\chapter{Cyclic Sextic Fields}
\label{chap:chap-six}
In this chapter, we will study cyclic sextic number fields. First of all, the result of discriminant of a cyclic sextic field could be found in M\"{a}ki's book \citep{maki1980determination}, while we would recover the result using the conductor-discriminant formula \ref{thm:conddisc}. Then, from a necessary theorem given by M\"{a}ki, together with the result of discriminant, we give the integral basis of a cyclic sextic number field. After that, with the help of the fundamental ramification theorem \ref{thm:ramification}, Stickelberger's theorem \ref{thm:unramified} on unramified primes and decomposition results for cyclic cubic field and quadratic field, we obtain the prime decomposition for cyclic sextic number fields. As for the unit groups and class numbers for real cyclic sextic fields, M\"{a}ki has solved those problem, and give a table on them. For complex case, it's a CM-field, hence the class number and the unit group could be reduced into its cyclic cubic field. But unfortunately, we haven't got the final precise results of them.

Let $K_6$ be a cyclic sextic number field over $\mathbb{Q}$ with Galois group $G=C_6$, then from Lemma \ref{lem:signaturegal}, we have that the signature of $K_6$ can only be $(6,0)$ or $(0,3)$ i.e. $K_6$ is totally real or totally complex field. It's easy to see that $G$ has exactly two nontrivial subgroups, namely those are of order 2 and order 3, thus the field $K_6$ has exactly two nontrivial subfields: a (real) cyclic cubic field $K_3$ and a quadratic field $K_2$.

Consider $K_2=\mathbb{Q}(\sqrt{m})$ where $m$ is a square-free integer. $K_3=\mathbb{Q}(\theta)$. Hence, $K_6=\mathbb{Q}(\theta,\sqrt{m})$. Let an odd integer $s$ be such that the automorphism $\sigma$ induced by the mapping $\zeta_{f_6}\rightarrow \zeta_{f_6}^s$, where $f_6$ is the conductor of $K_6$, satisfies the conditions:
$$\sigma(\theta)=\theta',\sigma(\theta')=\theta'',\sigma(\sqrt{m})=-\sqrt{m}$$
where the $\theta'$ and $\theta''$ denote the conjugates of $\theta$ in the cyclic cubic subfield, which are defined in theorem \ref{thm:ccpolycon}. What's more, we use the following notations $\gamma^{(i)}=\sigma^{i}(\gamma), i\in\mathbb{Z}$. For simplicity, we will continue to use these notations for the following content.

\section{Discriminant and Integral Basis}
From the Kronecker–Weber theorem, if $K_6$ is a subfield of a cyclotomic field $\mathbb{Q}(\zeta_k)$ then also $Q(\zeta_{f_2})$ and $Q(\zeta_{f_3})$ are contained in $Q(\zeta_{k})$. Hence, we have
$$f_6=\operatorname{lcm}(f_2,f_3)$$
As we all known, the conductor $f_2$ of real quadratic field $\mathbb{Q}(\sqrt{m})$ is equal to its fundamental discriminant $D$, and the conductor $f_3=e^2$ as we mentioned in \ref{thm:ccpoly}.
The characters of $K_6$ \citep{maki1980determination} are the principal character $1$, the quadratic character $\chi_2$ of $K_2$, the generating characters $\chi_3$ and $\bar{\chi}_3$ of $K_3$ and the generating characters $\chi_6=\chi_2\chi_3$ and $\bar{\chi}_6=\chi_2\bar{\chi}_3$ of $K_6$. The conductor of the character $\chi_n$ and $\bar{\chi}_n$ is $f_n$ (since they service for same cyclic galois group). Hence we have following results \citep{hasse1952uber}:
\begin{theorem}\label{thm:sexdisc}
The discriminant $d(K_6)$ of the real field $K_6$ is $$d(K_6)=f_6^2f_3^2f_2.$$
\end{theorem}
The proof is easy, as we mentioned above, we have found all characters of $K_6$, then by the conductor-discriminant formula \ref{thm:conddisc}, we immediately get $$d(K_6)=f_6^2f_3^2f_2.$$
What's more, for complex cyclic sextic fields, we have similar results:
\begin{theorem}\label{thm:sexdisccom}
The discriminant $d(K_6)$ of the complex field $K_6$ is $$d(K_6)=f_6^2f_3^2f_2.$$
\end{theorem}

The next theorem \citep{maki1980determination} gives a necessary condition for a number $\alpha\in K_6$ to belong to $O_{K_6}$. For simplicity, let us denote $\operatorname{gcd}(f_2,f_3)$ to be $f_*$.
\begin{lemma} \label{integersex}
If $\alpha\in O_{K_6}$, then $\alpha$ is of the form $$\alpha=\frac{1}{2}(x_0+x_1\theta+x_2\theta')+\frac{1}{2f_*}(y_0+y_1\theta+y_2\theta')\sqrt{m}$$
where $\frac{1}{2}x_i+\frac{1}{2}y_i\sqrt{m}\in O_{K_2},(i=0,1,2)$.
\begin{proof}
Let $\alpha=a_0+a_1\theta+a_2\theta'+(b_0+b_1\theta+b_2\theta')\sqrt{m}$, where $a_i,b_i\in\mathbb{Q}(i=0,1,2)$ be a number of $O_{K_6}$. Then from the definition of $\sigma$, we have $$\alpha+\alpha^{(3)}=2(a_0+a_1\theta+a_2\theta')\in O_{K_3}.$$ Recall the theorem \ref{thm:ccpoly}, we have $(1,\theta,\theta')$ is an integral basis of $K_3$. So we have $a_i=x_1/2$, where $x_i\in\mathbb{Z}(i=0,1,2)$. Also we have $$\sqrt{m}(\alpha-\alpha^{(3)})=2m(b_0+b_1\theta+b_2\theta')$$ is an algebraic integer. Hence $b_i=z_i/(2m)$ where $z_i\in\mathbb{Z}(i=0,1,2)$. Let $\lambda_i=\frac{1}{2}x_i+\frac{1}{2m}z_i\sqrt{m}$. Now we have the equations:
\begin{eqnarray}
\alpha&=&\lambda_0+\lambda_1\theta+\lambda_2\theta' \\
\alpha^{(4)}&=&\lambda_0+\lambda_1\theta'+\lambda_2\theta'' \\
\alpha''&=&\lambda_0+\lambda_1\theta''+\lambda_2\theta
\end{eqnarray}
the determinant of the system of linear equation is $\pm f_3$ ($-f_3$ actually, but no need to determine the sign), since this can be viewed as the determination of integral basis and its conjugates. From the definition of discriminant, we have the discriminant is a square root of the discriminant, namely $\pm f_3$. By any case, this follows that the number $f_3\lambda_i (i=0,1,2)$ are algebraic integers.

Then, the numbers $f_3z_i/m (i=0,1,2)$ are rational integers. Since $f_3$ is odd, $\operatorname{gcd}(m,f_3)=f_*$. Hence $z_i/m=y_i/f_*$ where $y_i\in\mathbb{Z}(i=0,1,2)$, and $\frac{1}{2}x_i+\frac{1}{2}y_i\sqrt{m}\in O_{K_2}$, because $f_3$ is odd and $f_3\lambda_i$ is integral.
\end{proof}
\end{lemma}
Note that if $f_*=\operatorname{gcd}(m,f_3)=1$, it follows that $O_{K_6}=O_{K_2}O_{K_3}$, which coincides the result which can be found in \citep{Xianke2006ANT,cohen1993course} etc.

Next we will using above lemma to determine the integral basis of the cyclic sextic field.
\begin{theorem}\label{thm:intbasis_sex}
The integral basis of the cyclic sextic field $K_6=\mathbb{Q}(\theta,\sqrt{m})$($m$ is a square-free integer. ) is of form $$(1,\theta,\theta',\eta,\eta\theta,\eta\theta'),$$ where $\eta=\frac{Df_*+\sqrt{D}}{2f_*}$, $f_*=\operatorname{gcd}(f_2,f_3)$ and $D=f_2$ is the (fundamental) discriminant of the quadratic subfield.
\begin{proof}
From lemma \ref{integersex}, it's easy to show that each element in the basis is of course integral in $K_6$. So we need to calculate the discriminant of these elements. Let $A$ denote the matrix $$\left(\begin{array}{lll} 1&\theta&\theta'\\ 1&\theta'&\theta'' \\1&\theta''&\theta\end{array}\right),$$
and $$B=\left(\begin{array}{lll} \eta&\eta\theta&\eta\theta'\\ \eta&\eta\theta'&\eta\theta'' \\ \eta&\eta\theta''&\eta\theta\end{array}\right),C=\left(\begin{array}{lll} \bar{\eta}&\bar{\eta}\theta&\bar{\eta}\theta'\\ \bar{\eta}&\bar{\eta}\theta'&\bar{\eta}\theta'' \\ \bar{\eta}&\bar{\eta}\theta''&\bar{\eta}\theta\end{array}\right)$$
where $\bar{\eta}=\frac{Df_*-\sqrt{D}}{2f_*}$, then the discriminant of the elements is following:
\begin{eqnarray*}
&&\operatorname{Disc}(1,\theta,\theta',\eta,\eta\theta,\eta\theta')\\
&=&\left(\det\left(\begin{array}{ll} A & B \\ 0&C-B \end{array}\right)\right)^2\\
&=&(\det{(A)}\cdot\det{(C-B)})^2\\
&=&\left(-f_3\cdot((\sqrt{D})^3\cdot(-f_3)/f_*)\right)^2\\
&=&\frac{f_3^4D^3}{f_*^2}\\
&=&f_3^2f_2\frac{f_3^2f_2^2}{f_*^2}\\
&=&f_3^2f_2f_6^2
\end{eqnarray*}
i.e. we have the basis's discriminant is equal to the discriminant of the field, hence $$(1,\theta,\theta',\eta,\eta\theta,\eta\theta')$$ is an integral basis.
\end{proof}
\end{theorem}

\section{Prime Decomposition}\label{sec:primdsex}
For the prime decomposition in cyclic sextic field, we should consider the situation of its two subfields, which are solved in Chapter \ref{chap:chap-four} and \ref{chap:chap-five}. First of all, let us consider the ramified primes in the cyclic sextic field. As we known in previous theorem, the discriminant of the cyclic sextic field is $d(K_6)=f_2f_3^2f_6^2$, from the fundamental ramification theorem \ref{thm:ramification}, we should consider the prime numbers and discriminant. Since $f_6=\operatorname{lcm}(f_2,f_3)$, hence if $p\mid d(K_6)$, then $p\mid f_2$ or $p\mid f_3$. More precisely, form the chain rules for ramification index and decomposition number, we can immediately get the following results.
\begin{theorem}\label{thm:csf-ramified}
Let $K_6=\mathbb{Q}(\theta,\sqrt{m})$ be the cyclic sextic field, suppose $f_3=3^{\delta}p_1p_2\cdots p_t$, and $f_2=D=2^{\delta}q_1q_2\cdots q_s$ where $\delta=\{0,2\}$,
$p_i\equiv 1 (\operatorname{mod} 3)$ and $q_i\equiv 1 (\operatorname{mod} 2)$; $s,t$ are rational integers. What's more, without loss of generality, suppose $p_i=q_i$ for $0<i\leq t_0\leq \min{\{s,t\}}$, Then we have
\begin{enumerate}
\item if $p=p_i=q_i$, where $0<i\leq t_0\leq \min{\{s,t\}}$, then $p$ is totally ramified, i.e. $pO_{K_6}=\wp^6$
\item if $p=p_i$, where $i>t_0$, then $p$ is ramified in the subfield $K(\theta)$, and we have $pO_{K_6}=\wp_1^3\wp_2^3$ if $\left(\frac{f_2}{p}\right)=1$ or $pO_{K_6}=\wp^3$ if $\left(\frac{f_2}{p}\right)=-1$.
\item if $p=q_i$, where $i>t_0$, then $p$ is ramified in the subfield $K(\sqrt{m})$, and we have $pO_{K_6}=\wp_1^2\wp_2^2\wp_3^2$ or $pO_{K_6}=\wp^2$. To determine which case is suitable for $p$, we should used the results in section \ref{sec:ccf-decom} in chapter \ref{chap:chap-five}.
\end{enumerate}
\end{theorem}

As for the results for unramified cases, suppose $p$ is an unramified prime in $O_{K_6}$, i.e. $p\nmid f_2$ and $p\nmid f_3$, then from the theorem \ref{thm:unramified}, we have
\begin{theorem}\label{thm:csf-unramified}
Let $K_6=\mathbb{Q}(\theta,\sqrt{m})$ be the cyclic sextic field, $p$ be an unramified prime in $O_{K_6}$, then
\begin{enumerate}
\item if $\left(\frac{d(K_6)}{p}\right)=1$, then $pO_{K_6}=\prod_{i=1}^6\wp_i$ (splits completely), or $pO_{K_6}=\wp_1\wp_2$.
\item if $\left(\frac{d(K_6)}{p}\right)=-1$, then $pO_{K_6}=p$ (inert) or $pO_{K_6}=\wp_1\wp_2\wp_3$.
\end{enumerate}
\end{theorem}
To determined the exact cases for above unramified theorem, we should refer to chapter \ref{chap:chap-five}.

\section{Unit and Class Number of Real Cyclic Sextic Field}
For real cyclic sextic field, we  have the signature of $K_6$ can only be $(6,0)$, then according to Dirichlet's theorem \ref{thm:Dirichlet} on units in $K_6$ there are 5 fundamental units, which together with $-1$ generate the multiplicative group $U_6$ of units of $K_6$. The unit group $U_6$ has the unit groups $U_2$ and $U_3$ of the subfields $K_2$ and $K_3$ as subgroups.

As we known before, suppose $U_2$ is generated by $-1$ and the fundamental unit $\mu$, and $U_3$ is generated by $-1$, a fundamental unit $\tau$ and one of its conjugates $\tau'=\sigma(\tau)$. From Latimer's work \citep{latimer1934units}, we know that $K_6$ has a system of fundamental units containing $\mu,\tau,\tau'$. So there are three fundamental units are known, i.e. those belonging to the proper subfields, namely $\epsilon,\tau,\tau'$.

To determine the other two units we should first get a so called cyclotomic unit which is calculable from a definite expression. This unit, together with its conjugates, and the units of the proper subfields generate a subgroup of finite index in the whole unit group, and it is in principle relatively easy to obtain the whole group from this subgroup.

First of all, we need a so-called relative units, a unit $\epsilon$ of $K_6$ for which $N_{6/3}(\epsilon)=\pm1$ and $N_{6/2}(\epsilon)=\pm1$ is called a \textbf{relative units}. Let $U_R$ denoted the group of relative units, i.e. we have $$U_R=\{\epsilon\in U_6|N_{6/3}(\epsilon)=\pm1,N_{6/2}(\epsilon)=\pm1\}$$

Note that if $\epsilon\in U_R$, then $N_{6/1}(\epsilon)=N_{2/1}(N_{6/2}(\epsilon))=N_{2/1}(\pm1)=1$. On the other hand, $1=N_{6/1}(\epsilon)=N_{3/1}(N_{6/3}(\epsilon))=(N_{6/3}(\epsilon))^3$ so that for $\epsilon\in U_R$, we have $N_{6/3}(\epsilon)=1$

What's more, M\"{a}ki has proved that in $K_6$, there exists a generating relative unit $\xi_R$ such that $$U_R=\{\pm\xi_R^k\xi_R'^l|k,l\in\mathbb{Z}\}.$$ On the contrary, every relative unit in $K_6$ has a unique representation in this form. M\"{a}ki also showed that how to calculate $\xi_R$ and then establish a solution of the unit.

