\chapter{Encryption}\label{chap:encryption}
In this chapter, we introduce notations for fundamental moves of the most common Rubik's Cube $C_3$. We then work on constructing a group using states of $C_3$. We explain how the encryption protocol is built using the Rubik's Cube and move on to analyze the possible attacks against this encryption protocol. Finally, we layout some improvements to the encryption protocol.

\section{The classic Rubik's Cube}
\par Recall Figure~\ref{fig:solved-cube}, $C_3$ has 3 layers where each layer is formed by 9 smaller cubes, so there are $3 \cdot 9 = 27$ cubes in total. Among those 27 small cubes, 26 small cubes are visible since the center cube is surrounded by them and thus, hidden. If you take apart one Rubik's Cube, you will find that the center cube does not actually exist. In place of the center cube, there is a special structure that holds all other pieces together.
\par We can split the 26 small cubes into three different types. As shown in Figure~\ref{fig:cube-type}, the small cubes in the corners are called ``corner cubes'', which have three visible colored pieces and there are 8 of them in total. The small cubes lie in the middle of each edge are called ``edge cubes'', which have two visible colored pieces and there are 12 of them. Finally, the cubes with a single visible colored piece located at center of each side of the cube are called ``center cubes''. Same as the number of sides a cube has, there are 6 of them.
% ------------------------------ Draw Examples --------------------------------
\begin{figure}[ht]
    \centering
    \begin{minipage}[b]{0.45\textwidth}
        \centering
        \RubikFaceUpAll{Y}
        \RubikFaceFrontAll{G}
        \RubikFaceRightAll{O}
        \ShowCube{5cm}{0.6}{
            \DrawRubikCubeRU
            \draw[line width=2pt, color=blue, <-] (2.5, 1.5) -- (6, 1.5);
            \node at (6, 2) [blue]{\textbf{\textsf{Edge Cube}}};

            \draw[line width=2pt, color=blue, <-] (2, 3.5) -- (2, 4.5);
            \node at (2, 5) [blue]{\textbf{\textsf{Center Cube}}};

            \draw[line width=2pt, color=blue, <-] (3.5, 3.8) -- (5, 5.5);
            \node at (5, 6) [blue]{\textbf{\textsf{Corner Cube}}};
        }
        \setlength{\abovecaptionskip}{0.7cm}
        \caption{Small cube types}\label{fig:cube-type}
    \end{minipage}
    \begin{minipage}[b]{0.45\textwidth}
        \centering
        \RubikFaceUpAll{Y}
        \RubikFaceFrontAll{G}
        \RubikFaceRightAll{O}
        \ShowCube{5cm}{0.6}{
            \DrawRubikCubeRU
            % Right Face
            \draw[line width=2pt, color=blue, <-] (3.5,2) -- (5.5, 2);
            \node at (5, 2.5) [blue]{\textbf{\textsf{Right}}};
            % Left Face
            \draw[line width=2pt, color=blue, <-] (-0.2,2) -- (-1.3, 2);
            \node at (-0.9, 2.5) [blue]{\textbf{\textsf{Left}}};
            % Up Face
            \draw[line width=2pt, color=blue, <-] (2, 3.5) -- (2, 5.5);
            \node at (1.4, 4.8) [blue]{\textbf{\textsf{Up}}};
            % Down Face
            \draw[line width=2pt, color=blue, <-] (2, -0.2) -- (2, -1.5);
            \node at (3, -1.1) [blue]{\textbf{\textsf{Down}}};
            % Front Face
            \draw[line width=2pt, color=blue, <-] (1.5, 1.5) -- (0, -1);
            \node at (-0.5, -1.3) [blue]{\textbf{\textsf{Front}}};
            % Back Face
            \draw[line width=2pt, color=blue, <-] (3.2, 4.2) -- (4, 5.5);
            \node at (4.6, 4.8) [blue]{\textbf{\textsf{Back}}};
        }
        \caption{Rubik's Cube Notation}\label{fig:cube-notation}
    \end{minipage}
\end{figure}
% -----------------------------------------------------------------------------
\par In future discussions, we will refer sides of the Rubik's Cube as faces. To distinguish the six faces, we will call them right face, left face, up face, down face, front face and back face as shown in Figure~\ref{fig:cube-notation}. Following this naming system, we can assign notations to the moves of $C_3$. The most basic move one can do it to rotate a single face of the cube. We use $U$ to denote a clockwise rotation of the up face. That is looking at the up face, turn it $90^\circ$ clockwise. Similarly, we use letters $R$, $L$, $D$, $F$ and $B$ to denote the clockwise $90^\circ$ rotation of the corresponding faces. For each of these six moves, there are three possible angles of rotation, which are $90^\circ$ clockwise, $180^\circ$ clockwise and $270^\circ$ clockwise. In total there are $6 \cdot 3 = 18$ possible moves and we will call these the \textit{fundamental moves}.
\begin{figure}[ht]
    \centering
    \begin{minipage}{0.9\textwidth}
        \centering
        \RubikCubeSolvedWY
        \ShowCube{2cm}{0.5}{\DrawRubikCubeRU}
        \quad\Rubik{U}\quad
        \RubikRotation{U}
        \ShowCube{2cm}{0.5}{\DrawRubikCubeRU}
        \quad\Rubik{Up}\quad
        \RubikRotation{Up}
        \ShowCube{2cm}{0.5}{\DrawRubikCubeRU}
        % Add a little space between the two graphs.
        \vspace*{10px}
    \end{minipage}
    \begin{minipage}{0.9\textwidth}
        \centering
        \RubikCubeSolvedWY
        \ShowCube{2cm}{0.5}{\DrawRubikCubeRU}
        \RubikRotation{U, U}
        \quad
        \SequenceBraceA{U2}{\ShowSequence{}{\Rubik}{\SequenceLong}}
        \quad
        \ShowCube{2cm}{0.5}{\DrawRubikCubeRU}
    \end{minipage}
    \caption{Rotation example}\label{fig:cube-rotation-example}
\end{figure}
\par To represent the clockwise $180^\circ$ rotation of the corresponding faces, we simply add a number 2 after the capital letters. Therefore, $U2$ represents the move where we face the up face and rotate it $180^\circ$ clockwise. For the $270^\circ$ clockwise rotation, which is same as a $90^\circ$ counterclockwise rotation, we add an apostrophe after the capital letter to denote it. Then $U'$ represents the move where we face the up face and rotate it $90^\circ$ counterclockwise. All above notations defined are illustrated in Figure~\ref{fig:cube-rotation-example}.
\begin{figure}[ht]
    \centering
    \begin{minipage}{0.48\textwidth}
        \centering
        \begin{tikzpicture}[scale=0.5]
            \draw[thick] (4.5,-0.5) -- (7.5,-0.5) -- (7.5,-9.5) -- (4.5,-9.5) -- cycle;
            \draw[thick] (1.5,-3.5) -- (13.5,-3.5) -- (13.5,-6.5) -- (1.5,-6.5) -- cycle;
            \draw[thick] (10.5,-3.5) -- (10.5,-6.5);
            \node[thick, scale=1.2] at (6,-2) {Up};
            \node[thick, scale=1.2] at (3,-5) {Left};
            \node[thick, scale=1.2] at (6,-5) {Front};
            \node[thick, scale=1.2] at (9,-5) {Right};
            \node[thick, scale=1.2] at (12,-5) {Back};
            \node[thick, scale=1.2] at (6,-8) {Down};
        \end{tikzpicture}
    \end{minipage}
    \begin{minipage}{0.48\textwidth}
        \centering
        \RubikCubeSolvedWY
        \RubikRotation{T,F,R,D,B,L,Tp,Fp,Rp,Dp,Bp,Lp}
        \ShowCube{7cm}{0.5}{\DrawRubikCubeF}
        \vspace{0.5cm}
    \end{minipage}
    \begin{minipage}{0.99\textwidth}
        \centering
        \RubikRotation{T,F,R,D,B,L,Tp,Fp,Rp,Dp,Bp,Lp}
        \ShowSequence{}{\Rubik}{\SequenceLong}
    \end{minipage}
    \caption{A state of the Rubik's Cube}\label{fig:cube-state-example}
\end{figure}
\par As we mentioned earlier, we refer each possible shuffling result of the cube as a state. Figure~\ref{fig:cube-state-example} is one possible state of the cube. The shuffling can be any combination of the fundamental moves applied to a solved cube. Each state of the cube is unique, though infinitely many different shufflings could reach it. Suppose we are at a state $S$ that can be reached by series of fundamental moves $M$. Then if we add ``$R\,R\,R\,R$'' at the end of $M$, we are still at state $S$ since ``$R\,R\,R\,R$'' simply rotates the right face $360^\circ$ clockwise and does not actually change it. In fact, we can insert any number of ``$R\,R\,R\,R$'' anywhere in $M$. Also, we do not have to always use $R$, any four fundamental moves will rotate one face of the cube by a multiple of $360^\circ$ and hence do not modify the cube. Thus we have infinitely many ways to reach $S$.
\par We now want to show that we can make the set of states of $C_3$ into a group. Let us denote the group as $G_3$ where the group operation is $*$, and each element of $G_3$ is a state. Though arguments below correspond to $C_3$, we can use them to construct group $G_n$ for states of an arbitrary cube $C_n$ in a similar fashion.
\par Assume $S_1$ and $S_2$ both represent a state of the classic 3 by 3 by 3 cube, that is $S_1, S_2 \in G_3$. Assume $S_1$ can be reached by a series of moves $M_1$ applied to the solved cube and similarly $S_2$ can be reached by a series of moves $M_2$ applied to the solved cube. Then $S_1 * S_2$ is the state you could reach to by first applying $M_1$ and then $M_2$ to the solved cube, or equivalently, you can directly apply $M_2$ to $S_1$. Then it is obvious that if we pick a different $M'$ which takes us from the solved cube to $S_1$, $S_1 * S_2$ still gives us the same result. Therefore the operation $*$ is well defined. We now can show a simple proof that $G_3$ is indeed a group under $*$. \\
\textit{Claim}: $G_3$ is a group under $*$.
\begin{proof}[Proof:]\item
    \begin{itemize}
        \item Show closure. \\
        Suppose we have $S_1, S_2 \in G_3$. From above description, we see that $S_1 * S_2$ can be reached by combining two series of moves. Thus $S_1 * S_2$ is indeed a state of the cube. Therefore $G_3$ is closed.
        \item Show identity. \\
        The solved cube is the identity and we denote it as $e$. It represents the "empty" move. Suppose we have $S \in G_3$, then $e*S$ means do nothing and move to $S$. Similarly $S*e$ means applying nothing to $S$. Therefore the solved cube is the identity.
        \item Show associativity. \\
        Suppose we have $S_1, S_2, S_3 \in G_3$. Clearly $(S_1 * S_2) * S_3 = S_1 * (S_2 * S_3)$ since the order we apply those moves does not change even if we combine two states together.
        \item Show inverse. \\
        Suppose we have $S \in G_3$ and $S$ can be reached by a series of moves $M$ applied to the solved cube. Each move in $M$ is one of the 18 possible fundamental moves. All fundamental moves have their inverses. For example, $U$ can be reversed by $U'$ and $U2$ can be reversed by $U2$. Thus there must exist a series of moves $M'$ that reverses $M$. We can find $M'$ by inverting of all movements in $M$ in reverse order. That is, the move that was done the last shall be undone first. Applying $M'$ to the solved cube to obtain $S'$ then $S*S' = S'*S = e$.
    \end{itemize}
    Therefore $(G_3, *)$ is a group.
\end{proof}

