Daniel Augot

Matthieu Finiasz

Direct Construction of Recursive MDS Diffusion Layers using Shortened BCH Codes

Keywords: Linear diffusion, recursive MDS matrices, BCH codes. contradiction

MDS matrices allow to build optimal linear diffusion layers in block ciphers. However, MDS matrices cannot be sparse and usually have a large description, inducing costly software/hardware implementations. Recursive MDS matrices allow to solve this problem by focusing on MDS matrices that can be computed as a power of a simple companion matrix, thus having a compact description suitable even for constrained environments. However, up to now, finding recursive MDS matrices required to perform an exhaustive search on families of companion matrices, thus limiting the size of MDS matrices one could look for.

In this article we propose a new direct construction based on shortened BCH codes, allowing to efficiently construct such matrices for whatever parameters. Unfortunately, not all recursive MDS matrices can be obtained from BCH codes, and our algorithm is not always guaranteed to find the best matrices for a given set of parameters.

Introduction

Diffusion layers are a central part of most block cipher constructions. There are many options when designing a diffusion layer, but linear diffusion is usually a good choice as it can be efficient and is easy to analyze. The quality of a linear diffusion layer is connected to its branch number [START_REF] Daemen | Cipher and hash function design, strategies based on linear and differential cryptanalysis[END_REF]: the minimum over all possible nonzero inputs of the sum of the Hamming weights of the input and the corresponding output of this diffusion layer. A high branch number implies that changing a single bit of the input will change the output a lot, which is exactly what one expects from a good diffusion layer. Before going into more details on how to build linear diffusion with a high branch number, let us recall some elements of coding theory.

Linear diffusion and coding theory. A linear code Γ of dimension k and length n over F q (denoted as an [n, k] q code) is a vectorial subspace of dimension k of (F q ) n . Elements of Γ are called code words. The minimal distance d of a code is the minimum over all nonzero code words c ∈ Γ of the Hamming weight of c. A [n, k] q code of minimal distance d will be denoted as an [n, k, d] q code. A generator matrix G of a code is any k × n matrix over F q formed by a basis of the vectorial subspace Γ . We say a generator matrix is in systematic form when it contains (usually on the left-most positions) the k × k identity matrix I k . The non-systematic part (or redundancy part) of G is the k × (n -k) matrix next to this identity matrix. Now, suppose a linear diffusion layer of a block cipher is defined by an invertible matrix M of size k × k over F q , so that an input x ∈ (F q ) k yields an output y ∈ (F q ) k with y = x × M . Then, the k × 2k generator matrix G M having M as its non-systematic part (the matrix defined as the concatenation of the k × k identity matrix I k and of M , as G M = [I k | M ]) generates a [2k, k] q code Γ M whose minimal distance is exactly the branch number of M . Indeed, a code word c = x × G M in Γ M is the concatenation of an input x to the diffusion layer and the corresponding output y = x × M . So the Hamming weight of every code word is the sum of the Hamming weights of an input and its output.

Optimal linear diffusion can thus be obtained by using codes with the largest possible minimal distance, namely maximum distance separable (MDS) codes. A [n, k] q code is called MDS if its minimal distance is d = n -k + 1. By extension, we will say that a matrix M is MDS when its concatenation with the identity matrix yields a generating matrix G M of an MDS code Γ M . In the context of diffusion where n = 2k being MDS means that d = k + 1: changing a single element in the input of the diffusion layer will change all the elements in its output.

We also recall the MDS conjecture: if there exists an [n, k] q MDS code, meaning an MDS code of length n and dimension k over F q , then n ≤ q + 1, except for particular cases which are not relevant to our context. All along this article we will assume that this conjecture holds [START_REF] Macwilliams | The Theory of Error Correcting Codes[END_REF].

Note on Vector Representation. In coding theory, vectors are usually represented as rows (with y = x × M ), as we have done for the moment. In cryptography, however, they are more often represented as columns (with y = M T ×x). Luckily, the transposed of an MDS matrix is also MDS, so if G M defines an MDS code, both M and M T can be used as MDS diffusion matrices. In the rest of the article we will use the column representation, which people used to the AES and the MixColumns operation are more familiar with: the diffusion layer defined by a matrix M computes y = M × x. This way, the branch number of M is the minimal distance of the code generated by

G M T = [I k | M T ].
However, in order to avoid matrix transpositions, we will rather check wether

G M = [I k | M ] generates an MDS code or not.
Recursive MDS matrices. MDS matrices offer optimal linear diffusion, but in general, they do not allow for a very compact description. Indeed, the nonsystematic part M of an MDS generator matrix cannot contain any 0 element 3 . These matrices can never be sparse and applying such a matrix to its input requires a full matrix multiplication for the diffusion. Several different techniques have been studied to obtain simpler MDS matrices, a well known example being circulant matrices (or modifications of circulant matrices) as used in the AES [START_REF] Daemen | The Design of Rijndael. Information Security and Cryptography[END_REF] or FOX [START_REF] Junod | FOX: A new family of block ciphers[END_REF]. Recently a new construction has been proposed: the so-called recursive MDS matrices, that were for example used in Photon [START_REF] Guo | The PHOTON family of lightweight hash functions[END_REF] or LED [START_REF] Guo | The LED block cipher[END_REF]. These matrices have the property that they can be expressed as a power of a companion matrix C. For example, in Photon, using the same decimal representation of elements of F 256 as in [START_REF] Guo | The PHOTON family of lightweight hash functions[END_REF]:

M =     1 2
    = C 4 , with C =     0 1 0 0 0 0 1 0 0 0 0 1 1 2 1 4     = Companion(1, 2, 1, 4).
The advantage of such matrices is that they are particularly well suited for lightweight implementations: the diffusion layer can be implemented as a linear feedback shift register that is clocked 4 times (or more generally k times), using a very small number of gates in hardware implementations, or a very small amount of memory for software. The inverse of the diffusion layer also benefits from a similar structure, see Eq. ( 1) for a particular case.