As for the class number, using the cyclotomic unit, M\"{a}ki has prove a theorem that $h_6=h_2h_3h_R$, where $h_2,h_3$ are class number of the subfield $K_2$ and $K_3$, and the $h_R$ is so-called relative class number of $K_6$. These numbers can be calculated by the cyclotomic units together with fundamental units.

M\"{a}ki lists a huge number with conductor $f_6\leq 2021$ of cyclic sextic field with class number and unit group in her book. Then, together with Ennola and Turunen, she extend this table for $f_6<4000$.

\section{Unit and Class Number of Complex Cyclic Sextic Fields}\label{sec:unitccsf}
For complex situation, then the signature of $K_6$ can only be $(0,3)$, then according to Dirichlet's theorem \ref{thm:Dirichlet} on units in $K_6$ there are 2 fundamental
units, which together with $\mu(K_6)$ generate the multiplicative group $U_6$ of units of $K_6$.

To start discussing the unit and class number of complex cyclic sextic fields,  we first introduce the CM-field. Then idea of CM-field is the extension of complex quadratic field and cyclotomic field.  A CM-field $K$ is a totally imaginary extension of a totally real number field $k^+$, i.e. $$K=K^+(\sqrt{a}),$$ where $K^+$ is totally real, and $a\in K^+$ has negative conjugates.

For example, $K=\mathbb{Q}(\zeta_m)$ is a CM-field, since $K=K^+(\sqrt{a})$, where $K^+=\mathbb{Q}(\zeta+\zeta^{-1})$, and $a=\zeta^2+\zeta^{-2}-2$.

The relationship between the largest totally real subfield and the CM-field are very useful:
\begin{theorem}
Let $\mathbb{Q}\subset F\subset K$ be nontrivial extensions of number fields. Then $K$ is a CM-field, with $F$ its totally real subfield, if and only if $U_K/U_F$ is finite.
\end{theorem}

Another useful theorem \citep{Xianke2006ANT} for class number and unit group is showed as follows:
\begin{theorem}\label{thm:unitcomplexsec}
Let $K$ be a CM-field, $K^+$ its largest totally real subfield, $h$ and $h^+$ be the class number of them respectively, $U$ and $U^+$ be the unit group of $K$ and $K^+$, then:
\begin{enumerate}
\item $h^-=h/h^+$ is so-called the relative class number, which is a rational integer.
\item $Q:=[U:\mu(K)U^+]=1\text{ or }2$
\end{enumerate}
\end{theorem}

More precisely, S. Louboutin has given the class number for complex cyclic sextic field  with $f_6\leq 220000$.


\documentclass[10pt]{article}

\usepackage[margin=1in]{geometry}
\usepackage{amsmath,amsthm,amssymb, graphicx, multicol, array, enumerate, gensymb}
\newcommand{\N}{\mathbb{N}}
\newcommand{\Z}{\mathbb{Z}}

\newenvironment{problem}[2][Problem]{\begin{trivlist}
\item[\hskip \labelsep {\bfseries #1}\hskip \labelsep {\bfseries #2.}]}{\end{trivlist}}

\begin{document}

\title{Mathematics solutions}
\date{}
\maketitle

 \section{Elementary algebra}

\begin{problem}{1.1}
 $$\frac{x^{n+2}}{x^{n-2}}=x^{n+2-n-2}=x^4$$
\end{problem}

\begin{problem}{1.2}
$$x^{-1}*8=2$$ $${x}\neq{0}$$
$$\frac{8}{x}=2$$
$${x}=\frac{8}{2}=4$$

\end{problem}

\begin{problem}{1.3}
$$(a^b)^0=(5^10)^0=5^0=1$$
\end{problem}

\begin{problem}{1.4}
$$\frac{\sqrt{4x}}{\sqrt{x}}=2\frac{\sqrt{x}}{\sqrt{x}}=2$$
\end{problem}

\begin{problem}{1.5}
$$x^2+(x+1)^2=(x+2)^2$$
$$x^2+(x^2+2x+1)=x^2+4x+4$$
$$x^2-2x-3=0$$
$$D=4+4*3=16$$
$$x=\frac{2-4}{2}=-1$$
$$x=\frac{2+4}{2}=3$$
\end{problem}

\begin{problem}{1.6}
$$2^x>1024$$
$$2^x>2^10$$
$$x>10$$
\end{problem}

\section{Functions of one variable}

\begin{problem}{2.1 (Based on SYD 2.5.6)}
$$y=kx+b$$
where x is the temperature in Celsius and y is temperature in Fahrenheit
$$32=k*0+b$$
$$212=k*100+b$$
$$b=32$$
$$212=100k+32$$
$$100k=180$$
$$k=1.8$$
$$x=y$$
$$x=32+1.8x$$
$$-0.8x=32$$
$$x=y=-40$$
\end{problem}

\begin{problem}{2.2}
$f(3)=5x+4=5*3+4=15+4=19$
\end{problem}

\begin{problem}{2.3}
$$x^2-4x+3=0$$
$$D=4^2-4*3=16-12=4$$
$$x=\frac{4-2}{2}=1$$
$$x=\frac{4+2}{2}=3$$

\end{problem}

\begin{problem}{2.4}
$$10*(1+0.02)^90)=60858$$
\end{problem}

\begin{problem}{2.5}

$$e^{\ln 5}=5$$
\end{problem}

\section{Calculus}

\begin{problem}{3.1}
$$\sum\limits_{i=1}^{\infty} \frac{12}{6^i}=\frac{12*\frac{1}{6}}{1-\frac{1}{6}}=\frac{2}{\frac{5}{6}}=\frac{2*6}{5}=2.4$$
\end{problem}

\begin{problem}{3.2}
$$\lim\limits_{x \rightarrow 1}\frac{6^{1-x}}{x}=\lim\limits_{x \rightarrow 1}\frac{6^{1-x}*6^x}{x*6^x}=\lim\limits_{x \rightarrow 1}\frac{6}{1*6}=1$$
\end{problem}

\begin{problem}{3.3}
$f(x)=x^5-8$
$$f'(x)=5x^4$$
$$f'(3)=5*3^4=405$$
\end{problem}

\begin{problem}{3.4}
$$\frac{\mathrm{d}}{\mathrm{d}\, x} \frac{x^3+2x-1}{x-2}$$
$$\frac{\mathrm{d}}{\mathrm{d}\, x} \frac{(3x^3+2x)(x-2)-(x^3+2x-1)}{(x-2)^2}=\frac{3x^3-6x^2+2x-4-x^3-2x+1}{(x-2)^2}=\frac{2x^3-6x^2-3}{(x-2)^2}$$
\end{problem}

\begin{problem}{3.5}
$$\frac{\mathrm{d}}{\mathrm{d}\, x} 4x^4+4x^2=16x^3+8x$$
 $$\frac{\mathrm{d^2}}{\mathrm{d}\, x^2} 4x^4+4x^2=\frac{\mathrm{d}}{\mathrm{d}\, x} 16x^3+8x=48x^2+8 $$

\end{problem}

\begin{problem}{3.6}

$$\frac{\mathrm{d}}{\mathrm{d}\, x} \frac{\ln x}{e^x}=\frac{\mathrm{d}}{\mathrm{d}\, x} \frac{\frac{e^x}{x}-\frac{e^x}{\ln x}}{e^{2x}}=\frac{\frac{e^x}{x}-\frac{e^x}{\ln{x}}}{e^{2x}}=\frac{1}{xe^x}-\frac{1}{x\ln{x}}$$
\end{problem}

\begin{problem}{3.7}

$$f(x)=3x^2-5x+2$$
$$f'(x)=6x-5=$$
$$6x=5$$
$$x=\frac{5}{6}$$

\begin{center}
 \begin{tabular}{||c c c c||}
 \hline
 x & $<\frac{5}{6}$ & $\frac{5}{6}$ & $>\frac{5}{6}$ \\ [0.5ex]
 \hline\hline
 $f'{x}$ & - & 0 & + \\
 \hline
 Slope & decreasing & min & increasing \\
 \hline
 $f''{x}$ & + & + & + \\
 \hline
 Convexity & convex & convex & convex \\ [1ex]
 \hline
\end{tabular}
\end{center}
\end{problem}

\begin{problem}{3.8}
$f(x,y)=x^2+y^3$
$$f(2,3)=2^2+3^3=4+9=13$$
\end{problem}

\begin{problem}{3.9}
$f(x,y)=\ln(x-y)$
$$x-y>0$$
$$x>y$$
\end{problem}

\begin{problem}{3.10}
$$\frac{\partial}{\partial \, x} x^5+xy^3=5x^4+y^3$$
\end{problem}

\begin{problem}{3.11}
$$f(x,y)=x^2y^2+10$$
$$\frac{\partial}{\partial \, x} x^2y^2+10=2xy^2$$
$$\frac{\partial}{\partial \, y} x^2y^2+10=2yx^2$$
$$2xy^2=2yx^2=0$$
$$y=x=0$$
As the function is convex, the stationary point (0,0) is a local minima.
\end{problem}

\begin{problem}{3.12}

$\max x^2y^2$ s.t. $x+y=10$
$$\frac{\partial}{\partial \, x} x^2y^2=2xy^2$$
$$\frac{\partial}{\partial \, y} x^2y^2=2yx^2$$
$$2xy^2=2yx^2$$
$$x=y$$
$$2x=10$$
$$x=y=5$$
\end{problem}

\section{Linear algebra}

\begin{problem}{4.1}

$$A=\begin{bmatrix} 2 & 6\\ 5 & 1 \\ 1 & 9\end{bmatrix}$$
$$B=\begin{bmatrix} 1 & 1 & 7\\2 & 8 & 2\end{bmatrix}$$

  $$A \cdot B=\begin{bmatrix} 2 & 2\\ 4 & 6 \\ 1 & 3\end{bmatrix}\cdot \begin{bmatrix} 1 & 1 & 7\\2 & 8 & 2\end{bmatrix}=\begin{bmatrix} 14 & 50 & 26\\7 & 13 & 37\\ 19 & 73 & 25 \end{bmatrix}$$

\end{problem}

\begin{problem}{4.2}
Take the following matrices:
$$A=\begin{bmatrix} 2 & 2\\ 4 & 6 \\ 1 & 3\end{bmatrix}$$
$$B=\begin{bmatrix} 1 & 9 & 1\\2 & 1 & 2\end{bmatrix}$$
$$A \cdot B=\begin{bmatrix} 2 & 2\\ 4 & 6 \\ 1 & 3\end{bmatrix}\cdot \begin{bmatrix} 1 & 9 & 1\\2 & 1 & 2\end{bmatrix}=\begin{bmatrix} 39 & 59\\ 10 & 16 \end{bmatrix}$$
\end{problem}

\begin{problem}{4.3}

$$\begin{bmatrix}7.1 & 9.1 & 4.7\\ 2 & 7.8 & 1.1 \\ 4 & 4.44 & 0\end{bmatrix}^T=\begin{bmatrix}7.1 & 2 & 4\\ 9.1 & 7.8 & 4.44 \\ 4.7 & 1.1 & 0\end{bmatrix}$$
\end{problem}

\begin{problem}{4.4}

$$\begin{bmatrix}1 & 9 \\ 2 & 8 \end{bmatrix} $$
$D=1*8-2*9=8-18=-10$
\end{problem}

\section{Probability theory}

\begin{problem}{5.1}
\begin{tabular}{llllll}
 11 & 12 & 13  & 14 & 15 & 16 \\
 21 & 22 & 23  & 24 & 25 & 26 \\
 31 & 32 & 33  & 34 & 35 & 36 \\
 41 & 42 & 43  & 44 & 45 & 46 \\
 51 & 52 & 53  & 54 & 55 & 56 \\
 61 & 62 & 63  & 64 & 65 & 66 \
\end{tabular}
\end{problem}

\begin{problem}{5.2+5.3}
$$
$$\begin{tabular}{llll}
\hline
 & Uses Drugs (D) & Doesn't Use Drugs (D') & Total \\
\hline
Positive Test Results (T) & P(T\cap D) & P(T\cap D') & P(T) \\
\hline
Negative Test Results (T') & P(T'\cap D) & P(T'\cap D') & P(T') \\
\hline
\hline
Total & 0.01 & 0.99
\end{tabular}
$$
\break
\break
\break
$$
$$P(T)=P(T\cap D)+P(T\cap D')$$
$$P(T|D)=0.99$$
$$P(T'|D')=0.995$$
$$P(T\cap D)=P(D)P(T|D)=0.01*0.99=0.0099$$
$$P(T'\cap D')=P(D')P(T'|D')=0.99*0.995=0.98505$$
$$P(D')=P(T'\cap D')+P(T\cap D')=1-0.01=0.99$$
$$P(T\cap D')=P(D')-P(T'\cap D')=0.99-0.98505=0.00495$$
$$P(T)=P(T\cap D)+P(T\cap D')=0.0099+0.00495=0.01485$$
\begin{tabular}{ llll }
\hline
 & Uses Drugs (D) & Doesn't Use Drugs (D') & Total \\
\hline
Positive Test Results (T) & 0.0099 & 0.00495 &0.01485 \\
\hline
Negative Test Results (T') & 0.0001 & 0.98505 &0.98515 \\
\hline
\hline
Total & 0.01 & 0.99 & 1
\end{tabular}
$$P(D|T)=\frac{P(D\cap T}{P(T)}=\frac{0.0099}{0.1485}=0.0667$$

\end{problem}

\end{document}


\subsection{Indexing states to time}

We have state defined at each time \(t\).

\(\Psi (t)\).

\subsection{Wave functions}

We have state \(\Psi (t)\).

\(\psi(x,t)=\langle x\rvert \Psi (t) \rangle\)

This is the wave function.


\documentclass[12]{scrartcl}
\usepackage{amssymb,amsmath,gensymb,dsfont,calc,multicol,fullpage}
\makeatletter
\newcommand\Aboxed[1]{
   \@Aboxed#1\ENDDNE}
\def\@Aboxed#1&#2\ENDDNE{%
   &
   \settowidth\@tempdima{$\displaystyle#1{}$}
   \setlength\@tempdima{\@tempdima+\fboxsep+\fboxrule}
   \kern-\@tempdima
   \boxed{#1#2}
}
\makeatother

\begin{document}

\title{Homework 4, Section 1.5: 3, 4(b,f), 5(d), 11, 14, 15, 22, 25}
\author{Alex Gordon}
\date{\today}
\maketitle
\section*{Homework}
\subsection*{3.}
\begin{tabular}{ l | c || r || r ||}
q & p $\wedge$ q are lying &$\neg$p \\
  \hline
  T & T & F\\
  F & F & F\\
  T & F & T\\
  F & F & T\\
  \hline
\end{tabular}
\subsection*{4. B)}
\begin{tabular}{| l | c || r | r | r ||}
p & q & p $\vee$ q &$\neg$ $p \ \vee \ q$ &$\neg p \rightarrow (p\ \vee  \ q)$ \\
  \hline
  T & T & F & T & F\\
  T & F & F & T & F\\
  F & T & T & T & T\\
  F & F & T & F & T\\
  \hline
\end{tabular}
\subsection*{4. F)}
\begin{tabular}{ | r | r | c || r | r | r ||}
p & q & r & p $\vee$ q &$\neg$ $p \ \vee \ q$ &$\neg p \rightarrow (p\ \vee  \ q)$ \\
  \hline
  T & T & F & T & F & F\\
  T & F & F & T & F & F\\
  F & T & T & T & T & T\\
  F & F & T & F & T & T\\
  \hline
\end{tabular}
\subsection*{5. D)}
\begin{tabular}{ | r | r | r || r |l |}
p & q & r & $ p \rightarrow (q \rightarrow r) $ & $p \wedge q \rightarrow r$   \\
  \hline
  T & T & T & T & T\\
  T & T & F & F & F\\
  T & F & T & T & T\\
  T & F & F & T & T\\
  F & T & T & T & T\\
  F & T & F & F & F\\
  F & F & T & T & T\\
  F & F & F & T & T\\
  \hline
\end{tabular} \\
\\
These statements are equivalent
\subsection*{11. A)}
True
\subsection*{11. B)}
False. If x = 11, then x is not $<$ 10
\subsection*{11. C)}
True
\subsection*{11. D)}
True
\subsection*{11. E)}
True, because it is not False.
\subsection*{14. A)}
D= All integers that end in 5\\
B(n) = $5\mod{n} = 0$ \\
$\forall_n \in D, B(n)$\
\subsection*{14. B)}
D= All integers that end in 3\\
B(m) = $3\mod{n} = 0$ \\
$\forall_m \in D, B(m)$\
\subsection*{14. C)}
D= Multiples of 5
B(n) = $n^2 - 1$ = multiple of 3 \\
$\forall_n \in D, B(n)$\
\subsection*{14. D)}
D= Positive real numbers greater than $\sqrt{2}$\\
B(x) = $2/x > \sqrt{2}$\\
$\forall_x \in D, B(x)$\
\subsection*{15.}
A and D are true.
\subsection*{22. A)}
If n is a positive integer and n is even then for all n $\frac{1}{n} < 1$
\subsection*{22. B)}
If a and b are positive integers and $a - b$ is odd then for all a and b $a^2 \neq 2b^2$
\subsection*{22. C)}
If a and b are positive integers and a and b are even then for all a and b $a/b \neq 1 + b/a$
\subsection*{22. D)}
If there is a right triangle with perimeter equal to three times the length of one leg, then for all triangles that have a perimeter not equal to three times the length of one leg, they are not right triangles.
\subsection*{25. A)}
If you do attend the concert you won't get and F for the course.
\subsection*{25. B)}
We won't go if you go.
\subsection*{25. C)}
If you do eat your breakfast, you won't go hungry.
\subsection*{25. D)}
If a quadrilateral is not a square, then it does not have four equal sides and four equal angles.
\subsection*{25. E)}
If a triangle does not either have two equal sides or two equal angles, then it is not an isosceles triangle.

