text:
# Contents

## Idea

The path integral in quantization can be understood – to the extent and in the cases that it can be understood at all – as an integral transform induced from a span that is given by hom-spaces. According to the general reasoning of integral transforms on sheaves this means that it is given by a pull-push operation through spans.

## Examples

### The quantum particle

The archetypical example of the path integral is that for the sigma model that describes the quantum mechanics of the particle propagating on the target space $X=ℝ$ – the line.

In a finite approximation, one considers for $N\in ℕ$ paths consisting on $N$ discrete steps: let ${I}_{N}:=\left\{0,1,\cdots ,N\right\}$ be the set of $N+1$ elements. Regarding this as an abstract discrete cobordism of $N$ steps, we consider the cospan

$\begin{array}{ccc}& & {I}_{N}\\ & {}^{\mathrm{in}}↗& & {↖}^{\mathrm{out}}\\ *& & & & *\end{array}\phantom{\rule{thinmathspace}{0ex}},$\array{ && I_N \\ & {}^{\mathllap{in}}\nearrow && \nwarrow^{\mathrlap{out}} \\ * &&&& * } \,,

where $\mathrm{in}:*\to {I}_{N}$ is the inclusion of the first elements 0, and $\mathrm{out}:*\to {I}_{N}$ the inclusion of the last element, $N$.

The mapping space ${X}^{{I}_{N}}\simeq X×X×\cdots ×X$ is the space of paths – the space of paths in $X=ℝ$ consisting of $n$ linear steps. Homming the above cospan into $X$ produces the span

$\begin{array}{ccc}& & {X}^{{I}_{N}}\\ & {}^{{X}^{\mathrm{in}}}↙& & {↘}^{{X}^{\mathrm{out}}}\\ X\simeq {X}^{*}& & & & {X}^{*}\simeq X\end{array}\phantom{\rule{thinmathspace}{0ex}}.$\array{ && X^{I_N} \\ & {}^{\mathllap{X^{in}}}\swarrow && \searrow^{\mathrlap{X^{out}}} \\ X \simeq X^* &&&& X^* \simeq X } \,.

In the canonical coordinates on ${X}^{{I}_{N}}$ a path $\gamma \in {X}^{{I}_{N}}$ is parameterized as

$\gamma =\left({x}_{0},{x}_{1},\cdots ,{x}_{N}\right)\phantom{\rule{thinmathspace}{0ex}}.$\gamma = (x_0, x_1, \cdots, x_N) \,.

The action functional that encodes the dynamics of the free particle on $X$ is the differential form on ${X}^{{I}_{N}}$ given by

$\mathrm{exp}\left(iS\right):=\mathrm{exp}\left(i\sum _{i=1}^{N}\frac{m}{2}\left(\frac{{x}_{i}-{x}_{i-1}}{1/N}{\right)}^{2}\right)d{x}_{0}\wedge d{x}_{1}\wedge \cdots \wedge d{x}_{N-1}\in {\Omega }^{N}\left({X}^{{I}_{n}}\right)\phantom{\rule{thinmathspace}{0ex}}.$\exp(i S) := \exp(i \sum_{i = 1}^N \frac{m}{2}(\frac{x_i - x_{i-1}}{1/N})^2) d x_0 \wedge d x_1 \wedge \cdots \wedge d x_{N-1} \in \Omega^{N}(X^{I_n}) \,.

Denote by

$\left({X}^{\mathrm{in}}{\right)}^{*}:{\Omega }^{•}\left(X\right)\to {\Omega }^{•}\left({X}^{{I}_{N}}\right)$(X^{in})^* : \Omega^\bullet(X) \to \Omega^\bullet(X^{I_N})

the pullback of differential forms along ${X}^{\mathrm{in}}$, and by

$\left({X}^{\mathrm{out}}{\right)}_{*}:={\int }_{{X}^{{I}_{N}}/X}:{\Omega }^{•}\left({X}^{{I}_{N}}\right)\to {\Omega }^{•-N}\left(X\right)$(X^{out})_* := \int_{X^{I_N}/X} : \Omega^\bullet(X^{I_N}) \to \Omega^{\bullet - N}(X)

the “pushforward”: the fiber integration of differential forms.

Then then standard path integral for the particle is given by

1. pulling back functions along ${X}^{\mathrm{in}}$;

2. taking their wedge product with $\mathrm{exp}\left(iS\right)$;

3. pushing the result forward along ${X}^{\mathrm{out}}$.

This gives the map

$\left({X}^{\mathrm{out}}{\right)}_{*}\circ \mathrm{exp}\left(iS\right)\wedge \left(-\right)\circ \left({X}^{\mathrm{in}}{\right)}^{*}:{\Omega }^{0}\left(X\right)\stackrel{\left({X}^{\mathrm{in}}{\right)}^{*}}{\to }{C}^{\infty }\left({X}^{{I}_{n}}\right)\stackrel{\mathrm{exp}\left(iS\right)\wedge }{\to }{\Omega }^{N}\left({X}^{{I}_{N}}\right)\stackrel{\left({X}^{\mathrm{out}}{\right)}_{*}}{\to }{\Omega }^{0}\left(X\right)$(X^{out})_* \circ exp(i S) \wedge (-) \circ (X^{in})^* : \Omega^0(X) \stackrel{(X^{in})^*}{\to} C^\infty(X^{I_n}) \stackrel{\exp(i S)\wedge}{\to} \Omega^{N}(X^{I_N}) \stackrel{(X^{out})_*}{\to} \Omega^0(X)

that acts by

$\left(\psi \in {C}^{\infty }\left(X\right)\right)↦\left(x↦{\int }_{{X}^{{I}_{N}}/X}\psi \left({x}_{0}\right)\mathrm{exp}\left(i\frac{m}{2}\sum _{i=1}^{N}\left(\frac{{x}_{i}-{x}_{i-1}}{1/N}{\right)}^{2}\right)d{x}_{0}\wedge \cdots \wedge d{x}_{N-1}\right)\phantom{\rule{thinmathspace}{0ex}}.$(\psi \in C^\infty(X)) \mapsto \left( x \mapsto \int_{X^{I_N}/X} \psi(x_0) \exp(i \frac{m}{2} \sum_{i = 1}^N (\frac{x_i - x_{i-1}}{1/N})^2 ) d x_0 \wedge \cdots \wedge d x_{N-1} \right) \,.

This is the standard expression for the path integral of the particle on the line, at the approximation of $N$ discrete steps.

### String topology

On the singular homology of smooth manifolds and other topological spaces, pullback operations can be defined by Thom isomorphisms and fiber integration (“Umkehr maps”). Together with the canonically defined push-forward of singular cycles, this yields a definition of pull-push transformations on singular homology.

It was realized in (CohenGodin) and (Godin) that such pull-push operations define a 2-dimensional HQFT whose space of states is the singular complex, and that the correlators of the thus defined FQFT are the Chas-Sullivan string topology operations. See there for more details.

### Geometric $\infty$-function theory

Every perfect derived stack in dg-geometry forms the target space for a pull-push transform on the stable (infinity,1)-category of quasicoherent sheaves and yields a 2-dimensional TQFT. For details on this see geometric infinity-function theory .

## References

The pull-push nature of the path integral was originally amplified somewhat implicitly in

• Dan Freed

• Quantum groups from path integrals (arXiv)

• Higher algebraic structures and quantization (arXiv)

and fully explicitly in

The description of string topology operations as an HQFT defined by pull-push transforms was originally realized in

• Hirotaka Tamanoi, Loop coproducts in string topology and triviality of higher genus TQFT operations (2007) (arXiv)

A detailed discussion and generalization to the open-closed HQFT in the presence of a single space-filling brane is in

Revised on June 5, 2012 18:59:51 by David Corfield (86.164.153.212)


text:
Article

# Semileptonic form factors D \rightarrow \pi, K and B \rightarrow \pi, K from a fine lattice

ETH Zürich Institute for Theoretical Physics 8093 Zürich Switzerland; Deutsches Elektronen-Synchrotron DESY 22603 Hamburg Germany
European Physical Journal A (Impact Factor: 2.04). 43(1). DOI:10.1140/epja/i2009-10893-3
Source: OAI

ABSTRACT We extract the form factors relevant for semileptonic decays of D and B mesons from a relativistic computation on a fine lattice in the quenched approximation. The lattice spacing is a = 0.04 fm (corresponding to a
-1 = 4.97 GeV), which allows us to run very close to the physical B meson mass, and to reduce the systematic errors associated with the extrapolation in terms of a heavy-quark expansion. For decays of D and Ds mesons, our results for the physical form factors at

$\ensuremath q^2 = 0$
are as follows:

$\ensuremath f_+^{D\rightarrow\pi}(0) = 0.74(6)(4)$
,

$\ensuremath f_+^{D \rightarrow K}(0) = 0.78(5)(4)$
and

$\ensuremath f_+^{D_s \rightarrow K} (0) = 0.68(4)(3)$
. Similarly, for B and Bs we find

$\ensuremath f_+^{B\rightarrow\pi}(0) = 0.27(7)(5)$
,

$\ensuremath f_+^{B\rightarrow K} (0) = 0.32(6)(6)$
and

$\ensuremath f_+^{B_s\rightarrow K}(0) = 0.23(5)(4)$
. We compare our results with other quenched and unquenched lattice calculations, as well as with light-cone sum rule predictions, finding good agreement.

0 0
·
1 Bookmark
·
85 Views
• Source
##### Article: Improved Nonrelativistic QCD for Heavy Quark Physics
[hide abstract]
ABSTRACT: We construct an improved version of nonrelativistic QCD for use in lattice simulations of heavy quark physics, with the goal of reducing systematic errors from all sources to below 10\%. We develop power counting rules to assess the importance of the various operators in the action and compute all leading order corrections required by relativity and finite lattice spacing. We discuss radiative corrections to tree level coupling constants, presenting a procedure that effectively resums the largest such corrections to all orders in perturbation theory. Finally, we comment on the size of nonperturbative contributions to the coupling constants. Comment: 40 pages, 2 figures (not included), in LaTeX
Physical review D: Particles and fields 05/1992;
• ##### Article: from UTangles and
[hide abstract]
ABSTRACT: The angles of the CKM unitarity triangle are now known well enough to allow a determination of its sides from global fits, with good accuracy. Assuming that new physics does not affect the angles, UTfit and CKMfitter find $|V_{ub}| = (3.50\pm 0.18)\times 10^{-3}$. Using this result, and new high-precision data on the spectrum of $B\to\pi \ell\nu$ decays from BaBar, we find $|V_{ub}| f_+(0) = (9.1\pm 0.7)\times 10^{-4}$ and $f_+(0) = 0.26\pm 0.02$, with $f_+$ the $B\to\pi$ weak transition form factor. These results are {\em completely model-independent}. We compare them to theoretical calculations from lattice and QCD sum rules on the light-cone.
Physics Letters B - PHYS LETT B. 01/2007; 644(1):38-44.
• Source
##### Article: Non-perturbative determination of the axial current normalization constant in 0(a) improved lattice QCD
[hide abstract]
ABSTRACT: A finite-size technique is employed to compute the normalization constant ZA of the isovector axial current in lattice QCD. The calculation is carried out in the quenched approximation for values of the bare gauge coupling g0 ranging from 0 to 1. In the lattice action and the lattice expression for the axial current we include the counterterms required for O(a) improvement, withaffe non-perturbatively determined coefficients. With little additional work the normalization constant ZV of the improved isospin current is also obtained.
Nuclear Physics B. 01/1997;

Available from
May 10, 2012

format: plain


text:
# Description files

Note

This is a brief overview of the des-file format. An in-depth, visually-aided tutorial can be found here.

