% Copyright 2018 Google LLC
%
% Use of this source code is governed by an MIT-style
% license that can be found in the LICENSE file or at
% https://opensource.org/licenses/MIT.

%!TeX spellcheck = en-US

\documentclass[eprint.tex]{subfiles}
\begin{document}
\section{Security of HBSH}
Assuming the security of the underlying block and stream ciphers,
we show here that HBSH has an
advantage bound that grows quadratically with the number of queries.
\subsection{Definition of HBSH}\label{funcdef}
We provide here an
equivalent definition of HBSH in functional form.
Where a parameter is given as $L \Concat R$ we have that
$L \in \mathcal{L}$, $R \in \mathcal{R}$, $L \Concat R \in \mathcal{M}$.

\begin{align*}
    \xi :{}& \mathcal{K}_H \times \mathcal{T} \times \mathcal{M} \rightarrow \mathcal{R} \\
    \xi_{K_H}(T, L \Concat R) \defeq{}& R \boxplus H_{K_H}(T, L) \\
    %
    \allowdisplaybreaks[4] \vphantom{|} \\ \allowdisplaybreaks[0]
    %
    \phi :{}& \mathcal{K}_H \times \mathcal{T} \times \mathcal{M} \rightarrow \mathcal{M} \\
    \phi_{K_H, T}(L \Concat R) \defeq{}& L \Concat \xi_{K_H}(T, L \Concat R) \\
    ={}& L \Concat (R \boxplus H_{K_H}(T, L)) \\
    \phi^{-1}_{K_H, T}(L \Concat R) ={}& L \Concat (R \boxminus H_{K_H}(T, L)) \\
    %
    \allowdisplaybreaks[4] \vphantom{|} \\ \allowdisplaybreaks[0]
    %
    \theta :{}& \Perm(\mathcal{R}) \times (\mathcal{N} \rightarrow \bin^{l_S}) \times \mathcal{M} \rightarrow \mathcal{M} \\
    \theta_{\pi, F}(L \Concat R) \defeq{}& (L \oplus F(\pi(R))[0;\abs{L}]) \Concat \pi(R) \\
    \theta_{\pi, F}^{-1}(L \Concat R) ={}& (L \oplus F(R)[0;\abs{L}]) \Concat \pi^{-1}(R) \\
    %
    \allowdisplaybreaks[4] \vphantom{|} \\ \allowdisplaybreaks[0]
    %
    \eta :{}& \mathcal{K}_H \times \Perm(\mathcal{R}) \times (\mathcal{N} \rightarrow \bin^{l_S}) \times \mathcal{T} \times \mathcal{M} \rightarrow \mathcal{M} \\
    \eta_{K_H, \pi, F, T} \defeq{}& \phi_{K_H,T}^{-1} \circ \theta_{\pi, F} \circ \phi_{K_H,T} \\
    %
    \allowdisplaybreaks[4] \vphantom{|} \\ \allowdisplaybreaks[0]
    %
    \bar{\eta} :{}& (\mathcal{N} \rightarrow \bin^{l_S}) \times \mathcal{T} \times \mathcal{M} \rightarrow \mathcal{M} \\
    \bar{\eta}_{F} \defeq{}& \eta_{K_H, E_{K_E}, F} \quad \textrm{where} \ K_E \Concat K_H \Concat \ldots = F(\lambda) \\
    %
    \allowdisplaybreaks[4] \vphantom{|} \\ \allowdisplaybreaks[0]
    %
    \HBSH :{}& \mathcal{K}_S \times \mathcal{T} \times \mathcal{M} \rightarrow \mathcal{M} \\
    \HBSH_{K_S} \defeq{}& \bar{\eta}_{S_{K_S}} \\
\end{align*}

\subsection{Security definitions}
\parintro{Hash function}
The hash function $H$
must be $\epsilon$-almost-$\Delta$-universal\label{eadudef}
($\epsilon$-$\Delta$U)
for some $\epsilon$~\cite{eadu}:
for any $g \in \mathcal{R}$ and
any two distinct messages $(T, L) \neq (T', L')$:
%
\begin{displaymath}
\probsub{K \sample \mathcal{K}_H}{H_{K}(T, L) \boxminus H_{K}(T', L') = g} \leq \epsilon
\end{displaymath}
%
Given bounds on the lengths of $T$ and $L$, the value of $\epsilon$ for the
hash function used in HPolyC is given in \autoref{hpolycepsilon},
and for Adiantum in \autoref{adiantumepsilon}.

\parintro{Block cipher}
The block cipher
$E$
must be a super-pseudorandom permutation~\cite{concsym}:
%
\begin{align*}
    \advantage{\pm \mathrm{prp}}{E}[(A)] \defeq
    {}&\left\lvert\probsub{K \sample \mathcal{K}_E}{A^{E_K,E_K^{-1}}\Rightarrow 1}\right.
    \\
    {}&\left. - \probsub{\pi \sample \Perm(\mathcal{R})}{A^{\pi,\pi^{-1}}\Rightarrow 1}\right\rvert
    \\
    \advantage{\pm \mathrm{prp}}{E}[(q, t)] \defeq
    {}&\max_{A \in \mathcal{A}(q, t)} \advantage{\pm \mathrm{prp}}{E}[(A)]
\end{align*}
%
where $A$ is an adversary,
$\Perm(S)$ denotes the set of all permutations on a set $S$,
and
$\mathcal{A}(q, t)$
is the set of all adversaries that make at most $q$ queries and take at most $t$ time.

\parintro{Stream cipher}
Our definition is related to the definition of a PRF in \cite{concsym}, but
because we model the stream cipher $S$ as a pseudorandom function with a very long output,
we bound the adversary not only in how many queries they make,
but also in how many bits they read in total.
Thus, a query consists of a pair
$(N, l_q) \in \mathcal{N} \times \NN$ where $0 < l_q \leq l_S$,
and the response is $S_K(N)[0;l_q]$ or $F(N)[0;l_q]$;
we cap the sum of $l_q$ values across queries.
%
\begin{align*}
    \advantage{\mathrm{sc}}{S}[(A)] \defeq
    {}&\left\lvert \probsub{K \sample \mathcal{K}_S}{A^{S_{K}(.)[0;.]}\Rightarrow 1}\right.
    \\
    {}&\left. - \probsub{F \sample (\mathcal{N} \rightarrow \bin^{l_S})}
    {A^{F(.)[0;.]}\Rightarrow 1} \right\rvert
    \\
    \advantage{\mathrm{sc}}{S}[(q, l, t)]
    \defeq {}&\max_{A \in \mathcal{A}(q, l, t)} \advantage{\mathrm{sc}}{S}[(A)]
\end{align*}
%
where $A$ is an adversary,
$\mathcal{N} \rightarrow \bin^{l_S}$ denotes the set of all
functions from $\mathcal{N}$ to $\bin^{l_S}$,
and
$\mathcal{A}(q, l, t)$
is the set of all adversaries that make at most $q$ queries such that
$\sum l_q \leq l$, and which take at most $t$ time.

\parintro{Tweakable SPRP}
Let $\LP^\mathcal{T}(\mathcal{M})$ denote the set of all
tweakable length-preserving functions
$\bm{f} : \mathcal{T} \times \mathcal{M} \rightarrow \mathcal{M}$
such that for all $T, M \in \mathcal{T} \times \mathcal{M}$,
$\abs{\bm{f}(T, M)} = \abs{M}$. Let $\Perm^\mathcal{T}(\mathcal{M})$ denote
the set of $\bm{\pi} \in \LP^\mathcal{T}(\mathcal{M})$ such that
for all $T \in \mathcal{T}$, $\bm{\pi}_{T}$ is a bijection.
In an abuse of notation
we use $\bm{\pi}^{-1}$ to refer to the function
such that $\bm{\pi}^{-1}(T, \bm{\pi}(T, M)) = M$ ie $(\bm{\pi}^{-1})_T = (\bm{\pi}_T)^{-1}$.

