\section{Syntactical considerations}

\begin{defn}
A language $\Li$ is a set of symbols. Throughout this dissertation we are going to work only with relational laguages; in some specific moments we will add constants to the language, but we will be explicit when we are doing so. We use $P, Q, P\p, Q\p, \dots$ to denote relation symbols. It is assumed that each relation symbol $P$ of $\Li$ is an $n$-ary relation symbol for $n \in \omega$. We call a $0$-ary relation symbol a \textit{propositional letter}, and we use $p,q,p\p,q\p, \dots$ to denote propositional letters (also called \textit{propositional variables}).

\qquad We use $\Li, \Li^{\prime}, \Li^{\prime \prime}, \dots$ as variables for languages. If $\Li \subseteq \Li^{\prime}$, we say that $\Li^{\prime}$ is an \textit{expansion} of $\Li$, and that $\Li$ is a \textit{reduction} of $\Li^{\prime}$.
\end{defn}

\begin{defn}
Together with $\Li$ we define the following \textit{logical symbols}:

\begin{itemize}
\item $x_{0}, x_{1}, x_{2}, \dots$ (\textit{variables});
\item $\nao, \ou$ (\textit{not, or});
\item $\ex$ (\textit{there exists});
\item $\Diamond$ (\textit{possibility symbol});
\item $=$ (\textit{equality symbol});
\item $),($ (\textit{parentheses}).
\end{itemize}
\qquad We use $x, y, z, \dots$ as syntactical variables for variables.
\end{defn}

\begin{defn}
The set $\FLi$ of formulas of $\Li$ is defined by the following rules:
\begin{itemize}
\item If $x, y$ are variables, then $x =y$ is a formula of $\Li$.
\item If $x_1, \dots, x_n$ $(n \geq 0)$  are variables and $P$ is an $n$-ary relation symbol of $\Li$, then $Px_1 \dots x_n$ is a formula of $\Li$.
\item If $\varphi$ is a formula of $\Li$, then $\nao \varphi$ is a formula of $\Li$.
\item If $\varphi$ and $\psi$ are formulas of $\Li$, then $(\varphi \ou \psi)$ is a formula of $\Li$.
\item If $\varphi$ is a formula of $\Li$, then $\Diamond \varphi$ is a formula of $\Li$.
\item If $\varphi$ is a formula of $\Li$ and $x$ a variable, then $\ex x \varphi$ is a formula of $\Li$.
\end{itemize}
\qquad We assume the standard syntactical notions of \textit{atomic formula}, \textit{free variable}, \textit{bound variable}, \textit{sentence}, \textit{formula complexity} and \textit{proof (definition) by induction on formulas}. We are going to employ the usual abbreviations:

\begin{center}
$(\varphi \e \psi) := \nao (\nao \varphi \ou \nao \psi)$\\
$(\varphi \impli \psi) := (\nao \varphi \ou \psi)$\\
$(\varphi \see \psi) := (\varphi \impli \psi)\e (\psi \impli \varphi)$\\
$\todo x \varphi := \nao\ex x \nao \varphi$\\
$\Box \varphi := \nao\Diamond \nao \varphi$\\
\end{center}

\qquad We write $\varphi(x_{1}, \dots, x_{n})$ to denote that the free variables of $\varphi$ are among $\{x_{1}, \dots, x_{n}\}$. Where $y_{1}, \dots, y_{n}$ are variables, we write $\varphi(y_{1}/x_{1}, \dots, y_{n}/x_{n})$ to denote the formula obtained by substitution of $y_{1}, \dots, y_{n}$ for all the free occurrences of $x_{1}, \dots, x_{n}$ in $\varphi$,  respectively. When it is clear from the context which variables are free in $\varphi$ we simply write $\varphi(y_{1}, \dots, y_{n})$ instead of $\varphi(y_{1}/x_{1}, \dots, y_{n}/x_{n})$. We use $\vec{x},\vec{y}, \dots$ for sequence of variables; and we write $\todo \vec{x} \varphi(\vec{x})$ in the place of $\todo x_1 \dots \todo x_n\varphi(x_1, \dots ,x_n)$.
\end{defn}

\section{Models: basic notions}

\begin{defn}
A \textit{frame} is a tuple $\bl\W,\R\br$ in which:

\begin{itemize}
\item $\W \neq \vazio$.
\item $\R \subseteq \W\times \W$.
\end{itemize}
\end{defn}

\begin{defn}
A \textit{skeleton}\footnote{Sometimes called \textit{augmented frame}.} is a quadruple $\Frame$ in which $\bl\W,\R\br$ is a frame and:
\begin{itemize}
\item $\D \neq \vazio$.
\item $\barD: \W \impli \Pa(\D)$, and for every $w$ of $\W$, $\barD(w) \neq \vazio$.
\item $\D = \bigcup_{w \in \W} \barD_{w}$.
\end{itemize}

\qquad The intuition behind the notion of skeleton is the same as in \cite{Kripke63}: $\W$ is the set of all `possible worlds'; $\R$ is the accessibility relation between worlds; $\barD$ is a function which gives to each world a domain of individuals, and $\D$ is the set of all possibles individuals.

\qquad We use $w, v, u, w^{\prime}, w_0, w_1, \dots$ as variables for worlds. From now on we write $\barD_{w}$ instead of $\barD(w)$. In the cases where $\barD$ is a constant function we write $\bl\W,\R, \D\br$ instead of $\Frame$.
\end{defn}

\begin{defn}
A \textit{(modal) model} for $\Li$ is a quintuple $\M = \strucA$ in which $\Frame$ is a skeleton and $\I$ is an \textit{interpretation function}, i.e., a function assigning to each $n$-ary relational symbol $P$ of $\Li$ and each possible world $w$ an $n$-ary relation $\I(P,w)$ on $\D$.

\qquad We use $\M, \N, \M\p, \dots$ as variables for models.
\end{defn}

\begin{defn}
Let $\Li$ and $\Li^{\prime}$ be languages such that $\Li^{\prime} \subseteq \Li$, $\M = \strucA$ be a model for $\Li$ and $\M^{\prime} = \bl\W\p,\R\p, \D\p, \barD\p,\I\p\br$ be a model for $\Li^{\prime}$. We call $\M^{\prime}$ a \textit{reduct} of $\M$ (and $\M$ an \textit{expansion} for $\M^{\prime}$) iff $\W =\W^{\prime}$, $\R =\R^{\prime}$, $\D =\D^{\prime}$, $\barD =\barD^{\prime}$, and $\I$ and $\I^{\prime}$ agree on the symbols of $\Li^{\prime}$. We write $\M^{\prime} = \M|_{\Li^{\prime}}$.
\end{defn}

\begin{defn}
A \textit{valuation} in a model $\M = \strucA$ is a function $h$ from the set of variables to $\D$.\footnote{Although is more natural to use $v$ to denote a valuation, it is easy to get lost in the proofs when we use $v$ for valuations and $w$ and $u$ for worlds.} We say that $h\p$ is an $x$\textit{-variant} of $h$ if the two valuations agree on all variables except possibly $x$. Similarly, we say that a valuation $h\p$ is an $x$\textit{-variant of $h$ at $w$} if $h\p$ is an $x$-variant of $h$ and $h\p(x) \in \barD_w$.
\end{defn}

\begin{defn}
Let $\M = \strucA$ be a model for $\Li$, $\varphi$ a formula of $\Li$, $h$ a valuation in $\M$ and $w \in \W$. The notion \textit{$\varphi$ is true at world $w$ of $\M$ with respect to valuation $h$}, in symbols $\M,w \vSs \varphi$, is defined recursively as follows:

\begin{itemize}
\item[] $\M,w \vSs x = y$ iff $h(x) = h(y)$.
\item[] $\M,w \vSs Px_{1} \dots x_{n}$ iff $\bl h(x_{1}), \dots, h(x_{n})\br \in \I(P,w)$.
\item[] $\M,w \vSs \nao \psi$ iff $\M,w \nvSs \psi$.
\item[] $\M,w \vSs \psi \ou \theta$ iff $\M,w \vSs \psi$ or $\M,w \vSs \theta$.
\item[] $\M,w \vSs \Diamond \psi$ iff there is a $w\p \in \W$ such that $w\R w\p$ and $\M,w\p \vSs \psi$.
\item[] $\M,w \vSs \ex x \psi$ iff there is an $x$-variant $h\p$ of $h$ at $w$ such that $\M,w \vSp \psi$.
\end{itemize}

\qquad This definition enables us to speak of the truth of a formula at a world in a model without mentioning the valuation. We write $\M,w \models \varphi$ if for every valuation $h$, $\M,w \vSs \varphi$; and when that is the case we say that \textit{$\varphi$ is true in $\M$ at $w$}. We write $\M \models \varphi$ if for every world $w$ of $\M$, $\M,w \models \varphi$. And we say that a formula $\varphi$ is\textit{ valid in a class of models}, if for every model $\M$ of this class, $\M \models \varphi$.

\qquad Let $\Gamma$ be a set of formulas of $\Li$ (we also call $\Gamma$ a \textit{theory}); then $\M,w \models \Gamma$ if for every $\varphi \in \Gamma$, $\M,w \models \varphi$. In this case, we say that the pair  $\M,w$ is \textit{a model for} $\Gamma$. Two formulas $\varphi$ and $\psi$ are \textit{equivalent} if for every model $\M$, $\M \models \varphi$ iff $\M \models \psi$.

% Similarly, $\M \models \Gamma$ if for every $\varphi \in \Gamma$, $\M \models \varphi$.

%, or that \textit{$\M, w$ is a model for $\varphi$}. Similarly, if $\M,w \models T$, we say that \textit{$\M,w$ is a model for $T$}.
\end{defn}

\qquad There are some basic propositions about the relation $\models$. Since their proofs are straightforward and they can be found in many different textbooks, we are going to state these propositions without proof.

\begin{pro}
Suppose that $\M$ and $\M\p$ are models for $\Li$ and $\Li^{\prime}$, respectively; that $\Li\subseteq\Li\p$; and that $\M$ is the reduct of $\M\p$ to $\Li$. Then for every world $w$ of $\M$, for every valuation $h$ in $\M$, if $\varphi$ is a formula of $\Li$ then:

\begin{center}
 $\M,w \vSs \varphi$ iff  $\M\p,w \vSs \varphi$.
\end{center}
\end{pro}

\begin{pro}
Let $\M$ be a model for $\Li$, $w$ a world of $\M$, $h_{1}$ and $h_{2}$ valuations in $\M$ and $\varphi$ a formula of $\Li$. If $h_{1}$ and $h_{2}$ agree on all the free variables of $\varphi$, then

\begin{center}
 $\M,w \models_{h_{1}} \varphi$ iff  $\M,w \models_{h_{2}} \varphi$.
\end{center}
\end{pro}

\begin{defn}
Let $\M = \strucA$ be a model for $\Li$:

\begin{itemize}
\item $\M$ is an \textit{S5-model} iff $\R$ is an equivalence relation.
\item $\M$ is an \textit{universal model} iff $\R = \W\times \W$.

\item $\M$ is a \textit{constant domain model} iff for every $w,v \in \W$, $\barD_{w} = \barD_{v}$.
\item $\M$ is a \textit{monotonic model} iff for every $w,v \in \W$, if $w\R v$, then $\barD_{w} \subseteq \barD_{v}$.
\item $\M$ is an \textit{anti-monotonic model} iff for every $w,v \in \W$, if $w\R v$, then $\barD_{v} \subseteq \barD_{w}$.
\item $\M$ is a \textit{locally constant domain model} iff for every $w,v \in \W$, if $w\R v$, then $\barD_{w} = \barD_{v}$.
\end{itemize}
\end{defn}

\qquad Very often, in different books and papers on first-order modal logic, there is the mentioning of the `Barcan Formula'. The following explains the connection between locally constant domain models and this formula.

\begin{defn}
Let $\M = \strucA$ be a model for $\Li$:

\begin{itemize}
\item We say that \textit{$\M$ satisfies the Barcan Formula} iff for every $\varphi \in Fml(\Li)$ of the form $\todo x \Box \psi \impli \Box \todo x\psi$, we have that $\M \models \varphi$.
\item We say that \textit{$\M$ satisfies the Converse Barcan Formula} iff for every $\varphi \in Fml(\Li)$ of the form $\Box \todo x\psi \impli \todo x \Box \psi$, we have that $\M \models \varphi$.
\end{itemize}
\end{defn}

\qquad By well-know equivalences of first-order modal logic, we have:

\begin{itemize}
\item[] $\M$ satisfies the Barcan Formula iff for every $\varphi \in Fml(\Li)$ of the form $\Diamond \ex x\psi \impli \ex x \Diamond \psi$, we have that $\M \models \varphi$.
\item[] $\M$ satisfies the Converse Barcan Formula iff for every $\varphi \in Fml(\Li)$ of the form $\ex x \Diamond \psi \impli \Diamond \ex x\psi$, we have that $\M \models \varphi$.
\end{itemize}

\begin{pro}
Let $\M = \strucA$ be a model for $\Li$:
\begin{enumerate}[(a)]
\item $\M$ is an anti-monotonic model iff $\M$ satisfies the Barcan Formula.
\item $\M$ is a monotonic model iff $\M$ satisfies the Converse Barcan Formula.
\item $\M$ is a locally constant domain model iff $\M$  satisfies the Barcan Formula and its converse.
\end{enumerate}
\end{pro}

\begin{proof}
(a) ($\Rightarrow$) Let $\varphi \in Fml(\Li)$ be a formula of the form $\todo x \Box \psi \impli \Box \todo x\psi$, $w \in \W$ and $h$ a valuation. If $\M,w \vSs \todo x \Box \psi$, then for every $x$-variant $h\p$ of $h$ at $w$ $\M,w \vSp \Box \psi$. Let $v$ be a member of $\W$ such that $w\R v$. By hypothesis, $\barD_{v} \subseteq \barD_{w}$, so every $x$-variant $h\p$ of $h$ at $v$ is an $x$-variant $h\p$ of $h$ at $w$, thus $\M,v \vSs \todo x\psi$. Since $v$ was arbitrarily chosen, $\M,w \vSs \Box \todo x \psi$, and hence $\M,w \vSs \varphi$.

