%!TEX root = morusAC.tex

\section{Introduction}
\label{sec/Introduction}

Authenticated Encryption (AE) schemes combine the functionality of symmetric encryption schemes and message authentication codes.
Based on a shared secret key $K$, they encrypt a plaintext message $M$ to a ciphertext $C$ and authentication tag $T$ in order to protect both the confidentiality and the authenticity of $M$.
Most modern authenticated encryption algorithms are nonce-based schemes with associated data (AEAD),
where $(C, T)$ additionally depends on a unique nonce $N$ (or initialization value IV) and optional associated metadata $A$.
One of the most prominent standardized AEAD designs is \cipher{AES-GCM} \cite{indocryptMcGrewV04,nistDworkin07},
which is widely deployed in protocols such as \cipher{TLS} (since v1.2).

To address the growing need for modern authenticated encryption designs for different application scenarios,
the CAESAR competition was launched in 2013 \cite{CAESAR}.
The goal of this competition is to select a final portfolio of AEAD designs for three different use-cases:
(1) lightweight hardware characteristics,
(2) high-speed software performance, and
(3) robustness.
The competition attracted 57 first-round submissions, 7 of which were recently selected as finalists in the fourth selection round.

\MORUS is one of the three finalists for use-case (2), together with \cipher{OCB} and \cipher{AEGIS}.
This family of authenticated ciphers by Wu and Huang \cite{MORUS} provides three main variants:
\MORUS[640] with a 128-bit key and \MORUS[1280] with either a 128-bit or a 256-bit key.
The design approach is reminiscent of classical stream cipher designs and
continuously updates a relatively large state with a few fast operations.
\MORUS can be efficiently implemented in both software and hardware;
in particular, the designers claim that the software performance even surpasses
\cipher{AES-GCM} implementations using Intel's \cipher{AES-NI} instructions,
and that \MORUS is the fastest authenticated cipher not using \cipher{AES-NI} \cite{MORUS}.

\subsubsection*{Related Work.}
In the \MORUS submission document, the designers discuss the security of \MORUS against
several attacks, including algebraic, differential, and guess-and-determine attacks.
The main focus is on differential properties, and not many details are given for other attack vectors.
In third-party analysis,
Mileva et~al.~\cite{balkancryptsecMilevaDV15} propose a distinguisher in the nonce-reuse setting and practically evaluate the differential behaviour of toy variants of \MORUS.
Shi et~al.~\cite{aiieShiGLZ16} analyze the differential properties of the finalization reduced to 2 out of 10 steps, but find no attacks.
Dwivedi et~al.~\cite{cryptoeprint:2016:1053} discuss the applicability of SAT solvers for state recovery, but the resulting complexity of $2^{370}$ for \MORUS[640] is well beyond the security claim.
Dwivedi et~al.~\cite{secryptDwivediMW17} also propose key-recovery attacks for \MORUS[1280] if initialization is reduced to 3.6 out of 16 steps, and discuss the security of \MORUS against internal differentials and rotational cryptanalysis.
Salam et~al.~\cite{trustcomSalamSBDPW17} apply cube attacks to obtain distinguishers for up to 5 out of 16 steps of the initialization of \MORUS[1280] with negligible complexity.
Additionally,
Kales et~al.~\cite{cryptoeprint:2017:1137} and
Vaudenay and Viz\'{a}r \cite{cryptoeprint:2017:1147}
independently propose state-recovery and forgery attacks on \MORUS in a nonce-misuse setting with negligible data and time complexities.

Finally, a keystream correlation similar in nature to our main attack was uncovered by Minaud \cite{sacryptMinaud14} on the authenticated cipher \cipher{AEGIS} \cite{AEGIS,sacryptWuP13}, another CAESAR finalist.
\cipher{AEGIS} shares the same overall structure as \MORUS, but uses a very different state update function,
based on the parallel application of \cipher{AES} rounds, rather than the shift/AND/XOR operations used in \MORUS.
Similar to our attack, the approach in \cite{sacryptMinaud14} is to build a linear trail linking ciphertext bits, while canceling the
contribution of inner state bits.
How the trail is built depends primarily on the state update function, and how it lends itself to linear cryptanalysis.
Because the state update function differs significantly between AEGIS and MORUS, the process used to build the trail is also quite different.

\subsubsection*{Our Contributions.}
Our main contribution is a keystream distinguisher on full \MORUS[1280], built from linear approximations of its core \StateUpdate{} function.
In addition, we provide results for round-reduced \MORUS, targeting both the initialization or finalization phases of the cipher.

In more detail, our main result is a linear approximation \cite{eurocryptMatsui93,eurocryptMatsuiY92} linking plaintext and ciphertext bits spanning five consecutive encryption blocks.
%As a consequence of this trail, we exhibit a biased linear combination of ciphertext bits, which holds across any given sequence of five consecutive encryption steps.
%Technically, this assumes that the inner state of the cipher at the start of the trail is uniformly random, but this is a fair assumption since the inner state should be indistinguishable from uniform randomness by design.
%Moreover, that is the only assumption required; in particular, the secret key or the nonce used to initialize the inner state of MORUS are irrelevant: the bias is independent of their value.
%As a consequence, when encrypting a fixed plaintext segment multiple times, a linear correlation exists between some output bits of the cipher.
Moreover, the correlation does not depend on the secret key of the cipher.
In principle, this property could be used as a known-plaintext distinguisher, or to recover unknown bits of a plaintext encrypted a large number of times.
For \MORUS[1280] with 256-bit keys, the linear correlation is $2^{-76}$
and can be exploited using about $2^{152}$ encrypted blocks.

To the best of our knowledge, this is the first attack on full \MORUS in the nonce-respecting setting.
We note that rekeying does not prevent the attack: the biases are independent of the secret encryption key and nonce, and can be exploited for plaintext recovery as long as a given plaintext segment is encrypted sufficiently often, regardless of whether each encryption uses a different key.
A notable feature of the linear trail underpinning our attack is also that it does not depend on the values of rotation constants: a very similar trail would exist for most choices of round constants.

To obtain this result, we propose a simplified abstraction of \MORUS, called \MiniMORUS. \MiniMORUS takes advantage of certain rotational invariants in \MORUS and simplifies the description and analysis of the attack. We then show how the attack can be extended from \MiniMORUS to the real \MORUS.
%We observe that the actual bias of the approximation is better than suggested by the construction of the characteristics.
To confirm the validity of our analysis,
we practically verified the correlation of the full linear trail for \MiniMORUS, as well as the correlation of trail fragments for the full \MORUS.
Our analysis is also backed by a symbolic evaluation of the full trail equation and its correlation on all variants of \MORUS.

In addition to the previous attack on full \MORUS, we provide two secondary results: (1) we analyze the security of \MORUS against forgery attacks with round-reduced finalization; and (2) we analyze its security against key recovery in a nonce-misuse setting, with round-reduced initialization.
While this extra analysis does not threaten full \MORUS, it complements the main result to provide a better overall understanding of the security of \MORUS.
More precisely, we present a forgery attack for round-reduced \MORUS[1280] with success probability $2^{-88}$ for a 128-bit tag if the finalization is reduced to 3 out of 10 steps. This nonce-respecting attack is based on a differential analysis of the padding rule.
The second result targets round-reduced initialization with 10 out of 16 steps, and extends a state-recovery attack (which can be mounted e.g. in a nonce-misuse setting) into a key-recovery attack.

\subsubsection*{Outline.}
This paper is organized as follows.
We first provide a brief description of \MORUS in \Cref{sec/Preliminaries}.
In \Cref{sec/introminimorus}, we introduce \MiniMORUS, an abstraction of \MORUS based on a certain class of rotational invariants.
We analyze this simplified scheme in \Cref{sec/minitrails} and provide a ciphertext-only linear approximation with a weight of 16.
We then extend our result to the full scheme in \Cref{sec/fulltrails}, showing a correlation in the keystream over 5 steps,
and discuss the implications of our observation for the security of \MORUS in \Cref{sec/Discussion}.
In \Cref{sec/IniFin}, we present our results on the security of \MORUS with round-reduced initialization (in a nonce-misuse setting) or finalization.
We conclude in \Cref{sec/Conclusion}.

%%% Local Variables:
%%% TeX-master: "morusAC"
%%% End:


% !TEX root =  main.tex

To establish an authenticated security context for \mOscore,
\mEdhoc{} uses a three-message protocol structure
shown in Figure~\ref{fig:edhocFramework}.
%
In the first message \mMsgone{}, the initiator (\mT{I}) sends to the responder (\mT{R}) an
ephemeral DH half-key \mGx{}, an ordered list of supported cipher suites, and, in the \mMethod{} element, suggests
authentication methods to be used.
%
\mT{R} may reject the choice of cipher suite, leading to a negotiation across multiple \mEdhoc{} sessions (see Section~\ref{sec:ciphersuiteNegotiation}), or that of the authentication methods.
%
In the second message \mMsgtwo{}, \mT{R} provides its ephemeral
DH half-key \mGy{} and authenticates itself to \mT{I} by
providing authentication data \mAuthr{}.
%
Finally, in the third message \mMsgthree{}, \mT{I} authenticates itself
to \mT{R} by providing authentication data \mAuthi{}.
%
The authentication data consists of a MAC for all authentication methods.
%
This MAC is also signed when authentication is based on public key signatures.
%
In addition to the exchange of DH half-keys and authentication data, the
messages also include parameters for the \mOscore{} security context, such as
encryption algorithm identifiers (\mSuites{}) and \mOscore{} security context
identifiers \mCi{} and \mCr{}.
%
Optionally, messages may also include application layer data \mAD{}, which
enjoys differing levels of protection depending on which message it is part of.
%
We do not include \mCi, \mCr, and \mAD{} in our modelling here.
%
When authentication is based on
a pre-shared key, the \mCredi{} and \mCredr{} credential identifiers are not
used.
%
Instead, a single identifier for the pre-shared key is transmitted in \mMsgone{}.
%
\begin{figure}
\centering
\linespread{1}
\tikzset{>=latex, every msg/.style={draw=thick}, every node/.style={fill=none,text=black}}
\begin{tikzpicture}
    \node (ini) at (0, 0) {Initiator (\mT{I})};
    \draw [very thick] (0, -0.25) -- (0,-2.2);
    \draw [very thick] (7, -0.25) -- (7,-2.2);
    \node (res) at (7,0) {Responder (\mT{R})};
    \msg{1em}{ini}{res}{\mMsgone: \mMethod, \mSuites, \mGx, \mCi, \mADone};
\msg{3em}{res}{ini}{\mMsgtwo: \mCi, \mGy, \mCr, [\mIdcredr, \mAuthr, \mADtwo]};
    \msg{5em}{ini}{res}{\mMsgthree: \mCr, [\mIdcredi, \mAuthi, \mADthree]};
    \draw [line width=1mm] (-0.75,-2.2) -- (0.75,-2.2);
    \draw [line width=1mm] (7-0.75,-2.2) -- (7+0.75,-2.2);
    \end{tikzpicture}
\caption{Structure of \mEdhoc{}: $[t]$ means $t$ is encrypted and integrity protected}
\label{fig:edhocFramework}
\end{figure}