## Overview

MiniHack leverages the description files of NetHack to provide a means to easily design rich and diverse environments. The description files (or des-files) are human-readable specifications of levels: distributions of grid layouts together with monsters, objects on the floor, environment features (e.g. walls, water, lava), etc. The developers of NetHack created a special domain-specific language for describing the levels of the game, called des-file format. The des-files can be compiled into binary using the NetHack level compiler, and MiniHack maps them to Gym environments.

Levels defined via des-file format can be fairly rich, as the underlying programming language has support for variables, loops, conditional statements, as well as probability distributions. Crucially, it supports underspecified statements, such as generating a random monster or an object at a random location on the map. Furthermore, it features commands that procedurally generate diverse grid layouts in a single line.

Below we present a brief overview of the different kinds of des-files, how to add entities to levels, and the main sources of randomness that can be used to create a distribution of levels on which to train RL agents. Please check out our in-depth, visually-aided tutorial here. We also refer users to the des-file tutorial in NetHack wiki.

Note

MiniHack addionally provides a convenient interface to describe the entire environment directly in Python. Check out our LevelGenerator here.

## Types of des-files

There are two types of levels that can be created using des-file format, namely MAZE-type and ROOM-type:

• MAZE-type levels are composed of maps of the level (specified with the MAP command) which are drawn using ASCII characters, followed by descriptions of the contents of the level, described in detail below. In MAZE-type environments, the layout of the map is fixed, but random terrain can be created around (or within) that map using the MAZEWALK command, which creates a random maze from a given location and filling all available space of a certain terrain type.

• ROOM-type levels are composed of descriptions of rooms (specified by the ROOM command), each of which can have its contents specified by the commands described below. Generally, the RANDOM_CORRIDORS command is then used to create random corridors between all the rooms so that they are accessible. On creation, the file specifies (or leaves random) the room’s type, lighting and approximate location. It is also possible to create subrooms (using the SUBROOM command) which are rooms guaranteed to be within the outer room and are otherwise specified as normal rooms (but with a location relative to the outer room).

As we have seen above, there are multiple ways to define the layout of a level using the des-file format. Once the layout is defined, it is useful to be able to add entities to the level. These could be monsters, objects, traps or other specific terrain features (such as sinks, fountains or altars). In general, the syntax for adding one of these objects is:

ENTITY: specification, location, extra-details

For example:

MONSTER: ('F',"lichen"), (1,1)
OBJECT: ('%',"apple"), (10,10)
TRAP: 'teleportation', (1,1)
SINK: (1,1)
FOUNTAIN: (0,0)

Note that many of the details here can instead be set to random. In this case, the game engine chooses a suitable value for that argument randomly each time the level is generated. For monsters and objects, this randomness can be controlled by just specifying the class of the monster or object and letting the specific object or monster be chosen randomly. For example:

MONSTER: 'F', (1,1)
OBJECT: '%', (10,10)

This code would choose a random monster from the Fungus class, and a random object from the Comestible class.

## Sources of Randomness in des-files

We have seen how to create either very fixed (MAZE-type) or very random (ROOM-type) levels, and how to add entities with some degree of randomness. The des-file format has many other ways of adding randomness, which can be used to control the level generation process, including where to add terrain and in what way. Many of these methods are used in \texttt{IF} statements, which can be in one of two forms:

IF[50%] {
MONSTER: 'F', (1,1)
} ELSE {
# ELSE is not always necessary
OBJECT: '%', (1,1)
}

IF[$variable_name < 15] { MONSTER: 'F', (1,1) } In the first form, a simple percentage is used for the random choice, whereas in the second, a variable (which could have been randomly determined earlier in the file) is used. A natural way to specify this variable is either in other conditional statements (perhaps you randomly add some number of monsters, and want to count the number of monsters you add such that if there are many monsters, you also add some extra weapons for the agent), or through dice notation. Dice notation is used to specify random expressions which resolve to integers (and hence can be used in any place an integer would be). They are of the form \texttt{NdM}, which means to roll N M-sided dice and sum the result. For example:$roll = 2d6
IF[$roll < 7] { MONSTER: random, random } Dice rolls can also be used for accessing arrays, another feature of the des-file format. Arrays are initialised with one or more objects of the same type, and can be indexed with integers (starting at 0), for example: # An array of monster classes$mon_letters = { 'A', 'L', 'V', 'H' }
# An array of monster names from each monster class respectively
$mon_names = { "Archon", "arch-lich", "vampire lord", "minotaur" } # The monster to choose$mon_index = 1d4 - 1
MONSTER:($mon_letters[$mon_index],$mon_names[$mon_index]),(10,18)

Another way to perform random operations with arrays is using the SHUFFLE command. This command takes an array and randomly shuffles it. This would not work with the above example, as the monster name needs to match the monster class (i.e. we could not use ('A', "minotaur"). For example:

$object = object: { '[',')','*','%' } SHUFFLE:$object

Now the $object array will be randomly shuffled. Often, something achievable with shuffling can also be achieved with dice-rolls, but it is simpler to use shuffled arrays rather than dice-rolls (for example, if you wanted to guarantee each of the elements of the array was used exactly once, but randomise the order, it is much easier to just shuffle the array and select them in order rather than try and generate exclusive dice rolls). ## Random Terrain Placement When creating a level, we may want to specify the structure or layout of the level (using a MAZE-type level), but then randomly create the terrain within the level, which will determine accessibility and observability for the agent and monsters in the level. As an example, consider the following example. In this level, we start with an empty 11x9 MAP. We first replace 33% of the squares with clouds 'C', and then 25% with trees 'T'. To ensure that any corner is accessible from any other, we create two random-walk lines using randline from opposite corners and make all squares on those lines floor .. To give the agent a helping hand, we choose a random square in the centre of the room with rndcoord (which picks a random coordinate from a selection of coordinates) and place an apple there. MAZE: "mylevel", ' ' GEOMETRY:center,center MAP ........... ........... ........... ........... ........... ........... ........... ........... ........... ENDMAP REGION:(0,0,11,9),lit,"ordinary" REPLACE_TERRAIN:(0,0,11,9), '.', 'C', 33% REPLACE_TERRAIN:(0,0,11,9), '.', 'T', 25% TERRAIN:randline (0,9),(11,0), 5, '.' TERRAIN:randline (0,0),(11,9), 5, '.'$center = selection: fillrect (5,5,8,8)
$apple_location = rndcoord$center
OBJECT: ('%', "apple"), $apple_location$monster = monster: { 'L','N','H','O','D','T' }
SHUFFLE: $monster$place = { (10,8),(0,8),(10,0) }
SHUFFLE: $place MONSTER:$monster[0], $place[0], hostile STAIR:$place[2],down
BRANCH:(0,0,0,0),(1,1,1,1)

Several other methods of randomly creating selections such as filter (randomly remove points from a selection) and gradient (create a selection based on a probability gradient across an area) are described in the NetHack wiki.

## Further Information

For more information on the des-file format, be sure to check out our in-depth, visually-aided tutorial here.


text:
# Runge Kutta 4th order for system of coupled equations

I have system of coupled differential equations:

$x_0 x_0'=\dfrac{32}{(r^4-2r^2)}$

$(x_o x_1)'=a x_0'$

$(x_o x_2)'=-x_1x_1'-a (-x_1'-\dfrac{x_0'}{x_0})$

$(x_o x_3)'=-(x_1x_2)' +a( x_2'+\dfrac{x_1'}{x_0}+\dfrac{2x_1'x_0'}{x_0^2}+\dfrac{x_1 x_0'}{x_0^2})$

Where I need to find values for $x_0, x_1, x_2, x_3$.

In equations $'$ means that is derivative $\dfrac{d}{dz}$, on the other side values of $a$ and $r$ are dependent on $z$ coordinate ($a=a(z), r=r(z)$). I have values of $x$ at the outlet boundary, I think that is boundary value problem than.

It is necessary to solve this system with Runge Kutta 4th order method, I don't know where to start when I have system of equations of this type on left side?

If I know boundary value, not initial values, does it mean that I need to rotate my geometry and equations on that way where my zero coordinate will be on the boundary, not at he inlet? Is it necessary for solution of system of this type?

• I've not worked with equations of this type before, so I'm not 100% sure, but my impression is -- If you want to integrate $(x_i)_{i=0}^3$ on $[a, b]$, and you only have the initial conditions $x_i(b)$, then it's still an initial value problem. To integrate using Runge-Kutta, you could either take the step-size $dz < 0$ (if your implementation of R-K lets you do that) or make a change of variables $z = b(1-s) + as$ (with $0 \leq s \leq 1$) and pick the step-size $ds > 0$. Does that make sense? – Kyle Mar 28 '18 at 3:02


text:
# Let $f:[-1,1] \to \mathbb{R}$ be differentiable 3 times, prove $\exists M>0 \ , \ s.t \ f(x) \le Mx^2$

Let $f:[-1,1] \to \mathbb{R}$ be differentiable 3 times, let $f(0)=0$ and $f(x) \ge 0 \ \forall x \in [-1,1]$.

Prove: $\exists M>0 \ , \ s.t \ f(x) \le Mx^2$.

I separated the proofs to two cases:

1. $f(x)=0 \forall x \in [-1,1]$, so we are done.
2. $\exists x \in [-1,1] \ s.t \ f(x) \ne 0$, so we can say that $x=0$ is an extremum, so $f'(0)=0$.

I have expanded the function using Taylor expansion: $$f(x)=f(0)+f'(0)x+\frac{f''(0)x^2}{2}+\frac{f'''(c_x)x^3}{6}=\frac{f''(0)x^2}{2}+\frac{f'''(c_x)x^3}{6}$$ where $c_x \in (-1,1)$.

I don't know how to continue...

You're on the right track, but I believe all you need to use is that $f$ is $C^2$ ($f''$ is continuous). Use the first degree Taylor polynomial with remainder to get $$f(x)=f(0)+f'(0)x+\frac12 f''(c_x)x^2 \quad\text{for some } x_c \text{ between 0 and x}.$$ But we know there is an $M$ so that $f''\le M$ on $[-1,1]$.
• You're saying that $M=\frac {f''(c)}{2}$ ? – GinKin Jun 24 '14 at 8:37
• @GinKin: No, I'm saying that because $f''$ is continuous, it attains a maximum on a closed interval. – Ted Shifrin Jun 24 '14 at 14:36
• @UneFemmeDouce: Because $f(x)\ge 0$ for all $x\in [-1,1]$ and $f(0)=0$, $x=0$ is an interior minimum point of $f$, and so $f'(0)=0$. – Ted Shifrin Aug 16 '14 at 12:24


text:
# Solved – How to compute (or numerically estimate) the standard error of the MLE

I have a model for which I know the log likelihood function, the gradient of the log likelihood and the Hessian of the log likelihood. For given data I can compute the MLE using a generic optimizer (Nelder-Mead). How do I compute (or estimate) the standard error for the MLE?

