Enrico Carlini

AND Maria Virginia Catalisano
email: catalisano@diptem.unige.it

Alessandro Oneto
email: alessandro.oneto@inria.fr

WARING LOCI AND THE STRASSEN CONJECTURE

come   L'archive ouverte pluridisciplinaire

Introduction

Let S = C[x 0 , . . . , x n ] = i≥0 S i be the standard graded polynomial ring. An element in S i , that is a degree i homogeneous polynomial, is called a form. A Waring decomposition, also called a sum of powers decomposition, of F ∈ S d is an expression of the form F = L d 1 + . . . + L d r , for linear forms L i ∈ S 1 . The Waring rank, or simply rank, of F is rk(F ) = min{r : F = L d 1 + . . . + L d r , L i ∈ S 1 for 1 ≤ i ≤ r}, and we say that a Waring decomposition of F is minimal if it involes rk(F ) summands. In the last decades, an intense research activity focused on computing Waring ranks and (minimal) Waring decompositions of homogeneous polynomials. A celebrated result in this field is due to J.Alexander and A.Hirschowitz who determined the rank of a generic form [START_REF] Alexander | Polynomial interpolation in several variables[END_REF], but still very little is known for given specific forms. The main abstract tools to deal with Waring ranks are in [START_REF] Landsberg | On the ranks and border ranks of symmetric tensors[END_REF][START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF]. One of the main reason for the great interest in Waring ranks and Waring decompositions is due to the relations with the theory of symmetric tensors and their decompositions as sums of rank one tensors which have applications in Algebraic Statistics, Biology, Quantum Information Theory and more, see [START_REF] Landsberg | Tensors: Geometry and applications[END_REF]. In this paper we investigate minimal Waring decompositions. Of particular interest are the cases when the minimal Waring decomposition is unique, called in the literature the identifiable cases, see [START_REF] Chiantini | On the concept of k-secant order of a variety[END_REF][START_REF] Mella | Singularities of linear systems and the Waring problem[END_REF][START_REF] Mella | Base loci of linear systems and the Waring problem[END_REF][START_REF] Bocci | Refined methods for the identifiability of tensors[END_REF][START_REF] Chiantini | On generic identifiability of symmetric tensors of subgeneric rank[END_REF][START_REF] Galuppi | Identifiability of homogeneous polynomials and Cremona transformations[END_REF]. Since finding a minimal Waring decomposition is usually beyond our computational capabilities, we decide to investigate properties of all minimal Waring decompositions of a given form at once. Definition 1.1. Given a form F , we define the Waring locus of F as the set of linear forms that appear, up to scalar, in a minimal Waring decomposition of F , namely W F = {[L] ∈ P(S 1 ) : ∃L 2 , . . . , L r ∈ S 1 , F ∈ L d , L d 2 , . . . , L d r , r = rk(F )}. We define the locus of forbidden points as its complement, F F = P(S 1 ) \ W F .

1

In [START_REF] Ballico | Sets computing the symmetric tensor rank[END_REF], the authors suggested the importance of the study of the Waring loci of homogeneous polynomials. In particular, they proved that W F has no isolated points if F ∈ S d is not identifiable and if rk(F ) < 3d 2 . One of our main result is a description of W F , or equivalently of F F , in the following cases:

(1) quadrics, that is degree two forms, see Corollary 3.2;

(2) monomials, see Theorem 3.3;

(3) binary forms, that is forms in two variable, see Theorem 3.5; (4) plane cubics, that is degree three forms in three variables, see Section 3.4;

(5) sums of particular families of homogeneous polynomials in different set of variables, see Theorem 4.6 and Section 5.

In Section 2, we introduce the basics facts and our main tool: the Apolarity Lemma, Lemma 2.1. The Apolarity Lemma provides a very explicit recipe to find Waring decompositions of an homogeneous polynomials F . In particular, it states that Waring decompositions of F corresponds to ideals of reduced points contained in the ideal F ⊥ , namely the ideal of polynomials annihilating F by acting as differentials. The reason why we succeeded in finding Waring loci in the cases listed above is that those are the cases when we can give a very precise description of all the possible minimal set of reduced points contained in the annihilating ideals. In Section 3, we present our main results about Waring loci. In Section 4, we discuss relations with Strassen's conjecture. In Section 5, we present some more technical results and open problems.

Acknowledgment. The authors want to thank Jaros law Buczyński and Brian Harbourne for comments on an earlier version of the paper. The first and second author are members of GNSAGA of INDAM. The third author wants to thank the first author and the School of Mathematical Sciences, Monash University, for the hospitality during a visit of three months while the work has been mostly done. The visit has been partially supported by G S Magnuson Foundation from Kungliga Vetenskapsakademien.

Basics

We introduce some basic notions on Apolarity theory, see also [START_REF] Iarrobino | Power sums, Gorenstein algebras, and determinantal loci[END_REF][START_REF] Geramita | Inverse systems of fat points: Waring's problem, secant varieties of veronese varieties and parameter spaces for gorenstein ideals[END_REF]. We consider two polynomial rings S = C[x 0 , . . . , x n ] = i≥0 S i and T = C[X 0 , . . . , X n ] = i≥0 T i with standard gradation, where S has the structure of a T -module via differentiation; namely, we consider the apolarity action given by

g • F = g(∂ x 0 , . . . , ∂ xn )F, for g ∈ T, F ∈ S.
Given F ∈ S d we define the apolar ideal of F as

F ⊥ = {∂ ∈ T : ∂ • F = 0}.
We say that F ∈ C[x 0 , . . . , x n ] essentially involves t + 1 variables if dim(F ⊥ ) 1 = n -t. In other words, if F essentially involves t + 1 variables, there exist linear forms l 0 , . . . , l t ∈ C[x 0 , . . . , x n ] such that F ∈ C[l 0 , . . . , l t ], see [START_REF] Carlini | Reducing the number of variables of a polynomial[END_REF]. We are interested in describing the minimal Waring decompositions of a form F ∈ S d and our main tool is the following.

Lemma 2.1 (Apolarity Lemma). Let X = {P 1 , . . . , P s } ⊂ P n be a set of reduced points where

P i = [p (i) 0 : . . . : p (i) n ]
, for all i = 1, . . . , s, and let

L i = p (i) 0 x 0 + . . . + p (i) n x n , for all i = 1, . . . , s.
Then, if F is a degree d homogeneous polynomial, the following are equivalent:

(1)

I X ⊂ F ⊥ ; (2) F = c 1 L d 1 + . . . + c s L s , for c 1 , . . . , c s ∈ C.
A set of points X such that the conditions of Apolarity Lemma hold is said to be apolar to F .

Example 2.2. Consider the monomial M = xyz ∈ C[x, y, z]. It is easy to check that M ⊥ = (X 2 , Y 2 , Z 2 ). Hence the ideal I = (X 2 -Y 2 , X 2 -Z 2 ) ⊂ F ⊥ corresponds
to the four reduced points [1 : ±1 : ±1] and we have the Waring decomposition

M = 1 24 (x + y + z) 3 -(x -y + z) 3 -(x + y -z) 3 + (x -y -z) 3 .
We can describe the Waring locus of a form F in terms of the apolar points to F , namely

W F = {P ∈ P n : P ∈ X, I X ⊂ F ⊥ and |X| = rk(F )}.
The following result, also given in [START_REF] Buczyński | Ranks of tensors and a generalization of secant varieties[END_REF] in the case of tensors, allows us to study a form F in the ring of polynomials with the smallest number of variables. In particular, we want to show that, if F ∈ C[y 0 , . . . , y m ] essentially involves n + 1 variables and X is a minimal set of points apolar to F , then X ⊂ P m is contained in a n-dimensional linear subspace of P m . Hence, W F ⊂ P n contains all points belonging to any minimal set of points apolar to F .

Proposition 2.3. Let F ∈ C[x 0 , . . . , x n , x n+1 , . . . , x m ] be a degree d form such that (F ⊥ ) 1 = (X n+1 , . . . , X m ). If F = r 1 L d i
where r = rk(F ) and the L i are linear forms in C[x 0 , . . . , x n , x n+1 , . . . , x m ], then

L i ∈ C[x 0 , . . . , x n ] ⊂ C[x 0 , . . . , x n , x n+1 , . . . , x m ] for all i, 1 ≤ i ≤ r.
Proof. We proceed by contradiction. Assume that L 1 = x n+1 + i =n+1 a i x i , that is to assume that L 1 actually involves the variable x n+1 . By assumption rk(F -L d 1 ) < r = rk(F ). However, since L 1 is linearly independent with x 1 , . . . , x n we can apply the following fact (see [START_REF] Carlini | Progress on the symmetric strassen conjecture[END_REF]Proposition 3

.1]): if y is a new variable, then rk(F + y d ) = rk(F ) + 1.
Hence, rk(F -L d 1 ) = rk(F ) + 1 and this is a contradiction. Remark 2.4. Using the previous result, performing a linear change of variables, and restricting the ring, we may always assume that F ∈ S d essentially involves n + 1 variables; hence, we always see W F and F F as subsets of P n .

Waring loci

In this section, we give our results about W F and F F .

