-5 mm  the mathematics of cryptography is driven by real world applications .the original and most basic application is the wish to communicate privately in the presence of an eavesdropper who is listening in . with the rise of computers as means of communication , abundant other application arise , ranging from verifying authenticity of data and access priveleges to enabling complex financial transactions over the internet involving several parties each with its own confidential information .  as a rule , in theoretical fields inspired by applications, there is always a subtle ( and sometimes not so subtle ) tension between those who do `` theory '' and those who `` practice '' . at times , the practitioner shruggs of the search for a provably good method , saying that in practice his method works and will perform much better when put to the test than anything for which a theorem could be proved .the theory of cryptography is unusual in this respect . without theorems that provably guarantee the security of a system ,it is in a sense worthless , as there is no observable outcome of using a security system other than the guarantee that no one will be able to crack it .  in computational complexitybased cryptography one takes feasible ( or easy ) to mean those computations that terminate in polynomial time and infeasible ( or hard ) those computations that do not .achieving many tasks of cryptography relies on a gap between feasible algorithms used by the legitimate user versus the infeasibility faced by the adversary . on close examinationthen , it becomes apparent that a necessary condition for many modern cryptographic goals is that , although it is not known to be a sufficient condition .a ( likely ) stronger necessary condition which is also sufficient for many tasks is the existence of _ one - way functions _ : those functions which are easy to compute but hard to invert with non - negligible probability of success taken over a polynomial time samplable distribution of inputs .  in 1976 when diffie and hellman came out with their paper `` new direction in cryptography '' announcing that we are `` on the brink of a revolution in cryptoghraphy '' hopes were high that the resolution of the celebrate vs. problem was close at hand and with it techniques to lower bound the number of steps required to break cryptosystems .that did not turn out to be the case . as of today , no non - linear lower bounds are known for any complete problem .namely , if an np complete problem can be solved in polynomial time and thus be in p , then all problems in np are in p. ] .  instead, we follow a 2-step program when faced with a cryptographic task which can not be proved unconditionally ( 1 ) find the minimal assumptions necessary and sufficient for the task at hand .( 2 ) design a cryptographic system for the task and prove its security if and only if the minimal assumptions hold .proofs of security then are realy proofs of secure design .they take a form of a constructive reduction . for example, the existence of a one - way function has been shown a sufficient and necessary condition for `` secure '' digital signatures to exist . to prove this statement one must show how to convert any `` break '' of the digital signature scheme into an efficient algorithm to invert the underlying one - way function .defining formally `` secure '' and `` break '' is an essential preliminary step in accomplishing this program .these type of constructive reductions are a double edged sword .say that system has been proved secure if and only if integer factorization is not in polynomial time . then , either the system is breakable and then the reduction proof immediately yields a polynomial time integer factorization algorithm which will please the mathematicians to no end , or there exists no polynomial time integer factorization algorithms and we have found a superb cryptosystem with guaranteed security which will please the computer users to no end .  curiously, whereas early hopes of complexity theory producing lower bounds have not materialized , cryptographic research has yielded many dividends to complexity theory .new research themes and paradigms , as well as techniques originating in cryptography , have made their way to the main stream of complexity theory .well known techniques include random self - reducibility , hardness amplification , low degree polynomial representations of boolean functions , and proofs by hybrid and simulation arguments .well known examples of research themes include : interactive and probabilisticly checkable proofs and their application to show inapproximability of np - hard algorithmic problems , the study of average versus worst case hardness of functions , and trading off hardness of computation for randomness to be used for derandomizing probabilistic complexity classes .these examples seem , on a superficial level , quite different from each other .there are similarities however , in addition to the fact that they are investigated by a common community of researchers , who use a common collection of techniques . in all of the above ,an `` observer '' is always present , success and failure are defined `` relative to the observer '' , and if the observer can not `` distinguish '' between two probabilistic events , they are treated as identical .this is best illustrated by examples .( 1 ) a probabilistically checkable proofs is defined to achieve soundness if the process of checking it errs with exponentially small probability ( which is indistinguishable from zero ) .( 2 ) a function is considered hard to compute if all observers fail to compute it with non negligible probability taken over a efficiently samplable input distribution .it is not considered `` hard '' enough if it is only hard to compute with respect to some worst case input never to be encountered by the observer .( 3 ) a source outputting bits according to some distribution is defined as pseudorandom if no observer can distinguish it from a truly random source ( informally viewed as an on going process of flipping a fair coin ) .-5 mm  computational infeasibility , which by algorithmic standards is the enemy of progress , is actually the cryptographer s best friend .when a computationally difficult problem comes along with some additional properties to be elaborated on in this article , it allows us to design methods which while achieving their intended functionality are `` infeasible '' to break .luckily , such computationally intensive problems are abundant in mathematics .famous examples include _ integer factorization , finding short vectors in an integer lattice , and elliptic curve logarithm problem_. viewed this way , cryptography is an external customer of number theory , algebra , and geometry .however , the complexity theory view point has not left these fields untouched , and often shed new light on old problems .in particular , the history of cryptography and complexity theory is intertwined with the development of algorithmic number theory .this is most evident in the invention of faster tests for integer primality testing and integer factorization whose quality is attested by complexity analysis rather than the earlier benchmarking of their performance . a beautiful account on the symbiotic relationship between number theory and complexity theory is given by adleman who prefaces his article by saying that `` though algorithmic number theory is one of man s oldest intellectual pursuit , its current vitality is unrivaled in history .this is due in part to the injection of new ideas from computational complexity . ''-5 mm  in a companion paper to his famous paper on information theory , shannon introduced a rigorous theory of perfect secrecy based on information theory .the theory addresses adversary algorithms which have unlimited computational resources .thus , all definitions of security , which we will refer to henceforth as _ information theoretic security _ , and proofs of possibility and impossibility are with respect to such adversary .shannon proves that `` perfectly secure encryption '' can only exist if the size of secret information that legitimate parties exchange between them in person prior to remote transmission , is as large as the total entropy of secret messages they exchange remotely .maurer generalized these bounds to two - way communications .this limits the practice of encryption based on information theory a great deal .even worse , the modern cryptographic tasks of public - key encryption , digital signatures , pseudo random number generation , and most two party protocols can be proved down right impossible information theoretically . to achieve those, we turn to adversaries who are limited computationally and aim at computational security with the cost of making computational assumptions or assumptions about the physical world .having said that , some cryptographic tasks can achieve full information theoretic security .a stellar example is of multi party computation .efficient and information theoretic secure multi - party protocols are possible unconditionally tolerating less than half faults , if there are perfect private channels between each pair of honest users .zero - knowledge proofs _ are another example .perfect private channels between pairs of honest users can be implemented in several settings : ( 1 ) the _ noisy channel _ setting ( which is a generalization of the _ wire tal channel _ ) where the communication between users in the protocol as well as what the adversary taps is subject to noise ) . ( 2 ) a setting where the adversary s memory ( i.e. ability to store data ) is limited . ( 3 ) the _ quantum channels _ setting where by quantum mechanics , it is impossible for the adversary to obtain full information on messages exchanged between honest users . introducing new and reasonable such settings which enable information theoretic security is an important activity .moreover , often paradigms and construction introduced within the computational security framework can be and have been lifted out to achieve information theoretic security .the development of randomness extractors from pseudo random number generators can be done in this fashion .we note that whereas the computational complexity notions of secrecy , knowledge , and pseudo - randomness are different than their information theoretic analogues , techniques of error recovery developed in information theory are extremely useful .examples include the haddamard error correcting codes which is used to exhibit hard core predicates in one - way functions , and various polynomial based error correcting codes which enable high fault tolerance in multi - party computation .  to sum up , the theory of cryptography has in the last 30 years turned into a rich field with its own rules , structure , and mathematical beauty which has helped to shape complexity theory . in the talk , i will attempt to lead you through a short summary of what i believe to have been a fascinating journey of modern cryptography .i apologize in advance for describing my own journey , at the expense of other points of view .i attach a list of references including several survey articles that contain full details and proofs .  in the rest of the article, i will briefly reflect on a few points which will make my lecture easier to follow .-5 mm  we say that an algorithm is _ polynomial time _ if for all inputs , the algorithm runs in time bounded by some polynomial in where the latter denotes the length of when represented as a binary string .probabilistic algorithm _ is one that can make random choices , where without loss of generality each choice is among two and is taken with probability 1/2 .we view these choices as the algorithm _coin tosses_. a probabilistic algorithm on input may have more than one possible output depending on the outcome of its coin tosses , and we will let denote the probability distribution over all possible outputs .we say that a probabilistic algorithm is _probabilistic polynomial time _( ppt ) if for any input , the expectation of the running time taken over the all possible coin tosses is bounded by some polynomial in , regardless of the outcome of the coin tosses .  