Per~\cite{cmc}, for a tweakable, variable-input-length, super-pseudorandom permutation
$\bm{E} : \mathcal{K} \times \mathcal{T} \times \mathcal{M} \rightarrow \mathcal{M}$
the distinguishing advantage of an adversary $A$ is:
%
\begin{align*}
    \advantage{\pm \widetilde{\mathrm{prp}}}{\bm{E}}[(A)] \defeq
    {}&\left\lvert\probsub{K \sample \mathcal{K}}{A^{\bm{E}_K,\bm{E}_K^{-1}}\Rightarrow 1}\right.
    \\
    {}&\left. - \probsub{\bm{\pi} \sample \Perm^\mathcal{T}(\mathcal{M})}
        {A^{\bm{\pi},\bm{\pi}^{-1}}\Rightarrow 1}\right\rvert
    \\
    \intertext{and}
    \advantage{\pm \widetilde{\mathrm{prp}}}{\bm{E}}[(q, l_T, l_M, t)]
    \defeq {}&
    \max_{A \in \mathcal{A}(q, l_T, l_M, t)} \advantage{\pm \widetilde{\mathrm{prp}}}{\bm{E}}[(A)]
\end{align*}
%
\begin{displaymath}
\end{displaymath}
where $\mathcal{A}(q, l_T, l_M, t)$
is the set of all adversaries that
make at most $q$ queries,
with tweak of length at most $l_T$
and message of length at most $l_M$,
and take at most $t$ time.

\subsection{Primary claim}
\begin{theorem}\label{hbshadvantage}
    Where HBSH mode is instantiated with hash function $H$, block cipher $E$ and stream cipher $S$,
    and where $H$ is $\epsilon$-almost-$\Delta$-universal for inputs such that
    $\abs{T} \leq l_T$, $\abs{L} \leq l_M - n$, then:
    %
    \begin{align*}
        \advantage{\pm \widetilde{\mathrm{prp}}}{\HBSH}[(q, l_T, l_M, t)]
        \leq {}&(\epsilon + 2(2^{-n}))\binom{q}{2} \\
        {}&+ \advantage{\mathrm{sc}}{S}[(q + 1, \abs{K_E} + \abs{K_H} + q(l_M - n), t')] \\
        {}&+ \advantage{\pm \mathrm{prp}}{E}[(q, t')]\\
    \end{align*}
    %
    where $t' = t + \bigO{q(l_T + l_M)}$.
\end{theorem}

This is proven in what follows. First we use the H-coefficient technique to establish
\autoref{xyadv}, a closely related bound; then in \autoref{hbshproof} we bridge the
gap between this bound and the desired bound.

\subsection{H-coefficient technique}
The H-coefficient technique was introduced by Patarin in 1991~\cite{ppdes,hco}.
In what follows we rely on the highly recommended exposition of
\cite{hco2} Section 3,
``The H-coefficient Technique in a Nutshell'', though we vary slightly by introducing
a new symbol $\Upsilon$ so we can distinguish between what is sampled and the adversary oracles.

We wish to bound the adversary's ability to distinguish between
two ``worlds'', world X (the ``real world'') and world Y (the ``ideal world'').
Associated with world X we have
\begin{itemize}
    \item $\Omega_X$: a set of instances we sample fairly from. We write
    $\probsub{\Omega_X}{}$ as shorthand for $\probsub{\omega \sample \Omega_X}{}$.
    \item $\Upsilon_X$: a map from an instance $\omega \in \Omega_X$ to a tuple of
    deterministic oracles we can present to the adversary.
    \item $\rho_X \defeq \probsub{\Omega_X}{A^{\Upsilon_X(\omega)} \Rightarrow 1}$\label{rhox}
    where the adversary $A$ is clear from context.
    As the adversary interacts with the oracles, a transcript $\tau$
    of queries and responses is generated.
    \item $X$: a random variable representing a transcript for $A^{\Upsilon_X(\omega)}$
    given $\omega \sample \Omega_X$; we write $\tau \sample X$
    to indicate that $\tau$ is sampled from this distribution.
    \item $\comp_X$:  We write $\omega \in \comp_X(\tau)$
    if a transcript $\tau$ is ``compatible'' with an instance $\omega \in \Omega_X$,
    ie if given an adversary $A$ that makes those queries, the oracles $\Upsilon_X(\omega)$
    make those responses and thus $A^{\Upsilon_X(\omega)}$ produces that transcript.
\end{itemize}
We have the same for world Y throughout.

We assume a deterministic adversary. This is without loss of
generality; if we assume a distribution of adversaries $A \sample \mathcal{A}$
then an advantage bound on each of the deterministic adversaries $A$ bounds the advantage
of the ensemble $\mathcal{A}$.

Once $\omega$ is sampled, the oracles $\Upsilon_X(\omega)$ are then deterministic;
the transcript produced by $A^{\Upsilon_X(\omega)}$ is thus the unique transcript
compatible both with adversary $A$ and instance $\omega$. Where a transcript
is not compatible with $A$, $\prob{X = \tau} = \prob{Y = \tau} = 0$. If either
of these is not zero, the transcript is compatible with $A$, and
$\prob{X = \tau} = \probsub{\Omega_X}{\omega \in \comp_X(\tau)}$ and similarly for Y.

The adversary always returns the same result for the same transcript, so
its advantage is maximized if it returns 1 exactly when $\prob{Y = \tau} > \prob{X = \tau}$.
Therefore:
\begin{align*}
    \advantage{\textrm{Y}}{\textrm{X}}[(A)] ={}&
    \abs{\rho_X - \rho_Y} \\
    \leq {}& \sum_{\tau: \prob{Y = \tau} > \prob{X = \tau}}
    \left(\prob{Y = \tau} - \prob{X = \tau}\right) \\
    = {}& \sum_{\tau: \prob{Y = \tau} > \prob{X = \tau}}
    \prob{Y = \tau}\left(1 - \frac{\prob{X = \tau}}{\prob{Y = \tau}}\right) \\
    = {}& \sum_{\tau: \prob{Y = \tau} > 0}
    \prob{Y = \tau}\left(1 - \minone{\frac{\prob{X = \tau}}{\prob{Y = \tau}}}\right) \\
    = {}& \expsub{\tau \sample Y}{1 - \minone{
           \frac{\prob{X = \tau}}{\prob{Y = \tau}}
        }} \\
    = {}& 1 - \expsub{\tau \sample Y}{\minone{
           \frac{\probsub{\Omega_X}{\omega \in \comp_X(\tau)}}
           {\probsub{\Omega_Y}{\omega \in \comp_Y(\tau)}}
        }}
\end{align*}
where $\expect{}$ is the expected value.
With this rearrangement, the only probability distribution we sum over is that
of $Y$, which can be more convenient to work with.

\subsection{Preliminaries}
\parintro{World X}
World X is
an idealized form of HBSH which uses a random function and permutation:
$\Omega_X \defeq \mathcal{K}_H \times \Perm(\mathcal{R}) \times (\mathcal{N} \rightarrow \bin^{l_S})$,
and given $(K_H, \pi, F) \in \Omega_X$,
$\Upsilon_X(K_H, \pi, F) \defeq (\eta_{K_H, \pi, F}, \eta_{K_H, \pi, F}^{-1})$.

\parintro{World Y}
World Y samples fairly from all possible pairs of tweakable length-preserving functions:
$\Omega_Y \defeq \LP^\mathcal{T}(\mathcal{M}) \times \LP^\mathcal{T}(\mathcal{M})$,
so given $(\mathcal{E}, \mathcal{D}) \in \Omega_Y$,
$\Upsilon_Y(\mathcal{E}, \mathcal{D}) \defeq (\mathcal{E}, \mathcal{D})$.

\parintro{Transcript}
Our transcript $\tau$ is a sequence of tuples
$(d^i, T^i, P^i, C^i)$
in
$\{+, -\} \times \mathcal{T} \times \mathcal{M} \times \mathcal{M}$
for $i \in [0 \ldots q-1]$.
For the $i$th sequential query
$d^i$ is the direction of the query:
if $d^i = +$ then a plaintext query $T^i, P^i$ is made and the result is $C^i$,
while if $d^i = -$ then a ciphertext query $T^i, C^i$ is made and the result is $P^i$.

\parintro{Pointless queries}
We consider adversaries contained in $\mathcal{A}(q, l_T, l_M, t)$ for some value of
the bounds $q$, $l_T$, $l_M$, $t$.
Without loss of generality, we consider only adversaries who do not make ``pointless''
queries as defined in \cite{cmc}. Thus for $i < j$, if $d^j = +$ then
$(T^i, P^i) \neq (T^j, P^j)$, and similarly if $d^j = -$ then
$(T^i, C^i) \neq (T^j, C^j)$.

