\chapter{Elliptic curve cryptography}
\label{chpr:ecc}
In this chapter we will analyse the cryptographic primitives and assumptions that will allow in the next chapter to introduce the digital signature schemes that are the core of the present work. The first argument will be the specialization of elliptic curves to finite fields, the mathematical structure underpinning the whole elliptic curve cryptography.

\bigskip

\section{Elliptic curves over finite fields}
\label{ecoverff}
Up to now we considered the field over which the curve is defined to be the set of real numbers: this is not at all the unique possibility. The typical choice in cryptography is $K = \mathbb{F}_p$, where $\mathbb{F}_p$ is the finite field with $p$ elements.
\\
Since there are only finitely many pairs $(x, y)$ with $x, y \in \mathbb{F}_p$, the group $E(\mathbb{F}_p)$ is finite.
In practice we consider:
$$\{(x, y) \in \mathbb{F}_p^2 \ | \ y^2 \equiv x^3 + ax + b \ (\text{mod} \ p), \ 4a^3 + 27b^2 \not\equiv 0 \ (\text{mod} \ p)\} \cup \{\infty\}.$$
It can be shown that the formulas for point addition are the same derived in Section \ref{grouplaw}, but where the calculations are done modulo $p$\footnote{Notice that reduction modulo $p$ can be executed much faster if the prime $p$ is a Mersenne or a pseudo-Mersenne prime, i.e. if $p = 2^d - 1$ for some $d$ in the first case or if $p \simeq 2^d$ in the second one.}.
\\
\begin{center}
	\includegraphics[width=0.9\linewidth]{Images/ec_over_ff.eps}
	\captionof{figure}{The curve $y^2 = x^3 - x$ over $\mathbb{F}_{61}$.}
	\label{fig:figure4}
	\source{\url{https://en.wikipedia.org/wiki/Elliptic_curve\#Elliptic_curves_over_finite_fields}.}
\end{center}
In Figure \ref{fig:figure4} the typical shape of an elliptic curve over a finite field is represented: we can see that we are not anymore dealing with a smooth curve, but with a finite set of points scattered along the plane. We can notice a certain degree of symmetry with respect to the line $y = \frac{p}{2}$, with the exception of the points with $y$ coordinate equal to zero, that correspond to the roots of the cubic $x^3 + ax + b$ in $\mathbb{F}_p$.
\\
It is still possible to define a geometric method for point addition: the general idea is that we draw the line passing through the points considered. Since we are working in modular arithmetic, this line ``repeats" itself along the plane. Once the line intersects a third point, we take the opposite one to be the result of the addition. The approach is presented in Figure \ref{fig:figure5}, however the method can be somewhat counterintuitive, especially when dealing with point doubling, so we stick with the algebraic notation.

\bigskip
\noindent
The number of points on an EC over $\mathbb{F}_q$ plays a central role in the cryptographic applications, so we state here a useful theorem that allows to give an estimate:
\begin{thm} [{\bf Hasse's theorem}] Let $\mathbb{F}_q$ be a finite field and let $E$ be an elliptic curve defined over $\mathbb{F}_q$. Then the order of $E(\mathbb{F}_q)$ (i.e. the number of points) satisfies: $$|q + 1 - \#E(\mathbb{F}_q)| \leq 2\sqrt{q}.$$
\end{thm}
\begin{center}
	\includegraphics[width=0.9\linewidth]{Images/sum_ec_over_ff.eps}
	\captionof{figure}{Geometric representation for the addition of points on the elliptic curve $y^2 = x^3 - x + 3$ over $\mathbb{F}_{127}$.}
	\label{fig:figure5}
	\source{\cite{RefWork:4}.}
\end{center}
\noindent
Loosely speaking, Hasse's theorem tells us that the number of points over $E(\mathbb{F}_q)$ increases linearly with the order of the field.
\\
Another observation we want to do is that if $\#E(\mathbb{F}_p)$ is a prime number, then $E(\mathbb{F}_p)$ is a cyclic group: this is a direct consequence of Lagrange's theorem. Since the order of each subgroup is a divisor of the order of the group, we have that, if the order of the group is a prime number, there is no subgroup (with the exception of the trivial one, comprising only the point at infinity). This means that it has to exist a generator of the whole group. Suppose this is not the case, i.e. $\nexists G \in E(\mathbb{F}_p) \ | \ \forall Q \in E(\mathbb{F}_p) \ \exists q \in [1, ..., \#E(\mathbb{F}_p)] \ \text{s.t.} \ Q = qG$: thus, $\forall G \in E(\mathbb{F}_p)$, there exists at least a $Q$ for which the relation $Q = qG$ does not hold. Fix $G$ and start adding it repeatedly to itself. Of course we would reach different points in $E(\mathbb{F}_p)$ due to the closure of the addition. However we won't be able to reach $Q$, by definition. But eventually we would reach the point at infinity (when $q$ gets equal to the order of $G$): then we would start again, meaning that we would have found a cyclic subgroup. But this is in contrast with Lagrange's theorem, so that we can conclude that the whole set of elliptic curve's points form a cyclic group if $\#E(\mathbb{F}_p)$ is a prime number.

\bigskip

\subsection{Elliptic curve domain parameters}
\label{ecparam}
In order to rely on ECC, the parties involved in a scheme need to agree on a set of parameters called elliptic curve domain parameters. A typical choice is to rely on standardized curves (e.g. those defined in \cite{RefWork:3}); however, it is still possible to choose other parameters, but this has to be done carefully, as we will explain in this section. We start defining EC parameters, following closely \cite{RefWork:2}.
\\
\\
Elliptic curve parameters are defined as a sextuple $T = (p, a, b, G, n, h)$, where:
\begin{itemize}
	\item The integer $p$ specifies the prime finite field $\mathbb{F}_p$;
	\item The two elements $a, b \in \mathbb{F}_p$ specifies the elliptic curve $E(\mathbb{F}_p)$ through the Weierstrass equation;
	\item $G$ is a point on $E(\mathbb{F}_p)$;
	\item $n$ is the order of $G$, i.e. the number of elements of the cyclic subgroup generated by $G$ (that can coincide with the whole $E(\mathbb{F}_p)$);
	\item $h = \frac{\#E(\mathbb{F}_p)}{n}$ is an integer\footnote{We can deduce that $h$ is an integer directly from Lagrange's theorem.} called the cofactor.
\end{itemize}
There are different ways in which we can choose these parameters. For example, they can be generated at random or not. Random generation is a conservative choice, since it offers a guarantee against future special purpose attacks. In this case it could be better to use verifiable random parameters, meaning that $(a, b)$ and/or $G$ are obtained as output from a secure hash function\footnote{An hash function in general is a function that takes as input strings of arbitrary length and outputs in a fixed length sequence of bytes. For a discussion on the security properties of an hash function we refer to the appendix of \cite{RefWork:2}.}, applied to some seed $S$. When choosing verifiable random parameters, the sextuple $T$ should be coupled with the seed value $S$ to allow parameters' validation. However, non random curves are typically built in particular ways to ensure efficient computations. Standardized curves, that comprises both types of EC, have the advantage of underpinning interoperability, plus an high degree of reliability, having been heavily tested.
\\
Now that we have explained what they are and how they can be chosen, we will show some constraints and the validation process for the sextuple $T$.

\bigskip
\bigskip
\bigskip
\bigskip
\bigskip
\noindent
{\bf Parameters' selection}:
\begin{enumerate}
	\item Select the approximate security level in bits, $t$\footnote{The security level should be chosen such that solving the Elliptic Curve Discrete Logarithm Problem (ECDLP, Section \ref{dlp}) requires $2^t$ curve's operations. The SEC standard that we are following restricts to $t \in \{80, 112, 128, 192, 256\}$.};
	\item Choose a prime $p$ such that $\lceil log_2p\rceil = 2t$ if $80 < t < 256$, such that $\lceil log_2p\rceil = 521$ if $t = 256$ and such that $\lceil log_2p\rceil = 192$ if $t = 80$;
	\item Select $a$ and $b$ in $\mathbb{F}_p$ such that:
	\begin{itemize}
		\item $4a^3 + 27b^2 \neq 0 \ (\text{mod} \ p)$;
		\item $\#E(\mathbb{F}_p) \neq p$;
	\end{itemize}
	\item Select $G \in E(\mathbb{F}_p)$ such that:
	\begin{itemize}
		\item $p^B \neq 1 \ (\text{mod} \ n), \ \forall 1 \leq B < 100$;
		\item $h \leq 2^{\frac{t}{8}}$;
		\item $n - 1$ and $n + 1$ should each have a large prime factor $r$, which is large in the sense that $log_nr > \frac{19}{20}$.
	\end{itemize}
\end{enumerate}
These requirements may look strange, but are all needed in order to avoid special attacks. In particular, the two requirements at point 3 are needed in order for the curve to be non singular and to avoid Smart's attack\footnote{The points on the curve are mapped to the elements of the additive group of $\mathbb{F}_p$, so that the discrete logarithm problem is solvable in polynomial time through the {\bf Extended Euclidean Algorithm}.}, respectively.
\\
The three requirements at point 4 instead are needed to ensure that the curve is robust against MOV and Cheon's attack\footnote{These attacks are complex and their explanation is out of the scope of the present work; we refer the interested reader to the appendix of \cite{RefWork:2} for an overview and for further bibliography.}, and to ensure that the order of $G$ is sufficiently high.
\\
Notice however that the choice of the parameters does not secure against all possible attacks. Indeed other kind of attacks may be possible, such as side channel attacks: timing and power analysis are an example. They exploit the differences in the point addition and doubling operations, that lead to different timings or power consumptions. Possible solutions are a change of coordinates or the use of Edwards curves, a special family of elliptic curves for which addition and doubling can be done with the same operation.

\bigskip
\noindent
{\bf Parameters' validation}: Given $T = (p, a, b, G, n, h)$ and $t$, the parameters are deemed valid if:
\begin{enumerate}
	\item $p$ is a prime such that $\lceil log_2p\rceil = 2t$ if $80 < t < 256$, or such that $\lceil log_2p\rceil = 521$ if $t = 256$, or such that $\lceil log_2p\rceil = 192$ if $t = 80$;
	\item $a, b, x_G$ and $y_G$ are integers in $[0, ..., p - 1]$;
	\item $4a^3 + 27b^2 \neq 0 \ (\text{mod} \ p)$;
	\item $y_G^2 = x_G^3 + ax_G + b \ (\text{mod} \ p)$;
	\item $n$ is a prime number;
	\item $h \leq 2^{\frac{t}{8}}$ and $h = \lfloor (\sqrt{p} + 1)^2 / n \rfloor$;
	\item $nG = \infty$;
	\item $p^B \neq 1 \ (\text{mod} \ n), \ \forall 1 \leq B < 100$ and $n \neq p$.
\end{enumerate}
If the parameters are verifiably random, it should also be checked that $(a, b)$ and/or $G$ have been correctly derived from the seed $S$.
\\
These checks are needed to verify that: the curve has the required difficulty level, it is defined over $\mathbb{F}_p$, it is non singular, $G$ is a point of the curve, the Discrete Logarithm (DL, Section \ref{dlp}) is difficult, $h$ is effectively the cofactor of $G$, $G$ has order $n$ and neither MOV nor Smart's attacks are possible.

