\documentclass{memoir}
\usepackage{linalg}

% \begin{figure}[ht]
%     \centering
%     \incfig{riemmans-theorem}
%     \caption{Riemmans theorem}
%     \label{fig:riemmans-theorem}
% \end{figure}

\begin{document}
\section{Matrix Multiplication}
\begin{defn}
	Suppose $A$ is an $m\times n$ matrix and $C$ is an $n\times p$ matrix. Then $AC$ is defined to be the $m\times p$ matrix whose entries are defined as follows:
	\begin{align*}
		(AC)_{jk} = \sum_{r=1}^{n} A_{jr}C_{rk}.
	\end{align*}
\end{defn}
Matrix multiplication is not commutative.

\begin{cor}
	If $T \in \mathcal{L}(U,V)$ and $S \in \mathcal{L}(V,W)$, then $\mathcal{M}(ST) = \mathcal{M}(S)\mathcal{M}(T)$
\end{cor}
We denote $A_{j,\cdot}$ to be the $1\times n$ matrix consisting of row $j$ of $A$. Likewise, $A_{\cdot ,k}$ denotes the $m\times 1$ matrix consisting of column $k$ of $A$.
\begin{cor}
	Suppose $A$ is an $m\times n$ matrix and $C$ is an $n\times p$ matrix. Then
	\begin{align*}
		(AC)_{jk} = A_{j\cdot }C_{\cdot k}
	\end{align*}
\end{cor}
\begin{cor}
	Suppose $A$ is $m\times n$ matrix and $C$ is $n\times p$ matrix. Then
	\begin{align*}
		(AC)_{k} = AC_{k}
	\end{align*}
\end{cor}
\begin{cor}
	Suppose $A$ is $m\times n$ matrix and $c = \begin{bmatrix} c_1 \\ \vdots \\ c_n \end{bmatrix} $ is an $n\times 1$ matrix. Then
	\begin{align*}
		Ac = c_1A_{~1} + \ldots + c_nA_{~n}.
	\end{align*}
\end{cor}

\section{Invertibility and Isomorphic Vector Spaces}
\label{cha:invertibility_and_isomorphic_vector_spaces}

\subsection{Invertible Linear Maps}
\label{sec:invertible_linear_maps}

\begin{defn}
	A linear map $T \in \mathcal{L}(V,W)$ is called \textbf{invertible} if there exists a linear map $S \in \mathcal{L}(W,V)$ such that $ST$ equals the identity map on $V$ and $TS$ equals the identity map on $W$. \\

	A linear map that $S$ that satisfies this is called an \textbf{inverse} of $T$. we denote the inverse by $T^{-1}$.
\end{defn}
\begin{lemma}
	An invertible linear map has a unique inverse.
\end{lemma}
\begin{thm}
	A linear map is invertible if and only if it is injective and surjective.
\end{thm}

We will not show it here, but one can see that the inverse of a linear map corresponds to the matrix inverse.
\subsection{Isomorphic Vector Spaces}
\label{sec:isomorphic_vector_spaces}

\begin{defn}[Isomorphism and Isomorphic]
	An \textbf{isomorphism between vector spaces} is an invertible linear map. Two vector spaces are called \textbf{isomorphic} if there is an isomorphism from one vector space onto the other one.
\end{defn}
\begin{lemma}[Equal dimension implies isomorphic]
	Two finite-dimensional vector spaces over $F$ are isomorphic if and only if they have the same dimension.
\end{lemma}
\begin{cor}
	Suppose $v_1,\ldots,v_n$ is a basis of $V$ and $w_1,\ldots,w_m$ is a basis of $W$. Then $\mathcal{M}$ is an isomorphism between $\mathcal{L}(V,W)$ and $F^{m,n}$.
\end{cor}
\begin{cor}[Dimension of Space of Linear Maps]
	Suppose $V$ and $W$ are finite-dimensional. Then $\mathcal{L}(V,W)$ is finite-dimensional and
	\begin{align*}
		\textrm{dim}\mathcal{L}(V,W) = ( \textrm{dim}V) ( \textrm{dim}W)
	\end{align*}
\end{cor}
\subsection{Linear Maps Thought of as Matrix Multiplication}
\label{sec:linear_maps_thought_of_as_matrix_multiplication}

\begin{defn}[Matrix of a vector]
	Suppose $v \in V$ and $v_1,\ldots,v_n$ is a basis of $V$. The \textbf{matrix of $v$} with respect to this basis is the $n\times 1$ matrix
	\begin{align*}
		\mathcal{M}(v) = \begin{bmatrix} c_1 \\ \vdots \\ c_n \end{bmatrix} ,
	\end{align*}
	where $c_1,\ldots,c_n$ are the scalars such that
	\begin{align*}
		v = c_1v_1 + \ldots + c_nv_n .
	\end{align*}
\end{defn}
\begin{cor}
	Suppose $T \in \mathcal{L}(V,W)$ and $v_1,\ldots,v_n$ is a basis of $V$, $w_1,\ldots,w_m$ a basis of $W$. Then the $ k$-th column of $\mathcal{M}(T)$ equals $\mathcal{M}(v_k)$.
\end{cor}

\begin{lemma}[Linear maps act like matrix multiplication]
	Suppose $T \in \mathcal{L}(V,W)$ and $v \in V$. Suppose $v,w$ are bases of $W$. Then
	\begin{align*}
		\mathcal{M}(Tv) = \mathcal{M}(T) \mathcal{M}(v) .
	\end{align*}
\end{lemma}
\subsection{Operators}
\label{sec:operators}

\begin{defn}[Operators]
	A linear map from a vector space to itself is called an \textbf{operator} or \textbf{endomorphism}. We notate $\mathcal{L}(V)$ as the set of all operators on $V$.
\end{defn}
\begin{thm}[Injectivity is equivalent to surjectivity in finite dimensions]
	Suppose $V$ is finite-dimensional and $T \in \mathcal{L}(V)$. Then the following are equivalent:
	\begin{itemize}
		\item $T$ is invertible
		\item $T$ is injective
		\item $T$ is surjective
	\end{itemize}
\end{thm}
\end{document}


\section{Horodeckis criterion in $C^*$-algebras}
In this section, we are going to present the result
analogous to the Theorem \ref{thm:main}, but this time in the C*-algebra setting.
It is expected that the previous assumption of injectivity
will have to be retained somehow. That leads to the choice of \emph{nuclear} C*-algebras,
i.e. algebras whose universal enveloping von Neumann algebras (the second dual spaces) are
injective. Not only it allows us to define a tensor product of two C*-algebras
uniquely, but also facilitates the usage of the previous result.
Nuclear C*-algebras, among others, share also the property of
local reflexivity, which will prove itself indispensable for
our line of reasoning.

Let $\mathcal{A}$ and $\mathcal{B}$ be C*-algebras.
By $\mathcal{A} \otimes_{max} \mathcal{B}$
and $\mathcal{A} \otimes_{min} \mathcal{B}$,
we denote respectively the \emph{maximal} and \emph{minimal}
C*-tensor product of $\mathcal{A}$ and $\mathcal{B}$.
It is known that if at least one of the algebras, say $\mathcal{A}$,
is nuclear, then those two tensor norms coincide and
the tensor product C*-algebra is in fact uniquely defined.
For a nuclear C*-algebra $\mathcal{A}$, we denote that tensor product
by $\mathcal{A} \bar{\otimes} \mathcal{B}$.
A C*-algebra $\mathcal{A}$ is by definition \emph{locally reflexive},
if for every finite-dimensional operator system $E \subset \mathcal{A}^{**}$,
i.e. a closed self-adjoint subspace containing the identity element,
there is a net $(T_{\lambda})$ of completely positive contractions,
$T_{\lambda}: E \rightarrow \mathcal{A}$,
which converges to the identity map on $E$ in the weak operator
topology. Every nuclear C*-algebra is locally reflexive
(see Brown and Ozawa\cite{Brown2008}, 9.3.1-9.3.3).
The algebras $\mathcal{A}$ and $\mathcal{B}$
can be treated as operator spaces in a natural way.
Thus, it is possible to introduce the operator space projective
tensor norm on the dual operator spaces $\mathcal{A}^{*}$
and $\mathcal{B}^{*}$, and the completion of the algebraic tensor product with
respect to that norm will be denoted by
$\mathcal{A}^{*} \hat{\otimes} \mathcal{B}^{*}$. Hence, we can introduce a cone of
separable states with respect to $\mathcal{A}$ and $\mathcal{B}$ in the same way as
in Section 2. Let  $\mathcal{S}(\mathcal{A})$ and $\mathcal{S}(\mathcal{B})$
denote the state spaces of $\mathcal{A}$ and $\mathcal{B}$, respectively.
We define a positive cone $C_{\mathcal{A},\mathcal{B}}$
of separable states with respect to $\mathcal{A}$ and $\mathcal{B}$ by
\begin{equation}
C_{\mathcal{A},\mathcal{B}} =
\overline{{\rm conv}}^{||\cdot||_{\wedge}}
\left \{\omega \otimes \varphi: \, \,\omega \in \mathcal{S}(\mathcal{A}),
\varphi \in \mathcal{S}(\mathcal{B})\right \}.
\end{equation}
It is clear that a state on $\mathcal{A} \bar{\otimes} \mathcal{B}$ is separable,
i.e. $\tilde{\phi} \in C_{\mathcal{A}, \mathcal{B}}$,
if and only if $\tilde{\phi}$ is a separable state
on the von Neumann algebra $\mathcal{A}^{**} \bar{\otimes} \mathcal{B}^{**}$.
\begin{theorem}
Let $\mathcal{A}$ and $\mathcal{B}$ be C*-algebras and suppose that
$\mathcal{A}$ is nuclear. A state $\tilde{\phi} \in
(\mathcal{A} \bar{\otimes} \mathcal{B})^{*}$ is separable
with respect to $\mathcal{A}$ and $\mathcal{B}$,
if and only if the functional $\tilde{\phi} \circ ( \mathbf{1} \otimes S )$
is positive for any positive and finite rank map $S: \mathcal{A} \rightarrow \mathcal{B}$.
\end{theorem}
{\bf Proof.} Let $\mathfrak{M}=\mathcal{A}^{**}$ and $\mathfrak{N}=\mathcal{B}^{**}$.
By the assumption, $\mathfrak{M}$ is injective. If $\tilde{\phi}$ is separable with respect to
$\mathcal{A}$ and $\mathcal{B}$, then it is also separable on
$\mathfrak{M} \bar{\otimes} \mathfrak{N}$. For any positive map
$S: \mathcal{A} \rightarrow \mathcal{B}$, the second dual map
$S^{**}:\mathfrak{M} \rightarrow \mathfrak{N}$ is positive and normal.
It follows from the first part of Theorem \ref{thm:main} that for any positive
$z \in \mathfrak{M} \bar{\otimes} \mathfrak{M}$,
$\langle (\mathbf{1} \otimes S^{**})(z), \tilde{\phi} \rangle \geq 0$.
Therefore, $\tilde{\phi} \circ (\mathbf{1} \otimes S)$ is a
positive functional on $\mathcal{A} \bar{\otimes} \mathcal{A}$.

Conversely, suppose that $\tilde{\phi} \circ (\mathbf{1} \otimes S) \geq 0$
for any positive and finite rank map $S: \mathcal{A} \rightarrow \mathcal{B}$.
We are going to show that the state $\tilde{\phi}$
is separable on $\mathfrak{M} \bar{\otimes} \mathfrak{N}$.
Suppose on the contrary that $\tilde{\phi}$ is not separable on
$\mathfrak{M} \bar{\otimes} \mathfrak{N}$.
By Theorem \ref{thm:main}, there is a positive normal and finite rank
map $\tilde{S}: \mathfrak{M} \rightarrow \mathfrak{N}$
and a positive element $z \in \mathfrak{M} \bar{\otimes} \mathfrak{M}$,
such that
\begin{equation}
\label{eq:Random6347}
\langle(\mathbf{1} \otimes \tilde{S})(z), \tilde{\phi}\rangle < 0.
\end{equation}
Moreover, we can choose the element $z$ from the algebraic tensor product
$\mathfrak{M} \otimes \mathfrak{M}$, i.e. $z = \sum_{j=1}^{N} x_{j} \otimes y_{j}$,
each $x_{j}$ and $y_{j} \in \mathfrak{M}$. Let $E \subset \mathfrak{M}$ be an
operator system generated by $\{ x_{j}, y_{j}\}_{j=1}^{N}$.
Since $\mathcal{A}$ is locally reflexive, there exists
a net $(T_{\lambda})$ of completely positive contractions
$T_{\lambda}: E \rightarrow \mathcal{A}$,
such that $T_{\lambda}$ converges to the identity map
on $E$ in the weak* operator topology, i.e.
for any $\omega \in \mathcal{A}^{*}$ and $x \in E$,
$ \langle \omega, T_{\lambda}x \rangle\stackrel{\lambda}{\rightarrow}
\langle x, \omega \rangle$. Let $a_{\lambda}$ denote the positive element
of $\mathcal{A} \otimes \mathcal{A}$,
$a_{\lambda} = (T_{\lambda} \otimes T_{\lambda}) (z) =
\sum_{j=1}^{N} T_{\lambda} x_{j} \otimes T_{\lambda} y_{j}$, and let
$i: \mathcal{A} \rightarrow \mathcal{A}^{**}=\mathfrak{M}$
be the canonical embedding. Then,
$i(a_{\lambda}) \stackrel{\lambda}{\rightarrow} z$ $\sigma$-weakly.
Since $\mathcal{B}$ is a Banach space, it has a local
reflexivity property in the following sense (see Ryan\cite{Ryan2002}, chapter 5.5).
For any finite-dimensional subspace $F \subset \mathcal{B}^{**}$,
there is an operator $P_{F}: F \rightarrow \mathcal{B}$
such that for any $y \in \mathcal{B}^{**} = \mathfrak{N}$
and $\varphi \in \mathcal{B}^{*}$, one has
\begin{equation}
\label{eq:Random24093}
\langle \varphi, P_{F}y \rangle =\langle y, \varphi \rangle.
\end{equation}
Let $F = \tilde{S}(\mathfrak{M})$.
It is obvious from equation \eqref{eq:Random24093} that $P_{F}$ is positive.
We define a positive map $S: \mathcal{A} \rightarrow \mathcal{B}$ by
$S = P_{F} \circ \tilde{S} \circ i$. Then,
for any $A \in \mathcal{A}$ and $\varphi \in \mathcal{B}^{*}$, we have
\begin{eqnarray}
\langle \varphi, SA \rangle =
\langle \varphi, P_{F} ( \tilde{S} \circ i (A)) \rangle =
\langle  \tilde{S} \circ i (A), \varphi \rangle \nonumber\\
=\langle i(A), \tilde{S}_{*} \varphi \rangle =
\langle \tilde{S}_{*} \varphi, A \rangle,
\end{eqnarray}
Suppose now that
$\tilde{\phi} = \lim \limits_{n} \sum_{i=1}^{n}\omega_{i} \otimes \varphi_{i}$,
where each $\omega_{i} \in \mathcal{A}^{*}$,
$\varphi_{i} \in \mathcal{B}^{*}$.
The limit is understood as the one in the projective
operator norm $|| \cdot ||_{\wedge}$, and hence also in the weak and weak* topology on
$(\mathcal{A} \bar{\otimes} \mathcal{B})^{*}$. Then, by the assumption,
$\langle \tilde{\phi},(\mathbf{1} \otimes S) (a_{\lambda}) \rangle \geq 0$. Moreover,
\begin{eqnarray}
\sum \limits_{i=1}^{n}\langle \omega_{i} \otimes \varphi_{i},
(\mathbf{1} \otimes S)(a_{\lambda}) \rangle =
\sum \limits_{i=1}^{n} \sum \limits_{j=1}^{N}
\langle \omega_{i} , T_{\lambda} x_{j} \rangle
\langle \tilde{S}_{*} \varphi_{i}, T_{\lambda} y_{j}\rangle \nonumber\\
\stackrel{\lambda}{\longrightarrow}\sum \limits_{i=1}^{n} \sum \limits_{j=1}^{N}
\langle  x_{j}, \omega_{i} \rangle\langle  y_{j},  \tilde{S}_{*} \varphi_{i} \rangle =
\langle (\mathbf{1} \otimes \tilde{S})(z),
\sum \limits_{i=1}^{n} \omega_{i} \otimes \varphi_{i} \rangle .
\end{eqnarray}
Taking the limit with respect to $n$,
since $(T_{\lambda})$ is a net of contractions, we get that
$\langle (\mathbf{1} \otimes \tilde{S}) (z) ,
\tilde{\phi}\rangle \geq 0$, which contradicts \eqref{eq:Random6347},
and so $\tilde{\phi}$ is separable on
$\mathfrak{M} \bar{\otimes} \mathfrak{N}$. $\Box$ \\
That essentially generalizes the result of St{\o}rmer's, who proved a similar theorem under
additional conditions. Namely, he used all positive linear maps and assumed that $\mathcal{B}$
was an UHF algebra \cite{Stormer2009}.


