\documentclass{article}
\usepackage[utf8]{inputenc}
\usepackage[a4paper, total={6in, 10in}]{geometry}
\usepackage{amsmath}
\usepackage{pgfplots}
\usepackage{hyperref}
\usepackage{graphicx}
\usepackage{float}
\usepackage{import}
\setlength{\parindent}{0pt}
\newcommand\inputpgf[2]{{
\let\pgfimageWithoutPath\pgfimage
\renewcommand{\pgfimage}[2][]{\pgfimageWithoutPath[##1]{#1/##2}}
\input{#1/#2}
}}

\begin{document}
\date{}
\title{KL-$\lambda$-optimal post model threshold search}
\author{Hilding Wollbo}
\maketitle
\vspace{-0.5cm}

\section{KL-Divergence in Machine Learning}

The Kullback-Leibler (KL) Divergence is an information theoretic concept used across many different probabilistic domains, including the field of Machine Learning. The KL-divergence is defined as

\begin{equation}
\textbf{KL}[p \vert\vert q] = -\int p(x) \log \frac{q(x)}{p(x)} dx
\end{equation}

and can be thought of as a metric describing the distance between two probability distributions $p$ and $q$. The KL-divergence is however not a true distance metric since it is neither symmetric in that $\textbf{KL}[p \vert\vert q] \neq \textbf{KL}[q \vert\vert p]$ nor does it satisfy the triangle inequality. \\

In the case of logistic regression, one tries to fit model parameters $\varphi$ such that the computed probability $\hat{P}_\varphi(y=1\vert x) $ is as close to the true probability $P(y=1\vert x)$ as possible, for every point $x$ in the dataset. The difference between these two distributions can be quantified by their KL-divergence, and the problem can be reduced to finding the set of parameters $\varphi$ that minimize the average KL-distance of the dataset such that

\begin{align}
    \varphi: \underset{\varphi}{\arg\min} \Big \{ -\frac{1}{N} \sum_{n=1}^N P(y_n=1\vert X_n) \log \frac{\hat{P}_\varphi(y_n=1\vert X_n)}{P(y_n=1\vert X_n)} + P(y_n=0\vert X_n) \log \frac{\hat{P}_\varphi(y_n=0\vert X_n)}{P(y_n=0\vert X_n)} \Big \}
\end{align}
% relate to cross entropy and likelihood
Noting that the minimization is performed with regard to $\varphi$ one can disregard the independent terms in the optimization, which leads to the equivalent problem of minimizing the average cross entropy loss

\begin{align}
    \varphi: \underset{\varphi}{\arg\min} \Big \{ -\frac{1}{N} \sum_{n=1}^N P(y_n=1\vert X_n) \log \hat{P}_\varphi(y_n=1\vert X_n) + P(y_n=0\vert X_n) \log \hat{P}_\varphi(y_n=0\vert X_n) \Big \}
\end{align}

This is also equivalent to the Maximum Likelihood formulation of finding the model parameters $\varphi$ which maximizes the probability that our model predictions $\hat{\mathbf{y}}$ gave rise to the set of observed true labels $\mathbf{y}$.
% EX from https://www.textbook.ds100.org/ch/17/classification_cost_justification.html

\section{Post model threshold selection}

In the case of binary classification, the trained model outputs a probability $f_\varphi (x) \in [0, 1]$ for each input $x$ which is then thresholded to either 0 or 1 by a threshold $\theta$. The default threshold is generally set to $\theta = 0.5$, which for well behaved and balanced datasets can be sufficient. However, the performance of the model predictions on the validation dataset can often be improved by shifting the threshold by maximizing a set of relevant metrics such as precision, recall, $F_1$-measure etc. depending on application. This view of threshold selection is generally to maximize the average performance of the model output for a specified metric $M$ by varying the threshold $\theta$:
\begin{align}
    \theta : \underset{\theta}{\arg\max}\{\frac{1}{N} \sum_{n=1}^N M(\theta(f_\varphi(x_n)), y_n\}
\end{align}
or equivalently, to minimize an expected total cost associated with the respective errors as
\begin{align}
	\label{eq:cost}
    \theta : \underset{\theta}{\arg\min}\{\frac{1}{N} \sum_{n=1}^N \alpha y_n (1-\theta(f_\varphi(x_n)) )+ \beta (1-y_n) \theta(f_\varphi(x_n))\}
\end{align}
where $\alpha$ is the cost of a false negative and $\beta$ that of a false positive. However, as given by the prediction problem we have no way of knowing the true labels $y_n$. We could use the training data to create predictions and calculate an expected cost and select an optimal threshold on this data. Still, we would like to incorporate the information about the test predictions in our threshold selection. % this section needs some polishing
Instead, given that we can collect a sufficient set of unthresholded test predictions, we can use a probabilistic view and just consider the relation between the ideal predictor $\hat{y}^*$ and the true data labels $y$. One property that an ideal predictor must fulfill is that $\hat{y}^* \sim p(y)$, since all predictions are correct. That is, the proportions of each class in the predictions should equal those in the dataset labels. This essentially means that, instead of minimizing the expected total error of our predictions, we could try to find an optimal threshold $\theta^*$ after training by minimizing the distance between the distribution of true class labels $p(y)$ and the global distribution of thresholded predictions $q_\theta(\hat{y})$.

\section{Binary classification}

Binary classification is the most simple application of prediction in machine learning, but also the most fundamental, since every classification problem can be formulated as sets of binary prediction tasks or decision trees. For a given post model classification problem we have a set of true labels following a distribution $p(y)$ which can be estimated empirically directly from the training data (assuming that both training and test data follow the same distribution). Likewise for the predictions $\hat{y}$ we can define an empirical distribution given a threshold $\theta$ as
\begin{align*}
    q_\theta(\hat{y}) = \begin{cases} 1, & \text{w. p.} \ \frac{1}{N}\sum_{n=1}^N \theta(\hat{y}_n) \\[0.2cm]
    0, &  \text{w. p.} \ 1 - \frac{1}{N}\sum_{n=1}^N \theta(\hat{y}_n) \end{cases}
\end{align*}\text{,}
where $\theta(\hat{y}_n) = 1$ if $\hat{y}_n \geq \theta$, else 0.
In the case of discrete class classification, the integral in the KL-divergence is replaced with a sum, such that
\begin{equation}
\textbf{KL}[p(y) \vert\vert q_\theta(\hat{y})] = -\sum p(y) \log \frac{q_\theta(\hat{y})}{p(y)}\text{,}
\end{equation}
and for the binary classification problem we simply insert our binary probabilities
\begin{align}
\textbf{KL}[p(y) \vert\vert q_\theta(\hat{y})] = & \ - p(y=1) \log \frac{q_\theta(\hat{y}=1)}{p(y=1)} - p(y=0) \log \frac{q_\theta(\hat{y}=0)}{p(y=0)} \\ = & \label{eq:tprfpr} -p \log \underbrace{\frac{P(\hat{y}\geq \theta)}{p}}_\text{"fnr cost"} - (1-p) \log \underbrace{\frac{P(\hat{y} < \theta)}{1-p}}_\text{"fpr cost"} \text{.}
\end{align}
In the binary case, each term is associated with an error cost depending on the amount of respective errors resulting from a given threshold, similar to the expected cost in Equation (\ref{eq:cost}). With a too conservative threshold the probability of a negative in the global distribution of predictions $q_\theta (\hat{y}=0)$ is larger than that of the true negative labels $p(y=0)$, resulting in an increased amount of false negatives. This in turn implies that the proportion of predicted positives must be smaller than the true amount of positives, $q_\theta(\hat{y} = 1) < p(y=1)$. That is, the classifications follow
\begin{align*}
    q_\theta(\hat{y}=0) > p(y=0) \iff  TN + FN > \underbrace{TN+FP}_{N} \rightarrow FN>FP \text{.}
\end{align*}
Vice versa holds for the case when $q_\theta(\hat{y}=1) > p(y=1)$, where the proportion of predicted positives is larger than that of the true distribution.
However, the cost associated with a false positive error is generally different than that of a false negative, this relation can be captured by a constant $\lambda$. One may then define the threshold optimization problem as:
\begin{align}
    \theta: \underset{\theta}{\arg \min} \Big\{ - p \log \frac{P(\hat{y}\geq \theta)}{p} - \lambda (1-p) \log \frac{P(\hat{y} < \theta)}{1-p} \Big \}
\end{align}
For $\lambda>1$, false positives are associated with a higher cost during minimization (in relation to their prevalence in the true labels). This causes the resulting proportion of predicted positives given the threshold to be smaller. % since the total product lambda * fpr cost is increased!
Again, the optimization is performed with regard to $\theta$ and the independent terms can be disregarded, leading to the equivalent optimization problem of minimizing the weighted cross entropy loss between the two distributions as
\begin{align}
\label{eq:threshold}
\theta: \underset{\theta}{\arg \min} \Big\{ - p \log P(\hat{y}\geq \theta) - \lambda (1-p) \log P(\hat{y} < \theta) \Big \} \text{.}
\end{align}
For brevity, we set $q = P(\hat{y}\geq \theta)$ and the minimization can be expressed as
\begin{align*}
\theta:& \ \underset{\theta}{\arg \min} \Big\{ - p \log q - \lambda (1-p) \log (1-q) \Big \} = \\
=& \ \underset{\theta}{\arg \min} \Big\{ - \log q^p - \log (1-q)^{\lambda(1-p)} \Big \} \\
=& \ \underset{\theta}{\arg \min} \Big\{ - \log q^p (1-q)^{\lambda(1-p)} \Big \} \\
=& \ \underset{\theta}{\arg \min} \Big\{ - q^p (1-q)^{\lambda(1-p)} \Big \} \text{.}
\end{align*}
Deriving and solving for zero, we have the expression
\begin{align*}
\partial_q q^p (1-q)^{\lambda(1-p)} =& \ -\lambda(1-p)(1-q)^{\lambda(1-p)-1}q^p + pq^{p-1}(1-q)^{\lambda(1-p)} \\
=& \ (1-q)^{\lambda(1-p)-1}(-\lambda(1-p)q^p + p(1-q)q^{p-1}) \\
=& \ 0
\end{align*}
leading to the closed form solution
\begin{align}
\label{eq:pos}
p(1-q)q^{p-1} =& \ \lambda(1-p)q^p \\
\rightarrow q =& \ \frac{p}{p + \lambda(1-p)}\text{.}
\end{align}
Here, $q$ corresponds to a resulting proportion of positive predictions associated with a certain threshold $\theta$ when applied to the raw predictions. This threshold can be found by finding the index $m$ in the sorted predictions which corresponds to the proportion $q$ of resulting positively classified predictions, according to
\begin{align}
\label{eq:m}
m : \underset{m}{\arg \min}&\Big\{ \Big \lvert q - \frac{1}{N}\sum_{n=m}^N\delta(f_\varphi(x_n)) \Big \rvert \Big\}, \ m \in [0, N] \\
&\theta = f_\varphi(x_m)
\end{align}
In this way, we arrive at a structured method of quantifying the tradeoff between probability of errors and the associated costs of each error to find the optimal threshold in the binary prediction setting.