3.1. Quadrics. We begin with the study of elements of S 2 , i.e. quadrics in P n . We recall that to each quadric Q we can associate a symmetric (n + 1) × (n + 1) matrix A Q and that rk(Q) equals the rank of

A Q . Proposition 3.1. If Q = x 2 0 + . . . + x 2 n , then F Q = V ( Q) ⊂ P n , where Q = X 2 0 + . . . + X 2 n ∈ T 2 .
Proof. A point P = [a 0 : . . . : a n ] is a forbidden point for Q if and only if

rk(Q -λL 2 P ) = n + 1, for all λ ∈ C
where L P = n 0 a i x i . Thus, P is a forbidden point for Q if and only if the symmetric matrix corresponding to the quadratic form Q -λL 2 P has non-zero determinant for all λ ∈ C. Thus, P is a forbidden point if and only if the symmetric matrix A L 2 corresponding to L 2 only have zero eigenvalues (note that, over C, A L 2 is not necessarily similar to a diagonal matrix). We now prove that A L 2 only have zero eigenvalues if and only if n 0 a 2 i = 0. Assume that zero is the only eigenvalue of A L 2 . Let a = ( a 0 . . . a n ) and note that

aA L 2 = (a 2 0 + . . . + a 2 n )a,
thus n 0 a 2 i = 0 since it is an eigenvalue. Now assume that n 0 a 2 i = 0. Note that

A 2 L 2 = n 0 a 2 i A L 2 .
thus A 2 L 2 = 0 and hence zero is the only eigenvalue. Hence, P is a forbidden point if and only if n 0 a 2 i = 0 and the proof is now completed.

Corollary 3.2. Let Q(x 0 , . . . , x n ) ∈ S 2 be a rank n + 1 quadric and let B be an (n + 1) × (n + 1) matrix such that the change of variables

(x 0 , . . . , x n ) = (y 0 , . . . , y n )B gives Q = y 2 0 + . . . + y 2 n . Then, F Q = V ( Q) ⊂ P n , where Q(X 0 , . . . , X n ) is the quadratic form (X 0 . . . X n )B t B(X 0 . . . X n ) t .
Proof. Let P = [a 0 : . . . : a n ] and L P = n 0 a i x i = (a 0 , . . . , a n )(x 0 , . . . , x n ) t . By the the linear change of variables (x 0 , . . . , x n ) = (y 0 , . . . , y n )B, we get

L P = (a 0 , . . . , a n )B t (y 0 , . . . , y n ) t . Let (a 0 , . . . , a n )B t = (b 0 , . . . , b n ), so that L P = b 0 y 0 + • • • + b n y n . Using Proposition 3.1 we know that a point [b 0 : . . . : b n ] ∈ F Q(y 0 ,...,yn) if and only if b 2 i = 0. That is, (a 0 , . . . , a n )B t B(a 0 , . . . , a n ) t = 0.
and the result follows.

3.2. Monomials. In this section, we consider monomials x d 0 0 . . . x dn n ∈ C[x 0 , . . . , x n ]. We always assume that the exponents are increasingly ordered, that is d 0 ≤ . . . ≤ d n . In [START_REF] Carlini | The solution to the Waring problem for monomials and the sum of coprime monomials[END_REF], the authors proved an explicit formula for the Waring rank of monomials, i.e. rk(x d 0 0 . . .

x dn n ) = 1 d 0 + 1 n i=0 (d i + 1).
We also know from [START_REF] Buczyńska | Waring decompositions of monomials[END_REF] that minimal sets of apolar points to monomials are complete intersections, namely they are given by the intersection of n hypersurfaces in P n of degrees d 1 +1, . . . , d n +1 intersecting properly. Moreover, it is known that, using our new terminology, the points lying on the hyperplane {X i = 0}, for i = 0, . . . , m, where m = max{i | d i = d 0 } are forbidden. This is implicitly proved during the proof of [CCG12, Proposition 3.1] and can also be found in [START_REF] Buczyńska | Waring decompositions of monomials[END_REF]Corollary 19]. Here, we prove that these are actually the only forbidden points of monomials.

Theorem 3.3. If M = x d 0 0 • • • x dn n ∈ S , then F M = V (X 0 • • • X m ) ⊂ P n , where m = max{i | d i = d 0 }. Proof. The perp ideal of M is M ⊥ = (X d 0 +1 0 , . . . , X dn+1 n
). Consider any point P = [p 0 : . . . :

p n ] / ∈ V (X 0 • • • X m ),
we may assume p 0 = 1 and we will prove that P ∈ W M , that is P ∈ F M . We construct the following hypersurfaces in P n

H i =      X d i +1 i -p d i +1 i X d i +1 0 if p i = 0; X d i +1 i -X i X d i 0 if p i = 0.
Note that, for any i = 1, . . . , n, the hypersurface H i = 0 is the union of d i + 1 hyperplanes. The ideal I = (H 1 , . . . , H n ) is contained in M ⊥ and V (I) is the set of reduced points [1 : q 1 : . . . : q n ] where

q i ∈      {ξ j i p i | j = 0, . . . , d i }, if p i = 0, where ξ d i +1 i = 1; {ξ j i | j = 0, . . . , d i -1} ∪ {0}, if p i = 0
, where ξ d i i = 1. Thus, we have a set of rk(M ) distinct points apolar to M and containing the point P ; hence,

P ∈ W M and V (X 0 • • • X m ) ⊃ F M .
To conclude the proof we need to prove that Remark 3.4. In the case d 0 ≥ 2, the second part of the proof can be explained as a direct consequence of the formula for the rank of monomials. Indeed, in the same notations as Theorem 3.3, for any i = 1, . . . , m, we have that rk(M ) = rk(∂ x i • M ). Therefore, given any minimal Waring decomposition of M = r j=1 L d j , by differentiating both sides, we must have

V (X 0 • • • X m ) ⊂ F M
∂ x i • L j = 0 for all i = 1, . . . , m. Hence [L j ] / ∈ V (X 0 • • • X m ).
3.3. Binary forms. In this section we deal with the case n = 1, that is the case of forms in two variables. The knowledge on the Waring rank of binary forms goes back to J.J. Sylvester [START_REF] Sylvester | Lx. on a remarkable discovery in the theory of canonical forms and of hyperdeterminants[END_REF].

It is known that, if F ∈ C[x, y] d , then F ⊥ = (g 1 , g 2 ) and deg(g 1 ) + deg(g 2 ) = d + 2. Moreover, if we assume d 1 = deg(g 1 ) ≤ d 2 = deg(g 2 ), then rk(F ) = d 1 if g 1 is square free and rk(F ) = d 2 otherwise.
See [START_REF] Comas | On the rank of a binary form[END_REF] for more about the rank of binary forms.

Theorem 3.5. Let F be a degree d binary form and let g ∈ F ⊥ be an element of minimal degree. Then, (1

) if rk(F ) < d+1 2 , then W F = V (g); (2) if rk(F ) > d+1 2 , then F F = V (g); (3) if rk(F ) = d+1 2 and d is even, then F F is finite and not empty; if rk(F ) = d+1 2 and d is odd, then W F = V (g).
Proof. (1) It is is enough to note that the decomposition of F is unique and the unique apolar set of points is V (g).

(2) As mentioned above, in this case we have that F ⊥ = (g 1 , g 2 ), where

d 1 = deg(g 1 ) < deg(g 2 ) = d 2 , d 1 + d 2 = d + 2
, g 1 is not square free, and rk(F ) = d 2 . In particular, g 1 is an element of minimal degree in the apolar ideal. We first show that F F ⊇ V (g 1 ). Let P = V (l) ∈ V (g 1 ) for some linear form l, that is l divides g 1 . We want to show that there is no apolar set of points to F containing P . Thus, it is enough to show that there is no square free element of degree d 2 in F ⊥ divisible by l. Since g 1 and g 2 have no common factors, and l divides g 1 , it follows that the only elements of degree d 2 in F ⊥ divisible by l are multiples of g 1 , thus they are not square free. Hence, P ∈ F F . We now prove that F F ⊆ V (g 1 ) by showing that, if P = V (l) ∈ V (g 1 ), then P ∈ W F . Note that l does not divide g 1 and consider

F ⊥ : (l) = (l • F ) ⊥ = (h 1 , h 2 )
where

c 1 = deg(h 1 ), c 2 = deg(h 2 ) and c 1 + c 2 = d + 1. Since h 1 is a minimal degree element in F ⊥ and l does not divide g 1 , we have h 1 = g 1 and c 2 = d 2 -1. Thus rk(F ) = rk(l • F ) + 1. Since (F ⊥ : (l)) d 2 -1
is base point free, we can choose h ∈ F ⊥ : (l) to be a degree d 2 -1 square free element not divisible by l. Hence, P ∈ V (lh) and V (lh) is a set of d 2 points apolar to F .

(3) Let F ⊥ = (g 1 , g 2 ), d 1 = deg(g 1 ), and

d 2 = deg(g 2 ). If d is odd, then d 2 = d 1 +1 and rk(F ) = d 1 ;
thus g 1 is a square free element of minimal degree and F has a unique apolar set of d 1 distinct points, namely V (g 1 ). This proves the d odd case. If d is even, then d 1 = d 2 = rk(F ) and F has infinitely many apolar sets of rk(F ) distinct points. However, for each P ∈ P 1 there is a unique set of rk(F ) points (maybe not distinct) apolar to F and containing P . That is, there is a unique element (up to scalar) g ∈ (F ⊥ ) d 1 vanishing at P . Thus, P ∈ F F if and only if g is not square free. There are finitely many not square free elements in (F ⊥ ) d 1 since they correspond to the intersection of the line given by (F ⊥ ) d 1 in P(T d 1 ) with the hypersurface given by the discriminant; note that the line is not contained in the hypersurface since (F ⊥ ) d 1 contains square free elements.

Remark 3.6. We can provide a geometric interpretation of Theorem 3.5 for F a degree d binary form of rank d, the maximal possible. In this case, after a change of variables, we can assume F = xy d-1 . To see geometrically that [0 : 1] ∈ F F , we consider the point [y d ] on the degree d rational normal curve of P d . Note that [F ] belongs to the tangent line to the curve in [y d ]. Thus, it is easy to see that there does not exist a hyperplane containing [F ] and [y d ] and cutting the rational normal curve in d distinct points. To prove geometrically that F F = {[0 : 1]} one can argue using Bertini's theorem. However, for forms of lower rank, we could not find a straightforward geometrical explanation.

We can improve part (3) of Theorem 3.5 for d even adding a genericity assumption.