If there is existing software that makes this easy that would be even better of course.

Contents

If you know the gradient and Hessian of the log-likelihood, you can write quick functions in R similar to the one you need for the LL itself. If you pass the gradient, you can use (L)BFGS in R as opposed to Nelder-Mead, which should converge a bit faster. Regardless, once you have the point of convergence, you can plug the values for the point of convergence into the function for the Hessian, and the sqrt of the diagonals is your estimated error. Here is an example using the Pareto distribution for which: $$f(x) = frac{alphatheta^{alpha}}{left(x+thetaright) ^{alpha + 1}}$$

``LL <- function(pars, X){   a <- pars[[1]]   q <- pars[[2]]   return(-sum(a * log(q) + log(a) - (a + 1) * log (X + q))) }  LLG <- function(pars, X){   a <- pars[[1]]   q <- pars[[2]]   ga <- -sum(log(q) + 1 / a - log(X + q))   gq <- -sum(a / q - (a + 1) / (X + q))   Z <- c(ga, gq)   names(Z) <- c('a', 'q')   return(Z) }    LLH <- function(pars, X){   a <- pars[[1]]   q <- pars[[2]]   n <- length(X)   haa <- n / a ^ 2   hqq <- n * a / q ^ 2 - sum((a + 1) / (X + q) ^ 2)   haq <- hqa <- sum(1 / (X + q)) - n / q   Z <- matrix(c(haa, hqa, haq, hqq), ncol = 2)   rownames(Z) <- colnames(Z) <- c('a', 'q')   return(Z) } ``

I tend to use `nloptr` for linear-search optimization, the call for `optim' would be similar. So assuming your data is stored as DATA:

``Fit <- nloptr(x0 = c(2, 1e6), eval_f = LL, eval_grad_f = LLG, lb = c(0,0), X = DATA,               opts = list(algorithm = "NLOPT_LD_LBFGS", maxeval = 1e5)) ``

Your values are in `Fit\$solution` so your Fisher information matrix estimate is the inverse of the Hessian (not negative Hessian since we are minimizing NLL, not maximizing LL) and so the estimate of the standard error can be calculated using:

``sqrt(diag(solve(LLH(Fit\$solution, DATA)))) ``

and their correlation would be the off-diagonal in:

``cov2cor(solve(LLH(Fit\$solution, DATA))) ``

Rate this post


text:
## anonymous 4 years ago y = ^3 square root 7x -9 help..i'm stumped :(

1. anonymous

What is it exactly that you want?

2. anonymous

do you mean the cube of square root of (7x-9)? y = (7x-8)^(3/2)

3. anonymous

I think he means $$y=\sqrt[3]{7x-9}.$$

4. anonymous

and as anwar said what do u want to do qith it?

5. anonymous

AnwarA has the correct equation. The question is what is the inverse of this equation. f^-1 = ??

6. anonymous

cube both sides: y^3 = 7x - 9 7x = y^3 + 9 x = (y^3 -9) / 7 replace y by x: f^-1 = (x^3 - 9) / 7


text:
Show Summary Details
More options …

# Analysis

### International mathematical journal of analysis and its applications

CiteScore 2018: 0.72

SCImago Journal Rank (SJR) 2018: 0.363
Source Normalized Impact per Paper (SNIP) 2018: 0.530

Mathematical Citation Quotient (MCQ) 2018: 0.36

Online
ISSN
2196-6753
See all formats and pricing
More options …
Volume 35, Issue 2

# Oscillating spectral multipliers on Riemannian manifolds

Published Online: 2015-03-12 | DOI: https://doi.org/10.1515/anly-2012-1196

## Abstract

Suppose that M is a Riemannian manifold satisfying the doubling volume property. Let L be a self-adjoint positive definite operator on M. We consider the heat semigroup ${e}^{-tL}$ and we assume that the associated heat kernel ${p}_{t}\left(x,y\right)$ satisfies certain upper Gaussian estimates. We study the Lp boundedness of oscillating spectral multipliers ${m}_{\alpha ,\beta }\left(L\right)$.

MSC: 32W30; 42B15; 42B20; 47F99; 58J35

Accepted: 2015-02-10

Published Online: 2015-03-12

Published in Print: 2015-05-01

Citation Information: Analysis, Volume 35, Issue 2, Pages 85–91, ISSN (Online) 2196-6753, ISSN (Print) 0174-4747,

Export Citation


text:
### Why is right ascension measured in hours?

• When viewing star maps in Stellarium, I noticed that the meridians of the equatorial grid were denoted in hours and not degrees, and that always puzzled me. Why did astronomers choose this system? I understand it has something to do with being relative to the Earth's rotation which takes 24 hours, but I can't figure out exactly what.

8 years ago

In order to know when a star will be above horizon, you'll need an equation with times, not "celestial latitudes".

So you end up adding RA and sidereal time.

EDIT

In order to find out the position of a star you need to find out how its Hour Angle varies with time.

The Hour Angle is how far the star is from the observer's meridian:

In this image, it is the angle between the site's celestial meridian (North Celestial P ole-Z enith-S outh horizon) and the star's celestial meridian (P-X-Y). It is the same angle as between where X culminates and X.

So it comes than $$HA=ST-RA$$ and since you may not have a "local sidereal time" clock at hand, you can use Greenwich's Sidereal Time: $$HA=GST-Lat-RA$$

• $$HA$$ (local) Hour Angle of a star

• $$ST$$ Local Sidereal Time

• $$GST$$ Greenwich Sidereal Time

• $$RA$$ Right Ascension of a star

• $$Lat$$ (local) Geographical Latitude

This is actually not correct! The Sidereal Time is not a time but an angle just as right ascension is. It is the angle between the local meridian and the vernal equinox. For instance, you cannot use sidereal time as the time of an event because the same sidereal time occurs every 23h56m... The strict interpretation of time includes the date.

@Dieudonné You are wrong. Sidereal time is a time, measured in Sidereal seconds, not in degrees.Please check e.g. Wikipedia: http://en.wikipedia.org/wiki/Sidereal_time **Local Sidereal Time at any locality differs from the Greenwich Sidereal Time value of the same moment, by an amount that is proportional to the longitude of the locality. When one moves eastward 15° in longitude, sidereal time is larger by one sidereal hour (note that it wraps around at 24 hours).** I have actually used sidereal time clocks in my observations.

To me, time can be used to identify a specific moment (in time), and should include a date. A time therefore, should not occur again. You cannot use sidereal time to identify a specific moment in time because 23h56m later it will occur again. I would call sidereal time an angle because it specifies the right ascension of objects which lie on the local meridian (i.e. the line from south to zenith in the northern hemisphere). Sirius, for instance, will be on the meridian when the sidereal time is 6h45m.

As you say, sidereal time is measured in **sidereal** seconds and not in degrees. But a **sidereal** second is not necessarily a unit of time. A second is precisely defined with the number of cycles of radiation of cesium 133. A sidereal second cannot be defined so exactly. The duration of a sidereal second in real seconds in January will be different from the duration in July because of variations in the rotation of the Earth. The practical use of sidereal time is as the right ascension of the local meridian at a specific time. And right ascension is an angle.

I'm not sure if I would use Wikipedia as a fountain of truth ;-) However, in the Glossary of the Explanatory Supplement to the Astronomical Almanac by Siedelmann, sidereal time is defined as "the measure of time defined by the apparent diurnal motion of the **catalog equinox**; hence a measure of the rotation of the Earth with respect to the stars rather than the Sun." -- It seems to me that it supports your definition.

@Dieudonné Moreover, a sidereal second is defined regarding Earth's rotation referring to "fixed stars" (so, to the catalog equinox). Please cf. http://en.wikipedia.org/wiki/Sidereal_time and the definition there: *Sidereal time, at any moment (and at a given locality defined by its geographical longitude), more precisely Local Apparent Sidereal Time (LAST), is defined as the hour angle of the vernal equinox at that locality: it has the same value as the right ascension of any celestial body that is crossing the local meridian at that same moment.* Since it is defined as HA, it is a time.

Which is why I have a problem with defining a sidereal second as a unit of time. Because the rotation of the earth is not constant, you cannot define a sidereal second in an exact number of seconds of time as it will be variable. You can however define a sidereal second as 1/2400 of a degree as that is the **average** rotation of the Earth (referred to the fixed stars) per second.

@Dieudonné No, you can not define a time unit as an angle, they are different magnitudes. You can, instead, define a time unit by using an angle: a sidereal second is the **time** the Earth rotates 360/(24*60*60) degrees in reference to the fixed stars in average.


text:
# Can 3 photons be combined to give a spin-0 projection?

Motivation: The neutral pion decays to 2 photons ($\pi^0\to\gamma\gamma$) most of the time. For the decay of the neutral to 3 photons ($\pi^0\to 3\gamma$) we have an upper limit on the branching ratio of $3.1 \cdot 10^{-8}$ in the Particle Data Book (2012). The explanation is that this decay would violate charge conjugation.

I haven't found anything about angular momentum conservation in this decay: The pion has spin zero, the photon is a spin-one particle, but, being massless, a (free) photon cannot have 0 for the projection of the spin.

Now, my question is: Can I combine three photons to give a spin-zero state such that angular momentum in the $\pi^0\to 3\gamma$ decay is conserved?

Thoughts: For "ordinary" spin-zero particles the spin addition is described by the Clebsch-Gordan coefficients. From the tabulated CG coefficients I see that I can combine $1\times1$ to give a $J=1$ state with zero contribution from $m_1=m_2=0$. So I could add two photons, giving $J=1$ and $M=0$ (the important point being that all other possibilities are ruled out by the requirement of the photon not having $m=0$??). I could then add the third photon on top, argueing along the same lines.

Does that make sense? Is the application of the formalism correct?

(Sorry for writing so much text about a simple question.)

-

The decay of a neutral $\pi^0$ to three photons would indeed violate charge conjugation.

The charge conjugation argument goes as follows: The reaction $$\pi^0 \to 3 \gamma$$ is mediated by electromagnetism. QED has a charge conjugation symmetry, so you should be able to apply a charge conjugation to both sides of the equation. Under charge conjugation, $\pi^0 \to \pi^0$ while $\gamma \to - \gamma$ (this follows from the gauge principle). Therefore, the initial state has an even C transformation while the final state has an uneven C transformation. In other words: Applying these transformation properties to both sides of the above equation gives you a minus sign (this may seem like a bogus calculation, but you can work it out with the actual fields if you like).

The angular momentum thing is more difficult. You have to take into account that the system of three photons does not only have spin, but can also have an non-zero 'regular' angular momentum (e.g. the photons are emitted in a p-wave and not an s-wave).