% Could be interesting to plot logarithmic x-axis of q as a function of lambda for a few different p

\subsection{Example}

We may also find specific solutions to this threshold optimization problem in cases where the distribution of test predictions is known but the actual test predictions are not.
Given that the set of predictions is modelled by the following, exponential mixture distribution

\begin{align*}
    f_0(x\vert y=0;\beta_0) =& \ \frac{\beta_0}{Z_0}e^{-\beta_0 x} = \frac{\beta_0}{1-e^{-\beta_0}}e^{-\beta_0 x} \\
    f_1(x\vert y=1;\beta_1) =& \ \frac{\beta_1}{Z_1}e^{\beta_1 x} = \frac{-\beta_1}{1-e^{\beta_1}}e^{\beta_1 x}\\
    f (x;\beta_0,\beta_1,\alpha) =& \ (1-\alpha)\frac{\beta_0}{1-e^{-\beta_0}}e^{-\beta_0 x} - \alpha\frac{\beta_1}{1-e^{\beta_1}}e^{\beta_1 x} % consider changing order of alpha=1-alpha
\end{align*}
we can find the optimal threshold $\theta$ by finding the point where the proportion of expected predicted positives is equal to the one found in Equation (\ref{eq:pos}). We recognize that $\alpha = p$ and set

\begin{align}
    \frac{p}{p+\lambda(1-p)} = & \int_{\theta}^1 f(x;\beta_0, \beta_1, p) dx = \\
    = & \int_{\theta}^1 \frac{1-p}{1-e^{-\beta_0}}\beta_0e^{-\beta_0x} - \frac{p}{1-e^{\beta_1}}\beta_1e^{\beta_1x} dx = \\
    = & \ \frac{1-p}{1-e^{-\beta_0}}(e^{-\beta_0}-e^{-\beta_0 \theta}) - \frac{p}{1-e^{\beta_1}}(e^{\beta_1}-e^{\beta_1 \theta})\text{.}
\end{align}

Rearranging and setting $\beta_1 = \beta_0 = \beta$ for simplicity, we can define the function

\begin{align}
    f(\theta) =& \ \frac{e^{-\beta \theta} (e^\beta-e^{\beta \theta}) (p(e^{\beta \theta}-1) + 1)}{e^{\beta}-1} - \frac{p}{p+\lambda(1-p)} = 0 \\
    f'(\theta) =& \ \frac{\beta e^{-\beta \theta} ((p-1) e^\beta - p e^{2\beta \theta})}{e^{\beta}-1}\text{.}
\end{align}
Using Newton's Method we can find an approximate solution to $\theta$ by iterating
\begin{align}
    \theta_{n+1} =& \ \theta_n - \frac{f(\theta_n)}{f'(\theta_n)}
\end{align}
until convergence. An example of this method is shown in Figure \ref{fig:exp5}.
\begin{figure}
    \centering
    \scalebox{.8}{\input{figures/thresholds_breastcancer_exponential_5.pgf}}
    \caption{Thresholds for an exponential test prediction distribution with parameter $\beta = 5$ in a dataset of 61 \% positive examples.}
    \label{fig:exp5}
\end{figure}

\subsection{Statistical significance}
The whole framework henceforth presented assumes that we have a batch of test predictions from which we are able to infer a threshold representative of the true distribution of test predictions. However, if by chance, we end up with a set of test predictions with class balance widely different from the training data, we can be sure to arrive at suboptimal thresholds. Therefore, in relation to the class balance, we need to define criteria for which we either proceed with calculating the threshold or simply wait for more data to become available before proceeding. \\

Assuming that the number of test predictions in the set is sufficiently large (i.e. $pN\geq 10, (1-p)N\geq 10$) to allow us to view $q$ as normally distributed around the true proportion $\bar{q}$, we can use a z-test to determine how many samples we need to achieve at most error $E=q-\bar{q}$ given a certain confidence level $\alpha$. The test statistic for the z-test is calculated by %We assume that the $q$ we calculate from the test predictions is normally distributed around the true mean $\bar{q}$.
\begin{align}
z_{\alpha/2} = \frac{q-\bar{q}}{\frac{\sigma_q}{\sqrt{N}}}\text{.}
\end{align}
From here, we may set the confidence interval and error tolerance and solve for $N$.
We already assumed that the proportion of positives in the training data is roughly the same as in the test data, so it is justified that we calculate the population variance from the training data as
\begin{align*}
    \sigma_q =& \ \sqrt{q(1-q)} \\
            =& \ \frac{1}{p+\lambda(1-p)}\sqrt{\lambda p(1-p)} \\
            =& \ \frac{\sqrt{\lambda}}{p+\lambda(1-p)}\sigma_p
\end{align*}
Furthermore, we need to decide a margin of error and a confidence interval for our estimation. Since our threshold $\theta$ and proportions $p$ and $q$ all lie in the interval $[0, 1]$, it can be suitable to assume that we want an error no larger than $0.05$ from the true weighted proportion $\bar{q}$. Following standard practice, we also select a 95\% confidence interval. Using the two-sided Z-test, we have
\begin{align}
    E = z_{\alpha/2}\frac{\sigma_q}{\sqrt{N}}
\end{align}
Thus, to find how large $N$ needs to be for our requirements to hold, we calculate
\begin{align*}
    N =& \ (\frac{z_{\alpha/2}}{E})^2\sigma_q^2 \\
      =& \ (\frac{z_{\alpha/2}}{E})^2 \frac{\lambda}{(p+\lambda(1-p))^2}\sigma_p^2
\end{align*}
For the chosen values, Figure \ref{fig:hmap} shows a heatmap of the number of samples $N$ needed to confidently use the developed threshold selection scheme.
%https://brownmath.com/stat/sampsiz.htm#Case2
% make a friendly and nice table with p: 0.05:0.95 and different lambda
\begin{figure}
    \centering
    \scalebox{.8}{\inputpgf{figures/}{hmap.pgf}}
    \caption{Heatmap of the required number of samples $N$ to achieve at most an error of $0.05$ with a $95\%$ CI when estimating $q$.}
    \label{fig:hmap}
\end{figure}

%Pr(X = m) = (N, m) p^(N-m)(1-p)^m (switched around because 1 is label of p)

\section{Practical examples}
In order to illustrate how this threshold search can be used in practice, a few simple cases are studied for known binary datasets.
\subsection{Setup}
In order to generate predictions, a small decision tree model using LightGBM was implemented with default parameters. The project was implemented in Python using the \texttt{LGBMClassifier} package, as well as \texttt{sklearn}, \texttt{numpy} and \texttt{pandas} for data manipulation. The code used to produce the results is available at \url{https://github.com/wollbo/threshold}. The labels of the dataset are marked accordingly: positive test samples in blue, and negative test samples are marked in orange. The probability output from the classifier is presented as histograms, with several thresholds $\theta$ calculated from the classifier predictions using Equation (\ref{eq:pos}) for different misclassification cost ratios $\lambda$. Points to the right of a threshold is classified as positive, data to the left of the threshold is classified as negatives.
\subsection{Breast Cancer Wisconsin}
The Breast Cancer Wisconsin dataset is a traditional dataset used for evaluating baseline performance for binary classifiers, containing a majority positive samples. It is comprised of features computed from digitized images of mammograms. In this case, the simple decision tree model is able to almost perfectly separate the positive and negative samples with only a few outliers. Notably, the raw output probabilities are also very distinctly 1 or 0.
\begin{figure}[H]
    \centering
    \scalebox{.8}{\input{figures/thresholds_breastcancer.pgf}}
    \caption{Thresholds and predictions generated for the Wisconsin Breast Cancer dataset, 64 \% positive samples. This is a very easy dataset to classify.}
\end{figure}

\subsection{German Credit Data}
The German Credit dataset is comprised of several categorical and numerical attributes associated with the financial status of individuals as to determine their credit worthiness, with the majority of samples being positive (corresponding to a 'good' credit status). This is also a rather traditional dataset, but is considerably harder to classify than the Breast Cancer dataset. Still, the algorithm is generally able to separate the positives and negatives, and the threshold selection shows how increasing the parameter $\lambda$ increases the propensity to classify samples as negatives, and how lowering $\lambda$ results in classifying most samples as positives.
\begin{figure}[H]
    \centering
    \scalebox{.8}{\input{figures/thresholds_credit.pgf}}
    \caption{Thresholds and predictions generated for the German Credit Data dataset, 71 \% positive samples.}
\end{figure}

\subsection{KDD CUP 2009 - Churn}
    The KDD CUP 2009 dataset was initially used for the competition bearing the same name, and consists of customer relationship data of the French Telecom company Orange. In this dataset, each customer has 190 numerical and 40 categorical features which are very sparse. Corresponding to the feature data is the labels of 'Churn' which is used to train and evaluate the model. This is a much harder dataset to classify than the other two, and the decision tree model struggles to separate the two distributions. In this case, only 7\% of the samples are positive, which means that the selected thresholds become shifted to 0.
\begin{figure}[H]
    \centering
    \scalebox{.8}{\input{figures/thresholds_orange-small.pgf}}
    \caption{Thresholds and predictions generated for the KDD Cup 2009 Churn dataset, 7 \% positive samples. This is a hard dataset to classify.}
\end{figure}

% \newpage
% \subsection{Extension to the Multi-label setup}
% The Multi-label classification task can essentially, from the post model perspective, be viewed as a joint set of binary classification tasks, assuming that each label is independent and mutually nonexclusive. Similarly to the binary case, one can calculate empirical dataset probabilities for each of the $M$ separate labels such that
% \begin{align*}
%     p(y_1 = 1) &= p_1 \\
%     p(y_2 = 1) &= p_2 \\
%     \vdots & \\
%     p(y_M = 1) &= p_M
% \end{align*}

% This leads to the set of KL-divergence equations

% \begin{align*}
% \textbf{KL}[p(\mathbf{y})\vert\vert q_\Theta(\mathbf{\hat{y}})] = - \sum p(\mathbf{y})\log \frac{q_\Theta(\hat{\mathbf{y}})}{p(\mathbf{y})} =
% \left [ \begin{aligned}
%    \left. - p_1 \log P(\hat{y}_1\geq \theta_1) -& \beta_1 (1-p_1) \log P(\hat{y}_1 < \theta_1) \\ \right.
%     \left.- p_2 \log P(\hat{y}_2\geq \theta_2) -& \lambda_2 (1-p_2) \log P(\hat{y}_2 < \theta_2) \\ \right.
%     \left.\vdots& \\ \right.
%     \left.- p_M \log P(\hat{y}_M\geq \theta_M) -& \lambda_M (1-p_M) \log P(\hat{y}_M < \theta_M)  \\ \right.  \end{aligned} \right ]
% \end{align*}

% Defining the set of $M$ thresholds as
% \begin{align}
% \label{eq:thresholdset}
%     \Theta_1^M = \bigcup\limits_{i=1}^M \theta_i
% \end{align}

% one would then try to find $\Theta_1^M$ by individually calculating the threshold $\theta_i$ for each class distribution $p(y_i)$, prediction distribution $q_\theta(\hat{y}_i)$ and error cost factor $\lambda_i$ according to equation (\ref{eq:threshold}).
% \subsubsection{Ranking Predictions}
% In some applications it can be desirable to rank the different positive label predictions according to their confidence when there are several positive predicted class labels. In a medical setting, for example, this could correspond to deciding which indicated disease in a multi-class medical test to treat first. The predictions can be weighed in many different ways. It would be reasonable to assign confidence in the predicted class label with regard to the overall distribution of possible samples in that specific class, as well as incorporation of how confident the specific class prediction is in relation to the average class prediction for the label, since it can be assumed that the distances between threshold and prediction are generally different between labels. In this way, one weighs both information about the distribution together with the quality of the individual prediction.
% \\
% Assuming that the probability of a correct thresholded prediction is directly related to the distance between the raw positive prediction $\hat{y}$ and the threshold $\theta$, one can define a distance factor simply as $\vert\vert \theta-\hat{y} \vert\vert $, where $\hat{y} \geq \theta$.
% We can also create a scale factor of the confidence of the $i$:th label predictions in relation to the other labels by calculating the average distance factor for each label as
% \begin{align}
%     \Delta_i =  \frac{1}{L_i}\sum_{l=1}^{L_i} \vert\vert \theta_i-\hat{y}_i^l \vert\vert
% \end{align}
% where $[\hat{y}_i^1, \hat{y}_i^2, \dots , \hat{y}_i^{L_i}] $ is the set of $i$:th label predictions greater than the threshold $\theta_i$. Finally, we can add a factor related to the probability of a positive sample in the distribution simply as the empirical mean of each label in the dataset as
% \begin{align*}
%     p_i = p(y_i = 1) = \frac{1}{N}\sum_{n=1}^N y_i^n .
% \end{align*}
% Thus, for each label $i$ and predicted positive sample $\hat{y}_i$ we can define the confidence score as

% \begin{align*}
%     c_i = p_i \frac{\vert\vert \theta_i-\hat{y}_i \vert\vert}{\Delta_i}
% \end{align*}
% and rank the confidence of each label $i$ for every positive prediction $\hat{y}_i$ in descending order.