Outline. In the next section, we will present previous methods that have been used to find recursive MDS matrices. Then, in Section 3, we will introduce BCH codes and shortened BCH codes, show that they too can yield recursive MDS matrices, and give a direct construction of such matrices. In Section 4 we will then describe an algorithm to explore all BCH codes and the MDS diffusion layers they yield for given parameters. We will conclude with a few experimental results.

Exhaustive Search for Recursive MDS Matrices

Exhaustive search for recursive MDS matrices can be quite straightforward:

-pick some parameters: the matrix size k and the field size q = 2 s , -loop through all companion matrices C of size k over F q , -for each C, computes its k-th power and check if it is MDS.

However, this technique is very expensive as there are many companion matrices (2 ks , which could be 2 128 for an 128-bit cipher) and checking if a matrix is MDS is also expensive (the number of minors to compute is exponential in k). Also, it does not specially explore the most efficient matrices first. In the Photon example, the matrix uses very sparse coefficients (the field elements represented by 1, 2 and 4) to make the implementation of their operations on inputs even more efficient. Exhaustive search should focus on such matrices.

Following this idea, Sajadieh et al. [START_REF] Sajadieh | Recursive diffusion layers for block ciphers and hash functions[END_REF] proposed to split the search in two. Their companion matrices are symbolic matrices C(X) which have coefficients in the polynomial ring F q [X] where X is an indeterminate, which will be substituted later by some F 2 -linear operator L of F q . Then their search space is reduced to symbolic companion matrices C(X) whose coefficients are small degree polynomials in X (small degree polynomials will always yield a rather efficient matrix). Once C(X) is raised to the power k, to get D(X) = C(X) k , the matrix D(X) will give an MDS matrix D(L) when evaluated at a particular L, if for all i ≤ k, all its i × i minors evaluated at L are invertible matrices (non-zero is enough in a field, but now the coefficients are F 2 -linear operators). Indeed, for a symbolic matrix D(X), the minors are polynomials in X, and their evaluation at a particular linear operator L needs to be invertible matrices.

This way, for each matrix C(X) explored during the search, the minors of all sizes of D(X) = C(X) k are computed: some matrices have minors equal to the null polynomial and can never be made MDS when X is substituted by a linear operator L, for the others this gives (many) algebraic polynomials in X which must not vanish when evaluated at L, for the k-th power D(L) to be MDS. Then, the second phase of the search of Sajadieh et al. is to look for efficient operators L such that all the above minors are non zero when evaluated at L. The advantage of this technique is that it finds specially efficient recursive MDS matrices, but the computations of the minors of symbolic matrices can be pretty heavy, because of the growth of the degree of the intermediate polynomials involved. In the case of Photon, the matrix could be found as C = Companion(1, L, 1, L 2 ) where L is the multiplication by the field element represented by 2.

Continuing this idea and focusing on hardware implementation, Wu, Wang, and Wu [START_REF] Wu | Recursive diffusion layers for (lightweight) block ciphers and hash functions[END_REF] were able to find recursive MDS matrices using an impressively small number of XOR gates. They used a technique similar to Sajadieh et al., first searching for symbolic matrices with a list of polynomials having to be invertible when evaluated in L, then finding an F 2 -linear operator L using a single XOR operation and with a minimal polynomial not among the list of polynomials that have to be invertible.

Then, looking for larger recursive MDS matrices, Augot and Finiasz [START_REF] Augot | Exhaustive search for small dimension recursive MDS diffusion layers for block ciphers and hash functions[END_REF] proposed to get rid of the expensive symbolic computations involved in this technique by choosing the minimal polynomial of L before the search of companion matrices C(X). Then, all computation can be done in a finite field (modulo the chosen minimal polynomial of L), making them much faster. Of course, assuming the MDS conjecture holds, the length of the code cannot be larger than the size of the field plus one, so for an L with irreducible minimal polynomial of degree s, the field is of size q = 2 s , and k must verify 2k ≤ 2 s + 1. Larger MDS matrices will require an operator L with a higher degree minimal polynomial. Also, in the case where the bound given by the MDS conjecture is almost met (when k = 2 s-1 ), Augot and Finiasz noted that all companion matrices found had some kind of symmetry: if the k-th power of Companion

(1, c 1 , c 2 , . . . , c k-1 ) is MDS, then c i = c k-i for all 1 ≤ i ≤ k-1 2 .

An Interesting Example

One of the symmetric MDS matrices found by Augot and Finiasz [START_REF] Augot | Exhaustive search for small dimension recursive MDS diffusion layers for block ciphers and hash functions[END_REF] for k = 8 and F q = F 16 is

C = Companion(1, α 3 , α 4 , α 12 , α 8 , α 12 , α 4 , α 3 )
with α 4 +α+1 = 0. As we will see later, there is a strong link between companion matrices and the associated polynomial, here

P C (X) = 1 + α 3 X + α 4 X 2 + α 12 X 3 + α 8 X 4 + α 12 X 5 + α 4 X 6 + α 3 X 7 + X 8 .
In this example, this polynomial factors into terms of degree two:

P C (X) = (1 + α 2 X + X 2 )(1 + α 4 X + X 2 )(1 + α 8 X + X 2 )(1 + α 9 X + X 2 ),
meaning that P C (X) is split in a degree-2 extension of F 16 , the field F 256 .

If we now consider P C (X) in F 256 [X], which we can, since F 16 is a subfield of F 256 , and look for its roots in F 256 , we find that there are 8 roots in F 256 , which, for a certain primitive 255-th root of unity β ∈ F 256 , are

[β 5 , β 6 , β 7 , β 8 , β 9 , β 10 , β 11 , β 12 ].
This indicates a strong connection with BCH codes that we will now study.

Cyclic Codes, BCH Codes, and Shortening

Before jumping to BCH codes, we must first note a few things that are true for any cyclic code and not only BCH codes. For more details on the definition and properties of cyclic codes, the reader can refer to [START_REF] Macwilliams | The Theory of Error Correcting Codes[END_REF].