\qquad ($\Leftarrow$) Suppose that $\M$ satisfies the Barcan Formula and
$\M$ is not an anti-monotonic model; then there are $w,v \in \W$ such that $w\R v$ and $\barD_{v} \nsubseteq \barD_{w}$. Hence, there is an $a \in \D$ such that $a \in \barD_{v}$ and $a \notin \barD_{w}$. Then for a valuation $h$ such that $h(y) = a$, $\M,v \vSs \ex x (x =y)$; and, since $w\R v$, $\M,w \vSs \Diamond \ex x (x =y)$.  By hypothesis, $\M,w \models \Diamond \ex x (x=y) \impli \ex x \Diamond (x =y)$. So, in particular, $\M,w \vSs \Diamond \ex x (x=y) \impli \ex x \Diamond (x =y)$; hence, $\M,w \vSs \ex x \Diamond (x =y)$. Then, there is an $x$-variant $h\p$ of $h$ at $w$ such that $\M,w \vSp \Diamond (x =y)$; so there is a $w\p \in \W$ such that $w\R w\p$ and $\M,w\p \vSp (x=y)$, hence $h\p(x) =h\p(y)$. Since $h\p(x) \in \barD_{w}$, $a \in \barD_{w}$; a contradiction. Therefore, if $\M$ satisfies the Barcan Formula, then $\M$ is an anti-monotonic model.

\qquad (b) ($\Rightarrow$) Let $\varphi \in Fml(\Li)$ be a formula of the form $\Box \todo x\psi \impli \todo x \Box \psi$, $w \in \W$ and $h$ a valuation. If $\M,w \vSs \Box \todo x\psi$, then let $v$ be a member of $\W$ such that $w\R v$; so $\M,v \vSs \todo x\psi$. Then, for every  $x$-variant $h\p$ of $h$ at $v$, $\M,v \vSp \psi$. By hypothesis, $\barD_{w} \subseteq \barD_{v}$; therefore every $x$-variant $h\p$ of $h$ at $w$ is an $x$-variant $h\p$ of $h$ at $v$, thus $\M,v \vSp \psi$ for every $x$-variant $h\p$ of $h$ at $w$. Since $v$ was arbitrarily chosen, $\M,w \vSs \Box \psi$ for every $x$-variant $h\p$ of $h$ at $w$. So $\M,w \vSs \todo x \Box \psi$ and hence $\M,w \vSs \varphi$.

\qquad ($\Leftarrow$) Suppose that $\M$ satisfies the Converse Barcan Formula and $\M$ is not a monotonic model; then there are $w,v \in \W$ such that $w\R v$ and $\barD_{w} \nsubseteq \barD_{v}$. Hence, there is an $a \in \D$ such that $a \in \barD_{w}$ and $a \notin \barD_{v}$. So for a valuation $h$ such that $h(x)=a$, $\M,v \vSs \todo y (y \neq x)$, and since $w\R v$, $\M,w \vSs \Diamond \todo y (y\neq x)$ and so $\M,w \models \ex x \Diamond \todo y (y\neq x)$. By hypothesis, $\M,w\models \ex x \Diamond \todo y (y\neq x) \impli \Diamond \ex x \todo y (y\neq x)$. So,  $\M,w\models \Diamond \ex x \todo y (y\neq x)$. Thus there is a $w\p \in \W$ such that $w\R w\p$ and $\M,w\p \models \ex x \todo y (y\neq x)$; this clearly implies a contradiction. Therefore, if $\M$ satisfies the Converse Barcan Formula, then $\M$ is a monotonic model.

\qquad (c) The result follows directly from (a) and (b).
\end{proof}

\qquad Strictly speaking, both the Barcan Formula and the Converse Barcan Formula are not formulas, they are formula schemes. So it is natural to ask if there is a formula which has the same `expressive power' as the Barcan Formula and the Converse Barcan Formula. In fact, dealing with S5-models we can find this formula.

\begin{pro}
Let $\M = \strucA$ be an S5-model for $\Li$, then:
\begin{center}
$\M \models \Box \todo x \Box \ex y (y=x)$ iff $\M$ satisfies the Barcan Formula and its converse.
\end{center}
\end{pro}

\begin{proof}
($\Rightarrow$) Let $w$ and $v$ be members of $\W$ such that $w \R v$. If $a \in \barD_{w}$, then since $\M,w \models \Box\todo x \Box \ex y (y=x)$ and $w\R w$, we have that $\M,w \models \todo x \Box \ex y (y=x)$. In particular, for a valuation $h$ such that $h(x) = a$, $\M,w \vSs \Box \ex y (y=x)$. Then, $\M,v \vSs \ex y (y=x)$. So there is an $x$-variant $h\p$ of $h$ at $v$ such that $\M,v \vSp y=x$, thus $h\p (y) = h\p (x)$ and so $a \in \barD_{v}$. Hence, $\barD_{w} \subseteq \barD_{v}$. We can prove that $\barD_{v} \subseteq \barD_{w}$ in a similar way. Therefore, $\M$  is a locally constant domain model; by Proposition 3, $\M$ satisfies the Barcan Formula and its converse.

\qquad ($\Leftarrow$) Suppose that $\M$ satisfies the Barcan Formula and its converse and there is a $w \in \W$ such that $\M,w \not\models \Box \todo x \Box \ex y (y=x)$. So, for some valuation $h$, $\M,w \nvSs \Box \todo x \Box \ex y (y=x)$. By Proposition 3, $\M$  is a locally constant domain model; and by equivalences of first-order modal logic, $\M,w \vSs \Diamond \ex x \Diamond \todo y (y \neq x)$. Hence there is a $v \in \W$ such that $w\R v$ and $\M,v \vSs \ex x \Diamond \todo y (y \neq x)$. So there is an $x$-variant $h\p$ of $h$ at $v$ such that $\M,v \vSp \Diamond \todo y (y \neq x)$. Then there is a $w\p \in \W$ such that $v\R w\p$ and $\M,w\p \vSp \todo y (y \neq x)$. Therefore, $h\p(x) \in \barD_{v}\backslash\barD_{w\p}$;  contradicting the assumption that $\M$  is a locally constant domain model.
\end{proof}

\section{First-order S5: two versions}

\qquad Before we advance, we need to address some technical details concerning S5-models. In order to save time we are going to skip the proofs of the propositions in this section.

\qquad First, since $\R$ is an equivalence relation in an S5-model, all the different notions of monotonic, anti-monotonic and locally constant domain model become equivalent when we work with an S5-model. Therefore, we shall only distinguish between locally constant domain models and \textit{varying domain models} (models with no restriction on the domains).

\qquad Second, the distinction between constant domain models and locally constant domain models can be dropped. Of course, as mathematical structures constant domain models and locally constant domain models are very different objects. But from the point of view of modal formulas they are the same. The following proposition states this fact more clearly:

\begin{pro}
Let $\varphi$ be a formula of $\Li$. $\varphi$ is valid in the class of constant domain models for $\Li$ iff $\varphi$ is valid in the class of locally constant domain models for $\Li$.
\end{pro}

\qquad Third, sometimes both for technical and theoretical reasons it is more useful to deal with universal models instead of S5-models. And as before, although they are different mathematical structures, from the point of view of the valid formulas we can take them as the same:

\begin{pro}
Let $\varphi$ be a formula of $\Li$. $\varphi$ is valid in the class of universal models for $\Li$ iff $\varphi$ is valid in the class of S5-models for $\Li$.
\end{pro}

\qquad We can now define the two main kinds of models that we are going to work with. Propositions 5 and 6 serve to show the non-arbitrariness of the following definition and to connect it with the results of the previous section.

\begin{defn}
For a fixed language $\Li$ we say that:
\begin{itemize}

\item a \textit{model for first-order S5 with constant domains}, denoted FOS5-model, is a universal and constant domain model.

\item a \textit{model for first-order S5 with varying domains}, denoted FOS5V-model, is a universal and varying domain model.

\end{itemize}

\end{defn}

\qquad The following definitions apply both to FOS5 and FOS5V models; to avoid duplication of definitions we use L as a variable for FOS5 and FOS5V.  From now on, when dealing with FOS5V-models we omit the accessibility relation, and when working with FOS5-models we omit the $\barD$ function too.

\pagebreak
\begin{defn}
Let $\Li$ be a language and let $\{\varphi\}, \{\psi\}$ and $\Gamma$ be sets of sentences of $\Li$:

\begin{itemize}
\item $\varphi$ is \textit{L-valid}, in symbols $\vSL \varphi$, iff $\varphi$ is valid in the class of L-models. We say that $\varphi$ is \textit{L-satisfiable} iff there is an L-model $\M$ and a world $w$ of $\M$ such that $\M,w \models \varphi$. And we say that $\varphi$ is \textit{L-unsatisfiable} iff $\nao \varphi$ is L-valid.
\item $\varphi$ is a \textit{consequence of $\Gamma$ in L}, in symbols $\Gamma \vSL \varphi$, iff for every pair $\M,w$, if $\M,w$ is an L-model for $\Gamma$, then $\M,w \models \varphi$. Instead of $\{\psi\} \vSL \varphi$ we write $\psi \vSL \varphi$.
\end{itemize}
\end{defn}

\qquad For example, from propositional modal logic it is well-known that:

\begin{center}
$\vSL \Box (\varphi \impli \psi) \impli (\Box \varphi \impli \Box \psi)$\\
$\vSL \Box \varphi \impli \varphi$\\
$\vSL \Box \varphi \impli \Box \Box \varphi$\\
$\vSL \nao \Box \varphi \impli \Box \nao \Box \varphi$\\
\end{center}

\qquad And using what we have seen so far, we have:

\begin{center}
$ \vS \Box \todo x \Box \ex y (y=x) \impli (\Box \todo x Px \see  \todo x \Box Px)$\\
$\vSB  \Box \todo x Px \see  \todo x \Box Px$\\
\end{center}

\qquad These last two examples are just instances of a more general fact that is an immediate consequence of Propositions 3 and 4.

\begin{pro}
A sentence $\varphi$ of $\Li$ is FOS5-valid iff $\Box \todo x \Box \ex y (y=x) \impli \varphi$ is FOS5V-valid.
\end{pro}

Now we have all the ingredients to present a notion of logic.

\begin{defn}
The logic L is a tuple $\bl Lan, \vSL\br$ where $Lan$ is a function which associates to every language $\Li$ a set $sen(\Li)$, the set of sentences of $\Li$; and $\vSL$ is the relation as defined above.
\end{defn}

\qquad A last basic topic worth noticing is that we can define an unary relation symbol $E$ such that $Ex$ expresses that the individual denoted by $x$ exists in the world in question. The definition of this relation, often called \textit{existence predicate},  is:

\begin{center}
$Ex:= \ex y (y=x) $
\end{center}

\qquad Obviously, $\M,w \vSs Ex$ iff $h(x) \in \barD_{w}$. The following proposition states some useful facts about the relation $\models$ and $Ex$.

\begin{pro}
For a formula $\varphi$ of $\Li$ such that $fv(\varphi) = \{x_1, \dots, x_n\}$, let $E\vec{x}$ be an abbreviation of $Ex_{1} \e \dots \e Ex_{n}$, then:
\begin{itemize}
\item $\vS \todo \vec{x}\varphi$ iff $\vS (E\vec{x} \impli \varphi)$.
\item $\vSB \todo \vec{x}\varphi$ iff $\vSB \varphi$.
\item If $\vS\varphi$, then $\vS \todo \vec{x}\varphi$.
\end{itemize}
\end{pro}


\subsection{Polynomials}\label{subsec:polynomials}

\begin{remark}\label{rem:polynomials_vs_polynomial_functions}
  Polynomial are a purely algebraic framework for describing certain well-behaved functions. The link between a polynomial and a function is given by \fullref{def:polynomial_function}, but in general these are different concepts. The link between a polynomial and its conventional symbolic expression is given by \fullref{def:algebra_of_polynomials}.

  \Fullref{thm:polynomial_embedding_behavior} allow us to ignore this distinction in most applications of polynomials outside of algebra.
\end{remark}

\begin{definition}\label{def:polynomial}\mcite[149]{Knapp2016BasicAlgebra}
  A \term{polynomial} \( p \) over \( R \) is a sequence of members of \( R \) called \term{coefficients},
  \begin{equation*}
    p \coloneqq ( a_0, a_1, a_2, \ldots ) \subseteq R,
  \end{equation*}
  such that only finitely many coefficients are nonzero. We can regard \( p \) as a \hyperref[def:topological_net]{net} over \( \BbbZ_{\geq 0} \) with finite \hyperref[def:function_support]{support}.

  \begin{thmenum}
    \thmitem{def:polynomial/zero_polynomial} An exception to most rules is the \term{zero polynomial}, all of whose coefficients are zeroes.

    \thmitem{def:polynomial/leading_coefficient} The last nonzero coefficient of a nonzero polynomial is called the \term{leading coefficient} and is denoted by \( \op{LC}(p) \). If \( \op{LC}(p) = 1 \), we call the polynomial \term{2}.