% \subsection{Special Case: Multiclass setup}

% The Multiclass classification problem is less straightforward than the binary and multi-label tasks.
% Normally for a multiclass problem, one determines class prediction by calculating the soft-max of the output and selects the class index with the largest probability. If we instead retain our output as a set of seemingly independent sigmoids, we can apply similar logic as in the previous sections. Here, one can calculate the empirical dataset probabilities $[p_1, p_2 \dots p_M]$ as before with the added constraint that
% \begin{align*}
%     \sum_{i=1}^M p_i = 1
% \end{align*}

% One simple way to handle the case where two or more probability outputs are above their thresholds is to define a new class $M+1$ representing an ambiguous output. With the definition of the joint set of thresholds according to equation (\ref{eq:thresholdset}), we arrive at the post model threshold classification problem

% \begin{align}
%     P(\Theta (\mathbf{\hat{y}})) & = \begin{cases}
%     j,& \text{if} \ \hat{y}_j \geq \theta_j \ \cup \ \hat{y}_i < \theta_i \ \forall \ {i\neq j} \\ % originally bigcup
%     M+1,& \text{otherwise}
%     \end{cases}
% \end{align}

% This naturally lends itself as a more conservative classifier, in that the ambiguous class naturally handles many of the samples that would be erroneously classified by a soft-max classifier. However, this setup is also guaranteed to produce false negatives that would be correctly classified by the softmax-classifier.

\end{document}


\documentclass[10pt,a4paper]{article}

\bibliographystyle{plain}
\usepackage{latexsym}
\usepackage{algorithm,algorithmic}
\usepackage{amssymb,amsthm}
\usepackage{amsmath,amsfonts}
\usepackage{mathrsfs}
\usepackage{enumerate}
\usepackage{graphicx,psfrag}
\usepackage{comment}
%\usepackage[notcite,notref]{showkeys}

\newtheorem{theorem}{Theorem}[section]
\newtheorem{remark}{Remark}[section]
\newtheorem{lemma}{Lemma}[section]
\newtheorem{corollary}{Corollary}[section]
\newtheorem{assumption}{Assumption}[section]
\newtheorem{definition}{{Definition}}[section]
\newtheorem{proposition}{Proposition}[section]
\newtheorem{question}{Question}

\author{G\"unay Do\u gan}
\title{Computing Surface Tension}

\begin{document}

\maketitle

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Introduction}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Our goal is to compute a displacement field $\vec{u}$ that minimizes
the energy
%
\begin{equation}\label{E:energy}
E(\vec{u}) = \int_\mathcal{D} \left( \frac{1}{2}\sigma_{ij}\varepsilon_{ij}
-\vec{f}\cdot\vec{u} \right) dx + \gamma \int_{\Gamma(\vec{u})} d\Gamma.
\end{equation}
%
The energy \eqref{E:energy} has two components: the elastic energy and
the surface tension, which is given by the surface area of
the displaced surface
%
\begin{equation}\label{E:displaced-surface}
\Gamma(\vec{u}) = \{\vec{x} + \vec{u}(\vec{x}), \vec{x} \in \Gamma_0 \}.
\end{equation}
%
To find a minimizer of the energy \eqref{E:energy}, we take
its first variation $\delta E(\vec{u};\vec{\phi})$
with respect to a test function $\vec{\phi}$ and seek
$\vec{u}$ that satisfies
\[
\delta E(\vec{u};\vec{\phi}) = 0, \quad \forall \vec{\phi}
\]
or more explicitly
%
\begin{equation}\label{E:1st-variation}
\int_\mathcal{D} \left( \frac{1}{2} D\vec{u}:C D\vec{\phi}
- \vec{f}\cdot\vec{\phi} \right) dx
+ \gamma \int_{\Gamma(\vec{u})} \kappa \vec{\phi}\cdot\hat{n} \, d\Gamma = 0,
\quad \forall \vec{\phi}.
\end{equation}
%
Given the first variation \eqref{E:1st-variation}, we could
attempt to write an iterative scheme to compute $\vec{u}$
that satisfies, for example,
%
\begin{equation}\label{E:1st-iterative-scheme}
\int_\mathcal{D} \left( \frac{1}{2} D\vec{u}^{n+1}:C D\vec{\phi}
- \vec{f}\cdot\vec{\phi} \right) dx
= -\gamma \int_{\Gamma(\vec{u}^n)} \kappa \vec{\phi}\cdot\hat{n} \, d\Gamma,
\quad \forall \vec{\phi}.
\end{equation}
%
In this way, we separate the linear and nonlinear parts
and treat the nonlinear part explicitly without the need
for a nonlinear solve at each step of iterations.
To use this scheme, we would still need to verify
that the scheme converges to a solution.
There are other issues that need to be addressed
as well. The right hand side in \eqref{E:1st-iterative-scheme}
is an integral computed on the displaced surface
$\Gamma(\vec{u})$. Therefore, at each iteration,
we need to move the surface $\Gamma$ to its displaced
position and then evaluate the surface integral.
Moreover, evaluating the integral requires computing
the curvature of the displaced curve $\Gamma(\vec{u})$.
Ideally we would like to avoid both tracking the displaced
curve and computing its curvature. For this reason,
in the following, we rederive the first variation
of the surface tension term in \eqref{E:energy}.
Our goal is to obtain an expression that is
evaluated on the initial surface $\Gamma_0$
and does not require the curvature of the surface.
For the moment, we restrict our attention
to parametric planar curves in 2d.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{First variation of curve length}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

We start by taking the first variation of
%
\begin{equation}\label{E:curve-length}
E(\Gamma_0) = \int_{\Gamma_0} d\Gamma = \int_{s_1}^{s_2} |\Gamma_0'(s)|ds
\end{equation}
%
with respect to a given parametric curve
\[
\Gamma_0(s) = \left( x(s), y(s) \right), \quad s_1 \leqslant s \leqslant s_2.
\]
Let us write \eqref{E:curve-length} more explicitly
%
\begin{align*}
\Gamma_0'(s)&=\left( x'(s), y'(s) \right), \\
|\Gamma_0'(s)|&=\left( |x'(s)|^2 + |y'(s)|^2 \right)^\frac{1}{2}
\end{align*}
%
\[
\Rightarrow  E(\Gamma_0) = \int_{s_1}^{s_2} \left( |x'(s)|^2 + |y'(s)|^2 \right)^\frac{1}{2} ds.
\]
We define the perturbed curve
\[
\Gamma_\varepsilon(s) = \left( x(s)+\varepsilon \phi(s), y(s) + \varepsilon \psi(s) \right)
\]
and compute
\[
\delta E(\Gamma_0) = \lim_{\varepsilon \rightarrow 0} \frac{E(\Gamma_\varepsilon) - E(\Gamma)}{\varepsilon}
= \frac{d}{d\varepsilon} E(\Gamma_\varepsilon) |_{\varepsilon=0}.
\]
We need to take the derivative of
\[
E(\Gamma_\varepsilon) = \int_{s_1}^{s_2} \left( |x'(s)+\varepsilon \phi'(s)|^2 + |y'(s) + \varepsilon \psi'(s)|^2 \right)^\frac{1}{2} ds
\]
with respect to $\varepsilon$. We start with
%
\begin{equation*}
\frac{d}{d\varepsilon} |\Gamma_\varepsilon'|
= \frac{(x'(s)+\varepsilon \phi'(s)) \phi'(s) + (y'(s) + \varepsilon \psi'(s))\psi'(s) }{\left( |x'(s)+\varepsilon \phi'(s)|^2 + |y'(s) + \varepsilon \psi'(s)|^2 \right)^{\frac{1}{2}}},
\end{equation*}
%
and
%
\begin{equation*}
\frac{d}{d\varepsilon} |\Gamma_\varepsilon'|_{\varepsilon=0} = \frac{x'(s)\phi'(s) + y'(s)\psi'(s)}{\left( |x'(s)|^2 + |y'(s)|^2 \right)^{\frac{1}{2}}}.
\end{equation*}
%
We have
\[
\delta E(\Gamma_0) = \int_{s_1}^{s_2} \frac{x'(s)\phi'(s) + y'(s)\psi'(s)}{\left( |x'(s)|^2 + |y'(s)|^2 \right)^{\frac{1}{2}}} ds.
\]
Let us integrate $\phi', \psi'$ by parts (with the simplifying assumption that
$ \int_{s_1}^{s_2} = \oint$, that is, we integrate over a closed curve).
Start with
%
\begin{align*}
\left(  \frac{x'(s)}{\left( |x'(s)|^2 + |y'(s)|^2 \right)^{\frac{1}{2}}} \right)'
&=x''(s)\frac{1}{\left( |x'(s)|^2 + |y'(s)|^2 \right)^{\frac{1}{2}}}
- x'(s)\frac{1}{2}\frac{(2x'(s)x''(s) + 2y'(s)y''(s))}{\left( |x'(s)|^2 + |y'(s)|^2 \right)^{\frac{3}{2}}} \\
&= \frac{x''\left( |x'|^2 + |y'|^2 \right) - x'x'x''-x'y'y''}{\left( |x'(s)|^2 + |y'(s)|^2 \right)^{\frac{3}{2}}} \\
&= -y'(s)\kappa(s) \\
&= -y' \frac{x'y'' - x''y'}{\left( |x'|^2 + |y'|^2 \right)^{\frac{3}{2}}} \\
\left(  \frac{y'(s)}{\left( |x'(s)|^2 + |y'(s)|^2 \right)^{\frac{1}{2}}} \right)'
&= x' \frac{x'y'' - x''y'}{\left( |x'|^2 + |y'|^2 \right)^{\frac{3}{2}}} \\
&= x'(s)\kappa(s).
\end{align*}
%
\begin{align*}
\Rightarrow \delta E(\Gamma_0) &= \int \kappa(s) \left( -y'(s)\phi(s) + x'(s)\psi(s) \right) \frac{1}{|\Gamma_0'(s)|} |\Gamma_0'(s)| ds, \\
\Rightarrow \delta E(\Gamma_0) &= \int \kappa(s) \vec{\varphi}\cdot \hat{n}(s)|\Gamma_0'(s)| ds,
\end{align*}
where $\vec{\varphi} = (\phi(s),\psi(s))$ and $\hat{n} = \frac{1}{|\Gamma_0'(s)|}(-y'(s),x(s))$.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Variation with respect to displacement}
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Now we take the first variation of $E(\Gamma_u)$ with
respect to the displacement field $\vec{u}$ (\emph{not $\Gamma_u$})
where $\Gamma_u$ is $\Gamma_0$ displaced by $\vec{u}$, that is,
\[
\Gamma_u(s) = \Gamma_0(s) + \vec{u}\cdot (x(s),y(s)) = \left( x(s)+u(x(s),y(s)), y(s)+v(x(s),y(s)) \right).
\]
We will need the derivative of $\Gamma_u(s)$
%
\begin{align*}
\Gamma_u'(s) &= \left( x' + \nabla u \cdot (x',y'), y' + \nabla v \cdot (x',y') \right) \\
\Gamma_u'(s) &= \Gamma_0'(s) + D\vec{u} \Gamma_0'(s) = (I + D\vec{u}) \Gamma_0'(s) \\
\Gamma_u'(s) &= \left( x' + \nabla u \cdot \Gamma_0', y' + \nabla v \cdot \Gamma_0' \right) .
\end{align*}
%
Note $D\vec{u} = \left( \begin{array}{c} \nabla u^T \\ \nabla v^T \end{array} \right)$. \\
Now we write
\[
|\Gamma_u'(s)| = \left( |x' + \nabla u \cdot \Gamma_0'|^2 + |y' + \nabla v \cdot \Gamma_0'|^2  \right)^\frac{1}{2}
\]
also the perturbed version (by $u \rightarrow u+\varepsilon\phi$, $v \rightarrow v+\varepsilon\psi$)
\[
|\Gamma_\varepsilon'(s)| = \left( |x' + \nabla u \cdot \Gamma_0'+ \varepsilon\nabla\phi \cdot \Gamma_0'|^2 + |y' + \nabla v \cdot \Gamma_0'+ \varepsilon\nabla\psi \cdot \Gamma_0'|^2  \right)^\frac{1}{2}.
\]
Differentiate $|\Gamma_\varepsilon'|$ with respect to $\varepsilon$ and evaluate at $\varepsilon=0$
%
\begin{equation*}
\frac{d}{d\varepsilon}|\Gamma_\varepsilon'|
= \frac{1}{2}\left( \ldots \right)^\frac{1}{2}
2 \left( (x' + \nabla u \cdot \Gamma_0'+ \varepsilon\nabla\phi \cdot \Gamma_0')\nabla\phi\cdot\Gamma_0' +
(y' + \nabla v \cdot \Gamma_0'+ \varepsilon\nabla\psi \cdot \Gamma_0')\nabla\psi\cdot\Gamma_0' \right),
\end{equation*}
%
\begin{equation*}
\frac{d}{d\varepsilon}|\Gamma_\varepsilon'| |_{\varepsilon=0} =
\frac{ \left( (x' + \nabla u \cdot \Gamma_0')\nabla\phi\cdot\Gamma_0' +
(y' + \nabla v \cdot \Gamma_0')\nabla\psi\cdot\Gamma_0' \right) }
{\left( |x' + \nabla u \cdot \Gamma_0'|^2 + |y' + \nabla v \cdot \Gamma_0'|^2  \right)^\frac{1}{2}},
\end{equation*}
%
whence we obtain the first variation of $E(\Gamma_u)$
%
\begin{equation}\label{E:displaced_curve_1st_variation}
\delta E(\Gamma_u) = \int_{s_1}^{s_2}
\frac{ \left( (x' + \nabla u \cdot \Gamma_0')\nabla\phi\cdot\Gamma_0' +
(y' + \nabla v \cdot \Gamma_0')\nabla\psi\cdot\Gamma_0' \right) }
{\left( |x' + \nabla u \cdot \Gamma_0'|^2 + |y' + \nabla v \cdot \Gamma_0'|^2  \right)^\frac{1}{2}} ds.
\end{equation}
%
Note $(\phi)' = (\phi(x(s),y(s)))'=\nabla\phi\cdot\Gamma_0'$, $(\psi)'=\nabla\psi\cdot\Gamma_0'$.

