\newcommand{\RN}[1]{%
  \textup{\uppercase\expandafter{\romannumeral#1}}%
}

\Lecture{Jayalal Sarma}{Oct 19, 2020}{17}{Generating Functions(continued)}{Lalithaditya}{$\alpha$}{JS}

\section{Quick Recap of Previous Two Lectures}

\begin{itemize}
	\item We represented the sequence of non-negative integers in the form of a formal power series.
	\item Operations on power series corresponding to combinatorial meanings.
	\item We used the concept of Generating Functions for the following examples:
		\begin{enumerate}
			\item Distributing 'n' votes to 'k' candidates such that every candidate gets atleast one vote.
			\item Count the number of non-negative solutions for the equation $a+b+c=n$
			\item Derving the expression for Catalan numbers.
		\end{enumerate}
\end{itemize}

\section{Recurrence Relations}

There are three types of recurrence relations,that are being discussed in this lecture. There are Linear Recurrence Relations, Degree Recurrence Relations and Homogenous Recurrence Relations.\\ \ Before getting into examples,lets discuss about these relations.

\begin{itemize}
	\item \textbf{Linear Recurrence Relation:}\\ \\A Linear Recurrence Relation is a equation that defines  $n\textsuperscript{th}$ in a sequence in terms of the $k$ previous terms in the sequence. The recurrence relation is in the form:\\$$a_n = c_1.a_{n-1}~+~c_2.a_{n-2}~+~c_3.a_{n-3}~+~\dots~+~ c_k.a_{n-k}$$ $$ =\sum_{i=1}^{k} c_i*a_{n-i}$$ $where~c_i's~are~constants~independent~of~n$,\\ $c_1,c_2,c_3,\dots,c_k \in \mathbb{R} $ and $c_k \neq 0$.

	\item \textbf{Degree Recurrence Relation:}\\ \\A recurrence relation of degree d is said to be Degree Recurrence Relation where $a_n$ depends only on $a_{n-d}$.

	\item \textbf{Homogenous Recurrence Relation:}\\ \\ A recurrence relation where each term of the right hand side of the equation has the same degree.

	\item \textbf{Some examples on recurrence relations:}
	\begin{enumerate}
		\item $a_n = 5.a_{n-1}~+~a_{n-2}.a_{n-3}$ : This is neither linear nor homogenous.
		\item $a_n = a_{n-1}.a_{n-2}~+~a_{n-3}.a_{n-4}$ : This is not linear but homogenous of degree 4.
		\item $a_n = 5.a_{n-2}~+~10^n$ : This is linear but not homogenous of degree 2.
	\end{enumerate}
\end{itemize}

\section{Using Generating Functions to solve recurrence relations}

In this section, we will look how to solve recurrence relations using generating functions.
\\ \\
\textbf{Example 1:}\\
In the previous lectures,we can calculated the number of binary strings of length n, which have even number of $0$'s. It turned out to be $2^{n-1}$.\\
Similarly, calculate the number of decimal strings of length n, which contain even number of $0$'s.\\ \\
\textbf{Solution:}\\
Let the $a_n$ be the number of decimal strings,which satisfy the given condition.\\
By convention,lets take that when $n=0$, the number of such strings is 1.\\
If $n=1$,then the number of such strings will be 9.\\
$\implies a_0=1$ and $a_1=9$.\\ \\
\textbf{Forming the recurrence relation:}
Let's take a n-length decimal string, and let $d_n$ be the last digit in the string. There are two cases for this type of situation i.e. if $d_n=0$ and $d_n \neq 0$.\\
\underline{\textbf{Case-\RN{1}:}} \\If the last digit is 0, then the remaining string must have odd number of zeroes.Then the number of such strings will be $(10^{n-1} - a_{n-1})$.\\ \\
\underline{\textbf{Case-\RN{2}:}}\\
If the last digit is not zero, then the remaining string must have even number of zeroes,which is equal to number of such strings of length $n-1$ i.e. $a_{n-1}$. The last digit can vary from $1,2,3, \dots,9$. Therefore, the number of such strings will be $(9a_{n-1})$.\\ \\
The resultant recurrence relation for $a_n$ is,\\
$$\implies a_n~=~(10^{n-1}-a_{n-1}+9a_{n-1})$$
$$\implies a_n~=~(10^{n-1}+8a_{n-1})$$
The generating function for this problem will be,
\begin{equation}
G(x) = \sum_{n \geq 0} a_n.x^n
\end{equation}
$$ G(x)~=~a_0~+~\sum_{n \geq 1}a_n.x^n $$
$$ G(x)~=~a_0~+~\sum_{n \geq 1}.(10^{n-1}+8a_{n-1})x^n$$
$$ G(x)~=~1~+~\sum_{n \geq 1} 8.a_{n-1}.x^n~+~\sum_{n \geq 1}10^{n-1}.x^n $$

$$ G(x)~=~1~+~8.x ~\sum_{n \geq 1} a_{n-1}.x^{n-1}~+~x~ \sum_{n \geq 1}10^{n-1}.x^{n-1} $$

Let $n-1~=~h$.Then,

$$ G(x)~=~1~+~8.x ~\sum_{h \geq 0} a_{h}.x^{h}~+~x~ \sum_{h \geq 0}10^{h}.x^{h} $$

After renaming the variable, we have

$$ G(x)~=~1~+~8.x ~\sum_{n \geq 0} a_{n}.x^{n}~+~x~ \sum_{n \geq 0}10^{n}.x^{n} $$

From the equation (17.72), we can see that $G(x) = \sum_{n \geq 0} a_n.x^n$

$$ G(x)~=~1~+~8.x.G(x)~+~x~ \sum_{n \geq 0}10^{n}.x^{n} $$

$$ G(x)~=~1~+~8.x.G(x)~+~x~ \sum_{n \geq 0}{(10.x)}^{n} $$

From the summation of infinte geometric progression, we have

$$\sum_{n \geq 0}{(10.x)}^{n} = \frac{1}{1-10.x}$$

$$ G(x)~=~1~+~8.x.G(x)~+~x.\left(\frac{1}{1-10.x}\right) $$

After rearranging the terms, we finally $G(x)$ as,

$$G(x)~=~\frac{\left(1-9.x\right)}{(1-8.x).(1-10.x)}$$

By using the concept of partial fractions, let's split the above into two fractions,

$$\frac{\left(1-9.x\right)}{(1-8.x).(1-10.x)} ~=~ \frac{A}{(1-8.x)}~+~\frac{B}{(1-10.x)}$$

$$=~\frac{A+B-(10.A.x)-(8.B.x)}{(1-8.x).(1-10.x)}$$

$$\implies A+B=9~and~10.A+8.B=9$$

After solving for A and B, we get $A=\frac{1}{2}$ and $B=\frac{1}{2}$

\begin{equation}
	G(x)~=~\frac{\frac{1}{2}}{(1-8.x)}~+~\frac{\frac{1}{2}}{(1-10.x)}
\end{equation}

Our aim was to find the number $a_n$,which is nothing but the coefficient of $x^n$ in $G(x)$.

$$\implies Coefficient~of~x^n~in~G(x)~=~ \left(\frac{1}{2}.8^n\right) + \left(\frac{1}{2}.10^n\right)$$
$$\hspace{1ex}=~\frac{8^n+10^n}{2}$$

$\therefore$ Number of decimal strings with even number of zeroes is $\left(\frac{8^n+10^n}{2}\right)$.
\\ \\
\textbf{Example 2:}\\
In this example, we are not using any recurrence relations. We are proving combinatorial equations using generating functions.
\\ \\
For $n \geq k$, prove that
\begin{equation}
	\sum_{m=k}^{k}{m \choose k}~=~{n+1 \choose k+1}
\end{equation}
\textbf{Solution:}\\

For a fixed $k$, lets assume that $$a_n~=~\sum_{m=k}^{n}{m \choose k} $$

The generating function for this problem will be,

\begin{equation}
 S(x)~=~ \sum_{n \geq k}a_n.x^n
\end{equation}

We can observe that in the above summation, n starts from k. It can also start from n = 0, but it is the same, as $k \geq 0$. \\ \\
Lets introduce a new function $\sigma$,

$$ \sigma = \left\{
\begin{array}{ll}
      1 & if~k\leq m\leq n \\
      0 & otherwise \\
\end{array}
\right. $$

From equation (17.74),

$$ S(x)~=~ \sum_{n \geq k}a_n.x^n$$

$$ S(x)~=~ \sum_{n \geq k}~\sum_{m=k}^{n}{m \choose k}.x^n$$

$$ S(x)~=~ \sum_{n \geq k}\left(~\sum_{m \geq k}{m \choose k}.x^n\left(\sigma \right) \right)$$

After rearranging the summations,

$$ S(x)~=~ \left(~\sum_{m \geq k}\sum_{n \geq k}{m \choose k}.x^n\left(\sigma \right) \right)$$

Since ${k \leq m}$ and ${k \leq n}$ the new function $\sigma$ becomes $1$.\\ \\
Also ${k \leq m}$ and ${k \leq n}$, $\implies m \leq n$.

$$\implies~S(x)~=~ \left(~\sum_{m \geq k}\sum_{n \geq m}{m \choose k}.x^n \right)$$

Since, ${m \choose k}$ is independent of $n$,

$$S(x)~=~ \left(~\sum_{m \geq k}{m \choose k}. \sum_{n \geq m}x^n \right)$$

$$S(x)~=~\sum_{m \geq k}{m \choose k}.\left(x^m \sum_{n \geq m}x^{n-m} \right) $$

We can observe that the second summation is the sum of an infinite geometric progression.

$$S(x)~=~\sum_{m \geq k}{m \choose k}.\left( \frac{x^m}{1-x} \right)$$

\begin{equation}
	S(x)~=~\frac{x^k}{1-x} \left(\sum_{m \geq k} {m \choose k}.x^{m-k} \right)
\end{equation}

We know that,
$$\frac{1}{1-x} = 1+x+x^2+\dots + \dots$$

and also,

$${\left(\frac{1}{1-x}\right)}^{k+1} = {(1+x+x^2+\dots+\dots)^{k+1}} $$

$${(1+x+x^2+\dots+\dots)^{k+1}} = (1+x+x^2+\dots).(1+x+x^2+\dots).\dots $$

Let $d_1,d_2,d_3,\dots,d_{k+1}$ be the degree of each x terms in the product.\\
Our aim is to get the coefficient of $x^{m-k}$ in the above product, this is equivalent to the question \\ \\
\emph{In how many ways can we pick $d_1,d_2,\dots,d_{k+1}$ such that} $$\sum_{i=1}^{k+1}d_i = (m-k)$$\\
This is an example of multichoosing. As discussed in the previous lectures, the number of solutions to this question is $${{k+1+m-k-1} \choose {m-k}} = {m \choose m-k}$$

and also,

$${m \choose m-k} = {m \choose k} $$

From the equation (17.76), we can replace ${m \choose k}.x^{m-k}$ with ${\left(\frac{1}{1-x}\right)}^{k+1}$

$$S(x)~=~\frac{x^k}{1-x}{\left(\frac{1}{1-X} \right)}^{k+1} $$

\begin{equation}
 S(x)~=~\frac{x^k}{{\left(1-x \right)}^{k+2}}
\end{equation}

Our aim is to find the number $a_n$, which is nothing but the coefficient of $x^n$ in the generating function $S(x)$.\\ \\

