\chapter{ECDSA asymmetric threshold scheme}
\label{chap:threshold}

Threshold cryptography has been discussed for a long time already, many
cryptographic schemes like RSA or Paillier \cite{10.1007/BFb0052253,
10.1007/978-3-642-27954-6_20} exist, but others are less suitable to port.
Since Bitcoin become famous, people have lost funds because they
lose keys or get hacked. Since then research has been done to secure Bitcoin
wallets \cite{Goldfeder2015SecuringBW, DBLP:conf/acns/GennaroGN16}, however, the
most significant problem today in Bitcoin that slows down the adoption of a
threshold cryptosystem is the complexity of creating an efficient and flexible
scheme for \gls{ecdsa}. Recently, researchers have focused on finding more efficient
and more generic systems, but fortunately, a protocol perfectly fulfilling the
needs described in the previous chapter required to improve payment channels in
Bitcoin already exists. Nevertheless, this scheme explains how to perform a threshold
\gls{dsa} and not a threshold \gls{ecdsa}. So the protocol needs to be
adapted.

The scheme analyzed, transformed, and implemented in the following has been
proposed by MacKenzie and Reiter in their paper \say{Two-Party Generation of DSA
Signatures} \cite{crypto-2001-1592}. This scheme is also the basis of several
other papers previously cited. They base their construction of a threshold signature
scheme on a simple multiplicative shared secret and
homomorphic encryption to keep the individual values unknown by the other
signer. The homomorphic encryption used as an example in the paper and chosen for
the implementation is the Paillier cryptosystem
\cite{Paillier:1999:PCB:1756123.1756146}. The following chapter describes how to
adapt the scheme from \gls{dsa} to \gls{ecdsa} and introduces some fundamental
building blocks needed for a real case scenario like hierarchical deterministic
threshold wallet or deterministic signatures.

\minitoc

\newpage

% -----------------------------------------------------------------------------
\section{Reminder}

Before introducing the threshold scheme, reminders of basic components used in
the scheme are presented. These reminders are composed of \gls{ec} general
mathematics, Paillier homomorphic encryption scheme, and digital signature
protocols, in particular \gls{dsa} and \gls{ecdsa} and their differences.

\subsection{Elliptic curves}

Bitcoin uses \gls{ec} cryptography for securing its transactions. \gls{ecdsa},
based on the \gls{dsa} proposal by the \gls{nist}, over the curve secp256k1,
proposed by the \gls{secg}, is used \cite{sec2}.

\subsubsection{Secp256k1 curve}

The curve secp256k1 is defined over the finite field $\mathbb{F}_p$ of $2^{256}$
bits with a Koblitz curve $y^2 = x^3 + ax + b$ where $a = 0$ and $b = 7$. The
equation is

\begin{equation*}
\begin{split}
  y^2 &= x^3 + 7\\
\end{split}
\end{equation*}

with parameters in hexadecimal

\begin{equation*}
\begin{split}
  p &= &\text{\scriptsize FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE FFFFFC2F}\\
  G &= &\text{\scriptsize (79BE667E F9DCBBAC 55A06295 CE870B07 029BFCDB 2DCE28D9 59F2815B 16F81798,}\\
    &  &\text{\scriptsize  483ADA77 26A3C465 5DA4FBFC 0E1108A8 FD17B448 A6855419 9C47D08F FB10D4B8)}\\
  n &= &\text{\scriptsize FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFE BAAEDCE6 AF48A03B BFD25E8C D0364141}
\end{split}
\end{equation*}

The curve order $n$ defines the number of elements (points) generated by the
generator $G$ on the curve. Exponentiation of the generator $g^a \mod p$ becomes
a point multiplication with the generator $a \cdot G$.

\subsubsection{Points addition}
With two distinct points $P$ and $Q$ on the curve $\mathcal{E}$, geometrically
the resulting point of the addition is the inverse point, $(x, -y)$ of the
intersection point with a straight line between $P$ and $Q$. An infinity point
$\mathcal{O}$ represents the identity element in the group. Algebraically the
resulting point is obtained with:

\begin{equation}
\begin{split}
  P + Q &= Q + P = P + Q + \mathcal{O} = R \\
  (x_p, y_p) + (x_q, y_q) &= (x_r, y_r) \\
  x_r &\equiv \lambda^2 - x_p - x_q \pmod p \\
  y_r &\equiv \lambda(x_p - x_r) - y_p \pmod p  \\
  \lambda &= \cfrac{y_q - y_p}{x_q - x_p} \\
          &\equiv (y_q - y_p)(x_q - x_p)^{-1} \pmod p
\end{split}
\end{equation}

\subsubsection{Point doubling}

For $P$ and $Q$ being equal, the formula is similar and can be simplified, the tangent to the curve
$\mathcal{E}$ at point $P$ determines $R$.

\begin{equation}
\begin{split}
  P + P &= 2P = R \\
  (x_p, y_p) + (x_p, y_p) &= (x_r, y_r) \\
  x_r &\equiv \lambda^2 - 2x_p \pmod p \\
  y_r &\equiv \lambda(x_p - x_r) - y_p \pmod p  \\
  \lambda &= \cfrac{3x_p^2 + a}{2y_p} \\
          &\equiv (3x_p^2 + a)(2y_p)^{-1} \pmod p
\end{split}
\end{equation}

\subsubsection{Point multiplication}

A point $P$ can be multiplied by a scalar $d$. The straightforward way of
computing a point multiplication is through repeated addition where $dP = P_1 +
P_2 + \dots + P_d$.

% However, this is a fully
% exponential approach to computing the multiplication.
% The simplest method is the double-and-add method. To compute
% $dP = P_1 + P_2 + \dots + P_d$, start with the
% binary representation for $d : d = d_0 + 2d_1 + 2^2d_2 + \dots + 2^md_m$,
% where
% $[ d_0 \dots d_m] \in {0,1}$, $N = P, Q = \mathcal{O} \and \forall d_x : \text{if } d_x = 1 Q = \text{add}(Q, P), N = \text{double}(N)$.

\begin{lemma}[Elliptic Curve Discrete Logarithm Problem]
  Given a multiple $Q$ of $P$ where $Q = nP$ it is infeasible to find $n$ if $n$ is large.
\end{lemma}

\begin{lemma}[Point Order]
  A point $P$ has order $2$ if $P + P = \mathcal{O}$, and therefore $P = -P$.
  A point $Q$ has order $3$ if $Q+Q+Q=\mathcal{O}$, and therefore $Q + Q = -Q$.
\end{lemma}

\subsection{Paillier cryptosystem}

\begin{quote}{Wikipedia:}
  The Paillier cryptosystem, invented by and named after Pascal Paillier in 1999,
  is a probabilistic asymmetric algorithm for public key cryptography. The problem
  of computing $n$-th residue classes is believed to be computationally difficult.
  The decisional composite residuosity assumption is the intractability hypothesis
  upon which this cryptosystem is based.
\end{quote}

\subsubsection{Encryption}

With a public key $(n, g)$ and a message $m < n$, select a random $r < n$ and
compute the ciphertext $c = g^m \cdot r^n \mod n^2$ to encrypt the plaintext.

\subsubsection{Decryption}

With a private key $(n, g, \lambda, \mu)$ and a ciphertext $c \in
\mathbb{Z}_{n^2}^*$ compute the plaintext as $m = L(c^{\lambda} \mod n^2) \cdot
\mu \mod n$ where $L(x) = \frac{x-1}{n}$.

\subsection{Signature schemes}
\subsubsection{Digital Signature Algorithm}

\begin{quote}{Wikipedia:}
  The Digital Signature Algorithm (DSA) is a Federal Information Processing Standard
  for digital signatures. In August 1991 the National Institute of Standards and
  Technology (NIST) proposed DSA for use in their Digital Signature Standard (DSS)
  and adopted it as FIPS 186 in 1993.
\end{quote}

\paragraph{Signing}

With public parameters $(p, q, g)$, \texttt{hash} the hashing function,
$m$ the message, and $x \in \mathbb{Z}_q$ the private key.

\begin{itemize}
  \item Generate a random $k \in \mathbb{Z}_q$
  \item Calculate $r \equiv (g^k \pmod p) \pmod q : r \neq 0$
  \item Calculate $s \equiv k^{-1}(\texttt{hash}(m) + xr) \pmod q : s \neq 0$
  \item The signature is $(r, s)$
\end{itemize}

\paragraph{Verifying}

With public parameters $(p, q, g)$, \texttt{hash} the hashing function,
$m$ the message, $(r, s)$ the signature, and $y = g^x \mod p$ the public key.

\begin{itemize}
  \item Reject the signature if $r, s \notin \mathbb{Z}_q$
  \item Calculate $w \equiv s^{-1} \pmod q$
  \item Calculate $u_1 \equiv \texttt{hash}(m) \cdot w \pmod q$
  \item Calculate $u_2 \equiv rw \pmod q$
  \item Calculate $v \equiv (g^{u_1}y^{u_2} \pmod p) \pmod q$
  \item The signature is valid if $v = r$
\end{itemize}

\subsubsection{Elliptic Curve Digital Signature Algorithm}

\gls{ecdsa} is a variant of \gls{dsa} which uses elliptic curve cryptography and
requires a different set of parameters and smaller keys.

\paragraph{Signing}

With public parameters $(\mathcal{E}, G, n)$, \texttt{hash} the hashing function,
$m$ the message, and $x \in \mathbb{Z}_n$ the private key.

\begin{itemize}
  \item Generate a random $k \in \mathbb{Z}_n$
  \item Calculate $(x_1, y_1) = k \cdot G$
  \item Calculate $r \equiv x_1 \pmod n : r \neq 0$
  \item Calculate $s \equiv k^{-1}(\texttt{hash}(m) + xr) \pmod n : s \neq 0$
  \item The signature is $(r, s)$
\end{itemize}

\paragraph{Verifying}

With public parameters $(\mathcal{E}, G, n)$, \texttt{hash} the hashing function,
$m$ the message, $(r, s)$ the signature, and $Q = x \cdot G$ the public key.

\begin{itemize}
  \item Reject the signature if $r, s \notin \mathbb{Z}_n$
  \item Calculate $w \equiv s^{-1} \pmod n$
  \item Calculate $u_1 \equiv \texttt{hash}(m) \cdot w \pmod n$
  \item Calculate $u_2 \equiv rw \pmod n$
  \item Calculate the curve point $(x_1, y_1) = u_1 \cdot G + u_2 \cdot Q$ if
  $(x_1, y_1) = \mathcal{O}$ then the signature is invalid
  \item The signature is valid if $r \equiv x_1 \pmod n$
\end{itemize}

\subsubsection{Analysis of the schemes}

In $(r, s)$ the computation of the part $s$ remains the same in each signature
scheme, the only difference for $s$ is the modulus applied. In \gls{dsa}
modulo $q$ is used, i.e., the order of the generator $g$ modulo $p$,  while in
\gls{ecdsa} modulo $n$ is used, i.e., the order of the generator $G$ on the
curve $\mathcal{E}$.

The biggest adaptation is on how to calculate the part $r$ from the private
random $k$. In \gls{dsa} the generator $g$ is used with at first modulo $p$
and then modulo $q$ while in \gls{ecdsa} the curve is used. The signer generates
a point and uses the coordinate $x_1$ modulo $n$.

\begin{postulate}
  The statement $a \equiv g^b \pmod p$ is equivalent in terms of security to $a = b \cdot G$
  and $a \equiv (g^b \pmod p) \pmod q$ is equivalent to $a \equiv x \pmod n : (x, y) = b \cdot G$.
  \label{post:adaptEcdsa}
\end{postulate}

The previous postulate is used to adapt zero-knowledge proofs from \gls{dsa} to
\gls{ecdsa} hereafter. Lack of time has not permitted further research into this
postulate.

% -----------------------------------------------------------------------------
\section{Threshold scheme}

The \say{Two-party generation of DSA signatures} scheme presented by MacKenzie
and Reiter \cite{crypto-2001-1592}, as mentioned before at the end of the
chapter \ref{chap:paymentChannels}, is an asymmetric scheme, i.e., at the end of
the protocol only the initiator can retrieve the full signature. The scheme
proposed is a cryptographic (1,2)-threshold, i.e., one corrupted player can
occur out of the two players, and the scheme remains safe. It is worth noting that
this is qualified as an optimal $(t, n)$-threshold scheme, i.e., $t = n - 1$,
because if only one honest player remains the safety is guaranteed.

