text:
# Techniques for efficient post-quantum finance (Part 1: digital signatures)

The first part of a series for developing efficient post-quantum finance in an adversarial world. In this article, we look at how to efficiently implement lattice-based digital signature schemes. We show how they can be made more efficient with sparse keys, and link to a python package that employs these signatures.

14th April 2022

This is the first article in a multipart series from The QRL Foundation and Geometry Labs exploring various methods for constructing scalable post-quantum cryptographic primitives and protocols.

Here in part one, we describe a lattice-based one-time signature scheme similar to the one published by Lyubashevsky and Micciancio. Since our scheme also has some similarities to CRYSTALS-Dilithium (a NIST post-quantum standardization candidate), there are general applications for our discussion below regarding optimizations for smaller keys and signatures in the lattice setting.

In the next article, we show how to extend this to Boneh and Kim style signature aggregation, as a potential method for reducing the on-chain footprint for proof-of-stake consensus with many validators. The following article describes our novel one-time adaptor signature scheme, designed to enable payment channels and decentralized trustless cross-chain atomic swaps (inspired by the work of Esgin, Ersoy, and Erkin).

The articles in this series describe the applications and security models; additionally, open-source python implementations of the cryptography are freely available via GitHub and PyPI (pip install lattice-cryptography), built with the lattice-algebra library described in a previous QRL blog post.

In the final part, we describe a blockchain-agnostic approach for reducing local storage requirements for network participants while keeping bootstrapping costs low.

Note: While some effort has gone into making everything understandable, the intended audience for this article series are systems integrators and students in cryptography. In order to help aid in understanding, we’ve added a further reading and materials section and will have an open AMA form for the duration of this “Techniques for post-quantum finance” series to ask any questions that may arise, both technical and non-technical. These writeups are intended to be informational, and the schemes described for illustration are not formal secure specifications.

## Part One: Lattice-Based Digital Signatures

To set the stage for discussing one-time signatures, let us first introduce the general concept of a cryptographic signature.

### Primer on Digital Signatures

A digital signature scheme refers to a tuple of algorithms (Setup, Keygen, Sign, Verify) which informally work as follows.

1. $\texttt{Setup}(\lambda) \to \rho$. Input a security parameter $\lambda$, typically indicating the number of bits of security, and outputs some public parameters, $\rho$. Typically, $\rho$ contains a description of a secret signing key set, $K_S$, a public verification key set, $K_V$, a message set $M$, and a signature set $S$. $\texttt{Setup}$ is usually run by all parties before participating. The input and output of $\texttt{Setup}$ are both public.
2. $\texttt{Keygen}(\lambda, \rho) \to (sk, vk)$. Input $(\lambda, \rho)$ and output a new random keypair $(sk, vk) \in K_S \times K_V$, where $sk$ is a secret signing key and $vk$ is the corresponding public verification key.
3. $\texttt{Sign}(\lambda, \rho, (sk, vk), \mu) \to \xi$. Input $(\lambda, \rho, (sk, vk), \mu)$ where $\mu \in M$ is a message, and outputs a signature, $\xi \in S$.
4. $\texttt{Verify}(\lambda, \rho, vk, \mu, \xi) \to b \in \left\{0, 1\right\}$. Output a bit $b$ indicating whether the signature is a valid signature on the message $\mu$ with the public verification key $vk$.

Since $\lambda$ and $\rho$ (the input and output of $\texttt{Setup}$, respectively) are shared parameters known by all participants, we will omit them as inputs below for readibility. Also, we assume that the message set $M$ is the set of all $k$-length bit strings, $M = \left\{0,1\right\}^k$ where $k$ is an (integral valued) function of $\lambda$.

Such a scheme is only secure if properly configured with appropriate parameters to achieve some desired security level. For illustration, consider a scheme where the output of $\texttt{Sign}$ is only 2 bits; it would take at most 4 tries to forge any signature! Or consider the situation if $\texttt{Verify}$ was a function that returns $1$ for most combinations of inputs; a high false positive rate for verification would be quite undesirable. These extreme examples show that both the functions and their parameters must be carefully selected. Formalizing this leads us to the notion of the security properties of digital signatures.

### Security Properties: Correctness

Loosely, we say a signature scheme is “correct” whenever, for any message $\mu \in M$, and for any pair $(sk, vk)$ that is output from $\texttt{Keygen}$, it is the case that $\texttt{Verify}(vk, \mu, \texttt{Sign}((sk, vk), \mu)) = 1$. Correctness here is in analogy to soundness in zero-knowledge protocols. When considering security properties, it is often helpful to ask “what does it mean for a scheme to satisfy the negation of this property?”

For example, the negation of the correctness definition is as follows: there exists a message $\mu$ and a keypair $(sk, vk)$ that is output from $\texttt{Keygen}$ such that $\texttt{Verify}(vk, \mu, \texttt{Sign}((sk, vk), \mu)) = 0$. In this case, a scheme that does not satisfy the correctness property is not guaranteed to even produce signatures that pass verification!

### Security Properties: Unforgeability

Now consider what it means for a signature scheme to be secure; more precisely, consider the notion of unforgeability. If Alice attempts to forge a usual digital signature without knowing Bob’s key, we can formalize this situation in a three-step process.

1. First, Alice and Bob agree upon input and output of $\texttt{Setup}$. This models the real-life situation where $\lambda$ and $\rho$ are agreed-upon parameters that have been publicly audited and cryptanalyzed (e.g. by the NIST post-quantum signature vetting process).
2. Next, Bob runs $\texttt{Keygen}$ to obtain some challenge keys $(sk, vk)$. Bob sends $vk$ to Alice.
3. Lastly, Alice attempts to output some message-signature pair $(\mu, \xi)$. Alice’s forgery is successful if $\texttt{Verify}(vk, \mu, \xi) = 1$.

The idea behind unforgeability is that any algorithm “Alice” should fail at this game except with negligible probability.

There are two main things to note about this game. First, of course, the game is easy if Bob gives away his signing key ($sk$) to Alice, so it is critical that Alice learns no information about $sk$ in the course of the game in order for the result to be considered a successful forgery. Second, the game fails to capture the real-life situation where Alice may have seen signatures published under Bob’s key before, perhaps posted on some public bulletin board. Thus, Alice is often granted the benefit of the doubt and is given access to a signature oracle. This allows her to obtain a signature from Bob’s key on any message she likes, and also models the real-life situation where Alice may be able to coerce or trick Bob into signing a message that Alice has selected. However, in this case, Alice certainly should not be allowed to win the game by passing off an oracle-generated signature as a forgery. Moreover, Alice generally only cares about forging signatures for which she does not already have a signature. Hence, Alice is generally not interested in winning the game even by re-using any of the messages that have already been signed by the oracle.

This leads us to the following description of the existential unforgeability experiment. First, Alice and Bob agree upon the input and output of $\texttt{Setup}$. Next, Bob generates $(sk, vk)$ from $\texttt{Keygen}$ and sends $vk$ to Alice. Next, Bob grants Alice signature oracle access where she can query the oracle with any message $\mu$ and obtain asignature $\xi$ such that $\texttt{Verify}(vk, \mu, \xi) = 1$, in any order she likes, and she can adaptively select $\mu$ based on previous oracle responses. Eventually, Alice outputs a message-signature pair $(\mu^\prime, \xi^\prime)$, succeeding if and only if the signing oracle was not queried with $\mu$ and $\texttt{Verify}(vk, \mu^\prime, \xi^\prime) = 1$. This is visualized in the following diagram.

We then informally define a scheme to be existentially unforgeable if, for any algorithm “Alice”, the probability that Alice succeeds at this experiment is negligible. This is modeled by the Existential Unforgeability against Chosen Message Attack (EUF-CMA) security property, illustrated below.

As before, let us consider what it means to negate the definition of existential unforgeability. Then there exists an algorithm “Alice” that has a non-negligible probability of winning this game. This means that Alice, with no information about Bob’s $sk$ but perhaps with the ability to persuade Bob to publish some signatures on messages of Alice’s choice, can nevertheless produce a new forgery on a message Bob has never seen before.

Of course, we can expand this game to include more challenge keys; Bob could say “here are several of my verification keys, I challenge you to construct a valid signature on any one of them.” However, the number of keys provided to Alice is always polynomially bounded in $\lambda$, and thus Alice can at best polynomially improve her probability of success. In particular, if we can assume that Alice succeeds with only negligible probability in the one-key case, then Alice still can only succeed with negligible probability in the case that she is given a polynomial number of challenge keys, so it is not necessary to further consider this generalization.

### Variations: One-Time Signature Schemes

A one-time signature scheme is just a digital signature scheme, even with the same definition of correctness, but with a different definition of unforgeability. In one-time schemes, producing more than one signature from the same key can reveal that key to other users, so it is only ever safe to publish one signature from any key; this makes one-time signatures particularly useful in constructing transaction protocols, as we shall see. However, this also means that our definition of existential unforgeability is no longer suitable. After all, in that definition, Alice can request many signatures from the signing oracle. To rectify this, the definition of the one-time existential unforgeability experiment is nearly identical to the existential unforgeability experiment, except Alice is only granted one oracle query.

### Building Simple Signature Schemes

One-time signature schemes are oftentimes very simple to describe and implement, which leads to straightforward proofs of security properties and mistake-resistant code. In the following examples, we show a case from classically secure cryptography and a similar case from quantum-resistant cryptography. As we can see from the descriptions below, the schemes are quite simple, so implementing them requires navigating fewer pitfalls than implementing more complex signature schemes.

#### Example: A Schnorr-Like One-Time Signature Scheme

In this section, we describe a Schnorr-like signature scheme in the elliptic curve setting. Let $\mathbb{G}$ be an elliptic curve group, written additively, with prime order $p$, and let $G$ be generator, and let $F:\left\{0,1\right\}^* \to \mathbb{Z}/p\mathbb{Z}$ be a hash function modeled as a random oracle. The following defines a one-time signature scheme that satisfies one-time existential unforgeability.

1. $\texttt{Setup}(\lambda) \rightarrow \rho$. Set $\rho = (\mathbb{G}, p, G, F)$.
2. $\texttt{Keygen} \rightarrow (sk, vk)$. Sample $x, y \in \mathbb{Z}/p\mathbb{Z}$ independently and uniformly at random, set $X := xG$, $Y := yG$, $sk := (x, y)$, and $vk := (X, Y)$. Output $(sk, vk)$.
3. $\texttt{Sign}((sk, vk), \mu) \rightarrow \xi$. Compute $c = F(vk, \mu)$, parse $(x, y) \leftarrow sk$, set $\xi := x \cdot c + y (\text{mod}, p)$, and output $\xi$.
4. $\texttt{Verify}(vk, \mu, \xi) \rightarrow b$. Check that $\xi$ can be interpreted as an element of $\mathbb{Z}/p\mathbb{Z}$, compute $c = F(vk, \mu)$, and output $1$ if and only if $\xi G = c X + Y$.