We can observe that the,

$$Coefficient~of~x^n~in \frac{x^k}{{\left(1-x \right)}^{k+2}}~~=~~Coefficient~of~x^{n-k}~in~{\left(\frac{1}{1-x}\right)}^{k+2}$$

As we proved earlier in this example, that the coefficient of $x^{n-k}$ in the right hand side, is equivalent to the sum of degrees of x terms by expanding $\left(\frac{1}{1-x}\right)$ equal to $(k+2)$.
\\
As proved in earlier lectures, this sum is equal to

$$a_n = {{k+2+n-k-1} \choose {n-k}}$$

$${{k+2+n-k-1} \choose {n-k}} = {n+1 \choose n-k} $$

$${n+1 \choose n-k} = {n+1 \choose k+1}$$

$$\boxed{\therefore a_n = {n+1 \choose k+1}}$$

\Lecture{Jayalal Sarma}{Oct 20, 2020}{18}{Two Variable Generating Functions}{Lalithaditya and Pragnya}{$\alpha$}{JS}

Till now we had discussed Generating Functions with one variable. In this lecture, we are going to discuss Generating Functions with two variables. Such type of Generating functions are known as \textbf{Bivariate Generating Functions}.\\ \\

The general form of the Bivariate Generating functions is,$$G(x,y) = \sum_{n,k \geq 0} a_{n,k}.x^n.y^k$$

These type of generating functions are useful, when dealing combinatorial problems with two variables.\\
Lets try out some examples, to get an idea on how to use Generating Functions with two variables.

\section{Examples based on Bivariate Generating Functions}
\textbf{Example 1:}\\ Prove the binomial theorem in single variable using the two variable generating functions.\\
Binomial Theorem in single variable:
$${\left(1+x\right)}^{n} = \sum_{k=0}^{n}{n \choose k}.x^k$$
\textbf{Solution:}\\

We know that the number of ways of choosing a k-sized subset from n-sized set is equal to ${n \choose k}$.\\

Let the number be $b_{n,k}$.
\\
When $n=0$ , $b_{0,k}~=~0$ and when $k=0$, $b_{n,0}~=~1$.\\
\\
As discussed in previous lectures, we can choose a k-sized subset from n-1 elements or from n elements.
\\
\textbf{Recurrence relation:}
$$b_{n,k} = b_{n-1,k-1} + b_{n-1,k} $$

The generating function for this problem is,
\begin{equation}
B(x,y) = \sum_{n,k \geq 0}b_{n,k}.\left(x^n.y^k \right)
\end{equation}

$$B(x,y) = \sum_{n \geq 0,k=0}b_{n,0}x^n + \sum_{n=0,k \geq 0}b_{0,k}.y^k + \sum_{n,k \geq 1}b_{n,k}.\left(x^n.y^k \right) $$

We know that $b_{0,k} = 0~and~b_{n,0}=1$.

$$B(x,y) = \sum_{n \geq 0,k=0}1. \left( x^n \right) + \sum_{n=0,k \geq 0}0. \left( y^k \right) + \sum_{n,k \geq 1}b_{n,k}.\left(x^n.y^k \right) $$

$$B(x,y) = \sum_{n \geq 0,k=0} \left( x^n \right) + \sum_{n,k \geq 1}b_{n,k}.\left(x^n.y^k \right)$$

By using the recurrence relation,

$$B(x,y) = \sum_{n \geq 0,k=0} \left( x^n \right) + \sum_{n,k \geq 1}b_{n-1,k-1}.\left(x^n.y^k \right) + \sum_{n,k \geq 1}b_{n-1,k}.\left(x^n.y^k \right)$$

We know that,
$$\sum_{n \geq 0}x^n = \frac{1}{1-x} $$

$$B(x,y) = \frac{1}{1-x} + \sum_{n,k \geq 1}b_{n-1,k-1}.\left(x^n.y^k \right) + \sum_{n,k \geq 1}b_{n-1,k}.\left(x^n.y^k \right)$$

$$B(x,y) = \frac{1}{1-x} + \left(x.y\right)\sum_{n,k \geq 1}b_{n-1,k-1}.\left(x^{n-1}.y^{k-1} \right) + x.\sum_{n,k \geq 1}b_{n-1,k}.\left(x^{n-1}.y^k \right)$$

$$B(x,y) = \frac{1}{1-x} + \left(x.y\right)\sum_{n,k \geq 1}b_{n-1,k-1}.\left(x^{n-1}.y^{k-1} \right) + x.\sum_{n,k \geq 1}b_{n-1,k}.\left(x^{n-1}.y^k \right)$$

Let $(n-1)=h~and~(k-1)=p$

$$B(x,y) = \frac{1}{1-x} + \left(x.y\right)\sum_{h,p \geq 1}b_{h,p}.\left(x^{h}.y^{p} \right) + x.\sum_{n,k \geq 1}b_{n-1,k}.\left(x^{n-1}.y^k \right)$$

After renaming of variables,

$$B(x,y) = \frac{1}{1-x} + \left(x.y\right)\sum_{n,k \geq 1}b_{n,k}.\left(x^{n}.y^{k} \right) + x.\sum_{n,k \geq 1}b_{n-1,k}.\left(x^{n-1}.y^k \right)$$

$$B(x,y) = \frac{1}{1-x} + \left(x.y\right)\sum_{n,k \geq 1}b_{n,k}.\left(x^{n}.y^{k} \right) + x.\left(\sum_{n,k \geq 0}b_{n,k}.\left(x^{n}.y^k \right) - \sum_{n \geq 0,k=0}x^n \right)$$

$$B(x,y) = \frac{1}{1-x} + \left(x.y\right)\sum_{n,k \geq 0}b_{n,k}.\left(x^{n}.y^{k} \right) + x.\left(\sum_{n,k \geq 0}b_{n,k}.\left(x^{n}.y^k \right) - \sum_{n \geq 0,k=0}x^n \right)$$

From the equation (18.78),

$$B(x,y) = \frac{1}{1-x} + \left(x.y\right).B(x,y) + x.\left(B(x,y) - \frac{1}{1-x} \right)$$

After rearranging the terms,

$$B(x,y) = 1+x.\left(y+1\right).B(x,y)$$

$$B(x,y) = \frac{1}{1-x.\left(y+1\right)}$$

$\therefore$ The generating function $B(x,y)$ is,

\begin{equation}
	\boxed{B(x,y) = \frac{1}{1-x.\left(y+1\right)}}
\end{equation}

Coefficient of $x^n$ in the Left hand side of the above equation is equal to the coefficient of $x^n$ in the right hand side of the above equation.

Coefficient of $x^n$ in the left hand side $= \sum_{k \geq 0}b_{n,k}.y^k~(\because From~equation~(18.78))$
\\

\textbf{Note:} Coefficient of $x^n$ in $\left(\frac{1}{1-ax}\right)$ is $a^n$.\\

$\implies$ Coefficient of $x^n$ in the right hand side $= {\left(1+y \right)}^{n}$\\

Hence,

$$\sum_{k \geq 0}b_{n,k}.y^k = {\left(1+y \right)}^{n} $$

After renaming of variables,

$${\left(1+x \right)}^{n} = \sum_{k \geq 0}b_{n,k}.x^k $$

At the beginning of the proof, we assumed that $b_{n,k} = {n \choose k}$

\begin{equation}
	\boxed{\therefore {\left(1+x \right)}^{n} = \sum_{k \geq 0}{n \choose k}.x^k}
\end{equation}

which completes our proof.
\\ \\
\textbf{Example 2 (Delannoy Numbers):}\\
Consider a nxn grid. Delannoy number D counts the number of paths from the left-bottom corner (0,0) to any other point on the grid (n,m). \\
The path can be reached by only three paths i.e Upward edges(U), Rightward edges(R) and upward forward diagonals(F). Find the Delannoy Number. \\ \\
\textbf{Solution:}\\
Let $d_{n,m}$ be the number of Delannoy paths from (0,0) to (n,m), by using the above edges only.
\\ \\
For example,When n=3 and m=3, then the number of Delannoy paths is 63.

	\begin{figure}[H]
		\centerline{\includegraphics[width=0.5\textwidth,height=0.5\textwidth]{images/DelannoyNumbers.png}}
	\end{figure}

\textbf{\underline{Aim}:} To find $d_{n,m}$ \\

\textbf{Recurrence Relation:}\\ \\
Lets find a recurrence relation for $d_{n,m}$.
\\
A point (n,m) can be reached from three ways i.e. from (n-1,m), from (n-1,m-1) and from (n,m-1).
\\
Hence, the recurrence relation for $d_{n,m}$ will be,
\begin{equation}
\boxed{d_{n,m} = d_{n,m-1} + d_{n-1,m} + d_{n-1,m-1}}
\end{equation}

\textbf{Generating Function:}\\ \\
The generating function for this problem is,
\begin{equation}
\boxed{D(x,y) = \sum_{n,m \geq 0}d_{n,m}.x^n.y^m}
\end{equation}

We can observe that $d_{n,0}=d_{0,m}=1$.

$$D(x,y) = \sum_{n \geq 0,m=0}d_{n,0}.x^n + \sum_{n=0,m \geq 1}d_{0,m}.y^m + \sum_{n \geq 1,m \geq 1}d_{n,m}.x^n.y^m$$

$$D(x,y) = \sum_{n \geq 0,m=0}1.x^n + \sum_{n=0,m \geq 1}1.y^m + \sum_{n \geq 1,m \geq 1}d_{n,m}.x^n.y^m$$

We know that,
$$\sum_{n \geq 0}x^n = \frac{1}{1-x}$$

$$D(x,y) = \frac{1}{1-x} + \sum_{n=0,m \geq 1}y^m + \sum_{n \geq 1,m \geq 1}d_{n,m}.x^n.y^m$$

$$D(x,y) = \frac{1}{1-x} + y.\sum_{n=0,m \geq 1}y^{m-1} + \sum_{n \geq 1,m \geq 1}d_{n,m}.x^n.y^m$$

Let $(m-1)=h$,

$$D(x,y) = \frac{1}{1-x} + y.\sum_{n=0,h=0}y^h + \sum_{n \geq 1,m \geq 1}d_{n,m}.x^n.y^m$$

After renaming the variables,

$$D(x,y) = \frac{1}{1-x} + y.\sum_{n=0,m=0}y^m + \sum_{n \geq 1,m \geq 1}d_{n,m}.x^n.y^m$$

$$D(x,y) = \frac{1}{1-x} + y.\left(\frac{1}{1-y}\right) + \sum_{n \geq 1,m \geq 1}d_{n,m}.x^n.y^m$$

