MD, MPH Robert M Szabo
email: rmszabo@ucdavis.edu

MD Christine Kwak

Natural History and Conservative Management of Cubital Tunnel Syndrome

½Q4

. Accuracy in diagnosis is key in identifying the cubital tunnel as the site of compression, and, depending on the severity of the symptoms, nonoperative and operative treatment options have been proposed. In this article, we discuss the course of ulnar neuropathy caused by compression at the cubital tunnel and the conservative management of this syndrome.

The natural course of cubital tunnel syndrome Buzzard [START_REF] Buzzard | Some varieties of traumatic and toxic ulnar neuritis[END_REF], in 1922, described chronic neuritis of the elbow and attributed its causes to ''excessive use of the hand and arm in flexed positions,'' ulnar nerve subluxation, and ''some form of toxic agent.'' The term cubital tunnel was first proposed by Feindal and Stratford [START_REF] Feindel | The role of the cubital tunnel in tardy ulnar palsy[END_REF] in 1958. They emphasized that anatomic peculiarities that predispose the ulnar nerve to compression are present in this region of the elbow and noted a similarity between ulnar nerve compression at the elbow and median nerve compression in the carpal tunnel [START_REF] Feindel | The role of the cubital tunnel in tardy ulnar palsy[END_REF][START_REF] Feindel | Cubital tunnel compression in tardy ulnar palsy[END_REF]. They observed the ulnar nerve being compressed in a fibro-osseous space defined by a ligament, which extends from the medial epicondyle to the olecranon. Its aponeuroticlike fibers adjoin with the two heads of the flexor carpi ulnaris muscle [START_REF] Feindel | The role of the cubital tunnel in tardy ulnar palsy[END_REF][START_REF] Britz | Ulnar nerve entrapment at the elbow: correlation of magnetic resonance imaging, clinical, electrodiagnostic, and intraoperative findings[END_REF][START_REF] Iba | Intraoperative measurement of pressure adjacent to the ulnar nerve in patients with cubital tunnel syndrome[END_REF].

The elbow is a dynamic joint. Its arc of motion typically ranges from full extension to 150 degrees of flexion, with the functional range of motion being from 30 to 130 degrees. Throughout the day, the elbow flexes and extends to place the hand in positions of function. With motion, associated changes occur to the shape and space within the cubital tunnel.

The tunnel is most patent with the elbow in extension. With each degree of flexion, the tunnel changes its shape. Patel and colleagues [START_REF] Patel | Morphologic changes in the ulnar nerve at the elbow with flexion and extension: a magnetic resonance imaging study with 3-dimensional reconstruction[END_REF], by using magnetic resonance imaging (MRI), showed that the tunnel is circular in shape and most spacious in extension. With flexion, the tunnel adopts a wider and flatter configuration. Beginning as a rounded tunnel, the tunnel becomes triangular or, as some describe, ellipsoid in flexion with a measurable height decrease of 2.5 mm. Vanderpool and colleagues [START_REF] Vanderpool | Peripheral compression lesions of the ulnar nerve[END_REF] showed that with the elbow in flexion, the aponeurosis stretches 5 mm for every 45 degrees of flexion. With the stretching of the aponeurosis and the innate tightness of the arcuate ligament, the tunnel has been shown to flatten and narrow by 55% with elbow flexion [START_REF] Apfelberg | Dynamic anatomy of the ulnar nerve at the elbow[END_REF]. This decreases the space surrounding the nerve, making the nerve susceptible to compression [START_REF] Feindel | The role of the cubital tunnel in tardy ulnar palsy[END_REF][START_REF] Vanderpool | Peripheral compression lesions of the ulnar nerve[END_REF][START_REF] Pechan | The pressure measurement in the ulnar nerve: a contribution to the pathophysiology of the cubital tunnel syndrome[END_REF].

With the change in shape, an associated change in pressure occurs within the tunnel. Werner and colleagues [START_REF] Werner | Pressures recorded in ulnar neuropathy[END_REF] studied the cubital tunnel pressure measurements with the elbow in extension and flexion. The average pressure measured in extension was 9 mm Hg, and with flexion, the pressure increased to approximately 63 mm Hg. Hand Clin j (2007) j-j

U N C O R R E C T E D P R O O F Gelberman ½Q5
[13] studied the extraneural and intraneural pressures and showed that with flexion, the extraneural pressure increased dramatically. Using cadaveric specimens, Gelberman showed that extraneural pressure measurements increased from 7 to 28 mm Hg with flexion and intraneural pressure measurements increased from 8 to 41 mm Hg with flexion. Macnicol [START_REF] Macnicol | Extraneural pressures affecting the ulnar nerve at the elbow[END_REF] also showed a rise in extraneural pressure with elbow flexion, recording pressure measurements as high as 200 mm Hg. They also ½Q6

showed a decrease in pressure by 50% with release of the flexor aponeurosis. Iba and colleagues [START_REF] Iba | Intraoperative measurement of pressure adjacent to the ulnar nerve in patients with cubital tunnel syndrome[END_REF] studied cubital tunnel pressure measurements in patients and found that the highest extraneural pressure measurements were 1 cm distal from the proximal edge of the arcuate ligament. They also found that those with severe neuropathy had the highest pressure measurements with flexion.

As the cubital tunnel changes with elbow flexion, so does the ulnar nerve. With elbow flexion, the excursion of the nerve proximal to the medial epicondyle has been recorded to be as long as 10 mm. Apfelberg and Larson [START_REF] Apfelberg | Dynamic anatomy of the ulnar nerve at the elbow[END_REF] showed that the nerve elongates approximately 4.7 mm with the elbow in flexion. Distal to the medial epicondyle, the nerve stretches approximately 3 to 6 mm with flexion. Other studies have shown the nerve elongating even up to 8 mm [START_REF] Kern | The electrodiagnosis of ulnar nerve entrapment at the elbow[END_REF]. This increases when the shoulder is held in abduction and the wrist is held in extension.

It is already clear that the environment surrounding the ulnar nerve at the elbow is a dynamic one. The natural course of the nerve is to experience some traction and some excursion with the elbow in motion. It is thought that with repetitive motion, the nerve becomes inflamed. With the inflammation comes edema and swelling in the nerve, which then affects its ability to glide. This has been well described both histologically and with imaging studies [START_REF] Bozentka | Cubital tunnel syndrome pathophysiology[END_REF][START_REF] Pechan | The pressure measurement in the ulnar nerve: a contribution to the pathophysiology of the cubital tunnel syndrome[END_REF][START_REF] Green | The cubital tunnel: anatomic, histologic, and biomechanical study[END_REF]. Studies have shown that blood flow and axonal transport are affected by compression [START_REF] Aziz | Blood flow in a chronic entrapment neuropathy model in the rabbit sciatic nerve[END_REF][START_REF] Lundborg | The pathophysiology of nerve compression[END_REF][START_REF] Dahlin | Changes in fast axonal transport during experimental nerve compression at low pressures[END_REF]. With low external compression, extraneural and intraneural blood flow is impaired, leading to an increase in pressure and change in nerve conduction. With higher pressures, thickening in the nervous tissue and severe impairment in nerve conduction occur. Clark and colleagues [START_REF] Clark | Nerve tension and blood flow in a rat model of immediate and delayed repairs[END_REF] showed a decrease in neural blood flow with elongation. Using sciatic nerves in rats, they measured a 50% decrease in blood flow with 8% stretch of the nerve and an 80% reduction in nerve blood flow with 15% of elongation. Wall and colleagues [START_REF] Wall | Experimental stretch neuropathy: changes in nerve conduction under tension[END_REF] studied the effects of nerve conduction with stretch using tibial nerves. At 6% stretch, the nerve conduction decreased by 70%; with 12% strain, conduction was completely blocked at 1 hour. Once decompressed, the recovery of nerve function was noted to be related to the severity and duration of the compression [START_REF] Dellon | Review of treatment results for ulnar nerve entrapment at the elbow[END_REF][START_REF] Clark | Nerve tension and blood flow in a rat model of immediate and delayed repairs[END_REF][START_REF] Wall | Experimental stretch neuropathy: changes in nerve conduction under tension[END_REF][START_REF] Mcgowen | The results of transposition of the ulnar nerve for traumatic ulnar neuritis[END_REF][START_REF] Posner | Compressive neuropathies of the ulnar nerve at the elbow and wrist[END_REF].