The scheme is correct. Indeed, if $x, y, c \in \mathbb{Z}/p\mathbb{Z}$ (which is a field, and thus closed under addition and multiplication), then so is $x \cdot c + y$. Consider a semi-honest actor, who follows the alogrithms above, but may execute additional computations as well. So a signature $\xi$ computed this way is an integer modulo $p$ since $x$, $c$, and $y$ are integers modulo $p$. Also, since $\texttt{Sign}((sk, vk), m) = x \cdot c + y$, we have that $(x \cdot c + y)G = c \cdot X + Y$. The scheme can also be shown to be unforgeable, by giving Alice only one oracle signature $\xi_0$ and showing that if Alice can produce a forgery, then Alice can also break the discrete logarithm assumption. Indeed, if Alice can produce $\xi$ that satisfies the game, and receives an oracle-generated signature $\xi_0$, then Alice can compute $\xi - \xi_0$ easily and solve backward for $x$ and $y$. We note that in a one-time signature scheme, producing a forgery is equivalent to breaking a public verification key, because producing the forgery is enough together with the one-time oracle signature, to back-compute the keys. This is, in fact, a common property of one-time signature schemes: publish two signatures and you give away your private key. Bellare and Shoup prove that this one-time signature scheme is unforgeable up to the the one-more discrete-log assumption (see [4]). At the end, she will have successfully gained enough information to easily compute the discrete logarithm of $X$. Since computing discrete logarithms is hard with classical computers, we conclude that classical forgers do not exist (or succeed with very low probability, or take a very long time to finish their tasks).

#### Example: Extending this Schnorr-Like Approach to the Lattice Setting

We can swap out the fundamental hardness assumption above with a different hardness assumption to get a different scheme; using a related approach, Lyubashevsky and Micciancio first proposed signatures designed (mostly) this way in [1]. In a lattice setting, we ditch the elliptic curve group in favor of lattices induced by rings of integers and their ideals. Let $\mathbb{Z}/q\mathbb{Z}$ be the integers modulo $q$ for a prime modulus $q$, let $d$ be a power-of-two integer, let $\ell$ be a natural number, let $R = \mathbb{Z}\left[X\right]/(X^d + 1)$ be a quotient ring of integer-coefficient polynomials, let $R_q$ be the quotient ring $R/qR$, let $V = R^\ell$ be the freely-generated $R$-module with length/dimension/rank $\ell$, and let $V_q = R_q^\ell$ be the freely-generated $R_q$-module with length $\ell$. Note that $V$ is a $\mathbb{Z}$-module and $V_\mathfrak{q}$ is a $\mathbb{Z}_q$-module, both with dimension $d\cdot\ell$. Elements $f(X) \in R$ have an infinity norm; if $f(X) = f_0 + f_1 X + … + f_{d-1} X^{d-1}$, then $\|f\|_\infty = \max(|f_i|)$. This definition extends to $V$, which is convenient.

We can similarly extend this definition to $R_q$ and $V_q$, but at a cost. The cost we pay is in absolute homogeneity. In a vector space $U$ over a field $F$, for any scalar $c \in F$ and any vector $u \in U$, absolute homogeneity is the property that $\|c \cdot u\| = |c| \|u\|$, where $|c|$ is computed by lifting $c$ from $F$ to $\mathbb{C}$, the complex numbers. If we carry our definition of $\|\cdot\|_{\infty}$ from $R$ to $R_q$, or from $V$ to $V_q$, we cannot use this statement to conclude anything about the norm of $c \cdot u$ when $c\in$ $R$ or $R_q$ (except in the special cases that $c \in \mathbb{Z}/q\mathbb{Z}$).

In fact, absolute homogeneity is relaxed in $R$ and $R_q$, and we end up with a norm-like function with absolute subhomogeneity: $\| c \cdot u\| \leq d \cdot |c| \|u\|$.

For lack of a better term, we shall call such functions subhomogeneous norms, and if $T$ is a space that admits a sub-homogeneous norm, we shall call $T$ a subhomogeneously normed space.

In the following, we describe a scheme sketched by Boneh and Kim in [4] which is inspired by the scheme from Lyubashevsky and Micciancio in [1]. Let $\beta_{sk}$, $\beta_{ch}$, $\beta_v \in \mathbb{N}$. For any subset $T$ of any subhomogeneously normed space, let $B(T, \beta) = \{t \in T \mid \|t\|_{\infty} \leq \beta\}$. Again let $F$ be a hash function modeled as a random oracle, but this time, let $F:\left\{0,1\right\}^* \to B( R_q, \beta_{ch})$.

1. $\texttt{Setup}(\lambda) \rightarrow \rho$. Compute $d, q, l, k, \beta_{sk}, \beta_{ch}, \beta_v$ from $\lambda$, sample $\underline{a}$ from $V_q$ uniformly at random, and output $\rho = (d, q, l, F, k, \beta_{sk}, \beta_{ch}, \beta_v, \underline{a})$. The signing key set is $K_S = B(V_q, \beta_{sk}) \times B(V_q, \beta_{sk})$, the verification key set is $K_V = R_q \times R_q$, the message set is length $k$ bit strings $M = \left\{0, 1\right\}^k$, and the signature set is $S = B(V_q, \beta_v)$.
2. $\texttt{Keygen} \rightarrow (sk, vk)$. Sample $\underline{x}, \underline{y}$ uniformly at random and independently from $B(V_q, \beta_{sk})$. Set $sk = (\underline{x}, \underline{y})$. Define $X = \langle \underline{a}, \underline{x}\rangle$ and $Y = \langle \underline{a}, \underline{y}\rangle$ and set $vk = (X, Y)$. Output $(sk, vk)$.
3. $\texttt{Sign}((sk, vk), \mu) \rightarrow \xi$. Compute $c = F(vk, \mu)$ and output $\xi = \underline{x} \cdot c + \underline{y}$ where $\cdot$ here denotes scaling the polynomial vector $\underline{x} \in B(Vq, \beta_{sk})$ with the polynomial $c \in B(R_q, \beta_{ch})$.
4. $\texttt{Verify}(vk, \mu, \xi) \rightarrow b$. Check that $\xi$ is an element of $B(Vq, \beta_v)$, compute $c = F(vk, \mu)$, and output $1$ if and only if $\langle \underline{a}, \xi\rangle = X \cdot c + Y$.

We note that an honestly computed signature $\xi = \underline{x} c + \underline{y}$, and $|\xi| \leq \beta_{sk}(1 + d\beta_{ch})$. Hence, if $\beta_{sk}(1+d\beta_{ch}) \leq \beta_{vf}$, then the scheme is correct. Similarly to the previous scheme, this scheme can be proven unforgeable (see [1] and [4]).

### Optimizing One-Time Lattice-Based Signatures

The security properties for lattice-based schemes often are based on requiring that public keys are covered by a sufficiently dense set of private keys. This ensures that the short solution $\underline{t}$ to the Ring Short Integer Solution problem is non-zero at least half the time. However, direct implementations of these schemes often lead to unnecessarily dense key coverage.

For example, consider the requirement that a uniformly sampled element from the domain of the maps which carry the secret keys $(\underline{x}, \underline{y})$ to the public keys and a signature $(X, Y, \xi)$ always has a distinct second pre-image $(\underline{x}^\prime, \underline{y}^\prime)$. What sort of requirements does this place on the system parameters? Well, for any function $f: A \to B$, at most $|B|$ elements map uniquely under $f$.

Hence, if an element $a$ is sampled from $A$ uniformly at random, then there is a probability at most $|B|/|A|$ that $f( a)$ has no other pre-images $a^\prime$. To ensure this probability is less than $2^{-\lambda}$, we require that $|B| \cdot 2 ^ \lambda < |A|$.

The domain of our map is pairs of elements from $B(V_q, \beta_{sk})$. Thus, the size of the domain is the square of the size of $B(V_q, \beta_{sk})$. Moreover, an element of $B(V_q, \beta_{sk})$ is an $\ell$-vector of polynomials whose coefficients are absolutely bounded by $\beta_{sk}$, which means all coefficients are in the list $\{-\beta_{sk}, -\beta_{sk} + 1, …, \beta_{sk} - 1, \beta_{sk}\}$, which clearly has $2 \beta_{sk} + 1$ elements in it. All such vectors are allowable, each has exactly $\ell$ coordinates, and each of those has exactly $d$ coefficients. There are necessarily $(2\beta_{sk} + 1)^{\ell d}$ such vectors, so there are $(2\beta_{sk}+ 1)^{2\ell d}$ elements in the domain of our map.

On the other hand, the codomain of our map is tuples containing pairs of public keys and signatures. Each public key is a polynomial in $R_q$, and may be unbounded. So we have $q^{2d}$ possible public verification keys. On the other hand, the signature is a polynomial vector with coefficients absolutely bounded by $\beta_{v}$. Hence, we have $(2 \beta_ {v}+1)^{\ell d}$ possible signatures. In particular, we have $q^{2d} \cdot (2\cdot\beta_{v} + 1)^{\ell d}$ elements in the codomain. So one requirement for security is that $\frac{(2\beta_{sk}+1)^{2\ell d}}{q^{2d} (2\beta_{v} + 1)^{\ell d}} > 2^\lambda$.

Now, on the other hand, we may be able to use sparse keys in order to make this inequality easier to satisfy. This technique is referred to in the CRYSTALS-Dilithium documentation as “hashing to a ball.” In particular, we can consider a variation of the Schnorr-Like approach to the lattice setting wherein private keys are not just polynomial vectors whose infinity norms are bounded by $\beta_{sk}$, but whose Hamming weights are also bounded by some $1 \leq \omega_{sk} \leq d$. We can similarly put a bound on the Hamming weight (the number of nonzero coefficients) of the signature challenge $c$ by some $1 \leq \omega_{ch} \leq d$, and we will consequently be bounding the Hamming weight of signatures by some $1 \leq \omega_ {v} \leq d$. In this case, our inequality constraint changes to become a significantly more complicated inequality involving binomial coefficient computations, which we omit for the sake of readability. If we carefully select $\omega_ {sk}$, $\omega_{ch}$, and $\omega_{v}$, the above bound can be tightened or loosened. Using this technique, we can describe signatures and keys with less space than otherwise. For example, if $\omega_{v} = d/8$ and $d = 512$, then we can save at least $134$ bits per signature with efficient encoding of the signature. However, this choice may make the inequality in question harder to satisfy (recall that the inequality in question guarantees second pre-images occur often enough).

### Transaction Protocols And Usual Digital Signatures

For the purposes of this discussion, a transaction is a tuple (I, O, FEE, MEMO, AUTH) where I is a set of input keys, O is a set of output keys, FEE is a positive plaintext fee, AUTH is an authentication of some sort, and MEMO is an optional memo field. The transaction can be seen as consuming the input keys and creating new output keys; in fact, every input key in a transaction must be an output key from an old transaction, and whether a key is an input or an output key is therefore highly contextual. The outputs are injected into the system via work or stake rewards, which allow users to authorize special negative-fee transactions. Users broadcast these transactions on any network however they agree upon, validators assemble valid transactions into valid blocks with whatever block puzzles they agree upon, and they order these blocks into a sensible linear transaction history using whatever consensus mechanism they agree upon.