\knote{note that the version we look at has private keys, but the current spec
    in IETF does not. OTOH, they aim to add that later, and I can't see how they
    could avoid doing so. That is why I write "aims to..."
}
\mEdhoc{} aims to accommodate three credential types
a party may use for authentication -- certificates, private keys
and static long-term DH keys.
%
Depending on the types used, the authentication methods differ,
and \mAuthi{} and \mAuthr{} need to be constructed accordingly.
%
The three authentication methods are based on digital signatures (\mSig),
challenge-response signatures based on static long-term DH keys (\mStat) and
pre-shared symmetric keys (\mPsk).
%
The two parties may use different authentication methods in an \mEdhoc{} run.
%
While any combination of the \mSig{} and \mStat{} methods is possible,
when \mPsk{} is used, both parties must use \mPsk{}.
%
We refer to these \emph{combinations} of authentication methods as
\emph{methods} to follow the terminology in the
\mSpec{}~\cite{selander-lake-edhoc-01}.
%
Thus, we have five methods: \mSigSig, \mSigStat, \mStatStat, \mStatSig{} and
\mPskPsk.
%
The first method in a name denotes the
authentication method used by the initiator of the protocol run and the second denotes the
one used by the responder.
%
We refer to a method where at least one party uses \mSig{} as a \mSig-based
method, and similarly for \mStat{} and \mPsk.
%

We first briefly discuss \mEdhoc's relations to the protocols on which it is
based before providing details about the methods.
%

%-----------------------------------------------------------------------------
\subsection{Relation to \mSigma, \mOptls{}, and \mNoise{}}
\label{sec:relationsToOtherProtocols}
We now present how \mEdhoc{} uses \mSigma, \mOptls{}, and \mNoise{} as
cryptographic cores for various methods, and the ways in which it differs from them.
\\
%
Being designed as an industrial standard, \mEdhoc{} specifies more details
on top of these cores, e.g., connection identifiers for message multiplexing,
encoding and application specific parameters to be negotiated.
%

%-----------------------------------------------------------------------------
%\runhead{\mSigma{}}
\subsubsection{\mSigma{}}
\label{sec:sigma}
The \mSigSig{} method of \mEdhoc{} is closely modeled on the \mSigma{}
variant that provides identity protection for the initiator~\cite{sigma}.
%
Some aspects differ though, e.g., \mSigSig{} uses Mac-then-Sign like
\mTls{} instead of Sign-then-Mac.
%

%-----------------------------------------------------------------------------
\subsubsection{\mOptls{}}
\label{sec:optls}
The \mStat-based methods use challenge-response signatures based on static
long-term DH keys, and proceed along the lines of
\mOptls~\cite{DBLP:conf/eurosp/KrawczykW16}.
%
The challenge-response works as follows.
Party $A$ sends a random challenge $r$
and an ephemeral DH half-key $e$ to a party $B$.
%
$B$ mixes $e$ and $r$ with its secret static
long-term DH key $s$ to obtain a temporary key, which
%
is used to compute a MAC that is returned to $A$.
%
This authenticates $B$ to $A$, which is sufficient for \mOptls,
because it only considers server authentication, where the server acts as $B$
and the client as $A$.
%
The temporary key also affects the final session key.
%

In \mEdhoc, a party using the \mStat{} authentication method
essentially acts as an \mOptls{} client and the peer as an \mOptls{}
server.
%
However, unlike \mOptls{}, \mEdhoc{} requires mutual
authentication~\cite{ietf-lake-reqs-04}.
%
\mStatStat{} can be thought of as interleaving two \mOptls{}
runs, one initiated by each party, and then combining the resulting session key
material.
%
Also, \mOptls{} uses the conservative security approach where $e$ and $r$
are distinct elements, whereas \mEdhoc{} reuses the $e$ as the challenge $r$.
%
The latter can only weaken security.
%

%------------------------------------------------------------------------- sub
\subsubsection{\mNoise{}}
The \mStatStat{} and \mPskPsk{} methods follow the \mNoise{}
framework~\cite{perrin2016noise}.
%
\mNoise{} defines how to construct AKE protocols, using static long-term DH
keys or pre-shared keys as credentials.
%
Its goal is to use so-called patterns to harmonize the many static long-term
key DH-based AKE protocols, of which \mOptls{} is one.
%
\mNoise{} specifies how to derive keys, use transcript hashes to ensure
authentication of the message flow etc.
%
The \mNoise{} pattern closest to the \mStatStat{} method is called XX.
%
However, \mEdhoc{} does not use the functions of \mNoise{} exactly as
prescribed.
%
It is thus not obvious that \mEdhoc{} automatically inherits
the properties enjoyed by XX.
%
For example, according to \mNoise{}, the mixHash function is called on
pre-message public keys during the initialization.
%
This would correspond to \mEdhoc{} computing a first intermediate transcript
hash over those keys, which \mEdhoc{} does not do.
%

%------------------------------------------------------------------------- sub
\subsection{Methods of \mEdhoc{}}
\label{sec:methods}
Although \mCbor{} and \mCose{}~\cite{rfc8152} are important building blocks of
\mEdhoc{}, and we use their terminology in our \mTamarin{} model to better
reflect the \mSpec{}, our model does not cover the details of encoding and
\mCose{} interfaces.
%
Thus, we omit details about \mCbor{} and \mCose{}. Similarly, we refer the reader to~\cite{aead} for details about authenticated encryption with associated data (AEAD).
%
All methods make use of a common key hierarchy, which we describe first.
%

%------------------------------------------------------------------------- sub
\subsubsection{Key Hierarchy}
%\runhead{Key Hierarchy}
\label{sec:keyHierarchy}
\mEdhoc{} derives keys using \mHkdf{}~\cite{rfc5869}.
%
The \mHkdf{} interface provides two functions -- \mHkdfExtract{}, which
constructs uniformly distributed key material from random input and a seed,
and \mHkdfExpand{}, which generates keys from key material and a seed.
%
The seeds are used to bind the key material and keys to certain parameters.
%
Derived keys (\mKtwoe, \mKtwom{}, \mKthreeae, and \mKthreem) are then used as
input to encryption and integrity protection algorithms.
%

The key hierarchy is rooted in the ephemeral DH key \mGxy{}, the combination
of the two half-keys \mGx{} and \mGy{}.
%
From this, keys are successively constructed with each transmitted message,
weaving in information parties learn as the protocol progresses, culminating
in the established session key material.
%
From the session key material, a key exporter (\mEdhoc-Exporter) based on
\mHkdf{} can be used to extract the encryption and integrity keys required
for \mOscore{}.
%
Figure~\ref{fig:kdfdiagram} shows an abstract description of the key hierarchy.
%

From \mGxy{}, three intermediate keys \mPRKtwo, \mPRKthree{} and
\mPRKthree{} are derived.
%
Each one of them corresponds to a specific message in the protocol, and from
these intermediate keys, encryption and integrity keys for that message are
derived.
%
For \mPskPsk{}, the pre-shared key is used as seed for \mPRKtwo.
%
For all other methods the seed for \mPRKtwo{} is empty.
%
In the \mPskPsk{} and \mSigSig{} methods, all three intermediate keys
are the same, i.e., $\mPRKtwo{} = \mPRKthree{} = \mPRKfour$.
%
For the three \mStat-based methods, however, they differ.
%
This is because the intermediate key \mPRKthree{} is dependent on the static
long-term key of the party (or parties, if both) using \mStat{}-based
authentication.
%

\begin{figure}[!h]
\centering
\scalebox{.75}{
\linespread{1}
\input{kdfdiagram.tex}
}
\caption{Joint key hierarchy for all methods}
\label{fig:kdfdiagram}
\end{figure}

We now describe the \mEdhoc{} methods.
%
%Since the \mSigSig{} method has been analyzed earlier, we do not focus on
%it here.
%

\subsubsection{\mPskPsk{}}
In this method, the initiator and responder are assumed to share a pre-shared
key (\mPsk) identified by \mIDPsk.
%
The message sequence is shown in Figure~\ref{fig:edhocpsk}.
%
The first message contains the \mIDPsk{} identifier.
%
The responder obtains the corresponding \mPsk{} and uses that to construct the
authentication data, i.e., the MAC in the \mAead{} transform), included in
the second message.
%
n the third message, the initiator uses this same technique to authenticate
to the responder.
%
The transcript hash \mTH{} keeps track of the data sent in the messages.
%
One unconventional feature is that the transcript hash lags behind by one
message.
%
That is, the second transcript hash \mTHtwo{}, does not cover the content of
the second message (similarly for \mTHthree).
%
The reason for this is that \mTHtwo{} cannot cover the output of the
\mAead{} transform, since \mTHtwo{} is itself an input to it.
%
This is the same for all methods, but it does not cause any problems with
authentication, since the data not covered by the transcript hash is
instead MACed or signed.
%

\begin{figure}
\centering
\linespread{1}
\scalebox{.69}{
\tikzset{>=latex, every msg/.style={draw=thick}, every node/.style={fill=none,text=black}}
\begin{tikzpicture}
    \node (ini) at (0, 0) {Initiator};
    \draw [very thick] (0, -0.5) -- (0,-11);
    \draw [very thick] (11.5, -0.5) -- (11.5,-11);
    \node[below=0.5em of ini,fill=white] () {Knows $g,\ \mPsk,\ \mIDPsk,\ \mADone,\ \mADthree$};
    \node (res) at (11.5,0) {Responder};
    \node[below=0.5em of res,fill=white] () {Knows $g,\ \mPsk,\ \mIDPsk,\ \mADtwo$};
    \action{3em}{ini}{Generates \mMethod,\ \mSuites,\ \mCi,\ $x$\\$\mGx = g^{x}$};
    \msg{6.5em}{ini}{res}{\mMsgone: \mMethod, \mSuites, \mGx, \mCi, \mIDPsk, \mADone};
    \action{7em}{res}{$
      \begin{array}{c}
        \text{Generates } \mCr,\ $y$\\
        \mGy = g^{y}\\
        \mTHtwo = \mHash(\mMsgone, g^{y})\\
        \mPRKtwo = \mHkdfExtract(\mPsk, g^{xy}) \\
        \mKtwoae = \mHkdfExpand(\mPRKtwo, \mTHtwo)
      \end{array}$};
    \msg{15.5em}{res}{ini}{\mMsgtwo: \mCi, \mGy, \mCr, $\overbrace{\mAead(\mKtwoae; \mTHtwo, \mADtwo)}^{\mCipher}$};
    \action{16.5em}{ini}{$
      \begin{array}{c}
       \mTHtwo = \mHash(\mMsgone, \mGy)\\
       \mPRKtwo = \mHkdfExtract(\mPsk, g^{xy}) \\
        \mKtwoae = \mHkdf(\mPRKtwo, \mTHtwo)\\
        \mTHthree = \mHash(\mTHtwo, \mCipher)\\
        \mPRKthree = \mPRKtwo \\
        \mKthreeae = \mHkdfExpand(\mPRKthree, \mTHthree)
      \end{array}$};

    \msg{25.5em}{ini}{res}{\mMsgthree: \mCr, \mAead(\mKthreeae; \mTHthree; \mADthree)};
    \action{26em}{res}{$
    \begin{array}{c}
    	\mPRKthree = \mPRKtwo \\
        \mKthreeae = \mHkdfExpand(\mPRKthree, \mTHthree)
    \end{array}$};
    \draw [line width=1mm] (-2,-11) -- (2,-11);
    \draw [line width=1mm] (9.5,-11) -- (13.5,-11);
    \end{tikzpicture}}
\caption{The \mPskPsk{} method; $\mAead(k; x; y)$ is used to denote
\mAead{} encryption where $k$ is the key, $x$ is associated data to be integrity
protected, and $y$ is the plaintext}
\label{fig:edhocpsk}
\end{figure}
%

