                    mark options={fill=black},
                    only marks,
                    mark size=1pt,
                ] table [x index=0, y index=1] {fit_data.txt};
                \addplot[
                    blue,
                    very thick,
                    domain=-1.6:1.6,
                    samples=3,
                ] {1.662};
                \addplot[
                    red!75!white,
                    very thick,
                    domain=-1.6:1.6,
                    samples=3,
                ] {1.662 - 0.00298*x};
                \addplot[
                    darkgreen,
                    very thick,
                    domain=-1.6:1.6,
                    samples=200,
                ] {1.633 + 0.00257*x + 0.1109*x^2};
            \end{axis}
        \end{tikzpicture}
        \caption{Result of fitting a 0, 1, and 2 degree power series to the data. Error bars are omitted for readability.}
        \label{fig:fit}
    \end{subfigure}
    \begin{subfigure}{0.49\textwidth}
        \begin{tikzpicture}
            \begin{axis}[
                title=Residuals for Degree 0 Fit,
                xlabel=Amplitude (rad),
                ylabel=Period (s),
                extra y ticks={0},
                extra y tick labels={},
                extra y tick style={grid=major}
            ]
                \addplot+[
                    only marks,
                    mark size=1pt,
                    error bars/.cd,
                        x dir=both,
                        y dir=both,
                        x explicit,
                        y explicit,
                ] table [
                    x index=0,
                    y index=1,
                    x error index=2,
                    y error index=3,
                ] {residuals_deg0.txt};
            \end{axis}
        \end{tikzpicture}
        \caption{Residuals from fitting the data to \(T(\theta) = T_0\).}
        \label{fig:residuals0}
    \end{subfigure}
    \begin{subfigure}{0.49\textwidth}
        \begin{tikzpicture}
            \begin{axis}[
                title=Residuals for Degree 2 Fit,
                xlabel=Amplitude (rad),
                ylabel=Period (s),
                extra y ticks={0},
                extra y tick labels={},
                extra y tick style={grid=major},
                yticklabel style={
                    /pgf/number format/precision=3,
                    /pgf/number format/fixed
                }
            ]
                \addplot+[
                    only marks,
                    mark size=1pt,
                    error bars/.cd,
                        x dir=both,
                        y dir=both,
                        x explicit,
                        y explicit,
                ] table [
                    x index=0,
                    y index=1,
                    x error index=2,
                    y error index=3,
                ] {residuals_deg2.txt};
            \end{axis}
        \end{tikzpicture}
        \caption{Residuals from fitting the data to \(T(\theta) = T_0 + B\theta + C\theta^2\).}
        \label{fig:residuals2}
    \end{subfigure}
\end{figure*}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\section{Analysis and Conclusion}

\subsection{Asymmetry}

Asymmetry in the pendulum is indicated by a nonzero coefficient on the odd-powered terms in the series ($B, D, \cdots$).
This is because the odd-powered terms are the only ones with different behaviour for $\theta < 0$ versus $\theta > 0$,
so these terms being nonzero would indicate different behaviour depending on the side that the bob starts on.

From Table \ref{table:fit}, for all the cases where $B$ is a parameter, its value never exceeds more than 2 times its
uncertainty. Furthermore, for most of the fits, $B$ is about or less than 1.5 times its uncertainty, therefore
\(B\) is consistent with zero. Additionally, for all the cases where $D$ is a parameter, its value is always much less
than its uncertainty, so \(D\) is experimentally zero. As both odd terms are consistent with zero, it can be
concluded that \textbf{there is no asymmetry in the pendulum}.

\subsection{Relationship Between Period and Amplitude}

From simply observing Figure \ref{fig:fit}, it is clear that the data forms a distinct pattern that is not
well-approximated by a constant or linear model of $T(\theta)$. Indeed, the value of $C$, the quadratic term, is always
much larger than its uncertainty (always more than $20 \times$).

By examining the residuals of the degree 0 fit in Figure \ref{fig:residuals0}, it is clear that \(T(\theta) = T_0\) is
not a correct model for the data, as there is a clear parabolic pattern in the residuals, with some points having a
residual more than 5 times their uncertainty. On the other hand, the residuals of the degree 2 fit in Figure
\ref{fig:residuals2} exhibit no clear pattern, especially when \(\theta\) is large.

Note there appears to be a pattern resembling a downward parabola in Figure \ref{fig:residuals2} when \(\theta\) is small.
This can be attributed to the discretization of time due to the data collection method. Because angle data is taken 30
times per second, the period has a resolution of \(1/30\si{s}\) without averaging. This is evident in Figure
\ref{fig:fit} as most data points seem to lie on discrete horizontal lines. Despite the pattern, the residual points are
evenly distributed above and below the zero line, indicating a good fit.

Furthermore, the higher-degree terms $D$ and $E$ are both smaller than 2 times their uncertainties, so they are
consistent with zero. This suggests a trend that no matter how many terms are in the equation, the terms with degree
higher than 2 should all be consistent with zero. Additionally, as $B$ is shown to be consistent with zero in the
previous subsection, it can be concluded that the actual $T(\theta)$ has a form of $T(\theta) = T_0 + C\theta^2$, i.e.
\textbf{there exists a quadratic relationship between period and amplitude}.

Rounding the parameters and uncertainties gives the final equation
\begin{equation}
    T(\theta) = (1.63\si{s} \pm 0.05\si{s}) + (0.111\si{s} \pm 0.003\si{s})\theta^2
\end{equation}

\subsection{Valid Range of Constant Period Approximation}

Since the relationship between period and amplitude is actually quadratic in nature, the approximation that
$T(\theta) = T_0$ (i.e. the period is constant) is only valid for small angles where $\theta^2 \approx 0$.

One way of determining when this approximation stops being valid is to see when the period as predicted by the constant
approximation stops being consistent with the period as predicted by the quadratic model. Here "consistent" is defined
as the values differing by no more than 2 uncertainties. Therefore, the valid range of the approximation is
\begin{equation}
    T(\theta) - T_0 \leq 2\epsilon
\end{equation}
where $T(\theta)$ is the quadratic period prediction, $T_0$ is the constant period approximation and $\epsilon$ is the
period error. As most data points have a period uncertainty of $\pm 0.02\si{s}$, substituting this into the equation creates
\begin{equation}
    1.633 + 0.1109\theta^2 - 1.662 \leq 0.04
\end{equation}

Solving this inequality produces the condition $-0.79 \leq \theta \leq 0.79$. In other words, for this pendulum,
\textbf{the constant period approximation is only valid when the absolute amplitude is no more than $0.79\si{rad}$ or
$45\degree$}.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

\appendix

\section{Source Code}

A comprehensive list of all source code, as well as the \LaTeX{} source for this report, can be found on GitHub at
\url{https://github.com/tylertian123/phy180_lab/tree/lab2/}, in particular:
\label{appendix:code}
\begin{enumerate}
    \item Vision tracking program for collecting raw data: \url{https://github.com/tylertian123/phy180_lab/tree/lab2/gendata.py}
    \item Program for finding the peaks of the raw data and collecting period-amplitude data: \url{https://github.com/tylertian123/phy180_lab/tree/lab2/lab2/process_data.py}
    \item Program for fitting the power series: \url{https://github.com/tylertian123/phy180_lab/tree/lab2/lab2/fit.py}
\end{enumerate}

\end{document}


\subsection{Support vectors}

Support vectors are those that make up the classifer boundry.


\documentclass{article}
\usepackage[top=1.0in,bottom=1.0in,left=1.0in,right=1.0in]{geometry}
\usepackage{amsmath,amssymb,amsthm,amsfonts}
\usepackage[utf8]{inputenc}
\usepackage{hyperref}
%\usepackage{graphicx}

\theoremstyle{plain}
\newtheorem{definition}{Definition}[section]
\newtheorem{theorem}{Theorem}[section]
\newtheorem{corollary}{Corollary}[theorem]
\newtheorem{lemma}[theorem]{Lemma}

\theoremstyle{remark}
\newtheorem*{remark}{Remark}

\title{A Report on Seraphis}
\author{coinstudent2048}
\date{\today}

\begin{document}

\maketitle

\begin{abstract}
This document contains a concise description of Seraphis \cite{seraphis}, a novel privacy-preserving transaction protocol abstraction, and its security model. This document will also serve as a suggestion to the organization of the contents of the final Seraphis paper.
\end{abstract}

\section{Introduction}
In a p2p (peer-to-peer) electronic cash system, the entire supply of currency exists as a digital record that can be stored by any person, and transactions (attempts to transfer money to new owners) are mediated by a network of \textit{peers} (usually called \textit{nodes})... ...An unfortunate consequence of cryptocurrencies being decentralized is that the ledger is \textit{public}, implying that all e-notes and transaction events are public knowledge. If amounts are in cleartext, addresses are trivially traceable, and e-notes to be spent are referenced directly, then observers can discern many details about users’ finances.

Hence, several confidential transaction protocols have been proposed to ensure financial privacy and currency fungibility. [List privacy technologies and limitations]
\subsection{Our contribution}
We introduce Seraphis, privacy-preserving transaction protocol abstraction, which means the unlike previous... Moreover...
\subsection{Acknowledgments}
Lelantus Spark

\section{Preliminaries}
\subsection{Public parameters}
Let $\lambda$ be the security parameter. Let $\mathbb{G}$ be a prime order group based on $\lambda$ where the Discrete Logarithm (DL) and Decisional Diffie-Hellman (DDH) problems are hard, and let $\mathbb{F}$ be its scalar field. Let $G, H, X, U$ be generators of $\mathbb{G}$ with unknown DL relationship to each other. Note that these generators may be produced using public randomness. Let $a_{max}\in\mathbb{F}$ (to be used in range proofs) and $s\in\mathbb{N}$ (to be used in membership proofs). Let $\mathcal{H}:\{0,1\}^*\rightarrow\mathbb{F}$ be a cryptographic hash function. We assume that $\mathcal{H}$ is a random oracle, hence we work in the random oracle model. We add a subscript to $\mathcal{H}$, such as $\mathcal{H}_1$, in lieu of domain-separating the hash function explicitly; any domain-separation method may be used in practice. All these public parameters are collected as $pp$, and we now define the setup algorithm: $pp\leftarrow\textsf{Setup}(1^{\lambda})$. $\textsf{Setup}$ is implicitly executed by all players involved in the beginning, hence it can be omitted in protocol descriptions.