Using the recurrence relation from equation (18.81),

$$D(x,y) = \frac{1}{1-x} + \frac{y}{1-y} + \sum_{n \geq 1,m \geq 1}(d_{n,m-1} + d_{n-1,m} + d_{n-1,m-1}).x^n.y^m$$

$$D(x,y) = \frac{1}{1-x} + \frac{y}{1-y} + \sum_{n \geq 1,m \geq 1}d_{n,m-1} + \sum_{n \geq 1,m \geq 1}d_{n-1,m} + \sum_{n \geq 1,m \geq 1}d_{n-1,m-1}.x^n.y^m$$

$$D(x,y) = \frac{1}{1-x} + \frac{y}{1-y} + x.y.\sum_{n \geq 1,m \geq 1}d_{n-1,m-1}.x^{n-1}.y^{m-1} + \sum_{n \geq 1,m \geq 1}d_{n,m-1} + \sum_{n \geq 1,m \geq 1}d_{n-1,m}$$

Let $(n-1)=h~and~(m-1)=p$,
$$D(x,y) = \frac{1}{1-x} + \frac{y}{1-y} + x.y.\sum_{h \geq 0,p \geq 0}d_{h,p}.x^{h}.y^{p} + \sum_{n \geq 1,m \geq 1}d_{n,m-1} + \sum_{n \geq 1,m \geq 1}d_{n-1,m}$$

After renaming the variables,
$$D(x,y) = \frac{1}{1-x} + \frac{y}{1-y} + x.y.\sum_{n \geq 0,m \geq 0}d_{n,m}.x^{n}.y^{m} + \sum_{n \geq 1,m \geq 1}d_{n,m-1}.x^{n}.y^{m} + \sum_{n \geq 1,m \geq 1}d_{n-1,m}.x^{n}.y^{m}$$

From the equation (18.82),
\begin{equation}
D(x,y) = \frac{1}{1-x} + \frac{y}{1-y} + x.y.D(x,y) + \sum_{n \geq 1,m \geq 1}d_{n-1,m}.x^{n}.y^{m} +\sum_{n \geq 1,m \geq 1}d_{n,m-1}.x^{n}.y^{m}
\end{equation}

Consider the fourth term in the above equation,
$$\sum_{n \geq 1,m \geq 1}d_{n-1,m}.x^{n}.y^{m} = x.\sum_{n \geq 1,m \geq 1}d_{n-1,m}.x^{n-1}.y^{m}$$

Let $(n-1)=h$
$$x.\sum_{n \geq 1,m \geq 1}d_{n-1,m}.x^{n-1}.y^{m} = x.\sum_{h \geq 0,m \geq 1}d_{h,m}.x^h.y^m$$
After renaming the variables,

$$x.\sum_{h \geq 0,m \geq 1}d_{h,m}.x^h.y^m = x.\sum_{n \geq 0,m \geq 1}d_{n,m}.x^n.y^m$$

$$x.\sum_{n \geq 0,m \geq 1}d_{n,m}.x^n.y^m = x.\left(\sum_{n \geq 0,m \geq 0}d_{n,m}.x^{n}.y^{m} - \sum_{n \geq 0,m = 0}d_{n,0}.x^{n} \right)$$

$$x.\left(\sum_{n \geq 0,m \geq 0}d_{n,m}.x^{n}.y^{m} - \sum_{n \geq 0,m = 0}d_{n,0}.x^{n} \right) = x.\left(D(x,y)-\frac{1}{1-x} \right) $$
\\ \\
Substituting the above value in the equation (18.83),then

$$D(x,y) = \frac{1}{1-x} + \frac{y}{1-y} + x.y.D(x,y) + x.\left(D(x,y)-\frac{1}{1-x} \right) +\sum_{n \geq 1,m \geq 1}d_{n,m-1}.x^{n}.y^{m}$$

After rearranging the terms,

\begin{equation}
D(x,y) = 1 + \frac{y}{1-y} + x.y.D(x,y) + x.D(x,y) + \sum_{n \geq 1,m \geq 1}d_{n,m-1}.x^{n}.y^{m}
\end{equation}

Consider the last term of the above equation,

$$\sum_{n \geq 1,m \geq 1}d_{n,m-1}.x^{n}.y^{m} = y.\sum_{n \geq 1,m \geq 1}d_{n,m-1}.x^{n}.y^{m-1} $$

Let $p=(m-1)$,then

$$y.\sum_{n \geq 1,m \geq 1}d_{n,m-1}.x^{n}.y^{m-1} = y.\sum_{n \geq 1,p \geq 0}d_{n,p}.x^{n}.y^{p}$$

After renaming the variables,

$$y.\sum_{n \geq 1,m \geq 0}d_{n,m}.x^{n}.y^{m} = y.\left(\sum_{n \geq 0,m \geq 0}d_{n,m}.x^n.y^m - \sum_{n=0,m \geq 0}d_{0,m}.y^{m} \right) $$

$$y.\left(\sum_{n \geq 0,m \geq 0}d_{n,m}.x^n.y^m - \sum_{n=0,m \geq 0}d_{0,m}.y^{m} \right) = y.\left(D(x,y) - \frac{1}{1-y} \right) $$

Substitute the above value in the equation (18.84),

$$D(x,y) = 1 + \frac{y}{1-y} + x.y.D(x,y) + x.D(x,y) + y.\left(D(x,y) - \frac{1}{1-y} \right)$$

$$D(x,y) = 1 + x.y.D(x,y) + x.D(x,y) + y.D(x,y) $$

After rearranging the terms,

$$D(x,y) = \frac{1}{1-x-y-xy} $$

$$D(x,y) = \left(\frac{1}{1-y}\right).\left(\frac{1}{1-\left(\frac{1+y}{1-y}\right).x}\right) $$

We know that,
$$\frac{1}{1-a.x} = \sum_{n \geq 0}a^n.x^n $$

$$D(x,y) = \left(\frac{1}{1-y}\right).\left(\sum_{n \geq 0}{\left(\frac{1+y}{1-y} \right)}^n.x^n \right) $$

The generating function is,
\begin{equation}
\boxed{D(x,y) = \left(\sum_{n \geq 0}{\frac{{(1+y)}^n}{{(1-y)}^{n+1}}}.x^n \right)}
\end{equation}

The required number $d_{n,m}$ is,\\

$$d_{n,m}~=~Coefficient~of~x^n.y^m~in~D(x,y)$$

$$d_{n,m}~=~Coefficient~of~y^m~in~{\frac{{(1+y)}^n}{{(1-y)}^{n+1}}}$$

$$d_{n,m}~=~Coefficient~of~y^m~in~ {(1+y)}^n.\left(\frac{1}{1-y}.\frac{1}{1-y}. \dots (n+1) times\right)$$

We know that,

$$\frac{1}{1-y} = 1+y+y^2+ \dots$$

$$d_{n,m}~=~Coefficient~of~y^m~in~{(1+y)}^n.\left((1+y+y^2+\dots).(1+y+y^2+\dots). \dots (n+1) times\right)$$

Let's say that a number $k \geq 0$ is taken, such that the term along with its coefficient $y^k$ comes from ${(1+y)^n}$ and the remaining term along with its coefficient $y^{m-k}$ comes from the (n+1) term product.\\

The coefficient of $y^k$ in ${(1+y)^n}$ is ${n \choose k}$.\\

Let $c_1,c_2,\dots,c_{n+1}$ be the degrees of x from the (n+1)-term product.\\

Finding out the coefficient of $y^{m-k}$ from the (n+1) term product is equivalent to count the number of ways of picking $c_i$'s such that $c_1+c_2+\dots+c_{n+1}=m-k$\\

The number of such pickings = ${{n+1+m-k-1} \choose {m-k}}$ = ${n+m-k} \choose {m-k}$ = ${n+m-k} \choose {n}$.\\

Therefore, the required number $d_{n,m}$ is,

$$d_{n,m} = \sum_{k \geq 0}{n \choose k}.{{n+m-k} \choose n}$$

Hence,
\begin{equation}
\boxed{Delannoy~Number~(D) = \sum_{k \geq 0}{n \choose k}.{{n+m-k} \choose n}}
\end{equation}

\Lecture{Jayalal Sarma}{Oct 21, 2020}{17}{Generating Functions(continued)}{Pragnya}{$\alpha$}{JS}

\section{Introduction}
In this section we'll see some examples of ordinary generating functions and get introduced to exponential generating functions.

\subsection{Example 3 : }
To show two combinatorial qualities are equal it sufficies to show that they have same generating functions. Consider the following,
$$ B_n(m) = \{(x_1, x_2, \dots x_n) ~|~ \forall i ~ x_i \in \Z , \sum |x_i| \leq m \}$$
let $b_{n,m} = |B_n(m)|$. Let's see properties of  $b_{n,m}$ :
\begin{enumerate}
    \item $b_{n, m} = \sum_{k=0}^n {n \choose k}{m \choose k} 2^k$.
    \item $b_{n, m} = b_{m, n}$. This can also be proved using bijection.
    \item $b_{n, m} = d_{m, n}$.
\end{enumerate}
We'll prove property $3$ by showing they have same generating functions.
\begin{align*}
    B_{x,y} &= \sum_{n,m \geq 0} b_{n, m} x^n y^m\\
    &= \sum_{n,m \geq 0} (\sum_{k=0}^n {n \choose k}{m \choose k} 2^k) x^n y^m \\
    &= \sum_{n,m,k \geq 0}{n \choose k}{m \choose k} 2^k x^n y^m \\
    &= \sum_{k \geq 0} 2^k \sum_{n,m \geq 0} {n \choose k}{m \choose k} x^n y^m \\
    &= \sum_{k \geq 0} 2^k (\sum_{n \geq 0} {n \choose k} x^n)(\sum_{m \geq 0} {m \choose k} y^m) \\
B_{x, y}&= \sum_{k \geq 0} 2^k (x^k \sum_{n \geq 0} {n \choose k} x^{n-k})(y^k \sum_{m \geq 0} {m \choose k} y^{m-k})
\end{align*}
Consider $\frac{1}{(1-x)^{k+1}}$ :
$$\frac{1}{(1-x)^{k+1}} = \frac{1}{(1-x)}.\frac{1}{(1-x)}. \dots \frac{1}{(1-x)} ~(k+1 ~times)$$
Coefficient of $x^{n-k}$ in $\frac{1}{(1-x)^{k+1}}$ is equivalent to no.of solutions of $a_1 + a_2 + \dots + a_{k+1} = n-k$ which is $ = {(n-k) + (k+1) -1 \choose n-k} = {n \choose k}$.
Hence
$$ \sum_{n \geq 0} {n \choose k} x^{n-k} = \frac{1}{(1-x)^{k+1}} $$
Similarly
$$ \sum_{m \geq 0} {m \choose k} y^{m-k} = \frac{1}{(1-y)^{k+1}} $$
Substituting them in the above derived $B_{x, y}$ -
\begin{align*}
    B_{x, y} &= \sum_{k \geq 0} 2^k x^k y^k \frac{1}{(1-x)^{k+1}} \frac{1}{(1-y)^{k+1}} \\
    &= \sum_{k \geq 0} (2xy)^k \frac{1}{(1-x)^{k+1}} \frac{1}{(1-y)^{k+1}} \\
    &= \frac{1}{(1-x)(1-y)} \sum_{k \geq 0} \frac{(2xy)^k}{(1-x)^k(1-y)^k} \\
    &= \frac{1}{(1-x)(1-y)} \sum_{k \geq 0} (\frac{(2xy)}{(1-x)(1-y)}) ^k \\
    &= \frac{1}{(1-x)(1-y)} \frac{1}{1- \frac{2xy}{(1-x)(1-y)}} \\
    &= \frac{1}{(1-x)(1-y) - 2xy} \\
    B(x, y) &=  \frac{1}{1 - x - y - xy} = D(x, y)
\end{align*}
Since $b_{n, m}$ and $d_{n, m}$ have same generating functions, $b_{n, m} = d_{n, m}$. Hence $b_{n, m}$ also satisfies recurrence relation of $d_{n, m}$ -
$$ b_{n, m} = b_{n-1, m} + b_{n, m-1} + b_{n-1, m-1}$$