\section{The design principle}
\par ``Do not worry about your difficulties in Mathematics. I can assure you mine are still greater.'' This is one of my favorite quote from Albert Einstein. Let us assume that we now want to secretly pass this quote to someone using the Rubik's Cube. The general idea is, as we mentioned in Chapter~\ref{chap:introduction}, instead of letting each cubie to hold a color, we use cubies to hold letters. We then need to agree on an order that we put the letters in. As long as we are consistent, we can order the six faces in any way we desire. Once we fill all the faces, we can shuffle the cube to obtain the ciphertext. But before we get started on filling the cube with letters, some pre-processing to the plaintext is essential. We want to remove blanks and punctuations, since their existences in the ciphertext leaks important information about the plaintext. An eavesdropper can count the number of blanks to deduce how many words were encrypted. Afterwards, we also want to make sure all the letters are either capitalized or lower cased. Here we choose to capitalize everything and the processed string looks like the following:
\begin{center}
    \texttt{DONOTWORRYABOUTYOURDIFFICULTIESINMATHEMATICSI} \\
    \texttt{CANASSUREYOUMINEARESTILLGREATERALBERTEINSTEIN}
\end{center}
Since we are using the classic Rubik's Cube $C_3$, we can put $3 \cdot 3 = 9$ letters on each face. At one time, we can use the cube to encrypt at most $9 \cdot 6 = 54$ letters. Our message is too long to fit, but we can take 54 letters and encrypt them first. Here are the first 54 letters split into chunk of 9:
\begin{center}
    \textcolor{blue}{\texttt{DONOTWORR}} \; \textcolor{red}{\texttt{YABOUTYOU}} \; \textcolor{blue}{\texttt{RDIFFICUL}} \;
    \textcolor{red}{\texttt{TIESINMAT}} \; \textcolor{blue}{\texttt{HEMATICSI}} \; \textcolor{red}{\texttt{CANASSURE}}
\end{center}
\par Let us agree on the order of filling the letters as the following: up face $\rightarrow$ front face $\rightarrow$ right face $\rightarrow$ down face $\rightarrow$ back face $\rightarrow$ left face. The cube with letters filled is displayed in Figure~\ref{fig:cube-plain-text}.
\begin{figure}[ht]
    \centering
    \begin{minipage}{0.45\textwidth}
        \centering
        \includegraphics[width=6cm]{figures/encryption/cube_plain_text.png}
        \caption{Cube with plaintext}\label{fig:cube-plain-text}
    \end{minipage}
    \begin{minipage}{0.45\textwidth}
        \centering
        \includegraphics[width=6cm]{figures/encryption/cube_cipher_text.png}
        \caption{Cube with ciphertext}\label{fig:cube-cipher-text}
    \end{minipage}
\end{figure}
We then need to determine a sequence of fundamental moves as our encryption key, which we denote as $k$. Suppose we apply ``$R\,U\,B2\,L'\,D2\,F\,R'\,D\,B\,L2\,$'' to the cube. The shuffled cube is shown as Figure~\ref{fig:cube-cipher-text}. To obtain the entire ciphertext $c$, which is shown below, we simply read out all the letters the same order we put them in.
\begin{center}
    \textcolor{blue}{\texttt{MDIATNNST}} \; \textcolor{red}{\texttt{UAUAUOHIN}} \; \textcolor{blue}{\texttt{CACIFFTSR}} \;
    \textcolor{red}{\texttt{YWLTIEBRM}} \; \textcolor{blue}{\texttt{EOCOTROID}} \; \textcolor{red}{\texttt{ESIOSUYAR}}
\end{center}
\par We now send the ciphertext $c$ to the receiver. It is crucial for us to have shared the key secretly with the receiver. We will discuss a method to do so in Chapter~\ref{chap:exchange}. Upon receiving the ciphertext, the receiver can decrypt the ciphertext by first finding the inverse of the key, which we denote as $k'$. By following the step described in proving the inverses of group $G_3$, we find $k'$ is ``$L2\,B'\,D'\,R\,F'\,D2\,L\,B2\,U'\,R'\,$''. Then the receiver can fill the cube with the ciphertext and apply $k'$ to the cube.
\par Let us take a closer look at what happened during the encryption. We notice that all letters that were in plaintext are present in the ciphertext. However most of them ended up in different locations. If we observe the center of each face, we can find that they all remained in the same places. This is not a coincidence since none of the basic moves changes the center. Therefore among the 54 letters, at most 48 letters can be permuted.

\section{Brute force attacks}
\par Let us consider the brute force attacks against this protocol. There are two relative obvious ways of doing so. From above discussion, we know the ciphertext is just one possible permutation result of 48 letters within the plaintext. Thus if we list out all elements of $S_{48}$, the permutation group on 48 elements, and apply each to the ciphertext, one of the permutations must revert the ciphertext back to the plaintext.
\par Though the group $S_{48}$ has $48! \approx 1.24 \cdot 10^{61}$ elements, later in this thesis, we will show that not all those permutations are needed to be checked. Even though Rubik's Cube permutes 48 elements, the size of the group $G_3$ is smaller than $S_{48}$, since there are invalid states that cannot be reached by series of fundamental moves. Potentially you can take the cube apart and put it back together to get to a invalid state. We will talk about what states are invalid and why they are invalid in Chapter~\ref{chap:structure} when we explore more about the group structure.
\par The other possible attack is to search the inverse of the encryption key. Without knowing the length of the key we used, the attacker can start with trying out all combination of fundamental moves with length of 1, length of 2 and so on. For each combination the attacker selects, he/she applies it to the cube and observe if the result makes sense. As an example, there are $18^2$ possible keys with length of 2 since every time the attacker can pick one from the 18 fundamental moves. It follows that, in our example, the number of keys the attacker needs to go through is upper bounded by $\sum_{i=1}^{10}18^i \approx 3.78 \cdot 10^{12}$.
\par By comparing the two brute force attacks described above, we notice that finding the inverse of the key would be easier for the attacker. It seems that there is a straightforward approach to make this brute force attack infeasible, which is to increase the key length. Instead of using a key with a length of 10 fundamental moves, we can randomly pick a key that is formed by 1000 fundamental moves. Then if we follow above methods, we will find the number of keys the attacker have go through being bounded by $\sum_{i=1}^{1000}18^i \approx 1.98 \cdot 10^{199}$ which is obviously a way larger number. However this approach will not work as expected due the existence of the God Number.

\section{The God Number}
\par We know that mathematicians love the Rubik's Cube as they are amazed by how such a seemingly regularly puzzle can hold so many secrets. Ever since the problem is invented, perhaps the biggest mystery of all is the upper bound for number of fundamental moves to reach to all possible states. The lower bound is proved earlier in 1995 by Michael Reid\cite{god}. Reid found that the superflip, which keeps all small cubes in their solved locations but flips the orientation of all edge cubes, as displayed in Figure~\ref{fig:superflip} requires at least 20 fundamental moves.
\begin{figure}[ht]
    \centering
    \RubikCubeSolvedWY
    \RubikRotation{\superflip}
    \ShowCube{8cm}{0.7}{\DrawRubikCubeSF}
    \caption{Superflip}
    \label{fig:superflip}
\end{figure}
It took mathematicians about 30 years to prove that this is an upper bond. We formally define the God Number as:
\newpage
\begin{definition}\textbf{The God Number} \\
    Let $m(S_1, S_2)$ denote the minimum number of fundamental moves to transform $C_3$ from $S_1$ to $S_2$. Then the God Number is $max\{m(S_1, S_2) \;|\; S_1, S_2 \in G_3\}$.
\end{definition}
\par With about 35 CPU-years of idle computer time donated by Google, a team of researchers essentially solved every position of the Rubik's Cube and showed in 2010 that the God Number is 20\cite{god}. Another way to express the meaning of the God Number is that any series of fundamental moves with length longer than 20 can be reduced to a series of fundamental moves with length less or equal to 20. Thus, we can not find two states in the Rubik's Cube that are more than 20 fundamental moves away. We can also say that the Rubik's Cube group $G_3$ we defined has a diameter of 20 fundamental moves.
\par Therefore, even if we have chosen a key with length of a thousand fundamental moves, the attacker will find the inverse of the key with only searching for keys that having length of 20 fundamental moves or less. That is, the number of keys the attacker has to go through is really bounded by $\sum_{i=1}^{20}18^i \approx 1.35 \cdot 10^{25}$, regardless to the key length we choose. It follows that the key search attack will almost always be easier than the attack on finding inverse of the permutation. It is also worthwhile to note that the God Number for larger cubes is unknown, so we are not able to perform a similar analysis on larger cubes.