The notation $\xleftarrow{\$}$ will be used to denote for a uniformly randomly chosen element, and $(1/x)$ for the modular inverse of $x\in\mathbb{F}$. Lastly, we use additive notation for group operations.

\subsection{E-notes and e-note images}
\begin{definition}\label{e-note}
An \textbf{\em e-note} for scalars $k_a^o, k_b^o, a \in\mathbb{F}$ is a tuple $(C, K^o, m)$ such that $C = x G + a H$ for $x\xleftarrow{\$}\mathbb{F}$, $K^o=k_a^o X + k_b^o U$, and $m$ is an arbitrary data.
\end{definition}
$C$ is called the \textbf{amount commitment} for the amount $a$ with blinding factor $x$, $K^o$ is called the \textbf{one-time address} for (one-time) private key $k_a^o$ and $k_b^o$ (the $o$ superscript indicates ``one-time''), and $m$ is the \textbf{memo field}. We say that someone \textit{owns} an e-note if they know the corresponding scalars $k_a^o, k_b^o, a, x \in\mathbb{F}$.

\begin{definition}\label{e-note-img}
An \textbf{\em e-note image} for an e-note $(C, K^o, m)$ is a tuple $(C', K'^o, \tilde{K})$ such that
\begin{align*}
C' &= t_c G + C \\ &= (t_c+x)G + aH \\ &= v_c G + aH \ , \\
K'^o &= t_k G + K^o \\ &= t_k G + k_a^o X + k_b^o U \ ,\ \text{and} \\
\tilde{K} &= (k_b^o/k_a^o)U
\end{align*}
for $t_c, t_k \xleftarrow{\$}\mathbb{F}$ and independent to each other.
\end{definition}
$C'$ is called the \textbf{masked amount commitment}, $K'^o$ is called the \textbf{masked address}, and $\tilde{K}$ is called the \textbf{linking tag}.

\begin{definition}\label{recv-addr}
A \textbf{\em receiver address} is a tuple $(K^{dh}, K^v, K^s)$  such that $K^{dh}\in\mathbb{G}$, $K^v = k^v K^{dh}$, and $K^s = k_a^s X + k_b^s U$.
\end{definition}
$K^{dh}$ is called the \textbf{Diffie-Hellman base public key}, the $v$ superscript indicates ``view'', and the $s$ superscript indicates ``spend''. The reason for the name of $K^{dh}$ will be clear in the next subsection, while the reason for the names of superscripts will be discussed in the addressing schemes (Subsection \ref{addr-scheme}). We say that someone \textit{owns} a receiver address if they know the corresponding scalars $k^v, k_a^s, k_b^s \in\mathbb{F}$.

\subsection{Authenticated symmetric encryption scheme}
We require the use of an authenticated symmetric encryption scheme. The Diffie-Hellman base public key enables shared secrets between the sender and the receiver, which can be used to produce the key for encryption and the authentication tag. We denote the encryption and decryption of data $x$ with the input $k$ for Key Derivation Function (KDF) as ${\tt enc}[k](x)$ and ${\tt dec}[k](x)$, respectively. We put overlines (e.g. $\overline{x}$) to indicate encrypted data.

The required security properties for application to Seraphis are described in Subsection \ref{sec-symm}.

\section{A Seraphis transaction}\label{ser-tx}
We now describe a simple Seraphis transaction. This will be used as the basis for further instantiations and modifications (Section \ref{inst}) and for the security model (Section \ref{sec}).

Suppose that Alice would send $a_t\in\mathbb{F}$ amount of funds to Bob. Alice owns a set of e-notes $\{(C_i,K_i^o,m_i)\}_{i=1}^n$ with a total amount of $\big(\sum_{i=1}^{n}{a_i}\big)\ge a_t$, all \textit{connected} to a receiver address $(K_{ali}^{dh}, K_{ali}^v, K_{ali}^s)$. This ``connection'' will be elaborated later on. On the other hand, Bob owns a receiver address $(K_{bob}^{dh}, K_{bob}^v, K_{bob}^s)$. For Bob to receive the funds, he will now send his receiver address to Alice. Alice will actually send funds to two addresses: to Bob's and to herself (for the ``change'' $a_{c} = \sum_{i=1}^{n}{a_i} - a_t$ \textit{even if} $a_{c}=0$). Hence, Alice must create 2 new e-notes. She starts the transaction by doing the following:
\begin{enumerate}
    \item Generate $r_{ali}, r_{bob}\xleftarrow{\$}\mathbb{F}$ and independent to each other.
    \item Compute $R_{ali} = r_{ali}K_{ali}^{dh}$ and $R_{bob} = r_{bob}K_{bob}^{dh}$, then store $R_{ali}$ and $R_{bob}$ to new (empty) memos $m_{ali}$ and $m_{bob}$, respectively. The name for $K^{dh}$ should now be clear.
    \item Compute the sender-receiver shared secrets $q_c = \mathcal{H}_1(r_{ali}K_{ali}^{v})$ and $q_t = \mathcal{H}_1(r_{bob}K_{bob}^{v})$.
    \item Compute the one-time addresses $K_{ali}^o = \mathcal{H}_2(q_c)X + K_{ali}^s$ and $K_{bob}^o = \mathcal{H}_2(q_t)X + K_{bob}^s$. The $\mathcal{H}_2(q_c)$ and $\mathcal{H}_2(q_t)$ are uniformly random because of $r_{ali}, r_{bob}$, and random oracle $\mathcal{H}$.
    \item Compute the amount commitments $C_{ali} = \mathcal{H}_3(q_c)G + a_c H$ and $C_{bob} = \mathcal{H}_3(q_t)G + a_t H$. The blinding factors $\mathcal{H}_3(q_c)$ and $\mathcal{H}_3(q_t)$ are uniformly random because of $r_{ali}, r_{bob}$, and random oracle $\mathcal{H}$.
    \item Encrypt the amounts: $\overline{a_c} = {\tt enc}[q_c](a_c)$ and $\overline{a_t} = {\tt enc}[q_t](a_t)$, and store $\overline{a_c}$ and $\overline{a_t}$ to memos $m_{ali}$ and $m_{bob}$, respectively.
\end{enumerate}
Alice now has two new e-notes: ${\tt enote}_{ali} = (C_{ali}, K_{ali}^o, m_{ali})$ and ${\tt enote}_{bob} = (C_{bob}, K_{bob}^o, m_{bob})$. These will then be stored to a new (empty) \textit{whole transaction} $T$. Other objects that will be stored to the whole transaction are from proving systems, which can be executed in \textit{any} order. Proving systems are discussed in the next subsections.

For specific instances of Seraphis, there might be changes in some parts of the above steps, and by reflection, in some parts of the Receipt. Here are some notable changes:
\begin{itemize}
\item For some addressing schemes (Subsection \ref{addr-scheme}), the input to $\mathcal{H}_2$, the input to $\mathcal{H}_3$, and the key for both ${\tt enc}$ and ${\tt dec}$ may be constructed differently and different to each other. Nevertheless, these inputs and key must be random sender-receiver shared secrets.
\item A Seraphis transaction can easily have multiple receivers aside from Bob, which implies that Alice will create more than 2 new e-notes. This technically breaks the privacy property described in Subsection \ref{sec-thm}. However, the same property guarantees that the number of receivers would be the \textit{only} break. % See Subsection \ref{sec-disc} for a discussion of how this affects the security model.
\item A Seraphis transaction can be collaboratively constructed by multiple players. This is the subject of the so-called ``proof dependency'', which will be discussed in Subsection \ref{proof-dep}). % Also see Subsection \ref{sec-disc} for a discussion of how this affects the security model.
\end{itemize}

\subsection{Ownership and unspentness proofs}\label{own-unsp}
For each of Alice's owned e-notes $\{(C_i,K_i^o,m_i)\}_{i=1}^n$, Alice must do the following:
\begin{enumerate}
    \item If the masked address $K_i'^o$ is already in the e-note image ${\tt enimg}_i$ in $T$, then go to next step. Else generate $K_i'^o$ from $(C_i, K_i^o, m_i)$ as per definition, and insert it to ${\tt enimg}_i$ in $T$.
    \item If the linking tag $\tilde{K}_i$ is already in ${\tt enimg}_i$ in $T$, then go to next step. Else generate $\tilde{K}_i$ from $(C_i, K_i^o, m_i)$ as per definition, and insert it to ${\tt enimg}_i$ in $T$.
    \item Prepare the proof transcript $\Pi_{\text{o\&u}, i}$ for a non-interactive proving system for the following relation:
$$\{(G, X, U, K_i'^o, \tilde{K}_i\in\mathbb{G}; t_{k,i}, k_{a,i}^o, k_{b,i}^o\in\mathbb{F}): k_{a,i}^o \ne 0 \wedge K_i'^o = t_{k,i} G + k_{a,i}^o X + k_{b,i}^o U \wedge \tilde{K}_i = (k_{b,i}^o/k_{a,i}^o)U \}$$
    \item Append $\Pi_{\text{o\&u}, i}$ to $({\tt enimg}_i, \ldots)$ in $T$.
\end{enumerate}
Aside from verifying the proof transcript, the Verifier must confirm that the linking tags do not yet appear in the ledger.