Causes

Cubital tunnel syndrome might be caused by constricting fascial bands, soft-tissue structures (hypertrophied synovium, tumor, ganglion, anconeus epitrochlearis muscle), bony abnormalities (cubitus valgus, bone spurs), or subluxation of the ulnar nerve over the medial epicondyle with elbow flexion. Although work-related activities involving repetitive elbow flexion and extension might aggravate cubital tunnel syndrome, no scientific data have supported work as a causal risk factor [START_REF] Blair | Cubital tunnel syndrome in the work environment[END_REF]. Many common themes are seen, however, in patients presenting with cubital tunnel syndrome. Environmental factors, such as specific occupations, have been associated with the diagnosis, and jobs that require repetitive motions involving elbow flexion have been implicated. Repetitive flexion can make one prone to developing traction neuritis because of the constant stretching of the ulnar nerve [START_REF] Terrono | Management of workrelated upper-extremity nerve entrapments[END_REF]. Baseball pitchers and tennis players often feel pain at the elbow and experience numbness in the ring and small fingers caused by the stress placed on the elbow. The wind-up while throwing a baseball or while serving a tennis ball stretches the ulnar nerve by placing a valgus force at the elbow while the shoulder is abducted. This position places the nerve under maximum compression and traction [START_REF] Aoki | Strain on the ulnar nerve at the elbow and wrist during throwing motion[END_REF].

Similarly, people who partake in occupations such as carpentry, painting, and music typically are more prone to developing ulnar nerve symptoms, most commonly because of prolonged elbow flexion. Charness [START_REF] Charness | Unique upper extremity disorders of musicians[END_REF] reported that with 117 musicians, cubital tunnel syndrome was the most commonly diagnosed nerve entrapment syndrome. Another well-studied group involves wheelchair athletes, who are known to be prone to upper extremity injuries caused by repetitive impact and overuse. The prevalence of nerve entrapment in this group was 23%. The majority of the neuropathies were from median nerve compression at the carpal tunnel. Thirty-nine percent of the nerve entrapment syndromes, however, involved the ulnar nerve, with a large subset of

ARTICLE IN PRESS

U N C O R R E C T E D P R O O F
those patients having cubital tunnel syndrome. The strong forceful contractions of the flexor carpi ulnaris and the repetitive elbow flexion have been thought to cause compression of the ulnar nerve at the elbow [START_REF] Burnham | Upper extremity peripheral nerve entrapments among wheelchair athletes: prevalence, location, and risk factors[END_REF].

Mechanical compression of the nerve at the elbow also is common because very little soft tissue surrounds the nerve. Postoperative ulnar nerve compression caused by inadequate padding at the elbow has been reported [START_REF] Miller | Postoperative ulnar neuropathy[END_REF]. The superficial course of the ulnar nerve predisposes it to injury during patient positioning in the operating room. In the supine position, with the arm tucked to the side, direct compression can occur and will be accentuated if the arm slips slightly over the edge of the table. Wheelchair users who constantly place their elbows on the armrests often have symptoms of ulnar neuropathy [START_REF] Burnham | Upper extremity peripheral nerve entrapments among wheelchair athletes: prevalence, location, and risk factors[END_REF]. Other sources include soft-tissue and bony abnormalities, such as cubitus valgus, ganglions, and space-occupying lesions in the cubital tunnel.

Clinical presentation

The most frequent way of diagnosing cubital tunnel syndrome is by obtaining a history and performing a physical examination. Patients commonly present with complaints of numbness and tingling in the small and ulnar half of the ring fingers, often accompanied by weakness of grip, particularly during activities for which torque is applied to a tool. Sensory involvement on the ulnar dorsal aspect of the hand also suggests cubital tunnel syndrome, as the dorsal cutaneous branch of the ulnar nerve originates proximal to the canal of Guyon. On rare occasions, patients present with wasting of the intrinsic musculature in the hand. Depending on the severity, the paresthesias might be intermittent or constant. The Semmes Weinstein monofilament test and vibration testing are helpful in detecting sensory impairment during the earlier stages of nerve compression. For more severe cases, static and moving two-point discrimination can be used. Weakness might also be present, although at times subtle. Comparison with the contralateral asymptomatic side can identify motor weakness with the intrinsic musculature. Patients also might complain of pain at the elbow and hypersensitivity with palpation of the ulnar nerve as it travels around the elbow [START_REF] Clark | Nerve tension and blood flow in a rat model of immediate and delayed repairs[END_REF][START_REF] Wall | Experimental stretch neuropathy: changes in nerve conduction under tension[END_REF][START_REF] Mcgowen | The results of transposition of the ulnar nerve for traumatic ulnar neuritis[END_REF][START_REF] Posner | Compressive neuropathies of the ulnar nerve at the elbow and wrist[END_REF][START_REF] Blair | Cubital tunnel syndrome in the work environment[END_REF][START_REF] Terrono | Management of workrelated upper-extremity nerve entrapments[END_REF][START_REF] Aoki | Strain on the ulnar nerve at the elbow and wrist during throwing motion[END_REF][START_REF] Charness | Unique upper extremity disorders of musicians[END_REF][START_REF] Burnham | Upper extremity peripheral nerve entrapments among wheelchair athletes: prevalence, location, and risk factors[END_REF][START_REF] Miller | Postoperative ulnar neuropathy[END_REF][START_REF] Cooper | Nerve injury associated with patient positioning in the operating room[END_REF][START_REF] Idler | General principles of patient evaluation and nonoperative management of cubital syndrome[END_REF]. In most cases, the forearm muscles are spared because their innervation might arise proximal to the cubital tunnel.

Weakness of the deep flexors to the ring and little fingers and weakness of the flexor carpi ulnaris, however, signal proximal ulnar nerve entrapment. Sunderland [START_REF] Sunderland | The intraneural topography of the radial, median and ulnar nerves[END_REF] studied the topography of the ulnar nerve at the level of the elbow and noted that the fascicles innervating the flexor carpi ulnaris and flexor digitorum profundus to the fourth and fifth digits are more central whereas the sensory fascicles and hand muscles are distributed more peripherally. The fibers are susceptible to changes in the environment, such as compression, frequent traction with elbow flexion, and direct trauma.

Provocative tests also are used to help identify ulnar neuropathy at the elbow. Tinel sign is positive when percussion of the ulnar nerve at the medial epicondyle reproduces paresthesias in the ring and small fingers. However, nearly 24% of asymptomatic people have this finding [START_REF] Rayan | Elbow flexion test in the normal population[END_REF]. The elbow flexion test also has been used to corroborate the diagnosis of cubital tunnel syndrome. As described by Buehler ½Q7 [START_REF] Buehler | The elbow flexion test. A clinical test for the cubital tunnel syndrome[END_REF], results of an elbow flexion test are positive when ulnar nerve symptoms are reproducible with the elbow flexed, the forearm supinated, and the wrist in extension for 3 minutes. Novak and colleagues [START_REF] Novak | Provocative testing for cubital tunnel syndrome[END_REF] studied four different provocative tests, including Tinel sign, elbow flexion test, pressure provocation, and combined flexion with pressure provocation, and found that the combined test was the most sensitive and specific in diagnosing cubital tunnel syndrome. Only 2 of the 66 control participants experienced ulnar nerve symptoms with the combined test, whereas 43 of the 60 affected participants had positive results of the tests. Despite studies supporting the use of provocative tests, it is well known that the tests can also render positive results in asymptomatic people. The frequency of false positives has been reported with the use of the elbow flexion test and Tinel sign. With the wrist and shoulder in neutral position, Rayan and colleagues [START_REF] Rayan | Elbow flexion test in the normal population[END_REF] showed that 10% of their asymptomatic patients had positive results of the flexion tests. The number of false positives increased when the test was performed with the shoulder abducted and the wrist extended. Therefore, care should be taken when interpreting the results of these tests, and an emphasis should be made on finding a positive correlation between the clinical examination and the history before making a diagnosis.