Proposition 3.7. Let d = 2h. If F ∈ S d is a generic form of rank h + 1, then F F is a set of 2h 2 distinct points.
Proof. Let ∆ ⊂ P h+1 be the variety of degree h + 1 binary forms having at least a factor of multiplicity two. Note that forms having higher degree factors, or more than one repeated factor, form a variety of codimension at least one in ∆. In particular, a generic line L will meet ∆ in deg ∆ distinct points each point corresponding to a form of the type B 2 1 B 2 . . . B h and B i is not proportional to B j if i = j. Now, recall the well-known Macaulay's duality between artinian Gorenstein algebras A F S/F ⊥ of socle degree d and homogeneous forms of degree d. For a generic F ∈ S d we have F ⊥ = (g 1 , g 2 ) where deg(g 1 ) = deg(g 2 ) = h+1. Therefore, we have that a generic form F determines a generic line in P h+1 and viceversa. The non square free elements of (F ⊥ ) h+1 corresponds to L∩∆ where L is the line given by (F ⊥ ) h+1 . By genericity, L ∩ ∆ consists of exactly deg(∆) points each corresponding to a degree h + 1 form f i having exactly one repeated factor of multiplicity two. Since every two elements in (F ⊥ ) h+1 have no common factors, it follows that

F F = i V (f i )
is a set of h deg(∆) distinct points. Since deg(∆) = 2h, the result is now proved.

We can also iterate the use of Theorem 3.5 to construct a Waring decomposition for a given binary form. Let F ∈ S d with rank r ≥ d+1 2 , so that the Waring decomposition is not unique, we can think of constructing such a decomposition one addend at the time. From our result, we know that in this case the forbidden locus is a closed subset F F = V (g) where g is an element in F ⊥ of minimal degree; hence, we can pick any point [L 1 ] in the open set P 1 \ V (g) to start our Waring decomposition of F . This means that there exists λ 1 ∈ C such that

F 1 = F -λ 1 L d
1 has rank one less than the rank of F . If the rank of F 1 is still larger than d+1 2 , we can proceed in the same way as before. We may observe that

F F 1 = F F ∪ [L 1 ]. Indeed, by Theorem 3.5, F F 1 = V (g 1 )
, where g 1 is an element of minimal degree of F ⊥ 1 . Since rk(F 1 ) = rk(F ) -1, we have that deg(g 1 ) = deg(g) + 1, in particular it has to be g 1 = gL ∨ 1 , where L ∨ 1 is the linear differential operator annihilating L 1 . Hence, we can continue to construct our decomposition for F by taking any point general smooth (a 3 = -27, 0, 6 3 ) x 3 + y 3 + z 3 + axyz 4 Theorem 3.16 (10) line + tangent conic x(xy + z 2 ) 5 Theorem 3.18 Note. In case (9), a 3 = 0, 6 3 so that the rank is actually 4 and a 3 = -27 for smoothness of the Hessian canonical form [START_REF] Dolgachev | Classical algebraic geometry: a modern view[END_REF].

[L 2 ] ∈ P 1 \ V (g 1 ) and a suitable λ 2 ∈ C such that F 2 = F -λ 1 L d 1 -λ 2 L d 2 has rank equal to rk(F ) -2.
Remark 3.9. We have already analyzed several cases:

(1),(3),(5): they are monomials and it follows from Theorem 3.3;

(2): these forms can be seen as forms in two variables, hence it follows from Theorem 3.5(3); (4): smooth plane cubics can be seen as sums of pairwise coprime monomials with high exponents which are analyzed separately in the next section, see Theorem 4.6; (8): plane cubic cusps can be seen as the kind of sums of pairwise coprime monomials that we have analyzed in Theorem 5.1.

We now study plane cubics of rank four. First, we need the following lemma.

Lemma 3.10. Let F be a plane cubic of rank four and let X be a set of four distinct points apolar to F . If X has exactly three collinear points, then F is a cusp, that is F is of type (8).

Proof. We can assume that the three collinear points lie on the line defined by X and the the point not on the line is [1 : 0 : 0]. Thus, XY, XZ ∈ F ⊥ and F = x 3 + G(y, z). By [CCC15a, Proposition 3.1] we have that rk(F ) = 1 + rk(G) and thus rk(G) = 3. Since all degree three binary cubics of rank three are monomials we get that, after a change of variables, G can be written as LM 2 , where L, M ∈ C[y, z] are linear forms. Hence, F = x 3 + LM 2 and this completes the proof.

Among the rank 4 plane cubics, we have already analyzed the cusps. Now, we consider families (6),( 7) and (9). Due to Lemma 3.10, we can actually study these families using the approach described in the following remark.

Remark 3.11. Let F be a rank four plane cubic which is not a cusp. Since F is not a binary form, L = (F ⊥ ) 2 is a net of conics and we let L = C 1 , C 2 , C 3 . Since F is not a cusp, all set of four points apolar to F are the complete intersection of two conics. Thus, when we look for minimal Waring decompositions of F , we only need to look at pencils of conics contained in L with four distinct base points. In particular, fixing a point P ∈ P 2 , we can consider the pencil L(-P ) of plane conics in L passing through P . If L(-P ) has four distinct base points, then P ∈ W F ; otherwise, we have that the base locus of L(-P ) is not reduced and P ∈ F F . In the plane P(L), we consider the degree three curve ∆ of reducible conics in L. We recall that a pencil of conics L has four distinct base points, no three of them collinear, if and only if the pencil contains exactly three reducible conics. In conclusion, given a point P ∈ P 2 , we consider the line P(L(-P )) ⊂ P(L): if the line is a proper secant line of ∆, that is it cuts ∆ in three distinct points, we have that P ∈ W F ; otherwise, P ∈ F F . Thus we have to study the dual curve ∆ ⊂ P(L) of lines not intersecting ∆ in three distinct points. An equation for ∆ can be found with a careful use of elimination. To explicitly find F F we the consider the map:

φ : P(S 1 ) -→ P(L) such that φ([a : b : c]) = [C 1 (a, b, c) : C 2 (a, b, c) : C 3 (a, b, c)].
Note that φ is defined everywhere and that it is generically 4 : 1. In particular,

F F = φ -1 ( ∆).
Theorem 3.12.

If F = x(yz + x 2 ), then F F = V (XY Z(X 2 -12Y Z)). Proof. Let L = (F ⊥ ) 2 and let C 1 : C 1 = X 2 -6Y Z = 0, C 2 : C 2 = Y 2 =
0, and C 3 : C 3 = Z 2 = 0 be the conics generating L. In the plane P(L) with coordinate α, β and γ, let ∆ be the cubic of reducible conics in L. By computing we get the following equation for ∆:

det   α 0 0 0 β -3α 0 -3α γ   = 0,
that is, αβγ -9α 3 = 0. In this case, ∆ is the union of the conic C : 9α 2 -βγ = 0 and the secant line r : α = 0. The line r corresponds to L(-[1 : 0 : 0]) and then, by Remark 3.11, we have that [1 : 0 : 0] ∈ F F . By Remark 3.11, in order to completely describe F F , we have to study two family of lines in P(L): the tangents to the conic C and all the lines passing through the intersection points between the line r and the conic C, that is through the points [0 : 0 : 1] and [0 : 1 : 0]. More precisely the point P = [X : Y : Z] is in F F if and only if the line L (of the plane P(L) ) In case (ii) and (iii) we get that Y 2 = 0 and Z 2 = 0, respectively. So V (Y Z) ⊂ F F . Now, by assuming P / ∈ {Y Z = 0}. By an easy computation we get that the line

L : C 1 (P )α + C 2 (P )β + C 3 (P )γ = 0, that is, L : α(X 2 -6Y Z) + βY 2 + γZ 2 = 0,
L is tangent to the conic C if X 2 (X 2 -12Y Z) = 0.
It follows that F F = V (XY Z(X 2 -12Y Z)). See Figure 1.

We now consider family (7), that is nodal cubics.

• • • [1:0:0] [0:1:0] [0:0:1] X = 0 Z = 0 Y = 0 X 2 -12Y Z = 0 Figure 1. The forbidden points of F = x(yz + x 2 ). Theorem 3.13. If F = y 2 z -x 3 -xz 2 , then F F = V (g 1 g 2 ) where g 1 = X 3 -6Y 2 Z +3XZ 2 and g 2 = 9X 4 Y 2 -4Y 6 -24XY 4 Z -30X 2 Y 2 Z 2 +4X 3 Z 3 -3Y 2 Z 4 - 12XZ 5 .
Proof. Note that [1 : 0 : 0] ∈ F F . In fact F + x 3 = z(y 2 -xz) represents a conic and a line tangent to it, namely it is in the family (10) and hence it has rank equal to five. Let L = (F ⊥ ) 2 and denote by C 1 : C 1 = XY = 0, C 2 : C 2 = X 2 -3Z 2 = 0 and C 3 : C 3 = Y 2 + XZ = 0 its generators. In the plane P(L) with coordinates α, β, and γ let ∆ be the cubic of reducible conics in L. By computing we see ∆ that is defined by det

  β 1 2 α 1 2 γ 1 2 α γ 0 1 2 γ 0 -3β   = 0, that is, 3α 2 β -12β 2 γ -γ 3 = 0.
In this case, we have that ∆ is an irreducible smooth cubic. Hence, we have that (1) F F = {P ∈ P 2 : P(L(-P )) is a tangent line to ∆ ⊂ P(L)}.

Thus, we are looking for points P such that the line C 1 (P )α + C 2 (P )β + C 3 (P )γ = 0 is tangent to ∆. We consider two cases, namely C 1 (P ) = 0 and C 1 (P ) = 0.