The required security properties for application to Seraphis are described in Subsection \ref{prov-prop}. We also introduce a \textit{composition proving system} in which instead of one $\Pi_{\text{o\&u}, i}$ per $i$ (as presented above), Alice only needs to produce one proof transcript for all $i$'s. We present this in Appendix \ref{comp-prov}, and provide proof that it satisfies the required security requirements.

\subsection{Amount balance}\label{amt-bal}
For each of Alice's owned e-notes $\{(C_i,K_i^o,m_i)\}_{i=1}^n$, Alice must do the following:
\begin{enumerate}
    \item If the masked amount commitment $C_i'$ is already in ${\tt enimg}_i$ in $T$, then exit this subsection. Else generate $C_i'$ from $(C_i, K_i^o, m_i)$ as per definition. Then compute the difference:
    $$D = d_a G + d_b H = C_{ali}+C_{bob} - \sum_{i=1}^n{C_i'}$$
    Note that $d_a$ is uniformly random because of $t_c$ and random oracle $\mathcal{H}$, while $d_b$ is a publicly known extra amount (e.g. transaction fee).
    \item Insert $C_i'$ to ${\tt enimg}_i$ in $T$, and store $(d_a, d_b)$ to $T$.
\end{enumerate}
The generation of $v_{c,n}$ is as such so that the Verifier can verify the amount balance $\sum_{i=1}^n{C_i'} + D = C_{ali}+C_{bob}$.

\subsection{Membership proofs}\label{mem}
For each of Alice's owned e-notes $\{(C_i,K_i^o,m_i)\}_{i=1}^n$, Alice must do the following:
\begin{enumerate}
    \item If the masked amount commitment $C_i'$ is already in ${\tt enimg}_i$ in $T$, then go to next step. Else generate $C_i'$ from $(C_i, K_i^o, m_i)$ exactly like in Step 1 of Subsection \ref{amt-bal}, and insert it to ${\tt enimg}_i$ in $T$.
    \item If the masked address $K_i'^o$ is already in ${\tt enimg}_i$ in $T$, then go to next step. Else generate $K_i'^o$ from $(C_i, K_i^o, m_i)$ as per definition, and insert it to ${\tt enimg}_i$ in $T$.
    \item Collect $s-1$ number of random e-notes from the ledger and add her owned $(C_i,K_i^o,m_i)$, for a total of $s$ e-notes. The number $s$ is called the \textbf{anonymity size}.
    \item For each e-note in the collection (of size $s$), extract only the amount commitment and one-time address like this: $(C_j, K_j^o)$. Then arrange the $s$ e-notes in random positions. Alice now has an array (of length $s$) of pairs: $\mathbb{S}_i = \{(C_j, K_j^o)\}_{j=1}^s$, which is called the \textbf{ring}. Its elements $(C_j, K_j^o)$ are called the \textbf{ring members}.
    \item Prepare the proof transcript $\Pi_{\text{mem}, i}$ for a non-interactive proving system for the following relation:
$$\{(G, C_i', K_i'^o \in\mathbb{G}, \mathbb{S}_i\subset\mathbb{G}^2; \pi_i\in\mathbb{N}, t_{c,i}, t_{k,i}\in\mathbb{F}): 1\le\pi_i\le s \wedge C_i' - C_{\pi_i} = t_{c,i} G \wedge K_i'^o - K_{\pi_i}^o = t_{k,i} G \}$$
    \item Append $(\mathbb{S}_i, \Pi_{\text{mem}, i})$ to $({\tt enimg}_i, \ldots)$ in $T$.
\end{enumerate}
Aside from verifying the proof transcript, the Verifier must confirm that all the collected e-notes in rings appear in the ledger.

The required security properties for application to Seraphis are described in Subsection \ref{prov-prop}. Specific proving systems satisfying the requirement include CSAG (CLSAG \cite{clsag} without linking) and One-out-of-Many proving system adapted from Groth and Bootle \textit{et al.} \cite{groth, bootle}.

We also introduce an alternative to the above proving relation that allows for relatively simpler and more efficient proof structures. We call it the \textit{squashed e-note model}. We present this in Appendix \ref{squashed} and provide proof that it satisfies the required security requirements.

\subsection{Range proofs}\label{range}
For the new e-notes ${\tt enote}_{ali}$ and ${\tt enote}_{bob}$, Alice must do the following:
\begin{enumerate}
    \item Prepare the respective proof transcript $\Pi_{\text{ran}, ali}$ and $\Pi_{\text{ran}, bob}$ for a non-interactive proving system for the following relation:
$$\{(G, H, C \in\mathbb{G}, a_{max}\in\mathbb{F}; x, a\in\mathbb{F}): C = x G + a H \wedge 0\le a \le a_{max}\}$$
	where $a_{max}$ is the maximum e-note amount.
    \item Store $\Pi_{\text{ran}, ali}$ and $\Pi_{\text{ran}, bob}$ to $T$.
\end{enumerate}

The required security properties for application to Seraphis are described in Subsection \ref{prov-prop}. Specific proving systems satisfying the requirement include Bulletproofs \cite{bp} and Bulletproofs+ \cite{bp-plus}.

\subsection{Receipt}
Once the construction of $T$ is completed, Alice sends it to the network. Its contents must now be
$$T=({\tt enote}_{ali}, {\tt enote}_{bob}, \Pi_{\text{ran}, ali}, \Pi_{\text{ran}, bob}, d_a, d_b, \{({\tt enimg}_i, \Pi_{\text{o\&u}, i}, \mathbb{S}_i, \Pi_{\text{mem}, i})\}_{i=1}^n).$$
We denote the full construction of $T$ as the function ${\tt tx}(\cdot)$. This function would be used for describing Seraphis security properties (Subsection \ref{sec-thm}).

Suppose that the Verifier accepts $T$, hence $T$ is now stored in the ledger. When Bob scans the ledger for new transactions, he must do the following for every $T$ he encounters:
\begin{enumerate}
    \item Get a new e-note $(C, K^o, m)$ in $T$. Note that $m$ contains $(R, \overline{a})$ (see the beginning of this whole section).
    \item Compute the nominal sender-receiver shared secret: $q_{nom} = \mathcal{H}_1(k_{bob}^v R)$.
    \item Compute the nominal spend public key: $K_{nom}^s = K^o - \mathcal{H}_2(q_{nom})X$. If $K_{nom}^s = K_{bob}^s$, then the e-note is \textit{connected} to Bob's receiver address, and proceed to the next step (this is the ``connection'' hinted at the beginning of this whole section).  Otherwise (if not equal), the e-note is not connected, and hence go to Step 1.
    \item Decrypt the amount: $a = {\tt dec}[q_{nom}](\overline a)$.
    \item Compute the nominal amount commitment: $C_{nom} = \mathcal{H}_3(q_{nom})G + a H$. If $C_{nom} \ne C$, then the e-note is malformed and cannot be spent.
    \item Compute the nominal linking tag: $\tilde{K}_{nom} = (k_{b, bob}^s/(k_{a, bob}^s + \mathcal{H}_2(q_{nom})))U$. If he finds a copy of $\tilde{K}_{nom}$ in the ledger, then the e-note has already been spent.
\end{enumerate}
If an e-note $(C, K^o, m)$ is connected to Bob's receiver address, then he knows the corresponding scalars of that e-note: $(k_a^o, k_b^o, a, x) = (k_{a, bob}^s + \mathcal{H}_2(q_{nom}), k_{b, bob}^s, a, \mathcal{H}_3(q_{nom}))$. Hence, ``connection'' implies e-note ownership. The transaction is complete for Bob.

For Alice to receive the change e-note, she must do the same above steps. After that, the transcation is complete for Alice. This finishes a Seraphis trancation.

\section{Instantiations and Modifications}\label{inst}
There are a number of details to consider when implementing Seraphis in a real cryptocurrency. Aside from instances of proving systems mentioned already in the previous section, this section is comprised of `recommendations' for instantiations and modifications of other parts of Seraphis, which are inspired by historical privacy-focused cryptocurrency implementations.

\subsection{Addressing schemes}\label{addr-scheme}
\subsection{Multisignature operations}
\subsection{Proof dependency}\label{proof-dep}
\subsubsection*{Transaction Chaining}
\subsection{Transaction fees}
\subsection{Coinbase transactions}
\subsection{?????}

\section{Security model}\label{sec}
For a start, we assume that the distributed ledger is immutable. Therefore, the adversary in our analysis will never be able to modify transactions already stored in the ledger. This ledger immutability can be actualized through, for instance, the Nakamoto consensus protocol \cite{bitcoin}.

Subsections \ref{prov-prop} to \ref{Comm} outline the required security properties of the cryptographic components for Seraphis, and then Subsection \ref{sec-thm} is the main security analysis of Seraphis. % and Subsection \ref{sec-disc} discusses how some instantiations and modifications described in Section \ref{inst} affect the security analysis.

\subsection{Proving systems security properties}\label{prov-prop}
We define a proving system as a tuple $(\textsf{Setup}, \mathcal{P}, \mathcal{V})$. $\textsf{Setup}$ is the setup algorithm: $pp\leftarrow\textsf{Setup}(1^{\lambda})$, and $\mathcal{P}$ and $\mathcal{V}$ are $\textsf{PPT}$ algorithms called \textbf{Prover} and \textbf{Verifier}, respectively. We denote the \textit{transcript} (all data being sent and received in the protocol) produced by $\mathcal{P}$ and $\mathcal{V}$ when dealing with inputs $x$ and $y$ as $tr\leftarrow\langle\mathcal{P}(x), \mathcal{V}(y)\rangle$. Once the transcript is produced, we denote the final transcript verification done by an algorithm $\mathcal{X}$ as $\mathcal{X}(tr)=1$ for accepted transcript and $\mathcal{X}(tr)=0$ for rejected.