%------------------------------------------------------------------------- sub
\subsubsection{\mStat-based Methods.}
\mEdhoc{} provides three \mStat-based methods -- \mSigStat{}, \mStatStat{} and
\mStatSig{}.
%
One or both of the initiator and responder authenticate to their peer using
their secret static long-term DH key, \mLtki{} or \mLtkr{} respectively.
%
Authentication of the party using the \mStat{} method follows the
challenge-response signature pattern from \mOptls.
%
In the same terms as Section~\ref{sec:optls}, the ephemeral DH half-key of the
peer takes the place of both $r$ and $e$, i.e., $r=e$, and $s$ is the secret
static long-term DH key of the party to be authenticated.
%
Assuming the discrete log problem is hard in the underlying DH group,
only the initiator and responder will be able to compute $e^s$.
%
That value is then affecting the computation of \mAuthr{} or \mAuthi{}
(depending on who is the authenticator), and it is also
woven in to the key hierarchy, see
Figures~\ref{fig:kdfdiagram} and \ref{fig:edhocsigstat}.
%
The receiver of \mAuthi{}/\mAuthr{} assumes that only the responder knows
the corresponding $e^s$, and therefore considers the peer authenticated if
the \mAead{} transform completes successfully.\\
%
In contrast to the \mPskPsk{} method, in \mStat{}-based methods, each party provides an identifier, \mIdcredi{} and \mIdcredr{} respectively, for the credentials they use.
%

%------------------------------------------------------------------------- sub
%\subsubsection{\mSigStat.}
\paragraph{\mSigStat}
The initiator uses the \mSig{} method, authenticating with a signature,
while the responder uses the \mStat{} method, authenticating with a
challenge-response signature.
%
The detailed message sequence chart is shown in Figure~\ref{fig:edhocsigstat}.
%
\mCredi{} and \mLtki{} must be signature keys since the initiator is using the
\mSig{} method.
%

\begin{figure}[h]
\centering
\linespread{1}
\scalebox{.7}{
\tikzset{>=latex, every msg/.style={draw=thick}, every node/.style={fill=none,text=black}}
\begin{tikzpicture}
    \node (ini) at (0, 0) {Initiator};
    \draw [very thick] (0, -0.5) -- (0,-15.5);
    \draw [very thick] (9, -0.5) -- (9,-15.5);
    \node[below=0.5em of ini,fill=white] {$
    \begin{array}{c}
    \text{Knows}\ $g$,\ \mCredi,\ \mLtki,\ \mIdcredi,\\
    \mIdcredr, \mADone,\ \mADthree
    \end{array}
    $};
    \node (res) at (9,0) {Responder};
    \node[below=0.5em of res,fill=white] {$
    \begin{array}{c}
    \text{Knows}\ $g$,\ \mCredr,\ \mLtkr, \ \mIdcredr,\\
    \mIdcredi, \mADtwo
    \end{array}$};
    \action{4.5em}{ini}{Generates \mMethod,\ \mSuites,\ \mCi,\ $x$\\$\mGx = g^{x}$};
    \msg{9em}{ini}{res}{\mMsgone: \mMethod, \mSuites, \mGx, \mCi, \mADone};
    \action{9.5em}{res}{$
      \begin{array}{c}
        \text{Generates } \mCr,\ $y$\\
        \mGy = g^{y}\\
        \mTHtwo = \mHash(\mMsgone, \langle \mCi, \mGy, \mCr \rangle)\\
        \mPRKtwo = \mHkdfExtract(\textrm{``\phantom{}''}, g^{xy}) \\
        \mGrx = \mGx^{\mLtkr} \\
        \mPRKthree = \mHkdfExtract(\mPRKtwo, \mGrx) \\
        \mKtwom = \mHkdfExpand(\mPRKthree, \mTHtwo) \\
        \mMactwo = \mAead(\mKtwom; \langle \mIdcredr, \mTHtwo, \mCredr, \mADtwo \rangle; \textrm{``\phantom{}''}) \\
        \mKtwoe = \mHkdfExpand(\mPRKtwo, \mTHtwo)
      \end{array}$};
    \msg{24em}{res}{ini}{\mMsgtwo: \mCi, \mGy, \mCr, $\overbrace{\mKtwoe\ \mXor\ \langle \mIdcredr, \mMactwo, \mADtwo \rangle}^{\mCipher}$};
    \action{25em}{ini}{$
      \begin{array}{c}
        %\mTHtwo = \mHash(\mMsgone, \langle \mCi, \mGy, \mCr \rangle) \
        \mPRKtwo = \mHkdfExtract(\textrm{``\phantom{}''}, g^{xy}) \\
        %\mKtwoe = \mHkdfExpand(\mPRKtwo,\mTHtwo)\\
        \mGrx = \mCredr^{x} \\
        \mPRKfour = \mPRKthree = \mHkdfExtract(\mPRKtwo, \mGrx) \\
        %\mKtwom = \mHkdfExpand(\mPRKthree, \mTHtwo) \\
        \mKthreeae = \mHkdfExpand(\mPRKthree, \mTHtwo) \\
        \mTHthree = \mHash(\mTHtwo, \mCipher, \mCr)\\
        \mKthreem = \mHkdfExpand(\mPRKfour, \mTHthree) \\
        \mMacthree = \mAead(\mKthreem; \langle \mIdcredi, \mTHthree, \mCredi, \mADthree \rangle; \textrm{``\phantom{}''}) \\
        \mSigthree = \mSign(\mLtki; \langle \mIdcredi, \mTHthree, \mCredi, \mADthree \rangle, \mMacthree \rangle)
      \end{array}$};
    \msg{37em}{ini}{res}{$\mMsgthree: \mCr, \mAead(\mKthreeae; \mTHthree; \langle \mIdcredi, \mSigthree, \mADthree \rangle$)};
    \action{37.5em}{res}{$
    \begin{array}{c}
        \mTHthree = \mHash(\mTHtwo, \mCipher, \mCr)\\
        \mKthreem = \mHkdfExpand(\mPRKthree, \mTHthree) \\
        \mKthreeae = \mHkdfExpand(\mPRKthree, \mTHthree)
    \end{array}$};
    \draw [line width=1mm] (-2,-15.5) -- (2,-15.5);
    \draw [line width=1mm] (7,-15.5) -- (11,-15.5);
    \end{tikzpicture}}
    \caption{The \mSigStat{} method; (\mCredi{}, \mLtki), and
        (\mCredr{}, \mLtkr{}) are public-private key pairs; $\mSign(k; x)$ is
    used to denote the signing of message $x$ using key $k$}
\label{fig:edhocsigstat}
\end{figure}
%

%------------------------------------------------------------------------- sub
\paragraph{\mStatSig}
This method mirrors the \mSigStat{} method.
%
The responder runs \mSig{} and creates \mAuthr{} as a signature over MAC,
while the initiator runs \mStat{}.
%
This is illustrated in Figure~\ref{fig:edhocstatsig}. \mCredr{} and \mLtkr{}
must be signature keys.
%

\begin{figure}[h]
\centering
\linespread{1}
\scalebox{.7}{
\tikzset{>=latex, every msg/.style={draw=thick}, every node/.style={fill=none,text=black}}
\begin{tikzpicture}
    \node (ini) at (0, 0) {Initiator};
    \draw [very thick] (0, -0.5) -- (0,-15.5);
    \draw [very thick] (9, -0.5) -- (9,-15.5);
    \node[below=0.5em of ini,fill=white,text=black] {$
    \begin{array}{c}
    \text{Knows}\ $g$,\ \mCredi,\ \mLtki,\ \mIdcredi,\\
    \mIdcredr, \mADone,\ \mADthree
    \end{array}
    $};
    \node (res) at (9,0) {Responder};
    \node[below=0.5em of res,fill=white] {$
    \begin{array}{c}
    \text{Knows}\ $g$,\ \mCredr,\ \mLtkr,\ \mIdcredr,\\
    \mIdcredi, \mADtwo
    \end{array}$};
    \action{4.5em}{ini}{Generates \mMethod,\ \mSuites,\ \mCi,\ $x$\\$\mGx = g^{x}$};
    \msg{8.5em}{ini}{res}{\mMsgone: \mMethod, \mSuites, \mGx, \mCi, \mADone};
    \action{9.5em}{res}{$
      \begin{array}{c}
        \text{Generates } \mCr,\ $y$\\
        \mGy = g^{y}\\
        \mTHtwo = \mHash(\mMsgone, \langle \mCi, \mGy, \mCr \rangle)\\
        \mPRKthree = \mPRKtwo = \mHkdfExtract(\textrm{``\phantom{}''}, g^{xy}) \\
        \mKtwom = \mHkdfExpand(\mPRKthree, \mTHtwo) \\
        \mMactwo = \mAead(\mKtwom; \langle \mIdcredr, \mTHtwo, \mCredr, \mADtwo \rangle; \textrm{``\phantom{}''}) \\
        \mSigtwo = \mSign(\mLtkr; \langle \langle \mIdcredr, \mTHtwo, \mCredr, \mADtwo \rangle, \mMactwo \rangle)\\
        \mKtwoe = \mHkdfExpand(\mPRKtwo, \mTHtwo)
      \end{array}$};
    \msg{23em}{res}{ini}{\mMsgtwo: \mCi, \mGy, \mCr, $\overbrace{\mKtwoe\ \mXor\ \langle \mIdcredr, \mSigtwo, \mADtwo \rangle}^{\mCipher}$};
    \action{24em}{ini}{$
      \begin{array}{c}
        \mPRKthree = \mPRKtwo = \mHkdfExtract(\textrm{``\phantom{}''}, g^{xy}) \\
        \mGiy = \mGy^{\mLtki} \\
        \mPRKfour = \mHkdfExtract(\mPRKthree, \mGiy) \\
        \mTHthree = \mHash(\mTHtwo, \mCipher, \mCr)\\
        \mKthreem = \mHkdfExpand(\mPRKfour, \mTHthree) \\
        \mMacthree = \mAead(\mKthreem; \langle \mIdcredi, \mTHthree, \mCredi, \mADthree \rangle; \textrm{``\phantom{}''}) \\
        \mKthreeae = \mHkdfExpand(\mPRKthree, \mTHthree) \\
      \end{array}$};
    \msg{34.7em}{ini}{res}{$\mMsgthree: \mCr, \mAead(\mKthreeae; \mTHthree; \langle \mIdcredi, \mMacthree, \mADthree \rangle$)};
    \action{35.2em}{res}{$
    \begin{array}{c}
       \mGiy = \mCredi^{y} \\
       \mPRKfour = \mHkdfExtract(\mPRKthree, \mGiy) \\
       \mTHthree = \mHash(\mTHtwo, \mCipher, \mCr)\\
        \mKthreem = \mHkdfExpand(\mPRKfour, \mTHthree) \\
        \mKthreeae = \mHkdfExpand(\mPRKthree, \mTHthree)
    \end{array}$};
    \draw [line width=1mm] (-2,-15.5) -- (2,-15.5);
    \draw [line width=1mm] (7,-15.5) -- (11,-15.5);
    \end{tikzpicture}}
\caption{The \mStatSig{} method of \mEdhoc}
\label{fig:edhocstatsig}
\end{figure}
%

\paragraph{\mStatStat}
Both the initiator and the responder use the \mStat{}
authentication method.
%
Both parties' secret static long-term DH keys feed into the key hierarchy.
%
The initiator computes authentication data using the \mAead{} transform
and includes that in the third message for the responder to verify.
%

%------------------------------------------------------------------------- sub
\subsubsection{\mSigSig}
Both parties run \mSig{} and authenticate with signatures.
%
As mentioned earlier, \mSigSig{} is very closely modeled on \mSigmaI{}, but
there are some notable differences.
%
For example, \mEdhoc{} aims to provide some degree of identity protection for
responders, and therefore uses the idea from \mSigmaI{} of encrypting the
responder identifier \mIdcredr{} (and other items) in the second message.
%
The designers of \mEdhoc{} consider it wasteful adding a second MAC in addition
to the already included \mMactwo{}, to limit bandwidth consumption.
%
\mEdhoc{} applies XOR encryption, with \mHkdf{} being used to generate the
key stream, whereas \mSigma{} assumes authenticated encryption for this
purpose (see Section 5.2 of~\cite{sigma}).
%
Because \mSigSig{} has been analyzed in~\cite{DBLP:conf/secsr/BruniJPS18}, we
do not focus on it here.
%
However, we model it and verify its properties as carefully as for the other methods.