\section{Improvements}
\par In this section, we discuss solutions that prevent the key from collapsing and other tweaks to our design to improve the security of our protocol in general. First, let us observe some additional features provided by Rubik's Cubes that we overlooked.
\par Suppose we fill a letter E in the right up corner cubie on the front face of the cube as shown in Figure~\ref{fig:cube-letter}.
\begin{figure}[ht]
    \centering
    \begin{minipage}{0.49\textwidth}
        \centering
        \includegraphics[width=4cm]{figures/encryption/cube_face_letter.png}
        \caption{Front face with letter}\label{fig:cube-letter}
    \end{minipage}
    \begin{minipage}{0.49\textwidth}
        \centering
        \includegraphics[width=4cm]{figures/encryption/cube_face_letter_rotate.png}
        \caption{Front face with rotated letter}\label{fig:cube-letter-rotate}
    \end{minipage}
\end{figure}
If we rotate the front face 90 degrees clockwise, as shown in Figure~\ref{fig:cube-letter-rotate}, we can find the position of letter \textbf{E} changes. However, we also notice that the orientation of \textbf{E} changes. Since anyone who reads English can still recognize those letters even if their direction changed, we omitted this feature while developing the encryption scheme. To benefit from this feature, we can use something that rotates while the cube faces rotate. Therefore, instead of putting the letters, we can put four bits into each cubie, where each corner of the cubie holds one bit. We need to agree on an order of placing those bits, for example: left up corner $\rightarrow$ right up corner $\rightarrow$ right down corner $\rightarrow$ left down corner, so we get a complete cycle here. Assume that we are putting integers from 1 to 36 on one face of the cube in the order, the face will look like what is displayed in Figure~\ref{fig:bit-order}.
\begin{figure}[ht]
    \centering
    \includegraphics[width=4cm]{figures/encryption/bit_order.png}
    \caption{Bit ordering}\label{fig:bit-order}
\end{figure}
We now can run the above experiment again with input ``1000.'' Following the order we agreed, we put the bits into the left up corner cubie on the front face as shown in Figure~\ref{fig:cube-bit} and the face after the rotation is displayed in Figure~\ref{fig:cube-bit-rotate}.
\begin{figure}[ht]
    \centering
    \begin{minipage}{0.49\textwidth}
        \centering
        \includegraphics[width=4cm]{figures/encryption/cube_face_bit.png}
        \caption{Front face with bits}\label{fig:cube-bit}
    \end{minipage}
    \begin{minipage}{0.49\textwidth}
        \centering
        \includegraphics[width=4cm]{figures/encryption/cube_face_bit_rotate.png}
        \caption{Front face with rotated bits}\label{fig:cube-bit-rotate}
    \end{minipage}
\end{figure}
If we read out the bits the same order we put them in, we get ``0100'', which is different from the original input. Hence using bits helps us benefit from the face rotations of the Rubik's Cube. Though this method does not directly address the key collapsing issue, it gives us more flexibility to modify the encryption protocol. We will make further improvements based on this setting.
\par One obvious reason the key would collapse is because some fundamental moves commute with each other. Clearly, each fundamental move commutes with itself regardless of the angle; for example $R$, $R2$ and $R'$ commute with each other. Also, the moves that rotate opposite sides commute with each other. For instance $R$, $R2$ and $R'$ commute with $L$, $L2$ and $L'$. Suppose we find a series of moves within a random key of length 15 as ``$R2\,L2\,R2\,L\,L\,$''. Since those moves commute, they are equivalent to ``$R2\,R2\,L2\,L\,L\,$''. In words, what this chunk of key does is rotating the right face $360^\circ$ clockwise and then rotating the left face $360^\circ$ clockwise, which has precisely no effect on the cube. Thus we can merely remove this chunk from the random key and its length will collapse down from 15 to 10.
\par To resolve this issue, we can shift the content to the right by one bit each time before we apply a move to the cube. Each one of the bits will move to the next position following the order they were put in. For example, recall Figure~\ref{fig:bit-order}, the bit at location of number $n$ will be shifted to the location of number $n + 1$. Notably, the last bit on one face will become the first bit on the face next to it. For instance, the last bit on the up face will become the first bit on the front face.
\begin{figure}[ht]
    \centering
    $\xrightarrow{\text{fill bits\;\;}}$
    \begin{minipage}{0.3\textwidth}
        \centering
        \includegraphics[width=3.5cm]{figures/encryption/bit_start.png}
    \end{minipage}
    $\xrightarrow{\text{shift bit}}$
    \begin{minipage}{0.3\textwidth}
        \centering
        \includegraphics[width=3.5cm]{figures/encryption/bit_shift_one.png}
    \end{minipage}
    \\ $\xrightarrow{\text{apply }F}$
    \begin{minipage}{0.3\textwidth}
        \centering
        \includegraphics[width=3.5cm]{figures/encryption/bit_rotate_one.png}
    \end{minipage}
    $\xrightarrow{\text{shift bit}}$
    \begin{minipage}{0.3\textwidth}
        \centering
        \includegraphics[width=3.5cm]{figures/encryption/bit_shift_two.png}
    \end{minipage}
    \\ $\xrightarrow{\text{apply }F'}$
    \begin{minipage}{0.3\textwidth}
        \centering
        \includegraphics[width=3.5cm]{figures/encryption/bit_rotate_two.png}
    \end{minipage}
    \caption{The bit shift method}\label{fig:bit-shift}
\end{figure}
As shown in Figure~\ref{fig:bit-shift}, we put ``1234'' in the right up corner of the front face and apply moves $F$ and $F'$ to the cube. We follow the procedures defined above and shift the bits before applying each move. Though ``1234'' is not a legal input to the Rubik's Cube encryption, we use it to clearly illustrate where each bits travels to. By observing the front face in the last row of Figure~\ref{fig:bit-shift}, we find the locations of all bits changed, though $F$ and $F'$ cancel each other out. Among the four bits, two bits even moved to other cubies. Therefore, with the shift, the bits travel around even when moves commute and cancel each other out as fundamental moves. We believe this method effectively prevents the key from collapsing. Also, this method addresses the "fixed center" issue since the shift affects bits that are held by center cubies.
\par To examine the modified encryption protocol, we can try to encrypt my favorite quote from Einstein again with the modified Rubik's Cube encryption. Notice we first need to convert the English letters to their ASCII representations, so each letter will be 8 bits long. Since $C_3$ can hold 216 bits, we can encrypt $\frac{216}{8} = 27$ letters at once. The first 27 letters are ``\texttt{DONOTWORRYABOUTYOURDIFFICUL}'' and the following is its binary representation:
\begin{center}
    010001000100111101001110010011110101010001010111010011110101001001010010
    010110010100000101000010010011110101010101010100010110010100111101010101
    010100100100010001001001010001100100011001001001010000110101010101001100
\end{center}
We can use the same key ``$R\,U\,B2\,L'\,D2\,F\,R'\,D\,B\,L2\,$'' to encrypt the plaintext but this time we will account for the shift before applying each move to the cube. The encrypted ciphertext is:
\begin{center}
    001110100110100110111010011100000010100011101111111010011111101111011101
    001000011001100011110000001000111111110110000010010100000000011010001000
    010011101010011010010100110001010100101000000110100110001100011010100001
\end{center}
From Figure~\ref{fig:bit-order}, we see that the center of the cube face goes from the 17th position to the 20th position. We thus can find, in the plaintext, the center of the up face holds $1001$ and this value changed to $0111$ after the encryption. Among the four bits, only one bit actually remained the same. So in this particular example, the shifting bits is effectively helping to change the bits held by the center cubes.
\par We can convert the ciphertext back to ``letters''. But since we can no longer guarantee that each chunk of 8 bits still represent a value that is less than or equal to 127, we need to rely on the extended ASCII table as shown in Figure~\ref{fig:ascii} to convert the ciphertext back to ``letters.''
\begin{figure}
    \centering
    \includegraphics[width=12cm]{figures/encryption/ascii.png}
    \caption{Extended ASCII table}
    \label{fig:ascii}
\end{figure}
The following characters are the results of the conversion: ``:i$\|$p($\cap\uptheta\surd\blacksquare$!\"{y}$\equiv$\#$^2$\'{e}P\;\^{e}N$^a$\"{o}$\dagger$J\;\"{y}$\vdash$\'{\i}.'' As one can notice that while we are using the extended ASCII, many more special characters will be involved. We find that the only common letter that exists in both the ciphertext and the plaintext is the letter N, but the location of it has changed.
\par The essence of the shift on the bits is just a permutation. We described the shift as a minimum working example, but we are free to pick any permutation on the 216 bits as long as we can specify it. To add more security, we can select a more complex permutation and secretly share it as part of the key with other trusted parties.