\documentclass[utf8x,hyperref={pdfpagelabels=false}]{beamer}

\usepackage[utf8x]{inputenc}
\usepackage[OT1]{fontenc}
\usepackage{graphicx}
\usepackage{xcolor}
\usepackage{amsmath}

\usetheme{Malmoe}  % Now it's a beamer presentation with the lisa theme!
\usecolortheme{beaver}
\setbeamertemplate{footline}[page number]
\setbeamertemplate{navigation symbols}{}

\title{Convolutions for neural networks}

\author{%
Arnaud Bergeron
}
\date{August 10, 2015}

\definecolor{termblue}{RGB}{51, 51, 179}
\newcommand{\term}[1]{\textcolor{termblue}{#1}}

\begin{document}

\begin{frame}[plain]
 \titlepage
\end{frame}

\setcounter{page}{1}

\section{Convolution}

% Basic operation
\begin{frame}
The basic convolution operation
\begin{overlayarea}{\textwidth}{5.6cm}
\only<1>{
\includegraphics[width=\textwidth]{Conv-single}
}
\only<2->{
\begin{displaymath}
C(i, j) = \sum^{x = 0}_{m-1} \sum^{y = 0}_{n-1} A(x + i, y + j) F(x, y)
\end{displaymath}
\begin{itemize}
\item $(m, n)$ is the size of the filter.
\end{itemize}
}
\end{overlayarea}
Where $A$ is the input channel, $F$ is the filter and $C$ is the output channel.
\end{frame}

\begin{frame}
The basic convolution operation with multiple outputs
\begin{overlayarea}{\textwidth}{5.6cm}
\only<1>{
\includegraphics[width=\textwidth]{Conv-mout}
}
\only<2->{
\begin{displaymath}
C_{o}(i, j) = \sum^{x = 0}_{m-1} \sum^{y = 0}_{n-1} A(x + i, y + j) F_{o}(x, y)
\end{displaymath}
\begin{itemize}
\item $(m, n)$ is the size of the filters.
\item $o$ is the output channel.
\end{itemize}
}
\end{overlayarea}
where $A$ is the input channel, $F$ are the filters and $C$ are output channels.
\end{frame}

\begin{frame}
The basic convolution operation with multiple inputs
\begin{overlayarea}{\textwidth}{5.6cm}
\only<1>{
\includegraphics[width=\textwidth]{Conv-min}
}
\only<2->{
\begin{displaymath}
C(i, j) = \sum^{k=0}_l \sum^{x = 0}_{m-1} \sum^{y = 0}_{n-1} A_{k}(x + i, y + j) F_{k}(x, y)
\end{displaymath}
\begin{itemize}
\item $(m, n)$ is the size of the filters.
\item $k$ is the input channel.
\item $l$ is the number of input channels.
\end{itemize}
}
\end{overlayarea}
where $A$ are the input channels, $F$ is the filter bank and $C$ is the output channel.
\end{frame}

\begin{frame}
The basic convolution operation with multiple inputs and outputs
\begin{overlayarea}{\textwidth}{5.6cm}
\only<1>{
\includegraphics[width=\textwidth]{Conv-basic}
}
\only<2->{
\begin{displaymath}
C_{o}(i, j) = \sum^{k=0}_{l-1} \sum^{x = 0}_{m-1} \sum^{y = 0}_{n-1} A_{k}(x + i, y + j) F_{ko}(x, y)
\end{displaymath}
\begin{itemize}
\item $(m, n)$ is the size of the filters.
\item $o$ is the output channel.
\item $k$ is the input channel.
\item $l$ is the number of input channels.
\end{itemize}
}
\end{overlayarea}
where $A$ are the input channels, $F$ are the filter banks and $C$ are the output channels.
\end{frame}

\begin{frame}
The basic convolution operation with batches
\begin{overlayarea}{\textwidth}{5.6cm}
\only<1>{
\includegraphics[width=\textwidth]{Conv-basic}
}
\only<2->{
\begin{displaymath}
C_{bo}(i, j) = \sum^{k=0}_{l-1} \sum^{x = 0}_{m-1} \sum^{y = 0}_{n-1} A_{bk}(x + i, y + j) F_{ko}(x, y)
\end{displaymath}
\begin{itemize}
\item $(m, n)$ is the size of the filters.
\item $o$ is the output channel.
\item $k$ is the input channel.
\item $l$ is the number of input channels.
\item $b$ is the batch.
\end{itemize}
}
\end{overlayarea}
where $A$ are the input channels, $F$ are the filter banks and $C$ are the output channels.
\end{frame}

% Definitions
\begin{frame}
Some vocabulary:
\begin{description}[filter banks]
\item[filter] what we call the smaller or "learned" 2D matrix in a traditional convolution.
\item[channel] what we call input or output 2D matrices in a traditional convolution.  Sometimes called \term{feature map}.
\item[filter bank] group of filters whose convolution output will be summed to form one output channel.  Sometimes called \term{filter stack}.
\end{description}
\end{frame}

% Technical considerations
\begin{frame}
Memory layout for images: 'bc01' (a.k.a 'nchw')

\begin{itemize}
\item first dimension is the batch ('b')
\item second dimension is the channel ('c')
\item last two dimensions are the data ('0', '1')
\end{itemize}

Memory layout for filters: 'nc01' ('nchw')

\begin{itemize}
\item first dimension is the output channel ('n')
\item second dimension is the input channel ('c')
\item last two dimensions are the data ('0', '1')
\end{itemize}

\ \\

\uncover<2->{Some other packages may use different conventions.}
\end{frame}

\section{Pooling}

\begin{frame}
Basic pooling operation
\includegraphics[width=\textwidth]{Pool-max}
\end{frame}

\begin{frame}
Max Pooling
\begin{displaymath}
O_k(i, j) = \max_{\substack{0 \leq x < m \\ 0 \leq y < n}} I_k(x + i, y + j)
\end{displaymath}
Average Pooling
\begin{displaymath}
O_k(i, j) = \frac{1}{mn}\sum^{x = 0}_{m - 1} \sum^{y = 0}_{n - 1} I_k(x + i, y + j)
\end{displaymath}
\begin{itemize}
\item $k$ is the channel.
\item $(m, n)$ is the size of the filters.
\end{itemize}
\end{frame}

\end{document}


%%% Template originaly created by Karol Kozioł (mail@karol-koziol.net) and modified for ShareLaTeX use

\documentclass[a4paper,11pt]{article}

\usepackage{amsmath}
\usepackage[T1]{fontenc}
\usepackage[utf8]{inputenc}
\usepackage{graphicx}
\usepackage[usenames,dvipsnames]{xcolor}

\usepackage{sansmath}
\renewcommand\familydefault{\sfdefault}
\usepackage{tgheros}

\usepackage{amsmath,amssymb,amsthm,textcomp}
\usepackage{enumerate}
\usepackage{multicol}
\usepackage{tikz}
\usetikzlibrary{graphs,automata,arrows,shapes.misc}

\usepackage{geometry}
\geometry{total={210mm,297mm},
left=25mm,right=25mm,%
bindingoffset=0mm, top=20mm,bottom=20mm}

\linespread{1.3}

\newcommand{\linia}{\rule{\linewidth}{0.5pt}}

% custom theorems if needed
\newtheoremstyle{mytheor}
    {1ex}{1ex}{\normalfont}{0pt}{\scshape}{.}{1ex}
    {{\thmname{#1 }}{\thmnumber{#2}}{\thmnote{ (#3)}}}

\theoremstyle{mytheor}
\newtheorem{defi}{Definition}

% my own titles
\makeatletter
\renewcommand{\maketitle}{
\begin{center}
\vspace{2ex}
{\huge \textsc{\@title}}
\vspace{1ex}
\\
\linia\\
\@author \hfill \@date
\vspace{4ex}
\end{center}
}
\makeatother
%%%

% custom footers and headers
\usepackage{fancyhdr}
\pagestyle{fancy}
\lhead{}
\chead{}
\rhead{}
\lfoot{Automatic~Verification Assignment \#5}
\cfoot{}
\rfoot{Page \thepage}
\renewcommand{\headrulewidth}{0pt}
\renewcommand{\footrulewidth}{0pt}
%

% all section titles centered and bolded
\usepackage{sectsty}
\allsectionsfont{\bfseries\large}
%
% add section label
\renewcommand\thesection{Problem~\arabic{section}:}
\renewcommand\thesubsection{(\alph{subsection})}
%

%%%----------%%%----------%%%----------%%%----------%%%

\begin{document}

\title{Homework Assignment~\#5}

\author{R02943142 Hsieh, Chiao}

\maketitle

\section{B\"uchi Automaton}
Define a B\"uchi automaton (by drawing its transition diagram) for each of the following temporal properties.

\subsection{$p$ holds initially (at position 0) and at every third position (3, 6, etc.).}
Answer.
\smallskip \\
The automaton for the property is as follow. It rejects infinite words where $\neg p$ is at one of the positions that are multiple of 3.
\begin{center}
\begin{tikzpicture}
\begin{graph}[circular placement,
  clockwise=4,
  nodes={draw, circle},
  edges={>=latex},
  radius=1.5cm,
  phase=180
  ]{
   "$s_0$"[accepting] <- ""[draw=none],
   "$s_1$"[accepting],
   "$s_2$"[accepting],
   "$s_3$",
   "$s_0$"->[edge label={$p$}]"$s_1$",
   "$s_0$"->[edge label={$\neg p$}, swap]"$s_3$",
   "$s_1$"->[edge label={$p, \neg p$}]"$s_2$",
   "$s_2$"->[edge label={$p, \neg p$}]"$s_0$",
   "$s_3$"->[edge label={$p, \neg p$}, loop right]"$s_3$"
};
\end{graph}
\end{tikzpicture}
\end{center}

\subsection{Whenever $p$ holds, $q$ must hold eventually at a strictly later position.}
Answer.
\smallskip \\
The automaton for the property is as follow. Basically, it corresponds to the LTL property, $\textbf{AG}(p \rightarrow \textbf{XF} q))$.
\begin{center}
\begin{tikzpicture}[font=\scriptsize]
\begin{graph}[circular placement,
  clockwise=4,
  nodes={draw, circle},
  edges={>=latex, inner sep=1pt},
  radius=2.5cm,
  phase=180
  ]{
   "$s_0$"[accepting] <- ""[draw=none],
   "$s_1$"[accepting],
   "$s_2$"[accepting],
   "$s_3$",
   "$s_0$"->[edge label={$\neg{p}q$}, out=120,in=90,looseness=8]"$s_0$",
   "$s_0$"->[edge label={$\neg{p}\neg{q}$}, bend left]"$s_1$",
   "$s_0$"->[edge label={$pq$}, bend left=15]"$s_2$",
   "$s_0$"->[edge label={$p\neg{q}$}, bend left=15]"$s_3$",
   "$s_1$"->[edge label={$\neg{p}q$}, bend left=15, swap]"$s_0$",
   "$s_1$"->[edge label={$\neg{p}\neg{q}$}, loop above]"$s_1$",
   "$s_1$"->[edge label={$p$}, bend left]"$s_2$",
   "$s_2$"->[edge label={$\neg{p}q$}, bend left=15, swap]"$s_0$",
   "$s_2$"->[edge label={$pq$}, loop right]"$s_2$",
   "$s_2$"->[edge label={$\neg{q}$}, bend left]"$s_3$",
   "$s_3$"->[edge label={$\neg{p}q$}, bend left]"$s_0$",
   "$s_3$"->[edge label={$pq$}, bend left=15]"$s_2$",
   "$s_3$"->[edge label={$\neg{q}$}, loop below]"$s_3$"
};
\end{graph}
\end{tikzpicture}
\end{center}

\section{LTL to B\"uchi Automata Translation}
Apply the simple on-the-fly translation algorithm to construct a generalized B\"uchi automaton from the LTL formula $(p \land q) \mathcal{U} (p \lor q)$
Please try to illustrate how the algorithm works by showing a few partially constructed automata during the translation.