\parintro{Bad events}
We define various classes of ``bad event'':

\begin{itemize}
    \item $(K_H, \tau) \in \badQ$ if there exists $i < j$ such that either
    \begin{itemize}
        \item $d^j = +$ and $\xi_{K_H}(T^i, P^i) = \xi_{K_H}(T^j, P^j)$, or
        \item $d^j = -$ and $\xi_{K_H}(T^i, C^i) = \xi_{K_H}(T^j, C^j)$.
    \end{itemize}
    \item $(K_H, \tau) \in \badR$ if there exists $i < j$ such that either
    \begin{itemize}
        \item $d^j = +$ and $\xi_{K_H}(T^i, C^i) = \xi_{K_H}(T^j, C^j)$, or
        \item $d^j = -$ and $\xi_{K_H}(T^i, P^i) = \xi_{K_H}(T^j, P^j)$.
    \end{itemize}
\end{itemize}

Finally we define the disjunction
$\bad \defeq \badQ \cup \badR$.

\subsection{Lemmas}
\begin{lemma} \label{badQ}
    For any $\tau$ such that $\prob{Y = \tau} > 0$,
    \begin{displaymath}
        \probsub{K_H \sample \mathcal{K}_H}{(K_H, \tau) \in \badQ}
        \leq \epsilon \binom{q}{2}
    \end{displaymath}
\end{lemma}

\begin{proof}
Assume $d^j = +$ for some pair $i, j$, and let $L^i \Concat R^i = P^i$ and similarly for $P^j$.
From $\prob{Y = \tau} > 0$ we know that $\abs{T^i}, \abs{T^j} \leq l_T$ and $\abs{P^i}, \abs{P^j} \leq l_M$,
and therefore that $\abs{L^i}, \abs{L^j} \leq l_M - n$.
Because pointless queries are forbidden we also know that $(T^i, P^i) \neq (T^j, P^j)$.
%
\begin{align*}
    {}&\xi_{K_H}(T^i, L^i \Concat R^i) = \xi_{K_H}(T^j, L^j \Concat R^j) \\
    \Leftrightarrow{}& R^i \boxplus H_{K_H}(T^i, L^i) = R^j \boxplus H_{K_H}(T^j, L^j) \\
    \Leftrightarrow{}& H_{K_H}(T^i, L^i) \boxminus H_{K_H}(T^j, L^j) = R^j \boxminus R^i \\
\end{align*}
%
If $(T^i, L^i) = (T^j, L^j)$ then $R^i \neq R^j$ and equality cannot occur.
Otherwise by the $\epsilon$-$\Delta$U property of $H$ this occurs with probability
at most $\epsilon$ (where $\epsilon$ depends on the bounds on
the parameters $l_T$, $l_M -n$).

Where $d^j = -$, a similar argument applies for $C^i$, $C^j$.
For an upper bound, we sum across all $\binom{q}{2}$ pairs $i, j$.
\end{proof}

\begin{lemma} \label{badR}
    For any $K_H \sample \mathcal{K}_H$,
    \begin{displaymath}
        \probsub{\tau \sample Y}{(K_H, \tau) \in \badR}
        \leq 2^{-n} \binom{q}{2}
    \end{displaymath}
\end{lemma}

\begin{proof}
    Assume $d^j = +$ for some pair $i, j$, and let $L^i \Concat R^i = C^i$ and similarly for $C^j$.
    Because pointless queries are forbidden, in world Y,
    conditioning on all prior queries and responses,
    all possible values of $C^j$ such that $\abs{C^j} = \abs{P^j}$ will be equally likely.
    In particular, even after conditioning on $L^j$,
    all values of $R^j$ are equally likely. Therefore
    $\prob{R^j = R^i \boxplus H_{K_H}(T^i, L^i) \boxminus H_{K_H}(T^j, L^j)} = 2^{-n}$.

    Where $d^j = -$, a similar argument applies for $P^i$, $P^j$.
    For an upper bound, we sum across all $\binom{q}{2}$ pairs $i, j$.
\end{proof}

\begin{lemma} \label{notbad}
    For any $K_H \in \mathcal{K}_H$ and transcript $\tau$ such that $\prob{Y = \tau} > 0$ and
    $(K_H, \tau) \notin \bad$,
    \begin{displaymath}
        \condprobsub{\Omega_X}{\omega \in \comp_X(\tau)}{\omega = (K_H, ., .)}
        \geq
        \probsub{\Omega_Y}{\omega \in \comp_Y(\tau)}
    \end{displaymath}
\end{lemma}

\begin{proof}
    In world Y, for any transcript such that $\prob{Y = \tau} > 0$,
    since all queries are distinct, the responses are independent fair random draws of
    binary strings of the appropriate length, and therefore
    $\probsub{\Omega_Y}{\omega \in \comp_Y(\tau)} = \prod_i 2^{-\abs{P^i}}$.

    For world X,
    let $P_L^i \Concat P_R^i = P^i$, $P_M^i = \xi_{K_H, T^i}(P^i)$ and similarly for $C^i$.
    Since $(K_H, \tau) \notin \bad$ we have that $P_M^i \neq P_M^j$
    and $C_M^i \neq C_M^j$ for all $i \neq j$.
    $(K_H, \pi, F) \in \comp_X(\tau)$ exactly if, for each $i$:
    \begin{align*}
        {}& \eta_{K_H, \pi, F, T^i}(P^i) = C^i\\
        \Leftrightarrow {}& \phi_{K_H,T^i}^{-1}(\theta_{\pi, F}(\phi_{K_H,T^i}(P^i))) = C^i\\
        \Leftrightarrow {}& \theta_{\pi, F}(P_L^i \Concat P_M^i) = C_L^i \Concat C_M^i \\
        \Leftrightarrow {}& P_L^i \oplus F(C_M^i)[0;\abs{P_L^i}] = C_L^i \wedge \pi(P_M^i) = C_M^i \\
        \Leftrightarrow {}& F(C_M^i)[0;\abs{P^i} - n] = P_L^i \oplus C_L^i \wedge \pi(P_M^i) = C_M^i \\
    \end{align*}

    Since $\pi$ and $F$ are drawn independently, we can consider these conditions on them
    separately. For $F$, since all $C_M^i$ are distinct,
    these are once again independent fair random draws of
    binary strings of the appropriate length:
    \begin{displaymath}
        \probsub{
            F \sample (\mathcal{N} \rightarrow \bin^{l_S})
        }{
            \forall_i : F(C_M^i)[0;\abs{P^i} - n] = P_L^i \oplus C_L^i
        } = \prod_i 2^{-(\abs{P^i} - n)}
    \end{displaymath}

    For $\pi$, again given that all $P_M^i$ are distinct and all $C_M^i$ are distinct,
    we have that
    \begin{displaymath}
        \condprobsub{
            \pi \sample \Perm(\mathcal{R})
        }{
            \pi(P_M^j) = C_M^j
        }{
            \forall_{0 \leq i < j} : \pi(P_M^i) = C_M^i
        } = \frac{1}{2^n - j}
    \end{displaymath}
    (we number queries in the range $i \in [0 \ldots q-1]$) and therefore that:
    \begin{displaymath}
        \probsub{
            \pi \sample \Perm(\mathcal{R})
        }{
            \forall_i : \pi(P_M^i) = C_M^i
        } = \prod_i \frac{1}{2^n - i}
    \end{displaymath}