The use of electrodiagnostic testing can help locate, confirm, and quantify the severity of nerve compression. The ulnar nerve at the elbow has

U N C O R R E C T E D P R O O F
been studied, and guidelines have been formulated with the use of nerve conduction studies to aid in the diagnosis. Conduction velocities are measured across the elbow with the intrinsic musculature used for motor velocity and the small finger for sensory velocity. Parameters for accurate testing include flexing the elbow between 70 and 90 degrees when measuring conduction at the elbow [START_REF] Britz | Ulnar nerve entrapment at the elbow: correlation of magnetic resonance imaging, clinical, electrodiagnostic, and intraoperative findings[END_REF]. The recommended length across the elbow is 100 mm; however, studies have supported measuring 50 to 80 mm across the elbow to obtain the most accurate measurement of conduction [START_REF] Kern | The electrodiagnosis of ulnar nerve entrapment at the elbow[END_REF]. The American Association of Electrodiagnostic Medicine criteria for a positive diagnosis of ulnar neuropathy include one of the following: absolute slowing of nerve conduction at the elbow, decreased conduction velocity of more than 10 m/s across the elbow, decreased amplitude of more than 20%, absence of sensory responses, or evidence of muscle atrophy [START_REF]Practice parameter for electrodiagnostic studies in ulnar neuropathy at the elbow: summary statement[END_REF]. Electromyography will reveal whether axonal degeneration has occurred. The first dorsal interosseous muscle is most commonly affected. The abductor pollicis brevis should be examined to exclude a C8ÀT1 nerve root or inferior brachial plexus lesion.

Radiographic examination of the elbow is useful in a small percentage of patients: those with arthritis, history of trauma, or abnormal elbow motion or carrying angle revealed by physical examination. Thoracic outlet syndrome most commonly involves the medial components of the brachial plexus and might be mistaken for cubital tunnel syndrome. An apical tumor of the lung can also compress or invade the inferior brachial plexus causing ulnar nerve symptoms. Chest radiography to rule out a Pancoast tumor should be obtained whenever a history of smoking, ulnar nerve symptoms, and shoulder pain is reported by the patient.

Ultrasonography also has been used to aid in the diagnosis of cubital tunnel syndrome. Studies have shown a difference in ulnar nerve size in patients diagnosed with cubital tunnel syndrome [START_REF] Mcpherson | Cubital tunnel syndrome[END_REF][START_REF] Park | The ultrasonographic and electrodiagnostic findings of ulnar neuropathy at the elbow[END_REF][START_REF] Wiesler | Ultrasound in the diagnosis of ulnar neuropathy at the cubital tunnel[END_REF]. Wiesler ½Q8

and colleagues [START_REF] Park | The ultrasonographic and electrodiagnostic findings of ulnar neuropathy at the elbow[END_REF] showed that the affected patients had a statistically significant increase in the cross-sectional area of the nerve when compared with normal controls. The increase in size correlated with the idea that compression induced a cascade of events that included endoneurial edema and inflammation. The authors showed a positive correlation between nerve conduction studies and ultrasound measurements. Ultrasonography, therefore, might provide a noninvasive way to help diagnose cubital tunnel syndrome.

MRI has been studied as a modality with which to visualize changes to the ulnar nerve around the elbow [START_REF] Patel | Morphologic changes in the ulnar nerve at the elbow with flexion and extension: a magnetic resonance imaging study with 3-dimensional reconstruction[END_REF]. Britz and colleagues [START_REF] Britz | Ulnar nerve entrapment at the elbow: correlation of magnetic resonance imaging, clinical, electrodiagnostic, and intraoperative findings[END_REF] showed a strong correlation with positive MRI findings, such as an increase in signal around the nerve, and nerve compression. The authors found that MRI was more sensitive than electrodiagnostic studies in diagnosing ulnar nerve compression at the elbow.

Staging

In 1950, McGowen [START_REF] Mcgowen | The results of transposition of the ulnar nerve for traumatic ulnar neuritis[END_REF] introduced a staging system that solely reflected the motor aspect of the ulnar nerve. Grade I had undetectable motor weakness. Grade II showed some motor weakness, and Grade III was described as severe motor weakness. Sensory findings were later included into the staging classification. For mild cases, symptoms are intermittent and include occasional paresthesia. The patient might have complaints of weakness, but findings of the motor examination typically are normal. For moderate cases, paresthesias are intermittent, and clinically, a decrease in vibratory sensation might be present. A discrepancy in intrinsic strength when compared with the unaffected side might be present. Results of provocative tests are also positive. In more severe cases, patients might complain of constant numbness in the ulnar nerve distribution in the hand and might have abnormal results of the two-point discrimination test. The patients present with atrophy of the ulnar innervated intrinsics and have obvious weakness.

Dellon [START_REF] Dellon | Review of treatment results for ulnar nerve entrapment at the elbow[END_REF] and Gabel ½Q9 [START_REF] Gabel | Reoperation for failed decompression of the ulnar nerve in the region of the elbow[END_REF] developed more comprehensive staging classifications by using additional diagnostic criteria and creating a more precise tool for reporting research data. Dellon ½Q10 [START_REF] Dellon | Nonoperative management of cubital tunnel syndrome: an 8-year prospective study[END_REF] used a numeric grading scale to categorize patients based on symptoms. A numeric score of 0 indicated normal results. Scores of 1 and 2 included intermittent paraesthesias and mild weakness observed during pinch and grip tests. Scores of 3 and 4 included vibratory changes and moderate objective weakness. A score of 5 indicated persistent paresthesias, and a score of 6 showed abnormal two-point discrimination. Scores 7 through 10 evidenced muscle atrophy. Based on the numeric grading, the authors showed that mildly affected patients achieved better outcomes with conservative therapy, whereas those with higher scores were more likely to need surgical treatment. This confirmed the findings of an earlier study in which

U N C O R R E C T E D P R O O F
Dellon [START_REF] Dellon | Review of treatment results for ulnar nerve entrapment at the elbow[END_REF] found that for 50% of patients with a minimal degree of nerve compression, excellent results were achieved by using nonoperative techniques.

Conservative therapy

Conservative therapy has been proposed and adopted for patients presenting with mild symptoms [START_REF] Dellon | Review of treatment results for ulnar nerve entrapment at the elbow[END_REF][START_REF] Idler | General principles of patient evaluation and nonoperative management of cubital syndrome[END_REF][START_REF] Eisen | The mild cubital tunnel syndrome: its natural history and indications for surgical intervention[END_REF][START_REF] Blackmore | Therapist's management of ulnar nerve neuropathy at the elbow[END_REF]. The goals of the treatment are to eliminate or decrease the frequency of symptoms and to prevent further progression of the disease. A detailed history is important and helps identify the activities that aggravate the symptoms. Patient education plays an important part in treating the mild symptoms. Activities that reproduce symptoms such as repetitive elbow flexion or direct pressure to the medial epicondyle should be avoided or limited, and elimination of these inciting activities has been shown to provide relief. The patient might be required to modify habits and the work environment [START_REF] Blackmore | Therapist's management of ulnar nerve neuropathy at the elbow[END_REF][START_REF] Lund | Treatment of cubital tunnel syndrome: perspectives for the therapist[END_REF].

In conjunction with activity modification, splinting has played a successful role in the conservative management of cubital tunnel syndrome. An elbow pad can help prevent direct trauma to the nerve. Wearing a splint also can act as a reminder to the patient to avoid flexing the elbow. By limiting flexion to 45 to 70 degrees, Dimond ½Q11

[15] and Lister

½Q12

[45] reported an 86% improvement of symptom severity in 73 patients who underwent splinting during an average 8.7 months. Studies have shown as high as 90% successful treatment achieved by using conservative modalities [START_REF] Kern | The electrodiagnosis of ulnar nerve entrapment at the elbow[END_REF][START_REF] Dimond | Cubital tunnel syndrome treated by long-term splintage. Proceedings of the 1985 American Society for Surgery of the Hand Annual Meeting[END_REF].