\subsection{Example 4 : Stirling number of second kind}
As discussed in previous lectures, number of ways to partition set $\{1, 2, 3 \dots n \}$ into $k$ non-empty parts is called stirling number of second kind. Let's represent by $S_{n,k}$. It's recurrence relation is given by -
$$S_{n, k} = S_{n-1, k-1} + k S_{n-1, k} $$
LHS : number of ways to partition set $\{1, 2, 3 \dots n \}$ into $k$ non-empty parts $ = S_{n, k}$ \\
RHS : \begin{enumerate}
\item If element $1$ occurs in a singleton set. No.of ways to partition remaining $n-1$ elements to $k-1$ sets $= S_{n-1, k-1}$.
\item If element $1$ doesn't occur in a singleton set. Then we can partition remaining $n-1$ elements to $k$ sets and add element $1$ to one of these $k$ sets $=  k S_{n-1, k}$
\end{enumerate}
We can also see that $S_{0,0} = 1 ,~ S_{n, 0} = 0 ,~ S_{0, k} = 0$.
%$S_{x, y} = {\sum_{n, k \geq 0} ^ {\infty} S_{n,k} x^n y^k}$ \\
%\begin{equation}
\begin{align*}
 S(x, y) &= {\sum_{n, k \geq 0} ^ {\infty} S_{n,k} x^n y^k} \\
&= S_{0,0}~x^0y^0 + {\sum_{n = 0, k \geq 1}^ {\infty} S_{0,k}~x^0y^k} + {\sum_{n \geq 1, k = 0}^ {\infty} S_{n,0}~x^n y^0} + {\sum_{n \geq 1, k \geq 1}^ {\infty} S_{n,k}~x^n y^k}  \\
 &= 1 + \sum_{n \geq 1 , k \geq 1} ^ {\infty} S_{n,k} ~ x^n y^k  \\
 &= 1 + \sum_{n \geq 1 , k \geq 1} S_{n-1, k-1}~ x^n y^k + \sum_{n \geq 1, k \geq 1} k S_{n-1, k}~ x^n y^k \\
 &= 1 + xy \sum_{n \geq 1, k \geq 1} S_{n-1, k-1} x^{n-1} y^{k-1} + x\sum_{n \geq 1, k \geq 1} k S_{n-1, k}~ x^{n-1} y^k \\
 &= 1 + xy~ S(x, y) + x \sum_{n \geq 0, k \geq 1} k S_{n, k}~ x^{n} y^k \\
 &= 1 + xy~ S(x, y) + \frac{\partial}{\partial y} S(x,y)
\end{align*}
Note : $\frac{\partial}{\partial y} S(x, y) = \sum_{n \geq 0, k \geq 1} k S_{n,k}~x^n y^{k-1}$

Consider $y^k$ coefficients on both sides :
\begin{equation}
  \begin{split}
    LHS &= \sum_{n \geq 0} S_{n, k} x^n \\
    RHS &= x\sum_{n \geq 0} S_{n, k-1} x^n + xk \sum_{n \geq 0} S_{n, k}x^n
\end{split}
\end{equation}
Equating LHS and RHS :
\begin{align*}
\sum_{n \geq 0} S_{n, k}~ x^n &= x\sum_{n \geq 0} S_{n, k-1} ~x^n + xk \sum_{n \geq 0} S_{n, k}~x^n \\
\sum_{n \geq 0} S_{n, k} ~x^n &= \frac{x}{1-xk}  \sum_{n \geq 0} S_{n, k-1}~ x^n   \\
&= \frac{x}{1-xk} \frac{x}{1-x(k-1)} \sum_{n \geq 0} S_{n, k-2}~ x^n \\
&= \frac{x}{1-xk} \frac{x}{1-x(k-1)} \dots \frac{x}{1-x(k-(k-1))}
\sum_{n \geq 0} S_{n, 0}~ x^n \\
&= \frac{x^k}{(1-x)(1-2x)\dots (1-kx)} \times 1 ~( Note : S_{0,0} = 1, S_{n, 0} = 0) \\
\sum_{n \geq 0} S_{n, k}~ x^n &= x^k \times (\frac{A_1}{1-x} + \frac{A_2}{1-2x} + \dots +  \frac{A_k}{1-kx})
\end{align*}
Solving for $A_1, A_2, \dots A_k $ we'll get $A_r = (-1)^{k-r} \frac{r^{k-1}}{(r-1)! (k-r)!}$. \\
$S_{n,k}$ is the coefficient of $x^n$ in RHS. i.e.,
\begin{align*}
S_{n,k} &= coeff~ of ~x^n ~in~ x^k \times (\frac{A_1}{1-x} + \frac{A_2}{1-2x} + \dots +  \frac{A_k}{1-kx}) \\
&= coeff ~ of ~ x^{n-k} ~ in ~ \sum_{r=1}^k \frac{A_r}{1-rx}
\end{align*}
Coefficient of $x^{p}$ in $\frac{1}{1-rx} = r^p$. hence,
\begin{align*}
S_{n,k} &= \sum_{r=1}^k A_r r^{n-k} \\
&= \sum_{r=1}^k (-1)^{k-r} \frac{r^{k-1}}{(r-1)! (k-r)!} ~ r^{n-k}\\
S_{n,k} &= \sum_{r=1}^k (-1)^{k-r} \frac{r^{n}}{(r-1)! (k-r)!}
\end{align*}
The above expression is Stirling number of second kind
%\end{equation}
%$$ = S_{0,0}~x^0y^0 + {\sum_{n = 0, k \geq 1}^ {\infty} S_{0,k}~x^0y^k} + {\sum_{n \geq 1, k = 0}^ {\infty} S_{n,0}~x^ny^0} + {\sum_{n \geq 1, k \geq 1}^ {\infty} S_{n,k}~x^ny^k} $$ \\
%$&= 1 + \sum_{\substack{n \geq 1 \\ k \geq 1}} ^ {\infty} S_{n,k} ~ x^n y^k$

\section{Exponential generating functions}
In ordinary generating functions we associate sequence, ${(a_n)}_{n \geq 0}$ with $G(x) = \sum_{n \geq 0} a_n x^n$. In $G(x)$ we chose basis $\{ 1, x, x^2, x^3 \dots\}$ for set of all polynomials in one variable. But there are many other basis for set of polynomials, like $\{1, x, x(x-1), x(x-1)(x-2), \dots\}$. We chose basis $\{ 1, x, x^2, x^3 \dots\}$ because it has combinatorial meaning. Other such meaning full basis are $\{\frac{x^n}{n!}\}_{n \in \N}$, $\{e^{-x} \frac{x^n}{n!}\}_{n \in \N}$ and $\{\frac{1}{n^x}\}_{n \in \N}$. In this lecture we'll explore exponential generating functions which use basis $\{\frac{x^n}{n!}\}_{n \in \N}$ . \\
So  ${(a_n)}_{n \geq 0}$ is associated with $E(x) = \sum_{n \geq 0} a_n \frac{x^n}{n!}$ . Let's see a few examples -
\begin{align*}
(1, 1, 1, \dots ) &\xrightarrow[generating function]{exponential} \sum_{n \geq 0} \frac{x^n}{n!} = e^x    \\
&\xrightarrow[generating function]{ordinary} \sum_{n \geq 0} x^n = \frac{1}{1-x} \\
(1!, 2!, 3!, \dots) &\xrightarrow[generating function]{exponential} \sum_{n \geq 0} n! \frac{x^n}{n!} = \sum_{n \geq 0} x^n = \frac{1}{1-x}
\end{align*}
$\frac{1}{1-x}$ is ordinary generating function(ogf) of $(1, 1, 1, \dots )$ and exponential generating function(egf) of $(1!, 2!, 3!, \dots )$.\\
\\
\textbf{\Large {Operations of EGF}}
\begin{enumerate}
\item{\textbf{Addition :} } It's similar to ogf.
    \begin{align*}
        \{a_n\}_{n \geq 0} &\xrightarrow[]{egf} E(x) \\
        \{b_n\}_{n \geq 0} &\xrightarrow[]{egf} F(x) \\
        \{a_n + b_n \}_{n \geq 0} &\xrightarrow[]{egf} E(x) + F(x) \\
    \end{align*}
\item {\textbf{Shifting :} } Multiplying ogf by $x$ shifts the sequence to left as seen in earlier lectures.
    \begin{align*}
        \{a_0, a_1, a_2 \dots \} &\xrightarrow[]{egf} E(x) \\
        \{0, a_0, a_1, a_2 \dots \} &\xrightarrow[]{egf} xE(x) \\
    \end{align*}
Differentiating egf function will shift the sequence to right.
\begin{gather*}
    \{a_0, a_1, a_2 \dots \} \xrightarrow[]{egf} ~~ E(x) \endline
        \{a_1, a_2, a_3 \dots \} \xrightarrow[]{egf} \frac{d}{dx} E(x) \\
        \frac{d}{dx} E(x) = \sum_{n \geq 1} a_n~ \frac{n. x^{n-1}}{n!} = \sum_{n \geq 1} a_n~ \frac{x^{n-1}}{(n-1)!} =  \sum_{n \geq 0} a_{n+1}~ \frac{x^{n}}{n!}
\end{gather*}
\item {\textbf{Multiplication :} }   EGFs are used if the sequence counts labelled structures like permutations, derangements and partitions. Let $(a_n)_{n \geq 0}$, $(b_n)_{n \geq 0}$ count arrangements  of type $A$ and type $B$ respectively using $n$ labelled objects. If we want to count type $C$ arrangements, that can be obtained by a unique split of $n$ objects into two sets and then arranging first set according to type $A$ and second set according to type $B$ - \\
 No.of arrangements of type $C$ of size $n, c_n = \sum_{k=0}^n {n \choose k} a_k b_{n-k}$.\\
 Now Let's see how multiplication of $A(x)$(egf of $A$) and $B(x)$(egf of $B$) is useful
 \begin{align*}
     A(x).B(x) &= (\sum_{n=0}^{\infty} a_n \frac{x^n}{n!})(\sum_{n=0}^{\infty} b_n \frac{x^n}{n!}) \\
     &= \sum_{n=0}^{\infty}(\sum_{k=0}^{n} \frac{a_k}{k!}.\frac{b_{n-k}}{(n-k)!}) x^n \\
     &= \sum_{n=0}^{\infty}(\sum_{k=0}^{n} \frac{n!}{k!(n-k)!} a_k b_{n-k}) \frac{x^n}{n!} \\
     &= \sum_{n=0}^{\infty}(\sum_{k=0}^{n} {n \choose k} a_k b_{n-k}) \frac{x^n}{n!} \\
     &= \sum_{n=0}^{\infty} c_n \frac{x^n}{n!} \\
     A(x).B(x) &= C(x)
 \end{align*}