If C 1 (P ) = 0, we compute α from the equation of the line and we substitute in the equation of ∆. Then it is enough to compute the discriminant D of the following form in β and γ

3(C 2 β + C 3 γ) 2 β -12C 2 1 β 2 γ -C 2 1 γ 3 and we get D = 27C 4 1 g 2 1 g 2 .
The script used in Macaulay2 to do this computation can be found in [O16, Algorithm 2.3.23]. Thus, if C 1 (P ) = 0, P ∈ F F if and only if P ∈ V (g 1 g 2 ).

If C 1 (P ) = 0, by direct computation we check that

F F ∩ V (C 1 ) = V (g 1 g 2 ) ∩ V (C 1 )
. Hence the proof is completed.

Remark 3.14. In this paper we consider F F , and W F , as varieties and not as schemes. However, we found in Theorem 3.13 that the ideal of F F is (g 2 1 g 2 ). Remark 3.15. The treatment of the forbidden locus of a plane cubic given in (1) is similar to a remark by De Paolis recently recalled in [START_REF] Banchi | Rank and border rank of real ternary cubics[END_REF]. Here, the author gives an algorithm to construct a decomposition of a general plane cubic F as sum of four cubes of linear forms. The algorithm starts with a linear form defining a line intersecting the Hessian of F in precisely three points.

We now consider the case of cubics in family (9) and we use the map φ defined in Remark 3.11. Theorem 3.16. If F = x 3 + y 3 + z 3 + axyz belongs to family (9), then

(1) if a 3 -54 9a 3 = 27, then F F = φ -1 ( ∆) where ∆ is the dual curve of the smooth plane cubic

α 3 + β 3 + γ 3 - (a 3 -54) 9a αβγ = 0;
(2) otherwise, F F is the union of three lines pairwise intersecting in three distinct points.

Proof. Let L = (F ⊥ ) 2 and denote by C 1 : C 1 = aX 2 -6Y Z = 0, C 2 : C 2 = aY 2 -6XZ = 0, and C 3 : C 3 = aZ 2 -6XY = 0 its generators. In the plane P(L) with coordinates α, β, and γ let ∆ be the cubic curve of reducible conics. By computing we get an equation for ∆ det

  aα -3γ -3β -3γ aβ -3α -3β -3α aγ   = (a 3 -54)αβγ -9aα 3 -9aβ 3 -9aγ 3 = 0.
In the numerical case a 3 -54 9a 3

= 27, we have that ∆ is a smooth cubic curve. Thus, we have that

F F = {P ∈ P 2 : P(L(-P )) is a tangent line to ∆ ⊂ P(L)}.
Hence we get F F as described in Remark 3.11 using the map φ.

Otherwise, ∆ is the union of three lines intersecting in three distinct points Q 1 , Q 2 and Q 3 . Hence,

F F = {P ∈ P 2 : Q i ∈ P(L(-P ))
for some i} and the proof is now completed.

Example 3.17. Consider a = -6, thus we are in case (1) of Theorem 3.16. We can find equations for F F using Macaulay2 [GS]. The script used can be found in [O16, Algorithm 2.3.23]. Hence,

F F = V (g 1 g 2 ),
where

g 1 = X 3 + Y 3 -5XY Z + Z 3 and g 2 = 27X 6 -58X 3 Y 3 + 27Y 6 -18X 4 Y Z -18XY 4 Z - 109X 2 Y 2 Z 2 -58X 3 Z 3 -58Y 3 Z 3 -18XY Z 4 + 27Z 6 .
We conclude with family (10), that is cubics of rank five.

Theorem 3.18.

If F = x(xy + z 2 ), then F F = {[1 : 0 : 0]}.
Proof. Let L be a linear form. The following are equivalent:

(i) [L] ∈ F F ;
(ii) rk(F -λL 3 ) = 5 for all λ ∈ C;

(iii) F -λL 3 = 0 is the union of an irreducible conic and a tangent line, for all λ ∈ C;

(iv) F and L 3 must have the common factor L, that is, the line L = 0 is the line x = 0. . It easy to show that (i) and (ii) are equivalent.

For the equivalence between (ii) and (iii) see the table in Subsection 3.4. If (iii) holds, then all the elements in the linear system given by F and L 3 are reducible; note that the linear system is not composed with a pencil. Thus, by the second Bertini's Theorem, the linear system has the fixed component x = 0. To see that (iv) implies (iii), note that for all λ ∈ C, the cubic x(xy + z 2 + λx 2 ) = 0 is the union of an irreducible conic and a tangent line.

To finish the treatment of plane cubics we need to deal with the cusp, that is type (4). In three variables an ad hoc argument can be produced, however we prefer to refer to a more general result, namely Theorem 5.1.

The forms x

a 0 (x b 1 + . . . + x b n ) and x a 0 (x b 0 + x b 1 + . . . + x b n ).
We study now the Waring loci for a family of reducible forms.

W F = W G = V (X 1 X 2 , X 1 X 3 , . . . , X 1 X n , X 2 X 3 , . . . , X 2 X n , . . . , X n-1 X n ) \ {P },
that is, the Waring loci are the coordinate lines through the point P = [1 : 0 : . . . : 0] minus the point itself.

Proof. By Propositions 4.4 and 4.9 in [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF] we know that rk(F ) = rk(G) = (a + 1)n. If P ∈ W F , we have rk(F -λx a+b 0 ) < (a + 1)n for some λ ∈ C. A contradiction, by Propositions 4.9 in [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF]. Hence P ∈ F F . Analogously, using Proposition 4.4 in [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF], we get that P ∈ F G . Now let ∂ = α 1 X 1 + . . . + α n X n , where the α i ∈ C are non-zero, for every i. By Propositions 4.4 and 4.9 in [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF], we have

rk(∂ • F ) = rk(∂ • G) = (a + 1)n.
Let I X ⊂ F ⊥ be the ideal of a set of points giving a Waring decomposition of F , i.e. the cardinality of X is equal to rk(F ). Thus, I X = I X : (∂) is the ideal of the points of X not on the hyperplane ∂ = 0. Since

I X = I X : (∂) ⊂ F ⊥ : (∂) = (∂ • F ) ⊥ , we have that (a + 1)n = rk(F ) = |X| ≥ |X | ≥ rk(∂ • F ) = (a + 1)n.
It follows that X does not have points on the hyperplane ∂ = 0. Thus

W F ⊆ V (X 1 X 2 , X 1 X 3 , . . . , X 1 X n , X 2 X 3 , . . . , X 2 X n , . . . , X n-1 X n ) \ {P }.
The opposite inclusion follows from the proof of Proposition 4.4 in [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF]. Similarly for G.

Strassen's conjecture

Fix the following notation:

S = C[x 1,0 , . . . , x 1,n 1 , . . . . . . , x s,0 , . . . , x s,ns ], T = C[X 1,0 , . . . , X 1,n 1 , . . . . . . , X s,0 , . . . , X s,ns ].
For i = 1, . . . , s, we let

S [i] = C[x i,0 , . . . , x i,n i ],
T

[i] = C[X i,0 , . . . , X i,n i ], F i ∈ S [i]
d , and

F = F 1 + • • • + F s ∈ S d .
We consider F i ∈ S and thus i] for all i = 1, . . . , s, then any minimal Waring decomposition of F is a sum of minimal Waring decompositions of the forms F i .

F ⊥ i = {g ∈ T | g • F i = 0} . Conjecture 1 (Strassen's conjecture). If F = s i=1 F i ∈ S is a form such that F i ∈ S [i] for all i = 1, . . . , s, then rk(F ) = rk(F 1 ) + . . . + rk(F s ). Conjecture 2. If F = s i=1 F i ∈ S is a degree d ≥ 3 form such that F i ∈ S [
Remark 4.1. Conjecture 2 also appears in [START_REF] Teitler | Sufficient conditions for Strassen's additivity conjecture[END_REF] where, as in Proposition 4.4, sufficient conditions are presented which imply the conjecture. The sufficient conditions in [START_REF] Teitler | Sufficient conditions for Strassen's additivity conjecture[END_REF] are different from the one we present in this paper. Moreover, as far as we can tell, the families of Lemma 4.5 are not obtained in [START_REF] Teitler | Sufficient conditions for Strassen's additivity conjecture[END_REF].

In view of Conjecture 2 it is natural to formulate the following conjecture in term of Waring loci. As already explained in Remark 2.4, we look at

W F i ⊂ P n i X i,0 ,...,X i,n i ⊂ P N . Conjecture 3. If F = s i=1 F i ∈ S is a degree d ≥ 3 form such that F i ∈ S [i] for all i = 1, . . . , s, then W F = i=1,...,r W F i ⊂ P N , where N = n 1 + . . . + n s + s -1.
Remark 4.2. Note that Conjectures 2 and 3 are false in degree two. For example, let F = x 2 -2yz.

The rank of F is three, but it is easy to find a Waring decomposition of F that is not the sum of x 2 plus a Waring decomposition of the monomial yz; for example

F = (x + y) 2 + (x + z) 2 -(x + y + z) 2 .
Lemma 4.3. Conjecture 2 and Conjecture 3 are equivalent and they imply Strassen's conjecture for d ≥ 3.

Proof. Clearly Conjecture 2 implies both Conjecture 1 and Conjecture 3. To complete the proof, we assume that Conjecture 3 holds. If F = i L d i is a minimal decomposition of F , then each L i appears in a minimal decomposition of F j(i) , thus L i only involves the variables of S [j(i)] . Setting all the variables not in S [j(i)] equal zero in the expression F = i L d i , we get a decomposition of F j(i) . Note that all the obtained decompositions of the F j are minimal, otherwise rk(F ) > i rk(F i ). Hence Conjecture 2 is proved by assuming Conjecture 3.

In order to study our conjectures we prove the following.