Beekman and colleagues [START_REF] Beekman | Ulnar neuropathy at the elbow: follow-up and prognostic factors determining outcome[END_REF] prospectively studied 74 patients who had cubital tunnel syndrome. Based on diagnostic testing, the authors divided the patients into two treatment groups. Forty-six patients were treated conservatively, and 28 were treated surgically. The division was decided based on the presenting symptoms, with the conservative group having more mild symptoms, limited to intermittent paresthesias and mild intrinsic weakness. The instructions for conservative treatment included avoiding leaning on the elbow, avoiding crossing the arms while sitting, and keeping the elbow extended as much as possible. After the 6 months of treatment, 35% of the conservatively treated patients achieved improvement and 11% experienced complete remission. The authors noted that during the course of 6 months, those with only sensory symptoms did not progress with any worsening symptoms or any motor involvement, thus implying that treatment can halt the progression of the neuropathy.

Night splinting has been successfully used in patients presenting with cubital tunnel syndrome. Seror ½Q13 and colleagues [START_REF] Seror | Treatment of ulnar nerve palsy at the elbow with a night splint[END_REF] studied 22 patients with electrodiagnostically confirmed ulnar nerve palsy and treated them with night splints. The splints limited flexion from 15 to 60 degrees but allowed unrestricted pronation and supination. During the daytime, the patients were advised not to rest the elbow on hard surfaces or partake in prolonged elbow flexion. The splints were worn regularly for 6 months. After 11.3 months, fewer symptoms were present in every patient treated and five of the patients reported 80% to 90% subjective improvement in symptoms. Sixteen of the 17 patients additionally experienced electrodiagnostic improvement. The best responders for the treatment were those who underwent splinting less than 3 weeks after the onset of symptoms. The first symptom to resolve was nocturnal paresthesias. Those more severely affected also showed improvements with sensation and strength; however, the authors noted that the time to recovery was more prolonged compared with the mildly affected patients. Interestingly, three of the patients included in the study had undergone previous surgical decompressions that did not achieve resolution of symptoms. Nighttime splinting did improve symptoms in all three patients, and clinical improvement for the three ranged from 60% to 95%. Two of the patients additionally had improvement shown by electromyography.

Dellon and colleagues [START_REF] Dellon | Nonoperative management of cubital tunnel syndrome: an 8-year prospective study[END_REF] prospectively studied 121 patients treated nonoperatively for a minimum of 3 months up to 6 months. The nonoperative management included thermoplastic splints or towel wrapping at night, patient education, and work modification. Alterations included placing pillows under the elbow for computer users. Telephones were to be used with the contralateral arm. Crossing arms was avoided, and patients were taught to place their hands on their thighs with their forearms supinated. Of the patients with intermittent paresthesias, 42% became symptom free after conservative treatment. Thirty-four percent of patients with moderate symptoms, which included electromyographic findings but no clinical signs of intrinsic wasting or abnormal two-point discrimination, became symptom free after 6 months of treatment. Twenty percent of the more severely affected patients also reported

ARTICLE IN PRESS

U N C O R R E C T E D P R O O F
being symptom free. The need for surgical treatment was 21% within 6 years for patients with mild symptoms, 33% within 3 years for moderate symptoms, and 62% within 3 years for severe symptoms.

Many varieties of splints are available. Homemade, custom fitted, and pre-made commercially available splints have been used to prevent elbow flexion. Apfel and Sigafoos [START_REF] Apfel | Comparison of range-of-motion constraints provided by splints used in the treatment of cubital tunnel syndrome: a pilot study[END_REF] studied five different types of splints, four of which are commercially available, to learn how effective they are in preventing flexion. The five splints consisted of the following: a large bath towel applied circumferentially around the elbow joint; Pil-O Splint elbow support adjustable with rigid plastic stay (IMAK Corp., San Diego, CA); Pil-O-Splint elbow support adjustable with rigid plastic stay removed (IMAK Corp.); the Hely & Weber cubital tunnel splint (Hely & Weber, Santa Paula, CA); and the AliMed Cubital Tunnel Syndrome Support (AliMed, Inc., Dedham, MA). Using cadaveric limbs, the authors studied the splints' ability to prevent elbow flexion against gravity and with an added weight. They found that the AliMed splint allowed for the most flexion against gravity, allowing the elbow to flex to 110 degrees. The Hely & Weber splint allowed only 53 degrees of flexion. This splint also prevented full extension: on average, 17 degrees of extension. The remaining splints allowed for elbow flexion, although none exceeded 90 degrees. By preventing the elbow to bend beyond 90 degrees, the products minimized compression on the ulnar nerve.

A consensus exists that limiting elbow flexion is what makes splinting effective; however, the degree of flexion that is tolerable has not been established. Gelberman ½Q14 [START_REF] Blackmore | Therapist's management of ulnar nerve neuropathy at the elbow[END_REF] showed that the lowest mean extraneural and intraneural pressures of the ulnar nerve occurred when the elbow was flexed to 40 to 50 degrees. The highest pressures were recorded with the elbow in maximal flexion, which was approximately 130 degrees. Interestingly, the elbow in full extension also recorded higher pressures at the cubital tunnel than when the elbow was flexed between 30 and 70 degrees [START_REF] Gelberman | Changes in interstitial pressure and cross-sectional area of the cubital tunnel and of the ulnar nerve with flexion of the elbow: an experimental study in human cadavera[END_REF]. Hong and colleagues [START_REF] Hong | Splinting and local steroid injection for the treatment of ulnar neuropathy at the elbow: clinical and electrophysiological evaluation[END_REF] recommended limiting flexion to 35 degrees, whereas other studies [START_REF] Bozentka | Cubital tunnel syndrome pathophysiology[END_REF][START_REF] Sailer | The role of splinting and rehabilitation in the treatment of carpal and cubital tunnel syndromes[END_REF] reported using 45 degrees as the limit. Although it seems the studies used different parameters for splinting, an underlying consistency exists in that a slight amount of flexion is more beneficial in decreasing the pressure in the cubital tunnel and that patients find slight flexion more tolerable than full extension [START_REF] Blackmore | Therapist's management of ulnar nerve neuropathy at the elbow[END_REF].

Little support is offered for local steroid injections into the cubital tunnel. Unlike with carpal tunnel syndrome, the response to cubital tunnel syndrome from steroid injections has not been as beneficial [START_REF] Mcpherson | Cubital tunnel syndrome[END_REF][START_REF] Lund | Treatment of cubital tunnel syndrome: perspectives for the therapist[END_REF]. Hong ½Q15 and colleagues [START_REF] Apfel | Comparison of range-of-motion constraints provided by splints used in the treatment of cubital tunnel syndrome: a pilot study[END_REF] studied 12 ulnar nerves, dividing the patients into two groups. Group A was treated with nocturnal and intermittent daytime splinting, limiting elbow flexion to 35 degrees. The splint was molded to 30 to 35 degrees of elbow flexion, forearm to 10 to 20 degrees of pronation, and wrist held in neutral. At the elbow, padding was added with added space medially. Compliance was monitored closely during the course of 6 months. Group B was treated with a similar splinting regimen and local steroid injection. The follow-up duration was 6 months, and the results showed that splinting alone was sufficient for treating mild symptoms. The addition of the steroid injection did not provide any further improvement in sensory or motor conduction. After 1 month of treatment, Group A participants reported symptomatic improvement and showed improvement in motor conduction, whereas Group B participants did not show any improvement in motor conduction at that time. At 6 months, however, a significant decrease in conduction time was shown in both groups. No change in sensory conduction occurred in either group at 1 or 6 months, most likely because recovery of the sensory type Ia fibers took longer than 6 months [START_REF] Hong | Splinting and local steroid injection for the treatment of ulnar neuropathy at the elbow: clinical and electrophysiological evaluation[END_REF]. It is important to view all the findings in perspective with the natural history of untreated cubital tunnel syndrome with which approximately half of patients improve spontaneously [START_REF] Padua | Natural history of ulnar entrapment at elbow[END_REF].