-
I know the C violation argument, the question is really more about the spin addition of photons (not taking into account orbital angular momentum because I do not see how that would help here). –  fuenfundachtzig May 16 at 11:11
Your calculations would be correct, if the photon had a $S=1, M=0$ state. However, the photon only allows $S = 1, M = \pm 1$ states. If you add the spin of two photons the possibilities are $J = 0, 1, 2$ with $M = 0 = -1 +1$ or $M = 2 = +1 +1$. If you add another photon your options are $J = 0, 1, 2, 3$ and $M = 1 = 0 + 1 = 2 - 1$ or $M = 3 = 2 + 1$. (and of course, for every M also -M). So there is no possibility to reach $M = 0$ with three photons, as the photon does not have a $S = 1, M = 0$ component. –  Neuneck May 16 at 11:30
I agree with the first part. I'm not sure about the second -- I thought I had been taught that I can do the addition of spins stepwise (i.e. it's associative)? –  fuenfundachtzig May 16 at 14:51
Yes, it is associative. Nevertheless adding +1 or -1 to 0 or 2 will never give you 0. And 0 or 2 are the only possibilities for the addition of two photon spins, irregardless of order. –  Neuneck May 17 at 6:02
I guess my wording in the heading is misleading, I tried to improve on that: I'm mostly interested in the conservation of angular momentum in the $3\gamma$ decay. I don't need a spin-0 state for that, only a state which allows the projection of the spin to be zero. –  fuenfundachtzig May 17 at 8:11


text:
# Can we simplify it further using determinant properties?

We have the points $A'(a_1'\mid a_2')$, $B'(b_1'\mid b_2')$ and $C'(c_1'\mid c_2')$. These points are collinear iff \begin{equation*}\begin{vmatrix} a_1' & a_2' & 1 \\ b_1' & b_2' & 1 \\ c_1' & c_2' & 1 \end{vmatrix}=0\end{equation*}

It is given that $\vec{C'}=\vec{A}+\lambda(\vec{B}-\vec{A})=(1-\lambda )\vec{A}+\lambda \vec{B}$, $\vec{A'}=\vec{B}+\mu(\vec{C}-\vec{B})=(1-\mu )\vec{B}+\mu \vec{C}$ and $\vec{B'}=\vec{C}+\nu(\vec{A}-\vec{C})=(1-\nu )\vec{C}+\nu \vec{A}$.

Let $A(a_1 \mid a_2)$, $B(b_1 \mid b_2)$ uand $C(c_1 \mid c_2)$.

We get the following \begin{align*}&\begin{vmatrix} a_1' & a_2' & 1 \\ b_1' & b_2' & 1 \\ c_1' & c_2' & 1 \end{vmatrix}=0 \iff \begin{vmatrix} (1-\mu )b_1+\mu c_1 & (1-\mu )b_2+\mu c_2 & 1 \\ (1-\nu )c_1+\nu a_1 & (1-\nu )c_2+\nu a_2 & 1 \\ (1-\lambda )a_1+\lambda b_1 & (1-\lambda )a_2+\lambda b_2 & 1 \end{vmatrix}=0 \\ & \iff \begin{vmatrix} (1-\mu )b_1 & (1-\mu )b_2+\mu c_2 & 1 \\ (1-\nu )c_1 & (1-\nu )c_2+\nu a_2 & 1 \\ (1-\lambda )a_1 & (1-\lambda )a_2+\lambda b_2 & 1 \end{vmatrix}+\begin{vmatrix} \mu c_1 & (1-\mu )b_2+\mu c_2 & 1 \\ \nu a_1 & (1-\nu )c_2+\nu a_2 & 1 \\ \lambda b_1 & (1-\lambda )a_2+\lambda b_2 & 1 \end{vmatrix}=0 \\ & \iff \begin{vmatrix} (1-\mu )b_1 & (1-\mu )b_2 & 1 \\ (1-\nu )c_1 & (1-\nu )c_2 & 1 \\ (1-\lambda )a_1 & (1-\lambda )a_2 & 1 \end{vmatrix}+\begin{vmatrix} (1-\mu )b_1 & \mu c_2 & 1 \\ (1-\nu )c_1 & \nu a_2 & 1 \\ (1-\lambda )a_1 & \lambda b_2 & 1 \end{vmatrix}+\begin{vmatrix} \mu c_1 & (1-\mu )b_2 & 1 \\ \nu a_1 & (1-\nu )c_2 & 1 \\ \lambda b_1 & (1-\lambda )a_2 & 1 \end{vmatrix}+\begin{vmatrix} \mu c_1 & \mu c_2 & 1 \\ \nu a_1 & \nu a_2 & 1 \\ \lambda b_1 & \lambda b_2 & 1 \end{vmatrix}=0 \end{align*}

Is it correct so far? Can we simplify it further using properties of the determinant or do we have to calculate the determinants?

You can simplify this problem from the beginning. Note that $$\begin{vmatrix} a_1 & a_2 & 1\\ b_1 & b_2 & 1\\ c_1 & c_2 & 1 \end{vmatrix}= \det (B,C)+\det(C,A)+\det(A,B)$$ where $A=(a_1, a_2)^T$ and $B,C$ are defined similarly. Now given you definitions of $A', B', C'$ \begin{aligned} \det (A',B') &=\det [(1-\mu) B+\mu C,(1-\nu)C+\nu A]\\ &=(1-\mu)(1-\nu)\det(B,C)-(1-\mu)\nu\det (A,B)+\mu\nu\det (C,A)\\\\ \det (B',C') &=\det [(1-\nu) C+\nu A,(1-\lambda)A+\lambda B]\\ &=(1-\lambda)(1-\nu)\det(C,A)-(1-\nu)\lambda\det (B,C)+\lambda\nu\det (A,B) \\\\ \det (C',A') &=\det [(1-\lambda) A+\lambda B,(1-\mu)B+\mu C]\\ &=(1-\lambda)(1-\mu)\det(A,B)-(1-\lambda)\mu\det (C,A)+\lambda\mu\det (B,C) \end{aligned} Therefore, after a bit of calculation \begin{aligned} &\det(A',B')+\det(B',C')+\det(C',A')=\\ &\big[ \lambda \mu \nu +(1-\lambda)(1-\mu)(1-\nu)\big]\big[\det(A,B)+\det(B,C)+\det (C,A)\big]\\ \end{aligned} In your original form of the question $$\begin{vmatrix} a'_1 & a'_2 & 1\\ b'_1 & b'_2 & 1\\ c'_1 & c'_2 & 1 \end{vmatrix}= \big[ \lambda \mu \nu +(1-\lambda)(1-\mu)(1-\nu)\big] \begin{vmatrix} a_1 & a_2 & 1\\ b_1 & b_2 & 1\\ c_1 & c_2 & 1 \end{vmatrix}$$ So $A,B,C$ are colinear iff $A',B', C'$ are colinear (I'm assuming $\lambda, \mu, \nu\in (0,1)$). However, using determinants to solve this geometric problem, in my humble opinion, is a bit odd and unneccasrily complicated.
• Why does the first relation hold? How did you calculated the the right part from the left one?  how else could we solve the problem besides using determinants? – Mary Star Jul 13 '17 at 6:46
• Regarding your first question I'm just using $$\begin{vmatrix}a & b & c\\ d & e & f\\ h & i &j\end{vmatrix}= c\begin{vmatrix} d & e\\ h & i\end{vmatrix}- f\begin{vmatrix} a & b\\ h & i\end{vmatrix}+j\begin{vmatrix} a & b\\ d & e\end{vmatrix}$$ then absorbing the minus sign (behind f) to swicth the rows. Turning it into $$\begin{vmatrix}a & b & c\\ d & e & f\\ h & i &j\end{vmatrix}= c\begin{vmatrix} d & e\\ h & i\end{vmatrix}+f\begin{vmatrix} h & i\\a & b\end{vmatrix}+j\begin{vmatrix} a & b\\ d & e\end{vmatrix}$$ – Hamed Jul 13 '17 at 9:12
• For you second question, if $A,B,C$ are collinear, the line being $L$, then a straightforward check (even a drawing) shows that $A',B', C'$ (for any choice of $\lambda, \mu, \nu$ lie on $L$ too. The converse is also similar. – Hamed Jul 13 '17 at 9:16
• Oh I'm sorry in derivation of the first equation I'm also using $\det M=\det M^T$ for a matrix $M$. – Hamed Jul 13 '17 at 9:17
• I understand!! Thank you so much!! There is also a second question: If $A',B',C'\neq A,B,C$ and either zero or two of the points $A',B',C'$ are at one side of triangle, then $A',B',C'$ are collinear iff $\frac{|AC'|}{|C'B|}=\frac{|BA'|}{|A'C|}=\frac{|CB'|}{|B'A|}=1$. Could you give me a hint how we could show that? – Mary Star Jul 13 '17 at 16:37


text:
# What are the historical and literary backgrounds of Dungeons & Dragons Languages?

Is there a source for the nature of the fantasy languages in D&D? An official source would be best, but I'd also be interested in other players' interpretations of the languages.

1. If the D&D languages are based on languages from specific literary works, which ones?

2. If there are canon sources for the nature of these languages, what are they?

3. If not, are there any 'standard' conventions for each of the fantasy languages?

For example:

• Elvish might only have good words, love hope but no words for war or hate

• Draconic might only express complex ideas, but not single/simple concepts. For example, expressing many details of a journey in a single word.

• Orcish statements might always imply threats

-
This question is worlds ahead of where it used to be. But the Draconic example is still nonsense. What's the difference between an idea and a concept? "...expressing a journey in a single word" is what? Impossible? – gomad Nov 9 '11 at 16:46
I'm working on re-wording it My DM used to sya that dragons could used 1 word to decribe our sentences The Idea that is used a lot in Sci-Fi (they put memories in anothers head) – Ax Kidson Nov 10 '11 at 3:16
Thanks for sticking with it. I think you'll find you get a really high quality of help around here for your efforts. – gomad Nov 10 '11 at 7:41

Really, the D&D languages are, for the most part, merely labels. There is no listed limitation nor link to real languages that I can see in the general D&D rules of any edition.

4th Edition does include cipher-scripts¹ for several "languages" but doesn't actually present the languages, and I've not seen (nor looked for) examples of words in languages associated with them.

The partial exception to languages being described as limited in concepts is in the early editions... White Box, Holmes, Moldvay/Cook and Mentzer D&D, AD&D 1E. In these editions, mention is made of Alignment Tongues. These are limited to members of a given alignment, and as written, pretty much mean most races can find some language to communicate in. But, for the most part, alignment tongues are ignored in the published adventures, and generally also by a large portion of the gamers playing those editions. Moreover, there is only the vaguest implications that they might be limited in subject.

Now, there are some settings that include some terms in other langues. Most memorable is Dragonlance... Krynn's terms for the various elven races, and some placenames, provide some terms that can be pieced together, and one can analyze them for the sounds Elven in Krynn. Plus, there are lots of elven words in the very successful novels of that setting, so some con-langers² have been busy collecting them and attempting to rationalize them into functional languages.³

One can look through the Forgotten Realms and pull place-names, and extract phonemes from the various personal names as well, to establish the sounds, but there isn't nearly as much placed where its meanings can be grabbed as with Dragonlance. What I've seen are simple borrows from real languages and/or ciphertext⁴.

Similarly, the GAZ series has some hints at languages in various books, but nothing even as thorough as Dragonlance nor as much as in Forgotten Realms.