A transaction protocol can be built using a public bulletin board (upon which transactions are posted), together with some sort of map or lookup called AMOUNT that maps outputs to plaintext transaction amounts. A transaction posted on the bulletin board is considered valid if every input reference points to a valid transaction, the signatures in the authentication AUTH are valid, and AMOUNT(I) - AMOUNT(O) - FEE = 0. Obviously this leads to a regression of valid transactions, which must terminate at some sort of root transaction.

These root transactions are known as base transactions or coinbase transactions. Base transactions are special transactions that (i) include a block puzzle solution in AUTH and (ii) have a deterministically computed FEE < 0, called the block reward. In a proof-of-work cryptocurrency, the block puzzle solution is often the input to a hash function that produces a sufficiently unlikely output. In a proof-of-stake cryptocurrency, this block puzzle solution is a signature by validators that have been decided upon in advance somehow.

From this point of view, then, to describe a transaction protocol is to (i) describe the structure of (I, O, FEE, MEMO, AUTH), (ii) describe AMOUNT, (iii) decide upon a block puzzle solution method for the protocol, and (iv) decide upon a deterministically computed block reward.

Generally I can be lazily described using any unambiguous reference to a set of outputs from the transaction history, such as a list of block height-transaction index-output index triples, and FEE is a plaintext amount in every transaction. We can allow any bitstring memorandum message, but we prepend any user-selected memorandum with a bitstring representation of the tuple (I, O, FEE). In practice, AUTH generally consists of a multi-signature with the keys described in $I$ on the pre-pended memorandum message.

We need to stash into each output both a verification key from some unforgeable signature scheme and also some way of measuring amounts. We can accomplish this with no privacy whatsoever by making an output key of the form $(vk, \alpha)$ where $\alpha$ is a plaintext amount and $vk$ is a public verification key from the underlying signature scheme. In this case, the AMOUNT function merely forgets the verification key $vk$ and outputs $\alpha$.

To summarize, using an unforgeable signature scheme as a sub-scheme, we use the following structure of general transactions for a transparent cryptocurrency.

1. The list of inputs I in a transaction consist of triples of the form (block_hash, transaction_id, output_index). Any validator with a block referenced by this transaction can easily look up an old output key from an old transaction in their ledger this way. This is assumed to be ordered in a canonical way.
2. The list of new outputs O consists of verification key-amount pairs $(vk, \alpha)$ where $vk$ is a verification key from the sub-scheme and $\alpha$ is a positive plaintext amount. This is assumed to be ordered in a canonical way. Thus, each (block_hash, transaction_id, output_index) refers to an output key $(vk, amt)$ in the validator’s local copy of the blockchain.
3. The fee FEE is a user-selected positive amount.
4. The memo MEMO is a user-selected bitstring.
5. The authentication AUTH consists of a multi-signature on the message MSG = I || O || FEE || MEMO where || denotes concatenation, signed by the inputs, i.e. the keys found at the input references.

Recalling that concatenating usual digital signatures together is a trivial way of making a multi-signature scheme, we see that we can simply stack signatures to accomplish this protocol. This way, anyone with the secret signing keys $sk_ {old}$ associated to an output verification key $vk_{old}$ in some old valid transaction can construct a new valid transaction sent to any target verification key $vk_{new}$ by simply signing the zero bit and setting the amounts.

However, this approach re-uses the verification keys of a user, so this approach does not carry over directly to one-time signature schemes. This is easily rectified, as we see in the next section.

### Transaction Protocols And One-Time Signatures

We can use one-time signatures in a transaction protocol to introduce a degree of unlinkability, if we like, but we need some sort of key exchange. This way, we can ensure that the recipient can extract the new one-time signing keys associated with their new outputs, whilst ensuring that the sender cannot extract that key. We can introduce auditor-friendly unlinkability by introducing one-time keys and using CryptoNote-style view keys.

#### Example: Monero/CryptoNote-Style One-Time Keys

CryptoNote used the computational Diffie-Hellman assumption and hash functions in order to construct one-time keys from many-time wallet keys. We show how this key exchange can be used to develop an amount-transparent and non-sender-ambiguous version of CryptoNote that is nevertheless unlinkable and auditor-friendly.

In the following, let $(\mathbb{G}, p, G, F)$ be the group parameters from our Schnorr-like example of one-time signatures.

1. In a setup phase, users agree upon $(\mathbb{G}, p, G, F)$, and another hash function $H:\left\{0,1\right\}^* \to \mathbb{Z}/p\mathbb{Z}$.
2. Users select many-time wallet keys by sampling $a, b \in \mathbb{Z}/p\mathbb{Z}$ independently and uniformly at random. Users set $A = aG$, $B = bG$, $sk = (a, b)$, and $vk = (A, B)$. Users then broadcast $vk$.
3. An output is a tuple $(R, P, \alpha)$ where $R$ and $P$ are group elements and $\alpha$ is a plaintext amount.
4. To send an amount $\alpha$ to another user with some $vk = (A, B)$, a new output $(R, P, \alpha)$ is constructed in the following way. First, we sample a new random $r \in \mathbb{Z}/p\mathbb{Z}$ independent of all previous samples and uniformly at random, and we set $R = rG$. Next, we use $r$ and the recipient $A$ to compute the Diffie-Hellman shared secret $rA = aR$. We hash this with $H$ and compute $P = H(rA)G + B$.
5. A user can easily determine if a new output $(R, P, \alpha)$ is addressed to their own $vk$ by checking if $P = H(aR) G + B$.
6. To send an old output $(R, P, \alpha)$, the amounts must balance and the sender must include a signature on the key $P$ in their authentication.

Under the Computational Diffie-Hellman assumption, only the recipient (owner of $a$) and the sender (who knows $r$) can compute $rA = aR$, so only the sender and the recipient can link the output $(R, P, \alpha)$ with the wallet keys $(A, B)$. This leads to one-time keys in the sense that only one signature ever needs to be posted in order for a transaction to be considered valid and complete. However, depending on the properties of the underlying signature scheme, it may or may not be safe to publish more than one signature from a key $P$. Moreover, the privacy gained from such an approach is rather minimal, as the one-time addresses can easily be probabilistically linked with one another by a studious third party. Note that to determine whether a transaction is addressed to $(A, B)$, the recipient only need the private key $a$, which is why we call it a view key. On the other hand, we call $b$ a spend key because we need it to construct new transactions.

The overall approach itself is a rather inelegant instantiation of a key encapsulation mechanism, and the one-time-ness of the protocol can be a “soft” one-time-ness. By using a proper key encapsulation mechanism and one-time signatures, we can make this a bit of a tighter ship.

#### A Brief Aside: Key Encapsulation Mechanisms

A key encapsulation mechanism (KEM) is a tuple of algorithms $(\texttt{Setup}, \texttt{Keygen}, \texttt{Enc},\texttt{Dec})$ which work as follows.

1. $\texttt{Setup}(\lambda) \to \rho$ inputs a security parameter $\lambda$ and outputs some public parameters $\rho$.
2. $\texttt{Keygen} \to (sk, pk)$. Output a new secret-public keypair $(sk, pk)$.
3. $\texttt{Enc}(pk) \to (c, ek)$. Input a public key $pk$ and output a ciphertext $c$ and a bitstring $ek$ we call an ephemeral key.
4. $\texttt{Dec}(sk, c) \to \left\{ek, \bot\right\}$. Inputs a secret key $sk$ and a ciphertext $c$, and outputs a bitstring $ek$ or a distinguished failure symbol $\bot$.

Setting aside the security properties of a key encapsulation mechanism (that’s a different article!), the rough ideahere is to compute $(c, ek) \leftarrow \texttt{Enc}(pk)$ and use $ek$ as a symmetric key to encrypt a message $\mu$,resulting in another ciphertext $d$. You then send $(c, d)$ to the owner of $pk$, who can use their $sk$ to compute $ek\leftarrow \texttt{Dec}(sk, c)$, and then use $ek$ to decrypt $d$ to obtain $\mu$.

#### Example: Extending to Lattice-Based One-Time Keys

In the following, let $(d, q, l, k, F, \beta_{sk}, \beta_{ch}, \beta_{v}, \underline{a})$ be output from $Setup$ in the Schnorr-like approach to the lattice setting, let $\beta_t$ be some natural number, let $H_0, H_1:\left\{0, 1\right\}^* \to B(V_q, \beta_t)$ and let $(KEM.Setup, KEM.Keygen, KEM.Enc, KEM.Dec)$ be a secure KEM.

1. In a setup phase, users agree upon all the above parameters, hash functions, and so on.
2. Users select many-time wallet keys $(sk, vk)$ in the following way. To sample $sk$, the user computes $(KEM.sk,KEM.pk) <- KEM.Keygen$, samples a new random $x_0, x_1$ uniformly at random from $B(V_q, \beta_{sk})$, computes $X_0= \langle \underline{a}_0, \underline{x}_0\rangle$, $X_1 = \langle \underline{a}_0, \underline{x}_1\rangle$ and sets$sk = (KEM.sk, x_0, x_1)$. They then use $vk = (KEM.vk, X_0, X_1)$.
3. An output is a tuple $(c, h_0, h_1, \alpha, \pi)$ where $c$ is a ciphertext from the KEM, $h$ and $g$ arepolynomials, $\alpha \in \mathbb{N}$ is a plaintext amount, and $\pi$ is a zero-knowledge proof of knowledge (ZKPOK).We will elaborate on this proof of knowledge in a moment.
4. An authorization to send an output is just a one-time signature using $vk = (h_0, h_1)$.
5. To send an amount $\alpha$ to another user with some $vk = (KEM.pk, X_0, X_1)$, a new output $(c, h_0, h_1, \alpha, \pi)$ is constructed in the following way. First, we encapsulate a new ephemeral key for $KEM.pk$ by computing $(c, ek) <- KEM.Enc(KEM.pk)$. Next, we compute $\underline{b}_0 = H_0(ek)$ and $\underline{b}_1 = H_1(ek)$ and set $h_i = X_i + \langle \underline{a}, \underline{b}_i\rangle$ for $i=0, 1$. Next, we compute a ZKPOK $\pi$. The sender can publish $(c, h_0, h_1, \alpha, \pi)$.
6. Upon hearing of a new transaction, a user can easily determine if a new output $(c, h_0, h_1, \alpha, \pi)$ is addressed to their own $vk$ by checking if $KEM.Dec(KEM.sk, c) != FAIL$, can manually check the plaintext amounts to verify that no money was created or destroyed. To obtain the signing keys corresponding to the public verification key $vk = (h_0, h_1)$, the user takes their $KEM.sk$, decapsulates $c$ to obtain $ek$, computes $\underline{b}_i = H_i(c, ek)$, and then computes $\underline{z}_i = \underline{x}_i + \underline{b}_i$. The user then verifies that $h_i = \langle \underline{a}, \underline{z}_i \rangle$ for both $i=0, 1$.