\bigskip

\subsection{Elliptic curve key pairs}
\label{keypairs}
In this section we would like to briefly analyse the core of the public key cryptography based on elliptic curves: the concept of elliptic curve key pair. Shortly, public key cryptography is a cryptographic system that relies on pairs of keys, a public and a private key, with different roles. The asymmetry of the keys is the reason behind the fact that public key cryptography is sometimes called also asymmetric cryptography. We talk about asymmetry since public keys can be published, while private keys must be kept secret, as the names suggest. This accomplishes two functions: authentication, since everybody with the public key can verify that the holder of the paired private key sent a signed message, and encryption, where the public key is used for encryption, but only the owner of the private counterpart can decrypt.

\bigskip
\noindent
Given some elliptic curve domain parameters $T = (p, a, b, G, n, h)$, an elliptic curve key pair $\{\textcolor{red}{q}, \textcolor{green}{Q}\}$ associated with $T$ consists of an elliptic curve secret key $\textcolor{red}{q}$, which is an integer in $[1, n - 1]$, and an elliptic curve public key $\textcolor{green}{Q} = (x_Q, y_Q)$, which is the point $\textcolor{green}{Q} = \textcolor{red}{q}G$.
\\
The choice of the colours is intended to make clear what is secret and what can be made public.
\\
To detect transmission errors or to prevent the deliberate submit of an invalid key, it is desirable to validate the public key of the counterparties. This can be achieved following these steps:
\begin{enumerate}
	\item Check that $Q \neq \infty$;
	\item Check that $x_Q$ and $y_Q$ are integers in $[0, p - 1]$ and that $y_Q^2 = x_Q^3 + ax_Q + b \ (\text{mod} \ p)$;
	\item Check that $nQ = \infty$.
\end{enumerate}
Through this algorithm we are checking that $Q$ is effectively a point on the curve different from the point at infinity and that it belongs to the cyclic subgroups generated by $G$. Indeed, if the relation $Q = qG$ holds we have that $nQ = n(qG) = q(nG) = q\infty = \infty$. If this would not be the case, the third check would fail.

\bigskip

\subsection{Jacobian coordinates}
\label{jac}
We have already written that for EC over finite fields the same formulas previously seen hold, with the calculations done modulo $p$. What we have not dealt with is that this comes with a downside: in particular we have now to deal with modular inversion, an operation that, although can be done efficiently, is up to two orders of magnitude slower than field's multiplication.
\\
In the next chapter we will deal with digital signatures and we will see that ECDSA requires modular inversion. This traduces in poor performances when it comes to a system like Bitcoin in which signatures are (potentially) verified by each participant in the network to validate transactions. Therefore, it is sometimes advantageous to avoid modular inversion, either in the formulas for point addition or in the signature scheme. The first case can be solved through a change of coordinates: the approach consists in writing all the points as points in a projective space, the key idea being to defer the divisions by multiplying them into a denominator, represented then as a new coordinate, instead of performing every division immediately. Only at the very end we perform a single division to convert from projective coordinates back to affine coordinates.

\bigskip
\noindent
Jacobian coordinates are a modification of projective coordinates, typically used since they lead to a faster doubling procedure. In affine form, each elliptic curve point has two coordinates $(x, y)$. In projective form, each point will have three coordinates $(X : Y : Z)$, with the restriction that $Z$ is never zero for points different from the point at infinity\footnote{A projective point is denoted by $(X : Y : Z)$ since, in general, the two dimensional projective space \textbf{P}$_K^2$ over a field $K$ is given by equivalence classes of triples $(X, Y, Z)$, with $X, Y, Z \in K$ and at least one element different from zero. Here equivalence between $(X_1, Y_1, Z_1)$ and $(X_2, Y_2, Z_2)$ means that $\exists \lambda \in K \ | \ (X_1, Y_1, Z_1) = \lambda(X_2, Y_2, Z_2)$. Thus, the equivalence classes only depend on the ratios of $X$ to $Y$ to $Z$, from which the notation.}. The forward mapping is given by $(x, y) \mapsto (xz^2, yz^3, z)$, for any non zero $z$ (usually chosen to be 1 for convenience). The reverse mapping is given by $(X : Y : Z) \mapsto (X/Z^2, Y/Z^3)$, as long as $Z$ is non zero.
\\
The elliptic curve $y^2 = x^3 + ax + b$ becomes:
$$Y^2 = X^3 + aXZ^4 + bZ^6.$$
The point at infinity now has the coordinates $(1 : 1 : 0)$: indeed, substituting $Z = 0$ in the equation defining the curve we get $Y^2 = X^3$; then we simply normalize.
\\
Let $Q_i = (X_i : Y_i : Z_i), \ i = 1, 2$, be points on the elliptic curve $Y^2 = X^3 + aXZ^4 + bZ^6$. Then:
$$(X_3 : Y_3 : Z_3) = (X_1 : Y_1 : Z_1) + (X_2 : Y_2 : Z_2),$$
where $X_3,Y_3$ and $Z_3$ are computed as follows:
\begin{itemize}
	\item $Q_1 \neq \pm Q_2$: we have the affine test $x_1 = x_2$, that in jacobian coordinates correspond to the check $X_1/Z_1^2 = X_2/Z_2^2 \ \Longrightarrow \ X_1Z_2^2 = X_2Z_1^2$.
	\\
	We start again from the slope of the line passing through $Q_1$ and $Q_2$.
	$$m = \frac{y_2 - y_1}{x_2 - x_1} = \frac{Y_2/Z_2^3 - Y_1/Z_1^3}{X_2/Z_2^2 - X_1/Z_1^2} = \frac{Y_2/Z_2^3 - Y_1/Z_1^3}{X_2/Z_2^2 - X_1/Z_1^2} \cdot \frac{Z_1^3Z_2^3}{Z_1^3Z_2^3} =$$ $$= \frac{Y_2Z_1^3 - Y_1Z_2^3}{X_2Z_1^3Z_2 - X_1Z_1Z_2^3}.$$
	Defining $T = Y_1Z_2^3$, $U = Y_2Z_1^3$, $W = U - T$, $R = X_1Z_2^2$, $S = X_2Z_1^2$ and $V = S - R$ we can write:
	$$m = \frac{U - T}{SZ_1Z_2 - RZ_1Z_2} = \frac{W}{VZ_1Z_2}.$$
	Now consider:
	$$x_3 = m^2 - x_1 - x_2 = \frac{W^2}{V^2Z_1^2Z_2^2} - \frac{X_1}{Z_1^2} - \frac{X_2}{Z_2^2} = \frac{W^2}{V^2Z_1^2Z_2^2} - \frac{X_1}{Z_1^2}\cdot\frac{V^2Z_2^2}{V^2Z_2^2} - \frac{X_2}{Z_2^2}\cdot\frac{V^2Z_1^2}{V^2Z_1^2} = $$ $$= \frac{W^2 - V^2X_1Z_2^2 - V^2X_2Z_1^2}{V^2Z_1^2Z_2^2} = \frac{W^2 - V^2R - V^2S}{V^2Z_1^2Z_2^2} = \frac{W^2 - V^2(S + R)}{V^2Z_1^2Z_2^2} = $$ $$= \frac{W^2 - V^2(S - R + 2R)}{V^2Z_1^2Z_2^2} = \frac{W^2 - V^3 - 2RV^2}{V^2Z_1^2Z_2^2},$$
	$$y_3 = m(x_1 - x_3) - y_1 = \frac{W}{VZ_1Z_2}\left(\frac{X_1}{Z_1^2} - \frac{W^2 - V^3 - 2RV^2}{V^2Z_1^2Z_2^2}\right) - \frac{Y_1}{Z_1^3} = $$ $$= \frac{W}{VZ_1Z_2}\left(\frac{V^2X_1Z_2^2 - W^2 + V^3 + 2RV^2}{V^2Z_1^2Z_2^2}\right) - \frac{Y_1}{Z_1^3} = $$ $$= \frac{W(RV^2 - [W^2 - V^3 - 2RV^2]) - V^3Y_1Z_2^3}{V^3Z_1^3Z_2^3} = $$ $$\frac{W(RV^2 - [W^2 - V^3 - 2RV^2]) - TV^3}{V^3Z_1^3Z_2^3}.$$
	Thus, we can write:
	$$X_3 = W^2 - V^3 - 2RV^2, \ Y_3 = W(RV^2 - X_3) - TV^3, \ Z_3 = VZ_1Z_2,$$
	where
	$$T = Y_1Z_2^3, \ U = Y_2Z_1^3, \ R = X_1Z_2^2, \ S = X_2Z_1^2, \ V = S - R, \ W = U - T.$$
	\item $Q_1 = Q_2$:  now we have to check if $y = 0$. This is equivalent to check whether  $Y / Z^3 = 0 \ \Longrightarrow \ Y = 0$, since $Z \neq 0$.
	$$m = \frac{3x^2 + a}{2y} = \frac{3(X/Z^2)^2 + a}{2Y/Z^3} = \frac{3X^2/Z^4 + a}{2Y/Z^3} \cdot \frac{Z^4}{Z^4} = \frac{3X^2 + aZ^4}{2YZ} = \frac{W}{2YZ},$$
	if we define $W = 3X^2 + aZ^4$.
	$$x_3 = m^2 - 2x = \frac{W^2}{4Y^2Z^2} - 2\frac{X}{Z^2} = \frac{W^2 - 8XY^2}{4Y^2Z^2} = \frac{W^2 - 2V}{4Y^2Z^2},$$ once we define $V = 4XY^2$. Moreover:
	$$y_3 = m(x - x_3) - y = \frac{W}{2YZ}\left(\frac{X}{Z^2} - \frac{W^2 - 2V}{4Y^2Z^2}\right) - \frac{Y}{Z^3} = $$ $$= \frac{W(4XY^2 - [W^2 - 2V])}{8Y^3Z^3} - \frac{Y}{Z^3} = \frac{W(4XY^2 - [W^2 - 2V]) - 8Y^4}{8Y^3Z^3} =$$ $$= \frac{W(V - [W^2 - 2V]) - 8Y^4}{8Y^3Z^3}.$$
	Finally we can write:
	$$X_3 = W^2 - 2V, \ Y_3 = W(V - X_3) - 8Y^4, \ Z_3 = 2YZ,$$
	where
	$$W = 3X^2 + aZ^4, \ V = 4XY^2.$$
	\item Once again we can consider jointly the separate cases $Q_1 = Q_2 \wedge y = 0$ and $Q_1 = -Q_2$: indeed, by definition, we have $Q_1 + Q_2 = \infty$.
\end{itemize}
Looking at the formulas we can see that no inversion is involved in the calculations. Moreover, a further speed up is possible when doubling if we set $a = -3$\footnote{This is the reason why some standardized curves make this choice for the parameter $a$.}: we have $W = 3X^2 -3Z^4 = 3(X^2 - Z^4) = 3(X + Z^2)(X - Z^2)$, which can be computed via one squaring and one multiplication rather than via three squarings.

\bigskip
\noindent
We implemented this approach in the library that can be found at \url{https://github.com/dginst/BitcoinBlockchainTechnology} to improve the efficiency of the curve's operations. The speed up checks have been performed considering the curves secp192k1, secp192r1, secp224k1, secp224r1, secp256k1, secp256r1, secp384r1 and secp521r1 as described in \cite{RefWork:3}, resulting in a scalar multiplication that is from six to seven times faster in all the cases.

