\documentclass[]{article}
\usepackage[margin=1.0in]{geometry}
\usepackage{amssymb}

%title material
\title{Astronomy 400B Final Review}
\author{Brant Robertson}
\date{May, 2015}

%include latex definitions
\input{astro400B_definitions.tex}

%begin the document
\begin{document}

%make the title, goes after document begins
\maketitle

%first section
\section{Lecture 1: Stellar Mass, Luminosity, Flux, Radius, and Temperature}
Stellar masses are often expressed in terms of a {\it solar mass} ($\Msun$; mass of the Sun)
\begin{equation}
1\Msun = 1.9891\times10^{33}\g
\end{equation}
\noindent
in grams ($\g$). The most massive stars are $\approx100\Msun$ while the
least massive stars are $\approx0.075\Msun$.

Stellar luminosities (ergs of energy emitted per second; $1\erg = 1~\g~\cm^{2}~\s^{-2}$) are also
often expressed in terms of the total (bolometric) {\it solar luminosity} ($\Lsun$; luminosity of the Sun)
\begin{equation}
1\Lsun = 3.846\times10^{33} \erg~\s^{-1}
\end{equation}
\noindent
Stars range in luminosity from $10^{6}\Lsun$ to less than $10^{-4}\Lsun$.

The {\it flux} $F$ is the energy per unit second per unit area ($\erg~\s^{-1}~\cm^{-2}$)
that is received from an object a distance $d$ away, and is
given by the {\it inverse square law}
\begin{equation}
\label{eqn:inverse_square}
F = \frac{L}{4\pi d^{2}}.
\end{equation}
\noindent

The {\it flux density} ($\Fnu \equiv dF/d\nu$) of an object is best measured in {\it janskys}
\begin{equation}
1\Jy = 10^{-23} \erg~\s^{-1}~\cm^{-2}~\Hz^{-1}.
\end{equation}
\noindent
Note that the {\it hertz} ($1\Hz = 1 s^{-1}$) is the unit of frequency $\nu$.
Astronomers will also use a flux density ($\Flambda = dF/d\lambda$)
defined relative to wavelength. Typically, the units of $\Flambda$
are in $\erg~\cm^{-2}~\s^{-1}~\Ang^{-1}$, where $\Ang$ is the {\it angstrom}
($1\Ang = 10^{-8}\cm$). The wavelength and frequency of light are related by
$c = \nu \lambda$, and the two flux densities are therefore
related by $\Flambda = (c/\lambda^2)\Fnu$.
The total flux is related to the flux density by
\begin{equation}
F = \int \Fnu d \nu = \int \Flambda d\lambda.
\end{equation}
\noindent
If the distance of an object is known, astronomers will also use the term
{\it luminosity density} (e.g., $\Lnu = dL/d\nu$).

The luminosity, radius, and temperature of an object are related. For stellar
objects, we often use the {\it solar radius} ($\Rsun$) to express sizes
\begin{equation}
1\Rsun = 6.995 \times 10^{10} \cm
\end{equation}
\noindent
If the luminosity $L$ and radius $R$ of an object are known, we can define
the effective temperature $T$ in {\it Kelvin} ($K$)
of an object through the {\it Stefan-Boltzmann Law}
\begin{equation}
L = 4\pi R^{2}\sigmaSB T^{4}
\end{equation}
\noindent
where the {\it Stefan-Boltzmann constant} is
\begin{equation}
\sigmaSB = 5.670373\times10^{-5} \erg~\cm^{-2}~\s^{-1}~\K^{-4}.
\end{equation}
The Stefan-Boltzmann constant can be computed theoretically in
terms of the speed of light, the {\it Boltzmann constant}
\begin{equation}
\kB = 1.380658\times10^{-16} \erg~\K^{-1}
\end{equation}
\noindent
and the {\it Planck constant}
\begin{equation}
h = 6.6260755\times10^{-27}\erg~\s,
\end{equation}
\noindent
which gives the definition
\begin{equation}
\sigmaSB \equiv \frac{2\pi^5 \kB^4}{15 h^3 c^2}.
\end{equation}

The effective temperature is typically a measure of the temperature
of the star at its {\it photosphere}, or the radius where the optical
depth of the star's atmosphere is $\tau\approx1$ and it becomes opaque.
For the Sun,
$T\approx5780\K$. The temperature is also related to the wavelength
at the peak of the black body curve via {\it Wien's Displacement Law}
\begin{equation}
\lambda_{\mathrm{max}} = \frac{2.897756\times10^{7} \Ang~\K}{T},
\end{equation}
which gives $\lambda_{\mathrm{max}}\approx5000\Ang$ (yellow)
for the Sun.

\section{Lecture 2: Extinction}

Dust absorbs and scatters optical light, and we can describe
the rate at which light is absorbed as it travels along the
$x$ direction through the differential relation
\begin{equation}
\frac{d\Flambda}{dx} = - \kappa_{\lambda} \Flambda
\end{equation}
\noindent
where $\kappa_{\lambda}$ is the {\it opacity}. This relation
has a simple solution
\begin{equation}
\Flambda(x) = \Flambda(x=0)\exp\left(-\int_{0}^{x} \kappa_{\lambda} dx'\right)
\end{equation}
\noindent
where we can define the optical depth
\begin{equation}
\tau = \int_{0}^{x} \kappa_{\lambda} dx'
\end{equation}
\noindent
In the limit of pure absorption, a system is {\it optically thick}
when $\tau = 1$ and $\Flambda = \Flambda(x=0)/e$. For
optical light, interstellar dust has approximately $\kappa_{\lambda}\propto1/\lambda$.

\section{Lecture 3: Galaxy Luminosity Function}

We can count the number density of galaxies as a function of their luminosity,
and we appropriately call this distribution the {\it luminosity function}. The
galaxy luminosity function has been found to have a shape close to a parameterized
form called the {\it Schechter} function (after Paul Schechter).  The Schechter
function provides the number density of galaxies in a differential luminosity bin
$dL$ as
\begin{equation}
\label{eqn:schechter_function_luminosity}
\Phi(L)dL = \phi_{\star} \left(\frac{L}{L_{\star}}\right)^{\alpha}\exp\left(-\frac{L}{L_{\star}}\right)\frac{dL}{L_{\star}}
\end{equation}
\noindent
where $L_{\star}$ is a characteristic luminosity of galaxies and $\phi_{\star}$ is
a typical abundance.  Below $L_\star$, the luminosity function is a power law, and
above $L_\star$ the abundance of galaxies drops exponentially. Sometimes, astronomers
will use $1+\alpha$ as the power law exponent, so beware!

{\bf See Figure 1.16 of Sparke and Gallagher.}

It happens to be the case that $L_{\star}\approx2\times10^{10}\Lsun$, which is close
to the luminosity of the Milky Way. The typical abundance of galaxies is $\phi_\star\approx7\times10^{-3}\Mpc^{-3}$. The faint-end slope of the 2DF luminosity function is $\alpha=-0.46$.
Defined as in Equation \ref{eqn:schechter_function_luminosity}, the number of galaxies
diverges as $L\to0$ if $\alpha<-1$.

The total luminosity density provided by galaxies can be found by integrating
Equation \ref{eqn:schechter_function_luminosity} as
\begin{equation}
\rho_{L} = \int_{0}^{\infty} \Phi(L) L dL = \phi_\star L_{\star} \Gamma(\alpha + 2)
\end{equation}
\noindent
where $\Gamma$ is the Gamma function, which for an integer $n$ is $\Gamma(n) = (n-1)!$.
It turns out that $\Gamma(1.5)\approx0.886227$, so we have that
$\rho_{L}\approx1.25\times10^{8}\Lsun\Mpc^{-3}$.

For a partial integral, we have
\begin{equation}
\rho_{L}(L>L_{\mathrm{min}}) = \int_{L_{\mathrm{min}}}^{\infty} \Phi(L) L dL = \phi_\star L_{\star} \Gamma(\alpha + 2, L_{\mathrm{min}}/L_{\star}),
\end{equation}
\noindent
where $\Gamma(a,x)$ is the incomplete gamma function.

\section{Lecture 4: Recombination and the Ionization State of the ISM}

Ionized hydrogen (proton plus electron) can undergo a recombination
to form neutral hydrogen. The rate of this process depends on the
properties of the ionized gas.  We can write the recombination rate
$dn_e/dt$ that changes the number density $n_e$ of free electrons as
\begin{equation}
\frac{d n_{e}}{d t} = n_{e}^2 \alpha(T_e)
\end{equation}
\noindent
where $T_e$ is the temperature of the gas and $\alpha(T_e)$ is
the ``recombination coefficient''
\begin{equation}
\alpha(T_e) \approx 2 \times 10^{-13} \left( \frac{T_e}{10^4~\K}\right)^{-3/4}~\cm^{3}~\s^{-1}.
\end{equation}
\noindent
There's a lot hidden in the coefficient!

We can also define the recombination time $t_{rec}$ that characterizes
the timescale over which the ionized gas will significantly increase
its neutrality.  The recombination time is given by
\begin{equation}
t_{rec} = \frac{n_e}{|dn_e/dt|} = \frac{1}{n_e \alpha(T_e)} \approx 1500~\yr \times \left(\frac{T_e}{10^{4}K}\right)^{3/4}\left(\frac{100~\cm^{-3}}{n_e}\right)
\end{equation}

In HII regions, $t_{rec}$ is a few thousand years.  In the diffuse ionized ISM, the recombination time is a few million years.

\subsection{Cooling Rate and Time}

Gas has an internal thermal energy of $E \propto nT$. If the gas radiates this thermal energy with an energy $L$, the
cooling timescale for the gas is $t_{cool} \propto nT/L$. For optically thin gas, we can write
\begin{equation}
L = n^{2} \Lambda(T)
\end{equation}
\noindent
and
\begin{equation}
t_{cool}  \propto T/[n\Lambda(T)].
\end{equation}
The quantity $\Lambda(T)$ is called the ``cooling function'' and depends only on temperature.

{\bf See Table 2.5 and Figure 2.25 of Sparke and Gallagher.}

At high temperatures $T>10^{7}~\K$, free-free cooling dominates such that $\Lambda(T) \propto T^{1/2}$
and $t_{cool} \propto \sqrt{T}/n$.

\section{Lecture 5: Poisson's Equation}

Take the potential and apply the Laplacian operator
\begin{equation}
\nabla^{2} \equiv \nabla \cdot \nabla = \left[\frac{\partial^{2}}{\partial x^{2}}+\frac{\partial^{2}}{\partial y^{2}}+\frac{\partial^{2}}{\partial z^{2}}\right]
\end{equation}
\noindent
to both sides.  Remembering that the operator acts on $\vx$ and not $\vx'$, we have
\begin{equation}
\label{eqn:pois_init}
\nabla^{2} \Phi(\vx) = - \int G \rho(\vx') \nabla^{2} \left(\frac{1}{|\vx-\vx'|}\right)d^{3}\vx'.
\end{equation}
\noindent
We can evaluate this by noting that
\begin{equation}
\label{eqn:nabla}
\nabla\left(\frac{1}{|\vx - \vx'|}\right) = -\frac{\vx-\vx'}{|\vx-\vx'|^3}, \nabla^{2}\left(\frac{1}{|\vx - \vx'|}\right) = 0.
\end{equation}
\noindent
So we conclude that outside of a very small region around $\vx$, $\nabla^{2}\Phi(\vx)=0$.
Let's take a spherical region $S(\epsilon)$ of radius $\epsilon$ centered on $\vx$. In proceeding, let's
note that
\begin{equation}
\nabla^{2} f(|\vx-\vx'|) = \nabla_{\vx'}^{2} f(|\vx-\vx'|)
\end{equation}
\noindent
for any function $f(|\vx - \vx'|)$. If we take $\epsilon$ to be small enough such
that $\rho(\vx)\approx$ a constant, then we can write
\begin{eqnarray}
\label{eqn:pois_med}
\nabla^{2}\Phi(\vx) &\approx& - G\rho(\vx) \int_{S(\epsilon)} \nabla^2 \left( \frac{1}{|\vx - \vx'|} \right)d^{3}\vx' \nonumber \\
&=& - G \rho(\vx)  \int_{S(\epsilon)} \nabla_{\vx'}^2 \left( \frac{1}{|\vx - \vx'|} \right)d V'.
\end{eqnarray}
\noindent
Now we get to use the {\it divergence} theorem
\begin{equation}
\int \nabla^{2} f dV = \oint \nabla f \cdot dS,
\end{equation}
\noindent
which allows us to write Equation \ref{eqn:pois_med} as
\begin{equation}
- G \rho(\vx)  \int_{S(\epsilon)} \nabla_{\vx'}^2 \left( \frac{1}{|\vx - \vx'|} \right)d V' = - G \rho(\vx) \oint_{S(\epsilon)} \nabla_{\vx'}\left(\frac{1}{|\vx-\vx'|}\right) \cdot d\vS'
\end{equation}
\noindent
By applying Equation \ref{eqn:nabla} and the identity $\nabla_{\vx'} f = -\nabla f$, we have
\begin{eqnarray}
- G \rho(\vx) \oint_{S(\epsilon)} \nabla_{\vx'}\left(\frac{1}{|\vx-\vx'|}\right) \cdot d\vS' &=&
-G \rho(\vx) \oint_{S(\epsilon)} \left(\frac{\vx-\vx'}{|\vx-\vx'|^{3}}\right) \cdot d\vS' \nonumber \\
&=& 4 \pi G \rho(\vx)
\end{eqnarray}