Let $\mathcal{R}$ be an NP (polynomial-time verifiable) relation of the form $\{(x,w):P(x, w)\}$ where $x$ is the \textit{statement}, $w$ is the \textit{witness}, and $P$ is a predicate of $x$ and $w$. Then ``$(\textsf{Setup}, \mathcal{P}, \mathcal{V})$ is a proving system for the relation $\mathcal{R}$'' informally means that when $\mathcal{P}$ gives an $x$ to $\mathcal{V}$, $\mathcal{P}$ must convince $\mathcal{V}$ that it knows a $w$ such that $(x,w)\in\mathcal{R}$ by generating $tr\leftarrow\langle\mathcal{P}(pp, x, w), \mathcal{V}(pp, x)\rangle$ that $\mathcal{V}$ accepts.

Here are the \textit{minimal} needed security properties of proving systems for Seraphis:

\begin{definition}[Perfect Completeness]
$(\emph{\textsf{Setup}}, \mathcal{P}, \mathcal{V})$ is perfectly complete for $\mathcal{R}$ if for all $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$,
\begin{align*}
\emph{\textsf{Pr}}\left[
\begin{array}{c|c}
    \begin{gathered}
        (x,w)\in\mathcal{R}\\
        \wedge\ \mathcal{V}(tr) = 0
    \end{gathered}
    &
    \begin{gathered}
        pp\leftarrow\emph{\textsf{Setup}}(1^{\lambda}); (x, w)\leftarrow\mathcal{A}(pp); \\
        tr\leftarrow\langle\mathcal{P}(pp,x,w), \mathcal{V}(pp,x)\rangle
    \end{gathered}
\end{array}
\right]
= 0.
\end{align*}
\end{definition}

\begin{definition}[Computational Soundness]
$(\emph{\textsf{Setup}}, \mathcal{P}, \mathcal{V})$ is computationally sound for $\mathcal{R}$ if for all $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$, there exists a negligible function $\emph{\textsf{negl}}(\lambda)$ such that
\begin{align*}
\emph{\textsf{Pr}}\left[
\begin{array}{c|c}
    \begin{gathered}
        (x,w)\not\in\mathcal{R}\\
        \wedge\ \mathcal{V}(tr) = 1
    \end{gathered}
    &
    \begin{gathered}
        pp\leftarrow\emph{\textsf{Setup}}(1^{\lambda}); (x, w)\leftarrow\mathcal{A}(pp); \\
        tr\leftarrow\langle\mathcal{A}(pp,x,w), \mathcal{V}(pp,x)\rangle
    \end{gathered}
\end{array}
\right]
\le \emph{\textsf{negl}}(\lambda).
\end{align*}
\end{definition}

There is another notion of soundness called \textit{Special Soundness}. For a proving system to be special sound, there must exist a \textit{witness extractor} that has an ability to ``rewind time'' and make the Prover answer several different challenges, and it must be able to extract a witness given the several accepted transcripts with the Prover. Because of this, proving systems satisfying special soundness are called \textit{Proofs of Knowledge}. Special soundness is a stronger notion of soundness, hence this already implies computational soundness.

\begin{definition}[Witness Indistinguishability]
	$(\emph{\textsf{Setup}}, \mathcal{P}, \mathcal{V})$ is witness indistinguishable for $\mathcal{R}$ if for all $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$, there exists a negligible function $\emph{\textsf{negl}}(\lambda)$ such that
	\begin{align*}
		\left| \frac{1}{2} - \emph{\textsf{Pr}}\left[
		\begin{array}{c|c}
			\begin{gathered}
				b' = b
			\end{gathered}
			&
			\begin{gathered}
				pp\leftarrow\emph{\textsf{Setup}}(1^{\lambda}); (x, w_0, w_1)\leftarrow\mathcal{A}(pp); \\
				b\xleftarrow{\$}\{0,1\}; tr\leftarrow\langle\mathcal{P}(pp,x,w_b), \mathcal{V}(pp,x)\rangle; \\
				b'\leftarrow\mathcal{A}(tr)
			\end{gathered}
		\end{array}
		\right]\right|
		\le\emph{\textsf{negl}}(\lambda)
	\end{align*}
	where $\mathcal{A}(pp)$ always outputs $(x,w_0,w_1)$ such that $(x,w_0)\in\mathcal{R}\wedge(x,w_1)\in\mathcal{R}$.
\end{definition}

Witness indistinguishability is weaker \cite{groth} than the following more well-known property:
\begin{definition}[Perfect Special HVZK]
$(\emph{\textsf{Setup}}, \mathcal{P}, \mathcal{V})$ is perfectly special honest-verifier zero knowledge (HVZK) for $\mathcal{R}$ if there exists a $\emph{\textsf{PPT}}$ simulator $\mathcal{S}$ such that for all $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$,
\begin{align*}
\emph{\textsf{Pr}}\left[
\begin{array}{c|c}
    \begin{gathered}
        (x,w)\in\mathcal{R}\\
        \wedge\ \mathcal{A}(tr) = 1
    \end{gathered}
    &
    \begin{gathered}
        pp\leftarrow\emph{\textsf{Setup}}(1^{\lambda}); (x, w, \rho)\leftarrow\mathcal{A}(pp); \\
        tr\leftarrow\langle\mathcal{P}(pp,x,w), \mathcal{V}(pp,x; \rho)\rangle
    \end{gathered}
\end{array}
\right] \\
=\emph{\textsf{Pr}}\left[
\begin{array}{c|c}
    \begin{gathered}
        (x,w)\in\mathcal{R}\\
        \wedge\ \mathcal{A}(tr) = 1
    \end{gathered}
    &
    \begin{gathered}
        pp\leftarrow\emph{\textsf{Setup}}(1^{\lambda}); (x, w, \rho)\leftarrow\mathcal{A}(pp); \\
        tr\leftarrow\mathcal{S}(pp, x, \rho)
    \end{gathered}
\end{array}
\right]
\end{align*}
where $\rho$ is the public randomness used by $\mathcal{V}$.
\end{definition}

Fiat-Shamir heuristic \cite{fiat-shamir} is applied to make interactive proving systems non-interactive. Moreover, it transforms interactive protocols satisfying HVZK into non-interactive (fully) zero-knowledge (NIZK) protocols in the random oracle model.

All proving systems for application to Seraphis must \textit{at least} have perfect completeness,  computational soundness, and witness indistinguishability. However, it is better for proving systems to satisfy the stronger properties, special soundness and perfect special HVZK.

\subsection{Authenticated symmetric encryption scheme}\label{sec-symm}
We require that the authenticated symmetric encryption scheme must at least have the following properties: indistinguishable against adaptive chosen-ciphertext attack (IND-CCA2) and key-private under chosen-ciphertext attacks (IK-CCA). These properties are defined in the Appendix A.4 of \cite{omniring}.

\subsection{Commitment schemes}\label{Comm}

We define a commitment scheme as a tuple $(\textsf{Setup}, \textsf{Comm})$. $\textsf{Setup}$ is the setup algorithm: $pp\leftarrow\textsf{Setup}(1^{\lambda})$, and $\textsf{Comm}:\mathcal{M}\times{\chi}\rightarrow\mathcal{C}$ is the $\textit{commitment function}$, where $\mathcal{M}$ is the message space, $\chi$ is the randomness space, and $\mathcal{C}$ is the commitment space. Note that $\mathcal{M}, \chi$ and $\mathcal{C}$ are all constructed from $pp$.
To commit to a message $m \in M$, the sender selects $r\xleftarrow{\$}\chi$ and computes the commitment $C = \textsf{Comm}(m; r)$. We define the required security properties of commitment schemes.

\begin{definition}[Hiding Property]
A commitment scheme $(\emph{\textsf{Setup}}, \emph{\textsf{Comm}})$ is computationally hiding if for all $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$, there exists a negligible function $\emph{\textsf{negl}}(\lambda)$ such that
\begin{align*}
\left| \frac{1}{2} - \emph{\textsf{Pr}}\left[
\begin{array}{c|c}
    \begin{gathered}
        b' = b
    \end{gathered}
    &
    \begin{gathered}
        pp\leftarrow\emph{\textsf{Setup}}(1^{\lambda}); (m_0, m_1)\leftarrow\mathcal{A}(pp); \\
        b\xleftarrow{\$}\{0,1\}; r \xleftarrow{\$}\chi; \\
        C = \emph{\textsf{Comm}}(m_b; r); b'\leftarrow\mathcal{A}(C)
    \end{gathered}
\end{array}
\right]\right|
\le \emph{\textsf{negl}}(\lambda).
\end{align*}
\end{definition}
A commitment scheme is \textit{perfectly hiding} if $\textsf{negl}(\lambda)$ is replaced by $0$.

\begin{definition}[Binding Property]
A commitment scheme $(\emph{\textsf{Setup}}, \emph{\textsf{Comm}})$ is computationally binding if for all $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$, there exists a negligible function $\emph{\textsf{negl}}(\lambda)$ such that
\begin{align*}
\emph{\textsf{Pr}}
\left[
\begin{array}{c|c}
    \begin{gathered}
         \emph{\textsf{Comm}}(m_0;r_0) \\
        = \emph{\textsf{Comm}}(m_1;r_1) \\
        \wedge\ m_0 \ne m_1
    \end{gathered}
    &
    \begin{gathered}
        pp\leftarrow\emph{\textsf{Setup}}(1^{\lambda}); \\
        (m_0,m_1,r_0,r_1)\leftarrow\mathcal{A}(pp)
    \end{gathered}
\end{array}
\right]
\le \emph{\textsf{negl}}(\lambda).
\end{align*}
\end{definition}
A commitment scheme is \textit{perfectly binding} if $\textsf{negl}(\lambda)$ is replaced by $0$.