% As also mentioned before, the scheme adheres to the same requirements as a
% Bitcoin 2-out-of-2 multi-signature script. This means that it is possible to
% use it to improve the payment channels. However, it is necessary to adapt the
% scheme and particularly the construction of the zero-knowledge proofs. The following
% explains the chosen adaptation.

The presented scheme in the original paper uses a multiplicative shared secret
and a multiplicative shared private random value. The secret $x$ is shared
between Alice and Bob, so that Alice holds the secret value $x_1 \in
\mathbb{Z}_{q}$ and Bob $x_2 \in \mathbb{Z}_{q}$ such that $x \equiv x_1x_2
\pmod q$. Along with the public key $y$, $y_1 \equiv g^{x_1} \pmod p$ and $y_2
\equiv g^{x_2} \pmod p$ are public. Alice holds a private key, from now on
mentioned as $sk$, corresponding to a public encryption key $pk$. Alice also
knows a public encryption key $pk'$ for which she does not know the private key
$sk'$. Here the Paillier homomorphic cryptosystem is used as the encryption
scheme, but other homomorphic encryption systems can be
used to implement the scheme. Alice and Bob know a set of parameters used for
both zero-knowledge proofs.

Starting now the initialization is not taken into account, and the author
assumes that the reader has a good understanding of the original scheme
\cite{crypto-2001-1592}. The choice was made to focus the work on the
signing protocol and because the implementation is not directly part of the
cryptographic \texttt{C} library. This initialization can be further researched.

\subsection{Adapting the scheme}

Except for the zero-knowledge proofs, the adaptation is trivial and just requires
the same adaptation of the \gls{dsa} signature scheme and \gls{ecdsa} signature
scheme, i.e., compute the $r$ value with the curve. The following figures
describe the adapted scheme. The adapted protocol keeps the same messages, so
they are not repeated. The postulate~\ref{post:adaptEcdsa} is used to perform
the adaptation.

The secret remains shared multiplicatively so that Alice holds the secret
value $x_1 \in \mathbb{Z}_{n}$ and Bob $x_2 \in \mathbb{Z}_{n}$ such that $x
\equiv x_1x_2 \pmod n$. Alice holds her public key $Q_1 = x_1 \cdot G$ and Bob
$Q_2 = x_2 \cdot G$ such that $Q = x_1 \cdot Q_2$ for Alice or $Q = x_2 \cdot
Q_1$ for Bob. The notation $\cdot$ is used to denote the point multiplication
over the curve.

All the random values $k$ are chosen in $\mathbb{Z}_{n}$ instead of
$\mathbb{Z}_{q}$, also in the case of deterministic signature. All the
computation modulo $q$ is replaced by modulo $n$, as shown in the previous
digital signature recap. Values $R_2$ and $R$ become points. Verifications of
values $R_2$ and $R$ become point verifications on the curve and $r'$ is
calculated by Alice and Bob as shown in the other reminder. The value $cq$ added
to the homomorphic encrypted signature is transformed into $cn$ to hide values
$z_2$ and $x_2z_2$ in $\mathbb{Z}_{n}$.

The author noticed an error of notation in the original paper. On the second
line Alice computes $z_1 \equiv (k_1)^{-1} \pmod n$ and the original paper uses
the random value selection $\xleftarrow[]{R}$ instead of a standard assignation
$\leftarrow$. This error is corrected in the following version of the protocol
and does not affect the security.

\newpage

\begin{figure}[H]
    \begin{table}[H]
      \centering
      \begin{footnotesize}
      {\renewcommand{\arraystretch}{1.2}%
      \begin{tabular}{ | l l | }
        \hline
        \multicolumn{1}{|c}{alice}  & \multicolumn{1}{c|}{bob} \\
        $k_1 \xleftarrow[]{R} \mathbb{Z}_{n}$ & \\
        $z_1 \leftarrow (k_1)^{-1} \mod n$ & \\
        $\alpha \leftarrow E_{pk}(z_1)$ & \\
        $\zeta \leftarrow E_{pk}(x_1z_1 \mod n)$ & \\[2ex]
          & abort if($\alpha \notin C_{pk} \lor \zeta \notin C_{pk}$) \\
          & $k_2 \xleftarrow[]{R} \mathbb{Z}_{n}$ \\
          & $\mathcal{R}_2 \leftarrow k_2 \cdot \mathcal{G}$ \\[2ex]
        abort if($\mathcal{R}_2 \notin \mathcal{E}$) & \\
        $\mathcal{R} \leftarrow k_1 \cdot \mathcal{R}_2$ & \\
        \multicolumn{2}{|l|}{
        $\Pi \leftarrow \texttt{zkp} \begin{bmatrix}\begin{array}{lr}
                                      \exists \eta_1, \eta_2 : & \eta_1, \eta_2 \in [-n^3, n^3] \\
                                      \land & \eta_1 \cdot \mathcal{R} = \mathcal{R}_2 \\
                                      \land & (\eta_2/\eta_1) \cdot \mathcal{G} = \mathcal{Q}_1 \\
                                      \land & D_{sk}(\alpha) \equiv_n \eta_1 \\
                                      \land & D_{sk}(\zeta) \equiv_n \eta_2
                                     \end{array}\end{bmatrix}$ } \\ & \\
          & abort if($\mathcal{R} \notin \mathcal{E}$) \\
          & abort if(\texttt{Verifier}$(\Pi) = 0$) \\
          & $m' \leftarrow \texttt{h}(m)$ \\
          & $r' \leftarrow x \mod n : (x,y) = \mathcal{R}$ \\
          & $z_2 \leftarrow (k_2)^{-1} \mod n$ \\
          & $c \xleftarrow[]{R} \mathbb{Z}_{n^5}$ \\
          & $\begin{aligned}[t]
              \mu \leftarrow & (\alpha \times_{pk} m'z_2) +_{pk} \\
                             & (\zeta \times_{pk} r'x_2z_2) +_{pk} E_{pk}(cn)
            \end{aligned}$ \\
          & $\mu' \leftarrow E_{pk'}(z_2)$ \\
          & {$\Pi' \leftarrow \texttt{zkp} \begin{bmatrix}\begin{array}{lr}
                                            \exists \eta_1, \eta_2, \eta_3 : & \eta_1, \eta_2 \in [-n^3, n^3] \\
                                            \land & \eta_3 \in [-n^5, n^5] \\
                                            \land & \eta_1 \cdot \mathcal{R}_2 = \mathcal{G} \\
                                            \land & (\eta_2/\eta_1) \cdot \mathcal{G} = \mathcal{Q}_2 \\
                                            \land & D_{sk'}(\mu') \equiv_n \eta_1 \\
                                            \multicolumn{2}{l}{
                                              \begin{aligned}[t]
                                                  \land \quad D_{sk}(\mu) \equiv_n & D_{sk}((\alpha \times_{pk} m'\eta_1) +_{pk} \\
                                                                                & (\zeta \times_{pk} r'\eta_2) +_{pk} E_{pk}(n\eta_3))
                                                \end{aligned}
                                            }
                                           \end{array}\end{bmatrix}$} \\ & \\
        abort if($\mu \notin C_{pk} \lor \mu' \notin C_{pk'}$) & \\
        abort if(\texttt{Verifier}$(\Pi') = 0$) & \\
        $s \leftarrow D_{sk}(\mu) \mod n$ & \\
        $r \leftarrow x \mod n : (x,y) = \mathcal{R}$ & \\
        publish <$r$, $s$> & \\
        \hline
      \end{tabular}}
      \end{footnotesize}
    \end{table}

  \caption{Adapted protocol for ECDSA}
  \label{fig:adaptationSchemeECDSA}
\end{figure}

\subsection{Adapting zero-knowledge proofs}

Because the protocol designs proofs for the DSA architecture the values
tested in the proofs are values in $\mathbb{Z}_{q}$. These values are used to
create a challenge value $e$ with two hash functions, a different one per proof. For
ECDSA some of these values become points, so some equations need to be adapted.
The adapted protocol serializes points in the long form, 65 bytes starting with
\texttt{0x04} and two 32 byte coordinates for $(x, y)$. As mentioned in the
original paper, the variables names are not consistent with the first part of
the paper. Starting now the variable names follow the same notation as the
original paper and are therefore no longer consistent with the previous pages.

\subsubsection{Zero-knowledge proof $\Pi$}

The first zero-knowledge proof $\Pi$ is created by Alice to prove to Bob that
she acted correctly and has encrypted coherent data with Paillier encryption,
proving the ownership and the validity of the two encrypted values in relation
to the public address $Q_1$ with $(x_1z_1 / z_1) \cdot G = Q_1$. The proof
states that the encrypted value $\alpha$ is related to $R$ and $R_2$ such that
$(k_1)^{-1} \cdot R = ((k_1)^{-1}k_1k_2) \cdot G = k_2 \cdot G = R_2$.

\begin{figure}[h]
    \begin{table}[H]
      \centering
      \begin{footnotesize}
        \[
        \Pi \leftarrow \texttt{zkp} \begin{bmatrix}\begin{array}{lr}
                                      \exists x_1, x_2 : & x_1, x_2 \in [-n^3, n^3] \\
                                      \land & x_1 \cdot \mathcal{C} = \mathcal{W}_1 \\
                                      \land & (x_2/x_1) \cdot \mathcal{D} = \mathcal{W}_2 \\
                                      \land & D_{sk}(m_1) \equiv_n x_1 \\
                                      \land & D_{sk}(m_2) \equiv_n x_2
                                     \end{array}\end{bmatrix}
        \]
      \end{footnotesize}
    \end{table}

  \caption{The proof $\Pi$ adapted}
  \label{fig:theProofPi}
\end{figure}

To help the reader a mapping of old variable names to the new variable names is presented below.

\begin{table}[h]
  \begin{tabular}{p{4cm} l}
    $x_1 = z_1$ & $\mathcal{C} = \mathcal{R}$ \\
    $x_2 = x_1z_1 \mod n$ & $\mathcal{D} = \mathcal{G}$ \\
    $m_1 = \alpha$ & $\mathcal{W}_1 = \mathcal{R}_2$ \\
    $m_2 = \zeta$ & $\mathcal{W}_2 = \mathcal{Q}_1$
  \end{tabular}
  \caption{Mapping between the protocol's variable names and the ZKP $\Pi$}
  \label{fig:mappingOfVarNamesPi}
\end{table}

\begin{figure}[h]
    \begin{table}[H]
      \centering
      \begin{footnotesize}
      \begin{tabular}{ | p{6cm} p{6cm} | }
        \hline
        \multicolumn{2}{ | c | }{$\langle z_1, z_2, \mathcal{Y}, e, s_1, s_2, s_3, t_1, t_2, t_3, t_4 \rangle \leftarrow \Pi$} \\
          & \\
        $\text{Verify } s_1, t_1 \in \mathbb{Z}_{n^3}$ & $\mathcal{V}_1 \leftarrow (t_1 + t_2) \cdot \mathcal{D} + (-e) \cdot \mathcal{Y}$ \\
        $\mathcal{U}_1 \leftarrow s_1 \cdot \mathcal{C} + (-e) \cdot \mathcal{W}_1$ & $\mathcal{V}_2 \leftarrow s_1 \cdot \mathcal{W}_2 + t_2 \cdot \mathcal{D} + (-e) \cdot \mathcal{Y}$ \\
        $u_2 \leftarrow g^{s_1}(s_2)^N(m_1)^{-e} \mod N^2$ & $v_3 \leftarrow g^{t_1} (t_3)^N (m_2)^{-e} \mod N^2$ \\
        $u_3 \leftarrow (h_1)^{s_1} (h_2)^{s_3} (z_1)^{-e} \mod \tilde{N}$ & $v_4 \leftarrow (h_1)^{t_1} (h_2)^{t_4} (z_2)^{-e} \mod \tilde{N}$ \\
         & \\
        \multicolumn{2}{|c|}{$\text{Verify } e = \texttt{hash}(\mathcal{C}, \mathcal{W}_1, \mathcal{D}, \mathcal{W}_2, m_1, m_2, z_1, \mathcal{U}_1, u_2, u_3, z_2, \mathcal{Y}, \mathcal{V}_1, \mathcal{V}_2, v_3, v_4)$} \\
        \hline
      \end{tabular}
      \end{footnotesize}
    \end{table}

