\section{Feistel Networks with Affine Encodings}
\SecLabel{afa}

In this section, I describe decomposition attacks on Feistel Networks masked with affine layers, which I shall call affine encodings. The motivation for studying this structure comes from the fact that such encodings preserve most of the cryptographic properties (linearity, differential uniformity, algebraic degree) but make it harder to distinguish or decompose the structure. As an evidence, observe that attacks on the ASASA construction~\cite{ASASA1,ASASA2} are more involved than the attack on the SASAS construction~\cite{SASAS}.
Thew new attacks also expand the toolkit for the white-box cryptanalysis and S-Box reverse-engineering. I start with a formal definition of the analyzed structure.

\newcommand\FF{\mathcal{F}^r_d}
\begin{definition}[Feistel Network with Affine Encodings]
\Label{def:afa}
    $\afanbij{r}{d}$ denotes the set of all permutations that can be expressed as an $r$-round Feistel Network with Feistel functions $f_1,\ldots,f_r\colon \field{n} \to \field{n}$ of algebraic degree at most $d$, and composed with bijective affine mappings from both sides. Furthermore, let $\ainvfanbij{r}{d}$ denote the $\afanbij{r}{d}$ structure where the output affine encoding is the inverse of the input affine encoding; let $\afnbij{r}{d}$ denote the $\afanbij{r}{d}$ structure where the input affine encoding is the identity mapping:
    \begin{align*}
        \afanbij{r}{d} &\eqdef \pset{\eta \circ R_{f_n}\circ\ldots\circ R_{f_1} \circ \mu \mid f_i \in \FF,
        \mu,\eta \in \affbij{n}
        },\\
        \ainvfanbij{r}{d} &\eqdef \pset{\mu^{-1} \circ R_{f_n}\circ\ldots\circ R_{f_1} \circ \mu \mid f_i \in \FF,
        \mu \in \affbij{n}
        },\\
        \afnbij{r}{d} &\eqdef \pset{\mu \circ R_{f_n}\circ\ldots\circ R_{f_1} \mid f_i \in \FF,
        \mu \in \affbij{n}
        },
    \end{align*}
    where $R_{f_i}$ is a Feistel round as defined in Definition~\Ref{def:feistel}, and $\FF$ denotes the set of all vectorial Boolean functions of degree at most $d$ mapping $\field{n}$ to itself.
\end{definition}

All the attacks in this section are based on the type-I and type-II integral distinguishers from \SecRef{hdim-feistel}. The constant additions on any of the sides do not change the integral property, in particular the HDIM. Therefore, it is sufficient to consider the case of linear encodings.

The cryptanalyst may compose a given structure $S \in \afanbij{r}{d}$ with additional random affine or linear encodings $\mu', \eta'$ and still obtain a structure $\eta' \circ S' \circ \mu' \in \afanbij{r}{d}$. In this way, it is possible to \emph{re-randomize} the initial encoding for any of the three structures. Our attack works for affine encodings satisfying a particular (rather dense) property. The attack therefore applies to arbitrary encodings via the re-randomization. The following definition captures the class of linear permutations that our attack will target.

\newcommand\idup[1]{
\matbtwo{\idmat{n}}{#1}{0}{\idmat{n}}
}
\newcommand\idlo[1]{
\matbtwo{\idmat{n}}{0}{#1}{\idmat{n}}
}
\newcommand\diag[2]{
\matbtwo{#1}{0}{0}{#2}
}
\newcommand\compos{\circ}

\begin{definition}
Let $\mu \in \linbij{2n}$.
$\mu$ is said to have a 2-UL decomposition, if there exist matrices $a,b,c,d \in \linmap{n}{n}$ such that
$$
\mu ~=~
\matb{
  \mu_{1, 1} & \mu_{1, 2} \\
  \mu_{2, 1} & \mu_{2, 2} \\
}
~=~
\idup{c} \compos \diag{b}{d} \compos \idlo{a}.
$$
\end{definition}

\begin{lemma}
It is sufficient that $\mu_{2,2}$ is invertible for $\mu$ to have a 2-UL decomposition.
\end{lemma}
\begin{proof}
Note that
$$
%2-UL
\idup{c} \compos \diag{b}{d} \compos \idlo{a} =
\matbtwo{c\times d\times a \oplus b}{c\times d}{d \times a}{d}.
$$
Set
\begin{align*}
&d = \mu_{2,2},\\
&a = d^{-1}\times \mu_{2,1},\\
&c = \mu_{1,2} \times d^{-1},\\
&b = \mu_{0,0} \oplus c\times d \times a.
\end{align*}
\end{proof}

The attacks presented in this section recover a partial information about the linear encodings. The underlying structure is not restricted to Feistel Network, it is only required that it has the type-I or type-II distinguisher. However, the partial information recovered is most useful in the Feistel Network case, as it allows to apply the decomposition attack on the unmasked Feistel Network.

% ===========================================================
% A'F4A
% ===========================================================

\subsection{Type-I Affine Encodings Recovery}

The following theorem describes an attack against a structure with the type-I distinguisher masked with affine encodings. Type-I distinguisher is strong and provides enough equations to recover the required partial information from both sides of the structure.

\begin{theorem}[Type-I Affine Encodings Recovery]
\Label{thm:af4a}
Let $S\colon \field{2n} \to \field{2n}$ be a permutation that has the type-I distinguisher and let $\HDIM{S} = \matbtwo{h_{1,1}}{0}{0}{0}$. Let $\mu,\eta \in \linbij{2n}$ such that $\mu$ and $\eta^{-1}$ both have a 2-UL decomposition. Let $T \eqdef \eta \circ S \circ \mu$.

Let $(a,b,c,d)$ and $(a',b',c',d')$ be the 2-UL decompositions of $\mu$ and $\eta^{-1}$ respectively.
Then, given $T$, $a$ and $a'$ can be recovered in time $\OO(n2^{2n})$ if $h_{1,1}$ is invertible.
\end{theorem}
\begin{proof}
Observe that $\eta$ can be expressed as
$$
\eta = \idlo{a'} \compos \diag{b'^{-1}}{d'^{-1}} \compos \idup{c'}.
$$
Let $S'\colon \field{2n}\to \field{2n}$ be given by:
$$
S' = \diag{b'^{-1}}{d'^{-1}} \compos \idup{c'} \compos S \compos \idup{c} \compos \diag{b}{d}.
$$
Then $T$ can be expressed as:
$$
T = \idlo{a'} \compos S' \compos \idlo{a}.
$$
The relation between $S, S'$ and $T$ is illustrated in \FigRef{afa-explanation} where $S$ assumed to be a Feistel Network).

\FigTex{afa-explanation.tex}

Consider the HDIM of $S'$ and $S$. They are related by Proposition~\Ref{prop:hdim-linear-effect}:
%Let $T=\eta \circ S \circ \mu$. Then
$$
\HDIM{S'} = \diag{b'^{-1}}{d'^{-1}} \compos \idup{c'} \compos \HDIM{S} \compos \idlo{c^\top} \compos \diag{\invtop{b}}{\invtop{d}}.
$$
It is easy to verify that
$$
\HDIM{S'} = \matbtwo{b'^{-1} \times h_{1,1} \times \invtop{b}}{0}{0}{0}.
$$
Let $h' = b'^{-1} \times h_{1,1} \times \invtop{b}$. By a similar argument,
$$
\HDIM{T} = \idlo{a'} \compos \HDIM{S'} \compos \idup{a^{\top}} = \matbtwo{h'}{h' \times a^{\top}}{a' \times h'}{a' \times h' \times a^{\top}}.
$$
Since $h_{1,1}$ is assumed to be invertible and $b,b'$ are invertible too, $h'$ is invertible. Therefore, $a$ and $a'$ can be easily recovered from $\HDIM{T}$ in time $\OO(n^3)$. The attack complexity is then dominated by the cost of computing $\HDIM{T}$, which can be done in $\OO(n2^n)$ operations.
\end{proof}
\begin{remark}
If the rank of $h_{1,1}$ is not full but is high enough, it may still be possible to recover $a$ and $a'$ completely by including the quadratic equations from $(\HDIM{T})_{2,2}$.
\end{remark}

The theorem shows that the type-I distinguisher provides $2n^2$ linear equations and $n^2$ quadratic equations. This is enough to recover $2n^2$ bits of information about the affine encodings. In the case of the type-II distinguisher, only $n^2$ quadratic equations are available for $2n^2$ unknowns. Still, the method can be applied to simplified structures. One possible scenario is the $\ainvfanbij{r}{d}$ structure where the output linear layer is the inverse of the input linear layer. In this case though, the cryptanalyst has to solve a system of quadratic equations. Another scenario is the one-sided affine masking, i.e. the $\afnbij{r}{d}$ structure. In this case linear equations are obtained and the required partial information is recovered.

% ===========================================================
% A-1F5A
% ===========================================================

\subsection{Type-II Affine Encodings Recovery}

\begin{theorem}[Type-II Affine Encodings Recovery, $\ainvfanbij{r}{d}$]
\Label{thm:af5a}
Let $S\colon \field{2n} \to \field{2n}$ be a permutation that has the type-II distinguisher and let $\HDIM{S} = \matbtwo{h_{1,1}}{h_{1,2}}{h_{2,1}}{0}$. Let $\mu \in \linbij{2n}$ such that $\mu$ has a 2-UL decomposition. Let $T \eqdef \mu^{-1} \circ S \circ \mu$.

Let $(a,b,c,d)$ be the 2-UL decomposition of $\mu$.
Then, given $T$, a system of $n^2$ quadratic equations on $a$ can be obtained.
\end{theorem}
\begin{proof}
Let $S'\colon \field{2n}\to \field{2n}$ be given by:
$$
S' = \diag{b^{-1}}{d^{-1}} \compos \idup{c} \compos S \compos \idup{c} \compos \diag{b}{d}.
$$
Similarly to the proof of Theorem~\Ref{thm:af4a},
$$
\HDIM{S'} = \diag{b^{-1}}{d^{-1}} \compos \idup{c} \compos \HDIM{S} \compos \idlo{c^{\top}} \compos \diag{\invtop{b}}{\invtop{d}},
$$
$$
\HDIM{S'} = \matbtwo{b^{-1}\times \pround{h_{1,1} \oplus c\times h_{2,1} \oplus h_{1,2}\times c^{\top}}\times \invtop{b}}{b^{-1}\times h_{1,2} \times \invtop{d}}{d^{-1}\times h_{2,1} \times \invtop{b}}{0}.
$$
Let
$$
\HDIM{T} = \matbtwo{t_{1,1}}{t_{1,2}}{t_{2,1}}{t_{2,2}}.
$$
Then
\begin{align*}
\HDIM{S'} &= \idlo{a} \compos \HDIM{T} \compos \idup{a^{\top}} = \\
          &= \matbtwo{t_{1,1}}{t_{1,2}\oplus t_{1,1}\times a^{\top}}{t_{2,1}\oplus a \times t_{1,1}}{t_{2,2} \oplus a\times t_{1,2}\oplus t_{2,1}\times a^{\top} \oplus a \times t_{1,1} \times a^{\top}}.
\end{align*}
The quadratic equation system follows:
$$
(\HDIM{S'})_{2,2} = t_{2,2} \oplus a\times t_{1,2}\oplus t_{2,1}\times a^{\top} \oplus a \times t_{1,1} \times a^{\top} = 0.
$$
\end{proof}

% ===========================================================
% A-1F5
% ===========================================================

\begin{theorem}[Type-II Affine Encodings Recovery, $\afnbij{r}{d}$]
\Label{thm:f5a}
Let $S\colon \field{2n} \to \field{2n}$ be a permutation that has the type-II distinguisher and let $\HDIM{S} = \matbtwo{h_{1,1}}{h_{1,2}}{h_{2,1}}{0}$. Let $\mu \in \linbij{2n}$ such that $\mu$ has a 2-UL decomposition. Let $T \eqdef \mu^{-1} \circ S$.