 Now Let's see few examples of egf
 \subsection{Derangements } Recall that we've discussed derangements in PIE and recurrence relations. Now let's derive it using egf. Let $D_n$ represent set of derangements of $n$ objects and let $d_n = |D_n|$. we can see that $d_0 = 1 ,~ d_1 = 0,~ d_2 = 1$. Recall the recurrence relation : $$ d_{n+2} = (n+1)(d_{n+1} + d_n)$$
 \begin{align*}
     D(x) &= \sum_{n=0}^{\infty} d_n \frac{x^n}{n!} \\
     D'(x) &= \sum_{n=0}^{\infty} d_{n+1} \frac{x^n}{n!} ~(by ~shifting ~operation)\\
     &= \sum_{n=1}^{\infty} n(d_n + d_{n-1}) \frac{x^n}{n!} \\
     &= \sum_{n=1}^{\infty} nd_n \frac{x^n}{n!} + \sum_{n=1}^{\infty} nd_{n-1} \frac{x^n}{n!} \\
     &= x \sum_{n=1}^{\infty} d_n \frac{x^{n-1}}{(n-1)!} + x \sum_{n=1}^{\infty} d_{n-1} \frac{x^{n-1}}{(n-1)!} \\
     &= x \sum_{n=0}^{\infty} d_{n+1} \frac{x^n}{n!} + x \sum_{n=0}^{\infty} d_n \frac{x^n}{n!} \\
     D'(x) &= xD'(x) + xD(x) \\
     (1-x)D'(x) &= xD(x) \\
     \frac{D'(x)}{D(x)} &= \frac{x}{1-x} = \frac{1}{1-x} - 1
 \end{align*}
Integrating on both sides
     $$\ln{D(x)} = \ln{(1-x)} - x + c$$
Since $D(0) = d_0 = 1 \implies c=0$.
    $$\ln{D(x)} = \ln{(1-x)} - x$$
    $$D(x) = \frac{e^{-x}}{1-x} = \sum_{n=0}^{\infty} d_n \frac{x^n}{n!}$$
To get $d_n$ we need coefficient of $\frac{x^n}{n!}$ in LHS.
$$e^{-x} \frac{1}{1-x} = (\sum_{n=0}^{\infty} (-1)^n \frac{x^n}{n!})(\sum_{n=0}^{\infty} n! \frac{x^n}{n!})$$
Coefficient of $\frac{x^n}{n!}$ by multiplication property = $\sum_{k=0}^{n} {n \choose k} a_k b_{n-k}$
\begin{align*}
    d_n = \sum_{k=0}^{n} {n \choose k} (-1)^{n-k} k!
    = \sum_{k=0}^{n} (-1)^{n-k} k! {n \choose k}
\end{align*}
$d_n$ is count of derangements of $n$ objects.

\subsection{Bell Numbers}
Let $S_{n,k}$ represent number of ways of partitioning \{$1, 2 ,3 \dots n $\} into $k$ non empty blocks and $B_n$ represent number of ways of partitioning \{$1, 2 ,3 \dots n $\} ($B_0 = 1$). By definitions,
$$B_n = \sum_{k=0}^n S_{n,k}$$
Equivalent intrepretation :  Consider a number whose prime factorization is square free i.e., $k \in \N$ such that $k = p_1p_2 \dots p_n$ where $\{p_1, p_2, \dots p_n\}$ are distinct primes. Number of ways of writing $k$ as product of natural numbers $\geq 2 = $ number of ways of partitioning  $\{p_1, p_2, \dots p_n\}$  $= B_n$. \\
Recurrence Relation :
 $$ B_n = \sum_{k=0}^{n-1} {{n-1} \choose k} B_k $$
% LHS : Number ways of partitioning  \{$1, 2 ,3 \dots n $\}. \\
% RHS : \begin{parts}
% \item If $1$ occurs in singleton set. No.of such partitions  = $B_{n-1}$
% \item If $1$ occurs in set with two elements. No.of ways element can be chosen $ = n-1$.No.of such partitions  = ${{n-1} \choose 1}B_{n-2}$.
% \item $1$ occurs in set with $k+1$ elements. No.of ways elements in this set can be chosen $ = {n-1 \choose k}$. No.of such partitions  = ${{n-1} \choose k}B_{n-(k+1)}$.
% \end{parts}
% Hence total $= \sum_{k=0}^{n-1} {{n-1} \choose k} B_{n-k-1}  = \sum_{k=0}^{n-1} {{n-1} \choose n-k-1} B_{n-k-1} = \sum_{n-k-1=0}^{n-1} {{n-1} \choose k} B_{k} = \sum_{k=0}^{n-1} {{n-1} \choose k} B_{k} $ \\
 Let's derive closed form expression for $B_n$ :
 \begin{align*}
     B(x) &= \sum_{n=0}^{\infty} B_n \frac{x^n}{n!} \\
     B'(x) &= \sum_{n=0}^{\infty} B_{n+1} \frac{x^n}{n!} ~(by ~ shifting ~rule) \\
     &= \sum_{n=0}^{\infty} (\sum_{k=0}^{n} {n \choose k} B_k) \frac{x^n}{n!} \\
     &= \sum_{n=0}^{\infty} (\sum_{k=0}^{n} {n \choose k}. ~1 B_k) \frac{x^n}{n!} \\
     &= (\sum_{n=0}^{\infty} B_n \frac{x^n}{n!})(\sum_{n=0}^{\infty} 1 \frac{x^n}{n!}) ~(by ~ multiplication ~rule) \\
     B'(x) &= B(x) . e^x \\
     \frac{B'(x)}{B(x)} &= e^x
 \end{align*}
 Integrating on both sides
 $$\ln{B(x)} = e^x + c$$
 Since $B(0) = B_0 = 1 \implies c = -1$. Hence,
 %$$ B(x) = e^{e^x - 1} = \frac{e^{e^x}}{e}$$
 \begin{align*}
     B(x) &= e^{e^x - 1} \\
     &= \frac{e^{e^x}}{e} \\
     &= \frac{1}{e} (\sum_{k=0}^{\infty} \frac{(e^x)^k}{k!}) \\
     &= \frac{1}{e} (\sum_{k=0}^{\infty} \frac{e^{kx}}{k!}) \\
     &= \frac{1}{e} (~\sum_{k=0}^{\infty} \frac{1}{k!}~ (\sum_{n=0}^{\infty} \frac{(kx)^n}{n!})~) \\
     &= \frac{1}{e} (~\sum_{n=0}^{\infty} \frac{x^n}{n!}~ (\sum_{k=0}^{\infty} \frac{k^n}{k!})~)\\
B(x)&= \sum_{n=0}^{\infty} \frac{1}{e} (\sum_{k=0}^{\infty} \frac{k^n}{k!}) \frac{x^n}{n!} \\
    B_n &= \frac{1}{e} (\sum_{k=0}^{\infty} \frac{k^n}{k!})
 \end{align*}
 We've derived closed form expression for bell number. Above expression for $B_n$ is also called as Dobinski's formula.

\end{enumerate}


\chapter{Classic ciphers}
\label{chapter:classic}

Modern cryptography has come a long way. In his excellent book on
cryptography, Singh traces it back to at least 5th century B.C., to
the times of Herodotus and the ancient Greeks~\cite{Singh:1999:CBE}.
That's some 2500 years ago, and surely we do not use those methods
anymore in modern day cryptography. However, the basic techniques are
still relevant for appreciating the art of secret writing.

Shift ciphers\indShiftcipher construct the \glosCiphertext
ciphertext\indCiphertext from the \glosPlaintext
plaintext\indPlaintext\ by means of a predefined {\em shifting}
operation,\glosCipherkey where the cipherkey of a particular shift
algorithm defines the shift amount of the cipher.\indCipherkey
Transposition ciphers work by keeping the plaintext the same, but {\em
  rearrange} the order of the characters according to a certain rule.
The cipherkey is essentially the description of how this transposition
is done.\indTranspositioncipher Substitution
ciphers\indSubstitutioncipher generalize shifts and transpositions,
allowing one to substitute arbitrary codes for plaintext elements.  In
this chapter, we will study several examples of these techniques and
see how we can code them in Cryptol.

In general, ciphers boil down to pairs of functions \emph{encrypt} and
\emph{decrypt} which ``fit together'' in the appropriate way.  Arguing
that a cryptographic function is \emph{correct} is subtle.

Correctness of cryptography is determined by cryptanalyses by expert
cryptographers.  Each kind of cryptographic primitive (i.e., a hash, a
symmetric cipher, an asymmetric cipher, etc.) has a set of expected
properties, many of which can only be discovered and proven by hand
through a lot of hard work.  Thus, to check the correctness of a
cryptographic function, a best practice for Cryptol use is to encode
as many of these properties as one can in Cryptol itself and use
Cryptol's validation and verification capabilities, discussed
later in~\autoref{cha:high-assur-progr}.  For example, the fundamental
property of most ciphers is that encryption and decryption are
inverses of each other.

To check the correctness of an \emph{implementation} $I$ of a
cryptographic function $C$ means that one must show that the
implementation $I$ behaves as the specification ($C$) stipulates.  In
the context of cryptography, the minimal conformance necesssary is
that $I$'s output \emph{exactly} conforms to the output characterized
by $C$.  But just because a cryptographic implementation is
\emph{functionally correct} does not mean it is \emph{secure}.  The
subtleties of an implementation can leak all kinds of information that
harm the security of the cryptography, including abstraction leaking
of sensitive values, timing attacks, side-channel attacks, etc.  These
kinds of properties cannot currently be expressed or reasoned about in
Cryptol.

Also, Cryptol does \emph{not} give the user any feedback on the
\emph{strength} of a given (cryptographic) algorithm.  While this is
an interesting and useful feature, it is not part of Cryptol's current
capabilities.