\noindent Answer.
\smallskip \\
Initially, we begin with the state $s_0$ with the formula $\phi= (p \land q) \mathcal{U} (p \lor q)$.
Following the GPVW algorithm, $s_0$ is split into two states $s_1, s_2$.
Then, we first process $s_1$ and put $s_2$ into stack. For $s_1$, the $p\land q$ in New is processed,
and two formulae $p$ and $q$ are added to New.
The above steps are shown in the following figure.

\begin{center}
\begin{tikzpicture}[
  every node/.style={draw},
  every edge/.style={>=latex}
  ]
  \node[cross out] (0) at (0, 0){
  \begin{tabular}{l}
    ID: 0 \\
    IN: init \\
    Old: \\
    New: $\phi$ \\
    Next:
  \end{tabular}
  };
  \node (1) at (5,0){
  \begin{tabular}{l}
    ID: 1 \\
    IN: init \\
    Old: $\phi, p \land q$\\
    New: $\phi, p \land q, p, q$ \\
    Next: $\phi$
  \end{tabular}
  };
  \node (2) at (9,0){
  \begin{tabular}{l}
    ID: 2 \\
    IN: init \\
    Old: $\phi$\\
    New: $\phi, p \lor q$ \\
    Next:
  \end{tabular}
  };
  \node[draw=none] (split) at (2.3,0){\Huge $\to$};
\end{tikzpicture}
\end{center}

Next state for $s_1$ is constructed as $s_3$.
$s_3$ is almost identical to $s_0$;
the only difference is that the incoming edge is from $s_1$.
Hence, the state $s_3$ is also split into two states $s_4$ and $s_5$.
$s_4$ is processed and $s_5$ is pushed into stack.
After comparison, $s_4$ is merged with $s_1$.
Currently, $\{s_2, s_5\}$ are in the stack.

\begin{center}
\begin{tikzpicture}[
  every node/.style={draw},
  every edge/.style={>=latex}
  ]
  \node[cross out] (3) at (0, 0){
  \begin{tabular}{l}
    ID: 3 \\
    IN: 1 \\
    Old: \\
    New: $\phi$ \\
    Next:
  \end{tabular}
  };
  \node (1) at (5,0){
  \begin{tabular}{l}
    ID: 1\textcolor{Gray}{, 4} \\
    IN: init, 1 \\
    Old: $\phi, p \land q$\\
    New: $\phi, p \land q, p, q$ \\
    Next: $\phi$
  \end{tabular}
  };
  \node (5) at (9,0){
  \begin{tabular}{l}
    ID: 5 \\
    IN: 1 \\
    Old: $\phi$\\
    New: $\phi, p \lor q$ \\
    Next:
  \end{tabular}
  };
  \node[draw=none] (split) at (2.3,0){\Huge $\to$};
\end{tikzpicture}
\end{center}

Then, we take the last state $s_5$ in the stack.
State $s_5$ is split into two states $s_6$ and $s_7$ due to the formula $p \lor q$.
For $s_6$, since there is no formula in Next, it is processed simply by moving formulae from Old to New and adding a Next state $s_8$ with self loop  and without any formula in Old.
At this time, $\{s_2, s_7\}$ are in the stack.
$s_7$ is then processed in the same way as $s_6$, and finally only $s_2$ remains in the stack.

\begin{center}
\begin{tikzpicture}[
  every node/.style={draw},
  every edge/.style={>=latex}
  ]
  \node[cross out] (5) at (0, 0){
  \begin{tabular}{l}
    ID: 5 \\
    IN: 1 \\
    Old: $\phi$\\
    New: $\phi, p \lor q$ \\
    Next:
  \end{tabular}
  };
  \node (6) at (5,0){
  \begin{tabular}{l}
    ID: 6 \\
    IN: 1 \\
    Old: $\phi, p \lor q$\\
    New: $\phi, p \lor q, p$\\
    Next:
  \end{tabular}
  };
  \node (7) at (8.5,0){
  \begin{tabular}{l}
    ID: 7 \\
    IN: 1 \\
    Old: $\phi, p \lor q$\\
    New: $\phi, p \lor q, q$\\
    Next:
  \end{tabular}
  };
  \node (8) at (11.5,0){
  \begin{tabular}{l}
    ID: 8 \\
    IN: 6, 7, 8 \\
    Old: \\
    New: \\
    Next:
  \end{tabular}
  };
  \node[draw=none] (split) at (2.3,0){\Huge $\to$};
\end{tikzpicture}
\end{center}

\pagebreak

For $s_2$, it is split into two states $s_9$ and $ s_{10}$ because of
$p \lor q$.
However, after checking, $s_9$ is merged with $s_6$ and $s_10$ is merged with $s_7$.
Therefore, no additional state is introduced.

\begin{center}
\begin{tikzpicture}[
  every node/.style={draw},
  every edge/.style={>=latex}
  ]
  \node[cross out] (2) at (0, 0){
  \begin{tabular}{l}
    ID: 2 \\
    IN: init \\
    Old: $\phi$\\
    New: $p \lor q$ \\
    Next:
  \end{tabular}
  };
  \node (6) at (5,0){
  \begin{tabular}{l}
    ID: 6\textcolor{Gray}{, 9} \\
    IN: 1, init \\
    Old: $\phi, p \lor q$\\
    New: $\phi, p \lor q, p$\\
    Next:
  \end{tabular}
  };
  \node (7) at (9,0){
  \begin{tabular}{l}
    ID: 7\textcolor{Gray}{, 10} \\
    IN: 1, init \\
    Old: $\phi, p \lor q$\\
    New: $\phi, p \lor q, q$\\
    Next:
  \end{tabular}
  };
  \node[draw=none] (split) at (2.3,0){\Huge $\to$};
\end{tikzpicture}
\end{center}

Now we discuss about the accepting states. There is only one $\mathcal{U}$ operator in $\phi$, so only one set of final state.
The set of states with $p \lor q$ is $\{s_6, s_7\}$, and the set without $\phi$ is $\{s_8\}$.
Thus, the set of final states is $\{s_6, s_7, s_8\}$.
With the help of GOAL, we then convert the labels on states to labels on edges.
The final automaton should look like below.

\begin{center}
\begin{tikzpicture}
\begin{graph}[circular placement,
  clockwise=4,
  nodes={draw, circle},
  edges={>=latex},
  radius=2cm,
  phase=180
  ]{
   "$s_1$" <- ""[draw=none],
   "$s_6$"[accepting],
   "$s_8$"[accepting],
   "$s_7$"[accepting],
   "$s_1$"->[edge label={$pq$},out=120,in=90,looseness=8]"$s_1$",
   "$s_1$"->[edge label={$p$}]"$s_6$",
   "$s_1$"->[edge label={$q$},swap]"$s_7$",
   "$s_6$"->[edge label={$True$}]"$s_8$",
   "$s_7$"->[edge label={$True$}, swap]"$s_8$",
   "$s_8$"->[edge label={$True$}, loop right]"$s_8$"
};
\end{graph}
\end{tikzpicture}
\end{center}

\end{document}


\subsection{Query 2}
\label{sec:solution-q2}

The second query focuses on identifying the $ k $ recent comments that are supported by the larger communities.
The value of \textit{k} is provided as parameter, whereas a community is defined as the set of users, friends each other, who have liked that comment.
%
The topology of our solution is represented in Figure~\ref{fig:q2-architecture}.
%
The \textit{Event Dispatcher} is a centralized operator that reads in parallel comments, like events, and friendship events from several data sources and, preserving their timestamp order, sends them downstream.
%
The \textit{Friendships Operator} receives the friendship events and updates the social graph, connecting the users that establish a new friend relation.
The social graph is stored into Redis, where it is represented with adjacency lists indexed by the user identifier.
%
This representation allows us to efficiently retrieve all the user's friends, that are needed to compute the largest community supporting a comment.
%
The \textit{Comment Score Updater} receives comments and like events, and computes the score associated to each comment as follows.
%
From each comment that was created not more than \textit{d} seconds ago, where \textit{d} is an input parameter, the operator extracts the set of users $ U $ that have liked it.
%
For each user $ u \in U $, the \textit{Comment Score Updater} creates a user-based social graph $ G_u $, containing the user $ u $, his/her friends, and the friends of his/her friends; in $ G_u $ the users are interconnected with respect to their friendships.
%
Afterwards, for each user-based social graph $ G_u, \forall u \in U $, the operator runs a customized version of the well-known and widely used Bron-Kerbosch algorithm~\cite{BronKerbosch1973} to identify the largest clique $ C_u $ associated to each user.
%
Observe that, at this point, the computed cliques depend only on the user-based social graph (i.e., his/her friendships) and also include users who have not liked the comment.
Therefore, \textit{Comment Score Updater} removes from each clique $ C_u $ the users who have not liked the comment, thus identifying the largest one as the community that supports the comment.
%
Determining the cliques within a graph is an NP-hard problem, so we adopted a lazy approach that executes the Bron-Kerbosch algorithm
(1) on subgraphs of the social network that, relying on friendships and being independent from like events, should change slowly; and
(2) just on comments that have received a new like event, i.e., avoiding to recompute the clique if not needed.
%
Nevertheless, when a new friendship relation is established, the \textit{Comment Score Updater} invalidates and recomputes all the cliques.
%
Since this operator performs critical operations, we deploy multiple instances of it; to preserve the application integrity while increasing the parallelism, the incoming streams are partitioned relying on the comment identifier.
%
Similarly to the first query, i.e., using a step-wise approach, the \textit{Comment Score Rank} and the \textit{Comment Rank Merger} rank the comments and identify the top-$ k $ ones that are supported by the larger communities.


\subsection{Group Signatures}
\label{ssec:crypto_group_sig}

\subsubsection{Constructing the Master Public Key}

The goal of our consensus algorithm is to enable a Byzantine-fault
tolerant subgroup to cryptographically sign on behalf of the entire
group without requiring every individual group member to sign.
This is enabled by signature aggregation in the appropriate way.

We let $\mathcal{Q}$ be the collection of qualified
actors who correctly shared their secrets and
$\mathcal{R}\subseteq\mathcal{Q}$ such that
$\abs{\mathcal{R}} = t+1$; thus, $\mathcal{R}$ is a
Byzantine-fault tolerant subgroup.
As discussed in~\cite{gennaro3revisiting,gennaro1999secure,ethdkg},
in order to ensure that no bad actors gain any information
about the master public key and not be able to change
its underlying probability distribution, we require
$h_{1}\in\G_{1}$ such that $\dlog_{g_{1}}h_{1}$ is unknown.
We also let $h_{2}\in\G_{2}$ be a generator.

The individual shared secrets $s_{i}$ allow us to define the
\emph{master secret key} $\text{msk}$:

\begin{equation}
    \text{msk} = \sum_{P_{i}\in\mathcal{Q}} s_{i}.
\end{equation}

\noindent
This gives us the \emph{master public key} $\text{mpk}$:

\begin{align}
    \text{mpk} &= h_{2}^{\text{msk}} \nonumber\\
        &= \prod_{P_{i}\in\mathcal{Q}} h_{2}^{s_{i}}.
\end{align}

\noindent
Because everyone in $\mathcal{Q}$ correctly shared his secret,
a Byzantine-fault tolerant subgroup $\mathcal{R}$ can
correctly obtain the secret $s_{i}$ via Lagrange interpolation:

\begin{align}
    s_{i} &= \sum_{P_{j}\in\mathcal{R}} s_{i\to j} R_{j} \nonumber\\
    R_{j} &= \prod_{\substack{P_{k}\in\mathcal{R} \\ k\ne j}} \frac{k}{k-j}.
    \label{eq:Rj_coefs}
\end{align}

\noindent
This would allow us to recover the secret $s_{i}$ should $P_{i}$
fail to share $h_{1}^{s_{i}}$ below; however,
we take a stricter response and would view failure to share
as malicious activity leading to stake slashing.

We now proceed to compute $\text{mpk}$.
Let

\begin{equation}
    \pi(h_{1}^{s_{i}}) = \textsc{DLEQ}(
        g_{1},g_{1}^{s_{i}},h_{1},h_{1}^{s_{i}},s_{i})
\end{equation}

\noindent
be the zk-proof that $h_{1}^{s_{i}}$ is $P_{i}$'s portion
of the master public key (technically part of $\text{mpk}^{*}$
as defined below).
Because $C_{i0} = g_{1}^{s_{i}}$ is public knowledge
and $P_{i}$ correctly shared his secret $s_{i}$, it is possible
to publicly verify $h_{1}^{s_{i}}$.
Additionally, $P_{i}$ will publish $h_{2}^{s_{i}}$ so that
we can ensure

\begin{equation}
    \textsc{PairingCheck}(h_{1}^{s_{i}},\bar{h}_{2},h_{1},h_{2}^{s_{i}})
        = 1.
\end{equation}

\noindent
This will be called by a smart contract.
Thus, failure of $P_{i}$ to publish $h_{1}^{s_{i}}$,
a valid proof $\pi(h_{1}^{s_{i}})$, and the corresponding
$h_{2}^{s_{i}}$ amounts to misbehavior which will
lead to a fine.

The Ethereum smart contract will store $h_{1}^{s_{i}}$ from
all participants and broadcast
$h_{1}^{s_{i}}$, $\pi(h_{1}^{s_{i}})$, and $h_{2}^{s_{i}}$.
From here, any participant will be able to submit

\begin{equation}
    \text{mpk} = \prod_{P_{i}\in\mathcal{Q}} h_{2}^{s_{i}}
\end{equation}

\noindent
to the smart contract.
Because $\braces{h_{1}^{s_{i}}}_{i\in\mathcal{Q}}$ are stored
and valid, the contract can construct

\begin{equation}
    \text{mpk}^{*} = \prod_{P_{i}\in\mathcal{Q}} h_{1}^{s_{i}}
    \label{eq:mpk_dual}
\end{equation}

\noindent
and call

\begin{equation}
    \textsc{PairingCheck}(\text{mpk}^{*},\bar{h}_{2},h_{1},\text{mpk})
\end{equation}

\noindent
to ensure $\text{mpk}$ is valid.
The master public key can then be stored publicly and used
for group signature verification.