Let $(a,b,c,d)$ be the 2-UL decomposition of $\mu$.
Then, given $T$, $a$ can be recovered in time $\OO(n2^n)$ if $h_{1,2}$ is invertible.
\end{theorem}
\begin{proof}
Let $S'\colon \field{2n}\to \field{2n}$ be given by:
$$
S' = \diag{b^{-1}}{d^{-1}} \compos \idup{c} \compos S
$$
Then
$$
\HDIM{S'} = \diag{b^{-1}}{d^{-1}} \compos \idup{c} \compos \HDIM{S},
$$
$$
\HDIM{S'} = \matbtwo{b^{-1}\times \pround{h_{1,1} \oplus c\times h_{2,1}}}{b^{-1}\times h_{1,2}}{d^{-1}\times h_{2,1} }{0}.
$$
Let
$$
\HDIM{T} = \matbtwo{t_{1,1}}{t_{1,2}}{t_{2,1}}{t_{2,2}}.
$$
Then
$$
\HDIM{S'} = \idlo{a} \compos \HDIM{T} = \matbtwo{t_{1,1}}{t_{1,2}}{t_{2,1}\oplus a \times t_{1,1}}{t_{2,2} \oplus a \times t_{1,2}}.
$$
It follows that
$$
(\HDIM{S'})_{2,2} = t_{2,2} \oplus a \times t_{1,2} = 0.
$$
Note that $t_{1,2} = b^{-1}\times h_{1,2}$ is invertible since $h_{1,2}$ is assumed to be invertible, therefore the linear system has full rank.
\end{proof}

\Todo{Mention implementation of AFA attacks}

In the next sections, I will describe how to continue the decomposition process of the unmasked Feistel Networks.


\chapter{Vector bundles}


\subsection{Propositional variables}

We can represent \(T\) or \(F\) using a symbol:

\(\theta \)


\documentclass[24pt, a4]{article}
% To compile latex inside of vim
% ! clear; pdlatex name_of_file.tex or "%"

% \usepackage[utf8]{inputenc}
\usepackage[parfill]{parskip}
\usepackage{listings}
\usepackage{geometry}

\title{Heap}
\author{Mustafa Muhammad}
\date{12th October 2021}

\begin{document}

\maketitle

\newpage

List of Questions:
\begin{enumerate}
    \item{General format}
    \item{Kth smallest element}
    \item{Return K largest elements in array}
    \item{Sort a K sorted array|Sort nearly sorted array}
    \item{K closest numbers}
    \item{Top K frequent elements}
    \item{Frequency sort}
    \item{Connect ropes to minimize the cost}
    \item{Sum of elements between k1 smallest and k2 smallest numbers}
\end{enumerate}

\section{General format and identification}
Identification
1, K will be mentioned, or any other limited range of numbers.

2, Smallest or largest.

1, Min Heap maps to k + Largest

2, Max Heap maps to k + Smallest

Sorting is nlog(n), using heap for K elements is nlog(K)

\section{Kth Smallest Element}
Default heap is a min heap in python, to make it max just multiply by -1.

\begin{lstlisting}
import heapq
class Solution:
    def k_smallest_element(self, arr, k):
        heap = []

        for i in range(0, len(arr)):
            heapq.heappush(heap, -arr[i])

            if len(heap) > k:
                heapq.heappop(heap)

        #Max heap so the smallest will be at the start of the array.
        return heap[0]*-1
\end{lstlisting}

\newpage

\section{Return K largest elements in an array}
\begin{lstlisting}
import heapq
class Solution:
    def k_largest_element(self, arr, k):
        heap = []

        for i in range(0, len(arr)):
            heapq.heappush(heap, arr[i])

            if len(heap) > k:
                heapq.heappop(heap)

        #Max heap so the smallest will be at the start of the array.
        return heap
\end{lstlisting}

\section{Sort a K sorted array | nearly sorted array}
Given an array of n elements, where each element is at most k away from its
target position, devise an algorithm that sorts in O(n log k) time. For
example, let us consider k is 2, an element at index 7 in the sorted array,
can be at indexes 5, 6, 7, 8, 9 in the given array.

We sort K values at a time, hence when we go above k length of heap, we pop and
add to the result array. We proceed to add all the remaining values at the end.

\begin{lstlisting}
def nearly_sorted_array(array, k):
    heap = []
    res = []
    for i in range(0, len(arr)):
        heapq.heappush(heap, arr[i])

        if len(heap) > k:
            res.append(heapq.pop(heap))

    for j in range(0, len(heap)):
        res.append(heapq.heapop(heap))

    return res
\end{lstlisting}

\newpage
\section{K closest numbers | K closest elements}
Given a sorted integer array arr, two integers k and x, return the k closest
integers to x in the array. The result should also be sorted in ascending
order. An integer a is closer to x than an integer b if:

$|$a - x$|$ $<$ $|$b - x$|$, or

$|$a - x$|$ == $|$b - x$|$ and a $<$ b

We put -arr[i] because the second key is compared if the difference is same.

\begin{lstlisting}
import heapq

class Solution:
    def findClosestElements(self, arr: List[int], k: int, x: int) -> List[int]:
        heap = []
        for i in range(0, len(arr)):
            diff = abs(arr[i]-x)

            heapq.heappush(heap, (-diff, -arr[i]))

            if len(heap) > k:
                heapq.heappop(heap)

        return sorted([h[1]*-1 for h in heap])
\end{lstlisting}

\section{Top K frequent numbers/elements}
Given an integer array nums and an integer k, return the k most frequent
elements. You may return the answer in any order.

Input: nums = [1,1,1,2,2,3], k = 2 Output: [1,2]
\begin{lstlisting}
import heapq
class Solution:
    def topKFrequent(self, nums: List[int], k: int) -> List[int]:
        hash_map = {}
        for i in range(0, len(nums)):
            if nums[i] in hash_map:
                hash_map[nums[i]] += 1
            else:
                hash_map[nums[i]] = 1
        heap = []
        for keys, vals in hash_map.items():
            heapq.heappush(heap, (vals, keys))
            if len(heap) > k:
                heapq.heappop(heap)
        return [h[1] for h in heap]
\end{lstlisting}

\newpage
\section{Frequency sort}
Sort on array by the frequency of its elements

\begin{lstlisting}
import heapq
class Solution:
    def frequencySort(self, nums: List[int]) -> List[int]:
        hash_map = {}
        heap = []
        res = []

        for i in range(0, len(nums)):
            if nums[i] not in hash_map:
                hash_map[nums[i]] = 1
            else:
                hash_map[nums[i]] += 1
        for key, val in hash_map.items():
            heapq.heappush(heap, (val, -key))

        for j in range(0, len(heap)):
            tup = heapq.heappop(heap)
            count = tup[0]
            key = tup[1]*-1
            for j in range(0, count):
                res.append(key)
        return res
\end{lstlisting}

\newpage
\section{Find K closest points to origin}
Given an array of points where points[i] = [xi, yi] represents a point on the
X-Y plane and an integer k, return the k closest points to the origin (0, 0).
You may return the answer in any order. The answer is guaranteed to be unique
\begin{lstlisting}
import heapq
class Solution:
    def kClosest(self, points: List[List[int]], k: int) -> List[List[int]]:
        heap = []
        for coord in points:
            x = coord[0]
            y = coord[1]
            dist = (x**2+y**2)**0.5
            heapq.heappush(heap, (-dist, (x,y)))
            if len(heap) > k:
                heapq.heappop(heap)
        return [h[1] for h in heap]
\end{lstlisting}
\section{Connect ropes to minimize cost}
There are given N ropes of different lengths, we need to connect these ropes
into one rope. The cost to connect two ropes is equal to sum of their lengths.
The task is to connect the ropes with minimum cost.
Input: n = 4 arr[] = {4, 3, 2, 6} Output: 29
Explanation:
For example if we are given 4 ropes of lengths 4, 3, 2 and 6. We can connect
the ropes in following ways. 1) First connect ropes of lengths 2 and 3.
Now we have three ropes of lengths 4, 6 and 5.
2) Now connect ropes of lengths 4 and 5.
Now we have two ropes of lengths 6 and 9.
3) Finally connect the two ropes and all
ropes have connected.
Total cost for connecting all ropes is 5
+ 9 + 15 = 29. This is the optimized cost
for connecting ropes. Other ways of
connecting ropes would always have same
or more cost. For example, if we connect
4 and 6 first (we get three strings of 3,
2 and 10), then connect 10 and 3 (we get
two strings of 13 and 2). Finally we
connect 13 and 2. Total cost in this way
is 10 + 13 + 15 = 38.
\begin{lstlisting}
import heapq
class Solution:
    def minCost(self,arr,n) :
        heap = []
        total = 0
        for i in range(0, len(arr)):
            heapq.heappush(heap, arr[i])
        while len(heap) >= 2:
            val1 = heapq.heappop(heap)
            val2 = heapq.heappop(heap)
            total += val1+val2
            heapq.heappush(heap, val1+val2)
        return total
\end{lstlisting}
\newpage
\section{Sum of Elements b/w k1 and k2 smallest numbers}
Given an array A[] of N positive integers and two positive integers K1 and K2.
Find the sum of all elements between K1th and K2th smallest elements of the
array. It may be assumed that (1 <= k1 < k2 <= n).
Input: N  = 7 A[] = {20, 8, 22, 4, 12, 10, 14} K1 = 3, K2 = 6 Output: 26
Explanation: 3rd smallest element is 10 6th smallest element is 20
Sum of all element between
K1 \& K2 is 12 + 14 = 26
\begin{lstlisting}
import heapq
class Solution:
    def sumBetweenTwoKth(self, A, N, K1, K2):
        def get_kth(arr, k):
            heap = []
            for i in range(0, len(arr)):
                heapq.heappush(heap, -arr[i])
                if len(heap) > k:
                    heapq.heappop(heap)
            return heap[0]
        v1 = get_kth(A, K1)*-1
        v2 = get_kth(A, K2)*-1
        total = 0
        for j in range(0, len(A)):
            if A[j] > v1 and A[j] < v2:
                total += A[j]
        return total
\end{lstlisting}
\end{document}


