Laurie André

Stéphane Abanades
email: stephane.abanades@promes.cnrs.fr

Laurent Cassayre

High-temperature thermochemical energy storage based on redox reactions using Co-Fe and Mn-Fe mixed metal oxides

Keywords:

Metal oxides are potential materials for thermochemical heat storage via reversible endothermal/exothermal redox reactions, and among them, cobalt oxide and manganese oxide are attracting attention. The synthesis of mixed oxides is considered as a way to answer the drawbacks of pure metal oxides, such as slow reaction kinetics, loss-in-capacity over cycles or sintering issues, and the materials potential for thermochemical heat storage application needs to be assessed. This work proposes a study combining thermodynamic calculations and experimental measurements by simultaneous thermogravimetric analysis and calorimetry, in order to identify the impact of iron oxide addition to Co and Mn-based oxides. Fe addition decreased the redox activity and energy storage capacity of Co 3 O 4 /CoO, whereas the reaction rate, reversibility and cycling stability of Mn 2 O 3 /Mn 3 O 4 was significantly enhanced with added Fe amounts above ~15 mol%, and the energy storage capacity was slightly improved. The formation of a reactive cubic spinel explained the improved re-oxidation yield of Mn-based oxides that could be cycled between bixbyite and cubic spinel phases, whereas a low reactive tetragonal spinel phase showing poor re-oxidation was formed below 15 mol% Fe. Thermodynamic equilibrium calculations predict accurately the behavior of both systems. The possibility to identify other suitable mixed oxides becomes conceivable, by enabling the selection of transition metal additives for tuning the redox properties of mixed metal oxides destined for thermochemical energy storage applications.

Introduction

The purpose of thermal energy storage (TES) in solar thermal power plants is to store solar heat in the form of sensible, latent or chemical energy during on-sun hours and then to use it during off-sun hours in order to match a variable electricity demand with an intermittent energy source supply, thus enabling energy production according to needs and enhancing energy generation dispatchability [START_REF] Abedin | A critical review of thermochemical energy storage systems[END_REF]. This study focuses on thermochemical heat storage, which shows advantages over latent and sensible heat storage, including higher energy storage densities, possible heat storage at room temperature in the form of stable solid materials, and long term storage in a broad temperature range (400-1200 °C) with heat released at a constant restitution temperature defined by the reaction equilibrium. Concentrated solar power (CSP) provides the heat source required for endothermal/exothermal reversible reactions involved in thermochemical energy storage (Eqs. [START_REF] Abedin | A critical review of thermochemical energy storage systems[END_REF] and [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF]) in order to store solar energy in the form of chemical bonds. When combined with CSP systems, the continuous production of electricity in thermal power plants becomes possible. The reaction enthalpy is stored in the reaction products during the heat charge (Eq. ( 1)), and can be released by reversing the reaction during the discharge (Eq. ( 2)). MO (ox) + Heat → MO (red) + α O 2(g) [START_REF] Abedin | A critical review of thermochemical energy storage systems[END_REF] MO (red) + α O 2(g) → MO (ox) + Heat [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF] An advantage of using metal oxides as TES materials is the use of air as the heat transfer fluid that can be processed in an open-loop system. Such thermochemical systems are suitable for application in high-temperature solar power plants based on central air receiver (pressurized air-based solar tower receivers for power generation via gas turbines). Cobalt oxide (Co 3 O 4 ) and manganese oxide (Mn 2 O 3 ), which reduce into CoO and Mn 3 O 4 respectively, are among the most studied metal oxides considered as promising materials for thermochemical energy storage. Experiments showed that Co 3 O 4 is the most suited raw material given the fast reaction kinetics, complete reaction reversibility and cycling stability with a measured gravimetric energy storage density of 576 kJ/kg [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF] (while reported theoretical enthalpy is 844 kJ/kg [START_REF] Agrafiotis | Exploitation of thermochemical cycles based on solid oxide redox systems for thermochemical storage of solar heat. Part 2: redox oxide-coated porous ceramic structures as integrated thermochemical reactors/heat exchangers[END_REF][START_REF] Agrafiotis | Exploitation of thermochemical cycles based on solid oxide redox systems for thermochemical storage of solar heat. Part 3: cobalt oxide monolithic porous structures as integrated thermochemical reactors/heat exchanger[END_REF][START_REF] Neises | Solar-heated rotary kiln for thermochemical energy storage[END_REF][START_REF] Tescari | Thermochemical solar energy storage via redox oxides: materials and reactor/heat exchanger concepts[END_REF]). However, the cost and potential toxicity of cobalt oxide may require the development of other alternative materials. The reduction step of Mn 2 O 3 was observed in the range of 920-1000 °C, with notably slow re-oxidation in the range of 850-500 °C, with a reported gravimetric energy storage density of 110-160 kJ/kg [START_REF] Karagiannakis | Monolithic ceramic redox materials for thermochemical heat storage applications in CSP plants[END_REF][START_REF] Carrillo | Improving the thermochemical energy storage performance of the Mn2O3/Mn3O4 redox couple by the incorporation of iron[END_REF] and a theoretical enthalpy of 202 kJ/kg [START_REF] Carrillo | Improving the thermochemical energy storage performance of the Mn2O3/Mn3O4 redox couple by the incorporation of iron[END_REF]. The re-oxidation usually happens in two steps, the first one being during the cooling and in between 700 °C and 500 °C and the second one being during the reheating and in the range of 500-850 °C [START_REF] Pagkoura | Cobalt oxide based structured bodies as redox thermochemical heat storage medium for future CSP plants[END_REF] because of strong kinetic limitations. In order to complete the slow re-oxidation during the cooling step, it needs to last long enough by decreasing drastically the cooling rate.

Optimization of materials reactivity is generally required for metal oxide species by using e.g. doping strategies, controlled synthesis techniques for tailored morphology, or stabilization with inert materials to alleviate sintering effects. Improvement of materials properties and flexibility such as reaction kinetics and reaction temperature tuning can be obtained by the addition of dopants. In the specific case of the Mn 2 O 3 /Mn 3 O 4 cycle, the doping with transition metals is an option to relieve the slow re-oxidation issue [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF][START_REF] Agrafiotis | Exploitation of thermochemical cycles based on solid oxide redox systems for thermochemical storage of solar heat. Part 3: cobalt oxide monolithic porous structures as integrated thermochemical reactors/heat exchanger[END_REF].

The present study aims at investigating the effect of Fe addition on the performances of Co and Mn metal oxides, which have been identified as interesting candidates for TES [START_REF] André | Screening of thermochemical systems based on solid-gas reversible reactions for high temperature solar thermal energy storage[END_REF]. The optimal mixed metal oxide composition to reach the highest performances for TES is addressed, encompassing high reaction enthalpy, stability upon cycling, low temperature gap between reduction and re-oxidation, and reaction in a temperature range adapted to CSP. The addition of transition metals is investigated as a way to answer the drawbacks of simple metal oxides, including slow reaction kinetics [START_REF] Neises | Solar-heated rotary kiln for thermochemical energy storage[END_REF], sintering [START_REF] Carrillo | Thermochemical heat storage based on the Mn 2 O 3 /Mn 3 O 4 redox couple: influence of the initial particle size on the morphological evolution and cyclability[END_REF], loss-in-capacity over cycles [START_REF] Carrillo | Improving the thermochemical energy storage performance of the Mn2O3/Mn3O4 redox couple by the incorporation of iron[END_REF], etc. Block et al. [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF] reported that both addition of iron to cobalt oxide or addition of cobalt to iron oxide results in lower enthalpies of reaction compared to those of the pure oxides. However, they estimated that cobalt oxide doped with 10% of iron possesses higher reduction/oxidation reversibility than pure cobalt oxide and still shows high enthalpy of reaction. Pagkoura et al. [START_REF] Pagkoura | Cobalt oxide based structured bodies as redox thermochemical heat storage medium for future CSP plants[END_REF] showed that cobalt oxide with 10-20 wt% of iron shows good thermo-mechanical stability over ten redox cycles. Carrillo et al. [START_REF] Carrillo | Thermochemical heat storage based on the Mn 2 O 3 /Mn 3 O 4 redox couple: influence of the initial particle size on the morphological evolution and cyclability[END_REF] showed that the addition of iron does not allow avoiding the sintering encountered with Mn 2 O 3 but helps to increase the heat storage density of the material. Furthermore, the addition of iron helped to stabilize and enhance the oxidation rate of manganese oxide over thirty redox cycles. According to their study, the fastest and most stable oxidation reaction was obtained for Mn 2 O 3 doped with 20 mol% Fe. In another study, the authors also considered Fe-Cu co-doping in manganese oxide and showed that the incorporation of Cu diminished the reduction temperature, whereas the incorporation of Fe increased the oxidation temperature [START_REF] Carrillo | Manganese oxide-based thermochemical energy storage: modulating temperatures of redox cycles by Fe-Cu Co-doping[END_REF].

Recent models provide thermodynamic descriptions of the Co-Fe-O [START_REF] Jung | Thermodynamic evaluation and modeling of the Fe-Co-O system[END_REF][START_REF] Zhang | Thermodynamic modeling of the Co-Fe-O system[END_REF] and Mn-Fe-O [START_REF] Kang | Thermodynamic modeling of oxide phases in the Fe-Mn-O system[END_REF][START_REF] Kjellqvist | Thermodynamic assessment of the Fe-Mn-O system[END_REF] systems, based on exhaustive studies of available experimental data. In the present work, some of these models were used to calculate the nature and composition of solid phases at equilibrium, the oxygen storage capacity (equal to the mass loss during reduction), the transition temperature, and the reaction enthalpy of Co-Fe and Mn-Fe mixed oxides, with Fe content up to 50 mol%. Equilibrium calculations were compared to experimental (thermogravimetric and calorimetric) measurements carried out with various oxide compositions, under 20%O 2 /Ar atmosphere, in the 750-1050 °C temperature range. The combination of experimental data and thermodynamics aims at providing a better understanding of the behavior of the mixed oxides and defining the optimal composition.

Materials and methods

Synthesis and characterization

Pure Co 3 O 4 and cobalt oxide mixed with 5, 10, 25, and 40 mol% Fe as well as pure Mn 2 O 3 and manganese oxide mixed with 10, 15, 20, 30, 40 and 50 mol% Fe were synthesized. In the following, the oxides compositions are either noted x(Fe) or mol% Fe, referring to the molar content of Fe on metal basis (based on a Fe/(Fe+Co) and Fe/(Fe+Mn) mole ratio). All the powders were synthesized via a modified Pechini method [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF], using metal nitrates ( > 98% purity), citric acid ( > 99% purity) and ethylene glycol ( > 99% purity) in aqueous solution. The solution was heated up until obtaining a viscous solution. The powders were then calcined in air at 200 °C for 2 h and at 750 °C for 4 h in order to fully eliminate the organic fraction and residues of the synthesis, and to stabilize the structure. Higher calcination temperatures were not considered to avoid the reduction of the materials during the synthesis. The powders were characterized by X-ray diffraction (XRD) before being studied in redox cycles. XRD analysis was performed (Figs. 1 and2, SI1, SI2) at room temperature using a PANalytical XPert Pro diffractometer (CuKα radiation, λ = 0.15418 nm). X-ray diffraction measurements of θ-θ symmetrical scans were made over an angular range of 10-80°. The step size and the time per step were fixed at 0.01°a nd 20 s, respectively. The contribution from Kα 2 was removed and the X-ray diffractograms were recorded and studied using the PANalytical software. The instrumental function was determined using a reference material (SRM 660, lanthanum hexaboride, LaB 6 polycrystalline sample) and can be expressed by a polynomial function [START_REF] Beche | XPS unvestigation of (La 2 O 3 ) 1-x (CeO 2 ) 2x (ZrO 2 ) 2 compounds elaborated by solar energy[END_REF]. The synthesized oxide phases were corresponding to the structures of (i) a cubic spinel solution (Co 1-x Fe x ) 3 O 4 (Fig. 1) and (ii) a bixbyite solution (Mn 1-x Fe x ) 2 O 3 [START_REF] Lai | Mixed iron-manganese oxide nanoparticles[END_REF] (Fig. 2), with traces of iron oxide only detected for the materials containing the largest amount of iron (Figs. 1a andb, and2a). Above 20 mol% Fe added to Co 3 O 4 , the material is no longer a single spinel phase but a mixture of two spinels.