%------------------------------------------------------------------------- sub
\subsection{Negotiating a cipher suite and method and correlation parameters}
\label{sec:ciphersuite}
Recall that we mentioned that the first message contains a list of cipher suites, ranked according to the preference of the initiator. What does a cipher suite actually contain? An \mEdhoc{} cipher suite consists of an ordered set of \mCose{} algorithms: an \mAead{} algorithm, a hash algorithm, an ECDH curve, a signature algorithm, a signature algorithm curve, an application \mAead{} algorithm, and an application hash algorithm from the \mCose{} Algorithms and Elliptic Curves registries.

There are four supported cipher suites in \mEdhoc{} -- we refer the reader to Section 3.4 of~\cite{selander-lake-edhoc-01} for the specifics of the algorithms allowed therein. Each cipher suite is identified by one of four predefined integer labels (0--3). Some algorithms are not used in some methods.  The signature algorithm and the signature algorithm curve are not used in methods without signature authentication (i.e. in \mPskPsk{} and \mStatStat).

In order to keep the presentation clean, we have omitted the cipher suite negotiation process from the description of the methods. However, this process happens as follows, at the beginning of every method, once the responder receives the first message. The initiator proposes an ordered list of cipher suites they support. This list presented in descending order to the responder who either accepts the topmost entry in this list (if they also support that suite) or makes a counter-proposal, namely the topmost entry which they support from the remaining part of the list. If there is no such entry the responder can reject, and the protocol does not continue. Similarly, the responder can reject the initiator's choices for the method and correlation parameters as well -- in the case of a reject for either of these values, the protocol aborts.

%------------------------------------------------------------------------- sub
\subsection{Claimed Security Properties}
\label{sec:claimedProperties}

We present the security properties that the authors
of the \mSpec{}~\cite{selander-lake-edhoc-01} claim \mEdhoc{} satisfies.
%
Many of the claims are imprecisely expressed.
%
We will revisit these claims when we discuss the formal modeling and
verification of \mEdhoc{} in Section~\ref{sec:formalization} and in the
discussions in Section~\ref{sec:discussion}.
%
These are our interpretations of the claimed security properties described in
the \mSpec~\cite{selander-lake-edhoc-01}, Section~8.1:
\begin{itemize}
    \item Perfect Forward Secrecy (\textbf{PFS}) for the session key material
    \item Mutual authentication (this presumably refers to entity authentication
        because it is followed by claims of
        \textbf{consistency} (defined in~\cite{sigma}),
        \textbf{aliveness}, and
        \textbf{peer awareness} to the responder, but not to the initiator)
    \item \textbf{Identity protection} (the initiator against active attacks
        and the responder against passive attacks, except for \mPskPsk{})
    \item Key Compromise Impersonation (\textbf{KCI}) resistance
    \item A single session of \mEdhoc{} enables the responder to verify
            that the selected cipher suite is the most preferred of the
            initiator which is supported by both parties, even though there is
            no negotiation of cipher suites per se.
    \item \textbf{Session key independence}
\end{itemize}


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%                                                                 %
%  GEANT manual in LaTeX form                                     %
%                                                                 %
%  Version 1.00                                                   %
%                                                                 %
%  Last Mod. 12 June 1993 18:20  MG                               %
%                                                                 %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\Origin{G.N.Patrick}
\Version{Geant 3.16}\Routid{PHYS400}
\Submitted {30.03.82} \Revised{16.12.93}
\Makehead{Simulation of particle decays in flight}
\section{Subroutines}
\Shubr{GDECAY}{}

\Rind{GDECAY} is the control routine for the simulation of particle
decays in flight. For a given parent particle it selects from a list a
two- or three-body decay mode using the known branching ratios and calls the
routines needed to generate the vertex and secondary tracks.
It used the following input and output:
\begin{DLtt}{MMMMMMM}
\item[input:]  via common blocks \FCind{/GCTRAK/} and \FCind{/GCKINE/}
\item[output:] via common block  \FCind{/GCKING/}
\end{DLtt}
\Rind{GDECAY} is called by the tracking routines.
It calls the subroutines
\Rind{GDECA2} for two-body decay, \Rind{GDECA3} for three-body decay,
\Rind{GLOREN} for Lorentz transformation and \Rind{GDROT} for rotation.
For the documentation of \Rind{GLOREN} and \Rind{GDROT}, see {\tt [PHYS410]}.
\Shubr{GDECA2}{(XM0,XM1,XM2,PCM)}
\begin{DLtt}{MMMMMMMM}
\item[XM0] ({\tt REAL}) mass of the parent particle
\item[XM1] ({\tt REAL}) mass of the first decay product
\item[XM2] ({\tt REAL}) mass of the second decay product
\item[PCM(3,4)] ({\tt REAL}) array containing the four-vectors of
the decay products
\end{DLtt}
{\tt GDECA2} simulates the two-body decay with isotropic angular
distribution in the center-of-mass system. It is called from
{\tt GDECAY}.
\Shubr{GDECA3}{(XM0,XM1,XM2,XM3,PCM)}
\begin{DLtt}{MMMMMMMM}
\item[XM0] ({\tt REAL}) mass of the parent particle
\item[XM1] ({\tt REAL}) mass of the first decay product
\item[XM2] ({\tt REAL}) mass of the second decay product
\item[XM3] ({\tt REAL}) mass of the third decay product
\item[PCM(3,4)] ({\tt REAL}) array containing the four-vectors of
the decay products
\end{DLtt}
{\tt GDECA3} simulates the three-body decay
with isotropic angular distribution in the center-of-mass system.
It is called from {\tt GDECAY}.

\section{Method}
\begin{itemize}
\item
Upon entry to \Rind{GDECAY} a binary search is made in a list of
parent particles. This list is stored in the {\tt JPART} structure
and currently contains the particles defined in \Rind{GPART}
{\tt [CONS300]}. If the current particle cannot be found in the list,
control is returned {\it without} any decay generation.
Up to six decay modes and their corresponding branching ratios are then
extracted from the {\tt JPART} data banks (see {\tt [CONS310]}).
\item
A decay channel is selected according to the branching ratios.
If the sum
of the branching ratios for a particle is not equal 100\%, it is
possible that {\it no} decay is selected.
\item
Depending on whether the two- or three-body decay is selected, either
\Rind{GDECA2} or \Rind{GDECA3} is called to generate the
four-momenta of the decay products with isotropic angular
distribution in the center-of-mass system.
\item
The momentum vectors of the decay products
are transformed into the laboratory
system and rotated back into the {\tt GEANT} coordinate frame.
The kinematics of the products is stored in the common \FCind{/GCKING/}.
\item
When a particle decays and no branching ratio is defined, then
\Rind{GDECAY}
calls the user routine \Rind{GUDCAY}.
\end{itemize}


\documentclass[modern]{aastex61}
\usepackage{graphicx}
\usepackage{grffile}
\usepackage{xcolor}
\usepackage[sort&compress]{natbib}
\usepackage[hang,flushmargin]{footmisc}
\usepackage{amsmath}

% units macros
\newcommand{\unit}[1]{\mathrm{#1}}
\newcommand{\km}{\unit{km}}
\newcommand{\m}{\unit{m}}
\newcommand{\s}{\unit{s}}
\newcommand{\kms}{\km\,\s^{-1}}
\newcommand{\ms}{\m\,\s^{-1}}
\newcommand{\ang}{\text{\normalfont\AA}}

% math macros
\newcommand{\dd}{\mathrm{d}}
\newcommand{\T}{^{\mathsf{T}}}

% text macros
\newcommand{\todo}[1]{\textcolor{red}{#1}}  % gotta have \usepackage{xcolor} in main doc or this won't work
\newcommand{\acronym}[1]{{\small{#1}}}
\newcommand{\project}[1]{\textsl{#1}}
\newcommand{\RV}{\acronym{RV}}
\newcommand{\CRLB}{\acronym{CRLB}}

\setlength{\parindent}{1.4em} % trust in Hogg

\shorttitle{is spectro-perfectionism perfect?}
\shortauthors{smartasses}

\begin{document}\sloppy\sloppypar\raggedbottom\frenchspacing % trust in Hogg
\graphicspath{ {figures/} }
\DeclareGraphicsExtensions{.pdf,.eps,.png}

\title{How perfect is spectro-perfectionism, really?}

\begin{abstract}\noindent
Current spectrograph performance requirements are increasing dramatically with pressure from the exoplanet community for precise radial velocity (\RV) measurements, the stellar community for detailed chemical abundances, and the cosmology community for intergalactic absorption mapping.
%Within the exoplanet community, spectrographs and their data reduction pipelines are designed with a primary goal in mind: obtaining the most precise  possible.
In some cases, design decisions are made at the instrument level to prioritize the capability of obtaining a reliably calibrated one-dimensional extracted spectrum from the two-dimensional raw data without losing much of the encoded information.
The concept of \textsl{spectro-perfectionism} outlines a way to extract spectra with minimal information loss \todo{(check that they claim this)} from any reasonable spectrograph design, at least in principle.
In this work we use \RV\ precision as a proxy for the accuracy and information content of an extracted spectrum.
We test the performances of traditional optimal extraction and of spectro-perfectionism on simulated spectra under a variety of spectrograph conditions.
We find that under [x] conditions, spectro-perfectionism is able to extract precise \RV s [at/near the Cram\'er--Rao bound], outperforming optimal extraction [by a factor of...].
However, both methods begin to fail when [x], suggesting a future need for performing spectroscopic inferences directly in the two-dimensional raw data space.
\end{abstract}

\section{Introduction}

Background on EPRV instruments and assumptions they make.

Background on optimal extraction and spectro-perfectionism

What we set out to do

\section{Data Generation}
General concept is a `photon-based' approach, meaning that a 2D spectrum is generated by repeating the following steps many times:
\begin{enumerate}
    \item select a random position in the input slit/fiber using a PDF that reflects the slit/fiber format.
    \item select a random wavelength (using the spectral source that we want to simulate as a PDF)
    \item transformation of the input position to a detector position via a (wavelength-dependent) affine transformation matrix.
The matrix represents (part of) the spectrograph optics and adjusting the matrix elements allows to define linear dispersion, the spatial format of the 2D spectrum as well as slit rotation ($\Theta$), shear and scaling (sx, sy) in dispersion and cross-dispersion direction.
    \item select a random xy distortion using a Gaussian (for now!) distribution to represent the spectrographs PSF
    \item bin the resulting detector position into detector pixels
\end{enumerate}
In equations:\\
Using

   	\[
	M_{\lambda} = \begin{pmatrix} m_{00} & m_{01} & m_{02} \\ m_{10} & m_{11} & m_{12} \\ m_{20} & m_{21} & m_{22} \end{pmatrix}  \stackrel{\text{(affine)}}{=} \begin{pmatrix} sx \cdot \cos(\Theta) & -sy \cdot \sin(\Theta+shear) & tx \\ sx \cdot \sin(\Theta) & sy \cdot \cos(\Theta+shear) & ty \\ 0 & 0 & 1 \end{pmatrix}
	\]

as an affine transformation matrix, we are calculating
\begin{equation}
    \begin{pmatrix} X \\ Y \\ 1 \end{pmatrix}_{\text{detector}} =
    \begin{pmatrix} m_{00} & m_{01} & tx \\ m_{10} & m_{11} & ty \\ 0 & 0 & 0 \end{pmatrix} \cdot
    \begin{pmatrix} X \\ Y \\ 1 \end{pmatrix}_{\text{slit}} +
    \begin{pmatrix} \Delta X \\ \Delta Y \\ 1 \end{pmatrix}_{\text{psf}}
\end{equation}
The simplest case is to have all matrix elements to be constant with wavelength except tx. That is equivalent to having pure linear dispersion and the detector rows
are perfectly aligned with the echelle orders.\\
In case a pure analytic function for the slit image is wanted, the slit input vector is replaced by $\begin{pmatrix} 0 & 0 & 1 \end{pmatrix}$.
Then, the matrix multiplication is simply a (wavelength dependent) shift but all spatial slit information come solely from the PSF.\\
The generated 2D data naturally comes with photon noise, detector readout noise can be added by adding appropriate noise on the binned detector data.
\begin{figure}
    \includegraphics[width=0.49\textwidth]{img/maroonx_data.png}
    \includegraphics[width=0.49\textwidth]{img/simulator_data.png}
    \caption{Comparison between part of a recorded MaroonX etalon spectrum (left) and simulation data with a similar spectral format and source (right).}
\end{figure}

how the data are generated, what the tunable knobs are, maybe a figure comparing fake data to e.g. MAROON-X test data or HARPS?

details on the time-series spectra we generate

\subsection{Theoretical Information Content}
since we're generating the data ourselves, it's possible to calculate the \CRLB\ on how much \RV\ information is encoded in the spectrograph images.