\par
\section{Data Structure}
\label{section:MPI:dataStructure}
\par
There is one MPI specific data structure, used in the distributed
matrix-matrix multiply.
\par
\subsection{{\tt MatMulInfo} :
            Matrix-matrix multiply information object}
\label{subsection:MatMulInfo}
\par
The distributed matrix-matrix multiply is a very complex operation.
We want to compute $Y := Y + \alpha A X$, where $Y$, $A$ and $X$
are distributed matrices.
Processor $q$ owns the local matrices $Y^q$, $A^q$ and $X^q$.
The entries of $A^q$ do not travel among the processors, it is the
entries of $X$ and/or the partial entries of the product $\alpha A X$
that are communicated.
Each processor performs the local computation
$Y_{supp}^q = \alpha A^q X_{supp}^q$,
where the rows of $X_{supp}^q$ correspond to the columns of $A^q$
with a nonzero entry,
and the rows of $Y_{supp}^q$ correspond to the rows of $A^q$
with a nonzero entry.
(Something similar holds for the operations
$Y := Y + \alpha A^T X$ and $Y := Y + \alpha A^T X$.)
This requires entries of $X$ to be {\it gathered} into $X_{supp}^q$
and the entries of $Y_{supp}^q$ be {\it scatter/added} into $Y$.
\par
The {\tt MatMulInfo} object stores all the necessary information to
make this happen.
There is one {\tt MatMulInfo} object per processor.
It has the following fields.
\begin{itemize}
\item
{\tt symflag} --- symmetry flag for $A$
\begin{itemize}
\item 0 ({\tt SPOOLES\_SYMMETRIC}) -- symmetric matrix
\item 1 ({\tt SPOOLES\_HERMITIAN}) -- hermitian matrix
\item 2 ({\tt SPOOLES\_NONSYMMETRIC}) -- nonsymmetric matrix
\end{itemize}
\item
{\tt opflag} --- operation flag for the multiply
\begin{itemize}
\item 0 ({\tt MMM\_WITH\_A})  --- perform $Y := Y + \alpha A X$
\item 1 ({\tt MMM\_WITH\_AT}) --- perform $Y := Y + \alpha A^T X$
\item 2 ({\tt MMM\_WITH\_AH}) --- perform $Y := Y + \alpha A^H X$
\end{itemize}
\item
{\tt IV *XownedIV}  ---
list of rows of $X$ that are owned by this processor,
these form the rows of $X^q$.
\item
{\tt IV *XsupIV}  ---
list of rows of $X$ that are accessed by this processor,
these form the rows of $X_{supp}^q$
\item
{\tt IV *XmapIV}  ---
a map from the global ids of the rows of $X_{supp}^q$
to their local ids within $X_{supp}^q$
\item
{\tt IVL *XsendIVL} ---
list $r$ holds the local row ids of the owned rows of $X^q$ that must
be sent from this processor to processor $r$
\item
{\tt IVL *XrecvIVL} ---
list $r$ holds the local row ids of the supported rows of $X_{supp}^q$
that will be received from processor $r$.
\item
{\tt IV *YownedIV}  ---
list of rows of $Y$ that are owned by this processor,
these form the rows of $Y^q$.
\item
{\tt IV *YsupIV}  ---
list of rows of $Y$ that are updated by this processor,
these form the rows of $Y_{supp}^q$
\item
{\tt IV *YmapIV}  ---
a map from the global ids of the rows of $Y_{supp}^q$
to their local ids within $Y_{supp}^q$
\item
{\tt IVL *YsendIVL} ---
list $r$ holds the local row ids of the supported rows of $Y_{supp}^q$
that must be sent from this processor to processor $r$
\item
{\tt IVL *YrecvIVL} ---
list $r$ holds the local row ids of the owned rows of $Y^q$
that will be received from processor $r$.
\item
{\tt DenseMtx *Xsupp} ---
a temporary data structure to hold $X_{supp}^q$.
\item
{\tt DenseMtx *Ysupp} ---
a temporary data structure to hold $Y_{supp}^q$.
\end{itemize}
\par
See the methods
{\tt MatMul\_MPI\_setup()},
{\tt MatMul\_setLocalIndices()},
{\tt MatMul\_setGlobalIndices()},
{\tt MatMul\_MPI\_mmm()} and
{\tt MatMul\_cleanup()}
which use the {\tt MatMulInfo} data object.


\SecDef{lineariz}{Linearization of ARX-boxes}

In recent attacks against Keccak instances \cite{KeccakLin1,KeccakLin2} the S-Box linearization technique is used. The idea is to find a subset of inputs (often an affine subspace), such that the S-Box acts linearly on this set. I attempted to linearize the ARX-boxes by finding all inputs, for which all four modular additions inflict no carry bits and thus are equivalent to \txor{}. For the addition of two random independent 32-bit words, the probability of having all carry bits equal to zero is equal to $(3/4)^{31}$. Indeed, for each bit position, if no carry comes in, then the outgoing carry will occur only if both input bits are equal to 1. Furthermore, the carry bit from the most significant bits is ignored. Assuming independence of the additions in an ARX-box, $2^{64}(3/4)^{124}\approx 2^{12.5}$ inputs are expected to satisfy the linearization trail. In order to find all such inputs, a quadratic equation system has to be solved.

\subsection{Quadratic Equation System}

The following proposition formalizes the linearization of addition modulo $2^n$.
\begin{proposition}
\PropLabel{linearize-add}
For any $x, y \in \field{n}$, the addition $(x+y)\mod{2^n}$ is equal to the \txor{} $x\oplus y$ if and only if $x_i y_i = 0$ for all $i \in \seg{2}{n}$. In particular,
$$
\Pr_{x,y\in\field{n}}[(x+y)\mod{2^n} = x\oplus y] = \pround{\frac{3}{4}}^{n-1}.
$$
\end{proposition}
\begin{proof}
By induction for $i$ from $n$ to $1$, $x_i \land y_i = 0$ implies that there are no carries, except maybe the carry after the addition of $x_1$ and $y_1$. For the other direction, observe that a single carry for any $i \ge 2$ would necessarily modify at least one bit. Furthermore, all positions are independent, since the carries are fixed, and the probability $3/4$ is simply multiplied.
\end{proof}

In order to find all inputs satisfying the linearization in all four rounds, we have to solve a system of quadratic equations. Indeed, for the first round with inputs $x,y \in \field{32}$, we obtain 31 quadratic bit equations from \PropRef{linearize-add}. Since the conditions ensures that the output of the first round is linear, similar quadratic equations are obtained for the second round, except that $x$ and $y$ are replaced by the corresponding linear functions. In total we obtain 124 quadratic equations of the form
$$
l(x,y) \cdot r(x,y) = 0,
$$
where $l,r\colon (\field{32})^2 \to \field{}$ are affine.

The linear functions $l(x,y),r(x,y)$ can be simplified by changing the basis of the equation system. Let $x, y \in \field{32}$ denote the branches of the state before the second constant addition (see~\FigRef{arxboxmid}). In order to perform computations from $x,y$, the first two modular additions must be replaced by modular \emph{subtractions}. The linearization of subtraction is formalized by the following proposition.

\FigTex{arxboxmid.tex}

\begin{proposition}
\PropLabel{linearize-sub}
For any $x, y \in \field{n}$, the subtraction $(x-y)\mod{2^n}$ is equal to the \txor{} $x\oplus y$ if and only if $(x_i \oplus 1) y_i = 0$ for all $i \in \seg{2}{n}$.
\end{proposition}
\begin{proof}
Observe that
$$
x-y = 2^n-1 - (2^n-1 - x+y) = \lnot( (\lnot x) + y).
$$
As we want to ensure $x-y = x\oplus y$, we get
$$
(\lnot x) + y = \lnot (x\oplus y) = (\lnot x) \oplus y.
$$
Therefore, the subtraction constraints are equivalent to the addition constraints for $(\lnot x) + y$. The result follows from~\PropRef{linearize-add}.
\end{proof}

The two modular subtractions and the two modular additions provide the following 124 equations for an ARX-box $A_c$.

\begin{proposition}
Consider the ARX-box $A_c$ with a constant $c \in \field{32}$. All four its modular additions are equivalent to \txor{}s if and only if the intermediate values $x,y\in \field{32}$ as shown in~\FigRef{arxboxmid} satisfy the following 124 equations:
\begin{align*}
(1 \oplus c_{2+i} \oplus x_{2+i} \oplus x_{32+i} \oplus y_{17+i}) \cdot (c_{11+i} \oplus x_{11+i} \oplus x_{18+i} \oplus x_{9+i} \oplus y_{26+i} \oplus y_{3+i}) = 0, \\
(1 \oplus x_{2+i}) \cdot (x_{32+i} \oplus y_{17+i}) = 0, \\
(c_{2+i} \oplus x_{2+i}) \cdot (y_{2+i}) = 0, \\
(x_{2+i} \oplus y_{2+i}) \cdot (c_{11+i} \oplus x_{11+i} \oplus y_{10+i} \oplus y_{11+i}) = 0,
\end{align*}
where $i \in \seg{0}{31}$.
\end{proposition}

\subsection{Guess and Determine Algorithm}

\subsubsection{Hardness of the Equation Type}

All the quadratic equations are of the form
$$
l(x,y) \cdot r(x,y) = 0,
$$
which is equivalent to any of the two implications
\eq{
l(x,y) \Rightarrow r(x,y)\oplus 1,
r(x,y) \Rightarrow l(x,y)\oplus 1.
}
If all $l,r$ were single variables, then the system would be equivalent to a 2-SAT problem and would be efficiently solvable. However, due to $l,r$ being linear functions of the secret variables, it is NP-complete.
\begin{proposition}
The problem of finding $x \in \field{n}$ such that $l_i(x) \cdot r_i(x) = 0$ for all given affine functions $l_i,r_i\colon \field{n} \to \field{}$ is NP-complete.
\end{proposition}
\begin{proof}
Let us reduce a general 3-SAT instance to this problem. It is sufficient to show en encoding of a 3-SAT clause $(a \lor b \lor c)$. Let us introduce a new variable $v_{bc}$ such that it should be equal to $b \lor c$. This can be ensured by two implications:
$$(b \Rightarrow v_{bc}) \land (v_{bc} \oplus c \Rightarrow b).$$
Then the following encodings are equivalent:
\eq{
(a \lor b \lor c) ~\Leftrightarrow~ &
    (a \lor v_{bc}) \land
    (b \Rightarrow v_{bc}) \land
    (v_{bc} \oplus c \Rightarrow b) ~\Leftrightarrow~ \\
    ~\Leftrightarrow~ &
        (\lnot a \cdot \lnot v_{bc} = 0) \land
        (b \cdot \lnot v_{bc} = 0) \land
        ((v_{bc} \oplus c) \cdot \lnot b = 0) ).
}
\end{proof}
Due to sparsity of the affine maps $l,r$ in the linearization problem, the guess-and-determine approach may work well enough.