%=====================================================================
\section{Caesar's cipher}
\label{sec:caesar}
\sectionWithAnswers{Caesar's cipher}{sec:caesar}

Caesar's cipher (a.k.a. Caesar's shift) is one of the simplest
ciphers.  The letters in the plaintext\indPlaintext are shifted by a
fixed number of elements down the alphabet.\indCaesarscipher For
instance, if the shift is 2, {\tt A} becomes {\tt C}, {\tt B} becomes
{\tt D}, and so on. Once we run out of letters, we circle back to {\tt
  A}; so {\tt Y} becomes {\tt A}, and {\tt Z} becomes {\tt B}.  Coding
Caesar's cipher in Cryptol is quite straightforward (recall from
Section~\ref{sec:tsyn} that a {\tt String n} is simply a sequence of n
8-bit words.):\indTSString
\begin{code}
  caesar : {n} ([8], String n) -> String n
  caesar (s, msg) = [ shift x | x <- msg ]
        where map     = ['A' .. 'Z'] <<< s
              shift c = map @ (c - 'A')
\end{code}
In this definition, we simply get a message {\tt msg} of type {\tt
  String n}, and perform a {\tt shift} operation on each one of the
elements.  The {\tt shift} function is defined locally in the {\tt
  where}-clause.\indWhere To compute the shift, we first find the
distance of the letter from the character {\tt 'A'} (via {\tt c -
  'A'}), and look it up in the mapping imposed by the shift. The {\tt
  map} is simply the alphabet rotated to the left by the shift amount,
{\tt s}. Note how we use the enumeration {\tt ['A' .. 'Z']} to get all
the letters in the alphabet.\indEnum

\begin{Exercise}\label{ex:caesar:0}
  What is the map corresponding to a shift of 2? Use Cryptol's
  \verb+<<<+\indRotLeft to compute it.  You can use the command {\tt
    :set ascii=on}\indSettingASCII to print strings in ASCII, like
  this:
\begin{Verbatim}
  Cryptol> :set ascii=on
  Cryptol> "Hello World"
  "Hello World"
\end{Verbatim}
Why do we use a left-rotate, instead of a right-rotate?
\end{Exercise}
\begin{Answer}\ansref{ex:caesar:0}
Here is the alphabet and the corresponding shift-2 Caesar's alphabet:
\begin{verbatim}
  Cryptol> ['A'..'Z']
  "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  Cryptol> ['A'..'Z'] <<< 2
  "CDEFGHIJKLMNOPQRSTUVWXYZAB"
\end{verbatim}
We use a left rotate to get the characters lined up correctly, as
illustrated above.  \indRotLeft\indRotRight
\end{Answer}

\begin{Exercise}\label{ex:caesar:1}
  Use the above definition to encrypt the message {\tt "ATTACKATDAWN"}
  by shifts 0, 3, 12, and 52. What happens when the shift is a
  multiple of 26? Why?
\end{Exercise}
\begin{Answer}\ansref{ex:caesar:1}
Here are Cryptol's responses:
\begin{Verbatim}
  Cryptol> caesar (0, "ATTACKATDAWN")
  "ATTACKATDAWN"
  Cryptol> caesar (3, "ATTACKATDAWN")
  "DWWDFNDWGDZQ"
  Cryptol> caesar (12, "ATTACKATDAWN")
  "MFFMOWMFPMIZ"
  Cryptol> caesar (52, "ATTACKATDAWN")
  "ATTACKATDAWN"
\end{Verbatim}
If the shift is a multiple of 26 (as in 0 and 52 above), the letters
will cycle back to their original values, so encryption will leave the
message unchanged. Users of the Caesar's cipher should be careful
about picking the shift amount!
\end{Answer}

\begin{Exercise}\label{ex:caesar:2}
  Write a function {\tt dCaesar} which will decrypt a ciphertext
  constructed by a Caesar's cipher. It should have the same signature
  as {\tt caesar}.  Try it on the examples from the previous exercise.
\end{Exercise}
\begin{Answer}\ansref{ex:caesar:2}
  The code is almost identical, except we need to use a right
  rotate:\indRotRight

\begin{code}
  dCaesar : {n} ([8], String n) -> String n
  dCaesar (s, msg) = [ shift x | x <- msg ]
        where map     = ['A' .. 'Z'] >>> s
              shift c = map @ (c - 'A')
\end{code}
%  dCaesar : {n} ([8], String n) -> String n
%  dCaesar (s, msg) = [ shift x | x <- msg ]
%    where  map     = ['A' .. 'Z']  >>> s
%           shift c = map @ (c - 'A')
We have:
\begin{Verbatim}
  Cryptol> caesar (12, "ATTACKATDAWN")
  "MFFMOWMFPMIZ"
  Cryptol> dCaesar (12, "MFFMOWMFPMIZ")
  "ATTACKATDAWN"
\end{Verbatim}
\end{Answer}

\begin{Exercise}\label{ex:caesar:3}
  Observe that the shift amount in a Caesar cipher is very limited:
  Any shift of {\tt d} is equivalent to a shift by {\tt d \% 26}. (For
  instance shifting by 12 and 38 is the same thing, due to wrap around
  at 26.) Based on this observation, how strong do you think the
  Caesar's cipher is? Describe a simple attack that will recover the
  plaintext and automate it using Cryptol.  Use your function to crack
  the ciphertext {\tt JHLZHYJPWOLYPZDLHR}.
\end{Exercise}
\begin{Answer}\ansref{ex:caesar:3}
  For the Caesar's cipher, the only good shifts are $1$ through $25$,
  since shifting by $0$ would return the plaintext unchanged, and any
  shift amount {\tt d} that is larger than $26$ and over is essentially
  the same as shifting by {\tt d \% 26} due to wrap around. Therefore,
  all it takes to break the Caesar cipher is to try the sizes $1$
  through $25$, and see if we have a valid message. We can automate this
  in Cryptol by returning all possible plaintexts using these shift
  amounts:
\begin{code}
  attackCaesar : {n} (String n) -> [25](String n)
  attackCaesar msg = [ dCaesar(i, msg) | i <- [1 .. 25] ]
\end{code}
If we apply this function to {\tt JHLZHYJPWOLYPZDLHR}, we get:
\begin{Verbatim}
  Cryptol> :set ascii=on
  Cryptol> attackCaesar "JHLZHYJPWOLYPZDLHR",
  ["IGKYGXIOVNKXOYCKGQ", "HFJXFWHNUMJWNXBJFP", "GEIWEVGMTLIVMWAIEO"
   "FDHVDUFLSKHULVZHDN", "ECGUCTEKRJGTKUYGCM", "DBFTBSDJQIFSJTXFBL"
   "CAESARCIPHERISWEAK", "BZDRZQBHOGDQHRVDZJ", "AYCQYPAGNFCPGQUCYI"
   "ZXBPXOZFMEBOFPTBXH", "YWAOWNYELDANEOSAWG", "XVZNVMXDKCZMDNRZVF"
   "WUYMULWCJBYLCMQYUE", "VTXLTKVBIAXKBLPXTD", "USWKSJUAHZWJAKOWSC"
   "TRVJRITZGYVIZJNVRB", "SQUIQHSYFXUHYIMUQA", "RPTHPGRXEWTGXHLTPZ"
   "QOSGOFQWDVSFWGKSOY", "PNRFNEPVCUREVFJRNX", "OMQEMDOUBTQDUEIQMW"
   "NLPDLCNTASPCTDHPLV", "MKOCKBMSZROBSCGOKU", "LJNBJALRYQNARBFNJT"
   "KIMAIZKQXPMZQAEMIS"]
\end{Verbatim}
If you skim through the potential ciphertexts, you will see that the
$7^{th}$ entry is probably the one we are looking for. Hence the key
must be $7$.  Indeed, the message is {\tt CAESARCIPHERISWEAK}.
\end{Answer}

\begin{Exercise}\label{ex:caesar:4}
  One classic trick to strengthen ciphers is to use multiple keys. By
  repeatedly encrypting the plaintext multiple times we can hope that
  it will be more resistant to attacks. Do you think this scheme might
  make the Caesar cipher stronger?
\end{Exercise}
\begin{Answer}\ansref{ex:caesar:4}
  No. Using two shifts $d_1$ and $d_2$ is essentially the same as
  using just one shift with the amount $d_1 + d_2$. Our attack
  function would work just fine on this schema as well. In fact, we
  wouldn't even have to know how many rounds of encryption was
  applied. Multiple rounds is just as weak as a single round when it
  comes to breaking the Caesar's cipher.  \end{Answer}

\begin{Exercise}\label{ex:caesar:5}
  What happens if you pass {\tt caesar} a plaintext that has
  non-uppercase letters in it? (Let's say a digit.) How can you fix
  this deficiency?
\end{Exercise}
\begin{Answer}\ansref{ex:caesar:5}
In this case we will fail to find a mapping:
\begin{Verbatim}
  Cryptol> caesar (3, "12")
  ... index of 240 is out of bounds
  (valid range is 0 thru 25).
\end{Verbatim}
What happened here is that Cryptol computed the offset {\tt '1' - 'A'}
to obtain the $8$-bit index $240$ (remember, modular arithmetic!), but
our alphabet only has $26$ entries, causing the out-of-bounds error.
\todo[inline]{Say something about how to guarantee that such errors
  are impossible. (Use of preconditions, checking and proving safety,
  etc.)}  We can simply remedy this problem by allowing our alphabet
to contain all $8$-bit numbers:\indRotLeft
\begin{code}
  caesar' : {n} ([8], String n) -> String n
  caesar' (s, msg) = [ shift x | x <- msg ]
    where map     = [0 .. 255] <<< s
          shift c = map @ c
\end{code}
Note that we no longer have to subtract {\tt 'A'}, since we are
allowing a much wider range for our plaintext and ciphertext. (Another
way to put this is that we are subtracting the value of the first
element in the alphabet, which happens to be 0 in this case!
Consequently, the number of ``good'' shifts increase from $25$ to
$255$.)  The change in {\tt dCaesar'} is analogous:\indRotRight
\begin{code}
  dCaesar' : {n} ([8], String n) -> String n
  dCaesar' (s, msg) = [ shift x | x <- msg ]
    where  map     = [0 .. 255] >>> s
           shift c = map @ c
\end{code}
\end{Answer}

%=====================================================================
\section{\texorpdfstring{Vigen\`{e}re}{Vigenere} cipher}
\label{sec:vigenere}
\sectionWithAnswers{\texorpdfstring{Vigen\`{e}re}{Vigenere} cipher}{sec:vigenere}

The Vigen\`{e}re cipher is a variation on the Caesar's cipher, where
one uses multiple shift amounts according to a
keyword~\cite{wiki:vigenere}.\indVigenere Despite its simplicity, it
earned the notorious description {\em le chiffre ind\`{e}chiffrable}
(``the indecipherable cipher'' in French), as it was unbroken for a
long period of time. It was very popular in the 16th century and
onwards, only becoming routinely breakable by mid-19th century or so.