    Therefore:
    \begin{align*}
        {}&\condprobsub{\Omega_X}{\omega \in \comp_X(\tau)}{\omega = (K_H, ., .)} \\
        ={}& \probsub{
            \pi \sample \Perm(\mathcal{R}),
            F \sample (\mathcal{N} \rightarrow \bin^{l_S})
        }{
            \forall_i : \eta_{K_H, \pi, F, T^i}(P^i) = C^i
        } \\
        ={}& \prod_i \frac{1}{2^n - i}2^{-(\abs{P^i} - n)} \\
        \geq {}& \prod_i 2^{-\abs{P^i}} = \probsub{\Omega_Y}{\omega \in \comp_Y(\tau)} \qedhere \\
    \end{align*}
\end{proof}

\begin{lemma} \label{xyadv}
    \begin{displaymath}
        \abs{\rho_X - \rho_Y}
        \leq (\epsilon + 2^{-n})\binom{q}{2}
    \end{displaymath}
\end{lemma}

\begin{proof}
    For any transcript $\tau$ such that $\prob{Y = \tau} > 0$:
    \begin{align*}
        {}& \minone{
               \frac{\probsub{\Omega_X}{\omega \in \comp_X(\tau)}}
               {\probsub{\Omega_Y}{\omega \in \comp_Y(\tau)}}
            } \\
        ={}& \minone{
              \frac{\expsub{K_H \sample \mathcal{K}_H}{\condprobsub{\Omega_X}{\omega \in \comp_X(\tau)}{\omega = (K_H, ., .)}}}
              {\probsub{\Omega_Y}{\omega \in \comp_Y(\tau)}}} \\
        \intertext{$\minone{\expect{U}} \geq \expect{\minone{U}}$ for any real random variable $U$, therefore}
        \geq{}&
            \expsub{K_H \sample \mathcal{K}_H}{
              \minone{
              \frac{\condprobsub{\Omega_X}{\omega \in \comp_X(\tau)}{\omega = (K_H, ., .)}}
              {\probsub{\Omega_Y}{\omega \in \comp_Y(\tau)}}
              }} \\
        \geq{}&
            \probsub{K_H \sample \mathcal{K}_H}{
                \frac{\condprobsub{\Omega_X}{\omega \in \comp_X(\tau)}{\omega = (K_H, ., .)}}
                {\probsub{\Omega_Y}{\omega \in \comp_Y(\tau)}} \geq 1
            } \\
        \intertext{by \autoref{notbad}}
        \geq{}& \probsub{K_H \sample \mathcal{K}_H}{(K_H, \tau) \notin \bad} \\
    \end{align*}

    Using the H-coefficient technique:
    \begin{align*}
        {}&\abs{\rho_X - \rho_Y} \\
        \leq{}& 1 - \expsub{\tau \sample Y}{\minone{
               \frac{\probsub{\Omega_X}{\omega \in \comp_X(\tau)}}
               {\probsub{\Omega_Y}{\omega \in \comp_Y(\tau)}}
            }} \\
        \leq{}& 1 - \expsub{\tau \sample Y}{
            \probsub{K_H \sample \mathcal{K}_H}{(K_H, \tau) \notin \bad}} \\
        = {}& \probsub{\tau \sample Y, K_H \sample \mathcal{K}_H}{(K_H, \tau) \in \bad} \\
        \leq {}& \probsub{\tau \sample Y, K_H \sample \mathcal{K}_H}{(K_H, \tau) \in \badQ}
         + \probsub{\tau \sample Y, K_H \sample \mathcal{K}_H}{(K_H, \tau) \in \badR} \\
         \intertext{by \autoref{badQ} and \autoref{badR}}
        \leq {}& (\epsilon + 2^{-n})\binom{q}{2} \qedhere \\
    \end{align*}
\end{proof}

\subsection{Proof of primary claim}
\begin{proof}[Proof of \autoref{hbshadvantage}]\label{hbshproof}
    Copying the definitions of $\rho_X$, $\rho_Y$ from \autoref{rhox},
    we define
    \begin{align*}
        \rho_V \defeq{}& \probsub{K_S \sample \mathcal{K}_S}
            {A^{\HBSH_{K_S}, \HBSH_{K_S}^{-1}}\Rightarrow 1} \\
        \rho_W \defeq{}& \probsub{F \sample (\mathcal{N} \rightarrow \bin^{l_S})}
            {A^{\bar{\eta}_{F}, \bar{\eta}_{F}^{-1}}\Rightarrow 1} \\
        \rho_X \defeq{}& \probsub{\Omega_X}{A^{\Upsilon_X(\omega)} \Rightarrow 1} \\
            ={}&\probsub{K_H, \pi, F \sample \Omega_X}{A^{\eta_{K_H, \pi, F}, \eta_{K_H, \pi, F}^{-1}} \Rightarrow 1} \\
        \rho_Y \defeq{}& \probsub{\Omega_Y}{A^{\Upsilon_Y(\omega)} \Rightarrow 1} \\
            ={}&\probsub{\mathcal{E}, \mathcal{D} \sample \LP^\mathcal{T}(\mathcal{M}) \times \LP^\mathcal{T}(\mathcal{M})}{A^{\mathcal{E}, \mathcal{D}} \Rightarrow 1} \\
        \rho_Z \defeq{}& \probsub{\bm{\pi} \sample \Perm^\mathcal{T}(\mathcal{M})}
            {A^{\bm{\pi},\bm{\pi}^{-1}}\Rightarrow 1} \\
    \end{align*}

    Distinguishing
    $\rho_V$ and $\rho_W$ is distinguishing the substitution of a stream cipher
    for a random function.
    Including the key schedule, the adversary distinguishing
    $\rho_V$ and $\rho_W$ makes at most $q + 1$ queries to the stream cipher
    or random function respectively, and uses at most $\abs{K_E} + \abs{K_H} + q(l_M - n)$ bits
    of the output; by a standard substitution argument per \cite{cbcsec,concsym},
    $\abs{\rho_V - \rho_W} \leq
    \advantage{\mathrm{sc}}{S}[(q + 1, \abs{K_E} + \abs{K_H} + q(l_M - n), t')]$
    where $t' = t + \bigO{q(l_T + l_M)}$.

    The differences between $\rho_W$ and $\rho_X$ are the use of a block cipher
    in place of a random permutation, and the use of $F(\lambda)$ to determine
    $K_E$ and $K_H$. Since $F$ is a random function and $F(\lambda)$ is used
    only here, this is equivalent to choosing them at random; again by a substitution
    argument we have that $\abs{\rho_W - \rho_X} \leq \advantage{\pm \mathrm{prp}}{E}[(q, t')]$.

    $\abs{\rho_X - \rho_Y} \leq (\epsilon + 2^{-n})\binom{q}{2}$ by \autoref{xyadv}.
    Since we forbid pointless queries,
    $\abs{\rho_Y - \rho_Z} \leq 2^{-n}\binom{q}{2}$ by Halevi and Rogaway's PRP-RND lemma
    (\cite{cmc}, Appendix C, Lemma 6).

    \autoref{hbshadvantage} follows by summing these bounds:
    $\abs{\rho_V - \rho_Z} \leq
    \abs{\rho_V - \rho_W} + \abs{\rho_W - \rho_X} + \abs{\rho_X - \rho_Y} + \abs{\rho_Y - \rho_Z}$.
\end{proof}

\subbib
\end{document}


\lesson{1}{Nov 15 2021 Mon (08:01:30)}{Polynomial Long Division}{Unit 3}

\subsubsection*{Steps to Dividing Polynomials}

\begin{enumerate}
    \item Divide
    \item Multiply
    \item Subtract
    \item Bring down
    \item Repeat
\end{enumerate}

\subsubsection*{Missing terms}

When either polynomial does not have all terms according to the descending powers on the variable, it is necessary to add in terms with $0$ coefficients.

\begin{example}[Dividing Polynomials]
    \[ \polylongdiv{x^2 + 3x + 2}{x + 1} \]

    Let me quickly go over everything:

    \begin{enumerate}
        \item First part, I'm multiplying $x$ by $x$ to get $x^2$.
        \item Second part, I'm also multiplying $1$ by $2$ to get $2$ because every time we do something to one, we must do it to all.
        \item Third part, I'm moving the answer we get ($x^2 + 2$) down. Now, I also distributed a negative ($-$), because I'm subtracting.
        \item Then, I repeat. I move the $2$ down next to the result I got, which was $2x$.
        \item Then, I multiply $x$ by $2$, which gets me $2x$.
        \item Since I multiplied $x$ by $2$, I have to do the same on the $1$. In the end, it brought me to $2x + 1$. But, I wanted to subtract the entire thing from the other answer, so I negated the whole equation.
        \item After subtracting, you are left with a $0$, meaning there is no remainder.
    \end{enumerate}
\end{example}

\subsubsection*{Remainders}

If the quotient has no remainder (a remainder of $0$), then the divisor is said to be a factor of the dividend.

\newpage


\section{Representations of Tweets}
\label{sec:tweetRepresentations}

In this section, we present all the algorithms that we investigated for converting our input tweets to numerical representations.
These representations try to capture the semantic meaning of the tweets
while having a constant size, which is independent of the words used in each tweet.
Thus, letting $N$ be the number of input tweets, we create an $N \times D$ matrix
with each line representing a different tweet with $D$ features.

\paragraph{\textbf{Bag of Words Representation}}
Bag of Words \cite{harris1954distributional} is a very common and straightforward numerical representation of text data.
Given that we have a vocabulary $V$ with finite size, we create
an array of size $|V|$ with $1s$ in the position of the words belonging in this text and $0s$ everywhere else.
Thus, in our case, we would have an $N \times |V|$ matrix representing our input tweets.