\subsubsection{Generating More Equations}

In order to improve the efficiency, we first generate more equations of the same form by combining the equations in the following way. For each affine map $l_i$ (or $r_i$) used in the equations, we attempt to find an affine function $\alpha$ and a subset of equations $\pset{l_j(x,y)\cdot r_j(x,y) = 0}_{j \in J}$ such that the function
$$
l_i' \eqdef \alpha \cdot l_i \oplus \bigoplus_{j \in J} l_j \cdot r_j
$$
has algebraic degree 1. This can be done using a basic linear algebra. We then obtain a new equation $$
l_i'(x,y) \cdot r(x,y) = \alpha(x,y) \cdot l(x,y) \cdot r(x,y) = 0.
$$
\begin{example}
Let $c_{2} = 0$ and consider the equations
$$
x_2 \cdot y_2 = 0,~~ (1\oplus x_2) \cdot (x_{32} \oplus y_{17}) = 0.
$$
Let $\alpha = x_{32} \oplus y_{17}$, and let the subset of equations consist of the second equation. Then
$$
\alpha \cdot x_2 \oplus (1\oplus x_2) \cdot (x_{32} \oplus y_{17}) = (x_{32} \oplus y_{17}) \cdot x_2 \oplus (1\oplus x_2) \cdot (x_{32} \oplus y_{17}) = x_{32} \oplus y_{17}.
$$
We obtain a new equation
$$
(x_{32} \oplus y_{17})\cdot y_2 = 0.
$$
\end{example}

The number of generated equations depends on the chosen round constant $c$ and in our case varies from 36 to 75 for the constants used in \aCipher, and 186 generated equations for the zero constant. The exact numbers are reported in \TabRef{arxlin-results}.

\subsubsection{Guess-and-Determine Approach}

Due to the implicational nature of equations, guess-and-determine method may work reasonably well. Our approach is based on two ideas. The first idea is to choose an order in which variables will be guessed by using a simple heuristic. The second idea is to verify the consistency of each current guess by checking the consistency of all linear equations that appear once some $l_i$ or $r_i$ becomes equal to one in the equation $l_i \cdot r_i = 0$. Finally, when only linear equations are left, the solutions are easily enumerated by basic linear algebra methods. Using these simple ideas, I managed to exhaustively find all solutions to the equation systems for several ARX-boxes. The algorithm implementation runs in an hour on a modern laptop, for a single ARX-box.

First, I describe the guessing order heuristic. Consider the equations $l_i \cdot r_i = 0$ where both $l_i,r_i$ are non-constant. Let $t_1$ denote the minimum number of variables involved in such a function $l_i$ or $r_i$. Let $t_2$ denote the second minimum such number, $t_3$ denote the third minimum such number, etc. Then, each variable $x_j$ is assigned a vector $C_j = (c_1, c_2, c_3, \ldots)$  where $c_k$ is the number of considered functions $l_i$ or $r_i$  involving $t_k$ variables including $x_j$. Then the variable $x_j$ with the largest such vector is selected, where the comparison is done lexicographically. The selected variable is added to the guess order, eliminated from equations and the process repeats until all variables are eliminated.

\begin{example}
Assume that we consider equations
$$
(x_1) \cdot (x_2)=0,
(x_1 \oplus 1) \cdot (x_1 \oplus x_2) = 0,
(x_2) \cdot (x_2 \oplus x_3) = 0,
(x_1 \oplus x_3 \oplus x_4 \oplus x_5) \cdot (x_3 \oplus 1) = 0.
$$
Initially, we get
$$
C_1 = (2, 1, 1), C_2 = (2, 2, 0), C_3 = (1, 1, 1), C_4 = (0, 0, 1), C_5 = (0, 0, 1).
$$
We select $x_2$ as the first variable to guess. After elimination, we obtain that the first and the third equations are removed, because $x_2$ becomes constant. Next, we get
$$
C_1 = (2, 0, 1), C_3 = (1, 0, 1), C_4 = (0, 0, 1), C_5 = (0, 0, 1).
$$
We select $x_1$ as the second variable to guess.
After the elimination, only the last equation remains, and $x_3$ is selected as the last variable to guess. We do not need to guess $x_4,x_5$ as the system at this point will be linear.
\end{example}
% ===================
% 1 (x_1)
% 1 (x_2)

% 1 (x_1 \oplus 1)
% 2 (x_1 \oplus x_2)

% 1 (x_2)
% 2 (x_2 \oplus x_3)

% 3 (x_1 \oplus x_3 \oplus x_4)
% 1 (x_3 \oplus 1)

% x_1: 1,1,2,3 -> 2,1,1
% x_2: 1,2,1,2 -> 2,2,0
% x_3: 2,3,1   -> 1,1,1
% x_4: 3       -> 0,0,1
% ===================
% 1 (x_1 \oplus 1)
% 1 (x_1) ::: was x_1 + x_2

% 3 (x_1 \oplus x_3 \oplus x_4)
% 1 (x_3 \oplus 1)

% x_1: 1,1,3 -> 2,0,1
% x_3: 3, 1  -> 1,0,1
% x_4: 3     -> 0,0,1
% ===================
% 2 (x_3 \oplus x_4)
% 1 (x_3 \oplus 1)

% x_1: 1,1,3 -> 2,0,1
% x_3: 3, 1  -> 1,0,1
% x_4: 3     -> 0,0,1
% ===================

The full approach is described in \AlgRef{gnd}.

\begin{algorithm}
    \AlgDef{gnd}{Guess-and-Determine algorithm for ARX-box Linearization.}
    \begin{algorithmic}[1]
    \Require a system $E$ of equations $\pset{l_i(x)\cdot r_i(x) = 0},$
    \Statex~~~~~~where $l_i,r_i\colon \field{n} \to \field{}$ are affine;
    \Ensure all solutions $x\in \field{n}$ to the system.

    \Statex
    \LeftComment{generate more equations:}
    \ForAll{$(l_i,r_i) \in E$, $(r_i,l_i) \in E$}
        \State $L \gets \Span(x_1\cdot l_i,\ldots,x_n\cdot l_i, l_i)$
        \State $E \gets E \cup \pset{l'\cdot r_i=0 \mid l' \in L/E, \deg{l'} \le 1}$ \Comment{Linear algebra}
    \EndFor

    \Statex
    \LeftComment{compute a guessing order heuristically:}
    \State $order \gets []$
    \State $E' \gets E$
    \While{$E'$ is not linear}
        \State $C_j \gets \proundd{\pabs{\pset{
            (l_i,r_i) \in E' ~\text{or}~(r_i,l_i) \in E'
            \mid
            \deg{l_i} = \deg{r_i} = 2,
            \pabs{l_i} = t,
            x_j \in l_i
        }}}_{t \in \ZZplus}$,
        \Statex ~~~~~~~~~~~~where $\pabs{l_i}$ is the number of variables in $l_i$,
        \Statex ~~~~~~~~~~~~~~~~~~~~~$x_j \in l_i$ means that $x_j$ is involved in $l_i$
        \State $j \gets \argmax_{j \in \seg{1}{n},j \notin order} C_j$
        \State $E' \gets E'\big|_{x_j=0}$ \Comment{elimination of $x_j$}
        \State append $j$ to $order$
    \EndWhile

    \Statex
    \LeftComment{enumerate solutions:}
    \Function{GuessAndDetermine}{$guessed,E$}
        \State $i \gets order_{\pabs{guessed}}$
        \ForAll{$v \in \pset{0, 1}$}
            \State $E' \gets E\big|_{x_i = v}$
            \State $L \gets$ all linear equations from $E'$
            \If{$L = E'$}
                \State yield solutions based on $guessed$ and $L$
            \ElsIf{$L$ is consistent}
                \State $GuessAndDetermine(guessed \cup \pset{x_i=v}, E')$
            \EndIf
        \EndFor
    \EndFunction
    \State $GuessAndDetermine(\pset{}, E)$
    \end{algorithmic}
\end{algorithm}

% ==================================================================
% ==================================================================

\subsection{Generalization to Arbitrary Carry Patterns}

Note that an ARX-box is linearized not only in the case when all carries are zero. In fact, it is sufficient that all carries are fixed. For an isolated modular addition, the fraction of inputs leading to a particular carry mask depends on the number of adjacent bits in the carry mask that are equal.

\begin{proposition}
Let $e \in \field{n}$.
For any $x, y \in \field{n}$, the addition $(x+y)\mod{2^n}$ is equal to the \txor{} $x\oplus y \oplus e$ if and only if $e_{n} = 0$ and for all $i \in \seg{1}{n-1}$,
$$
e_i \oplus e_{i+1} = (x_{i+1} \oplus e_{i+1}) \cdot (y_{i+1} \oplus e_{i+1}).
$$
In particular, for any $e \in \field{n}$ with $e_n = 0$,
$$
\Pr_{x,y\in\field{n}}[(x+y)\mod{2^n} = x\oplus y \oplus e] = \frac{3^m}{4^{n-1}},
$$
where $m = \sum_{i=1}^{n-1} (e_i \oplus e_{i+1} \oplus 1)$ (the sum is over integers).
\end{proposition}
\begin{proof}
Note that $e$ denotes the carry vector, and the addition simply \txor{}s the operands and the carry vector. It is left to ensure that the carry vector is correct. This requires only local constraints. The carry $e_i$ is computed as
\begin{multline*}
e_i = maj_3(e_{i+1}, x_{i+1}, y_{i+1}) = \\
x_{i+1}y_{i+1} \oplus x_{i+1}e_{i+1}\oplus y_{i+1}e_{i+1} =
(x_{i+1}\oplus e_{i+1})\cdot(y_{i+1}\oplus e_{i+1}) \oplus e_{i+1}.
\end{multline*}
where $maj_3$ is the majority function.

If $e_i \oplus e_{i+1} = 0$, we obtain a quadratic equation of the form $x_{i+1}\cdot y_{i+1}=0$, which has 3 solutions. If $e_i \oplus e_{i+1} = 0$, we obtain a quadratic equation of the form $x_{i+1}\cdot y_{i+1}=1$, which has 1 solution, and is equivalent to two linear equations $x_{i+1} = 1$ and $y_{i+1} = 1$. For all positions the constraints on $x,y$ are independent.
\end{proof}

\begin{example}
The all-zero carry patterns are the most probable, and the probability is equal to $(3/4)^{n-1}$. The second most probable patterns are those with one adjacent difference, i.e. of the form $e = (1,1,\ldots,1,0,\ldots,0)$. Their probability is equal to $(3/4)^{n-1}/3$.
\end{example}

As observed in the proof, a difference in adjacent carry bits results in lower probability of linearization, and results in two linear equations instead of one quadratic equation. Therefore, carry patterns with more differences in adjacent bits should result in easier equation systems but also in a lower number of solutions. In general, an extra adjacent difference reduces the probability by a factor of 3.

% ==================================================================
% ==================================================================

\subsection{Linearization Results}

I implemented the algorithm in SageMath~\cite{sage} and applied it to all 8 constants used in the ARX-boxes in \aCipher. In addition, I ran the algorithm on the all-zero and the all-one constants. The results are given in \TabRef{arxlin-results}. For all constants except the all-one constant, the equation generation took a couple of minutes and the solving part took around an hour. The all-one constant had no extra equations and, due to an unusually large number of solutions, the computations have not finished even after 200 hours, yielding more than 4 millions of inputs. The evaluation was performed on a single core of a 2.8 GHz CPU on a laptop.