The morphology of the synthesized (Mn 1-x Fe x ) 2 O 3 phase was also characterized (Fig. SI3) by SEM (FESEM, HITACHI S4800). The very porous structure obtained with the Pechini method can be observed in Mn 2 O 3 samples synthesized with no iron (Fig. SI3a andb). The porous structure is still present with the addition of iron during the synthesis; however, the porosity reduces with increasing iron content. The sample with 10 mol% Fe (Fig. SI3c andd) still resembles the pure Mn 2 O 3 sample, while the sample with 50 mol% Fe appears different (Fig. SI3e andf), with thicker necks forming the pore walls. This change in morphology does not alter the reactivity, as evidenced in the experimental section.

Experimental procedure for thermochemical redox cycling

Experimental data concerning transition temperatures during redox process, oxygen storage capacity and reaction enthalpies were obtained by coupled thermogravimetric analysis (TGA) and differential scanning calorimetry (DSC), using a Netzsch STA 449 F3 System. About 50 mg of powder was placed into an alumina crucible and then subjected to simultaneous thermal analysis (STA) consisting of TGA coupled with DSC.

Reduction-oxidation cycles were performed in a 20% O 2 /Ar atmosphere (10 N mL/min O 2 and 40 N mL/min Ar), between 800 °C and 1050 °C for cobalt based oxides and between 750 °C and 1050 °C for manganese based oxides. Each run also included a last reduction step under Ar (99.999% purity), in order to get information about the reduction temperature of the material under inert atmosphere. The heating rate was 20 °C/min for the reduction step, and the cooling rate was 10 °C/min for the re-oxidation step. For some runs with cobalt based oxides, the temperature was maintained for 15 min at 1050 °C and at 800 °C for achieving the state of reaction equilibrium. For all the materials, a series of three cycles was performed for each studied formulation in order to determine their suitability for achieving reversible reactions and to assess a possible chemical deactivation of the materials as a result of a loss of redox stability during thermal treatment.

Thermodynamic calculations

Equilibrium calculations were performed with the FactSage 7.0 software [START_REF] Bale | FactSage thermochemical software and databases[END_REF] and the FToxid database, which includes models of the thermochemical properties of the oxide phases in Fe-Co-O [START_REF] Jung | Thermodynamic evaluation and modeling of the Fe-Co-O system[END_REF] and Fe-Mn-O [START_REF] Kang | Thermodynamic modeling of oxide phases in the Fe-Mn-O system[END_REF] systems. For calculations in the Fe-Co-O system, the following solid phases were considered: the Fe 2 O 3 compound, the cubic spinel solution (Co 1-x Fe x ) 3 O 4 (C-Spin) and the monoxide solution (Co 1-x Fe x )O 1+y (Monoxide). For the Fe-Mn-O systems, four phases were considered: two spinel solutions (Mn 1-x Fe x ) 3 O 4 , one with cubic structure (C-Spin) and the other with tetragonal structure (T-Spin), the bixbyite solution (Mn 1-x Fe x ) 2 O 3 (Bixb) and the corundum solution (Fe 1-x Mn x ) 2 O 3 (Cor). The monoxide and spinel solid solutions were described within the framework of the Compound Energy Formalism [START_REF] Hillert | The compound energy formalism[END_REF], with two and three ionic sublattices, respectively (see [START_REF] Jung | Thermodynamic evaluation and modeling of the Fe-Co-O system[END_REF][START_REF] Kang | Thermodynamic modeling of oxide phases in the Fe-Mn-O system[END_REF] for more details). The bixbyite and corundum phases were modelled as a random mixture of the two end-members (Fe 2 O 3 and Mn 2 O 3 ), with no interaction parameter [START_REF] Kang | Thermodynamic modeling of oxide phases in the Fe-Mn-O system[END_REF]. Two gaseous components, O 2 and Ar, were taken into account, with ideal mixing properties. The total pressure was always 1 atm.

For both systems, two kinds of calculations were carried out: (i) plot of phase diagrams, (ii) system equilibrium at various compositions and temperatures, providing, for each composition and at each temperature step, the phase assemblage and the cationic distribution in each solution phases, as well as the total enthalpy of the system.

The second type of calculations gives access to the theoretical mass loss (i.e. oxygen storage capacity), Δm, as defined by (Eq. ( 3)). This quantity is directly comparable to the mass change measured by TGA. m mass of solid at T mass of solid at T mass of solid at T ∆ (%) = 100.

-

max min min ( 3
)
where T min and T max are referring to the minimal and maximal temperature of the thermochemical cycle. The enthalpy of the reduction reaction (Eq. ( 1)), Δ r H, was calculated according to (Eq. ( 4)). This quantity is compared to the heat of reaction determined by DSC analysis. For reactions occurring on a large temperature range (see Section 3), this calculation includes a contribution due to the calorific capacity of the compounds (sensible heat), which leads to an overestimation of the enthalpy strictly related to the reaction.

H of s m m H T m H T m H T H T ∆ (kJ/kg ) = 1 [ ( )+ ( )+ ( )] - ( ) r s s s end s s end O O end s beg 0 2 2 0 1 1 2 2 0 ( 4
)
where T end is the temperature (°C) at the end of the phase transition or the maximal temperature of the cycle; T beg is the temperature (°C) at the beginning of the phase transition; m S 0 is the mass (kg) of the solid phase at T min ; m S 1 and m S 2 are the mass (kg) of the solid phases at T end ; m O2 is the mass (kg) of dioxygen at T end ; H x (T) is the enthalpy (kJ/kg) of the compound x at the temperature T.

Results and discussion

Cobalt-based mixed oxides

The calculated Co-Fe-O phase diagram for pO 2 = 0.20 atm is presented in Fig. 3a. It shows that, at equilibrium, the iron content greatly influences the composition and the amount of the monoxide phase formed at 1050 °C when heating the spinel phase from 800 °C. For small Fe additions (0 < x(Fe) < 0.1), the spinel phase is fully converted into the monoxide phase. At very high Fe content (x(Fe) > 0.6), there is no phase transition achievable below 1200 °C, which is the upper temperature limit usually considered for TES applications. For intermediate Fe content (0.1 < x(Fe) < 0.6), an increasing proportion of spinel phase is not converted into monoxide. As an example, Fig. 3b presents the influence of the temperature on the phases amount for x(Fe) = 0.25. A temperature of about 1460 °C is required to fully convert the spinel phase into the monoxide phase. Furthermore, as illustrated in Fig. 3c for x(Fe) = 0.25, the monoxide phase (Co 1-x Fe x )O 1+y presents a noticeable over-stoichiometry (y) in oxygen, which increases with temperature.

The TGAs of cobalt-based oxides are presented in Figs. 4 and5 with different temperature programs. A first observation is that a noticeable change in the re-oxidation onset temperature (Fig. SI4) is measured between the samples with 0-10 mol% Fe (Figs. 4b-c, 5c-e) and with 25-40 mol% Fe (Figs. 4a, 5a-b). Indeed, the re-oxidation step starts at the beginning of the temperature decrease (i.e. 1050 °C) for the samples containing 25 mol% Fe and 40 mol% Fe, which is in line with the phase diagram (Fig. 3a) since the two-phase equilibrium strongly depends on the temperature. The Co-Fe samples were kept in a reduced state after TGA (final cooling step in Ar to avoid re-oxidation in Fig. 5) and analysed via XRD (Fig. SI1). Phase identification confirmed the presence of the single monoxide phase for low Fe contents (0 and 5 mol %), whereas the samples consisted of a mixture of monoxide and spinel phases for higher Fe contents (10-40 mol%), in agreement with the calculated phase diagram.

The influence of Fe incorporation on reaction temperatures is reported in Fig. 6 (Fig. SI4 compares data under Ar and 20%O 2 /Ar atmosphere). Both temperatures at peak reaction rate (i.e. temperatures at which the reaction kinetics reached its maximum, Fig. 6) and onset temperatures (Fig. SI4) were measured. The measured onset temperature for reduction of Co 3 O 4 to CoO is about 920 °C, which is in good accordance with previous studies carried out in air atmosphere, reporting temperatures ranging from 880 to 930 °C [START_REF] Tescari | Thermochemical solar energy storage via redox oxides: materials and reactor/heat exchanger concepts[END_REF][START_REF] Karagiannakis | Monolithic ceramic redox materials for thermochemical heat storage applications in CSP plants[END_REF][START_REF] Pagkoura | Cobalt oxide based structured bodies as redox thermochemical heat storage medium for future CSP plants[END_REF][START_REF] Ehrhart | Thermochemical cycle of a mixed oxide for augmentation of thermal energy storage in solid particles[END_REF]. A gradual increase of the reduction and oxidation temperatures is observed with increasing amount of iron in the material, which is consistent with the phase diagram (Fig. 3a). An effect of Fe addition on the temperature gap between reduction and oxidation is also evi-denced. Indeed, as both temperatures rise with Fe addition, it can be noticed that the gap between the reduction and oxidation temperatures reduces. For 40 mol% Fe, the onset temperature for reduction has increased by 50 °C compared to pure Co 3 O 4 , while the onset temperature for oxidation has increased by 90 °C. The reduction of this temperature gap is an asset for large-scale applications since it reduces the amount of energy spent for the heating and cooling of the system between the charge and the discharge steps. However, an increase in the oxidation temperature may also be a disadvantage if the system must be externally heated to initiate the oxidation (in case the material is stored in reduced form at room temperature).

In Fig. 7 are reported, along with the calculated equilibrium values, the maximum values of Δm measured for each oxide composition, which means the highest amount of O 2 released during reduction, and the average Δm for the three redox cycles. The hypothetic case of a full conversion of the initial spinel into a stoichiometric monoxide, calculated according to (Eq. ( 5)), is also plotted in Fig. 7.

(Co Fe ) O = 3 (Co Fe )O + 0.5 O (g) x s x s 1- x 3 4( ) 1- x ( ) 2 (5)
Measurements of the Δm values clearly show that increasing the amount of iron in the material reduces the amount of O 2 it is able to release at a given temperature. Furthermore, the maximum Δm values are in excellent accordance with equilibrium calculations, which implies that a full conversion has been reached.