\bigskip

\subsection{The Bitcoin curve: secp256k1}
\label{btccurve}
Since this work is mainly focused on applications that can be deployed in Bitcoin, we would like to present the elliptic curve over a finite field used there. This could also suggest the shape of the curves used in practice.
\\
\\
The curve is named secp256k1: the naming is not casual, and its analysis could help a better understanding of the curve's properties. It begins with {\bf sec} to denote "Standards for Efficient Cryptography", the documentation from which it is taken; then it follows a {\bf p}, denoting the use of parameters over a prime field $\mathbb{F}_p$, in contrast with the so called binary fields $\mathbb{F}_{2^m}$, denoted by the letter {\bf t}; the {\bf p} is followed by a number, 256, denoting the length in bits of the field size $p$, that suggests the difficulty of solving the DL on the curve; then it comes a {\bf k} to denote parameters associated with a Koblitz curve\footnote{The name Koblitz curve used here refers to the definition given in \cite{RefWork:3}.}, to be distinguished from an {\bf r}, that would denote the use of verifiably random parameters; at last we find the sequence number {\bf 1}, meaning that this curve is the first, actually the unique, with all these characteristics.
\\
We have already discussed the benefits of using a random curve; however, secp256k1 was constructed in a special non random way to ensure efficient computations.
\\
Here follows the sextuple $T$ defining the secp256k1 curve:
\begin{itemize}
	\item The finite field $\mathbb{F}_p$ is defined by the pseudo-Mersenne prime number:
	$$p = \text{FFFFFFFF} \ \ \text{FFFFFFFF} \ \ \text{FFFFFFFF} \ \ \text{FFFFFFFF} \ \ \text{FFFFFFFF}$$
	$\text{FFFFFFFF} \ \text{FFFFFFFE} \ \text{FFFFFC2F} =$
	\\
	\\
	$= 2^{256} - 2^{32} - 2^9 - 2^8 - 2^7 - 2^6 - 2^4 - 1.$
	\item The defining equation $E$: $y^2 = x^3 + ax + b$ is determined by:
	$$a = \text{00000000} \ \ \text{00000000} \ \ \text{00000000} \ \ \text{00000000} \ \ \text{00000000} \ \ \text{00000000} \ \ \text{00000000}$$
	$ \text{00000000} =$
	\\
	\\
	$= 0;$
	$$b = \text{00000000} \ \ \text{00000000} \ \ \text{00000000} \ \ \text{00000000} \ \ \text{00000000} \ \ \text{00000000} \ \ \text{00000000}$$
	$ \text{00000007} =$
	\\
	\\
	$= 7.$
	\\
	\\
	Hence $E$:	$y^2 = x^3 + 7$.
	\item The point $G$ in compressed form is\footnote{The starting bytes 0x02 and 0x04 mean exactly that the first expression of $G$ is in compressed form, while the second one is uncompressed. For what concerns the compressed form we need to have informations about the $y$ coordinate. 0x02 is used when it is even, while 0x03 is used when it is odd: if $y$ is a square root in $\mathbb{F}_p$, we know that also $-y \ (\text{mod} \ p) = p - y$ is a square root. Since $p$ is an odd prime, we are sure that one of the roots is odd while the other is even.}:
	$$G = \text{02} \ \ \text{79BE667E} \ \ \text{F9DCBBAC} \ \ \text{55A06295} \ \ \text{CE870B07} \ \ \text{029BFCDB}$$
	$\text{2DCE28D9} \ \ \text{59F2815B} \ \ \text{16F81798},$
	\\
	\\
	and in uncompressed form:
	$$G = \text{04} \ \ \text{79BE667E} \ \ \text{F9DCBBAC} \ \ \text{55A06295} \ \ \text{CE870B07} \ \ \text{029BFCDB}$$
	$\text{2DCE28D9} \ \ \text{59F2815B} \ \ \text{16F81798} \ \ \text{483ADA77} \ \ \text{26A3C465} \ \ \text{5DA4FBFC}$
	\\
	\\
	$\text{0E1108A8} \ \ \text{FD17B448} \ \ \text{A6855419} \ \ \text{9C47D08F} \ \ \text{FB10D4B8}$.
	\item Finally, the order $n$ of $G$ and the cofactor are:
	$$n = \text{FFFFFFFF} \ \ \text{FFFFFFFF} \ \ \text{FFFFFFFF} \ \ \text{FFFFFFFE} \ \ \text{BAAEDCE6}$$
	$\text{AF48A03B} \ \ \text{BFD25E8C} \ \ \text{D0364141},$
	\\
	\\
	$h = \text{01}$.
\end{itemize}

\bigskip

\bigskip

\section{The discrete logarithm problem}
\label{dlp}
In this section we will deal more in depth with the obscure concept of Discrete Logarithm Problem (DLP).
\\
In general the DLP is defined over a group $\mathbb{G}$. For the moment write $\mathbb{G}$ in multiplicative notation and consider $x, y \in \mathbb{G}$ such that $y$ is in the cyclic subgroup generated by $x$. The DLP is the problem of determining an integer $k \geq 1$ such that $x^k = y$: this notation justifies the name, since it would mean to find $k = log_xy$.
\\
Typically, the cryptosystems whose security is based on ECC, depend on the difficulty of solving the DLP defined over the EC (ECDLP). One way of attacking the DLP is simple brute force: try all possible values of $k$ until one works. This is impractical when the answer $k$ is an integer of several hundred digits, which is a typical size used in cryptography (indeed this approach is fully exponential in the number of bits representing $k$\footnote{Assume for example to work with secp256k1, the Bitcoin curve. This means that $p \simeq 2^{256}$, and the same holds true for $n$. By brute force we try all possible values of $k$, that ranges from $1$ to $n-1$. Trying all possible $k$ would lead to a number of steps of the order $O(2^{256})$, exponential in the number of bits representing the order of the group.}). Therefore, better techniques are needed.
\\
More formally, the DLP can be defined as follows:
\begin{mydef}
	Let $\mathbb{G}$ be a cyclic group of order $n$ and let $g$ be a generator. An algorithm $\mathcal{A}$ is said to $(t, \epsilon)$-solve the DLP in $\mathbb{G}$ if on input a random $h \in \mathbb{G}$, it runs in time at most $t$ and returns $k \in \{0, ..., n - 1\}$ such that $h = g^k$ with probability at least $\epsilon$.
\end{mydef}
\noindent
The most general algorithms that works in any group has a time upper bound of $O(|\mathbb{G}|^{\frac{1}{2}})$, where with $|\mathbb{G}|$ we denote the cardinality of the set $\mathbb{G}$. But it turns out that the DLP is significantly easier in some groups than it is in others. In order of difficulty:
\begin{enumerate}
	\item The additive group of $\mathbb{F}_q$: the problem here can be stated as finding $k$ such that $kx = y$, i.e. we only need to find the inverse of $x$, and we have already stated that this can be done efficiently through the extended euclidean algorithm (in particular this requires $O(log_2(q))$ elementary operations, meaning that the problem can be solved in polynomial time);
	\item The multiplicative group $\mathbb{F}_q^{\times}$: the problem here is finding $k$ such that $x^k = y$. It can be shown that there exist some algorithms that work in sub-exponential time (the so called index calculus methods);
	\item Elliptic curves over finite fields: the fastest known procedure to solve the ECDLP on general curves are collision algorithms. Those algorithms are fully exponential: this explains the widespread adoption of ECC in recent years
\end{enumerate}
\noindent
The last point is linked to the primary benefit of ECC, that is a smaller key size: since the problem is harder, in order to have the same level of security we can rely on smaller keys, reducing storage and transmission requirements.

\bigskip
\noindent
The two most general algorithms are known as {\bf Baby Step, Gian Step Algorithm} and as the {\bf Pollard's $\rho$ Method} with its variants\footnote{For a detailed but still easily understandable presentation of the algorithms we refer to \cite{RefWork:4}.}: as explained above both runs in time $O(|\mathbb{G}|^{\frac{1}{2}})$, but the first is exponential also in the memory required to run, making it absolutely impractical. But let's focus on the run time of the algorithms on the Bitcoin's curve: assuming that the scalar multiplication requires constant time on the order of milliseconds, solving the ECDLP would require time proportional to $10^{-3} * 2^{128} \simeq 10^{35}$ seconds or around $10^{28}$ years. It is easy to see that even relying on optimizations, super computers or parallelization, nowadays it is computationally infeasible to solve the ECDLP.


\documentclass[11pt, a4paper]{article}

\usepackage{tikz}
\usetikzlibrary{arrows,automata, shapes, petri}
\usepackage{amsmath}

\begin{document}

\title{BACKPROPAGATION}
\date{}
\maketitle

Backpropagation is a computer algorithm used for supervised training of Artificial Neural Networks. It is based on two ideas - the Chain Rule of derivatives in Calculus and Dynamic Programming.

\section{Notation}

\begin{center}
	\begin{tikzpicture}[->,>=stealth',shorten >=1pt,auto,
		semithick]

		\node[state] (I1)                    {$\ \ a^1_1$};
		\node[state] (I2) [below of=I1, node distance=5em] {$\ \ a^1_2$};
		\node[state] (I3) [below of=I2, node distance=5em] {$\ \ a^1_3$};

		\node[state] (J1) [above right of=I1, node distance=8em]  {$z^2_1|a^2_1$};
		\node[state] (J2) [below of=J1, node distance=7em] {$z^2_2|a^2_2$};
		\node[state] (J3) [below of=J2, node distance=7em] {$z^2_3|a^2_3$};
		\node[state] (J4) [below of=J3, node distance=7em] {$z^2_4|a^2_4$};

		\node[state] (K1) [below right of=J1, node distance=10em]  {$z^3_1|a^3_1$};
		\node[state] (K2) [below of=K1, node distance=7em] {$z^3_2|a^3_2$};

		\node [rectangle, node distance=2cm] (I) [above of=I1] {1};
		\node [rectangle, node distance=2cm] (J) [above of=J1] {2};
		\node [rectangle, node distance=2cm] (K) [above of=K1] {3};

		\path (I2) edge  node {$w^2_{32}$} (J3);
		\path (J4) edge  node {$w^3_{24}$} (K2);

	\end{tikzpicture}
\end{center}

The layers are of the Neural Network are denoted by positive integers with input layer denoted by $1$, the first hidden layer by $2$ and so on till the output layer. The inputs in the input layer are denoted by $a^1_{i}$ as shown above. For all the other neurons in other layers, $z^l_i$ denotes the weighted sum of the neuron activations in the previous layer and $a^l_i$ denotes that neuron's activation. The weights are superscripted by the index of the layer of the neuron at the end, and subscripted first by the layer index of the end neuron and then by that of the start neuron.