\section{Encrypt long messages}
\par When we first defined the Rubik's Cube encryption, we noticed that we could not use it to encrypt the entire quote, since the Rubik's Cube can only fit a certain amount of the plaintext at once. In real life, we may often need to encrypt messages that are much longer. Thus, we introduce two methods that help us encrypt long messages.
\par The first method is designed targeting the Rubik's Cube encryption. We have been using $C_3$ for the encryption, but in Chapter~\ref{chap:introduction} we mentioned that cubes with larger side length do exist. Hence we can use a Rubik's Cube with greater side length to extend the size of the message we are capable of encrypting. Suppose we instead use a 10 by 10 by 10 Rubik's Cube, denoting as $C_{10}$, we can encrypt $10^2 \cdot 6 \cdot 4 = 2400$ bits at once. If we are using ASCII representation of English letters, we can encrypt 300 letters at once. The advantage of using more giant cubes is that we make both brute force attacks we discussed earlier more challenging to succeed. To begin with, when the side length of the Rubik's Cube gets greater, we permute much more bits. For $C_{10}$, we permute 2400 bits, and thus the attacker has to search through group $S_{2400}$ which has $2400!$ elements. For an arbitrarily large cube $C_n$, we permute $24 \cdot n^2$ bits. It follows that if the attacker wants to search through the permutation group, he/she has to go through $(24 \cdot n^2)!$ possibilities. Therefore finding the inverse of the permutation will require much more computations as the side length of the cube increases. Besides, more giant cubes have more than just 18 fundamental moves. For example, $C_{10}$ has 180 fundamental moves. Since each time there are much more fundamental moves to select, finding the inverse of the key will get a lot harder too.
\par There are also two vulnerabilities of this approach. The first one is that we still cannot encrypt an arbitrarily long message. Once we fix a cube length, say 20, we do not want to change it during the communications. The reason is that, while modifying the size of the cube, we are changing the key space as well. That is the fundamental moves we can select for $C_3$ and $C_{20}$ are obviously different. However, for private key encryptions, we commonly exchange the secret key once before building the secure channel between parties, and we use the same key for all of the following communications. Secondly, we may end up wasting a lot of space when we need to encrypt a relatively short message since the cube size is fixed.
\par A more general approach that works for message with arbitrary length $l$ is called the cipher block chaining (CBC) mode, which the is the most commonly used mode of operation. Let us first introduce the operation ``XOR'' is denoted as $\oplus$ and it is also called ``exclusive or''. It gains the name "exclusive or" because it excludes the case when both operands are true.
\begin{table}[ht]
    \centering
    \begin{tabular}{|c|c|c|}
        \hline Input A & Input B & A $\oplus$ B \\ \hline\hline
        1 & 1 & 0 \\ \hline
        1 & 0 & 1 \\ \hline
        0 & 1 & 1 \\ \hline
        0 & 0 & 0 \\ \hline
    \end{tabular}
    \caption{XOR truth table}\label{tab:xor-truth-table}
\end{table}
``XOR'' is a logical operation that outputs true only when inputs differ. We build the truth table for it as shown in Table~\ref{tab:xor-truth-table}.
\par In CBC mode, each block of plaintext is XORed with the previous ciphertext block before being encrypted as shown in Figure~\ref{fig:cbc-encryption}.
\begin{figure}[ht]
    \centering
    \includegraphics[width=14cm]{figures/encryption/CBC_encryption.png}
    \caption{CBC mode encryption\cite{cbc_enc}}\label{fig:cbc-encryption}
\end{figure}
Hence each ciphertext block depends on all plaintext blocks processed up to that point. To make each message unique, we can use an initialization vector to XOR with the first block. Assume in total there are $k$ blocks of plaintexts $(m_0, m_1, ..., m_k)$ needed to be encrypted, the output will be $k$ blocks of ciphertexts $(c_0, c_1, ..., c_k)$.
\begin{figure}[ht]
    \centering
    \includegraphics[width=14cm]{figures/encryption/CBC_decryption.png}
    \caption{CBC mode decryption\cite{cbc_dec}}\label{fig:cbc-decryption}
\end{figure}
Giving all the ciphertexts, to retrieve $m_x$ where $2 \leq x \leq k$, we decrypt $c_x$ with the key and then XOR the result with $c_{x-1}$ to get $m_x$ back as shown in Figure~\ref{fig:cbc-decryption}. The first ciphertext $c_1$ is unique since we need to XOR its decryption result with the initialization vector to recover $m_1$. Though this general approach is easy to manage, it has some potential vulnerabilities such as one bit wrong in the $x_{th}$ ciphertext will generate errors in all blocks after it.
\par Finally, for both approaches discussed above, we have to deal with one more issue. In most times, we probably will not have a message that fits perfectly with the encryption scheme we have. Suppose we have a message $m$ with length of 2000 bits and we are using $C_{10}$ to encrypt it. Recall that $C_{10}$ offers 2400 spaces for bits and thus we have 400 spare spaces. We want to agree on a simple padding algorithm so that we do not have to leave some spaces blank. To pad the message $m$, we simply add a one at the end of it and add 399 more zeros to get the desired length. Notice that we have to complete the padding before encrypting the message. After decryption, the receiver simply removes all trailing zeros and removes one extra 1 to retrieve the original plaintext. This padding scheme will work for the CBC mode as well. Assume we are chaining a list of $C_3$ to encrypt $m$, we then need $\lceil \frac{2000}{216} \rceil = 10$ blocks, which offers $216 \cdot 10 = 2160$ spaces. Similar to above, we have to add a one and 159 more zeros at the end of $m$ to get the desired length. Note that if our message splits up evenly into $k$ blocks, we need to add in the $k+1$th block for just the padding.
\par In this chapter, we have designed a symmetric encryption scheme that avoids some apparent shortcomings and can encrypt arbitrarily long messages. In the next chapter, we will analyze our protocol under a more formal framework and see that further improvements are needed.


\chapter{Co-Word Problems}\label{chp:coword-problems}

Let $G$ be a group with a finite monoid generating set $S$.
Then, if we are given two words $u,v \in S^*$, it is a natural question to ask whether these words represent the same group element.
This question is equivalent to asking if the word $w = uv^{-1} \in S^*$ represents the group identity.
We then define the formal language
\[
	\WP_S
	=
	\left\{
		w \in S^*
	\mid
		\overline{w} = 1
	\right\}
\]
which we refer to as the \emph{word problem} with respect to the generating set $S$.

For each finite monoid generating set $S$ of $G$, we see that $\left\langle S \mid \WP_S \right\rangle$ is a presentation for $G$.
Thus, the word problem completely describes a group.
A classification of the word problem is thus one method to characterise the complexity of a group.

The study of the formal language complexity of group word problems began with \textcite{anisimov1971} who showed that the word problem is regular if and only if the group is finite.
This was extended by \textcite{muller1983} who showed that a group has a context-free word problem if and only if it is virtually free, in which case, the word problem is deterministic context-free.
It was shown by \textcite{elder2008} that a group has a word problem that is (deterministic) blind multicounter if and only if it is virtually abelian.
It was shown by \textcite{holt2008} that a group has a \emph{growing context-sensitive} word problem if and only if its word problem can be solved by a certain generalisation of \emph{Dehn's algorithm}, however, this result does not appear to provide a group-theoretic classification.

An alternate method of obtaining characterisation of group word problems is to characterise the \emph{co-word problem} $\coWP_S = S^* \setminus \WP_S$, that is, the formal language
\[
	\coWP_S
	=
	\left\{
		w \in S^*
	\mid
		\overline{w} \neq 1
	\right\}.
\]
It is known that regular and deterministic context-free languages are closed under taking set complements, see \cite[Theorem~8.4]{rich2007} and \cite[Theorem~2.42]{sipser2013}, respectively.
Thus, the co-word problem for a group is
\begin{itemize}
	\item regular if and only if the group is finite; and
	\item deterministic context-free if and only if the group is virtually free.
\end{itemize}
The class of groups for which $\coWP_S$ is context-free was first studied by \textcite{holt2005}, in particular, they showed that a polycyclic group has a context-free co-word problem if and only if it is virtually abelian.
The study of co-context-free groups was later extended by \textcite{lehnert2007} who showed that Thompson's group $V$ has a context-free co-word problem.
It is conjectured \cite[Conjecture~5]{bleak2016} that a group has a context-free co-word problem if and only if it is a subgroup of Thompson's group $V$.
However, a potential counter-example to such a classification is provided in \cite{berns-zieve2014}.

It was shown by \textcite{holt2006} that the class of \emph{bounded automata groups} have co-word problems that can be recognised as \emph{indexed languages}, as defined by \textcite{aho1968}.
The class of bounded automata groups includes important examples such as Grigorchuk's group of intermediate growth, the Gupta-Sidki groups, and many more~\cite{grigorchuk1980,gupta1983,nekrashevych2005,sidki2000}.

ET0L languages form a proper subfamily of the indexed languages (see Corollary~4.1 in~\cite{culik1974} and Proposition~4.5 in~\cite{ehrenfeucht1976}).
For the specific case of the Grigorchuk group, \textcite{ciobanu2018} constructed an ET0L grammar for the co-word problem.
In this chapter, we generalise this result by showing that the co-word problem for any bounded automata group is ET0L.
In particular, for each bounded automata group, we construct a cspd automaton which recognises the language of geodesics.