\section{Methods}
\subsection{Optimal Extraction}
implementation details

\subsection{Spectro-perfectionism}
implementation details, with some discussion of the trickiest parts (e.g. getting the A matrix right)

\section{Results \& Discussion}
Here's what we get when we run our two methods on data generated under a variety of conditions.

First we show that under a variety of spectrograph configurations, even ones where optimal extraction fails, spectro-perfectionism performs well.

Then we address the issues with implementing spectro-perfectionism in the real world: insert reasonable levels of noise into the algorithm and see where/how it breaks.

\section{Conclusions}

summarize results: conditions under which spectro-perfectionism is a good option, conditions under which optimal extraction will do, and conditions under which they both break

emphasize that even if both algorithms break, the \RV\ content is still in the 2D spectrograph images! future outlook on 2D modeling to get \RV s WITHOUT extracting a spectrum.

\bibliographystyle{apj}
\bibliography{}%general,myref,inprep}

\end{document}


\documentclass{article}
\usepackage[utf8]{inputenc}
\usepackage{amsmath}
\usepackage{graphicx}

\usepackage{titling}
\usepackage{hyperref}

\predate{\par\large\centering}
\postdate{\par}

\title{Gambleswap}
\author{Gambleswap Team}
\date{March 2022}

\begin{document}

\maketitle

\begin{abstract}

Gambleswap is a gambling powered Constant Product Automated Market Making protocol. Liquidity providers will be given \$GMB as a form of passive income and may enter into a gambling game to bet with their \$GMBs. Liquidity providers also can lend their LP tokens to those who do not have enough LP tokens for participating in the gambling game, thus, unlocking leveraging the value locked in liquidity pools even more.
The chance of winning in the game is proportional to the \$GMBs each user has put in the game. Also, it's designed to have the ability to control the total supply and price of \$GMB.

\end{abstract}

\section{Decentralized Exchange}
As a fork of Uniswap, Gambleswap is, in its core, a decentralized liquidity pool based exchange. Liquidity pools contain a huge amounts of two different assets like $aToken$ and $bToken$.
Users can use these pools to swap their $aTokens$ with $bTokens$ or vice versa. The ratio between the amount of token a user deposits and the amount of the token they take out is calculated through an Automated Market Maker (AMM) which will be discussed more later (For more details, see Appendix~\ref{app:amm}).
In Gambleswap, in addition to LP tokens, they also receive \$GMB. These tokens can be used to participate in the gambling and later moderating the Gambleswap ecosystem.

\section{Tokenomics}

Gambleswap has introduced GMB as the main token for particpation to empower its underlying automated market maker.
LP token holders will receive \$GMB as rewards. Later, they can use them to participate in the gambling.

\subsection{Mint GMB}

A fixed number of \$GMB is minted in each block. Each liquidity provider will receive a fraction of these tokens which is proportional to the amount of their LP tokens. In order to get these \$GMBs, the user needs to claim them. When a user $u$ claims that they should receive GMB tokens, the contract calculates the effective number of LP tokens that the user has and then find out their available number of GMB tokens to be minted. Effective LP tokens includes the amount of LP tokens that user holds at the time of calling claim, plus what he already has locked in the gambling game of the last recent 10 rounds, plus what he has lent:

$$
\text{ number of GMB tokens } u \text{ gets in a claim} =
$$
$$
\text{ GMB to mint per LP token }
$$
$$
\times \text{ effective number of LP tokens for the user} u
$$
$$
- \text{ number of all the GMB tokens that } u \text{ minted so far}
$$

% $$\times (\frac{\text{number of } u \text{'s LP tokens}}{\text{total LP tokens}})
% $$

To make it easier for the users to receive their \$GMB, the pool contract automatically claims these tokens for them whenever they update their LP token value, i.e. when they deposit liquidity to or withdraw liquidity from the pool.

\subsection{Burn GMB}
To be able to control the supply of \$GMB, the gambling game designed to burns some of the minted tokens on a regularly basis. We will discuss it in more details in the following sections.

\section{Gambling Game}
The gambling game is the powerful core of the enhancements added to Gambleswap's AMM logic. The rules of the game can be basically listed as follows:
\begin{itemize}
    \item Participants send their GMB tokens into the gambling contract. These tokens are accumulated to form our jackpot. They also send their bet values, which is a number they have guessed within a particular interval.
    \item Participants need to either own some LP tokens of the certain set of liquidity pools (called authorised pools) or borrow them from the LP lending pool to be able to play the game. Their LP tokens are locked during the game, and afterward, they can unlock them regardless of whether they win or lose. This rule intends to motivate users to provide liquidity in our pools.
    \item A random number is generated using some properties of the block like block number, block difficulty, and block timestamp.
    \item If the number a user has bet on falls inside a certain distance from the randomly generated number, that user is one of the winners of the game. This distance gets larger depending on the amount of GMB tokens they have deposited into the jackpot.
    \item 25\% of the jackpot of each round, and all the accumulated GMBs after every fourth game will be burnt. This is done in order to control the GMB total supply.
    \item If a game doesn't have any winners, the jackpot's contents remain in the jackpot and will be used in the next round. This motivates users to participate in the game if they see there is a non-empty jackpot before they start the game. Therefore, the number of participants can grow substantially.
    \item The maximum chance of winning is 50\%. It means if a player owns all the \$GMBs in the jackpot, they have a maximum 50\% chance of winning.
\end{itemize}

\subsection{Determining winners}
We introduce a variable as $coveragePerGMB$. This value demonstrates the length of the interval that each GMB token covers. Participants can increase their coverage by having more GMBs in the game. User's coverage shows the maximum distance the user's bet value can have with the correct random number for the user to win. The greater this value, the more chance the user has for winning. This value is calculated as follows.

\begin{align*}
    \text{user's coverage} &= min( \frac{1}{4} \times \text{maximum random number}, \\
    &coveragePerGMB \times \text{user's GMB tokens})
\end{align*}

the $\frac{1}{4} \times \text{maximum random number}$ is there to bound the maximum chance of winning to 50 percent.

Users have more chance to win by putting more GMB in the jackpot; each user wins if their bet value falls inside this interval:
$$
(\text{correct random number} - \text{user's coverage},$$
$$
\text{correct random number} + \text{user's coverage})
$$

The $coveragePerGMB$ value in each round is calculated based on the value of the jackpot in the previous game. For the first game, we assume the coveragePerGMB value is 10, and for games after that, we have:
$$
coveragePerGMB = \frac{\text{maximum random number}}{\text{4}
\times \text{total jackpot of the previous game}}
$$

In the other words the coveragePerGMB is a dynamic value depending on the previous game. In each game, this value is the same for all users.
If the number of participants in one game is small, the chance of winning in the next game goes higher; Consequently, more users are encouraged to participate in the next round. Figure \ref{fig:coverage} illustrates the process of determining the winners.

\begin{figure}
    \centering
    \includegraphics[width=\textwidth]{coverage.png}
    \caption{The blue interval shows the entire interval the random number can fall into. If the random number falls into the user's coverage, user will be one of the winners.}
    \label{fig:coverage}
\end{figure}

\subsection{LP Lending}
Gambleswap introduces users a LP lending protocol to participate in gambling game without the need to provide liquidity. There are two user's types in this lending protocol:
\begin{itemize}
    \item Lenders: Users who have LPs can lend their tokens from different pools; In return, after each round of the game, they will be given interest per borrow in form of GMB tokens.
    \item Borrowers: Users who do not have any LP tokens and can participate in each round of the game by borrowing lenders LP tokens. In return, they have to pay the interest to the lenders.
\end{itemize}

Each round of the game has its own capacity on the lending contract, and after each round, the capacity will be released for the upcoming round of the game. Every authorised liquidity pool has a separate lending pool and interest per borrow. Whenever a user attempts to borrow LP token, the lending contract finds the cheapest available pool which has enough capacity, and lends the needed amount of LP token to the user.
Lenders share the accumulated interest of their corresponding pool proportional to their share of the lending pool.

\subsection{Overflow/Underflow in the interval}
The generated interval for each user may exceed the $Maximum Random Number$ or may become less than $zero$. There are three scenarios for an interval:
\begin{itemize}
    \item Overflow: It happens when
    $$CorrectRandomNumber + UserCoverage > MaximumRandomNumber$$ In this scenario, the remaining  amount of the user's coverage will be considered from 0 to the OverflowValue.

    \begin{align*}
        \text{OverflowValue} &= \text{UserCoverage} \\ &+ \text{CorrectRandomNumber} \\ &-  \text{MaxRandomNumber}
    \end{align*}

    Users  will win when the below condition holds:
    $$(\text{betValue} > (\text{correctRandomNumber} - \text{UserCoverage})$$
    $$\lor$$
    $$
     \text{betValue} < \text{overflowValue}
    $$

    \item Underflow: This happens when
    $$UnderflowValue = UserInterval - CorrectRandomNumber$$
    Users  will win when the below condition holds:
    $$
    (\text{betValue} > (\text{maxRandomNumber} - \text{UnderflowValue}))
    $$
    $$\lor$$
    $$
     (\text{betValue} < (\text{CorrectRandomNumber} + \text{UserCoverage}))
    $$

    Figure \ref{fig:overflow} shows the coverage of the user in cases of underflow and overflow.