The problem with this representation is that $|V|$ can be arbitrary big especially if we do not handle appropriately slang and words with spelling mistakes, which can actually be solved by using the preprocessing methods that we proposed in Section~\ref{sec:preprocessing}.
Another problem of this representation is that it does not comprise any semantic information about the significance of each word in a tweet.

\paragraph{\textbf{TF-IDF Representation}}
The significance of the words in tweets is captured by a more sophisticated representation, which uses the Term Frequency - Inverse Document Frequency (TF-IDF).
TF-IDF \cite{sparck1972statistical} works by determining the relative frequency of a word in a specific document compared to the inverse proportion of that word over the entire document corpus.
Words that are common in a single or small group of documents tend to have higher TF-IDF numbers than common words such as articles and prepositions.

As can be used as a standalone representation, this metric can also be used to weight the Bag of Words representation, in which case the $1s$ in $N \times |V|$  representation matrix are replaced by $TF-IDFs$.

\paragraph{\textbf{N-grams Extension}}
In both of the above representations the $N \times |V|$ matrix
can become even bigger if we add sequences of contiguous words in our vocabulary.
These sequences are called \textit{n-grams} with $n$ being the maximum number of words in a sequence.
For example, for bigrams, in the worst case the size of the vocabulary becomes $|V| + {|V| \choose 2}$.
As we will see in the experimental evaluation we tested representations with up to 8-grams.

\paragraph{\textbf{Word Embeddings Representation}}
Word Embeddings (WE) \cite{DBLP:journals/corr/MikolovSCCD13} is a recently proposed representation that maps words to high dimensional vectors of real numbers.
This representation tries to capture the multiple contexts in which a word can appear in a text.
Hence, it guarantees that words that appear in similar context will have vectors that are very close each other.

The advantage of WE compared to the other aforementioned  representations is that each word is represented by a fixed-size vector regardless of the used vocabulary.
In tweet classification problem, given a of size $|V|$, tweets can be represented by a $|V| \times D$ matrix, where $D$ is the dimension of our vectors.
Depending on the vocabulary, we have different options for WE methods, which are listed below.

\subsubsection{GloVe Training Methods}
\textit{GloVe} \cite{pennington2014glove} has an open-source implementation of related training methods.
As a first option, we used the given training tweet dataset to obtain the representation matrix using both the given implementation and \textit{glove-python}\footnote{\url{http://github.com/maciejkula/glove-python}}, which is the python implementation of the original algorithm that uses \textit{SGD} for training.

\subsubsection{Pre-trained GloVe Embeddings}
As another option, we also employed the pre-trained set of Word Embeddings for tweets, published by GloVe\footnote{\url{http://nlp.stanford.edu/projects/glove/}}.
These vectors were trained with $2$ billions tweets containing $1.2$ millions words.
Regarding the one order of magnitude difference in terms of the amount of training data, their corpus is observed to cover a high percentage of the words used in our given train set.

\subsubsection{Hybrid Method}
Since not all of the words in our training dataset were found in the pre-trained Word Embeddings, we decided to train our own vectors for these remaining words and append them to the pre-trained ones.

\paragraph{\textbf{From Word Embeddings to Tweet Embeddings}}
All aforementioned representation methods enable us to construct vector representations for all the words in the vocabulary used by the tweets ($|V| \times D$ matrix).
Since tweets contain a subset of the words within the vocabulary, it's necessary to aggregate multiple rows of this matrix, in order to create representation for tweets ($N \times D$ matrix).

After investigating with various ways of aggregation (concatenation, summation and averaging), mean of WEs of all the words in a tweet is found to be the most expressive one for our classification algorithms.

\paragraph{\textbf{Paragraph Embeddings}}
One method that constructs directly embeddings for paragraphs (tweets, in our case) is proposed by \cite{le2014distributed}.
The advantage of this method is the fact that the order of the words in a tweet is also taken into account, by permuting them multiple times, which is claimed to reveal the semantic meaning of the phrases in a paragraph/tweet.
There are two model representations described in this paper: Distributed bag of words (DBoW) and Distributed Memory (DM) both of which are included in our experiments.
We observed that DBoW model is more efficient and requires less memory.


\documentclass[a4paper,twocolumn]{article}
\usepackage{enumitem}
\usepackage{tikz}
\usetikzlibrary{arrows,automata}
\usepackage{graphicx}
\usepackage{mathtools}
\usepackage{marvosym}
\usepackage[utf8]{inputenc}
\usepackage[T1]{fontenc}
\usepackage[a4paper, top=0.8in, bottom=1.0in, left=0.8in, right=0.8in]{geometry}
\usepackage{amssymb}
\usepackage{amsmath}
\usepackage{amsthm}
\usepackage{verbatim}
\usepackage{minted}

\setcounter{secnumdepth}{0}

\begin{document}

\title{A Introduction to an Algebra of labelled Graphs}
\author{Anton Lorenzen}
\date{March 2018}

\maketitle

The algebraic-graphs package, or just alga, is a library for constructing graphs in Haskell using a functional interface.
This is a ground up introduction to alga. You should definitely read it from the beginning on though, even if
you have already read the original functional pearl\footnote{https://github.com/snowleopard/alga-paper} since some definitions are different.

\section{A Introduction to Algebraic Graphs}

Think of any (finite) graph. As you probably know a graph can be represented as a matrix.
Let's say we have the vertices $V = (a, b, c, d, e)$:

\begin{center}
\begin{tikzpicture}[->,>=stealth',shorten >=1pt,auto,node distance=2.0cm,
                    semithick]

  \node[state] (C)                    {$c$};
  \node[state] (B) [below left  of=C] {$b$};
  \node[state] (D) [below right of=C] {$d$};
  \node[state] (A) [below right of=B] {$a$};
  \node[state] (E) [right of=D]       {$e$};

  \path (A) edge              node {} (B)
            edge              node {} (C)
        (B) edge [loop above] node {} (B)
            edge              node {} (C)
        (C) edge              node {} (D)
            edge [bend left]  node {} (E)
        (D) edge              node {} (A)
        (E) edge [bend left]  node {} (A);
\end{tikzpicture}
\end{center}

This is equivalent to the following matrix:

\[ A=
\begin{bmatrix}
  0 & 1 & 1 & 0 & 0 \\
  0 & 1 & 1 & 0 & 0 \\
  0 & 0 & 0 & 1 & 1 \\
  1 & 0 & 0 & 0 & 0 \\
  1 & 0 & 0 & 0 & 0
\end{bmatrix}
\]

We can decompose $A$ into 25 matrices each containing one of $A$'s elements and zeros everywhere else:

\[ A=
\begin{bmatrix}
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0
\end{bmatrix}
+
\begin{bmatrix}
  0 & 1 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0
\end{bmatrix}
+ \dots
\]

TODO: (also note that $A + A = A$, since $1$ is the maximum element in each cell).

We can write each of these matrices as $FromVertex\xrightarrow{}ToVertex$
in the case of a $1$ and $\varepsilon$ in the case of a zero.
Therefore we have:

\[ A = \varepsilon + a\xrightarrow{}b + \dots \]

We can therefore represent every matrix using the following data type:
\begin{minted}{haskell}
newtype Vertex a = Vertex a

data Graph a = Empty
  | Connect Vertex Vertex
  | Overlay (Graph a) (Graph a)
\end{minted}

Here \texttt{Connect} corresponds to $\xrightarrow{}$, \texttt{Empty} to $\varepsilon$ and \texttt{Overlay} to $+$.
We require that \texttt{Overlay} is associative, commutative, has \texttt{Empty} as an identity element
and is idempotent ($a\xrightarrow{}b + a\xrightarrow{}b = a\xrightarrow{}b$) just like our matrix addition above.