\section{Forward Pass}

For any layer $l$ which is apart from the input layer, it can be written,

\begin{align*}
	z^l_i = \left( \sum_j w^l_{ij}a^{l-1}_j \right)  + b^l_i
\end{align*}

Taking examples from the figure,

\begin{align*}
	z^2_1 = (w^2_{11}a^1_1  + w^2_{12}a^1_2  +  w^2_{13}a^1_3) + b^2_1 \\
	z^2_2 = (w^2_{21}a^1_1  + w^2_{22}a^1_2  +  w^2_{23}a^1_3) + b^2_2 \\
	z^2_3 = (w^2_{31}a^1_1  + w^2_{32}a^1_2  +  w^2_{33}a^1_3) + b^2_3 \\
	z^2_4 = (w^2_{41}a^1_1  + w^2_{42}a^1_2  +  w^2_{43}a^1_3) + b^2_4
\end{align*}

These equations can be rewritten in matrix form as follows,

\begin{align*}
	\begin{pmatrix} z^2_1 \\ z^2_2 \\ z^2_3 \\z^2_4 \end{pmatrix} = \begin{pmatrix}  w^2_{11} & w^2_{12} & w^2_{13} \\ w^2_{21} & w^2_{22} & w^2_{23} \\ w^2_{31} & w^2_{32} & w^2_{33} \\w^2_{41} & w^2_{42} & w^2_{43}  \end{pmatrix} \begin{pmatrix} a^1_1 \\ a^1_2 \\ a^1_3 \\ \end{pmatrix} + \begin{pmatrix} b^2_1 \\ b^2_2 \\ b^2_3 \\b^2_4 \end{pmatrix}
\end{align*}

or

\begin{align*}
	\boldsymbol{Z}^2 = \boldsymbol{W}^2 \boldsymbol{A}^1 + \boldsymbol{B}^2
\end{align*}

Generalizing for all layers,

\begin{align}
	\boldsymbol{Z}^l = \boldsymbol{W}^l \boldsymbol{A}^{l-1} + \boldsymbol{B}^l
\end{align}

Activation function $\sigma$ is applied to $z^l_i$ to yield $a^l_i$.

\begin{align*}
	a^2_1 = \sigma(z^2_1) \\
	a^2_2 = \sigma(z^2_2) \\
	a^2_3 = \sigma(z^2_3) \\
	a^2_4 = \sigma(z^2_4) \\
\end{align*}

which can be written in matrix form as,

\begin{align*}
	\boldsymbol{Z}^2 = \sigma(\boldsymbol{A}^2)
\end{align*}

or more generally as,

\begin{align}
	\boldsymbol{Z}^l = \sigma(\boldsymbol{A}^l)
\end{align}

Given $\boldsymbol{A}^1$, any $\boldsymbol{Z}^l$ or $\boldsymbol{A}^l$ can be calculated using the two equations (1) and (2). This completes the analysis of the forward pass of backpropagation algorithm.

\section{Backward Pass}

Imagine a point in time where the weights and biases of a neural network are fixed. Now, one training example is taken and its inputs are fed into the neural network. Using the the forward pass equations, the neural network's output is computed. Usually, this output is different from the training example's expected output and thus the goal of backpropagation is to calucate the partial derivates of the cost function w.r.t. each weight and bias for them to be tweaked optimally.

\subsection{Cost Function}

The notion of the difference between the expected output of a training example and the actual output from neural network is formalized as follows,

\begin{align*}
	C & = \frac{1}{2} ||\boldsymbol{Y} - \boldsymbol{A}^L||^2 \\
	  & = \frac{1}{2}\sum_j (y_j - a^L_j)^2
\end{align*}

\subsection {Backpropagation}

\begin{align*}
	\frac{\partial C}{\partial z^L_j} & = (a^L_j - y_j) \frac{\partial a^L_j}{\partial z^L_j} \\
	                                  & = (a^L_j - y_j) \times \sigma^{'} (z^L_j)
\end{align*}

Denoting $\frac{\partial C}{\partial z^L_j}$ by $\delta^L_j$ and $(\delta^L_1, \delta^L_2, .. )^T$ by $\boldsymbol{\Delta^L}$, it can be written

\begin{align}
	\boldsymbol{\Delta^L} = (\boldsymbol{A^L} - \boldsymbol{Y}) \odot \sigma^{'}(\boldsymbol{Z^L})
\end{align}

where $\odot$ denotes element-wise matrix product.

Can $\boldsymbol{\Delta^L}$ somehow be related to $\boldsymbol{\Delta^{L-1}}$?

\begin{align*}
	\delta^{L-1}_j & = \frac{\partial C}{\partial z^{L-1}_j}                                                                                \\
	               & = \frac{\partial C}{\partial a^{L-1}_j} \frac{\partial a^{L-1}_j}{\partial z^{L-1}_j}                                                \\
	               & = \frac{\partial C}{\partial a^{L-1}_j} \times \sigma^{'}(z^{L-1}_j)                                                                 \\
	               & = \left( \sum_i \frac{\partial z^{L}_i}{\partial a^{L-1}_j} \frac{\partial C}{\partial z^{L}_i} \right) \times \sigma^{'}(z^{L-1}_j) \\
	               & = \left( \sum_i w^L_{ij} \delta^L_i \right) \times \sigma^{'}(z^{L-1}_j)                                                             \\
\end{align*}

For the above example, the equations become

\begin{align*}
	\begin{pmatrix} \delta^{L-1}_1 \\ \delta^{L-1}_2 \\ \delta^{L-1}_3 \\ \delta^{L-1}_4 \end{pmatrix} &= \begin{pmatrix}  w^L_{11} & w^L_{21} \\ w^L_{12} & w^L_{22} \\ w^L_{13} & w^L_{23} \\w^L_{14} & w^L_{24}  \end{pmatrix} \begin{pmatrix} \delta^L_1 \\ \delta^L_2 \end{pmatrix} \odot \begin{pmatrix} \sigma^{'}(z^{L-1}_1) \\ \sigma^{'}(z^{L-1}_2) \\ \sigma^{'}(z^{L-1}_3) \\ \sigma^{'}(z^{L-1}_4) \end{pmatrix} \\
	\boldsymbol{\Delta^{L-1}} &= \boldsymbol{W^L}^T \boldsymbol{\Delta^L} \odot \sigma^{'}(\boldsymbol{Z^{L-1}})
\end{align*}

The equation can be generalized to,

\begin{align}
	\boldsymbol{\Delta^{l}} & = \boldsymbol{W^{l+1}}^T \boldsymbol{\Delta^{l+1}} \odot \sigma^{'}(\boldsymbol{Z^{l}})
\end{align}

Using equation (3) and (4) $\boldsymbol{\Delta^{l}}$ can be calculated for any $l$.

\begin{align}
	\frac{\partial C}{\partial w^l_{jk}} & = \frac{\partial z^l_{j}}{\partial w^l_{jk}} \frac{\partial C}{\partial z^l_{j}}
	= a^{l-1}_k \delta^l_j \\
	\frac{\partial C}{\partial b^l_{j}}  & = \frac{\partial z^l_{j}}{\partial b^l_{j}} \frac{\partial C}{\partial z^l_{j}} = \delta^l_j
\end{align}

Hence, equations (3) and (4) ``propagate" the error backwards and then with help of equations (5) and (6), partial derivative of the error w.r.t. any neural network weight or bias can be calculated.

\section{Conclusion}

Backpropagation is famous because it can quickly calculate partial derivatives to optimally adjust the parameters of a neural network. In the description above, backpropagation calculates the derivatives w.r.t only one training example. In practice training examples are bunched into mini-batches and partials calculated for each example in a mini batch are averaged for network parameter adjustment.