We integrate $(\phi)',(\psi)'$ by parts as we did for $E(\Gamma_0)$ and obtain
%
\begin{equation*}
\delta E(\Gamma_u) = \int \kappa_u(s) \vec{\varphi}(x,y) \cdot \hat{n}_u |\Gamma_u'(s)| ds,
\end{equation*}
%
where $\vec{\varphi}(x,y)=(\phi(x,y),\psi(x,y))$ and
\[
\hat{n}_u(s)=\frac{1}{|\Gamma_u'(s)|} (-y_u'(s),x_u'(s)), \qquad
\kappa_u(s) = \frac{x_u' y_u'' - x_u'' y_u'}{\left( |x_u'|^2 + |y_u'|^2 \right)^{\frac{1}{2}}}.
\]

Let us rearrange the terms in \eqref{E:displaced_curve_1st_variation}.
First recall that the tangent vector $\hat{\tau}$ is given by
\[
\hat{tau} = \frac{\Gamma_0'}{|\Gamma_0'|} = \frac{1}{|\Gamma_0'|} (x',y'), \qquad
\hat{tau} = (\tau_x,\tau_y).
\]
Rewrite $\delta E(\Gamma_u)$  in \eqref{E:displaced_curve_1st_variation}:
%
\begin{align*}
\delta E(\Gamma_u) &= \int
\frac{|\Gamma_0'|^2}{|\Gamma_0'|}
\frac{ \frac{x'}{|\Gamma_0'|} \nabla\phi \cdot \frac{\Gamma_0' }{|\Gamma_0'|}
+ \frac{y'}{|\Gamma_0'|} \nabla\psi \cdot \frac{\Gamma_0' }{|\Gamma_0'|}
+ \nabla u \cdot \frac{\Gamma_0'}{|\Gamma_0'|} \nabla\phi \cdot \frac{\Gamma_0'}{|\Gamma_0'|}
+ \nabla v \cdot \frac{\Gamma_0'}{|\Gamma_0'|} \nabla\psi \cdot \frac{\Gamma_0'}{|\Gamma_0'|} }
{\left[ \left( \frac{x'}{|\Gamma_0'|} + \nabla u \cdot \frac{\Gamma_0'}{|\Gamma_0'|} \right)^2 +
\left( \frac{y'}{|\Gamma_0'|} + \nabla v \cdot \frac{\Gamma_0'}{|\Gamma_0'|} \right)^2  \right]^\frac{1}{2}} ds \\
\delta E(\Gamma_u) &= \int
\frac{\tau_x \nabla\phi \cdot \hat{\tau} + \tau_y \nabla\psi \cdot \hat{\tau}
+ \nabla u \cdot \hat{\tau} \nabla\phi \cdot \hat{\tau}
+ \nabla v \cdot \hat{\tau} \nabla\psi \cdot \hat{\tau}}
{\left[ (\tau_x + \nabla u \cdot \hat{\tau})^2 + (\tau_y + \nabla v \cdot \hat{\tau})^2 \right]} ds.
\end{align*}
%
This can be written compactly as
\[
\delta E(\Gamma_u) = \int
\frac{\hat{\tau}^T (I + D\vec{u})^T D\vec{\varphi} \hat{\tau}}{|(I+D\vec{u})\hat{\tau}|} ds.
\]

\end{document}


\documentclass[a4paper,titlepage]{article}

\title{Lucre: Anonymous Electronic Tokens v1.8}
\author{Ben Laurie \\
ben@algroup.co.uk}

\begin{document}
\maketitle

\def\mod#1{\,(\textrm{mod}\,#1)}
\def\implies{\Rightarrow}
\def\qe#1{\begin{equation}#1\end{equation}}
\def\qearray#1{\begin{eqnarray}#1\end{eqnarray}}
\def\oneway#1{\textrm{oneway}(#1)}
\def\preoneway#1{\textrm{preoneway}(#1)}

\setlength{\parindent}{0pt}
\setlength{\parskip}{1ex plus 0.5ex minus 0.2ex}

\section{Introduction}

This is a revised version of the theory of blinded coins that may not
violate Chaum's patent\footnote{At least, that's what people
think. Take legal advice before using this stuff!}, based on the
original work by David Wagner, and conversations with Ian Goldberg,
David Molnar, Paul Barreto and various Anonymouses.

Note that this now includes variants that probably do violate the
patent, but are of sufficient academic interest to be worthy of
inclusion.

\section{Coins}

\subsection{Creating the Mint}
\label{sec:mint}

The mint chooses a prime, $p$, with $(p-1)/2$ also prime, a generator,
$g$, s.t.

\qe{\label{eq:3}g^2 \neq 1 \mod p}

and

\qe{\label{eq:1}g^{(p-1)/2} = 1 \mod p}

(see \ref{sec:theory1}) and a random number, $k$,

\qe{k \in [0,(p-1)/2)}

Let $G$ be the group generated by $g$.

The mint publishes

\qe{(g,p,g^k \mod p)}

\subsection{Withdrawing a Coin}

To withdraw a coin Alice picks a random $x$, the coin ID, from a
sufficiently large set that two equal values are unlikely to ever be
generated\footnote{Remember that if the size of the set of all
possible coins is $C$, the probability of two being the same is .5
after around $\sqrt{C}$ coins have been generated.}, and calculates,

\qe{y=\oneway{x}}

(see \ref{sec:oneway}). $y$ should be in $G$; check that

\qe{1 < y < p-1}

We should avoid the trivial values 1 and -1, because their signatures
are independent of $k$. Note that many one-way coin functions
(including the one presented here) provably never produce 1 or -1, but
we include this condition for completeness.

\qe{y^{(p-1)/2}=1 \mod p}

If it is not, a new coin should be chosen. Note that great care must
be take if you want to choose a one-way function that guarantees
membership of $G$ - certainly one attempt (see \ref{sec:badoneway})
led to disaster.

Alice chooses a random blinding factor $b \in [0,(p-1)/2)$ and sends
$y g^b$ (the coin request) to the mint. The mint debits Alice's
account and returns the blinded signature,

\qe{m=(y g^b)^k \mod p}

Alice unblinds $m$, calculating the signature,

\qe{z=m (g^k)^{-b}=(y g^b)^k g^{-kb}=y^k g^{bk} g^{-kb}=y^k \mod p}

The coin is then

\qe{c=(x,z)}

\subsection{Spending a Coin}

To spend a coin, Alice simply gives the coin, $c$, to Bob. Bob then
sends it to the mint to be checked. The mint first ensures that $x$
has not already been spent, and that $\oneway x$ is in $G$ and is not
1 or -1, then checks that $z$ is a signature for $x$
(i.e. $z=\oneway{x}^k \mod p$). The mint then records $x$ as spent and
credits Bob's account.

\section{Attack\cite{Anon1}}

Unfortunately an attack on the anonymity of this protocol is
possible. The mint can mark a coin in a way that only it can detect,
by signing it with $k'$ instead of $k$. Then the unblinded
``signature'' is

\qe{z=(y g^b)^{k'} g^{-bk}=y^{k'} g^{b(k'-k)} \mod p}

When Bob submits $c$ to the mint, then the mint calculates

\qe{y (z y^{-k'})^{1/(k'-k)}=y (g^{b(k'-k)})^{1/(k'-k)}=y g^b \mod p}

The mint can then simply look up who sent $y g^b$ to it and thus learn
Alice's identity.

\section{Type I Defence}

One defence against this attack is to make the mint prove that it has
signed with $k$ and not some other number. Since the mint must not
reveal $k$, this proof must be a zero-knowledge proof. Two possible
zero-knowledge proofs are known to me.

\subsection{Variation 1\cite{Goldberg2}}

Given a coin request, $y g^b$, the mint chooses a random number $r$
 s.t.