\section{Lecture 6: Distribution Function}

The {\it distribution function} $f(\vx,\vv,t)$ gives the probability density
in six-dimensional {\it phase space} $(\vx,\vv)$ of having an object
in the volume $d\vx d\vv$.  The number density $n(\vx,t)$ of objects is the
volume integral of the distribution function
\begin{equation}
n(\vx,t) = \int_{-\infty}^{\infty}\int_{-\infty}^{\infty}\int_{-\infty}^{\infty} f(\vx,\vv,t) dv_{x}dv_y,dv_z.
\end{equation}
\noindent
We can use this expression to define moments of the velocity distribution, such as
the average velocity
\begin{equation}
\ave{\vv(\vx,t)} = \frac{1}{n(\vx,t)} \int_{-\infty}^{\infty}\int_{-\infty}^{\infty}\int_{-\infty}^{\infty} \vv f(\vx,\vv,t) dv_{x}dv_y,dv_z.
\end{equation}

For a collisionless system where objects cannot be created or destroyed, the number density of objects
in a given volume will follow the continuity equation
\begin{equation}
\label{eqn:continuity}
\frac{\partial n}{\partial t} + \frac{\partial (nv)}{\partial x} = 0.
\end{equation}
\noindent
This equation simply describes the mass conservation of objects, such that
the time rate of change of the number density is balanced by the advection of
spatial gradients in the number density.

The {\it collisionless Boltzmann equation} that describes the probability density
of objects in phase space is more complicated because it must describe a time variation
in the velocity as well as the spatial coordinates.  In one dimension, we have that
\begin{equation}
\frac{\partial f}{\partial t} + v\frac{\partial f}{\partial x} + \frac{dv}{dt}(x,v,t) \cdot \frac{\partial f}{\partial v} = 0
\end{equation}
\noindent
The acceleration of an object will only depend on position in a background potential, so
we have that $dv/dt = -\partial \Phi/\partial x$, and
\begin{equation}
\label{eqn:boltzmann}
\frac{\partial f}{\partial t} + v \frac{\partial f}{\partial x} - \frac{\partial \Phi}{\partial x}(x,t)\cdot \frac{\partial f}{\partial v} = 0.
\end{equation}
\noindent
In three dimensions, we can write
\begin{equation}
\label{eqn:bvec}
\frac{\partial f(\vx, \vv, t)}{\partial t} + \vv \cdot \nabla f - \nabla \Phi \cdot \frac{\partial f}{\partial \vv} = 0.
\end{equation}
\noindent
We usually don't deal with this equation in this form, but often will take moments with respect to
e.g., velocity
\begin{equation}
\frac{\partial n(x,t)}{\partial t} + \frac{\partial}{\partial x}[n(x,t)\ave{v(x,t)}] - \frac{\partial \Phi}{\partial x}(x,t)[f]_{-\infty}^{\infty} = 0
\end{equation}
\noindent
The last term will be zero if $f$ is well behaved, and we get back Equation \ref{eqn:continuity}.

If we integrate Equation \ref{eqn:boltzmann} multiplied by $v$, we instead find
\begin{equation}
\frac{\partial}{\partial t}[n(x,t)\ave{v(x,t)}] + \frac{\partial}{\partial x}[n(x,t)\ave{v^2(x,t)}] = - n(x,t) \frac{\partial \Phi}{\partial x}
\end{equation}
\noindent
If we define the velocity dispersion as
\begin{equation}
\ave{v^2(x,t)} = \ave{v(x,t)}^2 + \sigma^2,
\end{equation}
\noindent
apply this definition, and then divide by $n(x,t)$, we have
\begin{equation}
\label{eqn:v_ave}
\frac{d\ave{v}}{dt} + \ave{v}\frac{\partial \ave{v}}{\partial x} = -\frac{\partial \Phi}{\partial x} - \frac{1}{n}\frac{\partial}{\partial x}[n\sigma^2(x,t)].
\end{equation}

\section{Lecture 7: A Simple Example of the Tidal Limit}

Consider the satellite to have mass $m$ and the main galaxy to have mass $M$, separated by distance $D$,
orbiting the center of mass $C$ with angular speed $\Omega$.  Take $x$ as the coordinate
along the ray between $m$ toward $M$.  The center of mass is then at $x=DM/(M+m)$.  The
effective potential is then
\begin{equation}
\Phieff(x) = -\frac{GM}{|D-x|} -\frac{Gm}{|x|} - \frac{\Omega^2}{2}\left(x-\frac{DM}{M+m}\right)^2.
\end{equation}

The effective potential has three maxima known as the {\it Lagrange points}, [$L_1$, $L_2$, $L_3$].  Let's find them by setting
the derivative of the effective potential to zero.
\begin{equation}
\label{eqn:find_phieff_max}
\frac{\partial\Phieff}{\partial x} = 0 = -\frac{GM}{(D-x)^2} \pm \frac{Gm}{x^2} - \Omega^2\left(x-\frac{DM}{M+m}\right)
\end{equation}
\noindent
The acceleration $\Omega^2DM/(M+m)$ of $m$ as it circles $C$ owes to the gravitational
attraction of $M$. We can then write
\begin{equation}
\Omega\frac{DM}{M+m}=\frac{GM}{D^2},~~\mathrm{so}~\Omega^2=\frac{G(M+m)}{D^3}
\end{equation}
\noindent
If the satellite is much less massive than the main galaxy, $L_1$ and $L_2$ will lie close to $m$.
Substitute $\Omega^2$ into Equation \ref{eqn:find_phieff_max}, and expand in powers of $x/D$ to find
\begin{equation}
0 \approx -\frac{GM}{D^2} - 2\frac{GM}{D^3}x \pm \frac{Gm}{x^2} - \frac{G(M+m)}{D^3}\left(x-\frac{DM}{M+m}\right)
\end{equation}
\noindent
At the Lagrange points $L_1$ and $L_2$ we have
\begin{equation}
x = \pm r_J, ~~\mathrm{where}~r_J = D\left(\frac{m}{3M+m}\right)^{1/3}
\end{equation}
\noindent
Stars that cannot stray further from the satellite than $r_J$, the {\it Jacobi radius} or {\it Roche limit},
will remain bound to it.  The radius $L_1$ is not where the gravitational force from the satellite and
main galaxy are the same, but where the effective potential has a minimum and lies further from the satellite.
This radius is also where expanding stars lose mass to their companion.

When $M\gg m$, then the mean density within $r_J$ is three times the mean density within $D$ of the main galaxy.
A star orbiting the satellite near $r_J$ will have an orbital period comparable to the orbit period of the
satellite around the main galaxy.

When satellites are not on circular orbits, the relevant $r_J$ is determined at the pericenter. If the
satellite is orbiting within the dark matter halo of the main galaxy, the relevant radius is
\begin{equation}
r_J = D\left[\frac{m}{2M(<D)}\right]^{1/3}
\end{equation}
where $M(<D)$ is the mass within D.

What's the Jacobi radius of the LMC-Milky Way system? The LMC is at a distance of $\sim50\kpc$ where
the speed of a circular orbit is about the same as it is at the solar circle, or about $\sim200\km~\s^{-1}$.
The mass of the Milky Way within the LMC's orbit is about $5\times10^{11}\Msun$.  The LMC mass is about
$10^{10}\Msun$, so we have
\begin{equation}
r_J\approx 50\kpc~\times~\left(\frac{10^{10}\Msun}{2\times5\times10^{11}\Msun}\right)^{1/3} \approx 11\kpc.
\end{equation}
The LMC disk lies within this radius, but the SMC is too far away to stay bound to the LMC.

\section{Lecture 8: Rotation Curve}

For a galaxy at a systemic velocity $V_{sys}$ inclined at an angle $i$ to face-on, the rotation curve we measure as a function of radial distance $R$ and azimuth $\phi$ is
\begin{equation}
V_r(R,i) = V_{sys} + V(R)\sin i \cos \phi
\end{equation}
\noindent
so to determine $V(R)$ we must determine the inclination and perhaps determine an angular average over azimuth.

In determining the rotation curve, we are often trying to weigh the galaxy.  This is straightforward to do in
some limiting cases.

For a thin exponential disk that supplies its own gravity, the rotation curve can be written in terms of Bessel
functions as
\begin{equation}
V^2(R) = 4\pi G \Sigma_0 h_R y^2 [I_0(y) K_0(y) - I_1(y) K_1(y)]
\end{equation}
\noindent
where $\Sigma_0$ is the central mass surface density, $y\equiv R/2h_R$,
 and $I$ and $K$ are modified Bessel functions (mind the subscript!). We can
relate this to the total disk mass $M_d = 2\pi\Sigma_0 h_R^2$, such that
\begin{equation}
V^2(R) = \frac{2GM_d}{h_R}f(y).
\end{equation}

Otherwise, if we examine the regions of a disk where the dark halo dominates the potential, than we can just use
the radial force equation
\begin{equation}
\frac{V^2(R)}{R} = \frac{GM(<R)}{R^2}
\end{equation}
\noindent
to estimate the interior mass from the rotation curve.

\section{Lecture 9: Fundamental Relations of Elliptical Galaxies}

There is a correlation between elliptical galaxy luminosity and
velocity dispersion called the Faber-Jackson relation
\begin{equation}
\frac{L_V}{2\times10^{10}\Lsun} \approx \left( \frac{\sigma}{200~\km~\s^{-1}}\right)^{4}.
\end{equation}

There is another relation called the {\it Fundamental Plane} that
connects the effective radius, surface brightness within the effective
radius, and velocity dispersion as
\begin{equation}
\Reff \propto \sigma^{1.2} I_{e}^{-0.8}.
\end{equation}
Note that expectations would suggest $\Reff \propto \sigma^2 I_{e}^{-1}$.

\section{Lecture 10: Dynamical Friction}

One of the most important phenomena in groups and clusters is
{\it dynamical friction}, which is the process by which the
galaxies in groups and clusters lose energy and angular momentum
to the surrounding sea of dark matter and stars in the intragroup
or intracluster medium. Dynamical friction causes galaxies to ``sink''
to the central regions of the group or cluster and thereby be
assimilated into the larger system.  So how does this process work?

As with the impluse approximation we studied before, consider a
{\it galaxy} of mass $M$ moving past a star (or clump of dark matter)
with a mass $m$ at an impact parameter $b$.  During the passage, the
galaxy has a change of velocity in the direction perpendicular to the
direction motion of
\begin{equation}
\Delta V_{\perp} = \frac{2Gm}{bV}.
\end{equation}
\noindent
This equation applies when the impact parameter $b$ is larger than the
size of the galaxy with mass $M$, and when the velocity $V$ is large
enough at separation $b$ such that $\Delta V_{\perp}\ll V$.  We then
require that
\begin{equation}
b \gg \frac{2G(M+m)}{V^2} \equiv 2 r_s.
\end{equation}
\noindent
Note this radius differs from the strong encounter radius we used
previously because $M\ne m$ in this case.

The perturber must obtain an equal and opposite momentum, so the
total kinetic energy in the perpendicular motion becomes
\begin{equation}
\Delta KE_{\perp} = \frac{M}{2}\left(\frac{2Gm}{bV}\right)^2 + \frac{m}{2}\left(\frac{2GM}{bV}\right)^2 = \frac{2G^2mM(M+m)}{b^2 V^2}.
\end{equation}
\noindent
The smaller object acquires most of the energy, which must be depleted from the motion by an amount $\Delta V_{\parallel}$ of the
larger object.  Once the galaxy and the perturber are far away (and before the encounter) the kinetic energies
before and after the encounter must be the same.  We then have that
\begin{equation}
\frac{M}{2}V^2 = \Delta KE_{\perp} + \frac{M}{2}(V + \Delta V_{\parallel})^2 + \frac{m}{2}\left(\frac{M}{m} \Delta V_{\parallel} \right)^2
\end{equation}
\noindent
If we take $\Delta V_{\parallel} \ll V$, then the terms proportional to $\Delta V_{\parallel}^2$ are very small and
can be ignored.  We can then find the amount by which each perturber reduces the velocity of the galaxy with
mass $M$ as
\begin{equation}
- \Delta V_{\parallel} \approx \frac{\Delta KE_{\perp}}{M V} = \frac{2G^2 m(M+m)}{b^2 V^3}.
\end{equation}

OK, now what if there are a number density per cubic parsec $n$ perturbers of mass $m$?
We then have to integrate through the cylinder of radius $b$ to find the total
effect on the galaxy of mass $M$.  We find that
\begin{equation}
-\frac{dV}{dt} = \int_{b_{\mathrm{min}}}^{b_{\mathrm{max}}} n V \frac{2G^2 m (M+m)}{b^2 V^3} 2\pi b db = \frac{4\pi G^2(M+m)}{V^2} n m \ln \Lambda
\end{equation}
\noindent
where $\Lambda\equiv b_{\mathrm{max}}/b_{\mathrm{min}}$.