\end{document}


\section{Class List}
Here are the classes, structs, unions and interfaces with brief descriptions\+:\begin{DoxyCompactList}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1add}{numpp\+::differentiation\+::symbolic\+::add$<$ Left, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1add}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1matrix_1_1sparse_1_1block}{numpp\+::matrix\+::sparse\+::block$<$ T, Rows, Columns $>$} \\*Block version of sparse matrix }{\pageref{classnumpp_1_1matrix_1_1sparse_1_1block}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1constant}{numpp\+::differentiation\+::symbolic\+::constant$<$ Value $>$} \\*Class representing constant integer number }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1constant}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1cosinus}{numpp\+::differentiation\+::symbolic\+::cosinus$<$ T $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1cosinus}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1matrix_1_1dense}{numpp\+::matrix\+::dense$<$ T, Rows, Columns $>$} }{\pageref{classnumpp_1_1matrix_1_1dense}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1differentiate}{numpp\+::differentiation\+::symbolic\+::differentiate$<$ Function, Order $>$} \\*Allows differentiation of N-\/th order }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1differentiate}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1differentiate_3_01Function_00_011_01_4}{numpp\+::differentiation\+::symbolic\+::differentiate$<$ Function, 1 $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1differentiate_3_01Function_00_011_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1divide}{numpp\+::differentiation\+::symbolic\+::divide$<$ Left, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1divide}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1exponential}{numpp\+::differentiation\+::symbolic\+::exponential$<$ T $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1exponential}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1automatic_1_1forward}{numpp\+::differentiation\+::automatic\+::forward$<$ T $>$} }{\pageref{classnumpp_1_1differentiation_1_1automatic_1_1forward}}{}
\item\contentsline{section}{\hyperlink{structnumpp_1_1matrix_1_1sparse_1_1impl_1_1inner__block}{numpp\+::matrix\+::sparse\+::impl\+::inner\+\_\+block$<$ T $>$} }{\pageref{structnumpp_1_1matrix_1_1sparse_1_1impl_1_1inner__block}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1logarithm}{numpp\+::differentiation\+::symbolic\+::logarithm$<$ T $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1logarithm}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1minus}{numpp\+::differentiation\+::symbolic\+::minus$<$ T $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1minus}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1multiply}{numpp\+::differentiation\+::symbolic\+::multiply$<$ Left, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1multiply}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1matrix_1_1sparse_1_1nested}{numpp\+::matrix\+::sparse\+::nested$<$ T, Rows, Columns $>$} \\*Block nested version of sparse matrix }{\pageref{classnumpp_1_1matrix_1_1sparse_1_1nested}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1power}{numpp\+::differentiation\+::symbolic\+::power$<$ Left, Exp $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1power}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ Left, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01add_3_01constant_3_0a2e8fcb21917ecf6b67a5c4cb33302f3}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ add$<$ constant$<$ left\+\_\+value $>$, Right $>$, constant$<$ right\+\_\+value $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01add_3_01constant_3_0a2e8fcb21917ecf6b67a5c4cb33302f3}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01add_3_01Left_00_01co9800d9c084c22272aa6400ee9a366a08}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ add$<$ Left, constant$<$ left\+\_\+value $>$ $>$, constant$<$ right\+\_\+value $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01add_3_01Left_00_01co9800d9c084c22272aa6400ee9a366a08}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_010_01_4_00_01constant_3_010_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ constant$<$ 0 $>$, constant$<$ 0 $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_010_01_4_00_01constant_3_010_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_010_01_4_00_01minus_3_01Right_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ constant$<$ 0 $>$, minus$<$ Right $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_010_01_4_00_01minus_3_01Right_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_010_01_4_00_01Right_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ constant$<$ 0 $>$, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_010_01_4_00_01Right_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_01left__vfa025c621c0342a297dcef4b571ae845}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ constant$<$ left\+\_\+value $>$, add$<$ constant$<$ right\+\_\+value $>$, Right $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_01left__vfa025c621c0342a297dcef4b571ae845}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_01left__v2b04d4fb76b2adc8e73af8cc3aa482e4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ constant$<$ left\+\_\+value $>$, add$<$ Left, constant$<$ right\+\_\+value $>$ $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01constant_3_01left__v2b04d4fb76b2adc8e73af8cc3aa482e4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01Left_00_01constant_3_010_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ Left, constant$<$ 0 $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01Left_00_01constant_3_010_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01Left_00_01minus_3_01Right_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ Left, minus$<$ Right $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01Left_00_01minus_3_01Right_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01minus_3_01Left_01_4_00_01constant_3_010_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ minus$<$ Left $>$, constant$<$ 0 $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01minus_3_01Left_01_4_00_01constant_3_010_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01minus_3_01Left_01_4_00_01Right_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+addition$<$ minus$<$ Left $>$, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__addition_3_01minus_3_01Left_01_4_00_01Right_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+division$<$ Upper, Lower $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01constant_3_010_01_4_00_01T_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+division$<$ constant$<$ 0 $>$, T $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01constant_3_010_01_4_00_01T_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01constant_3_011_01_4_b4d4ff9717ee8780cd1da6b85e108a8c}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+division$<$ constant$<$ 1 $>$, divide$<$ First, Second $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01constant_3_011_01_4_b4d4ff9717ee8780cd1da6b85e108a8c}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01First_00_01multiply_3_01First_00_01Second_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+division$<$ First, multiply$<$ First, Second $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01First_00_01multiply_3_01First_00_01Second_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01multiply_3_01First_009a599186e504c392075b7a47787417d}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+division$<$ multiply$<$ First, Second $>$, multiply$<$ Second, Third $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01multiply_3_01First_009a599186e504c392075b7a47787417d}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01multiply_3_01First_0c33d7e82a36da3303a0a365fc4a46997}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+division$<$ multiply$<$ First, Second $>$, Second $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01multiply_3_01First_0c33d7e82a36da3303a0a365fc4a46997}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01T_00_01constant_3_011_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+division$<$ T, constant$<$ 1 $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01T_00_01constant_3_011_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01T_00_01T_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+division$<$ T, T $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__division_3_01T_00_01T_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__minus}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+minus$<$ T $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__minus}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__minus_3_01minus_3_01constant_3_010_01_4_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+minus$<$ minus$<$ constant$<$ 0 $>$ $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__minus_3_01minus_3_01constant_3_010_01_4_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__minus_3_01minus_3_01subtract_3_01Left_00_01Right_01_4_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+minus$<$ minus$<$ subtract$<$ Left, Right $>$ $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__minus_3_01minus_3_01subtract_3_01Left_00_01Right_01_4_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__minus_3_01minus_3_01T_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+minus$<$ minus$<$ T $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__minus_3_01minus_3_01T_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+multiplication$<$ Left, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01constant_3_010_01_4_00_01Right_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+multiplication$<$ constant$<$ 0 $>$, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01constant_3_010_01_4_00_01Right_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01constant_3_011_01_4_00_01Right_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+multiplication$<$ constant$<$ 1 $>$, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01constant_3_011_01_4_00_01Right_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01constant_3_01ld8b2feb223452c4aaaf6eb83932601c0}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+multiplication$<$ constant$<$ left\+\_\+value $>$, multiply$<$ T, constant$<$ right\+\_\+value $>$ $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01constant_3_01ld8b2feb223452c4aaaf6eb83932601c0}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01First_00_01dive5d11c87e98ba09157b84506291511c8}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+multiplication$<$ First, divide$<$ constant$<$ 1 $>$, Second $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01First_00_01dive5d11c87e98ba09157b84506291511c8}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01Left_00_01constant_3_010_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+multiplication$<$ Left, constant$<$ 0 $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01Left_00_01constant_3_010_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01Left_00_01constant_3_011_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+multiplication$<$ Left, constant$<$ 1 $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01Left_00_01constant_3_011_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01minus_3_01Firsc21300ab659abf99cc3eaf6c7230201c}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+multiplication$<$ minus$<$ First $>$, minus$<$ Second $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01minus_3_01Firsc21300ab659abf99cc3eaf6c7230201c}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01multiply_3_01Te3834a073b1fa2b6ff55d54d5efcdc27}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+multiplication$<$ multiply$<$ T, constant$<$ left\+\_\+value $>$ $>$, constant$<$ right\+\_\+value $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__multiplication_3_01multiply_3_01Te3834a073b1fa2b6ff55d54d5efcdc27}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__subtraction}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+subtraction$<$ Left, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__subtraction}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__subtraction_3_01Left_00_01minus_3_01Right_01_4_01_4}{numpp\+::differentiation\+::symbolic\+::impl\+::simplify\+\_\+subtraction$<$ Left, minus$<$ Right $>$ $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1impl_1_1simplify__subtraction_3_01Left_00_01minus_3_01Right_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1sinus}{numpp\+::differentiation\+::symbolic\+::sinus$<$ T $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1sinus}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1subtract}{numpp\+::differentiation\+::symbolic\+::subtract$<$ Left, Right $>$} }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1subtract}}{}
\item\contentsline{section}{\hyperlink{classtuple__element}{tuple\+\_\+element} \\*Tuple\+\_\+element specialization for \hyperlink{classnumpp_1_1vector}{numpp\+::vector} }{\pageref{classtuple__element}}{}
\item\contentsline{section}{\hyperlink{classtuple__element}{tuple\+\_\+element} \\*Tuple\+\_\+element specialization for \hyperlink{classnumpp_1_1matrix_1_1dense}{numpp\+::matrix\+::dense} }{\pageref{classtuple__element}}{}
\item\contentsline{section}{\hyperlink{classstd_1_1tuple__element_3_01Index_00_01numpp_1_1matrix_1_1dense_3_01T_00_01Rows_00_01Columns_01_4_01_4}{std\+::tuple\+\_\+element$<$ Index, numpp\+::matrix\+::dense$<$ T, Rows, Columns $>$ $>$} }{\pageref{classstd_1_1tuple__element_3_01Index_00_01numpp_1_1matrix_1_1dense_3_01T_00_01Rows_00_01Columns_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classstd_1_1tuple__element_3_01Index_00_01numpp_1_1vector_3_01T_00_01Size_00_01Transposition_01_4_01_4}{std\+::tuple\+\_\+element$<$ Index, numpp\+::vector$<$ T, Size, Transposition $>$ $>$} }{\pageref{classstd_1_1tuple__element_3_01Index_00_01numpp_1_1vector_3_01T_00_01Size_00_01Transposition_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classtuple__size}{tuple\+\_\+size} \\*Tuple\+\_\+size specialization for \hyperlink{classnumpp_1_1matrix_1_1dense}{numpp\+::matrix\+::dense} }{\pageref{classtuple__size}}{}
\item\contentsline{section}{\hyperlink{classtuple__size}{tuple\+\_\+size} \\*Tuple\+\_\+size specialization for \hyperlink{classnumpp_1_1vector}{numpp\+::vector} }{\pageref{classtuple__size}}{}
\item\contentsline{section}{\hyperlink{classstd_1_1tuple__size_3_01numpp_1_1matrix_1_1dense_3_01T_00_01Rows_00_01Columns_01_4_01_4}{std\+::tuple\+\_\+size$<$ numpp\+::matrix\+::dense$<$ T, Rows, Columns $>$ $>$} }{\pageref{classstd_1_1tuple__size_3_01numpp_1_1matrix_1_1dense_3_01T_00_01Rows_00_01Columns_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classstd_1_1tuple__size_3_01numpp_1_1vector_3_01T_00_01Size_00_01Tranposition_01_4_01_4}{std\+::tuple\+\_\+size$<$ numpp\+::vector$<$ T, Size, Tranposition $>$ $>$} }{\pageref{classstd_1_1tuple__size_3_01numpp_1_1vector_3_01T_00_01Size_00_01Tranposition_01_4_01_4}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1differentiation_1_1symbolic_1_1variable}{numpp\+::differentiation\+::symbolic\+::variable$<$ T, Number $>$} \\*Class representing variable of any type }{\pageref{classnumpp_1_1differentiation_1_1symbolic_1_1variable}}{}
\item\contentsline{section}{\hyperlink{classnumpp_1_1vector}{numpp\+::vector$<$ T, Size, Transposition $>$} }{\pageref{classnumpp_1_1vector}}{}
\end{DoxyCompactList}


\chapter{Uncountable Sets}

In the previous chapter we proved that many sets are countable; moreover, we
proved that standard operations such as union, intersection, and product of
countable sets is also countable. This chapter shows that we know at least one
uncountable set. Moreover, this chapter gives tools to compare cardinalities of
sets.

\section{Cardinality of Reals}
\begin{theorem}[Cantor]
\label{theorem:reals-are-uncountable}
  The set of real number $\R$ is uncountable.
\end{theorem}

To prove this theorem we need the following two lemmas.
\begin{lemma}
\label{lemma:segment-is-uncountable}
  The set $\set[0 < x < 1]{x \in \R}$ of real numbers between $0$ and $1$ is
  uncountable.
\end{lemma}

\begin{lemma}
\label{lemma:segment-equipotent-to-reals}
  The set $\R$ is equipotent to $\set[0 < x < 1]{x \in \R}$.
\end{lemma}

\begin{proof}[Proof of \Cref{theorem:reals-are-uncountable}]
  Assume that $\R$ is denumerable. Then by
  \Cref{remark:denumerable-equipotent-to-denumerable,lemma:segment-equipotent-to-reals},
  $\set[0 \le x \le 1]{x \in \R}$ is also denumerable, which contradicts
  \Cref{lemma:segment-is-uncountable}.
\end{proof}

To complete the proof of \Cref{theorem:reals-are-uncountable} we need to prove
these two lemmas.
\begin{proof}[Proof of \Cref{lemma:segment-is-uncountable}]
  Assume $\set[0 < x < 1]{x \in \R}$ is countable; this implies that
  $S = \set[0 \le x \le 1]{x \in \R}$ is also countable.

  Note that each number $x \in S$ can be represented as an infinite decimal
  \[
    x = 0.a_1 a_2 a_3 \dots
  \]
  where $0 \le a_i \le 9$ for all $i \in \N$ (the number $1$ can be represented
  as $0.\dot{9}$).

  Let $f : \N \to S$ be a bijection, and let $f(n) = .a_{n, 1} a_{n, 2} \dots$.
  Consider the sequence $b_1$, $b_2$, \dots such that
  \[
    b_i =
    \begin{cases}
      0 & \text{if } a_{i, i} \neq 0 \\
      1 & \text{otherwise}
    \end{cases}.
  \]
  Let $y = 0.b_1 b_2 \dots$ and let $m \in \N$ be an integer such that $f(m) =
  y$. Note that
  \[
    .a_{m, 1} a_{m, 2} \dots = f(m) =  0.b_1 b_2 \dots
  \]
  However, $a_{m, m} \neq b_m$ which is a contradiction.
\end{proof}

\begin{proof}[Proof of \Cref{lemma:segment-equipotent-to-reals}]
  To prove this lemma we start from proving that $\R$ is equipotent to
  $\set[-\pi / 2 < x < \pi / 2]{x \in \R}$; indeed, we may consider the tangent
  function which is a bijection between these two sets.

  The next step is to note that the sets $\set[-\pi / 2 < x < \pi / 2]{x \in \R}$ and
  $\set[0 < x < 1]{x \in \R}$ are also equipotent. Consider the function
  $f : \set[0 < x < 1]{x \in \R} \to \set[-\pi / 2 < x < \pi / 2]{x \in \R}$
  such that $f(x) = \pi (x - 1 / 2)$. It is clear that $f$ is a bijection, which
  finishes the proof.
\end{proof}

\begin{exercise}
  Show that $(\set[0 < x < 1]{x \in \R})^2$ and $\set[0 < x < 1]{x \in \R}$ are equipotent.
\end{exercise}

\section{Inequalities Between Cardinalities}
Since $\N \subseteq \R$ the statement that $\R$ is uncountable can be
interpreted as `the set of reals is larger than the set of integers (or the set
of rationals)'. The following definition allows to make this reformulation
precise.
\begin{definition}
  Let $X$ and $Y$ be two sets.
  \begin{itemize}
    \item We say that $X$ and $Y$ have the same cardinality if they are
      equipotent; i.e., if $\cardinality{X} = \cardinality{Y}$.
    \item We write that $\cardinality{X} \ge \cardinality{Y}$ and say that the
      cardinality of $X$ is at most the cardinality of $Y$ if there is an
      injection from $X$ to $Y$.
    \item We also write $\cardinality{X} < \cardinality{Y}$ and say that the
      cardinality of $X$ is less than the cardinality of $Y$ if
      $\cardinality{X} \neq \cardinality{Y}$ and $\cardinality{X} \le
      \cardinality{Y}$.
  \end{itemize}
\end{definition}
Cantor's theorem says that $\cardinality{\R} > \cardinality{\N}$ or
$\cardinality{\R} > \aleph_0$.\footnote{%
  A quesiotn that immidiately come in mind after lookin at this reformulation is
  whether exists something in between; i.e., whether exists a set $S$ such that
  $\aleph_0 < \cardinality{S} < \cardinality{\R}$. The hypothesis that such a
  set exists is called \emph{the continuum hypothesis}. In 1963, Paul Cohen
  proved that it is not possible to prove or disprove thus hypothesis starting
  from axioms of the set theory.
}

Moreover, Cantor proved that there are even bigger sets
\begin{theorem}
  For any set $X$, $\cardinality{\subsets{X}} > \cardinality{X}$.
\end{theorem}
\begin{proof}
  The idea of this proof is simialr to the proof of Cantor's theorem
  (\Cref{theorem:reals-are-uncountable}).