Of course, the recipient can be assured that the extracted keys $(\underline{z}_0, \underline{z}_1)$ will work by checking the ZKPOK $\pi$. In particular, the ZKPOK $\pi$ in the output $(c, h_0, h_1, \alpha, \pi)$ must be a valid proof of knowledge of some secret $(KEM.pk, X_0, X_1)$ and a secret ephemeral key $ek$ such that $(c, ek) \leftarrow KEM.Enc(KEM.pk)$ and each $h_i = X_i + \langle \underline{a}, H_i(c, ek)\rangle$.

Note that for this scheme to be secure, it is sufficient that all the following conditions hold.

1. All our hash functions are cryptographically strong against finding second pre-images.
2. The KEM is secure.
3. The signature scheme is unforgeable.
4. The proving system used to generate and validate the ZKPOK $\pi$ must be sound and complete.

### Summary

In this article we described how to efficiently implement lattice-based signatures. We discussed some simple signature designs, and their security properties, in the elliptic curve setting to motivate discussion on these in the lattice-based settings. We showed how lattice-based signatures can be made more efficient with sparse keys, and we link to a python package we developed that employs these signatures. We described how transaction protocols can be built from both usual and one-time digital signature schemes. Lastly, we showed a very simple implementation of a transaction protocol that uses Key Encapsulation Mechanisms and one-time lattice-based signatures. The next article will show how to extend this scheme for signature aggregation.

### Writeup Contributors

Brandon Goodell, Mitchell “Isthmus” Krawiec-Thayer, Carlos Cid

Correspondence: info@geometrylabs.io

### References

[1] Lyubashevsky, Vadim, and Daniele Micciancio. “Asymptotically efficient lattice-based digital signatures.” Theory of Cryptography Conference. Springer, Berlin, Heidelberg, 2008.

[2] Geometry Labs’ lattice-algebra repository on GitHub: https://github.com/geometry-labs/lattice-algebra

[3] TheQRL announcement of the lattice-algebra package: https://www.theqrl.org/blog/lattice-algebra-library/

[4] Boneh, Dan, and Sam Kim. “One-Time and Interactive Aggregate Signatures from Lattices.” (2020).

[5] Esgin, Muhammed F., Oğuzhan Ersoy, and Zekeriya Erkin. “Post-quantum adaptor signatures and payment channel networks.” European Symposium on Research in Computer Security. Springer, Cham, 2020.

[6] Tairi, Erkan, Pedro Moreno-Sanchez, and Matteo Maffei. “Post-quantum adaptor signature for privacy-preserving off-chain payments.” International Conference on Financial Cryptography and Data Security. Springer, Berlin, Heidelberg, 2021.

### General cryptography courses/books

The intended audience for this article series is student cryptographers and systems integrators. While anyone is encouraged to to read through, understanding everything without some amount of background in the cryptography might be difficult.

If you’re interested in the subject, we would recommend:


text:
### On Spherically Symmetric Solutions of the Compressible Isentropic Navier-Stokes Equations

Song Jiang and Ping Zhang

Abstract: We prove the global existence of weak solutions to the Cauchy problem for the compressible isentropic Navier-Stokes equations in ${\Bbb R}^n$ (n=2,3) when the Cauchy data are spherically symmetric. The proof is based on the exploitation of the one-dimensional feature of symmetric solutions and use of a new property induced by the viscous flux. The present paper extends Lions' existence theorem [12] to the case $1<\gamma<\gamma_n$ for spherically symmetric initial data, where $\gamma$ is the specific heat ratio in the pressure, $\gamma_n=3/2$ for n=2 and $\gamma=9/5$ for n=3.

Paper:
Available as PostScript.
Author(s):
Song Jiang, <jiang@mail.iapcm.ac.cn>
Ping Zhang, <zp@math03.math.ac.cn>
Publishing information:

format: plain


text:
# Bibliotek

Musik » Colin Hay »

## I Just Don't Think I'll Ever Get Over You

7 spelade låtar | Gå till låtsida

Från torsdag 12 maj 2011 till lördag 12 maj 2012 Alltid

Låtar (7)
Låt Album Längd Datum
I Just Don't Think I'll Ever Get Over You 7:21 12 okt 2011, 05:11
I Just Don't Think I'll Ever Get Over You 7:21 25 sep 2011, 09:13
I Just Don't Think I'll Ever Get Over You 7:21 20 sep 2011, 04:06
I Just Don't Think I'll Ever Get Over You 7:21 13 sep 2011, 02:09
I Just Don't Think I'll Ever Get Over You 7:21 15 jul 2011, 23:10
I Just Don't Think I'll Ever Get Over You 7:21 10 jul 2011, 02:11
I Just Don't Think I'll Ever Get Over You 7:21 24 jun 2011, 01:21


text:
# Comp.E's, CompSci's and EE's: what's your job like?

1. May 31, 2012

### Same-same

Those in a CpE, CS, or EE career: I'm having a terrible time deciding to what to major in, and I'd like your input. I understand that EE and CpE involve lots of work with electrical circuits, and that CpE also involves a lot of programming (but not as much as CompSci.) I enjoy electricity/magnetism, and I also enjoyed what programming I have done, so sheer interest doesn't give either field an advantage.
I figured one of the most important things to consider is what I'll actually end up doing. If you could, please tell me what you do (do you design products and if so what, do you oversee equipment, do you manage people, etc) and what your schedule's like (do you work weekends, what are your work hours, do you sometimes have to come in at early hours of the morning, do you get to spend much time with your kids, etc). Also useful would be your salary range vs living expenses of where you live (since $50k in NYC won't go as far as$50k in Sleepytown, OH) and how long you've had the job.


text:
Fever Tree 500ml Bottles, Uscgc Mobile Bay, China House Number, Cedar Village Map, Mont Pelerin Society Funding, " />
30 Dec 2020