\section{Generating Sets}\label{sec:background-coword-problems}

Many interesting families of formal language are closed under inverse word homomorphism, as defined in \cref{defn:closed-under-inv-word-hom}.
For example, the class of regular, context-free and ET0L languages have this closure property.

\begin{definition}\label{defn:closed-under-inv-word-hom}
	A family of formal languages $\mathcal{F}$ is \emph{closed under inverse word homomorphism}, if for each language $L \in \mathcal{F} \subseteq \Sigma^*$, and each monoid homomorphism $h \colon \Gamma^* \to \Sigma^*$ where $\Gamma$ is an alphabet, the language
	$
		h^{-1}(L)
		=
		\{
			w \in \Gamma^*
			\mid
			h(w) \in L
		\}
	$
	lies within $\mathcal{F}$.
\end{definition}

We then see that the formal language complexity of the co-word problem for a group is well defined in the following sense.

\begin{lemma}\label{lem:well-defined-coword}
	Let $G$ be a group with a finite monoid generating set $S$.
	If $\coWP_S \in \mathcal{F}$ and $\mathcal{F}$ is closed under inverse word homomorphism, then $\coWP_X \in \mathcal{F}$ for each finite monoid generating set $X$ of $G$.
\end{lemma}

\begin{proof}
	For each $x \in X$ we choose a word $w_x \in S^*$ such that $\overline{x} = \overline{w_x}$.
	We then define a monoid homomorphism $h \colon X^* \to S^*$ where $h(x) = w_x$ for each $x \in X$.
	We see that $\coWP_X = h^{-1}(\coWP_S)$, and thus $\coWP_X \in \mathcal{F}$ as required.
\end{proof}

Let $\mathcal{F}$ be a family of languages which is closed under inverse word homomorphism.
Then, a group is co-$\mathcal{F}$ if its co-word problem lies in the class $\mathcal{F}$, for any and thus all generating sets.
It was shown by \textcite[Corollary~3.2~on~p.~40]{culik1974} that ET0L languages form a \emph{full AFL}, one of the defining properties of this being closure with respect to inverse word homomorphism.
From \cref{lem:well-defined-coword} it is well defined to ask if a group is co-ET0L.

\section{Bounded Automata Groups}\label{sec:bounded-automata-groups}

In this section, we define the class of \emph{bounded automata groups}.
Each such group is a group of automorphisms of an infinite rooted tree and can be completely described using finitely many finite-state rewrite automata.
We begin by defining rooted trees as follows.

For $d \geq 2$, let $\mathcal{T}_d$ denote the $d$-regular rooted tree, that is, the infinite rooted tree where each vertex has exactly $d$ children.
We identify the vertices of $\mathcal{T}_d$ with words in $\Sigma^*$ where $\Sigma = \{ a_1, a_2, \ldots, a_d \}$.
In particular, we identify the root with the empty word $\varepsilon \in \Sigma^*$ and we identify the $k$-th child of each vertex $v \in \mathrm{V}(\mathcal{T}_d)$ with the word $v a_k$, see \cref{fig:tree-vertex-labelling}.

\begin{figure}[h!t]
	\centering
	\includegraphics{figure/labelledTree}
	\caption{A labelling of the vertices of $\mathcal{T}_d$.}
	\label{fig:tree-vertex-labelling}
\end{figure}

Recall that an automorphism of a graph is a bijective mapping of the vertex set that preserves adjacency, thus an automorphism of $\mathcal{T}_d$ preserves the root and levels of the tree.
We denote the group of automorphisms of $\mathcal{T}_d$ as $\mathrm{Aut}(\mathcal{T}_d)$.
We write $\mathrm{Sym}(\Sigma)$ for the \emph{permutation group of $\Sigma$}.
An important observation  is that $\mathrm{Aut}(\mathcal{T}_d)$ can be seen as the wreath product $\mathrm{Aut}(\mathcal{T}_d) \wr \mathrm{Sym}(\Sigma)$, since any automorphism $\alpha \in \mathrm{Aut}(\mathcal{T}_d)$ can be written uniquely as $\alpha = (\alpha_1, \alpha_2, \ldots, \alpha_d) \cdot \sigma$ where each $\alpha_i \in \mathrm{Aut}(\mathcal{T}_d)$ is an automorphism of the sub-tree with root $a_i$, and $\sigma \in \mathrm{Sym}(\Sigma)$ is a permutation  of the first level.

Let $\alpha \in \mathrm{Aut}(\mathcal{T}_d)$ where $\alpha = (\alpha_1, \alpha_2, \ldots, \alpha_d) \cdot \sigma \in \mathrm{Aut}(\mathcal{T}_d) \wr \mathrm{Sym}(\Sigma)$.
Then, for any letter $a_i \in \Sigma$, the \emph{restriction of $\alpha$ to $a_i$}, denoted $\left.\alpha\right\vert_{a_i} = \alpha_i$, is the action of $\alpha$ on the sub-tree with root $a_i$ (which is given by $\alpha_i$).
Given any vertex $w = w_1 w_2 \cdots w_k \in \Sigma^*$ of $\mathcal{T}_d$, we can define the \emph{restriction of $\alpha$ to $w$} recursively as
\[
	\left.\alpha\right\vert_w
	=
	\left.
		\left(\left.\alpha\right\vert_{w_1w_2\cdots w_{k-1}}\right)
	\right\vert_{w_k}
\]
and thus describe the action of $\alpha$ on the sub-tree with root $w$.

The action of each element of a bounded automata group on its associated tree can be described using a certain type of finite-state rewrite automata, which we will refer to as a $\Sigma$-automaton.
We define this class of automata as follows.

\begin{definition}\label{defn:sigma-autom}
A \emph{$\Sigma$-automaton}, $(\Gamma,v)$, is a finite directed graph with a distinguished vertex $v$, called the initial state, and a $(\Sigma\times\Sigma)$-labelling of its edges, such that each vertex has exactly $\left\vert\Sigma\right\vert$ outgoing edges; and for each $a \in \Sigma$ each vertex has exactly one incoming edge of the form $(a,a')$ and exactly one outgoing edge of the form $(a',a)$.
Thus, the outgoing edges define a permutation of $\Sigma$.
\end{definition}

From a $\Sigma$-automaton, we may then define a tree automorphism as follows.

\begin{definition}\label{defn:automata-automorphism}
Let $(\Gamma,v)$ be a $\Sigma$-automaton with $\Sigma = \{a_1,\ldots,a_d\}$, then we define an automorphism $\alpha_{(\Gamma,v)} \in \mathrm{Aut}(\mathcal{T}_d)$ as follows.
Notice that for each vertex $b_1 b_2 \cdots b_k \in \mathrm{V}\!\left(\mathcal{T}_d\right) = \Sigma^*$, there is a unique path in the graph $\Gamma$ starting from the initial vertex, $v$, of the form
$
	(b_1, b_1')
	\,
	(b_2, b_2')
	\,
	\cdots
	\,
	(b_k, b_k')
$.
We define $\alpha_{(\Gamma,v)}$ such that $\alpha_{(\Gamma,v)} (b_1 b_2 \cdots b_k) = b_1' b_2' \cdots b_k'$.
From the definition of $\Sigma$-automata it the follows that $\alpha_{(\Gamma,v)}$ is an isomorphism.
\end{definition}

We provide an example of a $\Sigma$-automaton in \cref{fig:sigma_autom_grigorchuk}.

\begin{figure}[!ht]
	\centering
	\includegraphics{figure/grigorchuk}
	\caption{A $\Sigma$-automaton for the generator $b$ in Grigorchuk's group.}
	\label{fig:sigma_autom_grigorchuk}
\end{figure}

An \emph{automaton automorphism}, $\alpha$, of the tree $\mathcal{T}_d$ is an automorphism for which there exists a $\Sigma$-automaton, $(\Gamma,v)$, such that $\alpha = \alpha_{(\Gamma,v)}$.
We write $\mathcal{A}\!\left(\mathcal{T}_d\right)$ for the set of all automata automorphisms of the tree $\mathcal{T}_d$.
The set $\mathcal{A}\!\left(\mathcal{T}_d\right)$ forms a group~\cite[Proposition~1]{sidki2000}.
Moreover, a subgroup of $\mathcal{A}(\mathcal{T}_d)$ is called an \emph{automata group}.

An automorphism $\alpha \in \mathrm{Aut}(\mathcal{T}_d)$ will be called \emph{bounded} (originally defined in \cite{sidki2000}) if there exists a constant $N \in \mathbb{N}$ such that for each $k\in \mathbb{N}$, there are no more than $N$ vertices $v\in \Sigma^*$ with $\left\vert v \right\vert = k$ (i.e.\@ at level $k$) such that $\left.\alpha\right\vert_v \neq 1$.
Thus, the action of such a bounded automorphism will, on each level, be trivial on all but (up to) $N$ sub-trees.
The set of all such automorphisms form a group which we will denote as $\mathcal{B}(\mathcal{T}_d)$.
The group of all \emph{bounded automaton automorphisms} is defined as the intersection $\mathcal{A}(\mathcal{T}_d) \cap \mathcal{B}(\mathcal{T}_d)$, which we will denote as $\mathcal{D}(\mathcal{T}_d)$.
A subgroup of $\mathcal{D}(\mathcal{T}_d)$ is called a  \emph{bounded automata group}.