\qe{r \in [1,p-1)}

s.t. r is invertible modulo $p-1$ (i.e. $gcd(r,p-1)=1$) and calculates

\qe{t=k/r \mod{p-1}}

($p-1$ rather than $p$ because $r$ and $t$ will be used as exponents
modulo $p$). The mint then sends Alice

\qe{Q=(y g^b)^r \mod p}

and

\qe{A=g^r \mod p}

Alice then randomly demands one of $r$ or $t$.

If Alice chose $r$, she verifies that

\qe{Q=(y g^b)^r \mod p}

and

\qe{A=g^r \mod p}

If Alice chose $t$, she verifies that

\qe{A^t=g^{rt}=g^k \mod p}

and

\qe{Q^t=(y g^b)^{rt}=(y g^b)^k=z \mod p}

Note that a mint that wants to cheat has a .5 chance of getting away
with it each time (by guessing whether the challenger will choose $r$
or $t$ and lying about $Q$ and $A$ appropriately). Naturally, it is
increasingly unlikely to get away with this with each repetition. A
suspicious challenger could always repeat the protocol until the
probability of cheating is low enough to make them happy.

\subsection{Variation 2\cite{Chaum}}

The mint chooses a random value $r$ and sends Alice

\qe{u=g^r \mod p}

and

\qe{v=(y g^b)^r \mod p}

Alice responds with a challenge $d$. The mint answers with

\qe{w=dk+r \mod{(p-1)/2}}

Alice verifies that

\qe{g^w=g^{dk+r}=(g^k)^d u \mod p}

and

\qe{(y g^b)^w=(y g^b)^{dk+r}=((y g^b)^k)^d v=(y g^b)^d v \mod p}

\subsection{Non-interactive variant}

It is suggested that choosing

\qe{d=hash(u,v)}

would allow the second variation to be used non-interactively. The
mint sends $(d,w)$ along with the coin, Alice calculates

\qe{g^w (g^k)^{-d}=u \mod p}

and

\qe{(y g^b)^w m^{-d}=v \mod p}

and verifies that $d=hash(u,v)$.

I'm not entirely convinced that it isn't possible to search for (or
even calculate) a set of values that makes this appear to work whilst
still signing with $k'$.

\section{Type II Defence\cite{Anon1}}

Another defence is to combine two blinding methods, using two
indepenent random blinding factors. With this method, the
coin-withdrawal protocol changes as follows.

To withdraw a coin Alice picks a random $x$, the coin ID, from a
sufficiently large set that two equal values are unlikely to ever be
generated, and calculates,

\qe{y=\oneway{x}}

(see \ref{sec:oneway}). $y$ should be in $G$; check that

\qe{y^{(p-1)/2}=1 \mod p}

Alice chooses random blinding factors $b_y,b_g \in [1,p-1)$, ensuring
that $b_y$ is invertible modulo $p-1$ (i.e. $gcd(y,p-1)=1$) and sends
$y^{b_y} g^{b_g}$ (the coin request) to the mint. The mint debits
Alice's account and returns the blinded signature,

\qe{m=(y^{b_y} g^{b_g})^k \mod p}

Alice unblinds $m$, calculating the signature,

\qearray{z&=&(m.(g^k)^{-b_g})^{1/b_y} \\
	  &=&((y^{b_y} g^{b_g})^k g^{-kb_g})^{1/b_y} \\
	  &=&(y^{kb_y} g^{kb_g} g^{-kb_g})^{1/b_y} \\
	  &=&(y^{kb_y})^{1/b_y} \\
	  &=&y^k \mod p}

not forgetting that $1/b_y$ must be calculated modulo $p-1$, since it is
used as an exponent.

Now $z$ is in the same form as in the original scheme and we can
proceed as normal.

\subsection{Failed Attack}

If the mint attempts to mark the coin, as before, then let's see what
happens. The blinded signature is

\qe{m=(y^{b_y} g^{b_g})^{k'} \mod p}

unblinding, Alice gets

\qearray{z&=&(m.(g^k)^{-b_g})^{1/b_y} \\
	  &=&((y^{b_y} g^{b_g})^{k'} g^{-kb_g})^{1/b_y} \\
	  &=&(y^{k'b_y} g^{k'b_g} g^{-kb_g})^{1/b_y} \\
	  &=&(y^{k'b_y} g^{(k'-k)b_g})^{1/b_y} \\
	  &=&y^{k'} g^{(k'-k)b_g/b_y} \mod p}

Because this result entangles both the unknown (to the mint) value $y$
and the, also unknown, value $g^{b_g/b_y}$, the mint cannot even
verify that this is a correct signature, let alone figure out who gave
it the blinded coin in the first place.

\section{Type III Defence}

It has recently been pointed out that the Decisional Diffie-Hellman
(DDH) problem has to be separated from the Diffie-Hellman problem
(also known as the Computational Diffie-Hellman problem) (DH). In
particular there are groups where DDH is easy even though DH is
hard. What this actually means in practice is that although given $g$,
$g^a$ and $g^b$ we can't find an $h$ s.t. $h=g^{ab}$, we can, given
$g$, $g^a$, $g^b$ and $g^c$, determine whether $ab=c$ (all modulo $p$,
of course).\cite{Joux}

Given such a group, it is possible to verify that the signature is
correct in single blinding without a zero knowledge proof. This works
like this: once the coin $x$ has been signed, we have $y=oneway(x)$, a
number $z$ that we hope is $y^k$ (but let us signify our doubt for now
by calling it $y^{k'}$), $g$ and $g^k$.\cite{Goldberg}

We can check the correctness of $z$ using the easiness of DDH
as follows: since $g$ is a generator for the group, there must exist a
$t$ s.t. $y=g^t$. Then we have $g$, $g^t$ (which is $y$), $g^k$ and
$g^{tk'}$ (which is $y^{k'}=z$). We can use easy DDH to check whether
$tk=tk'$. If it is, then, of course, $k'=k$ and the signature is
genuine.

Of course, the groups we are talking about here are not $Z_p^*$. In
fact, the groups discovered so far with this property are carefully
constructed elliptic curves.

Note that there may well be an argument that the weakness of DDH in
this group means that the blind signature constitutes a verifiable
signature as covered by Chaum's patent and hence would no longer
sidestep the patent.

\section{Cost and Value}

Although there are those that hold that a coin should have a value
similar to its cost of production, this is clearly insane, at least
when the coin is to be used as money\footnote{A clear example where it
is not insane is Adam Back's hashcash used as an anti-spam measure -
in that case, the whole point is that the coin is expensive to
produce.}.

In general, the cost of production should be considerably
less than the value of the coin. So, it is worth calculating the cost
of producing Lucre coins.

Assuming that the coins are relatively low value, then a 512 bit
signing key should be sufficient. The cost of producing a coin is
really the cost of signing it twice (once blinded when withdrawn, and
once ublinded when deposited). Implemented in Java on a 300 MHz
Pentium\footnote{Surely nothing can be slower that this?} we can
achieve 25 signs per second. A server in the Bunker
(http://www.thebunker.net/) costs \pounds250 per month.

That's \pounds8 per day. 30p per hour, .5p per minute, .001p per second,
.0004p per sign.

So, values of .01p per coin are easily achievable.

Incidentally, signing with a 1024-bit key takes around 6 times as
long, so values of .1p with 1024-bit security are also achievable.

\section{Choosing Parameters}

When creating a mint, there are a number of parameters to choose, some
of which must satisfy certain properties. Also, some may be well-known
and some have to be secret. This section discusses these requirements.

\subsection{The Prime, $p$}

The prime, as noted in \ref{sec:mint}, needs to be a Sophie Germain
prime\footnote{Strictly, a Sophie Germain prime is the {\it smaller} of
the two, and we want the larger.}. There's no particular requirement
for secrecy, so an existing prime that has been proven prime should be
preferred to a probabilistically generated one.

The other factor in choosing the prime is a cost/security tradeoff. If
the prime is too small, there is a danger that an attacker can
retrieve it from coin signatures by brute force. If it is too large,
then the cost of signing coins can become prohibitive. A detailed
analysis of this tradeoff may be the subject of another paper, but for
now (i.e. in February 2003), I would say that a 512 bit prime should
only be used for very low value coins. 1024 or 2048 bits should be
safe for most applications.

Where can such primes be found? RFC 2412, Appendix E, contains
(allegedly) proven 768, 1024 and 1536 bit primes, though certificates
are not included. Nor is it entirely clear that $(p-1)/2$ have also
been proven prime.

The Internet Draft draft-ietf-ipsec-ike-modp-groups-05.txt adds 2048,
3072, 4096, 6144 and 8192 bit primes - but with no statement of proof
(and obviously no certificates). Sinced I-Ds are ephemeral, I include
the primes here.

\qe{2^{1536} - 2^{1472} - 1 + 2^{64} ( 2^{1406} \pi + 741804 ) }

\begin{tt}
	FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
	29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
	EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
	E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
	EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
	C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
	83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
	670C354E 4ABC9804 F1746C08 CA237327 FFFFFFFF FFFFFFFF
\end{tt}

\qe{2^{2048} - 2^{1984} - 1 + 2^{64} ( 2^{1918} \pi + 124476 ) }

\begin{tt}
        FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
        29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
        EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
        E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
        EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
        C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
        83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
        670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
        E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9
        DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510
        15728E5A 8AACAA68 FFFFFFFF FFFFFFFF
\end{tt}

\qe{2^{3072} - 2^{3008} - 1 + 2^{64} ( 2^{2942} \pi + 1690314 ) }

\begin{tt}
        FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
        29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
        EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
        E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
        EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
        C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
        83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
        670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
        E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9
        DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510
        15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64
        ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7
\end{tt}

\qe{2^{4096} - 2^{4032} - 1 + 2^{64} ( 2^{3966} \pi + 240904 ) }

\begin{tt}
        FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
        29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
        EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
        E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
        EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
        C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
        83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
        670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
        E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9
        DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510
        15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64
        ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7
        ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B
        F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
        BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31
        43DB5BFC E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7
        88719A10 BDBA5B26 99C32718 6AF4E23C 1A946834 B6150BDA
        2583E9CA 2AD44CE8 DBBBC2DB 04DE8EF9 2E8EFC14 1FBECAA6
        287C5947 4E6BC05D 99B2964F A090C3A2 233BA186 515BE7ED
        1F612970 CEE2D7AF B81BDD76 2170481C D0069127 D5B05AA9
        93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34063199
        FFFFFFFF FFFFFFFF
\end{tt}