in complexity theory, we often speak of language classes .a language is a subset of all binary strings .the class p is the set of languages such that there exists a polynomial time algorithm , which on every input can decide if is in the language or not . the class are those languages whose membership can be decided by a probabilistic polynomial time algorithm which for every input , is incorrect with at most negligible probability taken over the coin tosses of the algorithm. the class np is the class of languages accepted by polynomial time non - deterministic algorithm which may make non - deterministic choices at every point of computation .another characterization of np is as the class of languages that have short proofs of memberships .formally , there exists polynomial time computable function and 0 , such that iff there exists such that and .  in this article, we consider an ` easy ' computation to be one which is carried out by a ppt algorithm .a function is negligible if it vanishes faster than the inverse of any polynomial .all probabilities are defined with respect to finite probability spaces .-5 mm  indistinguishability of probability distributions is a central concept in modern cryptography .it was first introduced in the context of defining security of encryption systems by goldwasser and micali .subsequently , it turned out to play a fundamental role in defining pseudo - randomness by yao , and zero - knowledge proofs by goldwasser , micali , and rackoff .let , be two ensembles of probability distributions on .we say that is * computationally indistinguishable * from if probabilistic polynomial time algorithms ,  , , s.t , the algorithm used in the above definition is called a polynomial time _ statistical test_.  namely , for sufficiently long strings , no probabilistic polynomial time algorithms can tell whether the string was sampled according to or according to .note that such a definition can not make sense for a single string , as it can be drawn from either distribution . although we chose to focus on polynomial time indistinguishability, one could instead talk of distribution which are indistinguishable with respect to any other computational resource , in which case all the algorithms in the definition should be bounded by the relevant computational resource .this , has been quite useful when applied to space bounded computations .  of particular interestare those probability distributions which are indistinguishable from the uniform distribution , focused on in , and are called _pseudorandom distributions_.  let denote the uniform probability distribution on .that is , for every , = \frac{1}{2^k} ] ( the probability taken over and the coin tosses of ) .we call collections which satisfy such weaker conditions , collection of weak one - way functions .transformations exist via sampling algorithms between both types of collections .another useful and equivalent notion is of a _ one - way predicate _, first introduced in .this is a boolean function of great use in encryption and protocol design .a one - way predicate is equivalent to the existence of 0/1 problems , for which it is possible to uniformly select an instance for which the answer is 0 ( or respectively 1 ) , and yet for a ( pre - selected ) instance it is hard to compute with success probability greater than whether the answer is 0 or 1 .  a _ one - way predicate _ is a boolean function for which  1 ._ sampling is possible _ : ppt algorithm that on input and , outputs a random such that and .guessing is hard _ : , ppt algorithms , sufficiently large ,  \leqq { { 1\over 2 } + { 1\over{k^c}}} ] the probability is taken over the random coin tosses of a , and random choices of of length .yao proposed a construction of a hard - core predicate for any one - way function .a considerably simpler construction and proof general result is due to goldreich and levin .[ th - gl ]  be a length preserving one - way function .define , where , and is the concatenation function .then is a hard - core predicate for ( notice that if is one - way then so is ) .interestingly , the proof of the theorem can be regarded as the first example of a polynomial time list decoding algorithm .essentially may be viewed as the bit of a haddamrd encoding of .the proof of the theorem yields a polynomial time error decoding algorithm which returns a polynomial size list of candidates for , as long as the encoding is subject to an error rate of less than where for some constant , .the length of the list is .-5 mm  a _ trapdoor function _ is a one - way function with an extra property .there also exists a secret inverse function ( the _ trapdoor _ ) that allows its possessor to efficiently invert at any point in the domain of his choosing. it should be easy to compute on any point , but infeasible to invert with high probability without knowledge of the inverse function .moreover , it should be easy to generate matched pairs of s and corresponding trapdoor .  a _ trapdoor _ function is a one - way function such that there exists a polynomial and a probabilistic polynomial time algorithm such that for every there exists a such that and for all , such that .trapdoor functions are much harder to locate than one - way function , as they seem to require much more hidden structure .an important problem is to establish whether one implies the other .recent results of indicate this may not the case .a _ trapdoor predicate _ is a one - way predicate with an extra trapdoor property : for every , there must exist trapdoor information whose size is bounded by a polynomial in and whose knowledge enables the polynomial - time computation of , for all . restating as a collection of trapdoor predicates we get .let be an index set and for , a finite domain .a collection of trapdoor is a set such that :  1 . ppt algorithm which on input outputs where , and ( is the trapdoor ) .2 .  ppt algorithm which on input outputs such that . ppt algorithm which on input outputs . ppt adversary algorithms , , , \leq { { 1\over2 } + { 1\over{k^c}}} ]  the algorithm corresponds to the message space from which messages are drawn , and the function corresponds to information about message ( for example , if has the letter ` e ' in it ) . a public key cryptosystem is computationally indistinguishable if and only if it is semantically secure .   -5 mm  we turn now to showing how to actually build a public key encryption scheme which is polynomial time indistinguishable .the construction shown here is by goldwasser and micali .the key to the construction is to answer a simpler problem : how to securely encrypt single bits .encrypting general messages would follow by viewing each message as a string of bits each encrypted independently .given a collection of trapdoor predicates b , we define a public key cryptosystem as follows :  [ encrypt.def ] a probabilistic encryption based on trapdoor predicates is defined as :  1 .key generation algorithm g : on input , g outputs where , and is the trapdoor information .the public encryption key is and the private decryption key is .( this is achieved by running the sampling algorithm from the def of b. ) 2 .let where be the message .+ encrypts as follows : + = choose such that for .+ output .+ + -5 mm 3 .let where be the cyph ertext .+ decrypts as follows : + = compute for .+ output .+  it is clear that all of the above operations can be done in expected polynomial time from the definition of trapdoor predicates and that messages can indeed be sent this way .let us ignore for a minute the apparent inefficiency of this proposal in bandwidth expansion and computation ( which has been addressed by blum and goldwasser in ) and talk about security .it follows essentially verbatim from the definition of trapdoor predicates that this system is polynomially time indistinguishable in the case the message is a single bit ( i.e. ) .even though every bit individually is secure , it is possible in principle that some predicate computed on all the bits ( e.g. their parity ) is easily computable .luckily , it is not the case .we prove polynomial time indistinguishability using the _ hybrid argument_. this method is a key proof technique in the theory of pseudo randomness and secure protocol design , in enabling to show how to convert a slight `` edge '' in solving a problem into a complete surrender of the problem .  as this is one of the most straight forward simplest examples of this technique we shall give it in full . probabilistic encryption is semantically secure if and only if is a collection of trapdoor predicates .suppose that is not indistinguishably secure ( i.e. not semantically secure ) .then there is a , a ppt and such that for infinitely many , with , \\  & & -\pr[a(i , c ) = 1  ( i , t_i)\in g(1^k ) ; \ , c\in e(i , m_1 ) ] \geq  \frac{1}{k^c},\end{aligned}\ ] ] where the probability is taken the choice of , the coin tosses of and .  consider where ( * ) holds .wlog , assume that and that says more often when is an encryption of and more often when is an encryption of .  define distributions for where and differs from in precisely bit .let  ] . & = & \pr[a(i , c ) = 0 | c \in e(i , s_j)]\pr[c \in e(i , s_j ) ] \\  & & + \pr[a(i , c ) = 1 | c \in e(i , s_{j+1 } ) ] \pr[c \ine(i , s_{j+1 } ) ] \\  & \geq & ( 1-p_j)(\frac{1}{2 } ) + ( p_{j+1})(\frac{1}{2 } ) \\  & = & \frac{1}{2 } + \frac{1}{2}(p_{j+1 } - p_j ) \\& > & \frac{1}{2 } + \frac{1}{k^{c+1}}.\end{aligned}\ ] ]  thus , will predict given , with probability better than .this contradicts the assumption that is a trapdoor predicate .hence , the probabilistic encryption is indistinguishably secure .-5 mm  the entire discussion so far has assumed that the adversary can listen to the cipher texts being exchanged over the insecure channel , read the public - file ( in the case of public - key cryptography ) , generate encryptions of any message on his own ( for the case of public - key encryption ) , and perform probabilistic polynomial time computation .one may imagine a more powerful adversary who can intercept messages being transmitted from sender to receiver and either stop their delivery all together or alter them in some way .even worse , suppose the adversary can after seeing a ciphertext , request a polynomial number of related ciphertexts to be decrypted for him .for definitions and constructions of encryption schemes secure against such adverdary see .-5 mm  a theory of randomness based on computability theory was developed by kolmogorov , solomonov and chaitin .this theory applies to individual strings and defines the complexity of strings as the shortest program ( running on a universal machine ) that generates that string .a perfectly random string is the extreme case for which no shorter program than the length of the string itself can generate it .inherintly , it is impossible to generate perfect random strings from shorter ones .one of the surprising contributions of cryptographically motivated research in the early eighties , has been a theory of randomness computational complexity theory pioneered by shamir blum and micali , which makes it possible in principle to deterministically generate random strings from shorter ones .not to mix notions , we will henceforth refer to this latter development as a theory of pseudo randomness , and the strings generated as pseudo random .in contrast , when we speak of choosing a truly random string of a fixed length over some alphabet , we refer to selecting it with uniform probability over all strings of the same length . in this sectionwe shall only speak of binary alphabet .the notation will thus be taken to mean that for every , the probability of is .defining pseudo - random distributions is a special case of the definition of computational indistinguishability , which we encountered earlier in the context of secure encryption .a distribution over binary strings is called _ pseudo - random _ if it is computationally indistinguishable from the uniform distribution over all binary strings of the same length .the idea is that as long as we can not tell apart samples from the uniform distribution from samples of a distribution in polynomial time , there is no difference between using either distributions that can be observed in polynomial time .in particular , any probabilistic algorithm , in which the internal coin flips of the algorithm are replaced by strings sampled from , must not behave any different than it would using truly random coin flips .a counter example will yield a statistical test to distinguish between and the uniform distribution .  