A Systematic Representation of Cyclic Codes

An [n, k] q code is said to be cyclic if a cyclic shift of any element of the code remains in the code. For example, the code defined by the following generator matrix G over F 2 is cyclic:

G =     1 0 1 1 0 0 0 0 1 0 1 1 0 0 0 0 1 0 1 1 0 0 0 0 1 0 1 1     .
A cyclic shift to the right of the last line of G gives (1, 0, 0, 0, 1, 0, 1) which is the sum of the first, third and last lines of G, thus remains in the code: G indeed generates a cyclic code.

c 0 c 1 ... c k-1 c k-2 Fig. 1. An LFSR corresponding to the companion matrix C of polynomial g(X) = X k + c k-1 X k-1 + ... + c0. Clocking it k times is equivalent to applying C k to its internal state.
Cyclic codes can also be defined in terms of polynomials: (1, 0, 1, 1, 0, 0, 0) corresponds to 1 + X 2 + X 3 and a cyclic shift to the right is a multiplication by X modulo X n -1. This way, cyclic codes can be seen as ideals of F q [X]/(X n -1), meaning that each cyclic code Γ can be defined by a generator polynomial g(X) such that Γ =< g(X) > and g(X) divides X n -1. Then, the code defined by g(X) has dimension k = n -deg(g). In our example, g(X) = 1 + X 2 + X 3 , which divides X 7 -1, and the code is indeed of dimension 4.

Any multiple of g(X) is in the code, so for any polynomial P (X) of degree less than n, the polynomial P (X) -(P (X) mod g(X)) is in the code. Using this property with P (X) = X i for i ∈ [deg(g), n -1], we obtain an interesting systematic form for any cyclic code generator matrix:

G =     -X 3 mod g(X) 1 0 0 0 -X 4 mod g(X) 0 1 0 0 -X 5 mod g(X) 0 0 1 0 -X 6 mod g(X) 0 0 0 1     =     1 0 1 1 0 0 0 1 1 1 0 1 0 0 1 1 0 0 0 1 0 0 1 1 0 0 0 1     .
This form is exactly what we are looking for when searching for powers of companion matrices. Indeed, if we associate the companion matrix C = Companion(c 0 , . . . , c k-1 ) to the polynomial g

(X) = X k + c k-1 X k-1 + • • • + c 0 ,
then the successive powers of C are (continuing with our example where k = 3):

C =   0 1 0 0 0 1 -X 3 mod g(X)   , C 2 =   0 0 1 -X 3 mod g(X) -X 4 mod g(X)   , C 3 =   -X 3 mod g(X) -X 4 mod g(X) -X 5 mod g(X)   .
To build recursive MDS matrices we thus simply need to build MDS cyclic codes with suitable parameters and their corresponding g(X).

Note that a multiplication by a companion matrix can also be expressed in terms of LFSR. Initializing the LFSR of Fig. 1 with a vector and clocking it once corresponds to the multiplication of this vector by C. Clocking it k times corresponds to the multiplication by M = C k . We will continue using the matrix representation in the rest of the paper, but most results could also be expressed in terms of LFSR.

BCH Codes and Shortened BCH Codes

In general, given a generator polynomial g(X), computing the minimal distance of the associated cyclic code is a hard problem. For instance, the code generated by g(X) = 1 + X 2 + X 3 in the example of the previous section has minimal distance 3, but even for such small examples it is not necessarily immediate to find the minimum distance. Nonetheless, lower bounds exist for some specific constructions. This is the case for BCH codes, as described for example in [START_REF] Macwilliams | The Theory of Error Correcting Codes[END_REF].

Definition 1 (BCH codes). A BCH code over F q is defined using an element β in some extension F q m of F q . First, pick integers ℓ and d and take the (d -1) consecutive powers β ℓ , β ℓ+1 , . . . , β ℓ+d-2 of β, then compute g(X) = lcm(Min Fq (β ℓ ), . . . , Min Fq (β ℓ+d-2 )), where Min Fq (β ℓ ) is the minimal polynomial of β ℓ over F q .

The cyclic code over F q of length ord(β) defined by g(X) is called a BCH code, it has dimension (ord(β) -deg(g)) and has minimal distance at least d. We write this as being an [ord(β), ord(β) -deg(g), ≥ d] q code.

For such a BCH code to be MDS, g(X) must have degree exactly d -1 (for a cyclic code deg(g(X)) = n -k and for an MDS code d = n -k + 1, so an MDS BCH code necessarily verifies deg(g(X)) = d -1). Seeing that g(X) already has d -1 roots over F q m , it cannot have any other roots. This means that the powers β ℓ+j , j = 0, . . . , d -2, must all be conjugates of each other.

The need for shortening. When building diffusion layers, the input and output of the diffusion generally have the same size (otherwise inversion might be a problem), so we need codes of length 2k and dimension k. In terms of BCH codes, this translates into using k consecutive powers of an element β of order 2k, and having g(X) of degree k. Of course, elements of even order do not exist in extensions of F 2 , so this is not possible. Instead of using full length BCH codes, we thus use shortened BCH codes.

Definition 2 (Shortened code). Given a [n, k, d] q code Γ , and a set I of z indices {i 1 , . . . , i z }, the shortened code Γ I of C at indices from I is the set of words from Γ which are zero at positions i 1 , . . . , i z , and whose zero coordinates are deleted, thus effectively shortening these words by z positions. The shortened code Γ I has length n -z, dimension ≥ k -z and minimal distance ≥ d.

If Γ is MDS, then d = n-k+1 and Γ I will necessarily be an [n-z, k-z, d] q MDS code, as neither the dimension nor the minimal distance can increase without breaking the Singleton bound [START_REF] Singleton | Maximum distance q-nary codes[END_REF].