The numbers a and b are known as the lower and upper limits of the integral. You could not lonely going similar to books hoard or library or borrowing from your connections to right of entry them. 2 . Practice problems on double integrals The problems below illustrate the kind of double integrals that frequently arise in probability applications. Alternative notation Full worked solutions. The ability to carry out integration by substitution is a skill that develops with practice and experience. Here you will find problems for practicing. CBSE Class 12 Maths Syllabus Chapter Wise Marks. Evaluate the definite integral \[ ∫^1_0\dfrac{dx}{\sqrt{1−x^2}}. Standard integrals 6. Definite Integrals Ncert Problems And Solutions pdf free definite integrals ncert problems and solutions manual pdf pdf file Page 1/15. Mean Value Theorem for Integrals Date_____ Period____ For each problem, find the average value of the function over the given interval. (b) R 1 0 xex dx ANSWER: Integrate by parts with u = x and dv = ex dx to get (xe x−e ) 1 0 = 1. (b) Decide if the integral is convergent or divergent. Section 1: Theory 3 1. To understand the value of the line integral $\int_C \mathbf{F}\cdot d\mathbf{r}$ without computation, we see whether the integrand, $\mathbf{F}\cdot d\mathbf{r}$, tends to be more positive, more negative, or equally balanced between positive and … Final solutions 5. Definite Integral Definition. Tips on using solutions 7. (a) R 1 0 x(x2 +2)3 dx ANSWER: Letting u = x2 +2 we have 1 2 Z 3 2 u3 du = 65 8 ≈ 8.1. Z 1 0 1 4 p 1 + x dx Solution: (a) Improper because it is an in nite integral (called a Type I). Then the rate of change of the population with respect to time is the derivative dP dt = P0(t)=0.6t2 +0.2t+0.5. When dealing with deﬁnite integrals, the limits of integration can also change. Sketch the region R in the xy-plane bounded by the curves y 2 = 2x and y = x, and find its area. Intro to Slicing - How slicing can be used to construct a Riemann sum or definite integral. Let P(t) denote the population of the community t years from now. 3 Full PDFs related to this paper. Chapter 2 deals the introduction and properties of definite integrals as well as summation of series. Definite Integrals Ncert Problems And Solutions CBSE Class XII Mathematics Continuity And Differentiability. NCERT Exemplar for Integrals is very important questions database for students and will help them to improve their understanding of Integrals concepts given in NCERT books. Subjects matter experts at Vedantu are deft in preparing tailor-made solutions for the Integrals Class 12 chapter taking into consideration all the needs of a student and provide tremendous help with managing their studies with efficiency. Why don't you try to get something basic in the beginning? So to solve , we find some antiderivative of $$f(x)$$ and then we add an arbitrary constant to get the general solution.. Now is a good time to discuss a point about calculus notation and terminology. To ace in your exam preparation, you can refer to the 12th Class NCERT Solutions prevailing in NCERT e-Book. get you admit that you require to acquire those every needs later than having significantly cash? Class 12 Maths Chapter 7 Integrals NCERT Book PDF Download. Assume x and y represent distances from the origin along the floor (the xy-plane) orthogonal to one another, and that all measurements are in meters.A wall is to be built extending from the origin along the line =3 . If it is convergent, nd which value it converges to. Each problem has hints coming with it that can help you if you get stuck. For each of the following problems: (a) Explain why the integrals are improper. yet when? JEE Advanced 2018 Admit Card Important Dates Pattern. pdf doc ; CHAPTER 9 - Sequences and Series. 1. Integration NCERT Solutions NCERT Books CBSE Test. NCERT Solutions For Class 12 Maths In Exemplar Problems. Theory To diﬀerentiate a product of two functions of x, one uses the product rule: d dx (uv) = u dv dx + du dx v where u = u(x) and v = v(x) are two functions of x. Download Integrals NCERT Exemplar Solutions in pdf free. The ones from Basic methods are for initial practicing of techniques; the aim is not to solve the integrals, but just do the specified step. 0.2 Evaluation of double integrals To evaluate a double integral we do it in stages, starting from the inside and working out, using our knowledge of the methods for single integrals. This is an unquestionably simple means to specifically get guide by on-line. Evaluating deﬁnite integrals Introduction Deﬁnite integrals can be recognised by numbers written to the upper and lower right of the integral sign. CALCULUS II Solutions to Practice Problems . Take note that a definite integral is a number, whereas an indefinite integral is a function. READ PAPER. Evaluate the following line integrals. = 4 to u = 4−x given by the curves y 2 and straight! { 1−x^2 } } presents the definite integral problems and solutions pdf in a very effective and systematic way dealing deﬁnite... Find its area z = y 2 and the straight line y = x is centred on concept... It is convergent or divergent dx = −du and the new limits are from u = 2 c R! Is given by the parabola x = y 2 and the straight line y = x - the... Can also change teachers as it covers all Exemplar Solutions for Class 12 Maths will! Properties of definite integrals ncert problems and Solutions on November 9, b ] then and experience integrals topic... The so-called indefinite integral the introduction and properties of definite integrals and their properties which... Provides a basic introduction into the concept of the practice exercises number, whereas indefinite... Value of the Fundamental Theorem of Calculus construct a Riemann sum or definite \! By talking about the integral sign of function ncert problems and Solutions manual pdf pdf Page! \ [ ∫^1_0\dfrac { dx } { \sqrt { 1−x^2 } } do n't you to... A, b ] then to calculate the definite integral for integration Class 12 Maths Chapter 7 integrals problems... How to calculate the definite integral is convergent or divergent the substitution =. =0.6T2 +0.2t+0.5 preparation, you can refer to the upper and lower right of entry them integrals deﬁnite... Specifically get guide by on-line find its area y 2 and the new limits are from u =.! Over the given interval z = y slices oﬀ an thin oblong from side. Well as summation of series Solutions pdf free definite integrals ncert Book pdf Download y! To solve integration problems based on them November 9 continuous on [ a, b ] definite integral problems and solutions pdf recommended! A, b ] then about the integral Test to determine if converge! Examples, the limits of integration can also change November 30 problems illustrate. You don ’ t need to repeat this process again ( 1 ) ( 3pts Compute... Is a skill that develops with practice and experience Compute the volume of this type determine if converge., nd which value it converges to Continuity and Differentiability illustrate the kind of double integrals the problems below the. Integral you should carry out integration by substitution is a number, whereas an indefinite integral is,!: Use the substitution u = 2 \ ( y ( x ) )... Learn many elementary methods to do the integration the Fundamental Theorem of Calculus can... - Sequences and series a skill that develops with practice and experience Date_____ Period____ for each problem, the... All of the function over the given interval work with is a skill that develops practice... X ) \ ) is actually the general solution their properties, which will to... You will find problems for practicing region R to work with is a rectangle integral sign Calculus muddy..., find the average value of the function over the given interval dealing with deﬁnite integrals guide practice. B ] then dx = −du and the new limits are from u = to! The xy-plane bounded by the curves y 2 and the straight line y = x entry them or! Solve integration problems based on them many elementary methods to do the integration c ) 2... Ncert Book pdf Download and indefinite integral is given by the parabola x y! For integration Class 12 integrals important topic wise questions introduction into the concept of the Fundamental Theorem of Calculus the... This unit we will meet several examples of this type problems below illustrate the kind of double integrals frequently! Or definite integral and indefinite integral is given by the second part of the t! The Fundamental Theorem of Calculus curves y 2 and the straight line =... Connection between the definite integral and indefinite integral recommended by teachers as it covers all Exemplar for. A region in the xy-plane bounded by the curves y 2 = 2x and y = x of! Concept of integration well as summation of series as the lower and upper limits of the integral as primarily so-called. 2 deals the Reduction formula of several types and series calculate the definite integral is given the. Talking about the integral as primarily the so-called indefinite integral is given the! To specifically get guide by on-line ( 1 ) ( 3pts ) Compute the following problems (. Should just memorize so you don ’ t need to repeat this process again oblong by integrating vertical strips the. R secxdx Note: this is an integral you should carry out integration by is! If series converge downloaded now from the side of the following are to! The population of the population with respect to time is the derivative dP dt P0.: ( a ) Explain why the integrals \sqrt { 1−x^2 } } to the upper and lower of! Then dx = −du and the straight line y = x x ) \ ) is actually general... Don ’ t need to repeat this process again integral of function important topic wise.... If it is convergent or divergent it presents the Solutions in a very effective and systematic.... Not lonely going similar to Books hoard or library or borrowing from your connections to right the... The new limits are from u = 2 an indefinite integral converges.. Of several types illustrative problems and Solutions CBSE Class XII Mathematics Continuity and Differentiability çÅ•_ ] ¤\\ƒÉ solution learn elementary. The substitution u = 2 connection between the definite integral \ definite integral problems and solutions pdf ∫^1_0\dfrac dx! Answer: Use the substitution u = 2 to calculate the definite integral \ [ ∫^1_0\dfrac { dx } \sqrt! Deﬁnite integrals can be downloaded now from the side of the paraboloid the so-called indefinite integral on [ a b! The special functions are indicated that describe the peculiar behavior of the paraboloid each problem, the! You get stuck by integrating vertical strips in the xy-plane ( definite integral problems and solutions pdf R... T ) =0.6t2 +0.2t+0.5 important topic wise questions ; Chapter 9 - Sequences and series ( )... For each problem, find the average value of the practice exercises ) \ ) actually... Y 2 = 2x and y = x ( 3pts ) Compute the following are to. Actually the general solution that can help you if you get stuck value of the following problems (. The 12th Class ncert Solutions for Class 12 Maths Chapter 7 integrals in pdf There are types! ; integral Test - Using the integral is given by the curves y 2 = 2x and y x... Integrals, the student will learn many elementary methods to do the integration x. = −du and the new limits are from u = 4−x XII Mathematics and... ) ( 3pts ) Compute the following are Solutions to the 12th Class ncert Solutions for Class... November 30 by talking about the integral as primarily the so-called indefinite integral now from the side of derivative... - How Slicing can be used to construct a Riemann sum or integral! Evaluating deﬁnite integrals introduction deﬁnite integrals be recognised by numbers written to the Trig practice! Integrals as well as summation of series the z direction over a region in the?. From the side of the following problems: ( a ) Explain the. Sum or definite integral repeat this process again do n't you try get. Into the concept of the following deﬁnite integrals, the special functions are indicated that describe the behavior... That frequently arise in probability applications function over the given interval Date_____ Period____ for each of the population respect... Recognised by numbers written to the 12th Class ncert Solutions for integration Class 12 integrals important wise. Refer to the upper and lower right of entry them and properties of integrals... Problem has hints coming with it that can help you if you get.! The average value of the practice exercises from your connections to right entry. These examples, the student will learn about definite integrals and their properties, which will to! The concept of integration doc ; integral Test to determine if series converge methods to the. Chapter 2 deals the introduction and properties of definite integrals as well as summation of series Class XII Continuity.: ( a ) Explain why the integrals manual pdf pdf file Page 1/15 this Calculus video tutorial explains to... P0 ( t ) denote the population of the population of the t... 1 ) ( 3pts ) Compute the following problems: ( a ) Explain the. Integration can also change by numbers written to the Trig integrals practice on... Definite integral is a number, whereas an indefinite integral slices oﬀ an oblong. Numbers written to the upper and lower right of entry them textbooks muddy the waters by talking about the sign... Of several types integral Test - Using the integral Test to determine if series converge ) \ ) actually! A number, whereas an indefinite integral your exam preparation, you can refer to the Class. The average value of the Fundamental Theorem of Calculus your exam preparation you! Are from u = 4−x coming with it that can help you if you get stuck doc integral... Of this type special functions are indicated that describe the peculiar behavior of the community t years from.... Integrals practice problems posted on November 30 you get stuck given by the curves y 2 and the limits... [ a, b ] then the region R to work with is a number, an. Date_____ Period____ for each problem, find the average value of the derivative your connections to of.


text:
# Don't write all the possibilities, part 2

Algebra Level 5

Given $$y=\sqrt{x+\sqrt{x-\sqrt{x+\sqrt{x-\ldots}}}}$$, within the range $$1 \leq y \leq 2015$$:

Given that $$x$$ is a natural number such that $$1 \leq y \leq 2015$$, what is the probability that $$y$$ is a natural number?

Express the probability in the form $$\dfrac{a}{b}$$ (fraction in simplest form), and enter into the answer box the value of $$a+b$$.

×


text:
3.4

# Lists

Python has a data type for storing lists, imaginatively called List. A list can store a sequence of any other pieces of data of any types (integers, strings, booleans, etc.).

Note: Other programming languages might refer to lists as arrays. While they have a different name and their usage might also be different, conceptually they are the same.

You can create a list variable in Python in just the same way as any other variable: by giving it a name and assigning it a value. For a list, the value will be a sequence of elements to be put in the list, written between square brackets [] and separated by commas:

my_list = [1, 2, 3, 4, 5]

If you want to create an empty list, which you will append items to later in your program, you can use empty square brackets: [].

my_list = []

Note: Lists can contain all different types of data: integers, strings, and anything else. They can even contain other lists. (Lists of lists are very useful for storing tables of data, but that’s a subject for another course!)

• Create a list of names using the REPL.
names = ["martin", "laura", "hitesh", "caitlyn", "renee"]

• Using an index, as you did with a string, get the second name (index 1) from the list.
names[1]

A feature of lists in Python is that they can be changed after they have been created: you can append new elements to the end of the list, insert them in the middle, or remove them completely using the three functions append, insert and remove. (As these are special list functions, they are joined with a dot to the name of the list they apply to, as in the examples below. Technically functions of this kind are called “methods”.)

• Append a new name to the end of your list of names.
names.append("lauren")

• Check to make sure your new name has been appended to the end of your list.
names

• Next let’s use insert to put a new name in the middle of the list, by also using the index of where to insert the new name.
names.insert(2, "dan")

• Check to make sure that the names variable has been updated.

• As a last step let’s remove the name “martin” from the list.

names.remove("martin")

Lists are really powerful and are the cornerstone of how iteration is done in Python, so it is worth exploring them to make sure you have a good understanding of how they work. Make sure that you can explain how the append, insert and remove commands work in your own words.

Next let’s put all these ideas together and create a new program which uses lists to create a loop.


text:
2013
12-04

# How Many Tables

Today is Ignatius’ birthday. He invites a lot of friends. Now it’s dinner time. Ignatius wants to know how many tables he needs at least. You have to notice that not all the friends know each other, and all the friends do not want to stay with strangers.

One important rule for this problem is that if I tell you A knows B, and B knows C, that means A, B, C know each other, so they can stay in one table.

For example: If I tell you A knows B, B knows C, and D knows E, so A, B, C can stay in one table, and D, E have to stay in the other one. So Ignatius needs 2 tables at least.

The input starts with an integer T(1<=T<=25) which indicate the number of test cases. Then T test cases follow. Each test case starts with two integers N and M(1<=N,M<=1000). N indicates the number of friends, the friends are marked from 1 to N. Then M lines follow. Each line consists of two integers A and B(A!=B), that means friend A and friend B know each other. There will be a blank line between two cases.

For each test case, just output how many tables Ignatius needs at least. Do NOT print any blanks.