a deterministic polynomial time program which stretchs a short input string selected with uniform distribution ( henceforth called the ` seed ' ) , to a polynomial long output stringis called a pseudo random sequence generator .when such a construction is accompanied with a proof that the output string distribution is pseudo random we call the generator a strong pseudo random sequence generator ( sprsg ) .where is the seed length and is computationally indistinguishable with respect to algorithms which run in time for time functions . ]  in a culmination of a sequence of results by , hastand , impagliazzo , levin and luby showed that a necessary and sufficient condition for the existence of strong pseudo random sequence generators is the existence of one - way functions .the link between one - way functions and pseudo randomness starts from the following observation .first , rephrase the fact that inverting one - way functions is difficult , by saying that the inverse of a one - way function is unpredictable .in particular , the hard - core of a one - way function is impossible to predict with any non - negligible probability greater than .second , show that impossibility to predict is the ultimate test for pseudo randomness .namely , if a pseudo - random sequence generator has the property that it is difficult to predict the next bit from previous ones with probability significantly better than in time polynomial in the size of the seed , then it is impossible to distinguish in polynomial time between strings produced by the pseudo random sequence generators and truly random strings .this is proved by turning any statistical test that distinguishes in polynomial time pseudo random strings from random strings into polynomial time next bit predictor .this link is not conditional on the existence of one - way functions .in fact , in work by nisan and wigderson they removed the requirement that the pseudo random sequence generator has to work in time which is as fast as the algorithm trying to distinguish the output sequences from truly random .generators of this type are generally useless for cryptographic applications ( as they can not be generated in feasible time ) but are very useful for proving complexity theoretic results .strong pseudo random generators are useful for understanding the relation between deterministic algorithms and probablistic algorithms .the idea which was put forth by yao was to replace a single execution of a probablistic polynomial time algorithm with the majority output of all the executions of the same algorithm , where each execution uses instead of random coins the output of a strong pseudo random number generator on a different input seed .the cost of the latter deterministic procedure will be a factor of longer where is the seed length used to generate the pseudo random sequences necessary .the algorithm must behave `` the same '' when it uses truly random coins as when it uses coins which are pseudo - random , as otherwise it becomes a distinguisher between the uniform and pseudo - random distributions , an impossible task for a probabilistic polynomial time algorithm . putting this together ,we get : if one - way functions exist , then .this tradeoff between the _ hardness _ of inverting the one - way function , and _ randomness _ replacement , has been followed up with many papers in complexity theory each either relaxing the hardness assumption or tightening the relation between deterministic and probabilistic complexity classes .strong pseudo random generators are particularly useful for cryptography .suppose you need a large supply of random strings for your cryptographic applications ( e.g. the choice of secret keys , internal coin tosses of an encryption algorithm , etc . ) .if you use instead of truly random bits , pseudo random sequence generators which are weak ( e.g. predictable ) , it may completely destroy the underlying cryptographic applications .in contrast , we can replace any use of truly random coins with strong pseudo random ones ( assuming we have access to truly random coins for the seeds which is an interesting discussion all by itself ) , without fear of compromising the security of the underlying application .indeed , if as a result of such replacement the cryptographic application becomes insecure , then a way is found to distinguish outputs of sprg from the uniform distribution .many classical pseudo random number generators which are quite useful and effective for monte carlo simulations , have been shown not only weak but predictable in a strong sense which makes them typically unsuitable for cryptographic applications .for example , _ linear _ feedback shift registers are well - known to be cryptographically insecure ; one can solve for the feedback pattern given a small number of output bits , and similarily outputs of linear congruential generators . in kannan , lenstra , and lovaszuse the algorithm to show that the binary expansion of any algebraic number ( such as ) is insecure , since an adversary can identify exactly from a sufficient number of bits , and then extrapolate s expansion .-5 mm  similarily to defining pseudo random sequences one may ask what other random objects can be replaced with pseudo - random counter parts .goldreich , goldwasser and micali considered in this light random functions , which from a gold mind for applications .pseudo random functions are defined to be for every size a subset of all functions from ( and to ) the binary strings of length , which are polynomial time indistinguishable from truly random functions by any algorithm whose only access to the function is to query it on inputs of its choice . however, in contrast with a truly random function , a pseudo random function has a short description which if known enables efficient evaluation .let then . let .a _ polynomial time statistical test for functions _ is a polynomial time algorithm with access to a black box from which can request values of for x of s choice . a collection of functions where _ passes the statistical test _if , \exists k_0 , \forall k > k_{0 } \ : |t(f_k ) - t(h_k)| < \frac{1}{q(k)} ] and $ ] .a collection of functions is a _ pseudo - random collection of functions _ if  1 .( indexing ) for each k , there is a unique index associated with each .the function associated with index will be written .efficiency ) there is a polynomial time function so that .( pseudo - randomness ) passes all polynomial time statistical tests for functions . if there exist one - way functions , then there exist pseudo - random collections of functions .an immediate application of pseudo random functions is the construction of semantically secure private key cryptosystem as follows .let an index of a pseudo random function be the joint secret key of the sender alice and the receiver bob .then to encrypt message , alice selects at random , and sets the cipher text where is the bit - wise exclusive - or of two strings .to decrypt , bob computes .pseudo random functions have been used to derive negative results in computational learning theory by valiant and kearns .they show that any concept class ( i.e. a set of boolean functions ) which contains a family of pseudo random functions can not be efficiently learnable under the uniform distribution and with the help of membership queries .a learning algorithm is given oracle access to any function in the class and is required to output a description of a function which is close to the target function ( being queried ) .the work on _ natural proofs _ originated by rudich and razborov use pseudo random functions to derive negative results on the possibility of proving good complexity lower bounds using a restricted class of circuit lower bound proofs referred to as _natural_. it is proved that natural ( lower bound ) proofs can not be established for complexity classes containing a family of pseudo random functions .an interesting question is to characterize which classes of random objects can be replaced by pseudo random objects .luby and rackoff treated the case of pseudo random permutations and naor and reingold the case of permutations with cyclic structure .as any object can be abstracted as a restricted class of functions , the real question is what form of access to the function does the statistical test have . in the standard definition , the statistical test for functions can query the functions at values of its choice. this may not be necessarily the natural choice in every case .for example , if the function corresponds to the description of a random graph ( e.g. if and only if an edge is present between vertices and ) .  define the `` ultimate '' extension of a statistical test for functions on bit strings , to be given access to the _ entire truth table _ of the function ( i.e. an exponential size input ) .the following observation is then straightforward .let be polynomial time computable function , for which the fastest inverting algorithm runs in time for some .then , there exist collections of pseudo random functions which pass all ultimate statistical tests for functions .-5 mm  secure one - way communication is a special case of general interactive protocols .the most exciting developments in cryptography beyond public - key cryptography has been the development of interactive protocols , interactive proofs , and zero knowledge interactive proofs .unfortunately , we have no space to cover these developments in this article .these topics have been surveyed extensively , and the interested reader may turn to .  a few final words .generally speaking , an _ interactive protocol _ consists of two or more parties who cooperate and coordinate without a trusted `` third '' party to accomplish a common goal , referred to as the _ functionality _ of the protocol , while maintaining the _ secrecy _ of their private data .a functionality may be computing a simple deterministic function such as majority of the inputs of the communicating parties , or a more complicated probabilistic computation such as playing a non - cooperative game without a trusted referee .  in the case of more than two parties ,the case of adversarial coalitions of participants who attempt to damage the functionality and break secrecy has been considered .very powerful and surprising theorems about the ability of playing non - cooperative games without a trusted `` third party '' have been shown .a sample theorem of benor , goldwasser , and wigderson shows that in the presence of an adversarial coalition containing less than a third of the parties , any probabilistic computation can be performed maintaining functionality and perfect information theoretic secrecy of the inputs , as long as each pair of parties can communicate in perfect secrecy .these results make extensive use of error correcting codes based on polynomials .the connection between these theorems and research in game theory and threory of auctions is well worth examining .christian cachin and ueli maurer unconditional security against memory - bounded adversaries advances in cryptology crypto 97 , lecture notes in computer science , springer - verlag , vol .1294 , 292306 , 1997 .o. goldreich , s. micali , and a. wigderson .proofs that yield nothing but their validity and a methodology of cryptographic protocol design . in _ proc . ieee symp . on foundations of comp .science _ , 174187 , toronto , 1986 .ieee .r. kannan , a. lenstra , and l. lovsz .polynomial factorization and non - randomness of bits of algebraic and some transcendental numbers . in _ proc . acm symp . on theory of computing _ ,191200 , washington , d.c . , 1984 .acm .a. k. lenstra and h. w. lenstra , jr .algorithms in number theory . in jan van leeuwen , editor , _ handbook of theoretical computer science ( volume a : algorithms and complexity )_ , chapter 12 , 673715 .elsevier and mit press , 1990 .john rompel .one - way functions are necessary and sufficient for secure signatures .proceedings of the twenty second annual acm symposium on theory of computing , 387394 , baltimore , maryland , 1416 may 1990 .