\subsubsection{Constructing Group Signatures}

At this point, we have successfully constructed the master public
key $\text{mpk}$ for $\mathcal{Q}$ and distributed
the master secret key $\text{msk}$ among the members of $\mathcal{Q}$.
We now turn our attention to constructing group
signatures from partial signatures.

Each participant $P_{j}\in\mathcal{Q}$ has a portion of the
master secret key; this is portion is called the \emph{group secret
key}:

\begin{equation}
    \gsk_{j} = \sum_{P_{i}\in\mathcal{Q}} s_{i\to j}.
\end{equation}

\noindent
This is possible because we proved that every participant
in $\mathcal{Q}$ correctly shared his secret share.
We note that that $s_{j\to j}$ is included in the sum for
$\gsk_{j}$ even though the encrypted form was not publicly shared.
Naturally, there is the corresponding \emph{group public key}:

\begin{equation}
    \gpk_{j} = h_{2}^{\gsk_{j}}.
\end{equation}

\noindent
Here, $\gpk_{j}$ is $P_{j}$'s portion of the master public key
and will be broadcast to all users.
Cryptographic proof that $\gpk_{j}$ is valid will be discussed
in the next section.

The threshold property along with the previous definitions give
us the following result:

\begin{equation}
    \text{msk} = \sum_{P_{j}\in\mathcal{R}} \gsk_{j}R_{j}.
\end{equation}

\noindent
These $R_{j}$ factors only depend on $\mathcal{R}$.
It follows that

\begin{equation}
    \text{mpk} = \prod_{P_{j}\in\mathcal{R}} \gpk_{j}^{R_{j}}.
\end{equation}

\noindent
This will allow partial signatures to be combined into a valid
group signature.

We now assume that $\mathcal{Q}$ wants to sign message $M$.
We let $H_{2C}(M)\in\G_{1}$ be the result of a hash-to-curve algorithm;
these will be discussed in Sec.~\ref{ssec:hash-to-curve}.
In this case, participant $P_{j}\in\mathcal{R}$ computes the
partial signature

\begin{equation}
    \sigma_{j} = \brackets{H_{2C}(M)}^{\gsk_{j}}.
\end{equation}

\noindent
For security, we should confirm

\begin{equation}
    \textsc{PairingCheck}(\sigma_{j},\bar{h}_{2},H_{2C}(M),\gpk_{j}) = 1
\end{equation}

\noindent
to ensure we have a valid signature.
If $\gpk_{j}$ is stored and we can call the hash-to-curve function $H_{2C}$,
then the only inputs will be the message $M$
and signature $\sigma_{j}$.

It is easy to compute the group signature from the partial signatures:

\begin{equation}
    \sigma = \prod_{P_{j}\in\mathcal{R}} \sigma_{j}^{R_{j}}.
\end{equation}

\noindent
The $R_{j}$ constants are defined in Eq.~\eqref{eq:Rj_coefs};
as mentioned above, the $R_{j}$ depend upon $\mathcal{R}$
and can be computed by anyone.
Because $\sigma_{j}\in\G_{1}$, signature aggregation could be carried
out by the EVM if desired; the gas cost would come from calls to
\textsc{ECAdd}, \textsc{ECMul}, and modular exponentiation,
but this would be expensive.
We now prove this is the signature corresponding to the master public key:

\begin{align}
    e(\sigma, h_{2})
        &= \prod_{P_{j}\in\mathcal{R}}
            e\parens{\sigma_{j}^{R_{j}},h_{2}}
            \nonumber\\
        &= \prod_{P_{j}\in\mathcal{R}}
            e\parens{\brackets{H_{2C}(M)}^{\text{gsk}_{j}},h_{2}^{R_{j}}}
            \nonumber\\
        &= \prod_{P_{j}\in\mathcal{R}} e\parens{H_{2C}(M),
                \brackets{h_{2}^{\text{gsk}_{j}}}^{R_{j}}} \nonumber\\
        &= e(H_{2C}(M),\text{mpk}).
\end{align}

\noindent
It follows that

\begin{equation}
    \textsc{PairingCheck}(\sigma,\bar{h}_{2},H_{2C}(M),\text{mpk}) = 1.
\end{equation}

\noindent
This allows every member of $\mathcal{R}$ to compute the signature
for the entire group while not requiring anyone to share his
signing key.
This is of utmost importance for security.

\subsubsection{Malicious Group Public Key Shares}

We now look at how to ensure the broadcast value of
$\gpk_{j}$ is valid.

Along with the $P_{j}$'s group public key $\gpk_{j}\in\G_{2}$,
there is the corresponding version in $\G_{1}$:

\begin{equation}
    \gpk_{j}^{*} = g_{1}^{\gsk_{j}}.
\end{equation}

\noindent
Note the base is $g_{1}$ and not $h_{1}$ as in the case of $\text{mpk}^{*}$
in Eq.~\eqref{eq:mpk_dual}.
Participant $P_{j}$ will publish a signature $\sigma_{j}$ of a predetermined
message $M$ for security purposes.
An initial check will ensure

\begin{equation}
    \textsc{PairingCheck}(\sigma_{j},\bar{h}_{2},H_{2C}(M),\gpk_{j}) = 1;
\end{equation}

\noindent
any validator who provides an invalid signature
is clearly malicious.

Because $P_{j}$ correctly shared his secret, $\gpk_{j}^{*}$
is public knowledge, as

\begin{equation}
    \gpk_{j}^{*} = \prod_{P_{i}\in\mathcal{Q}}F_{i}(j).
    \label{eq:gpkj_star_def}
\end{equation}

\noindent
Thus, it could be reconstructed inside a smart contract.
From there, we will ensure

\begin{equation}
    \textsc{PairingCheck}(\gpk_{j}^{*},\bar{h}_{2},g_{1},\gpk_{j}) = 1.
\end{equation}

\noindent
Requiring submission of $\gpk_{j}^{*}$ and the associated
proof could be required at the time of submission.
This would be costly, though, and will instead allow
the other participants to prove malicious behavior.
We would prefer the entire process to be as inexpensive
as possible should there be no malicious actors.

It will be expensive to carry out this proof of malicious action.
The reason is that in order to compute $\gpk_{j}^{*}$,
the message containing the shared secrets and public coefficients
from every participant will need to be entered into a smart contract
in order to obtain the right hand side of
Eq.~\eqref{eq:gpkj_star_def}.
Because of this, there is another, cheaper way to prove malicious
behavior provided a Byzantine-fault tolerant group
correctly submits $\gpk_{j}$ with valid signatures $\sigma_{j}$
and we discuss this now.

First, a participant can go through all possible subgroups
$\mathcal{R}\subseteq\mathcal{Q}$ searching for a subset
whose signatures can be combined to form a valid
group signature.
Once a valid subset $\mathcal{R}$ is found,
we can then choose $P_{i}\in\mathcal{Q}\setminus\mathcal{R}$
in order to determine if
$\braces{P_{i}}\cup\parens{\mathcal{R}\setminus \braces{P_{v}}}$
can form a valid signature;
if it does not, then $P_{i}$ is malicious.
Here $P_{v}\in\mathcal{R}$ is a fixed.
In this case, two lists of participants would be entered into a smart
contract: a list of valid participants followed by a list of
invalid participants.
It is straightforward to show the list of valid
participants form a valid group signature.
From there, malicious participant's signatures are included
one at a time to show that they form invalid signatures,
giving cryptographic proof of malicious behavior.
Naturally, it would be a malicious action if false participant
lists were submitted.

We now look at the costs of both methods.
The major costs will be calling the precompiled contracts
\textsc{ECAdd}, \textsc{ECMul}, \textsc{PairingCheck},
and \textsc{ModExp} (modular exponentiation);
see Table~\ref{tab:evm_gas_cost} for the specific gas costs.
Note that the cost for \textsc{PairingCheck} comes
from our assumption that we are testing 2 pairings,
while the cost for \textsc{ModExp} comes from the fact
that all of our arguments are 256-bit (32-byte) unsigned integers.
These costs come from EIP-198\footnote{
    \url{https://github.com/ethereum/EIPs/blob/master/EIPS/eip-198.md}}
and EIP-1108\footnote{
    \url{https://github.com/ethereum/EIPs/blob/master/EIPS/eip-1108.md}}.

\input{tables/evm_cost.tex}

We begin with the standard method.
First, to compute $\gpk_{j}^{*}$, we must compute $F_{i}(j)$:

\begin{equation}
    F_{i}(j) = C_{i0}C_{i1}^{j}C_{i2}^{j^{2}}\cdots C_{it}^{j^{t}}.
\end{equation}

\noindent
The cost of computing $F_{i}(j)$ is dominated by $t$ calls to \textsc{ECMul}.
This will be done for each element in $\mathcal{Q}$, so the
main computation is $nt$ calls to \textsc{ECMul} in addition
to a call to \textsc{PairingCheck}.
Thus, we see

\begin{equation}
    \text{Cost of Standard Proof} \sim 113000 + 4000n^{2}.
\end{equation}

\noindent
For $n=20$, this corresponds to $1.7$M gas; the gas limit
is 10M.

We now look at the cost of the group method.
We will ignore the initial cost of ensuring a valid group signature
from $\mathcal{R}$.
The computation consists of forming

\begin{equation}
    \sigma = \prod_{P_{j}\in\mathcal{R}^{*}_{k}} \sigma_{j}^{R_{j}},
\end{equation}

\noindent
where

\begin{equation}
    \mathcal{R}^{*}_{k} = \parens{\mathcal{R}\setminus P_{v}}\cup
        \braces{P_{k}}
\end{equation}

\noindent
for $P_{v}\in\mathcal{R}$ fixed and $P_{k}\in\mathcal{I}$,
the set of participants who incorrectly shared $\gpk_{j}$.
From there, we would call

\begin{equation}
    \textsc{PairingCheck}(\sigma, \bar{h}_{2}, H_{2C}(M), \text{mpk})
\end{equation}

\noindent
to ensure that this is an invalid signature,
and the initial check confirming $\mathcal{R}$ forms a valid
signature implies that $P_{k}$ is malicious.

Each group signature $\sigma$ will require forming $R_{j}$
and computing $\sigma_{j}^{R_{j}}$.
After computing $R_{j}$, we require one \textsc{ECMul} call
to compute $\sigma_{j}^{R_{j}}$.
The expensive part turns out to be forming $R_{j}$,
and we focus on its straightforward computation.
We recall from Eq.~\eqref{eq:Rj_coefs} that

\begin{equation}
    R_{j} = \prod_{\substack{P_{k}\in\mathcal{R} \\ k\ne j}} \frac{k}{k-j}.
\end{equation}

\noindent
Naively, we would need to compute $t$ finite field inversions,
which corresponds to $t$ \textsc{ModExp} calls, to compute
$R_{j}$.
This must be performed $t+1$ times to form $\sigma$;
we must also call \textsc{ECMul} $t+1$ times but this is
negligible.
Finally, we must call

\begin{equation}
    \textsc{PairingCheck}(\sigma, \bar{h}_{2}, H_{2C}(M), \text{mpk});
\end{equation}

\noindent
this call must fail for invalid signatures.
Thus, we have

\begin{equation}
    \text{Cost of Naive Group Proof} \sim 113000 + 5800n^{2}.
\end{equation}

\noindent
For $n=20$, this corresponds to $2.4$M gas.
This is more expensive than the previous version, but we can
do better.

The main cost comes from the finite field inversions, which require
a call to \textsc{ModExp}.
To fix this, we precompute these inverses and include them
in the function call.
At the beginning of the call, we check to make sure that the submitted
inverses are valid; if they are valid, we proceed with the
accusation, and if they are invalid, we stop.
Everything else is the same as before;
see Alg.~\ref{alg:grpsig_malicious} for the complete description.
For each accusation, the main cost is $t+1$ \textsc{ECMul} calls
as well as one pairing check.
Now, these same computations must be included for the initial
check of a valid group signature, but we will ignore that for now.
Thus, we have the cost to prove malicious action for one participant:

\begin{equation}
    \text{Cost of Efficient Group Proof} \sim 113000 + 4000n.
\end{equation}

\noindent
For $n=20$, this corresponds to $200$K gas.
This is more efficient than computing $\gpk_{j}^{*}$ via smart contract.

Due to the costs, validators would always prefer to use the group
method over submitting all of the sent messages.
Even so, submitting all messages will always work, while in the group
setting we require a Byzantine-fault tolerant set of honest
validators.

\input{algs/gpkj_algs.tex}


%
%==> Section: Drawing lines and curves
%
\section{
  Drawing lines and curves
}
%
%==> simple straight lines
%
\begin{frame}[fragile]
  \frametitle{
    Simples straight lines
  }
  To draw a line you do something like

  \lstinputlisting{./tex/src/draw_line.tex}

  and you get

  \begin{center}
    \input{./tex/src/draw_line.tex}
  \end{center}

Ti$k$Z automatically draws a line between the points $(0,0)$ and $(1,2)$ and sets up the right space for the figure (by default, coordinates are in centimeters).
\end{frame}

%
%==> Sequence of segments
%
\begin{frame}

  You can do a sequence of segments which goes from point to point:

  \lstinputlisting{./tex/src/sequence_of_segments.tex}

  to get

  \begin{center}
    \input{./tex/src/sequence_of_segments.tex}
  \end{center}

\end{frame}

%
%==> Add grid lines
%
\begin{frame}[fragile]

  We now have added the grid lines on the graphic to make it clearer. This is done through the command

  \begin{lstlisting}
    \draw[help lines] (0,0) grid (2,3);
  \end{lstlisting}

  which draws a grid from $(0,0)$ to $(2,3).$

  \lstinputlisting{./tex/src/add_grid_lines.tex}

  to get

  \begin{center}
    \input{./tex/src/add_grid_lines.tex}
  \end{center}

\end{frame}

%
%==> Add several lines
%
\begin{frame}[fragile]

  Of course, you can put several lines on the same graph:

  \lstinputlisting{./tex/src/add_several_lines.tex}

  yields

  \begin{center}
    \input{./tex/src/add_several_lines.tex}
  \end{center}

  Notice the semi-colons ``; "at the end of lines -- they mark the end of instructions. That is, in the last picture we could have written

  {
    \footnotesize
    \begin{lstlisting}
      \draw (0,0) --(1,2) -- (2,3) -- (1,0); \draw (0,3) -- (1.5,0.5);
    \end{lstlisting}
  }

  without changing the output. You can also add and suppress spaces, for instance in order to make the code easier to read, without changing anything in the output.