    \thmitem{def:polynomial/degree} The zero-based index of the leading coefficient is called the \term{degree} of the polynomial as is denoted by \( \deg(p) \). That is, if only \( a_0 \) is nonzero, then \( \deg(p) = a_0 \). The degree of the zero polynomial is left undefined.

    \thmitem{def:polynomial/monomial} A \term{monomial} is a polynomial with only one nonzero element.

    \thmitem{def:polynomial/degree_names} Polynomials of degree \( n \) with special names include
    \begin{itemize}
      \item \term{constant} for the zero polynomial or if \( n = 0 \).
      \item \term{linear} if \( n = 1 \).
      \item \term{quadratic} if \( n = 2 \).
      \item \term{cubic} if \( n = 3 \).
      \item \term{quartic} if \( n = 4 \).
      \item \term{quintic} if \( n = 5 \).
    \end{itemize}
  \end{thmenum}
\end{definition}

\begin{definition}\label{def:algebra_of_polynomials}
  Denote by \( R[X] \) the set of polynomials over \( R \). Note that it is bijective with \( c_{00} \), and we can inherit pointwise addition and scalar multiplication from there. That is,

  \begin{thmenum}
    \thmitem{def:algebra_of_polynomials/addition} We define \term{polynomial addition} point as
    \begin{balign*}
       & +: R[X] \times R[X] \to R[X]                                                     \\
       & (a_0, a_1, \ldots) + (b_0, b_1, \ldots) \coloneqq (a_0 + b_0, b_0 + b_1, \ldots)
    \end{balign*}

    \thmitem{def:algebra_of_polynomials/scalar_multiplication} We define \term{scalar multiplication} as
    \begin{balign*}
       & \cdot: R[X] \times R[X] \to R[X]                            \\
       & t \cdot (a_0, a_1, \ldots) \coloneqq (t a_0, t b_1, \ldots)
    \end{balign*}

    \thmitem{def:algebra_of_polynomials/polynomial_multiplication} In order to make \( R[X] \) into an \hyperref[def:algebra_over_ring]{algebra}, we define \term{Cauchy multiplication} \( \odot: R[X] \times R[X] \to R[X] \) as follows: if \( (a_0, a_1, \ldots) \) and \( (b_0, b_1, \ldots) \) are polynomials, their product is defined to be the polynomial with coefficients
    \begin{equation}
      c_l \coloneqq \sum_{i+j=l} a_i b_j, l = 0, 1, \ldots
    \end{equation}

    Polynomial multiplication is bilinear, associative and commutative.
  \end{thmenum}

  We will implicitly use the canonical embedding \( \iota: R \to R[X] \), which sends an element \( r \) of \( R \) into the constant polynomial \( p(X) \coloneqq r \).

  We usually refer to \( R[X] \) as the \term{polynomial ring}, especially since scalar multiplication is the same multiplication by constants.
\end{definition}

\begin{remark}\label{rem:polynomial_symbolic_expression}
  We choose a \hyperref[def:formal_language]{symbol}, usually \( X \), called an \term{indeterminate}, and give it \hyperref[def:first_order_semantics/satisfiability]{semantics} using the \hyperref[def:polynomial/monomial]{monomial}
  \begin{equation*}
    X \coloneqq (0, 1, 0, 0, \ldots)
  \end{equation*}
  (the assignment should be understood as \enquote{defining the interpretation of \( X \) in a certain first-order language}).

  Using the definition of multiplication, we see that the coefficients \( c_0, c_1, \ldots \) of \( X^2 = X \cdot X \) can be expressed in terms of the coefficients \( a_0, a_1, \ldots \) of \( X \) as
  \begin{balign*}
    c_0 & = a_0 \cdot a_0 = 0                                                                 \\
    c_1 & = a_0 \cdot a_1 + a_1 \cdot a_0 = 0 + 0 = 0                                         \\
    c_2 & = a_0 \cdot a_2 + a_1 \cdot a_1 + a_2 \cdot a_0 = 0 + 1 + 0 = 1                     \\
    c_3 & = a_0 \cdot a_3 + a_1 \cdot a_2 + a_2 \cdot a_1 + a_0 \cdot a_3 = 0 + 0 + 0 + 0 = 0 \\
    c_4 & = \cdots = 0                                                                        \\
    c_5 & = \cdots = 0                                                                        \\
    \vdots
  \end{balign*}

  Proceeding by induction, we see that \( X^k \) corresponds to the sequence
  \begin{equation*}
    (\underbrace{0, 0, \ldots, 0, 0}_{k \text{times}}, 1, 0, 0, \ldots).
  \end{equation*}

  We define \( X^0 \coloneqq 1 \).

  It is conventional to then write a polynomial of degree \( n \) as the \hyperref[def:formal_language]{expression}
  \begin{equation}\label{eq:rem:polynomial_symbolic_expression}
    p(X) = a_n X^n + a_{n-1} X^{n-1} + \ldots + a_2 X^2 + a_1 X + a_0 = \sum_{i=0}^n a_i X^i
  \end{equation}
  and the zero polynomial as
  \begin{equation*}
    p(X) \coloneqq 0.
  \end{equation*}

  We use capital letters to highlight that this is not a function - see \fullref{def:polynomial_function}. We say that \( p(X) \) is a polynomial in one indeterminate.
\end{remark}

\begin{proposition}\label{thm:def:polynomial_degree/properties}
  The polynomial degree has the following basic properties:
  \begin{thmenum}
    \thmitem{thm:def:polynomial_degree/properties/sum} For nonzero polynomials \( p, q \in R[X] \) with \( p \neq -q \), we have
    \begin{equation*}
      \deg (p + q) \leq \max \{ \deg p, \deg q \}.
    \end{equation*}

    \thmitem{thm:def:polynomial_degree/properties/product} For nonzero polynomials \( p, q \in R[X] \) with \( pq \neq 0 \), we have
    \begin{equation*}
      \deg (pq) \leq \deg p + \deg q,
    \end{equation*}
    with equality holding if \( R \) is an integral domain.

    The requirement that \( pq \neq 0 \) may also be dropped if \( R \) is an integral domain as per \fullref{thm:polynomials_over_integral_domain_are_integral_domain}.
  \end{thmenum}
\end{proposition}
\begin{proof}
  Fix nonzero polynomials
  \begin{align}
    p(X) &\coloneqq \sum_{k=0}^n a_k X^k, \label{eq:thm:def:polynomial_degree/properties/p} \\
    q(X) &\coloneqq \sum_{k=0}^m b_k X^k. \label{eq:thm:def:polynomial_degree/properties/q}
  \end{align}

  \SubProofOf{thm:def:polynomial_degree/properties/sum} Additionally assume that \( p \neq -q \) since otherwise \( p + q = 0 \) and \( \deg(p + q) \) is undefined. Thus, there exists at least one index \( k = 1, 2, \ldots \), so that \( a_k \neq b_k \). Denote by \( k_0 \) the largest such index (only finitely many are nonzero). Then
  \begin{equation*}
    a_k = b_k = 0 \T{for} k > k_0.
  \end{equation*}

  Therefore, \( \deg(p + q) = k_0 \). Note that \( k_0 \) cannot exceed both \( \deg p \) and \( \deg q \) because it corresponds to a nonzero coefficient. Thus, \( k \leq \max\{ \deg p, \deg q \} \).

  \SubProofOf{thm:def:polynomial_degree/properties/product} By assumption \( pq \neq 0 \), so there exists at least one nonzero coefficient, say \( c_k \). Obviously \( k \leq \deg p + \deg q \) since the highest possible degree of \( pq \) is \( \deg p + \deg q \). Thus,
  \begin{equation*}
    k = \deg (pq) \leq \deg p + \deg q.
  \end{equation*}

  If \( R \) is an integral domain, the product of nonzero elements is nonzero. Thus, the leading coefficient \( \op{LC}(pq) = \op{LC}(p)\op{LC}(q) \) is nonzero and
  \begin{equation*}
    \deg(pq) = \deg p + \deg q.
  \end{equation*}
\end{proof}

\begin{proposition}\label{thm:polynomial_ring_universal_property}\mcite[150]{Knapp2016BasicAlgebra}
  For any nontrivial commutative unital ring \( T \), any unital ring homomorphism \( \varphi: R \to T \) and any \( t \in T \), there exists a unique homomorphism \( \Phi_t: R[X] \to T \) such that \( \iota(1) = t \) and the following diagram commutes:

  \begin{alignedeq}\label{thm:polynomial_ring_universal_property/diagram}
    \includegraphics[page=1]{output/thm__polynomial_ring_universal_property.pdf}
  \end{alignedeq}

  We call the map \( \Phi_t \) a \term{substitution homomorphism}.

  If \( T \) is a superring of \( R \), we call \( \Phi_t \) an \term{evaluation} at \( t \in T \). We also write
  \begin{equation}
    R[t] \coloneqq \Phi_t(R[X]).
  \end{equation}

  This allows us to \term{adjoin} elements from a superring to a subring. See \fullref{ex:polynomial_evaluation_gaussian_integers}.
\end{proposition}
\begin{proof}
  We will first prove uniqueness. Let \( \Phi_t: R[X] \to T \) and \( \Psi_t: R[X] \to T \) are two such homomorphisms and take their difference \( \Theta_t \coloneqq \Phi_t - \Psi_t \).

  Then for \( r \in R \) we have
  \begin{equation*}
    \Theta_t(\iota(r)) = \Psi_t(\iota(r)) - \Psi_t(\iota(r)) = \varphi(r) - \varphi(r) = 0.
  \end{equation*}

  Now since for any polynomial we have \( p = \iota(1) p \) and since \( \Theta_t \) is a homomorphism of rings, we have
  \begin{equation*}
    \Theta_t(p) = \Theta_t(\iota(1) p) = 0 \Theta_t(p) = 0.
  \end{equation*}

  Thus, \( \Theta_t = 0 \) and \( \Phi_t = \Psi_t \).

  Now we will show existence. Take a polynomial
  \begin{equation*}
    p = (a_0, a_1, \ldots, a_n, 0, 0, \ldots).
  \end{equation*}

  Define
  \begin{equation*}
    \Phi_t(p) \coloneqq \sum_{i=1}^n \phi(a_0) t^i.
  \end{equation*}

  By additivity, \( \Phi_t: R[X] \to T \) is obviously a homomorphism and \( \Phi_t((0, 1, 0, \ldots)) = t \). Therefore, we have proven existence.
\end{proof}

\begin{example}\label{ex:polynomial_evaluation_gaussian_integers}
  The Gaussian \hyperref[def:gaussian_integers]{integers} \( \BbbZ[i] \) are complex numbers with integer real and complex parts. We will now motivate this notation.

  Consider the substitution map \( \Phi_i: \BbbZ[X] \to \BbbC \) for the imaginary unit given by \fullref{thm:polynomial_ring_universal_property}. Let \( p(X) \in \BbbZ[X] \). Then
  \begin{equation*}
    p(i)
    =
    \Phi_i(p)
    =
    \sum_{j=0}^n a_j i^n
    =
    \sum_{\rem(j, 4) = 0}^n a_j - \sum_{\rem(j, 4) = 2}^n a_j + i \left(\sum_{\rem(j, 4) = 1}^n a_j - \sum_{\rem(j, 4) = 3}^n a_j \right).
  \end{equation*}

  This is clearly a Gaussian integer.

  Now fix a Gaussian integer \( z = a + bi \). It can be given by the polynomial
  \begin{equation*}
    p_z(X) \coloneqq a + bX.
  \end{equation*}

  It remains to show that multiplication in \( \BbbZ[X] \) is compatible with multiplication in \( \BbbC \). But complex \hyperref[def:set_of_complex_numbers]{multiplication} is defined to be compatible with the notation \( a + bi \), that is,
  \begin{equation*}
    (a + bi) (c + di)
    =
    ac + ibc + iad - bd
    =
    (ac - bd) + i(bc + ad).
  \end{equation*}

  Thus, the Gaussian integers are precisely the homomorphic image of \( Z[X] \) under \( \Phi_i \).
\end{example}

\begin{proposition}\label{thm:polynomial_ring_units}
  The units of the polynomial ring \( R[X] \) are precisely the units of \( R \).
\end{proposition}
\begin{proof}
  Any unit of \( R \) is obviously a unit of \( R[X] \).

  For the converse, fix a nonzero constant polynomial \( p(X) = r \). In order for it to have an inverse \( q(X) \), we should have
  \begin{equation*}
    1 = p(X) q(X) = r q(X),
  \end{equation*}
  which can only happen if \( q(X) \) is a constant and a multiplicative inverse of \( r \).
\end{proof}

\begin{proposition}\label{thm:polynomial_algebra_basis}
  The polynomial \hyperref[def:algebra_of_polynomials]{algebra} \( R[X] \) has a Hamel \hyperref[def:left_module_hamel_basis]{basis} consisting of all \hyperref[def:polynomial/monomial]{monomials}
  \begin{equation*}
    B \coloneqq \{ 1, X, X^2, X^3, \ldots \}.
  \end{equation*}
\end{proposition}
\begin{proof}
  By \fullref{def:algebra_of_polynomials/addition}, every polynomial can easily be represented as a sum of finitely many monomials.
\end{proof}

\begin{definition}\label{def:polynomial_free_module}
  It is convenient, especially in \hyperref[sec:approximation_theory]{approximation theory}, to work with the free module of polynomials of degree at most \( n \). We define
  \begin{equation*}
    \pi_n(R[X]) \coloneqq \linspan \{ 1, X, \ldots, X^{n-1}, X^n \}.
  \end{equation*}

  We will use \( \pi_n \) and when the ring is clear from the context.
\end{definition}

\begin{proposition}\label{thm:polynomials_over_integral_domain_are_integral_domain}
  If \( R \) is an integral domain, the polynomial ring \( R[X] \) is also an integral domain.
\end{proposition}
\begin{proof}
  Polynomial multiplication inherits its commutativity from multiplication in \( R \). It remains only to show that \( R[X] \) has no zero divisors.