We can thus look for [2k + z, k + z, k + 1] q BCH codes and shorten them on z positions to obtain our MDS codes. However, shortened BCH codes are no longer cyclic, so the shortening has to be done in a way that conserves the recursive structure. This is easy to achieve by using the previous systematic representation and shortening on the last positions. Starting from g(X) of degree k, which divides X 2k+z -1, we get a generating matrix:

G =     X k mod g(X) 1 0 0 0 X k+1 mod g(X) 0 1 0 0 • • • • • • X 2k+z-1 mod g(X) 0 0 0 1     .
size k+z Shortening the code on the z last positions will maintain the systematic form and simply remove the z last lines to obtain:

G I =     X k mod g(X) 1 0 0 0 X k+1 mod g(X) 0 1 0 0 • • • • • • X 2k-1 mod g(X) 0 0 0 1     . size k
As said above, when G generates an MDS code, then G I also generates an MDS code, and this is (up to a permutation of the two k × k blocks, that will not affect the MDS property) exactly what we are looking for: a recursive MDS matrix defined by the companion matrix associated to the polynomial g(X).

Direct Construction of Recursive MDS Matrices

From this result, in the case where q = 2 s , we can deduce a direct construction of recursive MDS matrices based on MDS BCH codes that were already described in [START_REF] Macwilliams | The Theory of Error Correcting Codes[END_REF], Chapter 11, §5. We first pick a β of order q + 1. As q + 1 divides q 2 -1, β is always in F q 2 , the degree-2 extension of F q . Then, apart from β 0 = 1, all powers of β have minimal polynomials of degree 2: since β is of order q + 1, each β i has a conjugate β qi = β -i which is the second root of Min Fq (β i ). From there, it is easy to build a [q + 1, q + 1 -k, k + 1] q MDS BCH code for any value of k ≤ q 2 . -If k is even, we need to select k consecutive powers of β that are conjugates by pairs: if β i is selected, β q+1-i is selected too. We thus select all the powers

β i with i ∈ [ q-k 2 + 1, q+k 2 ], grouped around q+1 2 .
-If k is odd, we need to select β 0 as well. We thus select all the powers

β i with i ∈ [-k-1 2 , k-1 2 ]
, grouped around 0. In both cases, we get a polynomial g(X) of degree k defining an MDS BCH code of length q + 1. We can then shorten this code on z = (q + 1 -2k) positions and obtain the [2k, k, k +1] q MDS code we were looking for. The non-systematic part of the generator matrix of this code is the k-th power of the companion matrix defined by g(X).

Also, as the conjugate of β i is its inverse, g(X) enjoys the same symmetry as the example of Section 2.1: X k g(X -1 ) = g(X). This explains the symmetry observed in [START_REF] Augot | Exhaustive search for small dimension recursive MDS diffusion layers for block ciphers and hash functions[END_REF]. Furthermore, the companion matrix associated to g(X) thus has at most k 2 different coefficients and can be implemented with at most k 2 multiplications. Finally, by cycling over all β of order q + 1, in the case where 2k = q we were able to recover with this direct construction all the solutions found in [START_REF] Augot | Exhaustive search for small dimension recursive MDS diffusion layers for block ciphers and hash functions[END_REF] through exhaustive search. We conjecture that when 2k = q, the only recursive MDS matrices that exist come from these shortened BCH codes.

An Algorithm to Find All MDS BCH Codes

We have seen that shortened BCH codes allow to directly build recursive MDS matrices. However, when building a block cipher, the designer usually has some parameters in mind (say, a diffusion layer on k symbols of s bits each) and wants the best diffusion layer matching these parameters. Our direct construction gives good solutions, but cannot guarantee they are the best. So the designer needs an algorithm that will enumerate all possible matrices and let him pick the most suitable one. For this, we will consider BCH codes where β is a (2k + z)-th root of unity and not only a (2k + 1)-th root of unity as in the direct construction. First, there are a few constraints to consider.

Field Multiplication or F 2 -linearity? The designer has to choose the type of linearity he wants for his diffusion layer. If he wants (standard) linearity over F 2 s , then the BCH code has to be built over F 2 s (or a subfield of F 2 s , but the construction is the same). However, as in the Sajadieh et al. [START_REF] Sajadieh | Recursive diffusion layers for block ciphers and hash functions[END_REF] or the Wu et al. [START_REF] Wu | Recursive diffusion layers for (lightweight) block ciphers and hash functions[END_REF] constructions, he could choose to use an F 2 -linear operator L. Assuming L has an irreducible minimal polynomial of degree s ′ ≤ s (see [START_REF] Augot | Exhaustive search for small dimension recursive MDS diffusion layers for block ciphers and hash functions[END_REF] for how to deal with non-irreducible minimal polynomials), then he needs to build a BCH code over F 2 s ′ . This choice is up to the designer but does not change anything to the rest of the algorithm, so we will assume s ′ = s.

The MDS Conjecture. Our shortened BCH construction starts by building an MDS code of length 2k + z over F 2 s . The MDS conjecture tells us that 2k + z ≤ 2 s + 1 must hold. When k = 2 s-1 , z = 1 is the only choice. In general, we can choose any z ∈ [1, 2 s + 1 -2k], so the algorithm will need to try all these possibilities.

Minimal Polynomials of Roots of Unity. The β involved in the BCH construction is a (2k + z)-th root of unity, and g(X) is formed as the product of minimal polynomials of powers of β. First, (2k + z)-th roots of unity must exist, meaning 2k + z must be odd (or more generally coprime with q when q is not 2 s ). Then, when factorizing X 2k+z -1, the minimal polynomials of the β i are factors of this decomposition, and g(X) is the product of some of these factors. It must thus be possible to obtain a polynomial of degree k this way. This is not always possible: for example, X 23 -1 decomposes over F 2 8 in a factor of degree 1 and two factors of degree 11 and very few values of k can be obtained. However, this last condition is rather complex to integrate in an algorithm and it will be easier to simply not take it into account.

A Simple Algorithm

For given parameters k and q = 2 s we propose to use Algorithm 1 to enumerate all possible recursive MDS matrices coming from shortened BCH codes. This algorithm explores all code lengths from 2k + 1 to q + 1, meaning that the number of shortened columns can be much larger than the final code we are aiming for. Instead of computing minimal polynomials and their least common multiple as in the definition of BCH codes we directly compute

k-1 j=0 (X -β ℓ+j ) and check if it is in F q [X]
. This allows the algorithm to be more efficient and also makes upper bounding its complexity much easier. The following lemma shows that the two formulations are equivalent.