% c_7: no equations + order heuristic: 6 hours
% c_7: no equations + manual order: 15 hours

\begin{table}[h!tb]
    \centering
    \begin{tabular}{ccccc}
        \toprule
        constant & hexadecimal & \# equations & \# inputs & example \\
        \midrule
        $c_0$ & \hext{b7e15162} & 199 & 13  & (\hext{05600000}, \hext{70000225}) \\
        $c_1$ & \hext{bf715880} & 199 & 11  & (\hext{2a001990}, \hext{00188000}) \\
        $c_2$ & \hext{38b4da56} & 196 & 18  & (\hext{1000c000}, \hext{144a0528}) \\
        $c_3$ & \hext{324e7738} & 196 & 3   & (\hext{1000e620}, \hext{04270080}) \\
        $c_4$ & \hext{bb1185eb} & 193 & 10  & (\hext{001c8181}, \hext{10808201}) \\
        $c_5$ & \hext{4f7c7b57} & 160 & 340 & (\hext{08301013}, \hext{28265722}) \\
        $c_6$ & \hext{cfbfa1c8} & 178 & 105 & (\hext{801d8000}, \hext{2fd10085}) \\
        $c_7$ & \hext{c2b3293d} & 199 & 76  & (\hext{00220110}, \hext{20001804}) \\
        $0$   & \hext{00000000} & 310 & 8   & (\hext{00000000}, \hext{40200080}) \\
        $2^{32}-1$ & \hext{ffffffff} & 124 & $\ge 2^{22}$ & (\hext{0b11cc51}, \hext{72770942})\\
        \bottomrule
    \end{tabular}
    \TabDef{arxlin-results}{The number of inputs for ARX-boxes inflicting no carries in all four rounds, for different round constants.}
\end{table}

The first interesting observation is that the number of solutions is much smaller than $2^{12.5}\approx 5900$ predicted under the round independence assumption. For 5 out of 8 used constants, the number of solutions is less than 20, and the maximum number of solutions among constants used in \aCipher{} is 340. The second observation is that, for the zero constant, the number of solutions is also extremely low. We find it rather counter-intuitive, since in absence of constants many low-weight vectors can be expected to pass through the ARX-box without inflicting any carries. We suggest that this happens due to strong choice of rotation amounts, leading to faster diffusion. Finally, it turns out that the all-one constant leads to a huge number of solutions.

I observed similar behaviour and verified correctness of the algorithm on 8-bit words, where an exhaustive search over all ARX-box inputs is feasible.

I also applied the algorithm to a carry pattern with a single difference in adjacent carry bits, namely when the carry pattern in the first round is
$$
e = (1, 1, \ldots, 1, 0) \in \field{32}
$$
and in other rounds the carry pattern is zero.
I generated the equations and ran the guess-and-determine algorithm on ARX-boxes with constants $c_0$ and $c_5$. The two linear equations that appear due to the carry difference allow to generate much more quadratic equations. Note that the algorithm for generating equations can be further improved to use linear relations in various ways. For the ARX-box $A_{c_0}$, 301 total equations are obtained, whereas for $A_{c_5}$, the system contains 409 equations. Though, the running time was still about 1 hour. The results for this ARX-boxes and the described carry pattern are given in \TabRef{arxlin-results2}.

\begin{table}[h!tb]
    \centering
    \begin{tabular}{ccccc}
        \toprule
        constant & hexadecimal & \# equations & \# inputs & example\\
        \midrule
        $c_0$ & \hext{b7e15162} & 301 & 41 & (\hext{1f5d7ff5}, \hext{b2d168b5}) \\
        $c_5$ & \hext{4f7c7b57} & 409 & 6 & (\hext{7ed77b73}, \hext{a3dccee7}) \\
        \bottomrule
    \end{tabular}
    \TabDef{arxlin-results2}{The number of inputs for ARX-boxes inflicting the carry pattern $(1,\ldots,1,0)$ in the first round an no carries in the other rounds, for round constants $c_0$ and $c_5$.}
\end{table}


\subsection{Natural numbers}\label{subsec:natural_numbers}

\begin{definition}\label{def:peano_arithmetic}\mcite[exmpl. 17.6]{OpenLogicFull}
  Peano arithmetic (commonly abbreviated as \logic{PA}) is a \hyperref[def:first_order_theory]{theory} in \hyperref[subsec:first_order_logic]{first-order predicate logic} for describing \hyperref[def:set_of_natural_numbers]{natural numbers} and their operations. It can also be formulated in \hyperref[rem:higher_order_logic]{second-order logic} or entirely within \hyperref[sec:set_theory]{set theory} (especially considering that we are working inside an ambient \hyperref[rem:standard_model_of_set_theory]{standard} \hyperref[rem:transitive_model_of_set_theory]{transitive} model of \hyperref[def:axiom_of_universes]{\logic{ZFC+U}}), however in this document we usually give preference to the first-order logic formulation of a theory.

  Peano's original axioms referred to sets rather than first-order logic, and we actually work  \ in this document, however we prefer to use a modern formulation of Peano arithmetic.

  The \hyperref[def:first_order_language]{language} of the theory consists of
  \begin{thmenum}[series=def:peano_arithmetic]
    \thmitem{def:peano_arithmetic/zero} A constant \( 0 \) for representing \term{zero}. We can alternatively require a constant for \( 1 \), but this would lead to worse metamathematical properties as discussed in \fullref{rem:peano_arithmetic_zero}.

    \thmitem{def:peano_arithmetic/succ} A unary \hyperref[def:first_order_language/func]{functional symbol} \( s \), called the \term{successor operation}.

    The successor function is only a technicality used for establishing basic properties and for defining addition and multiplication, both in this subsection and in \fullref{def:omega_operations}.

    We will only use the abstract successor operation prior to proving the familiar properties of addition and multiplication, although we will later use the \hyperref[def:ordinal_successor]{ordinal successor operation} for building a model of \logic{PA} --- see \fullref{thm:omega_is_model_of_pa}.

    \thmitem{def:peano_arithmetic/plus} An \hyperref[rem:first_order_formula_conventions/infix]{infix} binary functional symbol \( + \) for denoting \term{addition}.

    See \fullref{thm:natural_number_addition_properties} for the algebraic properties of natural number addition.

    \thmitem{def:peano_arithmetic/mult} Another infix binary functional symbol \( \cdot \) for denoting \term{multiplication}. Outside the object language we usually use juxtaposition instead.

    See \fullref{thm:natural_number_multiplication_properties} for the algebraic properties of natural number multiplication.

    As with all \hyperref[def:semiring]{semirings}, multiplication has higher priority than addition. In the unambiguous language defined in \fullref{ex:natural_number_arithmetic_grammar/backus_naur_form}, this means that we can use the shorthand \( \xi + \eta \cdot \zeta \) for \( ((\xi \cdot \eta) + \zeta) \). We often use juxtaposition for denoting multiplication.
  \end{thmenum}

  As usual, in order to avoid parentheses, we assume that multiplication has a higher precedence and thus the right-hand side of axiom \eqref{eq:def:peano_arithmetic/PA7} should be parenthesized as \( ((\eta \cdot \xi) + \xi) \). We avoid excessive parentheses in formulas as per our convention \fullref{rem:propositional_formula_parentheses}.

  We impose the following base \hyperref[def:first_order_theory]{axioms}:
  \begin{thmenum}[resume=def:peano_arithmetic]
    \thmitem[def:peano_arithmetic/PA1]{PA1} The successor function is \hyperref[thm:function_invertibility_categorical/nonempty_left_invertible]{injective}. This can be stated as follows:
    \begin{equation}\label{eq:def:peano_arithmetic/PA1}\tag{\logic{PA1}}
      s(\xi) \doteq s(\eta) \rightarrow \xi \doteq \eta.
    \end{equation}

    We use here the convention for implicit universal quantification described in \fullref{rem:mathematical_logic_conventions/quantification}.

    \thmitem[def:peano_arithmetic/PA2]{PA2} Zero is not the successor of any natural number. Symbolically,
    \begin{equation}\label{eq:def:peano_arithmetic/PA2}\tag{\logic{PA2}}
      \neg \qexists \xi (s(\xi) \doteq 0).
    \end{equation}

    \thmitem[def:peano_arithmetic/PA3]{PA3} The \term{axiom schema of induction} roughly states that for a property to hold for all natural numbers it is sufficient for the following two conditions to be met:
    \begin{itemize}
      \item The property holds for \( 0 \).
      \item We can prove that is holds for any number by assuming that it holds for its predecessor.
    \end{itemize}

    See the proof of \fullref{thm:nonzero_natural_numbers_have_predecessors} for a detailed discussion.

    To describe this formally, we state that for any \hyperref[def:first_order_language/var]{variables} \( \xi \) and \( \eta \) and any formula \( \varphi \) not containing \underline{\( \eta \)} as a \hyperref[def:first_order_syntax/formula_free_variables]{free variable}, the following is an axiom:
    \begin{equation}\label{eq:def:peano_arithmetic/PA3}\tag{\logic{PA3}}
      \parens[\Big]
        {
          \underbrace{\varphi[\xi \mapsto 0]}_{\T{base case}}
          \wedge
          \qforall \eta \parens[\Big]
            {
              \overbrace
                {
                  \underbrace{ \varphi[\xi \mapsto \eta] }_{\mathclap{\substack{\T{inductive} \\ \T{hypothesis}}}}
                  \rightarrow
                  \underbrace{ \varphi[\xi \mapsto s(\eta)] }_{\mathclap{\substack{\T{inductive step} \\ \T{conclusion}}}}
                }^{\T{inductive step}}
            }
        }
      \rightarrow
      \underbrace{ \qforall \eta \varphi[\xi \mapsto \eta] }_{\T{conclusion}}.
    \end{equation}

    It is important to highlight that \( \varphi \) may have any set of free variables, as long as \( \eta \) is not among them. As explained in \fullref{rem:mathematical_logic_conventions/quantification}, we avoid excessive universal quantification. Of course, the axiom is only interesting if \( \xi \in \boldop{Free}(\varphi) \). If \( \zeta_1, \ldots, \zeta_n \) are all the other free variables of \( \varphi \), then the \hyperref[thm:implicit_universal_quantification]{universal closure} of the corresponding axiom is
    \begin{equation}\label{eq:def:peano_arithmetic/PA3_quantified}\tag{PA3'}
      \qforall {\zeta_1} \cdots \qforall {\zeta_n}
      \parens[\Bigg]
      {
        \parens[\Big]
          {
            \underbrace{\varphi[\xi \mapsto 0]}_{\T{base case}}
            \wedge
            \qforall \eta \parens[\Big]
              {
                \overbrace
                  {
                    \underbrace{ \varphi[\xi \mapsto \eta] }_{\mathclap{\substack{\T{inductive} \\ \T{hypothesis}}}}
                    \rightarrow
                    \underbrace{ \varphi[\xi \mapsto s(\eta)] }_{\mathclap{\substack{\T{inductive step} \\ \T{conclusion}}}}
                  }^{\T{inductive step}}
              }
          }
        \rightarrow
        \underbrace{ \qforall \eta \varphi[\xi \mapsto \eta] }_{\T{conclusion}}
      }.
    \end{equation}

    Thus, the axiom holds for any assignment for the variables \( \zeta_1, \ldots, \zeta_n \). For this reason, we call these variables \term{parameters}. Parameters in axiom schemas are further discussed in \fullref{def:set_builder_notation} in relation to comprehension in set theory.