A related game, however, did make extensive use of a con-lang, back in the mid 70's... Empire of the Petal Throne. It was related to D&D in that it was a customized version of D&D, and sold by TSR, and remained mostly compatible. The setting and the Tsoylani con-lang are still going strong.

So, as far as adding restrictions on concepts, one could do so and not be outside the spirit of the game, but there's also not much done for you. Moreover, doing so may be beyond the scope play for many players, and seems to be beyond the scope for most groups.

The simplest way to make new language words, should you opt to do so, is to create a "fictionary" language⁵ - one that is simply english with made up words, and to generate a ciphertext or phonetic-cipher substitution table. I'll give you a two table example - one for vowels, and one for consonants. These are both a list which is then "rot 5"

Vowel - English: a  e  i  o  u  y  ow ar er or
vowel - cipher:  y  ow ar or a  e  i  o  u  y

Consonant English 1: b  c  d  f  g  h  j  k  l  m  n  p
consonant cipher 1:  h  j  k  l  m  n  p  q  r  s  t  v
Consonant English 2: q  r  s  t  v  w  x  z  ch ph sh th
consonant cipher 2:  w  x  z  ch ph sh th b  c  d  f  g

So, using the example, Watertown would become Shychuchit, and chit would be town, and Shychu would be water. Such cipher systems are readily used. Have fun with it. Note that one could also have other combinations on the table, change the rotation distances, or even assign the same output for 2 or more input letters, or have a randomization of 2 or more outputs for a single input.

¹: Cipher-scripts are scripts that simply replace extant letters with different looking letters, but provide a 1:1 or 1:2 correspondence with the extant character set. The 4E examples include a glyph for th, but are able to encode English.

²: con-langer - one who engages in the creation of constructed languages, or con-langs.

⁴: Ciphertext - substitution by table lookup, often by numeric offset in alphabetical order. One of the most common modes of ciphertext is "rot13" - the lookup table is:

Rot13
Line 1: A B C D E F G H I J K L M
Line 2: N O P Q R S T U V W X Y Z

If the letter to be encoded is on line 1, replace it in the cipher with the one below it on line two; if it is on line 2, replace it with the one above it from line 1. It's called rot 13 because, if you place the letters in an alphabetical pair of wheels, starting lined up, the output wheel is rotated 13 places.

-


text:
# Impedance in sine DC

If we have a DC sine signal. Can we say that capacitors and inductors have impedance despite not being AC?

If yes then what will the formula look like?

And the opposite if we have an AC square signal do capacitors and inductors have impedance?

• Can you elaborate on what you mean by DC sine signal ? If possible a mathematical expression representing such a signal. – AJN Jul 5 at 8:29
• For an AC suqare signal, the signal can be represented as the sum several sinusoids at different frequencies and amplitudes (en.wikipedia.org/wiki/Fourier_series) and analysis can be done separately for each sinusoid term (subject to some contstraints). – AJN Jul 5 at 8:31
• Sine DC is a signal produced by a full wave bridge rectifier without filters. – Maddy Wells Jul 5 at 9:04
• pulsed DC is what I mean That's DC + a pulsed shape signal, the pulse shaped signal has a value that varies over time and that means it is AC. DC does not vary over time. If it does, it is considered AC. – Bimpelrekkie Jul 5 at 10:19
• @Maddy, there are two ways of looking at it: (1) If we look at the overall current waveform and it varies but never changes direction then it's DC because the current is not alternating direction (and passing through zero). (2) If we consider the waveform as the sum of a DC and AC waveform we can, by definition, consider that it has an AC componenent. – Transistor Jul 5 at 11:46

## 2 Answers

If we have a DC sine signal. Can we say that capacitors and inductors have impedance despite not being AC?

When we talk about the impedance of an inductor or capacitor we are talking about one single frequency (a sine-wave) with no DC offset: -

$$|X_L| = 2\pi F L$$

And

$$|X_C| = \dfrac{1}{2\pi F C}$$

Where $$\F\$$ is a single operating frequency in hertz.

$$\color{red}{\boxed{\text{There's no room to consider DC or multiple frequencies}}}$$

And the opposite if we have an AC square signal do capacitors and inductors have impedance?

If we want to consider how the current might flow for an arbitrary voltage signal then we revert to the basic relationships: -

$$V = L\dfrac{di}{dt}$$

And

$$I = C\dfrac{dv}{dt}$$

For the inductor with a "square signal", when the voltage is +V, the current rises ($$\\frac{di}{dt}\$$) at a rate of $$\\frac{v}{L}\$$ amps per second and, when the "square signal" is -V, the current falls at a rate of $$\\frac{v}{L}\$$.

If we did the same for a capacitor, the rate of change of voltage ($$\\frac{dv}{dt}\$$) is infinite when the "square signal" switches so we get a pulse of infinite current. But we could assume that the "input" is current and that the current forms a square wave - now we'd get a very similar result for the inductor driven with a square voltage.

• "When we talk about the impedance of an inductor or capacitor we are talking about one single frequency (a sine-wave) with no DC offset:" This got me thinking, Andy. What difference does a DC offset make to the impedance of a capacitor? None, I think.The inductor case is conceptually a little more difficult as DC current will flow through it but the impedance at the AC frequency will be the same provided we haven't saturated the core of the inductor. Am I missing something in your thinking? – Transistor Jul 5 at 11:52
• there is no "basic relationship" like V = L*dI/dt. Do you mean EMF = -L*dI/dt here? – V.V.T Jul 5 at 12:28
• @Transistor no you're not missing anything - impedance is exclusively to do with sinewaves. – Andy aka Jul 5 at 12:30
• @V.V.T - what is the formula for current flow in an inductor when a fixed voltage is applied - it is this: $$V = L\dfrac{di}{dt}$$ – Andy aka Jul 5 at 12:31
• Current change in inductor produces EMF, not a voltage drop. Internal resistance does produces voltage drop across a non-ideal inductor, but it is altogether other story – V.V.T Jul 5 at 12:35

Capacitors and inductors always have impedance, at all frequencies, including 0 which is DC.

There is no DC sine. At DC, frequency is 0, so capacitor has impedance of infinity so it is an open circuit and inductance has impedance of zero so it is a short circuit. AC signal has a frequency, and ideal square wave consists of harmonic frequencies up to infinity, so yes, capacitors and inductors have impedance at all frequencies.

Recitified AC is also AC, even if it has an average DC component.


text:
# How do you simplify 7 + (53 + 6)?

Jul 3, 2016

$66$

#### Explanation:

hi u can write this as
$7 + 53 + 6 = 7 + 53 + 3 - 3 + 6$
=$7 + 56 + 3$=
=$7 \left(1 + 8\right) + 3$
=$7 \cdot 9 + 3$
=$63 + 3 = 66$

Jul 3, 2016

Use of the Associative Property gives $66$

#### Explanation:

Rather than treating this just as a plain addition, it explores one of the laws of maths: the associative property.
Regrouping can make the addition easier.

$7 + \left(53 + 6\right)$ can be written as $\left(7 + 53\right) + 6$

$= 60 + 6$

$= 66$


text:
scroll identifier for mobile
main-content

The two-volume set LNCS 8873 and 8874 constitutes the refereed proceedings of the 20th International Conference on the Theory and Applications of Cryptology and Information Security, ASIACRYPT 2014, held in Kaoshiung, Taiwan, in December 2014. The 55 revised full papers and two invited talks presented were carefully selected from 255 submissions. They are organized in topical sections on cryptology and coding theory; authenticated encryption; symmetric key cryptanalysis; side channel analysis; hyperelliptic curve cryptography; factoring and discrete log; cryptanalysis; signatures; zero knowledge; encryption schemes; outsourcing and delegation; obfuscation; homomorphic cryptography; secret sharing; block ciphers and passwords; black-box separation; composability; multi-party computation.

### Solving LPN Using Covering Codes

Abstract
We present a new algorithm for solving the LPN problem. The algorithm has a similar form as some previous methods, but includes a new key step that makes use of approximations of random words to a nearest codeword in a linear code. It outperforms previous methods for many parameter choices. In particular, we can now solve instances suggested for 80-bit security in cryptographic schemes like HB variants, LPN-C and Lapin, in less than 280 operations.
Qian Guo, Thomas Johansson, Carl Löndahl

### Algebraic Attack against Variants of McEliece with Goppa Polynomial of a Special Form

Abstract
In this paper, we present a new algebraic attack against some special cases of Wild McEliece Incognito, a generalization of the original McEliece cryptosystem. This attack does not threaten the original McEliece cryptosystem. We prove that recovering the secret key for such schemes is equivalent to solving a system of polynomial equations whose solutions have the structure of a usual vector space. Consequently, to recover a basis of this vector space, we can greatly reduce the number of variables in the corresponding algebraic system. From these solutions, we can then deduce the basis of a GRS code. Finally, the last step of the cryptanalysis of those schemes corresponds to attacking a McEliece scheme instantiated with particular GRS codes (with a polynomial relation between the support and the multipliers) which can be done in polynomial-time thanks to a variant of the Sidelnikov-Shestakov attack. For Wild McEliece & Incognito, we also show that solving the corresponding algebraic system is notably easier in the case of a non-prime base field $${\mathbb F}_q$$. To support our theoretical results, we have been able to practically break several parameters defined over a non-prime base field q ∈ {9,16,25,27, 32}, t ≤ 6, extension degrees m ∈ {2,3}, security level up to 2129 against information set decoding in few minutes or hours.
Jean-Charles Faugère, Ludovic Perret, Frédéric de Portzamparc

### Bivariate Polynomials Modulo Composites and Their Applications

Abstract
We investigate the hardness of finding solutions to bivariate polynomial congruences modulo RSA composites. We establish necessary conditions for a bivariate polynomial to be one-way, second preimage resistant, and collision resistant based on arithmetic properties of the polynomial. From these conditions we deduce a new computational assumption that implies an efficient algebraic collision-resistant hash function. We explore the assumption and relate it to known computational problems. The assumption leads to (i) a new statistically hiding commitment scheme that composes well with Pedersen commitments, (ii) a conceptually simple cryptographic accumulator, and (iii) an efficient chameleon hash function.
Dan Boneh, Henry Corrigan-Gibbs

### Cryptographic Schemes Based on the ASASA Structure: Black-Box, White-Box, and Public-Key (Extended Abstract)

Abstract
In this paper we pick up an old challenge to design public key or white-box constructions from symmetric cipher components. We design several encryption schemes based on the ASASA structure ranging from fast and generic symmetric ciphers to compact public key and white-box constructions based on generic affine transformations combined with specially designed low degree non-linear layers. While explaining our design process we show several instructive attacks on the weaker variants of our schemes.
Alex Biryukov, Charles Bouillaguet, Dmitry Khovratovich

### Beyond 2 c/2 Security in Sponge-Based Authenticated Encryption Modes

Abstract
The Sponge function is known to achieve 2 c/2 security, where c is its capacity. This bound was carried over to keyed variants of the function, such as SpongeWrap, to achieve a min {2 c/2,2 κ } security bound, with κ the key length. Similarly, many CAESAR competition submissions are designed to comply with the classical 2 c/2 security bound. We show that Sponge-based constructions for authenticated encryption can achieve the significantly higher bound of min {2 b/2,2 c ,2 κ } asymptotically, with b > c the permutation size, by proving that the CAESAR submission NORX achieves this bound. Furthermore, we show how to apply the proof to five other Sponge-based CAESAR submissions: Ascon, CBEAM/STRIBOB, ICEPOLE, Keyak, and two out of the three PRIMATEs. A direct application of the result shows that the parameter choices of these submissions are overly conservative. Simple tweaks render the schemes considerably more efficient without sacrificing security. For instance, NORX64 can increase its rate and decrease its capacity by 128 bits and Ascon-128 can encrypt three times as fast, both without affecting the security level of their underlying modes in the ideal permutation model.
Philipp Jovanovic, Atul Luykx, Bart Mennink

### How to Securely Release Unverified Plaintext in Authenticated Encryption

Abstract
Scenarios in which authenticated encryption schemes output decrypted plaintext before successful verification raise many security issues. These situations are sometimes unavoidable in practice, such as when devices have insufficient memory to store an entire plaintext, or when a decrypted plaintext needs early processing due to real-time requirements. We introduce the first formalization of the releasing unverified plaintext (RUP) setting. To achieve privacy, we propose using plaintext awareness (PA) along with IND-CPA. An authenticated encryption scheme is PA if it has a plaintext extractor, which tries to fool adversaries by mimicking the decryption oracle, without the secret key. Releasing unverified plaintext to the attacker then becomes harmless as it is infeasible to distinguish the decryption oracle from the plaintext extractor. We introduce two notions of plaintext awareness in the symmetric-key setting, PA1 and PA2, and show that they expose a new layer of security between IND-CPA and IND-CCA. To achieve integrity, INT-CTXT in the RUP setting is required, which we refer to as INT-RUP. These new security notions are compared with conventional definitions, and are used to make a classification of symmetric-key schemes in the RUP setting. Furthermore, we re-analyze existing authenticated encryption schemes, and provide solutions to fix insecure schemes.
Elena Andreeva, Andrey Bogdanov, Atul Luykx, Bart Mennink, Nicky Mouha, Kan Yasuda

### Forging Attacks on Two Authenticated Encryption Schemes COBRA and POET

Abstract
In FSE 2014, an authenticated encryption mode COBRA [4], based on pseudorandom permutation (PRP) blockcipher, and POET [3], based on Almost XOR-Universal (AXU) hash and strong pseudorandom permutation (SPRP), were proposed. Few weeks later, COBRA mode and a simple variant of the original proposal of POET (due to a forging attack [13] on the original proposal) with AES as an underlying blockcipher, were submitted to CAESAR, a competition [1] of authenticated encryption (AE). In this paper, we show a forging attack on the mode COBRA based on any n-bit blockcipher. Our attack on COBRA requires about O(n) queries with success probability of about 1/2. This disproves the claim proved in the FSE 2014 paper. We also show both privacy and forging attack on the parallel version of POET, denoted POET-m. In case of the modes POET and POE (the underlying modes for encryption), we demonstrate a distinguishing attack making only one encryption query when we instantiate the underlying AXU hash function with some other AXU hash function, namely a uniform random involution. Thus, our result violates the designer’s main claim (Theorem 8.1 in [1]). However, the attacks can not be extended to the specifications of POET submitted to the CAESAR competition.
Mridul Nandi

### Low Probability Differentials and the Cryptanalysis of Full-Round CLEFIA-128

Abstract
So far, low probability differentials for the key schedule of block ciphers have been used as a straightforward proof of security against related-key differential analysis. To achieve resistance, it is believed that for cipher with k-bit key it suffices the upper bound on the probability to be 2− k . Surprisingly, we show that this reasonable assumption is incorrect, and the probability should be (much) lower than 2− k . Our counter example is a related-key differential analysis of the well established block cipher CLEFIA-128. We show that although the key schedule of CLEFIA-128 prevents differentials with a probability higher than 2− 128, the linear part of the key schedule that produces the round keys, and the Feistel structure of the cipher, allow to exploit particularly chosen differentials with a probability as low as 2− 128. CLEFIA-128 has 214 such differentials, which translate to 214 pairs of weak keys. The probability of each differential is too low, but the weak keys have a special structure which allows with a divide-and-conquer approach to gain an advantage of 27 over generic analysis. We exploit the advantage and give a membership test for the weak-key class and provide analysis of the hashing modes. The proposed analysis has been tested with computer experiments on small-scale variants of CLEFIA-128. Our results do not threaten the practical use of CLEFIA.
Sareh Emami, San Ling, Ivica Nikolić, Josef Pieprzyk, Huaxiong Wang

### Automatic Security Evaluation and (Related-key) Differential Characteristic Search: Application to SIMON, PRESENT, LBlock, DES(L) and Other Bit-Oriented Block Ciphers

Abstract
We propose two systematic methods to describe the differential property of an S-box with linear inequalities based on logical condition modelling and computational geometry respectively. In one method, inequalities are generated according to some conditional differential properties of the S-box; in the other method, inequalities are extracted from the H-representation of the convex hull of all possible differential patterns of the S-box. For the second method, we develop a greedy algorithm for selecting a given number of inequalities from the convex hull. Using these inequalities combined with Mixed-integer Linear Programming (MILP) technique, we propose an automatic method for evaluating the security of bit-oriented block ciphers against the (related-key) differential attack with several techniques for obtaining tighter security bounds, and a new tool for finding (related-key) differential characteristics automatically for bit-oriented block ciphers.
Siwei Sun, Lei Hu, Peng Wang, Kexin Qiao, Xiaoshuang Ma, Ling Song

### Scrutinizing and Improving Impossible Differential Attacks: Applications to CLEFIA, Camellia, LBlock and Simon

Abstract
Impossible differential cryptanalysis has shown to be a very powerful form of cryptanalysis against block ciphers. These attacks, even if extensively used, remain not fully understood because of their high technicality. Indeed, numerous are the applications where mistakes have been discovered or where the attacks lack optimality. This paper aims in a first step at formalizing and improving this type of attacks and in a second step at applying our work to block ciphers based on the Feistel construction. In this context, we derive generic complexity analysis formulas for mounting such attacks and develop new ideas for optimizing impossible differential cryptanalysis. These ideas include for example the testing of parts of the internal state for reducing the number of involved key bits. We also develop in a more general way the concept of using multiple differential paths, an idea introduced before in a more restrained context. These advances lead to the improvement of previous attacks against well known ciphers such as CLEFIA-128 and Camellia, while also to new attacks against 23-round LBlock and all members of the Simon family.
Christina Boura, María Naya-Plasencia, Valentin Suder

### A Simplified Representation of AES

Abstract
We show that the so-called super S-box representation of AES – that provides a simplified view of two consecutive AES rounds – can be further simplified. In the untwisted representation of AES presented here, two consecutive AES rounds are viewed as the composition of a non-linear transformation S and an affine transformation R that respectively operate on the four 32-bit columns and on the four 32-bit rows of their 128-bit input. To illustrate that this representation can be helpful for analysing the resistance of AES-like ciphers or AES-based hash functions against some structural attacks, we present some improvements of the known-key distinguisher for the 7-round variant of AES presented by Knudsen and Rijmen at ASIACRYPT 2007. We first introduce a known-key distinguisher for the 8-round variant of AES which constructs a 264-tuple of (input,output) pairs satisfying a simple integral property. While this new 8-round known-key distinguisher is outperformed for 8 AES rounds by known-key differential distinguishers of time complexity 248 and 244 presented by Gilbert and Peyrin at FSE 2010 and Jean, Naya-Plasencia, and Peyrin at SAC 2013, we show that one can take advantage of its specific features to mount a known-key distinguisher for the 10-round AES with independent subkeys and the full AES-128. The obtained 10-round distinguisher has the same time complexity 264 as the 8-round distinguisher it is derived from, but the highlighted input-output correlation property is more intricate and therefore its impact on the security of the 10-round AES when used as a known key primitive, e.g. in a hash function construction, is questionable. The new known-key distinguishers do not affect at all the security of AES when used as a keyed primitive, for instance for encryption or message authentication purposes.
Henri Gilbert

### Simulatable Leakage: Analysis, Pitfalls, and New Constructions

Abstract
In 2013, Standaert et al. proposed the notion of simulatable leakage to connect theoretical leakage resilience with the practice of side channel attacks. Their use of simulators, based on physical devices, to support proofs of leakage resilience allows verification of underlying assumptions: the indistinguishability game, involving real vs. simulated leakage, can be ‘played’ by an evaluator. Using a concrete, block cipher based leakage resilient PRG and high-level simulator definition (based on concatenating two partial leakage traces), they included detailed reasoning why said simulator (for AES-128) resists state-of-the-art side channel attacks.
In this paper, we demonstrate a distinguisher against their simulator and thereby falsify their hypothesis. Our distinguishing technique, which is evaluated using concrete implementations of the Standaert et al. simulator on several platforms, is based on ‘tracking’ consistency (resp. identifying simulator inconsistencies) in leakage traces by means of cross-correlation. In attempt to rescue the approach, we propose several alternative simulator definitions based on splitting traces at points of low intrinsic cross-correlation. Unfortunately, these come with significant caveats, and we conclude that the most natural way of producing simulated leakage is by using the underlying construction ‘as is’ (but with a random key).
Jake Longo, Daniel P. Martin, Elisabeth Oswald, Daniel Page, Martijin Stam, Michael J. Tunstall

### Multi-target DPA Attacks: Pushing DPA Beyond the Limits of a Desktop Computer

Abstract
Following the pioneering CRYPTO ’99 paper by Kocher et al., differential power analysis (DPA) was initially geared around low-cost computations performed using standard desktop equipment with minimal reliance on device-specific assumptions. In subsequent years, the scope was broadened by, e.g., making explicit use of (approximate) power models. An important practical incentive of so-doing is to reduce the data complexity of attacks, usually at the cost of increased computational complexity. It is this trade-off which we seek to explore in this paper. We draw together emerging ideas from several strands of the literature—high performance computing, post-side-channel global key enumeration, and effective combination of separate information sources—by way of advancing (non-profiled) ‘standard DPA’ towards a more realistic threat model in which trace acquisitions are scarce but adversaries are well resourced. Using our specially designed computing platform (including our parallel and scalable DPA implementation, which allows us to work efficiently with as many as 232 key hypotheses), we demonstrate some dramatic improvements that are possible for ‘standard DPA’ when combining DPA outcomes for several intermediate targets. Unlike most previous ‘information combining’ attempts, we are able to evidence the fact that the improvements apply even when the exact trace locations of the relevant information (i.e. the ‘interesting points’) are not known a priori but must be searched simultaneously with the correct subkey.
Luke Mather, Elisabeth Oswald, Carolyn Whitnall