According to the thermodynamic model, the decrease in O 2 storage capacity with increasing Fe content is due to a combination of two factors. First, as evidenced by the phase diagram and the temperature profile for x(Fe) = 0.25 (Fig. 3b), the upper temperature limit of 1050 °C does not lead to a full conversion of the spinel phase when x(Fe) > 0.10. This contribution is represented as C1 in Fig. 7. It does not account for the decrease in Δm evidenced for x(Fe) = 0.05 and 0.10 (C2 in Fig. 7), which should be closer to the mass loss calculated according to (Eq. ( 5)) since a full conversion into monoxide occurs. This second factor is linked with the fact that the monoxide solid solution becomes non stoichiometric with the incorporation of Fe (Fig. 3c). This leads to a residual storage of oxygen in the monoxide phase, according to (Eq. ( 6)):

(Co Fe ) O = 3 (Co Fe )O + (1-3y)/2 O (g) x s x y s 1- x 3 4( ) 1- x 1+ ( ) 2 (6)
where y is the over-stoichiometry of oxygen in the monoxide phase.

As illustrated in Fig. 7, the calculated contribution of the oxygen over-stoichiometry in the monoxide phase at 1050 °C accounts for a loss of storage capacity of about 1% per unit mass of spinel when x(Fe) > 0.10, as compared to a maximum capacity of 6.6% for pure cobalt oxide.

As for the cycling stability, for pure Co 3 O 4 , the average Δm is the same as both the theoretical value and the maximum value measured experimentally. This means that the amount of O 2 released and regained did not change, confirming the good material cycling stability over three cycles, as already reported by several authors [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF][START_REF] Agrafiotis | Exploitation of thermochemical cycles based on solid oxide redox systems for thermochemical storage of solar heat. Part 2: redox oxide-coated porous ceramic structures as integrated thermochemical reactors/heat exchangers[END_REF][START_REF] Agrafiotis | Exploitation of thermochemical cycles based on solid oxide redox systems for thermochemical storage of solar heat. Part 3: cobalt oxide monolithic porous structures as integrated thermochemical reactors/heat exchanger[END_REF][START_REF] Neises | Solar-heated rotary kiln for thermochemical energy storage[END_REF][START_REF] Tescari | Thermochemical solar energy storage via redox oxides: materials and reactor/heat exchanger concepts[END_REF][START_REF] Karagiannakis | Monolithic ceramic redox materials for thermochemical heat storage applications in CSP plants[END_REF]. For the samples containing 5 and 10 mol% iron, since the average Δm falls slightly below the theoretical and maximum value, a minor loss in O 2 exchange capacity upon cycling is evidenced. Conversely, the amount of O 2 exchanged remains stable over cycles for larger Fe contents (x(Fe) > 0.10) at the expense of a decreased oxygen storage capacity. Thus, the cycling stability of cobalt oxide does not suffer from the addition of iron, as the re-oxidation conversion rate is not significantly decreasing over multiple cycles for Co-Fe mixed oxides, similarly to pure Co 3 O 4 . An additional cycling test was performed with a Co-Fe mixed oxide (10 mol% Fe) subjected to multiple consecutive cycles (12 cycles) in order to demonstrate the stability of the material regarding both oxygen storage capacities and energy storage densities (Fig. SI5). This confirms the robustness of the active redox materials and the ability to cycle without deactivation.

Regarding the effect of the gas flow composition, the measured Δm due to the reduction under pure Ar was not significantly different from the one measured with 20% O 2 /80% Ar. However, as illustrated by Fig. SI4, the reduction onset temperature under Ar was decreased by 60-80 °C, to reach a value of about 860 °C, almost independent of x(Fe). These data are rather different from the equilibrium state calculated with the thermodynamic model (Fig. SI6). Indeed, under pure Ar, the experimental oxygen partial pressure should be around 10 -5 atm (10 ppm O 2 ), which corresponds to a transition temperature of about 650-700 °C but it increases with a higher pO 2 . Furthermore, the calculated transition temperature depends noticeably on the composition of the system. It is thus concluded that, with a heating rate of 20 °C/min, the system does not reach equilibrium at low temperature, most likely because of solid-state diffusion limitations. Independently of the system composition, a minimum temperature threshold of about 850 °C is required to achieve the phase transition.

The effect of applying a higher temperature limit than 1050 °C was also estimated, both with experimental measurements and calculations. Cycles with a maximal temperature of 1150 °C were carried out on Co 3 O 4 with 5 mol% Fe (Fig. SI7). While this sample behaved well with a maximum temperature set at 1050 °C, the heating up to 1150 °C clearly affected its reactivity. Indeed, the sample did not regain the whole mass on cooling (67% average instead of 86% when heating at 1050 °C) and was sintered at the end of the run.

Furthermore, equilibrium calculations show that applying a temperature limit higher than 1050 °C will not increase drastically the oxygen storage capacity of mixed Co-Fe oxides, as illustrated by Fig. 8. Indeed, for Fe contents between 0% and 10%, the oxygen storage capacity is almost constant with temperature, because the nonstoichiometry of the monoxide is stable. For higher Fe contents (0.10 < x(Fe) < 0.40), a small increase of the storage capacity is evidenced at high temperature, due to a higher conversion rate of the spinel phase (Fig. 3b), but Fe addition is still detrimental for the total storage capacity.

As reported in Fig. 9, the measured reaction enthalpies are decreasing with increasing amount of Fe: the highest measured enthalpy is 597 kJ/kg for pure Co 3 O 4 , while the lowest is 50.7 kJ/kg for x(Fe) = 0.40. It should be noted that the DSC peaks for x(Fe) = 0.40 are very small, which makes them difficult to analyze. For pure Co 3 O 4 , our data is close to the value of 576 kJ/kg obtained by [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF] with a similar experimental procedure. As recently discussed in details by Block et al. [START_REF] Block | Metal oxides for thermochemical energy storage: a comparison of several metal oxide systems[END_REF], this kind of DSC measurements, operated in an open reactor at a rather fast heating rate, is not able to reproduce the tabulated enthalpy value, which is commonly reported as 844 kJ/kg [START_REF] Agrafiotis | Exploitation of thermochemical cycles based on solid oxide redox systems for thermochemical storage of solar heat. Part 2: redox oxide-coated porous ceramic structures as integrated thermochemical reactors/heat exchangers[END_REF][START_REF] Agrafiotis | Exploitation of thermochemical cycles based on solid oxide redox systems for thermochemical storage of solar heat. Part 3: cobalt oxide monolithic porous structures as integrated thermochemical reactors/heat exchanger[END_REF][START_REF] Neises | Solar-heated rotary kiln for thermochemical energy storage[END_REF][START_REF] Tescari | Thermochemical solar energy storage via redox oxides: materials and reactor/heat exchanger concepts[END_REF]. To explain the large discrepancy, the authors state that the contribution of a Co 3+ spin-state change, associated with an enthalpy of about 222 kJ/kg, is not measured by dynamic techniques.

The thermodynamic model used in this study [START_REF] Jung | Thermodynamic evaluation and modeling of the Fe-Co-O system[END_REF], which takes into account the heat capacity anomaly due to spin-state transition of Co 3+ , leads to an enthalpy of reaction of 749 kJ/kg for x(Fe) = 0. This is noticeably lower than the commonly admitted value of 827 kJ/mol [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF][START_REF] Block | Metal oxides for thermochemical energy storage: a comparison of several metal oxide systems[END_REF]. For higher Fe contents, the calculations reproduce well the general trend (decrease of Δ r H) with a systematic gap of about 180 kJ/ kg.

In TES application, the enthalpy of the reaction is related to the oxygen storage capacity of the material (the energy stored/released during the reduction/oxidation is related to the reaction extent that corresponds to the quantity of O 2 released/captured). As evidenced by measurements and calculations, the gravimetric energy storage density of mixed oxides is decreased when compared with pure Co 3 O 4 , resulting in less storage capacity per gram of material. This observation is in accordance with the work of Block et al. [START_REF] Block | The cobalt-oxide/iron-oxide binary system for use as high temperature thermochemical energy storage material[END_REF], who stated that both pure Co 3 O 4 and Fe 2 O 3 show higher enthalpies of reaction than any mixture of the two.

In summary, while the Co 3 O 4 /CoO redox pair shows very good cycling stability, the addition of iron is shown to slightly affect it and to decrease drastically the overall oxygen storage capacity. According to equilibrium calculations in the Co-Fe-O system, the addition of iron to Co 3 O 4 results in a lower amount of O 2 exchanged during cycles and a loss of the reduction reaction enthalpy, due to an incomplete conversion of the spinel phase at 1050 °C and to the formation of a nonstoichiometric monoxide. The addition of iron also increases the reduction and oxidation temperatures, while slightly decreasing the gap in temperature between the reduction and the oxidation step.

Manganese-based mixed oxides

The calculated Mn-Fe-O phase diagram is presented in Fig. 10, for pO 2 = 0.20 atm. Again, the expected behavior of the mixed oxides is strongly dependent on the system composition. At Fe contents above 50%, the requested temperature to reach a full conversion of the initial oxide into a spinel phase is above 1100 °C. At very low Fe contents (0 < x(Fe) < 0 .05), the stable phase at 1050 °C is the tetragonal spinel. For 0.05 < x(Fe) < 0.15, the transition of bixbyite to cubic spinel goes According to the model [START_REF] Kang | Thermodynamic modeling of oxide phases in the Fe-Mn-O system[END_REF], the non-stoichiometry of the oxide phases should not play a significant role regarding oxygen storage capacity. Indeed, the bixbyite phase (Mn 1-x Fe x ) 2 O 3 is considered as fully stoichiometric. For the spinel phases T-Spin and C-Spin, a cationic non-stoichiometry is considered in the model, with the presence of cationic vacancies. However, as shown in Fig. SI8, the vacancies concentration at 1050 °C is at the most 1.4×10 -4 mol per mol of Mn +Fe, which leads to a negligible impact on the oxygen storage capacity. In the composition range 0 < x(Fe) < 0.5 considered in this study, the redox cycle is thus represented by:

(Mn Fe ) O = 2/3 (Mn Fe ) O + 1/6 O (g) x s x s 1- x 2 3( ) 1- x 3 4( ) 2 (7)
At equilibrium, according to the model, the theoretical amount of O 2 exchanged between 750 °C and 1050 °C remains thus the same in the 0 < x(Fe) < 0.5 composition range.

The TGA, presented in Fig. 11, shows that the sample with the composition x(Fe) = 0.10 is unable to regain its full mass during oxidation, as the mass lost during the first reduction step is not recovered during the re-oxidation step, similarly to the case of pure Mn 2 O 3 (TGA shown in Fig. SI9). Conversely, the other compositions, from 15 mol% Fe to 50 mol% Fe, are regaining their lost mass in a complete reversible way. XRD analysis of Mn-Fe samples after TGA was performed (Fig. SI2). The XRD pattern of Mn 2 O 3 with 10 mol% Fe is identified as a mixture of tetragonal spinel structure and Fe 2 O 3 (Fig. SI2e), which confirms the poor re-oxidation yield of the cycled material. Conversely, the XRD pattern of Mn 2 O 3 with 20, 30, 40 and 50 mol% Fe after TGA is identified as (Mn 1-x Fe x ) 2 O 3 (Fig. SI2a-d) with Fe 2 O 3 visible on the sample with the highest amount of Fe added (Fig. SI2a), which denotes the complete re-oxidation of the samples after TGA. SEM characterization of the cycled materials compared with the fresh ones reveals sintering regardless of the amount of Fe (Fig. SI10), which does not alter the cycling ability of Mn-Fe mixed oxides. Sintering is thus not the cause of the reactivity loss in the case of pure Mn 2 O 3 and Mn 2 O 3 mixed with 10 mol% Fe.