    See \fullref{rem:induction} for a more detailed discussion of induction in general and \fullref{thm:omega_recursion} for the corresponding recursion principle.
  \end{thmenum}

  The theory we obtain without the binary operations and with only the axioms \eqref{eq:def:peano_arithmetic/PA1}-\eqref{eq:def:peano_arithmetic/PA3} is itself sometimes called Peano arithmetic. The operations are defined inductively, however, and there is no way for us to formalize them within the object theory without adding them to the language and theory itself.

  \begin{thmenum}[resume=def:peano_arithmetic]
    \thmitem[def:peano_arithmetic/PA4+5]{PA4+5} The next two axioms inductively define how addition is supposed to work:
    \begin{align}
      \xi + 0       &\doteq \xi           \label{eq:def:peano_arithmetic/PA4}\tag{\logic{PA4}} \\
      \xi + s(\eta) &\doteq s(\xi + \eta) \label{eq:def:peano_arithmetic/PA5}\tag{\logic{PA5}}
    \end{align}

    \thmitem[def:peano_arithmetic/PA6+7]{PA6+7} The final two axioms are for multiplication:
    \begin{align}
      \xi \cdot 0       &\doteq 0                    \label{eq:def:peano_arithmetic/PA6}\tag{\logic{PA6}} \\
      \xi \cdot s(\eta) &\doteq \xi \cdot \eta + \xi \label{eq:def:peano_arithmetic/PA7}\tag{\logic{PA7}}
    \end{align}
  \end{thmenum}
\end{definition}

\begin{remark}\label{rem:peano_arithmetic_zero}
  It is common to consider the first natural numbers to be \( 0 \) (e.g. \cite[exmpl. 17.6]{OpenLogicFull}). Peano himself, however, considered \( 1 \) to be the first natural number - see \cite[1]{Peano1889}.

  Whether \( 0 \) is considered to be a natural number is a matter of convention. The operations defined via \eqref{eq:def:peano_arithmetic/PA4}-\eqref{eq:def:peano_arithmetic/PA7} can be modified to work if \( 1 \) was instead the first natural number.

  We make choose for \( \BbbN \) to start with \( 0 \), however we often avoid referring to the set \( \BbbN \) of natural numbers and instead rely on the concepts \enquote{nonnegative} and \enquote{positive} integers formally defined in \fullref{def:integer_ordering}.
\end{remark}

\begin{definition}\label{def:set_of_natural_numbers}
  We define the set of \term[bg=естествени числа,ru=натуральные числа]{natural numbers} \( \BbbN \) as the \hyperref[thm:smallest_inductive_set_existence]{smallest inductive set} \( \omega \) with the \hyperref[def:first_order_structure/interpretation]{interpretation} described in \fullref{thm:omega_is_model_of_pa}.

  We do not depend on any particular properties of \( \omega \), but we use it because our construction of it is careful and purposely does not use natural numbers to avoid circularity. We are working in an ambient \hyperref[rem:standard_model_of_set_theory]{standard} \hyperref[rem:transitive_model_of_set_theory]{transitive} model of \hyperref[def:axiom_of_universes]{\logic{ZFC+U}} and hence we will conflate \( \BbbN \) with \( \omega \) as sets, however the first is also a \hyperref[def:first_order_structure]{structure of first-order logic}.

  We use the usual notation
  \begin{align*}
    0 &\coloneqq \varnothing \\
    1 &\coloneqq \op{succ}(\varnothing) = \set{ \varnothing } \\
    2 &\coloneqq \op{succ}(\op{succ}(\varnothing)) = \set{ \varnothing, \set{ \varnothing } } \\
      &\vdots
  \end{align*}
  and continue to use the notation functional symbols from \fullref{def:peano_arithmetic}, however we now denote the corresponding interpretations in the structure \( \BbbN \).

  See \fullref{ex:natural_number_arithmetic_grammar/backus_naur_form} for a simple \hyperref[def:formal_grammar]{grammar} that produces numeric symbols in their decimal notation.
\end{definition}

\begin{remark}\label{rem:standard_models_of_arithmetic}
  At this point, we have two kinds of natural numbers:
  \begin{itemize}
    \item We have natural numbers within the metatheory. This is our mental model of the natural numbers, and it is used for distinguishing between \enquote{unary} functional symbols like \( s \) and \enquote{binary} functional symbols like \( + \). This is mostly used within logic itself.

    \item We have the set of natural numbers \( \BbbN \) defined in \fullref{def:set_of_natural_numbers}. These are the numbers which we have defined formally, whose properties we study and the numbers which we use in the entire document. The properties of \( \BbbN \) help us develop a better mental model, which in turn changes our perception of the natural numbers within the metatheory.
  \end{itemize}

  We want the two sets of natural numbers to coincide. This is important when talking about, for example, \hyperref[def:sequence]{sequences}. If a number in \( \BbbN \) is not a natural number within the metatheory, we say that it is \term{nonstandard}. The existence of nonstandard models is guaranteed by \fullref{thm:upward_lowenheim_skolem_theorem}. There cannot be numbers in the metatheory that are not in \( \BbbN \) because a model of \logic{PA} cannot have a finite domain and the natural numbers are the smallest metalogical infinite set.

  A model of \logic{PA} which contains precisely the numbers in the metatheory is called a \term{standard model}. For the purpose of this document, it is sufficient to accept the convention that \( \BbbN \) is a standard model of \logic{PA}.
\end{remark}

\begin{proposition}\label{thm:nonzero_natural_numbers_have_predecessors}
  Every nonzero natural number has a unique predecessor. More precisely, zero has no predecessor and for any nonzero number \( n \) there exists a unique number \( m \) such that \( n = s(m) \). We will denote this predecessor by \( p(n) \).
\end{proposition}
\begin{proof}
  This proof is exemplar because it clearly demonstrates both the distinction between inductive and deductive reasoning and the role of the main three axioms.

  \begin{itemize}
    \item The axiom \eqref{eq:def:peano_arithmetic/PA1} states that the function \( s \) is injective. By the equivalences in \fullref{def:function_invertibility/injective} its \hyperref[def:multi_valued_function/inverse]{inverse multi-valued function} is actually a \hyperref[def:partial_function]{single-valued partial function}. Denote this inverse by \( p \).

    \item The axiom \eqref{eq:def:peano_arithmetic/PA2} states that the function \( s \) is not surjective. By the equivalences in \fullref{def:function_invertibility/surjective}, the inverse \( p \) is not a \hyperref[def:multi_valued_function/total]{total function}.
  \end{itemize}

  What we have shown up until this point in the proof is deductive --- we have restated the first two axioms of \logic{PA} and used some equivalent conditions that allowed us to deduce properties of the inverse function \( p \) of \( s \). We did all of this by following the precise rules of \hyperref[def:classical_logic]{classical logic} described formally in \fullref{subsec:deductive_systems}. This reasoning emulates \hyperref[eq:def:def:axiomatic_deductive_system/mp]{modus ponens}.

  Now we will show that every nonzero natural number has a predecessor. That is, that the function \( p \) is not defined only at \( 0 \). To highlight the logical structure of this proof, we will use \hyperref[def:first_order_natural_deduction_system]{first-order natural deduction} rather than work with the model \( \BbbN \) of \logic{PA}.

  Denote by \( \theta \) the formula
  \begin{equation*}
    \xi \doteq 0 \vee \qexists \zeta (\xi \doteq s(\zeta)).
  \end{equation*}

  Clearly \( \xi \) is the only free variable in \( \theta \). We want to derive the formula \( \qforall \eta \theta[\xi \mapsto \eta] \) from the axioms of \logic{PA}.

  In this part of the proof we will use inductive reasoning. This will highlight that \eqref{eq:def:peano_arithmetic/PA3} is not an axiom schema about specifying properties, but rather about introducing a proof technique that does not hold for general \hyperref[def:first_order_theory]{logical theories}. We will not attempt to prove \( \qforall \eta \theta[\xi \mapsto \eta] \) directly. Instead, we will prove a more complicated formula that is easier to prove and then by one of the many induction principles, it will follow that our desired result holds.

  We can deduce the following \hyperref[def:proof_derivability]{logical theorem}:
  \begin{equation*}
    \begin{prooftree}
      \infer0[\eqref{eq:def:first_order_natural_deduction_system/equality/intro}]{ (\xi \doteq s(\zeta))[\zeta \mapsto \eta, \xi \mapsto s(\eta)] }
      \infer1[\eqref{eq:def:first_order_natural_deduction_system/exists/intro}]{ \parens[\Big]{ \qexists \zeta (\xi \doteq s(\zeta) }[\xi \mapsto s(\eta)] }
      \infer1[\eqref{eq:def:minimal_propositional_natural_deduction_system/or/intro_right}]{ \theta[\xi \mapsto s(\eta)] }
      \infer1[\eqref{eq:def:minimal_propositional_natural_deduction_system/imp/intro}]{ \theta[\xi \mapsto \eta] \rightarrow \theta[\xi \mapsto s(\eta)] }
      \infer1[\eqref{eq:def:first_order_natural_deduction_system/forall/intro}]{ \qforall \eta (\theta[\xi \mapsto \eta] \rightarrow \theta[\xi \mapsto s(\eta)]) }

      \infer0[\eqref{eq:def:first_order_natural_deduction_system/equality/intro}]{ (\xi \doteq 0)[\xi \mapsto 0] }
      \infer1[\eqref{eq:def:minimal_propositional_natural_deduction_system/or/intro_left}]{ \theta[\xi \mapsto s(\eta)] }

      \infer2[\eqref{eq:def:minimal_propositional_natural_deduction_system/and/intro}]{ \theta[\xi \mapsto 0] \wedge \qforall \eta \parens[\Big] { \theta[\xi \mapsto \eta] \rightarrow \theta[\xi \mapsto s(\eta)] } }
    \end{prooftree}
  \end{equation*}

  This is precisely the antecedent of the instance of \eqref{eq:def:peano_arithmetic/PA3} with \( \varphi = \theta \). By \fullref{thm:syntactic_deduction_theorem} we have
  \begin{equation*}
    \eqref{eq:def:peano_arithmetic/PA3} \vdash \qforall \eta \theta[\xi \mapsto \eta].
  \end{equation*}

  When interpreted in \( \BbbN \), this formula \( \qforall \eta \theta[\xi \mapsto \eta] \) simply states that every natural number is either zero or has a predecessor. The statement does not concern itself with uniqueness nor with whether \( 0 \) has a predecessor.

  But we have already shown uniqueness --- the predecessor function \( p \) is a partial single-valued function. And we have shown that \( p \) is not defined at zero. The last part of the proof shows \( p \) is defined for all nonzero values.

  We may choose to define \( p \) at zero by giving it a sentinel value. This is precisely the technique we use in \fullref{thm:function_invertibility_categorical/nonempty_left_invertible} to show that \( s \) has a left inverse if it is injective. We can use only \eqref{eq:def:peano_arithmetic/PA1} to show that \( s \) is injective and then pick \( p \) to be any of its left inverses. We also want \( p \) to be as close as possible to a right inverse, however. The latter, as we have seen, is more tricky.
\end{proof}

\begin{proposition}\label{thm:natural_number_addition_properties}
  The \hyperref[def:set_of_natural_numbers]{natural numbers} \( \BbbN \) with \hyperref[def:peano_arithmetic/plus]{addition} form a \hyperref[def:magma/cancellative]{cancellative} \hyperref[def:magma/commutative]{commutative} \hyperref[def:zerosumfree]{zerosumfree} \hyperref[def:monoid]{monoid} with \( 0 \) as the identity.