\end{document}


\documentclass[12pt]{amsart}

\usepackage[margin=1in]{geometry}

\usepackage{amsmath,amssymb,amsthm}

\usepackage{enumerate}
\usepackage{todonotes}
\usepackage{hyperref}
\newtheorem{thm}{Theorem}
%\newtheorem{rmk}[thm]{Remark}
\newenvironment{sol}{\paragraph{{\bf Solution:}}}{\hfill$\square$}
\newenvironment{act}{\paragraph{{\bf Activity:}}}{\hfill$\square$}

\let\biconditional\leftrightarrow

\theoremstyle{definition}
\newtheorem*{defn}{Definition}
\newtheorem*{ex}{Example}
\newtheorem*{nonex}{Non-example}
\newtheorem*{rmk}{Remark}
\newtheorem*{prop}{Proposition}
\newtheorem*{cor}{Corollary}
\newtheorem*{conj}{Conjecture}
\newtheorem*{thmno}{Theorem}
\newtheorem*{exer}{Exercise}

\usepackage{tikz}
\usepackage{multicol}

\newcommand{\Z}{\mathbb{Z}}
\newcommand{\N}{\mathbb{N}}
\newcommand{\R}{\mathbb{R}}

\title{ Final Exam Review}

\begin{document}
\maketitle

\noindent\emph{Disclaimer: These practice problems are based on what the class requested to review for the first two exams plus the most recent material and what my impression of what the class struggled with. You should not assume the final will be exactly like this, but these are good practice problems to try.}\\

\noindent\textbf{Ways to study:}
\begin{itemize}
\item Go through the ``self quiz" questions on Blackboard and make sure you can answer them all.
\item For any section you struggled with do the practice problems from that section (on Blackboard).
\item The problems with ** are the potential proofs for the exam. You should definitely do these.
\item Make sure you know how to do the questions on previous exams.
\end{itemize}
Note for all of the above you should be \emph{doing} the mathematics. Reading over worksheet solutions has little to no value - studies have shown this will not improve your performance on the exam.

%\section{Some Example Proofs}
%
%\begin{enumerate}
%\item For $x,y\in \mathbb{Z}$ define $x\sim y$ if and only if $x+y$ is even. Then $\sim$ is an equivalence relation.\\
%
%\item For each $n\in \mathbb{N}$, $7^n$ is odd.\\
%
%\item Let $U$ be a set and $A, B,$ and $C$ subsets of some universal set. Then $(A\cap B) - C = (A-C)\cap (B-C)$.\\

\section{Induction}

\begin{enumerate}

\item ** For each $n\in\mathbb{N}$, $5^n$ is odd.\\

\item For all $n\in\mathbb{N}$,  $\displaystyle{\sum_{i=1}^n (2i-1) = n^2}$. (This is ``sigma notation" which you may have seen in Calculus 2. We could rewrite this statement as ``For all $n\in\N$, $1+3+5+\cdots + (2n-1) = n^2$.") \\

\item For all natural numbers $n$ with $n\geq 3$, $n^2\geq 2n+3$.\\

\item For any natural number $n$, $3\mid n^3+2n$.\\

\section{Using Cases in Proofs}

\item ** Let $U$ be a set and $A, B,$ and $C$ subsets of some universal set. Then $(A\cup B) - C = (A-C)\cup (B-C)$.\\

\item ** Prove that for each integer $n$, if $n$ is odd then $8\mid n^2-1$.\\

\item For all integers $a$, $b$, and $d$ with $d\neq 0$, if $d \mid a$ or $d\mid b$ then $d\mid ab$.

\section{Functions}

\item Define $f: \Z \to \Z$ by $f(x) = 5x+3$. State the domain, codomain and range. Is $f$ an injection? surjection? Prove/disprove.\\

\item ** Define $g: \R\times\R \to\R$ by $g(a,b) = a$. State the domain, codomain and range. Is $g$ an injection? Surjection? Prove/disprove.\\

\item ** Let $A,B,$ and $C$ be nonempty sets and $f:A\to B$ and $g: B\to C$. Prove that if $f$ and $g$ are bijections then $g\circ f$ is a bijection. \\

\section{Equivalence Relations and Equivalence Classes}

\item ** For $x,y\in \mathbb{Z}$ define $x\sim y$ if and only if $x+y$ is even. Prove that $\sim$ is an equivalence relation and find the equivalence class of $2$ (denoted $[2]_\sim$).\\

%\item Let $U$ be some universal set. For $A,B \in\mathcal{P}(U)$ define $A\sim B$ if and only if $A\subseteq B$. Is $A$ an equivalence relation?\\

\item ** For $(w,x)$ and $(y,z)$ in $\mathbb{Z}\times \mathbb{Z}$ define $(w,x)\sim (y,z)$ if and only if $w\leq y$ and $x\leq z$. Is $\sim$ an equivalence relation?\\

\item Define a function $f:\mathbb{R} \to\mathbb{R}$ by $f(x)=x^2+1$. For $a,b\in \mathbb{R}$, say $a\sim b$ if and only if $f(a) = f(b)$. Show this is an equivalence relation and then find $[3]_{\sim}$.\\

\item Write the addition and multiplication tables for $\Z_5$ and $\Z_6$. Somewhere you will have written $[0]$ in each table. Does this mean something different in $\Z_5$ and $\Z_6$ or is it the same?

%\section{Proving Set Relationships}
%
%\item Let $A,B,$ and $C$ be subsets of some universal set $U$. Prove or disprove: If $A\subset C$ and $B\subset C$ then $A\cup B \subset C$.\\
%
%\item Let $A,B,$ and $C$ be subsets of some universal set $U$. Then $A\times (B\cup C) = (A\times B) \cup (A\times C)$\\
%
%\item Let $A$ and $B$ be subsets of some universal set $U$. Then $A-(A\cap B^c)\subseteq A\cap B$. (These sets are actually equal, for an extra challenge, show they are equal.)

\end{enumerate}

  \end{document}


\chapter{Introduction}\label{chap:introduction}

\gravity is a hash-based \emph{few-time signature scheme}, meaning that it's only secure for a limited number of messages---a dozen, hundreds, or thousands, depending on the version.

This limitation allows \gravity to be relatively simple and efficient. It's also \emph{stateless}, as required by NIST.

\gravity is based on Hash to Obtain Random Subset, or HORS, a stateless few-time signature scheme proposed by Reyzin and Reyzin in 2002~\cite{hors}. Like HORST---a variant of HORS introduced for the SPHINCS construction by Bernstein et al. in 2015~\cite{sphincs}---\gravity reduces HORS' public key size thanks to a Merkle tree. The prefix \textsf{PRUNE} summarizes additional tricks to optimize HORS' security and efficiency:
\begin{itemize}
\item A \emph{pseudo-random} generator is used rather than just a hash function in order to obtain a random subset of a set of integers.
\item The pseudo-random generator allows to ensure that the subset elements are \emph{unique}, which increases the security of the scheme (see~\cite[\S4]{masters} and~\cite{subsetres}
\item The Merkle tree is \emph{pruned} in order to trade signature size for public key size, by eliminating redundant key nodes, similarly to what SPHINCS does to minimize the signature size.
\end{itemize}

\section{Advantages and Limitations}

Advantages:
\begin{itemize}

\item \textbf{Simple}: \gravity is much simpler than hash-based signature schemes such as SPHINCS or XMSS, and than signatures schemes from other post-quantum families. The logic of the scheme fits in about 200 lines of C code.

\item \textbf{High-assurance}: Security essentially depends on the collision resistance of hash functions, an assumption unlikely to fail for the proposed functions. \gravity also leverages our detailed analysis and bounds detailed in~\cite[\S4]{masters} and~\cite{subsetres}.

\item \textbf{Speed/security trade-offs} are easily done by varying the parameters $T$ and $K$. For a given choice of $T$ and $K$, an additional parameter $C$ allows to reduce the signature size at the cost of a larger public key.

\item \textbf{Forgeries detection}: If the limit of messages to be signed is exceeded, thereby making forgeries easier, the legitimate signer can detect such forgeries. Obviously, a signature forged by stealing the secret key couldn't be detected.

\item \textbf{Almost optimal}: the signature size can be further reduced by eliminating redundancies, as is our recent Octopus technique~\cite[\S5]{masters}, however by default \gravity avoids the extra complexity and uses suboptimal-length signatures.

\end{itemize}

Limitations:

\begin{itemize}

\item \textbf{Few-time}: Only a limited number of messages can be signed while retaining the highest security guarantees: about 100 or about 1000, depending on the instance. If more messages than the limit are signed, then security slowly degrades.

\item \textbf{Signature size}: Signatures aren't small, but they can be made smaller by using larger public keys. This trade-off has no security impact, and makes signing faster as the public key size grows.

\end{itemize}

\section{Motivations}

A few-time signature scheme allowing only for hundreds or thousands of
distinct messages to be signed is sufficient in a number of major
applications, such as:
root CAs signing intermediate CA certificates; signing of firmware or bootloader images for long-lived devices; protocols using ephemeral signing keys (as mpOTR did); identify management for device provisioning, for example in messaging applications.

Another class of application would use few-time signatures to enforce a bound in the number of authorized signatures.
For example, a bank might issue a digital checkbook limited to 100 transactions.
Would a client issues more than the authorized 100 signatures, they would reduce their own security and thereby allow an attacker to forge signatures on their behalf.

We chose HORS(T) as a basis because it's the most efficient few-time signature construction, and because of its simplicity.

Primitives in \gravity are SHA-256, AES-256-CTR, and Haraka\,v2~\cite{haraka}.
The latter is not a NIST standard, because we needed a fast, short-input hash function and NIST doesn't provide such a primitive.
Haraka\,v2 hashes 32- or 64-byte input values and produces a 32-byte hash value.
It is based on the AES round function and optimized implementations use AES-NIs.
We chose Haraka\,v2 with 6 rounds, rather than the default 5 round, for a greater assurance against collisions.


\chapter{Lecture 2 May 04th 2018}
  \label{chapter:lecture_2_may_04th_2018}

\section{Introduction (Continued)} % (fold)
\label{sec:introduction_continued}

\subsection{Permutations} % (fold)
\label{sub:permutations}

\begin{defn}[Injectivity]\label{defn:injectivity}
\index{Injectivity}
  Let $f: X \to Y$ be a function. We say that $f$ is \hlnoteb{injective} (or \hldefn{one-to-one}) if $f(x_1) = f(x_2)$ implies $x_1 = x_2$.
\end{defn}

\begin{defn}[Surjectivity]\label{defn:surjectivity}
\index{Surjectivity}
  Let $f: X \to Y$ be a function. We say that $f$ is \hlnoteb{surjective} (or \hldefn{onto}) if $\forall y \in Y \enspace \exists x \in X \enspace f(x) = y$.
\end{defn}

\begin{defn}[Bijectivity]\label{defn:bijectivity}
\index{Bijectivity}
  Let $f: X \to Y$ be a function. We say that $f$ is \hlnoteb{bijective} if it is both \hlnoteb{injective} and \hlnoteb{surjective}.
\end{defn}

\begin{defn}[Permutations]\label{defn:permutations}
\index{Permutations}
  Given a non-empty set $L$, a permutation of $L$ is a bijection from $L$ to $L$. The set of all permutations of $L$ is denoted by $S_L$.
\end{defn}

\begin{eg}
  \label{eg:permutations_first}
  Consider the set $L = \{1, 2, 3\}$, which has the following $6$ different permutations: \marginnote{\begin{note}
    \begin{equation*}
      \begin{pmatrix} 1 & 2 & 3 \\ 1 & 3 & 2 \end{pmatrix}
    \end{equation*}
    indicates the bijection $\sigma: \{1, 2, 3\} \to \{1, 2, 3\}$ with $\sigma(1) = 1$, $\sigma(2) = 3$ and $\sigma(3) = 2$.
  \end{note}}

  \begin{gather*}
     \begin{pmatrix} 1 & 2 & 3 \\ 1 & 2 & 3 \end{pmatrix} \quad \begin{pmatrix} 1 & 2 & 3 \\ 1 & 3 & 2 \end{pmatrix} \quad \begin{pmatrix} 1 & 2 & 3 \\ 2 & 1 & 3 \end{pmatrix} \\
     \begin{pmatrix} 1 & 2 & 3 \\ 2 & 3 & 1 \end{pmatrix} \quad \begin{pmatrix} 1 & 2 & 3 \\ 3 & 1 & 2 \end{pmatrix} \quad \begin{pmatrix} 1 & 2 & 3 \\ 3 & 2 & 1 \end{pmatrix}
   \end{gather*}
\end{eg}

\newthought{For $n \in \mathbb{N}$}, we denote $S_n := S_{\{1, 2, ..., n\}}$, the set of all permutations of $\{1, 2, ..., n\}$. \cref{eg:permutations_first} shows the elements of the set $S_3$.

\begin{defn}[Order]\label{defn:order}
\index{Order}
  The \hlnoteb{order} of a set $A$, denoted by $\abs{A}$, is the cardinality of the set.
\end{defn}

\begin{eg}
  \label{eg:order_of_prev_eg}
  We have seen that the order of $S_3$, $\abs{S_3}$ is $6 = 3!$.
\end{eg}

\begin{propo}\label{propo:order_of_Sn_is_n}
  $\abs{S_n} = n!$
\end{propo}

\begin{proof}
  $\forall \sigma \in S_n$, there are $n$ choices for $\sigma(1)$, $n - 1$ choices for $\sigma(2)$, ..., $2$ choices for $\sigma(n - 1)$, and finally $1$ choice for $\sigma(n)$. \qed
\end{proof}

\paragraph{Do elements of $S_n$ share the same properties as what we've seen in the numbers?} Given $\sigma, \tau \in S_n$, we can \hlnotea{compose} the 2 together to get a third element in $S_n$, namely $\sigma \tau$ (wlog), where $\sigma \tau : \{1, ..., n\} \to \{1, ..., n\}$ is given by $\forall x \in \{1, ..., n\}$, $x \mapsto \sigma( \tau(x) )$.