### GLV/GLS Decomposition, Power Analysis, and Attacks on ECDSA Signatures with Single-Bit Nonce Bias

Abstract
The fastest implementations of elliptic curve cryptography in recent years have been achieved on curves endowed with nontrivial efficient endomorphisms, using techniques due to Gallant–Lambert–Vanstone (GLV) and Galbraith–Lin–Scott (GLS). In such implementations, a scalar multiplication [k]P is computed as a double multiplication [k 1]P + [k 2]ψ(P), for ψ an efficient endomorphism and k 1,k 2 appropriate half-size scalars. To compute a random scalar multiplication, one can either select the scalars k 1,k 2 at random, hoping that the resulting k = k 1 + k 2 λ is close to uniform, or pick a uniform k instead and decompose it as k 1 + k 2 λ afterwards. The main goal of this paper is to discuss security issues that may arise using either approach.
When k 1 and k 2 are chosen uniformly at random in $$[0,\sqrt{n})$$, n = ord(P), we provide a security proofs under mild assumptions. However, if they are chosen as random integers of $$\lfloor\frac12\log_2 n\rfloor$$ bits, the resulting k is slightly skewed, and hence not suitable for use in schemes like ECDSA. Indeed, for GLS curves, we show that this results in a bias of up to 1 bit on a suitable multiple of $$k\bmod n$$, and that this bias is practically exploitable: while lattice-based attacks cannot exploit a single bit of bias, we demonstrate that an earlier attack strategy by Bleichenbacher makes it possible. In doing so, we set a record by carrying out the first ECDSA full key recovery using a single bit of bias.
On the other hand, computing k 1 and k 2 by decomposing a uniformly random k ∈ [0,n) avoids any statistical bias, but the decomposition algorithm may leak side-channel information. Early proposed algorithms relied on lattice reduction and exhibited a significant amount of timing channel leakage. More recently, constant-time approaches have also been proposed, but we show that they are amenable to power analysis: we describe a template attack that can be combined with classical lattice-based attacks on ECDSA to achieve full key recovery on physiscal devices.
Diego F. Aranha, Pierre-Alain Fouque, Benoît Gérard, Jean-Gabriel Kammerer, Mehdi Tibouchi, Jean-Christophe Zapalowicz

### Soft Analytical Side-Channel Attacks

Abstract
In this paper, we introduce a new approach to side-channel key recovery, that combines the low time/memory complexity and noise tolerance of standard (divide and conquer) differential power analysis with the optimal data complexity of algebraic side-channel attacks. Our fundamental contribution for this purpose is to change the way of expressing the problem, from the system of equations used in algebraic attacks to a code, essentially inspired by low density parity check codes. We then show that such codes can be efficiently decoded, taking advantage of the sparsity of the information corresponding to intermediate variables in actual leakage traces. The resulting soft analytical side-channel attacks work under the same profiling assumptions as template attacks, and directly exploit the vectors of probabilities produced by these attacks. As a result, we bridge the gap between popular side-channel distinguishers based on simple statistical tests and previous approaches to analytical side-channel attacks that could only exploit hard information so far.
Nicolas Veyrat-Charvillon, Benoît Gérard, François-Xavier Standaert

### On the Enumeration of Double-Base Chains with Applications to Elliptic Curve Cryptography

Abstract
The Double-Base Number System (DBNS) uses two bases, 2 and 3, in order to represent any integer n. A Double-Base Chain (DBC) is a special case of a DBNS expansion. DBCs have been introduced to speed up the scalar multiplication [n]P on certain families of elliptic curves used in cryptography. In this context, our contributions are twofold. First, given integers n, a, and b, we outline a recursive algorithm to compute the number of different DBCs with a leading factor dividing 2 a 3 b and representing n. A simple modification of the algorithm allows to determine the number of DBCs with a specified length as well as the actual expansions. In turn, this gives rise to a method to compute an optimal DBC representing n, i.e. an expansion with minimal length. Our implementation is able to return an optimal expansion for most integers up to 260 bits in a few minutes. Second, we introduce an original and potentially more efficient approach to compute a random scalar multiplication [n]P, based on the concept of controlled DBC. Instead of generating a random integer n and then trying to find an optimal, or at least a short DBC to represent it, we propose to directly generate n as a random DBC with a chosen leading factor 2 a 3 b and length ℓ. To inform the selection of those parameters, in particular ℓ, which drives the trade-off between the efficiency and the security of the underlying cryptosystem, we enumerate the total number of DBCs having a given leading factor 2 a 3 b and a certain length ℓ. The comparison between this total number of DBCs and the total number of integers that we wish to represent a priori provides some guidance regarding the selection of suitable parameters. Experiments indicate that our new Near Optimal Controlled DBC approach provides a speedup of at least 10% with respect to the NAF for sizes from 192 to 512 bits. Computations involve elliptic curves defined over $$\mathbb{F}_p$$, using the Inverted Edwards coordinate system and state of the art scalar multiplication techniques.
Christophe Doche

### Kummer Strikes Back: New DH Speed Records

Abstract
This paper sets new speed records for high-security constant-time variable-base-point Diffie–Hellman software: 305395 Cortex-A8-slow cycles; 273349 Cortex-A8-fast cycles; 88916 Sandy Bridge cycles; 88448 Ivy Bridge cycles; 54389 Haswell cycles. There are no higher speeds in the literature for any of these platforms.
The new speeds rely on a synergy between (1) state-of-the-art formulas for genus-2 hyperelliptic curves and (2) a modern trend towards vectorization in CPUs. The paper introduces several new techniques for efficient vectorization of Kummer-surface computations.
Daniel J. Bernstein, Chitchanok Chuengsatiansup, Tanja Lange, Peter Schwabe

### Jacobian Coordinates on Genus 2 Curves

Abstract
This paper presents a new projective coordinate system and new explicit algorithms which together boost the speed of arithmetic in the divisor class group of genus 2 curves. The proposed formulas generalise the use of Jacobian coordinates on elliptic curves, and their application improves the speed of performing cryptographic scalar multiplications in Jacobians of genus 2 curves over prime fields by an approximate factor of 1.25x. For example, on a single core of an Intel Core i7-3770M (Ivy Bridge), we show that replacing the previous best formulas with our new set improves the cost of generic scalar multiplications from 243,000 to 195,000 cycles, and drops the cost of specialised GLV-style scalar multiplications from 166,000 to 129,000 cycles.
Huseyin Hisil, Craig Costello

### Mersenne Factorization Factory

Abstract
We present work in progress to completely factor seventeen Mersenne numbers using a variant of the special number field sieve where sieving on the algebraic side is shared among the numbers. It is expected that it reduces the overall factoring effort by more than 50%. As far as we know this is the first practical application of Coppersmith’s “factorization factory” idea. Most factorizations used a new double-product approach that led to additional savings in the matrix step.
Thorsten Kleinjung, Joppe W. Bos, Arjen K. Lenstra

### Improving the Polynomial time Precomputation of Frobenius Representation Discrete Logarithm Algorithms

Simplified Setting for Small Characteristic Finite Fields
Abstract
In this paper, we revisit the recent small characteristic discrete logarithm algorithms. We show that a simplified description of the algorithm, together with some additional ideas, permits to obtain an improved complexity for the polynomial time precomputation that arises during the discrete logarithm computation. With our new improvements, this is reduced to O(q 6), where q is the cardinality of the basefield we are considering. This should be compared to the best currently documented complexity for this part, namely O(q 7). With our simplified setting, the complexity of the precomputation in the general case becomes similar to the complexity known for Kummer (or twisted Kummer) extensions.
Antoine Joux, Cécile Pierrot

### Big Bias Hunting in Amazonia: Large-Scale Computation and Exploitation of RC4 Biases (Invited Paper)

Abstract
RC4 is (still) a very widely-used stream cipher. Previous work by AlFardan et al. (USENIX Security 2013) and Paterson et al. (FSE 2014) exploited the presence of biases in the RC4 keystreams to mount plaintext recovery attacks against TLS-RC4 and WPA/TKIP. We improve on the latter work by performing large-scale computations to obtain accurate estimates of the single-byte and double-byte distributions in the early portions of RC4 keystreams for the WPA/TKIP context and by then using these distributions in a novel variant of the previous plaintext recovery attacks. The distribution computations were conducted using the Amazon EC2 cloud computing infrastructure and involved the coordination of 213 hyper-threaded cores running in parallel over a period of several days. We report on our experiences of computing at this scale using commercial cloud services. We also study Microsoft’s Point-to-Point Encryption protocol and its use of RC4, showing that it is also vulnerable to our attack techniques.
Kenneth G. Paterson, Bertram Poettering, Jacob C. N. Schuldt

### Multi-user Collisions: Applications to Discrete Logarithm, Even-Mansour and PRINCE

Abstract
In this paper, we investigate the multi-user setting both in public and in secret-key cryptanalytic applications. In this setting, the adversary tries to recover keys of many users in parallel more efficiently than with classical attacks, i.e., the number of recovered keys multiplied by the time complexity to find a single key, by amortizing the cost among several users. One possible scenario is to recover a single key in a large set of users more efficiently than to recover a key in the classical model. Another possibility is, after some shared precomputation, to be able to learn individual keys very efficiently. This latter model is close to traditional time/memory tradeoff attacks with precomputation. With these goals in mind, we introduce two new algorithmic ideas to improve collision-based attacks in the multi-user setting. Both ideas are derived from the parallelizable collision search as proposed by van Oorschot and Wiener. This collision search uses precomputed chains obtained by iterating some basic function. In our cryptanalytic application, each pair of merging chains can be used to correlate the key of two distinct users. The first idea is to construct a graph, whose vertices are keys and whose edges are these correlations. When the graph becomes connected, we simultaneously recover all the keys. Thanks to random graph analysis techniques, we can show that the number of edges that are needed to make this event occurs is small enough to obtain some improved attacks. The second idea modifies the basic technique of van Oorschot and Wiener: instead of waiting for two chains to merge, we now require that they become parallel.
We first show that, using the first idea alone, we can recover the discrete logarithms of L users in a group of size N in time $$\widetilde{O}(\sqrt{NL})$$. We put these two ideas together and we show that in the multi-user Even-Mansour scheme, all the keys of L = N 1/3 users can be found with N 1/3 + ε queries for each user (where N is the domain size). Finally, we consider the PRINCE block cipher (with 128-bit keys and 64-bit blocks) and find the keys of 2 users among a set of 232 users in time 265. We also describe a new generic attack in the classical model for PRINCE.
Pierre-Alain Fouque, Antoine Joux, Chrysanthi Mavromati

### Cryptanalysis of Iterated Even-Mansour Schemes with Two Keys

Abstract
The iterated Even-Mansour (EM) scheme is a generalization of the original 1-round construction proposed in 1991, and can use one key, two keys, or completely independent keys. In this paper, we methodically analyze the security of all the possible iterated Even-Mansour schemes with two n-bit keys and up to four rounds, and show that none of them provides more than n-bit security. Our attacks are based on a new cryptanalytic technique called multibridge which splits the cipher to different parts in a novel way, such that they can be analyzed independently, exploiting its self-similarity properties. After the analysis of the parts, the key suggestions are efficiently joined using a meet-in-the-middle procedure.
As a demonstration of the multibridge technique, we devise a new attack on 4 steps of the LED-128 block cipher, reducing the time complexity of the best known attack on this scheme from 296 to 264. Furthermore, we show that our technique can be used as a generic key-recovery tool, when combined with some statistical distinguishers (like those recently constructed in reflection cryptanalysis of GOST and PRINCE).
Itai Dinur, Orr Dunkelman, Nathan Keller, Adi Shamir