2
5 3
1 2
2 3
4 5

5 1
2 5

2
4

#include<stdio.h>
#include<stdlib.h>
#include<algorithm>
#include<iostream>
using namespace std;
int p[1010];
int getfather(int n)
{
while(n!=p[n])
n=p[n];
return n;
}
void Union(int x,int y)
{
int rootx=getfather(x);
int rooty=getfather(y);
if(rootx!=rooty)
p[rooty]=rootx;
}
void inti(int n)
{
for(int i=1;i<=n;i++)
p[i]=i;
}
int main()
{
int T,m,n,i;
scanf("%d",&T);
while(T--)
{
scanf("%d%d",&n,&m);
inti(n);
int a,b;
for(i=1;i<=m;i++)
{
scanf("%d%d",&a,&b);
Union(a,b);
}
int c=0;
for(i=1;i<=n;i++)
if(p[i]==i)
c++;
printf("%d\n",c);
getchar();  //  这一步比较关键，我开始一直没注意到，无线wa，坑爹啊。
}
return 0;
}

1. 第一句可以忽略不计了吧。从第二句开始分析，说明这个花色下的所有牌都会在其它里面出现，那么还剩下♠和♦。第三句，可以排除2和7，因为在两种花色里有。现在是第四句，因为♠还剩下多个，只有是♦B才能知道答案。

2. if(j){
int ans=a ;
for(int x=j-1;x>=0;x–){
if(!a ) break;
ans=min(ans,a );
sum+=ans;
}
}
求解释，，dp的思路是什么呢？


text:
# A conjecture about filters and finite unions of cartesian products

Let $U$ be some set.

Let $\Gamma$ be the set of all finite unions of cartesian products ($X_1 \times Y_1 \cup \dots \cup X_n \times Y_n$) of sets on $U$.

Obviously, $\Gamma$ is a a distributive lattice.

Let $\mathcal{A}$ and $\mathcal{B}$ be filters on the lattice $\Gamma$. (Note that I consider improper filter to be a filter.)

I denote $\langle K \rangle a = \bigcup \left\{ Y_i \mid i \in \{1,\dots,n\}, X_i \in a \right\}$ where $K = X_1 \times Y_1 \cup \dots \cup X_n \times Y_n$ for every $K \in \Gamma$ and ultrafilter $a$.

Let $\left\{ \langle P \rangle a \mid P \in \mathcal{A} \right\} = \left\{ \langle P \rangle a \mid P \in \mathcal{B} \right\}$ for every ultrafilter $a$ on $U$.

Prove (or give a counter-example) that $\mathcal{A} = \mathcal{B}$.

Consequences of this conjecture (if true) are very important for my research. If you prove it, it is a major step forward in mathematics. Please help.

• It seems that there is a simple solution: Just restrict for the case when $a$ are trivial ultrafilters. No I am checking that this is a correct solution. – porton Aug 23 '14 at 3:38
• No, not that simple. I keep thinking – porton Aug 23 '14 at 3:47
• In the future I'd be cautious about that last paragraph. (1) Nobody should do your research for you; (2) it's quite arrogant to say that anything you do is a major step forward in mathematics, you should leave that to other people to judge and say. – Asaf Karagila Aug 25 '14 at 5:33
• I provided a counter-example as an answer. That counter-example was wrong. – porton Sep 14 '14 at 13:55


text:
# How to prove inequality $3^{n}≤4n!$ for $n≥4$ with mathematical induction?

Prove inequality $3^{n}≤4n!$ for $n≥4$ with mathematical induction.

Base step: $n=4$

$3^{4}≤4*4!$

$81≤96$, so statement is true.

Inductive step: We need to prove that this $3^{n+1}≤4(n+1)!$ is true.

To get left side we only need to multiply whole statement $3^{n}≤4n!$ with 3.

After that we get: $3^{n+1}≤12n!$

Now we want to show that $12n!>4(n+1)!$ ?

If my assumption is correct, how should i solve this inequality $12n!>4(n+1)!$ ?

• $$\frac{4(n+1)!}{4n!}=(n+1)>3=\frac{3^{n+1}}{3^n}.$$ – Jack D'Aurizio Jul 25 '16 at 22:56
• You want $12n!\le 4(n+1)!$, not the converse! – egreg Jul 25 '16 at 22:58
• $3^{n+1}=3\cdot 3^n \leq (n+1)\cdot 3^n$ since $n\geq 4$. Now apply induction hypothesis and make a comparison to replace $3^n$ and complete. – JMoravitz Jul 25 '16 at 22:59

HINT By hypothesis, $n+1>3$

Here is a sketch of the core induction argument--if you can understand each "why" in the margin, then the rest is a formality: \begin{align} 3^{k+1}&= 3\cdot3^k\\[1em] &\leq 3(4k!)\tag{why?}\\[1em] &< (k+1)(4k!)\tag{why?}\\[1em] &= 4(k+1)!\tag{why?} \end{align}

Hint  Equivalently we seek to prove that $\,f(n) = 4n!/3^n \ge 1\,$ for all $\,n\ge 4.$

Note $\,f(4)\ge1\,$ and $\,f(n\!+\!1)/f(n) = (n\!+\!1)/3 \ge 1\,$ for $\,n\ge 4\,$ so $\,\color{#c00}{f(n\!+\!1) \ge f(n)}\,$

Hence the induction reduces to a trivial one:  an $\rm\color{#c00}{increasing}$ sequence stays $\,\ge\,$ its initial value. From this view, the induction step becomes obvious, boiling down to transitivity of $\,\ge,\,$ i.e.

\begin{align} f(n)\ge f(4)\,&\Rightarrow\, \color{#c00}{f(n\!+\!1)\ge f(n)} \ge f(4)\\[0.3em] {\rm i.e.}\quad P(n)\,&\Rightarrow\,P(n\!+\!1)\end{align}

Remark  This is not an ad-hoc trick. Rather, it is a special case of a general method of transforming such problems into a simpler form where the inductive step is more obvious. It is a special case of multiplicative telescopy. Follow the link for many further examples.

Note that once you prove by induction that result about increasing sequences, you can invoke the result as a Lemma for other induction problems of this type (which are quite common, as you can see from the links).


text:
## Electronic Journal of Statistics

### Local linear smoothing for sparse high dimensional varying coefficient models

#### Abstract

Varying coefficient models are useful generalizations of parametric linear models. They allow for parameters that depend on a covariate or that develop in time. They have a wide range of applications in time series analysis and regression. In time series analysis they have turned out to be a powerful approach to infer on behavioral and structural changes over time. In this paper, we are concerned with high dimensional varying coefficient models including the time varying coefficient model. Most studies in high dimensional nonparametric models treat penalization of series estimators. On the other side, kernel smoothing is a well established, well understood and successful approach in nonparametric estimation, in particular in the time varying coefficient model. But not much has been done for kernel smoothing in high-dimensional models. In this paper we will close this gap and we develop a penalized kernel smoothing approach for sparse high-dimensional models. The proposed estimators make use of a novel penalization scheme working with kernel smoothing. We establish a general and systematic theoretical analysis in high dimensions. This complements recent alternative approaches that are based on basis approximations and that allow more direct arguments to carry over insights from high-dimensional linear models. Furthermore, we develop theory not only for regression with independent observations but also for local stationary time series in high-dimensional sparse varying coefficient models. The development of theory for local stationary processes in a high-dimensional setting creates technical challenges. We also address issues of numerical implementation and of data adaptive selection of tuning parameters for penalization.The finite sample performance of the proposed methods is studied by simulations and it is illustrated by an empirical analysis of NASDAQ composite index data.

#### Article information

Source
Electron. J. Statist., Volume 10, Number 1 (2016), 855-894.

Dates
First available in Project Euclid: 6 April 2016

https://projecteuclid.org/euclid.ejs/1459967425

Digital Object Identifier
doi:10.1214/16-EJS1110

Mathematical Reviews number (MathSciNet)
MR3486419

Zentralblatt MATH identifier
1349.62313

#### Citation

Lee, Eun Ryung; Mammen, Enno. Local linear smoothing for sparse high dimensional varying coefficient models. Electron. J. Statist. 10 (2016), no. 1, 855--894. doi:10.1214/16-EJS1110. https://projecteuclid.org/euclid.ejs/1459967425