  \caption{Adaptation of the verification of $\Pi$ in ECDSA}
  \label{fig:adaptationOfPiVerification}
\end{figure}

\begin{figure}[h]
    \begin{table}[H]
      \centering
      \begin{footnotesize}
      \begin{tabular}{ | p{5cm} p{5cm} | }
        \hline
        $\alpha \xleftarrow[]{R} \mathbb{Z}_{n^3}$ & $\delta \xleftarrow[]{R} \mathbb{Z}_{n^3}$ \\
        $\beta \xleftarrow[]{R} \mathbb{Z}_{N}^{*}$ & $\mu \xleftarrow[]{R} \mathbb{Z}_{N}^{*}$ \\
        $\gamma \xleftarrow[]{R} \mathbb{Z}_{n^{3}\tilde{N}}$ & $\nu \xleftarrow[]{R} \mathbb{Z}_{n^{3}\tilde{N}}$ \\
        $\rho_1 \xleftarrow[]{R} \mathbb{Z}_{n\tilde{N}}$ & $\rho_2 \xleftarrow[]{R} \mathbb{Z}_{n\tilde{N}}$ \\
         & $\rho_3 \xleftarrow[]{R} \mathbb{Z}_{n}$ \\
         & $\epsilon \xleftarrow[]{R} \mathbb{Z}_{n}$ \\
         & \\
        $z_1 \leftarrow (h_1)^{x_1}(h_2)^{\rho_1} \mod \tilde{N}$ & $z_2 \leftarrow (h_1)^{x_2}(h_2)^{\rho_2} \mod \tilde{N}$ \\
        $\mathcal{U}_1 \leftarrow \alpha \cdot \mathcal{C}$ & $\mathcal{Y} \leftarrow (x_2 + \rho_3) \cdot \mathcal{D}$ \\
        $u_2 \leftarrow g^{\alpha} \beta^{N} \mod N^2$ & $\mathcal{V}_1 \leftarrow (\delta + \epsilon) \cdot \mathcal{D}$ \\
        $u_3 \leftarrow (h_1)^{\alpha} (h_2)^{\gamma} \mod \tilde{N}$ & $\mathcal{V}_2 \leftarrow \alpha \cdot \mathcal{W}_2 + \epsilon \cdot \mathcal{D}$ \\
         & $v_3 \leftarrow g^{\delta} \mu^{N} \mod N^2$ \\
         & $v_4 \leftarrow (h_1)^{\delta} (h_2)^{\nu} \mod \tilde{N}$ \\
         & \\
        \multicolumn{2}{|l|}{$e \leftarrow \texttt{hash}(\mathcal{C}, \mathcal{W}_1, \mathcal{D}, \mathcal{W}_2, m_1, m_2, z_1, \mathcal{U}_1, u_2, u_3, z_2, \mathcal{Y}, \mathcal{V}_1, \mathcal{V}_2, v_3, v_4)$} \\
         & \\
        $s_1 \leftarrow ex_1 + \alpha$ & $t_1 \leftarrow ex_2 + \delta$ \\
        $s_2 \leftarrow (r_1)^e \beta \mod N$ & $t_2 \leftarrow e \rho_3 + \epsilon \mod n$ \\
        $s_3 \leftarrow e \rho_1 + \gamma$ & $t_3 \leftarrow (r_2)^e \mu \mod N^2$ \\
         & $t_4 \leftarrow e \rho_2 + \nu$ \\
         & \\
        \multicolumn{2}{ | c | }{$\Pi \leftarrow \langle z_1, z_2, \mathcal{Y}, e, s_1, s_2, s_3, t_1, t_2, t_3, t_4 \rangle$} \\
        \hline
      \end{tabular}
      \end{footnotesize}
    \end{table}

  \caption{Adaptation of the construction of $\Pi$ in ECDSA}
  \label{fig:adaptationOfPi}
\end{figure}

\subsubsection{Zero-knowledge proof $\Pi'$}

The second zero-knowledge proof is created by Bob to prove to Alice that he
acted honestly according to the protocol. The proof states that the point
$\mathcal{R}_2$ is generated accordingly to the value $z_2$ and so to the value
$k_2$. That the public key $\mathcal{Q}_2$ is related to the values $z_2$ and
$x_2z_2$, and that the encrypted values $\mu$ and $\mu'$ are correctly composed.
Again a mapping between the old names and the new names is presented to help the
reader.

\begin{table}[h]
  \begin{tabular}{p{4cm} l}
    $x_1 = z_2$ & $\mathcal{C} = \mathcal{R}_2$ \\
    $x_2 = x_2z_2 \mod n$ & $\mathcal{D} = \mathcal{G}$ \\
    $x_3 = c \mod n$ & $\mathcal{W}_1 = \mathcal{G}$ \\
    $m_1 = \mu'$ & $\mathcal{W}_2 = \mathcal{Q}_2$ \\
    $m_2 = \mu$ & $m_3 = \alpha$ \\
    $m_4 = \zeta$ &
  \end{tabular}
  \caption{Mapping between the protocol's variable names and the ZKP $\Pi'$}
  \label{fig:mappingOfVarNamesPi2}
\end{table}

\begin{figure}[h]
    \begin{table}[H]
      \centering
      \begin{footnotesize}
        \[
        \Pi' \leftarrow \texttt{zkp} \begin{bmatrix}\begin{array}{lr}
                                          \exists x_1, x_2, x_3 : & x_1, x_2 \in [-n^3, n^3] \\
                                          \land & x_3 \in [-n^5, n^5] \\
                                          \land & x_1 \cdot \mathcal{C} = \mathcal{W}_1 \\
                                          \land & (x_2/x_1) \cdot \mathcal{D} = \mathcal{W}_2 \\
                                          \land & D_{sk'}(m_1) \equiv_n x_1 \\
                                          \multicolumn{2}{l}{
                                            \begin{aligned}[t]
                                                \land \quad D_{sk}(m_2) \equiv_n & D_{sk}((m_3 \times_{pk} m'x_1) +_{pk} \\
                                                                                & (m_4 \times_{pk} r'x_2) +_{pk} E_{pk}(nx_3))
                                              \end{aligned}
                                          }
                                         \end{array}\end{bmatrix}
        \]
      \end{footnotesize}
    \end{table}

  \caption{The proof $\Pi'$ adapted}
  \label{fig:theProofPi2}
\end{figure}

In the first Python implementation, the ZKP $\Pi'$ did not pass validation.
To investigate where the problem comes from, all equations from the validation
was done by hand. By expanding the equation $v_3$, we can see that the result
does not match the expected value.

\paragraph{Correcting the verification of $\Pi'$}
If $x_1 = z_2$, $x_2 = x_2 z_2$, $x_3 = c$, and $m_2 = \mu$ such that $\mu =
(\alpha)^{m' x_1} (\zeta)^{r' x_2} g^{nx_3} (r_2)^{N}$, then the equation $v_3$
in the validation process does not correspond to construction of $v_3$ in the
original paper. The result in the verification process $\Pi'$ need to match
$v_3 \leftarrow (m_3)^{\alpha} (m_4)^{\delta} g^{n \sigma} \mu^{N} \mod N^2$.
The original equation proposes $v_3 \leftarrow (m_3)^{s_1} (m_4)^{t_1} g^{nt_5}
(t_3)^{N} (m_2)^{-e} \mod N^2$ which does not include $m'$ and $r'$ present in $\mu$,
so $m_2$ cannot be used correctly as shown next.

\begin{equation}
\begin{split}
   v_3 &\equiv (m_3)^{s_1} (m_4)^{t_1} g^{nt_5} (t_3)^{N} (m_2)^{-e} \pmod{N^2} \\
       &\equiv (m_3)^{ex_1 + \alpha} (m_4)^{ex_2 + \beta} g^{n(ex_3 + \sigma)}
       \big((r_2)^e \mu\big)^{N}
       \big((m_3)^{m' x_1} (m_4)^{r' x_2} g^{nx_3} (r_2)^{N}\big)^{-e} \\
       &\equiv (m_3)^{ex_1 + \alpha} (m_4)^{ex_2 + \beta} g^{n(ex_3 + \sigma)}
       (r_2)^{eN} \mu^{N}
       (m_3)^{-e m' x_1} (m_4)^{-e r' x_2} g^{-e nx_3} (r_2)^{-eN} \\
       &\equiv (m_3)^{ex_1 + \alpha - e m' x_1} (m_4)^{ex_2 + \beta - e r' x_2}
       g^{enx_3 + n\sigma - enx_3} (r_2)^{eN - eN} \mu^{N}  \\
       &\equiv (m_3)^{ex_1 + \alpha - e m' x_1} (m_4)^{ex_2 + \beta - e r' x_2}
       g^{n\sigma} \mu^{N}  \\
\end{split}
\end{equation}

The equation $v_3$ needs to be adapted to include $x_4 = m'$ and $x_5 = r'$
($m'$ and $r'$ cannot be include directly in $x_1$ and $x_2$ without breaking
equations $u_1, u_2, u_3, v_2$.) Two new parameters $s_4 \leftarrow ex_1 x_4 +
\alpha$ and $t_7 \leftarrow ex_2 x_5 + \delta$ are added into the proof to
correct the equation.

\begin{equation}
\begin{split}
   v_3 &\equiv (m_3)^{s_4} (m_4)^{t_7} g^{nt_5} (t_3)^{N} (m_2)^{-e} \pmod{N^2} \\
       &\equiv (m_3)^{ex_1x_4 + \alpha} (m_4)^{ex_2x_5 + \beta} g^{n(ex_3 + \sigma)}
       \big((r_2)^e \mu\big)^{N}
       \big((m_3)^{x_1x_4} (m_4)^{x_2x_5} g^{nx_3} (r_2)^{N}\big)^{-e} \\
       &\equiv (m_3)^{ex_1x_4 + \alpha} (m_4)^{ex_2x_5 + \beta} g^{n(ex_3 + \sigma)}
       (r_2)^{eN} \mu^{N}
       (m_3)^{-e x_1x_4} (m_4)^{-e x_2x_5} g^{-e nx_3} (r_2)^{-eN} \\
       &\equiv (m_3)^{ex_1x_4 + \alpha - e x_1x_4} (m_4)^{ex_2x_5 + \beta - e x_2x_5}
       g^{enx_3 + n\sigma - enx_3} (r_2)^{eN - eN} \mu^{N}  \\
       &\equiv (m_3)^{\alpha} (m_4)^{\beta} g^{n\sigma} \mu^{N} \\
\end{split}
\end{equation}

Further research needs to be done to validate that the introduction of these two
new parameters $s_4$ and $t_7$ does not break the security model.