A \emph{finitary automorphism} of $\mathcal{T}_d$ is an automorphism $\phi$ such that there exists a constant $k \in \mathbb{N}$ for which $\left. \phi \right\vert_v = 1$ for each $v \in \Sigma^*$ with $\left\vert v \right\vert = k$.
Thus, a finitary automorphism is one that is trivial after some $k$ levels of the tree.
Given a finitary automorphism $\phi$, the smallest $k$ for which this definition holds will be called its \emph{depth} and will be denoted as $\mathrm{depth}(\phi)$.
We will denote the group formed by all finitary automorphisms of $\mathcal{T}_d$ as $\mathrm{Fin}(\mathcal{T}_d)$.
See \cref{fig:finitary examples} for examples of the actions of finitary automorphisms on their associated trees (where any unspecified sub-tree is fixed by the action).

\begin{figure}[!ht]
	\centering
	\begin{minipage}[t]{.3\linewidth}
		\centering
		\includegraphics{figure/finitaryA}
	\end{minipage}
	~
	\begin{minipage}[t]{.3\linewidth}
		\centering
		\includegraphics{figure/finitaryB}
	\end{minipage}
	\caption{Examples of finitary automorphisms $a,b\in\mathrm{Fin}\!\left(\mathcal{T}_2\right)$.}
	\label{fig:finitary examples}
\end{figure}

Let $\delta \in \mathcal{A}\!\left(\mathcal{T}_d\right) \setminus \mathrm{Fin}\!\left(\mathcal{T}_d\right)$. We call $\delta$ a \emph{directed automaton automorphism} if
\begin{equation}
	\label{eq:directed automorphism definition}
	\delta
	=
	(\phi_1, \phi_2, \ldots, \phi_{k-1}, \delta', \phi_{k+1}, \ldots, \phi_d) \cdot \sigma
	\in
	\mathrm{Aut}\!\left(\mathcal{T}_d\right) \wr \mathrm{Sym}(\Sigma)
\end{equation}
where each $\phi_j$ is finitary and $\delta'$ is also directed automaton (that is, not finitary and can also be written in this form).
We call $\mathrm{dir}(\delta) = b = a_k \in \Sigma$, where $\delta'=\delta\vert_{b}$ is directed automaton, the \emph{direction} of $\delta$; and we define the \emph{spine} of $\delta$, denoted $\mathrm{spine}(\delta) \in \Sigma^\omega$, recursively such that $\mathrm{spine}(\delta) = \mathrm{dir}(\delta) \, \mathrm{spine}(\delta')$.
We denote the set of all directed automaton automorphisms as $\mathrm{Dir}(\mathcal{T}_d)$.
See \cref{fig:directed examples} for examples of directed automaton automorphisms (in which $a$ and $b$ are the finitary automorphisms in \cref{fig:finitary examples}).

\begin{figure}[!ht]
	\centering
	\begin{minipage}[t]{.3\linewidth}
		\centering
		\includegraphics{figure/directedX}
	\end{minipage}
	~
	\begin{minipage}[t]{.3\linewidth}
		\centering
		\includegraphics{figure/directedY}
	\end{minipage}
	~
	\begin{minipage}[t]{.3\linewidth}
		\centering
		\includegraphics{figure/directedZ}
	\end{minipage}
	\caption{Examples of directed automorphisms $x,y,z \in \mathrm{Dir}(\mathcal{T}_2)$.}
	\label{fig:directed examples}
\end{figure}

The following lemma is essential to prove our main theorem.

\begin{lemma}[Lemma~3~in~\cite{holt2006}]
	\label{lemma:spine is eventualy periodic}
	The spine, $\mathrm{spine}(\delta) \in \Sigma^\omega$, of a directed automaton automorphism, $\delta \in \mathrm{Dir}(\mathcal{T}_d)$, is eventually periodic, that is, there exists some $\iota = \iota_1 \iota_2 \cdots \iota_s \in \Sigma^*$, called the \emph{initial section}, and
	$\pi = \pi_1 \pi_2 \cdots \pi_t \in \Sigma^*$, called the \emph{periodic section}, such that $\mathrm{spine}(\delta) = \iota \, \pi^\omega$; and
	\begin{equation}
		\label{eq:restrictions along periodic section}
		\left.
		\delta
		\right\vert_{\iota \, \pi^k \, \pi_1 \pi_2 \cdots \pi_j}
		=
		\left.
		\delta
		\right\vert_{\iota \, \pi_1 \pi_2 \cdots \pi_j}
	\end{equation}
	for each $k,j \in \mathbb{N}$ with $0\leq j <t$.
\end{lemma}

\begin{proof}
	Let $(\Gamma,v)$ be a $\Sigma$-automaton such that $\delta = \alpha_{(\Gamma,v)}$.
	By the definition of $\Sigma$-automata, for any given vertex $w = w_1 w_2 \cdots w_k \in \Sigma^*$ of $\mathcal{T}_d$ there exists a vertex $v_w \in \mathrm{V}(\Gamma)$ such that $\delta\vert_w = \alpha_{(\Gamma,v_w)}$.
	In particular, such a vertex $v_w$ can be obtained by following the path with edges labelled
	$
	(w_1, w_1')
	(w_2, w_2')
	\cdots
	(w_k, w_k')
	$.
	Then, since there are only finitely many vertices in $\Gamma$, the set of all restrictions of $\delta$ is finite, that is,
	\begin{equation}\label{eq:finitely many restrictions}
		\#
		\left\{
			\left.\delta\right\vert_w
			=
			\alpha_{(\Gamma,v_w)}
		\mid
			w \in \Sigma^*
		\right\}
		<
		\infty.
	\end{equation}
	Let $b = b_1 b_2 b_3 \cdots = \mathrm{spine}(\delta) \in \Sigma^\omega$ denote the spine of $\delta$.
	Then, there exists some $n,m \in \mathbb{N}$ with $n < m$ such that
	\begin{equation}
		\label{eq:equivalent restrictions}
		\delta\vert_{b_1 b_2 \cdots b_n}
		=
		\delta\vert_{b_1 b_2 \cdots b_n \cdots b_{m}}
	\end{equation}
	as otherwise there would be infinitely many distinct restrictions of the form $\delta\vert_{b_1 b_2 \cdots b_k}$ thus contradicting (\ref{eq:finitely many restrictions}).
	By the definition of the spine, it follows that
	\[
	\mathrm{spine}
	\left(
	\delta\vert_{b_1 b_2 \cdots b_n}
	\right)
	=
	(b_{n+1}b_{n+2} \cdots b_m)
	\
	\mathrm{spine}
	\left(
	\delta\vert_{b_1 b_2 \cdots b_n \cdots b_{m}}
	\right).
	\]
	Hence, by (\ref{eq:equivalent restrictions}),
	\[
	\mathrm{spine}
	\left(
	\delta\vert_{b_1 b_2 \cdots b_n}
	\right)
	=
	(b_{n+1}b_{n+2} \cdots b_m)^\omega.
	\]
	Thus,
	\begin{align*}
		\mathrm{spine}(\delta)
		&=
		(b_1 b_2 \cdots b_n)
		\
		\mathrm{spine}
		\left(
		\delta\vert_{b_1 b_2 \cdots b_n}
		\right)
		\\&=
		(b_1 b_2 \cdots b_n)
		\
		(b_{n+1}b_{n+2} \cdots b_m)^\omega.
	\end{align*}
	By taking $\iota = b_1 b_2 \cdots b_n$ and $\pi = b_{n+1} b_{n+2} \cdots b_m$, we have $\mathrm{spine}(\delta) = \iota\,\pi^\omega$.
	Moreover, from (\ref{eq:equivalent restrictions}), we have equation (\ref{eq:restrictions along periodic section}) as required.
\end{proof}

Notice that each finitary and directed automata automorphism is also bounded, in fact, we have the following proposition which shows that the generators of any given bounded automata group can be written as words in $\mathrm{Fin}\!\left(\mathcal{T}_d\right)$ and $\mathrm{Dir}\!\left(\mathcal{T}_d\right)$.

\begin{proposition}[Proposition 16 in \cite{sidki2000}]
	\label{prop:bounded automata group if directed}
	The group $\mathcal{D}\!\left(\mathcal{T}_d\right)$ of bounded automata automorphisms is generated by $\mathrm{Fin}\!\left(\mathcal{T}_d\right)$ together with $\mathrm{Dir}\!\left(\mathcal{T}_d\right)$.
\end{proposition}

\subsection{Co-Word Problems}\label{sec:mainthm}

We may now prove the following characterisation of bounded automata groups.

\setcounter{theoremx}{3}
\TheoremBoundedAutomata

The idea of the proof is straightforward:
we construct a cspd machine that nondeterministically chooses a vertex $v \in \mathrm{V}(\mathcal{T}_d)$, writing its labels on the check-stack and a copy on its pushdown;
as it reads letters from input, it uses the pushdown to keep track of where the chosen vertex is moved;
and finally it checks whether the pushdown and the check-stack differ.
The full details are as follows.

\begin{proof}

	Let $G \subseteq \mathcal{D}(\mathcal{T}_d)$ be a bounded automata group with finite monoid generating set $X$.
	By \cref{prop:bounded automata group if directed}, we can define a map
	\[
	\varphi\colon
	X
	\to
	\left(
	\mathrm{Fin}(\mathcal{T}_d) \cup \mathrm{Dir}(\mathcal{T}_d)
	\right)^*
	\] so that $x$ and $\varphi(x)$ are equal in $\mathcal{D}(\mathcal{T}_d)$ for each $x \in X$.
	Let
	\[
	Y
	=
	\left\{
		\alpha \in \mathrm{Fin}(\mathcal{T}_d) \cup \mathrm{Dir}(\mathcal{T}_d)
	\ \middle|\
		\alpha\text{ or } \alpha^{-1} \text{ is a letter in } \varphi(x) \text{ for some } x \in X
	\right\}
	\] which is a finite generating set for a group which contains $G$ as a subgroup.
	Consider the group $H \subseteq \mathcal{D}(\mathcal{T}_d)$ generated by $Y$.
	Since ET0L is closed under inverse word homomorphism, it suffices to prove that $\coWP_Y$ is ET0L, as $\coWP_X$ is its inverse image under the mapping $X^* \to Y^*$ induced by  $\varphi$.
	We construct a cspd machine $\mathcal{M}$ that recognises $\coWP_Y$, thus proving that $G$ is co-ET0L.