Now, this isn't too revolutionary since we are basically just building an unbalanced binary tree of edges.
But it gets more interesting if we allow \texttt{Connect} to connect more than simple vertices.
For example, maybe we could define the following:
\begin{minted}[escapeinside=~~]{haskell}
data Graph a = ~$\varepsilon$~
  | Vertex a
  | (Graph a) ~$\xrightarrow{}$~ (Graph a)
  | (Graph a) ~$+$~ (Graph a)

[x,y,z] = map Vertex ["x", "y", "z"]
\end{minted}
With the law:
\begin{minted}[escapeinside=~~]{haskell}
x ~$\xrightarrow{}$~ (y ~$+$~ z) == (x ~$\xrightarrow{}$~ y) ~$+$~ (x ~$\xrightarrow{}$~ z)
(x ~$+$~ y) ~$\xrightarrow{}$~ z == (x ~$\xrightarrow{}$~ z) ~$+$~ (y ~$\xrightarrow{}$~ z)
\end{minted}
That opens up the question what
\begin{minted}[escapeinside=~~]{haskell}
x ~$\xrightarrow{}$~ y == x ~$\xrightarrow{}$~ (y ~$+$~ ~$\varepsilon$~)
       == (x ~$\xrightarrow{}$~ y) ~$+$~ (x ~$\xrightarrow{}$~ ~$\varepsilon$~)
\end{minted}
means for the $x \xrightarrow{} \varepsilon$ part?
Obviously, it needs to be $\varepsilon$, you might say and you would end up with
a $\xrightarrow{}$ that looks pretty much like matrix multiplication.
But alga took a different route and added another law, which gives it a different spin:
\begin{minted}[escapeinside=~~]{haskell}
x ~$\xrightarrow{}$~ ~$\varepsilon$~ == ~$\varepsilon$~ ~$\xrightarrow{}$~ x == x
x ~$\xrightarrow{}$~ (y ~$\xrightarrow{}$~ z) == (x ~$\xrightarrow{}$~ (y ~$+$~ z)) ~$+$~ (y ~$\xrightarrow{}$~ z)
(x ~$\xrightarrow{}$~ y) ~$\xrightarrow{}$~ z == ((x ~$+$~ y) ~$\xrightarrow{}$~ z) ~$+$~ (x ~$\xrightarrow{}$~ y)
\end{minted}
This law is what makes alga different from existing approaches, because it does it away with the difference between vertices and edges:
The $\xrightarrow{}$ constructor of the graph preserves the vertices contained in it. We can even derive this property from the laws:

\begin{align*}
  x \xrightarrow{} y &= (x \xrightarrow{} y) \xrightarrow{} \varepsilon \\
  &= ((x + y) \xrightarrow{} \varepsilon) + (x \xrightarrow{} y) \\
  &= x + y + (x \xrightarrow{} y)
\end{align*}

Convince yourself that we can see $x$ and $y$ as arbitrary graphs from now on and not just as vertices.
Also we will assume that $\xrightarrow{}$ binds stronger than $+$.

So, what is a good intuition for $\xrightarrow{}$? To come back to your $A$ matrix above, we can write

\[ (a + b) \xrightarrow{} (d + e) =
\begin{bmatrix}
  0 & 0 & 0 & 1 & 1 \\
  0 & 0 & 0 & 1 & 1 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0
\end{bmatrix}
\]

Exercises:
\begin{itemize}
\item Show that the laws imply that $\xrightarrow{}$ is associative.
\item Show that the idempotence of $+$ and $\varepsilon$ being the identity of $+$ follow from the other laws.
\item Show that $x \xrightarrow{} x \xrightarrow{} x = x \xrightarrow{} x$.
\item Show we can derive the decomposition law from the original paper:
  \[ a \xrightarrow{} b \xrightarrow{} c = a \rightarrow{} b + a \xrightarrow{} c + b \xrightarrow{} c \]
\end{itemize}

\subsection{About intuition}

Now that you have worked through the exercises, you will probably agree
that we can characterize a graph by the following laws:
\begin{itemize}
\item Addition: $+$ is associative and commutative.
\item Identity: $\varepsilon$ is the identity of $\xrightarrow{}$.
\item Distribution:
  \begin{align*}
    x \xrightarrow{} (y + z) &= (x \xrightarrow{} y) + (x \xrightarrow{} z) \\
    (x + y) \xrightarrow{} z &= (x \xrightarrow{} z) + (y \xrightarrow{} z)
  \end{align*}
\item Extraction:
  \begin{align*}
    x \xrightarrow{} (y \xrightarrow{} z) &= (x \xrightarrow{} (y + z)) + (y \xrightarrow{} z) \\
    (x \xrightarrow{} y) \xrightarrow{} z &= ((x + y) \xrightarrow{} z) + (x \xrightarrow{} y)
  \end{align*}
\end{itemize}

The intuition I gave for these laws above might help you to understand what these laws mean in the contexts of graphs
and indeed all implementations of these laws as adjacency maps or sets follow this intuition.
However it falls short, if we go outside the context of graphs, so I would like to show you some statements you can't derive from the laws:
\begin{itemize}
\item \textit{$+$ and $\xrightarrow{}$ are distinct}. More specifically,
  every associative, commutative, idempotent operation with an identity fulfills the laws.
\item \textit{$\varepsilon$ denotes the empty matrix}. Consider for example $a + b = a \xrightarrow{} b = \text{min}(a,b)$
  with the identity being $\infty$.
\end{itemize}

\section{Labelled Graphs}

Let's go back to our graph from the beginning and add labels to the edges.

\begin{center}
\begin{tikzpicture}[->,>=stealth',shorten >=1pt,auto,node distance=2.0cm,
                    semithick]

  \node[state] (C)                    {$c$};
  \node[state] (B) [below left  of=C] {$b$};
  \node[state] (D) [below right of=C] {$d$};
  \node[state] (A) [below right of=B] {$a$};
  \node[state] (E) [right of=D]       {$e$};

  \path (A) edge              node {k} (B)
            edge              node {l} (C)
        (B) edge [loop above] node {m} (B)
            edge              node {n} (C)
        (C) edge              node {o} (D)
            edge [bend left]  node {p} (E)
        (D) edge              node {q} (A)
        (E) edge [bend left]  node {r} (A);
\end{tikzpicture}
\end{center}

This is equivalent to the following matrix:

\[ A=
\begin{bmatrix}
  0 & k & l & 0 & 0 \\
  0 & m & n & 0 & 0 \\
  0 & 0 & 0 & o & p \\
  q & 0 & 0 & 0 & 0 \\
  r & 0 & 0 & 0 & 0
\end{bmatrix}
\]

Here you can think of $k, l, m, \dots$ as variable names standing for strings, numbers or anything else.
We will come back to which elements exactly we can use here in a minute.

Again we can decompose $A$ into 25 matrices each containing one of $A$'s elements and zeros everywhere else:

\[ A=
\begin{bmatrix}
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0
\end{bmatrix}
+
\begin{bmatrix}
  0 & k & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0 \\
  0 & 0 & 0 & 0 & 0
\end{bmatrix}
+ \dots
\]

And write each of these matrices as $FromVertex\xrightarrow{edge}ToVertex$.
Therefore we have:

\[ A = a\xrightarrow{0}a + a\xrightarrow{k}b + \dots \]

We can therefore represent every labelled graph as the following data type:
\begin{minted}[escapeinside=~~]{haskell}
data Graph l a = ~$\varepsilon$~
  | Vertex a
  | (Graph a) ~$\xrightarrow{l}$~ (Graph a)
  | (Graph a) ~$+$~ (Graph a)

[x,y,z] = map Vertex ["x", "y", "z"]
[k,l,m,n] = ["k", "l", "m", "n"]
\end{minted}

With the new laws:
\begin{itemize}
\item Addition: $+$ is associative and commutative.
\item Identity: $\varepsilon$ is the identity of $\xrightarrow{l}$.
\item Distribution:
  \begin{align*}
    x \xrightarrow{k} (y + z) &= (x \xrightarrow{k} y) + (x \xrightarrow{k} z) \\
    (x + y) \xrightarrow{k} z &= (x \xrightarrow{k} z) + (y \xrightarrow{k} z)
  \end{align*}
\item Extraction:
  \begin{align*}
    x \xrightarrow{k} (y \xrightarrow{l} z) &= (x \xrightarrow{k} (y + z)) + (y \xrightarrow{l} z) \\
    (x \xrightarrow{k} y) \xrightarrow{l} z &= ((x + y) \xrightarrow{k} z) + (x \xrightarrow{l} y)
  \end{align*}
\item Absorption:
  \begin{align*}
    x \xrightarrow{k} y + x \xrightarrow{l} y &= x \xrightarrow{k + l} y
  \end{align*}
\end{itemize}

Exercise: Under which circumstances is the new $\xrightarrow{l}$ still associative?