\end{frame}

%
%==> Scaling pictures
%
\begin{frame}[fragile]
  \frametitle{
    Scaling pictures
  }

  One very useful feature of Ti$k$Z is that you can blow up the picture, by adding an option ``scale" to the environment.

  \begin{columns}
    \begin{column}{0.6\textwidth}
      \lstinputlisting{./tex/src/scaled_line.tex}
    \end{column}
    \begin{column}{0.4\textwidth}
      \input{./tex/src/scaled_line.tex}
    \end{column}
  \end{columns}

  which you can compare to the following:

  \begin{columns}
    \begin{column}{0.6\textwidth}
      \lstinputlisting{./tex/src/original_line.tex}
    \end{column}
    \begin{column}{0.4\textwidth}
      \input{./tex/src/original_line.tex}
    \end{column}
  \end{columns}

\end{frame}
% Scaling in one dimension
\begin{frame}[containsverbatim]
You can scale only one dimension:

  \begin{columns}
    \begin{column}{0.6\textwidth}
      \lstinputlisting{./tex/src/scale_one_dimension.tex}
    \end{column}
    \begin{column}{0.4\textwidth}
      \input{./tex/src/scale_one_dimension.tex}
    \end{column}
  \end{columns}

or both dimensions in different proportions:

  \begin{columns}
    \begin{column}{0.6\textwidth}
      \lstinputlisting{./tex/src/scale_both_dimensions.tex}
    \end{column}
    \begin{column}{0.4\textwidth}
      \input{./tex/src/scale_both_dimensions.tex}
    \end{column}
  \end{columns}

\end{frame}

%
%==> Arrows and the like
%
\begin{frame}[fragile]
  \frametitle{
    Arrows and the like
  }

  You can ``decorate" the lines. For instance we can put arrows or bars on one of both extremities:

  \lstinputlisting{./tex/src/decorate_lines.tex}

  which yields

  \begin{center}
    \input{./tex/src/decorate_lines.tex}
  \end{center}

\end{frame}
%
%==> Coordinates
%
\begin{frame}[fragile]

  When you draw several segments, the arrows are placed at the extremities of the first and the last segments. This is convenient, among other things to draw axes (we will see later how to label them):

  \lstinputlisting{./tex/src/coordinates.tex}

which gives you

  \begin{center}
    \input{./tex/src/coordinates.tex}
  \end{center}

\end{frame}
%
%==> Changing the thickness of lines
%
\begin{frame}[fragile]
  \frametitle{
    Changing the thickness of lines
  }

  Other decorations include changing the thickness:

  \lstinputlisting{./tex/src/change_line_thickness.tex}

  which gives you

  \begin{center}
    \input{./tex/src/change_line_thickness.tex}
  \end{center}

\end{frame}
%
%==> helplines
%
\begin{frame}[fragile]
  \frametitle{
    The help lines option
  }

  There is also the {\tt help lines} option, discussed earlier, which is made specially to be fine gray lines for showing special points:

    \lstinputlisting{./tex/src/add_help_lines.tex}

  which yields.

  \begin{center}
    \input{./tex/src/add_help_lines.tex}
  \end{center}

\end{frame}
%
%==> Custom line widths
%
\begin{frame}[fragile]
  \frametitle{
    Custom line widths
  }

  You can also use custom widths:

  \lstinputlisting{./tex/src/custom_line_widths.tex}

  which gives a line 12pt wide (the default dimension for width is point) and another one .2cm wide:

  \begin{center}
    \input{./tex/src/custom_line_widths.tex}
  \end{center}

\end{frame}
%
%==> Dashes and dots
%
\begin{frame}[fragile]
  \frametitle{
    Dashes and dots
  }

  You can also make dashed and dotted lines

  \lstinputlisting{./tex/src/dashes_and_dots.tex}

  This gives:

    \begin{center}
    \input{./tex/src/dashes_and_dots.tex}
    \end{center}

    The top line shows you that you can mix types of decorations. You have lots of control over the style of your dotted and dashed lines (see the manual).

\end{frame}
%
%==> Colored lines
%
\begin{frame}[fragile]
  \frametitle{
    Colored lines
  }

  And finally, you can color your lines.

  \lstinputlisting{./tex/src/colored_lines.tex}

   We obtain

    \begin{center}
    \input{./tex/src/colored_lines.tex}
    \end{center}

\end{frame}

%
%==> Taste the rainbow
%
\begin{frame}
  \frametitle{
    Taste the rainbow
  }
  You have direct access to the following pre-defined colors: red \begin{tikzpicture} \draw [red, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture},
green \begin{tikzpicture} \draw [green, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, blue \begin{tikzpicture} \draw [blue, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, cyan \begin{tikzpicture} \draw [cyan, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, magenta \begin{tikzpicture} \draw [magenta, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, yellow \begin{tikzpicture} \draw [yellow, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, black \begin{tikzpicture} \draw [black, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, darkgray\footnote{An affront to the King's language} \begin{tikzpicture} \draw [darkgray, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, light gray \begin{tikzpicture} \draw [lightgray, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, brown \begin{tikzpicture} \draw [brown, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, lime \begin{tikzpicture} \draw [lime, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, olive \begin{tikzpicture} \draw [olive, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, orange \begin{tikzpicture} \draw [orange, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, pink \begin{tikzpicture} \draw [pink, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, purple \begin{tikzpicture} \draw [purple, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, teal \begin{tikzpicture} \draw [teal, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, violet \begin{tikzpicture} \draw [violet, line width=6]
     (0,0) -- (.5,0);  \end{tikzpicture}, and white \begin{tikzpicture} \draw [white, line width=6]
  (0,0) -- (.5,0);  \end{tikzpicture}. And you can define all the colors you might want using the RGB color model (see the manual).
\end{frame}

%
%==> Pictures in the middle of text
%
\begin{frame}[fragile]
  \frametitle{
    Pictures in the middle of text
  }

  By the way, you may wonder how we included these rectangles in the text. Ti$k$Z makes a picture wherever \input{./tex/src/blue_in_middle_of_text} you want; we just typed

  \begin{center}
    \lstinputlisting{./tex/src/blue_in_middle_of_text.tex}
  \end{center}

  wherever we want in the text. To make these constructions easier to type you can use the command {\tt \bf \textbackslash tikz}  (see the manual).

\end{frame}

%
%==> Curves
%
\begin{frame}[fragile]
  \frametitle{
    Curves
  }

  We are not limited to straight lines:

  { \footnotesize
  \lstinputlisting{./tex/src/shapes.tex}
  }

  This gives:

  \begin{center}
    \input{./tex/src/shapes.tex}
  \end{center}

  The arc is of radius 1, starts at the point $(6,0)$ leaving it at an angle of $45^\circ$ and stops when its slope is $120^\circ$.

\end{frame}

%
%==> Smoother curves
%
\begin{frame}[fragile]
  \frametitle{
    Smoother curves
  }

  We can make paths take smoother turns:

  { \footnotesize
  \lstinputlisting{./tex/src/rounded_corners.tex}
  }

  which gives us

  \begin{center}
    \input{./tex/src/rounded_corners.tex}
  \end{center}

\end{frame}
%
%==> Hard coding graphs
%
\begin{frame}[containsverbatim]
  \frametitle{
    Hard coding graphs
  }

  If you want a precise curve you can do it by computing lots of points in a program such as C/C++, Fortran, Python, MATLAB, etc, and then putting them into Ti$k$Z:

  {
    \scriptsize
    \lstinputlisting{./tex/src/hard_coded_graph.tex}
  }

\end{frame}

%
%==> Hard coded graph results
%
\begin{frame}[containsverbatim]
    \frametitle{
    Hard coded graph results
    }

    \input{./tex/src/hard_coded_graph.tex}

    \begin{enumerate}
    \item
      This was overkill: We do not need so many points;
    \item
      This can also serve as a reminder that one Ti$k$Z instruction can be spread over several lines and cut arbitrarily over several lines. The marker is the semi-colon, not the end of line!
    \end{enumerate}

\end{frame}

%
%==> Plot curve
%
\begin{frame}[fragile]

  There are a number of ways by which you can do curves without plotting all the points. Here is an easy one:

  \lstinputlisting{./tex/src/plot_curve.tex}

  This gives us a curve from $(0,0)$ to $(2,1.5)$ which leaves at an angle of $90^\circ$ and arrive at an angle of $195^\circ$: Notice that we replaced the \textcolor{red}{\tt  --} with \textcolor{red}{\tt to}.

  \begin{center}
    \input{./tex/src/plot_curve.tex}
  \end{center}

\end{frame}
%
%==> Replacing -- with to
%
\begin{frame}
  \frametitle{
    Replacing \textbf{\tt  --} with \textbf{\tt to}
  }

  \begin{center}
    \begin{tikzpicture}
      \draw [style=help lines] (0,0) grid (2,2);
      \draw [very thick] (0,0) to [out=90,in=195] (2,1.5);
    \end{tikzpicture}
  \end{center}

  \begin{enumerate}
  \item
    When the curves goes \textcolor{red}{out} of $(0,0),$ you put a needle with one extremity on the starting point and the other one facing right and you turn it counterclockwise until it is tangent to the curve. The angle by which you have to turn the needle gives you the \textcolor{red}{out} angle.
  \item
    When the curves goes \textcolor{red}{in} at $(2,1.5),$ you put a needle with one extremity on the arrival point and the other one facing right and you turn it counterclockwise until it is tangent to the curve. The angle by which you have to turn the needle gives you the \textcolor{red}{in} angle.
  \end{enumerate}

\end{frame}

%
%==> Several to instructions
%
\begin{frame}[fragile]
  \frametitle{
    Several \textbf{\tt to} instructions
  }

  As with straight lines you can put several \textbf{\tt to} instructions in the same Ti$k$Z instruction:

  \lstinputlisting{./tex/src/several_to_instructions.tex}

  we obtain:

  \begin{center}
    \input{./tex/src/several_to_instructions.tex}
  \end{center}

\end{frame}


% This LaTeX was auto-generated from an M-file by MATLAB.
% To make changes, update the M-file and republish this document.

\subsection*{gSat.m}

\begin{par}
\textbf{Summary:} Compute moments of the saturating function $e*(9*\sin(x(i))+\sin(3*x(i)))/8$, where $x \sim\mathcal N(m,v)$ and $i$ is a (possibly empty) set of $I$ indices. The optional  scaling factor $e$ is a vector of length $I$. Optionally, compute derivatives of the moments.
\end{par} \vspace{1em}

\begin{verbatim}  function [M, S, C, dMdm, dSdm, dCdm, dMdv, dSdv, dCdv] = gSat(m, v, i, e)\end{verbatim}
    \begin{par}
\textbf{Input arguments:}
\end{par} \vspace{1em}
\begin{verbatim}m     mean vector of Gaussian                                    [ d       ]
v     covariance matrix                                          [ d  x  d ]
i     vector of indices of elements to augment                   [ I  x  1 ]
e     (optional) scale vector; default: 1                        [ I  x  1 ]\end{verbatim}
\begin{par}
\textbf{Output arguments:}
\end{par} \vspace{1em}

\begin{verbatim}M     output means                                                [ I       ]
V     output covariance matrix                                    [ I  x  I ]
C     inv(v) times input-output covariance                        [ d  x  I ]
dMdm  derivatives of M w.r.t m                                    [ I  x  d ]
dVdm  derivatives of V w.r.t m                                    [I*^2 x  d ]
dCdm  derivatives of C w.r.t m                                    [d*I x  d ]
dMdv  derivatives of M w.r.t v                                    [ I  x d^2]
dVdv  derivatives of V w.r.t v                                    [I^2 x d^2]
dCdv  derivatives of C w.r.t v                                    [d*I x d^2]\end{verbatim}
    \begin{par}
Copyright (C) 2008-2013 by Marc Deisenroth, Andrew McHutchon, Joe Hall, and Carl Edward Rasmussen.
\end{par} \vspace{1em}
\begin{par}
Last modified: 2013-03-25
\end{par} \vspace{1em}

\begin{lstlisting}
function [M, S, C, dMdm, dSdm, dCdm, dMdv, dSdv, dCdv] = gSat(m, v, i, e)
\end{lstlisting}

\subsection*{Code}

\begin{lstlisting}
d = length(m); I = length(i); i = i(:)';
if nargin < 4; e = ones(1, I); end; e = e(:)';

P = [eye(d); 3*eye(d)];                                        % augment inputs
ma = P*m;    madm = P;
va = P*v*P'; vadv = kron(P,P); va = (va+va')/2;

% do the actual augmentation with the right parameters
[M2, S2, C2, Mdma, Sdma, Cdma, Mdva, Sdva, Cdva] ...
  = gSin(ma, va, [i d+i], [9*e e]/8);

P = [eye(I) eye(I)]; Q = [eye(d) 3*eye(d)];
M = P*M2;                                                                % mean
S = P*S2*P'; S = (S+S')/2;                                           % variance
C = Q*C2*P';                                    % inv(v) times input-output cov

if nargout > 3                                        % derivatives if required
  dMdm = P*Mdma*madm;         dMdv = P*Mdva*vadv;
  dSdm = kron(P,P)*Sdma*madm; dSdv = kron(P,P)*Sdva*vadv;
  dCdm = kron(P,Q)*Cdma*madm; dCdv = kron(P,Q)*Cdva*vadv;
end
\end{lstlisting}


\section{Fundamentals of blockchain}\label{sec:fundamentals}
In this section, the key elements of the blockchain that contribute to its properties will be displayed: integrity, immutability, transparency, availability, disintermediation, decentralization.