\begin{figure}[ht]
    \begin{table}[H]
      \centering
      \begin{footnotesize}
      \begin{tabular}{ | p{5.5cm} p{6cm} | }
        \hline
        $\alpha \xleftarrow[]{R} \mathbb{Z}_{n^3}$ & $\delta \xleftarrow[]{R} \mathbb{Z}_{n^3}$ \\
        $\beta \xleftarrow[]{R} \mathbb{Z}_{N'}^{*}$ & $\mu \xleftarrow[]{R} \mathbb{Z}_{N}^{*}$ \\
        $\gamma \xleftarrow[]{R} \mathbb{Z}_{n^{3}\tilde{N}}$ & $\nu \xleftarrow[]{R} \mathbb{Z}_{n^{3}\tilde{N}}$ \\
        $\rho_1 \xleftarrow[]{R} \mathbb{Z}_{n\tilde{N}}$ & $\rho_2 \xleftarrow[]{R} \mathbb{Z}_{n\tilde{N}}$ \\
         & $\rho_3 \xleftarrow[]{R} \mathbb{Z}_{n}$ \\
         & $\rho_4 \xleftarrow[]{R} \mathbb{Z}_{n^5\tilde{N}}$ \\
         & $\epsilon \xleftarrow[]{R} \mathbb{Z}_{n}$ \\
         & $\sigma \xleftarrow[]{R} \mathbb{Z}_{n^7}$ \\
         & $\tau \xleftarrow[]{R} \mathbb{Z}_{n^7\tilde{N}}$ \\
         & \\
        $z_1 \leftarrow (h_1)^{x_1}(h_2)^{\rho_1} \mod \tilde{N}$ & $z_2 \leftarrow (h_1)^{x_2}(h_2)^{\rho_2} \mod \tilde{N}$ \\
        $\mathcal{U}_1 \leftarrow \alpha \cdot \mathcal{C}$ & $\mathcal{Y} \leftarrow (x_2 + \rho_3) \cdot \mathcal{D}$ \\
        $u_2 \leftarrow (g')^{\alpha} \beta^{N'} \mod (N')^2$ & $\mathcal{V}_1 \leftarrow (\delta + \epsilon) \cdot \mathcal{D}$ \\
        $u_3 \leftarrow (h_1)^{\alpha} (h_2)^{\gamma} \mod \tilde{N}$ & $\mathcal{V}_2 \leftarrow \alpha \cdot \mathcal{W}_2 + \epsilon \cdot \mathcal{D}$ \\
         & $v_3 \leftarrow (m_3)^{\alpha} (m_4)^{\delta} g^{n \sigma} \mu^{N} \mod N^2$ \\
         & $v_4 \leftarrow (h_1)^{\delta} (h_2)^{\nu} \mod \tilde{N}$ \\
         & $z_3 \leftarrow (h_1)^{x_3} (h_2)^{\rho_4} \mod \tilde{N}$ \\
         & $v_5 \leftarrow (h_1)^{\sigma} (h_2)^{\tau} \mod \tilde{N}$ \\
         & \\
        \multicolumn{2}{ | l | }{$e \leftarrow \texttt{hash'}(\mathcal{C}, \mathcal{W}_1, \mathcal{D}, \mathcal{W}_2, m_1, m_2, z_1, \mathcal{U}_1, u_2, u_3, z_2, z_3, \mathcal{Y}, \mathcal{V}_1, \mathcal{V}_2, v_3, v_4, v_5)$} \\
         & \\
        $s_1 \leftarrow ex_1 + \alpha$ & $t_1 \leftarrow ex_2 + \delta$ \\
        $s_2 \leftarrow (r_1)^e \beta \mod N'$ & $t_2 \leftarrow e \rho_3 + \epsilon \mod n$ \\
        $s_3 \leftarrow e \rho_1 + \gamma$ & $t_3 \leftarrow (r_2)^e \mu \mod N$ \\
        $s_4 \leftarrow ex_1 x_4 + \alpha$ & $t_4 \leftarrow e \rho_2 + \nu$ \\
         & $t_5 \leftarrow e x_3 + \sigma$ \\
         & $t_6 \leftarrow e \rho_4 + \tau$ \\
         & $t_7 \leftarrow ex_2 x_5 + \delta$ \\
         & \\
        \multicolumn{2}{ | c | }{$\Pi' \leftarrow \langle z_1, z_2, z_3, \mathcal{Y}, e, s_1, s_2, s_3, s_4, t_1, t_2, t_3, t_4, t_5, t_6, t_7 \rangle$} \\
        \hline
      \end{tabular}
      \end{footnotesize}
    \end{table}

  \caption{Adaptation of the construction of $\Pi'$ in ECDSA}
  \label{fig:adaptationOfPi2}
\end{figure}

\begin{figure}[ht]
    \begin{table}[H]
      \centering
      \begin{footnotesize}
      \begin{tabular}{ | p{6cm} p{6cm} | }
        \hline
        \multicolumn{2}{ | c | }{$\langle z_1, z_2, z_3, \mathcal{Y}, e, s_1, s_2, s_3, s_4, t_1, t_2, t_3, t_4, t_5, t_6, t_7 \rangle \leftarrow \Pi'$} \\
          & \\
        $\text{Verify } s_1, t_1 \in \mathbb{Z}_{n^3}$ & $\mathcal{V}_1 \leftarrow (t_1 + t_2) \cdot \mathcal{D} + (-e) \cdot \mathcal{Y}$ \\
        $\text{Verify } t_5 \in \mathbb{Z}_{n^7}$ & $\mathcal{V}_2 \leftarrow s_1 \cdot \mathcal{W}_2 + t_2 \cdot \mathcal{D} + (-e) \cdot \mathcal{Y}$ \\

        $\mathcal{U}_1 \leftarrow s_1 \cdot \mathcal{C} + (-e) \cdot \mathcal{W}_1$ &
        $\begin{aligned}[t]
            v_3 \leftarrow & (m_3)^{s_4} (m_4)^{t_7} g^{nt_5} (t_3)^{N} (m_2)^{-e} \\
                           &\mod N^2
          \end{aligned}$ \\
        $u_2 \leftarrow (g')^{s_1} (s_2)^{N'} (m_1)^{-e} \mod (N')^2$ & $v_4 \leftarrow (h_1)^{t_1} (h_2)^{t_4} (z_2)^{-e} \mod \tilde{N}$ \\
        $u_3 \leftarrow (h_1)^{s_1} (h_2)^{s_3} (z_1)^{-e} \mod \tilde{N}$ &  $v_5 \leftarrow (h_1)^{t_5} (h_2)^{t_6} (z_3)^{-e} \mod \tilde{N}$\\
         & \\
        \multicolumn{2}{ | c | }{$\text{Verify } e = \texttt{hash'}(\mathcal{C}, \mathcal{W}_1, \mathcal{D}, \mathcal{W}_2, m_1, m_2, z_1, \mathcal{U}_1, u_2, u_3, z_2, z_3, \mathcal{Y}, \mathcal{V}_1, \mathcal{V}_2, v_3, v_4, v_5)$} \\
        \hline
      \end{tabular}
      \end{footnotesize}
    \end{table}

  \caption{Adaptation of the verification of $\Pi'$ in ECDSA}
  \label{fig:adaptationOfPi2Verification}
\end{figure}

\vfill
\newpage

% -----------------------------------------------------------------------------
\section{Threshold Hierarchical Determinitic Wallets}

Hierarchical deterministic wallets are sophisticated wallets in which new keys
can be generated from a previous key. Adapting hierarchical deterministic
wallets with a threshold scheme can be achieved by sharing the private key
additively among $P = \{p_1, \dots, p_{i}\}$ players

\begin{equation*}
\begin{split}
  pk_i     &= sk_i \cdot G \\
  sk_{mas} &= \sum_{j=1}^{i} sk_j \bmod n \\
  pk_{mas} &= \Bigg[ \sum_{j=1}^{i} sk_j \bmod n \Bigg] \cdot G \\
           &= \sum_{j=1}^{i} (sk_j \cdot G) = \sum_{j=1}^{i} pk_i
\end{split}
\end{equation*}

or multiplicatively

\begin{equation*}
\begin{split}
  sk_{mas} &= \prod_{j=1}^{i} sk_j \bmod n \\
  pk_{mas} &= \Bigg[ \prod_{j=1}^{i} sk_j \bmod n \Bigg] \cdot G \\
           &= \Big(\big((G \cdot sk_1) \cdot sk_2\big) \dots \Big)\cdot sk_j
\end{split}
\end{equation*}

In the additive case, the master public key $pk_{mas}$ is also the sum of all
the points $pk_i$, which means that if each player publishes his share point,
everyone can compute the master public key. The multiplicative sharing is more
communication intensive because the computation of the public key is sequential
instead of parallel.

An extended private key share is a tuple of $(sk_i, c)$ with $sk_i$ the regular
private key and $c$ the chain code, such that $c$ is the same for each player.
In the following, it is assumed that the private key is shared multiplicatively.

\subsection{Private parent key to private child key}

The function \texttt{CKDpriv} computes a child extended private key from the
parent extended private key. The derivation can be \textit{hardened}. This
proposal differs from the BIP32 \cite{HDWallets} standard in the chain
derivation process. The \texttt{ser} function and \texttt{point} function are
the same as described in the \gls{bip}.

\begin{equation}
\begin{split}
  f(l) &=
  \begin{cases}
    \texttt{HMAC-SHA256}(c_{par}, \texttt{0x00}\mid\mid \texttt{ser}_{256}(sk_i^{par}) \mid\mid \texttt{ser}_{32}(k)) & \quad \text{if } k \geq 2^{31}\\
    \texttt{HMAC-SHA256}(c_{par}, \texttt{ser}_{p}(\texttt{point}(sk_{mas}^{par})) \mid\mid \texttt{ser}_{32}(k)) & \quad \text{if } k < 2^{31}
  \end{cases} \\
  sk_i &\equiv l \cdot sk_i^{par} \pmod n
\end{split}
\end{equation}

The function $f(l)$ computes the partial share $l$ at index $kFurther research needs$, such that
multiplied with the parent private key share $sk_i^{par}$ for the player $i$ the
result is $sk_i$.

\subsection{Public parent key to public child key}

The function \texttt{CKDpub} computes a child extend public key from the parent
extended public key. It is worth noting that it is not possible to compute a
\textit{hardened} derivation without the private parent key, and
that every player updates the master public key for the threshold not their
public key share.

\begin{equation}
\begin{split}
  f(l) &=
  \begin{cases}
    \texttt{failure} & \quad \text{if } k \geq 2^{31}\\
    \texttt{HMAC-SHA256}(c_{par}, \texttt{ser}_{p}(pk_{mas}^{par}) \mid\mid \texttt{ser}_{32}(k)) & \quad \text{if } k < 2^{31}
  \end{cases} \\
  pk_{mas} &= l \cdot pk_{mas}^{par}\\
      &= l \cdot (sk_{mas}^{par} \cdot G)\\
      &= (l \cdot sk_{mas}^{par} \bmod n) \cdot G
\end{split}
\end{equation}

\subsection{Child key share derivation}

The protocol assumes that one of the players $p_i \in P = \{p_1, \dots, p_{i}\}$ is designated as the leader
$L$. The function \texttt{CKSD} computes a threshold child extended key share
from the threshold parent extended key share for the derivation index $k$. It is
worth noting that only the leader $L$ uses \texttt{CKDpriv} and if the derivation
is \textit{hardened}, i.e., if $k \geq 2^{31}$, a special case occurred and a
round of communication is needed. Let's define \texttt{CKSD} for $k < 2^{31}$

\begin{equation}
\begin{split}
  \forall p_i \in P : f(t) &=
  \begin{cases}
    \texttt{CKDpriv}(k) & \quad \text{if } p_i = L\\% \land i < 2^{31}
    \texttt{CKDpub}(k) & \quad \text{if } p_i \neq L
  \end{cases}
\end{split}
\end{equation}

such that

\begin{equation}
\begin{split}
  sk_{i} &=
  \begin{cases}
    sk_{i}^{par} \cdot t & \quad \text{if } p_i = L\\% \land i < 2^{31}
    sk_{i}^{par} & \quad \text{if } p_i \neq L
  \end{cases}\\
  % sk_{i = L} &= sk_{i}^{par} \cdot t \\
  % sk_{i \neq L} &= sk_{i}^{par} \\
  sk_{mas} &= \Bigg[ \prod_{j=1}^{i} sk_{j}^{par} \Bigg] \cdot t \\
       &= sk_{mas}^{par} \cdot t
\end{split}
\end{equation}

and then $\forall p_i \in P$

\begin{equation}
\begin{split}
  pk_{mas} &= pk_{mas}^{par} \cdot t \\
       &= (sk_{mas}^{par} \cdot G) \cdot t \\
       &= \Bigg[ \prod_{j=1}^{i} sk_{j}^{par} \Bigg] \cdot G
\end{split}
\end{equation}

At each derivation index each player updates their chain code. The derivation
does not depend on the secret key because the chain code must remain
deterministic and have the same value for each player without requiring
a round of communication.

\begin{equation}
\begin{split}
  c_i &= \texttt{HMAC-SHA256}(c_i^{par}, \texttt{ser}_{32}(k))
\end{split}
\end{equation}

If the index $k \geq 2^{31}$ the new master public key, only calculable by the
master player $L$, must be revealed to other players. A round of communication
is then needed to continue derivation.

In this threshold HD scheme only one private share changes at each derivation. In
other words, the master private share is derived either with public information
or with private information. If the derivation is private, i.e.,
\textit{hardened} derivation, then a communication round between the players is
necessary, more specifically we assume that a secure broadcast channel is open
from the master player to the other players.

This scheme is sufficient for the payment channels. Players negotiate a
threshold key used for the $\texttt{Multisig}_i$ address with a root derivation
path \texttt{m/44'/0'/a'/0'} at the opening of the channel (with variable \texttt{a}
is related to the channel account number between the client and the provider as
shown in the paper.) Then the index \texttt{i} in the paper is used to derive
each address without requiring any communication. It is worth noting that the
root derivation path can also be simplified at \texttt{m/a'} or even \texttt{m/}
because the compatibility with a standard wallet is no longer a requirement.
Noted that the version \texttt{m/a'} is more flexible and allows multiple
channels between a client and a provider with only one threshold key.