\noindent The first kind of commitment we define is commonly known as \textbf{Pedersen commitments} \cite{pedersen}. We define two instances, $\textsf{PedersenC}:\mathbb{F}\times\mathbb{F}\rightarrow\mathbb{G}$ and $\textsf{PedersenK}:\mathbb{F}\times\mathbb{F}\rightarrow\mathbb{G}$ as follows:
\begin{align*}
\textsf{PedersenC}(a; x) &= x G + a H \\
\textsf{PedersenK}(k_b^o;k_a^o) &= k_a^o X + k_b^o U
\end{align*}
$\textsf{PedersenC}$ corresponds to the structure of amount commitment $C$ and masked amount commitment $C'$, while $\textsf{PedersenK}$ corresponds to the structure of one-time address $K^o$.
\begin{theorem}[From \cite{pedersen}]\label{thm-pedersen}
Pedersen commitment is perfectly hiding and computationally binding under the DL assumption.
\end{theorem}

\noindent Then we define a custom commitment $\textsf{LinkTag}:\mathbb{F}\setminus\{0\}\times\mathbb{F}\times\mathbb{F}\rightarrow\mathbb{G}\times\mathbb{G}$ as follows:
\begin{align*}
\textsf{LinkTag}(k_a^o, k_b^o; t_k) = (t_k G + k_a^o X + k_b^o U, (k_b^o/k_a^o)U)
\end{align*}
$\textsf{LinkTag}$ corresponds to structure of the combination of masked address $K'^o$ and linking tag $\tilde{K}$.

\begin{theorem}\label{thm-linktag}
$\emph{\textsf{LinkTag}}$ is perfectly hiding and computationally binding under the DL assumption.
\end{theorem}
\noindent We prove this in Appendix \ref{proofs}.

\subsection{Seraphis security properties}\label{sec-thm}
The required security properties for Seraphis are based on Omniring's security model \cite{omniring}, with modifications to fit Seraphis. The Omniring paper presents a rigorous treatment of RingCT constructions, providing precision for security analysis against several realistic attacks. However, we will not be fully formal in this presentation: we may treat algorithms such as $\mathcal{A}$ like \textit{agents}. For instance, we may simply write ``$\mathcal{A}$ outputs $x_1$ and $x_2$'' instead of ``we run a part of $\mathcal{A}$ twice to get outputs $x_1$ and $x_2$''.

It is important to note that the properties in Subsection \ref{prov-prop} are the \textit{minimal} requirements, thus the properties presented in this subsection are the \textit{weakest}. Because of Seraphis's modularity, stronger properties for proving systems must yield stronger properties for Seraphis. The `logic' of proofs for the theorems in this subsection, found in Appendix \ref{proofs}, can serve a guide for proving stronger properties.

Lastly, note that the mentioned proving systems in the theorems are in their ``original'' interactive versions. As Fiat-Shamir heuristic produces full zero-knowledge which is stronger than HVZK (in the random oracle model), the theorems should also apply to the non-interactive protocols transformed through the heuristic.

The first security property is \textbf{Completeness} (called \textit{Correctness} in Omniring), which means that if an e-note appears on the ledger, then its owner can honestly generate an accepted transaction spending it. Seraphis satisfying completeness immediately follows from the completeness properties of the cryptographic components and by inspection of the protocol description.

Next we consider the \textbf{Balance} property, which means that a spender adversary should never be able to spend more amounts than it truly owns, hence preventing double-spending. Balance property involves an experiment $\textsf{BAL}(\mathcal{A}, 1^{\lambda})$  on a $\textsf{PPT}$ adversary $\mathcal{A}$. The adversary succeeds in the experiment (i.e. $\textsf{BAL}(\mathcal{A}, 1^{\lambda})=1$) if it managed to generate an accepted transaction such that 1) some of spent e-notes are supposedly owned by others 2) some of spent e-note one-time private keys are \textit{not equal} to what is originally given to him, leading to a double-spend of same e-notes under different linking tags, or 3) the amount of the new e-note for the receiver is \textit{larger} than the supposed total amount of e-notes it owns.

\begin{figure}[htbp]
\centering
\fbox{\begin{minipage}{0.85\textwidth}
\underline{$\textsf{BAL}(\mathcal{A}, 1^{\lambda})$}
\begin{itemize}
\item $pp\leftarrow\textsf{Setup}(1^{\lambda})$.
\item $\mathcal{A}$ is provided random $k^v, k_a^s, k_b^s\in\mathbb{F}$ to construct the address ${\tt addr}_{\mathcal{A}} = (K_{\mathcal{A}}^{dh}, K_{\mathcal{A}}^v, K_{\mathcal{A}}^s)$, $\{(k_{a,i}^o, k_{b,i}^o, a_i, x_i)\}_{i=1}^n$ that makes ${\tt addr}_{\mathcal{A}}$ connect to ${\tt enote}_{\mathcal{A}}=\{(C_i,K_i^o,m_i)\}_{i=1}^n$ in the ledger, and some other e-notes ${\tt enote}_{\neg\mathcal{A}}$ \textit{not} connected to ${\tt addr}_{\mathcal{A}}$.
\item $\mathcal{A}$ chooses any receiver address ${\tt addr}_{\mathcal{B}}$.
\item $\{(k_{a,i}'^o, k_{b,i}'^o, a'_i, x'_i)\}_{i=1}^n \leftarrow\mathcal{A}(pp, {\tt enote}_{\mathcal{A}}, {\tt enote}_{\neg\mathcal{A}}, \{(k_{a,i}^o, k_{b,i}^o, a_i, x_i)\}_{i=1}^n)$.
\item $T\leftarrow{\tt tx}(pp, {\tt addr}_{\mathcal{A}}, {\tt addr}_{\mathcal{B}}, {\tt enote}_{\mathcal{A}}, {\tt enote}_{\neg\mathcal{A}}, \{(k_{a,i}'^o, k_{b,i}'^o, a'_i, x'_i)\}_{i=1}^n)$. $\mathcal{A}$ spends $n$ e-notes in ${\tt enote}_{\mathcal{A}} \cup {\tt enote}_{\neg\mathcal{A}}$ to send an amount $a_t$ to ${\tt addr}_{\mathcal{B}}$.
\item $b_0:=1$ if Verifier accepts $T$, else $:=0$.
\item $b_1:=1$ if some spent e-notes in $T$ are from ${\tt enote}_{\neg\mathcal{A}}$, else $:=0$.
\item $b_2:=1$ if $\exists i\in\{1,\ldots,n\}: k_{b,i}'^o / k_{a,i}'^o \ne k_{b,i}^o / k_{a,i}^o$, else $:=0$.
\item $b_3:=1$ if $\sum_{i=1}^n{a_i} < a_t$, else $:=0$.
\item Return $b_0 \wedge (b_1 \vee b_2 \vee b_3)$.
\end{itemize}
\end{minipage}}
\caption{Balance experiment $\textsf{BAL}$}
\label{exp-bal}
\end{figure}

\begin{definition}[Balance]
Seraphis is balanced if for all $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$, there exists a negligible function $\emph{\textsf{negl}}(\lambda)$ such that
\begin{align*}
\emph{\textsf{Pr}}
\left[
\emph{\textsf{BAL}}(\mathcal{A}, 1^{\lambda})=1
\right]
\le \emph{\textsf{negl}}(\lambda).
\end{align*}
where $\emph{\textsf{BAL}}$ is described in Figure \ref{exp-bal}.
\end{definition}
\begin{theorem}[Balance]\label{thm-bal}
If $\emph{\textsf{PedersenC}}$ and $\emph{\textsf{PedersenK}}$ are both binding, and all proving systems are (computational) sound, then Seraphis is balanced.
\end{theorem}
Next we consider the \textbf{Privacy} property, which means that an adversary should never be able to detect the spender, receiver, and amounts in any transaction, hence providing sender and receiver anonymity, and confidential transfer of amounts. Privacy property involves an experiment $\textsf{PRV}(\mathcal{A}, 1^{\lambda})$ on a $\textsf{PPT}$ adversary $\mathcal{A}$. In the experiment, it is as if $\mathcal{A}$ itself ``sent'' amounts to the two potential senders, hence $\mathcal{A}$ is provided the sender addresses, the e-notes themselves, and the private scalars of the amount commitment $C$ in those e-notes. Given a whole transaction $T$, the adversary succeeds in the experiment if it can guess the sender, the receiver, or the amount of the new e-note for the receiver, hence breaking the privacy of $T$.