\subsection{Semirings}

You have probably noticed that we used a new $+$ operation on our labels above
and as you might have guessed there are laws for it too, since we might run into contradictions otherwise:
\begin{itemize}
\item $+$ is commutative, associative and idempotent.
\item There is an element called $0$ which acts as an identity for $+$.
\end{itemize}

\end{document}


\subsection{Recursive types}

\FOM{} is very powerful, but does not allow us to define (non-positive) recursive
types. Adding a type-level fixed point operator enables us to do
this (see e.g. \cite[Chapter 20]{pierce2002types}).
However, we must make a number of choices about the precise nature of our type-level fixed points.

\subsubsection{Isorecursive and equirecursive types.}

The first choice we have is between two approaches to exposing the fixpoint
property of our recursive types.
Systems with \emph{equirecursive} types identify $(\fixo f)$ and $f (\fixo f)$; whereas
systems with \emph{isorecursive} types provide an isomorphism between
the two, using a term $\unwrap$ to convert the first into the second, and a term
$\wrap$ for the other direction.

The tradeoff is that equirecursive types add no additional terms to the language, but
have a more complicated metatheory. Indeed, typechecking \FOMF{} with equirecursive types is not
known to be decidable in general (\cite{dreyer:recursive-modules,cai-giarrusso-ostermann}). Isorecursive types, on the other hand,
have a simpler metatheory, but require additional terms. It is not
too important for an IR to be easy to program by hand, so we opt for
isorecursive types, with our witness terms being $\wrap$ and $\unwrap$.

\subsubsection{Choosing an appropriate fixpoint operator.}

We also have a number of options for \emph{which} fixpoint operator to add. The most obvious choice is a fixpoint
operator $\fixo$ which takes fixpoints of type-level endofunctions
at any kind $K$ (i.e. it has signature $\fixo : (K \kindArrow K) \kindArrow
K$). In contrast, our language \FOMF{} has a fixpoint operator $\ifix$
(``indexed fix'') which allows us to
take fixpoints only at kinds $K \kindArrow \Type$.

\noindent The key advantage of $\ifix$ over $\fixo$ is that it is much easier to give
fully-synthesizing type rules for $\ifix$. To see this, suppose we had a $\fixo$
operator in our language, with corresponding $\wrap$
and $\unwrap$ terms. We now want to write typing rules for $\wrap$.
However, $\fixo$ allows us to take fixpoints at \emph{arbitrary} kinds, whereas
$\wrap$ and $\unwrap$ are terms, which always have types of kind $\Type$.
Thus, the best we can hope for is to use $\wrap$ and $\unwrap$ with \emph{fully applied} fixed points, i.e.:
\begin{displaymath}
\begin{array}{l@{\ }l@{\ }l@{\ }l@{\ }l}
\wrap_0 f_0            & t &: \fixo f_0 & \quad\textrm{where} & t : f_0\ (\fixo f_0)\\
\wrap_1 f_1  ~ a1      & t &: \fixo f_1\ a1 & \quad\textrm{where} & t : f_1\ (\fixo f_1)\ a1\\
\wrap_2 f_2  ~ a1 ~ a2 & t &: \fixo f_2\ a1\ a2 & \quad\textrm{where} & t : f_2\ (\fixo f_2)\ a1\ a2\\
\dots & & & &
\end{array}
\end{displaymath}
This must be accounted for in our typing rules for fixed points.

It is possible to give typing rules for $\wrap$ that will do the right thing
regardless of how the fixpoint type is applied. One approach is to use
\emph{elimination contexts}, which represent the context in which a type will be
eliminated (i.e. applied). This is the approach taken in
\cite{dreyer2005understanding}. However, this incurs a cost, since we cannot
\emph{guess} the elimination context (since type synthesis is bottom-up), so we
must attach elimination contexts to our terms somehow.

An alternative approach is to pick a more restricted fixpoint operator. Using $\ifix$
avoids the problems of $\fixo$: it always produces fixpoints at kind $K \kindArrow
\Type$, which must be applied to precisely one argument of kind $K$ before
producing a type of kind $\Type$. This means we can give relatively straightforward typing rules as shown
in \cref{fig:fir_typing}.

\subsubsection{Adequacy of $\ifix$.}

Perhaps surprisingly, $\ifix$ is powerful enough to give us fixpoints at any
kind $K$. We give a semantic argument here, but the idea is simply
stated: we can ``CPS-transform'' a kind $K$ into
$(K \kindArrow \Type) \kindArrow \Type$, which then has the correct shape for
$\ifix$.

\begin{definition}
  Let $J$ and $K$ be kinds. Then $J$ is a \emph{retract} of $K$ if
  there exist functions $\phi: J \kindArrow K$ and $\psi : K \kindArrow J$
  such that $\psi \circ \phi = id$.
\end{definition}

\begin{proposition}
   \label{prop:retracts-fixed-points}
  Suppose $J$ is a retract of $K$ and there is a fixpoint operator \textnormal{$\fixo_K$} on $K$.
  Then there is fixpoint operator \textnormal{$\fixo_J$} on $J$.
\end{proposition}
\begin{proof}
  Take $\fixo_J(f) = \psi (\fixo_K (\phi \circ f \circ \psi))$.
\end{proof}

\begin{proposition}
  \label{prop:kind-structure}
  Let $K$ be a kind in \FOMF{}. Then there is a unique (possibly empty) sequence
  of kinds $(K_0, \dots, K_n)$ such that $K = \seqKindArr{K}{\Type}$.
\end{proposition}
\begin{proof}
  Simple structural induction.
\end{proof}

\begin{proposition}
  For any kind $K$ in \FOMF{}, $K$ is a retract of $(K \kindArrow \Type)
  \kindArrow \Type$.
\end{proposition}
\begin{proof}
  Let $K = \seqKindArr{K}{\Type}$ (by \cref{prop:kind-structure}), and take
  \begin{align*}
    \phi &: K \kindArrow (K \kindArrow \Type) \kindArrow \Type \\
    \phi &= \lambda (x :: K) . \lambda (f :: K \kindArrow \Type) . f\ x\\
    \psi &: ((K \kindArrow \Type) \kindArrow \Type) \kindArrow K\\
    \psi &= \lambda (w :: (K \kindArrow \Type) \kindArrow \Type) . \lambda (\seq{a :: K}) . w (\lambda (o :: K) . o\ \seq{a})\\
  \end{align*}
\end{proof}

\begin{corollary}
  If there is a fixpoint operator at kind $(K \kindArrow \Type) \kindArrow \Type$ then there is a fixpoint operator at any kind $K$.
\end{corollary}

We can instantiate $\ifix$ with $K \kindArrow \Type$ to get fixpoints at $(K
\kindArrow \Type) \kindArrow \Type$, so $\ifix$ is sufficient to get fixpoints
at any kind.

Note that since our proof relies on \cref{prop:kind-structure}, it will not go
through for arbitrary kinds when there are additional kind forms beyond $\Type$
and $\kindArrow$. However, it will still be true for all kinds of the structure
shown in \cref{prop:kind-structure}.

The fact that retractions preserve the fixed point property is
well-known in the context of algebraic topology: see
~\cite[Exercise 4.7]{fulton1995algebraic} or
~\cite[Proposition 23.9]{bredon1993topology} for example. While retractions
between datatypes are a common tool in theoretical computer science
(see e.g. \cite{stirling}), we have been unable to find a version of
\cref{prop:retracts-fixed-points} in the computer science
literature. Nonetheless, we suspect this to be widely known.


%
% firstly set up on Jan 2012
%
%
%
%
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\section{HGP Method}
%
%
%
%
HGP method\cite{HGP} is a revised method based on OS\cite{OS1986} framework.
It's central idea is to employ the horizontal recurrence relation so that
to take the contraction of coefficients into consideration.

Before we step into the discussion, let's define some expressions. The general
un-contracted integral, for example; the electron repulsion integral is
expressed as:
\begin{equation}
 (ab|cd) = \int dr \int dr^{'} \chi_{a}(r)\chi_{b}(r)\frac{1}{|r-r^{'}|}
\chi_{c}(r^{'})\chi_{d}(r^{'})
\label{HGP:1}
\end{equation}
This is same with the definition in \ref{OS_ERI_eq:1}. As we have noted in the
previous section that the integral are actually based on shell so we only need
to specify the shells of a, b, c, d. Therefore, the integral in the \ref{HGP:1}
is also called ``shell quartet''.