Proposition 4.4. Let F = s i=1 F i ∈ S be a form such that F i ∈ S [i] for all i = 1, . . . , s. If the following conditions hold (1) for each 1 ≤ i ≤ s there exists a linear derivation

∂ i ∈ T [i] such that rk(∂ i • F i ) = rk(F i ),
(2) Strassen's conjecture holds for F 1 + . . . + F s , (3) Strassen's conjecture holds for ∂ 1 F 1 + . . . + ∂ s F s , then F satisfies Conjecture 3.

Proof. Let's consider the linear form t = α 1 ∂ 1 + . . . + α s ∂ s , with α i = 0 for all i = 1, . . . , s. Let I X ⊂ F ⊥ be the ideal of a set of points giving a minimal Waring decomposition of F , i.e. the cardinality of X is equal to rk(F ). Thus, I X : (t) is the ideal of the points of X which are outside the linear space t = 0. We can look at

I X : (t) ⊂ F ⊥ : (t) = (t • F ) ⊥ .
By the assumptions we get that rk(F ) = rk(t • F ), hence the set of points corresponding to I X : (t) has cardinality equal to rk(F ); it follows that X does not have points on the hyperplane t = 0. For the sake of simplicity, if necessary, we rename and reorder the variables in such a way that ∂ i = X i,0 .

Claim. If P = [a 1,0 : . . . : a 1,n 1 : . . . : a s,0 : . . . : a s,ns ] belongs to W F then in the set {a 1,0 , . . . , a s,0 } there is exactly one non-zero coefficient.

The claim follows from the first part, since if we have either no or at least two non-zero coefficients in the set {a 1,0 , . . . , a s,0 } it is easy to find a linear space {t = 0} containing the point P and contradicting the assumption that it belongs to the Waring locus of F . Let's consider X i = X {x i,0 = 0}, for all i = 1, . . . , s. Similarly as above, by looking at

I X i = I X : (∂ i ) ⊂ F ⊥ : (∂ i ) = (∂ i • F i ) ⊥
Considering the exact sequence

(3) 0 -→ T /(I ∩ J) -→ T /I ⊕ T /J -→ T /(I + J) -→ 0, it follows from (2) that

(4) length T /F ⊥ = length T /M ⊥ 1 + length T /M ⊥ 2 -length T /(M ⊥ 1 + M ⊥ 2 ) -1. Now, since Y i ∈ M ⊥ 1 and X j ∈ M ⊥ 2
, for all i = 0, . . . , n, j = 0, . . . , m, we have that M ⊥ 1 + M ⊥ 2 is the maximal ideal. Thus, from (4), we conclude.

Lemma 5.3. Let F = M 1 + M 2 be as in Theorem 5.1. Then,

length T /(F ⊥ : (X 0 + Y 0 ) + (X 0 + Y 0 )) = rk(F ) -2.
Proof. We have

F ⊥ : (X 0 + Y 0 ) + (X 0 + Y 0 ) = (X 0 + Y 0 ) • F ⊥ + (X 0 + Y 0 ) = x a 1 1 • • • x an n + y b 0 -1 0 y b 1 1 • • • y bm m ⊥ + (X 0 + Y 0 ) = x a 1 1 • • • x an n + y b 0 -1 0 y b 1 1 • • • y bm m ⊥ + (Y 0 ),
where the last equality holds since

X 0 ∈ x a 1 1 • • • x an n + y b 0 -1 0 y b 1 1 • • • y bm m ⊥ .
In the case b 0 > 1, by direct computation, we get

x a 1 1 • • • x an n + y b 0 -1 0 y b 1 1 • • • y bm m ⊥ + (Y 0 ) = x a 1 1 • • • x an n ⊥ ∩ y b 0 -1 0 y b 1 1 • • • y bm m ⊥ + + (b 0 -1)! m i=1 (b i !)X a 1 1 • • • X an n - n i=1 (a i !)Y b 0 -1 0 Y b 1 1 • • • Y bm m + (Y 0 ) = x a 1 1 • • • x an n ⊥ ∩ y b 0 -1 0 y b 1 1 • • • y bm m ⊥ + (b 0 -1)! m i=1 (b i !)X a 1 1 • • • X an n + (Y 0 ) = x a 1 1 • • • x an n ⊥ ∩ (y b 0 -1 0 y b 1 1 • • • y bm m ) ⊥ + (Y 0 ) + X a 1 1 • • • X an n ,
where the last equality holds since

Y 0 ∈ (x a 1 1 • • • x an n ) ⊥ . Moreover, since X a 1 1 • • • X an n ∈ y b 0 -1 0 y b 1 1 • • • y bm m ⊥ , we get x a 1 1 • • • x an n ⊥ ∩ (y b 0 -1 0 y b 1 1 • • • y bm m ) ⊥ + (Y 0 ) + X a 1 1 • • • X an n = (x a 1 1 • • • x an n ) ⊥ + (X a 1 1 • • • X an n ) ∩ (y b 0 -1 0 y b 1 1 • • • y bm m ) ⊥ + (Y 0 ) .
Hence, using again the exact sequence (3), we get

length T / F ⊥ + (X 0 ) ≥ length T / x a 1 1 • • • x an n ⊥ + length T / (y 0 y b 1 1 . . . y bm m ) ⊥ + (Y 0 Y b 1 1 . . . Y bm m ) -1 = n i=1 (a i + 1) + 2 m i=1 (b i + 1) -2 = rkF + m i=1 (b i + 1) -2 > rkF.
It follows that length T /(F ⊥ + (X 0 )) > rkF. Analogously we have length T /(F ⊥ + (Y 0 )) > rkF. So X 0 and Y 0 are not zero divisors for I X . Hence there are points of X lying both on the hyperplane X 0 = 0 and on Y 0 = 0.

Since, by [CCG12, Remark 3.3], there are no points of X on the linear space defined by the ideal (X 0 , Y 0 ), and since (α 0 X 0 + β 0 Y 0 )(X 0 + Y 0 ) ∈ I X , it follows that α 0 = β 0 = 0. Thus I X : (X 0 + Y 0 ) + (X 0 + Y 0 ) contains only the linear form X 0 + Y 0 , and the Claim is proved also in case b 0 = 1. Now, the idea is to show that I X : (X 0 + Y 0 ) + (X 0 + Y 0 ) differs from F ⊥ : (X 0 + Y 0 ) + (X 0 + Y 0 ) also in degree d -1. From this, the Claim above and (5), it would follow that the cardinality of X is actually rkF and then we have no points of X over the hyperplane X 0 + Y 0 = 0. Consider first the case b 0 > 1. In this case, since (see the proof of Lemma 5.3)

F ⊥ : (X 0 + Y 0 ) + (X 0 + Y 0 ) = ((x a 1 1 • • • x an n ) ⊥ + (X a 1 1 • • • X an n )) ∩ ((y b 0 -1 0 y b 1 1 • • • y bm m ) ⊥ + (Y 0
)), we have that F ⊥ : (X 0 + Y 0 ) + (X 0 + Y 0 ) contains the whole vector space T d-1 . We will prove that (I X :

(X 0 + Y 0 ) + (X 0 + Y 0 )) d-1 = T d-1 . Since, from the Claim, I X : (X 0 + Y 0 ) + (X 0 + Y 0 ) differs from F ⊥ : (X 0 + Y 0 ) + (X 0 + Y 0 ), then |X | ≥ 1 + length T /(F ⊥ : (X 0 + Y 0 ) + (X 0 + Y 0 )) = rkF -1.
Hence there is at most one point of X, say P , lying on the hyperplane X 0 + Y 0 = 0. Since there are no points on the linear space (X 0 , Y 0 ), we can write

P = [1, u 1 , . . . , u n , -1, v 1 , . . . , v m ]. Let H = X a 1 1 • • • X an n -u a 1 1 • • • u an n X d-1 0 . If we assume, by contradiction, that I X : (X 0 + Y 0 ) + (X 0 + Y 0 ) contains all the forms of degree d -1, we have that H ∈ I X : (X 0 + Y 0 ) + (X 0 + Y 0 ), that is, H + (X 0 + Y 0 )G ∈ I X : (X 0 + Y 0 ) for some G ∈ T d-2 . Since H + (X 0 + Y 0 )G
vanishes at P and at the points of X , we actually have

H + (X 0 + Y 0 )G ∈ I X ⊂ F ⊥ , and from this H + (X 0 + Y 0 )G • F = 0. Hence, m i=1 (b i !)y 0 + α n i=1 (a i !)x 0 + G 2 • x a 1 1 • • • x an n + y b 0 -1 0 • • • y bm m = 0. Since G • x a 1 1 • • • x an n + y b 0 -1 0 • • • y bm m
cannot produce multiples of x 0 and y 0 , we get a contradiction. From this, it follows that dim I

X : (X 0 + Y 0 ) + (X 0 + Y 0 ) d-1 ≤ dim T d-1 -2.
Therefore,

I X : (X 0 + Y 0 ) + (X 0 + Y 0 ) d-1 = F ⊥ : (X 0 + Y 0 ) + (X 0 + Y 0 ) d-1 .
Lemma 5.5. Let F = M 1 + M 2 be as in Theorem 5.1 and let X be a minimal set of points apolar to F . Then,

(F ⊥ : (X 0 , Y 0 )) 2 ⊆ (I X + (X 0 + Y 0 )) 2 .
Proof. Let X be a minimal set of points apolar to F . Following the proof of [CCG12, Theorem 3.2], and considering the following chain of inclusions (6)

I X : (X 0 , Y 0 ) + (X 0 + Y 0 ) ⊆ F ⊥ : (X 0 , Y 0 ) + (X 0 + Y 0 ) ⊆ J 1 ∩ J 2 ,
where

J 1 = (X 0 , X a 1 +1 1 , . . . , X an+1 n , Y 0 , . . . , Y m ) and J 2 = (X 0 , X 1 , . . . , X n , Y 0 , Y b 1 +1 1 , . . . , Y bm+1 m ), we get that I X = I X : (X 0 , Y 0 ) and dim C (I X + (X 0 + Y 0 )) i = dim C (J 1 ∩ J 2 ) i , for any i = 1;
Therefore, considering the inclusion (6), it follows that

(I X + (X 0 + Y 0 )) i = F ⊥ : (X 0 , Y 0 ) + (X 0 + Y 0 ) i , for any i = 1;
this is enough to conclude the proof.