\subsection{Proof-of-concept implementation}

A Python proof-of-concept has been coded. A share can be tagged as
master share as previously described. The result of the script is presented
below, three shares are created, and the first one is tagged as the master
share. The root threshold public key \texttt{m/} is computed and displayed, then
individual shares' addresses are displayed. The share $s_1$ is derived with and
without \textit{hardened} path, as expected the resulting address is different.
The master public key resulting from each share derivation for the path
\texttt{m/44/0/1} is the same as computing the private key with all individual
secret shares and getting the associated address, as expected. To note that only
the master individual address for \texttt{m/} and \texttt{m/44/0/1} has changed.
The complete implementation is shown in the appendices.

\begin{listing}
  \begin{minted}[breaklines=true,fontsize=\scriptsize]{text}
=== Threshold addresses ===
Master root public key m/   : 1BF5ZpQMCg3eGDEm51rkiwcKR12UnFu

*** Individual addresses m/ ***
s1: 1tRFxbAfKKowtqrSC3bVUi491hTXqg1
s2: 16uCytSc9oAJyi5FbxmH6NyTJuYkCLj
s3: 1TcYLZUZYd86AFaT58tzFGBW1BVVw7K

*** Hardened derivation for one share ***
s1 m/44/0/1  : 128PvDGSbZuNpz1zG1Mh1fjJFN3eNaTb
s1 m/44/0/1' : 12883vUsA2gyCAcSNogGUMFuCJsrj58

*** Master public key m/44/0/1 ***
s1: 128PvDGSbZuNpz1zG1Mh1fjJFN3eNaTb
s2: 128PvDGSbZuNpz1zG1Mh1fjJFN3eNaTb
s3: 128PvDGSbZuNpz1zG1Mh1fjJFN3eNaTb

Master public key m/44/0/1 : 128PvDGSbZuNpz1zG1Mh1fjJFN3eNaTb

*** Individual addresses m/44/0/1 ***
s1: 1nNL1gozCk4J1agV667kJFmsyu4RvF5
s2: 16uCytSc9oAJyi5FbxmH6NyTJuYkCLj
s3: 1TcYLZUZYd86AFaT58tzFGBW1BVVw7K
  \end{minted}
	\caption{Result of Python proof-of-concept threshold HD wallet}
	\label{lst:testThresholdHDMainRes}
\end{listing}

A share is composed of four main pieces of information (i) the secret share, (ii) the
chain code, (iii) the tag for the master share, and (iv) the threshold public
key. Players can set the threshold public key address after computation. The
derive function \texttt{d} derives with \texttt{CKDpub} or \texttt{CKDpriv}
depending on the master tag and returns a new share for a given index. The path
derivation function \texttt{derive} takes a path and generates the chain of
shares. In this Implementation, if a share not tagged as master tries to derive a
path with a \texttt{hardened} index, an exception is raised, and the process
stops. However, in a real-world case, a communication process must take place to
complete the derivation with an external input to update the master player public
key share.

\begin{listing}
  \pythonfile[firstline=252,lastline=295]{02-main/listings/address.py}
	\caption{Demonstration of using threshold HD wallet}
	\label{lst:testThresholdHDMain}
\end{listing}

\begin{listing}
  \pythonfile[firstline=163,lastline=230]{02-main/listings/address.py}
	\caption{Construction of a share for a threshold HD wallet}
	\label{lst:testThresholdHDShare}
\end{listing}

% -----------------------------------------------------------------------------
\section{Threshold deterministic signatures}

One of the simplest ways to compromise the private key in \gls{ecdsa}, or in
\gls{dsa}, is to select a weak pseudo-random number generator for $k$ or even
worse, select a static value for $k$. This problem already affected Sony in
December 2010 when a group of hackers calling itself \textit{fail0verflow}
announced the recovery of the \gls{ecdsa} private key used to sign software for
the PlayStation 3. The recovery process is simple.

Given two signatures $(r, s)$ and $(r, s')$ employing the same unknown $k$ for
different messages $m$ and $m'$. Let's define $x$ as the private key, $z$ as the
hash of $m$ and $z'$ of $m'$, an attacker can calculate

\begin{equation}
\begin{split}
  s &\equiv k^{-1} (z + rx) \pmod n \\
  s' &\equiv k^{-1} (z' + rx) \pmod n \\
  s - s' &\equiv k^{-1} (z + rx) - k^{-1} (z' + rx) \pmod n \\
         &\equiv k^{-1} (z - z') \pmod n \\
  k &\equiv \frac{z - z'}{s - s'} \pmod n \\
  x &\equiv \frac{sk - z}{r} \pmod n
\end{split}
\end{equation}

However, this issue can be prevented by a deterministic generation of $k$, as
described by RFC 6979 \cite{rfc6979}. The random value $k$ can be generated
deterministically by using a \texttt{HMAC} function such that the parameters are
the private key and the message to sign.

The other positive side is that signatures for the same key pair and the same
message are deterministic, i.e., if the same message is signed multiple times, the
signature remains the same. This determinism is also a significant advantage in
Bitcoin to reduce transaction malleability (nevertheless, the signer can still
choose to sign with a non-deterministic nonce.) The threshold scheme can also
enjoy the same properties through a deterministic signature system.

\begin{equation}
\begin{split}
  \forall p_i : k_i &= \texttt{HMAC}(m, x_i) \\
  k &= \prod_{i=1}^{i} k_s \bmod n
\end{split}
\end{equation}

The values $k_i$ remain secret as well as the value $x_i$
but the signature will always be the same for the given message and threshold
key.


% !TeX spellcheck = en_GB
% !TeX root = ../main-scirep.tex
\section{Methods}
\label{section:methods}

\subsection{Modelling legislative document collections}\label{subsection:methods:modelling}

To formalize the intuition that is given in Section~\ref{subsection:model} and illustrated in Figure~\ref{fig:conceptual_sequence_graph},
we use the following definitions.
Let $D$ be a document understood by the Document Object Model (DOM) standard,
with elements $\mathcal{E}_D$ of types $\{$\texttt{document}, \texttt{item}, \texttt{seqitem}, \texttt{subseqitem}, \texttt{text}$\}$ and root $r_D$ of type \texttt{document}.
We interpret $D$ as a directed rooted tree $T_D$ in the graph theoretical sense,
where the nodes of $T_D$ are the elements of $D$ that are \emph{not} of type \texttt{text},
and an arc between two nodes indicates that the source contains the target---i.e., $T_D$ contains all structural elements of $D$ with their containment relations.
With each node in $T_D$, we associate a unique identifier and three attributes:
The \emph{type} of a node is its type in $D$,
the \emph{level} of a node is its distance $d$ from the root, with $d(r_D,r_D) = 0$, and the \emph{text} of a node is the text of all its children (which can be used to derive additional statistics as necessary).
Nodes of type \texttt{seqitem} (short for \emph{sequence item}) typically have \emph{cite~keys}, i.e., sequentially ordered unique identifiers by which they are commonly referenced.
All nodes may also have \emph{headings} (representing the headings in the original document), and \texttt{documents} may have abbreviations by which they are commonly referenced.
The custom XSD expressing this document model can be found in Section~2.4 of the \suppi.

Now let $\mathcal{D}^i_t$ be collection $i$ of documents at time $t$ with their tree representations $\mathcal{T}^i_t$.
We define the following graphs for $\mathcal{D}^i_t$:

\begin{definition}[Hierarchy Graph $H^i_t$]
	The \emph{hierarchy graph} of collection $\mathcal{D}^i_t$, denoted $H^i_t$, is a \emph{digraph}
	\begin{align*}
	H^i_t = (V^i_{t,H}, E^i_{t,H})~,
	\end{align*}
	where
	\begin{align*}
	V^i_{t,H} = \underset{T\in\mathcal{T}^i_t}{\bigcup} V(T) \cup \{~\bar{r}_i~\}
	\end{align*}
	with a structural element $\bar{r}_i$ on level $-1$ representing the identity of the collection,
	and
	\begin{align*}
	E^i_{t,H} = \underset{T\in\mathcal{T}^i_t}{\bigcup} E(T) \cup \{~(\bar{r}_i,r_D)\mid~D\in\mathcal{D}^i_t~\}~.
	\end{align*}
\end{definition}

That is, the hierarchy graph is the union of all document trees' structural elements equipped with their containment relation, joined by a meta root node identifying the collection.

\begin{definition}[Reference Graph $R^i_t$]
	The \emph{reference graph} of collection $\mathcal{D}^i_t$, denoted $R^i_t$,
	is a \emph{directed multigraph}
	\begin{align*}
	R^i_t = (V^i_{t,H}, E^i_{t,R})~,
	\end{align*}
	where
	\begin{align*}
	E^i_{t,R} = E^i_{t,H}\cup C^i_{t}~,
	\end{align*}
	with $C^i_{t}$ a multiset given by
	\begin{align*}
	C^i_{t} =\{~(v,w)^m \mid~\text{text of~}v~\text{makes m references}\phantom{~.}\\\text{to}~w~\text{in  }\mathcal{D}^i_t~\wedge~type(v)=type(w)=\texttt{seqitem}~\}~. % and both v and w are of type seqitem
	\end{align*}
\end{definition}

That is, the reference graph is the hierarchy graph,
augmented by reference relations between its nodes.

\begin{definition}[Sequence Graph $S^i_t(\rho, w, \alpha)$]\label{def:sequencegraph}
	The \emph{sequence graph} of collection $\mathcal{D}^i_t$ with parameters $\rho$, $w$, and $\alpha$, denoted $S^i_t(\rho, w, \alpha)$, is a \emph{directed multigraph}
	\begin{align*}
	S^i_t(\rho, w, \alpha) = (V^i_{t,S}(\rho), E^i_{t,S}(\rho, w, \alpha))~.
	\end{align*}
	Here, $V^i_{t,S}(\rho)$ initially contains all nodes of type \texttt{seqitem},
	and nodes that are neighbours in the sequence are merged if and only if
	they meet the \emph{merge condition} $\rho$.
	$E^i_{t,S}(\rho, w, \alpha)$ contains the arcs of $R^i_t$, projected onto the node set of $S^i_t$, with containment relations now represented as a pair of sequence arcs between nodes with adjacent \emph{cite keys}.
	The sequence arcs in $E^i_{t,S}(\rho, w, \alpha)$ are weighted according to a weight function $w$ (specifying the weight decay of sequence arcs as a function of the distance between the source node and the target node in the undirected graph underlying $H^i_t$),
	and the reference arcs are weighted according to a weight ratio $\alpha$ (specifying the weight of reference arcs in relation to sequence arcs of maximum weight).
\end{definition}

As mentioned in Section~\ref{subsection:model},
the sequence graph representation of a legislative document collection is inspired by how practitioners work with legislative texts.
Furthermore, the parameters of the sequence graph allow us to incorporate knowledge about legal users into our model
(e.g., by weighting reference arcs less heavily than the highest-weight sequence arcs, we can express the intuition that looking up a reference is less likely than simply reading on).
To compute the node alignments mentioned in Section~\ref{subsection:reorganisation},
we use a more granular variant of the sequence graph:

\begin{definition}[Subsequence Graph $\bar{S}^i_t(\rho, w, \alpha)$]\label{def:subsequencegraph}
	The \emph{subsequence graph} of collection $\mathcal{D}^i_t$ with parameters $\rho$, $w$, and $\alpha$, denoted $\bar{S}^i_t(\rho, w, \alpha)$,
	is defined as the sequence graph $S^i_t(\rho, w, \alpha)$, with \emph{seqitems} being replaced by \emph{subseqitems} (i.e., structural elements one level below the \texttt{seqitem} level) if they exist.
\end{definition}

Finally, we use a multigraph version of the standard graph theoretical notion of a quotient graph (see also Section~\ref{subsubsection:methods:temporal}):

\begin{definition}[Quotient Graph $Q(G,R)$]
	Given a graph $G$ and an equivalence relation $R$ on its node set $V$ (i.e., a reflexive, symmetric, and transitive binary relation),
	a quotient graph is the graph $Q(G,R)$ with
	\begin{align*}
	V_{Q(G,R)} = V / R = \{~[u]_R \mid u\in V~\}
	\end{align*}
	and
	\begin{align*}
	E_{Q(G,R)} = \{~([u]_R, [v]_R)^m \mid~|\{~(x,y) \in E_G \mid x\in [u]_R \wedge y\in [v]_R~\}| = m > 0~\}~,
	\end{align*}
	where $[u]_R := \{~x\in V\mid (u,x)\in R~\}$ and $[v]_R := \{~y\in V\mid (v,y)\in R~\}$ are equivalence classes of $V$ under $R$.
\end{definition}

As shown in Section~\ref{subsection:reorganisation} for aggregating legal texts at the Chapter level,
the equivalence relations of our quotient graphs are generally given by the attributes associated with the structural elements contained in our reference graphs.
Another example of quotient graphs, based on the cluster identifiers produced by our graph clustering as node attributes, can be found in Section~3.2 of the~\suppi.