Summary

Conservative therapy with splinting is an effective way to treat cubital tunnel syndrome. The variables of splinting include the type and durability of the splint and the patient's compliance. Factors such as comfort, practicality, and cosmesis play a large role in a patient's compliance with the treatment protocol [START_REF] Dimond | Cubital tunnel syndrome treated by long-term splintage. Proceedings of the 1985 American Society for Surgery of the Hand Annual Meeting[END_REF][START_REF] Apfel | Comparison of range-of-motion constraints provided by splints used in the treatment of cubital tunnel syndrome: a pilot study[END_REF][START_REF] Sailer | The role of splinting and rehabilitation in the treatment of carpal and cubital tunnel syndromes[END_REF]. Likewise, the rigidity of the splint, preventing flexion at angles beyond 90 degrees, is a very important factor in the success of the management of mild cubital tunnel syndrome. Although a consensus regarding duration of treatment, type of splinting, and degree of splinting is lacking, overall, a consistency in the support of the effectiveness of this modality in the spectrum of treatment options for cubital tunnel syndrome exists.

ARTICLE IN PRESS

SZABO & KWAK

ARTICLE IN PRESS


Florent Dewez
email: florent.dewez@outlook.com

Valentin Montmirail
email: valentin.montmirail@cril.fr

The Hill Cipher: A Weakness Studied Through Group Action Theory

Keywords: Symmetric Encryption, Hill Cipher, Mathematical Analysis, Cryptanalysis, Group Action Theory

The Hill cipher is considered as one of the most famous symmetric-key encryption algorithm: based on matrix multiplication, it has some interesting structural features which, for instance, can be exploited for teaching both cryptology and linear algebra. On the other hand, these features have rendered it vulnerable to some kinds of attack, such as the known-plaintext attack, and hence inapplicable in cases of real application. Despite this weakness, it does not stop the community proposing different upgrades for application purposes. In the present paper, we show that the Hill cipher preserves an algebraic structure of a given text and we use group action theory to study in a convenient setting some consequences of this fact, which turns out to be a potentially exploitable weakness. Indeed, our study might lead to a ciphertext-only attack requiring only that the alphabet has a prime number of characters. The main feature of this potential attack is the fact that it is not based on a search over all possible keys but rather over an explicit set of texts associated with the considered ciphertext. Group action theory guarantees that there will be, at worst, as much texts to test as keys, implying especially a better complexity.

Introduction

The Hill cipher is a relatively old polygraphic substitution cipher based on linear algebra and invented by Lester S. Hill in 1929 [START_REF] Hill | Cryptography in an Algebraic Alphabet[END_REF][START_REF] Hill | Concerning Certain Linear Transformation Apparatus of Cryptography[END_REF]. For a plaintext of M characters composed of m blocks of n characters in an alphabet with p elements, the Hill cipher considers each block as an element of the vector space (Z p ) n and multiplies each block by the same n × n invertible matrix, which is actually the secret key, to compute the whole ciphertext. As explained in the abstract, the Hill cipher is proved to be vulnerable to cryptanalysis attacks. Because of its linear nature, it suffers from the known-plaintext attack, i.e. attacker can obtain one or more plaintexts and their corresponding ciphertexts, as stated in [START_REF] Stinson | Cryptography: Theory and Practice[END_REF]. This weakness has lead to many modifications of the original version of this cipher to correct it [START_REF] Ismail | How to Repair the Hill Cipher[END_REF][START_REF] Kiele | A Tensor-Theoretic Enhancement to the Hill Cipher System[END_REF][START_REF] Saeednia | How to Make the Hill Cipher Secure[END_REF][START_REF] Mahmoud | Hill Cipher Modification Based on Eigenvalues HCM-EE[END_REF][START_REF] Toorani | A Secure Variant of the Hill Cipher[END_REF][START_REF] Toorani | A Secure Cryptosystem Based on Affine Transformation[END_REF]. Let us mention that some of these papers try to modify the Hill cipher by combining what is done in AES (Advanced Encryption Standard) [START_REF] Daemen | The Design of Rijndael: AES -The Advanced Encryption Standard[END_REF] with an interlacing approach at each iteration [START_REF] Sastry | Modified Hill Cipher with Interlacing and Iteration[END_REF].

We mention also that the most famous versions of the Hill cipher are probably the two Toorani-Falahati-Hill ciphers [START_REF] Toorani | A Secure Variant of the Hill Cipher[END_REF][START_REF] Toorani | A Secure Cryptosystem Based on Affine Transformation[END_REF]. These two versions have already been applied in many applications such as Cloud Storage [12], Image Encryption in Steganography [START_REF] Karthikeyan | An Enhanced Hill Cipher Approach for Image Encryption in Steganography[END_REF], Biometric-based Authentication [START_REF] Acharya | Privacy Protection of Biometric Traits Using Modified Hill Cipher with Involutory Key and Robust Cryptosystem[END_REF] or Software Copy Protection [START_REF] Huang | An Enhanced Hill Cipher and Its Application in Software Copy Protection[END_REF]. Nevertheless even such clever modifications, which are aimed at being applied in real situations, may be vulnerable to attacks [START_REF] Keliher | Slide Attacks Against Iterated Hill Ciphers[END_REF][START_REF] Keliher | Cryptanalysis of the Toorani-Falahati Hill Ciphers[END_REF]: this makes the research for a robust Hill cipher version interesting. We refer to [START_REF] Parmar | Hill Cipher Modifications: A Detailed Review[END_REF] for a recent detailed review of the existing modifications of the Hill cipher.

In order to perform ciphertext-only attacks, i.e. attacker can obtain one or more ciphertexts, approaches based on smart combinations between linear algebra, arithmetical and statistical arguments have been developed under the strong assumption that "the text consists of meaningful English words" with an alphabet having 26 letters [START_REF] Bauer | Cracking Matrix Encryption Row by Row[END_REF][START_REF] Yum | Cracking Hill Ciphers with Goodness-of-Fit Statistics[END_REF][START_REF] Leap | Further Improvements to the Bauer-Millward Attack On the Hill Cipher[END_REF][START_REF] Khazaei | Ciphertext-only Attack on d × d Hill in O(d × 13 d )[END_REF]. Roughly speaking, these methods consist mainly in recovering the key matrix row by row or column by column by exploiting statistical tools together with data on frequencies of occurrence of n-grams in the English language.

However, in the case of no restrictions on the considered language or alphabet, "the best publicly known ciphertext-only attack on Hill cipher requires full search over all possible secret keys", as it is recently stated in [START_REF] Khazaei | Ciphertext-only Attack on d × d Hill in O(d × 13 d )[END_REF]. In the case where p is a prime number, this brute-force tests all the p n 2 matrices since the ratio of n × n matrices that are invertible is very close to 1 in this case [START_REF] Overbey | On the Keyspace of the Hill Cipher[END_REF]Lemma 4.3]. Thus without considering any fast algorithm for matrix multiplication, such as Strassen's method [START_REF] Strassen | Gaussian Elimination is Not Optimal[END_REF] that would not lead to a significant improvement, the complexity to perform a ciphertext-only attack is O(n 3 × p n 2 ).

In view of this, we propose in the present paper to analyse an intrinsic property of the Hill cipher, which does not seem to be treated or exploited in the literature, to the best of our knowledge. We study also some of its consequences which, in particular, might create a new ciphertext-only attack or might improve existing ones. More precisely the property we focus on is the fact that the Hill cipher preserves the linear combinations of blocks of a given text. This has strong impacts on the set of ciphertexts (resp. plaintexts) which can be obtained from a given plaintext (resp. ciphertext) via the Hill encryption (resp. decryption) function, as we will show in this paper. To describe that in a explicit and rigorous way, we will employ results from group action theory. Let us also emphasise that our method requires only that the size of the alphabet is a prime number. As mentioned above, this work might lead for instance to a new ciphertext-only attack where the attacker would make an elegant search in the text-space to perform a brute-force instead of in the usual key-space, because group action theory assures that the number of plaintexts to test is smaller than the number of keys.

There exist two types of encryption, namely symmetric-key and asymmetric-key encryptions. Here we will discuss exclusively about symmetric-key encryption and we redirect you to [START_REF] Delfs | Introduction to Cryptography -Principles and Applications, Third Edition. Information Security and Cryptography[END_REF] for more information on the differences between symmetric and asymmetric-key encryptions.