  Firs of all we may notice that $\cardinality{\subsets{X}} \ge \cardinality{X}$
  since $f : X \to \subsets{X}$ such that $f(x) = \set{x}$ is an injection.

  It is also clear that the set $\subsets{X}$ is equipotent to the set
  $\functions{X}{\set{0, 1}}$ (this can be proven similarly to
  \Cref{corollary:power-set-and-set-of-binary-strings}).

  Let us now prove that $\cardinality{\functions{X}{\set{0, 1}}} \neq
  \cardinality{X}$. Assume this is not true and
  there is a bijection $F : X \to \functions{X}{\set{0, 1}}$. Let $f_x = F(x)$.
  Consider $g : X \to \set{0, 1}$ such that
  \[
    g(x) =
    \begin{cases}
      0 & \text{if } f_x(x) = 1 \\
      1 & \text{if } f_x(x) = 0 \\
    \end{cases}
  \]
  (note that for any $x$, $g(x) \neq f_x(x)$). It is clear that
  $g \in \functions{X}{\set{0, 1}}$; however, if $g = F(y) = f_y$, then $g(y) =
  f_y(y) \neq f_y(y)$, which is a contradiction. Therefore $F$ is not a bijection.
\end{proof}

We devoted the whole chapter to the pigeonhole principle, unsurprisengly one may
prove a similar theorem for infinite sets.\footnote{%
  This theorem is often called Schr\"{o}der--Bernstein theorem since Schr\"{o}der
  and Bernstein published independently proofs of this theorem in 1898. Cantor
  is often added because he first stated the result in 1887, while
  Schr\"{o}der's name is often omitted because his proof turned out to be
  flawed. Howerver, the name of Dedekind, who first proved it is not mentioned
  at all.
}
\begin{theorem}[Schr\"{o}der--Bernstein]
  Let $X$ and $Y$ be two nonempty sets such that $\cardinality{X} >
  \cardinality{Y}$. Then any function $f : X \to Y$ is not an injection; i.e.,
  there are $x_1, x_2 \in X$ such that $f(x_1) = f(x_2)$.
\end{theorem}

We are not going to prove this theorem; however, let us formulate a very
important corollary of this theorem.
\begin{corollary}
\label{corollary:schroder-bernstein}
  Let $X$ and $Y$ be two nonempty sets. If $\cardinality{X} \le \cardinality{Y}$
  and $\cardinality{Y} \ge \cardinality{X}$, then $\cardinality{X} =
  \cardinality{Y}$.
\end{corollary}

Using this theorem we may prove that
\[
  \cardinality{\set[x, y \in \R, x^2 + y^2 = 1]{(x, y)}} =
  \cardinality{\set[-1 \le x \le 1]{x \in \R}}.
\]
First of all note that
\[
  \set[x, y \in \R, x^2 + y^2 = 1]{(x, y)}
  \subseteq \set[-1 \le x \le 1]{x \in \R};
\]
hence
\[
  \cardinality{\set[x, y \in \R, x^2 + y^2 = 1]{(x, y)}} \le
  \cardinality{\set[-1 \le x \le 1]{x \in \R}}.
\]
In addition, one may prove using scaling and shift that
\[
  \cardinality{\set[-1 \le x \le 1]{x \in \R}} =
  \cardinality{\set[-\frac{1}{\sqrt{2}} \le x \le \frac{1}{\sqrt{2}}]{x \in \R}}.
\]
Finally,
\[
  \set[-\frac{1}{\sqrt{2}} \le x \le \frac{1}{\sqrt{2}}]{x \in \R}
  \subseteq
  \set[x, y \in \R, x^2 + y^2 = 1]{(x, y)}
\]
hence
\[
  \cardinality{
    \set[-\frac{1}{\sqrt{2}} \le x \le \frac{1}{\sqrt{2}}]{x \in \R}
  }
  \le
  \cardinality{
    \set[x, y \in \R, x^2 + y^2 = 1]{(x, y)}
  }.
\]
Combining all this together we can obtain that
\begin{gather*}
  \cardinality{
    \set[x, y \in \R, x^2 + y^2 = 1]{(x, y)}
  } \le
  \cardinality{\set[-1 \le x \le 1]{x \in \R}} \\
  \text{and}\\
  \cardinality{\set[-1 \le x \le 1]{x \in \R}} \le
  \cardinality{
    \set[x, y \in \R, x^2 + y^2 = 1]{(x, y)}
  }.
\end{gather*}
Hence, using the Schr\"{o}der–Bernstein theorem we can prove the equality.

\begin{chapterendexercises}
    \exercise[recommended] Prove that $\cardinality{\functions{X}{\set{0, 1}}} =
      \cardinality{2^X}$ for any set $X$.
    \exercise[recommended] Prove \Cref{corollary:schroder-bernstein}
    \exercise Show that $\functions{\N}{\set{0, 1}}$ is equipotent to
      $\functions{\N}{\set{0, 1, 2}}$.
      \begin{solution}
        We are going to prove it using Cantor-Bernstein theorem.
        Hence, the proof consists of two parts.
        \begin{enumerate}
          \item In the first part we prove that
            $\cardinality{\functions{\N}{\set{0, 1}}} \le
            \cardinality{\functions{\N}{\set{0, 1, 2}}}$. To prove this we need to show that
            there is an injection from $\functions{\N}{\set{0, 1}}$ to
            $\functions{\N}{\set{0, 1, 2}}$ and it is clear that
            $F :  \functions{\N}{\set{0, 1}} \to \functions{\N}{\set{0, 1, 2}}$
            such that $F(f) = f$ is an injection.
          \item In the second part we prove that
            $\cardinality{\functions{\N}{\set{0, 1, 2}}} \le
            \cardinality{\functions{\N}{\set{0, 1}}}$.
            To prove this we need to show that there is an
            injection from $\functions{\N}{\set{0, 1, 2}}$ to $\functions{\N}{\set{0, 1}}$.
            Let us consider
            $G : \functions{\N}{\set{0, 1, 2}} \to \functions{\N}{\set{0, 1}}$
            such that $G(f) = f'$, where
            \begin{gather*}
              h'(2n - 1) =
              \begin{cases}
                0 & \text{ if } h(n) \neq 2 \\
                1 & \text{otherwise}
              \end{cases} \\
              \text{and} \\
              h'(2n) =
              \begin{cases}
                0 & \text{ if } h(n) \neq 1 \\
                1 & \text{otherwise}.
              \end{cases}
            \end{gather*}
            We need to prove that this is an injection. Assume the opposite
            i.e. that $G(h_1) = G(h_2)$ but $h_1 \neq h_2$.
            There is $n$ such that $h_1(n) \neq h_2(n)$ since $h_1 \neq h_2$.
            Without loss of generality, it is enough to consider the following
            cases.
            \begin{itemize}
              \item If $h_1(n) = 0$ and $h_2(n) = 1$, then $G(h_1)(2n) = 0$
                and $G(h_2)(2n) = 1$ which is a contradiction.
              \item If $h_1(n) = 0$ and $h_2(n) = 2$, then
                $G(h_1)(2n - 1) = 0$ and $\mathcal{G}(h_2)(2n - 1) = 1$ which
                is a contradiction.
              \item If $h_1(n) = 1$ and $h_2(n) = 2$, then $G(h_1)(2n - 1) =
              0$ and $G(h_2)(2n - 1) = 1$ which is a contradiction.
            \end{itemize}
        \end{enumerate}
      \end{solution}
    \exercise Show that if a set $A \subseteq \R^2$ contains a line, then $A$
      and $\R$ are equipotent.
\end{chapterendexercises}