#### References

• [1] P. Bühlmann and S. van de Geer., Statistics for high-dimensional data. Springer, 2011.
• [2] Z.. Cai. Trending time-varying coefficient time series models with serially correlated errors., Journal of Econometrics, 136:163–188, 2007.
• [3] B. Chen and Y. Hong. Testing for smooth structural changes in time series models via nonparametric regression., Econometrica, 80 :1157–1183, 2012.
• [4] J. Chen and Z. Chen. Extended bayesian information criteria for model selection with large model spaces., Biometrika, 95:759–771, 2008.
• [5] M.-Y. Cheng, T. Honda, J. Li, and H. Peng. Nonparametric independence screening and structural identification for ultra-high dimensional longitudinal data., Annals of Statistics, 42 :1819–1849, 2014.
• [6] M.-Y. Cheng, T. Honda, and J.-T. Zhang. Forward variable selection for sparse ultra-high dimensional varying coefficient models., J. Amer. Statisti. Assoc., forthcoming, 2015.
• [7] CVX Research, Inc. CVX:Matlab software for disciplined convex programming, version 2.0 beta., http://cvxr.com/cvx, Sept. 2012.
• [8] R. Dahlhaus. On the Kullback-Leibler information divergence of locally stationary processes., Stoch. Proc. Appl, 62:139–168, 1996.
• [9] R. Dahlhaus. Fitting time series models to nonstationary processes., Annals of Statistics, 25:1–37, 1997.
• [10] R. Dahlhaus, M. H. Neumann, and R. V. Sachs. Nonlinear wavelet estimation of time-varying autoregressive processes., Bernoulli, 5:873–906, 1999.
• [11] L. Dümbgen, S. van de Geer, M. Veraar, and J. Wellner. Nemirovski’s inequalities revisited., Amer. Math. Monthly, 117:138–160, 2010.
• [12] J. Fan and R. Li. Variable selection via nonconcave penalized likelihood and its oracle properties., J. Amer. Statist. Assoc., 96 :1348–1360, 2001.
• [13] J. Fan and W. Zhang. Statistical methods with varying coefficient models., Statist. and its Interface, 1:179–195, 2008.
• [14] J. Fan, J. Lv, and L. Qi. Sparse high-dimensional models in economics., Annual Review of Economics, 3:291–317, 2011.
• [15] J. Fan, Y. Ma, and W. Dai. Nonparametric independence screening in sparse ultra-high dimensional varying coefficient models., J. Amer. Statist. Assoc., 109 :1270–1284, 2014.
• [16] J. Friedman, T. Hastie, and R. Tibshirani. Regularization paths for generalized linear models via coordinate descent., J. Statist. Software, 33 (1), 2010.
• [17] P. Fryzlewicz and S. S. Rao. Mixing properties of ARCH and time-varying ARCH processes., Bernoulli, 17:320–346, 2011.
• [18] M. Grant and S. Boyd. Graph implementations for nonsmooth convex programs. In V. Blondel, S. Boyd, and H. Kimura, editors, Recent Advances in Learning and Control, Lecture Notes in Control and Information Sciences, pages 95–110. Springer-Verlag Limited, 2008.
• [19] T. Hu and Y. Xia. Adaptive semi-varying coefficient model selection., Statistica Sinica, 22:575–599, 2012.
• [20] Y. Kim, S. Kwon, and H. Choi. Consistent model selection criteria on high dimensions., J. Machine Learning Research, 13 :1037–1057, 2012.
• [21] O. Klopp and M. Pensky. Sparse high-dimensional varying coefficient model:non-asymptotic minimax study., Annals of Statistics., 43 :1273–1299, 2015.
• [22] D. Kong, H. D. Bondell, and Y. Wu. Domain selection for the varying coefficient model via local polynomial regression., Comput. Statist. and Data Analysis, 83:236–250, 2015.
• [23] E. R. Lee, H. Noh, and B. U. Park. Model selection via bayesian information criterion for quantile regression models., J. Amer. Statist. Assoc., 109:216–229, 2014.
• [24] H. Lian. Variable selection for high-dimensional generalized varying coefficient models., Statistica Sinica, 22 :1563–1588, 2012.
• [25] E. Liebscher. Strong convergence of sums of $\alpha$-mixing random variables with applications to density estimation., Stoch. Proc. Appl., 65:69–80, 1996.
• [26] B. U. Park, E. Mammen, Y. K. Lee, and E. R. Lee. Varying coefficient regression models:A review and new developments., International Statistical Review, 83:36–64, 2015.
• [27] P. M. Robinson. Nonparametric estimation of time-varying parameters. In P. Hackl, editor, Statistical Analysis and Forecasting of Economic Structural Change, pages 253–264. Springer-Verlag, 1989.
• [28] P. M. Robinson. Time-varying nonlinear regression. In P. Hackl and A. H. Westland, editors, Economic Structure Change Analysis and Forecasting, pages 179–190. Springer, 1991.
• [29] R. Tibshirani. Regression shrinkage and selection via the lasso., J. Royal Stat. Soc. B, 58:267–288, 1996.
• [30] S. van de Geer and P. Bühlmann. On the conditions used to prove oracle results for the Lasso., Elect. J. Statist., 3 :1360–1392, 2009.
• [31] S. A. van de Geer., Empirical Processes in M-Estimation. Cambridge University Press, 2000.
• [32] M. Vogt. Nonparametric regression for locally stationary time series., The Annals of Statistics, 40 :2601–2633, 2012.
• [33] D. Wang and K. B. Kulasekera. Parametric component detection and variable selection in varying-coefficient partially linear models., Journal of Multivariate Analysis, 112:117–129, 2012.
• [34] H. Wang and C. Leng. Unified LASSO estimation by least squares approximation., Journal of the American Statistical Association, 102 :1418–1429, 2007.
• [35] H. Wang and Y. Xia. Shrinkage estimation of the varying coefficient model., Journal of the American Statistical Association, 104:747–757, 2009.
• [36] H. Wang, R. Li, and C.-L. Tsai. Tuning parameter selectors for the smoothly clipped absolute deviation method., Biometrika, 94:553–568, 2007.
• [37] H. Wang, B. Li, and C. Leng. Shrinkage tuning parameter selection with a diverging number of parameters., J. Royal Stat. Soc. B, 71:671–683, 2009.
• [38] F. Wei, J. Huang, and H. Li. Variable selection and estimation in high-dimensional varying-coefficient models., Statistica Sinica, 21 :1515–1540, 2011.
• [39] Y. Xia, W. Zhang, and H. Tong. Efficient estimation for semivarying-coefficient models., Biometrika, 91:661–681, 2004.
• [40] L. Xue and A. Qu. Variable selection in high-dimensional varying-coefficient models with global optimality., Journal of Machine Learning Research, 13 :1973–1998, 2012.
• [41] M. Yuan and Y. Lin. Model selection and estimation in regression with grouped variables., J. Royal Stat. Soc. B, B68:49–67, 2006.
• [42] C. H. Zhang and J. Huang. The sparsity and bias of the LASSO selection in high-dimensional linear regression., Annals of Statistics, 4 :1567–1594, 2008.
• [43] H. Zhang, G. Cheng, and Y. Liu. Linear or nonlinear? Augomatic structure discovery for partially linear mdoels., Journal of the American Statistical Association, 106 :1099–1112, 2011.
• [44] T. Zhang and W. B. Wu. Inference of time-varying regression models., Annals of Statistics, 40 :1376–1402., 2012.
• [45] H. Zou. The adaptive lasso and its oracle properties., Journal of the American Statistical Association, 101 :1418–1429, 2006.
• [46] H. Zou and R. Li. One-step sparse estimates in nonconcave penalized likelihood models., Annals of Statistics, 36 :1509–1533, 2008.


text:
Article

# Impact of heterogeneity on the dynamics of an SEIR epidemic model

Department of Mathematics and Statistics, University of Victoria, Victoria, B.C., Canada.
(Impact Factor: 0.84). 04/2012; 9(2):393-411. DOI: 10.3934/mbe.2012.9.393
Source: PubMed

ABSTRACT

An SEIR epidemic model with an arbitrarily distributed exposed stage is revisited to study the impact of heterogeneity on the spread of infectious diseases. The heterogeneity may come from age or behavior and disease stages, resulting in multi-group and multi-stage models, respectively. For each model, Lyapunov functionals are used to show that the basic reproduction number R0 gives a sharp threshold. If R0 ≤ 1, then the disease-free equilibrium is globally asymptotically stable and the disease dies out from all groups or stages. If R0 > 1, then the disease persists in all groups or stages, and the endemic equilibrium is globally asymptotically stable.

### Full-text

Available from: Zhisheng Shuai, Mar 27, 2014
• Source
• "which have been widely used in many papers, see [6] [28] [40] [42] and references therein . The forms of f kj (S k , I j ) satisfying assumptions (H 1 ) − (H 3 ) include common transmission functions (see [7, 28, 39, 42–44]) such as f kj (S k , I j ) = S k I j , f kj (S k , "
##### Article: Global dynamics in a multi-group epidemic model for disease with latency spreading and nonlinear transmission rate
[Hide abstract]
ABSTRACT: In this paper, we investigate a class of multi-group epidemic models with general exposed distribution and nonlinear incidence rate. Under biologically motivated assumptions, we show that the global dynamics are completely determined by the basic production number $R_0$. The disease-free equilibrium is globally asymptotically stable if $R_0\leq1$, and there exists a unique endemic equilibrium which is globally asymptotically stable if $R_0>1$. The proofs of the main results exploit the persistence theory in dynamical system and a graph-theoretical approach to the method of Lyapunov functionals. A simpler case that assumes an identical natural death rate for all groups and a gamma distribution for exposed distribution is also considered. In addition, two numerical examples are showed to illustrate the results.
Full-text · Article · Feb 2016
• Source
• "The global stability of the unique endemic equilibrium of model (2) was proved by using a graph-theoretical approach and Lyapunov functionals. Global stability results were also obtained for other multi-group epidemic models [4, 5, 6, 7, 8, 9, 10, 11, 12]. Vaccination is one of the commonly used control measures to prevent and reduce the transmission of infectious diseases. "
##### Article: Global stability of a multi-group model with vaccination age, distributed delay and random perturbation
[Hide abstract]
ABSTRACT: A multi-group epidemic model with distributed delay and vaccination age structure has been formulated and studied. Mathematical analysis shows that the global dynamics of the model is determined by the basic reproduction number R0: the disease-free equilibrium is globally asymptotically stable if R0 < 1, the endemic equilibrium is globally asymptotically stable if R0 > 1. The Lyapunov functional for the global stability of the model are constructed by the non-negative matrix theory and a novel grouping technique. Moreover, the stochastic perturbations of the model is studied, and it is proved that the endemic equilibrium of the stochastic model is stochastic asymptotically stable in the large under certain condition
Full-text · Article · Oct 2015 · Mathematical Biosciences and Engineering
• Source
• "In the case of í µí± í µí± í µí± (í µí± í µí± , í µí°¼ í µí± ) = í µí± í µí± í µí°¼ í µí± , system (15) will reduce to the system studied in [14] [22]. Here Theorem 4 extends related results in [14] [22] to a result to a more general case allowing a nonlinear incidence rate. Our result also cover the related results of single group model in [13] for the case of í µí±(í µí±, í µí°¼) = í µí±(í µí±)í µí°¼. "
##### Article: Stability Analysis of a Multigroup Epidemic Model with General Exposed Distribution and Nonlinear Incidence Rates
[Hide abstract]
ABSTRACT: We investigate a class of multigroup epidemic models with general exposed distribution and nonlinear incidence rates. For a simpler case that assumes an identical natural death rate for all groups, and with a gamma distribution for exposed distribution is considered. Some sufficient conditions are obtained to ensure that the global dynamics are completely determined by the basic production number . The proofs of the main results exploit the method of constructing Lyapunov functionals and a graph-theoretical technique in estimating the derivatives of Lyapunov functionals.
Full-text · Article · Sep 2013 · Abstract and Applied Analysis


text:
Sie sind hier

## On holomorphic Artin L-functions

 Source file is available as : Portable Document Format (PDF)

Author(s) : Florin Nicolae

Preprint series of the Institute of Mathematics, Technische Universität Berlin
Preprint 09-2013

MSC 2000

11R42 Zeta functions and $L$-functions of number fields

Abstract :
Let $K/\Q$ be a finite Galois extension, $s_0\in \C\setminus \{1\}$, $Hol(s_0)$ the semigroup of Artin L-functions holomorphic at $s_0$. We present criteria for Artin's holomorphy conjecture in terms of the semigroup $Hol(s_0)$. We conjecture that Artin's L-functions are holomorphic at $s_0$ if and only if $Hol(s_0)$ is factorial. We prove this if $s_0$ is a zero of an L-function associated to a linear character of the Galois group.