\begin{figure}[htbp]
\centering
\fbox{\begin{minipage}{0.85\textwidth}
\underline{$\textsf{PRV}(\mathcal{A}, 1^{\lambda})$}
\begin{itemize}
\item $pp\leftarrow\textsf{Setup}(1^{\lambda})$.
\item $\mathcal{A}$ is provided two random potential sender addresses ${\tt send}_0$ and ${\tt send}_1$, sets of e-notes ${\tt enote}_0$ and ${\tt enote}_1$ (with $|{\tt enote}_0|=|{\tt enote}_1|=n$) connected to ${\tt send}_0$ and ${\tt send}_1$ respectively, private scalars of $C$, $\{(x_{0, i}, a_{0, i})\}_{i=1}^n$ and $\{(x_{1, i}, a_{1, i})\}_{i=1}^n$, of each e-note in ${\tt enote}_0$ and ${\tt enote}_1$, respectively, and two random potential receiver addresses ${\tt recv}_0$ and ${\tt recv}_1$.
\item $\mathcal{A}$ constructs $\{\mathbb{S}_i\}_{i=1}^n$ such that each $\mathbb{S}_i$ contains one e-note in ${\tt enote}_0$ and one e-note in ${\tt enote}_1$.
\item $\mathcal{A}$ chooses any valid amount the potential senders would send: $0 \le a_{\mathcal{A}, 0} \le \sum_{i=1}^n{a_{0, i}}$ and $0 \le a_{\mathcal{A}, 1} \le \sum_{i=1}^n{a_{1, i}}$ for ${\tt send}_0$ and ${\tt send}_1$, respectively.
\item $b\xleftarrow{\$}\{0,1\}$.
\item $T\leftarrow{\tt tx}(pp, {\tt send}_b, {\tt recv}_b, {\tt enote}_b, \{\mathbb{S}_i\}_{i=1}^n, a_{\mathcal{A}, b})$. The owner of ${\tt send}_b$ honestly spends all e-notes in ${\tt enote}_b$ (which are also in $\{\mathbb{S}_i\}_{i=1}^n$) to send the amount $a_{\mathcal{A}, b}$ to ${\tt recv}_b$.
\item If Verifier rejects $T$, then return $0$.
\item $b'\leftarrow\mathcal{A}(pp, T, \{( {\tt send}_j, {\tt recv}_j, \{(x_{j, i}, a_{j,i})\}_{i=1}^n, a_{\mathcal{A},j})\}_{j\in \{0,1\}})$.
\item Return $1$ if $b = b'$, else $0$.
\end{itemize}
\end{minipage}}
\caption{Privacy experiment $\textsf{PRV}$}
\label{exp-prv}
\end{figure}

\begin{definition}[Privacy]
Seraphis is private if for all $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$, there exist a negligible function $\emph{\textsf{negl}}(\lambda)$ such that
\begin{align*}
\emph{\textsf{Pr}}
\left[
\emph{\textsf{PRV}}(\mathcal{A}, 1^{\lambda})=1
\right]
\le \emph{\textsf{negl}}(\lambda).
\end{align*}
where $\emph{\textsf{PRV}}$ is described in Figure \ref{exp-prv}.
\end{definition}
\begin{theorem}[Privacy]\label{thm-prv}
If $\emph{\textsf{PedersenC}}$, $\emph{\textsf{PedersenK}}$, and $\emph{\textsf{LinkTag}}$ are all hiding, ownership and unspentness proof and range proof are both perfect special HVZK, membership proof is witness indistinguishable, and authenticated symmetric encryption scheme is IND-CCA2 and IK-CCA, then Seraphis is private.
\end{theorem}

Lastly, we consider the \textbf{Non-slanderability} property, which means that an adversary should never be able to forge a linking tag of an honest user's e-notes when those are spent. Non-slanderability property involves an experiment $\textsf{NSLAND}(\mathcal{A}, 1^{\lambda})$ on a $\textsf{PPT}$ adversary $\mathcal{A}$. This property prevents the following attack known as \textit{denial-of-spending attack} \cite{denial-of-spend}: the adversary is in a remote note that can receive transactions, and also acts as a verifier of a victim transaction $T$. This means that $\mathcal{A}$ can see the linking tags in $T$. $\mathcal{A}$ then temporarily blocks $T$ from entering the ledger, creates a new transaction $T'$ that matches some linking tags in $T$, and enters $T'$ first in the ledger before finally entering $T$. This way $T$ is marked as a double-spend, and some e-notes of the victim sender are now unspendable. Now the adversary succeeds in the experiment if it successfully accomplished a denial-of-spending attack.

\begin{figure}[htbp]
\centering
\fbox{\begin{minipage}{0.85\textwidth}
\underline{$\textsf{NSLAND}(\mathcal{A}, 1^{\lambda})$}
\begin{itemize}
\item $pp\leftarrow\textsf{Setup}(1^{\lambda})$.
\item $\mathcal{A}$ is provided random $k^v, k_a^s, k_b^s\in\mathbb{F}$ to construct the address ${\tt addr}_{\mathcal{A}} = (K_{\mathcal{A}}^{dh}, K_{\mathcal{A}}^v, K_{\mathcal{A}}^s)$, and ${\tt enote}_{\mathcal{A}}=\{(C_i,K_i^o,m_i)\}_{i=1}^n$ in the ledger connected to ${\tt addr}_{\mathcal{A}}$.
\item $\mathcal{A}$ chooses any receiver address ${\tt addr}_{\mathcal{B}}$.
\item Let ${\tt addr}_{\mathcal{C}}$ be the random victim address, ${\tt addr}_{\mathcal{D}}$ be another random address, and ${\tt enote}_{\mathcal{C}}$ be all the e-notes in the ledger connected to ${\tt addr}_{\mathcal{C}}$.
\item $T\leftarrow{\tt tx}(pp, {\tt addr}_{\mathcal{C}}, {\tt addr}_{\mathcal{D}}, {\tt enote}_{\mathcal{C}})$. The owner of ${\tt addr}_{\mathcal{C}}$ honestly spends all e-notes in ${\tt enote}_{\mathcal{C}}$ to send some amounts to ${\tt addr}_{\mathcal{D}}$. Let $\{\tilde{K}_{\mathcal{C}}\}$ be all the linking tags in $T$.
\item $\mathcal{A}$ is provided $T$ and verifies it honestly. If $\mathcal{A}$ rejects $T$, then return 0.
\item $\{(k_{a,i}'^o, k_{b,i}'^o)\}_{i=1}^n \leftarrow\mathcal{A}(pp, {\tt enote}_{\mathcal{A}}, T)$.
\item $T'\leftarrow{\tt tx}(pp, {\tt addr}_{\mathcal{A}}, {\tt addr}_{\mathcal{B}}, {\tt enote}_{\mathcal{A}}, \{(k_{a,i}'^o, k_{b,i}'^o)\}_{i=1}^n)$. $\mathcal{A}$ spends all e-notes in ${\tt enote}_{\mathcal{A}}$ to send some amounts to ${\tt addr}_{\mathcal{B}}$. Let $\{\tilde{K}_{\mathcal{A}}\}$ be all the linking tags in $T'$.
\item $b_0:=1$ if Verifier accepts $T'$, else $:=0$
\item $b_1:=1$ if $\{\tilde{K}_{\mathcal{A}}\}\cap \{\tilde{K}_{\mathcal{C}}\}\ne\emptyset$, else $:=0$
\item Return $b_0 \wedge b_1$.
\end{itemize}
\end{minipage}}
\caption{Non-slanderability experiment $\textsf{NSLAND}$}
\label{exp-nsland}
\end{figure}

\begin{definition}[Non-slanderability]
Seraphis is non-slanderable if for all $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$, there exist a negligible function $\emph{\textsf{negl}}(\lambda)$ such that
\begin{align*}
\emph{\textsf{Pr}}
\left[
\emph{\textsf{NSLAND}}(\mathcal{A}, 1^{\lambda})=1
\right]
\le \emph{\textsf{negl}}(\lambda).
\end{align*}
where $\emph{\textsf{NSLAND}}$ is described in Figure \ref{exp-nsland}.
\end{definition}
\begin{theorem}[Non-slanderability]\label{thm-nsland}
If $\emph{\textsf{PedersenK}}$ is hiding, $\emph{\textsf{LinkTag}}$ is hiding and binding, ownership and unspentness proof and membership proof are sound and witness indistinguishable, then Seraphis is non-slanderable.
\end{theorem}
Because of the binding property of $\textsf{LinkTag}$ (for e-note images in both $T$ and $T'$), non-slanderability already captures that an adversary should never be able to forge an accepted transaction of another honest user, a property known as \textbf{Unforgeability}. Hence there is no need to formally define and prove an unforgeability property.

% \subsection{Discussions}\label{sec-disc}

\section{Efficiency}

\bibliographystyle{plain}
\bibliography{seraphis}

\appendix

\section{Composition proving system}\label{comp-prov}
The composition proving system is a protocol for the relation:
\begin{multline*}
\Big\{\big(G, X, U\in\mathbb{G}, \{K_i\}_{i=1}^n, \{K_{t1,i}\}_{i=1}^n, \{\tilde{K}_i\}_{i=1}^n \in\mathbb{G}^n; \{x_i\}_{i=1}^n, \{y_i\}_{i=1}^n, \{z_i\}_{i=1}^n \in\mathbb{F}^n\big): \\ \bigwedge_{i=1}^n{\big(y_i \ne 0 \wedge K_i = x_i G + y_i X + z_i U \wedge K_{t1,i} = (1/y_i)K_i \wedge \tilde{K}_i = (z_i/y_i)U\big)} \Big\}
\end{multline*}
Now the Prover only needs to produce one proof transcript for all $i$'s instead of one proof transcript for each $i$. This protocol is based on the concise approach from \cite{clsag} to reduce proof sizes when constructing multiple proofs in parallel. Notice the extra $\{K_{t1,i}\}_{i=1}^n$ in the relation. This should not affect the proving system's applicability for ownership and unspentness proof because all $y_i$'s are still hidden in $K_{t1,i}$ (by the DL assumption) and the required relationships for $\{K_i\}_{i=1}^n$ and $\{\tilde{K}_i\}_{i=1}^n$ are still proven.