Experimental and theoretical mass variations, Δm, were compared. As illustrated in Fig. 12a, all the samples feature the same Δm during the first reduction, in good accordance with the equilibrium calculations summarized by (Eq. ( 7)). However, pure Mn 2 O 3 shows cycling stability issues as already evidenced by [START_REF] Carrillo | Improving the thermochemical energy storage performance of the Mn2O3/Mn3O4 redox couple by the incorporation of iron[END_REF]. This phenomenon is reflected by the drop of the experimental Δm during 2nd and 3rd cycles, showing a decrease of redox activity with redox cycling. Similarly, Mn 2 O 3 mixed with 10 mol% Fe also loses cycling stability, regaining only 31% of its lost mass (Fig. 11f). From x(Fe) = 0.15 to 0.50, a great improvement is evidenced, since the experimental Δm value for each cycle remains close both to the maximum Δm value and to the equilibrium value, which denotes negligible deactivation during redox cycling. The addition of iron to Mn 2 O 3 thus increases the reoxidation yield of the material and enhances the cycling stability, as recently observed by Carrillo et al. [START_REF] Carrillo | Thermochemical heat storage based on the Mn 2 O 3 /Mn 3 O 4 redox couple: influence of the initial particle size on the morphological evolution and cyclability[END_REF].

Experimental measurements clearly indicate that the minimum Fe content necessary to improve the TES properties of mixed Mn-Fe oxides lies between 10 and 15 mol% Fe. The phase diagram indicates that this corresponds to the formation of the cubic spinel phase only, compared to lower Fe contents, where the tetragonal spinel cannot be reversibly oxidized during cooling. The addition of 20 mol% Fe in Mn 2 O 3 was previously mentioned as the optimal composition for obtaining the highest enthalpy and most stable re-oxidation yields [START_REF] Carrillo | Thermochemical heat storage based on the Mn 2 O 3 /Mn 3 O 4 redox couple: influence of the initial particle size on the morphological evolution and cyclability[END_REF]. However, the authors also obtained full conversion for all their tested samples regardless of the Fe content (especially below 10% Fe), which contrasts sharply with the results of the present study in which pure Mn 2 O 3 and Mn 2 O 3 sample with 10 mol% Fe were not able to fully recover the O 2 lost mass. More recently, an in-depth kinetic and mechanistic study focused on the 20 mol% Fe composition was carried out by the same group [START_REF] Carrillo | Understanding redox kinetics of iron-doped manganese oxides for high temperature thermochemical energy storage[END_REF]. It is stated that the cationic distribution in the spinel structures (cubic and tetragonal) might be sufficiently different to explain the strong variation in the kinetics of the oxidation reaction. The use of the thermodynamic model proposed by Kang and Jung [START_REF] Kang | Thermodynamic modeling of oxide phases in the Fe-Mn-O system[END_REF] brings support to this explanation. Indeed, as illustrated in Fig. 13a, the calculated cationic distribution evidences that the amount of Mn 2+ on octahedral sites of the spinel strongly increases in the cubic spinel. Furthermore, it has been shown that Mn 2+ on octahedral sites is easier to oxidize than Mn 2+ on tetragonal sites [START_REF] Agnoli | Manganites de Fer de Structure Spinelle Déformée à Très Fort Champ Coercitif. Exemple de l′Oxyde Lacunaire Mixte Mn1.7Fe1.3O4+δ[END_REF]. This difference might very well explain the reason why the cycling properties of the cubic spinel are much better than those of the tetragonal spinel.

Another difference between the two spinel structures is that, in the cubic spinel, a disproportionation reaction takes place according to Mn 3+ = 1/2 Mn 4+ + 1/2 Mn 2+ , as illustrated in Fig. 13b. The increased amount of Mn 2+ in the cubic spinel, which can be more easily oxidized than Mn 3+ thanks to the favored thermodynamic driving force, may also explain the enhanced re-oxidation ability of the cubic spinel. This result means that pure Mn 2 O 3 (that reduces into pure tetragonal spinel) and mixed Mn-Fe oxides with Fe content below 15% cannot be suitable candidates for achieving reversible reactions because of the poor re-oxidation ability of the tetragonal spinel formed upon reduction.

As for the influence of Fe incorporation in Mn 2 O 3 on the reaction temperatures, a similar tendency as with cobalt oxide is observed. The reduction and oxidation temperatures of Mn 2 O 3 softly increase with increasing amount of added iron (Fig. 12b). According to TGA, an increase of 60 °C is noted between the onset temperatures for reduction (Fig. SI11) of pure Mn 2 O 3 and Mn 2 O 3 with 50 mol% Fe. Concomitantly, a temperature increase of 160 °C is observed for oxidation of Mn 2 O 3 with 50 mol% Fe when compared to Mn 2 O 3 alone. This way, the reaction temperature can be tuned. On top of an increase of the reaction temperature, addition of iron also reduces the temperature gap between the reduction and the oxidation step. A temperature increase was also reported by [START_REF] Carrillo | Thermochemical heat storage based on the Mn 2 O 3 /Mn 3 O 4 redox couple: influence of the initial particle size on the morphological evolution and cyclability[END_REF], with 60 °C difference between 0 and 40 mol% Fe added for the reduction, and 236 °C for the oxidation.

Regarding the effect of the gaseous atmosphere composition, the experimental and theoretical Δm values for the reduction in pure Ar atmosphere were found stable with the addition of Fe to manganese oxide and similar to the Δm measured with 20% O 2 . Again, the reduction temperature increases with the O 2 partial pressure (Fig. SI11). The onset temperature for reduction under inert atmosphere rises with the amount of Fe added to manganese oxide, from about 800 °C for pure Mn 2 O 3 up to 903 °C for x(Fe) = 0.5 (Fig. SI11). As illustrated by the phase diagram (Fig. SI12) calculated at low pO 2 (10 -5 atm), decreasing the oxygen content results in enhancing the tetragonal spinel stability, which is likely to be detrimental to the cycling stability of the materials.

As for the energy storage density, the measured enthalpy for the first reduction step with full conversion of pure Mn 2 O 3 (148 kJ/kg) is smaller than theoretical estimations of 190.1 kJ/kg at turning temperature (ΔG°= 0) of 915 °C [START_REF] André | Screening of thermochemical systems based on solid-gas reversible reactions for high temperature solar thermal energy storage[END_REF]. An average of 187.7 kJ/kg is measured for the samples with compositions between 20 and 50 mol% Fe. Increasing the amount of Fe thus slightly improves the energy storage capacity of the material at low Fe contents while it remains unchanged above ~20 mol% Fe (Fig. 9). Accordingly, the thermodynamic calculations indicate that an increase of Δ r H is expected when the Fe content increases from 0 mol% (207 kJ/kg) to 20 mol% (300 kJ/ kg), and is stable for higher Fe contents.

In summary, the addition of iron to manganese oxide enhances considerably the cycling stability of the material by improving the reoxidation yield thanks to the formation of a reactive cubic spinel phase. Also, the higher the amount of Fe added to Mn 2 O 3 , the higher the reaction temperatures. In addition, the gap in temperature between the reduction and the oxidation decreases with higher iron content. The low re-oxidation yield observed for pure Mn 2 O 3 and Mn 2 O 3 with 10 mol% Fe is attributed to the low reactivity of the tetragonal spinel phase. The addition of Fe to Mn 2 O 3 becomes effective for the enhancement of the cycling stability above ~15 mol% Fe, with the suppression of any transition involving this tetragonal spinel phase. The markedly improved reactivity of the cubic spinel featuring reversible reactions is attributed to the increased amount of Mn 2+ cations (resulting from Mn 3+ disproportionation) on octahedral sites of the spinel.

Conclusion

The effect of Fe addition in Co and Mn-based oxides was studied experimentally and results were compared with thermodynamic calculations. The calculations were shown to be pertinent since equilibrium is reached at least on the first reduction step of all materials considered in this study. The addition of Fe to Mn 2 O 3 was shown to be beneficial to tune the temperature of redox reactions, to reduce the gap in temperature hysteresis between the reduction and the oxidation step, as well as to enhance the re-oxidation kinetics and cycling stability of the material by countering the deactivation issue of Mn 2 O 3 . Furthermore, a Fe content of ~15 mol% added to Mn 2 O 3 was identified as a minimum threshold for avoiding the formation of a low reactive Mn 3 O 4 tetragonal spinel phase during reduction, which is detrimental to the reaction reversibility because of poor oxidation rate and yield. Noticeably, the Mn 2 O 3 compounds with Fe content in the range 15-50 mol% could be cycled between bixbyite and cubic spinel phases without any reactivity losses during redox reactions. Conversely, the incorporation of Fe to Co 3 O 4 shows adverse effect on the redox performances since both the maximum amount of O 2 exchanged and the reaction enthalpy are lowered when the amount of iron added is increased. The increasing amount of iron added to Co 3 O 4 reduces the maximum oxygen exchange capacity during a redox cycle. The addition of iron to Co and Mn-based oxides also results in an increase of the reaction temperatures, while slightly lowering the gap in temperature between the reduction and oxidation step, which thereby reduces the sensible energy losses during the heating and cooling stages. The comparison of the obtained experimental data with thermodynamic modelling proves that equilibrium calculations bring a strong support for predicting the behavior of mixed oxides since it results in consistent

Fig. 1 .

 1 Fig. 1. XRD analysis of fresh synthetic Co 3 O 4 with (a) 40 mol% Fe, (b) 25 mol% Fe, (c) 10 mol% Fe, and (d) 5 mol% Fe.

Fig. 2 .

 2 Fig. 2. XRD analysis of fresh synthetic Mn 2 O 3 with (a) 50 mol% Fe, (b) 40 mol% Fe, (c) 30 mol% Fe, (d) 20 mol% Fe, and (e) 10 mol% Fe.

Fig. 3 .

 3 Fig. 3. (a) Calculated Co-Fe-O phase diagram at pO 2 = 0.20 atm, (b) calculated temperature evolution of the mass of solid phases for x(Fe) = 0.25, (c) calculated temperature evolution of oxygen over-stoichiometry (y) in the monoxide phase (Co 0.75 Fe 0.25 )O 1+y .

Fig. 4 .

 4 Fig. 4. TGA of Co 3 O 4 /CoO with addition of (a) 25 mol% Fe, (b) 10 mol% Fe, (c) 5 mol% Fe, including a final re-oxidation step under 20% O 2 /Ar at the end.

Fig. 5 .

 5 Fig. 5. TGA of Co 3 O 4 /CoO with addition of (a) 40 mol% Fe, (b) 25 mol% Fe, (c) 10 mol% Fe, (d) 5 mol% Fe, (e) no Fe added, ending on a final reduction step under Ar.