Abstract: theoretical computer science has found fertile ground in many areas of mathematics . the approach has been to consider classical problems through the prism of computational complexity , where the number of basic computational steps taken to solve a problem is the crucial qualitative parameter . this new approach has led to a sequence of advances , in setting and solving new mathematical challenges as well as in harnessing discrete mathematics to the task of solving real - world problems .  in this talk , i will survey the development of modern cryptography the mathematics behind secret communications and protocols in this light . i will describe the complexity theoretic foundations underlying the cryptographic tasks of encryption , pseudo - randomness number generators and functions , zero knowledge interactive proofs , and multi - party secure protocols . i will attempt to highlight the paradigms and proof techniques which unify these foundations , and which have made their way into the mainstream of complexity theory .   4.5 mm  * 2000 mathematics subject classification : * 68qxx , 11xx .  * keywords and phrases : * crytography , complexity theory , one - way functions , pseudo randomness , computational indistinguishability , zero knowledge interactive proofs .


variants of the tic - tac - toe game have been the focus of a number of studies in the area of recreational mathematics  .probably the most studied among these games is an achievement game , a class of generalized tic - tac - toe games presented by harary  .a _ polyomino _ or an _ animal _ is a set of connected cells ( in the 4-neighbor topology ) of the infinite grid . in the harary games defined by a given animal , two players alice and bob alternatively occupy one cell in each round of the game ( we assume that alice is the first player ) , and the first player who occupies a translated copy of the given animal is the winner . by the strategy stealing argument , bob can not win in these type of games .thus , his objective is to obstruct alice s achievement .  herewe present a new achievement game called the _ cannibal animal game_. as with harary s game , it is played on the infinite grid whereby players alternate turns to occupy free cells of the grid .this means that in each round the player must choose grid cells that are not yet occupied .once a cell is occupied , it remains so until the end of the game .in contrast to the generalized tic - tac - toe , the cannibal animal game is a _ partial game _ : the roles and legal moves of alice and bob are different .alice s legal move is to occupy one cell of the infinite grid in each round , and she wins if she occupies a translated copy of an animal given beforehand ( this move is the same as that of the first player of harary s generalized tic - tac - toe ) .bob s role and allowed moves , however , are different : in each round he must occupy a copy of the given animal ( i.e. , occupy a subset of the grid cells ) , and his objective is to prevent alice from achieving the animal .neither alice nor bob s moves are allowed to overlap with already occupied regions , even partially . the animal achieved or that bob occupies may be a translation , a mirror image and/or a , , or -degree rotation of the given animal .each such translation / rotation / reflection is called a _ copy _ of the animal .figure [ fig_el ] shows an example of the progress of the game where the animal is _ el _ , an l - shaped triomino .any animal of cells is called an -cell - animal ( alternative , we refer as the _ size _ of the animal ) . also , let \times [ y_{\min},y_{\max}] ] .for any , alice can construct using at most moves .we will describe alice s strategy for constructing : alice will try to play at locations , , and , forming a horizontal strip with none of bob s pieces ( see figure [ sn - case1 ] ) . by virtually rotating the boardwe can certify that bob s first move will be to the left of alice s .hence , she can occupy positions and with her first two moves .alice s strategy now depends on whether bob allows alice to play in the third and fourth positions ., , , and .,scaledwidth=60.0% ]  two cells occupied : :  the only case in which alice can not occupy position   in her third move is if bob plays his second move  occupying position .we claim that in such a case ,  alice will win in at most moves . to prove the  claim , let be the position in which bob  placed his second move .observe that we must have   and   .then alice plays her third move at  position .+   with his second move having its  bottom - left cell at , then alice plays her  third move at .the striped rectangular area is a  region that bob can not occupy.,scaledwidth=60.0% ]  +  at this point , note that the cells inside the rectangular region  \times[0,b_y+n-1] ] .since  alice occupies positions , , and   , bob s move in ( if any )  must either be strictly above the halfplane ( or  strictly below ) . without loss of generality , we assume that the region  \times [ 0,n] ] .after four turns , bob can place  at most three blocks in ( recall that bob s first move  is at a location to the left of the vertical line at   ) .moreover , bob can not occupy any cell of the  horizontal strip between and .hence , either the region above or below the horizontal strip will  contain at most one of bob s animals . without loss of generality, we  can assume that the upper half has none or one of bob s pieces .+  if this half is empty of bob s animals , alice will proceed as in the  case where three cells are occupied .her fifth move will be to play at  position and afterwards or   depending on bob s move . in either of the two  cases, moves will be sufficient to construct a  copy of the square .+  , , , and   then with her fifth move she  will play inside the region above or below the horizontal strip that  has at most one of bob s animals : in this example at   is above this strip .the striped rectangular area is a region that bob  can no longer occupy.,scaledwidth=60.0% ]  +  finally , it remains to consider the case in which bob has placed a  single animal for some   and .  additionally , we assume that ( if necessary , we  can flip the board vertically to obtain this property , see  figure [ sn - case4 - 1 ] ) . in this case, alice plays her fifth move at  position .this move will prevent bob from  occupying any position of the region .moreover , only three out of the five moves of alice have been placed  outside , hence alice wins again in   moves .observe that is a trivial lower bound on the number of moves of any winning strategy or .our strategy only uses at most 3 additional moves , which leads us to believe that our strategy is optimal ( in the sense that no other strategy can construct with fewer moves ) .in this section we demonstrate several strategies for bob that prevents alice from winning . by observation [ obs_three ] , the game becomes more interesting when the animal has 5 or more cells , since we will show that there exist both winning and losing polyominoes .we start by using the well - known concept of _ pairing strategy_. we note that this strategy has been successfully used in many other combinatorial games  .we start with a simple strategy for bob that works for the animal :  [ th_ring ] is a cannibal for any and .bob virtually partitions the playing - board into blocks of size .that is , we define the block as the rectangle \times [ j(m+k ) , ( j+1)(m+k)-1] ] .the exact value of the slant depends on the parameters and :   ( and ) : : :   . and : : :   .otherwise : : :  no slant is necessary ( i.e. , ) .it is easy to show that with such a partition , alice will be unable to construct her animal .by combining theorems [ th_l ] and [ th_u ] we can prove the existence of cannibal animals of any size .for example , the polyomino is a cannibal animal of size for any ( except for ) . if , an example of a cannibal animal would be .the above result combined with theorem [ theo_rect ] this allows us to show the existence of both cannibal and non - cannibal animals of any size .[ cor_5more ] for any , there exists a cannibal and a non - cannibal polyomino of size .we now introduce another idea to generate new cannibal animals from known cannibal animals .let be an animal and let be a subset of cells of . then is an animal created by removing from ( this operation will only be considered when is connected ) .we say that is an _ outer piece _ if we can locate a second disjoint copy of that overlays with a part of the removed piece of the first copy ( even if partially ) ; we call an _ inner piece _ otherwise. see figure [ fig_inner ] .notice that even if and are both inner pieces , need not be so .however , the superset of an outer piece must be an outer piece .   