\subsection{Assessing legislative growth}\label{subsection:methods:growth}

To assess legislative growth in Section~\ref{subsection:growth},
we track three statistics for the United States and Germany from 1994 to 2018:
the number of tokens,
the number of hierarchical structures,
and the number of references contained in the federal statutory legislation of both countries.
For the token counts, we concatenate the text of all statutory materials for one country and year,
ignoring the extensive appendices to some Titles or laws,
and split on whitespace characters.
The hierarchical structure counts reflect the number of nodes in our hierarchy graphs,
and the reference counts reflect the number of edges in our reference graphs.
Details on our data preprocessing steps can be found in Section~2 of the~\suppi.

\subsection{Comparing document networks over space and time}

\subsubsection{Clustering document networks}\label{subsubsection:methods:clustering}

To enable our comparative and dynamic analysis in Section~\ref{subsection:reorganisation},
we cluster each annual snapshot of the legislative network separately for both countries.
As mentioned in Section~\ref{subsection:reorganisation},
amongst the plethora of graph clustering methods,
we choose the \emph{Infomap} algorithm due to its information-theoretical underpinnings, scalability, and interpretability as a legal (re-)search process.
Details on this algorithm can be found in the original papers \cite{rosvall2008,rosvall2009}.

As the input data to \emph{Infomap},
we use the sequence graph representation of an annual snapshot
with a merge condition $\rho$ that collapses into one node
all rules from the same Chapter (or Title, if the Title has no Chapters) in the United States,
and all rules from the same Book (or law, if the law has no Books) in Germany.
This consolidation step densifies the adjacency matrix of the sequence graph and reduces the noise in our data.
As almost all remaining nodes lie at distance $2$ from one another in the hierarchy graph,
and very few sequence edges would remain,
we base the clustering solely on references.
Legislative network analyses using a different $\rho$ would also require the choice of a weight decay function $w$
and a \emph{sequence edge}-to-\emph{reference edge} weight ratio $\alpha$.
For \emph{Infomap} itself,
we use the default configuration with a preferred cluster number of $100$ as an additional input parameter.
As discussed in Section~\ref{subsection:reorganisation},
this parameter choice reflects the level of analytical resolution we seek to operate at,
and it approximates the number of high-level topics legal database providers utilise to organise their content.
The sensitivity analysis regarding our input parameter can be found in Section~4.1 of the~\suppi.

As \emph{Infomap} has a stochastic element,
we use \emph{consensus clustering} \cite{lancichinetti2012} to increase the robustness of our results as follows:
For each snapshot $t$ in each country $i$,
we produce $1000$ clusterings with different seeds.
From the results of these clusterings, we produce a \emph{consensus graph}
whose nodes are the nodes of the sequence graph,
and with an edge connecting two nodes if these nodes are in the same cluster in at least $950 = 95~\%$ of our \emph{Infomap} runs.
For each year and country, the connected components of the consensus graph then constitute our final clusters,
which represent a careful reorganisation of the law enabling comparative and dynamic analysis.
This leads to more than $100$ final clusters
because the initial clusters are typically split into a stable core and several smaller satellites,
each of which becomes an additional separate cluster.

\subsubsection{Tracing temporal dynamics}\label{subsubsection:methods:temporal}

To trace legislative change over time, we need to align the textual contents of our yearly snapshots within each jurisdiction.
Computing the optimal node alignment between two graphs is generally a hard problem,
and methods based on tree edit distance do not scale to legislative trees.
However, we can use sequence graphs with the highest possible granularity
(using a merge condition $\rho$ that condenses nothing)
along with the text associated with individual nodes,
and exploit the fact that most rules do not change most of the time
to construct a practical heuristic that greedily computes a partial node alignment $\phi^i_t$ across two snapshots $S^i_t$ and $S^i_{t+1}$ from corpus $i$.
Our heuristic operates in at most four sequential passes through these snapshots:

\begin{enumerate}
	\item First pass:
	If $v$ is a node in $S^i_t$ and we find exactly one node $w$ in $S^i_{t+1}$ with identical text \emph{and} the text is at least 50 characters long, set $\phi^i_t(v) = w$.
	\item Second pass:
	If $v$ is an unmatched node in $S^i_t$ and we find an unmatched node $w$ in $S^i_{t+1}$ with identical key \emph{and} identical text,
	set $\phi^i_t(v) = w$.
	\item Third pass:
	If $v$ is an unmatched node in $S^i_t$ and we find exactly one unmatched node $w$ in $S^i_{t+1}$ such that (i) the text of $v$ contains the text of $w$ (or the text of $w$ contains the text of $v$) and (ii) the text remaining unmatched in $v$ ($w$) is shorter than the matched part, set $\phi^i_t(v) = w$.
	\item Fourth pass:
	If $v$ is an unmatched node in $S^i_t$ and we find a matched node $v'$ in $S^i_t$ in the five-hop neighbourhood of $v$,
	search the five-hop neighbourhood of $\phi^i_t(v')$ for the unmatched node $w$ (if any) with the largest Jaro-Winkler string similarity\cite{winkler1990} to $v$;
	if that similarity is above $0.9$, set $\phi^i_t(v) = w$.
	Repeat recursively with all newly matched nodes until no further matches are found.
\end{enumerate}

With this procedure, we manage to map between $94~\%$ and $100~\%$ of the \emph{subseqitems} between adjacent snapshots in both the United States and Germany, i.e., our partial node alignments are almost complete,
and the unmatched subseqitems are indicators of larger changes in the code (rather than errors).
Based on partial \emph{node} alignments $\phi^i_t$ for all relevant $t$, we compute a partial \emph{cluster} alignment across snapshots,
which we call the \emph{cluster graph} $C^i$:

\begin{definition}[Cluster Graph $C^i$]\label{def:clustergraph}
	Let $C^i_t$ be the consensus clustering obtained for collection $i$ at time $t$.
	The \emph{cluster graph} of collection $i$ across times $T$, denoted $C^i$, is a weighted digraph
	\begin{align*}
	C^i = (V^i_C,E^i_C)~,
	\end{align*}
	where
	\begin{align*}
	V^i_C = \underset{t \in T}{\bigcup} \{~c \in C^i_t~\}
	\end{align*}
	and
	\begin{align*}
	E^i_C = \{~(c,c',w) \mid c\in C^i_t~\wedge~c'\in C^i_{t+1}~\wedge~ \Delta(c,c') = w~\}
	\end{align*}
	with
	\begin{align*}
	\Delta(c,c') = \sum_{v~\in~c~\setminus~\{~v~\mid~\phi^i_t(v)~\notin~c'~\}}|\phi^i_t(v)|~,
	\end{align*}
	where $|v|$ denotes the number of tokens in a node $v$ of the sequence graph $S^i_t$ used as input to the clustering at time~$t$.
\end{definition}

That is, the cluster graph $C^i$ contains the clusters resulting from the clusterings of all snapshots as nodes,
and its weighted edges $(c,c',w)$ indicate how many tokens from a cluster $c'\in C^i_{t+1}$ stem from cluster $c\in C^i_t$.

The cluster graph allows us to identify substantial additions, deletions, and movements of tokens in the United States and Germany over our entire period of study, revealing dynamics at the level of \emph{individual clusters}.
To trace dynamics at the level of \emph{legal topics},
we define \emph{cluster families} based on the \emph{family graphs} of our collections:

\begin{definition}[Family Graph $F^i(\gamma)$]\label{def:familygraph}
	Let $C^i$ be the cluster graph of collection $i$ across times $T$.
	The \emph{family graph} of collection $i$ across times $T$, denoted $F^i$,
	is a weighted digraph
	\begin{align*}
	F^i(\gamma) = (V^i_C,E^i_F(\gamma))~,
	\end{align*}
	where
	\begin{align*}
	E^i_F(\gamma) = \{~(c,c',w)~\mid~(c,c',w) \in E^i_C~\wedge~\chi(c,c',w) \geq \gamma~\}
	\end{align*}
	with
	\begin{align*}
	\chi(c,c',w)=\min~\Big\{~\frac{w}{|c|}, \frac{w}{|c'|}~\Big\}~,
	\end{align*}
	where $|c|$ denotes the number of tokens in cluster $c$.
\end{definition}

In words, the family graph $F^i(\gamma)$ contains the same nodes as the cluster graph $C^i$
but only those edges from $(c,c',w)~\in~E^i_C$ that account for at least a $\gamma$ fraction of the tokens in both $c$ and $c'$.
We set $\gamma = 0.15$ to filter out noise and isolate parts of the cluster graph that are largely self-contained,
but this threshold can be replaced by any other number between $0$ and $1$ depending for other analyses.

To trace the evolution of legal topics over time, based on the family graph, we define:

\begin{definition}[Cluster Family $V^i_{F,j}$]\label{def:cluster-family}
	Let $F^i(\gamma)$ be the family graph for collection $i$ across times $T$ consisting of cluster families as connected components.
	A \emph{cluster family} $V^i_{F,j}$ is the node set of $F^i(\gamma)$'s $j$\textsuperscript{th} largest connected component (measured in tokens).
\end{definition}

In addition to the overall size of a cluster family (given by the size of its leading cluster),
our analysis also uses a temporal notion of cluster family size:

\begin{definition}[Cluster Family Size at Time $t$ $|V^i_{F,j,t}|$]\label{def:cluster-family-size}
	Let $V^i_{F,j}$ be a cluster family $j$ in collection $i$,
	and let $C^i_t$ be the consensus clustering obtained for time $t$.
	The size of cluster family $j$ at time $t$ is defined as
	\begin{align*}
	|V^i_{F,j,t}| = \sum_{c~\in~(V^i_{F,j}~\cap~C^i_t)}|c|~,
	\end{align*}
	where $|c|$ denotes the number of tokens in a node $c$.
\end{definition}

With our parametrisation, cluster families are sets of Chapters, Books, or laws that are closely related by cross-references or (almost) textual identity over time.
As such, they approximately correspond to \emph{legal topics}.
Further information on how we label these topics can be found in Section~5.1 of the~\suppi.