\subsection{Cryptography}\label{sec:criptografia}
Blockchain relies heavily on encryption to satisfy system and application security requirements. As the word suggests, cryptocurrencies also make heavy use of encryption. Encryption provides a mechanism for safely encoding the rules of system encryption on the system itself. This can prevent tampering and misconceptions and coding in a mathematical protocol the rules for creating new currency units. So, before understanding blockchains correctly, it is necessary to understand the cryptographic foundations they trust \cite{narayanan2016bitcoin}.

Cryptography is a profound academic field of research that uses many advanced mathematical techniques that are notoriously subtle and complicated. In this chapter, cryptographic hashes and digital signatures will be defined, which stand out among the most used resources. For more details, the reader should refer to the book \cite{narayanan2016bitcoin}.

\subsubsection{Cryptographic Hashes}\label{sec:hashesCriptograficos}
A hash function is a mathematical function with the three properties to be followed \cite{narayanan2016bitcoin}:

\begin{itemize}
\item  Its input can be any string of any length;
\item Produces a fixed size output. To make concrete the discussion in this chapter (e.g., 256 digits);
\item It is efficiently computable. Intuitively, this means that it is possible to find out the hash function output within a reasonable time for a given input string. Technically, hashing a n-bit string must have an $O(n)$ runtime.
\end{itemize}

These properties define a general hash function. Cryptographic hash functions (or cryptographic summaries) are unidirectional and hardly allow retrieving the original value $x$ from the hash $h$. For a hash function to be cryptographically secure, it must satisfy the following three properties: (1) collision resistance, (2) hiding, and (3) puzzle friendliness \cite{greve2018blockchain}.

A collision occurs when two distinct inputs produce the same output. A hash function $H$ is collision-resistant when it is impossible to find two values $x$ and $y$, such that $x \neq y$ and $H(x) = H(y)$ \cite{narayanan2016bitcoin}.

The hidden property states that having the hash function output $y = H (x)$, there is no possible way to find the $x$ input \cite{greve2018blockchain}.

A hash function $H$ is considered puzzle friendliness if for each possible output value of $n$ bits $y$ if $k$ is chosen from a distribution with high min-entropy, then it is impracticable to find $x$ such that $H (k \| x) = y$ in time significantly less than $2^n$ \cite{narayanan2016bitcoin}.

\subsubsection{Digital Signatures}\label{sec:assinaturasDigitais}
A digital signature is supposed to be a digital analog of a handwritten paper signature. Two signature properties are desired, which correspond well to the analogy of the handwritten signature. First, only one person can make their signature, but anyone can verify if it is valid. Secondly, it is desired that the signature be linked to a specific document, so it cannot indicate the agreement or endorsement to a different document \cite{merkle1989certified}. Moreover, it is not possible to forge a signature in such a way as to reuse it in some other context. That is, signatures must be irrefutable.

To implement digital signatures, asymmetric key encryption is used. A \ac{SK} is used for signing the document, and a \ac{PK} is used to attest the signature's authenticity \cite{greve2018blockchain}.

A digital signature consists of the following three algorithms \cite{narayanan2016bitcoin}:

\begin{itemize}
\item $(sk , pk) := generateKeys(keysize)$ – The $generateKeys()$ method receives a key size $(keysize)$ in the input and return a pair of public $(pk)$ and private $(sk)$ keys.
\item $sig := sign(sk , msg)$ – The method $sign()$ receives a message $msg$ and a secret key $(sk)$ on entry and returns the signature $sig$ f that message under $sk$.
\item $isValid := verify(pk , msg , sig)$ – The method $verify$ receives a public key $(pk)$, a message $msg$, and a signature $(sig)$ as input, and returns a boolean value: $isValid = true$ if $sig$ is a signature valid for $msg$ under $pk$; $isValid = false$, otherwise.
\end{itemize}

The following two properties must be maintained:

\begin{itemize}
\item Authenticity: Signatures can be validated: \\ $verify(pk, message, sign(sk, message)) = = true$.
\item Signatures are existentially unfalsifiable: signature cannot be forged.
\end{itemize}

It is noted that \textit{generateKeys()} and \textit{sign()} can be random algorithms. Generating keys should be randomized because it should be generating different keys for different people. On the other hand, \textit{verify()} will always be deterministic.

\begin{figure}[htbp]
\begin{center}
  \includegraphics[scale=1.0]{images/AliceBob.jpg}
\caption{Signatures validated by public/private key \cite{forging}.}
\label{fig:authenticationExample}
\end{center}
\end{figure}

\subsection{Consensus}\label{sec:consenso}
The key to blockchain operation is that the network must agree collectively on the ledger's content.  Instead of a central entity maintain control over information (such as a bank, for example), the data is shared among all. This requires the network to maintain the consensus around the information recorded in the blockchain. How this consensus is reached affects the security and economic parameters of the protocol \cite{kostarev2017review}.

In this context, consensus emerges as a fundamental problem since it allows distributed participants to coordinate their actions to reach joint decisions, ensuring the consistency of safety and system progress (liveness) despite failures \cite{greve2018blockchain}. More specifically, in the context of blockchain, consensus enables an agreement on the next block that will be added to the blockchain.

In the blockchain, reaching consensus between untrusted nodes is a transformation of the problem of \ac{BG} \cite{lamport1982byzantine}. In the BG problem, a group of generals who command a portion of the Byzantine army circles the city. The attack would fail if only part of the generals attacked the city. Generals need to communicate to agree on the attack or not. However, there may be traitors in the generals. The traitor could send different decisions to different generals. This is an environment without trust.

Reaching consensus in such an environment is a challenge. This is also a challenge for blockchain because its network is distributed, and there is no central node that ensures that ledgers on distributed nodes be all the same. Nodes do not need to trust other nodes. Thus, some protocols are required to ensure that ledgers on different nodes are consistent \cite{kostarev2017review}. To solve the consensus problem, several algorithms have been proposed, the mainly used are Proof-of-Work, Proof-of-Stake, Delegated Proof-of-Stake, Leased Proof-Of-Stake, Proof of Elapsed Time, Practical Byzantine Fault Tolerance, Simplified Byzantine Fault Tolerance, Delegated Byzantine Fault Tolerance, Directed Acyclic Graphs, Proof-of-Activity, Proof-of-Importance, Proof-of-Capacity, Proof-of-Burn and Proof-of-Weight \cite{mingxiao2017review}.

A good consensus algorithm means efficiency, security, and convenience. Current standard consensus algorithms still have many shortcomings. New consensus algorithms are created to solve some blockchain-specific problems \cite{zheng2016blockchain}.

\subsection{Distributed Ledger}\label{sec:livro}
A distributed ledger is a data structure distributed by several nodes or computing devices. Each node replicates and saves an identical ledger copy. Each participating node in the network updates independently \cite{greve2018blockchain}.

The innovative feature of distributed accounting technology is that any central authority does not maintain the ledger. Updates to The ledger are independently constructed and recorded by each node. The nodes then vote on these updates to ensure that most agree on the conclusion, based on some previous consensus algorithm. Once consensus has been reached, the distributed ledger updates itself, and the latest agreed version is saved on each separate node \cite{swan2015blockchain}. Thus, the distributed ledger is replicated and immutable.

\subsubsection{Transactions}\label{sec:transac}
The blockchain is a public digital book that records online transactions. In it, transactions are recorded in a block without the help of third parties, such as a bank or payment processor. The blockchain algorithm automatically graphs and authenticates the transaction, which is immediately visible to all users, minimizing the possibility of fraud. The terms of a transaction do not include any personal or identifying information \cite{Bankrate2018}.

The most fundamental definition of a transaction is an atomic event allowed by the underlying protocol from a technical standpoint. A transaction determines a sequence of state operations.  It adds a transfer of an asset or, generally speaking, a smart contract.  In a basic case, the transaction girds a digital signature of the issuer holding the asset and the receiver's address and inputs and outputs for the transaction. Each transaction must contain both Inputs and Outputs, just like in an accounting book. Entries indicate the previous transaction hash related to the current one \cite{greve2018blockchain}. Validating a Transition involves:

\begin{enumerate}
	\item signature verification;
	\item confirmation of existing values from hashes of previous referenced transactions;
	\item confirmation that any other transactions did not previously spend the amount.
\end{enumerate}

In this case, it is necessary to search the blockchain between the block from the referenced transaction to the last block of the structure. Each node of the blockchain network independently validates transactions, and this feature contributes to the decentralization of the process \cite{greve2018blockchain}.

\subsubsection{Blocks}\label{sec:blocks}
Blocks contain a header with the information needed for the current maintenance and its validation. A block consists of the block header and block body, as shown in Figure \ref{fig:block}.

\begin{figure}[htbp]
\begin{center}
  \includegraphics[scale=0.5]{images/blockStructure.png}
\caption{Structure of a block. \cite{zheng2016blockchain}}
\label{fig:block}
\end{center}
\end{figure}

In particular, the header Pack includes:

\begin{itemize}
\item Block version: indicates which set of block validation rules to follow.
\item Parent block hash: A 256-bit hash value that points to the previous block.
\item Merkle tree root hash: The hash value of all transactions in the block.
\item Timestamp: Current date and time as seconds since 1970-01-01T00:00 UTC.
\item  nBits: current hashing target in a compact format.
\item Nonce: A 4-byte field, usually starting with 0 and increasing for each hash.
\end{itemize}

The body's block consists of a transaction counter and transaction. The maximum number of transactions a block can hold depends on block size and the size of each transaction. Blockchain uses an asymmetric encryption mechanism to validate transaction authentication. A digital signature based on asymmetric encryption is used in an untrusted environment \cite{zheng2016blockchain}.

The validation of a block consists in verifying (i) if its structure is well-formed (ii) its hash is valid (meets the challenge), (iii) its size is within the network accepted limit, (iv) the set of transactions within the block is valid, (v) the first transaction (and only the first) is the coinbase transaction - which incorporates the generation of new cryptocurrencies in the system, besides acting as a reward mechanism. The blocks are validated independently by each node of the blockchain network, and this feature contributes to the process of decentralization \cite{greve2018blockchain}.

Figure \ref{fig:blockchain} presents a visual representation of a blockchain \cite{tian2017supply}.

\begin{figure}[htbp]
\begin{center}
  \includegraphics[scale=0.35]{images/blockchain.png}
\caption{Blockchain representation \cite{michael2018blockchain}}
\label{fig:blockchain}
\end{center}
\end{figure}


\chapter{Relativistic Spin-$\frac{1}{2}$ particles}
\section{Spin in non-relativistic QM}
The quantum states corresponding to spin-$\frac{1}{2}$ particles are eigenstates of the spin operator,
\begin{equation}
\hat{S}_i = \frac{1}{2}\sigma_i
\end{equation}
where $\sigma_i$ are the Pauli matrices,
\begin{equation}
\sigma_x = \mqty(0 & 1 \\ 1 & 0), \quad
\sigma_y = \mqty(0 & -i \\ i & 0), \quad
\sigma_z = \mqty(1 & 0 \\ 0 & -1).
\end{equation}
Application of $\hat{S}_z$ on a state of definite spin projection on the z-axis gives
\begin{equation}
\hat{S}_z \ket{s, m} = m \ket{s, m}
\end{equation}
and application of the operator $\hat{S}^2 = \sum_i \hat{S}_i^2$ -- which corresponds to the total spin angular momentum of the state -- gives
\begin{equation}
\hat{S}^2 \ket{s, m} = s(s+1) \ket{s, m}.
\end{equation}

The commutator of any two spin operators is
\begin{equation}
\left[ \hat{S}_i, \hat{S}_j \right] = i \epsilon_{ijk} \hat{S}_k
\end{equation}
and they have the anticommutation relation
\begin{equation}
\left\{ \hat{S}_i, \hat{S}_j \right\} = \delta_{ij}.
\end{equation}
Therefore, we have that
\begin{align}
\sigma_i \sigma_j &= \frac{[ \sigma_i, \sigma_j ] + \{ \sigma_i, \sigma_j \}}{2}  \nonumber \\
&= \delta_{ij} + i\epsilon_{ijk}\sigma_k.
\end{align}
So for any two vectors, $\vec{a}$ and $\vec{b}$,
\begin{align}
(\vec{\sigma}\cdot\vec{a})(\vec\sigma\cdot\vec{b}) &= \sigma_i \, a_i \, \sigma_j \, b_j \nonumber \\
&= \sigma_i \, \sigma_j \, (a_i \, b_j) \nonumber \\
&= (\delta_{ij} + i\epsilon_{ijk}\sigma_k)(a_i \, b_j) \nonumber \\
&= a_i \, b_i + i \, \sigma_k \, \epsilon_{kij} \, a_i \, b_j \nonumber \\
&= \vec{a}\cdot\vec{b} + i \vec{\sigma}\cdot(\vec{a}\times\vec{b}).
\end{align}
Applying this result to $\vec{a} = \vec{b} = \vec{p}$, the momentum operator,
\begin{align}
(\vec{\sigma}\cdot\vec{p})(\vec{\sigma}\cdot\vec{p}) &= \vec{p}\cdot\vec{p} + i \vec{\sigma}\cdot\underbrace{(\vec{p} \times \vec{p})}_0 \nonumber \\
&= \abs{\vec{p}}^2. \label{eq:sigmaDotP2}
\end{align}
This allows us to express the energy as
\begin{equation}
E = \frac{(\vec{\sigma}\cdot\vec{p})(\vec{\sigma}\cdot\vec{p})}{2m} + V
\end{equation}
which leads to the correct energy for a particle with a gyromagnetic ratio if the EM coupling is included.

\section{The Dirac equation}
To avoid the negative energy solutions seen in the treatment of the Klein-Gordon equation, Dirac proposed an equation of motion that is linear in $\pdv{t}$. Also, there should be distinct solutions for particles with opposite spin.

\begin{equation}\boxed{
\hat{H}\psi = \left( \vec{\alpha}\cdot{\vec{p}} + \beta m \right) \psi
}\end{equation}
is the Dirac equation. Here, $\alpha_i$ and $\beta$ are $4\times4$ matrices and $\psi$ therefore a 4-component Dirac spinor.