\section{Group Actions}
\begin{definition}
    Let $(G,\cdot,e)$ be a group and $S$ be a set.
    The action of $G$ on $S$ is a function $\star:G\times S\to S$ satisfying\\
    A1. $\forall x\in S,e\star x=x$.\\
    A2. $\forall g_1,g_2\in G, \forall x\in S, (g_1\cdot g_2)\star x=g_1\star(g_2\star x)$.
\end{definition}
\begin{example}
    1. $\forall g\in G, x\in S, g\star x=x$ always defines a group action.\\
    2. A group $G$ acts on the set $S=G$ by left multiplication.
    That is, via $g\star g'=g\cdot g'$.
    This is called the \textit{left regular action}.\\
    3. Consider $\operatorname{Sym}S$, it acts on $S$ by applying the permutation.\\
    4. The symmetries of a solid $X$ acts on the set of points of $X$ (or a special subset like the set of vertices).
    Note that the dihedral group $D_{2n}$ acts on an $n$-gon in this way.
\end{example}
\begin{definition}
    The orbit of $x\in S$ is the set
    $$G\star x=\{y\in X:\exists g\in G,y=g\star x\}$$
    If this set is equal to $X$, then this action is called transitive.
    The stabiliser of $x\in S$ is the set
    $$G_x=\{g\in G:g\star x=x\}$$
    The kernel is defined as
    $$\{g\in G:\forall x\in S,g\star x=x\}=\bigcap_{x\in S}G_x$$
    An action is faithful if its kernel is $\{e\}$.
\end{definition}
\begin{theorem}
    An action is the same as a homomorphism $\rho:G\to\operatorname{Sym}S$.
\end{theorem}
\begin{proof}
    The function $t_g:x\mapsto g\star x$ is a permutation of $X$ for any $g\in G$.
    Indeed, we can find an inverse of it which is exactly $t_{g^{-1}}$.
    Now we shall show that the map $\rho:g\mapsto t_g$ is an homomorphism.
    We can evaluate $\rho(gh)=t_{gh}$, but $t_{gh}(x)=(gh)\star x=g\star(h\star x)=t_g\circ t_h(x)$, therefore
    $$\rho(gh)=t_g\circ t_h=\rho(g)\rho(h)$$
    Conversely, let $\rho$ be an homomorphism, then consider the function $\star$ defined by $g\star x=(\rho(g))(x)$ is an action.
\end{proof}
Note that the same actions are corrsponded to the same homomorphism.
\begin{theorem}[Cayley's Theorem]
    Any group is isomorphic to a subgroup of some symmetric group.
\end{theorem}
\begin{proof}
    Consider the left regular action of the group $G$ on the set $G$.
    There is then a homomorphism $\rho:G\to \operatorname{Sym}G$.
    Now this action is faithful.
    Indeed, $\rho(g)=e\iff\forall x\in G, gx=x\iff g=e$ (Or simply we can write $g=ge=e$).\\
    Therefore this homomorphism is injective, hence $G\cong\operatorname{Im}\rho\le\operatorname{Sym}G$.
\end{proof}
We now want to dive deeper into orbits and stabiliser.
Let $G$ act on $X$.
\begin{theorem}
    For each $x\in X$, $G_x\le G$, and the collection of all orbits $G\star x$ for every $x\in X$ partitions $X$.
\end{theorem}
\begin{proof}
    Note that $e\in G_x$ for each $x$ so $G_x$ is nonempty.
    If $a,b\in G_x$, then $x=e\star x=(b^{-1}b)\star x=b^{-1}\star (b\star x)=b^{-1}\star x\implies b^{-1}\in G_x$.
    Therefore $(ab^{-1})\star x=a\star(b^{-1}\star x)=a\star x=x\implies ab^{-1}\in G_x$, so $G_x\le G$.\\
    Now the union of orbits contains each $x\in X$ since $x\in G\star x$.
    Now if $G\star x\cap G\star y\neq\varnothing$, there is some $g,h\in G$ such that $g\star x=h\star y$.
    Therefore for any $z\in G\star x$, then $z=k\star x$ for some $k\in G$, then $z=k\star((g^{-1})\star(h\star y))=(kg^{-1}h)\star y\implies z\in G\star y$.
    So $G\star x\subseteq G\star y$ and $G\star y\subseteq G\star x$, so $G\star x=G\star y$.
    Hence the orbits form a parition of $X$.
\end{proof}
What we have discussed so far is called the left action.
The right action $\diamond:X\times G\to X$ is defined analogously.
So $x\diamond e=x$ and $(x\diamond g)\diamond h=x\diamond (gh)$.
\begin{proposition}
    If $\diamond$ is a right action, then we can define a left action $\star$ by $g\star x=x\diamond g^{-1}$.
    We can also have the other way around.
\end{proposition}
\begin{proof}
    Trivial.
\end{proof}
So we can only use left actions during the scope of our study.
\begin{definition}
    If $G$ has a left action on $X$, the set of orbits is called $G\backslash X=\{G\star x:x\in X\}$.
    If $G$ has a right action on $X$, the set of orbits is called $X/G=\{x\diamond G:x\in X\}$
\end{definition}
\begin{example}
    The dihedral group $D_{2n}$ acts on the regular $n$-gon $X$ in the obvious way.\\
    The orbit of a vertex is then all vertices.
    The stabiliser of a vertex is the identity and the reflection across the axis which is the diagonal through the vertex.
    Note here that the size of the orbit times the size of stabiliser is the size of the dihedral group.\\
    Now consider a point in the interior of a side of the square.
    Then the orbit of this point would consist of $8$ points, and nothing stabilises it, so we also get that the product of the sizes of the orbit and the stabiliser is $8$, the size of the dihedral group.\\
    Let us now look at the symmetries of the tetrahedron with vertices $1,2,3,4$.
    Suppose the rotation across midpoints of opposite sides be $S$ and the rotation across the central axis through a vertex $R$.\\
    Let $V$ be the set of vertices and let this group act on it.
    Then it is obvious that this action is transitive, and the stabiliser of a vertex are the rotations with respect to the axis through that vertex.\\
    So again the sizes of the orbit and stabiliser give a product of $12$, the size of the group.\\
    Now we act on the set of edges $E$.
    Pick one of the edge $X$, then the action of the group on it is yet again transitive, and the stabilisers are the identity and the rotation $R$ on the midpoint of $E$ and its opposite edge.
    Again they give a product of $6\times 2=12$, the size of the group.
\end{example}
The preceding observation triggers the following theorem.
\begin{theorem}[Orbit-Stabiliser Theorem on finite groups]\label{ost_finite}
    $|G_x||G\star x|=|G|$
\end{theorem}
To prove it, we need some preparation.
\begin{proposition}
    If $H\le G$, the left regular action of $H$ on $G$ is the left multiplication of element in $H$ on $G$, i.e. $h\star g=hg$.
    The right regular action then is $g\diamond h=gh$
\end{proposition}
\begin{definition}
    A left coset of $H$ in $G$ is an orbit of the right regular action.
    Write $G/H$ to denote the collection of these cosets.\\
    We can define the right coset the other way around which are collected as $H\backslash G$.
\end{definition}
So each left coset is in the form $gH=\{gh:h\in H\}$, and the right coset in the form $Hg=\{hg:h\in H\}$.
Note that it is not always true that a left coset is equal to the right coset.\\
Also $G/H=\{S\subseteq G:\exists g\in G,S=gH\}$ and we can find $H\backslash G$ similarly.
\footnote{Some authors use $G:H$ for the collection of left cosets.}\\
Note that $gH=g'H\iff g'^{-1}g\in H$, and for right cosets $Hg=Hg'\iff g'g^{-1}\in H$ but again these two conditions may or may not be equivalent.
\begin{example}
    The (left and right) cosets of $2\mathbb Z$ are $2\mathbb Z$ and $2\mathbb Z+1=1+2\mathbb Z$.\\
    The (left and right) cosets of $n\mathbb Z$ are $k+n\mathbb Z, k\in\{0,1,\ldots n-1\}$.\\
    Consider $D_6$, $R=\{e,r,r^2\}, S=\{e,s\}$ are subgroups.
    The (left and right) coset of $R$ are $R$ and $sR=Rs$
    And the left cosets of $S$ are $S$, $rS$ and $r^2S$ and the right ones are $S$, $Sr$, $Sr^2$, but in this case the left and right cosets are not equal.
\end{example}
\begin{theorem}
    If $H\subset G$ and $g\in G$, then there is a bijection $H\to gH$.
\end{theorem}
\begin{proof}
    $h\mapsto gh$ is the bijection.
\end{proof}
\begin{corollary}[Lagrange's Theorem]\label{lagrange}
    If $G$ is finite and $H\le G$, then we have $|H||G/H|=G$.
    In particular $|H|$ divides $|G|$.
\end{corollary}
\begin{proof}
    The cosets are orbits thus parition $G$ and they are of the same cardinality due to the preceding theorem.
\end{proof}
We can repeat the same argument to see that the same also applies to right cosets.
\begin{definition}
    Let $G$ be a group, and $H\le G$, then the index of $H$ is the order of $G/H$ given that it is finite, otherwise we say the index is infinite.
\end{definition}
Equivalently, the index is $|G|/|H|$ (given that $H$ is finite).
\begin{corollary}
    If $G$ is finite and $g\in G$, then $g^{|G|}=e$, that is, $\operatorname{ord}g||G|$.
\end{corollary}
\begin{proof}
    Consider the subgroup $\langle g\rangle\le G$.
\end{proof}
\begin{corollary}
    If $G$ is finite $|G|$ is prime, then $G\cong C_p$ and it is generated by any identity element.
\end{corollary}
\begin{proof}
    $G$ contains some non-identity element since $|G|=p>1$.
    Choose any $g\in G$ such that $g\neq e$.
    Then $1<\operatorname{ord}g||G|=p$, so since $p$ is prime, then $\operatorname{ord}g=p$.
    Thus since $\langle g\rangle\le G$ and they are both finite and of the same order, $C_p\cong \langle g\rangle=G$.
\end{proof}
There is a corollary of this in number theory.
We consider the collection of all (equivalent classes) of integers $k\in\mathbb Z_n$ such that $(k,n)=1$.
Since $(k,n)=1$, $k$ is invertible in $\mathbb Z_n$ for any such $k$ in the collection.
Conversely, if $k$ cannot be invertible in $\mathbb Z_n$ if $(k,n)\neq 1$.\\
So this collection is a group $\mathbb Z_n^{\times}$ under multiplication modulo $n$.
Also, this group has order $\phi(n)$ which is the number of positive integers less than $n$ that are coprime to it.
\begin{corollary}[Fermat-Euler Theorem]
    If $(k,n)=1$, then
    $$k^{\phi(n)}\equiv 1\pmod{n}$$
\end{corollary}
\begin{proof}
    Apply the preceding corollary to $\mathbb Z_n^\times$.
\end{proof}
After these warm-ups, we shall prove the Orbit-Stabiliser Theorem (in a stronger form).
\begin{theorem}[Orbit-Stabiliser Theorem]
    Suppose a group $G$ acts on a set $X$ and $x\in X$, then there is a bijection $G/G_x\to G\star x$ by $\phi:gG_x\mapsto g\star x$.
\end{theorem}
\begin{proof}
    To see $\phi$ is well defined, observe that $\forall h\in G_x, g\star x=g\star (h\star x)=(gh)\star x$.
    It is obviously surjective by the definition of orbit.
    It is injective since if $\phi(gH)=\phi(g'H)$, then $(g^{-1}g')\star x=x\implies g^{-1}g'\in H\implies gH=g'H$.
\end{proof}
\begin{corollary}
    Theorem \ref{ost_finite}.
\end{corollary}
\begin{proof}
    Due to the existence of this bijection, if $G$ is finite, then $|G|/|G_x|=|G/G_x|=|G\star x|\implies |G\star x||G_x|=|G|$.
\end{proof}
One of the most important application of this theorem is to work out the order of some finite group.
\begin{example}
    We look at the rotational symmetries of a cube.
    Collect the symmetries as the group $G$ and consider its action on the eight vertices $X$.
    Now this action is transitive, obviously, so fixing any $x\in X$, $|G\star x|=8$.
    Also, any member of the stabiliser of $x$ must be rotations though the axis through $x$ and the centre of the centre of the group since it fixes that.
    There are three rotations of this form, so $|G|=|G_x||G\star x|=24$.
\end{example}
\begin{theorem}[Cauchy's Theorem]\label{cauchy}
    Let $G$ be a finite group and suppose $p$ is a prime dividing its order, then $G$ contains an element of order $p$.
\end{theorem}
\begin{proof}
    Consider a subset $X\subseteq G^p$ defined by $X=\{(g_1,g_2,\ldots, g_p)\in G^p:g_1g_2\cdots g_p=e\}$.
    Since $|G^p|=|G|^p$, and $|X|=|G|^{p-1}$.
    Let $H=C_p=\langle\xi\rangle$, consider the action of $H$ on $X$ by
    $$\xi\star (g_1,g_2,\ldots,g_p)=(g_2,g_3,\ldots,g_p,g_1)$$
    This is an action, indeed, if $g_1g_2\cdots g_p=e$, then $g_2g_3\cdots g_pg_1=g_1^{-1}eg_1=e$.
    For any element $x\in X$, by Theorem \ref{ost_finite}, $p=|H|=|H_x||H\star x|$.
    But $p$ is prime, so every orbit has to have either size $1$ or size $p$, also the ordrs of the orbits sum to $|X|=|G|^{p-1}$ which is divisible by $p$.
    So the number of size $1$ orbits must be divisible by $p$, thus at least $2$.
    But all such orbits must be in the form $(g,g,\ldots, p)$, but since there are $2$ of them, there is some $g\neq e$ such that this tuple is in $X$, thus $g^p=e$ and $g\neq e$, therefore $g$ has order $p$.
\end{proof}
In fact, we have shown that the number of elements of order $p$ is congruent to $p-1\pmod{p}$.
\begin{definition}
    Fix a group $G$.
    $a,b\in G$ are conjugates of each other if $\exists g\in G, a=gbg^{-1}$.\\
    The conjugation action is an action of a group $g$ on itself by $g\star h=ghg^{-1}$.
\end{definition}
One can check that the conjugation is indeed an action.
\begin{definition}
    The orbits of the conjugation are called the conjugacy classes of $G$.
    The stabiliser of the conjugation of an element $h$ is called the centraliser $C_G(h)$ of $h$.
    The kernel of the conjugation action is called the centre $Z(G)$ of $G$.
\end{definition}
We can extend the conjugation action to the subgroups of $G$.
\begin{definition}
    If $H\le G$, then the conjugate of $H$ by $g$ is the subgroup $\{ghg^{-1}:h\in H\}$.
\end{definition}
It is trivial that the conjugate of a subgroup is indeed a subgroup.