It is important to note that $\because \sigma, \tau$ are \hlimpo{both bijective}, $\sigma \tau$ is also bijective. Thus, together with the fact that $\sigma \tau : \{1, ..., n\} \to \{1, ..., n\}$, we have that $\sigma \tau \in S_n$ by definition of $S_n$.

$\therefore \forall \sigma, \tau \in S_n, \; \sigma \tau, \tau \sigma \in S_n$, but $\sigma \tau \neq \tau \sigma$ in general. The following is an example of the stated case:

\begin{eg}
  \label{eg:commutativity_of_Sn}
  Let
  \begin{equation*}
    \sigma = \begin{pmatrix}
      1 & 2 & 3 & 4 \\
      3 & 4 & 1 & 2
    \end{pmatrix}, \text{ and }
    \tau = \begin{pmatrix}
      1 & 2 & 3 & 4 \\
      2 & 4 & 3 & 1
    \end{pmatrix}.
  \end{equation*}
  Compute $\sigma \tau$ and $\tau \sigma$ to show that they are not equal.

  \begin{solution}
    \begin{equation*}
      \sigma \tau = \begin{pmatrix}
        1 & 2 & 3 & 4 \\
        4 & 2 & 1 & 3
      \end{pmatrix} \text{ but }
      \tau \sigma = \begin{pmatrix}
        1 & 2 & 3 & 4 \\
        3 & 1 & 2 & 4
      \end{pmatrix}
    \end{equation*}
  \end{solution}
\end{eg}

Perhaps what is interesting is the question of: \textbf{when does commutativity occur?} One such case is when $\sigma$ and $\tau$ have support sets\sidenote{Defined as
\begin{equation*}
  \supp(\sigma) = \{ x \in (1, 2, ..., n) : \sigma(x) \neq x \}
\end{equation*}
} that are disjoint\sidenote{This is proven in A1}.

On the other hand, the associative property holds\sidenote{
  \begin{ex}
    Prove this as an exercise.
  \end{ex}
}, i.e.
\begin{equation*}
  \forall \sigma, \tau, \mu \in S_n \enspace \sigma (\tau \mu) = (\sigma \tau) \mu
\end{equation*}

The set $S_n$ also has an identity element\sidenote{
  \begin{ex}
    Verify that the given identity element is indeed the identity, i.e.
    \begin{equation*}
      \forall \sigma \in S_n \enspace \sigma \epsilon = \sigma = \epsilon \sigma.
    \end{equation*}
  \end{ex}
}, namely
\begin{equation*}
  \epsilon = \begin{pmatrix}
    1 & 2 & \hdots & n \\
    1 & 2 & \hdots & n
  \end{pmatrix}
\end{equation*}

Finally, $\forall \sigma \in S_n$, since $\sigma$ is a bijection, we have that its inverse function, $\sigma^-1$ is also a bijection, and thus satisfies the requirements to be in $S_n$. We call $\sigma^{-1} \in S_n$ to be the \hldefn{inverse permutation} of $\sigma$, such that
\begin{equation*}
  \forall x, y \in \{1, ..., n\} \quad \sigma^{-1}(x) = y \iff \sigma(y) = x.
\end{equation*}
It follows, immediately, that
\begin{equation*}
  \sigma \big( \sigma^{-1}(x) \big) = x \, \land \, \sigma^{-1} \big( \sigma(y) \big) = y.
\end{equation*}
$\therefore$ We have that
\begin{equation*}
  \sigma \sigma^{-1} = \epsilon = \sigma^{-1} \sigma.
\end{equation*}

\begin{eg}
  \label{eg:inverse_permutation}
  Find the inverse of
  \begin{equation*}
    \sigma = \begin{pmatrix}
      1 & 2 & 3 & 4 & 5 \\
      4 & 5 & 1 & 2 & 3
    \end{pmatrix}
  \end{equation*}

  \begin{solution}
    By rearranging the image in ascending order, using them now as the object and their respective objects as their image, construct
    \begin{equation*}
      \tau = \begin{pmatrix}
        1 & 2 & 3 & 4 & 5 \\
        3 & 4 & 5 & 1 & 2
      \end{pmatrix}.
    \end{equation*}
    It can easily (although perhaps not so prettily) be shown that
    \begin{equation*}
      \sigma \tau = \epsilon = \tau \sigma.
    \end{equation*}
  \end{solution}
\end{eg}

With all the above, we have for ourselves the following proposition:

\begin{propo}[Properties of $S_n$]\label{propo:properties_of_Sn}
  We have\sidenote{These properties show that $S_n$ is a group, which will be defined later.}
  \begin{enumerate}
    \item $\forall \sigma, \tau \in S_n \enspace \sigma \tau, \tau \sigma \in S_n$.
    \item $\forall \sigma, \tau, \mu \in S_n \enspace \sigma (\tau \mu) = (\sigma \tau) \mu$.
    \item $\exists \epsilon \in S_n \enspace \forall \sigma \in S_n \enspace \sigma \epsilon = \sigma = \epsilon \sigma$.
    \item $\forall \sigma \in S_n \enspace \exists! \sigma^{-1} \in S_n \enspace \sigma \sigma^{-1} = \epsilon = \sigma^{-1} \sigma$.
  \end{enumerate}
\end{propo}

\newthought{Consider}
\begin{equation*}
  \sigma = \begin{pmatrix}
    1 & 2 & 3 & 4 & 5 & 6 & 7 & 8 & 9 & 10 \\
    3 & 1 & 7 & 6 & 9 & 4 & 2 & 5 & 8 & 10
  \end{pmatrix} \in S_{10}
\end{equation*}
If we represent the action of $\sigma$ geometrically, we get

\begin{tabular}{c c c}
  \begin{tikzcd}
   & 1 \arrow[rd] &  \\
  2 \arrow[ru] &  & 3 \arrow[ld] \\
   & 7 \arrow[lu] &
  \end{tikzcd}
  &
  \begin{tikzcd}
  4 \arrow[dd, bend left] \\
   \\
  6 \arrow[uu, bend left]
  \end{tikzcd}
  &
  \begin{tikzcd}
   & 5 \arrow[rdd] &  \\
   &  &  \\
  8 \arrow[ruu] &  & 9 \arrow[ll]
  \end{tikzcd}
  \\ &
  \begin{tikzcd}
    10 \arrow[loop below]
  \end{tikzcd}
\end{tabular}
We observe that $\sigma$ can be \hlnotea{decomposed} into one $4$-cycle, $\begin{pmatrix} 1 & 3 & 7 & 2 \end{pmatrix}$, one $2$-cycle, $\begin{pmatrix} 4 & 6 \end{pmatrix}$, one $3$-cycle, $\begin{pmatrix} 5 & 9 & 8 \end{pmatrix}$, and one $1$-cycle, $\begin{pmatrix} 10 \end{pmatrix}$.

Note that these cycles are (pairwise) \hlnotea{disjoint}, and we can write\sidenote{We generally do not include the $1$-cycle and assume that by excluding them, it is known that any number that is supposed to appear loops back to themselves.}
\begin{equation*}
  \sigma = \begin{pmatrix} 1 & 3 & 7 & 2 \end{pmatrix}\begin{pmatrix} 4 & 6 \end{pmatrix}\begin{pmatrix} 5 & 9 & 8 \end{pmatrix}
\end{equation*}
Note that we may also write
\begin{align*}
  \sigma &= \begin{pmatrix} 4 & 6 \end{pmatrix}\begin{pmatrix} 5 & 9 & 8 \end{pmatrix}\begin{pmatrix} 1 & 3 & 7 & 2 \end{pmatrix} \\
    &= \begin{pmatrix} 6 & 4 \end{pmatrix}\begin{pmatrix} 9 & 8 & 5 \end{pmatrix}\begin{pmatrix} 7 & 2 & 1 & 3 \end{pmatrix}
\end{align*}
It is interesting to note that the cycles can rotate their ``elements'' in a \hlnotea{cyclic} manner, i.e.
\begin{gather*}
  \begin{pmatrix} 1 & 3 & 7 & 2 \end{pmatrix} = \begin{pmatrix} 7 & 2 & 1 & 3 \end{pmatrix} \neq \begin{pmatrix} 1 & 2 & 7 & 3 \end{pmatrix}.
\end{gather*}
Although the decomposition of the cycle notation is not unique (i.e. you may rearrange them), each individual cycle is unique, and is proven below.

\begin{thm}[Cycle Decomposition Theorem]\label{thm:cycle_decomposition_theorem}
\index{Cycle Decomposition Theorem}
  If $\sigma \in S_n$, $\sigma \neq \epsilon$, then $\sigma$ is a product of (one or more) disjoint cycles of length at least $2$. This factorization is unique up to the order of the factors.
\end{thm}

\begin{proof}
  Since $\sigma \in S_n$, we may write $\sigma$ as
  \begin{equation*}
    \sigma = \begin{pmatrix}
      1   & 2   & 3   & \hdots & n - 2     & n - 1     & n \\
      a_1 & a_2 & a_3 & \hdots & a_{n - 2} & a_{n - 1} & a_n
    \end{pmatrix}
  \end{equation*}
  where for $1 \leq i \leq n$, $\sigma(i) = a_i$, $1 \leq a_i \leq n$, for $1 \leq j \leq n$ with $j \neq i$, $a_i \neq a_j$.

  Since $\sigma \neq \epsilon$, then $\exists k \in \mathbb{N}$, where $1 \leq k \leq n$, such that $\sigma (k) \neq l$ for some $l \in \mathbb{N}$, where $1 \leq l \leq n$ and $l \neq k$. If $\sigma(l) = k$, then we would have the cycle $\begin{pmatrix} k & l \end{pmatrix}$, which has length $2$. Consequently, if $\forall j \in \mathbb{N}$, with $1 \leq j \leq n$ and $j \neq k, l$, we have $\sigma(j) = j$, then we may express $\sigma$ simply as
  \begin{equation*}
    \sigma = \begin{pmatrix} k & l \end{pmatrix}.
  \end{equation*}
  Otherwise, if there is a $j \in \mathbb{N}$, $1 \leq j \leq n$ and $j \neq k, l$, such that $\sigma(j) = i$ for some $i \in \mathbb{N}$, with $1 \leq i \leq n$ and $i \neq j, k, l$. Then, at the very least, we would have that $\sigma$ can be written as
  \begin{equation*}
    \sigma = \begin{pmatrix} k & l \end{pmatrix} \begin{pmatrix} j & i & \hdots \end{pmatrix}
  \end{equation*}
  Now if for $2 \leq m \leq n - 3$, if $\sigma^m (j) \neq j$, then the above cyclic decomposition is complete. Otherwise, if for some $m < n$, $\sigma^m(j) = j$, then
  \begin{equation*}
    \sigma = \begin{pmatrix} k & l \end{pmatrix} \begin{pmatrix} j & i & \sigma^2(j) & \hdots & \sigma^{m - 1}(j) \end{pmatrix} \tau
  \end{equation*}
  where $\tau$ is the remaining cyclic decompositions which can be constructed using the same argument for $j$. Similarly, if $\sigma(l) \neq k$, then the first cycle would be ``longer''. Therefore, we observe that for any $\sigma \in S_n$, we have that $sigma$ must be a product of at least one disjoint cycle of length at least $2$.

  Now note that
  \begin{align}
    &\begin{pmatrix} k & \sigma(k) & \sigma^2(k) & \hdots & \sigma^m(k) \end{pmatrix} \nonumber \\
    &= \begin{pmatrix} \sigma(k) & \sigma^2(k) & \hdots & \sigma^m(k) & k \end{pmatrix} \nonumber \\
    &= \begin{pmatrix} \sigma^2(k) & \sigma^3(k) & \hdots & k & \sigma(k) \end{pmatrix} \tag{$\dagger$}\label{eq:qb_1}\\
    &\qquad \vdots \nonumber \\
    &= \begin{pmatrix} \sigma^m(k) & k & \sigma(k) & \hdots & \sigma^{m-1}(k) \end{pmatrix} \nonumber
  \end{align}
  for some $k \in \{1, n\} \subseteq \mathbb{N}$ and $m \in \{1, n - 1\} \subseteq \mathbb{N}$. For example,
  \begin{equation*}
    \begin{pmatrix} 1 & 2 & 3 \end{pmatrix} = \begin{pmatrix} 2 & 3 & 1 \end{pmatrix},
  \end{equation*}
  but
  \begin{equation*}
    \begin{pmatrix} 1 & 2 & 3 \end{pmatrix} \neq \begin{pmatrix} 2 & 1 & 3 \end{pmatrix}.
  \end{equation*}
  Suppose that $\exists m, l \in \mathbb{N}$ such that $\sigma$ can be expressed as
  \begin{gather*}
    \sigma = \alpha_1 \alpha_2 \hdots \alpha_m \quad \text{and} \\
    \sigma = \beta_1 \beta_2 \hdots \beta_l
  \end{gather*}
  where $\alpha_i$ and $\beta_i$ are cycles and factors of $\sigma$ (note that we will enforce the convention of dropping the 1-cycle). Then by \cref{eq:qb_1},  there must be some $1 \leq i \leq m$ and $1 \leq j \leq l$ such that $\alpha_i = \beta_j$. Otherwise, there would be a case such that $\sigma(k) = a_i$ for some $a_i \in \{1, n\}$, where $a_i$ is not in the cycle that $k$ belongs to. We can keep applying this argument and eventually find that it must be the case that $m = l$, and each $\alpha_i$ must be equal to some $\beta_j$. Therefore, the factorization is unique up to the order of the factors. \qed

\end{proof}

\begin{note}[Convention]
 Every permutation in $S_n$ can be regarded as a permutation of $S_{n + 1}$ by fixing the permutation of $n + 1$. Therefore, we have that
 \begin{equation*}
   S_1 \subseteq S_2 \subseteq \hdots \subseteq S_n \subseteq S_{n + 1} \subseteq \hdots
 \end{equation*}
\end{note}

% subsection permutations (end)

% section introduction_continued (end)

% chapter lecture_2_may_04th_2018 (end)


\section{Phi Nodes}

In SSA IR, we encountered the issue of figuring out which variable version to use after a join point where multiple paths were coming in with different versions of the same variable. As a solution to this, phi nodes or phi functions are extremely helpful that could be placed only at the beginning of a basic block with multiple edges coming in (join point).

These phi nodes can be placed at each join point for every variable in the program. This placement strategy is a bit wasteful as illustrated in the following diagram:

\begin{figure}[htp]
\centering
\includegraphics[height=6cm]{images/phinodes.png}
\caption{Placement of \(\Phi\) nodes}
\end{figure}

\subsection{Path Convergence Criterion}

Consider z to be node with multiple edges coming in (thus it is a join point). We need \(\Phi\) node for variable a at node z if and only if
\begin{enumerate}
    \item There is a block x containing the definition of a.
    \item There is a block y (not x) containing the definition of a.
    \item There are non empty paths \(P_{xz}\) and \(P_{yz}\) from x to z and y to z respectively.
            \begin{figure}[htp]
\centering
\includegraphics[height=3cm]{images/Condition123.png}
\caption{CFG for condition 1, 2, 3}
\end{figure}
    \item \(P_{xz}\) and \(P_{yz}\) should not have any node in common except z.
        \begin{figure}[htp]
\centering
\includegraphics[height=3cm]{images/Condtion4.png}
\caption{Violation of Condition 4}
\end{figure}
    \item The node z does not appear within both  \(P_{xz}\) and \(P_{yz}\), prior to the end. It is fine if z appears only in one of the path before end.
            \begin{figure}[htp]
\centering
\includegraphics[height=3cm]{images/Condition5.png}
\caption{Cpndition 5: Left CFG does not need \(\Phi\) node, right CFG needs \(\Phi\) node}
\end{figure}
\end{enumerate}

\subsection{Iterative Fixed Point Algorithm}

while \{there are nodes x, y, z satisfying condition 1-5 and z does not contain a \(\Phi\) node for a\}\\
do \{insert \(a \leftarrow \Phi(a_1, a_2, ..., a_j)\) \}

The \(\Phi\) function has as many 'a' arguments as there are predecessors of z. Since the conditions 1-5 are both sufficient and necessary, the above algorithm is sound and complete.