For the contracted integrals, we express it as:
\begin{align}
 \label{HGP:2}
[ij|kl] &=
\sum_{\mu}^{K_{\mu}}\sum_{\nu}^{K_{\nu}}\sum_{\lambda}^{K_{\lambda}}
\sum_{\eta}^{K_{\eta}}c_{\mu i}c_{\nu j}c_{\lambda k}c_{\eta l} \nonumber \\
&\int dr \int dr^{'} \chi_{\mu}(r)\chi_{\nu}(r)\frac{1}{|r-r^{'}|}
\chi_{\lambda}(r^{'})\chi_{\eta}(r^{'})
\end{align}
The Greek letters are the indices over AO space, the i,j,k,l are indices over
the basis set function space. $K$ denotes the contraction degree.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{Horizontal Recurrence Relation}
In the OS framework, we already derived the recursive relation for the electron
repulsion integral:
\begin{equation}
 \begin{split}
 ((a+\iota_{i})b|cd)^{(m)} &= (P_{i} - A_{i})(ab|cd)^{(m)} +
\left(W_{i} -P_{i}\right)(ab|cd)^{(m+1)} \\
&+\frac{N_{i}(A)}{2\epsilon}\left(((a-\iota_{i})b|cd)^{(m)}-\frac{\rho}{
\epsilon }((a-\iota_{i})b|cd)^{(m+1)}\right)  \\
&+\frac{N_{i}(B)}{2\epsilon}\left((a(b-\iota_{i})|cd)^{(m)}-\frac{\rho}{
\epsilon }(a(b-\iota_{i})|cd)^{(m+1)}\right)  \\
&+\left(\frac{N_{i}(C)}{2}\right)\frac{1}{\epsilon+\eta}
(ab|(c-\iota_{i})d)^{(m+1)} \\
&+\left(\frac{N_{i}(D)}{2}\right)\frac{1}{\epsilon+\eta}
(ab|c(d-\iota_{i}))^{(m+1)}
 \end{split}
\label{HGP_ERI_eq:1}
\end{equation}
Here we noted that in such relation, the shell $a$ and shell $b$ are in some
``symmetrical'' position thus if we consider the expression of
$(a(b+\iota_{i})|cd)^{(m)}$, it's:
\begin{equation}
\begin{split}
 (a(b+\iota_{i})|cd)^{(m)} &= (P_{i} - B_{i})(ab|cd)^{(m)} +
\left(W_{i} -P_{i}\right)(ab|cd)^{(m+1)} \\
&+\frac{N_{i}(A)}{2\epsilon}\left(((a-\iota_{i})b|cd)^{(m)}-\frac{\rho}{
\epsilon }((a-\iota_{i})b|cd)^{(m+1)}\right)  \\
&+\frac{N_{i}(B)}{2\epsilon}\left((a(b-\iota_{i})|cd)^{(m)}-\frac{\rho}{
\epsilon }(a(b-\iota_{i})|cd)^{(m+1)}\right)  \\
&+\left(\frac{N_{i}(C)}{2}\right)\frac{1}{\epsilon+\eta}
(ab|(c-\iota_{i})d)^{(m+1)} \\
&+\left(\frac{N_{i}(D)}{2}\right)\frac{1}{\epsilon+\eta}
(ab|c(d-\iota_{i}))^{(m+1)}
 \end{split}
\label{HGP_ERI_eq:2}
\end{equation}
We can see that most of the terms in \ref{HGP_ERI_eq:2} are same with
\ref{HGP_ERI_eq:1}. Then if we subtract the two terms, it gives:
\begin{equation}
 \label{HGP_ERI_HRR}
 (a(b+\iota_{i})|cd)^{(m)} = ((a+\iota_{i})b|cd)^{(m)} +
(A_{i} - B_{i})(ab|cd)^{(m)}
\end{equation}
The new recursive relation in \ref{HGP_ERI_HRR} is called ``horizontal
recurrence relation''(HRR). The relation in \ref{HGP_ERI_eq:1} and
\ref{HGP_ERI_eq:2} are called ``vertical recurrence relation''(VRR).
Here it has an important feature, that for the \ref{HGP_ERI_HRR}
we could contract it so that to transform it into:
\begin{equation}
 \label{HGP_ERI_eq:3}
 [a(b+\iota_{i})|cd]^{(m)} = [(a+\iota_{i})b|cd]^{(m)} +
(A_{i} - B_{i})[ab|cd]^{(m)}
\end{equation}
Therefore, the advantages for the HRR relation is that it reduces the
calculation inside the loop of primitive function pairs. For example, for the
$[pp|pp]$ primitives, now we just need to calculate the $[ds|ds]$. Therefore,
much less calculation is done with VRR.

What's more, we note that the HRR relation in \ref{HGP_ERI_HRR} is also applied
to the other OS recursive relations. For example, for the three center overlap
integral whose relationship is:
\begin{equation}
 \begin{split}
 (a+\iota_{i}|b|c)
&= (G_{Ai} - A_{i})(a|b|c) +
N_{i}(A)\left(\frac{1}{2(\alpha+\beta+\gamma)}\right)(a-\iota_{i}|b|c) \\
&+
N_{i}(B)\left(\frac{1}{2(\alpha+\beta+\gamma)}\right)(a|b-\iota_{i}|c) \\
&+
N_{i}(C)\left(\frac{1}{2(\alpha+\beta+\gamma)}\right)(a|b|c-\iota_{i})
 \end{split}
\end{equation}
It's easy to see that the corresponding HRR is:
\begin{equation}
\label{HGP_ERI_eq:4}
 (a|b+\iota_{i}|c) = (a+\iota_{i}|b|c) +
(A_{i} - B_{i})(a|b|c)
\end{equation}
Therefore, the same formula retains.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
\subsection{HGP Algorithm to Evaluate Integrals}
%
%
%
Based on the HRR, we have some new algorithm to evaluate the integrals(the
real calculation will be in reverse order):
\begin{description}
 \item[HRR step:]
 For a general shell quartet of $[ab|cd]$, through the HRR it could be
 evidently reduced to the integrals of $[e0|f0]$; where for the $e$ the angular
 momentum would be the sum of $a$ and $b$, for the $f$ it would be sum of $c$
 and $d$.
 \item[CONTRACTION step:]
 Perform the contraction from $(e0|f0)$ to $[e0|f0]$.
 \item[VRR step:]
 Calculate the primitive integral of $(e0|f0)$ in VRR. Each of such integrals
 will be reduced to the $(ss|ss)^{(m)}$, while for $(ab|cd)$ $m$ ranges from
 0 to $a+b+c+d$.
 \end{description}

How to evaluate the HGP algorithm? By using the HRR, a lot of calculations
within the loop of primitives pairs now could be moved out of the contraction
loop (this loop is scaled with $K^{4}$). However, in HRR the angular momentum
increases in the right hand side so it implies that more shell quartets
are needed to be generated; which is sacrifice in terms of the balance.

Now let's give an example to see how the HGP works. Suggest that for the
shell quartet of $[FF|FF]$, by using the HRR we can have:
\begin{enumerate}
 \item $[FF|FF]$ is reduced to $[GD|FF]$ and $[FD|FF]$;
 \item $[GD|FF]$ is reduced to $[HP|FF]$ and $[GP|FF]$;
 \item $[FD|FF]$ is reduced to $[GP|FF]$ and $[FP|FF]$;
 \item $[HP|FF]$ is reduced to $[IS|FF]$ and $[HS|FF]$;
 \item $[GP|FF]$ is reduced to $[HS|FF]$ and $[GS|FF]$;
 \item $[FP|FF]$ is reduced to $[GS|FF]$ and $[FS|FF]$
\end{enumerate}
Therefore, there are only four elementary shell quartets, namely the
$[FS|FF]$, $[GS|FF]$, $[HS|FF]$ and $[IS|FF]$. On the other hand, similar
treatment to the ket side will yields $[FF|FS]$, $[FF|GS]$, $[FF|HS]$ and
$[FF|SI]$ therefore only their combinations are needed:
\begin{enumerate}
 \item $[FS|FS]$, $[FS|GS]$, $[FS|HS]$, $[FS|IS]$
 \item $[GS|FS]$, $[GS|GS]$, $[GS|HS]$, $[GS|IS]$
 \item $[HS|FS]$, $[HS|GS]$, $[HS|HS]$, $[HS|IS]$
 \item $[IS|FS]$, $[IS|GS]$, $[IS|HS]$, $[IS|IS]$
\end{enumerate}
Then in the VRR step we could calculate all of these integrals.