\qe{2^{6144} - 2^{6080} - 1 + 2^{64} ( 2^{6014} \pi + 929484 ) }

\begin{tt}
        FFFFFFFF FFFFFFFF C90FDAA2 2168C234 C4C6628B 80DC1CD1
        29024E08 8A67CC74 020BBEA6 3B139B22 514A0879 8E3404DD
        EF9519B3 CD3A431B 302B0A6D F25F1437 4FE1356D 6D51C245
        E485B576 625E7EC6 F44C42E9 A637ED6B 0BFF5CB6 F406B7ED
        EE386BFB 5A899FA5 AE9F2411 7C4B1FE6 49286651 ECE45B3D
        C2007CB8 A163BF05 98DA4836 1C55D39A 69163FA8 FD24CF5F
        83655D23 DCA3AD96 1C62F356 208552BB 9ED52907 7096966D
        670C354E 4ABC9804 F1746C08 CA18217C 32905E46 2E36CE3B
        E39E772C 180E8603 9B2783A2 EC07A28F B5C55DF0 6F4C52C9
        DE2BCBF6 95581718 3995497C EA956AE5 15D22618 98FA0510
        15728E5A 8AAAC42D AD33170D 04507A33 A85521AB DF1CBA64
        ECFB8504 58DBEF0A 8AEA7157 5D060C7D B3970F85 A6E1E4C7
        ABF5AE8C DB0933D7 1E8C94E0 4A25619D CEE3D226 1AD2EE6B
        F12FFA06 D98A0864 D8760273 3EC86A64 521F2B18 177B200C
        BBE11757 7A615D6C 770988C0 BAD946E2 08E24FA0 74E5AB31
        43DB5BFC E0FD108E 4B82D120 A9210801 1A723C12 A787E6D7
        88719A10 BDBA5B26 99C32718 6AF4E23C 1A946834 B6150BDA
        2583E9CA 2AD44CE8 DBBBC2DB 04DE8EF9 2E8EFC14 1FBECAA6
        287C5947 4E6BC05D 99B2964F A090C3A2 233BA186 515BE7ED
        1F612970 CEE2D7AF B81BDD76 2170481C D0069127 D5B05AA9
        93B4EA98 8D8FDDC1 86FFB7DC 90A6C08F 4DF435C9 34028492
        36C3FAB4 D27C7026 C1D4DCB2 602646DE C9751E76 3DBA37BD
        F8FF9406 AD9E530E E5DB382F 413001AE B06A53ED 9027D831
        179727B0 865A8918 DA3EDBEB CF9B14ED 44CE6CBA CED4BB1B
        DB7F1447 E6CC254B 33205151 2BD7AF42 6FB8F401 378CD2BF
        5983CA01 C64B92EC F032EA15 D1721D03 F482D7CE 6E74FEF6
        D55E702F 46980C82 B5A84031 900B1C9E 59E7C97F BEC7E8F3
        23A97A7E 36CC88BE 0F1D45B7 FF585AC5 4BD407B2 2B4154AA
        CC8F6D7E BF48E1D8 14CC5ED2 0F8037E0 A79715EE F29BE328
        06A1D58B B7C5DA76 F550AA3D 8A1FBFF0 EB19CCB1 A313D55C
        DA56C9EC 2EF29632 387FE8D7 6E3C0468 043E8F66 3F4860EE
        12BF2D5B 0B7474D6 E694F91E 6DCC4024 FFFFFFFF FFFFFFFF
\end{tt}

Certificates for all of these can be found at
ftp://ftp.ssh.com/pub/ietf/ecpp-certificates, however, I am not aware
of source for code that allows the certificates to be checked.

\subsection{The Generator, $g$}

Equations \ref{eq:3} and \ref{eq:1} constrain the generator. Luckily,
there's a trivial choice that satisfies them always: 4.

\subsubsection{Proof}

\qe{4^2=16=1 \mod {15}}

and 15 isn't prime.

\qe{n^{p-1}=1 \mod p}

by Euler's theorem, so

\qe{2^{p-1}=4^{(p-1)/2}=1 \mod p}

which satisfies \ref{eq:1} for all primes.

\subsection{Coin Size}

The coin needs to be large enough that collisions are extremely
unlikely. The only other constraint is that the total size needs to be
the same as the key size, so it should not be so large as to reduce
the size of the stuff added by the one-way coin function (see
\ref{sec:oneway}) to a level were coin signatures might be
forged. Generally 128 bits is considered sufficient to avoid
collisions in most real-world situations. Since we've stipulated a
minimum key size of 512 bits, there's no reason to fiddle with this,
so 128 bits for the random part is sufficient.

Note that even though the client generates the coin, there's no reason
to defend against a client generating the same coin twice (or the same
coin as someone else), since that would cause their coin to appear to
be a doublespend and would cost them money.

\section{Theory}

\subsection{Subgroup Order}
\label{sec:theory1}

(\ref{eq:1}) ensures that the order of the subgroup generated by $g$ is
$(p-1)/2$.

\subsubsection{Leakage}

This avoids leakage of information about $k$ which can
occur if $g$ generates the whole of $Z_p^*$, because

\qe{(g^k)^{(p-1)/2}\left\{\begin{array}{ll}
	=1 & \textrm{if $k$ is even} \\
	\neq 1 & \textrm{if $k$ is odd} \\
\end{array} \right.}

{\bf Proof}

If $k$ is even, then there exists an $n$
s.t. $k=2n$.

\qe{(g^{2n})^{(p-1)/2}=(g^n)^{p-1}}

Since

\qe{gcd(g^n,p)=1}

then, by Euler's theorem,

\qe{\label{eq:2}(g^n)^{p-1}=1 \mod p}

If $k$ is odd, then there exists an $n$ s.t. $k=2n+1$.

\qe{(g^{2n+1})^{(p-1)/2}=(g^n)^{p-1} g^{(p-1)/2}}

\qe{(g^n)^{p-1}=1 \mod p}

(see (\ref{eq:2})) and

\qe{g^{(p-1)/2} \neq 1 \mod p}

because the order of $g$ is $p-1$, so no $y < p-1$ can give $g^y=1
 \mod p$. So

\qe{(g^n)^{p-1} g^{(p-1)/2}=1 \cdot x \mod p, x \neq 1}

\subsubsection{Subgroup Order Revisited}

It has been pointed out that using a $g$ that generates the whole
group $Z_p^*$ and choosing $k$ odd also fixes both the above problems,
and makes some parts of the protocol cheaper (because you can avoid
the exponentiation in the one-way function). This seems to me to be
somehow less satisfying, but I can't see anything actively wrong with
it.

\subsection{One-way Coin Function}
\label{sec:oneway}

The purpose of the one way function is to prevent Alice from cheating
the mint by producing variants on a signed coin by simpy reblinding
the coin and the signature - the fact that the coin has a special
structure prevents this from working.

The one-way coin function can, in principle, be any one way function
producing a sufficient number of bits (i.e. around the same number as
in $p$), but the one chosen for Lucre is defined as follows: Let the
random seed for the coin be in $[0,2^n)$ where

\qe{n=m+((\log_2(p)-m) \bmod 160)}

$m$ is the minimim number of bits in $x$, chosen to be large
enough to avoid collisions (128 in Lucre's case). We then define

\qe{\oneway{x}=x\|SHA1(x\|1)\|SHA1(x\|2)\| \cdots \|SHA1(x\|(\log_2(p)-n)/160)}

where $\|$ denotes concatenation. In case it isn't obvious, this
ensures that

\qe{\log_2(\oneway x) \approx \log_2(p)}

Note that the resulting coin must actually be in $G$, so it may take
several attempts to find a correct one.

Also note that Lucre encodes the appended numbers as two bytes, LSB
first. This is massive overkill and allows for gigantic primes.

\subsection{A Possibly Weak One-Way Coin Function}

In an earlier version of Lucre, we defined the one-way function like
this

\qe{h_0(x)=x}
\qe{h_k(x)=h_{k-1}(x)\|SHA1(h_{k-1}(x))}

\qe{\oneway{x}=h_{(n-m)/160}(x)}

The problem with this is that

\qe{\oneway{x|SHA1(x)}=\oneway{x}/2^{160} + O(2^{160})}

Whilst we can't see an attack that uses this property, we find it
slightly worrying, and so prefer the more conventional construction above.

\subsection{A Bad One-way Coin Function}
\label{sec:badoneway}

An earlier version of this paper contained an ``improvement'' to the
one-way coin generation - namely the need to test the resulting coin
for membership in $G$ was removed by adding an extra step:

\qe{\oneway x=g^{\preoneway x} \mod p}

where $\preoneway$ is the one-way function defined above. This guarantees
the coin is in $G$. However, the consequences are disastrous\cite{Wagner}.

The mint publishes $g^k \bmod p$. A coin's signature is $\oneway
x^k \bmod p$. But

\qe{\oneway x^k=(g^{\preoneway x})^k=(g^k)^{\preoneway x} \mod p}

That is, the signature can be forged, trivially!

\begin{thebibliography}{99}

	\bibitem{Goldberg2} Ian Goldberg -- mail to {\sl coderpunks}.

	\bibitem{Chaum} David Chaum and Torben Pedersen -- {\sl
	"Wallet databases with observers"} -- Advances in Cryptology
	-- Proceedings of Crypto '92, pp. 89-105.

	\bibitem{Joux} Antoine Joux and Kim Nguyen -- {\sl
	``Separating Decision Diffie-Hellman from Diffie-Hellman in
	cryptographic groups''} -- http://eprint.iacr.org/2001/003.

	\bibitem{Goldberg} Ian Goldberg -- mail to {\sl coderpunks}.

	\bibitem{Wagner} David Wagner -- personal communication.

	\bibitem{Anon1} Anonymous --
	http://www.mail-archive.com/coderpunks@toad.com/msg02186.html
	and
	http://www.mail-archive.com/coderpunks@toad.com/msg02323.html.

\end{thebibliography}

\section{Change History}

A change history was not kept until v1.8. The original version of this
paper was written 30 November 1999.

\subsection{Changes in 1.8}

Released 1 June 2003.

Several errors in the handling of exponents in modulo arithmetic and
checks for invertability were corrected.

\end{document}


\chapter{Python Lists}

Watch CS Dojo's \textbf{Introduction to Lists in Python} video at \url{https://www.youtube.com/watch?v=tw7ror9x32s}

To review, Python list is an indexed collection. The indices start at
zero. You can create a list using square brackets.

Now you are going to write a program that makes an array of
strings. Type this code into a file called \filename{faves.py}:

\begin{Verbatim}
favorites = ["Raindrops", "Whiskers", "Kettles", "Mittens"]
favorites.append("Packages")
print("Here are all my favorites:", favorites)
print("My most favorite thing is", favorites[0])
print("My second most favorite is", favorites[1])
number_of_faves = len(favorites)
print("Number of things I like:", number_of_faves)

for i in range(number_of_faves):
    print(i, ": I like", favorites[i])
\end{Verbatim}

Run it:
\begin{Verbatim}[commandchars=\\\{\}]
$ \textbf{python3 faves.py}
Here are all my favorites: ['Raindrops', 'Whiskers', 'Kettles', 'Mittens', 'Packages']
My most favorite thing is Raindrops
My second most favorite is Whiskers
Number of things I like: 5
0 : I like Raindrops
1 : I like Whiskers
2 : I like Kettles
3 : I like Mittens
4 : I like Packages
\end{Verbatim}
After you have run the code, study it until the output makes sense.

\begin{Exercise}[title={Assign into list}, label=assignintolist]
  Before you list the items, replace "Mittens" with "Gloves".
\end{Exercise}
\begin{Answer}[ref=assignintolist]
\begin{Verbatim}
favorites[3] = "Gloves"
\end{Verbatim}
\end{Answer}

\section{Evaluating Polynomials in Python}

First, before you go any further, you need to know that raising a
number to a power is done with ** in Python.  So for example, to get
$5^2$, you would write \texttt{5**2}.

Back to polynomials: if you had a polynomial like $2x^3 -9x + 12$, you
could write it like this: $12x^0 + (-9)x^1 + 0x^2 + 2x^3$.  We could
use this representation to keep a polynomial in a Python list. We
would simply store all the coefficients in order:
\begin{Verbatim}
pn1 = [12,-9,0,2]
\end{Verbatim}

In the list, the index of each coefficient would correspond to the
degree of that monomial. For example, in the list 2 is at index 3, so
that entry represents $2x^3$.

In the last chapter, you evaluated the polynomial $x^3 - 3x^2 + 10x -
12$ at $x=4$. Now you will write code that does that evalution.
Create a file called \filename{polynomials.py} and type in the following:

\begin{Verbatim}
def evaluate_polynomial(pn, x):
    sum = 0.0
    for degree in range(len(pn)):
        coefficient = pn[degree]
        term_value = coefficient * x ** degree
        sum = sum + term_value
    return sum

pn1 = [-12.0, 10.0, -3.0, 1.0]
y = evaluate_polynomial(pn1, 4.0)
print("Polynomial 1: When x is 4.0, y is", y)
\end{Verbatim}

Run it. It should evaluate to 44.0.