	Let $\alpha = \alpha_1 \alpha_2 \cdots \alpha_n \in Y^*$ denote an input word given to $\mathcal{M}$.
	The execution of the cspd will be separated into four stages;
	(1) choosing a vertex $v \in \Sigma^*$ of $\mathcal{T}_d$ which witnesses the non-triviality of $\alpha$ (and placing it on the stacks);
	(2a)  reading a finitary automorphism from the input tape;
	(2b)  reading a directed automaton automorphism from the input tape; and
	(3)  checking that the action of $\alpha$ on $v$ that it has computed is non-trivial.

	After Stage~1, $\mathcal{M}$ will be in state $q_\mathrm{comp}$.
	From here, $\mathcal{M}$ nondeterministically decides to either read from its input tape, performing either Stage~2a or 2b and returning to state $q_\mathrm{comp}$; or to finish reading from input by performing Stage~3.

	We	set both the check-stack and pushdown alphabets to be $\Sigma \cup \{\mathfrak{t}\}$,
	i.e., we have $\Delta=\Gamma=\Sigma \cup \{\mathfrak{t}\}$.
	The letter $\mathfrak{t}$ will represent the top of the check-stack.

	\proofsection{Stage 1: choosing a witness $v = v_1 v_2 \cdots v_m \in \Sigma^*$}

	If $\alpha$ is non-trivial, then there must exist a vertex $v \in \Sigma^*$ such that $\alpha \cdot v \neq v$.
	Thus, we nondeterministically choose such a witness from $\mathcal{R} = \Sigma^* \mathfrak{t}$ and store it on the check-stack, where the letter $\mathfrak{t}$ represents the top of the check-stack.

	From the start state, $q_0$, $\mathcal{M}$ will copy the contents of the check-stack onto the pushdown, then enter the state $q_\mathrm{comp} \in Q$.
	Formally, this will be achieved by adding the transitions (for each $a \in \Sigma$):
	\[
	(
	(q_0,\varepsilon,(\mathfrak{b},\mathfrak{b})),
	(q_0,\mathfrak{t}\mathfrak{b})
	),\,
	(
	(q_0,\varepsilon,(a,\mathfrak{t})),
	(q_0,\mathfrak{t}a)
	),\,
	(
	(q_0,\varepsilon,(\mathfrak{t},\mathfrak{t})),
	(q_\mathrm{comp},\mathfrak{t})
	).
	\]

	This stage concludes with $\mathcal{M}$ in state $q_{\mathrm{comp}}$, and the read-head pointing to $(\mathfrak t, \mathfrak t)$.
	Note that whenever the machine is in state $q_{\mathrm{comp}}$ and $\alpha_1 \alpha_2 \cdots \alpha_k$ has been read from input, then the contents of pushdown will represent the permuted vertex $(\alpha_1 \alpha_2 \cdots \alpha_k) \cdot v$.
	Thus, the two stacks are initially the same as no input has been read and thus no group action has been simulated.
	In Stages~2a and 2b, only the height of the check-stack is important, that is, the exact contents of the check-stack will become relevant in Stage~3.

	\proofsection{Stage~2a: reading a finitary automorphism $\phi \in Y\cap\mathrm{Fin}(\mathcal{T}_d)$}

	By definition, there exists some $k_\phi = \mathrm{depth}(\phi) \in \mathbb{N}$ such that $\left.\phi\right\vert_u = 1$ for each $u \in \Sigma^*$ for which $\vert u \vert \geq k_\phi$.
	Thus, given a vertex $v = v_1 v_2 \cdots v_m \in \Sigma^*$, we have
	\[
	\phi(v)
	=
	\phi(v_1 v_2 \cdots v_{k_\phi})
	\
	v_{(k_\phi+1)}
	\cdots
	v_m.
	\]

	Given that $\mathcal{M}$ is in state $q_\mathrm{comp}$ with $\mathfrak{t} v_1 v_2 \cdots v_m \mathfrak{b}$ on its pushdown, we will read $\phi$ from input, move to state $q_{\phi,\varepsilon}$ and pop the $\mathfrak{t}$;
	we will then pop the next $k_\phi$ (or fewer if $m < k_\phi$) letters off the pushdown, and as we are popping these letters we visit the sequence of states $q_{\phi,v_1}$, $q_{\phi,v_1 v_2}$, \dots, $q_{\phi,v_1 v_2 \cdots v_{k_\phi}}$.
	From the final state in this sequence, we then push $\mathfrak t\phi(v_1\cdots v_{k_\phi})$ onto the pushdown, and return to the state $q_{\mathrm{comp}}$.

	Formally, for letters $a,b \in \Sigma$, $\phi \in Y\cap\mathrm{Fin}(\mathcal{T}_d)$, and vertices $u,w\in\Sigma^*$ where $ |u|< k_\phi$ and $ |w|=k_\phi$, we have the transitions
	\[
	(
	(q_{\mathrm{comp}}, \phi, (\mathfrak{t},\mathfrak{t})),
	(q_{\phi,\varepsilon}, \varepsilon)
	), \
	(
	(q_{\phi,u}, \varepsilon, (a,b)),
	(q_{\phi, ub}, \varepsilon)
	),
	\]
	\[
	(
	(q_{\phi,  w}, \varepsilon, (\varepsilon,\varepsilon)),
	(q_\mathrm{comp}, \mathfrak{t}\phi(w))
	)
	\]
	for the case where $m > k_\phi$, and
	\[
	(
	(q_{\phi, u}, \varepsilon, (\mathfrak{b},\mathfrak{b})),
	(q_\mathrm{comp}, \mathfrak{t}\phi(u)\mathfrak{b})
	)
	\]
	for the case where $m \leq k_\phi$.
	Notice that we have finitely many states and transitions  since $Y,$ $\Sigma$ and each $k_\phi$ is finite.

	\proofsection{Stage~2b: reading a directed automorphism $\delta \in Y\cap\mathrm{Dir}(\mathcal{T}_d)$}

	By \cref{lemma:spine is eventualy periodic}, there exists some $\iota = \iota_1 \iota_2 \cdots \iota_s \in \Sigma^*$ and $\pi = \pi_1 \pi_2 \cdots \pi_t \in \Sigma^*$ such that
	$
	\mathrm{spine}(\delta)
	=
	\iota \, \pi^\omega
	$
	and
	\[
	\delta(\iota\pi^\omega)
	=
	I_1 I_2 \cdots I_s
	\,
	\left( \Pi_1 \Pi_2 \cdots \Pi_t \right)^\omega
	\]
	where
	\[
	I_i
	=
	\left. \delta \right\vert_{\iota_1 \iota_2 \cdots \iota_{i-1}} (\iota_i)
	%
	\qquad
	%
	\text{and}
	%
	\qquad
	%
	\Pi_j
	=
	\left. \delta \right\vert_{\iota \, \pi_1 \pi_2 \cdots \pi_{j-1}}\!(\pi_j).
	\]

	Given some vertex $v = v_1 v_2 \cdots v_m \in \Sigma^*$, let $\ell \in \mathbb{N}$ be largest such that $p = v_1 v_2 \cdots v_\ell$ is a prefix of the sequence $\iota\pi^\omega = \mathrm{spine}(\delta)$.
	Then by  definition of directed automorphism, $\delta' = \delta\vert_p$ is directed and $\phi = \delta\vert_a$, where $a = v_{\ell}$, is finitary.
	Then, either $p = \iota_1 \iota_2 \cdots \iota_\ell$ and
	\[
	\delta(v)
	=
	(I_1 I_2 \cdots I_\ell)
	\
	\delta'(a)
	\
	\phi(v_{\ell+2} v_{\ell+3} \cdots v_m),
	\]
	or $p = \iota\pi^k\pi_1\pi_2\cdots\pi_j$, with $\ell = |\iota|+k\cdot|\pi| + j$, and
	\[
	\delta(v)
	=
	(I_1 I_2 \cdots I_s)
	\,
	(\Pi_1 \Pi_2 \cdots \Pi_t)^k
	\,
	(\Pi_1 \Pi_2 \cdots \Pi_j)
	\
	\delta'(a)
	\
	\phi( v_{\ell+2} v_{\ell+3} \cdots v_m).
	\]

	Hence, from state $q_\mathrm{comp}$ with $\mathfrak{t} v_1 v_2 \cdots v_m \mathfrak{b}$ on its pushdown, $\mathcal M$ reads $\delta$ from input, moves to state $q_{\delta,\iota,0}$ and pops the $\mathfrak{t}$;
	it then pops $pa$ off the pushdown, using states to remember the letter $a$ and the part of the prefix to which the final letter of $p$ belongs (i.e.\@ $\iota_i$ or $\pi_j$).
	From here, $\mathcal{M}$ performs the finitary automorphism $\phi$ on the remainder of the pushdown (using the same construction as Stage~2a), then, in a sequence of transitions, pushes $\mathfrak{t}\delta(p)\delta'(a)$ and returns to state $q_\mathrm{comp}$.
	The key idea here is that, using only the knowledge of the letter $a$, the part of $\iota$ or $\pi$ to which the final letter of $p$ belongs, and the height of the check-stack, that $\mathcal M$ is able to recover $\delta(p)\delta'(a)$.

	We now give the details of the states and transitions involved in this stage of the construction.