  Furthermore, the sum of two natural numbers is nonzero if and only if both numbers are nonzero, that is,
  \begin{equation}\label{eq:thm:natural_number_addition_properties/nonzero_sum}
    n + m = 0 \T{if and only if} n = 0 \T{and} m = 0.
  \end{equation}

  This generalizes to \fullref{thm:cardinal_addition_algebraic_properties} and \fullref{thm:cardinal_addition_algebraic_properties}.
\end{proposition}
\begin{proof}
  \SubProofOf[def:magma/commutative]{commutativity} Consider the sum \( n + m \). We use induction on \( m \) to prove its commutativity.
  \begin{itemize}
    \item If \( m = 0 \), nested induction by \( n \) yields:
    \begin{itemize}
      \item If \( n = m = 0 \), clearly \( n + m = 0 + 0 = m + n \).
      \item If the inductive hypothesis holds for its predecessor \( p(n) \),
      \begin{balign*}
        n + m
        &=
        n + 0
        = \\ &=
        s(p(n)) + 0
        \reloset {\eqref{eq:def:peano_arithmetic/PA4}} = \\ &=
        s(p(n))
        \reloset {\eqref{eq:def:peano_arithmetic/PA4}} = \\ &=
        s(p(n) + 0)
        = \\ &=
        s(p(n) + m)
        \reloset {\T{ind.}} = \\ &=
        s(m + p(n))
        \reloset {\eqref{eq:def:peano_arithmetic/PA5}} = \\ &=
        m + s(p(n))
        =
        m + n.
      \end{balign*}
    \end{itemize}

    \item If \( m \neq 0 \) and if the inductive hypothesis holds for \( p(m) \), \eqref{eq:def:peano_arithmetic/PA1} yields that \( n + m = m + n \) if and only if \( n + p(m) = p(m) + n \). But the last equality is satisfied because of the inductive hypothesis, hence commutativity of \( n \) and \( m \) follows.
  \end{itemize}

  \SubProofOf[def:magma/associative]{associativity} Fix natural numbers \( n \), \( m \), \( k \). We will prove associativity by induction on \( k \). If \( k = 0 \), we have
  \begin{equation*}
    (n + m) + 0
    \reloset {\eqref{eq:def:peano_arithmetic/PA4}} =
    n + m
    \reloset {\eqref{eq:def:peano_arithmetic/PA4}} =
    n + (m + 0).
  \end{equation*}

  If \( k \neq 0 \), the proof follows directly from \eqref{eq:def:peano_arithmetic/PA1} as in the proof of commutativity.

  \SubProofOf[def:monoid]{identity} We have \( n + 0 = n \) by \eqref{eq:def:peano_arithmetic/PA4} and \( 0 + n = n \) by commutativity.

  \SubProofOf[def:magma/cancellative]{cancellation} Let \( n + k = m + k \). We will prove that \( n = m \) by induction. This is obvious for \( k = 0 \). For \( k \neq 0 \) we have
  \begin{equation*}
    n + s(p(k))
    =
    n + k
    =
    m + k
    =
    m + s(p(k)),
  \end{equation*}
  which by \eqref{eq:def:peano_arithmetic/PA5} is equivalent to \( s(n + p(k))) = s(m + p(k))) \).

  By \eqref{eq:def:peano_arithmetic/PA1}, we have \( n + p(k) = m + p(k) \). The inductive hypothesis implies that \( n = m \).

  \SubProofOf[def:zerosumfree]{zerosumfree} We will use induction on \( m \) in \( n + m = 0 \).
  \begin{itemize}
    \item If \( m = 0 \), then \( n + m = n \) by \eqref{eq:def:peano_arithmetic/PA4}, and hence \( n = 0 \).

    \item If \( m > 0 \), then \( n + m = s(n + p(m)) \) by \eqref{eq:def:peano_arithmetic/PA5}, and by \eqref{eq:def:peano_arithmetic/PA2}, \( n + m \neq 0 \).
  \end{itemize}

  Therefore, \( n + m = 0 \) if and only if \( n = m = 0 \).
\end{proof}

\begin{remark}\label{rem:natural_number_multiplication}
  \hyperref[rem:additive_magma/multiplication]{Multiplication in commutative monoids} (i.e. monoid exponentiation) is defined in \fullref{def:monoid/exponentiation} for a natural number and a monoid member. It just to happens that, by \fullref{thm:natural_number_addition_properties}, the natural numbers are themselves a monoid. We cannot rely on \fullref{thm:magma_exponentiation_properties}, however, if we want to avoid circular definitions and proofs.

  Having multiplication as part of the signature of \hyperref[def:peano_arithmetic]{Peano arithmetic} allows us to avoid this circularity.
\end{remark}

\begin{proposition}\label{thm:natural_number_multiplication_properties}
  The \hyperref[def:set_of_natural_numbers]{natural numbers} \( \BbbN \) with \hyperref[def:peano_arithmetic/mult]{multiplication} form a \hyperref[def:magma/commutative]{commutative} \hyperref[def:monoid]{monoid} with \( 1 \) as the identity.

  When combined with addition, the natural numbers become an \hyperref[def:entire_semiring]{entire} \hyperref[def:semiring/commutative]{commutative semiring}.

  This generalizes to \fullref{thm:ordinal_multiplication_algebraic_properties} and \fullref{thm:cardinal_multiplication_algebraic_properties}.
\end{proposition}
\begin{proof}
  \SubProofOf[def:monoid]{identity} Multiplication by \( 1 \) on the right preserves any natural number:
  \begin{equation*}
     n \cdot 1
     \reloset{\eqref{eq:def:peano_arithmetic/PA7}} =
     n \cdot 0 + n
     \reloset{\eqref{eq:def:peano_arithmetic/PA6}} =
     0 + n
     =
     n.
  \end{equation*}

  Multiplication from the left is handled by induction. Indeed, the case \( n = 0 \) is trivial and for nonzero \( n \) we have
  \begin{equation*}
     1 \cdot n
     \reloset{\eqref{eq:def:peano_arithmetic/PA7}} =
     1 \cdot p(n) + 1
     \reloset{\eqref{eq:def:peano_arithmetic/PA6}} =
     p(n) + 1
     =
     n.
  \end{equation*}

  \SubProofOf[def:semiring/left_distributivity]{distributivity} We will prove that \( (n + m)k = n \cdot k + n \cdot k \) with induction on \( k \).

  If \( k = 0 \),
  \begin{equation*}
    (n + m) \cdot 0
    \reloset{\eqref{eq:def:peano_arithmetic/PA6}} =
    0
    \reloset{\eqref{eq:def:peano_arithmetic/PA4}} =
    0 + 0
    \reloset{\eqref{eq:def:peano_arithmetic/PA6}} =
    n \cdot 0 + m \cdot 0.
  \end{equation*}

  For all nonzero \( k \), if the inductive hypothesis holds for \( p(k) \), then
  \begin{balign*}
    (n + m) \cdot k
    &\reloset*{\eqref{eq:def:peano_arithmetic/PA7}} =
    (n + m) + (n + m) \cdot p(k)
    \reloset {\T{ind.}} = \\ &=
    (n + m) + n \cdot p(k) + n \cdot p(k)
    = \\ &=
    (n + n \cdot p(k)) + (m + m \cdot p(k))
    \reloset{\eqref{eq:def:peano_arithmetic/PA7}} = \\ &=
    n \cdot k + m \cdot k.
  \end{balign*}

  \SubProofOf[def:magma/associative]{associativity} With distributivity proven, associativity of multiplication follows by induction. Indeed,
  \begin{equation*}
    (n \cdot m) \cdot k = n \cdot (m \cdot k)
  \end{equation*}
  is trivially satisfied for \( k = 0 \) and for all nonzero \( k \), whenever the inductive hypothesis holds for all \( n, m \in \BbbN \), it follows that
  \begin{balign*}
    (n \cdot m) \cdot k
    &\reloset*{\eqref{eq:def:peano_arithmetic/PA7}} =
    n \cdot m + (n \cdot m) \cdot p(k)
    \reloset {\T{ind.}} = \\ &=
    n \cdot m + n \cdot (m \cdot p(k))
    \reloset{\eqref{eq:def:semiring/left_distributivity}} = \\ &=
    n \cdot (m + m \cdot p(k))
    \reloset{\eqref{eq:def:peano_arithmetic/PA7}} = \\ &=
    n \cdot (m \cdot k).
  \end{balign*}

  \SubProofOf[def:magma/commutative]{commutativity} By induction on \( m \) we prove
  \begin{equation*}
    n \cdot m = m \cdot n.
  \end{equation*}

  The base case is trivial for nonzero \( m \), if \( n \cdot p(m) = p(m) \cdot n \) for all \( n \in \BbbN \), then
  \begin{equation*}
    n \cdot m
    \reloset{\eqref{eq:def:peano_arithmetic/PA7}} =
    n + n \cdot p(m)
    \reloset {\T{ind.}} =
    n + p(m) \cdot n
    \reloset{\eqref{def:semiring/left_distributivity}} =
    (1 + p(m)) \cdot n
    \reloset{\eqref{eq:def:peano_arithmetic/PA5}} =
    m \cdot n.
  \end{equation*}

  \SubProof{Proof of no zero divisors} We will now show that \( \BbbN \) has no zero divisors.

  If \( m = 0 \), then \( n \cdot m = 0 \) by \eqref{eq:def:peano_arithmetic/PA6}. If \( n = 0 \), then by induction on \( m \) we can easily show that \( n \cdot m = n \cdot p(m) + n = 0 + 0 = 0 \).

  Conversely, let \( n \cdot m = 0 \). By induction on \( m \), either \( m = 0 \) or we have \( n \cdot m = n \cdot p(m) + n \), in which case \eqref{eq:thm:natural_number_addition_properties/nonzero_sum} both \( n \cdot p(m) \) and \( n \) are zero. Thus, if we assume that \( m \neq 0 \), then we can conclude that \( n = 0 \).
\end{proof}

\begin{remark}\label{rem:natural_number_successor_via_addition}
  In \cite[1]{Peano1889}, Peano defined an \enquote{\( n \mapsto n + 1 \)} operation rather than a successor operation. It has since become common practice to instead define a \enquote{successor} operation, define addition and then show that the two are compatible:
  \begin{equation*}
    n + 1
    \reloset {\eqref{eq:def:peano_arithmetic/PA5}} =
    s(n + 0)
    \reloset {\eqref{eq:def:peano_arithmetic/PA4}} =
    s(n).
  \end{equation*}

  The predecessor operation then corresponds to integer subtraction by \( 1 \). We avoid subtraction in this subsection --- we are only interested in the fact that every nonzero natural number \( n \) has a predecessor \( m \) such that \( n = m + 1 \).

  It is dangerous to conflate \( n + 1 \) and \( s(n) \) until we have proved the familiar properties of addition. We have already done, so in \fullref{thm:natural_number_addition_properties}, however, and will further avoid mentioning directly the operations \( s(n) \) and \( p(n) \).