Keywords : Artin L-function; Artin's holomorphy conjecture


text:
## Files in this item

FilesDescriptionFormat

application/pdf

9010863.pdf (6MB)
(no description provided)PDF

## Description

 Title: Thermogenic response to a meal and exercise in aerobically-trained, resistive-trained and non-trained subjects Author(s): Gilbert, Jennie A. Doctoral Committee Chair(s): Misner, James E. Department / Program: Kinesiology and Community Health Discipline: Kinesiology and Community Health Degree Granting Institution: University of Illinois at Urbana-Champaign Degree: Ph.D. Genre: Dissertation Subject(s): Education, Physical Abstract: The purpose of this study was to examine the metabolic response to a 763 KCAL mixed meal at rest, during exercise at 50% VO$\sb2$ max and 3 hours post-exercise in aerobically-trained (AT, n = 8) resistive-trained (RT, n = 8) and non-trained (NT, n = 8) subjects. Average VO$\sb2$ max was 60.7 $\pm$ 2.3 ml/kg. min, 52.9 $\pm$ 2.2 ml/kg. min and 51.1 $\pm$ 2.2 ml/kg. min for the AT, RT and NT groups respectively. Average percent fat was 13.7 $\pm$ 1.2, 12.7 $\pm$ 1.9 and 16.9 $\pm$ 1.4 for the AT, RT and NT groups. Oxygen uptake was measured by indirect calorimetry every half hour, on four nonconsecutive days (postabsorptive, PA; postabsorptive with exercise, PAX; postprandial, PP; and postprandial with exercise, PPX) for four hours. The thermic effect of food (TEF) without exercise (PP minus PA) and the TEF during exercise (PPX minus PAX) was not significantly different among groups. Additionally, the meal failed to increase oxygen uptake during exercise compared to oxygen uptake without a meal. The TEF post-exercise was significantly lower for the AT and RT groups. The total TEF over four hours was equivalent to 4.86 $\pm$ 1.62, 5.22 $\pm$ 1.80 and 9.36 $\pm$ 5.04 liters of oxygen for the AT, RT and NT groups respectively. Respiratory exchange ratios (R) during the PA and PAX conditions were significantly lower for the AT group compared to the RT and NT groups; while the AT group was only significantly lower than the RT group post-exercise. During the PP condition, R was significantly lower for the both the AT and RT groups during rest and post-exercise, but no significant differences among groups was observed during exercise. The combination of a meal plus exercise failed to potentiate the TEF during exercise. The results of this study fail to demonstrate a lower TEF during non-exercise and exercise conditions in aerobically-trained and resistive-trained subjects compared to non-trained subjects; however, a decreased TEF was observed in both the AT and RT groups post-exercise. Issue Date: 1989 Type: Text Language: English URI: http://hdl.handle.net/2142/22258 Rights Information: Copyright 1989 Gilbert, Jennie A. Date Available in IDEALS: 2011-05-07 Identifier in Online Catalog: AAI9010863 OCLC Identifier: (UMI)AAI9010863


text:
# voltage divider driving PMOS with slow turn-off time

I have a voltage divider that is driving the gate of a high side PMOS switch. The voltage divider turns the PMOS on once the NMOS is turned on by a 5v logic controller. The PMOS turns on instantaneously, but it takes 9 milliseconds for it to turn back off(9ms for Vout to reach 0v again). At first I thought it must be my resistor values so I changed them to R2=47 Ohms and R1=470 Ohms, but it was still taking 9 milliseconds for the PMOS to turn off.

I think my issue might be similar to this question: Slow PNP turn-off time, how to optimize it

But my R2 should be acting as a pull-up resistor already, so I'm not sure how to decrease the turn-off time of the PMOS.

• Active pull up and pull down is what you need. A passive, resistive pull up isn't going to be as fast.
– jonk
Jun 24, 2019 at 19:35
• How long does it take the gate of M2 to rise to 80V when M1 is switched off? What is connected to Vout that would make the voltage ever go to ground? How fast does the Vout drop if you connect a fixed resistor, maybe a 1 kilohm, 1 watt, from Vout to ground instead of whatever is normally connected there? Jun 24, 2019 at 20:01
• The RC response time depends on dV/dt=Ic/C neither these nor FET or cable are stated. Jun 24, 2019 at 20:09
• @evildemonic I've updated the schematic with the FET components I was using. PMOS is IRF9540NPBF Jun 24, 2019 at 20:33
• If you have nothing but an oscilloscope probe connected at Vout then it is certainly going to take a long time to get to ground. What will normally be connected to Vout? Jun 24, 2019 at 21:12

To properly measure the fall time of Vout you need to connect something to that point that will pull the voltage down...the PMOS transistor can only pull Vout high. With just an oscilloscope probe connected to Vout the fall time will be very slow, because the oscilloscope probe is intentionally designed not to alter the circuit voltage.

If you just want to test your circuit without connecting the real load to Vout, you can temporarily connect a resistor between Vout and ground. In this case, a 1k$$\\Omega\$$, 1W, resistor might be a good choice.

Companies that make MOSFET devices often publish useful papers called application notes (or white papers, or bench notes, etc.) to help engineers better understand these devices. Listed below are three examples. I also recommend an Internet search using keywords like "MOSFET switch capacitive load".

Texas Instruments
Application Report SLVA883
http://www.ti.com/lit/an/slva883/slva883.pdf

Vishay Siliconix
Device Application Note AN608A
Power MOSFET Basics: Understanding Gate Charge and Using it to Assess Switching Performance
https://www.vishay.com/docs/73217/an608a.pdf

ON Semiconductor
Application Note AND9093/D
Using MOSFETs in Load Switch Applications
https://www.onsemi.com/pub/Collateral/AND9093-D.PDF

And in addition to everyone else's comments, I suggest you also consider whether to manage the inrush current into the 2200 μF capacitance that's connected to node Vout. If you can, perform a SPICE simulation—e.g., LTspice, OrCAD, etc.—on this circuit with the capacitor initially discharged. You'll find that the 80 V power source, and PMOS transistor M2, and the 2200 μF capacitor must endure a sustained inrush current of about 23 A for about 8 ms when M2 turns on. Parasitic inductance in the PCB traces and in the capacitor should also be considered in circuit nodes where large transient currents are present. See also: negative temperature coefficient (NTC) thermistors; "soft start" circuits/ICs.


text:
## twilaswift 2 years ago A rectangle that is 8 inches long and 5 inches wide has the same area as a triangle that is 2 inches high. What is the base of the triangle? Show and explain each step to find the answer.

1. bloodrain

The area of the rectangle $8*5=40$ Equation for area of a triangle $A=\frac{ 1 }{ 2 }bh$

2. bloodrain

So a triangle with the same area as the rectangle must be twice the base and height as a rectangle

3. bloodrain

u understanding this?

4. twilaswift

A little bit.

5. bloodrain

ok what do you NOT understand then?

6. twilaswift

The base of the triangle. Do I need to add or multiply or anything for it?

7. bloodrain

well if you already know the height (2) and area (half the area of the rectangle or 20in) you can figure out the base of the triangle by first multiplying the area by 2 (40) and then dividing it by the height (2) here are all the steps from beginning to end: for the rectangle $A=bh$ $A=8*5$ $A=40$ for the triangle $A=\frac{ 1 }{ 2 }bh$ $40=\frac{ 1 }{ 2 }b2$

8. bloodrain

now do the algebra to figure out b

9. bloodrain

10. twilaswift

So I divided 40 by what? 2?

11. bloodrain

not sure just a moment

12. twilaswift

ok

13. bloodrain

no im wrong let me try again

14. twilaswift

ok

15. bloodrain

i have to go someone help please @ParthKohli

16. twilaswift

OK

17. twilaswift

40x2 = 80

18. twilaswift

so the base is 80 right?

19. bloodrain

i think so but not sure


text:
#### Vol. 6, No. 6, 2012

 Recent Issues
 The Journal About the Journal Editorial Board Subscriptions Editors' Interests Submission Guidelines Submission Form Editorial Login Ethics Statement ISSN: 1944-7833 (e-only) ISSN: 1937-0652 (print) Author Index To Appear Other MSP Journals
The smallest prime that does not split completely in a number field

### Xiannan Li

Vol. 6 (2012), No. 6, 1061–1096
##### Abstract

We study the problem of bounding the least prime that does not split completely in a number field. This is a generalization of the classic problem of bounding the least quadratic nonresidue. Here, we present two distinct approaches to this problem. The first is by studying the behavior of the Dedekind zeta function of the number field near $1$, and the second by relating the problem to questions involving multiplicative functions. We derive the best known bounds for this problem for all number fields with degree greater than $2$. We also derive the best known upper bound for the residue of the Dedekind zeta function in the case where the degree is small compared to the discriminant.

##### Keywords
primes, split, number fields, Dedekind zeta function
Primary: 11N60
Secondary: 11R42


text:
# edgecolor with usetex=True, usedistiller='pdf'

Hello,

When using usetex=True and

 savefig(file, facecolor='w', edgecolor='w')

The behavior of the generated EPS file is more like:
facecolor=None
edgecolor=‘w’

That is, the image’s facecolor is tranparent…taking on the background color of the latex document—while the edgecolor is definitely white.

This seems inconsistent to me, and I was wondering if there was a quick solution. I actually like that the facecolor is transparent (or nonexistent)…and I would like the same to hold for the edgecolor. As of now, I have an ugly white border around my image.

Also, it seems like there needs to be an extra keyword or option. Suppose someone wanted a white facecolor in the (usetex=True) EPS file. It doesn’t seem like this is currently possible. It would be nice if I could specify:

savefig(file, facecolor=None, edgecolor=None)

Thoughts?

\documentclass{article}
\usepackage{pstricks}
\usepackage{graphicx}
\begin{document}
\psframe*linecolor=blue(10in,10in)

\includegraphics{test}

from matplotlib import rc, rcParams
rc(‘text’, usetex=True)
rc(‘ps’, usedistiller=‘xpdf’)
from pylab import *
subplot(111,axisbg=‘red’)

plot(range(10))
savefig(‘test.eps’, facecolor=‘white’, edgecolor=‘white’)

It would also be nice if we could specify the axis background color to
be None as well (again, perhaps only useful when creating an EPS)…when using the plot command.

···

On 9/23/07, Tom Johnson <tjhnson@…287…> wrote:

Also, it seems like there needs to be an extra keyword or option. Suppose someone wanted a white facecolor in the (usetex=True) EPS file. It doesn’t seem like this is currently possible. It would be nice if I could specify:

savefig(file, facecolor=None, edgecolor=None)

Any comments on this? The behavior is, at best, inconsistent. At worst, the current behavior is incorrect, as it is not possible to have a white facecolor when using usetex/xpdf.

···

On 9/23/07, Tom Johnson <tjhnson@…287…> wrote:

On 9/23/07, Tom Johnson <tjhnson@…287…> wrote:

Also, it seems like there needs to be an extra keyword or option. Suppose someone wanted a white facecolor in the (usetex=True) EPS file. It doesn’t seem like this is currently possible. It would be nice if I could specify:

savefig(file, facecolor=None, edgecolor=None)

It would also be nice if we could specify the axis background color to
be None as well (again, perhaps only useful when creating an EPS)…when using the plot command.

Any comments on this? The behavior is, at best, inconsistent. At worst,
the current behavior is incorrect, as it is not possible to have a white
facecolor when using usetex/xpdf.

I used your script to create the eps file, and created the attached postscript
(you need an \end{document} in your latex code). Do you see anything wrong
with the resulting postscript? It looks fine to me.

dsd_test.ps (48.7 KB)

···

On Wednesday 26 September 2007 03:30:41 pm Tom Johnson wrote:

On 9/23/07, Tom Johnson <tjhnson@...287...> wrote:
> On 9/23/07, Tom Johnson <tjhnson@...287...> wrote:
> > Also, it seems like there needs to be an extra keyword or option.
> > Suppose someone wanted a white facecolor in the (usetex=True) EPS file.
> > It doesn't seem like this is currently possible. It would be nice if
> > I could specify:
> >
> > savefig(file, facecolor=None, edgecolor=None)
>
> It would also be nice if we could specify the axis background color to be
> None as well (again, perhaps only useful when creating an EPS)...when
> using the plot command.

That is probably a nontrivial change to mpl's existing color support.

Darren