Symmetric-key encryption and Hill cipher

We talk about symmetric encryption when both Alice and Bob use the same key k to encrypt and decrypt a text. They are supposed to keep their shared key secret. Alice encrypts her plaintext X with an encryption algorithm E which uses the shared key k. She then obtains a ciphertext Y = E(X, k) and sends Y to Bob. At the reception, Bob uses a decryption algorithm D and the same key k to recover the plaintext X = D(Y, k).

Definition 1 (Symmetric-key encryption schema). A schema E : K × PT → CT is called a symmetric-key encryption schema, where PT is the set of plaintexts and CT is the set of ciphertexts, if it has the property that for each key k in the key-space K, the encryption function

E k : PT → CT, X → E(k, X) is invertible. The inverse of E k is called the decryption function and is noted D k .
A security requirement for E in Def. 1 is that it should be impossible 3 to successfully execute the good decryption function D k without owning the key k. The Hill cipher is one example of a Symmetric-key encryption schema. The definition of this cipher we propose here is slightly different from the original version [START_REF] Hill | Cryptography in an Algebraic Alphabet[END_REF], but the schema stays the same.

Definition 2 (The Hill cipher). A plaintext string X of size M over an alphabet having p characters is defined as a vector of size M over Z p using an arbitrary bijection between the elements of the alphabet and the elements of Z p . The plaintext X is splitted into m blocs of size n such that X = X 1 X 2 . . . X m . An invertible n × n matrix K over Z p , called the key-matrix, is then chosen. Afterwards we construct a block diagonal matrix A whose main diagonal submatrices are equal to K. The encryption is finally performed by considering each X i as a vector of (Z p ) n and by computing the ciphertext

Y = Y 1 Y 2 . . . Y m as follows: Y = A X (mod p) ,
which is equivalent to Y i = K ×X i (mod p), for all i ∈ {1, . . . , m}. Thanks to the invertible nature of K, A is invertible as well and the decryption is performed by computing:

X = A -1 Y (mod p) .
In the case of a key K = (k ij ) of size 3 × 3, the matrix A introduced in the preceding definition is a 9 × 9 block diagonal matrix whose blocks are given by

A =               k11 k12 k13 k21 k22 k23 k31 k32 k33   03 03 03   k11 k12 k13 k21 k22 k23 k31 k32 k33   03 03 03   k11 k12 k13 k21 k22 k23 k31 k32 k33               Fig. 1. Value of A with n = 3
the key K; see Fig. 1 for an illustration of such a matrix A. We precise that each "0 3 " appearing in this figure is the null matrix of size 3×3. The Hill cipher being now defined, let us now formalise it by using the frame of Def. 1. Before that, let us precise that, for the sake of simplicity, we choose p as a prime number throughout the rest of the present paper. This implies in particular that the set Z p is the field of p elements in this case. Because of the nature of the Hill cipher, PT and CT are given by the same set (Z p ) M . Now we introduce the following set of matrices G M,n in order to define properly the key-space K:

Definition 3. Let G M,n ⊂ GL M (Z p )
, where GL M (Z p ) is the space of invertible matrices of size M × M over Z p , be the set defined as follows

A ∈ G M,n ⇐⇒ ∃ K ∈ GL n (Z p ) A =      K K . . . K     
.

Since the sets GL n (Z p ) and G M,n are clearly in bijection, we identify the keyspace K to GL n (Z p ). Putting everything together, we are in position to define the "Hill cipher map" (or "Hill cipher schema") which will be proved to be a group action in the following section.

Definition 4 (Hill cipher map). Let

H : G M,n × (Z p ) M -→ (Z p ) M be the map defined by ∀ (A, X) ∈ G M,n × (Z p ) M H(A, X) := AX .

Existing results on group action theory

In this short section, we state some results from group action theory which will furnish a convenient setting in the next section to study the Hill cipher. For the sake of clarity, we provide only the statements of the results and not their proofs, which can be found for instance in [START_REF] Smith | Introduction to Abstract Algebra[END_REF]Chapter 10]. The results presented here will be interpreted in Sec. 3 in the frame of the Hill cipher.

In the rest of the present section, the notation G will refer to a group whose group law and identity element are respectively represented by • and e.

We start by recalling the notion of a (left) group action on a set.

Definition 5 (Group action).

Let G be a group and S a set. A map ϕ : G × S -→ S is said to be a group action of G on S if and only if it satisfies the two following properties:

-

Identity: ∀ s ∈ S ϕ(e, s) = s -Compatibility: ∀ g, h ∈ G ∀ s ∈ S ϕ(g • h, s) = ϕ g, ϕ(h, s)
We define now the orbit and the stabiliser of an element s ∈ S: the orbit of s is actually the set of elements of S to which s can be sent by the elements of G while the stabiliser of s is the set of elements of the group G which do not make move s. Let us emphasise that an element s of S can not be sent outside its orbit by definition.

Definition 6 (Orbit and stabiliser). Let ϕ : G × S -→ S be a group action of a group G on a set S and let s ∈ S.

1. The orbit Orb ϕ (s) of s is defined as follows:

Orb ϕ (s) = y ∈ S ∃ g ∈ G y = ϕ(g, s) .
2. The stabiliser Stab ϕ (s) of s is defined as follows:

Stab ϕ (s) = g ∈ G ϕ(g, s) = s .
These two notions are closely related as shown in the following result: Theorem 1. Let ϕ : G × S -→ S be a group action of a group G on a set S and let s ∈ S. Then the orbit of s is isomorph to the quotient of the group G by the stabiliser of s, i.e.

Orb ϕ (s) G/Stab ϕ (s) .

Roughly speaking, this theorem claims that it is sufficient to make move s by all the elements of the group G which do not fix it to recover all the elements of the orbit of s.

A direct consequence of the preceding result in the case of finite groups, namely the cardinal of the group is finite, is the equality of the cardinal of the orbit of a given element s ∈ S with the quotient of the cardinals of the group G and of the stabiliser of s.

Corollary 1. Let ϕ : G × S -→ S be a group action of a finite group G on a set S and let s ∈ S. Then we have

Orb ϕ (s) = G Stab ϕ (s)
,

where |Z| denotes the cardinal of a given set Z.

To conclude this subsection, we mention that an action of a group G on a set S defines an equivalence relation on S whose equivalence classes are given by the orbits. Since two equivalence classes are either equal or disjoint, the set of the orbits under the action of G forms a partition of S; this is recalled in the following result: Theorem 2. Let ϕ : G × S -→ S be a group action of a group G on a set S. An illustration of the Theo. 2 is given in Fig. 2.

Orb ϕ (s 1 ) Orb ϕ (s 2 ) Orb ϕ (s 3 ) Orb ϕ (s 4 ) Orb ϕ (s 5 ) s1 ϕ(g, s1) ϕ(g • g, s1)
S g g Fig. 2. Illustration of the partition of S created by the group action ϕ

Applications of group action theory to Hill cipher

As explained in the introduction, the Hill cipher preserves the linear combinations of a given plaintext. We state this result in the following proposition:

Proposition 1. Let X = X 1 . . . X m ∈ (Z p
) M be a plaintext. Suppose that the block X i is a linear combination of q other blocks X i1 , . . . , X iq , i.e.

X i = q k=1 λ (i) k X i k , (1)
where λ

(i) k ∈ Z p . Then the i-th block of the ciphertext Y = H(A, X), with A an element of G M,n associated with a key-matrix K ∈ GL n (Z p ), satisfies Y i = q k=1 λ (i) k Y i k .
Proof. Since we have Y i = KX i for all i ∈ {1, . . . , m}, it sufficient to multiply equality (1) by K to obtain the result.

Our goal in the present section is to study some consequences of this property. Especially, we shall exhibit an algebraic structure of the text-space (Z p ) M inherited from the Hill cipher: this is actually a theoretical weakness which might be exploited to improve some attacks. In order to structure our argument, we will employ results from group action theory which have been recalled in Subsec. 2.2.

It is important to note that, the Hill cipher being a symmetric-key encryption, the results presented here can be interpreted in two ways: the relation Y = H(A, X) can describe either the encryption of the plaintext X leading to the ciphertext Y , or the decryption of a ciphertext X leading to the plaintext Y . For the sake of clarity, we will define an input text X that can be a plaintext (resp. ciphertext) and the output text Y that can be a ciphertext (resp. plaintext) if we consider an encryption (resp. decryption).