  Fix two polynomials \( p, q \in R[X] \). If either of them is zero, their product \( pq \) is zero.

  Assume that both are nonzero polynomials. The leading coefficient of their product is, by definition of multiplication, \( \op{LC}(pq) = \op{LC}(p) \op{LC}(q) \). Since \( R \) has no zero divisors, then \( \op{LC}(pq) \neq 0 \) and thus \( pq \) is a nonzero polynomial.

  Therefore, \( R[X] \) is an integral domain.
\end{proof}

\begin{proposition}\label{thm:polynomials_over_unique_factorization_domain_are_unique_factorization_domain}
  If \( R \) is a unique factorization domain, the polynomial ring \( R[X] \) is also a unique factorization domain.
\end{proposition}

\begin{theorem}[Euclidean division of polynomials]\label{thm:euclidean_division_of_polynomials}\mcite[10]{Knapp2016BasicAlgebra}
  Let \( a, b \in R[X] \) and \( b \) be \hyperref[def:polynomial/leading_coefficient]{monic} (in particular, \( b \neq 0 \)). Then there exist unique polynomials \( q, r \in R[X] \), where \( r \) is either zero or \( \deg r < \deg b \), such that
  \begin{equation*}
    a = bq + r.
  \end{equation*}
\end{theorem}
\begin{proof}
  Let \( a, b \in R[X] \) and \( b \neq 0 \). If \( a = 0 \) or \( \deg a < \deg b \), define
  \begin{balign*}
    q & \coloneqq 0, \\
    r & \coloneqq a.
  \end{balign*}

  In this case, \( \deg r = \deg a < \deg b \).

  Suppose that \( \deg b \leq \deg a \). We will use proof by induction on \( \deg a \). If \( \deg a = 0 \), obviously \( \deg b = 0 \) (thus \( b = 1 \)) and we define
  \begin{balign*}
    q & \coloneqq a, \\
    r & \coloneqq 0.
  \end{balign*}

  In this case, \( r \) is the zero polynomial.

  Assume the result holds for \( \deg a < n \) and let \( \deg a = n, \deg b = m \). Then there exists a polynomial \( \hat a(X) \) that is either zero or \( \deg \hat a = n - 1 \) such that
  \begin{equation*}
    a(X) = a_n a^n + \hat a(X).
  \end{equation*}

  Analogously, we find \( \hat b(X) \) that is either zero or \( \deg \hat b = m - 1 \) such that
  \begin{equation*}
    b(X) = X^m + \hat b(X).
  \end{equation*}

  Thus,
  \begin{balign*}
    \hat r(X)
     & \coloneqq
    a(X) - b(X) a_n X^{n-m}
    =            \\ &=
    a_n X^n + \hat a(X) - (b_m X^m + \hat b(X)) a_n X^{n-m}
    =            \\ &=
    a_n X^n + \hat a(X) - a_n X^n - \hat b(X) a_n X^{n-m}
    =            \\ &=
    \hat a(X) - \hat b(X) a_n X^{n-m}.
  \end{balign*}

  Therefore, \( \hat r(X) \) is either the zero polynomial (in which case we define \( r(X) \coloneqq \hat r(X) \)) or \( \deg \hat r \leq n - 1 \). In the latter case, we can divide \( \hat r \) by \( b \) to obtain \( \hat q(X) \) and \( r(X) \) such that
  \begin{equation*}
    \hat r(X) \coloneqq b(X) \hat q(X) + r(X),
  \end{equation*}
  where \( r = 0 \) or \( \deg r < \deg b \).

  Substitute into the definition of \( \hat r(X) \):
  \begin{balign*}
    \hat r(X)                                         & = a(X) - b(X) a_n X^{n-m} \\
    b(X) \hat q(X) + r(X)                             & = a(X) - b(X) a_n X^{n-m} \\
    b(X) \left(\hat q(X) - a_n X^{n-m} \right) + r(X) & = a(X).
  \end{balign*}

  Define
  \begin{equation*}
    q(X) \coloneqq \hat q(X) - a_n X^{n-m}.
  \end{equation*}

  We have obtained polynomials \( r(X) \) and \( q(X) \) where \( r(X) \) is either zero or \( \deg r < \deg b \).

  It remains only to show uniqueness. Suppose that
  \begin{equation*}
    a = bq + r = bq' + r'.
  \end{equation*}

  If \( r - r' \) is the zero polynomial, so is \( q - q' \), and uniqueness follows.

  If \( r - r' \) is not zero, then neither is \( q - q' \). Then \( b(q - q') = -(r - r') \) and
  \begin{equation*}
    \deg b + \deg(q - q') = \deg[b (q - q')] = \deg(r - r') \leq \max(\deg r, \deg r') < \deg b,
  \end{equation*}
  which is a contradiction.

  This proves uniqueness.
\end{proof}

\begin{corollary}\label{thm:polynomials_over_field_are_euclidean_domain}\mcite[10]{Knapp2016BasicAlgebra}
  The polynomial \hyperref[def:semiring/integral_domain]{ring} \( \BbbK[X] \) over a field \( \BbbK \) is an \hyperref[def:semiring/euclidean_domain]{Euclidean} domain with \( \delta(p) \coloneqq \deg p \). Furthermore, the remainder and quotient are unique.
\end{corollary}
\begin{proof}
  By \fullref{thm:polynomials_over_integral_domain_are_integral_domain}, \( \BbbK[X] \) is an integral domain.

  To show that it is Euclidean, fix two polynomials \( a, b \in \BbbK[X] \) with \( b \neq 0 \). We use \fullref{thm:euclidean_division_of_polynomials} to perform Euclidean division of \( a \) by the monic polynomial \( \frac {b} {\op{LC}(b)} \) and obtain polynomials \( q, r \), where either \( r = 0 \) or \( \deg r < \deg b \), such that
  \begin{equation*}
    a = \frac {b} {\op{LC}(b)} q + r.
  \end{equation*}

  Instead of dividing \( b \) by its leading coefficient \( \op{LC}(b) \), we can divide \( q \) and thus obtain the required factorization.
\end{proof}

\begin{definition}\label{def:polynomial_function}
  Denote by \( \cat{Set}(R) \) the ring of all functions over \( R \) (see \fullref{thm:functions_over_ring_form_algebra}). Define the unital ring homomorphism
  \begin{balign*}
     & \Phi: R[X] \to \cat{Set}(R)                                                                      \\
     & \Phi((a_0, a_1, \ldots, a_n, 0, 0, \ldots)) \coloneqq \left( x \to \sum_{i=0}^n a_i x^n \right),
  \end{balign*}
  which constructs a \term{polynomial function} from a polynomial. This map is not injective in general and multiple polynomials may be equivalent as \hyperref[def:function]{functions}.

  If we want to highlight that we are referring to a polynomial function rather than a polynomial \( p(X) \), we usually use a lowercase letter for the variable, i.e.
  \begin{equation*}
    p(x) = \sum_{i=0}^n a_i x^i.
  \end{equation*}

  If the ring is \hyperref[def:set_finiteness]{infinite}, \fullref{thm:polynomial_embedding_behavior} allows us to set aside the difference between polynomials and polynomial functions and we usually identify the two when working over \( \BbbR \) or \( \BbbC \).
\end{definition}
\begin{proof}
  It is obvious that \( \Phi \) is a homomorphism of the additive groups of \( R \) and \( \cat{Set}(R) \).

  We will prove that multiplication of polynomials corresponds to multiplication of polynomial functions. Take
  \begin{balign*}
    p(X) & \coloneqq \sum_{i=0}^n a_i X^i, \\
    q(X) & \coloneqq \sum_{j=0}^m b_j X^j.
  \end{balign*}

  For their product \( s(X) = \sum_{i=0}^{n + m} c_i X^i \) by definition we have
  \begin{equation*}
    c_l = \sum_{i+j=l} a_i b_j, l = 0, 1, \ldots, n + m.
  \end{equation*}

  We need to show that for any \( r \in R \),
  \begin{equation*}
    \Phi_r(p) \Phi_r(q) = \Phi_r(s).
  \end{equation*}

  Using associativity and commutativity of multiplication and distributivity of multiplication over addition, we obtain
  \begin{balign*}
    \Phi_r(p) \Phi_r(q)
     & =
    \left( \sum_{i=0}^n a_i r^i \right) \left( \sum_{j=0}^m b_j r^j \right)
    =    \\ &=
    \sum_{i=0}^n a_i r^i \left( \sum_{j=0}^m b_j r^j \right)
    =    \\ &=
    \sum_{i=0}^n a_i r^i \left( \sum_{j=0}^m b_j r^j \right)
    =    \\ &=
    \sum_{i=0}^n \sum_{j=0}^m a_i r^i b_j r^j
    =    \\ &=
    \sum_{i=0}^n \sum_{j=0}^m a_i b_j r^{i + j}
    =    \\ &=
    \sum_{l=0}^{n + m} \sum_{i+j=l} a_i b_j r^l
    =    \\ &=
    \sum_{l=0}^{n + m} c_l r^l
    =
    \Phi_r(s),
  \end{balign*}
  where we have used that \( a_i = 0, i > n \) and \( b_j = 0, j > m \).

  Thus, \( \Phi: R[X] \to \fun(R) \) is indeed a homomorphism of rings.
\end{proof}

\begin{definition}\label{def:formal_power_series}
  If we extend \fullref{def:polynomial} to allow for polynomial with infinite terms (that is, allow for the sequence to have infinitely many nonzero items), we obtain a set \( R\Bracks{X} \) which we call the \term{formal power series} over \( R \).

  Note that the operations in \fullref{def:algebra_of_polynomials} are well-defined and still make \( R\Bracks{X} \) into an algebra. Evaluation (see \fullref{thm:polynomial_ring_universal_property} and \fullref{def:polynomial_function}) is problematic, however, since algebraic operations are finitary by nature. In practice, we use a topology over \( R \) and speak of convergent and divergent power series.
\end{definition}

\begin{theorem}[Newton's binomial theorem]\label{thm:binomial_theorem}
  \begin{equation*}
    (X + Y)^n = \sum_{k=0}^n \binom n k X^k Y^{n-k}
  \end{equation*}
\end{theorem}
\begin{proof}
  We use induction on \( n \). For \( n = 0 \), the theorem trivially holds. Assume that the theorem holds for \( 1, \ldots, n \). Then
  \begin{balign*}
    (X + Y)^{n+1}
     & =
    X (X + Y)^n + Y (X + Y)^n
    =    \\ &=
    \sum_{k=0}^n \binom n k X^{k+1} Y^{n-k} + Y \sum_{k=0}^n \binom n k X^k Y^{n-k}
    =    \\ &=
    X^{n+1} + Y \sum_{k=0}^{n-1} \binom n k X^{k+1} Y^{n-(k+1)} + Y \sum_{k=0}^n \binom n k X^k Y^{n-k}
    =    \\ &=
    X^{n+1} + Y \left[ \sum_{k=1}^n \binom n {k-1} X^k Y^{n-k} + Y^n \sum_{k=1}^n \binom n k X^k Y^{n-k} \right] + Y^{n+1}
    =    \\ &\reloset {\ref{thm:pascals_identity}} =
    X^{n+1} + Y \sum_{k=1}^n \binom {n+1} k X^k Y^{n-k} + Y^{n+1}
    =    \\ &=
    \sum_{k=0}^n \binom {n+1} k X^k Y^{(n+1)-k}.
  \end{balign*}
\end{proof}

\begin{proposition}\label{thm:xn_minus_one_factorization}
  For any nonnegative \( n \) we have
  \begin{equation}\label{eq:thm:xn_minus_one_factorization}
    X^{n + 1} - 1 = (X - 1)(X^n + X^{n-1} + \cdots + 1) = (X - 1) \sum_{k=0}^n X^k.
  \end{equation}
\end{proposition}
\begin{proof}
  We use induction on \( n \).
  \begin{itemize}
    \item For \( n = 0 \) we have
    \begin{equation*}
      X^1 - 1 = X - 1 = (X - 1) 1.
    \end{equation*}

    \item If for some fixed \( n \)
    \begin{equation*}
      X^{n + 1} - 1 = (X - 1) \sum_{k=0}^n X^k,
    \end{equation*}
    then
    \begin{balign*}
      X^{n + 2} - 1
      &=
      X(X^{n + 1} - 1) + (X - 1)
      \reloset {\T{ind.}} = \\ &=
      X (X - 1) \sum_{k=0}^n X^k + (X - 1)
      = \\ &=
      (X - 1) \parens*{ X \sum_{k=0}^n X^k + 1 }
      = \\ &=
      (X - 1) \sum_{k=0}^{n + 1} X^k.
    \end{balign*}
  \end{itemize}
\end{proof}

\begin{proposition}\label{thm:polynomial_root_iff_divisible}
  The value \( u \in R \) is a \hyperref[def:semiring_kernel]{root} of the polynomial function \( p(x) \) if any only if the polynomial \( (X - u) \) divides \( p(X) \).
\end{proposition}
\begin{proof}
  \SufficiencySubProof Suppose that \( u \in R \) is a root of \( p(x) \). By \fullref{thm:euclidean_division_of_polynomials}, we can divide \( p(X) \) by the monic polynomial \( (X - u) \):
  \begin{equation*}
    p(X) = (X - u) q(X) + r(X).
  \end{equation*}

  Assume that \( r(X) \) is nonzero. Evaluating \( p(X) \) at \( u \) gives us
  \begin{equation*}
    0 = p(u) = (u - u) q(r) + r(u),
  \end{equation*}
  hence \( u \) is a root of \( r(X) \). But \( \deg r < \deg (X - u) = 1 \), that is, \( r \) is a nonzero constant and cannot have roots. The obtained contradiction proves the statement.