To illustrate the operation of the Vigen\`{e}re cipher, let us
consider the plaintext {\tt ATTACKATDAWN}. The cryptographer picks a
key, let's say {\tt CRYPTOL}. We line up the plaintext and the key,
repeating the key as much as as necessary, as in the top two lines of
the following:
\begin{tabbing}
\hspace*{2cm} \= Ciphertext: \hspace*{.5cm} \= {\tt CKRPVYLVUYLG} \kill
\> Plaintext : \> {\tt ATTACKATDAWN} \\
\> Cipherkey : \> {\tt CRYPTOLCRYPT} \\
\> Ciphertext: \> {\tt CKRPVYLVUYLG}
\end{tabbing}
We then proceed pair by pair, shifting the plaintext character by the
distance implied by the corresponding key character.  The first pair
is {\tt A}-{\tt C}.  Since {\tt C} is two positions away from {\tt A}
in the alphabet, we shift {\tt A} by two positions, again obtaining
{\tt C}.  The second pair {\tt T}-{\tt R} proceeds similarly: Since
{\tt R} is 17 positions away from {\tt A}, we shift {\tt T} down 17
positions, wrapping around {\tt Z}, obtaining {\tt K}.  Proceeding in
this fashion, we get the ciphertext {\tt CKRPVYLVUYLG}. Note how each
step of the process is a simple application of the Caesar's
cipher.\indCaesarscipher

\begin{Exercise}\label{ex:vigenere:0}
  One component of the Vigen\`{e}re cipher is the construction of the
  repeated key.  Write a function {\tt cycle} with the following
  signature:
\begin{code}
  cycle : {n, a} (fin n, n >= 1) => [n]a -> [inf]a
\end{code}
such that it returns the input sequence appended to itself repeatedly,
turning it into an infinite sequence. Why do we need the predicate
{\tt n >= 1}?\indPredicates
\end{Exercise}
\begin{Answer}\ansref{ex:vigenere:0}
Here is one way to define {\tt cycle}, using a recursive definition:
\begin{code}
  cycle xs = xss
        where xss = xs # xss
\end{code}
We have:
\begin{Verbatim}
  Cryptol> cycle [1 .. 3]
  [1, 2, 3, 1, 2, ...]
\end{Verbatim}
If we do not have the {\tt n >= 1} predicate, then we can pass {\tt
  cycle} the empty sequence, which would cause an infinite loop
emitting nothing.  The predicate {\tt n >= 1} makes sure the input is
non-empty, guaranteeing that {\tt cycle} can produce the infinite
sequence.
\end{Answer}

\begin{Exercise}\label{ex:vigenere:1}
  Program the Vigen\`{e}re cipher in Cryptol. It should have the
  signature:
\begin{code}
  vigenere : {n, m} (fin n, n >= 1) => (String n, String m) -> String m
\end{code}
where the first argument is the key and the second is the
plaintext. Note how the signature ensures that the input string and
the output string will have precisely the same number of characters,
{\tt m}. \lhint{Use Caesar's cipher repeatedly.}
\end{Exercise}
\begin{Answer}\ansref{ex:vigenere:1}
\begin{code}
  vigenere (key, pt) = join [ caesar (k - 'A', [c])
                              | c <- pt
                              | k <- cycle key
                            ]
\end{code}
Note the shift is determined by the distance from the letter {\tt 'A'}
for each character. Here is the cipher in action:
\begin{Verbatim}
  Cryptol> vigenere ("CRYPTOL", "ATTACKATDAWN")
  "CKRPVYLVUYLG"
\end{Verbatim}
\end{Answer}

\begin{Exercise}\label{ex:vigenere:2}
  Write the decryption routine for Vigen\`{e}re. Then decode \\
  {\tt "XZETGSCGTYCMGEQGAGRDEQC"} with the key {\tt "CRYPTOL"}.
\end{Exercise}
\begin{Answer}\ansref{ex:vigenere:2}
Following the lead of the encryption, we can rely on {\tt dCaesar}:
\begin{code}
  dVigenere : {n, m} (fin n, n >= 1) =>
              (String n, String m) -> String m
  dVigenere (key, pt) = join [ dCaesar (k - 'A', [c])
                               | c <- pt
                               | k <- cycle key
                             ]
\end{code}
The secret code is:
\begin{Verbatim}
  Cryptol> dVigenere ("CRYPTOL", "XZETGSCGTYCMGEQGAGRDEQC")
  "VIGENERECANTSTOPCRYPTOL"
\end{Verbatim}
\end{Answer}

\begin{Exercise}\label{ex:vigenere:3}
  A known-plaintext attack\indKnownPTAttack is one where an attacker
  obtains a plaintext-ciphertext pair, without the key. If the
  attacker can figure out the key based on this pair then he can break
  all subsequent communication until the key is replaced. Describe how
  one can break the Vigen\`{e}re cipher if a plaintext-ciphertext pair
  is known.
\end{Exercise}
\begin{Answer}\ansref{ex:vigenere:3}
  All it takes is to decrypt using using the plaintext as the key and
  message as the cipherkey. Here is this process in action. Recall
  from the previous exercise that encrypting {\tt ATTACKATDAWN} by the
  key {\tt CRYPTOL} yields {\tt CKRPVYLVUYLG}. Now, if an attacker
  knows that {\tt ATTACKATDAWN} and {\tt CKRPVYLVUYLG} form a pair,
  he/she can find the key simply by:\indVigenere
\begin{Verbatim}
  Cryptol> dVigenere ("ATTACKATDAWN", "CKRPVYLVUYLG")
  "CRYPTOLCRYPT"
\end{Verbatim}
Note that this process will not always tell us what the key is
precisely.  It will only be the key repeated for the given message
size. For sufficiently large messages, or when the key does not repeat
any characters, however, it would be really easy for an attacker to
glean the actual key from this information.

This trick works since the act of using the plaintext as the key and
the ciphertext as the message essentially reverses the shifting
process, revealing the shift amounts for each pair of characters.  The
same attack would essentially work for the Caesar's cipher as well,
where we would only need one character to crack it.\indCaesarscipher
\end{Answer}

%%%% Way too complicated for the intro.. skipping for now
%% \section{Rail fence cipher}
%% \lable{sec:railfence}
%% \sectionWithAnswers{Rail fence cipher}{sec:railfence}\indRailFence
%% The $k$-rail fence cipher is a simple example of a transposition
%% cipher\indTranspositioncipher, where the text is written along {\em
%% k}-lines in a zig-zag fashion. For instance, to encrypt {\tt
%% ATTACKATDAWN} using a 3-rail fence, we construct the following
%% text:
%% \begin{Verbatim}
%%  A . . . C . . . D . . .
%% . T . A . K . T . A . N
%% . . T . . . A . . . W .
%% \end{Verbatim}
%% going down and up the 3 fences in a zigzag fashion. We then read
%% the ciphertext\indCiphertext line by line to obtain:
%% \begin{Verbatim}
%%   ACDTAKTANTAW
%% \end{Verbatim}
%%
%% \begin{Exercise}\label{ex:railfence:0}
%%   Program the 3-rail fence cipher in Cryptol. You should write the
%%   functions:
%% \begin{code}
%%   rail3Fence, dRail3Fence : {a} (fin a) => String((4*a))  -> String ((4*a));
%% \end{code}
%% that implements the 3-rails encryption/decryption. Using your
%% functions, encrypt and decrypt the message {\tt
%% RAILFENCECIPHERISTRICKIERTHANITLOOKS}.
%% \end{Exercise}
%% \begin{Answer}\ansref{ex:railfence:0}
%% \begin{code}
%%   rail3Fence pt = heads # mids # tails
%%   where {
%%      regions = groupBy (4, pt);
%%      heads   =      [| r @ 0             || r <- regions |];
%%      mids    = join [| [(r @ 1) (r @ 3)] || r <- regions |];
%%      tails   =      [| r @ 2             || r <- regions |];
%%   };
%% \end{code}
%% \end{Answer}

%=====================================================================
\section{The atbash}
\label{sec:atbash}
\sectionWithAnswers{The atbash}{sec:atbash}

The atbash cipher is a form of a shift cipher, where each letter is
replaced by the letter that occupies its mirror image position in the
alphabet.\indAtbash That is, {\tt A} is replaced by {\tt Z}, {\tt B}
by {\tt Y}, etc. Needless to say the atbash is hardly worthy of
cryptographic attention, as it is trivial to break.

\begin{Exercise}\label{ex:atbash:0}
  Program the atbash in Cryptol. What is the code for {\tt
    ATTACKATDAWN}?
\end{Exercise}
\begin{Answer}\ansref{ex:atbash:0}
  Using the reverse index operator, coding atbash is
  trivial:\indRIndex\indAtbash
\begin{code}
  atbash : {n} String n -> String n
  atbash pt = [ alph ! (c - 'A') | c <- pt ]
      where alph = ['A' .. 'Z']
\end{code}
We have:
\begin{Verbatim}
  Cryptol> atbash "ATTACKATDAWN"
  "ZGGZXPZGWZDM"
\end{Verbatim}
\end{Answer}

\begin{Exercise}\label{ex:atbash:1}
  Program the atbash decryption in Cryptol. Do you have to write any
  code at all? Break the code {\tt ZGYZHSRHHVOUWVXIBKGRMT}.
\end{Exercise}
\begin{Answer}\ansref{ex:atbash:1}
  Notice that decryption for atbash\indAtbash is precisely the same as
  encryption, the process is entirely the same. So, we do not have to
  write any code at all, we can simply define:
\begin{code}
  dAtbash : {n} String n -> String n
  dAtbash = atbash
\end{code}
We have:
\begin{Verbatim}
  Cryptol> dAtbash "ZGYZHSRHHVOUWVXIBKGRMT"
  "ATBASHISSELFDECRYPTING"
\end{Verbatim}
\end{Answer}

%=====================================================================
\section{Substitution ciphers}
\label{section:subst}
\sectionWithAnswers{Substitution ciphers}{section:subst}

Substitution ciphers\indSubstitutioncipher generalize all the ciphers
we have seen so far, by allowing arbitrary substitutions to be made
for individual ``components'' of the
plaintext~\cite{wiki:substitution}.  Note that these components need
not be individual characters, but rather can be pairs or even triples
of characters that appear consecutively in the text. (The
multi-character approach is termed {\em
  polygraphic}.)\indPolyGraphSubst Furthermore, there are variants
utilizing multiple {\em polyalphabetic} mappings,\indPolyAlphSubst as
opposed to a single {\em monoalphabetic} mapping\indMonoAlphSubst.  We
will focus on monoalphabetic simple substitutions, although the other
variants are not fundamentally more difficult to implement.