The protocol proceeds as follows:
\begin{enumerate}
\item The Prover generates $\alpha_a, \alpha_b, \alpha_i \xleftarrow{\$}\mathbb{F}\ ,\ \forall i\in\{1,\ldots,n\}$. The Prover computes $(A_a, A_b) = (\alpha_a G, \alpha_b U)$ and $A_{i}=\alpha_i K_i\ ,\ \forall i\in\{1,\ldots,n\}$, and sends $(A_a, A_b, \{A_i\}_{i=1}^n)$ to the verifier.
\item Both the Prover and Verifier compute $K_{t2,i} = K_{t1,i} - X - \tilde{K}_i\ ,\ \forall i\in\{1,\ldots,n\}$.
\item The Verifier sends a challenge $c\xleftarrow{\$}\mathbb{F}$ and random scalars $\mu_a,\mu_b\xleftarrow{\$}\mathbb{F}$ to the Prover.
\item The Prover computes the responses:
\begin{align*}
r_{a} &= \alpha_a - c \sum_{i=1}^{n}{\mu_a^{i-1} (x_i/y_i)} \\
r_{b} &= \alpha_b - c \sum_{i=1}^{n}{\mu_b^{i-1}(z_i/y_i)} \\
r_{i} &= \alpha_i - c (1/y_i)\ ,\ \forall i\in\{1,\ldots,n\}\\
\end{align*}
and sends those values to the Verifier.
\item The Verifier checks the following equalities. If any of them fail, then the Prover has failed to satisfy the composition proof system.
\begin{align*}
A_{a} &= r_a G + c \sum_{i=1}^{n}{\mu_a^{i-1} K_{t2,i}} \\
A_{b} &= r_b U + c \sum_{i=1}^{n}{\mu_b^{i-1} \tilde{K}_i} \\
A_{i} &= r_i K_i + c K_{t1,i}\ ,\ \forall i\in\{1,\ldots,n\}\\
\end{align*}
\end{enumerate}
We now prove that the protocol is perfectly complete, computationally sound, and perfectly special honest-verifier zero knowledge, all if $G$, $X$, and $U$ are mutually independent.

\begin{proof}
For perfect completeness, note that $\forall i\in\{1,\ldots,n\}$, knowledge of $(x_i/y_i$, $z_i/y_i$, $1/y_i)$ is also enough to satisfy the proving relation, and
\begin{align*}
K_{t2,i} &= K_{t1,i} - X - \tilde{K}_i \\ &= (1/y_i)(x_i G + y_i X + z_i U) - X - (z_i/y_i)U \\
&= (x_i/y_i)G + X + (z_i/y_i) U - X - (z_i/y_i)U \\ &= (x_i/y_i)G.
\end{align*}
Then the property follows from inspection.

For perfect special HVZK, we construct a simulator producing accepted transcripts with probability distribution identical to the probability distribution of legitimate accepted transcripts by Prover and Verifier. The simulator generates $c, \mu_a, \mu_b, r_a, r_b, r_i \xleftarrow{\$}\mathbb{F}\ ,\ \forall i\in\{1,\ldots,n\}$. Then the simulator computes $A_{a}, A_{b}, \{A_{i}\}_{i=1}^n$ exactly according to Step 5 of the protocol description. Because of this last step, the Verifier will accept the simulated transcript. Now assume that $G$, $X$, and $U$ are mutually independent. Observe that the simulated transcript is uniformly random because $c, \mu_a, \mu_b, r_a, r_b, \{r_i\}_{i=1}^n$ are uniformly randomly selected. On the other hand, observe that a legitimate accepted transcript between Prover and Verifier is also uniformly random because the Prover's $\alpha_a, \alpha_b, \{\alpha_i\}_{i=1}^n$ and the Verifier's $c, \mu_a, \mu_b$ are all uniformly randomly selected. Hence the two probability distributions are identical.

For computational soundness under the DL assumption, the proof is by contraposition. Suppose that a $\textsf{PPT}$ adversarial prover $\mathcal{A}$ \textit{not} knowing a witness, can produce an accepted transcript $$(A_a, A_b, \{A_i\}_{i=1}^n,c, \mu_a, \mu_b, r_a, r_b, \{r_i\}_{i=1}^n)$$ with an honest verifier with non-negligible probability. From the third equation in Step 5, $\forall i\in\{1,\ldots,n\}$:
\begin{align*}
A_{i} &= r_i K_i + c K_{t1,i} \\
\implies\alpha_i K_i &= r_i K_i + c (1/y_i)K_i \\
\implies\alpha_i &= r_i + c(1/y_i) \\
\implies(1/y_i) &= (\alpha_i - r_i)(1/c)
\end{align*}
Hence solving the discrete log (DL) problem for $K_{t1,i} = (1/y_i)K_i$ with non-negligible probability. Note that $\alpha_i$ and $(1/y_i)$ must always exist because $\mathbb{G}$ is of prime order which implies that any non-zero point is a generator.
\end{proof}

\begin{remark}
Since only computational soundness is proven for this protocol, this cannot be called a proof of knowledge.
\end{remark}

Applying Fiat-Shamir heuristic to the composition proving system should be straightforward. Note that the $c$, $\mu_a$ and $\mu_b$ are generated through domain separation of hash function $\mathcal{H}$.

\section{Squashed e-note model}\label{squashed}
The following definitions are only applicable in membership proofs.
\begin{definition}\label{sq-e-note}
The \textbf{\em squashed e-note} for e-note $(C, K^o, m)$ is a pair $(Q, m)$ such that $Q = \mathcal{H}_4(C, K^o) K^o + C$, and $m$ is the same memo field.
\end{definition}
\begin{definition}\label{sq-e-note-img}
A \textbf{\em squashed e-note image} for e-note image $(C', K'^o, \tilde{K})$ is a pair $(Q', \tilde{K})$ such that $Q' = \mathcal{H}_4(C, K^o) K'^o + C'$, and $\tilde{K}$ is the same linking tag.
\end{definition}

Going back to Step 4 of Subsection \ref{mem}, each e-note in the collection (of size $s$) are converted to squashed e-notes, and extract only the $Q$'s. Then arrange the $s$ e-notes in random positions. Alice now has an array (of length $s$): $\mathbb{Q}_i = \{Q_j\}_{j=1}^s$, which is called the \textbf{squashed ring}. On the other hand, the e-note image for the true spent e-note is converted to squashed e-note image.

The squashed e-note model is the following proving relation for $\Pi_{\text{mem}, i}$:
$$\{(G, Q'_i \in\mathbb{G}, \mathbb{Q}_i\subset\mathbb{G}; C_i, K_i^o \in \mathbb{G}, \pi_i\in\mathbb{N}, t_{c,i}, t_{k,i}\in\mathbb{F}): 1\le\pi_i\le s \wedge Q'_i - Q_{\pi_i} = ( \mathcal{H}_4(C_i, K_i^o) t_{k,i} + t_{c,i}) G \}$$

The benefit of this specialization compared to the original membership proof model is you only need to prove knowledge of one discrete logarithm rather than two. Now for analysis of this specialization, we prove the following three properties which are described informally:
\begin{enumerate}
\item It is impossible to find an input e-note such that the output of the transformation is \textit{not} in the above new proving relation.
\item It is difficult for a $\textsf{PPT}$ adversary $\mathcal{A}$ to find an element of the above new proving relation if $\mathcal{A}$ does \textit{not} know the input e-note.
\item The above new proving relation does not leak any private information of the input e-note.
\end{enumerate}
\begin{proof}
The first property immediately follows from inspection of the above transformation. The third property immediately holds because the private keys of $C$ and $K^o$ are still perfectly hidden (as those are Pedersen commitments) when producing $Q$ and $Q'$. Lastly, for the second property: [UNFINISHED].
\end{proof}

\section{Proofs of some theorems in Section \ref{sec}}\label{proofs}
We first present another hardness assumption which will be helpful for the next proof. This assumption is used in Bulletproofs \cite{bp} and Bulletproofs+ \cite{bp-plus}:

\begin{definition}[Discrete Logarithm Relation Assumption]
DL Relation assumption holds relative to $\emph{\textsf{Setup}}$ if for all $n \ge 2$ and  $\emph{\textsf{PPT}}$ adversary $\mathcal{A}$, there exists a negligible function $\emph{\textsf{negl}}(\lambda)$ such that
\begin{align*}
\emph{\textsf{Pr}}\left[
\begin{array}{c|c}
	\begin{gathered}
		\exists i \in \{1, \ldots, n\}: x_i \ne 0 \\
		\wedge \sum_{i=1}^{n} x_i G_i = 0
	\end{gathered}
	&
	\begin{gathered}
		(\mathbb{G}, \mathbb{F})\leftarrow\emph{\textsf{Setup}}(1^{\lambda}); \\
		\{G_i\}_{i=1}^n \xleftarrow{\$}\mathbb{G}; \\
		\{x_i\}_{i=1}^n \leftarrow\mathcal{A}(\mathbb{G}, \mathbb{F}, \{G_i\}_{i=1}^n) \\
	\end{gathered}
\end{array}
\right]
\le \emph{\textsf{negl}}(\lambda).
\end{align*}
\end{definition}
It is said in \cite{bp} and \cite{bp-plus} that this assumption and the DL assumption are equivalent.

\begin{proof}[Proof of Theorem \ref{thm-linktag}]
Perfect hiding follows from the proof of perfect hiding of Pedersen commitments because the blinding factor $t_k$ is only used in one of the pair output: the one corresponding to $K'^o$.