  \NecessitySubProof Suppose that \( (X - u) \) divides \( p(X) \) with quotient \( q(X) \). Then
  \begin{equation*}
    p(X) = (X - u) q(X).
  \end{equation*}

  Evaluation at \( u \) gives us
  \begin{equation*}
    p(u) = (u - u) q(u) = 0.
  \end{equation*}

  Therefore, \( u \) is a root of \( p(X) \).
\end{proof}

\begin{definition}\label{def:polynomial_root_multiplicity}
  We say that the polynomial \( p \in R[X] \) has the root \( r \in R \) with multiplicity \( m \in \BbbZ_{>0} \) if there exists a polynomial \( q \in R[X] \) of degree \( \deg q = \deg p - m \) such that \( (X - r) \) does not divide \( q(X) \) and
  \begin{equation*}
    p(X) = (X - r)^m q(X).
  \end{equation*}
\end{definition}

\begin{proposition}\label{thm:integral_domain_polynomial_root_limit}
  If \( R \) is an integral domain, a nonzero polynomial of degree \( n \) has at most \( n \) (not necessarily \hyperref[def:polynomial_root_multiplicity]{distinct}) roots.
\end{proposition}
\begin{proof}
  We will use induction on \( n \).

  In the case \( n = 0 \), we have that \( p \) is a nonzero constant polynomial. Such a polynomial cannot have roots, hence the statement holds.

  Now assume that the statement holds for polynomials of degrees \( 1, \ldots, n - 1 \). Let \( p \in R[X] \) be a polynomial of degree \( n \) and let \( r \in R \) be a root of \( p \). \Fullref{thm:polynomial_root_iff_divisible} implies that there exists a polynomial \( q(X) \) of degree \( n - 1 \) such that
  \begin{equation*}
    p(X) = (X - r) q(X).
  \end{equation*}

  Fix \( t \neq r \) that is a not a root of \( q(X) \). Evaluation at \( t \) gives us
  \begin{equation*}
    p(t) = (t - r) q(t).
  \end{equation*}

  Both \( (t - r) \neq 0 \) and \( q(t) \neq 0 \). Since \( R \) has no zero divisors, the product \( p(t) \) of \( (t - r) \) and \( q(t) \) is also nonzero. Thus, the only roots of \( p(X) \) are \( r \) and the roots of \( q(X) \).

  By the induction conjecture, \( q(X) \) has at most \( n - 1 \) roots (counting multiplicities). Thus, \( p(X) \) has at most \( (n - 1) + 1 = n \) roots.
\end{proof}

\begin{proposition}\label{thm:polynomials_with_identical_values}
  In an integral domain, two polynomials \eqref{eq:thm:def:polynomial_degree/properties/p} and \eqref{eq:thm:def:polynomial_degree/properties/q} with \( m \leq n \) are equal (i.e. have the same coefficients) if and only if their functions agree at \( n + 1 \) points.
\end{proposition}
\begin{proof}
  \SufficiencySubProof Obvious

  \NecessitySubProof Define
  \begin{equation*}
    r(X) \coloneqq p(X) - q(X) = \sum_{k=0}^n (a_k - b_k) X^k.
  \end{equation*}

  This is a polynomial of degree at most \( n \) that has \( n + 1 \) roots. By \fullref{thm:integral_domain_polynomial_root_limit}, \( r \) is the zero polynomial. Hence, \( p = q \).
\end{proof}

\begin{definition}\label{def:primitive_polynomial}\mcite[394]{Knapp2016BasicAlgebra}
  A nonzero polynomial is called \term{primitive} if its coefficients are \hyperref[def:coprime_ring_ideals]{coprime}.
\end{definition}

\begin{proposition}\label{thm:polynomial_quotient_rings_equinumerous_with_module_of_polynomials}
  Fix a monic polynomial \( p(X) \in R[X] \) of degree \( n \). The free module \( \pi_n(R[X]) \), as defined in \fullref{def:polynomial_free_module}, is \hyperref[def:equinumerosity]{equinumerous} with the quotient ring \( R[X] / \braket{p(X)} \). This allows us to choose a \enquote{canonical representative} of the cosets of the quotient ring in similarly to \fullref{thm:cyclic_group_isomorphic_to_integers_modulo_n}.

  Consequently, for different polynomials \( p(X) \), only the ring structure on \( R[X] / \braket{p(X)} \) differs.
\end{proposition}
\begin{proof}
  Euclidean \hyperref[thm:euclidean_division_of_polynomials]{division} allows us to define the homomorphism
  \begin{balign*}
     & \Theta: R[X] / \braket{p(X)} \to \pi_n(R[X])             \\
     & \Theta(q(X) + \braket{p(X)}) \coloneqq \rem(q(X), p(X)).
  \end{balign*}

  It is injective since if \( q_1(X) \) and \( q_2(X) \) are not congruent modulo \( \braket{p(X)} \), they have different remainders. Conversely, \( \Theta \) is surjective because any remainder \( r(X) \) belongs to the coset
  \begin{equation*}
    r(X) + \braket{p(X)}.
  \end{equation*}

  See \fullref{ex:polynomial_quotient_rings_gaussian_integers} and \fullref{ex:polynomial_quotient_rings_z2} for differing ring structures in \( \pi_n(R[X]) \).
\end{proof}

\begin{example}\label{ex:polynomial_quotient_rings_gaussian_integers}
  The value of \fullref{thm:polynomial_quotient_rings_equinumerous_with_module_of_polynomials} is in that, like \fullref{thm:integers_modulo_isomorphic_to_quotient_group}, it allows us to identify elements of the quotient rings of the form \( R[X] / \braket{p(X)} \), for monic \( p \), with concrete polynomials.

  \Fullref{thm:polynomial_quotient_rings_equinumerous_with_module_of_polynomials} tells us that we can choose a concrete polynomial from \( \pi_{n-1}(R[X]) \) for every equivalence class in \( R[X] / \braket{p(X)} \) and that these polynomials have degree strictly less than \( n \) (if they are not zero).

  For example, consider the polynomial \( p(X) \coloneqq X^2 + 1 \) over the \hyperref[def:set_of_integers]{integers} \( \BbbZ \). It has degree \( 2 \), so the quotient ring \( R[X] / \braket{p(X)} \) can be identified with polynomials of the form
  \begin{equation}\label{ex:polynomial_quotient_rings_gaussian_integers/linear_polynomial}
    bX + a
  \end{equation}
  with integer coefficients.

  In order to make sense of the imposed ring structure in \( \BbbZ[X] / \braket{X^2 + 1} \), we can see how multiplication modulo \( X^2 + 1 \) works. We have
  \begin{balign*}
    (bX + a) (dX + c)
     & \cong
    bdX^2 + (ad + bc)X + ac
     & \pmod {X^2 + 1} \cong            \\ &\cong
    bd[X^2 + 1] + [(ad + bc)X - bd + ac]
     & \pmod {X^2 + 1} \cong            \\ &\cong
    (ad + bc)X + (ac - bd)
     & \pmod {X^2 + 1}. \phantom{\cong}
  \end{balign*}

  This is precisely the definition of multiplication of complex numbers (see \fullref{def:set_of_complex_numbers}). Thus, we can identify
  \begin{equation*}
    \BbbZ[X] / \braket{X^2 + 1} \cong \BbbZ[i].
  \end{equation*}

  Like in \fullref{ex:polynomial_evaluation_gaussian_integers}, we arrive at the Gaussian \hyperref[def:gaussian_integers]{integers}, but using a different approach.
\end{example}

\begin{example}\label{ex:polynomial_quotient_rings_z2}
  Similarly to how the Gaussian integers were identified using \fullref{ex:polynomial_quotient_rings_gaussian_integers}, we will provide a different ring structure on \( \BbbZ[X] / \braket{p(X)} \) for a polynomial \( p(X) \) of degree \( 2 \).

  Consider the polynomial \( p(X) \coloneqq X^2 - 2 \) over the \hyperref[def:set_of_integers]{integers} \( \BbbZ \). We know that \( \sqrt 2 \) is a root of \( X^2 - 2 \) in \( \BbbR \), so we can identify
  \begin{equation*}
    \BbbZ[X] / \braket{X^2 - 2} \cong \BbbZ[\sqrt 2].
  \end{equation*}

  We will verify that multiplication is indeed compatible. Multiplication modulo \( X^2 - 2 \) works as follows:
  \begin{balign*}
    (aX + b) (cX + bd)
     & \cong
    acX^2 + (bc + ad)X + bd
     & \pmod X^2 - 2 \cong            \\ &\cong
    ac[X^2 - 2] + [(bc + ad)X + 2ac + bd]
     & \pmod X^2 - 2 \cong            \\ &\cong
    (bc + ad)X + (2ac + bd)
     & \pmod X^2 - 2. \phantom{\cong}
  \end{balign*}

  Multiplication in \( \BbbZ[\sqrt 2] \) works as follows:
  \begin{balign*}
    (a \sqrt 2 + b) (c \sqrt b + d)
    =
    2ac + (bc + ad) \sqrt 2 + bd.
  \end{balign*}

  The two results are identical.
\end{example}

\begin{definition}\label{def:algebraic_derivative}
  Generalizing \fullref{def:differentiability} from analysis, we define the \term{algebraic derivative} of a polynomial \( p(X) \in R[X] \) as
  \begin{equation*}
    p'(X) \coloneqq n a_n X^{n-1} + (n-1) a_{n-1} X^{n-2} + \cdots + a_2 X + a_1.
  \end{equation*}
\end{definition}

\begin{proposition}\label{thm:algebraic_derivative_product_rule}
  Algebraic \hyperref[def:algebraic_derivative]{derivatives} satisfy the product rule
  \begin{equation*}
    (pq)' = p'q + pq'.
  \end{equation*}
\end{proposition}
\begin{proof}
  By linearity, it is enough to consider the case where both \( p(X) \) and \( q(X) \) are monomials.

  \begin{balign*}
    p'(X) q(X) + p(X) q'(X)
     & =
    n a_n X^{n-1} b_m X^m + a_n X^n m b_m X^{m-1}
    =    \\ &=
    (n + m) a_n b_m X^{n+m-1}
    =    \\ &=
    (a_n b_m X^{n+m})
    =    \\ &=
    (pq)'(X).
  \end{balign*}
\end{proof}

\begin{proposition}\label{thm:algebraic_derivative_of_linear_polynomial_power}
  The algebraic \hyperref[def:algebraic_derivative]{derivative} of
  \begin{equation*}
    p(X) \coloneqq a (X - u)^n
  \end{equation*}
  is
  \begin{equation*}
    p'(X) = an(X - u)^{n-1}.
  \end{equation*}
\end{proposition}
\begin{proof}
  We use induction on \( n \). The case \( n = 1 \) is obvious. Assume that the statement holds for \( 1, \ldots, n - 1 \).

  By \fullref{thm:algebraic_derivative_product_rule},
  \begin{balign*}
    p'(X)
     & =
    [a(X - u)^{n-1}]' (X - u) + a(X - u)^{n-1} [(X - u)]'
    =    \\ &=
    a(n-1)(X - u)^{n-2} (X - u) + a(X - u)^{n-1}
    =    \\ &=
    an(X - u)^{n-1}.
  \end{balign*}
\end{proof}

\begin{corollary}\label{thm:repeated_root_iff_derivatives_divisible}
  The value \( u \in R \) is a \hyperref[def:semiring_kernel]{root} of multiplicity \( m \) of the polynomial function \( p(x) \) if any only if \( u \) is a root of multiplicity \( m - 1 \) of its algebraic \hyperref[def:algebraic_derivative]{derivative} \( p'(x) \).
\end{corollary}
\begin{proof}
  \SufficiencySubProof Let \( u \) be a root of \( p(X) \) of multiplicity \( m \), i.e. there exists a polynomial \( q(X) \) of degree \( \deg(q) = \deg(p) - m \) such that \( (X - u) \) does not divide \( q(X) \) and
  \begin{equation*}
    p(X) = (X - u)^m q(X).
  \end{equation*}

  By \fullref{thm:algebraic_derivative_product_rule} and \fullref{thm:algebraic_derivative_of_linear_polynomial_power},
  \begin{equation*}
    p'(X)
    =
    m (X - u)^{m-1} q(X) + (X - u)^m q'(X)
    =
    (X - u)^{m-1} [m q(X) + (X - u) q'(X)].
  \end{equation*}

  Then \( u \) is a root of \( p'(X) \) of multiplicity at least \( m - 1 \). Assume that the multiplicity is at least \( m \), that is,
  \begin{equation*}
    (X - u) \mid [mq(X) + (X - u) q'(X)].
  \end{equation*}

  Since \( X - u \) obviously divides \( (X - u) q'(X) \), then the above implies
  \begin{equation*}
    (X - u) \mid mq(X).
  \end{equation*}

  But this contradicts our choice of \( q(X) \) that does not divide \( (X - u) \).

  The obtained contradiction proves that \( u \) if a root of \( p'(X) \) of multiplicity exactly \( n \).
\end{proof}

\begin{definition}\label{def:multivariate_polynomial}
  We define the \term{multivariate polynomial ring} in \( n \) indeterminates as the \enquote{iterated} single-variable polynomial ring
  \begin{equation*}
    R[X_1, X_2, \ldots, X_n] \coloneqq R[X_1][X_2] \cdots [X_n].
  \end{equation*}

  Note that we are using the letter \( n \) to represent the number of indeterminates rather than the degree of the multivariate polynomial. When we need the degree, we will note it specifically.