Fig. 6 .

 6 Fig. 6. Experimental temperatures at peak reaction rate for cobalt-based oxides in 20% O 2 /Ar and comparison with the calculated temperature of the C-Spin/Monoxide transition.

Fig. 7 .

 7 Fig. 7. Average and maximal experimental mass loss (Δm in %) of the Co-Fe mixed oxide between 800 °C and 1050 °C compared to Δm at thermodynamic equilibrium.

Fig. 8 .

 8 Fig. 8. Temperature evolution of the amount (kg) of O 2 (g) released per kg of cobaltbased spinel containing various amounts of Fe.

Fig. 9 .

 9 Fig. 9. Experimental and calculated enthalpies of reaction for the Co-Fe and Mn-Fe mixed oxides. Fig. 10. Calculated Mn-Fe-O phase diagram at pO 2 = 0.20 atm.

Fig. 11 .

 11 Fig. 11. TGA of Mn 2 O 3 /Mn 3 O 4 with addition of (a) 50 mol% Fe, (b) 40 mol% Fe, (c) 30 mol% Fe, (d) 20 mol% Fe, (e) 15 mol% Fe, and (f) 10 mol% Fe.

Fig. 12 .

 12 Fig. 12. (a) Evolution of experimental Δm (%) during reduction compared to theoretical Δm (pO 2 = 0.20 atm), (b) Experimental temperatures at peak reaction rate for manganese-based oxides in 20% O 2 /Ar and comparison with the calculated temperature of the Bixb/Spinel transition.

Fig. 13 .

 13 Fig. 13. (a) Evolution of the amount of Mn 2+ on octahedral sites of the spinel phases with Fe content, at 1050 °C. (b) Evolution of the oxidation number of Mn cations in the spinel phases with Fe content, at 1050 °C.

Acknowledgments

This study was performed in the framework of the STAGE-STE European Project (FP7, Project no. 609837). Philippe Tailhades is warmly thanked for the fruitful discussion on spinel properties.

phase transition temperatures and reliable oxygen storage capacities. It further provided new physical insights into the role of Fe incorporation on the oxidation improvement of Co and Mn-based oxides related to the crystallographic transformations that take place during such redox process depending on Fe content. With the development of new models covering large multi-components systems, it could be further used for selecting other transition metals to enhance the properties of mixed metal oxides for thermochemical energy storage application.

Appendix A. Supplementary material

Supplementary data associated with this article can be found in the online version at doi:10.1016/j.jssc.2017.05.015.


Konstantinos Chatzikokolakis

On the Additive Capacity Problem for Quantitative Information Flow

Keywords: Quantitative information flow, capacity, Kantorovich distance

.

Introduction

Preventing sensitive information from being leaked is a fundamental goal of computer security. There are many situations, however, in which completely eliminating such leaks is impossible for a variety of reasons. Sometimes the leak is intentional: we want to extract knowledge from a statistical database; sometimes it is due to side channels that are hard or impossible to fully control; sometimes the leak is in exchange to a service, as in the case of Location-Based Services; sometimes it is in exchange for efficiency: i.e. using a weaker but more efficient anonymous communication system.

In these cases, it becomes crucial to quantify such leaks, measure how important the threat they pose is and decide whether they can be tolerated or not. This problem is studied in the area of quantitative information flow, in which much progress has been done in recent years, both from a foundational viewpoint [START_REF] Köpf | An information-theoretic model for adaptive side-channel attacks[END_REF][START_REF] Malacaria | Assessing security threats of looping constructs[END_REF][START_REF] Chatzikokolakis | On the Bayes risk in information-hiding protocols[END_REF][START_REF] Smith | On the foundations of quantitative information flow[END_REF][START_REF] Mciver | Compositional closure for Bayes risk in probabilistic noninterference[END_REF][START_REF] Clarkson | Quantification of integrity[END_REF][START_REF] Barthe | Information-theoretic bounds for differentially private mechanisms[END_REF][START_REF] Alvim | Measuring information leakage using generalized gain functions[END_REF], but also in the development of counter-measures and verification techniques [START_REF] Antonopoulos | Decomposition instead of self-composition for proving the absence of timing channels[END_REF][START_REF] Backes | Automatic discovery and quantification of information leaks[END_REF][START_REF] Chatzikokolakis | Statistical measurement of information leakage[END_REF][START_REF] Köpf | Approximation and randomization for quantitative informationflow analysis[END_REF][START_REF] Yasuoka | Quantitative information flow -verification hardness and possibilities[END_REF][START_REF] Meng | Calculating bounds on information leakage using two-bit patterns[END_REF][START_REF] Khouzani | Relative perfect secrecy: Universally optimal strategies and channel design[END_REF][START_REF] Biondi | Quail: A quantitative security analyzer for imperative code[END_REF][START_REF] Biondi | Hyleak: Hybrid analysis tool for information leakage[END_REF][START_REF] Sweet | What's the over/under? probabilistic bounds on information leakage[END_REF], and the analysis of real systems [START_REF] Doychev | Rigorous analysis of software countermeasures against cache attacks[END_REF][START_REF] Köpf | Vulnerability bounds and leakage resilience of blinded cryptography under timing attacks[END_REF][START_REF] Heusser | Quantifying information leaks in software[END_REF][START_REF] Köpf | Automatic quantification of cache side-channels[END_REF].

Robustness is a fundamental theme in this area; we aim at developing measures and bounds that are robust wrt a variety of adversaries and operational scenarios. In the context of the successful g-leakage model, the operational scenario is captured by a gain function g, and the adversary's knowledge by a prior π. Developing the theme of robustness in this model, [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF] studied the theory of channel capacity, that is the problem of maximizing leakage over π for a fixed g, maximizing over g for a fixed π, or maximizing over both π and g. Comparing the system's prior and posterior vulnerability can be done either multiplicatively or additively, leading to a total of six capacity scenarios.

In this paper we make substantial progress in two of the scenarios for additive leakage, namely in maximizing over g alone, or over both π, g. When maximizing over g, we quickly realize that if we allow vulnerability to take values in the whole R ≥0 , we can always scale it up, leading to unbounded capacity. In practice, however, it is common to measure vulnerability within a predefined range; for instance, vulnerabilities capturing the probability of some unfortunate event (e.g. Bayes vulnerability) take values in [0, 1], while vulnerabilities measuring bits of information (e.g. Shannon vulnerability) take values in [0, log 2 |X |]. It is thus natural to restrict to a class G of gain functions, in which the range of vulnerabilities is limited. In [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF], this is achieved by the class G 1 X of 1-spanning gain functions, in which the gain of different secrets varies by at most 1.

Although G 1 X provides a solution for capacity, this choice is not completely satisfactory from the point of view of robustness, since it excludes important vulnerability functions. Most notably, Shannon vulnerability (the complement of entropy) is not kspanning for any k, hence the capacity bound for G 1 X does not apply, and indeed the leakage in this case (known as mutual information) does exceed the bound. In this paper we take a more permissive approach, by imposing the 1-spanning condition not on g itself, but on the corresponding vulnerability function V g , leading to the class G X . Since any vulnerability is k-spanning for some k, this class does not a priori exclude any type of adversary, it only restricts the range of values.

Solving the capacity problem for G X is however not straightforward. It turns out that the core technique from [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF], namely the use of the Kantorovich distance on the hyper-distribution produced by the channel, can still be applied. However, substantial modifications are needed, involving the use of quasimetrics, and in particular the novel "convex-separation" quasimetric, replacing the total variation used in [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF]. These improvements not only lead to a solution to the problem of maximizing leakage over g : G X , but also lead to a solution for the third scenario of maximizing over both π, g, as well as to a variant of the "Miracle" theorem for the additive setting.

In detail, the paper makes the following contributions to the study of g-capacity:

-We present a general technique for computing additive capacity wrt a class of gain functions G, using the Kantorovich distance over a properly constructed quasimetric. -This technique is instantiated for G 1 X using the total variation metric, recovering the results of [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF] in a more structured way. -The same technique is then instantiated for the larger class G X , using the novel "convex-separation" quasimetric for which an efficient solution is provided. -The results for G X also provide an immediate solution to the scenario of maximizing over both π, g, which was left completely open in [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF]. -Finally, the results for G X lead to an "Additive Miracle" theorem, similar in nature to the "Miracle" theorem of [START_REF] Alvim | Measuring information leakage using generalized gain functions[END_REF] for the multiplicative case.

π 1 /3 1 /3 1 /3 C y1 y2 y3 y4 x1 1 0 0 0 x2 0 1 /2 1 /4 1 /4 x3 1 /2 1 /3 1 /6 0 -→ J y1 y2 y3 y4 x1 1 /3 0 0 0 x2 0 1 /6 1 /12 1 /12 x3 1 /6 1 /9 1 /18 0 -→ [πŻC] 1 /2 5 /12 1 /12 x1 2 /3 0 0 x2 0 3 /5 1 x3 1 /3 2 /5 0

Preliminaries

Channels and their effect on the adversary's knowledge A channel C is a simple probabilistic model describing the behavior of a system that takes input values from a finite set X (the secrets) and produces outputs from a finite set Y (the observations). Formally, it is a stochastic |X | × |Y| matrix, meaning that elements are non-negative and rows sum to 1. C x,y can be thought of as the conditional probability of producing y when the input is x.

We denote by DA the set of all discrete distributions on A, and by [a]: DA the point distribution, assigning probability 1 to a: A. Given C and a distribution π: DX , called the prior, we can create a joint distribution J: D(X × Y) as J x,y = π x C x,y . When J is understood, it is often written in the usual notation p(x, y), in which case the conditional probabilities p(y|x) = p(x,y) /p(x) coincide with C x,y (when p(x) is non-zero) and the x-marginals p(x) = y p(x, y) coincide with π x .

The prior π can be thought of as the initial knowledge that the adversary has about the secret. When secrets are passwords, for instance, she might know that some are more likely to be chosen than others. Always assuming that C is known to the adversary, each output y provides evidence that allows her to update her knowledge, creating a posterior distribution δ y , defined as δ y x = p(x,y) /p(y). This, of course, can be done for each output; every y: Y potentially provides information to the adversary leading to an updated probabilistic knowledge δ y . But not all outputs have the same status; each happens with a different marginal probability p(y) = x p(x, y), denoted by a y .

Hence, the effect of a channel C to the adversary's prior knowledge π, is to produce a set of posteriors δ y , each with probability a y . It is conceptually useful to view this outcome as a single distribution on distributions, called a hyper-distribution or just hyper. Such a hyper has type D 2 X and is denoted by [πŻC] = y a y [δ y ].1 The a y -component of [πŻC] is called the outer distribution, expressing the probability of obtaining the posteriors δ y , called the inner distributions.

An example of all constructions is given in Fig. 1. From a channel C and the uniform prior π we can construct the joint J by multiplying (element-wise) each column of C by π. J is then a single distribution assigning probabilities to each pair (x, y). To construct the hyper [πŻC], we normalize (i.e. divide by p(y)) each column J -,y , forming the posterior δ y . The marginals p(y) become the outer probabilities a y , labeling the columns of [πŻC]. Finally, note that [πŻC] no longer records the original label y of each column. As a consequence, the columns y 2 and y 3 , both producing the same posterior δ y2 = δ y3 = (0, 3 /5, 2 /5), are merged in [πŻC], which assigns to that posterior the combined probability p(y 2 ) + p(y 3 ) = 5 /12. This phenomenon happens automatically by the construction of the hyper.