\section{Spectral Theory of Selfadjoint Mappings of a Euclidean Space Into Itself}

\subsection{Exercise 1}
This is only true when $(y, My)$ is real, since
\begin{align*}
        (y, \frac{M + M^{*}}{2}y) &= \frac{1}{2} (y, My) + \frac{1}{2} \overline{(y, My)} \\
                                  &= \Re (y, My)
\end{align*}

\subsection{Exercise 2}
Algorithm is described by Lax; I'll pass on coding.

\subsection{Exercise 3}
Let $S$ be the max subspace such that $q \geq 0$ and $S_+$ be the max subspace such that $q > 0$.
Then the nullspace of the mapping $P: S \to S_+$ defined as setting the first $p_+$ elements of a vector to 0
consists of those vectors for which $q = 0$. Since the dimension of this nullspace is $p_0$, we have the
desired result. Showing the same for $S_-$ is analogous.

\subsection{Exercise 4}
This exercise is almost identical to the second proof of Theorem 4 shown in the book.

(a) Let $q(x) = (x, Hx)$ and $p(x) = (x, Mx)$. Then $R_{H,M} (x) = \frac{q(x)}{p(x)}$ is real
since $H$ and $M$ are both self-adjoint. Furthermore, $R_{H,M} (kx) = R_{H,M} (x)$, so it suffices
to optimize $R_{H,M}$ over the unit sphere. Since the unit sphere is compact, and $R_{H,M}$ is the
quotient of two continuous functions (with $p(x) > 0$ due to positivity), $R_{H, M}$ has a minimum
on the unit sphere (which is non-zero).

(b) Let the minimum in question be $f$. Then we can do exactly as Lax did and consider $R_{H,M}(f + tg)$
as a function of a single real variable $t$. The derivative of this function at $t = 0$ is $0$, from which
we get
\begin{align*}
        \frac{p(f) \dot{q}(0) - q(f) \dot{p}(0)}{p^2(f)} &= 0 \\
        \dot{q}(0) - b\dot{p}(0) &= 0 \quad b = \frac{q(f)}{p(f)} \\
        (g, Hf) = b (g, Mf) &\implies Hf = bMf
\end{align*}
Where $\dot{q}$ and $\dot{p}$ refer to the derivatives of $q, p$ with respect to the variable $t$.

(c) We are done if we can show that both $H$ and $M$ map the space $Y$ consisting of
$(y, Mf) = 0$ back to itself. To do so, we appeal to the representation of $M$ as a sum of projection
operators, $M = \sum a_i P_i$ (this is possible since $M$ is self-adjoint). Using this representation,
we have that
\begin{align*}
        (My, Mf) = (y, M^2 f) = (y, \sum a_i^2 P_i f) = \sum a_i (y, a_i P_i f) = 0
\end{align*}
The analogous result follows for $H$ since $HM f = b M^2 f$.

(d) This follows immediately from solving the constrained optimization problem in (c) in the same manner
as (b).

\subsection{Exercise 5}
Repeatedly applying the procedure outlined in Exercise 4 allows us to construct the desired $f_i$. These
$f_i$ all satisfy $(Mf_i, Mf_j) = 0$ for $i \neq j$, so $Mf_i$ forms a basis for $X$.
As such, $f_i$ must also form a
basis for $X$, as otherwise the $Mf_i$ would have a nontrivial linear relation sending them to 0.

\subsection{Exercise 6}
The equivalent minmax is
\begin{align*}
        b_j = \min_{\text{dim} S = j} \max_{x \in S, x \neq 0} \frac{(x, Hx)}{(x, Mx)}
\end{align*}
The logic to show this is the same as in Theorem 10 in the book. For showing $\geq b_j$ we use the linear
conditions $(x, f_i) = 0$ to get an $x$ with no contribution from $f_1, ..., f_{j-1}$. For $\leq b_j$
we use the space spanned by $f_1, ..., f_j$.

The only difference is that instead of using Equation (36) from the chapter, we instead use
\begin{align*}
        x &= z_1 f_1 + ... + z_n f_n \\
        \frac{(x, Hx)}{(x, Mx)} &= \frac{\sum b_i z_i^2 (f_i, Mf_i)}{\sum z_i^2 (f_i, Mf_i)}
\end{align*}

\subsection{Exercise 7}
We have that $Hf_i = bMf_i \implies M^{-1} H f_i = b_i f$ and all of the $b_i$ are real per Exercises 4 and 5.
If $H$ is also positive, then $R(x)$ as defined in Exercise 4 is always positive, so the $b_i$ will be
positive as well.

\subsection{Exercise 8}
Since  $N$ is normal, it has an orthonormal basis consisting of eigenvectors $f_i$. Thus, we have
\begin{align*}
        x &= z_1 f_1 + ... + z_n f_n \\
        \frac{(Ax, Ax)}{(x, x)} &= \frac{\sum n_i^2 z_i^2}{\sum z_i^2} \\
                                &\leq \max n_j^2
\end{align*}
Equality holds when $x$ is selected to be the eigenvector corresponding to the largest (in absolute value)
eigenvalue. Thus, $\norm{N} = \max \abs{n_j}$.

\subsection{Exercise 9}
(a) $S$ is clearly an isometry, since all it does is rearrange terms in the expression for the distance
between two vectors.

(b) Since $S^n = I$, the eigenvalues of $S$ must be $n^{\text{th}}$ roots of unity. Each $n^{\text{th}}$
root $a_i$ can be used to construct an eigenvector by letting $x_1 = \bar{a_i}, x_2 = \bar{a_i}^2, ..., x_n = 1$.

(c) Let $x$ and $y$ be eigenvectors corresponding to the eigenvalues $a_i$ and $a_j$ and let $(x, y) = \alpha$.
Then $a_i \bar{a_j} (x, y) = \alpha$ since the $a_i \bar{a_j}$ powers are cyclic.
Since $1 - a_i \bar{a_j} \neq 0$ for all $i \neq  j$, $(x, y) = 0$ when $i \neq j$ and the eigenvectors are
therefore orthogonal.


    \filetitle{litterman}{Litterman's prior dummy observations for BVARs}{BVAR/litterman}

	\paragraph{Syntax}\label{syntax}

\begin{verbatim}
O = BVAR.litterman(Rho,Mu,Lmb)
\end{verbatim}

\paragraph{Input arguments}\label{input-arguments}

\begin{itemize}
\item
  \texttt{Rho} {[} numeric {]} - White-noise priors (\texttt{Rho = 0})
  or random-walk priors (\texttt{Rho = 1}).
\item
  \texttt{Mu} {[} numeric {]} - Weight on the dummy observations.
\item
  \texttt{Lmb} {[} numeric {]} - Exponential increase in weight
  depending on the lag; \texttt{Lmb = 0} means all lags are weighted
  equally.
\end{itemize}

\paragraph{Output arguments}\label{output-arguments}

\begin{itemize}
\itemsep1pt\parskip0pt\parsep0pt
\item
  \texttt{O} {[} bvarobj {]} - BVAR object that can be passed into the
  \href{VAR/estimate}{\texttt{VAR/estimate}} function.
\end{itemize}

\paragraph{Description}\label{description}

See the section explaining the \href{BVAR/Contents}{weights on prior
dummies}, i.e.~the input argument \texttt{Mu}.

\paragraph{Example}\label{example}


\section{Prob 2. f)}

\lstinputlisting{root_finding.py}

Output of the root(s) found for $N(x)=y/2$, where $y$ is the maximum of $N(x)$.
\lstinputlisting{root_found.txt}


\subsection{Distributed Key Generation Protocol}
\label{ssec:dkg}

We desire a Byzantine Fault Tolerant consensus algorithm.
So, we let $\mathcal{P}$ be the total collection of participants with
$\abs{\mathcal{P}} = n$.
We set the threshold $t = \floor{2n/3}$ in our $\parens{t,n}$
secret sharing protocol.
Thus, it takes $t+1$ users to reconstruct a secret, which corresponds
to strictly greater than two-thirds of the participants.
We assume there is an open broadcast channel between all participants.
Encryption will be provided through Diffie-Hellman-style shared
secret encryption; this will be discussed at the end of
Sec.~\ref{sssec:share_distribution}.
The group's shared secret, henceforth called the \emph{master secret key},
will be the sum of the shared secrets of
each group member who correctly shared his secret.
Once there are $t+1$ valid partial signatures, these will be
combined to form a group signature.

As stated above, although the final master public key will
reside in $\G_{2}$, because the precompiled contracts
currently available in the Ethereum Virtual Machine only allow addition
and scalar multiplication in $\G_{1}$ (multiplication and exponentiation
in our multiplicative notation), we will primarily
use computations in $\G_{1}$ and anything required
in $\G_{2}$ will be confirmed via a \textsc{PairingCheck} call.

\subsubsection*{Protocol Overview}

We briefly give an overview of the DKG protocol.
Here are the different phases of the protocol:

\begin{enumerate}
\item \textbf{\Registration{}:}
    Participants submit a public key
    which will allow for secure communication on an open channel.
\item \textbf{\ShareDistribution{}:}
    Secret shares are distributed
    through verifiable secret sharing;
    these shares allow for the construction of the master public key.
\item \textbf{\ShareDistributionDispute{}:}
    If there are any invalid shares,
    accusations can be made against malicious validators.
\item \textbf{\KeyShare{}:}
    Portions of the master public key and accompanying
    proofs are submitted.
\item \textbf{\MasterPublicKey{}:}
    Any participant is able to construct and submit
    the master public key.
\item \textbf{\GPKSubmission{}:}
    Group public keys are submitted.
\item \textbf{\GPKDispute{}:}
    Accusations are made against those who submitted invalid
    group public keys.
\item \textbf{\Completion{}:}
    Any participant is able to signal the successful completion
    of the DKG protocol.
    This is required for MadNet to proceed.
\end{enumerate}

\subsubsection{\Registration{}}
Each participant $P_{i}\in\mathcal{P}$ begins by selecting
a secret key $\sk_{i}\in\Z_{q}$ with public key $\pk_{i} = g_{1}^{\sk_{i}}$.
The public-private key pair $\angles{\pk_{i},\sk_{i}}$ will be
used for secure communication over the insecure broadcast channel;
it will not be used for signing any messages.
The public key $\pk_{i}$ will be submitted during registration.

\subsubsection{\ShareDistribution{}}
\label{sssec:share_distribution}
The primary purpose of this phase is to correctly share secrets
between validators.
These shared secret will then be used to establish a master secret key.
By distributing the appropriate shares,
each participant will be able to construct a portion
of the key to create group signatures.
This is done via Verifiable Secret Sharing
and is based on a distributed version of
Shamir's Secret Sharing~\cite{shamir1979share}.

Participant $P_{i}$ chooses a secret
$s_{i}\in\Z_{q}$ to share with the other participants.
To do this, choose a secret polynomial $f_{i}:\Z_{q}\to\Z_{q}$
with

\begin{equation}
    f_{i}(x) = c_{i0} + c_{i1}x + c_{i2}x^{2} + \cdots + c_{it}x^{t},
\end{equation}

\noindent
where $c_{i0} = s_{i}, c_{i1}, \cdots, c_{it}$ are chosen uniformly
in $\Z_{q}$.
Setting

\begin{equation}
    C_{ik} = g_{1}^{c_{ik}}\quad k\in\braces{0,\cdots,t},
\end{equation}

\noindent
we have the corresponding public polynomial $F_{i}:\Z_{q}\to\G_{1}$:

\begin{equation}
    F_{i}(x) = C_{i0}C_{i1}^{x}\cdots C_{it}^{x^{t}}.
\end{equation}

\noindent
The shared secret from $P_{i}$ to $P_{j}$ is $s_{i\to j} = f_{i}(j)$
and

\begin{equation}
    \overline{\texttt{s}}_{i\to j} =
        \textsc{Encrypt}(\text{sk}_{i},\text{pk}_{j},j, s_{i\to j})
\end{equation}

\noindent
refers to a particular encryption scheme discussed
at the end of this \hyperref[par:secret_enc]{section}.
Participant $P_{i}$ will broadcast the message

\begin{equation}
    \left\{
        \overline{\texttt{s}}_{i\to 1}, \overline{\texttt{s}}_{i\to 2},
            \cdots,
            \overline{\texttt{s}}_{i\to i-1},
            \overline{\texttt{s}}_{i\to i+1},
            \cdots,
            \overline{\texttt{s}}_{i\to n},
        C_{i0}, C_{i1}, \cdots, C_{it}
    \right\}
\end{equation}

\noindent
over the broadcast channel.
In our setting, this information will be submitted to the
Ethereum smart contract and
all participants will receive notification.
We note this message does not include the secret
$\overline{\texttt{s}}_{i\to i}$.

Once participant $P_{j}$ receives the message from $P_{i}$,
he sets

\begin{equation}
    \hat{s}_{i\to j} = \textsc{Decrypt}(\text{sk}_{j},\text{pk}_{i}, j,
        \overline{\texttt{s}}_{i\to j}).
\end{equation}

\noindent
$P_{j}$ then determines if

\begin{equation}
    g_{1}^{\hat{s}_{i\to j}} \overset{?}{=} F_{i}(j).
    \label{eq:secret_share_test}
\end{equation}

\noindent
If we have equality, then $\hat{s}_{i\to j} = s_{i\to j}$.
Otherwise, $P_{i}$ incorrectly shared his secret.

\paragraph{Shared Secret Encryption}
\label{par:secret_enc}

As mentioned above, the shared secret from
$P_{i}$ to $P_{j}$ is $s_{i\to j} = f_{i}(j)$.
To encrypt this, we need to compute their shared secret:

\begin{equation}
    k_{ij} = \pk_{i}^{\sk_{j}} = \pk_{j}^{\sk_{i}} =
    g_{1}^{\sk_{i}\sk_{j}}.
\end{equation}

\noindent
Encryption and decryption are based on the idea of a one-time pad;
in particular, we use outputs of cryptographic hashes of
the $x$-coordinate of the shared secret along with the index
of the participant receiving the message as our ``one-time pad''.
This does not meet the technical definition of a one-time pad
as it is usually defined (one standard reference is~\cite{hac1996}),
but the idea is similar.
By including the index of the intended recipient in the hash function,
each symmetric encryption key is unique.
See Alg.~\ref{alg:enc_dec} for details.

\input{algs/encryption_and_decryption.tex}

\subsubsection{\ShareDistributionDispute{}}
If we have $g_{1}^{\hat{s}_{i\to j}} = F_{i}(j)$
in Eq.~\eqref{eq:secret_share_test} for all participants,
then everyone correctly shared his secrets.
In this case, there is nothing to dispute and the DKG protocol
will proceed to the next phase.

Instead, we now suppose that $\overline{\texttt{s}}_{i\to j}$ is incorrect;
that is, $g_{1}^{\hat{s}_{i\to j}} \ne F_{i}(j)$
in Eq.~\eqref{eq:secret_share_test} for some $i$ and $j$.
In order to prove this to be the case, everyone needs to be
able to prove that the encrypted secret
$\overline{\texttt{s}}_{i\to j}$ is incorrect.
To do this, $P_{j}$ must publish and prove the shared secret $k_{ij}$;
this is required in order to ensure bad actors
do not submit false proofs against honest actors.