### Meet-in-the-Middle Attacks on Generic Feistel Constructions

Abstract
We show key recovery attacks on generic balanced Feistel ciphers. The analysis is based on the meet-in-the-middle technique and exploits truncated differentials that are present in the ciphers due to the Feistel construction. Depending on the type of round function, we differentiate and show attacks on two types of Feistels. For the first type, which is the most general Feistel, we show a 5-round distinguisher (based on a truncated differential), which allows to launch 6-round and 10-round attacks, for single-key and double-key sizes, respectively. For the second type, we assume the round function follows the SPN structure with a linear layer P that has a maximal branch number, and based on a 7-round distinguisher, we show attacks that reach up to 14 rounds. Our attacks outperform all the known attacks for any key sizes, have been experimentally verified (implemented on a regular PC), and provide new lower bounds on the number of rounds required to achieve a practical and a secure Feistel.
Jian Guo, Jérémy Jean, Ivica Nikolić, Yu Sasaki

### XLS is Not a Strong Pseudorandom Permutation

Abstract
In FSE 2007, Ristenpart and Rogaway had described a generic method XLS to construct a length-preserving strong pseudorandom permutation (SPRP) over bit-strings of size at least n. It requires a length-preserving permutation $$\mathcal{E}$$ over all bits of size multiple of n and a blockcipher E with block size n. The SPRP security of XLS was proved from the SPRP assumptions of both $$\mathcal{E}$$ and E. In this paper we disprove the claim by demonstrating a SPRP distinguisher of XLS which makes only three queries and has distinguishing advantage about 1/2. XLS uses a multi-permutation linear function, called mix2. In this paper, we also show that if we replace mix2 by any invertible linear functions, the construction XLS still remains insecure. Thus the mode has inherit weakness.
Mridul Nandi

### Structure-Preserving Signatures on Equivalence Classes and Their Application to Anonymous Credentials

Abstract
Structure-preserving signatures are a quite recent but important building block for many cryptographic protocols. In this paper, we introduce a new type of structure-preserving signatures, which allows to sign group element vectors and to consistently randomize signatures and messages without knowledge of any secret. More precisely, we consider messages to be (representatives of) equivalence classes on vectors of group elements (coming from a single prime order group), which are determined by the mutual ratios of the discrete logarithms of the representative’s vector components. By multiplying each component with the same scalar, a different representative of the same equivalence class is obtained. We propose a definition of such a signature scheme, a security model and give an efficient construction, which is secure in the SXDH setting, where EUF-CMA security holds against generic forgers in the generic group model and the so called class hiding property holds under the DDH assumption.
As a second contribution, we use the proposed signature scheme to build an efficient multi-show attribute-based anonymous credential (ABC) system that allows to encode an arbitrary number of attributes. This is – to the best of our knowledge – the first ABC system that provides constant-size credentials and constant-size showings. To allow an efficient construction in combination with the proposed signature scheme, we also introduce a new, efficient, randomizable polynomial commitment scheme. Aside from these two building blocks, the credential system requires a very short and constant-size proof of knowledge to provide freshness in the showing protocol.
Christian Hanser, Daniel Slamanig

### On Tight Security Proofs for Schnorr Signatures

Abstract
The Schnorr signature scheme is the most efficient signature scheme based on the discrete logarithm problem and a long line of research investigates the existence of a tight security reduction for this scheme in the random oracle. Almost all recent works present lower tightness bounds and most recently Seurin (Eurocrypt 2012) showed that under certain assumptions the non-tight security proof for Schnorr signatures in the random oracle by Pointcheval and Stern (Eurocrypt 1996) is essentially optimal. All previous works in this direction rule out tight reductions from the (one-more) discrete logarithm problem. In this paper we introduce a new meta-reduction technique, which shows lower bounds for the large and very natural class of generic reductions. A generic reduction is independent of a particular representation of group elements and most reductions in state-of-the-art security proofs have this desirable property. Our approach shows unconditionally that there is no tight generic reduction from any natural computational problem Π defined over algebraic groups (including even interactive problems) to breaking Schnorr signatures, unless solving Π is easy.
Nils Fleischhacker, Tibor Jager, Dominique Schröder

### Square Span Programs with Applications to Succinct NIZK Arguments

Abstract
We propose a new characterization of NP using square span programs (SSPs). We first characterize NP as affine map constraints on small vectors. We then relate this characterization to SSPs, which are similar but simpler than Quadratic Span Programs (QSPs) and Quadratic Arithmetic Programs (QAPs) since they use a single series of polynomials rather than 2 or 3.
We use SSPs to construct succinct non-interactive zero-knowledge arguments of knowledge. For performance, our proof system is defined over Type III bilinear groups; proofs consist of just 4 group elements, verified in just 6 pairings. Concretely, using the Pinocchio libraries, we estimate that proofs will consist of 160 bytes verified in less than 6 ms.
George Danezis, Cédric Fournet, Jens Groth, Markulf Kohlweiss

### Better Zero-Knowledge Proofs for Lattice Encryption and Their Application to Group Signatures

Abstract
Lattice problems are an attractive basis for cryptographic systems because they seem to offer better security than discrete logarithm and factoring based problems. Efficient lattice-based constructions are known for signature and encryption schemes. However, the constructions known for more sophisticated schemes such as group signatures are still far from being practical. In this paper we make a number of steps towards efficient lattice-based constructions of more complex cryptographic protocols. First, we provide a more efficient way to prove knowledge of plaintexts for lattice-based encryption schemes. We then show how our new protocol can be combined with a proof of knowledge for Pedersen commitments in order to prove that the committed value is the same as the encrypted one. Finally, we make use of this to construct a new group signature scheme that is a “hybrid” in the sense that privacy holds under a lattice-based assumption while security is discrete-logarithm-based.
Fabrice Benhamouda, Jan Camenisch, Stephan Krenn, Vadim Lyubashevsky, Gregory Neven


text:
Warning

This version of the documentation is NOT an official release. You are looking at ‘latest’, which is in active and ongoing development. You can change versions on the bottom left of the screen.

sinusoidal_gamma_generator – Generates sinusoidally modulated gamma spike trains¶

Description¶

sinusoidal_gamma_generator generates sinusoidally modulated gamma spike trains. By default, each target of the generator will receive a different spike train.

The instantaneous rate of the process is given by

$f(t) = rate + amplitude \sin ( 2 \pi frequency t + phase * \pi/180 )$

Remarks¶

• The gamma generator requires 0 <= amplitude <= rate.

• The state of the generator is reset on calibration.

• The generator does not support precise spike timing.

• You can use the multimeter to sample the rate of the generator.

• The generator will create different trains if run at different temporal resolutions.

Individual spike trains vs single spike train: By default, the generator sends a different spike train to each of its targets. If /individual_spike_trains is set to false using either SetDefaults or CopyModel before a generator node is created, the generator will send the same spike train to all of its targets.

All stimulation devices share the parameters start and stop, which control the stimulation period. The property origin is a global offset that shifts the stimulation period. All three values are set as times in ms.

• For spike-emitting devices, only spikes with times t that fulfill start < t <= stop are emitted. Spikes that have timestamp of t = start are not emitted.

• For current-emitting devices, the current is activated and deactivated such that the current first affects the target dynamics during the update step (start, start+h], i.e., an effect can be recorded at the earliest at time start+h. The last interval during which the current affects the target’s dynamics is (stop-h, stop].

The property stimulus_source defaults to an empty string. It can be set to the name of a stimulation backend, in which case it will take its parameters from the configured backend instead of from the internally stored values. More details on available backends and their properties can be found in the guide to stimulating the network.

Parameters¶

label

A string (default: “”) specifying an arbitrary textual label for the device. Stimulation backends might use the label to generate device specific identifiers like filenames and such.

origin

A positive floating point number (default : 0.0) used as the reference time in ms for start and stop.

start

A positive floating point number (default: 0.0) specifying the activation time in ms, relative to origin.

stimulus_source

A string (default: “”) specifying the name of the stimulation backend from which to get the data for updating the stimulus parameters of the device. By default the device uses its internally stored parameters for updating the stimulus.

stop

A floating point number (default: infinity) specifying the deactivation time in ms, relative to origin. The value of stop must be greater than or equal to start.

rate

Mean firing rate, default: 0 spikes/s

amplitude

Firing rate modulation amplitude, default: 0 s^-1

frequency

Modulation frequency, default: 0 Hz

phase

Modulation phase in degree [0-360], default: 0

order

Gamma order (>= 1), default: 1

individual_spike_trains

See note above, default: true

Set parameters from a stimulation backend¶

The parameters in this stimulation device can be updated with input coming from a stimulation backend. The data structure used for the update holds one value for each of the parameters mentioned above. The indexing is as follows:

1. frequency

2. phase

3. order

4. rate

5. amplitude

6. individual_spike_trains

DataLoggingRequest

SpikeEvent

References¶

1

Barbieri et al. (2001). Construction and analysis of non-Poisson stimulus-response models of neural spiking activity. Journal of Neuroscience Methods, 105:25-3. DOI: https://doi.org/10.1016/S0165-0270(00)00344-7


text:
MathSciNet bibliographic data MR1116640 (92h:58159) 58F20 Baldwin, Stewart An extension of Šarkovskiĭ's theorem to the $n\text{-od}$$n\text{-od}$. Ergodic Theory Dynam. Systems 11 (1991), no. 2, 249–271. Article

For users without a MathSciNet license , Relay Station allows linking from MR numbers in online mathematical literature directly to electronic journals and original articles. Subscribers receive the added value of full MathSciNet reviews.


text:
# is.recursive

0th

Percentile

##### Is an Object Atomic or Recursive?

is.atomic returns TRUE if x is of an atomic type (or NULL) and FALSE otherwise.

is.recursive returns TRUE if x has a recursive (list-like) structure and FALSE otherwise.

Keywords
classes, programming
##### Usage
is.atomic(x)
is.recursive(x)
##### Arguments
x
object to be tested.
##### Details

is.atomic is true for the atomic types ("logical", "integer", "numeric", "complex", "character" and "raw") and NULL.

Most types of objects are regarded as recursive, except for the atomic types, NULL and symbols (as given by as.name). It is common to call the atomic types ‘atomic vectors’, but note that is.vector imposes further restrictions: an object can be atomic but not a vector (in that sense).

These are primitive functions.

##### References

Becker, R. A., Chambers, J. M. and Wilks, A. R. (1988) The New S Language. Wadsworth & Brooks/Cole.

is.list, is.language, etc, and the demo("is.things").
library(base) require(stats) is.a.r <- function(x) c(is.atomic(x), is.recursive(x)) is.a.r(c(a = 1, b = 3)) # TRUE FALSE is.a.r(list()) # FALSE TRUE - a list is a list is.a.r(list(2)) # FALSE TRUE is.a.r(lm) # FALSE TRUE is.a.r(y ~ x) # FALSE TRUE is.a.r(expression(x+1)) # FALSE TRUE (nowadays)