  See \fullref{rem:ordinal_successor_via_addition} for the more general case of ordinal addition.
\end{remark}

\begin{definition}\label{def:natural_number_ordering}
  Although this is sometimes stated as part of \logic{PA}, e.g. \cite[exmpl. 17.6]{OpenLogicFull}, we can define the familiar order \( \leq \) on the natural numbers via addition as the \hyperref[rem:predicate_formula]{predicate formula}
  \begin{equation}\label{eq:def:natural_number_ordering/predicate}
    \alpha \leq \beta \coloneqq \qexists \xi \parens[\Big]{ \alpha + \xi \doteq \beta }.
  \end{equation}

  We use the infix notation for convenience, however we do not assume that \( \leq \) is part of the language of \logic{PA} (as explained in \fullref{rem:first_order_formula_conventions/necessary_signature}).

  The following relation
  \begin{equation}\label{eq:def:natural_number_ordering/strict_predicate}
    \alpha < \beta \coloneqq \qexists {\xi \neq 0} \parens[\Big]{ \alpha + \xi \doteq \beta }.
  \end{equation}
  is then connected to \( \leq \) via \eqref{def:partially_ordered_set/compatibility_strict}.

  For the specific model of \logic{PA} based on the smallest inductive set \( \omega \), the latter relation \( < \) is equivalent to \( \in \) as discussed in \fullref{rem:ordinal_definition}.

  We will show in \fullref{thm:natural_numbers_are_well_ordered} that \( \BbbN \) is \hyperref[def:totally_ordered_set]{total ordered} (even \hyperref[def:well_ordered_set]{well-ordered}) with \( \leq \) as the nonstrict order and \( < \) as the strict order.
\end{definition}
\begin{proof}
  We will show that \( n < m \) if and only if \( n \leq m \) and \( n \neq m \).

  \SufficiencySubProof Assume that \( n < m \). Then there exists some nonzero \( a \) such that \( n + a = m \). In particular, we have \( n \leq m \). If we suppose that \( n = m \), then \( n + a = m \) and since addition is cancellative, it would follow that \( a = 0 \), contradicting the assumption that \( a \) is nonzero.

  Therefore, \( n \leq m \) and \( n \neq m \).

  \NecessitySubProof Assume that \( n \leq m \) and \( n \neq m \). Then there exists some \( a \) such that \( n + a = m \) If we suppose that \( a = 0 \), then we would obtain that \( n = m \), which would contradict our choice of \( n \) and \( m \).

  Therefore, \( n < m \).
\end{proof}

\begin{proposition}\label{thm:natural_numbers_are_well_ordered}
  The natural numbers are \hyperref[def:well_ordered_set]{well-ordered} by the relation \( < \) defined by \eqref{eq:def:natural_number_ordering/strict_predicate}.

  Furthermore, \( \BbbN \) is an \hyperref[def:ordered_semiring]{ordered semiring}. That is, the nonstrict order \( \leq \) is compatible with addition and multiplication.
\end{proposition}
\begin{proof}
  As discussed in \fullref{def:well_ordered_set}, in order to show that \( < \) well-orders \( \BbbN \), we only need to show that \( < \) is \hyperref[def:binary_relation/transitive]{transitive}, satisfies \hyperref[def:binary_relation/trichotomic]{trichotomy} and does not allow an infinitely descending chain.

  \SubProofOf[def:binary_relation/transitive]{transitivity} Let \( n < m \) and \( m < k \). Then there exist nonzero numbers \( a \) such that \( n + a = m \) and \( b \) such that \( m + b = k \). Thus, \( n + a + b = k \), which demonstrates that \( n \leq k \). Furthermore, because \( \BbbN \) is zerosumfree, it also follows that \( a + b \neq 0 \).

  Therefore, \( n < k \).

  \SubProofOf[def:binary_relation/trichotomic]{trichotomy} Let \( n \) and \( m \) be natural numbers.

  We have already shown in \fullref{def:natural_number_ordering} that due to \eqref{def:partially_ordered_set/compatibility_strict} the equality \( n = m \) holds if and only if neither \( n < m \) nor \( n > m \).

  Aiming at a contradiction, suppose that both \( n < m \) and \( n > m \) hold. There must exist nonzero numbers \( a \) and \( b \) such that \( n + a = m \) and \( n = m + b \). Then
  \begin{equation*}
    n = m + b = (n + a) + b.
  \end{equation*}

  Since addition is cancellative, we have \( a + b = 0 \). Therefore, \( n = m \), which as we have shown is incompatible with neither \( n < m \) nor \( n > m \).

  Therefore, at most one of the three conditions \( n = m \), \( n < m \) or \( n > m \) holds.

  We will use induction on \( m \) to show that at least one of the conditions hold. If \( m = 0 \), then either \( n = 0 \) and \( m = n \) or \( n \neq 0 \) and \( m < n \). Now suppose that the inductive hypothesis holds for \( m \). We will show that it also holds for \( m + 1 \).
  \begin{itemize}
    \item If \( n = m \), then clearly \( n < m + 1 \).
    \item If \( n < m \), then since \( m < m + 1 \) by transitivity of \( < \), we have \( n < m + 1 \).
    \item If \( n > m \), then there exists some nonzero \( a \) such that \( n = m + a \). If \( a = 1 \), then \( n = m + 1 \). If \( a \) is neither \( 0 \) nor \( 1 \), then \( n > m + 1 \).
  \end{itemize}

  \SubProofOf[def:well_founded_relation]{well-foundedness} We will show by induction on \( n \) that an infinitely descending chain ending at \( n \) cannot exist.

  If \( n = 0 \), by \eqref{eq:def:peano_arithmetic/PA2} \( n \) has no predecessor and thus there cannot exist a natural number \( m \) such that \( m < n \).

  Now assume that the inductive hypothesis holds for \( n \) and suppose that there exists an infinitely descending chain ending in \( n + 1 \):
  \begin{equation}\label{eq:thm:natural_numbers_are_well_ordered/descending_chain}
    \cdots < k < m < n + 1.
  \end{equation}

  If \( m = n \), it follows that
  \begin{equation*}
    \cdots < k < n
  \end{equation*}
  is an infinitely descending chain ending in \( n \).

  If \( m < n \), then
  \begin{equation*}
    \cdots < k < m < n
  \end{equation*}
  is again an infinitely descending chain ending in \( n \).

  By the inductive hypothesis, a chain ending at \( n \) cannot exist, therefore neither does \eqref{eq:thm:natural_numbers_are_well_ordered/descending_chain}.

  \SubProofOf[def:ordered_magma]{compatibility with addition} We will show that the nonstrict order is compatible with addition in \( \BbbN \). Let \( n \leq m \) and let \( k \) be an arbitrary natural number. Since \( n \leq m \), there exists a number \( a \) such that \( n + a = m \). Then
  \begin{equation*}
    m + k = (n + a) + k = (n + k) + a.
  \end{equation*}

  Therefore,
  \begin{equation*}
    n + k \leq m + k.
  \end{equation*}

  \SubProofOf[def:ordered_semiring]{compatibility with multiplication} If \( n \geq 0 \) and \( m \geq 0 \), then \( n \cdot m \geq 0 \) for the simple reason that all natural numbers are greater than or equal to zero.
\end{proof}

\begin{proposition}\label{thm:natural_number_divisibility_lattice}
  The semiring \hyperref[def:set_of_natural_numbers]{\( \BbbN \)} of natural numbers is a \hyperref[def:semilattice/bounded]{bounded lattice} with respect to \hyperref[def:divisibility]{semiring divisibility}. Explicitly:
  \begin{thmenum}
    \thmitem{thm:natural_number_divisibility_lattice/join} The \hyperref[def:semilattice/join]{join} of \( n \) and \( m \) is their \hyperref[def:gcd_and_lcm]{least common multiple} \( \lcm\set{ n, m } \) (defined via \fullref{alg:euclidean_algorithm} and \fullref{thm:gcd_and_lcm}).

    \thmitem{thm:natural_number_divisibility_lattice/bottom} The \hyperref[def:partially_ordered_set_extremal_points/top_and_bottom]{bottom element} is \( 1 \) since \( 1 \) divides every natural number.

    \thmitem{thm:natural_number_divisibility_lattice/meet} Dually, the \hyperref[def:semilattice/meet]{meet} of \( n \) and \( m \) is their \hyperref[def:gcd_and_lcm]{greatest common divisor} \( \gcd\set{ n, m } \) (defined via \fullref{alg:euclidean_algorithm}).

    \thmitem{thm:natural_number_divisibility_lattice/top} The \hyperref[def:partially_ordered_set_extremal_points/top_and_bottom]{top element} is \( 0 \) since every natural number divides \( 0 \).
  \end{thmenum}

  Furthermore, divisibility is compatible with the standard ordering in the sense that \( n \mid m \) implies \( n \leq m \).

  \begin{figure}
    \centering
    \includegraphics[page=1]{output/thm__natural_number_divisibility_order.pdf}
    \caption{A spatial \hyperref[def:hasse_diagram]{Hasse diagram} for a fragment of the \hyperref[thm:natural_number_divisibility_lattice]{natural number divisibility lattice}}
    \label{fig:thm:natural_number_divisibility_lattice/divisibility}
  \end{figure}

  \begin{figure}
    \centering
    \includegraphics[page=2]{output/thm__natural_number_divisibility_order.pdf}
    \caption{A comparison of the \hyperref[thm:natural_number_divisibility_lattice]{divisibility lattice} of \( \BbbN \) and the \hyperref[thm:semiring_of_ideals/lattice]{lattice of ideals} of \( \BbbZ \).}
    \label{fig:thm:natural_number_divisibility_lattice/ideals}
  \end{figure}
\end{proposition}
\begin{proof}
  By \fullref{thm:semiring_divisibility_order}, divisibility is a preorder.

  \SubProofOf[def:binary_relation/antisymmetric]{antisymmetry} If \( n \mid m \) and \( m \mid n \), there exist numbers \( a \) and \( b \) such that \( n = ay \) and \( m = bx \). Then \( n = abx \), and we can cancel \( n \) to obtain that \( ab = 1 \). But \( 1 \) is the only unit in \( \BbbN \), hence \( a = b = 1 \), and thus \( n = m \).

  \SubProofOf[def:semilattice/lattice]{lattice structure} By \fullref{alg:euclidean_algorithm}, every pair of integers has a positive greatest common divisor, and also a least common multiple.

  By \fullref{thm:def:semiring_ideal/division}, the lattice of principal ideals in \( \BbbN \) must be dual to it. Indeed, by \fullref{thm:bezouts_identity}, we have that
  \begin{equation*}
    \braket{n} + \braket{m} = \braket{ \gcd(n, m) },
  \end{equation*}
  and by \fullref{thm:def:semiring_ideal/division}, \( \braket{n} \cap \braket{m} \) contains the common multiples of \( n \) and \( m \), hence
  \begin{equation*}
    \braket{n} \cap \braket{m} = \braket{ \lcm(n, m) }.
  \end{equation*}

  \SubProof{Proof that the order are compatible} If \( n \mid m \), then there exists a positive natural number \( a \) such that \( an = m \). We have
  \begin{equation*}
    an
    \reloset{\eqref{eq:def:peano_arithmetic/PA7}} =
    (a - 1)n + n
    =
    m.
  \end{equation*}

  Thus, by \eqref{eq:def:natural_number_ordering/predicate}, \( n \leq m \).
\end{proof}