Vulnerability and leakage A fundamental notion in measuring the information leakage of a system is that of a vulnerability function V : DX → R ≥0 . The goal of V (π) is to measure how vulnerable a system is when the adversary has knowledge π about the secret. To create a suitable vulnerability function we need to consider the operational scenario at hand: we first determine what the adversary is trying to achieve, then take V (π) as a measure of how successful the adversary is in that goal. Clearly, no single function can capture all operational scenarios; as a consequence a variety of vulnerability functions has been proposed in the literature, each having a different operational interpretation.

For instance, Bayes-vulnerability V B (π):= max x π x measures the probability of success of an adversary who tries to guess the complete secret in one try; Shannonvulnerability V H (π):= log 2 |X |+ x π x log 2 π x (the complement of entropy) measures the expected number of Boolean questions needed to reveal the secret; and Guessingvulnerability V G (π) = |X |+1 /2i iπ i (where the i-indexing of X is in non-decreasing probability order) measures the expected numbers of tries to guess the secret correctly.

To study vulnerability in a unifying way, the g-leakage framework was introduced in [START_REF] Alvim | Measuring information leakage using generalized gain functions[END_REF], in which the operating scenario is parametrized by a (possibly infinite) set of actions W, and a gain function g: W × X → R. Intuitively, W consists of actions that the adversary can perform to exploit his knowledge about the system. Then, g(w, x) models the adversary's reward when he performs the action w and the actual secret is x.

In such an operational scenario, it is natural to define g-vulnerability V g as the expected gain of a rational adversary who chooses the best available action:

V g (π) := sup w x π x g(w, x) .

The g-leakage framework is quite expressive, allowing to obtain a variety of vulnerability functions as special cases for suitable choices of g. For instance, by picking W = X and the identity gain function given by g id (w, x) = 1 iff w = x and 0 otherwise, we get V gid = V B . Similarly, we can construct gain functions expressing Shannon (for which an infinite W is needed) and Guessing vulnerabilities, as well as a variety of other operational scenarios. In fact, it can be shown that any continuous and convex vulnerability V : DX → R ≥0 can be written as V g for some g [START_REF] Alvim | Axioms for information leakage[END_REF].

For expressiveness, it is crucial to allow g to potentially take negative values, and W to be infinite. However, it is desirable that V g itself be non-negative and finite-valued, since it is meant to express vulnerability. As a consequence we always restrict to the class of GX of gain functions, defined as those such that V g : DX → R ≥0 . As already discussed in the introduction, it is often desirable to further restrict to subsets of GX .

Having established a way to measure vulnerability in the prior case, we move on to measuring how vulnerable our system is after observing the output of a channel C. Viewing the outcome of C on π as the hyper [πŻC], there is a natural answer: we can measure the vulnerability of each posterior (inner) distribution of [πŻC], then average by the outer probabilities, leading to the following definition of posterior g-vulnerability:

V g [πŻC] := y a y V g (δ y ) where [πŻC] = y a y [δ y ]
Finally, information leakage is measured by comparing the vulnerability in the prior and posterior case. Depending on how we compare the two vulnerabilities, this leads to the additive or multiplicative leakage, defined as:

L + g (π, C) := V g [πŻC] -V g (π) , L × g (π, C) := V g [πŻC] V g (π)
.

Additive g-capacities A fundamental theme when measuring information leakage is robustness; we need bounds that are robust wrt a variety of different adversaries and operational scenarios. Following this theme, since the g-leakage of a channel C depends on both the prior π and the gain function g, it is natural to ask what is the maximum leakage of C, over a class of gain functions G ⊆ GX and a class of priors D ⊆ DX . This maximum leakage is known as the capacity of C.

Definition 1. The additive (G, D)-capacity of C, for G ⊆ GX , D ⊆ DX , is ML + G (D, C) := sup g: G,π: D L + g (π, C) .
For brevity, when maximizing only over π for a fixed g, we write

ML + g (D, C) instead of ML + {g} (D, C); similarly, when π is fixed we write ML + G (π, C); for specific classes, say G = GX , D = DX , we write ML + G (D, C) instead of ML + GX (DX , C).
We can maximize over π, or g, or both, getting three scenarios for additive capacity. The multiplicative capacity ML × G (D, C), defined similarly, is outside the scope of this paper; the corresponding three scenarios are studied in [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF].

For the first scenario, g is fixed and we maximize over the whole DX . For some gain functions an efficient solution exists; for instance, for g H giving Shannon vulnerability, ML + g H (D, C) is the Shannon capacity (maximum transmission rate)2 which can be computed using the well-known Blahut-Arimoto algorithm [START_REF] Cover | Elements of Information Theory[END_REF]. However, for g id (giving Bayes vulnerability), bounding ML + gid (D, C) is known to be NP-complete [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF], which of course leaves no hope for a general solution.

The second scenario (fixed π, maximize over g) is the main focus of this paper and is studied in detail in §3. Our solution turns out to also provide an answer for the third scenario (maximize over both π, g), discussed in §3.5.

Computing additive capacities

In this section we study the problem of computing the additive (G, π)-capacity. We quickly realize, however, that the unrestricted maximization over the whole GX yields unbounded leakage. The problem is the unbounded range of V g , and can be illustrated by "scaling" g. Define the scaling of g by k>0 as g ×k (w, x) = k • g(w, x). It is easy to show [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF] that this operation gives leakage

L + g ×k (π, C) = k • L + g (π, C
), and since k can be arbitrary we get that ML + G (π, C) = +∞.3

There are important classes of gain functions, however, which effectively limit the range of V g , causing the additive leakage to remain bounded. Even when ML + G (π, C) is finite, computing it efficiently is non-trivial. A solution can be obtained by exploiting the fact that ML + G (π, C) is connected to the well-known Kantorovich distance between [π] and [πŻC].

This section proceeds as follows. In §3.1 we recall the Kantorovich distance and then use it in §3.2 to obtain a generic technique for computing ML + G (π, C), in time linear on the size of C, using properties of G. We apply these bounds to obtain efficient solutions for the class G 1 X of 1-spanning gain functions in §3.3, as well as the class G X of gain functions giving 1-spanning vulnerability in §3.4. Finally, §3.5 discusses the scenario of maximizing over both π and g.

The Kantorovich and Wasserstein distances

We begin by recalling the Kantorovich distance between probability distributions. Given α: DA and random variable F : A→R we write E α F for the expected value of F over α, or E x∼α F (x) to make precise the variable we are averaging over. Observe that for a point distribution centered at a ∈ A we have

E [a] F = F (a). A function d : A 2 → R is called a quasimetric iff it satisfies the triangle inequality and d(a, a ) = 0 ∧ d(a , a) = 0 iff a = a . If d is also symmetric it is called a metric.
The set of all quasimetrics on A is denoted by MA. Although less frequently used than metrics, quasimetrics will play an important role in computing additive capacity in §3. [START_REF] Antonopoulos | Decomposition instead of self-composition for proving the absence of timing channels[END_REF].

A natural quasimetric on R is given by d < R (x, y) := max{y -x, 0} . Intuitively, d < R (x, y) measures "how much smaller" than y is x; 0 means that x is no smaller than y. This quasimetric can be extended to x, y ∈ R n as d < R n (x, y) = i d < R (x i , y i ), giving an "asymmetric Manhattan" distance.

A function

F : A→R is called d, d T -Lipschitz iff d T (F (a), F (a )) ≤ d(a, a ) for all a, a ∈ A . (1)
The set of all such functions (also called contractions) is denoted by C d,d T A. For the source metric, a scaled distance k • d (for some k ≥ 0) is often used. For the target metric d T the Euclidean distance d R is commonly employed (in which case we might simply write d-Lipschitz for brevity). In this section, however, we consider functions that are

d, d < R -Lipschitz, which holds iff F (a ) -F (a) ≤ d(a, a ) for all a, a ∈ A . (2)
Note that the max from the definition of d < R is not needed, since d(a, a ) is non-negative. The Kantorovich construction allows us to lift a metric d on A to a metric on probability distributions over A. The standard construction is done by maximizing |E α F -E α F | over all functions that are d, d R -Lipschitz. Note that the Euclidean distance is implicitly used twice in this construction: first, in the Lipschitz condition and second, for comparing E α F and E α F . We can, however, define variants of the Kantorovich by using any other distance on R. Our purpose is to work with quasimetrics, hence we employ d < R , leading to the following definition.

Definition 2. The Kantorovich quasimetric is the mapping K < : MA → MDA:

K < (d)(α, α ) := sup F : C d,d < R A d < R (E α F, E α F ) = sup F : C d,d < R A E α F -E α F .
Note that that max was again dropped from d < R , since the sup is anyway non-negative (E α F -E α F = 0 for F constant).

An important property of the Kantorovich distance is that it has a dual formulation as the Wasserstein (or "earth-moving") metric, for which efficient algorithms exist. Earth moving measures measuring the cost of transforming one distribution into another, using the underlying distance d as the cost function. Given two distributions α, α : DA (the "source" and "target"), an earth-moving strategy is a joint distribution S ∈ DA 2 whose two marginals are α and α . We write S α,α for the set of such strategies. The Wasserstein distance is then defined as the minimum transportation cost; similarly to Kantorovich, it provides a lifting from MA to MDA. Definition 3. The Wasserstein distance is the mapping W : MA → MDA given by:

W(d)(α, α ) := inf S: S α,α E S d .
The well-known Kantorovich-Rubinstein theorem [START_REF] Villani | Topics in optimal transportation[END_REF] states that, if (d, A) is a separable metric space then K(d) = W(d). For our purposes, we will use this result in the restricted case where one of the two distributions is a point distribution [a]. This restriction is useful for two reasons: first, it allows us to give a simplified proof, adjusted to our K < variant, drop the assumption of separability and allow d to be a quasimetric. Second, we show that that W(d)([a], α) can be easily obtained as the expected (wrt α) distance between a and the elements in the support of α.

We first fix some notation: given d ∈ MA and a ∈ A, we denote by d a : A → R the function "currying" a, defined by d a (x) = d(a, x). Note that d a is d, d < R -Lipschitz since d a (y) -d a (x) = d(a, y) -d(a, x) ≤ d(x, y) follows from the triangle inequality. We are now ready to state the result relating the two distances.