%\documentclass{article}
\documentclass[nofootinbib,amsmath,amssymb,10pt,eqsecnum, twocolumn]{revtex4-1}
\usepackage{graphicx, amsmath, amsmath, amssymb}
\usepackage[caption=false]{subfig}
\usepackage[breaklinks, colorlinks, citecolor=blue]{hyperref}
%\usepackage[maxbibnames=4]{biblatex}
\usepackage{color}
\usepackage{float}
\usepackage{natbib,hyperref,ifthen}
%------------ May need to comment out this -----------
%\usepackage{epstopdf}
%-----------less/greater than approx eq to--------------
\newcommand{\lta}{\mbox{\small\raisebox{-0.6ex}{$\,\stackrel
{\raisebox{-.2ex}{$\textstyle <$}}{\sim}\,$}}}
\newcommand{\gta}{\mbox{\small\raisebox{-0.6ex}{$\,\stackrel
{\raisebox{-.2ex}{$\textstyle >$}}{\sim}\,$}}}
%-------------------------------------------------------
\newcommand{\edT}{\eta_{\Delta T}}
\newcommand{\nueff}{\nu_{\rm eff}}
\newcommand{\Tobs}{\tilde{T}_A^F}
\newcommand{\sigpix}{\sigma_{\rm pix}}
\newcommand{\sigsr}{\sigma_{\rm sr}}
\newcommand{\Tfa}{\Tobs}
\newcommand{\Tmod}{\hat{T}_A^F}
\newcommand{\Planck}{{\em Planck}}
\newcommand{\WMAP}{{\em WMAP}}
\newcommand{\un}{\, \rm}
\newcommand{\al}{\alpha}
\newcommand{\be}{\beta}
\newcommand{\ga}{\gamma}
\newcommand{\de}{\delta}
\newcommand{\s}{\sigma}
\newcommand{\pd}{\partial}
\newcommand{\brpd}{\bar{\partial}}
\newcommand{\Chr}[2]{\Gamma^{#1}{}_{\!#2}}
\newcommand{\brChr}[2]{\overline{\Gamma}^{#1}{}_{\!#2}}
\newcommand{\brg}{\bar{g}}
\newcommand{\brR}{\bar{R}}
\newcommand{\brG}{\bar{G}}
\newcommand{\brT}{\bar{T}}
\newcommand{\brLambda}{\overline\Lambda}
\newcommand{\brdel}{\overline\nabla}
\newcommand{\dd}{{\rm d}}
\newcommand{\jump}[1]{ \left[ #1 \right]^+_- }
\newcommand{\avrg}[1]{ \left\langle #1 \right\rangle^+_- }
\newcommand{\Boxbar}{\overline{\Box}}
\newcommand{\diag}{\mbox{diag}}
\newcommand{\eps}{\varepsilon}
\newcommand{\oem}{{\cal T}}
\newcommand{\brW}{\overline{\cal W}}
\newcommand{\wave}{\square}
\newcommand{\brwave}{\overline{\square}}
\newcommand{\brkap}{{\bar\kappa}}
\newcommand{\bo}{\beta_0}
\newcommand{\binf}{\beta_{\!_\infty}}
\newcommand{\boldomega}{{\bf \omega}}
\newcommand{\appleq}{\raisebox{-3pt}{\makebox[14pt]{$\stackrel{\textstyle<}
{\sim}$}}}
\newcommand{\blockmatrix}[4]{\left( \begin{array}{c|c} #1
& #2 \\ \hline #3 & #4 \end{array} \right)}
\newcommand{\mbar}{{\bar m}}
\newcommand{\beq}{\begin{equation}}
\newcommand{\eeq}{\end{equation}}
\newcommand{\btheta}{{\bf \hat{n}}}
\newcommand{\absmax}{{$|\mbox{Max}|$}}
\renewcommand{\arraystretch}{1.6}
\newcommand{\qsubrm}[2]{{#1}_{\scriptsize{\textrm{#2}}}}
\def\ee{\end{equation}}
\def\bea{\begin{eqnarray}}
\def\eea{\end{eqnarray}}
\def\bse{\begin{subequations}}

\bibliographystyle{arxiv}

\def\mnras{MNRAS}
\def\jcap{JCAP}

\newcommand\comment[1]{\textcolor{red}{#1}}

%-------------------------------------------------------

\begin{document}

\title{Deep Recurrent Neural Networks for Supernovae Classification}

\author{Tom Charnock} \email{tom.charnock@nottingham.ac.uk}
\affiliation{School of Physics \& Astronomy\\
University of Nottingham,
Nottingham, NG7 2RD, England}

\author{Adam Moss} \email{adam.moss@nottingham.ac.uk}
\affiliation{School of Physics \& Astronomy\\
University of Nottingham,
Nottingham, NG7 2RD, England}

\date{\today}

\begin{abstract}
   We apply deep recurrent neural networks, which are capable of learning complex sequential information, to classify supernovae\footnote{Code available at \href{https://github.com/adammoss/supernovae}{https://github.com/adammoss/supernovae}}. The observational time and  filter fluxes are used as inputs to the network, but since the inputs are agnostic additional data such as host galaxy information can also be included. Using the Supernovae Photometric Classification Challenge (SPCC) data, we find that deep networks are capable of learning about light curves, however the performance of the network is highly sensitive to the amount of training data.  For a training size of 50\% of the representational SPCC dataset (around $10^4$ supernovae) we obtain a type Ia vs non type Ia classification accuracy of 94.8\%, an area under the Receiver Operating Characteristic curve AUC of 0.986 and a SPCC figure-of-merit $F_1=0.64$. We also apply a pre-trained model to obtain classification probabilities as a function of time, and show it can give early indications of supernovae type. Our method is competitive with existing algorithms and has applications for future large-scale photometric surveys.
   \end{abstract}

\maketitle

\section{Introduction}

Future large, wide-field photometric surveys such as the Large Synoptic	Survey Telescope (LSST) will produce a vast amount of data, covering a large fraction of the sky every few nights. The amount of data produced lends itself to new analysis methods which can learn abstract representations of complex data. Deep learning is a powerful method for gaining multiple levels of abstraction, and has recently produced state-of-the-art results in tasks such as image classification and natural language processing. There are several types of deep learning architectures, such as convolutional neural networks, deep belief networks and recurrent neural networks (see~\cite{0483bd9444a348c8b59d54a190839ec9} for an excellent overview of deep learning and refs. within for more details).

There are many applications of deep learning for large photometric surveys, such as: (1) the measurement of galaxy shapes from images; (2) automated strong lens identification from multi-band images; (3) automated classification of supernovae; (4) galaxy cluster identification. In this paper we will focus on supernovae classification using deep recurrent neural networks. The LSST, for example, is expected to find over $10^7$ supernova~\cite{2009arXiv0912.0201L}. However,  it is estimated that only 5000 to 10,000\footnote{Although these numbers are not guaranteed.} will be spectroscopically confirmed  by follow up surveys~\cite{2013arXiv1311.2496M}, so classification methods need to be developed  for photometry.  All previous approaches to automated classification~\cite{Newling:2010bp, Karpenka:2012pm, Lochner:2016hbn} have first extracted features from supernovae light curves before using machine learning algorithms.  One of the advantages of deep learning is replacing this feature extraction.

In this work we will use {\em supervised} deep learning. During training, the machine is given inputs and produces a set of output predictions.  It is also given the correct set of outputs. An objective loss function then measures the error between the predicted and target outputs, and the machine updates its adjustable parameters to reduce the error. It can then make predictions for unknown outputs.

\begin{figure}
\centering
\includegraphics[width=88mm, angle=0]{1.pdf}
\caption{\label{fig:network} Bidirectional recurrent neural network for sequence classification. The input vectors at each sequential step are fed into a pair of bidirectional hidden layers, which can propagate information forwards and backwards. These are then merged to obtain a consensus view of the network, and finally a softmax layer computes classification probabilities.
 }
\end{figure}

{\em Recurrent neural networks} (RNNs) are a class of artificial neural network  that can learn about sequential data. They are commonly used for tasks such speech recognition and language translation, but have several possible applications in astronomy  and cosmology for processing temporal or spatial sequential data. RNNs have several properties which makes them suitable for sequential information. The inputs to the network are flexible, and they are able to recognise patterns with noisy data (for example the context of a word in a sentence relative to others can vary, or a time stream can contain instrument noise).

The main problem with vanilla RNNs  is that they are unable to store long-term information, so inputs at the end of a sequence have no knowledge of inputs at the start. This is a problem if the data has long-term correlations. Several types of RNNs have been proposed to solve this problem, including {\em Long Short-Term Memory} (LSTM)~\cite{LSTM} and {\em Gated Recurrent Unit} (GRU)~\cite{2014arXiv1412.3555C} units. These are similar in concept, in that information is able to flow through the network via a gating mechanism. One further problem with RNNs is that information is only able to flow in one direction. In {\em bidirectional} RNNs information is able to pass both forwards and backwards. Bidirectional LSTM networks have been shown to be particularly powerful for supervised sequence labelling, where sequential data is accompanied by a set of discrete labels.

The architecture of a typical bidirectional RNN for sequence labelling is shown in Fig.~\ref{fig:network}, where the squares represent {\rm neurons}. In this case the inputs, which are vectors at each sequential step, are connected to two hidden RNN layers, which can be either vanilla RNN or memory units.  Each hidden layer contains a number of hidden units (capable of storing information), and in each layer information flows either forwards or backwards,  but no information passes between the two directions. Several hidden layers can be stacked to form {\em deep} neural networks. Deep networks are capable of learning higher-level temporal or spatial representations, and complex relationships between the inputs and outputs.

The output from the final set of hidden layers in each direction is merged at each sequential step, and mean pooled (averaged) over all steps to obtain a consensus view of the network\footnote{We find that obtaining a consensus view improves the performance of the network.}. Finally, the mean output is fed to a {\em softmax} layer, which takes an input vector ${\bf z}$ and returns normalised, exponentiated outputs for each class label $i$, $\exp(z_i) / \sum_{i} \exp(z_i)$, i.e. a vector of probabilities.

 In the network, each neuron is connected to another by a weight matrix, and the optimal weights are found by back-propagating the errors from a {\em loss function} of the output layer. For classification problems, this is typically the categorical cross-entropy between predictions and targets, defined as
\begin{equation}
L= -\sum_{i,j} t_{i,j} \log \left( p_{i,j} \right)
\end{equation}
where $i,j$ run over the class labels, $t_{i,j}$ are the targets for each class (either 0 or 1) and $p_{i,j}$ are the predicted probabilities. Back-propogation essentially takes the derivative of the loss with respect to the weights $W$ of the output layer, $\partial L/\partial W$, and uses the chain rule to update the weights in the network.

\section{Example Data}

In this paper we will consider data from the Supernovae Photometric Classification Challenge (SPCC)~\cite{Kessler:2010wk,Kessler:2010qj}, which consists of a set of 21319 simulated supernove light curves.  Each supernovae sample consists of a time series of flux measurements, with errors, in the $g, r, i, z$ bands (one band for each timestep), along with the position on the sky and dust extinction. An example set of light curves is shown in Fig.~\ref{fig:lightcurve}.

Due to the format of the input data, we first do a small amount of data processing to obtain values of the $g, r, i, z$ fluxes and errors at each sequential step.  First, we assume the time sequence begins at day 0 for each supernovae, rather than counting days forwards and backwards from the maxima of the light curve. Next, for observations less than $\sim1$ hour apart, we group the $g, r, i, z$ values into a single vector, ensuring there is at most one filter type in each group. If there is more than one filter type, we further subdivide the group using a finer time interval.  We take the time of the group to be the mean time of its individual observations, which is reasonable as the time intervals are small compared to the characteristic time of the light curve.

 Observations are then of the form in Tab.~\ref{tab:augment}, where any missing values are denoted by a dash. In order to impute the missing value of $i$, we use {\em data augmentation} and randomly select a value between $i_1$ or $i_3$. We make 5 random augmentations of all missing data, thereby increasing the size of the dataset by a factor of 5. We can test the importance of this by training each augmentation separately and  comparing the change in accuracy, which we find is $\sim 1\%$. Training with multiple augmentations at once gives the best performance, since the network will learn  to ignore random filled values.

\begin{table}[htdp]
\begin{center}
\begin{tabular}{|c|c|c|c|c|} \hline
 Time & g & r & i & z \\ \hline \hline
$ t_1$  & $g_1$ & $r_1$ &$ i_1$ & $z_1$ \\ \hline
$ t_2$  & $g_2$ & $r_2$ &$  - $ & $z_2$ \\ \hline
$ t_3$  & $g_3$ & $r_3$ &$ i_3$ & $z_3$ \\ \hline
 \end{tabular}
\end{center}
\label{tab:augment}
\caption{Data augmentation of missing observations. The missing data is replaced randomly by a value between $i_1$ or $i_3$.}
\end{table}%

\begin{figure}
\centering
\includegraphics[width=88mm, angle=0]{2.pdf}
\caption{\label{fig:lightcurve} (Top) Example light curve in the 4 $g, r, i, z$ bands for SN ID 551675 (a type Ia) in the Supernovae Photometric Classification Challenge data~\cite{Kessler:2010wk}. The data has been processed using augmentation so there is a $g, r, i, z$ value at each sequential step. (Bottom) Type Ia probability as a function of time from a 2 layer LSTM model, trained with around $10^4$ supernovae and SN 551675 excluded. The final probability gives $99.5\%$ confidence that the supernovae is of type Ia.
 }
\end{figure}

The data comes in two types, those with and those without the  host galaxy photometric redshift. Each dataset is split into a training and test set, with the training set containing a spectroscopically confirmed supernovae type and redshift. It is important that augmented data with the same supernovae ID go into either the training {\em or} test set, not a mix of both, otherwise the training and test data will not be independent. The original SPCC data consisted of 1103 training samples. The answer keys were subsequently made available for the test set~\cite{Kessler:2010qj}.

The input vector to each sequential step then consists of: the time in days since the first observation; the flux in each of the 4 bands; the flux errors in each of the 4 bands; the RA and Dec; the dust extinction; and the host photo-z if relevant. Whilst we do not expect some of these variables to impact the classifier accuracy, we do not attempt any feature engineering and leave it to the network to decide if they are relevant.