Some interesting things to note
\begin{enumerate}
\item The slower the galaxy $M$ moves, the larger its deceleration.
\item If $V\ll\sigma$, where $\sigma$ is the velocity dispersion of perturbers, we find that $dV/dt\propto -V$.  This is the same as what happens to a parachutist.
\item The net effect is to lower the total kinetic motions of the galaxies over time.
Before the encounter, the kinetic energy of one of the galaxies is
\begin{equation}
E_0 = KE_0 + PE_0 = - KE_0
\end{equation}
\noindent
since the potential energy is $ PE_0 = - 2KE_0$ in virial equilibrium.
Dynamical friction increases the energy in random motions and the internal kinetic
energy by $\Delta KE$.  After the system again reaches virial equilibrium,
the kinetic energy is less than before
\begin{equation}
KE_1  = - (E_0 + \Delta KE) = KE_0 - \Delta KE
\end{equation}
\noindent
Stars that gain the most kinetic energy are ejected.
\item Groups have lower relative velocties, so the dynamical
friction should operate more efficiently.
\end{enumerate}

\section{Lecture 10: Gravitational Lensing}

Einstein predicted that light passing a distance $b$
past a mass $M$ would be deflected by an angle
\begin{equation}
\label{eqn:alpha_grav_lens}
\alpha \approx \frac{4GM}{bc^2} = \frac{2R_s}{b}
\end{equation}
\noindent
where $R_s = 2 GM/c^2$ is the {\it Schwarzschild radius}.
For the Sun, $R_s\sim3~\km$. The approximation
holds only for small deflections $\alpha\ll1$.
Note this is exactly twice the deflection determined by
the impluse approximation.

{\bf Show figure 7.14 of SG.}

Without the lense $L$, the object would appear at an angle
$\beta = y/d_{S}$ as long as $d_{S} \gg y$.
The light is bent by $\alpha$, so the object instead appears
at an angle $\theta \approx x/d_S$ (for $d_S \gg x$).
When the bending is small $x-y = \alpha d_{LS}$.
The impact parameter in the lens plane is $b = \theta d_{L}$
as long as $d_S \gg b$.

If we divide Equation \ref{eqn:alpha_grav_lens} by $d_S$
we find
\begin{equation}
\theta - \beta = \frac{\alpha d_{LS}}{d_S} = \frac{1}{\theta} \frac{4 GM}{c^2} \frac{d_{LS}}{d_L d_S} \equiv \frac{1}{\theta} \theta_E^2
\end{equation}
\noindent
where $\theta_E$ is called the {\it Einstein radius}.
We have a quadratic relation between the angular distance $\theta$ between
$L$ and the object's position as
\begin{equation}
\theta^2 - \beta \theta - \theta_E^2 = 0,~\mathrm{so}~\theta_{\pm} = \frac{\beta \pm \sqrt{\beta^2 + 4 \theta_E^2}}{2}.
\end{equation}
\noindent
A star directly behind the lense with $\beta=0$ will be seen as a circle
on the sky with radius $\theta_E$.  When $\beta>0$, the image at $\theta_{+}$
is further away from the lense with $\theta_{+}>\beta$ and is outside
the Einstein radius with $\theta_{+}>\theta_E$ (these were the images
seen in the Sun's lensing).  The image at $\theta_{-}$ is inverted, on
the other side of the lens, and is within the Einstein radius.

Stars in the disk plane of the Milky Way will lense each other.  We
often cannot resolve the lense and the source separately, but we will
see the magnification of the star -- we call this microlensing.

Gravitational lensing leaves the surface brightness unchanged by increases
the area of an extended source on the sky.  The increase of the apparent
brightness is then just proportional to the increase in the area.

{\bf Show figure 7.15 of SG.}

Consider an annulus of width $S'$ centered on $L$ between
radius $y$ and $y+\Delta y$.  An image $I$ of
$S'$ occupies the same angle $\delta \Phi$ but the distance
from the center is expanded or contracted as $x/y = \theta/\beta$
while $\delta x/\delta y= d\theta/d\beta$.  The ratio of the areas
is
\begin{equation}
\frac{A_{\pm}(image)}{A(source)} = \left| \frac{\theta}{\beta}\frac{d\theta}{d\beta}\right| = \frac{1}{4}\left( \frac{\beta}{\sqrt{\beta^2 + 4 \theta_E^2}} + \frac{\sqrt{\beta^2 + 4 \theta_E^2}}{\beta}\pm 2 \right)
\end{equation}
\noindent
The image at $\theta_{+}$ is always brighter than the source and is stretched in the
tangential direction.  The closer image is dimmer unless
\begin{equation}
\beta^2 < (3-2\sqrt{2})\theta_E^2 / \sqrt{2}
\end{equation}
\noindent
or
\begin{equation}
\beta \lesssim 0.348 \theta_E.
\end{equation}

\section{Lecture 11: Expansion History}

The rate of expansion is determined by the gravitational effects
of the energy densities it contains.  We can model the expansion
using Newtonian physics first, and then use general relativity
to revise for a more correct answer.

Consider a sphere of radius $r$ at time $t$ when the
universe has a typical density $\rho(t)$, and assume
$r$ is much less than any curvature radius in the
universe.  Assuming symmetry about $r=0$, the
gravitational force at radius $r$ is just supplied by the
mass within the sphere.  If the sphere
is large enough that pressure forces are small, then
the force on a object of mass $m$ at radius $r$ is
\begin{equation}
m \frac{d^2 r}{dt^2} = - \frac{G m M(<r)}{r^2} = - \frac{4\pi Gm}{3}\rho(t)r.
\end{equation}
\noindent
The radius of the sphere of matter is expanding with the
rest of the universe, so $r\propto R(t)$.  The mass of the
cloud cancels, such that
\begin{equation}
\label{eqn:friedman_A}
\ddot{R}(t) = - \frac{4\pi G}{3} \rho(t) R(t).
\end{equation}
\noindent
The mass doesn't change, so $\rho(t) R(t)$ is a constant.
We can multiply by $\dot{R}(t)$ to find
\begin{equation}
\frac{1}{2} \frac{d}{dt}[\dot{R}^2(t)] = - \frac{4 \pi G}{3} \frac{\rho(t_0)R^3(t_0)}{R^2(t)} \dot{R}(t)
\end{equation}
\noindent
where $t_0$ is the present day.  We then integrate to find
\begin{equation}
\label{eqn:friedman_B}
\dot{R}^2(t) = \frac{8\pi G}{3}\rho(t) R^2(t) - kc^2
\end{equation}
\noindent
where $k$ is a constant of integration.  Turns out Equation
\ref{eqn:friedman_B} is valid in GR, and tells us
that $k$ is the same constant as in the metric.

We appeal to thermodynamics to tell us that
as heat $\Delta Q$ flows into a volume $V$ its
internal energy $E$ must increase, or it expands
and does work against pressure
\begin{equation}
\Delta Q = \Delta E + p \Delta V = V \Delta(\rho c^2) + (\rho c^2 + p)\Delta V
\end{equation}
\noindent
where $\rho$ includes all the forms of matter and energy.
But no volume $V$ gains heat at the expense of another and
\begin{equation}
\Delta Q = 0 = \Delta \rho + \left(\rho + \frac{p}{c^2}\right)\frac{\Delta V}{V}
\end{equation}
\noindent
or
\begin{equation}
\frac{d\rho}{dt} = - c \frac{\dot{R}(t)}{R(t)}\left( \rho + \frac{p}{c^2}\right)
\end{equation}
\noindent
Differentiating Equation \ref{eqn:friedman_B} and substituting for $d\rho/dt$
yields
\begin{equation}
\label{eqn:friedman_C}
\ddot{R}(t) = - \frac{4\pi G}{3} R(t) \left[ \rho(t) + \frac{3p(t)}{c^2}\right]
\end{equation}
\noindent
So in GR, the pressure $p$ adds to the gravitational attraction.
Equations \ref{eqn:friedman_B} and \ref{eqn:friedman_C} are
called the {\it Friedmann equations}.  For cool matter
the pressure $p \sim \rho c_s^2$ where the sound speed $c_s \ll c$,
and the pressure term in equation \ref{eqn:friedman_C} is 0.
Then $\rho(t)\propto R^{-3}$.  For radiation and particles,
$p\approx pc^2/3$ and $\rho(t) \propto R^{-4}(t)$.
For matter and radiation $\rho + 3p/c^2$ is positive, and the
universe decelerates.

The quantity $\rho(t)R^2(t)$ decreases as $R(t)$ grows, so the
right hand side of eqn \ref{eqn:friedman_B} becomes negative
for large $R$ if $k=1$.  Since $\dot{R}^2$ cannot be negative,
$R$ will reach a maximum and turn around.  For $k\le0$, the
expansion never ends.

GR allows for a {\it vacuum energy} with constant density $\rho_{\Lambda} = \Lambda/(8\pi G)$.  Since $\rho_{\Lambda}$ is a constant, the RHS of the $\Delta Q$ equation must
be zero since $\rho_{\Lambda}$
cannot change and the pressure is $p_{\Lambda} = -\Lambda c^2/(8\pi G)$,
which is more like a tension pulling out than a pressure pushing in.
Once the universe expands so $\rho_{\Lambda}$ is larger than the other
components, the universe expands exponentially.  This kind of
expansion may have happened in the early universe (inflation), which
enables us to explain away several cosmological puzzles.

\section{Lecture 11: Growth of Structure}

The initial perturbations seeded by cosmic inflation likely had a
power spectrum $P(k) \propto k$.  These perturbations were affected
by physical processes at later times to alter $P(k)$ on small scales.
We see evidence of this in the cosmic microwave background. As
photons try to move out of the gravitational potential wells of the
initial density perturbations, the photons experience a
{\it gravitational redshift} $\Delta\Phi_g$ that changes the
temperature $T$ of the radiation by an amount $\Delta T$ according
to
\begin{equation}
\frac{\Delta T}{T}|_{\mathrm{grav}} \sim \Delta \Phi_g c^{-2}
\end{equation}
\noindent
The temperature is reduced where the potentially
is unusually deep since $\Delta \Phi_g$ is negative
there, and time runs more slowly such that $\Delta t/t =\Delta \Phi_g/c^2$
and we see the gas at an earlier time when it was hotter.  The temperature
declines by $T\propto 1/ a(t)$, so we have
\begin{equation}
\left.\frac{\Delta T}{T}\right|_{\mathrm{time}} = -\frac{\Delta a}{a} = -\frac{2}{3}\frac{\Delta t}{t} =  -\frac{2}{3}\frac{\Delta \Phi_g}{c^2}
\end{equation}
\noindent
where we've used $a\propto t^{2/3}$ for the matter-dominated era.
The net effect is that $\Delta T/T \sim \Delta \Phi_g / (3 c^2)$.
If the region has density $\rho = \bar{\rho}(1+\delta)$ and a
corresponding mass excess of $\Delta M = 4\pi \bar{\rho}R^3 \delta / 3$,
then
\begin{equation}
3c^2\frac{\Delta T}{T} = \Delta \Phi_g \sim - \frac{2G\Delta M}{R} = - \frac{8\pi}{3} G \bar{\rho}R^2 \delta \approx - \delta(t)[\bar{H}(t)R]^2
\end{equation}
\noindent
such that radiation from dense regions is {\it colder}.

We can model the temperature map of the sky by expanding
the pattern of the CMB in spherical harmonics as
\begin{equation}
\Delta T(\theta, \phi) = \sum_{l>1} \sum_{-l\le m \le l} a_l^m Y_l^m(\theta, \phi).
\end{equation}
\noindent
The theoretical predictions are often expressed in terms of $C_l = \ave{|a_l^m|^2}$ averaged over $m$ since this does not depend on the direction of ``north''
in the map.  A commonly plotted quantity is $\Delta_T^2 = T^2 l(l+1)C_l/(2\pi)$.