and are inner pieces . and are outer pieces since a second copy covers a part of the piece as seen in the right examples.,scaledwidth=70.0% ]  [ lem : punch ] let be a cannibal and let be an inner piece of .the animal is also a cannibal .assume otherwise that is non - cannibal ; by definition , alice is capable of constructing a copy of without bob preventing it .consider now the removed piece of the animal alice constructed .because is an inner piece , this position can not be occupied by bob .hence , alice can afterwards occupy this position in subsequent rounds to form animal .thus , we obtain a contradiction .note that the reciprocal is not always true ( see for example lemma [ lem_squa2 ] and theorem [ theo_rect ] ) . as a simple application of this lemma, we have the following result :  for any integer , let be an animal in which any number of interior cells have been removed .if at least one of the removed cells has distance or more to the boundary , then is a cannibal .we presented the cannibal animal game , a new partial game as variant of tic - tac - toe - like games .in harary s generalized tic - tac - toe , some monotone properties hold , e.g. , `` increasing the size of the board helps alice '' and `` increasing the size of the animal helps bob . ''however , such properties do not hold for this game , making it deeper and more interesting .in this paper we studied some basic animals and classified them into cannibals ( losers ) or non - cannibals ( winners ) .more interestingly , we introduced the `` bounding strategy '' ( lemma [ lem_rect ] ) and `` punching lemma ( lemma [ lem : punch ] ) , '' tools which we think that can be used for other games .  in harary s generalized tic - tac - toe , some monotone properties hold ; these properties include `` increasing the size of the board helps alice '' and `` increasing the animal helps bob . ''however , such properties do not hold for the cannibal animal game , making it deeper and more interesting .we also note that the cannibal property of many other animals is still left unsolved . among themis the animal , which we conjecture to be a cannibal .we conjecture that all -cell - animals are also non - cannibals , and consequently , the -cell - animal would be the smallest cannibal .another problem that remains open is what happens with the squares in which one or more interior cells have been removed , and the distance of these removed cells to the boundary is less than units away from the boundary .finally , we conclude with an open problem posed by an anonymous referee ; observe that the only arbitrarily large non - cannibal animals that we know of are rectangles .so , it would be interesting to know if there exist arbitrarily large non - cannibal animals ( other than rectangles ) .99   e. r. berlekamp , j. h. conway , and r. k. guy , winning ways for your mathematical plays , vol . 3 , second edition , a k peters , massachusetts , 2003. j. cardinal , h. ito , m. korman , and s. langerman .helly numbers of polyominoes . ,pages 114 , 2012 .e. fisher and n. seiben , rectangular polyomino set weak ( 1 , 2)-achievement games , theoretical computer science , * 409 * , 2008 , pp .. m. gardner , generalized ticktacktoe , in : fractal music , hypercards and more ... ,w. h. freeman and company , ny , 1992 , pp . 202213 .goodman and j. orourke , handbook of discrete and computational geometry , crc press , 1997 .f. harary , achieving the skinny animal , eureka , * 42 * , 1982 , pp . 814 .errata in edition number 42 , * 43 * , 1983 , pp . 56 .f. harary and h. harborth , achievemt and avoidance games with triangular animals , j. recreational mathematics , * 18(2 ) * , 198586 , pp . 110115. h. harborth and m. seemann , handicap achievement for squares , j. combin .comput . , * 46 * , 2003 , pp . 4752. h. ito and h. miyagawa , snaky is a winner with one handicap , abstracts of hercma 2007 , sept . 2022 , athens univ . of economics and business , athens , greece , 2007 , pp

Abstract: this paper presents a new partial two - player game , called the _ cannibal animal game _ , which is a variant of tic - tac - toe . the game is played on the infinite grid , where in each round a player chooses and occupies free cells . the first player alice can occupy a cell in each turn and wins if she occupies a set of cells , the union of a subset of which is a translated , reflected and/or rotated copy of a previously agreed upon polyomino ( called an _ animal _ ) . the objective of the second player bob is to prevent alice from creating her animal by occupying in each round a translated , reflected and/or rotated copy of . an animal is a _ cannibal _ if bob has a winning strategy , and a _ non - cannibal _ otherwise . this paper presents some new tools , such as the _ bounding strategy _ and the _ punching lemma _ , to classify animals into cannibals or non - cannibals . we also show that the _ pairing strategy _ works for this problem .


on saturday , august 16th 2008 , usain bolt shattered the world record of 100 meter dash in the bird s nest at the beijing olympics 2008 . in a spectacular run dubbed `` the greatest 100 meter performance in the history of the event '' by michael johnson , bolt finished at 9.69 seconds , improving his own previous world record from earlier this year by 0.03 seconds .however , the most impressive fact about this run was the way in which he did it : after accelerating away from the rest of the field , he looked to his sides when two seconds and 20 meters remained , and when that noting he was completely alone , he started celebrating !he extended his arms , and appeared to almost dance along the track .  despite this , he broke the world record by 0.03 seconds .but , needless to say , this celebration left spectators and commentators all over the world wondering about one big question : what would the world record have been if he had _ not _ celebrated the last 20 meters ?bolt s coach , glen mills , recently suggested at a press conference of the golden league tournament in zrich , that the record could have been 9.52 seconds , or even better .we wanted to check this for ourselves , by attempting to measure bolt s position as a function of time , and extrapolate from the dynamics before the celebration began , into the last two seconds of the race .based on ( hopefully ) reasonable assumptions , we could then obtain an estimate of the new world record .  in this paperwe analyze footage of the run obtained from various web sites and the norwegian broadcasting corporation ( nrk ) , with the goal of estimating this `` hypothetical '' world record . the main technical difficulty in performing this analysis lies in obtaining accurate distance measurements as a function of time for each runner .fortunately , this task is made considerably easier by the presence of a moving camera mounted to a rail along the track .this rail is bolted to the ground at regular intervals , and thereby provides the required standard ruler . using the methods detailed in the following sections , and properly taking into account all major sources of statistical uncertainty , we believe that our measurements are sufficiently accurate and robust to support interesting conclusions .our analysis is based on the following simple steps :  1 .we first obtained several different videos of the race from the internet ( nbc and bbc ) and the norwegian broadcasting company ( nrk ) , and printed out screen shots at different times from these .we then constructed a standard ruler by counting the total number of bolts ( called `` ticks '' in the following ) on the rail of the moving camera along the 100 meter track ( see figure [ fig : screenshot ] ) .we assumed the distance between these to be constant .3 .  next , we drew lines orthogonal to the track , using whatever means most accurate for a given screen shot . for early and late frames , lines in the actual track itself ( e.g. , starting and finishing lines ) were most useful , while for intermediate frames , the lower right edge of the camera mount was utilized ( figure [ fig : screenshot ] ) .4 .  for a given frame , we then read off the positions of usain bolt and richard thompson , the runner - up , with the ruler , and recorded these together with the time from the screen clock .next , we assigned an uncertainty to each distance measurement , by estimating how many ticks we believed we were off in a given frame .for later frames , when the camera angle is almost orthogonal to the track , this uncertainty is smaller than in the beginning of the race because of the camera perspective .6 .  based on these uncertainties, we fitted a smooth spline with inverse variance weights to the data .this provided us with a smooth approximation to the runners positions as a function of time , and also with the first and second derivatives , i.e. , their speeds and accelerations .7 .  to make the projections , we consider two cases :first , we conservatively assume that bolt would have been able to keep up with thompson s acceleration profile in the end race after 8 seconds of elapsed time , and project a new finishing time .second , given his clearly stronger acceleration around 6 seconds , we also consider the case in which he is able to maintain a .5 m/ higher acceleration than thompson through to the end .the final goal is the new projected world record , which is found by extrapolating the resulting motion profile to 100 meters .we also estimate the uncertainty in this number by repeating the above analysis 10000 times , each time adding a random fluctuation with specified uncertainties to each time and tick count .ccccccl 0.0 & -7.0 & 0.0 & -7.0 & 0.0 & 0.0 & none + ( 0.01 & -7.0 & 0.0 & -7.0 & 0.0 & 0.0 & none ) + 1.1 & -2.0 & 5.0 & -2.1 & 4.9 & 0.5 & nrk + 3.0 & 15.5 & 22.5 & 15.6 & 22.6 & 0.5 & nrk + 4.0 & 27.0 & 34.0 & 27.0 & 34.0 & 0.4 & nrk + 4.5 & 34.3 & 41.3 & 34.1 & 41.1 & 0.5 & nrk + 5.4 & 45.1 & 52.1 & 44.3 & 51.3 & 0.5 & nbc + 5.8 & 48.9 & 55.9 & 48.3 & 55.3 & 0.5 & bbc + 6.2 & 54.5 & 61.5 & 53.8 & 60.8 & 0.5 & nbc + 6.5 & 57.8 & 64.8 & 56.9 & 63.9 & 0.4 & bbc + 6.9 & 62.6 & 69.6 & 61.5 & 68.5 & 0.2 & nbc + 7.3 & 66.3 & 73.3 & 65.1 & 72.1 & 0.2 & nbc + 7.7 & 71.5 & 78.5 & 70.1 & 77.1 & 0.2 & nbc + 8.0 & 74.7 & 81.7 & 72.9 & 79.9 & 0.2 & nbc + 8.3 & 78.6 & 85.6 & 76.8 & 83.8 & 0.2 & nbc + 8.6 & 82.2 & 89.2 & 80.5 & 87.5 & 0.2 & nbc + 8.8 & 84.3 & 91.3 & 82.4 & 89.4 & 0.2 & nbc + 9.4 & 91.6 & 98.6 & 89.4 & 96.4 & 0.2 & nbc + 9.69 & 93.0 & 100 . & & & 0.0 & nrk + 9.89 & & & 93.0 & 100 . & 0.0 & nrk + ( 13 & 105 & 112 . & 105 . & 112 & 5.0 & nrk )the data used for this analysis consist of three clips filmed by three cameras located along the finishing line at slightly different positions .specifically , the clips were obtained from nrk , nbc , and bbc .unfortunately , the nrk and bbc clips were filmed with cameras positioned fairly close to the track , and the rail of the moving camera therefore disappears outside the field - of - view after about 6 seconds .this is not the case for the nbc clip , which was filmed from further away . even though the quality of this version is rather poor, it is possible to count the number of ticks to the end .  