  Just like a polynomial \( p(X) \) in one indeterminate is a sequence, that is, a \hyperref[def:topological_net]{net} over \( \BbbZ_{>0} \), each multivariate polynomial \( p(X_1, \ldots, X_n) \) is a map from \( \BbbZ_{>0}^n \) to \( R \) (there is no natural order on \( \BbbZ_{>0}^n \) for defining \( p \) as a net). We can regard it as an \( n \)-dimensional \hyperref[def:array]{array} over \( R \), although arrays are purposely defined to only have finitely many elements, which makes it more difficult to define operations for an arbitrary pair of polynomials. For example, if there are only two variables, multivariate polynomials are \enquote{infinite matrices}
  \begin{equation*}
    p(X_1, X_2) \coloneqq \begin{pmatrix}
      a_{0,0} & a_{0,1} & \cdots \\
      a_{1,0} & a_{1,1} & \cdots \\
      \vdots  & \vdots  & \ddots \\
    \end{pmatrix}
  \end{equation*}
  with only finitely many nonzero elements.

  A \term{monomial} is a polynomial with only one nonzero element. The monomial
  \begin{equation*}
    p(X_1, X_2) \coloneqq \begin{pmatrix}
      0      & 0      & 0      & \cdots \\
      0      & 0      & 0      & \cdots \\
      0      & r      & 0      & \cdots \\
      0      & 0      & 0      & \cdots \\
      \vdots & \vdots & \vdots & \ddots \\
    \end{pmatrix}
  \end{equation*}
  can also be written symbolically as \( p(X_1, X_2) = r X_1^2 X_2 \), with the power for each variable corresponding to the zero-based index of the element along the corresponding axis.

  The sum of the indices over all axes is called the \term{degree} of this monomial. The above monomial has degree \( 3 = 2 + 1 \). We leave the degree for the zero monomial undefined.

  Every polynomial can be regarded as the sum of finitely many monomials by taking each element of the array and putting it in its own monomial array.

  The \term{degree} \( \deg p \) of a multivariate polynomial \( p \) is defined as the maximal degree among all of its nonzero monomials. If all monomials are zero, the degree is left undefined.

  If all nonzero monomials have the same degree, the polynomial is said to be \term{homogeneous}. Homogeneous polynomials of degree \( 1 \) are called \term{linear}.
\end{definition}

\begin{theorem}\label{thm:polynomial_embedding_behavior}
  Let \( \mscrR \) be an integral domain and \( \xi \coloneqq \min \{ \card(\mscrR), \aleph_0 \} \).

  \begin{thmenum}
    \thmitem{thm:polynomial_embedding_behavior/zero} The only polynomial corresponding to the zero function \( f(x) = 0 \) is the zero polynomial.

    \thmitem{thm:polynomial_embedding_behavior/univariate} Let \( p(X) \) be a nonzero polynomial and let \( \Phi(p) \) is its polynomial function. Then there exists exactly one polynomial \( q(X) \) of degree \( \deg(p) < \xi \) such that \( \Phi(q) = \Phi(p) \).

    \thmitem{thm:polynomial_embedding_behavior/multivariate} Let \( p(X_1, \ldots, X_n) \) be a nonzero multivariate polynomial and let \( \Phi(p) \) be its polynomial function. Then there exists exactly one polynomial \( q(X_1, \ldots, X_n) \) such that the power of every variable in every monomial is strictly less than \( \xi \) and \( \Phi(q) = \Phi(p) \).
  \end{thmenum}
\end{theorem}
\begin{proof}
  \SubProofOf{thm:polynomial_embedding_behavior/zero} The nonzero constant polynomials are obviously different from the zero function. The nonconstant polynomials should have at least one value different from zero, hence are again different from the zero function.

  Therefore, only the zero polynomial gives rise to the zero function.

  \SubProofOf{thm:polynomial_embedding_behavior/univariate} In the univariate case, by \fullref{thm:polynomials_with_identical_values}, two nonzero polynomials of degree less than \( \xi \) are equal if and only if they agree at \( \xi \) points.

  If \( \deg(p) < \xi \), which is automatically true if \( \mscrR \) is an infinite ring, then \( q \coloneqq p \) is the desired polynomial. It is unique by the previous paragraph.

  If \( \deg(p) \geq \xi \), which is only possible if \( \mscrR \) is a finite ring, we can easily give a non-constructive proof in the general case. \Fullref{alg:finite_field_polynomial_reduction} gives a concrete procedure for finding \( q \) in the case of certain Galois fields.

  If \( \mscrR \) is finite, both the \hyperref[def:polynomial_free_module]{polynomial free module} \( \pi_{\xi - 1} \) and the \hyperref[thm:functions_over_ring_form_algebra]{function space} \( \fun(\mscrR) \) have exactly \( \xi^\xi \) elements. Furthermore, by the first paragraph of the proof, two distinct polynomials in \( \pi_{\xi - 1} \) give rise to distinct functions. Therefore, the evaluation \( \Phi: \pi_{\xi - 1} \to \fun(\mscrR) \) is an injective function between finite sets of the same cardinality. It is therefore a bijection. That is, to each endofunction over \( \mscrR \), in particular to \( \Phi(p) \), there corresponds a unique univariate polynomial over \( \mscrR \) of degree less than \( \xi \).

  \SubProofOf{thm:polynomial_embedding_behavior/multivariate} As in the univariate case, if \( \mscrR \) is infinite, the statement trivially holds.

  Assume that \( \mscrR \) is a finite ring. A simple counting argument shows that the vector spaces \( \fun(\mscrR^n, \mscrR) \) and
  \begin{equation*}
    \mscrL \coloneqq \linspan \{ X_1^{k_1} \cdots X_n^{k_n} \colon k_j = 1, \ldots, \xi \T{for} j = 1, \ldots, n \}
  \end{equation*}
  have exactly \( \xi^{\xi^n} \) vectors.

  We must, therefore, only show that \( \Phi \) is injective on \( \mscrL \).

  We use induction on the number of variables. We already showed injectivity for one variable, and we now assume that the statement is true for all polynomials with (strictly) less than \( n \) variables.

  Assume that \( \Phi \) is not injective for polynomials in \( n \) variables. Then there exist polynomials \( f, g \in L \) such that \( r \coloneqq f - g \) is nonzero and yet \( \Phi(r) = 0 \). We know that
  \begin{equation*}
    f \in R[X_1, \ldots, X_n] = \mscrR[X_1, \ldots, X_{n-1}][X_n],
  \end{equation*}
  hence
  \begin{equation*}
    f(X_1, \ldots, X_n) = \sum_{k=0}^{q-1} f_k(X_1, \ldots, X_{n-1}) X_n^k,
  \end{equation*}
  where \( f_k(X_1, \ldots, X_{n-1}) \in L \) satisfy the inductive hypothesis and analogously for \( g \).

  Then, since \( \Phi \) is a homomorphism,
  \begin{equation*}
    \Phi(r(X_1, \ldots, X_n)) = \sum_{k=0}^{q-1} \Phi(f_k(X_1, \ldots, X_{n-1}) - g_k(X_1, \ldots, X_{n-1})) \Phi(X_n^k) = 0.
  \end{equation*}

  By the inductive hypothesis, the vectors \( \Phi[f_k - g_k], k = 0, \ldots, q - 1 \) are linearly independent. Therefore, \( \Phi[r(X_1, \ldots, X_n)] = 0 \) if and only if \( \Phi(X_n^k) = 0 \) for all \( k = 0, \ldots, q - 1 \). But evaluating \( \Phi_t(X_n) \) would give \( t \), which may be nonzero, hence \( \Phi(X_n) \) is necessarily a nonzero function.

  Hence, \( \Phi(r) \) is a nonzero function as a nontrivial combination of linearly independent nonzero functions. But this contradicts our assumption that \( f \neq g \). Therefore, \( \Phi \) is injective over \( \mscrL \).

  Therefore, as in the univariate case, to each function from \( \fun(\mscrR^n, \mscrR) \), in particular to \( \Phi(p) \), there corresponds a unique polynomial from \( \mscrL \).
\end{proof}

\begin{definition}\label{def:rational_algebraic_function}
  We denote the field of \hyperref[def:field_of_fractions]{fractions} of \( R[X_1, \ldots, X_n] \) by \( R(X_1, \ldots, X_n) \) and call it the field of \term{rational algebraic functions}.
\end{definition}

\begin{definition}\label{def:laurent_polynomial}
  We generalize \hyperref[def:polynomial]{polynomials} by allowing negative coefficients.

  \begin{thmenum}
    \thmitem{def:laurent_polynomial/polynomial} A \term{Laurent polynomial} over \( R \) is, formally, a \hyperref[def:topological_net]{net} with finite support over the integers \( \BbbZ \) rather than a net over \( \BbbZ_{\geq 0} \) (i.e. the nonnegative integers). The operations \fullref{def:algebra_of_polynomials} make the Laurent polynomials into a ring, which we denote by \( R[X^\pm] \). This notation is consistent with \fullref{thm:polynomial_ring_universal_property}. Note that
    \begin{equation*}
      R[X^\pm] \cong R[X, X^{-1}] \cong R[X, Y] / (XY - 1),
    \end{equation*}
    so all three notations are used.

    The terms \enquote{\hyperref[def:polynomial/degree]{degree}} and \enquote{\hyperref[def:polynomial/leading_coefficient]{leading coefficient}} do not generalize naturally, so we leave them undefined.

    We use the notation
    \begin{equation*}
      p(X) = \sum_{k \in \BbbZ} a_k X^k = \sum_{k=-\infty}^\infty a_k X^k.
    \end{equation*}

    \thmitem{def:laurent_polynomial/multivariate} Analogously to \fullref{def:multivariate_polynomial}, we define the ring of multivariate Laurent polynomials \( R[X_1^\pm, \ldots, X_n^\pm] \) as maps from \( \BbbZ^n \) to \( R \) rather than from \( \BbbZ \) to \( R \) or, inductively, as
    \begin{equation*}
      R[X_1^\pm, \ldots, X_n^\pm] = R[X_1^\pm, \ldots, X_{n-1}^\pm][X_n^\pm]
    \end{equation*}

    \thmitem{def:laurent_polynomial/series} A \term{formal Laurent series} is simply a Laurent polynomial in which we remove the restriction of only finitely many nonzero coefficients. We denote the set of all formal Laurent series over \( R \) by \( R\Bracks{X^\pm} \).
  \end{thmenum}
\end{definition}


%!TEX root = ../gfkg.tex
\subsection{Chapter 3}
\begin{p}
{Show that $v+w$ and $gw\in \text{Vect}(M)$.}
\end{p}

$[v+w](f+g)=v(f+g)+w(f+g)=v(f)+w(f)+v(g)+w(g)=[v+w](f)+[v+w](g)$\\
$[v+w](\alpha f)=v(\alpha f)+w(\alpha f)=\alpha (v(f)+w(f))=\alpha[v+w](f)$\\
$[v+w](fg)=v(fg)+w(fg)=v(f)g+f v(g)+w(f)g+f w(g)=[v+w](f)g+f[v+w](g)$.\\

$[gw](f+h)=g\, w(f+h)=g(w(f)+w(h))=[gw](f)+[gw](h)$.\\
$[gw](\alpha f)=g\, w(\alpha f)=\alpha g\, w(f)=\alpha[gw](f)$.\\
$[gw](fh)=g\,w(fh)=g(w(f)h+fw(h))=g\,w(f)h+fg\,w(h)=[gw](f)\,h+f\,[gw](h)$.

\begin{p} Show that the following rules hold for all $v, w\in \text{Vect}(M)$ {\em and}
$f,g\in C^\infty(M)$: 1. $f(v+w)=fv+fw$, 2. $(f+g)v=fv+gv$, 3. $(fg)v=f(gv)$, 4. $1v=v$, where 1 denotes the constant function equal to 1 on all of $M$. This makes $\text{Vect}(M)$
a \emph{module} over $C^\infty(M)$.
\end{p}
$f(v+w)[g]=fv(g)+fw(g)$, so the first one holds. The remainder work exactly the same way:
apply both sides of the equation to a test function and show that they are equal.

\begin{p}
{Show that if $v^\mu\partial_\mu=0$ we must have $v^\mu=0$ for all $\mu$.}
\end{p}
Choose as test functions the coordinate functions $x^\mu$ so that $\partial_\mu x^\mu = 1$ for all
$\mu$, meaning $v=0$.

\begin{p}
{Let $v,w\in$ \emph{Vect($M$)}. Show that $v=w$ iff $v_p=w_p$ for all $p\in M$.}
\end{p}
If $v=w$ then $v_p=w_p$ since $v_p(f)=v(f)[p]=w(f)[p]=w_p$ for all $f$. If $v_p=w_p$,
then $v(f)[p]=v_p(f)=w_p(f)=w(f)[p]$ for all $p\in M$ and $f\in C^\infty(M)$, so $v=w$.

\begin{p}
{Show that $T_p M$ is a vector space over the real numbers.}
\end{p}
... Need to show linearity, closedness, and existence of a zero.

\begin{p}
{Check that $\gamma'(t)\in T_{\gamma(t)}M$.}
\end{p}

$\gamma'(t)[f+g]=\frac{\rm d}{{\rm d}t}(f(\gamma(t))+g(\gamma(t)))=\gamma'(t)[f]+\gamma'(t)[g]$. Similarly
we get $\gamma'(t)[\alpha f]=\alpha \gamma'(t)[f]$. Finally, $\gamma'(t)[fg]=\frac{\rm d}{{\rm d}t}
(f(\gamma(t))g(\gamma(t)))=\gamma'(t)[f]g+f\gamma'(t)[g]$.