Pressure forces can act to suppress structure, but only on the
sound horizon scale.  The sound horizon scale when the
gas becomes transparent to photons (recombination) is
\begin{equation}
R(t_{rec}) \sigma_H = 3 c t_{rec} = \frac{2c}{H(t_{rec})} \approx \frac{2c}{H_0\sqrt{\Omega_m}(1+z_{rec})^{3/2}}.
\end{equation}
\noindent
This works out to about $184/(h^2 \Omega_m)^{1/2}$~Mpc today.  The
angle $\theta_H$ subtended by the sound horizon depends on
the angular-size distance to $z_{rec}$.  When $\Omega_\Lambda\to0$
and $\Omega_0 z\gg1$, then $d_A\to 2c/(H_0 z \Omega_0)$. We then
have
\begin{equation}
\theta_H \approx \frac{R(t_{rec}\sigma_H)}{d_A(t_{rec})} \approx \sqrt{\frac{\Omega_0}{z_{rec}}} \approx 2^\circ \times \sqrt{\Omega_0},
\end{equation}
\noindent
and only points separated by this angle on the sky can communicate before $t_{rec}$.  For $\Omega_0=1$, $\Delta_T$ is largest on the scale of about a degree,
where the {\it first acoustic peak} of the CMB is found. A model
with $\Omega_0=0.3$ provides about half this angle. In a cosmology
close to what we think ours is, it turns out the
first peak is at $l\approx 220$ that corresponds to a size scale of
aobut $105~\Mpc$ today, which is a sphere that contains $2.5\times10^{16}M_{\odot}$.  The second peak is at $l\approx540$.

\section{Lecture 12: Tidal Torques}

Peculiar velocities grow as $\vv\propto t^{1/3}$ while distances
grow as $d\propto a(t) \propto t^{2/3}$. In the linear regime,
angular momentum then grows as $d \times v\propto t$. The
region stops accruing angular momentum once it turns around
and begins to collapse. Therefore, more overdense regions
tend to have less time to spin up.  However, tidal torques
are also stronger in dense regions and so objects
acquire the same average angular momentum in relation to their
mass or energy.

A galaxy of radius $R$, mass $M$, and angular momentum $L$
will rotate an angular speed
\begin{equation}
\omega \sim L / (MR^2).
\end{equation}
\noindent
The angular speed of a circular orbit at radius $R$ is
\begin{equation}
\omega_c^2 R \sim G M/R^2.
\end{equation}
The energy is $E\sim - GM^2/R$.  We therefore have
\begin{equation}
\frac{\omega}{\omega_c}\equiv\lambda = \frac{L}{MR^2} \times \frac{R^{3/2}}{\sqrt{GM}} = \frac{L|E|^{1/2}}{GM^{5/2}}.
\end{equation}
\noindent
From N-body simulations, we expect that $\lambda\sim$ a  few percent.
Ellipticals have about this spin, but the Milky Way has $\lambda \approx 0.5$.
Since the MW is a disk, energy dissipation can help amplify $\lambda$.

This also argues for a dark halo, as otherwise the disk would
not have time to form.  Without a halo, $L$ and $M$ remain
fixed as the disk moves in.  The radius must decrease by $100\times$
for $E$ to increase proportionally by the same amount.
Disk material near the Sun would need to originate $800~\kpc$
from the center, but $M(<R)$ would lie interior to the Sun's orbit.
The orbital period of the Sun would be $1000\times$ longer than
it's observed to be ($240~\Gyr$).  It would take many times the
age of the universe to make the disk.

Since the milky way has a large DM halo, the gas in the MW disk
originates from a radius closer by a factor $M_d/M_{DM}$. The
decrease in size is only a factor of 10.  Shrinking at
$200~\km~\s^{-1}$ from a radius $80~\kpc$, the disk could
have formed in $\lesssim2~\Gyr$.

\end{document}


\documentstyle[11pt]{article}

\title{R/I\_SOLVE: Rational/Integer Polynomial Solvers}

\author{Francis J. Wright \\
School of Mathematical Sciences \\
Queen Mary and Westfield College \\
University of London \\
Mile End Road, London E1 4NS, UK. \\
E-mail: {\tt F.J.Wright@QMW.ac.uk}}

\date{27 January 1995}

\begin{document}
\maketitle

\begin{abstract}
  This package provides the operators \verb|r/i_solve| that compute
  respectively the exact rational or integer zeros of a single
  univariate polynomial using fast modular methods.
\end{abstract}

\section{Introduction}

This package provides operators that compute the exact rational zeros
of a single univariate polynomial using fast modular methods.  The
algorithm used is that described by R. Loos (1983): Computing rational
zeros of integral polynomials by $p$-adic expansion, {\it SIAM J.
Computing}, {\bf 12}, 286--293.  The operator \verb|r_solve| computes
all rational zeros whereas the operator \verb|i_solve| computes only
integer zeros in a way that is slightly more efficient than extracting
them from the rational zeros.  The \verb|r_solve| and \verb|i_solve|
interfaces are almost identical, and are intended to be completely
compatible with that of the general \verb|solve| operator, although
\verb|r_solve| and \verb|i_solve| give more convenient output when
only rational or integer zeros respectively are required.  The current
implementation appears to be faster than \verb|solve| by a factor that
depends on the example, but is typically up to about 2.

I plan to extend this package to compute Gaussian integer and rational
zeros and zeros of polynomial systems.

\section{The user interface}

The first argument is required and must simplify to either a
univariate polynomial expression or equation with integer, rational or
rounded coefficients.  Symbolic coefficients are not allowed (and
currently complex coefficients are not allowed either.)  The argument
is simplified to a quotient of integer polynomials and the denominator
is silently ignored.

Subsequent arguments are optional.  If the polynomial variable is to
be specified then it must be the first optional argument, and if the
first optional argument is not a valid option (see below) then it is
(mis-)interpreted as the polynomial variable.  However, since the
variable in a non-constant univariate polynomial can be deduced from
the polynomial it is unnecessary to specify it separately, except in
the degenerate case that the first argument simplifies to either 0 or
$0 = 0$.  In this case the result is returned by \verb|i_solve| in
terms of the operator \verb|arbint| and by \verb|r_solve| in terms of
the (new) analogous operator \verb|arbrat|.  The operator
\verb|i_solve| will generally run slightly faster than \verb|r_solve|.

The (rational or integer) zeros of the first argument are returned as
a list and the default output format is the same as that used by
\verb|solve|.  Each distinct zero is returned in the form of an
equation with the variable on the left and the multiplicities of the
zeros are assigned to the variable \verb|root_multiplicities| as a
list.  However, if the switch \verb|multiplicities| is turned on then
each zero is explicitly included in the solution list the appropriate
number of times (and \verb|root_multiplicities| has no value).

\begin{sloppypar}
Optional keyword arguments acting as local switches allow other output
formats.  They have the following meanings:
\begin{description}
\item[\verb|separate|:] assign the multiplicity list to the global
  variable \verb|root_multiplicities| (the default);
\item[\verb|expand| or \verb|multiplicities|:] expand the solution
  list to include multiple zeros multiple times (the default if the
  \verb|multiplicities| switch is on);
\item[\verb|together|:] return each solution as a list whose second
  element is the multiplicity;
\item[\verb|nomul|:] do not compute multiplicities (thereby saving
  some time);
\item[\verb|noeqs|:] do not return univariate zeros as equations but
  just as values.
\end{description}
\end{sloppypar}

\section{Examples}

\begin{verbatim}
r_solve((9x^2 - 16)*(x^2 - 9), x);
\end{verbatim}
\[
  \left\{x=\frac{-4}{3},x=3,x=-3,x=\frac{4}{3}\right\}
\]
\begin{verbatim}
i_solve((9x^2 - 16)*(x^2 - 9), x);
\end{verbatim}
\[
  \{x=3,x=-3\}
\]
See the test/demonstration file \verb|rsolve.tst| for more examples.

\section{Tracing}

The switch {\tt trsolve} turns on tracing of the algorithm.  It is off
by default.

\end{document}


\documentclass{article}
\usepackage{amsmath,mathtools,amssymb}
\usepackage{graphicx}
\usepackage{gensymb}
\usepackage{verbatim}
\usepackage{mathrsfs}
\usepackage{bbm}
\usepackage{braket}
\usepackage{hyperref}
\usepackage{verbatim}
\usepackage{cancel}
\usepackage[margin=1.0in]{geometry}
\newcommand{\ol}{\overline}
\newcommand{\ve}{\varepsilon}
\def\*#1{\mathbf{#1}}
\DeclarePairedDelimiter\floor{\lfloor}{\rfloor}

\title{Lecture 3.1: Introduction to Second Quantization}
\date{February 3, 2020}
\begin{document}
\maketitle
\noindent
\section{The wavefunction is fully represented by a linear combination of Slater determinants}
Recall that the set of all \textbf{spin orbitals} $\{\phi_p\}$ forms a basis for the one-particle space.
They can be used to represent any single-particle state.
These spin orbitals form a complete set; any \textbf{single particle state} $\psi$ can be represented by
a linear combination of spin orbitals:
\[\ket{\psi} = \sum_p \ket{\phi_p}\braket{\phi_p | \psi} \]
How many terms are in the summation over $p$?
In theory, we could have an infinite set of spin orbitals.
For all practical purposes, however, we define a finite number of spin orbitals, known as the basis set. \\
\\
A N-particle state $\Psi$ can be expressed as a tensor\footnote{See \url{http://hitoshi.berkeley.edu/221A/tensorproduct.pdf} for a thorough explanation of tensor products}
of N spin orbitals multiplied by a coefficient:
\[\ket{\Psi} = \sum_{p_1}\sum_{p_2}\cdots\sum_{p_N} \ket{\phi_{p_1}}\otimes \ket{\phi_{p_2}} \otimes \cdots \otimes \ket{\phi_{p_N}}  \bra{\phi_{p_N}}\otimes \cdots \otimes \bra{\phi_{p_2}} \otimes \braket{\phi_{p_1}  | \Psi} \]
Or to write it more succinctly:
\begin{equation}
\ket{\Psi} = \sum_{p_1 \cdots p_N} \ket{\phi_{p_1 \cdots p_N}} \braket{\phi_{p_1 \cdots p_N} | \Psi}
\end{equation}
For a N-particle state made of fermions, our wavefunction is antisymmetric.
Thus, the antisymmetrizer $\hat{A}$ acting on state $\ket{\Psi}$ should not change it:
\[ \hat{A}\ket{\Psi} = \ket{\Psi} \]
We will now replace $\ket{\Psi}$ with the expression in Equation 1:
\begin{align*}
\ket{\Psi} &=  \hat{A} \ket{\Psi}\\
&=\sum_{p_1 \cdots p_N}\hat{A} \ket{\phi_{p_1 \cdots p_N}} \braket{\phi_{p_1 \cdots p_N} | \Psi}
\end{align*}
We can also replace $\braket{\phi_{p_1 \cdots p_N} | \Psi}$ with $\braket{\phi_{p_1 \cdots p_N} | \hat{A} | \Psi} $:
\begin{align*}
\ket{\Psi} &=\sum_{p_1 \cdots p_N}\hat{A} \ket{\phi_{p_1 \cdots p_N}} \braket{\phi_{p_1 \cdots p_N} | \hat{A} | \Psi}
\end{align*}
We can multiply this expression by a factor of one, expressed as $\frac{1}{\sqrt{N!}} \sqrt{N!}$:
\begin{align*}
\ket{\Psi} &=\sum_{p_1 \cdots p_N}  \frac{1}{\sqrt{N!}} \sqrt{N!} \hat{A} \ket{\phi_{p_1 \cdots p_N}} \braket{\phi_{p_1 \cdots p_N} | \hat{A} | \Psi}
\end{align*}
We see now that $\sqrt{N!} \hat{A} \ket{\phi_{p_1 \cdots p_N}}$ is just what we've previously defined as our Slater determinant $\ket{\Phi_{p_1 \cdots p_N}}$
\footnote{The tensor product here represent a literal product of orbitals in our case, so $\sqrt{N!} \hat{A} \ket{\phi_{p_1 \cdots p_N}} = \sqrt{N!} \hat{A} \ket{\phi_{p_1}\phi_{p_2} \cdots \phi_{p_N}} = \ket{\Phi_{p_1 \cdots p_N}}$ as we have defined in the HF notes}
\begin{align*}
\ket{\Psi} &=\sum_{p_1 \cdots p_N}  \frac{1}{\sqrt{N!}} \ket{\Phi_{p_1 \cdots p_N}} \braket{\phi_{p_1 \cdots p_N} | \hat{A} | \Psi}
\end{align*}
Now, let's re-express the term $ \braket{\phi_{p_1 \cdots p_N} | \hat{A} | \Psi} $ by taking similar steps:
\begin{align*}
\braket{\phi_{p_1 \cdots p_N} | \hat{A} | \Psi} &=  \frac{1}{\sqrt{N!}} {\sqrt{N!}} \braket{\phi_{p_1 \cdots p_N} | \hat{A} | \Psi}  \\
&=  \frac{1}{\sqrt{N!}}\braket{\phi_{p_1 \cdots p_N} | \hat{A}  {\sqrt{N!}}  | \Psi}  \\
&= \frac{1}{\sqrt{N!}}\braket{\Phi_{p_1 \cdots p_N} | \Psi}
\end{align*}
Putting this back into our expression for $\ket{\Psi}$, we obtain:
\begin{align*}
\ket{\Psi} &=\sum_{p_1 \cdots p_N}  \frac{1}{\sqrt{N!}} \ket{\Phi_{p_1 \cdots p_N}} \braket{\phi_{p_1 \cdots p_N} | \hat{A} | \Psi}  \\
 &=\sum_{p_1 \cdots p_N}  \frac{1}{\sqrt{N!}} \ket{\Phi_{p_1 \cdots p_N}}\frac{1}{\sqrt{N!}}\braket{\Phi_{p_1 \cdots p_N} | \Psi}   \\
&=\sum_{p_1 \cdots p_N}  \frac{1}{N!} \ket{\Phi_{p_1 \cdots p_N}}\braket{\Phi_{p_1 \cdots p_N} | \Psi}   \\
\end{align*}
To simplify our expression further, we have to recognize two things.
First, the indices $p_1 \cdots p_N$ must all be unique in order to have a nonzero determinant.
This is simply a manifestation of the antisymmetric properties of fermions.
Thus, our sum goes from all $p_1 \cdots p_N$ to $p_1 \neq \cdots \neq p_N$.
Second, we recognize that since our determinant comes up in two places in the expression, any phase factor associated with a permutation of indices $p_1 \cdots p_N$ will cancel out.
Thus, all permutations of a set of indices $p_1 \cdots p_N$ will give back the same expression.
For a set with N members, there will be N! permutations for that set, and thus N! permutations that will give back the same expression.
Thus, we can just reduce our summation to be over the set of unique permutations, represented by the ordered set $p_1 < \cdots < p_N$, and add a factor of N! to account for the
other possible permutations of set $p_1 \cdots p_N$ that give the same expression:
\begin{align*}
\ket{\Psi} &=N! \sum_{p_1 < \cdots < p_N}  \frac{1}{N!} \ket{\Phi_{p_1 \cdots p_N}}\braket{\Phi_{p_1 \cdots p_N} | \Psi}   \\
&=  \sum_{p_1 < \cdots < p_N} N! \frac{1}{N!} \ket{\Phi_{p_1 \cdots p_N}}\braket{\Phi_{p_1 \cdots p_N} | \Psi}   \\
&=  \sum_{p_1 < \cdots < p_N} \ket{\Phi_{p_1 \cdots p_N}}\braket{\Phi_{p_1 \cdots p_N} | \Psi}   \\
&=  \sum_{p_1 < \cdots < p_N} c_p \ket{\Phi_{p_1 \cdots p_N}} \\
\end{align*}
We have arrived at an expression that we know how to interpret!
The Slater determinants form a basis in which we can expand a N-particle state $\ket{\Psi}$.
$\ket{\Psi}$ can be completely expressed as a linear combination of all possible Slater determinants that can be formed from spin orbitals $\phi_p$ in a defined basis set, with a coefficient $c_p$.
This expansion in terms of Slater determinants is often called the Configuration Interaction (CI) expansion.
\\ \\
There are some shortcomings to this way of expressing things.
First, the description of the N-particle state $\ket{\Psi}$ is explicitly dependent on the particle number N.
This means that a different expression has to be written for systems with different particle numbers N.
Second, the set of indices is ordered in the expression above, and any permutations will have signs associated with it.
We have to explicitly keep track of antisymmetry properties.