\section{Walking the list backwards}

Now you are going to make a function that makes a pretty string to
represent your polynomial. Here is how it will be used:
\begin{Verbatim}
def polynomial_to_string(pn):
    ...Your Code Here...

pn_test = [-12.0, 10.0, 0.0, 1.0]
print(polynomial_to_string(pn1))
\end{Verbatim}

This would output:
\begin{Verbatim}
1.0x**3 + 10.0x + -12.0
\end{Verbatim}
This is not as simple as you might hope. In particular:
\begin{itemize}
\item You should skip the terms with a coefficient of zero
\item The term of degree 1 has an $x$, but no exponent
\item The term of degree 0 has neither an $x$ nor an exponent
\item Standard form demands that you list the terms in the reverse
  order from that of your coefficients list. You will need to walk the
  list from last to first.
\end{itemize}

Add this function to your \filename{polynomials.py} file after your \pyfunction{evaluate\_polynomial} function:
\begin{Verbatim}
  def polynomial_to_string(pn):

    # Make a list of the monomial strings
    monomial_strings = []

    # Start at the term with the largest degree
    degree = len(pn) - 1

    # Go through the list backwards stop after constant term
    while degree >= 0:
        coefficient = pn[degree]

        # Skip any term with a zero coefficient
        if coefficient != 0.0:

            # Describe the monomial
            if degree == 0:
                monomial_string = "{}".format(coefficient)
            elif degree == 1:
                monomial_string = "{}x".format(coefficient)
            else:
                monomial_string = "{}x^{}".format(coefficient, degree)

            # Add it to the list
            monomial_strings.append(monomial_string)

        # Move to the previous term
        degree = degree - 1

    # Deal with the zero polynomial
    if len(monomial_strings) == 0:
        monomial_strings.append("0.0")

    # Make a string that joins the terms with a plus sign
    return " + ".join(monomial_strings)
\end{Verbatim}

Note that in a list $n$ items, the indices go from 0 to $n-1$. So when
we are walking the list backwards, we start at \pyfunction{len(pn) -
  1} and stop at zero.

Look over the code and google the functions you aren't familar
with. For example, if you want to know about the \pyfunction(join)
function, google for ``python join''.

Now change your code to use the new function:
\begin{Verbatim}[commandchars=\\\{\}]
pn1 = [-12.0, 10.0, -3.0, 1.0]
y = evaluate_polynomial(pn1, 4.0)
\textbf{print("y =", polynomial\_to\_string(pn1))}
print("    When x is 4.0, y is", y)
\end{Verbatim}

Run the program. Does the function work?

\begin{Exercise}[title={Evaluate Polynomials}, label=pyevalpolynomials]
Using the function that you just wrote, add a few lines of code to
\filename{polynomials.py} to evaluate the following polynomials:
\begin{itemize}
\item Find $4x^4 - 7x^3 - 2x^2 + 5x + 2.5$ at $x = 8.5$.  It should be 16481.875
\item Find $5x^5 - 9$ at $x = 2.0$.  It should be 151.0
\end{itemize}
\end{Exercise}
\begin{Answer}[ref=pyevalpolynomials]
\begin{Verbatim}
pn2 = [2.5, 5.0, -2.0, -7.0, 4.0]
y = evaluate_polynomial(pn2, 8.5)
print("Polynomia 2: When x is 8.5, y is", y)

pn3 = [-9.0, 0.0, 0.0, 0.0, 0.0, 5.0]
y = evaluate_polynomial(pn3, 2.0)
print("Polynomial 3: When x is 2.0, y is", y)
\end{Verbatim}
\end{Answer}

\section{Plot the polynomial}

We can evaluate a polynomial at many points and plot them on a
graph. You are going to write the code to do this.  Create a new file
called \filename{plot\_polynomial.py}. Copy your \pyfunction{evaluate\_polynomial}
function into the new file.

Add a line at the beginning of the program that imports the plotting library matplotlib:
\begin{Verbatim}
import matplotlib.pyplot as plt
\end{Verbatim}

After the \pyfunction{evaluate\_polynomial} function:
\begin{itemize}
\item Create a list with polynomial coefficients.
\item Create two empty arrays, one for x values and one for y values.
\item Fill the x array with values from -3.5 to 3.5. Evaluate the polynomial at each of these points; put those values
  in the y array.
\item Plot them
\end{itemize}

Like this:
\begin{Verbatim}
# x**3 - 7x + 6
pn = [6.0, -7.0, 0.0, 1.0]

# These lists will hold our x and y values
x_list = []
y_list = []

# Start at x=-3.5
current_x =-3.5

# End at x=3.5
while current_x <= 3.5:
    current_y = evaluate_polynomial(pn, current_x)

    # Add x and y to respective lists
    x_list.append(current_x)
    y_list.append(current_y)

    # Move x forward
    current_x += 0.1

# Plot the curve
plt.plot(x_list, y_list)
plt.grid(True)
plt.show()
\end{Verbatim}

You should get a beautiful plot like this:

\includegraphics[width=\textwidth]{polyplot1.png}

If you received an error that the matplotlib was not found, use pip to install it:
\begin{Verbatim}[commandchars=\\\{\}]
$ \textbf{pip3 install matplotlib}
\end{Verbatim}

\begin{Exercise}[title={Observations}, label=plotobservations]
  Where does your polynomial cross the y-axis? Looking at the
  polynomial $x^3 - 7x + 6$, could you have guessed that value?

  \vspace{20mm}

  Where does your polynomial cross the x-axis? The places where a
  polynomial crosses the x-axis is called \emph{its roots}. Later in
  the course, you will learn techniques for finding the roots of a
  polynomial.
\end{Exercise}
\begin{Answer}[ref=plotobservations]
  The polynomial crosses the y-axis at 6. When x is zero, all the terms are zero except the
  last one. Thus you can easily tell that $x^3 - 7x + 6$ will cross the y-axis at $y=6$.

  Looking at the graph, you tell that the curve crosses the y-axes
  near -3, 1 and 2. If you plug those numbers into the polynomial, you
  would find that it evalutes to zero at each one. Thus, $x=-3$, $x=1$, and $x=2$ are roots.
\end{Answer}


\label{ch:two}
\section{What is a shared key?}
	The first step towards understanding \emph{bound information} is looking at the end product of a key exchange.
	The secret key is what we want to obtain from a protocol, so we must understand what we are after.
	What is then a shared key?
	How do we define a common secret shared between Alice and Bob than can be used formally later on?
%    	\subsection{Common Secret} \label{commonsecret}

Intuitively a common secret is a piece of information (i.e. \textit{bits} of information) known to trusted parties --- for example Alice and Bob --- and to none else.
In an environment where we allow the presence of an eavesdropper Eve that makes observation on the communication reaching such state is not always trivial.
There exist methods and protocols to generate such secrets, even from nothing, although they reach different levels of secrecy. A notable one is the famous Diffie-Hellman method to generate a common cryptographic key \cite{DH76} .
We discuss in section \ref{comparison}, while still secure, it is not \textit{information theoretical secure}.
Here we provide a mathematical definition of a common secret that makes use of concepts that will be explained later in chapter \ref{ch:four}.
    	\begin{definition}
	Let $X,Y,Z,S$ be random variables on the same range $\mathcal{X}$. Let $X$ be owned by Alice, $Y$ by Bob and $Z$ by Eve. Then if
  \begin{equation} \label{eq:common}
	  P[X=Y=S] > 1 - \epsilon \tag{common}
	\end{equation}
	\begin{equation} \label{eq:secret}
	  \I(X;Z) = 0 \: \wedge \: \I(Y;Z) = 0 \tag{secret}
  \end{equation}
for all $\epsilon > 0 $ we say Alice and Bob share a common secret.
    	\end{definition}
The first part defines the \textit{common} property: $X$ and $Y$ --- Alice and Bob's variables in the system --- must be asymptotically the same, i.e. the probability that they are the same comes arbitrarily close to $1$ for an arbitrarily large number of realization.
The second part states that the amount of information Eve can gather about $X$ and $Y$, through it's realization of $Z$, is zero.
\section{The analogy with entanglement}
	A fascinating feature that arises from quantum mechanics is quantum entanglement. As Einstein, Podolsky and Rosen pointed out almost a century ago \cite{einstein1935},
	the measurement of entangled states defies the classical understanding of a state.
	They concluded that the theory is incomplete and has to be replaced.
	Bell responded to that with \emph{non-locality}\cite{Bell64}: there are probability distributions for which there is no local hidden variable model, i.e. exactly what EPR are chasing for.
	As quantum mechanics gives rise to such non-local probability distributions we cannot hope to find a "local hidden variable model" replacing quantum mechanics.

	For a quantum system to exhibit non-locality, entanglement is necessary.
%	Entangled particles remain connected so that actions on one affect the other, even when separated by great distances.
	Consider two pure quantum states $\ket{\psi}_A$ and $\ket{\phi}_B$.
	The composite system of the two states is
	\begin{equation}\label{eq:separable}
		\ket{\psi}_A \otimes \ket{\phi}_B = \ket{\psi\phi}_{AB}
	\end{equation}
	States that can be represented as in Eq. \ref{eq:separable} are called \emph{separable}.
	Not all states are separable. Non-separable states are called \emph{entangled}.
	Consider now the state
	\begin{equation}
		\frac{1}{\sqrt{2}}\left(\ket{0}_A\otimes\ket{1}_B - \ket{1}_A\otimes\ket{0}_B\right) = \ket{\Psi^{-}}_{AB}
	\end{equation}
	for it there is no decomposition into (indices are omitted)
	\begin{multline}
		\frac{1}{\sqrt{2}}\left( (\alpha_0\ket0+\alpha_1\ket1)\otimes (\beta_0\ket0 + \beta_1\ket1) \right) \\
		= \frac{1}{\sqrt{2}} \left( \alpha_0\beta_0\ket{00} + \alpha_0\beta_1\ket{01} + \alpha_1\beta_0\ket{10} + \alpha_1\beta_1\ket{11} \right)
	\end{multline}
	that satisfies
	\begin{align}
	\alpha_0\beta_0 = \alpha_1\beta_1 & = 0 \\
	\alpha_0\beta_1 & = 1\\
	\alpha_1\beta_0 & = -1
	\end{align}
	This is an entangled state\footnote{This particular state is called "singlet" and is one of the four Bell's basis presented in \cite{Bell64}}.

	Furthermore, if Alice measures to have $\ket{0}$ on her part of the system, then Bob, using the same measurement basis, by non-locality, will measure $\ket{1}$.
	The other option of measuring $\ket1$ for Alice and $\ket0$ for Bob is also equally probable.
	Alice and Bob's values are always (anti-)correlated, regardless of which of the measurements is obtained (which is random).