Lemma 1. A BCH code over F q defined by the d -1 roots [β ℓ , ..., β ℓ+d-2 ] is MDS, if and only if P (X) = d-2 j=0 (X -β ℓ+j ) is in F q [X]. In this case, g(X) = lcm Min Fq (β ℓ ), ..., Min Fq (β ℓ+d-2 ) is equal to P (X).
Proof. We have seen that a BCH code is MDS if and only if g(X) is of degree d -1 exactly. Also, g(X) is always a multiple of P (X).

First, assume we have an MDS BCH code. Then g(X) is of degree d -1 and is a multiple of P (X) which is also of degree d -1. So, up to a scalar factor, g(X) = P (X) and P (X) ∈ F q [X].

Conversly, assume we have a BCH code such that P (X) ∈ F q [X]. Then, for any j ∈ [0, d -2], P (X) is a polynomial in F q [X] having β ℓ+j as a root, so P (X) is a multiple of Min Fq (β ℓ+j ). Therefore, g(X) divides P (X) and, as P (X) also divides g(X), we have g(X) = P (X). g(X) thus has degree d -1 and the code is MDS. ⊓ ⊔

Complexity

The previous algorithm simply tests all possible candidates without trying to be smart about which could be eliminated faster. It also finds each solution several times (typically for β and β -1 ), and finds some equivalent solutions (applying α → α 2 on all coefficients of the polynomial preserves the MDS property, so each equivalence class is found s times). The product at line 7 does not have to be fully recomputed for each value of ℓ. It can be computed once for ℓ = 0, then one division by (X -β ℓ ) and one multiplication by (X -β ℓ+k ) are enough to update it at each iteration. This update costs O(k) operations in the extension of F q containing α. The whole loop on ℓ can thus be executed in O((2k + z)k) operations in the extension field.

The number of β for which the loop has to be done is Euler's phi function ϕ(2k+z) which is smaller than (2k+z), itself smaller than q, and there are q-2k 2 + 1 values of z to test. This gives an overall complexity of O(q 2 k(q-2k)) operations Algorithm 1: Search for Recursive MDS Matrices Input: parameters k and s Output: a set S of polynomials yielding MDS matrices 1 q ← 2 s 2 S ← ∅ 3 for z ← 1 to (q + 1 -2k), with z odd do in an extension of F q . This extension is of degree at most 2k + z, so operations are at most on q log q bits in this extension and cost at most O(q 2 (log q) 2 ). This gives an upper bound on the total complexity of O q 4 k(q -2k)(log q) 2 binary operations, a degree-6 polynomial in k and q. This is a quite expensive, but as we will see in the next section, this algorithms runs fast enough for most practical parameters. It should also be possible to accelerate this algorithm using more elaborate computer algebra techniques.

Experimental Results

We implemented Algorithm 1 in Magma [START_REF] Bosma | The Magma algebra system. I. The user language[END_REF] (see the code in Appendix A) and ran it for various parameters.

5.1

The Extremal Case: 2k = 2 s .

First, we ran the algorithm for parameters on the bound given by the MDS conjecture, that is, when 2k = 2 s . These are the parameters that were studied by Augot and Finiasz in [START_REF] Augot | Exhaustive search for small dimension recursive MDS diffusion layers for block ciphers and hash functions[END_REF]. It took their algorithm 80 days of CPU time to perform the exhaustive search with parameters k = 16 and s = 5 and find the same 10 solutions that our new algorithm finds in a few milliseconds. The timings and number of solutions we obtained are summarized in Table 1. We were also able to find much larger MDS diffusion layers. For example, we could deal with k = 128 elements of s = 8 bits, which maybe is probably too large to be practical, even with a recursive structure and the nice symmetry. Below

The General Case

We also ran some computations for other interesting parameters, typically for values of k and s that are both powers of 2 as it is often the case in block ciphers.

The results we obtained are summarized in Table 2. Note that for these solutions the number of shortened positions is sometime huge: for k = 4 and s = 8 one can start from a [257, 253, 5] 256 BCH code and shorten it on 249 positions to obtain a [START_REF] Macwilliams | The Theory of Error Correcting Codes[END_REF][START_REF] Daemen | The Design of Rijndael. Information Security and Cryptography[END_REF][START_REF] Guo | The PHOTON family of lightweight hash functions[END_REF] 256 code. We counted both the total number of solutions we found and the number of regular solutions where the constant term of the polynomial is 1.

Regular solutions are particularly interesting as the diffusion and its inverse share the same coefficients:

Companion(1, c 1 , . . . , c k-1 ) -1 =     0 1 0 . . . 0 0 1 1 c 1 c k-1     -1 =     c 1 c k-1 1 1 0 0 . . . 0 1 0     . (1)
In the case of symmetric solutions (like those from Section 3.3), encryption and decryption can even use the exact same circuit by simply reversing the order of the input and output symbols. Here are some examples of what we found:

-for parameters k = 4 and s = 4, with α such that α 4 +α+1 = 0, the matrices Companion(1, α 3 , α, α 3 ) 4 and Companion(α 3 + α, 1, α, α 3 ) 4 are MDS. -for parameters k = 4 and s = 8, with α such that α 8 + α 4 + α 3 + α 2 + 1 = 0, the matrices Companion(1, α 3 , α -1 , α 3 ) 4 , Companion(1, α 3 +α 2 , α 3 , α 3 +α 2 ) 4 , and Companion(α + 1, 1, α 202 + 1, α 202 ) 4 are MDS.

The reader might note the absence of larger fields in Table 2. One could for example want to obtain a 128-bit diffusion layer using k = 8 symbols of s = 16 bits. However, going through all the possible values of z and ℓ takes too long with q = 2 16 . Our algorithm is too naive, and an algorithm enumerating the divisors of X 2k+z -1 of degree k and checking if they correspond to BCH codes could be faster in this case. Otherwise, it is always possible to use the direct construction given in Section 3.3.

Further Work

As we have seen, for most parameters, this algorithm runs fast enough to find all recursive MDS matrices coming from BCH codes. However, not all recursive MDS matrices come from a BCH code.