\section{Representing Slater determinants with occupation numbers}
We want to find a different way of representing our Slater determinant $\Phi_{p_1 \cdots p_N}$.
Let's think about what we actually need to define a Slater determinant.
If we have a set of spin orbitals $\phi_p$, all we really need to know in order to uniquely define a determinant is which $\phi_p$ is occupied, and thus included in our Slater determinant, and which $\phi_p$ is not.
In other words, we only need the set of indices $p$.
For the Slater determinant written as $\Phi_{p_1 \cdots p_N}$, we need to know indices $p_1 \cdots p_N$.
\\ \\
We can assign an ``occupation number" to each $\phi_p$ in our basis set.
If it is occupied and in our Slater determinant, we can assign a number 1, denoting that there is one electron in the spin-orbital.
If it is unoccupied, we can assign a number 0.
In this course, we are only dealing with electrons, which can only have occupation numbers 1 or 0, since two electrons cannot occupy the same spin orbital.
For particles which are bosons, we do not have this limitation and the occupation numbers are only restricted by the total number of particles N (in that all occupation numbers must sum to N).  \\
\\
The general notation for representing a state in the occupation number (ON) representation is this:
\[\ket{\*{n}} = \ket{n_1 \, n_2 \, \cdots \,  n_p \, \cdots n_M}\]
where $n_p = 0$ if single-particle state $p$ is unoccupied and $n_p = 1$ if single-particle state $p$ is occupied. We see there are M occupation numbers, one for each spin-orbital in our basis.\\
\\
The ON vectors can be manipulated as an ordinary inner-product vector space.
We can define an inner product between two ON vectors $\*{n}$ and $\*{k}$ as:
\[\braket{\*{n} | \*{k}} = \delta_{\*{n} \*{k}} = \prod_{p = 1}^M \delta_{n_Pk_P}\]
A general vector can be expressed as a linear combination of ON vectors
\[\ket{\*{c}} = \sum_n c_n \ket{\*{n}} \]
and an inner product of two general vectors as:
\[\braket{\*{c}| \*{d}} = \sum_n c_n^*d_n \]
We also have the usual resolution of the identity:
\[1 = \sum_n \ket{\*{n}}\bra{\*{n}} \]
The sum n is over the \textbf{full} set of ON vectors for all numbers of electrons in a given basis with spin-orbitals M.

\section{Relating the determinant and ON formalisms}

For the set of ordered indices $p_1 < p_2 < \cdots < p_n$, a determinant $\Phi_{p_1 \cdots p_N}$ is equivalent to the occupation vector $\ket{\mathbf{n}_{p_1 \cdots p_N}}$:
\[\ket{\Phi_{p_1 \cdots p_N}} = \ket{\bold{n}_{p_1 \cdots p_N}}= \ket{ \cdots \,  n_p \, \cdots }\]
where
\[n_p = 0 \,\, \text{if $p \notin \{p_1 \cdots p_N\}$} \]
\[n_p = 1 \,\, \text{if $p \in \{p_1 \cdots p_N\}$} \]
That is to say, $n_p$ is zero if spin orbital $\phi_p$ is not part of the determinant $\Phi_{p_1 \cdots p_N}$, and one if it is.
Thus, in a given spin-orbital basis, there is a one-to-one mapping between Slater determinants with spin orbitals in canonical order and the ON vectors.
\\ \\
Let's go through an example.
Say we have a 4 particle system.
We choose to represent this system with a basis set of 10 spin orbitals.
We form our first Slater determinant with particles in spin orbitals 1, 3, 4, and 7, and represent it as
$\ket{\Phi_{1347}}$, or alternatively, $\ket{\{\phi_1\phi_3\phi_4\phi_7\}}$
How do we represent this in the  occupation number (ON) representation?
We simply use numbers 0 or 1 to represent all the spin orbitals in the basis set, putting a 1 when that spin orbital is occupied in the Slater determinant:
\[\ket{\Phi_{1347}} \rightarrow \ket{1011001000} \]
For a set of indices $q_1, q_2, \cdots, q_n$ that are not ordered,
\[\ket{\Phi_{p_1 \cdots p_N}}  = (-1)^R \ket{\bold{n}_{p_1 \cdots p_N}}\]
where $R \in S_n$ represents the permutations such that $q_{R_1} < q_{R_2} < \cdots < q_{R_n}$ \\
\\
Note that the choice to represent the Slater determinant in terms of occupation numbers is not much more abstract than our choice
of representing a quantum state by a state vector $\ket{\psi}$.
Just as the state vectors came with its own set of mathematical rules and physical interpretations,
we now delve into the mathematics of the ON representation.
%where n_p = 0 if $\phi_p$ is unoccupied and n_p = 1 if $\phi_p$ is occupied.
%Hilbert space vs Fock space
\section{Creation and annihilation operators}
Just as there were operators that acted on state vectors, there are operators that act on ON vectors.
Can we come up with some operators that make sense for this representation?
Remember that we are talking about performing actions on the numbers 1 or 0, corresponding to whether a spin-orbital is occupied or not.
Realistically, there is not many basic actions that we can think of.
In fact, there are just \textit{two} basic operators that act in the ON representation:
one that takes $n_p$ from 1 to 0 (makes an occupied spin-orbital unoccupied) and one that takes $n_p$ from 0 to 1 (makes an unoccupied spin-orbital occupied).

\subsection{The Annihilation Operator}
First, we can define an operator that takes $n_p$ from 1 to 0.
Formally, this is defined as:
\begin{equation}
a_p \ket{\cdots n_p \cdots} = (-1)^{m} n_p \ket{\cdots (1-n_p) \cdots}
\end{equation}
where
\[m = \sum_{k=1}^{p-1} n_k \]
You can see that when $n_p$ is 1, acting $a_p$ on the ON state returns a phase factor times that state with $n_p$=0.
Specifically, phase factor depends on the sum of all $n$ before $n_p$.
If $n_p$ is already 0, we just get 0 for the final result. \\ \\
We can represent this in determinant form, assuming an ordered set $\{p_1 < \cdots  < p_N\}$,
\[a_p \ket{\Phi_{\cdots p \cdots}} = (-1)^m  \ket{\Phi_{\cdots \cancel{p} \cdots }} \]
where the $\cancel{p}$ means spin orbital $\phi_p$ is not in the determinant $\Phi$.
In the language of determinants, $a_p$ takes a determinant where spin orbital $\phi_p$ is occupied and makes it unoccupied.
To say it another way, it decreases the number of particles in a state by one.
If $\phi_p$ is already unoccupied, we get a 0 because you cannot take away a particle that is not there.
We refer to $a_p$ as the annihilation operator, because it annihilates a particle from a particle state.
What happens if we act $a_p$ on a determinant with a single particle state $p$?
That is, where all $n_k$ is 0 except for $n_p$?
\[a_p \ket{0 \cdots n_p \cdots0} = (-1)^{m} n_p \ket{\cdots (1-n_p) \cdots}  \]
We see that this gives us a state in which all occupation numbers are 0:
\[a_p \ket{0 \cdots n_p \cdots0} = \ket{0 \cdots 0 \cdots 0}  \]
We call this state the \textit{true vacuum} state, and represent it as $\ket{0}$.
It is an artificial state that we have defined so we know how the annihilation operator acts on single particle states, and it is normalized such that
\[\braket{0 | 0} = 1\]
Using our definition of the annihilation operator in Equation 2, we know that
\[a_p \ket{0} = 0 \,  \, \forall \, \, p \]

\subsection{The Creation Operator}
We now need to define an operator that takes $n_p$ from 0 to 1.
To do this, let's start from a relation we have discussed in the previous section:
\[a_p \ket{0 \cdots n_p \cdots0} = \ket{0} \]
We can take the adjoint of both sides:
\begin{align*}
(a_p \ket{0 \cdots n_p \cdots0})^\dagger &= (\ket{0})^\dagger \\
\bra{0 \cdots n_p \cdots0} a_p^\dagger &= \bra{0} \\
\end{align*}
We can now right project $\ket{0}$ on both sides:
\begin{align*}
\bra{0 \cdots n_p \cdots0} a_p^\dagger \ket{0} &= \braket{0 | 0}  \\
\bra{0 \cdots n_p \cdots0} a_p^\dagger \ket{0} &= 1  \\
\end{align*}
Remember that $\bra{0 \cdots n_p \cdots0} $ represents a single particle state in which only spin orbital $\phi_p$ is occupied.
We see that in order for the quantity $\bra{0 \cdots n_p \cdots0} a_p^\dagger \ket{0}$ to equal 1, $a_p^\dagger \ket{0}$ has to also give a state in which just $\phi_p$ is occupied
because of the orthonormality of the spin orbitals. We obtain:
\begin{align*}
&\bra{0 \cdots n_p \cdots0} a_p^\dagger \ket{0} = 1 \\
&\braket{0 \cdots n_p \cdots0 | 0 \cdots n_p \cdots0 } = 1  \\
&a_p^\dagger \ket{0}  = \ket{0 \cdots n_p \cdots0 } \\
\end{align*}
We have arrived at something that gives us what we wanted: a way to take $n_p$ from 0 to 1!
We see that the desired operator on state $\phi_p$ is simply the adjoint of the annhilation operator on state $\phi_p$.\\
\\
Formally this is defined as:
\begin{equation}
a_p^\dagger \ket{\cdots n_p \cdots} = (-1)^{m} (1 - n_p) \ket{\cdots (1-n_p) \cdots}
\end{equation}
where
\[m = \sum_{k=1}^{p-1} n_k \]
You can see that when $n_p$ is 0, acting $a_p^\dagger$ on the ON state returns a phase factor times that state with $n_p$=1.
If $n_p$ is already 1, we get a 0 for the final result. \\ \\
We can represent this in determinant form, assuming an ordered set $\{p_1 < \cdots < p_N\}$,
\[a_p^\dagger \ket{\Phi_{\cdots \cancel{p} \cdots}} = (-1)^m  \ket{\Phi_{\cdots p \cdots }} \]
where the $\cancel{p}$ means spin orbital $\phi_p$ is not in the determinant $\Phi$.
In the language of determinants, $a_p^\dagger$ takes a determinant where spin orbital $\phi_p$ is unoccupied and makes it occupied.
To say it another way, it increases the number of particles in a state by one.
If $\phi_p$ is already occupied, we get a 0 because we cannot occupy the same spin state more than once.
This is simply a reflection of the fermionic properties of the electron.
We refer to $a_p^\dagger$ as the creation operator, because it creates a particle and adds it to a state.