We start this section by showing that the Hill cipher map given in Def. 4 is actually a group action. This is a direct consequence of the basic properties of matrix multiplication.

Theorem 3. The Hill cipher map given in Def. 4 is a group action.

Proof. First of all, it is easy to show that the set G M,n is actually a subgroup of GL M (Z p ), so it is itself a group. Now let us prove that the map H : G M,n × (Z p ) M -→ (Z p ) M satisfies the two points of Def. 5:

-Identity. This point is clear since:

∀ X ∈ (Z p ) M H(I M , X) = I M X = X ,
where I M is the identity matrix of GL M (Z p ). -Compatibility. Let A, B ∈ G M,n and X ∈ (Z p ) M . Then, by the associativity of matrix multiplication, we have

H(AB, X) = (AB)X = A(BX) = H A, H(B, X) .
The proof is now complete.

Thanks to the preceding theorem, we are in position to apply Theo. 2 and Cor. 1 to the Hill cipher map H. As a first result, the text-space is split into orbits which are stable under the Hill cipher map; in other words, if we choose an input text and we apply the Hill cipher map to it, then the resulting output text is again in the orbit of the input text. The second result we provide gives a theoretical formula for the number of elements of a given orbit.

Corollary 2. 1. Let X, X ∈ (Z p ) M . Then we have either Orb H (X) = Orb H (X )
or Orb H (X) ∩ Orb H (X ) = ∅. 2. Let X ⊆ (Z p ) M be a set of orbit representatives, in other words a subset of texts which contains exactly one text from each orbit. Then the family Orb H (X) X∈X forms a partition of (Z p ) M . 3. For all X ∈ (Z p ) M , we have

Orb H (X) = GL n (Z p ) Stab H (X) .
Proof. Simple application of Theo. 2 and Cor. 1.

What is important to notice here is that a given input text will stay in its orbit after being encrypted (resp. decrypted) by the Hill cipher: it can not be sent to any element of the text-space, as illustrated in Fig. 2 in an abstract setting.

According to Cor. 2, the number of elements of an orbit given by an input text X depends on the cardinal of the stabiliser of X. In the following proposition, we describe explicitly the stabiliser of any input text X by exploiting the property that the Hill cipher preserves linear combinations (see Prop. 1); in particular, this will permit to derive the cardinal of the orbit of X in Cor. [START_REF] Stinson | Cryptography: Theory and Practice[END_REF].

In favour of readability, we divide the statement of the following proposition into two cases: the case of n linearly independent blocks in the input text and the case of q linearly independent blocks, where 1 q < n. In the first case, the existence of n linearly independent blocks implies that the only matrix in G M,n which does not change the input text is the identity matrix. In the second case, a matrix in the stabiliser of the input text is defined through the key-matrix K which have to be equal to the identity on the subspace generated by the q linearly independent blocks but which may be equal to anything on the complement of this subspace. Finally let us mention that we do not treat the case of the input text given by 0 (Zp) M since any matrix belonging to G M,n is in its stabiliser.

Proposition 2. Let X = X 1 . . . X m ∈ (Z p ) M \ 0 (Zp) M .
1. Suppose that there exist i 1 , . . . , i n ∈ {1, . . . , m} such that X i1 , . . . , X in are linearly independent. Then we have

Stab H (X) = {I M } .
2. Suppose that there exist q ∈ {1, . . . , n -1} and i 1 , . . . , i q ∈ {1, . . . , m} such that X i1 , . . . , X iq are linearly independent and, for each i / ∈ {i 1 , . . . , i q }, X i is a linear combination of X i1 , . . . , X iq . Then we have

A ∈ Stab H (X) ⇐⇒ A =      P KP -1 P KP -1 . . . P KP -1      , with -P = X i1 . . . X iq V q+1 . . . V n where V q+1 , . . . , V n are vectors of (Z p ) n such that X i1 , . . . , X iq , V q+1 , . . . , V n is a basis of (Z p ) n ; -K ∈ GL n (Z p ) is of the form           1 0 . . . 0 k1,q+1 . . . k1,
          . (2) Proof. Choose X = X 1 . . . X m ∈ (Z p ) M \ 0 (Zp) M .
1. Suppose that X i1 , . . . , X in are linearly independent, where i 1 , . . . , i n ∈ {1, . . . , m}. ⊇ This point is clear since I M X = X. ⊆ Let A be an element of Stab H (X); in particular, A belongs to G M,n and hence

AX = X ⇐⇒ ∀ i ∈ {1, . . . , m} KX i = X i ,
where K ∈ GL n (Z p ) is the key-matrix. Since the vectors X i1 , . . . , X in are linearly independent, the family {X i1 , . . . , X in } is a basis of (Z p ) n . Hence the linear application associated with the matrix K is equal to the application identity on a basis of (Z p ) n . Therefore we have K = I M , implying finally A = I M . 2. Assume that X i1 , . . . , X iq are linearly independent, where 1 q < n and i 1 , . . . , i q ∈ {1, . . . , m}, and that

∀ i / ∈ {i 1 , . . . , i q } ∃ λ (i) 1 , . . . , λ (i) q ∈ Z p X i = q k=1 λ (i) k X i k .
Now choose V q+1 , . . . , V n ∈ (Z p ) n such that the family X i1 , . . . , X iq , V q+1 , . . . , V n is a basis of (Z p ) n ; let us mention that such vectors exist according to the incomplete basis theorem [START_REF] Artin | Algebra. Advanced Mathematics Series edn[END_REF]Proposition 3.15]. Hence the matrix P defined in the statement of Prop. 2 is invertible and satisfies for all k ∈ {1, . . . , q},

P E k = X i k ⇐⇒ P -1 X i k = E k , (3)
where E k is the k-th vector of the canonical basis of (Z p ) n . Furthermore, for a given matrix K of the form (2), the following relation is true for each k ∈ {1, . . . , q}, P KP -1

X i k = P KE k = P E k = X i k . ( 4
)
Then we deduce that, for all i / ∈ {i 1 , . . . , i q },

P KP -1 X i = P KP -1 q k=1 λ (i) k X i k = q k=1 λ (i) k P KP -1 X i k = q k=1 λ (i) k X i k = X i .
(5) We are now in position to prove the equivalence stated in Prop. 2.2.

⇐ If a matrix A ∈ G M,n is given by A =      P KP -1 P KP -1 . . . P KP -1      ,
where K is an invertible matrix of the form (2), then A satisfies

AX =      P KP -1 P KP -1 . . . P KP -1           X 1 X 2 . . . X m      =      X 1 X 2 . . . X m      = X ,
according to the relations (4) and ( 5). This proves that A ∈ Stab H (X). ⇒ Let A ∈ G M,n be an element of the stabiliser of X. It follows

∀ k ∈ {1, . . . , q} KX i k = X i k ,
where K ∈ GL n (Z p ) is the key-matrix. Hence, by using relation (3), we obtain ∀ k ∈ {1, . . . , q}

P -1 KP E k = E k .
We observe then that the matrix K := P -1 KP is of the form (2) and is invertible since K ∈ GL n (Z p ). This finally proves that

A =      P KP -1 P KP -1 . . . P KP -1      .
As a consequence of the preceding result, we are able to give the cardinal of the orbit of any input text, i.e. the number of texts which can be attained from this input. We note that this cardinal depends actually only on the number of linearly independent blocks of the input text according to Prop. 2.

The proof of the following corollary consists in a combination of the preceding result, which permits to determine the cardinal of the stabiliser of a given input text, with Cor. 2.