using these data sets, we measured the position of usain bolt and richard thompson at 16 different times in units of ticks .these are all listed in table [ tab : data ] .there are three issues that must be addressed before the tick counts listed in table [ tab : data ] can be translated into proper distance measurements .first , the camera rail is not visible entirely to the starting line , as the very first part is obscured by a camera man .the tick counts in table [ tab : data ] are therefore counted relative to the first visible tick .fortunately , it is not very problematic to extrapolate into the obscured region by using the distance between the visible ticks , and knowing that the distance between the starting lines for the 100 meter dash and 110 meter hurdles is precisely 10 meters .we estimate the number of obscured ticks to be .second , the precision of the screen clock is only a tenth of a second , and the clock also appears to truncate the time , not round off .we therefore add 0.05 seconds to each time measurement , and define our uncertainty in time to uniform between -0.05 and 0.05 seconds .finally , the screen clock is not calibrated perfectly with the stadium clock .( see figure 1 for an example frame . )a little more than half of all frames appear to be synchronized , while in the rest the screen clock is lagging behind by 0.1 seconds .we assume that the stadium clock is the correct one , and re - calibrate the screen clock by adding an additional 0.04 seconds to each time measurement .  with these assumptions ,it is straightforward to calibrate both the clock and distance measurements , and this is done in the corresponding columns in table [ tab : data ] .with calibrated distance information ready at hand , it is straightforward to make the desired predictions .first , we compute a smooth spline , , through each of the two runners measured positions .a nice bonus of using splines is that we automatically obtain the second derivatives of ( ie . ,acceleration ) at each time step , and also the first derivatives ( ie . ,speed ) ,   to obtain a well - behaved spline , we impose three constraints .first , we add two auxiliary data points at and seconds .these are not measurements , but included only in order to guarantee sensible boundary conditions at each end : the first one implies that the starting velocity is zero , while the last one leads to a smooth acceleration at the finishing line .thirdly , we adopt a smooth spline stiffness parameter of  to minimize unphysical fluctuations .the results are fairly insensitive to the specific value of this parameter .the resulting functions are plotted in figure [ fig : evolution ] . some interesting points to noticeare the following :  * bolt and thompson are virtually neck by neck up to four seconds , corresponding to a distance of 35 meters .* bolt s olympic gold medal is essentially won between 4 and 8 seconds .* at 8 seconds bolt decelerates noticeably , and thompson equalizes and surpasses bolt s speed .note however that thompson is also not able to maintain his speed to the very end , but runs out of power after about 8.5 seconds .still , his acceleration is consistently higher than bolt s after 8 seconds .we are now in the position to quantitatively answer the original question : how fast would bolt really have run , if he had nt celebrated the last 2 seconds ? to make this projection , we consider the following two scenarios :  1 .bolt matches thompson s acceleration profile after 8 seconds . 2 .bolt maintains a 0.5 m / s higher acceleration than thompson after 8 seconds .the justification of scenario 1 is obvious , as bolt outran thompson between 4 and 8 seconds .the justification of scenario 2 is more speculative , as it is difficult to quantify exactly _ how much _ stronger bolt was .still , looking at the acceleration profiles in figure [ fig : evolution ] , and noting that bolt traditionally was considered a 200 meter specialist , a value of 0.5 m / s seems fairly realistic .then , for each scenario we compute a new trajectory for bolt by choosing initial conditions , and , and an acceleration profile as described above .the computation of these trajectories are performed by simply integrating equation [ eq : v_and_a ] with respect to time ,   in figure [ fig : end_run ] we compare the projected trajectories , ( dashed red line shows scenario 1 , dotted red line shows scenario 2 ) , with the actual trajectory , ( solid red line ) . for comparison ,thompson s trajectory is indicated by a solid blue line .the projected new world record is the time for which equals 100 meter . including 95% statistical errors estimated by monte carlo simulations as described in section [ sec : method ] ,we find that the new world record would be seconds in scenario 1 , and in scenario 2 .glen mills , usain bolt s coach , suggested that the world record could have been 9.52 seconds if bolt had not danced along the track in beijing for the last 20 meters .according to our calculations , that seems like an good , but perhaps slightly optimistic , estimate : depending on assumptions about bolt s acceleration at the end of the race , we find that his time would have been somewhere between 9.55 and 9.61 seconds , with a 95% statistical error of seconds . clearly , the uncertainties due to the assumptions about the acceleration are comparable to or larger than the statistical uncertainties. therefore , 9.52 seconds does by no means seem to be out of reach .  in figure[ fig : manipulated ] we show an illustration of how such a record would compare to the actual world record of 9.69 seconds , relative to the rest of the field : the left version of bolt shows his actual position at seconds , while the right version indicates his position in the new scenarios .  of course, there are potential several systematics errors involved in these calculations . for instance , it is impossible to know for sure whether usain might have been tired at the end , which of course would increase the world record beyond our estimates . on the other hand , judging from his facial expressions as he crossed the finishing line , this does nt immediately strike us as a very plausible hypothesis .another issue to consider is the wind .it is generally agreed that a tail wind speed of 1 m / s improves a 100 meter time by 0.05 seconds .further , for iaaf ( international association of athletics federations ) to acknowledge a given run as a record attempt , the wind speed must be less than + 2 m / s .when bolt ran in beijing , there was no measurable wind speed at all , and one can therefore safely assume that the world record could have been further decreased , perhaps by as much as 0.1 seconds , under more favorable wind conditions .   first and foremost , we would like to thank christian nitschke smith at nrk sporten for providing very useful high - resolution footage of the beijing 100 dash run , and also bbc and nbc for making their videos available on their web pages .second , we thank the pizza guy from peppe s who provided us with a very good half - n - half `` thai chicken '' and `` heavy heaven '' pizza on a late friday night . this article has been submitted to the american journal of physics .after it is published , it will be found at http://scitation.aip.org/ajp .

Abstract: since that very memorable day at the beijing 2008 olympics , a big question on every sports commentator s mind has been `` what would the 100 meter dash world record have been , had usain bolt not celebrated at the end of his race ? '' glen mills , bolt s coach suggested at a recent press conference that the time could have been 9.52 seconds or better . we revisit this question by measuring bolt s position as a function of time using footage of the run , and then extrapolate into the last two seconds based on two different assumptions . first , we conservatively assume that bolt could have maintained richard thompson s , the runner - up , acceleration during the end of the race . second , based on the race development prior to the celebration , we assume that he could also have kept an acceleration of 0.5 m / s higher than thompson . in these two cases , we find that the new world record would have been and seconds , respectively , where the uncertainties denote 95% statistical errors .