\subsection{Constraints on $\alpha_i$, $\beta$}
For the Dirac equation to describe relativistic particles, it must agree with the relation
\begin{equation}
E^2 = p^2 + 2m.
\end{equation}
Expanding out the operators in the Dirac equation above,
\begin{align}
\hat{H}^2 &= \left( \alpha_i p_i + \beta m \right)\left( \alpha_j p_j + \beta m \right) \nonumber \\
&= \alpha_i \alpha_j p_i p_j + \left\{ \alpha_i, \beta \right\}p_i + \beta^2 m^2.
\end{align}
So we see that the matrices $\alpha_i$ and $\beta$ have the constraints:
\begin{itemize}
\item $\beta^2 = I_4$
\item $\alpha_i \alpha_j = \delta_{ij} I_4$
\item $\left\{ \alpha_i, \beta \right\} = 0 \quad \Rightarrow \quad \alpha_i \beta = - \beta \alpha_i$
\end{itemize}
This final constraint further requires that $\alpha_i$ and $\beta$ are all traceless:
\begin{align*}
\tr(\alpha_i \beta) &= -\tr(\beta \alpha_i) \\
\tr(\alpha_i \beta^2) &= -\tr(\beta \alpha_i \beta) \\
\tr(\alpha_i) &= -\tr(\beta^2 \alpha_i) \quad \text{by cyclicity of the trace} \\
&= -\tr(\alpha_i) = 0.
\end{align*}
Moreover, we require that $\alpha_i$ and $\beta$ are Hermitian.

These constraints still allow for many different representations of the Dirac equation. A commonly used choice is
\begin{equation}
\alpha_i = \mqty(\admat[0]{\sigma_i, \sigma_i}), \quad \beta = \mqty(\dmat[0]{I_2, -I_2}).
\end{equation}

\subsection{Covariant form}
Using the Schr{\"o}dinger equation, express the Dirac equation in terms of differential operators
\begin{equation}
i \pdv{\psi}{t} = -i \vec{\alpha}\cdot\vec{\nabla}\psi + \beta m \psi
\end{equation}
and pre-multiply by $\beta$,
\begin{equation}
i \beta \pdv{\psi}{t} = -i \beta \vec{\alpha}\cdot\psi + \beta^2 m \psi.
\end{equation}
Now we recognise that $\beta^2=I_4$ and define the Dirac gamma matrices $\gamma^0 = \beta$, $\gamma^k = \beta\alpha^k$. This gives
\begin{equation}\boxed{
\left(i \gamma^\mu \partial_\mu - m \right)\psi = 0 \label{eq:covDirac}
}.\end{equation}
This is the covariant form of the Dirac equation. Explicitly, the Dirac matrices are
\begin{align*}
\gamma^0 = \mqty(\dmat[0]{I_2,-I_2}), \quad \gamma^k = \mqty(\admat[0]{\sigma^k, -\sigma^k}).
\end{align*}

\subsection{Properties of the $\gamma$ matrices}
Clearly $\gamma^0$ is Hermitian,
\begin{equation}
(\gamma^0)^\dagger = \gamma^0
\end{equation}
but the $\gamma^k$ are anti-Hermitian,
\begin{align}
(\gamma^k)^\dagger &= (\beta\alpha^k)^\dagger \nonumber \\
&= (\alpha^k)^\dagger \beta^\dagger \nonumber \\
&= \alpha^k \beta \nonumber \\
&= -\beta \alpha^k \nonumber \\
&= -\gamma^k.
\end{align}
Also we have that
\begin{equation}
(\gamma^0)^2 = I_4
\end{equation}
and
\begin{equation}
(\gamma^k)^2 = -I_4.
\end{equation}
Finally, the anticommutator
\begin{equation}
\left\{ \gamma^0, \, \gamma^k \right\} = 0.
\end{equation}

These properties will prove useful in the following manipulations of the Dirac equation.

\section{Adjoint Dirac equation}
Taking the Hermitian conjugate of \eqref{eq:covDirac} and expanding out the space and time components,
\begin{equation}
-i \partial_0 {\psi^\dagger} \gamma^0 + i \partial_k {\psi^\dagger} \gamma^k - m \psi^\dagger = 0.
\end{equation}
Now multiply by $-\gamma^0$ from the right and use $\gamma^0\gamma^k = -\gamma^k\gamma^0$,
\begin{equation}
i \partial_0 {\psi^\dagger} \gamma^0 \gamma^0 + i \partial_k \psi^\dagger \gamma^0 \gamma^k + m\psi^\dagger \gamma^0 = 0.
\end{equation}
Here is it natural to identify the adjoint Dirac spinor,
\begin{equation}\boxed{
\overline{\psi} \equiv \psi^\dagger \gamma^0
}\end{equation}
so the adjoint Dirac equation becomes
\begin{equation}\boxed{
i\left(\partial_\mu \overline{\psi}\right) \gamma^\mu + m \overline{\psi} = 0 \label{eq:adjDirac}
}\end{equation}

\subsection{Conserved current}
Pre-multiply the standard Dirac equation, \eqref{eq:covDirac}, by the adjoint spinor
\begin{equation}
i \overline{\psi} \gamma^\mu \left(\partial_\mu \psi\right) - m \overline{\psi}\psi = 0
\end{equation}
and post-mulitply the adjoint Dirac equation, \eqref{eq:adjDirac}, by $\psi$,
\begin{equation}
i\left(\partial_\mu\overline{\psi}\right)\gamma^\mu \psi + m\overline{\psi}\psi = 0.
\end{equation}
Adding these, we see that
\begin{equation}
\overline{\psi} \gamma^\mu \left(\partial_\mu \psi\right) + \left(\partial_\mu\overline{\psi}\right)\gamma^\mu \psi = \partial_\mu\left( \overline{\psi} \gamma^\mu \psi \right) = 0
\end{equation}
where we can identify the 4-current density,
\begin{equation}
j^\mu = \overline{\psi} \gamma^\mu \psi.
\end{equation}
Now the probability density is given by
\begin{align*}
j^0 &= \overline{\psi}\gamma^0\psi \\
&= \psi^\dagger \gamma^0 \gamma^0 \psi \\
&= \abs{\psi}^2
\end{align*}
which is always positive. Hence the Dirac equation avoids the negative probabilities we saw in the treatment of the Klein-Gordon equation.

As usual the electromagnetic charge-current density is given by $-e\overline{\psi}\gamma^\mu\psi$ for electrons.

\section{Free particle solutions}
Consider solutions of the form
\begin{equation}
\psi = u(p) \, e^{-ipx}
\end{equation}
where $u(p)$ is a 4-component spinor and $p$ and $x$ are understood to be 4-vectors.

Substituting this into the covariant form of the Dirac equation, \eqref{eq:covDirac},
\begin{align}
0 &= \left( i \gamma^\mu \partial_\mu - m \right) u(p) \, e^{-ipx} \nonumber \\
&= \left( \gamma^\mu p_\mu - m \right) u(p) \, e^{-ipx}.
\end{align}

Now define the Feynman slash notation, $\fsl{p} \equiv \gamma^\mu p_\mu$. Solutions of the above equation are given by spinors $u(p)$ that satisfy
\begin{equation}
(\fsl{p} - m) u(p) = 0.
\end{equation}

To find these solutions, it is helpful to return to the original $\alpha_i, \beta$ matrices. Do this by expanding out the $\fsl{p}$ and pre-multiplying by $\gamma^0$:
\begin{align}
\gamma^0(\fsl{p}-m) &= \gamma^0 \gamma^0 E - \gamma^0 \gamma^k p_k - \gamma^0 m \nonumber \\
&= E - \alpha^k p^k - \beta m
\end{align}
so we look for solutions of
\begin{equation}
\left( E - \alpha^k p_k - \beta m \right) u(p) = 0.
\end{equation}

\subsection{Particles at rest}
For a particle at rest $p_k=0$ so we have to solve
\begin{equation}
\left(E - \beta m \right) u(p) = 0.
\end{equation}
Solutions exist for
\begin{equation}
\mdet{\dmat[0]{(E-m)I_2, -(E+m)I_2}} = 0
\end{equation}
which has energy solutions $E = \pm m$. We have not escaped the negative energy solutions after all! In fact, this leads to four distinct solutions for the spinor
\begin{equation}
u_{1,2} = \mqty(\chi_\pm \\ 0) , \quad u_{3,4} = \mqty(0 \\ \chi_\pm) \quad \text{where} \quad \chi_+ = \mqty(1 \\ 0), \quad \chi_- = \mqty(0 \\ 1). \label{eq:solutionsAtRestDirac}
\end{equation}
It is simple to see that $u_{1,2}$ are associated with positive energy states and $u_{3,4}$ with negative energy states. Furthermore, the spinors $\chi_\pm$ correspond to particles with spin projections $\pm \frac{1}{2}$.

\subsection{Moving particle solutions}
Now consider the case where $p_k \neq 0$. This gives the eigenvalue problem
\begin{equation}
\left[ \mqty(\admat[0]{\vec{\sigma}, \vec{\sigma}}) \cdot \vec{p} + \mqty(\dmat[0]{I_2, I_2}m) \right] \mqty(u_A \\ u_B) = E \mqty(u_A \\ u_B)
\end{equation}
or the simultaneous equations
\begin{align}
u_A &= \frac{\vec{\sigma}\cdot\vec{p}}{E-m} \, u_B \\
u_B &= \frac{\vec{\sigma}\cdot\vec{p}}{E+m} \, u_A.
\end{align}
There are still infinitely many solutions but $u_B$ is determined from $u_A$ or vice-versa. To agree with our choices for the spinor at rest, \eqref{eq:solutionsAtRestDirac}, we choose that for positive energy solutions
\begin{equation}
u_{1,2}(p) = \mathcal{N} \mqty(\chi_\pm \\ \frac{\vec{\sigma}\cdot\vec{p}}{E+m} \chi_\pm)
\end{equation}
and for negative energies, $E = -\abs{E} < 0$,
\begin{equation}
u_{1,2}(p) = \mathcal{N} \mqty(-\frac{\vec{\sigma}\cdot\vec{p}}{\abs{E}+m} \chi_\pm \\ \chi_\pm)
\end{equation}

\subsection{Antiparticles}
So far we have seen that there are four distinct solutions to the Dirac equation, accounting for each spin and positive and negative energy states. In keeping with the Feynman-Stueckelberg interpretation, we ought to demonstrate that the negative energy solutions of the Dirac equation correspond to the positron.

The full spinor states for the negative energy solutions are
\begin{align}
\psi &= u_{3,4}(p) \, e^{-ipx} \nonumber \\
&= u_{3,4}(p) \, \exp[-i(Et - \vec{p}\cdot\vec{x})] \nonumber \\
&= u_{3,4}(p) \, \exp[i(\abs{E}t + \vec{p}\cdot\vec{x})]
\end{align}
so again the negative energy solution can be interpreted as a positive energy particle travelling backwards in time and space. Hence, we can write the spinor as
\begin{equation}
\phi = v_{1,2}(p) e^{-ipx}
\end{equation}
where $v_{1,2}(p) = u_{4,3}(-p)$ and this describes a positive energy particle travelling forwards through time. Note that since what we have done is essentially a $CT$ (or equivalently $P$) transformation, the spin states are reversed such that
\begin{equation}
v_1(p) = \mathcal{N} \mqty(\frac{\vec{\sigma}\cdot\vec{p}}{E+m} \chi_- \\ \chi_-)
\end{equation}
corresponds to a spin \emph{up} positron, and
\begin{equation}
v_2(p) = \mathcal{N} \mqty(\frac{\vec{\sigma}\cdot\vec{p}}{E+m} \chi_+ \\ \chi_+)
\end{equation}
corresponds to spin down.

\section{Orthogonality and normalisation}
Without loss of generality, consider electrons travelling along the $z$-axis. Then for a spin-up electron,
\begin{equation}
u_1(p) = \mathcal{N} \mqty(1 \\ 0 \\ \frac{p}{E+m} \\ 0)
\end{equation}
and for spin-down
\begin{equation}
u_2(p) = \mathcal{N} \mqty(0 \\ 1 \\ 0 \\ \frac{-p}{E+m})
\end{equation}

Consider two electron wavefunctions, $\psi_1$, $\psi_2$, with opposite spin. Their overlap is given by
\begin{equation}
\int \psi_1^\dagger \psi_2 \, \dd[3]{\vec{x}}.
\end{equation}
Now
\begin{equation}
\psi_1^\dagger \psi_2 = \mathcal{N}^* \mathcal{N} \, \mqty(1, \, 0, \, \frac{p}{E+m}, \, 0) \mqty(0 \\ 1 \\ 0 \\ \frac{-p}{E+m}) = 0
\end{equation}
and therefore the overlap is zero. This shows that the solutions to the Dirac equation are orthogonal.

The normalisation condition is given by
\begin{equation}
2E = \int_V \psi_1^\dagger \psi_1 \, \dd[3]{\vec{x}}.
\end{equation}
For a spin-up electron travelling along the $z$-axis,
\begin{align}
\psi_1^\dagger \psi_1 &= \abs{\mathcal{N}}^2 \, \mqty(1, \, 0, \, \frac{p}{E+m}, \, 0) \mqty(1 \\ 0 \\ \frac{p}{E+m} \\ 0) \nonumber \\
&= \abs{\mathcal{N}}^2 \, \left( 1+\frac{p^2}{(E+m)^2} \right) \nonumber \\
&= \abs{\mathcal{N}}^2 \, \left( 1+\frac{E-m}{E+m} \right) \nonumber \\
&= \abs{\mathcal{N}}^2 \, \frac{2E}{E+m}
\end{align}
Therefore the normalisation condition gives
\begin{equation}
2E = \mathcal{N}^2 \, \frac{2E}{E+m} \, V
\end{equation}
\begin{equation}
\Rightarrow \quad \mathcal{N} = \sqrt{\frac{E+m}{V}}
\end{equation}
Often we will use $V=1$ for convenience.