\begin{p}
Let $\phi: \R\rightarrow \R$ be given by $\phi(t)=e^t$. Let
$x$ be the usual coordinate function on $\R$. Show that $\phi^*x=e^x$.
\end{p}

The coordinate of the transformed point $\phi(p)$ is clearly $e^{x(p)}$, so $\phi^*x$ should be $e^x$. More
formally, $\phi^*x(p)=x(\phi(p))=x(e^{p})=e^{x(p)}$ so indeed $\phi^*x=e^x$.
%It's a little tricky to keep the notion of the coordinate function $x:M\rightarrow \R$ and its value $x(p)$ at the point $p$ distinct, and it will just get worse when looking at derivatives of $x$.\\

{\begin{p}
{Let $\phi:\R^2\rightarrow \R^2$ be a rotation counterclockwise
by an angle $\theta$. Let $x,y$ be the usual coordinate functions on $\R^2$. Show that
$\phi^*x=x\cos \theta-y\sin\theta$ and $\phi^*y=x\sin\theta+y\cos\theta$.}
\end{p}

Again $\phi^*x(p)=x(\phi(p))$, the $x$ coordinate of the rotated point.
If $p$ is the point $(s,t)$, then
$\phi(p)=(s',t')=(s\cos\theta-t\sin\theta,s\sin\theta+t\cos\theta)$.
Thus $\phi^*x(p)=s\cos\theta-t\sin\theta=x(p)\cos\theta-y(p)\sin\theta$ and similarly for $\phi^*y$.
Since the point $p$ is arbitrary, the desired result follows.

\begin{p}{$\phi:M\rightarrow N$ is smooth if $f\in C^\infty(N)$ implies $\phi^*f\in C^\infty(M)$. Show
that this definition is consistent with smooth functions $f:M\rightarrow\R$ and smooth
curves $\gamma:\R\rightarrow M$.}
\end{p}

A function $f:N\rightarrow\R$ is smooth if
$f\circ\varphi^{-1}_\alpha:\R^n\rightarrow \R$ is smooth
for all $\alpha$. Pulling the function back by using $\phi$ makes a new smooth function $f':M\rightarrow
\R$ where $f'=f\circ\phi$ since its smoothness is determined by
that of $(f\circ\phi)\circ(\varphi_\alpha\circ\phi)^{-1}=f\circ\varphi^{-1}_\alpha$ which is assumed to
be smooth. Any other coordinate system for $M$ would also produce a smooth result, since the
different systems are related by smooth coordinate transformations.

\begin{p}{Prove that $(\phi\circ\gamma)'(t)=\phi_*(\gamma'(t))$}
\end{p}

$\phi_*(\gamma'(t))[f]=\gamma'(t)(\phi^*f)=\gamma'(t)(f\circ\phi)=\frac{\rm d}{{\rm d}t}(f\circ\phi)(\gamma(t))=\frac{\rm d}{{\rm d}t}f(\phi(\gamma(t)))=\frac{\rm d}{{\rm d}t}f((\phi\circ\gamma)(t))=(\phi\circ\gamma)'(t)[f]$

\begin{p}
 Show that the pushforward operation $\phi_*:T_pM\rightarrow T_{\phi(p)}N$ is linear.
 \end{p}

$\phi_*(v+w)[f]=(v+w)(\phi^*f)=v(\phi^*f_+w(\phi^*f)=\phi_*v[f]+\phi_*w[f]$ and similarly for scalars $\alpha$.

\begin{p}{Show that if $\phi:M\rightarrow N$
we can push forward a vector field $v$ on $M$ to obtain a vector field
$\phi_*v$ on $N$ satisfying $(\phi_*v)_q=\phi_*(v_p)$ whenever $\phi(p)=q$.}
\end{p}

Since the vector fields can be specified pointwise, it suffices to consider a general point $p$.
Now, $(\phi_*v)_q[f]=\phi_*v(f)[q]=v(f\circ\phi)[p]=v_p(\phi^*f)=\phi_*(v_p)[f]$.

\begin{p}
{Let $\phi:\R^2\rightarrow\R^2$ be rotation counterclockwise
by an angle $\theta$. Let $\partial_x,\partial_y$ be the coordinate vector fields on $\R^2$.
Show that at any point of $\R^2$: $\phi_*\partial_x=(\cos\theta)\partial_x+(\sin\theta)\partial_y$
and $\phi_*\partial_y=-(\sin\theta)\partial_x+(\cos\theta)\partial_y$.}
\end{p}

Intuitively, this is just a rotation of the vectors, since they are tangent vectors to the coordinate paths
which are rotated by $\phi$. To make this more precise, consider $(\phi_*\partial_x)f=\partial_x(\phi^*f)=
\partial_x(f\circ\phi)$. Note that $\partial_x$ really means the derivative of the
function with respect to whatever quantity is in the first input; choosing the point $(x,y)$ as the input
makes this automatic. Then $\partial_x(f\circ\phi)(x,y)=\partial_uf \cdot \partial_x u+\partial_v f\cdot \partial_x v$, where $(u,v)=(x\cos\theta-y\sin\theta,x\sin\theta+y\cos\theta)=\phi(x,y)$. We then obtain
$(\phi_*\partial_x)f=(\cos\theta)\partial_u f+(\sin\theta)\partial_vf$. Since $u$ is the first input to $f$, $\partial_u$ is
the same as $\partial_x$ in the rotated space, and similarly for $v$ and $y$. This gives us
$\phi_*\partial_x=(\cos\theta)\partial_x+(\sin\theta)\partial_y$; the same argument works for $\phi_*\partial_y$.

\begin{p}{Let $v$ be the vector field $x^2\partial_x+y\partial_y$ on $\R^2$. Calculate
the integral curves $\gamma(t)$ and see which ones are defined for all $t$.}
\end{p}

We start by making up a representation. $\gamma'(t)[f]=\frac{\rm d}{{\rm d}t}f(\gamma(t))
=\partial_\mu f\frac{{\rm d}\gamma^\mu}{{\rm d}t}$, so $\gamma'(t)=
\frac{{\rm d}\gamma^\mu}{{\rm d}t}\partial_\mu$.
If $\gamma(t)=(x(t),y(t))$, then $\gamma'(t)=\dot{x}(t)\partial_x+\dot{y}(t)\partial_y$.
Then $\dot{x}=x^2$ and $\dot{y}=y$. The solution is $\gamma(t)=(x(0)/(1-x(0)t),y(0)e^t)$, which
is finite for finite $t$ provided $1-x(0)t\neq 0$. Thus, only the curves with $x(0)=0$ are defined for all
$t$.

\begin{p}{Show that $\phi_0$ is the identity map id:$X\rightarrow X$, and that for all $s,t\in\R$ we have $\phi_t\circ\phi_s=\phi_{t+s}$.}
\end{p}

The point $p$ is translated to the point $\gamma(t)$ along the integral curve $\gamma$ of $v$ with $p$
as the initial point. Since $\gamma(0)=p$, $\phi_0(p)=p$. Moreover, as the integral curve is the solution
to a first-order differential equation, the solutions are unique and the curves don't intersect. If we move
apply $\phi_t\circ\phi_s$ to $p$ we are first moving the point $p=\gamma(0)$ to $\gamma(s)$ and then using
this point as the new intial value for the integral curve so that we can move it to $\widetilde{\gamma}(t)$. But
the curves are unique and any point on the curve defines a boundary condition which together with
the differential equation, yields the curve. Thus, $\gamma$ and $\widetilde{\gamma}$ are the same curve
with the same parameterization (except for the offset).

\begin{p}
{Consider the normalized vector fields in the $r$ and $\theta$ direction on the plane in polar coordinates (not defined at the origin):
\[
v=\frac{x\partial_x+y\partial_y}{\sqrt{x^2+y^2}},\qquad w=\frac{x\partial_y-y\partial_x}{\sqrt{x^2+y^2}}
\]
Calculate $[v,w]$}.
\end{p}

Let's put this into component notation first. Define $\bar{r}=1/\sqrt{x^2+y^2}$,
$x_0=x$, and $x_1=y$. Then $v=\bar{r}x^k\partial_k$ while $w=\bar{r}\epsilon^j_i x^i\partial_j$, for $\epsilon^j_i$ the antisymmetric symbol/tensor. Before getting started, note that $\partial_j\bar{r}=-x_j\bar{r}^3$ (watch out for the lower index!). Now
\begin{eqnarray*}
[v,w]&=&vw-wv=\bar{r}x^k\partial_k(\bar{r}\epsilon^j_ix^i\partial_j)-
\bar{r}\epsilon^j_ix^i\partial_j(\bar{r}x^k\partial_k)\\
&=&\bar{r}^2\epsilon^j_ix^k\left(\delta_k^i\partial_j+x^i\partial_k\partial_j-\bar{r}^2x_k x^i\partial_j\right)-\bar{r}^2\epsilon^j_i x^i\left(\partial_j+x^k\partial_j\partial_k-\bar{r}^2 x_j x^k\partial_k\right)\\
&=&-\bar{r}^4x^kx_k\epsilon^j_i x^i\partial_j=-\bar{r}^2\epsilon^j_i x^i\partial_j=-\frac{x\partial_y-y\partial_x}{x^2+y^2}=-\frac{w}{r},
\end{eqnarray*}
since $[\partial_i,\partial_j]=0$ and $\epsilon^j_ix^ix_j=0$.

\begin{p}{Check that $[v,w](f)(p)=\frac{\partial^2}{\partial t \partial s}\left[
f(\psi_s(\phi_t(p)))-f(\phi_t(\psi_s(p)))\right]_{s=t=0}$}
\end{p}

Start with $(vf)(p)=\frac{d}{dt}f(\phi_t(p))|_{t=0}$ and
$(wf)(p)=\frac{d}{ds}f(\psi_s(p))|_{s=0}$.
Then we have $(vwf)(p)=v(wf)(p)=\frac{d}{dt}wf(\phi_t(p))|_{t=0}=\frac{\partial^2}{\partial t\partial s}f(\psi_s(\phi_t(p)))|_{s=t=0}$. Note that $wf$ means take $f$ and displace its input a little bit, and evaluate the derivative at zero
displacement. In the compound expression, the input to $f$ is $\phi_t(p)$, so $\psi_s$ ends up first inside $f$ in the final expression. Alternatively, we could work from inside-out: $v(wf)(p)=v\left(\frac{d}{dt}f(\psi_s(\cdot))|_{s=0}\right)(p)=\frac{\partial^2}{\partial t\partial s}f(\psi_s(\phi_t(p)))|_{s=t=0}.$
Similarly, $(wvf)(p)=\frac{\partial^2}{\partial t\partial s}f(\phi_t(\psi_s(p)))|_{s=t=0}$, so the expression for the commutator holds.

\begin{p}{Show that for all vector fields $u, v, w$ on a manifold, and all real numbers $\alpha$ and $\beta$, we have:
\begin{enumerate}
\item $[v,w]=-[w,v]$
\item $[u,\alpha v+\beta w]=\alpha[u,v]+\beta[u,w]$
\item The {\bf Jacobi identity}: $[u,[v,w]]+[v,[w,u]]+[w,[u,v]]=0$
\end{enumerate}}
\end{p}
\begin{enumerate}
\item $[u,v]=uv-vu=-(vu-uv)=-[v,u]$
\item $[u,\alpha v+\beta w]=u(\alpha v+\beta w)-(\alpha v+\beta w)u=\alpha[u,v]+\beta[u,w]$
\item $[u,[v,w]]=u(vw-wv)-(vw-wv)u$, so $[u,[v,w]]+[v,[w,u]]+[w,[u,v]]=
u(vw-wv)-(vw-wv)u+v(wu-uw)-(wu-uw)v+w(uv-vu)-(uv-vu)w=0$
\end{enumerate}


\documentclass[11pt]{article}

\textheight 22cm
\textwidth  16cm
\hoffset= -0.6in
\voffset= -0.5in
\setlength{\parindent}{0cm}
\setlength{\parskip}{10pt plus 2pt minus 2pt}
\pagenumbering{roman}
\setcounter{page}{-9}

\newcommand{\be}{\begin{equation}}
\newcommand{\ee}{\end{equation}}
\newcommand{\bd}{\begin{displaymath}}
\newcommand{\ed}{\end{displaymath}}
\begin{document}

\title{Astrophysics II: Laboratory 6}
\author{\Large The Shape and Scale of the Milky Way}
\maketitle

\setlength{\parindent}{0.2pt}
\setlength{\parskip}{2ex}

\section{{\bf Objectives:}}

{\it The student investigates the shape, structure and scale of the
 Milky Way using only visible wavelengths using the locations of stellar clusters and compares the galactic distribution of open vs. globular clusters.}

\section{{\bf Procedure}}

Part I - Open Clusters A: The Orientation of the Milky Way

1) Go to www.astro.iag.usp.br/$\sim$wilton/clusters.txt.  You will see data
on 1777 Milky Way open clusters.  The format is the following:\\
column 1 - object name\\
column 2-4 - right accession (RA) (hours : minutes : seconds)\\
column 5-7 - declination ($\delta$) (degrees : arc-minutes : arc-seconds)

In order to make importing the part of this information relevant to this lab easier, I have written a python script in order to extract only the values of columns 2-7. This is much easier to import into Matlab. It is not necessary to understand the python script, but if you know python, it is available at http://www.astro.umd.edu/~mavara/matlab/121labs.html

2) Save the simplified data text file to your desktop.