the search for generally applicable methods capable of determining structural parameters from small - angle scattering patterns for a broad range of samples has yielded several viable methods . for monodisperse systems consisting of identical particles , these methods attempt to find a free - form solution to the pair - distance distribution function , whereas for polydisperse systemsthe aim is to determine the distribution in real space . in both cases ,relevant transformation should yield the observed scattering pattern .there are indirect transform methods ( itm ) based on regularization techniques which either impose that the solution is as smooth as possible , or bayesian and maximum entropy itm methods , which find a most likely solution using a bayesian approach and entropy maximization , respectively .there are also methods available based on titchmarsh transforms for determining size distributions .another class of methods , such as the structure interference method ( sim ) and some monte - carlo ( mc ) methods , assume a particular shape and do not appear to require smoothness constraints .these only have a positivity constraint and have so far been limited to size distributions of sphere - shaped scatterers .these methods can be used to extract the particle size distribution function of systems of ( dilute ) scatterers whose shape is known or assumed .the mc variant approaches the optimization by trial - and - error , whereas the sim uses a conjugate gradient approach .both are conceptually easier than the itm or those based on titchmarsh transforms , and provide stable and unique solutions .  upon implementation of one such method by , hereafter referred to as `` the martelli method '' , several noteworthy changes were made in the present work .we give a brief summary of the working principle , and highlight the differences from the martelli method .then , a general solution for detection limits is derived for particles in a polydisperse set .this aids the mc method as it allows for improved contribution scaling during the optimization procedure and indicates detectability limits in the final result .lastly , a convergence criterion is defined for the mc method , allowing for the calculation of uncertainties in the resulting size distribution .this method is applied to scattering data obtained during the synthesis of alooh nanoparticles .the initial guess of the scattering intensity is calculated for a uniform random distribution of a number of spheres anywhere between size bounds ( where is the smallest measured value of , with the wavelength of the radiation and the scattering angle ) , using : where is the rayleigh form factor for a sphere , the radius for sphere , and the pseudo - size distribution is related to the number distribution through .in other words , in this calculation ( for reasons detailed in paragraph [ sc : obs ] ) the volume - squared scaling of each sphere contribution is partially compensated for by an exponent , so that the scaling follows , with typically between . incidentally , setting makes identical to the volume - weighted size distribution .subsequently , the mc intensity is brought in line with the measured intensity through optimization of the scaling factor and background level using a least - squares residual minimization procedure , minimizing the reduced chi - squared  : ^ 2\ ] ] where and where is the number of data points , the number of degrees of freedom ( unfortunately ill - defined in an mc model , and is set equal to two here for the intensity scaling parameter and background contribution parameter ) , and the measured intensity and calculated model intensity , respectively , and the estimated error on the data point ( the estimation method for the error is detailed in paragraph [ sc : conv ] ) .the monte - carlo optimization cycle then begins , by picking a random sphere from the set of spheres , changing its radius to another random value within the bounds , recalculating the intensity of the entire set using equation [ eq : main ] and reoptimizing the scaling factor and background level ( eqn .[ eq : chisqr ] and [ eq : icalc ] ) , and checking if this radius change improves the agreement between measured and mc intensity , i.e. if the change reduces the -value . if it does , the change is accepted , otherwise rejected . a rejection - acceptance mechanism( occasionally accepting `` bad moves '' ) was found not to be necessary .this method differs from the martelli method , in that the martelli method continually attempts to add new sphere contributions to an ever growing set , leaving the prior established set contributions untouched .the adaptation presented here leaves the number of sphere contributions in the set unchanged , but repeatedly tries to change the radius of a random contribution in the set .the optimization is stopped once the condition has been reached ( c.f .paragraph [ sc : conv ] ) . if convergence has not been reached within a certain number of steps ( here set to 1 million ) for a limited number of attempts , the pattern is considered unsuitable for fitting with this method . for visualization and analysis purposes ,the set of spheres can be distributed in a histogram ( weighted to compensate for ) .the whole mc procedure is then repeated several tens of times in order to obtain information on the mean and standard deviation of the histogram points .as the scattering intensity of particles scales proportional to their volume squared ( radius to the sixth power for spheres ) , the scattered intensity of smaller particles in a polydisperse set is quickly drowned out by the disproportionally larger signal of larger particles .this effect , however , is partially compensated for by the different q - dependence of the scattering of the smaller particles .  to investigate how large this compensatory effect is, we can define the `` maximum observability '' of a particle in a set as the maximum fractional contribution of that component to the total scattering pattern .i.e. the observability for component in a scattering pattern of independent contributions , measured within the -range delimited by is defined as : where the location is the value within the observed q - range where is largest . for the mc method ,both and are defined by equation [ eq : main ] .when plotting for any size distribution of spherical particles , it is evident that the observability scales with the sphere radius squared ( c.f .figure [ fg : obs ] ) for particles with sizes larger than .particles smaller than exhibit an observability scaling in line with the volume - squared intensity scaling ( i.e. radius to the sixth power ) .the observability is shown for three unimodal distributions ( one uniform and two triangular distributions of 50000 spheres ) with particle radii between .the modes of the triangular distributions are set to and for the `` trailing '' and `` leading '' triangular distributions , respectively ( the distributions are shown in figure [ fg : obsc ] ) .figure [ fg : obs ] shows that the shape of the distribution has little visible effect on the shape of the observability .the absolute values of the observability are slightly dependent on the distribution , but more significantly dependent on the number of contributions ( as can be inferred from equation [ eq : mobs ] directly , but is not graphically shown ) .  ) , within . a change in slopeis observed at . is zero in the calculation.,scaledwidth=90.0% ]  , scaledwidth=90.0% ]  the information on the observability can be used for three purposes .first and foremost , there is a clear indication of the limits of small - angle scattering for resolving the smaller sizes , and there is a link between the smallest measurable sizes and the maximum measured ( as the observability scales with radius to the sixth power for particles with radii smaller than , their contribution vanishes rapidly ) .note that it does not give information about the upper particle size detection limit , which is defined by the ability to distinguish the differences of scattering patterns of large particles .secondly , the knowledge can be used to calculate , for any model fitting solution , the minimum number of particles required to make a measurable impact on the total scattering pattern .this is done by calculating the inverse observability for the resulting distribution , and multiplying this with the overall measurement accuracy ( usually 1% ) . note that for the mc method presented here , in order to compensating for the discrepancy between the number of sphere contributions used and the number of bins they eventually end up in , we need to calculate :   in this way , any plots of size distributions can contain a line indicating a rough estimate for the minimum detectable number of particles ( c.f .figures [ fg : past ] and [ fg : p ] ) , which can prevent drawing erroneous conclusions from analysis artifacts . as stated above , the observability , and therefore these minimum required particle numbers , are directly dependent on the number of size divisions in the distribution .thirdly , the disproportionate contribution of larger spheres in numerical integrations over size distributions can be reduced by , instead of determining the size distribution function in , to determine a pseudo - size distribution in equation [ eq : main ] . upon determination of , the correct number - weighted distribution can be retrieved through division of by . as indicated in paragraph [sc : imp ] , this compensatory power does not have to be equal to , and can be tuned to further make the mc minimization more efficient .estimates of the level of uncertainty on each measured data point ( `` errors '' , in equation [ eq : chisqr ] ) are invaluable to assessing the veracity of model fitting results ( i.e. to determine whether the analysis provided a solution to within the uncertainty estimate ) . additionally , its knowledge can help unlink the model fitting result from more arbitrary parameters such as the measured intensity integration bin width or the number of data points . by weighting of the goodness - of - fit parameter ( used in the least - squares minimization function ) by this error ( c.f .equation [ eq : chisqr ] ) uncertainties on the mc solution can be established .these errors can be estimated to be _ at their very least _ the counting - statistics - based poisson error ( where is the number of detected counts ) .furthermore , if this estimate is exceeded by the sample standard error of the mean of the values contained in each individual integration bin ( defined in equation [ eq : sse ] ) , the sample standard error should be the preferred error estimate for that bin ( as it can account for some detector irregularities ) .this sample standard error for each bin ( ) is defined as : where is the mean intensity in the bin , the intensity of datapoint in the bin and the total number of points in the bin .lastly , the absolute uncertainty of the measured intensity is commonly challenging to be below 1% .thus , 1% ( or however small the instrumental error is estimated to be ) of the measured intensity should be preferred if it exceeds the other two estimates , these errors can then be used in equation [ eq : chisqr ] to determine the goodness - of - fit parameter as acceptance - rejection criterion for a mc proposition .the advantage of using these errors in the expression for is that if this parameter drops below one , the deviations between model- and measured intensities are _ on average _ smaller than the statistical uncertainties .this thus provides a cut - off criterion for ( for example ) the mc method , allowing for the estimation of the mean and standard deviations of the final particle size histogram ( shown in figure [ fg : p ] ) .additionally , by using these errors in the expression for the goodness - of - fit parameter , the intensities are weighted by their relative errors in the fitting procedures and thus become less sensitive to arbitrary values such as bin widths or number of data points used in the fit .  