Proving $k_{ij}$ is the shared secret is based on showing

\begin{equation}
    \pk_{j} = g_{1}^{\sk_{j}} \quad\text{and}\quad
    k_{ij} = \pk_{i}^{\sk_{j}}
\end{equation}

\noindent
\emph{without} sharing the secret key $\sk_{j}$;
that is, we wish to show
$\dlog_{g_{1}}(\pk_{j}) = \dlog_{\pk_{i}}(k_{ij})$
while keeping their common value ($P_{j}$'s secret key $\sk_{j}$) secret.
To do this, we use a zero-knowledge proof;
see Alg.~\ref{alg:zk_dleq_proof} for constructing the zk-proof
and Alg.~\ref{alg:zk_dleq_verify} for proof verification.
One reference for zk-proofs involving discrete logarithms
is~\cite{camenisch1997proof}.

Thus, $P_{j}$ would compute

\begin{equation}
    \pi(k_{ij}') = \textsc{DLEQ}(g_{1},\pk_{j},\pk_{i},k_{ij}',\sk_{j})
\end{equation}

\noindent
and publish $\angles{k_{ij}',\pi(k_{ij}')}$, where $k_{ij}'$
is claimed shared secret.
This allows anyone to use \textsc{DLEQ-verify} to determine
its validity.
If

\begin{equation}
    \textsc{DLEQ-verify}(g_{1},\pk_{j},\pk_{i},k_{ij}',\pi(k_{ij}'))
        = \texttt{true},
\end{equation}

\noindent
then $k_{ij}' = k_{ij}$, the shared secret.
Using this, everyone can decrypt $\overline{\texttt{s}}_{i\to j}$
by

\begin{equation}
    \hat{s}_{i\to j}
        = \textsc{DecryptSS}(k_{ij},j,\overline{\texttt{s}}_{i\to j}, b)
\end{equation}

\noindent
and determine if

\begin{equation}
    g_{1}^{\hat{s}_{i\to j}} \overset{?}{=} F_{i}(j).
    \label{eq:secret_share_test_2}
\end{equation}

\noindent
If the DLEQ proof $\pi(k_{ij}')$ shows $k_{ij}'$ is the shared
secret between $P_{j}$ and $P_{i}$ and we do not have equality in
Eq.~\eqref{eq:secret_share_test_2}, then $P_{i}$ is acted maliciously
and should be removed.
There are two other possibilities:
$k_{ij}'$ is not the shared secret, or $k_{ij}'$ is the shared secret
and we have equality in Eq.~\eqref{eq:secret_share_test_2}.
In both cases, $P_{j}$ acted maliciously and should be removed.
Thus, when $P_{j}$ submits a claim that $P_{i}$
failed to share a secret,
either $P_{j}$'s or $P_{i}$'s stake will be slashed.

In practice, $P_{j}$ will submit $P_{i}$'s broadcast message to an
Ethereum smart contract along with purported shared secret $k_{ij}'$
and proof $\pi(k_{ij}')$, and the smart contract would
determine its validity and burn stake as appropriate.

\input{algs/zk_dleq.tex}

\subsubsection{\KeyShare{}}

At this point, we know that every individual correctly shared his secret.
Thus, we can now use this to submit the information required
to build the master public key.

Participant $P_{i}$'s secret $s_{i}$ is concealed behind
their commitment $C_{i0} = g_{1}^{s_{i}}$.
As discussed in~\cite{gennaro3revisiting,gennaro1999secure,ethdkg},
in order to ensure that no bad actors gain any information
about the master public key and are not be able to change
its underlying probability distribution, we require
$h_{1}\in\G_{1}$ such that $\dlog_{g_{1}}h_{1}$ is unknown.
We also let $h_{2}\in\G_{2}$ be a generator.

Let

\begin{equation}
    \pi(h_{1}^{s_{i}}) = \textsc{DLEQ}(
        g_{1},g_{1}^{s_{i}},h_{1},h_{1}^{s_{i}},s_{i})
\end{equation}

\noindent
be the zk-proof that $h_{1}^{s_{i}}$ is $P_{i}$'s portion
of the master public key (technically part of $\text{mpk}^{*}$
as defined below).
Because $C_{i0} = g_{1}^{s_{i}}$ is public knowledge
(stored in the smart contract)
and $P_{i}$ correctly shared his secret $s_{i}$,
the zk-proof will ensure the submitted value is valid.
Additionally, $P_{i}$ will publish $h_{2}^{s_{i}}$ so that
we can ensure

\begin{equation}
    \textsc{PairingCheck}(h_{1}^{s_{i}},\bar{h}_{2},h_{1},h_{2}^{s_{i}})
        = \texttt{true}.
\end{equation}

\noindent
This \textsc{PairingCheck} will be called by a smart contract.
Thus, failure of $P_{i}$ to publish $h_{1}^{s_{i}}$,
a valid proof $\pi(h_{1}^{s_{i}})$, and the corresponding
$h_{2}^{s_{i}}$ amounts to misbehavior which will
lead to a fine.
In particular, $P_{i}$ will submit
$\angles{h_{1}^{s_{i}}, \pi(h_{1}^{s_{i}}), h_{2}^{s_{i}}}$
to the smart contract.
The Ethereum smart contract will store $h_{1}^{s_{i}}$ from
all participants and broadcast
$h_{1}^{s_{i}}$, $\pi(h_{1}^{s_{i}})$, and $h_{2}^{s_{i}}$.

If any participant does not correctly submit these value,
then this entire process is required.

\subsubsection{\MasterPublicKey{}}

In this phase, a participant must submit the master public key.

At this phase, all participants have correctly shared
the secret share $s_{i}$ as well as $h_{1}^{s_{i}}$ and $h_{2}^{s_{i}}$.
The individual shared secrets $s_{i}$ allow us to define the
\emph{master secret key} $\text{msk}$:

\begin{equation}
    \text{msk} = \sum_{P_{i}\in\mathcal{P}} s_{i}.
\end{equation}

\noindent
This gives us the \emph{master public key} $\text{mpk}$:

\begin{align}
    \text{mpk} &= h_{2}^{\text{msk}} \nonumber\\
        &= \prod_{P_{i}\in\mathcal{P}} h_{2}^{s_{i}}.
\end{align}

\noindent
A Byzantine-fault tolerant subgroup $\mathcal{R}\subseteq\mathcal{P}$ can
correctly obtain the secret $s_{i}$ via Lagrange interpolation:

\begin{align}
    s_{i} &= \sum_{P_{j}\in\mathcal{R}} s_{i\to j} R_{j} \nonumber\\
    R_{j} &= \prod_{\substack{P_{k}\in\mathcal{R} \\ k\ne j}} \frac{k}{k-j}.
    \label{eq:Rj_coefs}
\end{align}

\noindent
This would allow us to recover the secret $s_{i}$ should $P_{i}$
fail to share $h_{1}^{s_{i}}$ below; however,
we take a stricter response and would view failure to share
as malicious activity leading to stake slashing.
Furthermore, the DKG process must restart.
We note that the Lagrange interpolation just described
occurs in a finite field;
this means that $R_{j}$ is constructed using finite field divisions.

Because $h_{2}^{s_{i}}$ has been broadcast to all participants,
anyone will be able to submit

\begin{equation}
    \text{mpk} = \prod_{P_{i}\in\mathcal{P}} h_{2}^{s_{i}}
\end{equation}

\noindent
to the smart contract.
Because $\braces{h_{1}^{s_{i}}}_{i\in\mathcal{P}}$ are stored
and valid, the contract can construct

\begin{equation}
    \text{mpk}^{*} = \prod_{P_{i}\in\mathcal{P}} h_{1}^{s_{i}}
    \label{eq:mpk_dual}
\end{equation}

\noindent
and confirm its validity with a \textsc{PairingCheck}
with the follow operation:

\begin{equation}
    \textsc{PairingCheck}(\text{mpk}^{*},\bar{h}_{2},h_{1},\text{mpk})
        = \texttt{true}.
\end{equation}

\noindent
The master public key can then be stored publicly and used
for group signature verification.

\subsubsection{\GPKSubmission{}}

At this point, we have successfully constructed the master public
key $\text{mpk}$ and distributed
the master secret key $\text{msk}$ among the members of $\mathcal{P}$.
We now turn our attention to constructing group
signatures from partial signatures.

Each participant $P_{j}\in\mathcal{P}$ has a portion of the
master secret key; this portion is called the \emph{group secret key}
$\gsk_{j}$:

\begin{equation}
    \gsk_{j} = \sum_{P_{i}\in\mathcal{P}} s_{i\to j}.
\end{equation}

\noindent
This is possible because we proved that every participant
in $\mathcal{P}$ correctly shared his secret share.
We note that that $s_{j\to j}$ is included in the sum for
$\gsk_{j}$ even though the encrypted form was not publicly shared.
Naturally, there is the corresponding \emph{group public key}
$\gpk_{j}$:

\begin{equation}
    \gpk_{j} = h_{2}^{\gsk_{j}}.
\end{equation}

\noindent
Here, $\gpk_{j}$ is $P_{j}$'s portion of the master public key
and will be broadcast to all users.
Cryptographic proof that $\gpk_{j}$ is valid will be discussed
in Sec.~\ref{app:gpkj_dispute}.

Each participant must submit group public key $\gpk_{j}$
and signature $\sigma_{j}$ for message $M$.
This signature is computed by

\begin{equation}
    \sigma_{j} = \brackets{H_{2C}(M)}^{\gsk_{j}}
\end{equation}

\noindent
with $\sigma_{j}\in\G_{1}$ and $M$ is a predetermined message to be signed.
Here, $H_{2C}:\braces{0,1}^{*}\to\G_{1}$ is a hash-to-curve function.
Hash-to-curve functions will be discussed in greater detail in
Sec.~\ref{ssec:hash-to-curve}.

During submission of $\angles{\gpk_{j},\sigma_{j}}$,
we confirm that

\begin{equation}
    \textsc{PairingCheck}(\sigma_{j},\bar{h}_{2},H_{2C}(M),\gpk_{j})
        = \texttt{true}.
\end{equation}

\noindent
This is performed to ensure that the signature is valid.
While this by itself does not ensure $\gpk_{j}$ is valid,
it helps enable some $\gpk_{j}$ validation logic.

\subsubsection{\GPKDispute{}}
\label{app:gpkj_dispute}

We now look at how to ensure the broadcast value of
$\gpk_{j}$ is valid.

Along with the $P_{j}$'s group public key $\gpk_{j}\in\G_{2}$,
there is the corresponding dual version in $\G_{1}$:

\begin{align}
    \gpk_{j}^{*} &= g_{1}^{\gsk_{j}}
            \nonumber\\
        &= \prod_{P_{i}\in\mathcal{P}}F_{i}(j).
    \label{eq:gpkj_star_def}
\end{align}

\noindent
Note the base is $g_{1}$ and not $h_{1}$ as in the case of $\text{mpk}^{*}$
in Eq.~\eqref{eq:mpk_dual}.
Here, we remember that

\begin{equation}
    F_{i}(j) = C_{i0}C_{i1}^{j}C_{i2}^{j^{2}}\cdots C_{it}^{j^{t}}.
    \label{eq:Fij_def}
\end{equation}

\noindent
This shows that $\gpk_{j}^{*}$ is public knowledge
and can be used to determine validity;
that is, we form $\gpk_{j}^{*}$ locally and the check that

\begin{equation}
    \textsc{PairingCheck}(\gpk_{j}^{*}, \bar{h}_{2}, g_{1}, \gpk_{j})
        = \texttt{true}.
\end{equation}

\noindent
If all $\gpk_{j}$ submissions are valid,
then there is nothing to dispute and we can proceed to the next phase.
Otherwise, some accusations must be made to prove malicious behavior.

\paragraph{Gas Cost Discussion}
The major costs will be calling the precompiled contracts
\textsc{ECAdd}, \textsc{ECMul}, \textsc{PairingCheck},
and \textsc{ModExp} (modular exponentiation);
see Table~\ref{tab:evm_gas_cost} for the specific gas costs.
Note that the cost for \textsc{PairingCheck} comes
from our assumption that we are testing 2 pairings,
while the cost for \textsc{ModExp} comes from the fact
that all of our arguments are 256-bit (32-byte) unsigned integers.
These costs come from EIP-198\footnote{
    \url{https://github.com/ethereum/EIPs/blob/master/EIPS/eip-198.md}}
and EIP-1108\footnote{
    \url{https://github.com/ethereum/EIPs/blob/master/EIPS/eip-1108.md}}.

\input{tables/evm_cost.tex}

\paragraph{GPK Standard Accusation}
The standard accusation is when we submit the necessary information
to compute $\gpk_{j}^{*}$ to a smart contract and then show
that the submission fails the pairing check.

Using Eqs.~\eqref{eq:gpkj_star_def} and \eqref{eq:Fij_def},
we see

\begin{align}
    \gpk_{j}^{*} &= \prod_{P_{i}\in\mathcal{P}}F_{i}(j)
            \nonumber\\
        &= \prod_{P_{i}\in\mathcal{P}} \brackets{\prod_{k=0}^{t} C_{ik}^{j^{k}}}
            \nonumber\\
        &= \prod_{k=0}^{t}
            \brackets{\prod_{P_{i}\in\mathcal{P}} C_{ik}}^{j^{k}}
    \label{eq:gpkj_rearrange}
\end{align}

\noindent
With this rearrangement, we see that inside the brackets we must perform
$t$ additions; this is followed by one multiplication.
This set of operations is performed $t+1$ times.
To combine these results also requires $t$ more additions.
In all, we have $t^{2} + 2t$ \textsc{ECAdd} operations,
$t+1$ \textsc{ECMul} operations,
and 1 \textsc{PairingCheck} operation.
Given that $t \sim \frac{2}{3}n$, we have

\begin{equation}
    \text{Cost of Standard Proof} \sim 113000 + 4200n + 67n^{2}.
\end{equation}

\noindent
For $n=20$, this corresponds to $224$K gas;
the gas limit is approximately 10M.

\paragraph{GPK Group Accusation}
The group accusation is when we form a group signature and
show that using $P_{j}$'s submitted information results
in an invalid signature.
If we have a Byzantine fault-tolerant majority,
this shows that $\gpk_{j}$ is invalid.

To form a group signature, we must compute

\begin{equation}
    \sigma = \prod_{P_{j}\in\mathcal{R}} \sigma_{j}^{R_{j}},
\end{equation}

\noindent
where $\mathcal{R}\subseteq\mathcal{P}$ is the set of participants
who form a group signature.
We must have $\abs{\mathcal{R}} = t+1$.
From there, we verify the signature with the following operation:

\begin{equation}
    \textsc{PairingCheck}(\sigma, \bar{h}_{2}, H_{2C}(M), \text{mpk})
        = \texttt{true}.
\end{equation}

\noindent
Here, $M$ is publicly known and $\text{mpk}$ has already
been verified.

Each group signature $\sigma$ will require forming $R_{j}$
and computing $\sigma_{j}^{R_{j}}$.
After computing $R_{j}$, we require one \textsc{ECMul} call
to compute $\sigma_{j}^{R_{j}}$.
The expensive part turns out to be forming $R_{j}$,
and we focus on its straightforward computation.
We recall from Eq.~\eqref{eq:Rj_coefs} that

\begin{equation}
    R_{j} = \prod_{\substack{P_{k}\in\mathcal{R} \\ k\ne j}} \frac{k}{k-j}.
\end{equation}

\noindent
Naively, we would need to compute $t$ finite field inversions,
which corresponds to $t$ \textsc{ModExp} calls, to compute $R_{j}$;
this must be performed $t+1$ times to form $\sigma$.
This results in an expensive operation.