Since $t_k$ can be any scalar, the restriction of $\tilde{K}$ for $k_a^o, k_b^o$ is not enough to make $\textsf{LinkTag}$ perfectly binding. Now we prove computational binding by contraposition. By breaking the binding of $\textsf{LinkTag}$, $\mathcal{A}$ finds $(k_a^o, k_b^o, t_k)$ and $(k_a'^o, k_b'^o, t'_k)$ such that the two are \textit{not} equal and $\textsf{LinkTag}(k_a^o, k_b^o; t_k) = \textsf{LinkTag}(k_a'^o, k_b'^o; t'_k)$. This implies that
$$(t_k - t'_k) G + (k_a^o - k_a'^o) X + (k_b^o - k_b'^o) U = 0$$
and this breaks the DL relation assumption of $G, X, U \in \mathbb{G}$.
\end{proof}
\begin{proof}[Proof of Theorem \ref{thm-bal}]
We prove by contraposition. Assume that $\mathcal{A}$ succeeds in the $\textsf{BAL}$ experiment with non-negligible probability. There are three cases as to \textit{why} $\mathcal{A}$ succeeded, each with sub-cases: $b_0 \wedge b_1 = 1$, $b_0 \wedge b_2 = 1$, or $b_0 \wedge b_3 = 1$.

For the first case, assume that $b_0 \wedge b_1 = 1$. One sub-case is that $\mathcal{A}$ finds correct private scalars of $C$ and $K^o$ in some e-notes in ${\tt enote}_{\neg\mathcal{A}}$, but this breaks the binding property of $\textsf{PedersenC}$ and $\textsf{PedersenK}$. Another sub-case is that $\mathcal{A}$ doesn't have correct private scalars of $C$ and $K^o$, yet $\mathcal{A}$ can non-negligibly create accepted proofs. For $C$, this breaks the [UNFINISHED]**. For $K^o$, this breaks the [UNFINISHED]**. Hence for all sub-cases, at least one supposed property of a cryptographic construction is broken.

For the second case, assume that $b_0 \wedge b_2 = 1$. One sub-case is that there exists $i\in\{1,\ldots,n\}$ such that $(k_{b,i}^o, k_{a,i}) \ne (k_{b,i}^o, k_{a,i})$. The two must produce unequal linking tags because the $(k_b^o, k_a^o)$ that satisfy both the equations for $K^o$ and $\tilde{K}$ is unique. However, the inequality means that $(k_{b,i}^o, k_{a,i}^o)$ and $( k_{b,i}'^o, k_{a,i}'^o)$ break the binding property of $\textsf{PedersenK}$. Another sub-case is that $( k_{a,i}'^o, k_{b,i}'^o, t'_{k,i})$ does \textit{not} satisfy proving relations involving those values, yet $\mathcal{A}$ can non-negligibly create accepted proofs, but this breaks the soundness property of ownership and unspentness proof, and therefore, of membership proof**. Hence for all sub-cases, at least one supposed property of a cryptographic construction is broken.

For the third case, assume that $b_0 \wedge b_3= 1$. One sub-case is that the new e-notes are constructed honestly and amount balance $\sum_{i=1}^n{C_i'} = C_c + C_t - D$ (where $C_c$ is the ``change'' e-note) is satisfied, but $\sum_{i=1}^n{a_i} < a_t$. This implies that there exists $i\in\{1,\ldots,n\}$ such that $C'_i = v_{c,i} G + a_i H = v'_{c,i} G + a'_i H$ (where $v'_{c,i}\in\mathbb{F}$ is also found by $\mathcal{A}$) \textit{and} $a'_i > a_i$. Thus $( v_{c,i}, a_i)$ and $(v'_{c,i}, a'_i)$ breaks the binding property of $\textsf{PedersenC}$. Another sub-case is that $\mathcal{A}$ can non-negligibly create an accepted range proof for the amount $a$ committed in new e-note such that $C \ne x G + a H$ or $\neg (0 \le a \le a_{max})$, but this breaks the soundness property of range proof. Hence for all sub-cases, at least one supposed property of a cryptographic construction is broken.
\end{proof}
\begin{proof}[Proof of Theorem \ref{thm-prv}]
Assume that $\mathcal{A}$ succeeds in the $\textsf{PRV}$ experiment with non-negligible probability. There are three cases, each with sub-cases: the sender is distinguished, the receiver is distinguished, or the sent amount is distinguished.

For the first case, assume that $\mathcal{A}$ distinguished the sender. One sub-case is that $\mathcal{A}$ determined the $k_b^o = k_b^s$ that $K'^o$ and $\tilde{K}$ hide, but this breaks the hiding property of $\textsf{LinkTag}$. Another sub-case is that the proving systems leak parts of witness that are related to the sender, like $\pi$, the index of true spent e-note in a ring, or $k_b^o$ in e-note images, but this breaks the witness indistinguishability of ownership and unspentness proof and membership proof. Hence for all sub-cases, at least one supposed property of a cryptographic construction is broken.

For the second case, assume that $\mathcal{A}$ distinguished the receiver. One sub-case is that $\mathcal{A}$ found $q_t$. Now $q_t$ can be found in two ways. One is via $C_t$ of new e-note in $\texttt{recv}_b$, but this breaks the random oracle property of  $\mathcal{H}$, DL assumption of $\mathbb{G}$, and requires determining $a_{\mathcal{A},b}$, which will be discussed in the third case. Another way is via determining the encryption key of $\overline{a_t}$, but this breaks the IK-CCA property of authenticated symmetric encryption scheme. From just $q_t$, $\mathcal{A}$ can get $K^s$ because $K^o - \mathcal{H}_2(q_t)X = K^s$ in new e-note. Now with $\mathcal{H}^{-1}(q_t) = r K^{v}$, $\mathcal{A}$ may find $K^v$ because of $r$, but this breaks $\mathcal{H}$ and the randomness of $r$. Still with $\mathcal{H}^{-1}(q_t)$ and now with $R = r K^{dh}$ in the memo of new e-note, $\mathcal{A}$ may also deduce $K^v$, but this breaks $\mathcal{H}$ and the DDH assumption of $\mathbb{G}$. Another sub-case is that $\mathcal{A}$ determined that the $K^o$ of new e-note hides $k_a^s, k_b^s$, but this breaks the hiding property of $\textsf{PedersenK}$. Hence for all sub-cases, at least one supposed property of a cryptographic construction is broken.

For the third case, assume that $\mathcal{A}$ distinguished the sent amount. One sub-case is that $\mathcal{A}$ determined that the $C_t$ of new e-note hides $a_{\mathcal{A}, b}$, but this breaks the hiding property of $\textsf{PedersenC}$. Another sub-case is that $\mathcal{A}$ recognized in $T$ that $C'_i - t_{c, i}G = x_{b,i}G + a_{b,i}H$ for some $i \in \{1, \ldots, n\}$, but this breaks the randomness of $t_c$. Another subcase is that the proving systems leak parts of witness that are related to amounts, but this breaks the witness indistinguishability of range proof and membership proof. Moreover, leaking $t_c$ from membership proof leads to the previous case. The last subcase is that $\mathcal{A}$ can non-negligibly decrypt $\overline{a_{\mathcal{A},b}}$ without correct key, but this breaks the IND-CCA2 property of authenticated symmetric encryption scheme. Hence for all sub-cases, at least one supposed property of a cryptographic construction is broken.
\end{proof}
\begin{proof}[Proof of Theorem \ref{thm-nsland}]
Assume that $\mathcal{A}$ succeeds in the $\textsf{NSLAND}$ experiment with non-negligible probability. The first step of $\mathcal{A}$ is to get the discrete logarithm $k_i$ of some $\tilde{K}_i \in \{\tilde{K}_{\mathcal{C}}\}$ (base $U$), and the second step of $\mathcal{A}$ is to find $(k_{a,i}'^o, k_{b,i}'^o, t'_{k,i})$ (for e-note image in $T'$) such that $k_{b,i}'^o/k_{a,i}'^o = k_i$, making $\tilde{K}_i \in \{\tilde{K}_{\mathcal{A}}\}$.

For the first step, one case is to simply find $k_i$ by breaking the DL assumption. Another case is to get $(k_a^o, k_b^o, t_k)$ that $K_i'^o$ and $\tilde{K}_i$ hides and simply set $k_i = k_b^o / k_a^o$, but this breaks the hiding property of $\textsf{LinkTag}$. Another case is to get $(k_b^o, k_a^o)$ that the $K_{\pi_i}^o$ in $\mathbb{S}_i$ (i.e. the one-time address of the true spent e-note) hides, but this breaks the hiding property of $\textsf{PedersenK}$. The last case is that the proving systems may leak the same $(k_a^o, k_b^o, t_k)$ from the second case above, but this breaks the witness indistinguishability of ownership and unspentness proof and membership proof. Hence for all cases, at least one supposed property of a cryptographic construction is broken.

For the second step, one case is that in $T'$, $K_i'^o = t'_{k,i} G+ K^o$, with $K^o$ the one-time address of an e-note in ${\tt enote}_{\mathcal{A}}$, but this breaks the binding property of $\textsf{LinkTag}$. The other case is the negation of the previous case: $K_i'^o \ne t'_{k,i} G+ K^o$, yet $\mathcal{A}$ can non-negligibly create accepted proofs, but this breaks the soundness property of ownership and unspentness proof, and therefore, of membership proof**. Hence for all cases, at least one supposed property of a cryptographic construction is broken.
\end{proof}

\noindent **\textit{Regarding the soundness property of membership proof.} On its own, one can easily construct a membership proof for $(C, K^o)$ they \textit{don't} own in the ring \textit{without} breaking the soundness property: pick any $(C, K^o)$ from $\mathbb{S}$, record its index as $\pi$, get $t_c, t_k \xleftarrow{\$}\mathbb{F}$, and set $C' = t_c G + C$ and $K'^o = t_k G + K^o$. Surely, $(G, C', K'^o \in\mathbb{G}, \mathbb{S}\subset\mathbb{G}^2; \pi\in\mathbb{N}, t_c, t_k\in\mathbb{F})$ is in the proving relation for membership proof.
\end{document}