\subsection{The number operator}
The annihilation and creation operators are the building blocks for more complicated operators, which are represented by products of the two.
If an operator is particle conserving, we expect the same number of creation and annihilation operators.
The simplest particle conserving operator we can come up with is just the product of one creation and one annihilation operator:
\[a_p^\dagger a_p \]
There are two cases, applying the operator on a state in which $n_p = 1$ and a state in which $n_p = 0$.
We now treat both cases to see the consequences of this operator: \\
\\
Case 1: $n_p = 1$ \\
\begin{align*}
a_p^\dagger a_p \ket{\cdots p \cdots} &= a_p^\dagger a_p \ket{\cdots 1 \cdots} \\
&= (-1)^m a_p^\dagger \ket{\cdots 0 \cdots} \\
&= (-1)^m (-1)^m \ket{\cdots 1 \cdots}  \\
&= (1) \ket{\cdots n_p \cdots}  \\
\end{align*}
Case 2: $n_p = 0$ \\
\begin{align*}
a_p^\dagger a_p \ket{\cdots p \cdots} &= a_p^\dagger a_p \ket{\cdots 0 \cdots} \\
&= (0)\ket{\cdots 0 \cdots} \\
\end{align*}
We see that generally,
\[a_p^\dagger a_p \ket{\cdots p \cdots} = n_p\ket{\cdots p \cdots}  \]
Operating the operator $a_p^\dagger a_p$ on a state will give back the occupation number times that state.
The occupation numbers thus are eigenvalues of the operator $a_p^\dagger a_p$.
Because of this, we refer to this operator as the Number operator $N_p$.
We can define a Total Number operator, $\hat{N} = \sum_p N_p$, which gives back the total numbers of particles in a state. \\
\\
The number operator gives us some insight as to why we refer to this formalism as the occupation number occupation.
Just as in the ``energy representation", basis states are eigenfunctions of an energy operator (Hamiltonian),
in the ``occupation number representation", basis states are eigenfunctions of the number operator.

\subsection{Anticommutation relations}

Recall that the commutator of 2 operators $\hat{A}$ and $\hat{B}$ is defined as
\[ [\hat{A}, \hat{B} ] = \hat{A}\hat{B} - \hat{B}\hat{A} \]
We can also defined an \textit{anticommuntator} for operators $\hat{A}$ and $\hat{B}$:
\[ \{\hat{A}, \hat{B} \} = \hat{A}\hat{B} + \hat{B}\hat{A} \]
There are some key anticommuntation relations that will be critical for mathematical manipulations for creation and annihilation operators:
\begin{enumerate}
\item  $\{a_p, a_q\} = 0$
\item $\{a_p^\dagger, a_q^\dagger \} = 0$
\item $\{a_p^\dagger, a_q\} = \delta_{pq}$
\end{enumerate}
Additionally, there are some properties that directly result from the anticommutation rules:
\begin{enumerate}
\item $(a_p)^2 = 0$, $(a_p^\dagger)^2 = 0$
\item $a_pa_q = -a_qa_p$,  $a_p^\dagger a_q^\dagger = -a_q^\dagger a_p^\dagger$
\item$ N_p^2 = N_p$
\item $[N_p, N_q] = 0$
\item $[a_p, N_q] = \delta_{pq}a_p$
\item $[a_p^\dagger, N_q] = -\delta_{pq}a_p^\dagger$
\end{enumerate}
You will prove these anticommuntation relations and properties in your homework.

\section{The determinant can be represented by a string of creation operators}

For an ordered set $p_1 < \cdots  < p_N$,
we can see that
\[\ket{\Phi_{p_1, p_2, \cdots, p_N}} = a_{p_1}^\dagger \ket{\Phi_{p_2, \cdots, p_N}} = a_{p_1}^\dagger a_{p_2}^\dagger \ket{\Phi_{p_3, \cdots, p_N}}=
 a_{p_1}^\dagger a_{p_2}^\dagger \cdots a_{p_N}^\dagger \ket{0}\]
In words, a Slater determinant can be represented by a string of creation operators acting on the vacuum in the same order as the spin states in the Slater determinant. \\ \\
If we now consider a unordered set $q_1 \cdots q_N$, we can conclude that
\begin{equation}\ket{\Phi_{p_1 \cdots p_N}} = a_{p_1}^\dagger \cdots a_{p_N}^\dagger \ket{0}\end{equation}
since in order to put $q_1 \cdots q_N$ in order, the change of sign will be the same whether we permute the determinant or the string of operators.
Since the change of sign is the same on both sides, we do not have to keep track of it.
Thus, \textit{any} string of creation operators acting on the vacuum is equivalent to the corresponding Slater determinant with the same ordering of states.
The determinant can be directly represented as a string of creation operators without phase ambiguity.
We have now arrived at the reason we refer to this formalism as ``second quantization".
In ``first quantization", we formulate physical observables to be represented by operators.
These operators act on a functional form of our wavefunction.
In ``second quantization", our wavefunction itself is represented by a string of operators.
The next task is to formulate our Hamiltonian in terms of creation and annihilation operators.
Once that is done, everything will be in terms of these two operators, and we will see that this unified representation serves to greatly simplify our mathematics.  \\
\\
From here on out, we will go back and forth between the two forms in equation 4, without much reference to the occupation number formalism.
It was useful for understanding the context of creation and annihilation operators, but for our purposes it will be easier to represent our wavefunction in the determinant representation
and not with occupation numbers.

\section{A note on spaces}
We refer to the space of all possible Slater determinants for a system with N particles in M spin orbitals as the N-particle Hilbert space.
In the ON formalism, the N-particle Hilbert space contains all ON vectors for which the sum of occupation numbers is N:
\[ N = \sum_{P = 1}^M n_P \]
The N-particle Hilbert space can be thought of as a subset of the \textit{Fock space}.
 A $2^M$--dimensional Fock space F(M) is defined as a direct sum of subspaces $F(M, N)$:
 \[F(M) = F(M, 0 ) \oplus  F(M, 1 )  \oplus   F(M, 2 )  \oplus \cdots \oplus F(M, N) \]
where each $F(M, N)$ is the just the N-particle Hilbert space defined above.
The occupation vectors
\[\ket{\*{n}} = \ket{n_1 \, n_2 \, \cdots \,  n_p \, \cdots n_M}\]
form an orthonormal basis in the Fock space F(M).
We see that the creation and annihilation operators take us from one $F(M, N_1)$ to another $F(M, N_2)$.
F(M, 0) is the true vacuum state $\ket{0}$.

\section{Recommended Resources}
\begin{itemize}
\item Lecture notes of J. Paldus \url{http://www.math.uwaterloo.ca/~paldus/resources.html}
\item Lectures of Piotr Piecuch (Search Piotr Piecuch CHEM 580/PHYSICS 580 on Youtube)
\item ``The Many-Body Problem in Quantum Mechanics" by March, Young, and Sampanthar
\item ``Molecular Electronic-Structure Theory" by Helgaker et al.
\end{itemize}
\end{document}


% #############################################################################
% This is Chapter 2
% !TEX root = ../main.tex
% #############################################################################
% Change the Name of the Chapter i the following line
\fancychapter{Background and Related Work}
\cleardoublepage
% The following line allows to ref this chapter
\label{chap:background}

This chapter details the technical concepts required to understand the problem, the proposed solution and the rationale behind it. It starts by providing an overview of cryptographic services, primitives and protocols. Then, it presents several general purpose computing systems which offer cryptographic services, and ends by presenting other relevant components.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Cryptography and Other Concepts}\label{chap:background:crypto}

There are four important cryptographic services relevant for this work. Confidentiality is used to scramble information and hide the content from unauthorized entities. Integrity protects data from unauthorized modification. Authentication ascertains the origin of a message. Non-Repudiation prevents an entity from denying the authorship of a document or message.
To guarantee these services, two types of key infrastructure exist: symmetric and asymmetric.
Symmetric keys are shared by two or more communicating parties. The same key is used to encrypt and decrypt data, or for other services. The keys are generally smaller and the operations faster than with asymmetric keys. Asymmetric keys constitute a pair for each side, a private and a public key. The private key is personal and should never be shared. The public key may be shared widely.

There are two types of ciphers: stream and block ciphers. Stream ciphers usually process 1 bit of data at a time. Stream ciphers are usually faster than block ciphers, have lower memory requirements and thus are more suitable to embedded devices with limited memory. Block ciphers encrypt fixed-length groups of bits, called blocks. They have a higher memory usage, in order to keep the blocks in memory. The processed data needs to be padded to a multiple of the block size. This can introduce problems if not done correctly. Another caveat of block ciphers is they are more susceptible to noise in transmissions. If a bit is flipped in a stream cipher, only the corresponding bit is affected, while with a block cipher, more than 1 bit can be affected.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Hash Functions}\label{chap:background:crypto:hash}

A cryptography hash function generates a fixed dimension value (digest) based on input texts, such as messages or files. Secure hashes provide message integrity by comparing digests, calculated before and after transmission, to determine if the message was modified. The same message always generates the same digest.
To achieve this, hash functions must have several properties. The same input value always results in the same hash. Very different outputs must be generated from very similar inputs. It should be hard to find two messages which generate the same hash and it should be hard to find an input that produces a given hash.
Popular and recommended hash functions include \ac{SHA}-2 and the newer \ac{SHA}-3~\cite{dang2015secure}. Both versions have variants. For example, the \ac{SHA}-256 function produces a 256 bit digest and \ac{SHA}-512 a 512 bit digest.
% \begin{enumerate}
%     \item They must be deterministic, meaning the same input value must always result in the same hash value;
%     \item They must generate very different output values for similar inputs;
%     \item They must be collision resistant, meaning it should be hard to find two input messages that generate the same hash value;
%     \item The hash value should be computed relatively quickly;
%     \item Given a hash value, it should be hard to find an input text that produces that hash value.
% \end{enumerate}

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Symmetric Encryption}\label{chap:background:crypto:symmetric}

Symmetric ciphers are frequently used to provide authentication and confidentiality, using symmetric keys.
\ac{AES} is one of the most popular symmetric-key algorithms. It has multiple block and stream cipher modes, which offer confidentiality. It uses 128-bit blocks and keys can have 128, 192 or 256 bits. Some relevant AES encryption modes are presented next.

\textbf{\ac{ECB}} is the simplest mode. It is a block cipher and works by encrypting each block with the symmetric key. If the same key is used for equal plaintext blocks, the result will always be the same. For this reason, patterns are easily seen and the mode is considered insecure.

\textbf{\ac{CBC}} is another block cipher mode. It combines the first block of plaintext and an \ac{IV} with the XOR operator and encrypts the result. For the subsequent blocks, the previous ciphertext is used instead of the IV. The message needs to be padded to a multiple of the block size. If done incorrectly, the mode is vulnerable to padding oracle attacks \cite{paddingoracle}. Implementing ciphertext stealing, which avoids padding, is recommended for the security of \ac{CBC} \cite{ciphertextstealing}.

\textbf{\ac{OFB}} mode repeatedly encrypts the IV for each block, xoring the result with the plaintext block. The encryption and decryption processes are exactly the same.
The block cipher is only used in the encryption direction, which means the message does not need to be padded. Therefore, it is a stream cipher.