\section{Helicity}
We would like a way to describe the spin of a Dirac particle that is consistent in time. Such a good quantum number must commute with the Dirac Hamiltonian, $\hat{H}$, which the usual QM operator $\hat{S}$ does not. To find a suitable operator, it is instructive to expand out the Hamiltonian. According to the Dirac equation,
\begin{align}
\hat{H} \mqty(u_A \\ u_B) &= \left( \vec{\alpha}\cdot\vec{p} + \beta m \right) \mqty(u_A \\ u_B) \nonumber \\
&= \mqty(m & \vec{\sigma}\cdot\vec{p} \\ \vec{\sigma}\cdot\vec{p} & -m)\mqty(u_A \\ u_B)
\end{align}
where it is to be understood that $m$ stands for $\smqty(m & 0 \\ 0 & m)$. We see from the matrix form of the Dirac Hamiltonian that $\vec{\sigma}\cdot\vec{p}$ commutes with $\hat{H}$ and hence there exists a corresponding conserved quantity.

\subsection{Helicity}
Define the helicity operator
\begin{equation}\boxed{
h \equiv \frac{1}{2} \vec{\sigma}\cdot\hat{\vec{p}}
}\end{equation}
where $\hat{\vec{p}} = \vec{p}/\abs{\vec{p}}$. Notice that $\vec{\sigma}/2 = \vec{S}$ so that $h = \vec{S}\cdot\hat{\vec{p}}$ is nothing but the projection of the particle's spin along its direction of travel.

To find the spectrum of helicities, we solve the eigenvalue problem for the matrix $\frac{1}{2} \vec{\sigma}\cdot\hat{\vec{p}}$. This is most easily done by writing out the momentum in polar coordinates:
\begin{equation}
\hat{\vec{p}} = \mqty(\sin\theta\cos\phi \\ \sin\theta\sin\phi \\ \cos\theta)
\end{equation}
then
\begin{equation}
\vec{\sigma}\cdot\hat{\vec{p}} = \mqty(\cos\theta & \sin\theta \, e^{-i\phi} \\
\sin\theta \, e^{i\phi} & -\cos\theta).
\end{equation}
This gives the eigenvalue problem,
\begin{equation}
\frac{1}{2} \mqty(\cos\theta & \sin\theta \, e^{-i\phi} \\
\sin\theta \, e^{i\phi} & -\cos\theta) \mqty(u_A \\ u_B) = \lambda \mqty(u_A \\ u_B)
\end{equation}
which has the characteristic equation
\begin{equation}
-\left( \cos\theta - 2\lambda \right) \left( \cos\theta + 2\lambda \right) - \sin^2\theta = 0
\end{equation}
with solutions
\begin{equation}
\lambda_\pm = \pm\frac{1}{2}.
\end{equation}

\section{The $\gamma^5$ matrix}\label{sec:gammaMatrix}
Define the useful $\gamma^5$ matrix
\begin{equation}
\gamma^5 = i \gamma^0 \gamma^1 \gamma^2 \gamma^3.
\end{equation}
In the Dirac-Pauli representation, it takes the form
\begin{equation}
\gamma^5 = \mqty(0 & I_2 \\ I_2 & 0)
\end{equation}
with the properties
\begin{align}
(\gamma^5)^\dagger &= \gamma^5 \\
(\gamma^5)^2 &= I_4 \\
\gamma^5 \gamma^\mu &= -\gamma^\mu \gamma^5.
\end{align}

Now consider the action of $\gamma^5$ on a solution of the Dirac equation,
\begin{equation}
\gamma^5 \mqty(u_A \\ u_B) = \mqty(0 & I_2 \\ I_1 & 0) \mqty(\chi \\ \frac{\vec{\sigma}\cdot\vec{p}}{E+m} \chi) = \mqty(\frac{\vec{\sigma}\cdot\vec{p}}{E+m} \chi \\ \chi).
\end{equation}
For ultra-relativistic particles $m \rightarrow 0$ and hence $\frac{\vec{\sigma}\cdot\vec{p}}{E+m} \rightarrow \vec{\sigma}\cdot\hat{\vec{p}}$. We also use the fact that $(\vec{\sigma}\cdot\hat{\vec{p}})(\vec{\sigma}\cdot\hat{\vec{p}}) = I_2$, as shown in \eqref{eq:sigmaDotP2}.
\begin{align}
\gamma^5 \mqty(u_A \\ u_B) &= \mqty(\left(\vec{\sigma}\cdot\hat{\vec{p}}\right) \chi \\ \chi) \nonumber \\
&= \mqty(\left(\vec{\sigma}\cdot\hat{\vec{p}}\right) \chi \\ \left(\vec{\sigma}\cdot\hat{\vec{p}}\right)^2 \chi) \nonumber \\
&= \vec{\sigma}\cdot\hat{\vec{p}} \, \mqty(\chi \\ \left(\vec{\sigma}\cdot\hat{\vec{p}}\right)\chi) \nonumber \\
&= \vec{\sigma}\cdot\hat{\vec{p}} \, \mqty(u_A \\ u_B).
\end{align}
Therefore, in the limit where $m \rightarrow 0$, the helicity operator becomes $h \rightarrow {\gamma^5/2}$.

Define the chiral projection operators,
\begin{equation}
P_R = \frac{1}{2}\left( 1 + \gamma^5 \right), \quad P_L = \frac{1}{2}\left( 1 - \gamma^5 \right).
\end{equation}
In the limit where $m \rightarrow 0$, a helicity eigenstate corresponds to a chiral state -- i.e.~$h=1$ is a right-handed state. For small $m$, a helicity eigenstate will be mostly one chirality plus a small amount of the other.

\section{Completeness relations}
The completeness relations are used extensively in the evaluation of Feynman diagrams.

Sum over the spin states,
\begin{align}
\sum_{s=\pm} u_s(p) \, \overline{u}_s(p) &= \sum_{s=\pm} (E+m) \, \mqty(\chi_s \\ \frac{\vec{\sigma}\cdot\vec{p}}{E+m} \chi_s) \mqty(\chi_s^\dagger, \, -\frac{\left(\vec{\sigma}\cdot\vec{p}\right)^\dagger}{E+m} \chi_s^\dagger) \nonumber \\
&= \sum_{i=\pm} (E+m) \, \mqty(\chi_s \chi_s^\dagger & -\frac{\left(\vec{\sigma}\cdot\vec{p}\right)^\dagger}{E+m} \chi_s \chi_s^\dagger \\ \frac{\vec{\sigma}\cdot\vec{p}}{E+m} \chi_s \chi_s^\dagger & -\frac{E-m}{E+m} \chi_s \chi_s^\dagger)
\end{align}
where for the bottom-right element we have used $(\vec{\sigma}\cdot\vec{p})^2 = \abs{p}^2 = E^2 - m^2 = (E-m)(E+m)$.

The sum over spin states can be easily performed:
\begin{equation}
\sum_{i=\pm} \chi_s \chi_s^\dagger = \mqty(1 \\ 0) \mqty(1,\, 0) + \mqty(0 \\ 1) \mqty(0,\, 1) = \mqty(\dmat[0]{1,1}) = I_2
\end{equation}
So we have that
\begin{align}
\sum_{i=\pm} u_s(p) \, \overline{u}_s(p) &= (E+m) \, \mqty(I_2 & -\frac{\vec{\sigma}\cdot\vec{p}}{E+m} \\ \frac{\vec{\sigma}\cdot\vec{p}}{E+m} & \frac{m-E}{E+m}) \nonumber \\
&= \mqty(E+m & -\vec{\sigma}\cdot\vec{p} \\ \vec{\sigma}\cdot\vec{p} & m-E) \label{eq:spinSum}
\end{align}

Now consider the matrix given by
\begin{align}
\fsl{p} + m &= \gamma^\mu p_\mu + m \\
&= \mqty(E & 0 \\ 0 & -E) - \mqty(0 & \vec{\sigma}\cdot\vec{p} \\ -\vec{\sigma}\cdot\vec{p} & 0) + \mqty(\dmat[0]{m,m}) \nonumber \\
&= \mqty(E+m & -\vec{\sigma}\cdot\vec{p} \\ \vec{\sigma}\cdot\vec{p} & m-E) \label{eq:pslash+m}
\end{align}

Comparing \eqref{eq:spinSum} and \eqref{eq:pslash+m} gives the completeness relation
\begin{equation}\boxed{
\sum_{i=\pm} u_s(p) \, \overline{u}_s(p) = \fsl{p} + m \label{eq:completeness}
}.\end{equation}

Similarly for antiparticles,
\begin{equation}
\sum_{i=\pm} v_s(p) \, \overline{v}_s(p) = \fsl{p} - m.
\end{equation}

\section{Forms of interaction in Dirac theory}
\textbf{Scalar} (even parity): $\overline{\psi} \psi$

\textbf{Pseudoscalar} (odd parity): $\overline{\psi} \gamma^5 \psi$

\textbf{Polar vector} (odd parity): $\overline{\psi} \gamma^\mu \psi$. Fermi $\beta$ decay is described by a polar vector current.

\textbf{Axial vector} (even parity): $\overline{\psi}\gamma^5 \gamma^\mu \psi$. The weak interaction is a mixture of polar and axial vector interactions.

\textbf{Tensor}: $\overline{\psi}\sigma^{\mu\nu} \psi$. This type of interaction has not been observed by experiment, although does provide a description of the mechanism behind the anomalous magnetic moment. Spin-2 gravitons would have interactions of this form.

\section{Trace theorems}\label{sec:Trace}
In scattering problems, we will often see calculations involving the traces of $\gamma$-matrices. What follows will simplify these calculations with some algebraic results.

We start with the facts that traces are associative:
\begin{equation}
\Tr(A+B) \equiv \Tr(A) + \Tr(B)
\end{equation}
and are unchanged by cyclic permutations of the argument:
\begin{equation}
\Tr(AB \ldots YZ) \equiv \Tr(ZAB \ldots Y).
\end{equation}

Also the algebra of the $\gamma$-matrices is defined by their anticommutation relation,
\begin{equation}
\gamma^\mu \gamma^\nu + \gamma^\nu \gamma^\mu = 2g^{\mu\nu} I_4 \label{eq:gammaAnticommute}
\end{equation}
where the presence of the identity has been made explicit. Taking the trace,
\begin{equation}
\Tr(\gamma^\mu \gamma^\nu) + \Tr(\gamma^\nu \gamma^\mu) = 2g^{\mu\nu} \Tr(I_4)
\end{equation}
and using the cyclicity of the trace,
\begin{equation}\boxed{
\Tr(\gamma^\mu \gamma^\nu) = 4g^{\mu\nu} \label{eq:trace2}
}.\end{equation}

The trace of any odd number of $\gamma$-matrices can be shown to be zero by inserting $\gamma^5 \gamma^5 = I_4$ into the trace. For example,
\begin{align}
\Tr(\gamma^\mu \gamma^\nu \gamma^\rho) &= \Tr(\gamma^5 \gamma^5 \gamma^\mu \gamma^\nu \gamma^\rho) \nonumber \\
&= \Tr( \gamma^5 \gamma^\mu \gamma^\nu \gamma^\rho \gamma^5) \nonumber \\
&= -\Tr(\gamma^5 \gamma^5 \gamma^\mu \gamma^\nu \gamma^\rho)
\end{align}
where the last line is reached by commuting the last $\gamma^5$ through three $\gamma$-matrices, each time introducing a factor $-1$. Hence we have that $\Tr(\gamma^\mu \gamma^\nu \gamma^\rho) = -\Tr(\gamma^\mu \gamma^\nu \gamma^\rho)$ which can only be true for
\begin{equation}\boxed{
\Tr(\gamma^\mu \gamma^\nu \gamma^\rho) = 0
}.\end{equation}
This is easily extended to the case for any odd number of $\gamma$-matrices.

The trace of four $\gamma$-matrices can be obtained using \eqref{eq:gammaAnticommute}:
\begin{align}
\gamma^\mu \gamma^\nu \gamma^\rho \gamma^\sigma &= \left( 2g^{\mu\nu} - \gamma^\nu \gamma^\mu \right) \gamma^\rho \gamma^\sigma \nonumber \\
&= 2g^{\mu\nu}\gamma^\rho\gamma^\sigma - 2g^{\mu\rho}\gamma^\nu\gamma^\sigma + \gamma^\nu\gamma^\rho\gamma^\mu\gamma^\sigma \nonumber \\
&= 2g^{\mu\nu}\gamma^\rho\gamma^\sigma - 2g^{\mu\rho}\gamma^\nu\gamma^\sigma + 2g^{\mu\sigma}\gamma^\nu\gamma^\rho - \gamma^\nu\gamma^\rho\gamma^\sigma\gamma^\mu
\end{align}
Hence,
\begin{equation}
\Tr(\gamma^\mu \gamma^\nu \gamma^\rho \gamma^\sigma) = g^{\mu\nu}\Tr(\gamma^\rho\gamma^\sigma) - g^{\mu\rho}\Tr(\gamma^\nu\gamma^\sigma) + g^{\mu\sigma}\Tr(\gamma^\nu \gamma^\rho)
\end{equation}
Evaluating the traces with \eqref{eq:trace2} gives the result
\begin{equation}\boxed{
\Tr(\gamma^\mu \gamma^\nu \gamma^\rho \gamma^\sigma) = 4g^{\mu\nu}g^{\rho\sigma} - 4g^{\mu\rho}g^{\nu\sigma} + 4g^{\mu\sigma}g^{\nu\rho}
}\end{equation}

The full set of trace theorems is:
\begin{itemize}
\item $\Tr(I_4) = 4$;
\item the trace of any odd number of $\gamma$-matrices is zero;
\item $\Tr(\gamma^\mu \gamma^\nu) = 4g^{\mu\nu}$;
\item $\Tr(\gamma^\mu \gamma^\nu \gamma^\rho \gamma^\sigma) = 4g^{\mu\nu}g^{\rho\sigma} - 4g^{\mu\rho}g^{\nu\sigma} + 4g^{\mu\sigma}g^{\nu\rho}$;
\item the trace of $\gamma^5$ multiplied by an odd number of $\gamma$-matrices is zero;
\item $\Tr(\gamma^5) = 0$;
\item $\Tr(\gamma^5 \gamma^\mu \gamma^\nu) = 0$; and
\item $\Tr(\gamma^5 \gamma^\mu \gamma^\nu \gamma^\rho \gamma^\sigma) = 4i \varepsilon^{\mu\nu\rho\sigma}$, where $\varepsilon^{\mu\nu\rho\sigma}$ is the antisymmetric tensor under the exchange of any two indices.
\end{itemize}