-First, there are other classes of cyclic codes that are MDS and could be shortened in a similar way. Any such class of codes can directly be plugged into our algorithm, searching for polynomials g(X) having another structure than roots that are consecutive powers of β. -Then, there also are cyclic codes which are not MDS, but become MDS once they are shortened. These will be much harder to track as they do not have to obey the MDS conjecture and can have a much larger length before shortening.

For this reason, we are not always able (yet) to find the most efficient matrices with our algorithm. For example, the matrix used in Photon corresponds to a cyclic code of length 2 24 -1 over F 2 8 which is not MDS. We know that this code has minimum distance 3, and its distance grows to 5 when shortened from the length 2 24 -1 to the length 8. However, for some parameters, our algorithm is able to find very nice solutions. For k = 4 and α verifying α 5 + α 2 + 1 = 0 (a primitive element of F 2 5 , or an F 2 -linear operator with this minimal polynomial), the matrix Companion(1, α, α -1 , α) found by Algorithm 1 yields an MDS diffusion layer. This is especially nice because it is possible to build simple F 2 -linear operators that also have a simple inverse, and this solution is symmetric meaning the inverse diffusion can use the same circuit as the diffusion itself.

Conclusion

The main result of this article is the understanding that recursive MDS matrices can be obtained directly from shortened MDS cyclic codes. From this, we derive both a direct construction and a very simple algorithm, based on the enumeration of BCH codes, that allows to efficiently find recursive MDS matrices for any diffusion and symbol sizes. These constructions do not always find all existing recursive MDS matrices and can thus miss some interesting solutions. As part of our future works, we will continue to investigate this problem, trying to understand what properties the other solutions have and how we can extend our algorithm to find them all. A first step is to elucidate the Photon matrix in terms of cyclic codes which are not BCH codes, hopefully finding a direct construction of this matrix. However, in the same way as computing the minimal distance of a cyclic code is difficult, it might turn out that finding all recursive MDS matrices of a given size is a hard problem.

4 α 9 SFig. 2 .

 492 Fig. 2. Algorithm searching for MDS BCH codes

Table 1 .

 1 Experimental results for parameters on the bound given by MDS conjecture. The value "diff. bits" is the size in bits of the corresponding diffusion layer. The number of solutions is given as both the raw number and the number of distinct equivalence classes.

	k s	diff. bits num. classes solutions	time
	4 3 12	3	1	<0.01s
	8 4 32	8	2	<0.01s
	16 5 80	10	2	<0.01s
	32 6 192	24	4	∼0.02s
	64 7 448	42	6	∼0.07s
	128 8 1024 128	16	∼0.52s
	256 9 2304 162	18	∼1.71s

Table 2 .

 2 Experimental results for other interesting parameters. The reg. solutions refer to regular solutions where the constant term of the polynomial is 1.

	k s	diff. solutions bits num. reg.	time
	4 4 16	68	12 ∼0.02s
	4 8 32 20180 252 ∼37s
	8 8 64 20120 248 ∼44s
	16 8 128 19984 240 ∼55s
	32 8 256 19168 224 ∼80s
	are the logs in base α (with α 8 + α 4 + α 3 + α 2 + 1 = 0) of the last line of the
	companion matrix of an example of such 1024-bit diffusion:
	[0, 83, 25, 136, 62, 8, 73, 112, 253, 110, 246, 156, 53, 1, 41, 73, 5, 93, 190, 253, 149,
	98, 125, 124, 149, 94, 100, 41, 37, 183, 81, 6, 242, 74, 252, 104, 57, 117, 55, 224,
	153, 130, 77, 156, 192, 176, 52, 133, 218, 59, 158, 18, 228, 89, 218, 126, 146,
	210, 217, 18, 84, 209, 30, 123, 97, 123, . . .

[ symmetric ]

. . . , 83]

If the non-systematic part M of an MDS generator matrix contained a 0, then the line of GM containing this zero would have Hamming weight ≤ k, which is in

A Magma Code

Here is the Magma code for Algorithm 1. Simply run BCH(k,s) to get the set of all polynomials of degree k over F 2 s that yield MDS diffusion layers on ks bits. Of course, these polynomials have to be written as companion matrices which then have to be raised to the power k to obtain the final MDS matrices.


Middle Eastern collections of Orientalist painting at the turn of the 21 st Century:

Paradoxical reversal or persistent misunderstanding?

Mercedes VOLAIT

"Collectors-those mythical figures about whom there are still sometimes so many assumptions, approximations, uncertainties, misunderstandings." 1 In a recent talk, the art historian Marc Gotlieb mischievously credited Edward Said with the rediscovery of Jean-Léon Gérôme: Who had ever heard of this prolific pompier painter, cast into oblivion by the death of academicism, before his 1880 Charmeur de serpents was chosen for the cover of an early edition of Said's Orientalism? 2 Though we can be fairly certain the Palestinian intellectual was not himself responsible for that iconographic choice, there can be no doubt that Orientalist painting's return to fashion owes much to the Middle East. This is of course not the only facet of the phenomenon: pictorial Orientalism came to be reassessed in the larger framework of a rehabilitation of the nineteenth century as a whole. A major milestone in that process was the October 20, 1977 decision of the French inter-ministerial council, acting on the initiative of President Valéry Giscard d'Estaing, to create the Musée d'Orsay in Paris. In its galleries, the enlightened public learned to take a different view of academicism and nineteenth-century official or pompier painting, to discover its visual qualities and skillful execution. But as all art professionals-experts, museum curators, exhibition organizers-in contact with the market for Orientalist painting can attest and indeed have attested, 3 it has long been the case that most transactions are made by private or institutional buyers originally from or based in the Middle East, and to a lesser degree North Africa. It is these buyers who are responsible for the record prices of Orientalist painting after nearly half a century of art world indifference. With regard to Said's critique this situation may seem paradoxical, as Roger Benjamin quite rightly pointed out in one of the first texts on the subject. 4 Indeed, if we subscribe to the radical critique of this pictorial genre developed in the last decades, how are we to explain the fact that Turkish, Iranian and Arab collectors have been spending fortunes-an 1876 canvas by Gérôme entitled Femme circassienne voilée went for 2.5 million euros in 2008, a record for the painter to this day5 -to acquire stereotypical, supposedly disparaging representations of their own societies? 6 More prosaically, how are we to make sense of a phenomenon confined primarily to the closed world of art dealing and the equally closed interiors of powerful private owners, spaces that are by definition not really 4 Benjamin, "Post-colonial taste."