\tip{For the exercises in this section we will use a running key
  repeatedly. To simplify your interaction with Cryptol, put the
  following definition in your program file:}
\begin{code}
  substKey : String 26
  substKey = "FJHWOTYRXMKBPIAZEVNULSGDCQ"
\end{code}
The intention is that {\tt substKey} maps {\tt A} to {\tt F}, {\tt B}
to {\tt J}, {\tt C} to {\tt H}, and so on.

\begin{Exercise}\label{ex:subst:0}
  Implement substitution ciphers in Cryptol. Your function should have
  the signature:
\begin{code}
  subst : {n} (String 26, String n) -> String n
\end{code}
where the first element is the key (like {\tt substKey}).
What is the code for \\
{\tt "SUBSTITUTIONSSAVETHEDAY"} for the key {\tt substKey}?
\end{Exercise}
\begin{Answer}\ansref{ex:subst:0}
\begin{code}
  subst (key, pt) = [ key @ (p - 'A') | p <- pt ]
\end{code}
We have:
\begin{Verbatim}
  Cryptol> subst(substKey, "SUBSTITUTIONSSAVETHEDAY")
  "NLJNUXULUXAINNFSOUROWFC"
\end{Verbatim}
\end{Answer}

\paragraph*{Decryption} Programming decryption is more subtle.  We can
no longer use the simple selection operation ({\tt @})\indIndex on the
key. Instead, we have to search for the character that maps to the
given ciphertext character.

\begin{Exercise}\label{ex:subst:1}
Write a function {\tt invSubst} with the following signature:
%%   type Char = [8] // now in prelude.cry
\begin{code}
  invSubst : (String 26, Char) -> Char
\end{code}
such that it returns the mapped plaintext character. For instance,
with {\tt substKey}, {\tt F} should get you {\tt A}, since the key
maps {\tt A} to {\tt F}:
\begin{Verbatim}
  Cryptol> invSubst (substKey, 'F')
  A
\end{Verbatim}
And similarly for other examples:
\begin{Verbatim}
  Cryptol> invSubst (substKey, 'J')
  B
  Cryptol> invSubst (substKey, 'C')
  Y
  Cryptol> invSubst (substKey, 'Q')
  Z
\end{Verbatim}
One question is what happens if you search for a non-existing
character.  In this case you can just return {\tt 0}, a non-valid
ASCII character, which can be interpreted as {\em not found}.
\hint{Use a fold (see Pg.~\pageref{par:fold}).}\indFold
\end{Exercise}
\begin{Answer}\ansref{ex:subst:1}
\begin{code}
  invSubst (key, c) = candidates ! 0
    where candidates = [0] # [ if c == k then a else p
                             | k <- key
                             | a <- ['A' .. 'Z']
                             | p <- candidates
                             ]
\end{code}
The comprehension\indComp defining {\tt candidates} uses a fold (see
page~\pageref{par:fold}).\indFold The first branch ({\tt k <- key})
walks through all the key elements, the second branch walks through
the ordinary alphabet ({\tt a <- ['A' .. 'Z']}), and the final branch
walks through the candidate match so far. At the end of the fold, we
simply return the final element of {\tt candidates}. Note that we
start with {\tt 0} as the first element, so that if no match is found
we get a {\tt 0} back.
\end{Answer}

\begin{Exercise}\label{ex:subst:2}
  Using {\tt invSubst}, write the decryption function {\tt dSubst}.
  It should have the exact same signature as {\tt subst}.  Decrypt
  {\tt FUUFHKFUWFGI}, using our running key.
\end{Exercise}
\begin{Answer}\ansref{ex:subst:2}
\begin{code}
  dSubst: {n} (String 26, String n) -> String n
  dSubst (key, ct) = [ invSubst (key, c) | c <- ct ]
\end{code}
We have:
\begin{Verbatim}
  Cryptol> dSubst (substKey, "FUUFHKFUWFGI")
  "ATTACKATDAWN"
\end{Verbatim}
\end{Answer}

\todo[inline]{This exercise and the true type of \texttt{invSubst}
  indicate that specs are needed.  In other words, we cannot capture
  \texttt{invSubst}'s tightest type, which would encode the invariant
  about contents being capital letters, and that lack of
  expressiveness leaks to \texttt{dSubst}.  We really need to either
  enrich the dependent types or add some kind of support for
  contracts.  The reason this works most of the time is that crypto
  algorithms work on arbitrary bytes.}

\begin{Exercise}\label{ex:subst:3}
  Try the substitution cipher with the key {\tt
    AAAABBBBCCCCDDDDEEEEFFFFGG}. Does it still work?  What is special
  about {\tt substKey}?
\end{Exercise}
\begin{Answer}\ansref{ex:subst:3}
No, with this key we cannot decrypt properly:
\begin{Verbatim}
  Cryptol> subst ("AAAABBBBCCCCDDDDEEEEFFFFGG", "HELLOWORLD")
  "BBCCDFDECA"
  Cryptol> dSubst ("AAAABBBBCCCCDDDDEEEEFFFFGG", "BBCCDFDECA")
  "HHLLPXPTLD"
\end{Verbatim}
This is because the given key maps multiple plaintext letters to the
same ciphertext letter. (For instance, it maps all of {\tt A}, {\tt
  B}, {\tt C}, and {\tt D} to the letter {\tt A}.) For substitution
ciphers to work the key should not repeat the elements, providing a
1-to-1 mapping. This property clearly holds for {\tt substKey}. Note
that there is no shortage of keys, since for 26 letters we have 26!
possible ways to choose keys, which gives us over 4-billion different
choices.
\end{Answer}

%=====================================================================
\section{The scytale}
\label{sec:scytale}
\sectionWithAnswers{The scytale}{sec:scytale}

The scytale is one of the oldest cryptographic devices ever, dating
back to at least the first century
A.D.~\cite{wiki:scytale}.\indScytale Ancient Greeks used a leather
strip on which they would write their plaintext\indPlaintext message.
The strip would be wrapped around a rod of a certain diameter. Once
the strip is completely wound, they would read the text row-by-row,
essentially transposing the letters and constructing the
ciphertext\indCiphertext. Since the ciphertext is formed by a
rearrangement of the plaintext, the scytale is an example of a
transposition cipher.\indTranspositioncipher To decrypt, the
ciphertext needs to be wrapped around a rod of the same diameter,
reversing the process. The cipherkey\indCipherkey is essentially the
diameter of the rod used. Needless to say, the scytale does not
provide a very strong encryption mechanism.

Abstracting away from the actual rod and the leather strip, encryption
is essentially writing the message column-by-column in a matrix and
reading it row-by-row.  Let us illustrate with the message {\tt
  ATTACKATDAWN}, where we can fit 4 characters per column:
\begin{verbatim}
    ACD
    TKA
    TAW
    ATN
\end{verbatim}
To encrypt, we read the message row-by-row, obtaining {\tt
  ACDTKATAWATN}. If the message does not fit properly (i.e., if it has
empty spaces in the last column), it can be padded by {\tt Z}'s or
some other agreed upon character. To decrypt, we essentially reverse
the process, by writing the ciphertext row-by-row and reading it
column-by-column.

Notice how the scytale's operation is essentially matrix
transposition.  Therefore, implementing the scytale in Cryptol is
merely an application of the {\tt transpose} function.\indTranspose
All we need to do is group the message by the correct number of
elements using {\tt split}.\indSplit Below, we define the {\tt
  diameter} to be the number of columns we have. The type synonym {\tt
  Message} ensures we only deal with strings that properly fit the
``rod,'' by using {\tt r} number of rows:\indJoin

\begin{code}
  scytale : {row, diameter} (fin row, fin diameter)
            => String (row * diameter) -> String (diameter * row)
  scytale msg = join (transpose msg')
       where   msg' : [diameter][row][8]
               msg' = split msg
\end{code}
The signature\indSignature on {\tt msg'} is revealing: We are taking a
string that has {\tt diameter * row} characters in it, and chopping it
up so that it has {\tt row} elements, each of which is a string that
has {\tt diameter} characters in it.  Here is Cryptol in action,
encrypting the message {\tt ATTACKATDAWN}:
\begin{Verbatim}
  Cryptol> :set ascii=on
  Cryptol> scytale "ATTACKATDAWN"
  "ACDTKATAWATN"
\end{Verbatim}
Decryption is essentially the same process, except we have to {\tt
  split} so that we get {\tt diameter} elements
out:\indSplit\indJoin\indScytale
\begin{code}
  dScytale : {row, diameter} (fin row, fin diameter)
             => String (row * diameter) -> String (diameter * row)
  dScytale msg = join (transpose msg')
     where   msg' : [row][diameter][8]
             msg' = split msg
\end{code}
Again, the type on {\tt msg'} tells Cryptol that we now want {\tt
  diameter} strings, each of which is {\tt row} long.  It is important
to notice that the definitions of {\tt scytale} and {\tt dScytale} are
precisely the same, except for the signature on {\tt msg'}! When
viewed as a matrix, the types precisely tell which transposition we
want at each step.  We have:
\begin{Verbatim}
  Cryptol> dScytale "ACDTKATAWATN"
  "ATTACKATDAWN"
\end{Verbatim}

\begin{Exercise}\label{ex:scytale:0}
  What happens if you comment out the signature for {\tt msg'} in the
  definition of {\tt scytale}? Why?\indScytale
\end{Exercise}
\begin{Answer}\ansref{ex:scytale:0}
  If you do not provide a signature for {\tt msg'}, you will get the
  following type-error message from Cryptol:
\begin{small}
\begin{Verbatim}
  Failed to validate user-specified signature.
    In the definition of 'scytale', at classic.cry:40:1--40:8:
      for any type row, diameter
        fin row
        fin diameter
      =>
      fin ?b
        arising from use of expression split at classic.cry:42:17--42:22
      fin ?d
        arising from use of expression join at classic.cry:40:15--40:19
      row * diameter == ?a * ?b
        arising from matching types at classic.cry:1:1--1:1
\end{Verbatim}
\end{small}
Essentially, Cryptol is complaining that it was asked to do a {\tt
  split}\indSplit and it figured that the constraint
$\text{\emph{diameter}}*\text{\emph{row}}=a*b$ must hold, but that is
not sufficient to determine what {\tt a} and {\tt b} should really
be. (There could be multiple ways to assign {\tt a} and {\tt b} to
satisfy that requirement, for instance {\tt a=4}, {\tt b=row}; or {\tt
  a=2} and {\tt b=2*row}, resulting in differing behavior.)  This is
why it is unable to ``validate the user-specified signature''.  By
putting the explicit signature for {\tt msg'}, we are giving Cryptol
more information to resolve the ambiguity. Notice that since the code
for {\tt scytale} and {\tt dScytale} are precisely the same except for
the type on {\tt msg'}. This is a clear indication that the type
signature plays an essential role here.\indAmbiguity\indSignature
\end{Answer}

\begin{Exercise}\label{ex:scytale:1}
  How would you attack a scytale encryption, if you don't know what
  the diameter is?
\end{Exercise}
\begin{Answer}\ansref{ex:scytale:1}
  Even if we do not know the diameter, we do know that it is a divisor
  of the length of the message. For any given message size, we can
  compute the number of divisors of the size and try decryption until
  we find a meaningful plaintext.  Of course, the number of potential
  divisors will be large for large messages, but the practicality of
  scytale stems from the choice of relatively small diameters, hence
  the search would not take too long. (With large diameters, the
  ancient Greeks would have to carry around very thick rods, which
  would not be very practical in a battle scenario!)\indScytale
\end{Answer}

%%% Local Variables:
%%% mode: latex
%%% TeX-master: "../main/Cryptol"
%%% End: