%!TEX program = lualatex

% Copyright (c) 2021 Thomas Jenni

% Permission is hereby granted, free of charge, to any person obtaining a copy
% of this software and associated documentation files (the "Software"), to deal
% in the Software without restriction, including without limitation the rights
% to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
% copies of the Software, and to permit persons to whom the Software is
% furnished to do so, subject to the following conditions:

% The above copyright notice and this permission notice shall be included in all
% copies or substantial portions of the Software.

% THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
% IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
% FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
% AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
% LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
% OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
% SOFTWARE.

\documentclass{article}

\usepackage{luacode}
\usepackage{siunitx}
\usepackage{amsmath}

% siunitx config
\sisetup{
	output-decimal-marker = {.},
	per-mode = symbol,
	separate-uncertainty = false,
	add-decimal-zero = true,
	exponent-product = \cdot,
	round-mode=off
}

% empty unit
\DeclareSIUnit\unitless{}

\DeclareSIUnit\inch{in}

% init lua-physical
\begin{luacode}
physical = require("physical")
N = physical.Number
\end{luacode}

\newcommand{\q}[1]{%
	\directlua{tex.print(physical.Quantity.tosiunitx(#1,"add-decimal-zero=true,scientific-notation=fixed,exponent-to-prefix=false"))}%
}

\newcommand{\qs}[1]{%
	\directlua{tex.print(physical.Quantity.tosiunitx(#1,"scientific-notation=true,exponent-to-prefix=false,round-integer-to-decimal=true"))}%
}

\newcommand{\qt}[1]{%
	\directlua{tex.print(physical.Quantity.tosiunitx(#1,"scientific-notation=engineering,exponent-to-prefix=true,round-integer-to-decimal=true"))}%
}

\newcommand{\qn}[1]{%
	\directlua{tex.print(physical.Quantity.tosiunitx(#1,"add-decimal-zero=true,scientific-notation=fixed,exponent-to-prefix=false",1))}%
}

\newcommand{\qu}[1]{%
	\directlua{tex.print(physical.Quantity.tosiunitx(#1,nil,2))}%
}

\begin{document}

\section*{Example for the {\tt lua-physical} package}.

Compile this Lua\LaTeX file with the command `{\tt lualatex lua-physical\_example.tex}'.

\begin{enumerate}

\begin{luacode}
a = 12 * _cm
b = 150 * _mm
c = 1.5 * _m

V = ( a * b * c ):to(_dm^3)
\end{luacode}

\item Find the volume of a cuboid with lengths $\q{a}$,
$\q{b}$ and $\q{c}$.
%
\begin{equation*}
  V= a \cdot b \cdot c
  = \q{a} \cdot \q{b} \cdot \q{c}
  = \underline{\q{V}}
\end{equation*}

\begin{luacode}
l = 12 * _in
\end{luacode}

\item Convert $\q{l}$ to the unit $\qu{_cm}$.
%
\begin{equation*}
  l = \q{l} \cdot \frac{\q{_in:to(_cm)}}{\qu{_in}} = \q{l:to(_cm)}
\end{equation*}

\begin{luacode}
N.omitUncertainty = true

d = N(1,0.0001) * ( _au ):to(_km)
v = N(1,0.0001) * ( _c ):to(_km/_s)
t = ( d/v ):to(_min)
\end{luacode}

\item Calculate the time, a lightray travels from the surface of the sun to the earth.
The mean distance from the sun to the eart is $\qs{d}$. The speed of light is $\q{v}$.
%
\begin{equation*}
  t = \frac{d}{v} = \frac{\qs{d}}{\q{v}} = \underline{\q{t}}
\end{equation*}

\end{enumerate}

\end{document}


%% SECTION HEADER /////////////////////////////////////////////////////////////////////////////////////
\section{Model-Assisted Damage Identification Function}
\label{sec:madif}

%% SECTION CONTENT ////////////////////////////////////////////////////////////////////////////////////
he severity of damage was estimated based on the function determined with the numerical simulation.
A simple flowchart given in Figure~\ref{fig:Flowchart} represents a process for the sample assessment.
When the structure model is developed, several computer simulations for various damage sizes must be conducted to determine the \ac{madif}.
%\begin{figure}[H]
%	%	\begin{center}
%	\includegraphics[width=1\linewidth]{Chapter_7/flowchart}
%	%	\end{center}
%	\caption{A flowchart representing the process for damage size estimation.}
%	\label{fig:Flowchart}
%\end{figure}
The \ac{madif} indicates the damage size according to measured damage index \(I\) normalized by the value obtained for the pristine sample \(I^{ref}\).
In the paper, two types of damage index \(I\) are considered: the energy \(I_{eng}\) and the maximum value of the half-width of the first package arrived in the sensor \(I_{amp}\), and these are defined as:
\begin{eqnarray}
	I_{eng}(\Phi_D)=\sum_{t=0}^{T} \left (\Psi_g(t,\Phi_D)\right )^2,\quad I_{eng}^{ref}=\sum_{t=0}^{T} \left (\Psi_g(t,0)\right )^2,\\
	I_{amp}(\Phi_D)=\mathrm{max}\left ( \Psi_g(t,\Phi_D)\right ),\quad I_{amp}^{ref}=\mathrm{max}\left ( \Psi_g(t,0)\right ),
	\label{eq:I_amp}
\end{eqnarray}
where \textit{T} is a period of the signal.
\(\Psi_g(t,\Phi_D)\) is for the damaged case scenario, whereas \(\Psi_g(t,0)\) is for the pristine sample and it is realized in the same way by windowing the full-length signals of the sensor \(\Psi(t)\) with a flattened Gaussian window \emph{g(t)} as follows:
\begin{eqnarray}
	\Psi_g(t)=\Psi(t)g(t)= \Psi(t)\mathrm{exp}\left(-\left(\frac{t-t_0}{0.6005612w_g}\right) ^{12}\right),
	\label{eq:psi_g}
\end{eqnarray}
where \(t_0\) is the center and \(w_g=0.5N_c/f_c\) is a half-width of the window.
Windowing the signals ensures obtaining the signals without any reflections from the boundaries.
The determination of \(\Psi_g\) is pictured in Figure~\ref{fig:window_madif}a.

\begin{figure}[H]
	%	\begin{center}
	\includegraphics[width=1\linewidth]{Chapter_7/window_madif_03}
	%	\end{center}
	\caption{(\textbf{a}) The %MDPI: The hyphen in the picture should be changed to minus sign, e.g., ``-0.5'' to ``$-$0.5'', please change. Please check all like this in all figures.
		sensor signal \(\Psi(t)\) windowed by a flattened Gaussian window \(g(t)\) and (\textbf{b}) the damage size estimation from the \ac{madif}.}
	\label{fig:window_madif}
\end{figure}
In the time domain, an equivalent numerical signal to the signal registered by the \ac{pzt} acquisition instrument is calculated as an average value of the electrical potential of the electrode surface
\begin{eqnarray}
	\Psi^{n}(t) = \frac{\int_{\Gamma_e}\phi\mathrm{d}\Gamma}{\Gamma_e},
	\label{eq:psi}
\end{eqnarray}
where \(n=1\) and \(n=2\) correspond to the homogenized and presented model, respectively.

The \ac{madif} is achieved by approximating the inverse of the computed damage index that best matches the experimental one.
Finally, the damage size \(\Phi_D\) is obtained from the \ac{madif} curve for measuring the normalized value of \(I/I^{ref}\) as it is presented in Figure~\ref{fig:window_madif}b.


\newcommand{\HTSwiki}{\cite{HighTempSuperconductor-wiki}}
\newcommand{\RVBwiki}{\cite{ResonatingValenceBondTheory-wiki}}
\newcommand{\SCor}{\cite{StronglyCorrelatedModels-paper}}

\section{Introduction}

\subsection{HighTempSuperconductors}

\subsubsection{Transition Temperatures}
While normal {\quo{superconductors usually have transition temperatures below $30 k$, high temperatures have been observed with transition temperatures as high as $138 k$}}\HTSwiki

\subsubsection{Materials}

\paragraph{Certain cuprates} Compounds of copper and oxygen \HTSwiki \n
{\quo{Strong correlations}} have something to do {\quo{with these compounds}} \SCor

\paragraph{Hydrogen sulfide $H_2 S$} {\quo{under extremely high pressure}} is the {\quo{highest temperature superconductor known to date}}, with $T_c = 203 k$ \HTSwiki

\paragraph{Ceramics}
	\begin{itemize}
		\item {\quo{barium doped lanthanum and copper oxide}} with $T_c \approx 35 k$ \HTSwiki
		\item {\err{list some others?}}
	\end{itemize}

{\qs{I think I’ll be investigating cuprates? But I initially thought it would be ceramics?}}{\err{Find out which ones!}}

\subsubsection{Theories}

\paragraph{Resonating Valence Bond Theory} \RVBwiki

\section{Models}
The {\quo{two simplest models for strongly correlated electrons}} are \SCor
	\begin{itemize}
		\item {\quo{The Hubbard}} model \SCor
		\item {\quo{The $t-J$}} model \SCor
	\end{itemize}

{\quo{P.W Anderson proposed that a resonating valence bond wave-function,}} consisting {\quo{of a superposition of valence bond states, contains the ingredients to account for a consistent theory of}} these models \SCor

{\quo{Variational Monte Carlo}} programs have been successful in {\quo{describing some of the peculiar properties of these cuprates}}

{\na{Cedric’s Paper proposes an extension to these to include {\quo{strongly correlated }} … maybe that’s what he wants me to do?}}

\section{Magnetism}
\subsection{Antiferromagnetism}

\section{DMFT}

\subsection{Aim}
{\quo{There are many interesting unsolved problems, such as high critical temperatures}} \qi

\subsection{Perks}
{\quo{
	The simple Hubbard {\qs{(“truncated” PPP)}} model on a 2D lattice
		\eq{-t \sum_{ij, \sigma}{c^\dagger_{i\sigma}c_{j\sigma}} - \mu \sum_{i,\sigma}{c^\dagger_{i\sigma}c_{i\sigma}} + U \sum_i{n_{i\uparrow} n_{i\downarrow}} }
	gives rise to many electronic phases, e.g.
		\begin{itemize}
			\item anti ferromagnetism
			\item superconductors
		\end{itemize}
}} \qi


\documentclass{article}

\usepackage{fancyhdr}
\usepackage{extramarks}
\usepackage{amsmath}
\usepackage{amsthm}
\usepackage{amssymb}
\usepackage{amsfonts}
\usepackage{tikz}
\usepackage{physics}
\usepackage[plain]{algorithm}
\usepackage{algpseudocode}
\usepackage{graphicx,wrapfig,lipsum}
\usetikzlibrary{automata,positioning}

%
% Basic Document Settings
%

\topmargin=-0.45in
\evensidemargin=0in
\oddsidemargin=0in
\textwidth=6.5in
\textheight=9.0in
\headsep=0.25in

\linespread{1.1}

\pagestyle{fancy}
\lhead{\hmwkAuthorName}
\chead{\hmwkClass\ : \hmwkTitle}
\rhead{\firstxmark}
\lfoot{\lastxmark}
\cfoot{\thepage}

\renewcommand\headrulewidth{0.4pt}
\renewcommand\footrulewidth{0.4pt}

\setlength\parindent{0pt}

%
% Create Problem Sections
%
\newcommand{\be}{\begin{equation}}
\newcommand{\ee}{\end{equation}}
\newcommand{\bes}{\begin{equation*}}
\newcommand{\ees}{\end{equation*}}
\newcommand{\bea}{\begin{flalign*}}
\newcommand{\eea}{\end{flalign*}}

\newcommand{\enterProblemHeader}[1]{
    \nobreak\extramarks{}{Problem \arabic{#1} continued on next page\ldots}\nobreak{}
    \nobreak\extramarks{Problem \arabic{#1} (continued)}{Problem \arabic{#1} continued on next page\ldots}\nobreak{}
}

\newcommand{\exitProblemHeader}[1]{
    \nobreak\extramarks{Problem \arabic{#1} (continued)}{Problem \arabic{#1} continued on next page\ldots}\nobreak{}
    \stepcounter{#1}
    \nobreak\extramarks{Problem \arabic{#1}}{}\nobreak{}
}

\setcounter{secnumdepth}{0}
\newcounter{partCounter}
\newcounter{homeworkProblemCounter}
\setcounter{homeworkProblemCounter}{1}
\nobreak\extramarks{Problem \arabic{homeworkProblemCounter}}{}\nobreak{}

%
% Homework Problem Environment
%
% This environment takes an optional argument. When given, it will adjust the
% problem counter. This is useful for when the problems given for your
% assignment aren't sequential. See the last 3 problems of this template for an
% example.
%
\newenvironment{homeworkProblem}[1][-1]{
    \ifnum#1>0
        \setcounter{homeworkProblemCounter}{#1}
    \fi
    \section{Problem \arabic{homeworkProblemCounter}}
    \setcounter{partCounter}{1}
    \enterProblemHeader{homeworkProblemCounter}
}{
    \exitProblemHeader{homeworkProblemCounter}
}

%
% Homework Details
%   - Title
%   - Due date
%   - Class
%   - Section/Time
%   - Instructor
%   - Author
%

\newcommand{\hmwkTitle}{Assignment\ \#4}
\newcommand{\hmwkDueDate}{Due on 13th November, 2018}
\newcommand{\hmwkClass}{Fluid Mechanics}
\newcommand{\hmwkClassTime}{}
\newcommand{\hmwkClassInstructor}{}
\newcommand{\hmwkAuthorName}{\textbf{Aditya Vijaykumar}}

%
% Title Page
%

\title{
    %\vspace{2in}
    \textmd{\textbf{\hmwkClass:\ \hmwkTitle}}\\
    \normalsize\vspace{0.1in}\small{\hmwkDueDate\ }\\
%    \vspace{3in}
}

\author{\hmwkAuthorName}
\date{}

\renewcommand{\part}[1]{\textbf{\large Part \Alph{partCounter}}\stepcounter{partCounter}\\}

%
% Various Helper Commands
%

% Useful for algorithms
\newcommand{\alg}[1]{\textsc{\bfseries \footnotesize #1}}

% For derivatives
\newcommand{\deriv}[1]{\frac{\mathrm{d}}{\mathrm{d}x} (#1)}

% For partial derivatives
\newcommand{\pderiv}[2]{\frac{\partial}{\partial #1} (#2)}

% Integral dx
\newcommand{\dx}{\mathrm{d}x}

% Alias for the Solution section header
\newcommand{\solution}{\textbf{\large Solution}}

% Probability commands: Expectation, Variance, Covariance, Bias
\newcommand{\E}{\mathrm{E}}
\newcommand{\Var}{\mathrm{Var}}
\newcommand{\Cov}{\mathrm{Cov}}
\newcommand{\Bias}{\mathrm{Bias}}

\begin{document}

\maketitle
\textbf{Acknowledgements} - I thank Junaid Majeed for discussions.

\begin{homeworkProblem}[1]
	In ideal $2$D flow, $ \div{\va{u}} = 0 $. This means,
	\begin{equation*}
	\pdv{u}{x} + \pdv{v}{y} = 0 \implies u = \pdv{\psi}{y} \qq{and} v = - \pdv{\psi}{x}
	\end{equation*}
	Hence, $ \grad{\psi} = \pdv{\psi}{x} \vu{x} + \pdv{\psi}{y} \vu{y} = -v \vu{x} +  u \vu{y} $. By definition $ \va{u} = \grad{\phi} = u \vu{x} + v \vu{y} $. Now we can do the calculations required in the problem,

	\begin{itemize}
		\item $ \grad{\psi} \vdot \grad{\phi} = (-v \vu{x} +  u \vu{y})  \vdot  ( u \vu{x} + v \vu{y} ) = -vu + uv = 0$.
		\item $ - \grad{\psi} \cross \grad{\phi} = - (-v \vu{x} +  u \vu{y}) \cross  ( u \vu{x} + v \vu{y} ) =  - (-v^2 - u^2 )\vu{z} = \abs{\va{u}}^2 \vu{z} $
		\item $\abs{\grad{\psi}}^2 = u^2 + v^2 \qq{and}  \abs{\grad{\phi}}^2 = u^2 + v^2 \implies  \abs{\grad{\psi}}^2 = \abs{\grad{\phi}}^2$
		\item $ -\vu{z} \cross \grad{\psi} = -\vu{z} \cross (-v \vu{x} +  u \vu{y} ) = u \vu{x} + v \vu{y}  = \grad{\phi} $
	\end{itemize}
\end{homeworkProblem}

\begin{homeworkProblem}[2]
	\begin{itemize}
		\item For point source, $ \va{u} = \dfrac{q_s}{2 \pi r} \vu{r} $, where $ q_s $ is the source strength. In spherical polar coordinates, $  \va{u} = \pdv{\phi}{r} \vu{r} + \frac{1}{r} \pdv{\phi}{\theta} \vu{\theta} $. This means
		\begin{equation*}
		\phi = \int \pdv{\phi}{r} dr + \int \dfrac{1}{r} \pdv{\phi}{\theta} d\theta  = \dfrac{q_s}{2\pi} \ln r + constant
		\end{equation*}
		For lines of constant $ \phi $,
		\begin{align*}
		\dfrac{q_s}{2\pi} \ln r &= C\\
		\implies \dfrac{q_s}{2\pi r} \dv{r}{x} &= 0\\
		\implies \dfrac{q_s}{2\pi r^2} \qty(2x + 2y \dv{y}{x}) &= 0 \implies  \dv{y}{x} = - \dfrac{x}{y} = m
		\end{align*}
		As velocity is radial, the streamlines are also radial straight lines passing through the origin. The slope of such straight lines is $ \dfrac{y}{x} = - \dfrac{1}{m} $. Hence the streamlines and lines of constant $ \psi $ are perpendicular.

		\item For point vortex, $ \va{u} = \dfrac{\Gamma}{2 \pi r} \vu{\theta} = \dfrac{ -\Gamma y}{2 \pi (x^2 + y^2)} \vu{x} + \dfrac{ \Gamma x}{2 \pi (x^2 + y^2)} \vu{y} $. This means,
		\begin{equation*}
		\phi =  \dfrac{\Gamma}{2 \pi} \tan^{-1} \dfrac{y}{x} \qq{and} \psi = - \dfrac{\Gamma}{2 \pi} \ln r
		\end{equation*}
		For lines of constant $ \phi $,
		\begin{align*}
		\dfrac{\Gamma}{2 \pi} \tan^{-1} \dfrac{y}{x} &= C_1\\
		\implies \dfrac{y}{x} &= constant = m_1\\
		\implies  \dv{y}{x} &= m_1
		\end{align*}
		For lines of constant $ \psi $,
		\begin{align*}
		\dfrac{\Gamma}{2 \pi} \ln r &= C_2\\
		\implies r &= constant\\
		\implies  x^2 + y^2 &= constant\\
		\implies \dv{y}{x} &= - \dfrac{x}{y} = - \dfrac{1}{m_1}
		\end{align*}
		Hence proved.
	\end{itemize}

\end{homeworkProblem}

\begin{homeworkProblem}[3]
	Given $ A =  \mqty[-1 & p \\ 0 & -2] $. The eigenvalues of $ A $ are $ \lambda_1 = -1 $ and $ \lambda_2 = -2 $ with corresponding (normalized) eigenvectors are $v_1 = \mqty[1 & 0]^T$ and $ v_2 = \mqty[\dfrac{-p}{\sqrt{1 + p^2}} & \dfrac{1}{\sqrt{1 + p^2}}]^T $. So, the resultant vector is,
	\begin{align*}
	v &= v_1 e^{\lambda_1 t} + v_2 e^{\lambda_2 t}\\
	&= \mqty[1 \\ 0] e^{-t} + \dfrac{1}{\sqrt{1 +p^2}}\mqty[{-p} \\ {1}] e^{-2t}\\
	v &= \mqty[e^{-t} -\frac{p}{\sqrt{1 + p^2}} e^{-2t} \\ \frac{1}{\sqrt{1 + p^2}} e^{-2t}]\\
	\abs{v}^2 &= \qty(e^{-t} -\frac{p}{\sqrt{1 + p^2}} e^{-2t} )^2 + \qty(\frac{1}{\sqrt{1 + p^2}} e^{-2t})^2\\
	&= e^{-2t} + e^{-4t} - \dfrac{2p}{\sqrt{1 + p^2}} e^{-3t}\\
	\dv{\abs{v}^2}{t} &= -2 e^{-2t} -4 e^{-4t} + \dfrac{6p}{\sqrt{1 + p^2}} e^{-3t}
 	\end{align*}
	For the resultant to grow, $ \dv{\abs{v}^2}{t} > 0 $.
	\begin{align*}
	\implies -2 e^{-2t} -4 e^{-4t} + \dfrac{6p}{\sqrt{1 + p^2}} e^{-3t} &> 0\\
	\implies \dfrac{p}{\sqrt{1 + p^2}} &> \dfrac{ e^{t} + 2 e^{-t}}{3}
	\end{align*}
	The function $ \dfrac{ e^{t} + 2 e^{-t}}{3} $ has a minimum value of $ \dfrac{2\sqrt{2}}{3} $. Hence, for the resultant to grow for some finite time,
	\begin{align*}
	\dfrac{p}{\sqrt{1 + p^2}} &> \dfrac{2 \sqrt{2}}{3}\\
	\implies \dfrac{p^2}{1 + p^2} &> \dfrac{8}{9}\\
	\implies p^2 &> 8 \\
	\implies p &> 2 \sqrt{2}
	\end{align*}
	Hence, the resultant will grow for some finite time if $ p > 2 \sqrt{2} $.

\end{homeworkProblem}

\begin{homeworkProblem}[4]
	\begin{figure}[h!]
		\centering
		\includegraphics[scale=0.09]{q2.jpg}
	\end{figure}
	Let's first find the potential. As described in Problem 1, $ \phi = \dfrac{q_s}{2 \pi} \ln r $. So for this problem,
	\begin{align*}
	\phi &= -\dfrac{q_s}{4 \pi} \ln [(x - \epsilon/2)^2 + y^2] + \dfrac{q_s}{4 \pi} \ln [(x + \epsilon/2)^2 + y^2] \\
	&= \dfrac{q_s}{4 \pi} \ln \dfrac{(x + \epsilon/2)^2 + y^2}{(x - \epsilon/2)^2 + y^2}\\
	&= \dfrac{q_s}{4 \pi} \ln \dfrac{1 + \epsilon x / r^2 }{1 - \epsilon x /r^2 }\\
	&= \dfrac{q_s}{4 \pi} \ln ({1 + 2\epsilon x / r^2 })\\
	\phi &= \dfrac{q_s \epsilon \cos \theta}{2 \pi r}
	\end{align*}

	Hence, the velocity profile is,
	\begin{equation*}
	\va{u} = -\dfrac{q_s \epsilon \cos \theta}{2 \pi r^2} \vu{r} - \dfrac{q_s \epsilon \sin \theta}{2 \pi r^2} \vu{\theta}
	\end{equation*}
	For the streamlines, we note that for a single point source at origin, \begin{align*}
	u = \dfrac{q_s x}{2 \pi (x^2 + y^2)} &\qq{and} v = \dfrac{q_s y}{2 \pi (x^2 + y^2)}\\
	\therefore \psi &= \dfrac{q_s}{2 \pi} \tan^{-1} \dfrac{y}{x}
	\end{align*}
	Hence, for this problem,
	\begin{align*}
	\psi &= -\dfrac{q_s}{2 \pi} \tan^{-1} \dfrac{y}{x - \epsilon/2} + \dfrac{q_s}{2 \pi} \tan^{-1} \dfrac{y}{x + \epsilon/2}\\
	&= \dfrac{q_s}{2 \pi} \qty(\tan^{-1} \dfrac{y}{x + \epsilon/2} - \tan^{-1} \dfrac{y}{x - \epsilon/2} )\\
	&= \dfrac{q_s}{2 \pi} \tan^{-1} \dfrac{y(x - \epsilon/2 - x - \epsilon/2) }{x^2 + y^2}\\
	&= \dfrac{q_s}{2 \pi} \tan^{-1} \dfrac{-y\epsilon}{r^2}\\
	\psi &= - \dfrac{q_s}{2 \pi} \dfrac{\sin \theta}{r}
	\end{align*}

	\begin{equation*}
	\psi = - \dfrac{q_s}{2 \pi} \dfrac{\sin \theta}{r} = constant \implies \dfrac{\sin \theta}{r } = \dfrac{y}{x^2 + y^2} = \dfrac{1}{2C} \implies x^2 + (y - C)^2 = C^2
	\end{equation*}
	which is the equation of a circle with centre at $ (0,C) $ and radius $ C $.
\end{homeworkProblem}

\end{document}


\section{Prefixed Tableaus}

\qquad For a fixed language $\Li$, we can think on the logic \textbf{L} as the set of all valid sentences relative to the class of all \textbf{L}-structures. There is a natural interest to know if there is a constructive method to verify which sentence belong to the mentioned set. For this purpose proof methods have been developed and used. Here, among the variety of methods, we choose the method of \textit{semantic tableaus}, more specifically, we are going to use the method of \textit{prefixed modal tableaus} as introduced in \cite{Fitting83}.

\qquad This choice is motivated by practical reasons: it is easier to find a proof using tableaus, if compared to axiomatic proof procedures; and the tableau method play a key role in the study of the Interpolation theorem for \textbf{S5B} with propositional quantification.

\qquad In this chapter, we are going to present a prefixed tableau system for \textbf{S5} and \textbf{S5B}, which, not surprisingly, are going to be called \textbf{S5}-\textit{tableau system} and \textbf{S5B}-\textit{tableau system}, respectively. Although the two systems are presented, we are going to prove the basic theorems (Soundness and Completness) only for the \textbf{S5}-tableau system. The corresponding proofs for the other system are similar, so we believe that there would be no loss by omitting them.

\qquad Another detail worth noticing is that for tableaus is convenient to have $\nao, \e, \ou, \impli, \Box, \Diamond, \todo, \ex$ as primitive logical symbols. So, in this chapter only, we will assume that these symbols are primitive.

\qquad Let $\Li$ be a language such that for any $n \in \omega$ there is an infinite list of $n$-ary relations. When working with tableaus is useful to add new variables called \textit{parameters}. We use $\Li^{+}$ to denote a language obtained from $\Li$ which for each $n \in \omega - \{0\}$ there is an infinite list of parameters associated with $n$ (from now on we call an $n \in \omega - \{0\}$ a \textit{prefix}). It is assumed that different prefixes never have the same parameters associated with them. We use $a^{1}, b^{1}, \dots, a^{n}, b^{n}, \dots$ as syntactical variables for parameters. $a^{n}$ indicates that $a$ is a parameter associated with the prefix $n$. It is easy to check that both $\Li$ and $\Li^{+}$ are countable languages.

\qquad The informal idea behind this is that each prefix $n$ names a possible world and the set of parameters associated with $n$ represent the domain of individuals in the world $n$. Of course, when working with \textbf{S5B}-Tableaus $\Li^{+}$ will have only parameters that are not associated with any prefix $n$ (they will be denoted by $a, b, \dots$).

\qquad The formulas of $\Li^{+}$  are defined in the same way as the formulas of $\Li$, the only difference is that \textit{there cannot be any bound occurrence of a parameter in a formula of} $\Li^{+}$. Clearly, $\FLi \subset Fml(\Li^{+})$.

\begin{defn}
A \textit{prefixed formula} is $n.$  $\varphi$ where $n$ is a prefix and $\varphi \in  Fml(\Li^{+})$.
\end{defn}

\begin{defn}
A \textit{prefixed tableau} $\mathcal{T}$ is a tree whose nodes are prefixed formulas. We say that a branch $\mathcal{B}$ of $\mathcal{T}$ is \textit{closed} if it contains $n.$ $\varphi$ and $n.$ $\nao \varphi$ for some prefix $n$ and some formula $\varphi \in  Fml(\Li^{+})$. Similarly, a prefixed tableau is closed if each branch of it is closed. A \textit{tableau proof} of a sentence $\varphi$ is a closed tableau with $1.$ $\nao \varphi$ at its root.
\end{defn}

\qquad To give a simple presentation it is useful to group the formulas of $\Li^{+}$  in some categories. The next table defines what are called \textit{alpha} and \textit{beta} formulas and for each, two components.

\begin{center}
Alpha and Beta Formulas
\end{center}

$$
\begin{tabular}{c|c}
$\alpha$ & \hspace{2mm} $\alpha_1$ \hspace{5mm} $\alpha_2$\\
\hline
$\varphi \e \psi$ & \hspace{2mm} $\varphi$ \hspace{5mm} $\psi$  \\
$\nao(\varphi \ou \psi)$ & \hspace{2mm} $\nao\varphi$ \hspace{5mm} $\nao\psi$ \\
$\nao(\varphi \impli \psi)$ & \hspace{2mm} $\varphi$ \hspace{5mm} $\nao\psi$ \\
\end{tabular}
\quad
\begin{tabular}{c|c}
$\beta$ & \hspace{2mm} $\beta_1$ \hspace{5mm} $\beta_2$\\
\hline
$\varphi \ou \psi$ & \hspace{2mm} $\varphi$ \hspace{5mm} $\psi$  \\
$\nao(\varphi \e \psi)$ & \hspace{2mm} $\nao\varphi$ \hspace{5mm} $\nao\psi$ \\
$(\varphi \impli \psi)$ & \hspace{2mm} $\nao\varphi$ \hspace{5mm} $\psi$ \\
\end{tabular}
$$

\pagebreak
\qquad To deal with the modal operators $\Box$ and $\Diamond$, the next table defines the \textit{nu} and \textit{pi} formulas and their components.

\begin{center}
Nu and Pi Formulas
\end{center}

$$
\begin{tabular}{c|c}
$\nu$ & \hspace{2mm} $\nu_0$ \\
\hline
$\Box \varphi$ & \hspace{2mm} $\varphi$\\
$\nao \Diamond \varphi$ & \hspace{2mm} $\nao \varphi$\\
\end{tabular}
\quad
\begin{tabular}{c|c}
$\pi$ & \hspace{2mm} $\pi_0$ \\
\hline
$\Diamond\varphi$ & \hspace{2mm} $\varphi$\\
$\nao \Box \varphi$ & \hspace{2mm} $\nao \varphi$\\
\end{tabular}
$$

\vspace{10mm}

\qquad The least two categories deals with the quantifiers $\todo$ and $\ex$. The following table defines the \textit{gamma} and \textit{delta} formula and their components.

\vspace{10mm}

\begin{center}
Gamma and Delta Formulas
\end{center}

$$
\begin{tabular}{c|c}
$\gamma$ & \hspace{2mm} $\gamma(a)$ \\
\hline
$\todo x \varphi$ & \hspace{2mm} $\varphi(a)$\\
$\nao \ex x \varphi$ & \hspace{1mm} $\nao \varphi(a)$\\
\end{tabular}
\quad
\begin{tabular}{c|c}
$\delta$ & \hspace{2mm} $\delta(a)$ \\
\hline
$\ex x \varphi$ & \hspace{2mm} $\varphi(a)$\\
$\nao \todo x \varphi$ & \hspace{1mm} $\nao \varphi(a)$\\
\end{tabular}
$$

\vspace{10mm}

\qquad To construct a tableau for a sentence $\varphi$ we start with $1.$ $\nao \varphi$ and we apply some \textit{branch extension rules}. These rules are:
\pagebreak
\begin{center}
\textbf{Negation Rule}
\end{center}

$$
\begin{tabular}{c}
$n.$ $\nao \nao \psi$ \\
\hline
$n.$ $\psi$
\end{tabular}
$$

\vspace{10mm}

\begin{center}
\textbf{Alpha and Beta Rules}
\end{center}

$$
\begin{tabular}{c}
$n.$ $\alpha$ \\
\hline
$n.$ $\alpha_1$\\
$n.$ $\alpha_2$
\end{tabular}
\quad
\begin{tabular}{c}
$n.$ $\beta$ \\
\hline
$n.$ $\beta_1$ $|$ $n.$ $\beta_2$
\end{tabular}
$$

\vspace{10mm}

\begin{center}
\textbf{Nu and Pi Rules}
\end{center}

$$
\begin{tabular}{c}
$n.$ $\nu$ \\
\hline
$k.$ $\nu_0$ \\
for $k$ used.
\end{tabular}
\quad
\begin{tabular}{c}
$n.$ $\pi$ \\
\hline
$k.$ $\pi_{0}$ \\
for $k$ new.
\end{tabular}
$$

\pagebreak
\begin{center}
\textbf{Varying Domain Gamma and Delta Rules}
\end{center}

$$
\begin{tabular}{c}
$n.$ $\gamma$ \\
\hline
$n.$ $\gamma(a^{n})$ \\
for any $a^{n}$.
\end{tabular}
\quad
\begin{tabular}{c}
$n.$ $\delta$ \\
\hline
$n.$ $\delta(a^{n})$ \\
for $a^{n}$ new.
\end{tabular}
$$

\vspace{10mm}

\begin{center}
\textbf{Constant Domain Gamma and Delta Rules}
\end{center}

$$
\begin{tabular}{c}
$n.$ $\gamma$ \\
\hline
$n.$ $\gamma(a)$ \\
for any $a$.
\end{tabular}
\quad
\begin{tabular}{c}
$n.$ $\delta$ \\
\hline
$n.$ $\delta(a)$ \\
for $a$ new.
\end{tabular}
$$

\vspace{10mm}
\begin{center}
\textbf{Reflexivity Rule}
\end{center}

$$
\begin{tabular}{c}

\hline
$n.$ $a=a$ \\
\end{tabular}
$$
\begin{center}
for any used $a$ and any used $n$.
\end{center}

\pagebreak
\begin{center}
\textbf{Substitutivity Rule}
\end{center}

$$
\begin{tabular}{c}
$k.$ $a=b$ \\
$n.$ $\varphi(a)$ \\
\hline
$n.$ $\varphi(b)$ \\
for any $k$.
\end{tabular}
$$

\vspace{10mm}

\begin{defn}
The \textbf{S5}-tableau system is a prefixed tableau system whose branch extension rules are all the rules listed above with the exception of the constant domain gamma rule and the constant domain delta rule. Analogously, the \textbf{S5B}-tableau system is a prefixed tableau system whose branch extension rules are the same as the \textbf{S5}-tableau system, but in the place of the varying domain gamma and delta rules, the \textbf{S5B}-tableau system has the constant domain gamma and delta rules.
\end{defn}

\qquad We write $\vdash_{\textbf{L}}\varphi$ to indicate that $\varphi$ has a proof in the \textbf{L}-tableau system. For example, the following is a proof of
$\vdash_{\textbf{S5}} \Box \todo x \Box \ex y (x=y) \impli (\Box \todo x Fx \see  \todo x \Box Fx)$:\\

\vspace{10mm}

\Tree
[ .{$1.$ $\nao (\Box \todo x \Box \ex y$ $x=y$ $\impli (\Box \todo x Fx \see \todo \Box x Fx))$\\
	$1.$ $\Box \todo x \Box \ex y$ $x=y$\\
	$1.$ $\nao (\Box \todo x Fx \see \todo x \Box Fx)$
}
[.{$1.$ $\Box \todo x Fx$\\
	$1.$ $\nao (\todo x \Box Fx)$\\
	$1.$ $\nao (\Box Fa^{1})$\\
	$2.$ $\nao Fa^{1}$\\
	$1.$ $\todo x \Box \ex y$ $x=y$\\
	$1.$ $\Box \ex y$ $a^{1}=y$\\
	$2.$ $\ex y$ $a^{1}=y$\\
	$2.$ $a^{1}=a^{2}$\\
	$2.$ $\nao Fa^{2}$\\
	$2.$ $\todo x Fx$\\
	$2.$ $Fa^{2}$}
]
[.{$1.$ $\todo x \Box Fx$\\
	$1.$ $\nao (\Box \todo x Fx)$\\
	$2.$ $\nao (\todo x Fx)$\\
	$2.$ $\nao Fa^{2}$\\
	$2.$ $\todo x \Box \ex y$ $x=y$\\
	$2.$ $\Box \ex y$ $a^{2}=y$\\
	$1.$ $\ex y$ $a^{2}=y$\\
	$1.$ $a^{2}=a^{1}$\\
	$2.$ $\nao Fa^{1}$\\
	$1.$ $\Box Fa^{1}$\\
	$2.$ $Fa^{1}$}
]
]

\vspace{10mm}

\section{Soundness}

\begin{defn}
Let $S$ be a set of prefixed formulas. We say that $S$ is S5-\textit{satisfiable} if there is an S5-structure $\A = \strucAS$, a valuation $s$ and a function $f$ assigning to each prefix $n$ that occur in $S$ some member $f(n)$ of $\W$ such that:

\begin{enumerate}[(i)]
\item if the parameter $a^{n}$ occur in $S$, then $s(a^{n}) \in \barD_{f(n)}$.
\item if $n.$ $\varphi \in S$, then $\A, f(n) \vSs \varphi$.
\end{enumerate}

\end{defn}

\qquad A tableau branch is S5-satisfiable is the set of prefixed formulas on it is S5-satisfiable. And an S5-tableau is satisfiable if some branch of it is S5-satisfiable.

\begin{lema}
Suppose $\mathcal{T}$ is an S5-tableau that is S5-satisfiable. If any S5-tableau rule is applied to $\mathcal{T}$, the resulting tableau is still S5-satisfiable.
\end{lema}

\begin{proof}
Suppose that the branch $\mathcal{B}$ of $\mathcal{T}$ is S5-satisfiable, say $\mathcal{B}$ is satisfiable in the S5-structure $\A = \strucAS$ with respect to the valuation $s$, using the function $f$. And say a tableau rule is applied to $\mathcal{T}$. If it is applied on a branch other than $\mathcal{B}$, the resulting tableau is trivially S5-satisfiable. So now we assume that the tableau   rule has been applied on $\mathcal{B}$.

\qquad Since the argument for the negation rule, alpha rule, beta rule, reflexivity rule and substitutivity rule are straightforward, we omit them.

\qquad If the applied rule was the \textit{nu rule}, then for some prefixed formula $n.$ $\nu$ occurring in $\mathcal{B}$ we add $k.$ $\nu_{0}$ for some k alredy occurring in $\mathcal{B}$, i.e. we expand $\mathcal{B}$ in the new branch $\mathcal{B}$, $k.$ $\nu_{0}$. By hypothesis, $\A, f(n) \vSs \nu$. It is easy to see that for every $w\p \in \W$, $\A, w\p \vSs \nu_{0}$. So for every prefix $m$ occurring in $\mathcal{B}$, $\A, f(m) \vSs \nu_{0}$; in particular, $\A, f(k) \vSs \nu_{0}$. Therefore, $\mathcal{B}$, $k.$ $\nu_{0}$ is S5-satisfiable.

\qquad If the applied rule was the \textit{pi rule}, then for some prefixed formula $n.$ $\pi$ occurring in $\mathcal{B}$ we expand $\mathcal{B}$ in the new branch $\mathcal{B}$, $k.$ $\nu_{0}$ for a $k$ not occuring in $\mathcal{B}$. By hypothesis, $\A, f(n) \vSs \pi$; so there is a world $w\p \in \W$ such that $\A, w\p \vSs \pi_{0}$. Let $f\p = f \cup \{\bl k, w\p \br\}$. Since $k$ did not occur in $\mathcal{B}$, $f\p$ is a function from the set of prefixes of the branch $\mathcal{B}$, $k.$ $\nu_{0}$ to $\W$. Clearly, the branch $\mathcal{B}$, $k.$ $\nu_{0}$ is satisfiable in $\A$ with respect to the valuation $s$ using the function $f\p$.

\qquad Now, suppose the applied rule was the \textit{varying domain gamma rule}, then for some formula $n.$ $\gamma$ occuring in  $\mathcal{B}$, we expand $\mathcal{B}$ in the new branch $\mathcal{B}$, $n.$ $\gamma(a^{n})$ where $a^{n}$ is any parameter associated with $n$.

\qquad If $a^{n}$ occurs in $\mathcal{B}$, then by condition $(i)$ of Definition 16, $s(a^{n}) \in \barD_{f(n)}$. Let $s^{*}$ be an $x$-variant of $s$ such that for every variable $y$ of $\Li^{+}$

$$
s^{*}(y) = \left\{
\begin{array}{rcl}
s(y) & \mbox{if} & y \neq x\\
s(a^{n}) & \mbox{if} & y = x\\
\end{array}
\right.
$$

\qquad So, $s^{*}$ is an $x$-variant of $s$ at $f(n)$. By hypothesis, $\A, f(n)\vSs \gamma$. Thus, for every $x$-variant $s\p$ of $s$ at $f(n)$, $\A, f(n)\vSp \gamma(x)$. In particular, $\A, f(n)\models_{s^{*}} \gamma(x)$. By Proposition 3, $\A, f(n)\vSs \gamma(a^{n})$. Therefore, $\mathcal{B}$,  $n.$ $\gamma(a^{n})$ is satisfiable in $\A$ with respect to the valuation $s$ using the function $f$.

\qquad On the other hand if $a^{n}$ did not occur in $\mathcal{B}$, then, since $\barD_{f(n)} \neq \vazio$, there is a $c \in \barD_{f(n)}$. Let $s^{*}$ be a valuation such that for every variable $y$ of $\Li^{+}$

$$
s^{*}(y) = \left\{
\begin{array}{rcl}
s(y) & \mbox{if} & y \neq a^{n}\\
c & \mbox{if} & y = a^{n}\\
\end{array}
\right.
$$

\qquad  By hypothesis, $\A, f(n)\vSs \gamma$. Thus, for every $x$-variant $s\p$ of $s$ at $f(n)$, $\A, f(n)\vSp \gamma(x)$. In particular, for an $x$-variant $s\p$ of $s$ such that $s\p(x)=c$, $\A, f(n)\vSp \gamma(x)$. By Proposition 3, $\A, f(n)\models_{s^{*}} \gamma(a^n)$. Using Proposition 2 it is easy to see that $s^{*}$ satisfies conditions (i) and (ii) of Definition 16. Therefore, $\mathcal{B}$,  $n.$ $\gamma(a^{n})$ is satisfiable in $\A$ with respect to the valuation $s^{*}$ using the function $f$.

\qquad  At last, if the applied rule was the \textit{varying domain delta rule}, then for some formula $n.$ $\delta$ occurring in  $\mathcal{B}$, we expand $\mathcal{B}$ in the new branch $\mathcal{B}$, $n.$ $\delta(a^{n})$ where $a^{n}$ is a new parameter associated with $n$.

\qquad By hypothesis, $\A, f(n)\vSs \delta$. Thus, for some $x$-variant $s\p$ of $s$ at $f(n)$, $\A, f(n)\vSp \delta(x)$. Let $s^{*}$ be a valuation such that for every variable $y$ of $\Li^{+}$

$$
s^{*}(y) = \left\{
\begin{array}{rcl}
s(y) & \mbox{if} & y \neq a^{n}\\
s\p(x) & \mbox{if} & y = a^{n}\\
\end{array}
\right.
$$

\qquad Since $\A, f(n)\vSp \delta(x)$, then by Proposition 3, $\A, f(n)\models_{s^{*}} \delta(a^n)$. Once again, using Proposition 2 it is easy to see that $s^{*}$ satisfies conditions (i) and (ii) of Definition 16. Therefore $\mathcal{B}$,  $n.$ $\delta(a^{n})$ is satisfiable in $\A$ with respect to the valuation $s^{*}$ using the function $f$.
\end{proof}

\begin{teor}
(Soundness) For every $\varphi \in sen(\Li)$, if $\vdash_{S5} \varphi$, then $\vS \varphi$.
\end{teor}

\begin{proof}
Suppose $\not\vS \varphi$, then there is an S5-structure $\A$, a world $w$ and a valuation $s$ such that $\A, w\models_{s} \nao\varphi$. Then $\{1.$ $\nao \varphi\}$ is S5-satisfiable. Any tableau proof of $\varphi$ has $1.$ $\nao \varphi$ at its root. By Lemma 1, any extension rule applied to $1.$ $\nao \varphi$ will generate an S5-satisfiable tableau. And, of course, an S5-satisfiable tableau is not closed. Therefore, $\not \vdash_{S5} \varphi$
\end{proof}

\section{Completeness}

\begin{defn}
We now present a \textit{systematic tableau construction} for \textbf{S5}. As in \cite{Fitting83}  we will work with each occurrence of a prefixed formula only once, but whenever we work with one of the form $n.$ $ \nu$ and $n.$ $ \gamma$ we add a fresh occurrence of it at the end of the branch. It is assumed that the tableau method has the property to declare that some occurrences are "finished' (or "used'). And we say that a tableau $\mathcal{T}$ is a \textit{systematic tableau} if it is generated by this construction.

\qquad A prefix formula is \textit{atomic} if it is of the form $n.$ $\psi$ or $n.$ $\nao\psi$ and $\psi$ is an atomic formula. Since $\Li^{+}$ is a countable language, we may arrange all the parameters of $\Li^{+}$ in a list, this list will be refered as \textit{initial list}.

\qquad Let $\varphi$ be a sentence, as usual the method is described in stages.

\qquad \textit{Stage $1)$} Begin by placing $1.$ $\nao \varphi$ at the origin.

\qquad Suppose $n$ stages of the construction have been completed. If the tableau we have constructed is closed, then stop. Likewise if every occurrence of a prefixed formulas is finished, then stop. Otherwise we go on to:

\qquad \textit{Stage $n+1)$} Chose an occurrence of a prefixed formulas as closed to the origin as possible that has not been declared finished and which appears on at least one open branch, say $m.$ $\psi$. If $m.$ $\psi$ is atomic, simply declare the occurrence finished. This ends stage $n+1$. Otherwise we extend the tableau as follows:

\qquad For each open branch $\mathcal{B}$ thought the occurrence of $m.$ $\psi$:

\begin{itemize}
\item If $m.$ $\psi$ is of the form $m.$ $\nao \nao \theta$, then we extend $\mathcal{B}$ to the branch $\mathcal{B}, m.$ $\theta$.
\item If $m.$ $\psi$ is of the form $m.$ $\alpha$, then we extend $\mathcal{B}$ to the branch $\mathcal{B}, m.$ $\alpha_{1},m.$ $\alpha_{2}$.
\item If $m.$ $\psi$ is of the form $m.$ $\beta$, then we simultaneously extend $\mathcal{B}$ to the two branches $\mathcal{B}, m.$ $\beta_{1}$ and $\mathcal{B}, m.$ $\beta_{2}$.
\item If $m.$ $\psi$ is of the form $m.$ $\nu$ and $k_{1}, \dots , k_{l}$ are all the prefixes occurring in $\mathcal{B}$, then we extend $\mathcal{B}$ to the branch $\mathcal{B}, k_{1}.$ $\nu_{o}, \dots, k_{l}.$ $\nu_{0}, m.$ $\nu$.
\item If $m.$ $\psi$ is of the form $m.$ $\pi$, then we extend $\mathcal{B}$ to the branch $\mathcal{B}, k.$ $\pi_{0}$ where $k$ is the least prefix not used on $\mathcal{B}$.
\item If $m.$ $\psi$ is of the form $m.$ $\gamma$ and  $a_{1}, \dots , a_{n}$ are the first $n$ parameters associated with $m$ of the initial list, then we extend $\mathcal{B}$ to the branch $\mathcal{B}, m.$ $\gamma(a_{1}), \dots, m.$ $\gamma(a_{n}), m.$ $\gamma$.
\item If $m.$ $\psi$ is of the form $m.$ $\delta$, then we extend $\mathcal{B}$ to the branch $\mathcal{B}, m.$ $\delta(a)$ where $a$ is the first parameter associated with $m$ of the initial list that has not yet been used on the branch $\mathcal{B}$.
\end{itemize}

\qquad Having done this for each branch $\mathcal{B}$ thought the particular occurrence of $m.$ $\psi$  being considered, we declare that occurrence of $m.$ $\psi$  \textit{finished}. Immediately afterward, for every open branch $\mathcal{B}$ we do the following:

\begin{itemize}
\item If a new prefix $k$ has been introduced to $\mathcal{B}$ and $a_{1}, \dots, a_{s}$ are all the parameter occurring on $\mathcal{B}$, we extend $\mathcal{B}$ to $\mathcal{B}$, $k.$ $a_{1} = a_{1}, \dots,k.$ $a_{s} = a_{s}$.
\item If a new parameter $a$ has been introduced to $\mathcal{B}$ and $k_{1}, \dots, k_{s}$ are all the prefixes occurring on $\mathcal{B}$, we extend $\mathcal{B}$ to $\mathcal{B}$, $k_{1}.$ $a=a, \dots,k_{s}.$ $a = a$.
\item For each $n.$ $a = a\p$ and for each $k.$ $\psi(a)$ occurring on $\mathcal{B}$, we extend $\mathcal{B}$ to $\mathcal{B}, k.$ $\psi(a\p)$ provided that $k.$ $\psi(a\p)$ did not occur on $\mathcal{B}$.
\end{itemize}

\qquad This complete \textit{stage} $n+1$.
\end{defn}

\qquad The above construction can terminate and produce a closed tableau; can terminate and produce a tableau with an open branch; or can never terminate. In the last case, we need a fact which inform us if a systematic tableau construction never terminate, then an infinite branch is involved. This fact is called "K\"onig Lemma'. We are going to state this fact without proof, but such a proof can be found in \cite{Fitting83}.

\qquad A tree is \textit{finitely generated} if each node has only a finite number of immediate successors. And a tree is \textit{infinite} if it has infinitely many nodes. A tableau is a finitely generate tree because any node has at most two immediate successors (when we apply the beta rule). Now the content of K\"onig Lemma is: \\

\vspace{10mm}

\textbf{K\"onig Lemma:} \textit{If $\mathcal{T}$ is an infinite tree which is finitely generated, then $\mathcal{T}$ has an infinite branch $\mathcal{B}$.}
\vspace{10mm}

\qquad Clearly, if a systematic tableau $\mathcal{T}$ has an infinite branch $\mathcal{B}$, $\mathcal{B}$ is open. Therefore, if the systematic tableau construction never terminate, there must be an infinite open branch.

\begin{defn}
Let $S$ be a set of prefixed formulas of $\Li^{+}$. $S$ is S5-\textit{downward saturated} if:

\begin{enumerate} [$(i)$]

\item For no atomic formula $\varphi$ and no prefix $n$ do we have both $n.$ $\varphi$ and $n.$ $\nao \varphi$ in $S$.
\item If $n.$ $\nao\nao\varphi \in S$, then $n.$ $\varphi \in S$.
\item If $n.$ $\alpha \in S$, then $n.$ $\alpha_{1}, n.$ $\alpha_{2} \in S$.
\item If $n.$ $\beta \in S$, then $n.$ $\beta_{1}$ or $n.$ $\beta_{2} \in S$.
\item If $n.$ $\nu \in S$, then for every prefix $k$ that occurs in $S$,  $k.$ $\nu_{0} \in S$.
\item If $n.$ $\pi \in S$, then for some prefix $k$ that occurs in $S$,  $k.$ $\pi_{0} \in S$.
\item If $n.$ $\gamma \in S$, then for every parameter $a$ associated with $n$, $n.$ $\gamma(a) \in S$.
\item If $n.$ $\delta \in S$, then for some parameter $a$ associated with $n$, $n.$ $\delta(a) \in S$.
\item If $n$ and $a$ both occur in $S$, then $n.$ $a=a \in S$.
\item If $n.$ $a=a\p ,k.$ $\varphi(a) \in S$, then $k.$ $\varphi(a\p) \in S$.
\end{enumerate}
\end{defn}

\begin{pro}
Let $\mathcal{B}$ be a branch from a systematic tableau $\mathcal{T}$ and $S$ be the set of all prefixed formulas occurring on $\mathcal{B}$. If $\mathcal{B}$  is an open branch, then $S$ is an S5-downward saturated set.
\end{pro}

\begin{proof}
To prove this fact we need to check that $S$ satisfies conditions $(i)-(x)$ of Definition 18. We will present here the argument only for the non-trivial ones.

\qquad $(v)$: Suppose $k.$ $\nu \in S$ and $m$ is a prefix occurring on some prefixed formula $m.$ $\psi$ of $S$. Then, in some stage $n$, $m.$ $\psi$ is not finished. If $k.$ $\nu$ appear in some stage $n\p$ and $n \leq n\p$ , then $m.$ $\nu_{0}$ is added in the stage $n\p +1$. On the other hand, if $k.$ $\nu$ had appear in some stage $n\p$ and $n\p<n$, then, since we always introduce a fresh occurrence of $k.$ $\nu$ in any stage, there is a not finished occurrence of $k.$ $\nu$ in the stage $n$, so $m.$ $\nu_{0}$ is added in the stage $n +1$. Therefore,  $m.$ $\nu_{0} \in S$.

\qquad $(vii)$: Suppose $k.$ $\gamma \in S$ and $a$ is a parameter associated with $k$. Let $a_{1}, \dots , a_{m}$ be all parameters associated with $k$ which come before $a$ in the initial list. Then, in some stage $n$, $k.$ $\gamma$ is not finished. If $n = m+1$, then $k.$ $\gamma(a)$ is added in the stage $m+2$. If $n<m+1$, then since we always introduce a fresh occurrence of $k.$ $\gamma$ in any stage, there is a not finished occurrence of $k.$ $\gamma$ in the stage $m+1$, so $k.$ $\gamma(a)$ is added in the stage $m+2$. And if $n>m+1$, then $a_{1}, \dots , a_{m},a, \dots, a_{l}$ are the first $n$ parameters associated with $k$, so $k.$ $\gamma(a)$ is added in the stage $n+1$. Therefore,  $k.$ $\gamma(a) \in S$.
\end{proof}

\begin{lema}
If $S$ is S5-downward saturated, then $S$ is S5-satisfiable.
\end{lema}

\begin{proof}
We shall define an S5-structure $\A$ using the formulas of $S$. First, for every parameter $a,b$ in $S$, we define:

\begin{center}
$a \thicksim b$ iff there is a prefix $n$ such that $n.$ $a=b \in S$.
\end{center}

\qquad Using properties $(ix)$ and $(x)$ of Definition 18, it can be easily seen that $\thicksim$ is an equivalence relation. We write $a^{\circ}$ to denote the equivalence class of $a$.

\qquad Second, let $\A = \strucAS$ where:

\begin{itemize}
\item $\W$ is the set of prefixes of $S$.
\item $\D$ the set of all equivalence classes of $\thicksim$.
\item $a^{\circ} \in \barD_{n}$ iff there is a $b \in a^{\circ}$ such that $b$ is a parameter associated with $n$.
\item for any $a_1^{\circ}, \dots, a_k^{\circ}$ in $\D$, $\bl a_1^{\circ}, \dots, a_k^{\circ} \br \in \I(F,n)$ iff $n.$  $Fa_1, \dots, a_k \in S$.
\end{itemize}

\qquad Again, using property $(x)$ of Definition 18, it can be seen that the definition of $\I(F,n)$ depend only on the $a_i^{\circ}$ and not on the $a_i$.

\qquad Now, let $s$ be a valuation in $\A$ such that for every parameter $a$, $s(a)= a^{\circ}$. To prove that $S$ is S5-satisfiable is enough to prove the following proposition:

\begin{center}
(+) For each formula $\varphi$ and for each prefix $n$ of $S$:\\
$\bullet$ If $n.$ $\varphi \in S$, then $\A,n \vSs \varphi$. \\
$\bullet$ If $n.$ $\nao \varphi \in S$, then $\A,n \nvSs \varphi$.
\end{center}

\qquad (Proof of (+)) Induction on $\varphi$.
\vspace{10mm}

($\varphi : = a=b$)\\
\qquad If $n.$ $a=b \in S$, then $a\thicksim b$. Thus, $a^{\circ} = b^{\circ}$. Hence, $s(a)=s(b)$ and so $\A,n \vSs a=b$.

\qquad If $n.$ $a\neq b \in S$, suppose $a\thicksim b$. Then, for some prefix $m$, $m.$ $a = b \in S$. By $(x)$ of Definition 18, $n.$ $b\neq b \in S$. By $(ix)$ of Definition 18, $n.$ $b= b \in S$; contradicting condition $(i)$. Therefore, $a \not \thicksim b$, thus $a^{\circ} \neq b^{\circ}$. Hence, $s(a)\neq s(b)$ and so $\A,n \nvSs a=b$.

\vspace{10mm}

($\varphi: = Fa_{1},\dots,a_{n}$)\\
\qquad If $n.$ $Fa_1, \dots ,a_k \in S$, then $\bl a_1^{\circ}, \dots, a_k^{\circ} \br \in \I(F,n)$, i.e. $\bl s(a_1), \dots, s(a_k) \br \in \I(F,n)$. And so  $\A,n \vSs Fa_1, \dots ,a_k$.

\qquad If $n.$ $\nao Fa_1, \dots ,a_k \in S$, then, by condition $(i)$, $n.$ $Fa_1, \dots ,a_k \notin S$. So $\bl a_1^{\circ}, \dots, a_k^{\circ} \br \notin \I(F,n)$, i.e. $\bl s(a_1), \dots, s(a_k) \br \notin \I(F,n)$. And so  $\A,n \nvSs Fa_1, \dots ,a_k$.
\vspace{10mm}

($\varphi := \nao \psi$)\\
\qquad If $n.$ $\nao \psi \in S$, then, by induction hypothesis, $\A,n \nvSs \psi$; so $\A,n \vSs \nao \psi$.

\qquad If $n.$ $\nao\nao \psi \in S$, then, by condition $(ii)$, $n.$ $\psi \in S$. Thus, by induction hypothesis, $\A,n \vSs \psi$; so $\A,n \nvSs \nao\psi$.

\vspace{10mm}

($\varphi: = \psi \ou \theta$)\\
\qquad If $n.$ $\psi \ou \theta \in S$, then, by condition $(iii)$, either $n.$ $\psi \in S$, or $n.$ $\theta \in S$.  By induction hypothesis, either $\A,n \vSs \psi$ or $\A,n \vSs \theta$; so $\A,n \vSs \psi \ou \theta$.

\qquad If $n.$ $\nao(\psi \ou \theta) \in S$, then, by condition $(iv)$, $n.$ $\nao \psi, n.$ $\nao \theta \in S$. Thus, by induction hypothesis, $\A,n \nvSs \psi$ and $\A,n \nvSs \theta$; so $\A,n \nvSs \psi\ou\theta$.
\vspace{10mm}

\qquad The proof for $\varphi := \psi \e \theta$ and $\varphi := \psi \impli \theta$ are similar.
\vspace{10mm}

($\varphi: = \Diamond \psi$)\\
\qquad If $n.$ $\Diamond \psi \in S$, then, by condition $(vi)$, for some prefix $k$ of $S$, $k.$ $\psi \in S$. By induction hypothesis, $\A,k \vSs \psi$; so  $\A,n \vSs \Diamond\psi$.

\qquad If $n.$ $\nao\Diamond\psi \in S$, then, by condition $(v)$, for every prefix $k$ of S, $k.$ $\nao \psi \in S$. Thus, by induction hypothesis, for every $k \in \W$, $\A,k \nvSs \psi$; so $\A,n \nvSs \Diamond \psi$.
\vspace{10mm}

\qquad The proof for $\varphi := \Box\psi$ is similar.
\vspace{10mm}

($\varphi := \ex x \psi$)\\
\qquad If $n.$ $\ex x \psi \in S$, then, by condition $(viii)$, for some parameter $a$ associated with $n$, $n.$ $\psi(a) \in S$. By induction hypothesis, $\A,n \vSs \psi(a)$. Since $a \in a^{\circ} = s(a)$ and $a$ is a parameter associated with $n$, then $a^{\circ} \in \barD_{n}$. Let $s\p$ be a valuation in $\A$ such that for every variable $y$ of $\Li^{+}$

$$
s\p(y) = \left\{
\begin{array}{rcl}
s(y) & \mbox{if} & y \neq x\\
s(a) & \mbox{if} & y = x\\
\end{array}
\right.
$$

\qquad Clearly, $s\p$ is an $x$-variant of $s$ at $n$. By Proposition 3, $\A,n \vSp \psi$. So, $\A,n \vSs \ex x\psi$.

\qquad If $n.$ $\nao\ex x \psi\in S$, then, by condition $(vii)$, for every parameter $a$ associated with $n$, $n.$ $\nao \psi(a) \in S$. By induction hypothesis, for every parameter $a$ associated with $n$, $\A,n \vSs \psi(a)$.

\qquad Suppose $\A,n \vSs \ex x \psi$. Then, for some $x$-variant $s\p$ of $s$ at $n$, $\A,n \vSp \psi$. Since $s\p(x) \in \barD_{n}$, there is a parameter $b$ associated with $n$ such that $b \in s\p(x)$. So, $b^{\circ} = s\p(x)$, i.e. $s(b)= s\p(x)$. By Proposition 3, $\A,n \vSs \psi(b)$, a contradiction. Therefore, $\A,n \nvSs \ex x \psi$.
\vspace{10mm}

\qquad The proof for $\varphi := \todo x\psi$ is similar.
\end{proof}

\begin{teor}
(Completeness) For every $\varphi \in sen(\Li)$, if $\vS\varphi$, then $\vdash_{\textbf{S5}} \varphi$
\end{teor}

\begin{proof}
Suppose $\not\vdash_{\textbf{S5}} \varphi$. Then, $\varphi$ has no S5-tableau proof, then a systematic tableau for $1.$  $\nao \varphi$ will wither terminate producing an open branch or will not terminate. By K\"onig's Lemma, in either case there will be an open branch $\mathcal{B}$. Let $S$ be the set of all prefixed formulas occurring on $\mathcal{B}$. By Proposition 7, $S$ is an S5-downward saturated set. By Lemma 2, $S$ is S5-satisfiable. Since $1.$ $\nao \varphi \in S$, $\nao \varphi$ is S5-satisfiable. Therefore $\not\vS\varphi$.
\end{proof}

\section{Compactness}

\begin{defn}
Let $T$ be a set of sentences of $\Li$. We modify the definition of systematic tableau construction in order to extend the tableau method for sets of sentences. Since both $\Li$ and $\Li^{+}$ are countable languages, $T$ is a countable set. Let $\varphi_1, \varphi_2, \varphi_3, \dots$ be a list of the member of $T$. The construction of the sistematic tableau for $T$ is described as follows:

\qquad \textit{Stage $1)$} Begin by placing $1.$ $\varphi_{1}$ at the origin

\qquad Suppose $n$ stages have been completed.

\qquad \textit{Stage $n+1)$} Do everything as described in Definition 17. But before completing stage $n+1$, we extend each open branch $\mathcal{B}$ to the branch $\mathcal{B}, 1.$ $\varphi_{n+1}$.

\end{defn}

\begin{teor}
(Compactness) Let $\{\varphi\}$, $T$ be set of sentences of $\Li$. Then:
\begin{enumerate}[(a)]
\item If for every $T_{0} \subseteq_{fin} T$, $T_{0}$ is S5-satisfiable, then $T$ is S5-satisfiable.
\item If $T\vS \varphi$, then for some $T_{0} \subseteq_{fin} T$, $T_{0}\vS \varphi$.
\end{enumerate}
\end{teor}

\begin{proof}
(a) By definition, the construction of the systematic tableau for $T$ can either terminate and produce a closed tableau or can never terminate. Suppose it terminates, then it terminates at some stage $n$. So the resulting tableau is the same as the tableau for the set $\{\varphi_1, \dots, \varphi_n\}$. It can be easily seen, that if there is a closed tableau for $\{\varphi_1, \dots, \varphi_n\}$, then there is a closed tableau for $\varphi_1 \e \dots \e \varphi_n$; and so there is a closed tableau for $\nao\nao(\varphi_1 \e \dots \e \varphi_n)$. Hence, $\vdash_{\textbf{S5}}\nao(\varphi_1 \e \dots \e \varphi_n)$. By Theorem 2, $\vS\nao(\varphi_1 \e \dots \e \varphi_n)$; contradicting the assumption that $\{\varphi_1, \dots, \varphi_n\}$ is S5-satisfiable. Therefore, the construction of the systematic tableau for $T$ never terminate. By K\"onig's Lemma, there is an infinite open branch $\mathcal{B}$. Let $S$ be the set of all formulas occurring in $\mathcal{B}$. Clearly, for every $\varphi \in T$, $1.$ $\varphi \in S$. By Proposition 7 and Lemma 2, $S$ is S5-satisfiable, and so $T$ is S5-satisfiable.

\qquad (b) If $T\vS \varphi$, then $T \cup \{\nao \varphi\}$ is not S5-satisfiable. By item (a), there is a $T_{0}\cup\{\nao \varphi\}  \subseteq_{fin} T \cup \{\nao \varphi\}$ such that $T_{0}\cup\{\nao \varphi\}$ is not S5-satisfiable. Hence, $T_{0}\vS \varphi$.
\end{proof}


% !TEX root = ../../../proposal.tex

\section{IPsec}

%Description of IKEv1 and IKEv2.

IPsec is a set of Layer-3 protocols which add confidentiality, data protection,
sender authentication, and access control to IP traffic. IPsec is commonly used
to implement VPNs.
%IPsec provides two types of security service: Authentication Header (AH),
%which provides sender authentication, and Encapsulating Security Payload
%(ESP), which provides both sender authentication and payload encryption.  Each
%of these services requires the communicating parties to establish shared
%state, which includes the cryptographic algorithms used to provide the service
%and the keys used as input for the cryptographic algorithms.
IPsec uses the Internet Key Exchange (IKE) protocol to determine the keys used
to secure a session. IPsec may use IKEv1~\cite{rfc2409} or
IKEv2~\cite{rfc7296}. While IKEv2 is not backwards-compatible with IKEv1, the
two protocols are similar in message structure and purpose. Both versions use
Diffie-Hellman to negotiate shared secrets. The groups used are limited to a
fixed set of pre-determined choices, which include the DSA groups from
RFC~5114, each assigned a number by IANA~\cite{rfc3526,rfc5114,rfc7296}.

% IKE versions
\paragraph{IKEv1}
%IKEv1 is a hybrid protocol built upon three other protocols:
%ISAKMP~\cite{rfc2408}, which establishes a framework for authentication and
%key exchange; Oakley~\cite{rfc2412}, which defines a series of key exchanges
%and services based on the Diffie-Hellman key exchange; and
%SKEME~\cite{krawczyk1996skeme}, a key exchange protocol that provides
%anonymity, repudiability, and quick key refreshement.  IKEv1 is formally
%defined in RFCs 2407~\cite{rfc2407}, 2408~\cite{rfc2408}, and
%2409~\cite{rfc2409}.
IKEv1~\cite{rfc2407,rfc2408,rfc2409} has two basic methods for authenticated
key exchange: Main Mode and Aggressive Mode. Main Mode requires six messages to
establish the requisite state. The initiator sends a Security Association
(\texttt{SA}) payload, containing a selection of cipher suites and
Diffie-Hellman groups they are willing to negotiate. The responder selects a
cipher and responds with its own \texttt{SA} payload. After the cipher suite is
selected, the initiator and responder both transmit Key Exchange (\texttt{KE})
payloads containing public Diffie-Hellman values for the chosen group. At this
point, both parties compute shared key materials, denoted \texttt{SKEYID}. When
using signatures for authentication, \texttt{SKEYID} is computed
$\texttt{SKEYID} = \operatorname{prf}(N_i | N_r, g^{x_ix_r})$.  For the other
two authentication modes, pre-shared key and public-key encryption,
\texttt{SKEYID} is derived from the pre-shared key and session cookies,
respectively, and does not depend on the negotiated Diffie-Hellman shared
secret.

Each party then in turn sends an authentication message (\texttt{AUTH}) derived
from a hash over \texttt{SKEYID} and the handshake. The authentication messages
are encrypted and authenticated using keys derived from the Diffie-Hellman
secret $g^{x_i x_r}$.  The responder only sends her \texttt{AUTH} message after
receiving and validating the initiator's \texttt{AUTH} message.

Aggressive Mode operates identically to Main Mode, but in order to reduce
latency, the initiator sends \texttt{SA} and \texttt{KE} messages together, and
the responder replies with its \texttt{SA}, \texttt{KE}, and \texttt{AUTH}
messages together. In aggressive mode, the responder sends an authentication
message first, and the authentication messages are not encrypted.

\paragraph{IKEv2}
%IKE Version 2 (IKEv2) was released in RFC 4306~\cite{rfc4306} to replace IKEv1
%and the plethora of RFCs that define it. RFC 7296~\cite{rfc7296} gives the
%current version of the IKEv2 specification.
IKEv2~\cite{rfc4306,rfc7296} combines the \texttt{SA} and \texttt{KE} messages
into a single message. The initiator provides a best guess ciphersuite for the
\texttt{KE} message. If the responder accepts that proposal and chooses not to
renegotiate, the responder replies with a single message containing both
\texttt{SA} and \texttt{KE} payloads. Both parties then send and verify
\texttt{AUTH} messages, starting with the initiator.  The authentication
messages are encrypted using session keys derived from the \texttt{SKEYSEED}
value which is derived from the negotiated Diffie-Hellman shared secret. The
standard authentication modes use public-key signatures over the handshake
values.

%IKE Group~23, the 2048-bit MODP group with a 224-bit subgroup, is particularly
%vulnerable as shown in Section~\ref{sec:ecm}.

\subsection{Small Subgroup Attacks in IPsec} There are several variants of
small subgroup attacks against IKEv1 and IKEv2.  We describe the attacks
against these protocols together in this section.

\paragraph{Small subgroup confinement attacks} First, consider attacks that can
be carried out by an attacking initiator or responder. In IKEv1 Main Mode and
in IKEv2, either peer can carry out a small subgroup confinement attack against
the other by sending a generator of a small subgroup as its key exchange value.
The attacking peer must then guess the other peer's view of the Diffie-Hellman
shared secret to compute the session keys to encrypt its authentication
message, leading to a mostly online attack. However, in IKEv1 Aggressive Mode,
the responder sends its \texttt{AUTH} message before the initiator, and this
value is not encrypted with a session key. If signature authentication is being
used, the \texttt{SKEYID} and resulting hashes are derived from the
Diffie-Hellman shared secret, so the initiator can perform an offline
brute-force attack against the responder's authentication message to learn
their exponent in the small subgroup.

Now, consider a man-in-the-middle attacker. Bhargavan, Delignat-Lavaud, and
Pironti~\cite{bhargavan-channel-bindings-2015} describe a transcript synchronization
attack against IKEv2 that relies on a small subgroup confinement attack.  A
man-in-the-middle attacker initiates simultaneous connections with an initiator
and a responder using identical nonces, and sends a generator $g_i$ for a
subgroup of small order $q_i$ to each as its \texttt{KE} message.  The two
sides have a $1/q_i$ chance of negotiating an identical shared secret, so an
authentication method depending only on nonces and shared secrets could be
forwarded, and the session keys would be identical.

If the attacker also has knowledge of the secrets used for authentication, more
attacks are possible.  Similar to the attack described for TLS, such an
attacker can use a small subgroup confinement attack to force a connection to
use weak encryption. The attacker only needs to rewrite a small number of
handshake messages; any further encrypted communications can then be decrypted
at leisure without requiring the man-in-the-middle attacker to continuously
rewrite the connection. We consider a man-in-the-middle attacker who modifies
the key exchange message from both the initiator and the responder to
substitute a generator $g_i$ of a subgroup of small order $q_i$.  The attacker
must then replace the handshake authentication messages, which would require
knowledge of the long-term authentication secret.  We describe this attack for
each of pre-shared key, signatures, and public-key authentication.

For pre-shared key authentication in IKEv1 Main Mode, IKEv1 Aggressive Mode,
and IKEv2, the man-in-the-middle attacker must only know the pre-shared key to
construct the authentication hash; the authentication message does not depend
on the negotiated Diffie-Hellman shared secret. With probability $1/q_i$, the
two parties will agree on the Diffie-Hellman shared secret. The attacker can
then brute force this value after viewing messages encrypted with keys derived
from it.

For signature authentication in IKEv1 Main Mode and in IKEv2, the signed hash
transmitted from each side is derived from the nonces and the negotiated shared
secret, which is confined to one of $q_i$ possible values.  The attacker must
know the private signing keys for both initiator and responder and brute force
\texttt{SKEYID} from the received signature in order to forge the modified
authentication signatures on each side. The communicating parties will have a
$q_i$ chance of agreeing on the same value for the shared secret to allow the
attack to succeed. For IKEv1 Aggressive Mode, the attack can be made to succeed
every time. The responder's key exchange message is sent together with their
signature which depends on the negotiated shared secret, so the
man-in-the-middle attacker can brute force the $q_i$ possible values of the
responders private key $x_r$ and replace the responder's key exchange message
with $q_i^{x_r}$, forging an appropriate signature with their knowledge of the
signing key.

For public key authentication in IKEv1 Main Mode, IKEv1 Aggressive Mode, and
IKEv2, the attacker must know the private keys corresponding to the public keys
used to encrypt the ID and nonce values on both sides in order to forge a valid
authentication hash.  Since the authentication does not depend on the shared
Diffie-Hellman negotiated value, a man-in-the-middle attacker must then brute
force the negotiated shared key once they receives a message encrypted with the
derived key.  The two parties will agree on their view of the shared key with
probability $1/q_i$, allowing the attack to succeed.

\paragraph{Small subgroup key recovery attacks} Similar to TLS, an IKE
responder that reuses private exponents and does not verify that the initiator
key exchange values are in the correct subgroup is vulnerable to a small
subgroup key recovery attack. The most recent version of the IKEv2
specification has a section discussing reuse of Diffie-Hellman exponents,
and states that ``because computing Diffie-Hellman exponentials is
computationally expensive, an endpoint may find it advantageous to reuse those
exponentials for multiple connection setups''~\cite{rfc7296}. Following this
recommendation could leave a host open to a key recovery attack, depending on
how exponent reuse is implemented. A small subgroup key recovery attack on IKE
would be primarily offline for IKEv1 with signature authentication and for
IKEv2 against the initiator.

For each subgroup of order $q_i$, the attacker's goal is to obtain a responder
\texttt{AUTH} message, which depends on the secret chosen by the responder. If
an \texttt{AUTH} message can be obtained, the attacker can brute-force the
responder's secret within the subgroup offline. This is possible if the server
supports IKEv1 Aggressive Mode, since the server authenticates before the
client, and signature authentication produces a value dependent on the
negotiated secret.  In all other IKE modes, the client authenticates first,
leading to an online attack. The flow of the attack is identical to TLS; for
more details see Section~\ref{sec:subgroup_tls}.

Ferguson and Schneier~\cite{ferguson2000cryptographic} describe a hypothetical
small-subgroup attack against the initiator where a man-in-the-middle attacker
abuses undefined behavior with respect to UDP packet retransmissions. A
malicious party could ``retransmit'' many key exchange messages to an initiator
and potentially receive a different authentication message in response to each,
allowing a mostly offline key recovery attack.

%The attacker must choose their key exchange value to be a generator of the
%selected subgroup, which we call $g_i$.  When the responder computes the
%shared secret, $g_i^a$, it will lie within the chosen subgroup.  The attacker
%must guess $g_i^a \bmod q_i$, and construct their \texttt{AUTH} message
%accordingly.  The responder will reply with an \texttt{AUTH} message in the
%event of a correct guess, and an error message otherwise.  With repeated
%guessing, the attacker can learn the value of $g_i^a$ for each subgroup, and
%take advantage of the Pollard labmda algorithm to solve for the rest of the
%secret offline within the reduced search space.

\subsection{Implementations}

We examined several open-source IKE implementations to understand server
behavior.  In particular, we looked for implementations that generate small
Diffie-Hellman exponents, repeat exponents across multiple connections, or do
not correctly validate subgroup order. Despite the suggestion in IKEv2 RFC 7296
to reuse exponents~\cite{rfc7296}, none of the implementations that we examined
reused secret exponents.

% This is already included in the intro
%RFC 6989~\cite{rfc6989} (``Additional Diffie-Hellman Tests for IKEv2'')
%specifies additional checks that IKE implementations supporting MODP groups
%with small subgroups should perform. The RFC requries IKE implementations to
%choose between either checking that the peer's public value is in the correct
%subgroup, or it must never reuse Diffie-Hellman private values.

All implementations we reviewed are based on FreeS/WAN~\cite{freeswan}, a
reference implementation of IPSec. The final release of FreeS/Wan, version
2.06, was released in 2004. Version 2.04 was forked into
Openswan~\cite{openswan} and strongSwan\cite{strongswan}, with a further fork
of Openswan into Libreswan~\cite{libreswan} in 2012.  The final release of
FreeS/WAN used constant length 256-bit exponents but did not support RFC~5114
DSA groups, offering only the Oakley 1024-bit and 1536-bit groups that use safe
primes.

\IKEGroupSupportAndValidationTable

Openswan does not generate keys with short exponents. By default, RFC~5114
groups are not supported, although there is a compile-time option that can be
explicitly set to enable support for DSA groups.  strongSwan both supports
RFC~5114 groups and has explicit hard-coded exponent sizes for each group. The
exponent size for each of the RFC~5114 DSA groups matches the subgroup size.
However, these exponent sizes are only used if the
\texttt{dh\_exponent\_ansi\_x9\_42} configuration option is set. It also
includes a routine inside an \texttt{\#ifdef} that validates subgroup order by
checking that $g^q \equiv 1 \bmod p$, but validation is not enabled by default.
Libreswan uses Mozilla Network Security Services (NSS)~\cite{nss-overview} to
generate Diffie-Hellman keys. As discussed in Section~\ref{subsec:nss}, NSS
generates short exponents for Diffie-Hellman groups. Libreswan was forked from
Openswan after support for RFC~5114 was added, and retains support for those
groups if it is configured to use them.

Although none of the implementations we examined were configured to reuse
Diffie-Hellman exponents across connections, the failure to validate subgroup
orders even for the pre-specified groups renders these implementations fragile
to future changes and vulnerable to subgroup confinement attacks.

Several closed source implementations also provide support for RFC~5114
Group~24. These include Cisco's IOS~\cite{ciscogroup24}, Juniper's
Junos~\cite{junosgroup24}, and Windows Server 2012 R2~\cite{windowsgroup24}. We
were unable to examine the source code for these implementations to determine
whether or not they validate subgroup order.

%\IKEGroupSupportAndValidationTable

\subsection{Measurements}

We performed a series of Internet scans using ZMap to identify IKE responders.
In our analysis, we only consider hosts that respond to our ZMap scan probes.
Many IKE hosts that filter their connections based on IP are excluded from our
results.  We further note that, depending on VPN server configurations, some
responders may continue with a negotiation that uses weak parameters until they
are able to identify a configuration for the connecting initiator. At that
point, they might reject the connection. As an unauthenticated initiator, we
have no way of distinguishing this behavior from the behaviour of a VPN server
that legitimately accepts weak parameters. For a more detailed explanation of
possible IKE responder behaviors in response to scanning probes, see
Wouters~\cite{paul-wouters}.

In October 2016, we performed a series of scans offering the most common cipher
suites and group parameters we found in implementations to establish a baseline
population for IKEv1 and IKEv2 responses. For IKEv1, the baseline scan offered
Oakley groups 2 and 14 and RFC~5114 groups 22, 23, and 24 for the group
parameters; SHA1 or SHA256 for the hash function; pre-shared key or RSA
signatures for the authentication method; and AES-CBC, 3DES, and DES for the
encryption algorithm.  Our IKEv2 baseline scan was similar, but also offered
the 256-bit and 384-bit ECP groups and AES-GCM for authenticated encryption.

On top of the baseline scans, we performed additional scans to measure support
for the non-safe RFC~5114 groups and for key exchange parameter validation.
Table~\ref{tab:ikegroupsupportandvalidation} shows the results of the October
IKE scans.  For each RFC~5114 DSA group, we performed four handshakes with each
host; the first tested for support by sending a valid client key exchange
value, and the three others tested values that should be rejected by a
properly-validating host. We did not scan using the key exchange value $0$
because of a vulnerability present in unpatched Libreswan and Openswan
implementations that causes the IKE daemon to restart when it receives such a
value~\cite{cve-2015-3240}.

We considered a host to accept our key exchange value if after receiving the
value, it continued the handshake without any indication of an error. We found
that 33.2\% of IKEv1 hosts and 17.7\% of IKEv2 hosts that responded to our
baseline scans supported using one of the RFC 5114 groups, and that a
surprising number of hosts failed to validate key exchange values.  24.8\% of
IKEv1 hosts that accepted Group 23 with a valid key exchange value also
accepted $1 \bmod p$ or $-1 \bmod p$ as a key exchange value, even though this
is explicitly warned against in the RFC~\cite{rfc2412}.  This behavior leaves
these hosts open to a small subgroup confinement attack even for safe primes,
as described in Section~\ref{subsec:small-subgroup-attack}.

For safe groups, a check that the key exchange value is strictly between $1$
and $p-1$ is sufficient validation. However, when using non-safe DSA primes, it
is also necessary to verify that the key exchange value lies within the correct
subgroup (\ie, $y^q \equiv 1 \bmod p$). To test this case, we constructed a
generator of a subgroup that was not the intended DSA subgroup, and offered
that as our key exchange value. We did not find any IKEv1 hosts that rejected
this key exchange value after previously accepting a valid key exchange value
for the given group. For IKEv2, the results were similar with the exception of
Group 24, where still over 93\% of hosts accepted this key exchange value. This
suggests that almost no hosts supporting DSA groups are correctly validating
subgroup order.

We observed that across all of the IKE scans, 109 IKEv1 hosts and 52 IKEv2
hosts repeated a key exchange value. This may be due to entropy issues in key
generation rather than static Diffie-Hellman exponents; we also found 15,891
repeated key exchange values across different IP addresses. We found no hosts
that used both repeated key exchange values and non-safe groups. We summarize
these results in Table~\ref{tab:scandata}.

%The results of these scans are presented in Table~\ref{tab:scandata}.  To get
%a an estimate of the number of hosts that support each IKE version, we
%conducted scans of 1\% of the IPv4 address space using Zmap. If the host
%responded with a valid message for the IKE version we were scanning for, we
%considered it to support that version. The numbers present for IKE support in
%Table~\ref{tab:scandata} are extrapolated from these 1\% scans.

%To measure support for each of the RFC 5114 DSA groups, we conducted
%additional 1\% scans for IKEv1 Main Mode and IKEv2. We advertised a variety of
%common ciphersuite parameters, but only a single Diffie-Hellman group for each
%of these scans.  We considered a host willing to negotiate that group if they
%responded with a valid key exchange payload.  Table~\ref{tab:scandata} shows
%the number of hosts that were willing to negotiate any of the RFC 5114 DSA
%groups for IKEv1 Main Mode and IKEv2.  These hosts fit at least one of the
%four conditions for the small subgroup attack by using a prime $p$ where $p-1$
%has small factors.

%We performed additional scans to measure if any hosts repeated Diffie-Hellman
%key exchange values. First, we performed two simultaneous IKEv1 Main Mode
%scans proposing Group 23 only. In this scan, we did not observe any repeated
%key exchange values. However, across all the IKE scans that we performed, we
%observed that 109 hosts for IKEv1 and 52 hosts for IKEv2 repeated key exchange
%values at least once with Group 2 (a 1024-bit MODP group).