Theorem 1. Let d ∈ MA be any quasimetric. For all [a], α ∈ DA it holds that

K < (d)([a], α) = W(d)([a], α) = E α d a .
Proof. We start with the Wasserstein distance. The crucial observation is that for point [a], there is informally a single source "pile of earth": all the probability has to come from a. As a consequence, S [a],α contains a unique strategy S x,y = [a] x • α y with independent marginals [a] and α. We can then calculate

W(d)([a], α) = inf S: S [a],α E S d "definition of W" = E (x,y)∼S d(x, y)
"take unique S with independent marginals [a], α"

= E y∼α E x∈[a] d(x, y) "independence of marginals" = E y∼α d(a, y) "expectation over point distribution" = E α d a
For the Kantorovich distance, we bound it from above by E α d a , as follows:

K < (d)([a], α) = sup F : C d,d < R A E α F -E [a] F "definition of K < " = sup F : C d,d < R A E α F -F (a)
"expectation over point distribution"

= sup F : C d,d < R A E x∼α (F (x) -F (a)) ≤ sup F : C d,d < R A E x∼α d(a, x) "(2), F is d, d < R -Lipschitz" = E α d a
Finally we bound K < (d)([a], α) from below by E α d a , as follows:

K < (d)([a], α) = sup F : C d,d < R A E α F -E [a] F "definition of K < " ≥ E α d a -E [a] d a "da ∈ C d,d < R A" = E α d a "E [a] da = da(a) = 0"

Computing additive (G, π)-capacity

We now discuss a generic technique for computing the additive (G, π)-capacity, for a given family of gain functions G ⊆ GX , using the Kantorovich distance. Recall that ML + G (π, C) (Def. 1) is defined as the maximum difference between the posterior and prior vulnerabilities V g [πŻC], V g [π]. The latter are simply the expected value of V g over the distributions [π], [πŻC], which are hyper distributions, having sample space DX .

We start by taking A = DX as the underlying space of the Kantorovich construction. A quasimetric d ∈ MDX measures the distance between two distributions on secrets.

The key for bounding ML + G (π, C) from above is to find such a quasimetric d wrt which V g is Lipschitz for all g ∈ G. Since the Kantorovich distance maximizes E α F -E α F over all Lipschitz functions F , it will provide an upper bound to the additive capacity.

Bounding the capacity from below is also possible if there exists some g ∈ G such that d π = V g . This is due to the fact that the g-leakage for this g is exactly E [πŻC] d π .

In the following, given a class of gain function G ⊆ GX , we denote by V G = {V g | g ∈ G} the set of g-vulnerabilities induced by G. The bounding technique is formalized in the following result.

d π ∈ V G implies ML + G (π, C) ≥ k , and (3)
C d,d < R DX ⊇ V G implies ML + G (π, C) ≤ k , ( 4
)
where

k = K < (d)([π], [πŻC]) = W(d)([π], [πŻC]) = E [πŻC] d π .
Proof. The fact that

K < (d)([π], [πŻC]) = W(d)([π], [πŻC]) = E [πŻC] d π comes from Thm. 1, for A = DX , a = π, α = [πŻC]. We start with (3): for V g = d π we have that V g (π) = 0 and V g [πŻC] = E [πŻC] d π hence ML + G (π, C) ≥ L + g (π, C) = E [πŻC] d π . For (4) we have that ML + G (π, C) = sup Vg: V G E [πŻC] V g -E [π] V g "definition" ≤ sup F : C d,d < R DX E [πŻC] F -E [π] F "sup over larger class" = K < (d)([π], [πŻC])
"definition" So far we have considered an unknown quasimetric d on probability distributions, and identified in Thm. 2 two properties of d that provide bounds for additive leakage. It is not clear, however, whether such a quasimetric exists and what is its relationship with the class G. We now show that the choice of d is in fact canonical for each class. More precisely, for any G we can construct a quasimetric d < G satisfying the second condition of Thm. 2. Furthermore, if a quasimetric d satisfying both conditions (for any π) does exist, then it is unique and equal to d < G .

Theorem 3. Let G ⊆ GX and define a quasimetric d < G : MDX as

d < G (π, σ) := sup g∈G d < R (V g (π), V g (σ)) . Then V G ⊆ C d < G ,d < R DX . Moreover, if {d π | π: DX } ⊆ V G ⊆ C d,d < R DX holds for some quasimetric d, then d = d < G .
Proof. Let g ∈ G. We trivially have that

d < R (V g (π), V g (σ)) ≤ sup g∈G d < R (V g (π), V g (σ)) = d < G (π, σ) , hence V g is d < G , d < R -Lipschitz. Now let d: MDX such that {d π | π: DX } ⊆ V G ⊆ C d,d < R DX and let π, σ: DX . From d π ∈ V G , we get that d(π, σ) = d < R (d π (π), d π (σ)) ≤ sup g∈G d < R (V g (π), V g (σ)) = d < G (π, σ) .
Then, since V g is d, d < R -Lipschitz for all g ∈ G, we get that

d < G (π, σ) = sup g∈G d < R (V g (π), V g (σ)) ≤ sup

Additive capacity for 1-spanning gain functions

We are now ready to provide a complete method for computing additive capacity for an important family of gain functions. The span of a function f : A→R is defined as

f := sup a,a ∈A |f (a) -f (a )| ,
while for gain functions (having two arguments) we define g := sup w∈W g(w, •) . Since scaling g causes unbounded leakage, a natural solution is to limit the range of g. This can be done in an elegant way, without completely fixing g's range, by requiring that g ≤ 1, which brings us to the class G 1 X of 1-spanning gain functions, the topic of study in this section. In the following we see that this restriction in fact limits the steepness of V g .

Note that any result for G 1 X can be straightforwardly extended to k-spanning gain functions, since

L + g ×k (π, C) = k • L + g (π, C) implies that the k-spanning additive capacity is simply k • ML + G 1 (π, C
). Note also that this class is quite large: any g with a finite number of actions has finite span. For an infinite number of actions, however, it is possible that g = +∞, i.e. that g is not k-spanning for any k; important functions such as Shannon vulnerability fall in this category. In §3.4 we enlarge our class of gain functions to include such cases.

Total variation, steepness and g's span

To apply the bounding technique of §3.2 to G 1 X we need a (quasi)metric d ∈ MDX with respect to which V g is Lipschitz when g is 1-spanning. Conveniently, this is the case of the well-known total variation distance:

tv(π, π ) := sup X⊆X |π(X) -π (X)| .
For discrete distributions, expressed as vectors, the total variation is equal to d < R n (π, π ), which is in fact symmetric when restricted to probability distributions (because the elements sum up to 1), and equal to 1 /2 the Manhattan distance π -π 1 . Total variation is a natural choice for DX when X is an "unstructured" space with no underlying metric. Indeed, such spaces can be naturally equipped with the discrete metric dm: MX , defined as dm(x, x ) = 0 iff x = x and 1 otherwise. It is well known that the Kantorovich lifting of this metric gives total variation, namely tv = K(dm). Note, however, that the fact that tv is the result of Kantorovich is not important for our goals; our technique involves applying K < to tv itself, lifting it to hyper-distributions.

The Lipschitz property wrt tv and the standard Euclidean d R naturally expresses the steepness of V g . If V g is k•tv-Lipschitz then the vulnerability can be modified by at most k• while changing the probability of any subset of secrets by . The larger k is, the steeper V g can be, i.e. the faster it is allowed to change. It turns out that this property is tightly connected to the span of g, as the following result from [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF] states. Proposition 1. For all g: GX it holds that V g is g •tv-Lipschitz.

As a consequence of the above result we get that V g ≤ g , since |V g (π) -V g (π )| can be no greater than g •tv(π, π ) ≤ g .

Putting the pieces together

We can finally recover (in a more structured way) the result of [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF] for computing the additive (G 1 ,π)-capacity. Denote by 1 S (x) the indicator function, equal to 1 if x ∈ S and 0 otherwise. Theorem 4. Given a channel C and prior π, it holds that

ML + G 1 (π, C) = E [πŻC] tv π .
The capacity is realized by the gain function g: G 1 X defined by

W := 2 X , g(W, x) := 1 W (x) -π(W ) ,
for which it holds that V g = tv π .4

Proof. The result comes from Thm. 2 for d = tv and G = G 1 X ; we show here that the two conditions of this theorem hold.

For the upper bound we need to show that g:

G 1 X implies that V g is tv, d < R -Lipschitz. But from Prop. 1 we know that V g is tv, d R -Lipschitz, which is a stronger property since d <
R is no greater than d R for all reals.

For the lower bound, we need to show that the claimed gain function g is 1-spanning and V g (τ ) = tv π (τ ). Note that g clearly depends on the fixed π. For the 1-spanning part we have that |g(W, x) -g(W, x

)| = |1 W (x) -1 W (x )| ≤ 1. Moreover, it holds that V g (τ ) = max W E x∼τ g(w, x) "definition of Vg" = max W E x∼τ 1 W (x) -π(W ) "definition of g" = max W x∈W (τ x -π x ) = x d < R (π x , τ x ) "take W = {x | τx ≥ πx}" = tv(π, τ ) . "tv(π, π ) = d < R n (π, π )"
In the above proof we showed that tv satisfies the two conditions of Thm. 2. From Thm. 3 we known that there is a unique quasimetric satisfying these conditions which can be constructed explicitly from the class

G = G 1 X , that is: tv(π, π ) = d < G 1 (π, σ) = sup g: G 1 X V g (σ) -V g (π). Note also that tv can be computed in |X | time, hence, as discussed in §3.2, ML + G 1 (π, C) can be computed in time O(|X ||Y|).

Additive capacity for 1-spanning vulnerability functions

As discussed in the introduction it is often desirable to measure vulnerability within a predefined range, for instance [0, 1] or [0, log 2 n] (n = |X |). A natural way to achieve this is to consider k-spanning gain functions, implicitly limiting the range of V g to an interval of size at most k. This choice, however, excludes important vulnerabilities that cannot be expressed as V g for any k-spanning g. For instance, for the Shannon vulnerability function V H (see §2) the additive capacity is equal to the well known Shannon mutual information. Although V H lies within [0, log 2 n] and it can be expressed as V g H for a suitable g H , this gain function is not log 2 n-spanning, in fact g H = +∞. As a consequence, the additive capacity ML + G 1 (π, C), discussed in the previous section, does not provide a bound for g Hleakage. Indeed, the mutual-information of the fully transparent identity channel C id on a uniform prior is L + g H (π u , C id ) = log 2 n, which exceeds its additive capacity wrt log 2 n-spanning gain functions, which is equal to

log 2 n•ML + G 1 (π u , C id ) = n-1 n log 2 n.
Aiming at robustness wrt a larger class of vulnerabilities, we can allow functions V g that have a bounded range, even though g itself is unbounded. Similarly to G 1 X , we choose to limit the range of V g without completely fixing it, by restricting to the class G X = {g: GX | V g ≤ 1} of 1-spanning vulnerability functions. Since V g ≤ g , but not vice-versa (as V H demonstrates), it holds that G 1 X ⊂ G X . Since any convex (and continuous) function can be expressed as V g for some properly constructed g [START_REF] Alvim | Axioms for information leakage[END_REF], V G X is the class of all 1-spanning convex functions. Note also that, since any V g , g: GX is bounded, it is k-spanning for some k.

To compute the additive capacity via the technique of §3.2, we need a quasimetric satisfying both conditions of Thm. 2. From Theorem 3 we know that such a quasimetric (if it exists) is unique and equal to the d < G construction. In the previous section, this turned out to be the well-known total variation distance. In this section, on the other hand, we start directly with d < G for our class G = G X . The resulting quasimetric d <

G

is called the "convex-separation" quasimetric, and is given by

d < G (π, σ) := sup g∈G X d < R (V g (π), V g (σ)) = sup g∈G X V g (σ) -V g (π) .
Note that, once again, we removed the max from the definition of d < R since the sup is anyway non-negative.