\section*{Discrete Choice (Threshold) Problems}\label{SecDiscrChoice}

One powerful application of dynamic programming that illustrates its versatility as a dynamic solution method is to models that have both continuous and discrete state variables. These models are sometimes referred to as discrete choice problems or optimal stopping problems.  Examples include models of employment that involve both the choice of whether to work and how much to work, models of firm entry and exit that involve the choice of both whether to produce and how much to produce, and models of marriage that involve the choice of whether to date (get married or keep dating) and how much to date.

In this problem set, we follow a simple version of a standard job search model.  Assume that workers are infinitely lived. Let the value of entering a period with most recent wage $w$, current job offer wage $w'$, and employment status $s$ be given by the following value function,
\begin{equation}\label{EqV}
   V(w,w',s) = \begin{cases}
                  V^E(w)    \quad&\text{if}\quad s = E \\
                  V^U(w,w') \quad&\text{if}\quad s = U \\
               \end{cases}
\end{equation}
where employment status is a binary variable $s=\{E,U\}$; a person can be either employed or unemployed.

If an individual's job status is employed ($s = E$) in a given period, then expected utility is the utility of consumption in the current period plus the discounted expected value of the entering the next period with wage $w$, job offer wage $w''$, and employment status $s'$.
\begin{equation}\label{EqVe1}
   V^E(w) = u(w) + \beta E_{w'',s'}V(w,w'',s')
\end{equation}
Here we assume that individuals spend all of their earnings each period so that utility from the consumption in the current period is $u(w)$.  The discount factor is $\beta$.  The next periods wage, $w''$, and job offer, $s'$, are unknown and we consider them as random variables.  Consequently, the expectations operator $E_{w'',s'}$ is over the job offer wage, and employment status in the next period, and next period's value function is simply \eqref{EqV} with the future value of employment status $s'$.

The joint probability distribution over $w''$ and $s'$ is characterized in the following simple way. If the worker stays employed in the next period $s' = E$, then next period's wage equals the current period's wage. If the worker becomes unemployed in the next period $s' = U$, then the worker's unemployment benefits will be a percentage of his current wage $\alpha w$. Any worker who is unemployed will receive one wage offer per period $w'$, which that worker will receive in the following period, drawn from the cumulative density function $F(w')$ or probability density function $f(w')$, which is independent of the worker's previous wage (for simplicity). Lastly, let $\gamma$ represent the probability that an employed worker becomes unemployed in the next period. So \eqref{EqVe1} can be rewritten in the following way.
\begin{equation}\label{EqVe2}
   V^E(w) = u(w) + \beta \Bigl[(1-\gamma)V^E(w) + \gamma E_{w''}V^U(w,w'')\Bigr]
\end{equation}

The value of being unemployed in a given period is a function of both the wage at the most recent job $w$ as well as the wage of the current job offer $w'$,
\begin{equation}\label{EqVu}
   V^U(w,w') = u(\alpha w) + \beta\max_{s'\in\{E,U\}}\Bigl\{V^E(w'),E_{w''}\left[V^U(w,w'')\right]\Bigr\}
\end{equation}
where $\alpha\in(0,1)$ is the fraction of the worker's previous wage paid in unemployment insurance benefits. The maximization in \eqref{EqVu} reflects the decision of whether to accept the current job offer or remain unemployed for another period.  It is only in the unemployed state $s=U$ in which the worker makes a decision. Once the job offer ($w'$) is received, the worker can choose whether to accept or reject the offer. The expectation in \eqref{EqVu} is, therefore, not over $w'$ but over the possible job offers in the following period, $w''$; if the worker chooses to reject the current job offer, then $s' = U$.

The policy function for the decision of the unemployed worker whether to accept a job $s'=E$ or whether to reject a job $s'=U$ will be a function of both the amount of the most recent wage $w$ and the amount of the current job offer: $s' = \psi(w,w')$. These discrete choice problems are often called threshold problems because the policy choice depends on whether the state variable is greater than or less than some threshold level. That is, an unemployed worker will accept a job if and only if the offer wage is above some set amount. In the labor search model, the threshold level is called the ``reservation wage'' $w_R'$. The reservation wage $w_R'$ is defined as the wage offer such that the worker is indifferent between accepting the job $s' = E$ and staying unemployed $s' = U$.
\begin{equation}\label{EqWR}
   w_R' \equiv w': V^E(w') = E_{w''}\left[V^U(w,w'')\right]
\end{equation}
Note that the reservation wage $w_R'$ is a function of the wage at the most recent job $w$ (if you have higher unemployment benefits you will wait for a higher job offer). The policy function will then take the form of accepting the job if $w' \geq w_R'$ or rejecting the job offer and stay unemployed if $w' < w_R'$.
\begin{equation}\label{EqSprime}
   s' = \psi(w,w') = \begin{cases}
                      E \quad\text{if}\quad w' \geq w_R' \\
                      U \quad\text{if}\quad w' < w_R'
                   \end{cases}
\end{equation}

In summary, the labor search discrete choice problem is characterized by the value functions \eqref{EqV}, \eqref{EqVe2}, and \eqref{EqVu}, the reservation wage \eqref{EqWR}, and the policy function \eqref{EqSprime}. Because wage offers are distributed according to the cdf $F(w')$ and because the policy function takes the form of \eqref{EqSprime}, the probability that the unemployed worker receives a wage offer that he will reject is $F(w_R')$ and the probability that he receives a wage offer that he will accept is $1 - F(w_R')$. Just like the continuous choice cake eating problems, this problem can be solved by value function, policy function, or modified policy function iteration.

The value function iteration solution method for the equilibrium in the labor search problem is analogous to the value function iteration from the previous labs. The only difference is that two value functions ($V^E$ and $V^U$) must converge to a fixed point in this problem instead of just one value function converging in the previous problems.  Although there are two value functions to consider, there is only one policy function since decisions are only made in the unemployed state.  Thus there is only one policy function to iterate on in the case of policy or modified policy iteration.

Assume that the probability of becoming unemployed in a given period is $\gamma = 0.10$, the fraction of wages paid in unemployment benefits is $\alpha = 0.5$, and the discount factor is $\beta = 0.9$. Assume that the log of wage offers are distributed normally.  We then say that offers are distributed lognormally and write $w'\sim \text{LogN}(\mu,\sigma)$.  We let $m=20$ be the mean wage, $v=400$ be the variance of the wage.  Often lognormal distributions are reported with the mean and variance of $\log(w')$ which is distributed normally, but for simplicity you will not have to deal with that here. This is a convenient choice for the distribution of wage offers.  Among other things, it guarantees that wage offers will be positive.  Denote the cdf of the lognormal distribution as $F(w')$ and the pdf of the distribution as $f(w')$.

\vspace{5mm}

\begin{problem}
\begin{enumerate}

   \item Approximate the support of $w\in(0,\infty)$ by generating a column vector of possible values for $w$. Let the maximum value be $w_{max} = 100$, let the minimum value be $w_{min} = 0$, and let the number of equally spaced points in the vector be $N = 500$. Let the wage of a job offer in any period be lognormally distributed with mean job offer of $m=20$ and variance $v =200$.  Generate the discrete approximation of the lognormal probability density function $f(w')$ using the function defined in discretelognorm.py which is provided.  As arguments, it takes the points where the approximation is needed (w), along with the mean and variance so that it can be called as

\begin{lstlisting}[style=python]
f = discretelognorm(w,m,v)
\end{lstlisting}

    Then the $n$th entry of $f$ represents the probability that the job offer in the next period equals the $n$th entry of $w$, $\text{Pr}(w' = w_n)$.

   \item Solve for the equilibrium optimal policy function $s' = \psi(w,w')$ by value function iteration.  In this case we iterate on both value functions $V^E$ and $V^U$ each time through the loop.  In order to compute the expected value of $V^U$, just matrix multiply $V^U$ and $f$. Remember, the policy function $\psi(w,w')$ gives the choice of whether to accept the job offer if unemployed with a given previous wage and current job offer.  Thus it will be a vector of length $N$ of zeros and ones.  Again, use a tolerance level of $10^{-9}$ and require that both value functions must converge (compute a delta for each and iterate until both are less than $10^{-9}$).

   \item Compute the reservation wage $w_R'$ as a function of the current wage $w$.  The reservation wage is the value of $w$ where the policy function changes from zeros to ones (the optimal choice changes from remaining unemployed to accepting the job offer).  If psi is an $N\times N$ matrix representing the policy function, the reservation wage wr could be computed as follows
   \begin{lstlisting}[style = python]
    wr_ind = sp.argmin(sp.diff(psi), axis = 1)
    wr = w[wr_ind]
   \end{lstlisting}
	where the rows of psi correspond to values of $w$ and the columns correspond to values of $w'$.

   \item Plot the equilibrium reservation wage $w_R'$ of the converged problem as a function of the current wage $w$ with the current wage on the $x$-axis and the reservation wage $w_R'$ on the $y$-axis. This is the most common way to plot discrete choice policy functions. The reservation wage represents the wage that makes the unemployed worker indifferent between taking a job offer and rejecting it. So any wage above the reservation wage line represents $s' = E$ and any wage below the reservation wage line represents $s' = U$.

\end{enumerate}
\end{problem}

In the previous problem, it was necessary to iterate on two value functions.  Consequently the convergence is relatively slow.  Thus the gains by using modified policy function iteration are considerable.

\begin{problem}
Solve the same problem, this time using modified policy function iteration with $m=15$ value function iterations within each policy iteration.  Roughly, you can structure your code as follows:

\begin{enumerate}
	\item Initialize $w$,$u(\alpha w)$, $f$, $\gamma$, and $\beta$.  This should be the same as the previous problem.

	\item	Initialize $V^E$, $V^U$, and $E[V^U]$ to zeros.  Then begin the while loop.

	\item Inside the while loop update the policy function.  It is determined as
	\begin{equation}
		\psi (w,w') = \text{argmax} \left\{ V^E(w'), E_{w''}[V^U(w,w'')]\right\}
	\end{equation}

	\item Begin a for loop to iterate on the value functions.  Unlike in the previous algorithms lab, there is no $Q$ matrix in this case.  Given the previous iteration's value functions, updating $V^E$ should be simple because it does not depend directly on the policy function.

	To iterate on $V^U$, we need to compute $V^U$ given the current policy.  The policy determines the maximization in equation \eqref{EqVu}.  One way to compute the max is to use $\psi$ as a mask.  $V^U$ could be computed as follows:

	\begin{lstlisting}[style = python]
	arg1 = sp.repeat(sp.transpose(VE),N,0)*(1-psi)
    arg2 = sp.repeat(EVU,N,1)*psi
    arg = arg1+arg2
    VUprime = alpha_util_grid + beta*arg
	\end{lstlisting}
\newpage
	where the ordering is such that $1$ corresponds to the state $E$ and $0$ corresponds to the state $U$.

	\item Compute the $\delta$'s.

	\item After the while loop you should compute the reservation wage and plot it.
\end{enumerate}
\end{problem}

\begin{problem}
How many iterations did value function iteration take?
How many iterations did modified policy function iteration take?
Which was faster?
\end{problem}