Proof of Theorem 5.1. By Lemma 5.4 and [CCG12, Remark 3

.3], W F ⊂ V (X 0 Y 0 ) V (X 0 , Y 0 ).
Hence, we can write any minimal Waring decomposition of F as

(7) F = r 1 i=1 (L i ) d + r 2 j=1 (L j ) d ,
where, L i ∈ V (Y 0 ) and L j ∈ V (X 0 ), namely,

L i = α i,0 x 0 + . . . + α i,n x n + β i,1 y 1 + . . . + β i,m y m ,
where α i,0 = 0, for i = 1, . . . , r 1 , and

L j = γ j,1 x 1 + . . . + γ j,n x n + δ j,0 y 0 + . . . + δ j,m y m ,
where δ j,0 = 0, for j = 1, . . . , r 2 . Let X be the set of points apolar to F corresponding to the decomposition (7). Now, we prove the following statement. Claim: L i ∈ V (Y 0 , . . . , Y m ), for i = 1, . . . , r 1 , and L j ∈ V (X 0 , . . . , X n ), for j = 1, . . . , r 2 .

Proof of Claim. Since L i ∈ V (Y 0 ) and L j ∈ V (X 0 ) and since coeff x 0 (L i ) = α i,0 = 0, for any i = 1, . . . , r 1 , and coeff y 0 (L j ) = δ j,0 = 0, for any j = 1, . . . , r 2 , in order to prove the Claim, it is enough to show that X 0 Y 1 , . . . , X 0 Y m and X 1 Y 0 , . . . , X n Y 0 are in I X .

We have that X 0 Y l ∈ F ⊥ ; hence, by Lemma 5.5,

X 0 Y l ∈ I X + (X 0 + Y 0 ) =⇒ X 0 Y l + G l • (X 0 + Y 0 ) ∈ I X ⊂ F ⊥ , (deg(G l ) = 1) (8) =⇒ G l ∈ ((X 0 + Y 0 ) • F ) ⊥ . Since X k Y 0 ∈ F ⊥ (k = 1, . . . , n), we get X k Y 0 ∈ I X + (X 0 + Y 0 ) =⇒ X k Y 0 + G k • (X 0 + Y 0 ) ∈ I X ⊂ F ⊥ , (deg(G k ) = 1) (9) =⇒ G k ∈ ((X 0 + Y 0 ) • F ) ⊥ .
Now, we need to distinguish between two cases.

If b 0 ≥ 2, then ((X 0 + Y 0 ) • F ) ⊥ = x a 1 1 • • • x an n + y b 0 -1 0 y b 1 1 • • • y bm m ⊥
. Therefore, since deg G l = deg G k = 1, we have G l = a l X 0 and G k = a k X 0 , for some a l , a k ∈ C. So, from (9), we have that X k Y 0 + a k X 0 (X 0 + Y 0 ) ∈ I X , and, multiplying by X 0 , since X 0 Y 0 ∈ I X , we get a k X 3 0 ∈ I X , for k = 1, . . . , n. Since the coefficients of x 0 in the L i 's are different from 0, it follows that a k = 0, for all k = 1, . . . , n. Therefore, X k Y 0 ∈ I X , for all k = 1, . . . , n. Hence, we get that L j ∈ V (X 0 , . . . , X n ), for j = 1, . . . , r 2 , and we have L j = δ j,0 y 0 + . . . + δ j,m y m . From (8), since X 0 Y 0 ∈ I X , we obtain that X 0 Y l + a l X 0 (X 0 + Y 0 ) ∈ I X =⇒ X 0 (Y l + a l X 0 ) ∈ I X .

Consider the points P i = (α i,0 , . . . , α i,n , 0, β i,1 , . . . , β i,m ) ∈ X (i = 1, . . . , r 1 ) associated to the L 's. Since X 0 (Y l + a l X 0 ) ∈ I X and α i,0 = 0, for any i = 1, . . . , r 1 , it follows that b i,l = -a l α i,0 , for all i = 1, . . . , r 1 and l = 1, . . . , m. multiplying by Y 0 , since X 0 Y 0 ∈ I X , we have that b l Y 3 0 ∈ I X , for any l = 1, . . . , m. Since the points corresponding to the L 's have the coefficient of y 0 different from 0, it follows that b l = 0 and, therefore, X 0 Y j ∈ I X . Analogously, we can prove that a k = 0, for all k = 1, . . . , n and, consequently, that X i Y 0 ∈ I X . This concludes the proof of the Claim.

Hence

So we have proved that L i = α i,0 x 0 + . . . + α i,n x n , L j = δ j,0 y 0 + . . . + δ j,m y m , and so (11)

M 1 = x 0 x a 1 1 • • • x an n = r 1 i=1 L i , M 2 = y b 0 0 y b 1 1 • • • y bm m = r 2 i=1 L j ;
therefore, r i ≥ rk(M i ), for i = 1, 2. Since r 1 + r 2 = rk(F ) = rk(M 1 ) + rk(M 2 ), we have that actually r i = rk(M i ), for i = 1, 2. Thus, the expressions in (11) are minimal decompositions of M 1 and M 2 , respectively. It follows that W F ⊂ W M 1 ∪ W M 2 . Since the opposite inclusion is trivial, we conclude the proof.

Open problems.

There are several aspect that we consider to be worth of further investigation. Here we list some example.

(1) It is not clear to us whether some of our results hold when weaker assumptions are made. Consider, for example, Theorem 4.6 for any monomial and not only when all exponents are at least two. Similarly, we do not know if Theorem 3.19 holds in the case of b = 2.

(2) In all of our results F F is never empty and we conjecture that this is the case for any form F . Roughly speaking, the more Waring decompositions of F we have, the smaller F F should be. Thus, this last conjecture, seems to have a strong relation with forms of high Waring rank which usually have many sum of powers decompositions. Note, for example in the case of plane cubics, that the smallest F F occurs for F of type (10), that is for plane cubics of maximal Waring rank.

(3) It would be interesting to consider the sets W t F formed by t-uples of linear forms appearing in the same minimal Waring decomposition of F . Note that W 1 F = W F , while W rk(F ) F is the well known variety of sum of powers VSP (F ) defined in [START_REF] Ranestad | Varieties of sums of powers[END_REF].

(4) When we are able to find an ideal defining F F this ideal is often not radical. Thus, the scheme of forbidden points comes with a non reduced structure, but it is not clear what this is telling us about F .

  and this readily follows by [CCG12, Remark 3.3] or by [BBT13, Corollary 19].

  falls in one of the following cases: (i) L is tangent to the conic C : βγ -9α 2 = 0; (ii) L passes through the point [0 : 1 : 0]; (iii) L passes through the point [0 : 0 : 1].

  Theorem 3.19. Let F = x a 0 (x b 1 +. . .+x b n ) and G = x a 0 (x b 0 +x b 1 +. . .+x b n ), where n ≥ 2, a+1 ≥ b ≥ 3. Then

  0 (x 0 -a 1 y 1 + . . . -a m y m ) + α i,1 x 1 . . . + α i,n x n d .Now, observe that, setting y 0 = . . . = y m = 0 in (7), we obtain thatx 0 x a 1 1 • • • x an n = r 1 i=1 (α i,0 x 0 + . . . + α i,n x n ) d ; so, replacing x 0 with (x 0 -a 1 y 1 + . . . -a m y m ) we get that 0 (x 0 -a 1 y 1 + . . . -a m y m ) + α i,1 x 1 . . . + α i,n x n d = (x 0 -a 1 y 1 + . . . -a m y m )x a 1 1 • • • x an n .

  We can continue this procedure until we get a form F i with rank equal to d+12 . If d is odd, we can actually do one more step and arrive to a form F i with rank strictly less than d+1 2 . In other words, we have proven the following result. Plane cubics. In this section we describe W F (and F F ) for n = 2 and F ∈ S 3 , that is for plane cubics. For simplicity, we let S = C[x, y, z] and T = C[X, Y, Z]. We use the following characterization of plane cubics adapted from the table given in[START_REF] Landsberg | On the ranks and border ranks of symmetric tensors[END_REF].

	Type	Description	Normal form	Waring rank	Result
	(1)	triple line	x 3	1	Theorem 3.3
	(2)	three concurrent lines	xy(x + y)	2	Theorem 3.5
	(3)	double line + line	x 2 y	3	Theorem 3.3
	(4)	smooth	x 3 + y 3 + z 3	3	Theorem 4.6
	(5)	three non-concurrent lines	xyz	4	Theorem 3.3
	(6) line + conic (meeting transversally)	x(yz + x 2 )	4	Theorem 3.12
	(7)	nodal	xyz -(y + z) 3	4	Theorem 3.13
	(8)	cusp	x 3 -y 2 z	4	Theorem 5.1
	(9)
	Proposition 3.8. Let F be a degree d binary form of rank r ≥ d+1 2 . For any choice of [L 1 ], . . . , [L s ] / ∈ F F where s = r -d+1 there exists a minimal Waring decomposition for F 2 involving L d

1 , . . . , L d s . If d is odd, then it is also unique.

3.4.

we can conclude that the cardinality of each X i is at least rk(F i ). Moreover, by the claim, we have that the X i 's are all pairwise disjoint. By additivity of the rank, we conclude that X = i=1,...,s X i , with X i ∩ X j = ∅, for all i = j, and

for all i = 1, . . . , s.