RNNs typically perform better with more training data, so for training purposes we use the SPCC test set with answer keys (which is a non-biased representational dataset\footnote{The original SPCC training set was non-representational.}), and select a random fraction to act as the training set. We consider 1103 supernovae (a training fraction of 0.052), the same size as the original challenge, and fractions of 0.25 and 0.5 (around 5000 and $10^4$ supernovae respectively), nearly an order of magnitude larger, and closer to the number likely to be followed up for the LSST. The training performance of RNNs is also improved if the data is processed in mini-batches. In order to do this the input data must be of the same length, so we set the sequence length to be the maximum length over all supernovae observations, and prepend the input with padding. In training the network we ensure the padding is ignored by masking the padded input.

The goal of the classifier is to determine the supernovae type in the test set. We consider two problems, the first being to categorise two classes (type Ia vs non type Ia), and the second to categorise three classes (supernovae types 1, 2 and 3). We denote these as  `SN1a' and  `123' respectively.

We use several metrics to assess the classifier. The simplest is the accuracy, defined as the ratio between the number of correct predictions and total number of predictions. With two classes, a random classifier would have an accuracy of 0.5, and with three classes, an accuracy of 1/3.

Next are a variety of metrics coming from the {\em confusion matrix} of predictions.  For binary classification problems, the confusion matrix splits predictions into true positives (TP), false positives (FP),  false negatives (FN), and true negatives (TN). We consider the purity (also known as precision) and completeness (also known as recall) of the classifier. These are defined as
\begin{equation}
{\rm Purity} = \frac{{\rm TP}}{{\rm TP}+{\rm FP}}\,, \quad {\rm Completeness} = \frac{{\rm TP}}{{\rm TP}+{\rm FN}}\,.
\end{equation}
We evaluate these for each class separately vs `the rest' (e.g. type Ia vs non type Ia). The SPCC also defined the $F_1$ figure-of-merit for the SN1a classification problem. This is
\begin{equation}
F_1 = \frac{1}{{\rm TP}+{\rm FN}} \frac{{\rm TP}^2}{{\rm TP}+3 \times {\rm FP}}\,,
\end{equation}
so false positives (incorrectly classifying a non type Ia supernovae as a type Ia) are penalised more heavily.

Finally, we also calculate  the Area Under the Curve (AUC). The AUC is the area under the curve of the TP rate vs FP rate, as the threshold probability for classification is increased from 0 to 1. A perfect classifier has an AUC of 1, and a random classifier 0.5. For multi-class problems, we calculate the AUC for each class vs the rest, and take an unweighted average to give the final AUC score.

\section{Network Architecture}

We consider several combinations of the network architecture. For the RNN type in the hidden layers, we test both vanilla RNN and long-term memory (LSTM and GRU) units. We also consider unidirectional  and bidirectional networks. For the unidirectional network, we fix the direction to be forwards. For the bidirectional network, we fix the number of hidden units in each RNN layer to be equal for the forward and backward directions.

We also test stacking two sets of layers to form a deep network.  In the unidirectional case we stack two hidden layers. In the bidirectional case the two stacks consists  of a pair  of forwards and backwards layers.  We denote the number of hidden units in a network with a  single stack by $[h_1]$, and the number of hidden layers in a two stack model by $[h_1, h_2]$. We vary the number of hidden units, testing h=[4], [8], [16], [32], [4,4], [8,8], [16,16] and [32,32]. We do not go beyond a stack of two layers due to the limited size of the dataset.

For each network we perform 5 randomised runs over the training data to obtain the classifier metrics. We define the loss function as the categorical cross-entropy between the predictions and test data. The network weights were trained using back-propogation with the `Adam' updater~\cite{2014arXiv1412.6980K}. Mini-batches of size 10\footnote{If training with a GPU larger mini-batches are recommended to make use of the GPU cores.} were used throughout, and each model was trained over approximately 200 {\em epochs}, where each epoch is a full pass over the training data.

\section{Results}

\begin{figure}
\centering
\includegraphics[width=88mm, angle=0]{3.pdf}
\caption{\label{fig:loss} (Left) Training loss (green) vs test loss (blue) for a unidirectional 2 layer  LSTM network with 16 hidden units in each layer. (Right) Training accuracy (green) vs test accuracy (blue) for the same network.  }
\end{figure}

A dataset of 21319 is relatively small by deep learning standards. Furthermore, the `feature space' of supernovae light curves is significantly smaller than, say using RNNs to learn about language. We therefore need to be careful about {\em over-fitting}. Over-fitting arises when the network fits noise between the inputs and outputs of the training data, which do not exist in the test data. It can typically be detected by comparing the loss of the training and test data. If the loss of training data continues to decrease, but the loss of the test data increases, this is a sure sign of over-fitting. On the other hand, if no sign of over-fitting is observed, the network is not usually complex enough to fully learn the relationship between inputs and outputs (called {\em under-fitting}).

For a training fraction of 0.5, we found the best architecture was a deep 2 layer network with unidirectional LSTM units. Bidirectional units did not significantly improve the test accuracy and made the network more difficult to train. There was a marked improvement in test accuracy using 16 hidden units in each layer rather than 8, but too much over-fitting occured using 32 hidden units. Over-fitting was still an issue for 16 hidden units,  but we make use of a technique called {\em dropout}~\cite{JMLR:v15:srivastava14a} to regularize this. Dropout  sets a random fraction of connections to 0 at each update during training {\em only}, which prevents the units from adapting too much. We apply dropout only to non-recurrent connections after each hidden layer.

In Fig.~\ref{fig:loss} we show the training and tests losses for such a network, with a dropout of $0.5$, applied to type Ia vs non type Ia classification with host galaxy photo-z information. Without dropout the training loss would continue to fall and the test loss would rise. For 5 randomised runs, after training for  200 epochs, we obtain a classification accuracy of $94.8 \pm 0.2$\%, an AUC of $0.986 \pm 0.001$ and $F_1 = 0.64 \pm 0.01$. The corresponding type Ia purity and completeness are 87\% and 92\% respectively. A summary of results for this network can be found in Tabs.~\ref{tab:05_SN1a} and~\ref{tab:05_123}. It can be seen that the inclusion of host galaxy photo-z does not significantly improve the classifier performance.

\begin{table}[t!]
\begin{tabular}{|c | c | c | c | c |} \hline
AUC & Accuracy & F1 & Host z \\ \hline
$ 0.986 \pm  0.001$ &  $  94.8 \pm 0.2\% $ & $  0.64 \pm 0.01  $ & T  \\
$ 0.981 \pm  0.002$ &  $  93.6 \pm 0.3\% $ & $  0.60 \pm 0.02  $ & F  \\ \hline
\end{tabular}
\caption{\label{tab:05_SN1a} Summary of results for  type Ia vs non type Ia classification with a training fraction of 0.5. The network used is a 2 layer LSTM, each with 16 hidden units, and a dropout of 0.5.}
\end{table}

\begin{table}[t!]
\begin{tabular}{|c | c | c | c | c |} \hline
AUC & Accuracy & Host z  \\ \hline
$ 0.971  \pm 0.003 $ &  $  90.4  \pm 0.4 \% $ & T  \\
$ 0.958 \pm  0.007 $ &  $   88.8 \pm 1.0 \% $ & F \\ \hline
\end{tabular}
\caption{\label{tab:05_123} Summary of results for three class categorisation (supernovae types 1, 2 and 3). The model is the same as in Tab.~\ref{tab:05_SN1a}}
\end{table}

One advantage of our approach is that light curve data can be directly inputted to a {\em pre-trained} model to give very fast evaluation ($<1\,$s) of supernovae type. In the lower panel of Fig.~\ref{fig:lightcurve} we input the light curve, as a function of time, of a type Ia supernovae (excluded from training) to the pre-trained 2 layer LSTM model discussed above. The classifier (type Ia vs non type Ia) is initially unsure of classification, with a type Ia probability of around 0.5. The probability then decreases slightly, but rapidly increases near the peak of the light curve. The classifier has high confidence the supernovae is of type Ia at around 60 days, and the final probability is excess of $99.5\%$.  This method could therefore be useful to give early indication of supernovae type in  surveys.

We also test the same model using a training fraction of 0.25 (around 5000 supernovae), closer to the lower  end of the number likely to be followed up for the LSST. Again, after 5 randomised runs and training for 200 epochs we obtain an accuracy of $93.3 \pm 0.4\%$, an AUC of $0.978 \pm 0.002$ and $F_1 = 0.57 \pm 0.02$. The corresponding type Ia purity and completeness are 85\% and 87\% respectively. The $F_1$ metric, for example, has degraded by $\sim10\%$ for a reduction in data of $50\%$.

For $5.2\%$ of the representative SPCC data, the training dataset is so small that over-fitting is more severe. Using the same 2 layer LSTM network with 16 hidden units and a dropout of 0.5 we find a notable increase in the test loss after $\sim 20$ epochs, but the accuracy and other metrics remain relatively constant ($F_1$ values, for example, of 0.35 to 0.4 were obtained). The reason for this apparent discrepancy is that the accuracy, say, simply takes the maximum value of the softmax output layer. For example, a 2 class problem with output probabilities [0.6, 0.4] and target [1, 0] has the same accuracy as one with output probabilities [0.8, 0.2]. The loss in the latter case would be lower however, and represents increased confidence of the network in its predictions. We therefore reject models with severe over-fitting and an increasing cross-entropy loss, at the expense of metrics such as $F_1$, and decrease the model complexity.

For a training fraction of  $5.2\%$ we find a single layer LSTM network, with 4 hidden units, and a dropout of 0.5 satisfies this criteria. For 5 randomised runs, after training for  200 epochs, we obtain a classification accuracy of $85.9 \pm 1.2$\%, an AUC of $0.910 \pm 0.012$ and $F_1 = 0.31 \pm 0.03$. The corresponding type Ia purity and completeness are 72\% and 66\% respectively.

\section{Conclusions}

We have presented a new method for performing  photometric classification of supernovae. Machine learning methodology has previously been applied to SPCC classification~\cite{Newling:2010bp, Karpenka:2012pm, Lochner:2016hbn}. These all employ a two step process, where features are first extracted by some method before classification. In our approach light curves are used directly as inputs to a recurrent neural network, which is able to learn information from the sequence of observations.

Using post SPCC data, we obtain results which are competitive with previous approaches.  Although we have trained the network on the cross-entropy loss  and not the $F_1$ score, for the same sized dataset of $\sim10^3 (10^4)$ supernovae (including host galaxy photo-z), \cite{Karpenka:2012pm} obtained $F_1$ values of 0.33 (0.58), and \cite{Newling:2010bp} values of 0.42 (0.57), compared to our  0.31 (0.65). Recurrent neural networks  therefore compare well with other methods when a larger training  set is available. The performance isn't  quite as good with a smaller training set, possibly due to the network having to learn from no prior information about (noisy) light curves. The current state of the art for a small training set  ($\sim10^3$ supernovae) comes from a combination of SALT2 (Spectral Adaptive Light curve Template 2) template fits and boosted decision trees~\cite{Lochner:2016hbn}. It would be interesting to check how how deep learning compares to this with a larger training set.

As well as finding competitive results for the final metrics, we have shown that it is possible to give fast, early evaluation of supernovae type using pre-trained models. This is possible since the light curve can be fed to the model directly without needing any feature extraction.

There are several possibilities for future work. One of the advantages of recurrent neural networks is that inputs are agnostic, so the impact of any additional inputs could be explored. It would be possible, for example, to even pass the raw images in each filter though a convolutional network and use those as inputs. We have considered a representative training sample, but spectroscopic follow up surveys may be biased. The performance of the network could be measured against selection bias, and the results used to inform the best follow up strategy.  Further work could also be performed to optimise the early detection probability of the network.  Finally, to improve performance in the small data regime one can use {\em transfer learning.} Here, a more complex network is pre-trained on simulations or existing data from other surveys, then the weights of the network are fine-tuned on the new, smaller dataset. The simulated SPCC data used in this work are based on the DES instrument, so it would be interesting to apply transfer learning to real DES data.

\section*{Acknowledgements}

We appreciate helpful conversations with Steven Bamford, Simon Dye, Mark Sullivan and Michael Wood-Vasey, and Natasha Karpenka, Richard Kessler and Michelle Lochner for help with data acquisition. T. C. is supported by a STFC studentship, and A. M. is supported by a Royal Society University Research Fellowship.

\bibliography{bib}

\end{document}