\textbf{\ac{CTR}} mode concatenates an IV with a counter beginning at 0. This sequence is encrypted and applied to the xor operation with the plaintext block. For each block the sequence is incremented by 1.
This mode is comparable to \ac{OFB}, as it is also a stream cipher and the encryption operation is exactly the same as the decryption.

The \ac{IV} needs to be sent along with the ciphertext to the receiver, or the receiver will not be able to retrieve the entire message. There is no need for the IV to be kept secret.
\ac{CBC}, \ac{OFB} and \ac{CTR} modes are proved secure, assuming the \ac{IV} is random and unique, meaning it is only used once for each key and message.
Regarding performance, \cite{aesmodes} states \ac{CBC} is slower than \ac{CTR} mode, and \ac{OFB} is even slower.
When efficiency characteristics matter, nothing comes close to \ac{CTR}: it has better performance characteristics, compared to \ac{CBC} and \ac{OFB}.

All these cipher modes are malleable, meaning an attacker can modify a ciphertext C, to create ciphertext C' which will decrypt to plaintext P' that is similar to the original plaintext. Malleability is connected to message integrity. This is not considered a relevant weakness since these modes are only designed to offer confidentiality. If integrity is needed, one of these modes should be paired with a \ac{MAC}, or instead use a dedicated authenticated-encryption mode like \ac{CCM} or \ac{GCM} (discussed in Section~\ref{chap:background:crypto:aead}), which guarantee both confidentiality and integrity.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Message Authentication Code}\label{chap:background:crypto:mac}

\ac{MAC} is a value, also called tag, used for authenticating a message.
A \ac{MAC} algorithm generates a tag from a message and symmetric key. Unlike digital signatures, \ac{MAC} does not offer non-repudiation since it uses a symmetric key, which is shared among all users. Anyone in possession of the key can generate a \ac{MAC} for a message, as well as, verify a MAC generated with the same key. On the contrary, digital signatures utilize the private key of an asymmetric pair to generate, and public key to verify.
Several techniques exist to construct a \ac{MAC}. One is \textbf{\ac{CBC-MAC}}, which utilizes the \ac{CBC} block cipher to encrypt data. A chain of blocks is generated, and the last block is the tag.
\ac{CBC-MAC} also has similar caveats to \ac{CBC}, it is only secure for fixed-length messages \cite{aesmodes} and different keys have to be used for \ac{CBC} encryption and tag generation.

\textbf{\ac{HMAC}} is different, it uses a cryptographic hash function, such as SHA-2, and a symmetric secret key to construct a tag. \ac{HMAC} is secure, as long as the underlying hash function used is secure. Therefore SHA-2 is a good option.
\ac{HMAC} does not have the security problems of \ac{CBC-MAC}. It is a popular and well-designed construction, but it is not the most efficient approach~\cite{aesmodes}.
% \ac{CBC-MAC} security deficiencies were resolved with \ac{OMAC}, which is secure for variable-length messages.
%Despite \ac{CBC}'s inefficiencies, \ac{HMAC} is slower due to the hashing operations.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Authenticated Encryption}\label{chap:background:crypto:aead}

\ac{AEAD} schemes assure confidentiality and authenticity using symmetric keys. They may be more efficient than combining separate encryption and authentication techniques, such as the ones discussed in earlier sections, and are less likely to be used incorrectly. \ac{AEAD} schemes also allow associated data to be included in the message, which is authenticated but not encrypted. This feature is useful for network packets. The header is visible but is authenticated, while the payload is encrypted and authenticated.
\ac{AES} has several of these schemes.

\textbf{\ac{CCM}} is an \ac{AEAD} mode that combines \ac{CBC-MAC} for authentication with \ac{CTR} for confidentiality.
\ac{CCM} uses a MAC-then-Encrypt approach. First, the \ac{MAC} is computed from the message. Then the message and the tag are encrypted with \ac{CTR} mode.
Due to performing two encryption operations, \ac{CBC-MAC} and then \ac{CTR}, the mode is not as efficient compared to others such as \ac{GCM}, which only performs one encryption operation.
It is not an online mode, meaning it needs to know the message and \ac{AD} length beforehand. Therefore, \ac{AD} cannot be preprocessed.
Despite being a slower mode, it is secure and widely supported. It is included in \ac{IPsec}, \ac{TLS} and Bluetooth low energy.

\textbf{\ac{GCM}} utilizes an encrypt-then-MAC approach. It first encrypts with \ac{CTR} mode, then uses Galois mode of authentication to generate the tag. The Galois field multiplication supports parallel computation, making this mode faster than \ac{CCM}.
Beyond being parallelizable, it is online and the \ac{AD} can be preprocessed.
For security reasons, authentication tags should be at least 96 bits, even though the mode allows smaller tags. One limitation of \ac{GCM} is, it can encrypt a maximum of 64 gigabytes of plaintext. Security analysis of several modes decisively states that \ac{GCM} in hardware is unsurpassed by any authenticated-encryption scheme~\cite{aesmodes}.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Asymmetric Encryption}\label{chap:background:crypto:assymetric}

Asymmetric cryptography uses public and private keys. It is commonly used to provide confidentiality, data integrity, authentication and non-repudiation.
The private key must always remain secure with the owner. Public keys may be distributed. Encrypting a message with the public key provides confidentiality, since only the owner who possesses the private key can decipher the message. On the other hand, private key encryption provides authentication, since only the owner is in possession of the private key. These two different concepts can be combined to provide confidentiality, authentication and non-repudiation to a message, through digital signatures.

Compared to symmetric keys, asymmetric keys are less risky to distribute, as the public key can be viewed by anyone. However, there is the problem of validating public keys, which consists of guaranteeing a public key is owned by the correct identity.
Once two parties have traded public keys, asymmetric and symmetric keys can be combined in a hybrid encryption scheme. It takes advantage of the faster symmetric encryption to cipher the data, and the asymmetric encryption to encrypt the symmetric key, and provide authentication. Alternatively, it can be used to share symmetric keys for usage with an authenticated-encryption scheme.

There are two popular algorithms for public-key encryption, \ac{RSA} and \ac{ECC}~\cite{mahto2016security}.
\ac{RSA} has been used for decades, is well established and widely used. It is based on the difficulty of factoring the product of two large prime numbers.
\ac{ECC} is a more recent algorithm, based on the Elliptic Curve Discrete Logarithm Problem. The main advantage of \ac{ECC} is it offers the same level of security, with a smaller key size. According to Gupta \& Silakari, 2011~\cite{eccoverrsa}, a 160-bit \ac{ECC} private key has similar security to a 1024-bit \ac{RSA} key.
\ac{ECC} operations are potentially faster with smaller key sizes, so this makes elliptic curve based schemes more suited for less powerful and memory constrained devices \cite{selvakumaraswamy2016efficient}.
With the threat of quantum computers, both \ac{ECC} and \ac{RSA} could become obsolete in the future, as they are vulnerable to brute force attacks from such devices.
% useful for small wireless devices with processing power, storage space, or power consumption restrictions.
%They also state that smaller key sizes may result in faster execution timings for the schemes, which is beneficial to systems where real time performance is a critical factor.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Diffie-Hellman}\label{chap:background:crypto:ecdh}

The \ac{DH} key exchange algorithm allows two parties to agree on a shared secret, which can be used to derive a symmetric key. Both parties compute the secret from publicly exchanged integers, and private integers. Attackers listening on the exchanged public integers cannot compute the same secret, since both sides' private integers are never shared.

\ac{ECDH} key exchange is similar, it computes the shared secret from \ac{ECC} private and public keys, instead of integers. Incorporating \ac{ECC} keys provides the same level of security compared with integers, but with a smaller bit size ~\cite{fiskiran2002workload}.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Digital Signatures}\label{chap:background:crypto:signatures}

Signatures are a standard scheme for authenticating digital messages and ensuring the signer cannot repudiate the signature. A digital signature is generated by combining asymmetric cryptography and a hash function.
A digital signature is generated by first computing a hash of the message, then signing the hash with the author's private key. The message is not directly signed, since public-key encryption is slow and messages are most likely bigger than the hash of a message, which has a fixed size. Third parties can validate the signature using the author's public key. Only the author, in possession of their private key, could have generated the signature.
Digital signatures are a digital version of handwritten signatures~\cite{digitalsignatures}, commonly used anywhere forgery detection is essential, for instance in financial transactions or software distribution.
A popular digital signatures algorithm with ECC keys is \ac{ECDSA}.

Qualified signatures are a special type of signatures where the private keys are generated and stored inside a device, such as a Smart Card, and are never exposed to the outside. For the owner to sign a document, the Smart Card is needed (something owned) and a \ac{PIN} (something known). This strong signature legally represents a person or a group. This type of signatures are used in the Portuguese Citizen Card.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Transport Layer Security}\label{chap:background:TLS}

\ac{TLS} is a cryptographic protocol that aims to provide confidentiality and data integrity, during transmission, over the \ac{TCP}. It uses symmetric cryptography to encrypt data. A new set of symmetric keys is generated for each connection.
TLS supports asymmetric cryptography which authenticates the identity of the communicating parties.
TLS is widely used in web browsing, e-mail and instant messaging.
The protocol can provide perfect forward secrecy, assuring any past connections are secure, if in the future encryption keys are compromised.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Public Key Infrastructure}\label{chap:background:PKI}

Asymmetric cryptography needs a secure mechanism to validate public keys, achieved by guaranteeing a public key is owned by a certain identity.
A \ac{PKI} is a central database of public-key certificates. It is responsible for managing, distributing, storing and revoking digital certificates. Digital certificates map public keys to identities, and are used to verify that a specific public key belongs to a given identity.
A \ac{PKI} has several components, e.g., a registration authority, a certification authority and a central database of stored keys.
A user can submit other entities' public keys. Entities that trust the user responsible for the submission can use the public keys.
There are alternative approaches to \ac{PKI}, such as a web of trust. This mechanism uses self-signed certificates and third parties attest these certificates. This approach is implemented in \ac{PGP}~\cite{modelingPKI}.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Random Number Generators}

A \ac{TRNG} can generate a sequence of numbers that cannot be predicted. Generating random numbers is a common and critical requirement for most cryptographic algorithms. Pseudo-random number generators are frequent in software approaches and are not truly random. They depend on an algorithm and initial conditions (seed) to generate random numbers. If the seed is known, the numbers are predictable.
\ac{TRNG} are hardware devices that generate numbers from unpredictable physical conditions. For this reason, \ac{TRNG}s are perfect for use in cryptography and secure cryptoprocessors.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Public-Key Cryptography Standards \#11}
\ac{PKCS} \#11 are a group of cryptographic standards, published by RSA Laboratories, which describe guidelines to manipulate common cryptographic objects.
The standards define an \ac{API} designed to interface between applications and cryptographic devices, such as smart cards or \ac{HSM}~\cite{pkcs11analysis}.
Applications can use, create and modify objects, without exposing them to the application's memory.
The standard has been widely used, promoting interoperability between devices. By using the same standard, devices can take advantage of another's \ac{API}.
Applications can access cryptographic devices through slots. The slots represent a socket or device reader. A session can be established through a slot, which represents a socket or device reader. The application can authenticate itself to a token with a default \ac{PIN}. The token holds private and public objects, which can be keys or certificates, among other objects, and can be accessed by the application.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{Secure Cryptoprocessors}\label{chap:background:cryptoprocessors}

In this section we discuss some computing systems that are relevant to this work.
Secure cryptoprocessors are dedicated physical computational devices for performing operations, such as cryptography. Among them, Smart Cards and \ac{HSM}, which are frequently used to offer cryptography services, will be discussed next. Then, the SmartFusion2 \ac{SoC} board is presented.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Hardware Security Modules}\label{chap:background:computing:hsm}

A \ac{HSM} is a high grade computational device, responsible for storage, management, generation of cryptographic keys, and cryptographic operations. Keys never leave the device and all operations are performed inside the \ac{HSM}. These devices have physical security mechanisms to achieve tamper-resistance, random number generators, support several cryptographic algorithms and have fail-safe mechanisms in place, in case of an attack, e.g., deletion of keys. Some devices have \ac{CPU} optimizations to improve the performance of operations.
These modules are much costlier than other computational systems but are more powerful in processing power and available services.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Smart Cards}\label{chap:background:computing:smartcards}

Smart Cards are a type of \ac{HSM}, credit card-sized with an embedded microchip and provide secure, tamper-resistant storage. These devices have a low price for manufacturing, which allows for bulk production and easy replacement if needed. They have a low computing power, and small memory which allows storage of a small amount of data. To be used, the cards need either contact or contactless readers. These characteristics make them extremely popular, used in many industries, such as retail, healthcare, communication and government.

% descrever smartfusion, caracteristicas, o que suporta, etc.
\subsection{Field-Programmable Gate Array System-on-Chip}\label{chap:background:computing:fpga}

A \ac{FPGA} is an integrated circuit designed to be programmed and configured after manufacturing. \ac{FPGA}s are often used to prototype and for highly specialized systems produced at low scale. One of the major advantages is their agility and flexibility to be customized for special use cases~\cite{cyberphysicalsystems}. However, the reconfigurability may introduce certain weaknesses to the system. Its bitstream is vulnerable to cloning, if no additional protection is applied. The configuration data of these devices is stored in non-volatile memory and may be directly copied if no authentication mechanism is implemented~\cite{drimer2007authentication}.

FPGA is composed of an array of electrically programmable logic blocks. FPGAs can provide a cheaper and faster solution compared to other circuits \cite{farooq2012fpga}. These devices can be partially reconfigured while the rest is still running, which is great for production systems. FPGAs are a good option due to less time-to-market and lower cost. They have been used in systems targeting different areas: multimedia, networking, control and bioinformatics \cite{dorta2009overview}.
These types of devices have also been used for implementing cryptographic algorithms, e.g., AES and ECC \cite{wolf2011design}.
%Despite this, FPGAs are a good options due to their less time to market and low volume cost.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection*{Smartfusion2 SoC}\label{chap:background:computing:smartfusion}

The SmartFusion2 \ac{SoC}, illustrated in Figure \ref{fig:smartfusion2}, integrates a non-volatile \ac{FPGA} with a \ac{SoC} and an internal \ac{NVM} of 512 KB, for storing boot code.
It has a \ac{SRAM} with 64 KB protected against \ac{SEU} or 80 KB unprotected. The board has an embedded ARM Cortex-M3 processor and a \ac{TRNG}, which provides a quality source of entropy, a critical part of most cryptographic algorithms. It supports multiple cryptographic functions: \ac{AES}, \ac{SHA}-256, \ac{HMAC} and \ac{ECC}, among others.

\begin{figure}[h!]
    \centering
    \includegraphics[width=1\textwidth]{./Images/Microsemi_Smartfusion2_BD.png}
    \caption{SmartFusion2 SoC FPGA Components}
    \label{fig:smartfusion2}
\end{figure}

The \ac{AES} system service supports encryption with 128 bit and 256 bit keys, with the following modes: ECB, CBC, OFB and CTR.
It provides a \ac{SHA}-256 hashing service, and a \ac{HMAC} service using the same hashing function.
The KeyTree service provides access to a SHA-256 based key-tree cryptography algorithm. Notably, it can be used to generate a message authentication code from a hash input and key, as a key derivation function with a key and salt as input or in challenge-response protocols.
The \ac{TRNG} service provides a raw entropy source based upon a noisy ring oscillator, measured against a system clock.

The device includes several relevant \ac{ECC} accelerators, with the \ac{NIST} defined P-384 elliptic curve.
It can generate public keys from the corresponding private key, using its scalar point multiplication service, by multiplying the scalar (private key) with the curve's base point. This service also allows the generation of a shared secret with \ac{ECDH}, by multiplying the device's private key with another user's public key.
The device also includes a point addition service, which allows the implementation of the \ac{ECDSA} algorithm for generating digital signatures.

The board provides a SRAM-PUF service to store user supplied or randomly generated keys.  It holds up to 56 key slots with a maximum of 4096 bits each.
It uses the random start-up behaviour of a 2KB \ac{SRAM} block to determine a static secret, unique to each device. There is enough repeatability in the SRAM turn-on behaviour to reconstruct the same secret each time. This secret is used to derive cryptographic keys with 256 bit security strength.
When power is removed, the secret disappears. At present, there is no technology able to detect the start-up behaviour of an SRAM \cite{smartfusionSecurityPractices}. It is determined by atomic-scale manufacturing differences in SRAM transistors.
Each enrolled key generates a key code, required along with the secret to generate the specific key.
The key codes are protected by \ac{AES} encryption and stored in a private section of the eNVM.

The eNVM is a tamper-resistant nonvolatile memory. It has a size of 512KB, with the top 64 pages reserved for keys and passcodes, inaccessible by the user.
It has a limited number of write cycles. For a predicted life span of 20 years, there is a limit of 1000 writes per page of 128 bytes \cite{smartfusionDatasheet}. For a smaller life span of 10 years, it has a limit of 10000 cycles per page.

The side-channel \ac{DPA} is an advanced power analysis technique, to compute values from statistical analysis of multiple cryptographic operations \cite{kocher1999differential}.
Not all services in the SmartFusion2 board are \ac{DPA}-resistant. ECC point multiplication, \ac{NRBG}, SRAM-PUF and KeyTree have strong resistance measures.
On the other hand, AES, SHA-256 and HMAC accelerators have very light countermeasures, and are not considered safe to use repeatedly with the same keys, or in situations where the adversary may be able to choose the ciphertext.
For the non \ac{DPA}-resistant services, there is a danger of key extraction if the same key is used repeatedly.
To extract information with this type of attack, physical access to the device is needed. In this case, the device has tamper detection mechanisms, so its services can be blocked, or the device is completely reset and all sensitive information is deleted.
This feature is called zeroization, and can be run when a tamper attempt is detected or manually by the user.
% To setup this type of attack, physical access to the device is needed with an oscilloscope to measure the voltage \cite{dpaKocher2011}.
% It is advisable for the services to rotate keys in a regular schedule.
% They are all safe of Timing Analysis.
% Tamper detection mechanisms are available so the user can block operations or completely reset the device with zeroization.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection*{Secure boot}

Boot code should be validated before its execution leads to potentially executing untrusted code. This can cause problems such as malware insertion, download of intellectual property or user spying.
Most embedded processors do not validate code before it is executed. The SmartFusion2 \ac{SoC} solves this problem by using a non-volatile memory (eNVM) to store boot code, which is write protected. It authenticates each stage of the boot process, to create a chain-of-trust.
Other systems also implement solutions to secure boot code. Infineon secures the boot process for ARM platforms by incorporating a \ac{TPM} into the platform. The \ac{TPM} operates as a root of trust, to certify the platform's integrity and correct system state. This prevents tampered kernels and fault attacks.
Texas Instruments Sitara processors allow the customer to specify a public key as a root of trust, into the device. This key is used to authenticate other keys, used to authenticate software components.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{State of the Art}\label{chap:background:art}

In general, \ac{HSM} have been applied in several contexts, to exploit their cryptographic services, secure storage and physical tamper protections.

Lesjak et al. \cite{iothardware} developed a system to secure remote snapshot acquisition, between the vendor and customers, by attaching a HSM to the products distributed among customers.
The messages are protected with the authenticated-encryption scheme \ac{AES}-\ac{GCM} and a TLS connection.
The Infineon security controller stores the TLS keys, and protects the data with the authenticated-encryption scheme, using its TRNG and a \ac{DH} based algorithm for key establishment with ECC keys. The controller has protections against side-channel attacks such as \ac{DPA} and physical manipulation.

Seol et al. \cite{trustediaashsm} proposed a system to isolate critical operations and sensitive data from cloud administrators, by implementing a \ac{HSM} next to a virtual machine.

Wolf et al. \cite{wolf2011design} implemented a HSM on a 663€ Xilinx Virtex-5 FPGA to secure network communications in vehicles. The authors implemented several cryptographic algorithms on the FPGA, e.g., AES-128 bit and ECC point-multiplication with a 256 bit curve. The board was connected to a microcontroller running linux, with additional algorithms available from a cryptographic library.

An IBM 4764 PCI-X cryptographic coprocessor has been used to store and manage symmetric keys, which encrypt biomedical data \cite{canim2011biomedical}. The symmetric keys, which encrypt the database, are transferred to the device using public-key cryptography. All database queries are performed by the coprocessor, since only it has the keys. The system uses AES with 128 bit encryption. Notably, the device has physical measures which ensure the keys are not leaked and the data is erased upon any attack.

Wherry \cite{wherry2003secure} recognizes the need for a HSM PKIs to protect the cryptographic keys.
Lorch et al. \cite{lorch2004hardware} uses an IBM 4758 cryptographic coprocessor to protect keys in a secure online repository for PKIs. The authors were able to store more than 800 2048-bit RSA key pairs on the device's secure storage. The PKI system interfaces with the HSM using a PKCS\#11 interface. Keys are generated in the coprocessor and the private key is never extracted. The RSA implementation is used to sign certificates, while the public key can be extracted to the application. A PIN is necessary to access the coprocessor.

Several protocols and HSM applications have also been proposed.
Rössler et al. \cite{rossler2005voting} applied a HSM to an e-voting electronic ballot box. The HSM is used for decrypting and verifying the signature of cast votes.
The votes decryption is done solely inside the electronic ballot box during the counting process.
Voters sign their ballot using a smart card, e.g., their citizen card.
Only the HSM is capable of counting votes, using its private key.
The author recommends 1024 bit RSA or 160 bit ECC keys for an actual implementation.

Additionally, authors have proposed using a HSM to secure web services by providing secure storage for keys and cryptography algorithms in the TLS protocol, but also for providing a complete security service, not just an algorithm implementation \cite{baldwin2003hardware}, \cite{mont2003secure}.

% include openHSM?
Martina et al. \cite{openhsm} presents OpenHSM, an open cryptographic protocol to manage private keys in an application embedded in a HSM.
The protocol was implemented with a customized FreeBSD system. The authors introduced administrator and operator groups to manage
private keys inside the HSM. The hardware was projected to be tamper proof using a Security Unit to manage all sensors and protection mechanisms.
The OpenSSL library and SQLite database were used to provide smart card support, data storage, secret sharing and X509v3 certificates.

% -------------------------
Several HSMs on the market have been studied.
Kehret et al. \cite{tlsintegration} studied two devices. VaultIC460, a secure microcontroller manufactured by Inside Secure with a RISC CPU. It includes a varied offering of cryptographic algorithms, such as, AES encryption, public-key cryptography with RSA and ECC, MAC, SHA, SSL support, as well as a random number generator. Additionally it includes several authentication mechanisms for users, to secure the connection between the application and device.
It includes 112 KB of tamper resistant memory for key storage.
ATECC508A from Microsemi is a small security controller with the asymmetric key algorithms: ECDSA and ECDH, along with SHA, a TRNG and storage of up to sixteen 256 bit keys.
This type of controllers, in general, are not suitable for this work. They are very limited, with no symmetric key algorithms, preventing encryption of large amounts of data. They are designed to be added to Internet of Things devices.

The survey \cite{ivarsson2010review} studies the features of four \ac{HSM} on the market, Keyper v2 by AEP, nShield Connect 6000 by Thales, Safenet Luna and Utimaco CryptoServer.
All devices support authentication using smartcards, password or a PIN. The AEP and Utimaco also have additional smartcard integration, for backing up the device's internal keys.
All devices have tamper resistant storage, a \ac{TRNG}, as well as a varied range of supported cryptographic services. Several AES encryption modes for both 128 and 256 bit keys, SHA, HMAC and public-key cryptography with RSA.
ECDSA and ECDH are supported by the devices from Safenet and Utimaco.
All devices provide a PKCS\#11 interface implementation for all cryptography services. The provided API can be used to build an application adapted to each user's requirements. The PKCS\#11 implementation does not output any unencrypted sensitive information, such as keys.

HSMs on the market go from 650€ up to \$39,000 \cite{HSMpriceArticles}, \cite{HSMPresentationPrices}.
One of the smallest and cheapest devices, the YubiHSM 2 by Yubico \cite{YubiHSM2}, is a \ac{USB} sized device for 650€. It supports several SHA algorithms, RSA, the asymmetric key ECC algorithms: ECDSA and ECDH, with multiple curves, a \ac{TRNG} and the \ac{AES}-\ac{CCM} authenticated encryption algorithm.
It provides a PKCS\#11 implementation, 128KB of tamper resistant storage for keys, and an authenticated and encrypted connection, between the PKCS\#11 API calls and the device.
For comparison, a M2S090TS SmartFusion2 evaluation kit is priced at 384 € \cite{smartfusionPrice}.

Overall, the studied systems and devices are not suited for this work for one or more reasons. All of the systems focus on a very specific context other than secure communications between entities. The HSMs used in these systems have a high cost and are not very flexible, which prevents its use for a low cost and portable secure communications device. Lastly, other systems use FPGAs which are not security focused and are vulnerable to tampering. Therefore, the proposed solution intends to use a lower cost and flexible system, such as the SmartFusion2 SoC with an integrated and secured FPGA. All the discussed systems could potentially be implemented in such a device.
For this reason, it is important to assess the suitableness of this type of device as a HSM for this solution and potentially others. Thus, this work will also have the objective of analysing and evaluating the chosen device regarding its services, functionalities and performance as a suitable HSM alternative.