Corollary 3. Let X = X 1 . . . X m ∈ (Z p ) M \ 0 (Zp) M .
1. Suppose that there exist i 1 , . . . , i n ∈ {1, . . . , n} such that X i1 , . . . , X in are linearly independent. Then we have

Orb H (X) = n-1 k=0 p n -p k .
2. Suppose that there exist q ∈ {1, . . . , n -1} and i 1 , . . . , i q ∈ {1, . . . , m} such that X i1 , . . . , X iq are linearly independent and, for each i / ∈ {i 1 , . . . , i q }, X i is a linear combination of X i1 , . . . , X iq . Then we have

Orb H (X) = q-1 k=0 p n -p k .
Proof. First of all, let us recall that the cardinal of GL n (Z p ) is given by

GL n (Z p ) = n-1 k=0 p n -p k .
1. According to Prop. 2.1, we have in the present case

Stab H (X) = {I M } .
Hence Stab H (X) = 1 and, by employing Cor. 2.2, we obtain

Orb H (X) = GL n (Z p ) Stab H (X) = n-1 k=0 p n -p k 1 = n-1 k=0 p n -p k . 2.
As above, we determine first the cardinal of Stab H (X) in the present case, which is actually equal to the number of invertible matrices of the form (2), namely

              1
              =   I q K 1,2 0 K 2,2   .
Such a matrix being invertible, the sub-matrix K 2,2 is invertible as well; hence we have n-q-1 k=0

p n-q -p k choices for the sub-matrix K 2,2 . Once this sub-matrix is fixed, it remains to choose K 1,2 , which does not have any restriction: thus there are p q(n-q) choices for the sub-matrix K 1,2 . Consequently, we obtain

Stab H (X) = p q(n-q) n-q-1 k=0 p n-q -p k = n-q-1 k=0 p n -p k+q .
Finally, by using Cor. 2.2, it follows

Orb H (X) = n-1 k=0 p n -p k n-q-1 k=0 p n -p k+q = n-1 k=0 p n -p k n-1 k=q p n -p k = q-1 k=0 p n -p k .
The preceding corollary shows that the number of elements of an orbit given by an input text is always smaller than the number of elements in the key-space GL n (Z p ). Theoretically this means that if we consider an oracle able to answer in O(1) whether a matrix is the key or whether a text is the corresponding plaintext of the considered ciphertext, then performing an exhaustive search on the key-space would be in O n-1 k=0 (p n -p k ) whereas performing an exhaustive search on the text-space would be in O q-1 k=0 (p n -p k ) with q ≤ n (q being the number of linearly independent blocks in the ciphertext).

In the last result of this paper, we provide an explicit description of the orbit of a given input text which might help to improve some attacks. To do so, we use once again the fact the Hill cipher preserves linear combinations; see Prop. 1.

Let us mention that we use Cor. 3 to prove the following theorem. Nevertheless it seems to be possible to prove this theorem without employing the preceding results and group action theory. We emphasize that we have chosen to study the Hill cipher via group action theory to obtain a convenient setting which makes clear the effects of this cipher on texts. We hope that our approach may be exploited for educational purposes.

As previously, we distinguish two cases for the sake of readability and we do not treat the case of the input text given by 0 (Zp) M since its orbit is equal to the singleton {0 (Zp) M }.

Theorem 4. Let X = X 1 . . . X m ∈ (Z p ) M \ 0 (Zp) M .
1. Suppose that there exist i 1 , . . . , i n ∈ {1, . . . , m} such that X i1 , . . . , X in are linearly independent; in particular, we have

∀ i / ∈ {i 1 , . . . , i n } ∃ λ (i) 1 , . . . , λ (i) n ∈ Z p X i = n k=1 λ (i) k X i k . Then Y = Y 1 . . . Y m ∈ (Z p ) M belongs
∀ i / ∈ {i 1 , . . . , i n } Y i = n k=1 λ (i) k Y i k .
2. Suppose that there exist 1 q < n and i 1 , . . . , i q ∈ {1, . . . , m} such that X i1 , . . . , X iq are linearly independent and

∀ i / ∈ {i 1 , . . . , i q } ∃ λ (i) 1 , . . . , λ (i) q ∈ Z p X i = q k=1 λ (i) k X i k . Then Y = Y 1 . . . Y m ∈ (Z p ) M belongs
∀ i / ∈ {i 1 , . . . , i q } Y i = q k=1 λ (i) k Y i k .
Proof. Choose X = X 1 . . . X m ∈ (Z p ) M \ 0 (Zp) M and suppose that there exist 1 q n and i 1 , . . . , i q ∈ {1, . . . , m} such that X i1 , . . . , X iq are linearly independent and

∀ i / ∈ {i 1 , . . . , i q } ∃ λ (i) 1 , . . . , λ (i) q ∈ Z p X i = q k=1 λ (i) k X i k .
For the sake of readability, we define the set

E q (X) :=      Y = Y 1 . . . Y m ∈ (Z p ) M      Y i1 , . . . , Y iq are linearly independent ∀ i / ∈ {i 1 , . . . , i q } Y i = q k=1 λ (i) k Y i k      .
1. This point is equivalent to Orb H (X) = E n (X). To show this equality, we prove an inclusion and the equality between the two cardinals.

⊆ Let Y = Y 1 . . . Y m ∈ (Z p )
M be an element of Orb H (X). Then, by definition, there exists A ∈ G M,n such that

Y = AX ⇐⇒ ∀ i ∈ {1, . . . , m} Y i = KX i ,
where K is the key-matrix. As an immediate consequence of the linear independence of X i1 , . . . , X in , the vectors Y i1 , . . . , Y in are linearly independent, and by Prop. 1, we have

∀ i / ∈ {i 1 , . . . , i n } Y i = n k=1 λ (i) k Y i k .
This shows that Orb H (X) is included in E n (X). = We remark that the cardinal of the set E n (X) is actually equal to the number of linearly independent families of n vectors belonging to (Z p ) n , that is to say the number of matrices in GL n (Z p ). Hence

E n (X) = GL n (Z p ) = n-1 k=0 p n -p k .
And according to Cor. 3.1, we have

Orb H (X) = n-1 k=0 p n -p k ,
showing that Orb H (X) = E n (X) and so Orb H (X) = E n (X). 2. In the present case, we prove Orb H (X) = E q (X), with 1 q < n. To do so, we proceed as previously. ⊆ It is sufficient to follow the same arguments as those employed in the preceding point.

= The cardinal of the set E q (X) is given by the number of linearly independent families of q vectors belonging to (Z p ) n : this number is equal to q-1 k=0 p n -p k .

We employ then Cor. 3.2 to show that Orb H (X) and E q (X) have the same cardinal, proving that Orb H (X) = E q (X).

Conclusion

In this paper, we exhibit the property that the Hill cipher preserves linear combinations of blocks in a text, implying a potential weakness. We employ the convenient framework of group action theory to study the consequences of this weakness, such a work being eventually exploitable for educational purposes. Thanks to the partition of the text-space caused by the Hill cipher, we show that the set of accessible output texts (orbit) of a given input text has at worst the same size as the one of all invertible matrices. We show also that, for a given text, there exists a set of matrices that make the text unchanged (stabiliser) via the Hill cipher. Consequently, in certain cases, there are redundant computations when one performs an exhaustive search in the key-space.

To finish, let us talk briefly about the outlook. To remove the only condition that we need in our study, we would like to generalise our approach to an alphabet whose size is not necessarily a prime number, similarly to what was done for the key-space in [START_REF] Overbey | On the Keyspace of the Hill Cipher[END_REF]. Moreover, it could be interesting to use our knowledge of the orbits to improve the security of the Hill cipher. For instance, one may think that making permutations in the key-matrix would create a new partition of the textspace whose orbits would be bigger than the original ones. On the other hand, we hope that our results might improve some existing attacks, even lead to a ciphertext-only attack performing an elegant search of the orbit of a ciphertext. Finally a last idea would be to adapt our approach to the latest modified versions of the Hill cipher, such as the two Toorani-Falahati-Hill ciphers [START_REF] Toorani | A Secure Variant of the Hill Cipher[END_REF][START_REF] Toorani | A Secure Cryptosystem Based on Affine Transformation[END_REF], to bring better understanding of these versions, even some improvements.

1 .

 1 Let s, t ∈ S. Then we have either Orb ϕ (s) = Orb ϕ (t) or Orb ϕ (s)∩Orb ϕ (t) = ∅. 2. Let R ⊆ S be a set of orbit representatives, in other words a subset of S which contains exactly one element from each orbit. Then the family Orb ϕ (s) s∈R forms a partition of S.

  to Orb H (X) if and only if Y i1 , . . . , Y iq are linearly independent and