3a) Import the file into Matlab like this:
$\gg$ load clusters\_relevant.txt

3b) Double click on the clusters\_relevant structure name in the ``Workspace" window to check that this structure is a matrix with the correct information: each row contains locational information for each cluster.

4) Convert the RA and $\delta$ into decimals of hours and degrees with the
following formulas:
\begin{equation}
RA = RA(hr) + \frac{RA(min)}{60 min/hr} + \frac{RA(sec)}{3600 sec/hr}
\end{equation}
\begin{equation}
\delta = \delta(deg) + \frac{\delta(arcmin)}{60 arcmin/deg} + \frac{\delta(arcsec)}{3600 arcsec/deg}
\end{equation}

In other words, create a new matrix with each three value set of coordinates transformed into a single value each; so, this new matrix has two columns, the first giving RA and the second giving $\delta$.

5) Plot the $\delta$ (vertical axis) and RA (horizontal axis) of all 1777
open clusters.  What does this plot tell you about the shape of the
Milky Way?  Feel free to sketch this out with labels to show or turn in to your TA.

6) On this plot the ecliptic (plane of the solar system) is a sine
wave starting at RA = 0 hours, with a period of 24 hours and an
amplitude of 23 degrees.  Print out your plot and draw the ecliptic.

Part II - Open Clusters B: The Scale of the Milky Way

1) Go to www.astro.iag.usp.br/$\sim$wilton/clustersGAL.txt.  You will see the data
on the same 1777 Milky Way open clusters, this time with galactic coordinates.  The format is the following:\\
column 1 - object name\\
column 2 - galactic longitude\\
column 3 - galactic latitude (with sign)\\
column 4 - classification flag (you will not need this)\\
column 5 - apparent size (you will not need this either)\\
column 6 - distance in pc

2) Save the data file clusters\_relevantGAL.txt to your desktop (this file was made from that on the website using clusters2.py).

3) Import this data into a Matlab matrix.  Go ahead and change the values of the first two columns from degrees to radians.

4) Next you will be changing into a Cartesian coordinate system
centered on the Sun.  To make life easier, the positive x axis points
towards l=0, b=0. Make three variables which will give cartesian positions in units of distance in parsecs.  Use these formulas to convert from (l,b,d) to (x,y,z):
\begin{equation}
x = d cos(b)cos(l)
\end{equation}
\begin{equation}
y = d cos(b)sin(l)
\end{equation}
\begin{equation}
z = d sin(b)
\end{equation}

5) Make three scatter plots, x verses y, x verses z, and y verses z.
Based on your plots what is the shape of the Milky Way?  Make sure to
base your answer only on what you see in your plots, not anything you
read in the text or on-line.\\

6) On your plots label the thickness and diameter of the Milky Way in
parsecs and kiloparsecs.  Where is the center of the Milky Way?\\

Part III - Globular Clusters: The Scale of the Milky Way, Reloaded

1) Go to the Globular Cluster Catalog at
http://physwww.physics.mcmaster.ca/$\sim$harris/mwgc.dat.  The format is provided
at the top of the file.  Note, the distances this time are in
kiloparsecs, not parsecs.

2) Save the simplified file just containing the positions of the clusters, mwgc-short\_relevant.txt, to your desktop. Each row is the (x,y,z) position of the cluster centered on the Sun, in the same format as you put the data in section 2 in, but with distances in kpc now.

3) Load the positions into Matlab vectors for x, y, and z.

5) Plot the positions for the globular
clusters in the same way you did in Part 2.  What does your plot tell you about the distribution of globular clusters relative to the Milky Way plane?  Where would you
expect the center of the globular cluster distribution to be?\\

6) Mark the diameter on your plots in kiloparsecs.  Where is the center
of your distribution (check out x verses y and x verses z for the best
view of this)?\\

\section{{\bf Questions}}

{\it Answer these questions on a separate sheet of paper and hand them
  in with your lab}

1) What does your plot from Part I tell you about the orientation of
the Milky Way plane with respect to the plane of the solar system?

2) How does the size of the Milky Way you found with the open clusters
compare to the size you found with the globulars?  What happened to
the position of the Sun in the galaxy when you used the globular
clusters?  Which answer is closer to the one given in your book for
the size of the Milky Way and the Sun's position in it?

3) Which set of objects were better probes of the Milky Way's size?  Why?

4) Which set of objects were better probes of the Milky Way's disk?  Why?

5) Many of the distance measurements to globulars were initially done
using Cepheid variables.  Why would Cepheid make such excellent
standard candles for the Milky Way's globular clusters?

\end{document}


\SecDef{intro}{Introduction}
After the introduction of \emph{linear cryptanalysis} in~\cite{EC:Matsui93} as a powerful method to attack symmetric cryptographic primitives, people started studying how to generalize this method in order to exploit \emph{nonlinear approximations} for cryptanalysis, see, e.g.,~\cite{EC:HarKraMas95} and~\cite{EC:KnuRob96}. While it might be easier to find a nonlinear approximation over parts of the primitive, e.g., over an S-box of small size, a crucial problem in nonlinear cryptanalysis is to find nonlinear approximations that hold true for the \emph{whole round function} of the primitive. An example  that exploits nonlinear approximations that are preserved over the whole round function is \emph{bilinear cryptanalysis} over Feistel ciphers~\cite{C:Courtois04}.

More recently, an interesting solution for the above problem was described by Todo, Leander and Sasaki in~\cite{NonlinInv} for round functions that can be described in terms of an LS-design~\cite{FSE:GLSV14}.  Let one round of a substitution-permutation cipher operating on $n$ S-boxes of $t$-bit length be given as depicted in \FigRef{spn} and let the linear layer $L^{(t)} \colon \F_2^{nt} \rightarrow \F_2^{nt}$ only XOR the outputs of the S-boxes, i.e., each $(y_1,\dots,y_{n})$ for $y_j \in \F_2^t$ is mapped to $(z_1,\dots,z_{n})$ where $z_j = \sum_{i=1}^{n}\alpha_{i,j} y_i$ for particular $\alpha_{i,j} \in \F_2$. In that case, $L^{(t)}$ can be  defined by $t$ parallel applications of the matrix $L$ given by
\[L = \left[\begin{array}{cccc} \alpha_{1,1} & \alpha_{1,2} & \dots & \alpha_{1,n} \\
\alpha_{2,1} & \alpha_{2,2} & \dots& \alpha_{2,n} \\
\vdots & \vdots & \ddots& \vdots \\
\alpha_{n,1} & \alpha_{n,2} & \dots & \alpha_{n,n} \\
\end{array}\right]\;.\]
Todo \etal{} observed that if $L$ is orthogonal, then for \emph{any} $t$-bit Boolean function $f$ of algebraic degree less than or equal to $2$ and for any $y_1,\ldots,y_n \in \F_2^t$ it is
\begin{equation}
\EqLabel{target}
    f(y_1) + f(y_2) + \dots + f(y_{n}) = f(z_1) + f(z_2) + \dots + f(z_{n})\;.
\end{equation}
This fact was used to successfully cryptanalyze the block ciphers Midori, Scream and iScream in a weak key setting. Indeed, if $f$ is any invariant function for the S-box $S$, i.e., if for all $x \in \F_2^t$, $f(x) = f(S(x))$, and if $\deg(f) \leq 2$, one obtains an invariant function for the whole round according to \EqRef{target}.

An interesting question is whether the property of $L$ being orthogonal is also necessary for \EqRef{target} to hold for all $f$ with degree upper-bounded by $2$. More generally, we would like to understand the necessary and sufficient properties of the linear layer that preserve such invariants in the case when $\deg(f) \leq d$ for $d > 2$. Although the existence of a non-trivial\footnote{By \emph{non-trivial}, we mean that the matrix of $L$ is not a permutation matrix.} linear layer for which \EqRef{target} holds for all $f$ with $\deg f \leq d$ is totally unclear, such a construction would be of significant interest. On the one hand, it would deepen the knowledge on how to design strong symmetric cryptographic primitives and to avoid possible attacks and could on the other hand be useful in order to design symmetric \emph{trapdoor ciphers} to be used as public-key schemes, see, e.g.,~\cite{FSE:RijPre97,DBLP:conf/icics/PatarinG97a,DBLP:journals/iacr/BannierBF16}.
The idea would be to hide a nonlinear approximation as the trapdoor information. If the linear layer is designed such that it preserves \emph{all invariants} of a special form, e.g., all functions of degree at most $d$, the specification of the linear layer would not leak more information on the particular invariant and thus on the trapdoor. There could also be applications besides cryptography, so the above problem might be of independent interest.

\begin{figure}
    \centering
    \includegraphics[scale=0.9]{\PathFig{spn_round.pdf}}
    \FigDef{spn}{The round function of a substitution-permutation cipher based on an LS-design.}
\end{figure}

\subsection{Our Contribution} In this work we answer the above question and consider the case of $L \in \F_2^{n \times m}$, i.e., the number of outputs might be different than the number of inputs. We precisely characterize the matrices that preserve \emph{all} invariants of the form similar as given in \EqRef{target}, i.e.,
\begin{equation}
\EqLabel{target_general}
    f(y_1) + \dots + f(y_{n}) = f(z_1) + \dots + f(z_{m}) + f(0)\cdot (m+n \mod 2)\;,
\end{equation}
where the degree of $f$ is upper bounded by $d$. We call such matrices \emph{degree-$d$ sum-invariant}. We show that such matrices correspond to $n$-bit Boolean functions of degree at most $n-d-1$ which admit no linear annihilators. We call the \emph{supports} of such Boolean functions \emph{degree-$d$ zero-sum sets of rank $n$}. This characterization is obtained in \PropRef{zero_sum}, \PropRef{inner_product} and \PropRef{annihilator_construction}. Our results imply that $m \geq n$ and, for the case of $d=2$, the property of $L$ being (semi-)orthogonal is not only sufficient, but also necessary. Moreover, we obtain an interesting characterization of orthogonal matrices over $\F_2$, i.e., $L \in \F_2^{n \times n}$ is orthogonal if and only if in every $2 \times 2n$ submatrix of $\left[\begin{array}{c|c}I_n & L\end{array}\right]$, each column occurs an even number of times.

Besides showing the link between degree-$d$ zero-sum sets and degree-$d$ sum-invariant matrices, we study degree-$d$ zero-sum sets of full rank in more detail. We are in particular interested in the smallest of such sets. Let $\minzs{n}{d}$ denote the minimum number of elements in a degree-$d$ zero-sum set of rank $n$. The following theorem summarizes our main results.

\begin{theorem}
\ThmLabel{main}
Let $n,d \in \ZZplus$ with $n > d \geq 1$. Then the following properties of $\minzs{n}{d}$ hold.
 \renewcommand{\labelenumi}{(\roman{enumi})}
\begin{enumerate}
    \item $\minzs{n}{d} = \min\{ \wt(g) \mid g \in \BF{n}{n-d-1} \setminus \{0\} \text{ with } g \text{ having at most 1}$ affine annihilator$\}$.
    \vspace{.3em}
    \item $\minzs{n}{1} = n+2-(n \mod 2)$ and, for $n = 4$ or $n > 5$, $\minzs{n}{2} = 2n$.

    As exceptions, $\minzs{3}{2} = 8$ and $\minzs{5}{2} = 12$.
    \vspace{.3em}
    \item $\minzs{d+1}{d} = \minzs{d+2}{d} = 2^{d+1}$. Moreover, $\minzs{d+3}{d} = 3 \cdot 2^d$ and $\minzs{2d+4}{d} = 2^{d+2}$. For $d+4 \leq n \leq 2d+3$,  \[\minzs{n}{d} = 2^{2d-n+4}(2^{n-d-2}-1)\;.\]
    \item for any fixed $d$, the sequence $\minzs{n}{d}$ is increasing, i.e., $\minzs{n+1}{d} \geq \minzs{n}{d}$.
    \vspace{.3em}
    \item for $n_1, n_2 > d$, the inequality \[\minzs{n_1+n_2}{d} \leq \minzs{n_1}{d} + \minzs{n_2}{d}\] holds. Moreover, for $d \geq 2$, it is \[\minzs{n+d}{d-1} \leq \minzs{n}{d} \leq 2 \minzs{n-1}{d-1}\;.\]
\end{enumerate}
The last inequality implies that, for $n \geq 4$,  $\minzs{n}{3} \geq 2n +6$.
\end{theorem}

We prove the above values by providing a construction of the corresponding zero-sum sets (resp. Boolean functions). In case where we only prove an upper bound, we provide a construction that meets this bound. \TabRef{bounds} shows the values and bounds for $\minzs{n}{d}$ for $n \leq 30$ and $d \leq 10$.

The last inequality in \ThmRef{main} implies that any degree-$d$ sum-invariant matrix $L \in \F_2^{n \times n}$ for $d \geq 3$ must be a permutation matrix, i.e. an invertible matrix with exactly $n$ ones. In other words, the observation of Todo \etal cannot be extended for higher-degree invariants without $L$ being expanding.

\subsection{Organization} In \SecRef{prelim}, I fix notation specific to this chapter. I also recall the observations made in~\cite{NonlinInv} with regard to orthogonal matrices and the preservation of degree-$2$ invariants. For motivating the remainder of the chapter, I directly present an example construction of an expanding linear mapping that preserves higher-degree invariants.

In \SecRef{zerosum}, I show equivalent characterizations of degree-$d$ zero-sum sets and explain the links between degree-$d$ sum-invariant matrices and degree-$d$ zero-sum sets.

Minimal degree-$d$ zero-sum sets are studied in \SecRef{minimal}, where \ThmRef{main} is proven. I further summarize the implications to degree-$d$ sum-invariant matrices in \SecRef{implications}. Finally, the chapter is concluded in \SecRef{conclusions}.