Hence, we have that the sets X i give minimal Waring decompositions of the forms ∂ i • F i 's and, by Proposition 2.3, they lie in P n i X i,0 ,...,X i,n i

, respectively. Since X gives a minimal Waring decomposition of F , specializing to zero the variables not in S [i] we see that X i gives a minimal Waring decomposition of F i . Hence, it follows W F ⊂ i=1,...,s W F i . The other inclusion is easily seen to be true.

As we show in the following lemma, there are several families of forms for which we can apply Proposition 4.4.

Lemma 4.5. If F is one of the following degree d forms

(1) a monomial x d 0 0 • . . . • x dn n with d i ≥ 2 for 0 ≤ i ≤ n;

(2) a binary form of less than maximal rank, i.e., F = LM d-1 , with L, M linear forms;

(3) x a 0 (x b 1 + . . . + x b n ) with n ≥ 2 and a + 1 ≥ b > 2; (4) x a 0 (x b 0 + x b 1 + . . . + x b n ) with n ≥ 2 and a + 1 ≥ b > 2;

(5) x a 0 G(x 1 , . . . , x n ) with a ≥ 2 and such that G ⊥ is a complete intersection in C[x 1 , . . . , x n ] generated by forms of degree at least a + 1, then there exists a linear derivation ∂ such that

(2) We know that

we can always consider a non square-free element g ∈ (F ⊥ ) d 1 . Indeed, if both g 1 and g 2 are square-free, then it is enough to consider one element [g] lying on the intersection between the hypersurface in P(S d 1 ) defined by the vanishing of the discriminant of polynomials of degree d 1 and the line passing through [g 1 ] and [g 2 ]. Thus, g = l m 1 1 • • • l ms s , with m 1 ≥ . . . ≥ m s and m 1 ≥ 2. Fix ∂ = l 1 ∈ T 1 . Hence, we conclude similarly as part b).

(3) If F = x a 0 (x b 1 + . . . + x b n ) with b, n ≥ 2 and a + 1 ≥ b, then we have that rk(F ) = (a + 1)n, by [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF]. If we set

) and the rank is preserved.

(4) If F = x a 0 (x b 0 + . . . + x b n ) with b, n ≥ 2 and a + 1 ≥ b, then we have that rk(F ) = (a + 1)n, by [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF]. If we set ∂ = X 1 + . . . + X n , then ∂F = x a 0 (x b-1 1 + . . . + x b-1 n ) and the rank is preserved.

(5

. . , g n ), a ≥ 2, and deg [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF]. If we consider ∂ = X 0 , then we have that ∂ • F = x a-1 0 G(x 1 , . . . , x n ) and the rank is preserved.

Theorem 4.6. Let F = s i=1 F i ∈ S be a form such that F i ∈ S [i] for all i = 1, . . . , s. If each F i is one of the following,

(1) a monomial

(2) a binary form of less than maximalrank, i.e., F = LM d-1 , with L, M linear forms;

(3)

x n ] generated by forms of degree at least a + 1, then Conjecture 3 holds for F .

Proof. We check that conditions (1), (2), and (3) of Proposition 4.4 are verified. Condition (1) holds because of Lemma 4.5 and condition (2) follows from Theorem 6.1 in [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF]. To check condition (3) we use the linear derivations ∂ i appearing in the proof of Lemma 4.5. Namely, we note that Theorem 6.1 in [START_REF] Carlini | Symmetric tensors: rank, strassen's conjecture and e-computability[END_REF] applies to the sum i ∂ i F i , thus condition (3) follows. The result is now proved.

More results and open problems

We prove that Conjecture 3 holds for the sum of two monomials where one of them has the lowest exponent equal to one. In this case, Lemma 4.5 does not apply and we need different methods.

Theorem 5.1. Conjecture 3 is true for a form

We assume that b 0 ≤ b i , for any i = 1, . . . , m. Before proving the theorem, we need some preliminary result.

So, by the exact sequence (3), we get

Lemma 5.4. Let F = M 1 + M 2 be as in Theorem 5.1. Then,

Proof. Let I X ⊂ F ⊥ be the ideal of a minimal set of apolar points for F , thus

It is enough to show that there are no points of X lying on the hyperplanes λX 0 + µY 0 = 0, for λµ = 0. After a change of coordinates, we may assume λ = µ = 1. We consider I X = I X : (X 0 + Y 0 ) the ideal of the set of points in X which do not lie on X 0 + Y 0 = 0. The cardinality of X is at least the length of the ring T /(F ⊥ :

It follows that on the hyperplane X 0 + Y 0 = 0 we have at most two points of X.

Claim:

In degree 1, the ideal

Proof of Claim. As already computed in the proof of Lemma 5.3, we have that F ⊥ : (X 0 + Y 0 ) + (X 0 + Y 0 ) contains two linear forms, namely X 0 and Y 0 . Now, assume that

• F = 0, and from this easily follows that α 1 = . . . = α n = β 0 = β 1 = . . . = β m = 0. Hence, L = α 0 X 0 and so α 0 X 0 (X 0 + Y 0 ) ∈ I X . Now, consider the hyperplane Y 0 = 0. Again, by direct computation, we get

Hence, using again the exact sequence (3), we get

Hence, Y 0 is not a zero divisor for I X and there are points of X lying on the hyperplane Y 0 = 0. Since, by [CCG12, Remark 3.3], there are no points of X on the linear space defined by the ideal (X 0 , Y 0 ), and since α 0 X 0 (X 0 + Y 0 ) ∈ I X , it follows that α 0 = 0. So I X : (X 0 + Y 0 ) + (X 0 + Y 0 ) contains only the linear form X 0 + Y 0 , and thus in case b 0 > 1 the Claim is proved.

Now, consider the hyperplanes X 0 = 0 and Y 0 = 0. Again, by direct computation, we get

Now, recalling that d ≥ 3, and so X d-1 0

• F = 0, we get

) cannot be a multiple of x 0 . Now, let b 0 = 1. In this case we have

Since, from the Claim,

Hence there is at most one point of X, say P , lying on the hyperplane X 0 + Y 0 = 0. Since there are no points on the linear space (X 0 , Y 0 ), we can assume that

for some G 1 ∈ T d-2 . But H 1 + (X 0 + Y 0 )G 1 vanishes at P and at the points of X , so we have

and from this (

and this is impossible, since

) cannot be a multiple of x 0 . Now, we can also show that H 2 / ∈ I X : (X 0 +Y 0 )+(X 0 +Y 0 )+(H 1 ). Indeed, assume by contradiction that there exists α ∈ C and G 2 ∈ T d-2 such that

Since H 2 + αH 1 + (X 0 + Y 0 )G 2 vanishes at the point P by construction, we get that

and, therefore,

It follows that

Therefore, looking at the coefficient of the monomial x a 1 1 • • • x an n y l , we obtain -a l = 0, for any l = 1, . . . , m. Hence from (8), we get X 0 Y l ∈ I X for any l = 1, . . . , m.

. Therefore, from (8) and ( 9) we have

Considering the points P i = (α i,0 , . . . , α i,n , 0, β i,1 , . . . , β i,m ) ∈ X (i = 1, . . . , r 1 ) associated to the L 's, since a i,0 = 0, it follows that b i,l = -a l α i,0 , for all i = 1, . . . , r 1 and l = 1, . . . , m. Analogously, considering the monomials X k Y 0 , for any k = 1, . . . , n, we get γ i,k = -b k δ i,0 . Hence, recalling that L i = α i,0 x 0 + . . . + α i,n x n + β i,1 y 1 + . . . + β i,m y m , we get Looking at the coefficient of the monomial x a 1 1 • • • x an n y l (l = 1, . . . , m), we get a l = 0. Similarly, considering the coefficient of the monomial x k y b 1 1 • • • y bm m (k = 1, . . . , n) we get b k = 0. Now, substituting a l = 0 in (8), we get that


Denis Migdal
email: denis.migdal@ecole.ensicaen.fr

Christian Johansen

Audun Jøsang
email: josang@ifi.uio.no

DEMO: OffPAD -Offline Personal Authenticating Device with Applications in Hospitals and e-Banking

Identity and authentication solutions often lack usability and scalability, or do not provide high enough authentication assurance. The concept of Lucidman (Local User-Centric Identity Management) is an approach to providing scalable, secure and user friendly identity and authentication functionalities. In this context we demonstrate the use of an OffPAD (Offline Personal Authentication Device) as a trusted device to support different forms of authentication. The Lucidman/OffPAD approach consists of locating the identity management and authentication functionalities on the user side instead of on the server side or in the cloud. This demo aims to show how OffPAD strengthens authentication assurance, improves usability, minimizes trust requirements, and has the advantage that trusted online interaction can be achieved even in the presence of malware infection of client platforms. The trusted device OffPAD has been designed as a phone cover, therefore not requiring the user to carry an extra gadget. We focus on six demonstrators, three useful in e-banking and three in the hospital domain where nurses, doctors, or patients are authenticated and access is granted in various situations base on the OffPAD. A video for this demo will be available online.

Motivation and Background

We demo the OffPAD concept, i.e., the hardware, a phone cover with secure elements, and software components. The concept of OffPAD has been put forward in [START_REF] Jøsang | Local user-centric identity management[END_REF], whereas the hardware prototype and software have been developed during the past two years part of the project called OffPAD. 1 Several use cases have been identified to show case the OffPAD in the domains of e-banking and hospitals.

One aim with OffPAD is to increase security assurance without reducing the usability, i.e., have minimal interference with the normal tasks of the user, yet automate some of the authentication related tasks. OffPAD can be seen as an identity management device, assuming an entity to have multiple identities simultaneously, similar to what ABAC and Attribute-Based Credentials advocate. OffPAD aims to improve on the traditional "silo model" where the identities are located on the server side, by managing identities locally under user's control only. However, OffPAD does not maintain only user's credentials, but also the credentials of service providers to be used in authenticating the service to the user. OffPAD also improves on the identity federation endeavours (e.g., Shibboleth, OpenId, FacebookConnect, FIDO) which are managed on servers or clouds, thus making them "network-centric" instead of "user-centric".