	We have states $q_{\delta,\iota,i}$ and $q_{\delta,\pi,j}$ with $0 \leq i \leq \vert \iota \vert$, $1 \leq j \leq \vert \pi \vert$; where $q_{\delta,\iota,i}$ represents that the word $\iota_1 \iota_2 \cdots \iota_i$ has been popped off the pushdown, and $q_{\delta,\pi,j}$ represents that a word $\iota\pi^k\pi_1\pi_2\cdots \pi_j$ for some $k \in \mathbb{N}$ has been popped of the pushdown.
	Thus, we begin with the transition
	\[
	(
	(q_\mathrm{comp}, \delta, (\mathfrak{t},\mathfrak{t})),
	(q_{\delta,\iota,0},\varepsilon)
	),
	\]
	then for each $i,j\in \mathbb{N}$, $a \in \Sigma$ with $0 \leq i < \vert \iota \vert$ and $1 \leq j < \vert \pi \vert$, we have transitions
	\begin{align*}
		(
		(q_{\delta,\iota,i}, \varepsilon, (a,\iota_{i+1})),
		(q_{\delta,\iota,(i+1)},\varepsilon)
		),&\ \
		(
		(q_{\delta,\iota,|\iota|}, \varepsilon, (a,\pi_1)),
		(q_{\delta,\pi,1},\varepsilon)
		),
		\\
		(
		(q_{\delta,\pi,j}, \varepsilon, (a,\pi_{j+1})),
		(q_{\delta,\pi,(j+1)},\varepsilon)
		),&\ \
		(
		(q_{\delta,\pi,|\pi|}, \varepsilon, (a,\pi_1)),
		(q_{\delta,\pi,1},\varepsilon)
		)
	\end{align*}
	to consume the prefix $p$.

	After this,  $\mathcal{M}$ will either be at the bottom of its stacks, or its read-head will see a letter on the pushdown that is not the next letter in the spine of $\delta$.
	Thus, for each $i,j \in \mathbb{N}$ with $0 \leq i \leq \vert \iota \vert$ and $1 \leq j \leq |\pi|$ we have states $q_{\delta,\iota,i,a}$ and $q_{\delta,\pi,j,a}$;
	and for each $b \in \Sigma$ we have transitions
	\[
	(
	(q_{\delta,\iota,i}, \varepsilon, (b,a)),
	(q_{\delta,\iota,i,a},\varepsilon)
	)
	\]
	where $a \neq \iota_{i+1}$ when $i < |\iota|$ and $a \neq \pi_1$ otherwise, and
	\[
	(
	(q_{\delta,\pi,j}, \varepsilon, (b,a)),
	(q_{\delta,\pi,j,a},\varepsilon)
	)
	\]
	where $a \neq \pi_{j+1}$ when $j < |\pi|$ and $a \neq \pi_1$ otherwise.

	Hence, after these transitions, $\mathcal{M}$ has consumed $pa$ from its pushdown and will either be at the bottom of its stacks in some state $q_{\delta,\iota,i}$ or $q_{\delta,\pi,j}$; or will be in some state $q_{\delta,\iota,i,a}$ or $q_{\delta,\pi,j,a}$.
	Note here that, if $\mathcal{M}$ is in the state $q_{\delta,\iota,i,a}$ or $q_{\delta,\pi,j,a}$, then from \cref{lemma:spine is eventualy periodic} we know $\delta' = \delta\vert_{p}$ is equivalent to $\delta\vert_{\iota_1 \iota_2\cdots \iota_i}$ or $\delta\vert_{\iota \pi_1 \pi_2 \cdots \pi_j}$, respectively; and further, we know the finitary automorphism $\phi = \delta\vert_{pa} = \delta'\vert_a$.

	Thus, for each state $q_{\delta,\iota,i,a}$ and $q_{\delta,\pi,a}$ we will follow a similar construction to Stage~2a, to perform the finitary automorphism $\phi$ to the remaining letters on the pushdown, then push $\delta'(a)$ and return to the state $r_{\delta,\iota,i}$ or $r_{\delta,\pi,j}$, respectively.
	For the case where $\mathcal{M}$ is at the bottom of its stacks we have transitions
	\[
	(
	(q_{\delta,\iota,i}, \varepsilon, (\mathfrak{b},\mathfrak{b})),
	(r_{\delta,\iota,i}, \mathfrak{b})
	),\ \
	(
	(q_{\delta,\pi,i}, \varepsilon, (\mathfrak{b},\mathfrak{b})),
	(r_{\delta,\pi,i}, \mathfrak{b})
	)
	\]
	with $0 \leq i \leq |\iota|$, $1 \leq j \leq |\pi|$.

	Thus, after following these transitions, $\mathcal{M}$ is in some state $r_{\delta,\iota,i}$ or $r_{\delta,\pi,j}$ and all that remains is for $\mathcal{M}$ to push $\delta(p)$ with $p = \iota_1 \iota_2\cdots \iota_i$ or $p = \iota\pi^k\pi_1 \pi_2\cdots \pi_k$, respectively, onto its pushdown.
	Thus, for each $i,j\in \mathbb{N}$ with $0 \leq i \leq |\iota|$ and $1 \leq j \leq |\pi|$, we have transitions
	\[
	(
	(r_{\delta,\pi,i}, \varepsilon,(\varepsilon,\varepsilon)),
	(q_\mathrm{comp}, \mathfrak{t} I_1 I_2 \cdots I_i)
	),
	\ \
	(
	(r_{\delta,\pi,j}, \varepsilon,(\varepsilon,\varepsilon)),
	(r_{\delta,\pi}, \Pi_1 \Pi_2 \cdots \Pi_j)
	)
	\]
	where from the state $r_{\delta,\pi}$, through a sequence of transitions, $\mathcal{M}$ will push the remaining $I\Pi^k$ onto the pushdown.
	In particular, we have transitions
	\[
	(
	(r_{\delta,\pi}, \varepsilon,(\varepsilon,\varepsilon)),
	(r_{\delta,\pi},\Pi)
	),
	\ \
	(
	(r_{\delta,\pi}, \varepsilon,(\varepsilon,\varepsilon)),
	(q_\mathrm{comp},\mathfrak{t}I)
	),
	\]
	so that $\mathcal{M}$ can nondeterministically push some number of $\Pi$'s followed by $\mathfrak{t}I$  before it finishes this stage of the computation.
	We can assume that the machine pushes the correct number of $\Pi$'s onto its pushdown as otherwise it will not see $\mathfrak{t}$ on its check-stack while in state $q_\mathrm{comp}$ and thus would not be able to continue with its computation, as every subsequent stage (2a,2b,3) of the computation begins with the read-head pointing to $\mathfrak{t}$ on both stacks.

	Once again it is clear that this stage of the construction requires only finitely many states and transitions.

	\proofsection{Stage~3: checking that the action is non-trivial}

	At the beginning of this stage, the contents of the check-stack represent the chosen witness, $v$, and the contents of the pushdown represent the action of the input word, $\alpha$, on the witness, i.e., $\alpha \cdot v$.

	In this stage $\mathcal{M}$  checks if the contents of its check-stack and pushdown differ.
	Formally, we have states $q_\mathrm{accept}$ and  $q_{\mathrm{check}}$, with $q_\mathrm{accept}$ accepting;
	for each $a \in \Sigma$, we have transitions
	\[
	(
	(q_\mathrm{comp}, \varepsilon, (\mathfrak{t},\mathfrak{t})),
	(q_\mathrm{check}, \varepsilon)
	),
	\ \
	(
	(q_\mathrm{check}, \varepsilon, (a,a)),
	(q_\mathrm{check}, \varepsilon)
	)
	\]
	to pop identical entries of the pushdown; and for each $(a,b) \in \Sigma \times \Sigma$ with $a \neq b$ we have a transition
	\[
	(
	(q_\mathrm{check},\varepsilon,(a,b)),
	(q_\mathrm{accept},\varepsilon)
	)
	\]
	to accept if the stacks differ by a letter.

	Observe that if the two stacks are identical, then there is no path to the accepting state, $q_\mathrm{accept}$, and thus $\mathcal{M}$ will reject.
	Notice also that by definition of cspd automata, if $\mathcal M$ moves into  $q_{\mathrm{check}}$ before all input has been read, then $\mathcal{M}$ will not accept, i.e., an accepting state is only effective if all input is consumed.

	\proofsection{Soundness and Completeness}

	If $\alpha$ is non-trivial, then there is a vertex $v \in \Sigma^*$ such that $\alpha \cdot v \neq v$, which $\mathcal{M}$ can nondeterministically choose to write on its check-stack and thus accept $\alpha$.
	If $\alpha$ is trivial, then $\alpha \cdot v = v$ for each vertex $v \in \Sigma^*$, and there is no choice of checking stack for which $\mathcal{M}$ will accept, so $\mathcal{M}$ will reject.

	Thus, $\mathcal{M}$ accepts a word if and only if it is in $\coWP_Y$.
\end{proof}

\section{Open Problems and Concluding Remarks}

\Cref{thm:bounded automata is ET0L} opens the door to a new characterisation of groups by their co-word problem.
In particular, this result is a step towards a characterisation of groups with ET0L co-word problems.
However, it still remains to be shown that there is a group whose co-word problem is ET0L but not context-free.
It is conjectured~\cite[2]{bleak2016} that Grigorchuk's group does not have a context-free co-word problem.
Thus, we ask the following.

\begin{question}
	Is the co-word problem for Grigorchuk's group (or some other bounded automata group) not context-free?
\end{question}

It is then natural to ask if there is a classification of co-ET0L groups.