To reduce the required gas cost, we precompute these
multiplicative inverses and include them in the function call.
At the beginning of the call, we check to make sure that the submitted
inverses are valid; if they are valid, we proceed with the
accusation, and if they are invalid, we stop.
Everything else is the same as before;
see Alg.~\ref{alg:grpsig_malicious} for the complete description.
For each accusation, the main cost is $t+1$ \textsc{ECMul} calls,
$t$ \textsc{ECAdd} calls,
and one pairing check.
Therefore, we see

\begin{equation}
    \text{Cost to Form and Verify Group Signature} \sim 113000 + 4100n.
\end{equation}

\noindent
For $n=20$, this corresponds to $195$K gas.

\paragraph{Accusation Discussion}
In order to allow for a valid comparison between the two methods,
we must realize that any proof of malicious behavior involving
group signatures must require an \emph{additional} group signature
construction to form a valid group signature.
As we can see from Table~\ref{tab:grpsig_accusation_cost},
the more efficient accusation method depends upon
the number of malicious actors as well as the total validator set.

It is important that the total number of validators be limited
so that the accusation logic does not become too large.
It is \emph{critical} that the accusation transaction
be easily formed and executed in Ethereum in order to ensure
a quick response to malicious behavior.

If a malicious actor submits an invalid $\gpk_{j}$,
this does \emph{not} affect the ability of the rest of the validators
to form a valid group signature.
It would, though, require the byzantine fault-tolerant majority
to move proceed.

\input{tables/accusation_comparison.tex}

\input{algs/gpkj_algs.tex}

\subsubsection{\Completion{}}

At this point, the master public key is stored
and the group public keys are correct.
The DKG protocol is complete.

In our case, we confirm that DKG has been completed in order
for MadNet to proceed.


\section{Cross-Entropy Method (CEM)}
\begin{figure}[H]
	\centering

	\begin{tabular}{lccc}
		\toprule
		\textbf{experiment} & \textbf{population} & \textbf{elite} &
		\textbf{generations} \\
		\midrule
		\texttt{baseline 						}	 & 100 	& 0.20 	& 100\\
		\texttt{pop\_size-1000 					}	 & 1000 	& 0.20 	& 100\\
		\texttt{pop\_size-3000 					}	 & 3000 	& 0.20 	& 100\\
		\texttt{elite-40 						}	 & 100 	& 0.40 	& 100\\
		\texttt{elite-30 						}	 & 100 	& 0.30 	& 100\\
		\texttt{elite-10 						}	 & 100 	& 0.10 	& 100\\
		\texttt{pop\_size-1000+elite-40 		}	 & 1000 	& 0.40 	& 100\\
		\texttt{pop\_size-1000+elite-30 		}	 & 1000 	& 0.30 	& 100\\
		\texttt{pop\_size-1000+elite-10 		}	 & 1000 	& 0.10 	& 100\\
		\texttt{pop\_size-3000+elite-40 		}	 & 3000 	& 0.40 	& 100\\
		\texttt{pop\_size-3000+elite-30 		}	 & 3000 	& 0.30 	& 100\\
		\texttt{pop\_size-3000+elite-10 		}	 & 3000 	& 0.10 	& 100\\
		\texttt{iter-200 						}	 & 100 	& 0.20 	& 200\\
		\texttt{iter-50 						}	 & 100 	& 0.20 	& 50\\
		\texttt{iter-30 						}	 & 100 	& 0.20 	& 30\\
		\texttt{iter-200+elite-30 				}	 & 100 	& 0.30 	& 200\\
		\texttt{iter-200+pop\_size-3000+elite-30} 	 & 3000 	& 0.30 	& 200\\
		\bottomrule
	\end{tabular}
	\captionof{table}{CEM parameters}
	\label{tab:cem-param}
\end{figure}

The first algorithm implemented is the \textbf{Cross-Entropy Method (CEM)}.

Different execution of the algorithm has been performed. The first experiment is called baseline, and it uses the same parameters as for the following algorithms. After that, were made some attempts of improving the performances trying different population size and elite set ratio, and also with different number of generations. In all the experiments the domain size is fixed to 100 dimensions.

For all the experiments, the initial population parameters are initialised reasonably far from the global optimum, in particular, the mean is uniformly sampled in the range [-5, 5] and the variance is uniformly sampled in the range [4, 5].

In Table \ref{tab:cem-param} are shown the different combinations of parameters used.
\bigskip

The algorithm has been run 3 times for both test functions.
In order to evaluate the performance, for each pair of experiment and test function, the best and the worse fitness for each generation (averaged over 3 runs) has been plotted.

In Tables \ref{tab:cem-performance-s} and \ref{tab:cem-performance-r} are summarised the results.
\bigskip

\begin{figure}[htb]
	\centering

	\begin{tabular}{lccc}
		\toprule
		\textbf{experiment} & \textbf{best fitness} & \textbf{worse fitness} & \textbf{avg run time} \\
		\midrule
		\texttt{baseline 						}		 &	  7.17 &	   7.19 &	  0.43 sec \\
		\texttt{pop\_size-1000 					}		&	   0.0 &	    0.0 &	  0.94 sec \\
		\texttt{pop\_size-3000 					}		&	   0.0 &	    0.0 &	  2.24 sec \\
		\texttt{elite-40 						}		 &	  2.65 &	   2.71 &	  0.54 sec \\
		\texttt{elite-30 						}		 &	  1.54 &	   1.56 &	  0.42 sec \\
		\texttt{elite-10 						}		 &	 93.74 &	  93.74 &	  0.42 sec \\
		\texttt{pop\_size-1000+elite-40 		}	 &	   0.0 &	    0.0 &	  0.95 sec \\
		\texttt{pop\_size-1000+elite-30 		}	 &	   0.0 &	    0.0 &	  0.98 sec \\
		\texttt{pop\_size-1000+elite-10 		}	 &	   0.0 &	    0.0 &	  0.95 sec \\
		\texttt{pop\_size-3000+elite-40 		}	 &	   0.0 &	    0.0 &	  2.17 sec \\
		\texttt{pop\_size-3000+elite-30 		}	 &	   0.0 &	    0.0 &	  2.27 sec \\
		\texttt{pop\_size-3000+elite-10 		}	 &	   0.0 &	    0.0 &	  2.24 sec \\
		\texttt{iter-200 						}		&	  8.57 &	   8.57 &	  0.62 sec \\
		\texttt{iter-50 						}	&	 12.09 &	   12.9 &	  0.43 sec \\
		\texttt{iter-30 						}	&	 27.18 &	  35.71 &	  0.36 sec \\
		\texttt{iter-200+elite-30 				}	&	  0.18 &	   0.18 &	   0.5 sec \\
		\texttt{iter-200+pop\_size-3000+elite-30} 	 &	   0.0 &	    0.0 &	  3.63 sec \\
		\bottomrule
	\end{tabular}
	\captionof{table}{Sphere CEM performance}
	\label{tab:cem-performance-s}
\end{figure}

In Figure \ref{fig:cem-s-fitness/baseline} is plotted the best and the worse fitness for each generation (averaged over 3 runs) for the baseline model. Below, in Figures \ref{fig:cem-s-fitness/1000} and \ref{fig:cem-s-fitness/200}, are plotted the fitness of the two models that perform better with the sphere function.

For the sphere function, it is possible to see that simply using a large enough population size the algorithm converges.
Moreover, increasing the elite set ratio the algorithm converges quickly.

 \begin{figure}[H]
 	\centering
 	\begin{minipage}[b]{.6\textwidth}
 		\includegraphics[width=\linewidth]{../src/out/cem/baseline/sphere/fitness.pdf}
 	\end{minipage}
	 \caption{Sphere fitness \texttt{baseline}}
	 \label{fig:cem-s-fitness/baseline}

	 \begin{minipage}[b]{.6\textwidth}
	 	\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/fitness.pdf}
	 \end{minipage}
	 \caption{Sphere fitness \texttt{pop\_size-1000}}
	 \label{fig:cem-s-fitness/1000}

	 \begin{minipage}[b]{.6\textwidth}
	 	\includegraphics[width=\linewidth]{../src/out/cem/iter-200+elite-30/sphere/fitness.pdf}
	 \end{minipage}
	 \caption{Sphere fitness \texttt{iter-200+elite-30}}
	 \label{fig:cem-s-fitness/200}
\end{figure}

In the following Figures is shown the effect of executing the algorithm on the experiment \texttt{pop\_size-1000}.
 \begin{figure}[H]
	\begin{minipage}[b]{.3\textwidth}
		\centering
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/cem-generation-contour-0.pdf}
	\end{minipage}
	~
	\begin{minipage}[b]{.3\textwidth}
		\centering
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/cem-generation-contour-10.pdf}
	\end{minipage}
	~
	\begin{minipage}[b]{.3\textwidth}
		\centering
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/cem-generation-contour-20.pdf}
	\end{minipage}

	\begin{minipage}[b]{.3\textwidth}
		\centering
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/cem-generation-contour-30.pdf}
	\end{minipage}
	~
	\begin{minipage}[b]{.3\textwidth}
		\centering
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/cem-generation-contour-40.pdf}
	\end{minipage}
	~
	\begin{minipage}[b]{.3\textwidth}
		\centering
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/cem-generation-contour-50.pdf}
	\end{minipage}

		\begin{minipage}[b]{.3\textwidth}
		\centering
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/cem-generation-contour-60.pdf}
	\end{minipage}
	~
	\begin{minipage}[b]{.3\textwidth}
		\centering
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/cem-generation-contour-70.pdf}
	\end{minipage}
	~
	\begin{minipage}[b]{.3\textwidth}
		\centering
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000/sphere/cem-generation-contour-80.pdf}
	\end{minipage}

\end{figure}

For the rastrigin function, it is necessary not only to increase the size of the population but also the number of generations to allow the algorithm to converge. Moreover, in this case, by decreasing the elite set ratio the algorithm performs better.

\begin{figure}[htb]
	\centering

	\begin{tabular}{lccc}
		\toprule
		\textbf{experiment} & \textbf{best fitness} & \textbf{worse fitness} & \textbf{avg run time} \\
		\midrule
		\texttt{baseline 						}		 &	 146.9 &	 147.84 &	  0.74 sec \\
		\texttt{pop\_size-1000 					}			   &	408.33 &	  726.5 &	  1.39 sec \\
		\texttt{pop\_size-3000 					}			   &	561.48 &	  998.0 &	   3.0 sec \\
		\texttt{elite-40 						}		 &	183.21 &	 308.04 &	  0.64 sec \\
		\texttt{elite-30 						}		 &	143.56 &	 173.52 &	  0.68 sec \\
		\texttt{elite-10 						}		 &	342.08 &	 342.11 &	  0.66 sec \\
		\texttt{pop\_size-1000+elite-40 		}	  &	 754.4 &	1225.99 &	  1.37 sec \\
		\texttt{pop\_size-1000+elite-30 		}	  &	647.67 &	1084.44 &	  1.37 sec \\
		\texttt{pop\_size-1000+elite-10 		}	  &	 70.65 &	 194.74 &	   1.4 sec \\
		\texttt{pop\_size-3000+elite-40 		}	  &	774.94 &	1290.65 &	  3.08 sec \\
		\texttt{pop\_size-3000+elite-30 		}	  &	740.86 &	1245.91 &	  3.37 sec \\
		\texttt{pop\_size-3000+elite-10 		}	  &	117.32 &	 317.21 &	   2.9 sec \\
		\texttt{iter-200 						}	 &	134.35 &	 134.36 &	  0.88 sec \\
		\texttt{iter-50 						}	  &	449.25 &	 641.98 &	   0.8 sec \\
		\texttt{iter-30 						}	  &	831.28 &	1178.28 &	  0.64 sec \\
		\texttt{iter-200+elite-30 				}	 &	 83.65 &	  83.76 &	  0.74 sec \\
		\texttt{iter-200+pop\_size-3000+elite-30} 	&	 15.85 &	   45.2 &	  4.96 sec \\
		\bottomrule
	\end{tabular}
	\captionof{table}{Rastrigin CEM performance}
	\label{tab:cem-performance-r}
\end{figure}
\bigskip

In Figure \ref{fig:cem-r-fitness/baseline} is plotted the best and the worse fitness for each generation (averaged over 3 runs) for the baseline model. Below, in Figures \ref{fig:cem-r-fitness/1000} and \ref{fig:cem-r-fitness/200}, are plotted the fitness of the two models that perform better with the rastrigin function.

\begin{figure}[H]
	\centering
	\begin{minipage}[b]{.6\textwidth}
		\includegraphics[width=\linewidth]{../src/out/cem/baseline/rastrigin/fitness.pdf}
	\end{minipage}
	\caption{Sphere fitness \texttt{baseline}}
	\label{fig:cem-r-fitness/baseline}
\end{figure}
\begin{figure}[htb]
	\centering
	\begin{minipage}[b]{.6\textwidth}
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-1000+elite-10/rastrigin/fitness.pdf}
	\end{minipage}
	\caption{Sphere fitness \texttt{pop\_size-1000}}
	\label{fig:cem-r-fitness/1000}
\end{figure}
\begin{figure}[htb]
	\centering
	\begin{minipage}[b]{.6\textwidth}
		\includegraphics[width=\linewidth]{../src/out/cem/pop_size-3000+iter-200+elite-30/rastrigin/fitness.pdf}
	\end{minipage}
	\caption{Sphere fitness \texttt{iter-200+elite-30}}
	\label{fig:cem-r-fitness/200}
\end{figure}

\bigskip
For the sphere function, 40 generations are enough to obtain a solution close enough to the global optimum, as shown for the experiment \texttt{pop\_size-1000}.

For the rastrigin function and the parameter tested, at least 200 generations are necessary to obtain a solution close enough to the global optimum, as shown for the experiment \texttt{iter-200+elite-30}.


\documentclass[a4paper]{article}
\usepackage[utf8]{inputenc}
\usepackage[margin=1in]{geometry}
\usepackage{amsmath}
\usepackage{amssymb}
\usepackage{setspace}

\title{Chapter 1\\ The Real and Complex Number Systems}
\author{solutions by Hikari}
\date{June 2021}

\begin{document}

\maketitle

\newcommand{\V}{\mathbf}

\paragraph{1.}
If $r+x$ is rational, than $x=(r+x)-r$ is rational, a contradiction, so $r+x$ is irrational.

If $rx$ is rational, than $x=(rx)\frac{1}{r}$ is rational, a contradiction, so $rx$ is irrational.

\paragraph{2.}
If there is a rational number $\frac{p}{q}$ (p,q are intergers and $gcd(p,q)=1$), whose square is 12. Then $p^2=12q^2$. $3|12$, so $3|p^2$, $3|p$. So $9|p^2$, $9|12q^2$, $3|4q^2$, $3|q$. So $3|p$ and $3|q$, contrary to $gcd(p,q)=1$.

\paragraph{3.}
(a) $x\neq0$, so $\frac{1}{x}$ exists. $y=y\cdot x\cdot \frac{1}{x}=z\cdot x\cdot \frac{1}{x}=z$

(b) Take $z=1$ in (a).

(c) Take $z=\frac{1}{x}$ in (a).

(d) $\frac{1}{x}\cdot x=1$, so $x=\frac{1}{\frac{1}{x}}$ from (c).

\paragraph{4.}
For an element x of E, $\alpha\leq x $ and $x\leq \beta$, so $\alpha \leq\beta$.

\paragraph{5.}
For every $x\in A$, $x\geq \inf A$, so $-x\leq -\inf A$, so $-\inf A$ is an upper bound of -A. If $\gamma<-\inf A$, $-\gamma >\inf A$, so $-\gamma$ is not a lower bound of A, then there is a element $x<-\gamma$ in A. Then there is an element $-x>\gamma$ in -A, which means $\gamma$ is not an upper bound of -A. So $-\inf A=\sup (-A)$, and $\inf A=-\sup (-A)$.