An important property of d < G is that it admits a simple closed-form solution. Theorem 5. The convex-separation quasimetric d < G is equal to

d < G (π, σ) = max x: π 1 - σ x π x .
Proof. Let π, σ ∈ DX . Assume π =σ (the case π = σ is trivial) and consider the line in R n joining the two priors, as shown in Fig. 2. The points on that line, starting from π and moving towards σ can be written as π c = π + c(σ -π) for c ≥ 0. Continuing on that line, at some point we are going to hit the boundary of the probability simplex DX . Let π c be the point on that boundary, i.e.

c := max{c | π c ∈ DX } . (5)
Note that c ≥ 1 since π 1 = σ ∈ DX . Now let F : DX → R be convex and 1spanning. Since σ lies in the line segment between π and π c , we can write it as a convex combination

σ = c -1 π c + (1 -c -1 )π (6)
with c -1 ∈ (0, 1]. From convexity we get that

F (σ) ≤ c -1 F (π c ) + (1 -c -1 )F (π) ,
from which, together with F (π c ) -F (π) ≤ 1 (F is 1-spanning), we get

F (σ) -F (π) ≤ c -1 (F (π c ) -F (π)) ≤ c -1 . (7)
We now compute c, which is given by the maximization problem [START_REF] Backes | Automatic discovery and quantification of information leaks[END_REF]. The problem has a single variable c and the constraint π c ∈ DX can be expressed by x π c x = 1 and the inequalities π c

x ≥ 0. The first constraint x π c x = 1 is always satisfied by construction of π c . Hence we only need to ensure that π c x = π x + c(σ x -π x ) ≥ 0 for all x: X . If π x = σ x this is always satisfied, and if π x < σ x then this imposes a lower bound on c. The only interesting case is when π x > σ x which gives us an upper bound c ≤ πx /πx-σx. The max c satisfying all upper bounds is equal to the smallest of them:

c = min x:πx>σx π x π x -σ x .
Replacing c in [START_REF] Biondi | Hyleak: Hybrid analysis tool for information leakage[END_REF] we get

F (σ) -F (π) ≤ max x:πx>σx π x -σ x π x = max x: π 1 - σ x π x .
We finally show that the above bound is attainable. Define

F π (τ ) := max x: π 1 - τ x π x .
F π is convex as the max of convex (in fact linear) functions of τ , so it can be expressed as V g (see Thm. 6 for the exact g). Moreover, F π (π) = 0, hence F π (σ) -F π (π) = max x: π 1 -σx πx , which concludes the proof.

We can now use d < G to compute the additive (G ,π)-capacity. Theorem 6. Given a channel C and prior π, it holds that

ML + G (π, C) = E [πŻC] d < G π = 1 - y: Y min x: π C x,y .
The capacity is realized by the complement of the "π-reciprocal" gain function

W = π , g c π -1 = 1 -1 πx , if w = x 1, if w = x ,
for which it holds that V g c π -1 = d < G π , and as a consequence g c π -1 : G X .

Proof. The result comes from Thm. 2 for d = d < G and G = G X ; we show here that its two conditions of the theorem hold. The second is satisfied automatically by the construction of d < G (Thm. 3). For the first condition, after simple calculations we find that the g c π -1 -vulnerability function is equal to

V g c π -1 (σ) = max x: π 1 -σx πx , hence from Thm. 5 we have that V g c π -1 = d < G π . Finally, simple calculations show that V g c π -1 [πŻC] = 1 -y min x∈ π C x,y , which concludes the proof since V g c π -1 (π) = d < G π (π) = 0.
Note that the capacity-realizing gain function g c π -1 essentially "cancels out" the effect of the prior, making ML + G (π, C) independent from π, and equal to 1 minus the sum of the column minima of C (ignoring the rows when π x = 0). Remarkably, the "π-reciprocal" gain function g π -1 (the complement of g c π -1 ) produces the same "cancellation" effect for multiplicative (G + ,π)-capacity, making it independent from π.

An observation that can be made from Thm. 6 is that the capacity realizing g is k-spanning for k = max x: π 1 πx . From this we can conclude that ML

+ G (π, C) ≤ k • ML + G 1 (π, C) for k = max x: π 1 /πx. In particular ML + G (π u , C) ≤ |X |•ML + G 1 (π u , C) for the uniform π u .
A final note about our use of quasimetrics. Although the total variation tv, used in §3.3 for G 1 X , is a proper metric, d < G used in this section for G X is not, since it is not symmetric. This is why we had to work with quasimetrics; it is certainly possible to define a symmetric variant of d < G (eg. as max{d < G (π, σ), d < G (σ, π)}), however this metric would not satisfy both conditions of Thm. 2. Recall that for each class G there can be at most one quasimetric satisfying both properties, and for G X this is d < G .

Maximize over both g and π

This scenario was left open in [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF] (which uses the class G 1 X ), since ML + G 1 (π, C) depends on the prior, and maximizing it over π is challenging. Our results on the larger class G X , however, lead to a complete solution since ML + G (π, C) is independent from π. By Thm. 6, any full-support π with g c π -1 are capacity-realizing, giving

ML + G (D, C) = 1 -y min x C x,y .

The additive miracle theorem

The multiplicative Bayes-capacity ML × gid (D, C) is well known to be realized on a uniform prior, and is equal to the sum of the column maxima of C [START_REF] Braun | Quantitative notions of leakage for one-try attacks[END_REF][START_REF] Smith | On the foundations of quantitative information flow[END_REF]. A result from [START_REF] Alvim | Measuring information leakage using generalized gain functions[END_REF], which was surprising enough to be named "Miracle", states that ML × gid (D, C) is in fact a universal upper bound for multiplicative leakage (wrt non-negative g's).

Theorem 7 ("Miracle", [3]

). For any C, π: DX , and non-negative g: G + X , we have

L × g (π, C) ≤ y max x C x,y = ML × gid (D, C) .
In [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF], this theorem was used to easily conclude that the capacity ML × G + (π, C) is equal to ML × gid (D, C) for any full-support π. In the additive case, having already a solution for ML + G (π, C), we can go in the opposite direction and obtain an additive variant of the miracle theorem. Denote by g c id = 1 -g id the complement of g id . Theorem 8 ("Additive Miracle"). For any C, π: DX , and g: G X , we have We have that V g * = |X |(1min x: X π x ). For uniform π u we compute L + g * (π u , C) = 1y min x C x,y , and since g * : G X , this is an upper bound for all π: DX , and hence equal to ML + g * (D, C).

The multiplicative and additive miracle theorems are similar in nature, although they do have several differences. They both provide a universal bound for leakage, which holds for all priors and all gain functions within a certain class. In the multiplicative case, this is the class G + X of non-negative gain functions, while in the additive case, the class G X of gain functions producing a 1-spanning V g . In the multiplicative case the bound is given by the sum of column maxima of C, while in the additive case by 1 minus the sum of column minima. In the multiplicative case the bound coincides with the (g id , D)capacity for the identity gain function (i.e. the Bayes-capacity), which is realized on a uniform prior. In the additive case the bound is (|X | times) the (g c id , D)-capacity for the "complement of identity" gain function, also realized on a uniform prior.

C y 1 y 2 x 1 0.8 0.2 x 2 0.2 0.8

Example Consider the case X = {x 1 , x 2 } with a gain function penalizing wrong guesses, defined as W = X , and g(w, x) = 1 iff w = x and -1 otherwise. Note that V g is always non-negative since the probability of a correct guess is at least 0.5 (for |X | = 2). For a uniform prior π u , both guesses are equivalent, giving expected gain 0.5 • 1 + 0.5 • -1 = 0, so V g (π u ) = 0. Now consider the illustrated channel C which gives rather good information about the secret. Computing the two posteriors we get δ y1 = (0.8, 0.2) and δ y2 = (0.2, 0.8), which both give g-vulnerability V g (δ y1 ) = V g (δ y2 ) = 0.8-0.2 = 0.6. Hence V g [π u ŻC] = 0.6 and as a consequence L × g (π u , C) = +∞, clearly larger than the multiplicative Bayes capacity ML × gid (D, C) = 0.8 + 0.8 = 1.6. The miracle theorem does not apply here since g takes negative values.

On the other hand, V g is 1-spanning (although g itself is 2-spanning), since its value is at least 0 (for a uniform prior) and at most 1 (for a point prior). As a consequence the additive miracle theorem applies, guaranteeing that L + g (π u , C) ≤ 1y min x C x,y = 1 -0.2 -0.2 = 0.6. Indeed L + g (π u , C) = 0.6 -0, exactly matching the bound.

Conclusion and future work

We studied the problem of computing additive g-capacities. Extending the Kantorovich technique of [START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF] with quasimetrics, we provided a solution for the class G X of 1spanning vulnerabilities, which, in contrast to G 1 X , can include any vulnerability function (by scaling). The results also provided a solution to the problem of maximizing leakage over both π and g, and lead to an additive variant of the miracle theorem of [START_REF] Alvim | Measuring information leakage using generalized gain functions[END_REF].

In future work we plan to study approximation algorithms for all scenarios, especially ML + g (D, C) which is NP-complete in general. Moreover, we aim at developing a theory that unifies the two main approaches to robustness, namely capacity and refinement.

Fig. 1 .

 1 Fig. 1. A prior π (type DX ), a channel C (rows have type DY), a joint J (type D(X × Y)), and a hyper [πŻC] (type D 2 X , each column has type DX ).

Theorem 2 .

 2 Let d ∈ MDX , let G ⊆ GX and fix a channel C and prior π. Then

  g∈G d(π, σ) = d(π, σ) , hence d and d < G coincide. Finally, an important corollary of this technique is that, assuming that d can be computed in time O(|X |), ML + G (π, C) can be computed in time O(|X ||Y|). Indeed, calculating E [πŻC] d π involves computing the output and posterior distributions of [πŻC]. The former can be computed in O(|X ||Y|) time via the joint matrix J; then for each posterior δ y , we need to construct δ y (O(|X |)) and compute d(π, δ y ) (O(|X |)).

Fig. 2 .

 2 Fig. 2. Line connecting π and σ, extended to the boundary of the simplex.

  L + g (π, C) ≤ 1y min x C x,y = |X | • ML + g c id (D, C) .Proof. The inequality is a direct consequence of Thm. 6; note that it holds for any prior since 1y: Y min x: X C x,y ≥ 1y: Y min x: π C x,y . Now let g * = g c id × |X |, for which it holds that ML + g * (D, C) = |X | • ML + g c id (D, C).

The notation is due to the fact that distributions can be convexly combined (DA is a vector space). y ay[δ y ] is exactly the hyper assigning probability ay to each δ y .

Which is why we generally refer to the maximization of leakage as "capacity".

The same phenomenon happens for multiplicative leakage, this time demonstrated by shifting. To keep ML × G (π, C) bounded we can restrict to the class G + X of non-negative gain functions.

The choice W = X → {-1, 1}, g(w, x) = 1 2 w(x) -Eπw is also capacity-realizing[START_REF] Alvim | Additive and multiplicative notions of leakage, and their capacities[END_REF].

Acknowledgements All results were obtained in the process of preparing a manuscript on Quantitative Information Flow with my long-term collaborators M. Alvim, C. Morgan, A. McIver, C. Palamidessi and G. Smith, and were heavily influenced by their feedback.