since the mc method does not provide us with an intensity at the same level as the measured intensity , and since thereoften is a constant background associated with small - angle scattering patterns for a variety of reasons , these two parameters will have to be determined separately .thus , after every mc proposed change , but before calculation of the goodness - of - fit , an intermediate least - squares minimization routine is applied to optimize the model intensity scaling and background parameters ( eqn .[ eq : icalc ] ) .if required , the least - squares minimization method can be expanded to include more terms , at the cost of speed and stability .one reason for such an inclusion could be to include a power - law slope ( with optional cut - off ) to compensate for scattering from large structures or some inter - particle scattering effects .one common criticism of mc methods is the potential for ambiguity in the result , or the risk of over - fitting the data . while a rough estimate for the number of independently determinable radii ( c.q .histogram bins ) can be found using the sampling theorem ( since , , assuming the largest measurable dimension is identical to the measurement limit ) , it also has to be dependent on the uncertainty of the underlying dataset . an alternative practical way of investigating the result validity is to determine the errors ( standard deviation in this case ) on the result .these can be obtained with the present mc method , by performing the mc fit to the same data several tens of times , and for each time optimizing until has been achieved .by distributing the results in histograms with a fixed array of bins , the mean value and standard deviation for each bin can be determined . naturally , the relative standard deviation is a function of the bin size , so that more numerous narrower bins will have a larger standard deviation than fewer wider bins ( within reason ) .additionally , the level of the observability ( equation [ eq : mobs ] ) is dependent on the number of bins , leading to a trade - off between minimum observable number of particles and the number of bins . for the most common equidistant histogramming , however , it is up to the user to determine the best suited number of size histogram bins ( or to use a value close to the sampling - theorem - derived value ) .the procedure then provides the user with a clear overview of the uncertainties and detection limits attached to the determination of polydispersity from small - angle scattering patterns , which can be used for further extraction of meaningful numbers from the resulting distribution .boehmite ( alooh ) particles were synthesized in - situ using an automated and modified version of a high - pressure high - temperature reactor .the sapphire capillary in which the reaction takes place has an inner diameter of 1.0 mm and an outer diameter of 1.57 mm .the particles were synthesized from a solution of 0.5 m al(no) precursor in water .the start of the reaction was considered to be the moment at which the pressurized solution ( maintained at a pressure of 250 bar ) is heated to its reaction temperature of 275 degrees centigrade .the measurement used in this paper was obtained 1700 seconds from the start of the reaction .further details and results will be presented in a forthcoming paper .synchrotron saxs experiments were performed at the bl45xu beam line of the spring-8 synchrotron in japan .the beam was collimated to a 0.4 by 0.2 mm beam ( horizontal by vertical , respectively ) , with photons with a wavelength of nm . the sample - to - detector distance was 2.59 meter .the scattering patterns were recorded on a pilatus 300k detector whose total surface area covers 33.5 by 254 mm , consisting of 195 by 1475 pixels measuring 0.172 by 0.172 mm .transmission values were determined using in - line ionization chambers .the polarization factor was assumed to be 0.95 .the measurements were collected at a rate of 1 hz .the data were corrected for background ( water at 275 degrees centigrade and 250 bar ) , incoming flux , measurement time , transmission factor , polarization factor , spherical correction factor and calibrated to absolute units using a glassy carbon sample from series h , supplied by dr .ilavsky from aps .statistics were calculated according to the procedure outlined in paragraph [ sc : conv ] , with the minimum possible error set to 1% of the measured intensity .the collected dataset , its error and the mc fit are shown in figure [ fg : fit ] , where the mc fit intensity is the average of 100 repetitions of the mc procedure .while a single run also delivers a model intensity to within the determined error ( on average ) , the mean intensity is shown here as it matches the mean of the size distributions shown in figures [ fg : past ] and [ fg : p ] . in figure[ fg : past ] , the pseudo - size distribution is shown , as determined from the mc procedure using .the error bars indicate the standard deviation of the histogrammed value for each of 100 repetitions .this figure also contains the line indicating the minimum number of visible particles required ( which here is proportional to the radius due to the choice of ) .transformed to a number size distribution the histogram becomes that shown in figure [ fg : p ] .it is immediately clear that the larger particles are only present in the solution in minuscule amounts , and that there is a dip in the number of particles with a radius around 5 nanometer , with many particles slightly smaller and larger than that size .  in this example , the number of histogram bins is 25 , but one can choose more or fewer bins .the effect of this is shown in the pseudo - size distributions in figures [ fg : past60 ] and [ fg : past15 ] for 60 and 15 histogram bins , respectively .this clearly shows the relation between the standard deviation in the bins and the minimum observable number of particles .if the number of histogram bins is high , the uncertainty for each value is equally large , _ and _ the minimum number of particles of each bin size required to make a measurable impact on the scattering pattern increases .if the number of bins is reduced , both the uncertainty and reduces , at the cost of detail . forfurther ( and more involved ) improvement in information content retrieval , the bins in figure [ fg : past ] that fall below the line could be combined ( which would render them `` observable '' ) , and the bins above this line could be further subdivided for improved information extraction .    , standard errors and minimum observable number of particles obtained by transforming the distribution shown in figure [ fg : past ] . shown with limited vertical axis range for clarity.,scaledwidth=100.0% ]   with as used for the mc fit shown in figure [ fg : fit ] .error bars indicate sample standard deviation over 100 repetitions .minimum observable number of spheres shown as blue line.,scaledwidth=100.0% ]   of figure [ fg : past ] histogrammed in 60 bins .minimum observable number of spheres shown as blue line.,scaledwidth=100.0% ]   of figure [ fg : past ] histogrammed in 15 bins .minimum observable number of spheres shown as blue line.,scaledwidth=100.0% ]all the above results were obtained assuming that the scatterers are spherical in shape .this does not have to be the correct particle shape for the method to arrive at a solution . as mentioned before , the size distribution and shape can not be uniquely separated from scattering patterns ( which has been tested for simulated isotropic scattering patterns from polydisperse sets of prolate and oblate ellipsoids ) .the solution from the mc method , then , shows the user what the size distribution would be _ if _ the scattering pattern originated from spherical particles .if the shape of the scatterers is known from other investigations such as electron microscopy , and deviates from a spherical shape , this information can be used to obtain the correct size distribution for that particular shape .this can be done by either adjusting the particular scattering function in the mc method , or by analysis ( or rather deconvolution ) of the correlation function which can be calculated from the sphere - based mc method result .however , it should be kept in mind that only one length distribution can be uniquely determined due to the limited dimensionality ( information content ) of the isotropic scattering data .discussed in this paper are modifications to the martelli mc method , the general veracity of the result , and the application of it to a saxs measurement .it is shown that by using the methodology described in this paper , a particle size distribution can be retrieved from a scattering pattern , uncertainties can be estimated for the particle size distribution , and the minimum number of particles indicated for each size required to make a measurable impact on the scattering pattern can be indicated for each size .the mc code is available for inspection , improvements and application and will be freely supplied by the author upon request .spring-8 , riken and dr .hikima are acknowledged for their beamtime and support .dr . becker and dr .eltzholtz have been instrumental in the success of the measurements .

Abstract: monte - carlo ( mc ) methods , based on random updates and the trial - and - error principle , are well suited to retrieve particle size distributions from small - angle scattering patterns of dilute solutions of scatterers . the size sensitivity of size determination methods in relation to the range of scattering vectors covered by the data is discussed . improvements are presented to existing mc methods in which the particle shape is assumed to be known . a discussion of the problems with the ambiguous convergence criteria of the mc methods are given and a convergence criterion is proposed , which also allows the determination of uncertainties on the determined size distributions .   pauwbrian.nl  pedersen  tardif  takata  iversen