\paragraph{6.*}
(a) $((b^m)^{\frac{1}{n}})^{nq}=b^{mq}=b^{np}=((b^p)^{\frac{1}{q}})^{nq}=k$. By Theorem 1.21, $k^{\frac{1}{nq}}$ is unique, so $(b^m)^{\frac{1}{n}}=(b^p)^{\frac{1}{q}}$.
\medskip

(b) Let $r=\frac{m}{n}$, $s=\frac{p}{q}$. $(b^{r+s})^{nq}=(b^{\frac{mq+np}{nq}})^{nq}=b^{mq+np}=((b^m)^{\frac{1}{n}}(b^p)^{\frac{1}{q}})^{nq}=(b^rb^s)^{nq}$. By \\Theorem 1.21, $b^{r+s}=b^rb^s$.
\medskip

(c) If $t<r$, then $r-t>0$, so $b^{r-t}>1$, $b^r>b^t$. So $b^r\geq b^t$ for all $b^t\in B(r)$, so $b^r$ is an upper bound of $B(r)$. But $b^r\in B(r)$, so every $\gamma<b^r$ is not an upper bound of $B(r)$, so $b^r=\sup B(r)$.
\medskip

(d) If $b^{x+y}<b^xb^y$, then $\frac{b^{x+y}}{b^y}<b^x$, and there is an rational $t\leq x$ that $\frac{b^{x+y}}{b^y}<b^t$. Then $\frac{b^{x+y}}{b^t}<b^y$, and there is an rational $s\leq y$ that $\frac{b^{x+y}}{b^t}<b^s$. So $b^{s+t}>b^{x+y}$, but $s+t\leq x+y$, contradicting to the definition of $b^{x+y}$.

If $b^{x+y}>b^xb^y$, then there is a rational $r<x+y$ that $b^r>b^xb^y$ $\,^*$, which means $b^r>b^pb^q$ for all rational $p\leq x$ and $q\leq y$. Let $\varepsilon$ be an positive real number such that $r<x+y-\varepsilon$. By Theorem 1.20(b), there are rational $p$ and $q$ such that $x-\frac{\varepsilon}{2}<p<x$ and $y-\frac{\varepsilon}{2}<q<y$. So $r<x+y-\varepsilon<p+q$, and $b^r<b^{p+q}=b^pb^q$, contradicting with $b^r>b^pb^q$.

Therefore, only $b^{x+y}=b^xb^y$ can be the case.

\paragraph{7.}
(a)
$b^n-1=(b-1)(b^{n-1}+b^{n-2}+\cdots +1)\geq (b-1)(1+1+\cdots +1)=(b-1)n$
\medskip

(b)
$b^{\frac{1}{n}}>1$, so substitute $b$ with $b^{\frac{1}{n}}$ in (a) we obtain (b).
\medskip

(c)
$b-1\geq n(b^{\frac{1}{n}}-1)>\frac{b-1}{t-1}(b^{\frac{1}{n}}-1)$, so $(b^{\frac{1}{n}}-1)<(t-1)$ since $b-1>0$ and $t-1>0$. So $b^{\frac{1}{n}}<t$.
\medskip

(d)
$b^w<y$, so $y\cdot b^{-w}>1$. So from (c), $b^{\frac{1}{n}}<y\cdot b^{-w}$ when $n>\frac{b-1}{y\cdot b^{-w}-1}$. So $b^{w+\frac{1}{n}}<y$ for sufficiently large n.
\medskip

(e)
$b^w>y$, so $\frac{b^w}{y}>1$. So from (c), $b^{\frac{1}{n}}<\frac{b^w}{y}$ when $n>\frac{b-1}{\frac{b^w}{y}-1}$. Since $b^{\frac{1}{n}},y>0$, $b^{w-\frac{1}{n}}>y$ for sufficiently large n.
\medskip

(f)
If $b^x<y$, from (d) $b^{x+\frac{1}{n}}<y$ for some n. Then $x+\frac{1}{n}\in A$, but $x+\frac{1}{n}>x$, contrary to the fact that x in an upper bound of A.

If $b^x>y$, form (e) $b^{x-\frac{1}{n}}>y$ for some n. So $b^{x-\frac{1}{n}}>b^w$, and $x-\frac{1}{n}>w$ for all w in A since $b>1$. So $x-\frac{1}{n}$ is an upper bound of A, but $x-\frac{1}{n}<x$, contrary to $x=\sup A$.

Therefore, only $b^x=y$ can be the case.
\medskip

(g)
If $x<x'$, let $q$ be a rational that $x<q<x'$(Theorem 1.20(b)). By definition of real power in Exercise 6, $b^x<b^q\leq b^{x'}$, so $b^x<b^{x'}$. Similarly, $x>x'$ implies $b^x>b^{x'}$. Therefore, if $b^x=b^{x'}$, then $x=x'$ and $x$ is unique

\paragraph{8.}
If complex field is an ordered field, then $1>0$ from proposition 1.18(d), $-1<0$ from proposition 1.18(a). But $-1=i^2>0$ from proposition 1.18(d), a contradiction, so complex field cannot be an ordered field.

\paragraph{9.}
When $a<c$, $z<w$. When $a>c$, $z>w$. When $a=c$ and $b<d$, $z<w$. When $a=c$ and $b>d$, $z>w$. When $a=c$ and $b=d$, $z=w$. So definition 1.5(i) is satisfied.

If $z<w$ and $w<r$ ($r=e+fi$), then $a<c$ or $a=c$, $c<e$ or $c=e$. If $a<c$, then $a<e$, so $z<r$. If $a=c$ and $c<e$, then $a<e$, so $z<r$. If $a=c$ and $c=e$, then $b<d$ and $d<f$, so $b<f$, so $z<r$. Therefore, for all cases $z<r$ when $z<w$ and $w<r$, satisfying definition 1.5(ii).
\medskip

Assume that complex number under this definition has least-upper-bound property. Consider the set $S=\{xi|x\in\mathbb{R}\}$. $1$ is greater than all the $0+xi$, so $S$ is bound above. Let $a+bi=\sup S$, $a\geq0$. If $a>0$, then $\frac{a}{2}>0$ is also an upper bound, a contradiction. So $a=0$, but then $(b+1)i>a+bi$ and $(b+1)i\in S$, a contradiction. Therefore, complex number under this definition cannot have least-upper-bound property.

\paragraph{10.}
$z^2=(a^2-b^2)+2abi$, $a^2-b^2=u$, $2ab=(|w|^2-u^2)^{\frac{1}{2}}=|v|$, so when $v\geq 0$, $z^2=w$, when $v\leq 0$, $\overline{z}^2=u-2abi=u+vi=w$. When $w\neq 0$, either $a$ or $b\neq 0$, and $z\neq -z$, so $\pm z^2=w$ when $v\geq 0$ and $\pm \overline{z}^2=w$ when $v\leq 0$.

\paragraph{11.}
If $z=0$, then $r=0$ and $w$ can be any complex number that $|w|=1$. $w$ and $r$ are not uniquely determined by $z$.
\medskip

If $z\neq 0$, let $z=a+bi$. Let $r=\sqrt{a^2+b^2}$ and $w=\frac{a}{\sqrt{a^2+b^2}}+\frac{b}{\sqrt{a^2+b^2}}i$. Then $|w|=\frac{a^2+b^2}{a^2+b^2}=1$, and $z=rw$.
If $z=rw$, then $|z|=|r||w|=|r|=r$, and $w=\frac{z}{r}$, so $r$ and $w$ are uniquely determined by $z$.

\paragraph{12.}
If $|z_1+z_2+\cdots+z_{n-1}|\leq |z_1|+|z_2|+\cdots+|z_{n-1}|$, then by Theorem 1.33(e), $|z_1+z_2+\cdots+z_n|\leq |z_1+z_2+\cdots+z_{n-1}|+|z_n|\leq|z_1|+|z_2|+\cdots+|z_{n-1}|+|z_n|$. $|z_1|\leq|z_1|$, so the proof completes by induction.

\paragraph{13.}
$|x|=|x-y+y|\leq|x-y|+|y|$, so $|x|-|y|\leq|x-y|$; $|y|=|y-x+x|\leq|y-x|+|x|$, so $|y|-|x|\leq|y-x|=|x-y|$. So $\left||x|-|y| \right|\leq|x-y|$.

\paragraph{14.}
$|1+z|^2+|1-z|^2=(1+z)(1+\bar{z})+(1-z)(1-\bar{z})=1+z+\bar{z}+1+1-z-\bar{z}+1=4$.

\paragraph{15.}
According to the proof of Theorem 1.35, when the equality holds, $\sum|Ba_j-Cb_j|^2=0$, so $Ba_j-Cb_j=0$ for all $j$, and $a_j=\frac{C}{B}b_j=kb_j$ where $k$ is a constant independent of $j$. If $a_j=kb_j$ for all $j$, $C=\sum kb_j\bar{b_j}=kB$, and $Ba_j-Cb_j=Bkb_j-kBb_j=0$, the equality holds. So $a_j=kb_j$ with $k$ being a constant independent of $j$ is a sufficient and necessary condition for the equality to hold.

\paragraph{16.}
(a) If $\V{z}=\frac{\V{x}+\V{y}}{2}+\V{w}$, $\V{w}\cdot(\V{x}-\V{y})=0$, and $|\V{w}|=\sqrt{r^2-\frac{d^2}{4}}$, then $|\V{z}-\V{x}|=|-\frac{\V{x}-\V{y}}{2}+\V{w}|=\sqrt{|\V{w}|^2+|\frac{\V{x}-\V{y}}{2}|^2-2\V{w}\cdot\frac{\V{x}-\V{y}}{2}}=\sqrt{r^2-\frac{d^2}{4}+\frac{d^2}{4}}=r$, and similarly $|\V{z}-\V{y}|=r$. So we want to prove that there are infinitely many $\V{w}$ that satisfy $\V{w}\cdot(\V{x}-\V{y})=0$ and $|\V{w}|=\sqrt{r^2-\frac{d^2}{4}}$. Let $\V{x}-\V{y}=\V{u}\neq0$, $\sqrt{r^2-\frac{d^2}{4}}=s>0$. Let $u_i$ be the coordinate that $u_i\neq0$, and choose other two coordinates $u_j, u_k$(they exist because the dimension $k\geq3$). Let $w_i=au_j+bu_k$, $w_j=-au_i$, $w_k=-bu_i$, and all the other coordinates $=0$. Then $\V{w}\cdot\V{u}=0$, and we want to prove that there are infinitely many $a,b$ that satisfy $|\V{w}|=s$. Substituting, we get \[(au_j+bu_k)^2+(-au_i)^2+(-bu_i)^2=s^2\]
\[(u_i^2+u_k^2)b^2+2u_ju_ka\cdot b+a^2(u_i^2+u_j^2)-s^2=0\]
To solve the quadratic equation for $b$, the discriminant  $\Delta=4u_j^2u_k^2a^2-4(u_i^2+u_k^2)\left[a^2(u_i^2+u_j^2)-k^2 \right]$. When $a^2<\frac{k^2}{u_i^2+u_j^2}$, $\Delta>0$, the solution of $b$ exists, so there are infinitely many $a$ and $b$ satisfying $|\V{w}|=s$. So there are infinitely many $\V{w}$ satisfying $\V{w}\cdot(\V{x}-\V{y})=0$ and $|\V{w}|=\sqrt{r^2-\frac{d^2}{4}}$, so there are infinitely many $\V{z}$ satisfying $|\V{z}-\V{x}|=r$ and $|\V{z}-\V{y}|=r$.
\medskip

(b) Let $\V{z}=\frac{\V{x}+\V{y}}{2}$, then $|\V{z}-\V{x}|=|\V{z}-\V{y}|=|\frac{\V{x}-\V{y}}{2}|=\frac{d}{2}=r$. If $\V{z}'\neq \V{z}$, then $|\V{z}'-\V{z}|=\varepsilon>0$, and $|\V{z}'-\V{x}|\geq|\V{z}'-\V{z}|+|\V{z}-\V{x}|=\varepsilon+r>r$, so $\V{z}'$ cannot satisfy the condition, and $\V{z}$ is unique.
\medskip

(c) If such $\V{z}$ exists, then $2r=|\V{x}-\V{z}|+|\V{z}-\V{y}|\geq|\V{x}-\V{y}|=d$, contradicting with $2r<d$, so the $\V{z}$ cannot exist.

\paragraph{17.}
$|\V{x}+\V{y}|^2+|\V{x}-\V{y}|^2=\sum(x_i+y_i)^2+\sum(x_i-y_i)^2=2\sum x_i^2+2\sum y_i^2+\sum 2x_iy_i+\sum(-2)x_iy_i=2|\V{x}|^2+2|\V{y}|^2$. It can be geometrically interpreted as the sum of squares of two diagonals of parallelograms being equal to the sum of squares of four sides of parallelograms.

\paragraph{18.}
If $x_1=x_2=0$, let $y_1=y_2=1$, $y_k=0$ for $k>2$, then $\V{y}\neq0$ and $\V{x}\cdot\V{y}=0$. If one of $x_1,x_2\neq0$, let $y_1=x_2, y_2=-x_1$, $y_k=0$ for $k>2$, then $\V{y}\neq0$ and $\V{x}\cdot\V{y}=0$.

When $k=1$, if $\V{x}\neq0$ and $\V{y}\neq0$, then $\V{x}\cdot\V{y}=x_1y_1\neq0$, so the $\V{y}$ satisfying the condition does not necessary exist.

\paragraph{19.}
\[\sum(x_i-a_i)^2=4\sum(x_i-b_i)^2\]
\[\sum3x_i^2-(8b_i-2a_i)x_i+(4b_i^2-a_i^2) =0\]
\[\sum3(x_i-\frac{4b_i-a_i}{3})^2+(4b_i^2-a_i^2)-\frac{(4b_i-a_i)^2}{3}=0\]
\[\sum3(x_i-\frac{4b_i-a_i}{3})^2=\sum\frac{4a_i^2-8a_ib_i+4b_i}{3}\]
\[\sum(x_i-\frac{4b_i-a_i}{3})^2=\sum\frac{4}{9}(b_i-a_i)^2=\sum(\frac{2}{3}(b_i-a_i))^2\]
So if $\V{c}=\frac{4\V{b}-\V{a}}{3}$ and $r=\frac{2}{3}|\V{b}-\V{a}|$, then the two equations are sufficient and necessary conditions for each other.

\paragraph{20.}
The proof of least-upper-bound property and axioms (A1) to (A3) did not use property (III) and therefore still hold. Let $0^*$ be $\{x|x\in\mathbb{Q},x\leq0 \}$. For every $r\in\alpha$ and $s\in0^*$, $r+s\leq r$, hence $r+s\in\alpha$, so $\alpha+0^*\subset\alpha$. For every $r\in\alpha$, $r=r+0\in\alpha+0^*$, so $\alpha\subset\alpha+0^*$. So $\alpha+0^*=\alpha$, and (A4) holds. If (A5) holds, let $\alpha=\{x|x\in\mathbb{Q},x<1\}$, then there is an $\alpha'$ such that $\alpha+\alpha'=0^*$. So there are $r\in\alpha$ and $s\in\alpha'$ that $r+s=0$, and because $r<1$, $s>-1$. Let $s=-1+\varepsilon$, $\varepsilon>0$, and let $t=1-\frac{\varepsilon}{2}$, then $t\in\alpha$. $s+t\in\alpha'+\alpha=0^*$, so $s+t\leq0$, but $s+t=-1+\varepsilon+1-\frac{\varepsilon}{2}=\frac{\varepsilon}{2}>0$, a contradiction, so (A5) cannot hold.

\end{document}

Principles of Mathematical Analysis/Chapter 01/main.tex