    \item Normal: In this scenario users will win when their $betValue$ is in the below interval:
    $$
    {CorrectRandomNumber \pm{UserInterval}}
    $$
\end{itemize}

\begin{figure}
    \centering
    \includegraphics[width=\textwidth]{coverage2.png}
    \caption{User's coverage in underflow and overflow cases.}
    \label{fig:overflow}
\end{figure}

\subsection{Expected value of net profit}

Let's assume user $u_i$ deposits $a_i$ GBM tokens in the gambling contract. The random number can be between zero and the maximum. Let's assume the maximum is $M$ and the number of participants is $n$ and number of winners is $W$. Also, $\frac{1}{4}$ of the tokens are burnt.
Therefore, the probability of $u_i$ being one of the winners is:
\begin{equation*}
    p_i = a_i \times \frac{1}{4\times (\sum_{i = 0}^{n} a_i)_{lastRound}}
\end{equation*}
Hence, the expected value of $u_i$'s profit in one round of gambling is:
\begin{align*}
    E[profit(u_i)] &= p_i \times \frac{3\sum_{i=0}^{n}a_i}{4W} \\
    &=
    a_i \times \frac{1}{4\times (\sum_{i = 0}^{n} a_i)_{lastRound}} \times
    \frac{3\sum_{i=0}^{n}a_i}{4W} \\
    &=
    \frac{a_i}{16 W} \times \frac{3\sum_{i=0}^{n} a_i}{(\sum_{i=0}^{n} a_i)_{lastRound}}
\end{align*}

As we see, when the number of players increases in one round in respect to the last round, the probability of winning increases. If we assume the
$\frac{\sum_{i=0}^{n} a_i}{(\sum_{i=0}^{n} a_i)_{lastRound}}$ factor to be close to one, we can see that

$$
E[profit(u_i)] \approx \frac{3a_i}{16W}
$$
So, the expected net profit of the the $u_i$ is approximately
$
\frac{3a_i}{16W} - a_i
$.

\section{Conclusion}
Gambleswap seeks to unlock the hundreds of millions of dollars in value locked in a decentralized exchange. Up until now, the community has shown great enthusiasm toward gambling and lottery games. The economic dynamics behind Gambleswap's gambling game also incentivizes people to provide even more liquidity.

\pagebreak
\appendix
\label{app:amm}
\section{Automated Market Maker}
As mentioned before there are two tokens in each liquidity pool in an AMM-based exchange. The ratio between the amount of one token a user takes out and the amount of the other token the user endows, are calculated using a constant product equation.
Assume the amounts of the tokens are $R_a$ and $R_b$ before the swap. A user can deposit $x$ tokens of $R_a$ in the pool and take $y$ tokens of $R_b$ out.
A small portion of $x$ is taken as a fee. This fee is divided between all liquidity providers proportional to their share in the pool. The fee ratio is shown by $\mu$. Now, because the product of the two tokens amounts should remain equal to $k$, we can calculate $y$ like this:

\begin{align*}
    R_a R_b &= (R_a + (1 - \mu)x)(R_b - y) \\
    \to (1 - \mu)xR_b &= (1 - \mu)xy + yR_1 \\
    \to y &= R_b - \frac{R_aR_b}{R_a + (1 - \mu)x}
\end{align*}

\end{document}


%!TEX root = ../../common/main.tex

\chapter[
  head={Supplementary material to the measurement of \sintwobetait},
  tocentry={Supplementary material to the measurement of \sintwobetabfsfHyperref}
]
{Supplementary material to the measurement of \sintwobetabfsf}
\label{ch:app:measurement_of_sin2beta}

% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Decay time resolution and acceptance}
\label{sec:app:measurement_of_sin2beta:resolution_and_acceptance}

% ------------------------------------------------------------------------------
\subsection{Resolution}
\label{sec:app:measurement_of_sin2beta:resolution_and_acceptance:resolution}

For the \catDD candidates
\cref{tab:app:measurement_of_sin2beta:resolution_and_acceptance:resolution:calibration:dd}
shows the fit results of the $\chisq$-fit of the decay time error estimate
calibration parameters for a linear function and a parabolic function with
offset parameter, while
\cref{tab:app:measurement_of_sin2beta:resolution_and_acceptance:resolution:calibration:ll}
includes fit results for the \catLL subsample where a linear function and a
parabolic function without offset parameter are fitted.
%
\begin{table}[h]
\centering
\caption{Fit parameters of the decay time resolution calibration functions for the \catDD subsample.}
\label{tab:app:measurement_of_sin2beta:resolution_and_acceptance:resolution:calibration:dd}
  \begin{tabular}{lllr@{$\,\pm\,$}lr@{$\,\pm\,$}l}
    \toprule
    Model                       & \multicolumn{2}{c}{Parameter}               &   \multicolumn{2}{c}{narrow width ($i = 1$)}  & \multicolumn{2}{c}{wider width ($i = 2$)}\\
    \midrule
    \multirow{2}{*}{linear}     &   $b_{i}$       &                           &   0.89    &   0.10                  &   1.34        &   0.29    \\
                                &   $c_{i}$       &  (\si{\pico\second})      &   0.008   &   0.004                 &   0.018       &   0.011   \\
    \midrule
    \multirow{3}{*}{parabolic}  &   $a_{i}$      &  (\si{\per\pico\second})  &   -3      &   6                     &   -1          &   17      \\
                                &   $b_{i}$      &                           &    1.2     &   0.5                   &   1.4         &   1.4     \\
                                &   $c_{i}$      &  (\si{\pico\second})      &   0.003   &   0.010                 &   0.016       &   0.028   \\
    \bottomrule
  \end{tabular}
\end{table}
%
\begin{table}[h]
\centering
\caption{Fit parameters of the decay time resolution calibration functions for the \catLL subsample.}
\label{tab:app:measurement_of_sin2beta:resolution_and_acceptance:resolution:calibration:ll}
  \begin{tabular}{lllr@{$\,\pm\,$}lr@{$\,\pm\,$}l}
    \toprule
    Model                       & \multicolumn{2}{c}{Parameter}     &  \multicolumn{2}{c}{narrow width ($i = 1$)} &  \multicolumn{2}{c}{wider width ($i = 2$)}\\
    \midrule
    \multirow{2}{*}{linear}     & $b_{i}$  &                          &   1.10        &   0.07            &   1.81        &   0.26    \\
                                & $c_{i}$  & (\si{\pico\second})      &   0.0034      &   0.0019          &   0.009       &   0.008   \\
    \midrule
    \multirow{2}{*}{parabolic}  & $a_{i}$  & (\si{\per\pico\second})  &   -4.7        &   2.1             &   -6          &   8       \\
                                & $b_{i}$  &                          &   1.36        &   0.07            &   2.27        &   0.26    \\
    \bottomrule
  \end{tabular}
\end{table}

\newpage
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section[
  head={Measurement of \CP violation},
  tocentry={Measurement of \CPHyperref violation}
]
{Measurement of \CPbfsf violation}
\label{sec:app:measurement_of_sin2beta:cpv_measurement}

% ------------------------------------------------------------------------------
\subsection{Tables of fixed parameters}
\label{sec:app:measurement_of_sin2beta:cpv_measurement:fixed_parameters}