We take the distinction between a system entity (browser or server) and a legal/cognitive entity (person or organisation) thus multiplying the mutual authentication possibilities. We also consider authentication to be of three types: (i) syntactic, being the simplest, including X.800 certificates, which, e.g., does not prevent phishing attacks since the relying party is indifferent to the identity of the certificate owner; (ii) semantic authentication includes syntactic and moreover the verification by the relying entity that the remote entity has semantic characteristics that are compliant with a specific security policy; and (iii) cognitive being the richest, requiring the relying party to have cognitive reasoning power, such as in humans or advanced AI systems. Cognitive authentication effectively prevents phishing attacks as users recognise the server identity, spotting a malicious owner of a legitimate certificate accepted by the browser.

With OffPAD we are interested in cognitive authentications involving the human user. The X.800 standard is concerned with authenticating the Client Computer to the Server (CS) and the other way around (SC) which take place at the network protocol layers and are typically transparent to the human user. However, for online services the User authentication to the Server (US) and the cognitive server authentication by the user (SU) are more relevant. The importance of these authentication classes emerges from the need for end-to-end security, i.e., between the human user (U) and the server system (S).

It is assumed that traditional server authentication with browser PKIX 2 server certificates and TLS provides SU authentication, however in reality it does not. This might seem surprising but is in fact easy to understand [START_REF] Jøsang | Trust Extortion on the Internet[END_REF].

For example, phishing attacks normally start with spam emails that invite people to access a fake web site that tricks the user into providing user Id and password. In a syntactic sense the fake phishing website is correctly authenticated through TLS because the server certificate is validated by the browser. However, from a cognitive point of view this is not authentication because the website's identity is different from that intended by the user. The problem is due to the poor usability offered by current implementations of TLS [START_REF] Jøsang | Security Usability Principles for Vulnerability Analysis and Risk Assessment[END_REF] which does not facilitate cognition of identities.

Data origin authentication, according to the X.800 standard, is "the corroboration that the source of data received is as claimed". Malware infection of client platforms opens up for attacks against data authentication that entity authentication cannot prevent. A typical example is online banking transactions with mutual entity authentication. Even when there is strong 2-factor user authentication, there is the possibility that a Trojan program changes the transaction details without the user's knowledge (commonly known as a "web inject" that can change the behaviour of the browser and modify input and output data arbitrarily). SpyEye, Zeus, IceIX, TDL, Hiloti, Carberp, are concrete examples of malware that enable such attacks. In this case the human user is assumed to be the origin, but the client modifies data input by the user before it is sent to the server system, thus breaching data origin authentication. For typical online transactions current solutions for user data origin authentication are either non-existent or inadequate because they assume the client system to be the origin of data.

The difference between entity authentication and data authentication makes it necessary to have specific security mechanisms to ensure data integrity in online transactions. The OffPAD enables data origin authentication with high assurance and usability, as explained below.

Related works are discussed in the journal paper [START_REF] Jøsang | Local user-centric identity management[END_REF] and the technical report [START_REF] Johansen | Offpad: Offline personal authenticating device -implementations and applications[END_REF] accompanying this abstract. Several authentication solutions that rely on an external device are present in the literature, including Pico by Stajano, MP-Auth by Mannan and van Oorschot, and Nebuchadnezzar by Singer and Laurie. However, these devices only support authentication of client-side entities to server-side parties, i.e. typically user authentication, in contrast to the OffPAD which also supports the authentication of server-side entities to 2 Public-Key Infrastructure based on X.509 certificates 3 client-side parties, as well as data authentication.

OffPAD device description

The OffPAD is a trusted device, i.e. assumed to function as intended and to be adequately protected against relevant attacks. The first OffPAD prototype is a phone cover connected to its host with a standard micro-USB interface. This makes the OffPAD a portable object, but not a second electronic object in the user's pocket. Unlocking the OffPAD is currently done through fingerprint biometrics.

OffPAD is considered offline, meaning that communications follow controlled formats, during short and restricted time periods, not involving wireless broadband capabilities, i.e., we use only micro-USB or NFC communications.

Being offline eliminates exposure to Internet threats. Thus we assume that attackers are unable to exploit bugs in OffPAD's operating system and applications.

The first connection to the OffPAD requires Trust-On-First-Use (TOFU), also known as leap-of-faith. On first use, there is no cryptographic way to verify the connection between the device and the client platform, the trust must simply be based on the physically observed set-up.

A schematic view of OffPAD design is illustrated in Fig. 1. We assume that the sensors integrated in the OffPAD are secure. OffPAD still makes use of the host phone for other sensors, like camera, thus a malware on the phone can communicate false information to the OffPAD. OffPAD also asks the host phone for the more heavy computations, e.g., for OCR. However, all these inputs from the phone are considered in our scenarios as untrusted.

The OffPAD firmware supports the following features:

User Authentication by performing a biometric authentication of the holder Manage certificates in OffPAD's certificate store to check signature, s.a. for authenticating service provider's identity.

Sign and check signature using the OffPAD's holder private key unlocked after successful holder's authentication.

Show sensitive information using the e-Ink display or the multi-color LED.

Biometric user enrolment on the OffPAD according to the specified biometric modality.

OffPAD demonstrators

The following applications of OffPAD will be demonstrated.

Data-US: Authentication of user Data by the Service provider, based on OCR

(Optical Character Recognition), alternatively displayed on the OffPAD e-Ink screen. SU: Server authentication by the User, based on petname systems [START_REF] Ferdous | Entity Authentication & Trust Validation in PKI using Petname Systems[END_REF] managed by the OffPAD. US: User authenticated by the service provider, based on an extended challengeresponse protocol XDAA [START_REF] Klevjer | Extended HTTP digest access authentication[END_REF] between the client terminal and OffPAD. Auto-login: Contextual automatic login/off based on indoor location of the OffPAD, using Sonitor's system. Multi-login: Automatic access to a resource conditioned on multiple users authenticated at once, also using TellU Smarttracker system. Strong auth.: Strong authentication required for accessing sensitive information or tasks, using biometric fingerprint authentication of the user by the OffPAD.

We demonstrate how the OffPAD enables mutual user-server entity authentication as well as data authentication. Each use case is illustrated with a ceremony [START_REF] Ellison | Ceremony Design and Analysis[END_REF] which is simply a protocol where relevant actions by users and the context environment are included. The intention of our solutions is to support trusted interaction even in the presence of malware infected client platforms. We illustrate here only the ceremony SU and motivate Auto-login for hospitals.

In order to support cognitive server authentication, the server domain name, received in the server certificate, is mapped to a user-defined petname representing the service provider. The server certificate is also validated in the traditional way, which provides syntactic server authentication.

The actions/messages of the SU demonstrator are described at a high-level as: (1) User initiates secure TLS connection through client platform (2) Client platform contacts server (3) Server returns server certificate containing public key (4) Server certificate is forwarded to OffPAD (5) Server certificate is validated (syntactic server authentication) (6) Server certificate is mapped to Hospitals are a hectic working environment where multiple users with diverse roles interact with hospital IT shared systems for various duties like patient records, routine information, or logging of medical tasks. However, patient information security and privacy must still be ensured throughout the daily work. This implies that the staff must log on to terminals and be authorised every time they interact with IT systems. This has been found very time consuming and distracts attention from primary tasks. The inadequacy of standard username/password process is due to the following observations: (i) clinical work happens in a fast pace while login causes focus shift; (ii) medical work is nomadic and with constant interruptions while login is fixed to one computer; (iii) medical work is collaborative using shared material while login is intended for single user activities.

The OffPAD demonstrators focus on continuous, context-aware, and usable authentication mechanisms to relieve the user from the burden of a frequent login/logoff process. We demonstrate a location-based authentication mechanism where the user will be automatically logged in to a terminal when she approaches the terminal, and logged off from it when she leaves the terminal.

Discussions and Conclusion

Various applications can be imagined using OffPAD [START_REF] Varmedal | The OffPAD: Requirements and Usage[END_REF]. We mention here a few other than the six demonstrated. The method for bank transaction can be used to sign medical prescriptions. The method for loading patient record can be used in other situations, e.g., when a nurse is allowed to make changes to a resource only under the supervision of a doctor (maybe a specialist). Auto-login can be used for easy moving of patients between rooms, where the entertaining system, like preferred TV channels, are immediately transferred to the new terminal based on the location. Petnames can be associated to any kinds of domain names for sensitive services, like tax office, preferred shops, etc, and the user can do cognitive authentication of these web-sites as well.

During the demo we also use a poster to describe the OffPAD graphically. The demo uses two laptops which need to sit at least 2 meters apart, along with indoor location equipment from the project partners TellU and Sonitor. Besides, the demo also uses a smart phone application, together with the OffPAD hardware phone cover attached to the phone. 3 The demo also uses the Smart-Tracker technology from the project partner TellU, which runs in the servers of TellU, therefore, Internet connection is needed.

Figure 1 :

 1 Figure 1: OffPAD v.1 design elements

Figure 2 :

 2 Figure 2: Server authentication by the User based on petname systems managed with the OffPAD

www.offpad.org

The secure cover is a hardware prototype version 1, which does not have the proper dimensions. Unfortunately, the version 2 of the cover, with proper form factor, will appear only towards the end of the year.

Acknowledgements:

We thank all OffPAD project members who have either put effort into parts of this demo or have contributed with great ideas or discussions; particularly to: L. Dallot, L. Miralabe, and G. Cornet (TazTag, manufacturer of secure mobile hardware) K.E. Husa and S. Morka (TellU, providing IoT platform and services), M.P. Haugen (U.Oslo), C. Rosenberger and E. Cherrier (ENSI Caen GREYC lab), A. Taherkordi (Sonitor, manufacturer of indoor locating solutions).