%	Let a joint quantum system between Alice and Bob be entangled.
%	Tracing out the part of the system only for Alice (respectively for Bob) will give a completely mixed state.
%	Since entanglement is a phenomenon that appears non-locally, it can be measured only on the whole system, i.e. one has to have access to both the states.
%	This makes the two states \emph{inseparable}.
%	A complete (anti-)correlation exists then between maximally entangled states when measured in the same basis.
%	 This allows Alice and Bob to encode a message onto the quantum state and use it as a variable to share a secret\footnotemark .
%	If Alice measures to have $\ket{0}$ on her part of the system, then Bob, using the same measurement basis, by non-locality, will measure $\ket{1}$\\

	Quantum entanglement possesses one more feature that classical correlation does not have: the monogamy of entanglement \cite{KW04}.
	As Koashi and Winter state in their paper a fundamental difference is that classical correlation can be shared, while quantum entanglement can not.
	This translates to the case where an eavesdropper Eve listens to the message exchange between Alice and Bob: in the classical communication there is no direct way for Alice nor Bob to know that Eve is listening (i.e. \textit{shares the correlation}), while in the second case Eve breaks the existing correlation between Alice and Bob.
These two aspects of quantum entanglement --- correlation and monogamy --- give a valid framework for the establishment of a private channel between parties.

	\footnotetext{A quantum state in quantum mechanics describes a single and isolated quantum system. This can be for example an electron or a photon. For our purposes, a quantum state is always abstracted as a \emph{qubit} or multiple qubits, as described in appendix \ref{App:appendixB}}
	\footnotetext{There are known protocols that achieve that, for example in \cite{Ekert91} or \cite{BB84}}
%   	 \begin{figure}[h]
%			\centering
%			\input{images/entanglement-origin}
%			\caption{origin of entanglement via linearity}
%		\end{figure}

\section{Examples of key exchange}
	Exchanging keys for encryption was once done \textit{physically}, requiring the parties to meet and assure that no eavesdropper was present.
	Modern cryptographic systems make use of protocols over telecommunication channels.
	In both cases the result at the end is that the trusted parties leave (or terminate the protocol) with a bit of information that they know it will be known only to them.
	Here we present examples for both classical and quantum mechanical channels and compare them.
	The intention is to compare them and discuss on the different level of security -- computational, physical and information theoretical --- one might achieve with the correct implementation of one of those.
		\subsection{The Diffie-Hellman key exchange}
		\label{Diffie}
		% Explain only how the protocol works, what is based on, what are its bounds, how it can be attacked (ideally).
		% Don't dive into Maurer violations, that will be covered in chapter [3] (XX)

		A famous and widely used method for the exchange of cryptographic keys is the Diffie-Hellman (DH) key-exchange method.
	The whole process can be summarized in five basic steps \cite{DH76}:
	\begin{enumerate}
		\item Alice and Bob \emph{publicly} communicate and agree on two numbers, that will serve as basis for the computations.
		\item Each party generates \emph{locally} a personal and distinct secret ($s_A$ and $s_B$) without ever communicating it .
		\item They mix their own secret with the common agreed basis, producing a result $R_A$ and $R_B$. The mathematical properties of this operation make it so it is computational infeasible to go back and retrieve the secrets $s$ from $R$.
		\item Both parties exchange \emph{publicly} their result. Each party now know both the result of the other and their own.
		\item Each party applies their secret to the received $R$. The outputs are equal for Alice and Bob so they can use this result as a common secret to create a key.
	\end{enumerate}

	The parts exchanged over the public channel --- the ones that Eve knows --- are only the mutually agreed base and the two partial mixtures.
	It can be proven that those two elements alone give no information about the complete shared secret and that it is virtually impossible (within reasonable amount of time and use of resources) to obtain the correct final product with only those two.\\

	\subsection{The BB84 protocol}
	Protocols for the exchange of keys over a quantum channel have been invented \cite{BB84, Ekert91}.
	These protocols work on the underlying physics of quantum mechanics.
	Alice and Bob need then to have access to a quantum channel to exchange quantum states
	\footnote{A quantum channel is anything that can carry quantum states between two points. For example an optical fiber that carries photons.}.
	Here follows the BB84 protocol as described in \cite{NC10} :
		\begin{enumerate}
			\item Alice chooses $(4+\delta )n$ data bits.
			\item Alice chooses a random $(4+\delta )n$-bit string $b$. She encodes each data bit as $\{\ket{0},\ket{1}\}$ if the corresponding bit of $b$ is $0$ or with the diagonal basis $\{\frac{\ket{0} + \ket{1}}{\sqrt{2}},\frac{\ket{0} - \ket{1}}{\sqrt{2}}\}$ if $b$ is $1$.
			\item Alice sends the resulting state to Bob.
			\item Bob receives the $(4+\delta )n$, announces \emph{publicly} this fact, and measures each qubit in the $X$ or $Z$ basis at random.
			\item Alice announces \emph{publicly} $b$.
			\item Alice and Bob discard any bits where Bob measured a different basis than Alice prepared. With high probability, there are at least $2n$ bits left (if not, abort the protocol and restart). They keep $2n$ bits.
			\item Alice selects a subset of $n$ bits that will to serve as a check on Eve's interference, and tells Bob which basis she selected.
			\item Alice and Bob announce \emph{publicly} and compare the values of the $n$ check bits. If more than an acceptable number disagree, they abort the protocol.
			\item Alice and Bob perform information reconciliation and privacy amplification on the remaining $n$ bits to obtain $m$ shared key bits.
		\end{enumerate}

	\subsection{The one-time Pad}
		%this is not really a method to share a common secret, since you have
		% to already start with a secret.. <- point that out!

		% example of utilization of the key after generation
		% info theoretical key exchanged with OTP over already existing channel
		The one-time pad is not a key exchange method, but a technique to encrypt a message once the key is obtained.
		Here is presented as an example of utilization of a key previously exchanged with some other secure algorithm.
		The message obtained from the OTP is as secure as the method that produced the key.
		This means that if the key is provided to be information theoretical secure, then Eve is \emph{completely factored out} from the information contained in the message.
		Shannon proved in \cite{Shannon49} the perfect security of OTP.
		Figure \ref{Fig:OTP} illustrates an example over a 5-bits string.
		It is important to notice that in order for to OTP to function correctly the key has to be perfectly random and at least of the same size of the message.

		\begin{figure}[h!]
			\centering
			\input{images/Otp}
			\caption{The one-time pad. In order to get true security the key should change each time for each message.}
			\label{Fig:OTP}
		\end{figure}
\section{A comparison between securities}\label{comparison}
    A point can be made comparing these different way of establishing privacy.
    The majority of cryptographic systems used are built on computational complexity security.
	When Shannon laid out the basis of information theory in \cite{Shannon49} in 1949, he affirmed that the highest level of security (information theoretical security) can only be achieved by sharing a secret key from the beginning.
	Maurer later expanded this concept saying that it is not possible to obtain an information theoretical secure key from just a protocol through local operations and public communications\cite{Maur93}. A starting initial correlation must be provided.\\

	 Even though the Diffie-Hellman method does start from nothing, it does not violates Maurer's statement.
	 The key produced by DH is not information theoretical secure.
	 Step $3$ enumerated above relies on computational complexity.
	 The difficulty of breaking this step --- thus accessing the correlation between Alice and Bob --- is bounded only by the length of the number chosen one one side and the computational power available to the adversary on the other.
	 This means, for example, that one cannot use a key obtained through Diffie-Hellman (DH) to generate an information theoretical secure key:
	 as DH starts from nothing, a protocol $R$ constructed to start as DH and producing information theoretical secure key with LOPC will violate the statement that no key can be crated by LOPC alone.
	 The BB84 protocol works differently, but also does not violate Maurer.
	 Albeit Alice and Bob share, at the end of the protocol, a key starting from nothing, and the secret is in theory information theoretical secure --- it can be arbitrarily close ---, it does not so with public (classical) communication.
	 Alice utilizes a quantum channel to pass the states to Bob, which is not public because of the monogamy of entanglement.
	 The communication part in BB84 over a classical channel serves only to check for the presence of an enemy Eve, not to modify the secret --- which is already transferred at this point.
	 Thus the key is created only through a quantum channel, which is not covered by Maurer's claim.

%    The so-called cryptographic functions are functions that are easy to compute in one way, but have a much higher complexity the other way round.\\
%    This is the case for example for the Diffie-Hellman method.
%	The security in this method relies mainly on step 3 (listed above).
%    Here an action as $ R_A = g^{s_A} \bmod p $ is performed, where $g$ and $p$ are the public common basis agreed beforehand.
%	To get back to $s_A$  one will need to find the prime factors of $R_A$, which is a known hard problem.
%	It is not impossible nevertheless.
%	The difficulty of breaking this step --- thus accessing the correlation between Alice and Bob --- is bounded only by the length of the number chosen one one side and the computational power available to the adversary on the other.\\
%
%	The BB84 protocol works differently.
%	It takes advantage of the monogamy of entanglement.
%	If Eve was able to wire-tap the quantum channel, she would disrupt the correlation between Alice and Bob.
%	In this sense the correlation between Alice and Bob is much more protected, since the eavesdropper Eve is factored out from the entangled state $\rho = \rho_{AB}\otimes\rho_E$.
%	However, the entanglement in the protocol is only used to spot the presence of Eve over a large number of repetitions of the experiment.
%	While the amount of information that Eve gets can be bounded by some $\epsilon$, she is not yet \emph{completely} factored out.\\

\section{The equivalent of CKA in QM}
	What we were trying to do was to factor out Eve from Alice and Bob's point of view.
	The goal of classical key agreement (CKA) is also to create a private correlation between Alice and Bob, from one that also includes Eve.
	We already stated that entangled states can provide this level of privacy \cite{Ekert91}.
	However pure entangled states are very fragile and do not occur in nature.
	The more general quantum state is a mixed state.
	A mixed state is a convex mixture of pure states with their probability.
	A mixed state is represented by a density matrix, defined as a positive, trace-$1$ operator.
	By the spectral theorem they can then be wrote in the form of
	\begin{equation}
		\rho = \sum_i p_i \ketbra{\psi_i}{\psi_i} ,\quad \ket{\psi_i}: \text{ state with probability } p_i
	\end{equation}
	and interpreted as a statistical
	Assume that Alice and Bob start with a state $\ket{\psi_{ABE}}$, which is also mixed with a part owned by Eve.
	Is there a way to factor her out the state, so that they obtain
	\begin{equation}
		\rho_{AB} = \Tr_E \kb{\psi_{ABE}}{\psi_{ABE}}
	\end{equation}
	with
	\begin{equation}
		\rho_{AB}\otimes\rho_E
	\end{equation}
	after a series of local operations and classical communication (LOCC)?
	Quantum distillation is a process that allows that. \label{distillation}
	If Alice and Bob have maximally entangled states after distillation then they know --- by the monogamy of entanglement --- that Eve is factored out.
	In other words, the state Alice and Bob have is product with the environment and entangled among them.
	The joint probability distribution $P_{ABE}$ falls similarly into a product $P_{AB}\cdot P_E$ after a CKA protocol.
	However from within $P_{AB}$ we cannot decide whether Eve is factored out or not in classical key agreement.

    \begin{figure}[h]
    	\centering
    	\input{images/intuition_poster}
    	\caption{Entanglement distillation and CKA utilize a resource (mixed state or probability distribution) to produce a distillate that factors out Eve.}
    	\label{Fig:intuition}
    \end{figure}

    To measure entanglement one might consider the least number of maximally entangled bipartite quantum states required to prepare a density matrix $\rho_{AB}$ by local operations and classical communication.
    Similarly one might measure entanglement by the maximal number of singlets that can be obtained form $\rho$ by local operations and classical communication.
    These measures are not the same.
    The first is called \emph{entanglement cost} or \emph{entanglement of formation}; the second describes the \emph{distillate entanglement}.
    We will discuss the classical counterparts, namely the \emph{information of formation} and the \emph{secret-key rate}.
    Figure \ref{Fig:intuition} illustrates the analogy between the resource, distillate and cost.
    This is part of the intuition that leads to bound information.