\begin{table}[h]
\caption{Fixed mass parameters.}
\label{tab:app:measurement_of_sin2beta:cpv_measurement:fixed_parameters:mass}
\centering
\begin{tabular}{lr@{$\,\pm\,$}l}
  \toprule
  Parameter                     & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
  $\alpha_{1,m}^\text{\catDD}$      & \multicolumn{2}{c}{$2.28$}\\
  $\alpha_{1,m}^\text{\catLL}$      & \multicolumn{2}{c}{$2.1$}\\
  $\alpha_{2,m}^\text{\catDD}$      & \multicolumn{2}{c}{$2.08$}\\
  $\alpha_{2,m}^\text{\catLL}$      & \multicolumn{2}{c}{$2.43$}\\
  $\lambda_m^\text{\catDD}$         & \multicolumn{2}{c}{$-2.8$}\\
  $\lambda_m^\text{\catLL}$         & \multicolumn{2}{c}{$-3.6$}\\
  $\zeta_m^\text{\catDD}$           & \multicolumn{2}{c}{$0.0$}\\
  $\zeta_m^\text{\catLL}$           & \multicolumn{2}{c}{$0.0$}\\
  $n_1^\text{\catDD}$               & \multicolumn{2}{c}{$3.18$}\\
  $n_1^\text{\catLL}$               & \multicolumn{2}{c}{$3.2$}\\
  $n_2^\text{\catDD}$               & \multicolumn{2}{c}{$6.8$}\\
  $n_2^\text{\catLL}$               & \multicolumn{2}{c}{$4.1$}\\
  \bottomrule
\end{tabular}
\end{table}
%
\begin{table}[h]
\caption{Fixed decay time error parameters of the (left) signal and (right)
background parametrisation.}
\label{tab:app:measurement_of_sin2beta:cpv_measurement:fixed_parameters:decay_time_error}
\centering
\begin{tabular}[t]{llr@{$\,\pm\,$}l}
  \toprule
  \multicolumn{2}{c}{Parameter}              & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
  $f_{\sigma_t}^\text{\catDD,\catOS,\catAU}$ &                       & \multicolumn{2}{c}{$0.069461$}\\
  $f_{\sigma_t}^\text{\catDD,\catOS,\catEB}$ &                       & \multicolumn{2}{c}{$0.09431$}\\
  $f_{\sigma_t}^\text{\catDD,\catSS}$        &                       & \multicolumn{2}{c}{$0.088404$}\\
  $f_{\sigma_t}^\text{\catLL,\catOS}$        &                       & \multicolumn{2}{c}{$0.55165$}\\
  $M_1^\text{\catDD,\catOS,\catAU}$          & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.037506$}\\
  $M_1^\text{\catDD,\catOS,\catEB}$          & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.034481$}\\
  $M_1^\text{\catDD,\catSS}$                 & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.032577$}\\
  $M_2^\text{\catDD,\catOS,\catAU}$          & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.077666$}\\
  $M_2^\text{\catDD,\catOS,\catEB}$          & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.072158$}\\
  $M_2^\text{\catDD,\catSS}$                 & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.059685$}\\
  $M^\text{\catLL,\catOS}$                   & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.033253$}\\
  $M^\text{\catLL,\catSS}$                   & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.029475$}\\
  $k_1^\text{\catDD,\catOS,\catAU}$          &                       & \multicolumn{2}{c}{$0.721$}\\
  $k_1^\text{\catDD,\catOS,\catEB}$          &                       & \multicolumn{2}{c}{$0.73243$}\\
  $k_1^\text{\catDD,\catSS}$                 &                       & \multicolumn{2}{c}{$0.72851$}\\
  $k_1^\text{\catLL,\catOS}$                 &                       & \multicolumn{2}{c}{$0.80445$}\\
  $k_2^\text{\catDD,\catOS,\catAU}$          &                       & \multicolumn{2}{c}{$0.73407$}\\
  $k_2^\text{\catDD,\catOS,\catEB}$          &                       & \multicolumn{2}{c}{$0.65444$}\\
  $k_2^\text{\catDD,\catSS}$                 &                       & \multicolumn{2}{c}{$0.70283$}\\
  $k_2^\text{\catLL,\catOS}$                 &                       & \multicolumn{2}{c}{$0.70335$}\\
  $k^\text{\catLL,\catSS}$                   &                       & \multicolumn{2}{c}{$0.75457$}\\
  \bottomrule
\end{tabular}
%
\quad
%
\begin{tabular}[t]{llr@{$\,\pm\,$}l}
  \toprule
  \multicolumn{2}{c}{Parameter}                  & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
  $f_{\sigma_t}^\text{\catDD,!(\catOS,\catAU)}$  &                       & \multicolumn{2}{c}{$0.11432$}\\
  $f_{\sigma_t}^\text{\catDD,\catOS,\catAU}$     &                       & \multicolumn{2}{c}{$0.29076$}\\
  $f_{\sigma_t}^\text{\catLL,\catAU}$            &                       & \multicolumn{2}{c}{$0.85159$}\\
  $f_{\sigma_t}^\text{\catLL,\catEB}$            &                       & \multicolumn{2}{c}{$0.93631$}\\
  $M_1^\text{\catDD,!(\catOS,\catAU)}$           & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.03674$}\\
  $M_1^\text{\catDD,\catOS,\catAU}$              & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.037739$}\\
  $M_1^\text{\catLL,\catAU}$                     & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.042243$}\\
  $M_1^\text{\catLL,\catEB}$                     & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.047283$}\\
  $M_2^\text{\catDD,!(\catOS,\catAU)}$           & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.072757$}\\
  $M_2^\text{\catDD,\catOS,\catAU}$              & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.064157$}\\
  $M_2^\text{\catLL,\catAU}$                     & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.030178$}\\
  $M_2^\text{\catLL,\catEB}$                     & ($\si{\pico\second}$) & \multicolumn{2}{c}{$0.029563$}\\
  $k_1^\text{\catDD,!(\catOS,\catAU)}$           &                       & \multicolumn{2}{c}{$0.73464$}\\
  $k_1^\text{\catDD,\catOS,\catAU}$              &                       & \multicolumn{2}{c}{$0.72987$}\\
  $k_1^\text{\catLL,\catAU}$                     &                       & \multicolumn{2}{c}{$0.69218$}\\
  $k_1^\text{\catLL,\catEB}$                     &                       & \multicolumn{2}{c}{$0.59111$}\\
  $k_2^\text{\catDD,!(\catOS,\catAU)}$           &                       & \multicolumn{2}{c}{$0.68463$}\\
  $k_2^\text{\catDD,\catOS,\catAU}$              &                       & \multicolumn{2}{c}{$0.67792$}\\
  $k_2^\text{\catLL,\catAU}$                     &                       & \multicolumn{2}{c}{$0.77259$}\\
  $k_2^\text{\catLL,\catEB}$                     &                       & \multicolumn{2}{c}{$0.78276$}\\
  \bottomrule
\end{tabular}
\end{table}
%
\begin{table}[h]
\caption{Fixed \OS mistag spline parameters for the (left) signal and (right)
background parametrisation.}
\label{tab:app:measurement_of_sin2beta:cpv_measurement:fixed_parameters:eta:os}
\centering
\begin{tabular}[t]{lr@{$\,\pm\,$}l}
  \toprule
  Parameter                & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
  $u_{S,1}^\text{\catOS}$  & \multicolumn{2}{c}{$0.0$}\\
  $u_{S,2}^\text{\catOS}$  & \multicolumn{2}{c}{$0.50758$}\\
  $u_{S,3}^\text{\catOS}$  & \multicolumn{2}{c}{$3.0879$}\\
  $u_{S,4}^\text{\catOS}$  & \multicolumn{2}{c}{$3.7690$}\\
  $u_{S,5}^\text{\catOS}$  & \multicolumn{2}{c}{$12.776$}\\
  $u_{S,6}^\text{\catOS}$  & \multicolumn{2}{c}{$9.2243$}\\
  $u_{S,7}^\text{\catOS}$  & \multicolumn{2}{c}{$26.375$}\\
  $u_{S,8}^\text{\catOS}$  & \multicolumn{2}{c}{$29.490$}\\
  $u_{S,9}^\text{\catOS}$  & \multicolumn{2}{c}{$39.154$}\\
  $u_{S,10}^\text{\catOS}$ & \multicolumn{2}{c}{$39.090$}\\
  $u_{S,11}^\text{\catOS}$ & \multicolumn{2}{c}{$34.295$}\\
  \bottomrule
\end{tabular}
%
\qquad
%
\begin{tabular}[t]{lr@{$\,\pm\,$}l}
  \toprule
  Parameter                           & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
    $u_{B,1}^\text{\catDD,\catOS}$    & \multicolumn{2}{c}{$0.0$}\\
    $u_{B,2}^\text{\catDD,\catOS}$    & \multicolumn{2}{c}{$0.25646$}\\
    $u_{B,3}^\text{\catDD,\catOS}$    & \multicolumn{2}{c}{$2.8381$}\\
    $u_{B,4}^\text{\catDD,\catOS}$    & \multicolumn{2}{c}{$5.0101$}\\
    $u_{B,5}^\text{\catDD,\catOS}$    & \multicolumn{2}{c}{$19.184$}\\
    $u_{B,6}^\text{\catDD,\catOS}$    & \multicolumn{2}{c}{$12.047$}\\
    $u_{B,7}^\text{\catDD,\catOS}$    & \multicolumn{2}{c}{$42.811$}\\
    $u_{B,8}^\text{\catDD,\catOS}$    & \multicolumn{2}{c}{$53.376$}\\
    $u_{B,9}^\text{\catDD,\catOS}$    & \multicolumn{2}{c}{$59.998$}\\
    $u_{B,10}^\text{\catDD,\catOS}$   & \multicolumn{2}{c}{$67.425$}\\
    $u_{B,11}^\text{\catDD,\catOS}$   & \multicolumn{2}{c}{$64.236$}\\
    $u_{B,1}^\text{\catLL,\catOS}$    & \multicolumn{2}{c}{$0.0$}\\
    $u_{B,2}^\text{\catLL,\catOS}$    & \multicolumn{2}{c}{$0.96109$}\\
    $u_{B,3}^\text{\catLL,\catOS}$    & \multicolumn{2}{c}{$10.005$}\\
    $u_{B,4}^\text{\catLL,\catOS}$    & \multicolumn{2}{c}{$13.055$}\\
    $u_{B,5}^\text{\catLL,\catOS}$    & \multicolumn{2}{c}{$65.181$}\\
    $u_{B,6}^\text{\catLL,\catOS}$    & \multicolumn{2}{c}{$33.077$}\\
    $u_{B,7}^\text{\catLL,\catOS}$    & \multicolumn{2}{c}{$161.56$}\\
    $u_{B,8}^\text{\catLL,\catOS}$    & \multicolumn{2}{c}{$163.82$}\\
    $u_{B,9}^\text{\catLL,\catOS}$    & \multicolumn{2}{c}{$244.14$}\\
    $u_{B,10}^\text{\catLL,\catOS}$   & \multicolumn{2}{c}{$238.57$}\\
    $u_{B,11}^\text{\catLL,\catOS}$   & \multicolumn{2}{c}{$259.16$}\\
  \bottomrule
\end{tabular}
\end{table}
%
\begin{table}[h]
\caption{Fixed \SSpi mistag spline parameters for the (left) signal and (right)
background parametrisation.}
\label{tab:app:measurement_of_sin2beta:cpv_measurement:fixed_parameters:eta:ss}
\centering
\begin{tabular}[t]{lr@{$\,\pm\,$}l}
  \toprule
  Parameter                      & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
  $u_{S,1}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.0$}\\
  $u_{S,2}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.0$}\\
  $u_{S,3}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.0402$}\\
  $u_{S,4}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.2597$}\\
  $u_{S,5}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.4804$}\\
  $u_{S,6}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.6534$}\\
  $u_{S,1}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.0$}\\
  $u_{S,2}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.0$}\\
  $u_{S,3}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.013$}\\
  $u_{S,4}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.1183$}\\
  $u_{S,5}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.2695$}\\
  $u_{S,6}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.4455$}\\
  \bottomrule
\end{tabular}
%
\qquad
%
\begin{tabular}[t]{lr@{$\,\pm\,$}l}
  \toprule
  Parameter                     & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
  $u_{B,1}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.0$}\\
  $u_{B,2}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.0$}\\
  $u_{B,3}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.1498$}\\
  $u_{B,4}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$0.8688$}\\
  $u_{B,5}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$1.9698$}\\
  $u_{B,6}^\text{\catDD,\catSS}$ & \multicolumn{2}{c}{$5.3155$}\\
  $u_{B,1}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.0$}\\
  $u_{B,2}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.0$}\\
  $u_{B,3}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.0022$}\\
  $u_{B,4}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.1173$}\\
  $u_{B,5}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$0.4442$}\\
  $u_{B,6}^\text{\catLL,\catSS}$ & \multicolumn{2}{c}{$1.2042$}\\
  \bottomrule
\end{tabular}
\end{table}
%
\begin{table}[h]
\caption{Fixed decay time resolution parameters}
\label{tab:app:measurement_of_sin2beta:cpv_measurement:fixed_parameters:decay_time_resolution}
\centering
\begin{tabular}[t]{lr@{$\,\pm\,$}l}
  \toprule
  Parameter                                & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
  $c_1^\text{\catDD}$                      & \multicolumn{2}{c}{$0.0077$}\\
  $c_1^\text{\catLL}$                      & \multicolumn{2}{c}{$0.0045$}\\
  $c_2^\text{\catDD}$                      & \multicolumn{2}{c}{$0.019$}\\
  $c_2^\text{\catLL}$                      & \multicolumn{2}{c}{$0.007$}\\
  $g_2^\text{\catDD}$                      & \multicolumn{2}{c}{$0.251$}\\
  $g_2^\text{\catLL}$                      & \multicolumn{2}{c}{$0.24$}\\
  $\mu_t^\text{\catDD}$                    & \multicolumn{2}{c}{$0.0$}\\
  $\mu_t^\text{\catLL}$                    & \multicolumn{2}{c}{$0.0$}\\
  $b_1^\text{\catDD}$                      & \multicolumn{2}{c}{$0.88$}\\
  $b_1^\text{\catLL}$                      & \multicolumn{2}{c}{$1.04$}\\
  $b_2^\text{\catDD}$                      & \multicolumn{2}{c}{$1.33$}\\
  $b_2^\text{\catLL}$                      & \multicolumn{2}{c}{$1.8$}\\
  $\sigma_\text{\acs*{PV}}^\text{\catDD}$  & \multicolumn{2}{c}{$1.6$}\\
  $\sigma_\text{\acs*{PV}}^\text{\catLL}$  & \multicolumn{2}{c}{$1.40$}\\
  $f_\text{\acs*{PV}}^\text{\catDD}$       & \multicolumn{2}{c}{$0.048$}\\
  $f_\text{\acs*{PV}}^\text{\catLL}$       & \multicolumn{2}{c}{$0.0488$}\\
  \bottomrule
\end{tabular}
\end{table}
%
\begin{table}[h]
\caption{Fixed \catAU acceptance spline parameters for (left) \catAU and (right)
\catEB candidates.}
\label{tab:app:measurement_of_sin2beta:cpv_measurement:fixed_parameters:acc}
\centering
\begin{tabular}[t]{lr@{$\,\pm\,$}l}
  \toprule
  Parameter              & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
    $h_1^\text{\catAU}$  & \multicolumn{2}{c}{$0.93057$}\\
    $h_2^\text{\catAU}$  & \multicolumn{2}{c}{$0.93485$}\\
    $h_3^\text{\catAU}$  & \multicolumn{2}{c}{$0.96383$}\\
    $h_4^\text{\catAU}$  & \multicolumn{2}{c}{$0.96521$}\\
    $h_5^\text{\catAU}$  & \multicolumn{2}{c}{$0.99547$}\\
    $h_6^\text{\catAU}$  & \multicolumn{2}{c}{$0.97126$}\\
    $h_7^\text{\catAU}$  & \multicolumn{2}{c}{$0.96399$}\\
    $h_8^\text{\catAU}$  & \multicolumn{2}{c}{$0.9725$}\\
    $h_9^\text{\catAU}$  & \multicolumn{2}{c}{$0.98045$}\\
    $h_{10}^\text{\catAU}$ & \multicolumn{2}{c}{$0.97533$}\\
    \bottomrule
\end{tabular}
%
\qquad
%
\begin{tabular}[t]{lr@{$\,\pm\,$}l}
  \toprule
  Parameter               & \multicolumn{2}{c}{Fixed Value} \\
  \midrule
    $h_1^\text{\catEB}$   & \multicolumn{2}{c}{$0.1481$}\\
    $h_2^\text{\catEB}$   & \multicolumn{2}{c}{$0.27167$}\\
    $h_3^\text{\catEB}$   & \multicolumn{2}{c}{$0.29418$}\\
    $h_4^\text{\catEB}$   & \multicolumn{2}{c}{$0.35902$}\\
    $h_5^\text{\catEB}$   & \multicolumn{2}{c}{$0.40022$}\\
    $h_6^\text{\catEB}$   & \multicolumn{2}{c}{$0.4262$}\\
    $h_7^\text{\catEB}$   & \multicolumn{2}{c}{$0.44465$}\\
    $h_8^\text{\catEB}$   & \multicolumn{2}{c}{$0.47084$}\\
    $h_9^\text{\catEB}$   & \multicolumn{2}{c}{$0.49859$}\\
    $h_{10}^\text{\catEB}$ & \multicolumn{2}{c}{$0.52957$}\\
    \bottomrule
\end{tabular}
\end{table}

\FloatBarrier
% ------------------------------------------------------------------------------
\subsection{Fit results of subordinate parameters}
\label{sec:app:measurement_of_sin2beta:cpv_measurement:results}

\begin{table}[!h]
  \caption{Results for the estimated signal and background candidate numbers
  from the nominal fit.}
  \label{tab:app:measurement_of_sin2beta:cpv_measurement:results:yields}
  \centering
  \footnotesize
  \resizebox{0.49\textwidth}{!}{
  \begin{tabular}{lllllr@{$\,\pm\,$}l}
    \toprule
    \multicolumn{4}{l}{Sample} & Parameter & \multicolumn{2}{c}{Fitted Value}   \\
    \midrule
    \multirow{24}{*}{2011}  & \multirow{12}{*}{\catDD} & \multirow{4}{*}{\catOS}      & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $5134$   &   $103$  \\
                            &                             &                           &                             & $N_{\Bkg}$ & $9352$   &   $122$  \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $856$    &   $39$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $1413$   &   $46$   \\
                            &                             & \multirow{4}{*}{\catSS}   & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $2028$   &   $54$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $1251$   &   $46$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $324$    &   $20$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $153$    &   $16$   \\
                            &                             & \multirow{4}{*}{\catBS}   & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $941$    &   $38$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $913$    &   $38$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $138$    &   $14$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $121$    &   $13$   \\
                            & \multirow{12}{*}{\catLL} & \multirow{4}{*}{\catOS}      & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $2263$   &   $54$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $1504$   &   $47$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $333$    &   $20$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $304$    &   $19$   \\
                            &                             & \multirow{4}{*}{\catSS}   & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $744$    &   $29$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $119$    &   $14$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $89$     &   $9$    \\
                            &                             &                           &                             & $N_{\Bkg}$ & $13$     &   $4$    \\
                            &                             & \multirow{4}{*}{\catBS}   & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $321$    &   $19$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $119$    &   $13$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $46$     &   $7$    \\
                            &                             &                           &                             & $N_{\Bkg}$ & $11$     &   $4$    \\
    \midrule
    \multirow{24}{*}{2012}  & \multirow{12}{*}{\catDD} & \multirow{4}{*}{\catOS}      & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $10378$  &   $156$  \\
                            &                             &                           &                             & $N_{\Bkg}$ & $20569$  &   $185$  \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $2188$   &   $66$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $4724$   &   $83$   \\
                            &                             & \multirow{4}{*}{\catSS}   & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $4246$   &   $80$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $3199$   &   $74$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $979$    &   $35$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $468$    &   $27$   \\
                            &                             & \multirow{4}{*}{\catBS}   & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $1962$   &   $57$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $2251$   &   $59$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $403$    &   $24$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $343$    &   $23$   \\
                            & \multirow{12}{*}{\catLL} & \multirow{4}{*}{\catOS}      & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $4599$   &   $79$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $3245$   &   $70$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $971$    &   $35$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $939$    &   $35$   \\
                            &                             & \multirow{4}{*}{\catSS}   & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $1550$   &   $41$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $298$    &   $22$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $281$    &   $17$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $55$     &   $9$    \\
                            &                             & \multirow{4}{*}{\catBS}   & \multirow{2}{*}{\catAU}     & $N_{\Sig}$ & $658$    &   $27$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $177$    &   $17$   \\
                            &                             &                           & \multirow{2}{*}{\catEB}     & $N_{\Sig}$ & $118$    &   $11$   \\
                            &                             &                           &                             & $N_{\Bkg}$ & $34$     &   $7$    \\
    \bottomrule
\end{tabular}
}
\end{table}
%
\begin{table}
  \caption{Results for the mass parameters in the nominal fit}
  \label{tab:app:measurement_of_sin2beta:cpv_measurement:results:mass}
  \centering
  \begin{tabular}{llr@{$\,\pm\,$}l}
      \toprule
      \multicolumn{2}{c}{Parameter}                                & \multicolumn{2}{c}{Value}  \\
      \midrule
      $m^{DD}_{}$              & ($\si{\MeVcc}$)        & $5281.80$    & $0.28$        \\
      $\sigma^{DD}_{m}$        & ($\si{\MeVcc}$)        & $9.9$        & $0.1$        \\
      $\beta^{DD}_{m}$         &                        & $-0.004$     & $0.004$     \\
      $\alpha^{DD}_{m}$        & ($\si{(\MeVcc)^{-1}}$) & $-0.00091$   & $0.00019$     \\
      \midrule
      $m^{LL}_{}$              & ($\si{\MeVcc}$)        & $5281.20$    & $0.30$        \\
      $\sigma^{LL}_{m}$        & ($\si{\MeVcc}$)        & $8.33$       & $0.09$        \\
      $\beta^{LL}_{m}$         &                        & $-0.009$     & $0.005$     \\
      $\alpha^{LL}_{m}$        & ($\si{(\MeVcc)^{-1}}$) & $-0.0004$    & $0.0004$      \\
      \bottomrule
    \end{tabular}
\end{table}
%
\begin{table}
  \caption{Results for the background decay time parameters in the nominal fit}
  \label{tab:app:measurement_of_sin2beta:cpv_measurement:results:time:bkg}
  \centering
  \begin{tabular}{llr@{$\,\pm\,$}l}
      \toprule
      \multicolumn{2}{c}{Parameter}       & \multicolumn{2}{c}{Value}                  \\
      \midrule
      $f^{\catDD,\catOS}_{2,t}$   &                       & $0.34$    & $0.06$   \\
      $f^{\catDD,\catOS}_{3,t}$   &                       & $0.049$   & $0.018$  \\
      $\tau^{\catDD,\catOS}_{1}$  & ($\si{\pico\second}$) & $0.579$   & $0.028$  \\
      $\tau^{\catDD,\catOS}_{2}$  & ($\si{\pico\second}$) & $1.41$    & $0.17$   \\
      $\tau^{\catDD,\catOS}_{3}$  & ($\si{\pico\second}$) & $4.2$     & $0.7$    \\
      \midrule
      $f^{\catDD,\catSS}_{2,t}$   &                       & $0.15$    & $0.06$   \\
      $\tau^{\catDD,\catSS}_{1}$  & ($\si{\pico\second}$) & $0.703$   & $0.032$   \\
      $\tau^{\catDD,\catSS}_{2}$  & ($\si{\pico\second}$) & $1.72$    & $0.23$   \\
      \midrule
      $f^{\catLL}_{2,t}$          &                       & $0.48$    & $0.21$   \\
      $f^{\catLL}_{3,t}$          &                       & $0.043$   & $0.027$  \\
      $\tau^{\catLL}_{1}$         & ($\si{\pico\second}$) & $0.22$    & $0.04$  \\
      $\tau^{\catLL}_{2}$         & ($\si{\pico\second}$) & $0.40$    & $0.07$   \\
      $\tau^{\catLL}_{3}$         & ($\si{\pico\second}$) & $4.2$     & $0.5$    \\
      \bottomrule
    \end{tabular}
\end{table}

\clearpage
% %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Studies of systematic effects}
\label{sec:app:measurement_of_sin2beta:systematics}

% ..............................................................................
\subsubsection{Fit model}
\label{sec:app:measurement_of_sin2beta:systematics:systematics:fit_model}

\begin{figure}[h]
\centering
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fitmodel_bkttaggingasym_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fitmodel_bkttaggingasym_s_res.pdf}\\
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fitmodel_bkttaggingasym_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fitmodel_bkttaggingasym_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of an asymmetry in the background tagging estimates on the measurement
of the \CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:fit_model:bkg_tagging_asymmetry}
\end{figure}

\begin{figure}[h]
\centering
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fitmodel_mtcorr_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fitmodel_mtcorr_s_res.pdf}\\
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fitmodel_mtcorr_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fitmodel_mtcorr_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of a small mass and decay time correlation on the measurement of the
\CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:fit_model:mass_time_correlations}
\end{figure}

\clearpage
% ..............................................................................
\subsubsection{Flavour Tagging}
\label{sec:app:measurement_of_sin2beta:systematics:systematics:tagging}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_ft_calibration_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_ft_calibration_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_ft_calibration_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_ft_calibration_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of the systematic uncertainties on the flavour tagging calibration
parameters on the measurement of the \CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:tagging}
\end{figure}

\clearpage
% ..............................................................................
\subsubsection{Decay time resolution}
\label{sec:app:measurement_of_sin2beta:systematics:systematics:resolution}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_calibration_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_calibration_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_calibration_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_calibration_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of the decay time resolution calibration model on the measurement of
the \CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:resolution:calibration}
\end{figure}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_offset_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_offset_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_offset_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_offset_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of neglecting a non-zero offset in the decay time resolution
calibration model on the measurement of the \CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:resolution:offset}
\end{figure}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_wrongpv_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_wrongpv_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_wrongpv_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_resolution_wrongpv_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of the fraction of candidates with a wrong \PV association on the
measurement of the \CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:resolution:wrong_pv}
\end{figure}

\clearpage
% ..............................................................................
\subsubsection{Decay time acceptance}
\label{sec:app:measurement_of_sin2beta:systematics:systematics:acceptance}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_acc_lower_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_acc_lower_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_acc_lower_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_acc_lower_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of the low decay time acceptance model on the measurement of the \CP
parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:acceptance:lower}
\end{figure}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_acc_upper_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_acc_upper_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_acc_upper_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_acc_upper_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of the upper decay time acceptance correction function on the
measurement of the \CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:acceptance:upper}
\end{figure}

\clearpage
% ..............................................................................
\subsubsection[Production asymmetry, $z$-scale, \DMd, and \DGd]{Production asymmetry, $\mathbfsfit{z}$-scale, $\mathbfsfit{\DMd}$, and $\mathbfsfit{\DGd}$}
\label{sec:app:measurement_of_sin2beta:systematics:systematics:further_studies}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_zscale_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_zscale_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_zscale_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_zscale_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of the relative $z$-scale uncertainty on the measurement of the \CP
parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:further_studies:zscale}
\end{figure}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_prodasym_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_prodasym_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_prodasym_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_prodasym_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of an enlarged production asymmetry $A_P^{\catOO}$ on the measurement
of the \CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:further_studies:production_asymmetry}
\end{figure}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_dgd_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_dgd_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_dgd_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_dgd_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of a non-zero decay width difference $\DGd$ on the measurement
of the \CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:further_studies:decay_width_difference}
\end{figure}

\begin{figure}[h]
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_dmd_s_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_dmd_s_res.pdf}
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_dmd_c_pull.pdf}\hfill
  \includegraphics[width=0.49\textwidth]{private/content/appendices/figs/systematics_fs_dmd_c_res.pdf}
\caption{Shown are (left) pull and (right) residual distributions of the
parameters (top) \SJpsiKS and (bottom) \CJpsiKS from a \ToyMC study of the
influence of an enlarged mass difference $\DMd$ on the measurement
of the \CP parameters.}
\label{fig:app:measurement_of_sin2beta:systematics:systematics:further_studies:mass_difference}
\end{figure}