accessible to researchers? What heuristic and societal value are we to grant to Middle Eastern devotion to collecting Orientalist paintings, once we have acknowledged that the phenomenon concerns no more than a few handfuls of individuals representing a very small segment of their societies? Museum studies dispel these reservations by recalling the high degree of porosity between private art choices and the shaping of public tastes. Lying dormant in every private collection is a possible common good. Public collections, meanwhile, amount to random groupings of private collections that entered the public domain in the form of donations and acquisitions. 7 We know that the donations to the Louvre that followed on the pillaging of the Napoleonic period were instrumental in shaping the content and contours of the museum's collections, and that acquisition choices are strongly influenced by donors and art dealers (who are sometimes the same individuals). [START_REF]Les donateurs du Louvre[END_REF] My study of nineteenth-century collectors in Egypt, Fous du Caire, shows how the "private passions" of French and Egyptian art lovers, the domestic, everyday "commerce" with Islamic art objects in Orientalist interiors created with architectural salvages, and activities aimed at preserving Egypt's cultural heritage were not only not antinomic but actually worked together to create a whole, ultimately helping to change the way Islamic art was viewed by providing access to the collected artefacts and endowing them with value. [START_REF] Volait | Fous du Caire: excentriques, architectes and amateurs d'art en Egypte (1867-1914[END_REF] My hypothesis here is that we have only to pay serious attention to the objects acquired, who acquires them and what the acquirers say about what they do 10 for the practice of collecting Orientalist art to offer a useful perspective for observing a phenomenon of much greater scope; namely, the ambivalences, selective sorting systems and misunderstandings at the core of all cultural interaction.

A well-guarded secret?

First it should be recalled that Middle Eastern collections of Orientalist paintings have existed for some time, though the phenomenon has not been studied in any detail. The case of the diplomat Khalil-bey (1831-1879), for whom Courbet painted L'origine du monde (1866) and who caused quite a stir in Paris for his love of gambling, women and erotic imagery, is an exception. [START_REF] Haddad | un homme, une collection[END_REF] The ancient and modern art collection assembled from 1865 to 1868 in Paris by this "parfait honnête homme," in Courbet's words, [START_REF]Correspondance de Courbet[END_REF] contained no fewer than 108 objects; it was dispersed by public auction on January 16, 1868, to pay the owner's gambling debts. The collection contained a few Orientalist works of the first order, including Ingres' Bain turc (1862), now in the Louvre. Together with exhibition loans, auctions are extremely welcome information sources, affording us a peek into otherwise hermetically sealed worlds. The recent obsession with provenance (information now almost systematically indicated in museum text labels and data bases), together with the fact that a great number of sale and exhibition catalogues and inventories can now be consulted online, has changed the situation: practices that used to be difficult to research have become more transparent.

The fact remains that in the nineteenth century, the elites and reigning dynasties of the eastern Mediterranean proved good customers for "Orientalist" painting, which at the time had the virtue of being "contemporary art." The fairly simple, direct relations between the Pasha of Egypt Mehmet-Ali (1769-1849) and the fine arts inspired Gaston Wiet to write a voluminous monograph attesting to the pasha's frequent contacts with the Orientalist school and his regular commissions. [START_REF] Wiet | Muhammad Ali et les Beaux-Arts[END_REF] In 1876, the art dealer Goupil furnished a series of French paintings to the Dolmabahçe Palace in Istanbul, among them Fromentin's Bords du Nil (1872) and other works with Oriental subjects. The go-between was an aide-de-camp of the sultan Abdülaziz, Şeker Ahmed Pasha, who had spent some time in Paris and prided himself on his knowledge of painting. Mathaf quickly became the leader in the field but was not the only gallery to move into the niche. In 1976, Patrick and Viviane Berko opened a gallery in Belgium specialized in Orientalist painting that was also quite successful. [START_REF] Berko | Orientalist Painting-Peinture Orientaliste[END_REF] The Paris art auctioneer Henri Gros, a French specialist of the genre, says he began selling Orientalist art in 1985 and has since organized no fewer than 45 sales. [START_REF]Orientalisme et art islamique[END_REF] Museums soon followed suit. The Orientalists: Delacroix to Matisse: European Painters in North Africa and the Near East was held at London's Royal Academy of the Arts in 1984, then traveled to Washington, D.C.'s National Gallery of Artthe prelude to a long series of cultural events, the latest being De Delacroix à Kandinsky: l'orientalisme en Europe, an exhibition which opened in Brussels in 2010 and traveled through Europe in 2011. [START_REF] Delacroix À Kandinsky | l'orientalisme en Europe[END_REF] Collector taste turns out to have been a driving force, fueling business enterprises, exhibition projects, museum acquisitions, and even epistemological transfer. For while the art market changes in accordance with buyer demand and the supply that dealers, experts and auctioneers manage to keep coming even as the vein is being exhausted and the number of fakes rises, that market in turn impacts on how Orientalist art is understood, to the point of actually altering historiographic categorizations. Pictorial Orientalism was long sold at auctions of nineteenth-century European art as a subcategory of such art. Today, however, most "Islamic art" sales have an "Orientalism" section-the term "Arts of the Orient" was invented to accommodate this addition. Conversely, "Orientalism" sales are increasingly likely to have an "Islamic art" section, and even a modern Arab, Turkish and Iranian art section, in a broad continuum dictated by the direct relations that exist today between Europe and the space of the Orient and encompassing anything related to that geography. 31 In this respect, Orientalism is moving out of the European field and into the "non-Western" one-the latest neologism produced by post-colonial theory-thereby following art market demand (buyers for the two segments are the same), much to the displeasure of specialists at pains to argue the need for a strict separation between "Islamic art," "Contemporary art" and "Orientalism" on the grounds that only the first of these is "authentic." 32 We can predict with some confidence that market restructuring of this sort will lead to changes in the academic field. roses), Islamic ceramics and modern Egyptian painting. 37 During the 2010 celebrations of Doha as capital of Arab culture-just as Istanbul was assuming the same role for Europecame the momentous opening of Qatar's Orientalist Museum. The institution claims to be the only one of its kind in the world. In the short decade leading up to the opening, it assembled around 900 first-order works, ranging from the early sixteenth century and encompassing all ramifications of Orientalism up to the twenty-first. The Qatar museums include precious photography collections (daguerreotypes, original prints by the great photography "primitives") that strongly emphasize the Middle East. These two initiatives (the Orientalist museum and the photographic collection) manifest not only the Qatari strategy of achieving economic development through culture but also the desire to regain control of the discourse on self. In the words of an advisor to the Emir of Qatar, Yusuf Ahmad Al-Homaid, "All in all, the presentation of these works comes off as a reclamation of history, a way of 'de-Orientalizing' the exotic scenes. We're recapturing the culture and trying to present it again." 38 With its 1792 artworks and 50 000 books, the collection did not readily lend itself to exhibition, especially in a city already saturated with museums. Most of the paintings are modest not to say poorly executed, since price was a primary acquisition criteria. Another constraint was Dr Dahesh's interests. Centered as it is around realism, mythological subjects and works whose moral teaching was consistent with his own spirituality, the collection did not have much aesthetic coherence. The task of finding a clear and attractive main theme for the new institution fell to the American anthropologist Flora Kaplan, head of New York University's museum studies program. 42 The Museum's first publication, dating from 1993, set the tone:

The Dahesh Museum is rooted in European and Middle Eastern humanist tradition. Its collections […] are intended to express the notion of art as universal truth… In a period of conflicts and divisiveness around the world, it is both a labor of love and a demonstration of responsibility to honor a promise given, and to offer the public an oasis for quiet contemplation and renewed faith in the human spirit expressed through art. 43 That same year the curator David Farmer, specialist of the Renaissance but with significant museum experience, was hired to head the Dahesh Museum, to identify the collection's strong points and figure out how to develop it further. Only 47 works in the collection were of some value (including Orientalist paintings by Frère, Clairin and Carl Vernet). A possible niche was identified-European academic art, including Orientalism-and it was this acquisition strategy that was pursued. From 1995 to 2005, acquisitions plus donations (which the museum began receiving in 2001) enriched the collection by 200 works, including paintings by Alma-Tadema, Bouguereau, Cabanel, Delaroche, Doré, Fabre, Gérôme, Lecomte de Nouÿ, Leighton, Merson, Troyon, Vernet, and others. These new holdings fueled a rich program of exhibitions of French and British art as well as academic symposiums, thus fully legitimizing the entreprise. When at last the museum opened in 1995 it won praise from the public and critics alike, but it closed in 2007 when no long-term solution could be found for housing the collection. Traveling exhibitions continue to be organized and a store in Manhattan sells derivative products while the collection waits for permanent premises.

The Shafik Gabr collection, installed in a vast residence in the stylish Qattamiyya Heights section of Cairo, presents quite another configuration. Gabr speaks in his own name and wrote a long preface to his collection catalogue, published in 2008. He regularly has himself photographed and gives interviews to journalists. His is among the profiles in Thames and Hudson's Art and patronage: The Middle East (2010), and the internet abounds with portraits of him. We can assume that these are all part of a carefully devised public relations program. 44 Shafik Gabr, born in 1954, currently heads a powerful investment group present in 32 countries and involved in such diverse enterprises as steel, oil, real estate, publishing and retail. His diplomat father made him pay for his higher education, and he calls himself a selfmade man. Gabr's first art purchases, made at the age of 20, were of historical photographs of Egyptian subjects. He himself practices photography during trips in his home country, elsewhere in Africa and in Asia. He bought his first painting in Paris in 1993 for a few thousand dollars, a work by the hyperrealist painter Ludwig Deutsch-a logical choice for someone interested in photography of Egypt. By 2010 his collection contained 100 pieces and was estimated at $62 million. The catalogue relates the order in which pieces were acquired and explicitly identifies realism as a fundamental choice criterion.

Celebrating private experience

For Gabr, in whose understanding the Orientalist movement continued up to the 1950s, there are two types of Orientalists: those who carefully painted what they saw and those who gave their imagination free range without ever leaving the studio. He is only really interested in promoting the first variety, and likes to say they were "global artists." Next to views of the Nile (by Crapelet, Frère, Roberts, Weeks and Pasini), the collection's major focus is street scenes and images of Cairo crafts, particularly as captured by Deutsch, Ernst, Rudolf Weiss, Paul Joanovitch and Swoboda. One obsession of Gabr's is representations of curiosity shops-a direct allusion to his own past-time? The clear priority given to Egyptian subjects does not preclude an interest in painters of North African realities: Dinet, Bridgman, Tornai, Deckers, and Styka also figure in his collection.

For me it is more than a collection of paintings; it represents a personal journey I have made, a passion I have, and a message I want to pass on.

There are several components to that message. The first is to celebrate artistic experience of the Middle East rather than scholarly uses of that experience:

The Middle East has always been a crossroads between East and West. But it is a meeting place that is so often stained with blood. It is a place that some visitors have chosen to exploit. Today it is oil. In the 19 th century it was our artistic heritage. Important though the work of those early Egyptologists was, very often their explorations were carried out with dubious intentions. At the same time, their fellow countrymen were carrying heavy easels and cameras around the country. Maybe this is why I feel a deep respect for, and affinity with, the artists of my collection. They were respectful onlookers. They could sit at a street corner and find in an everyday scene (that you can still see in Cairo's streets today, as in Deutsch's A Gathering Around the Morning News) something that touches the essence of our culture. 45 The second is to urge cultures to respect each other:

Whatever they chose to paint, these artists were fascinated by and anxious to record our world, our customs, our architecture, our habits. We owe them a great debt, because although much of what they saw lives on today in our streets and villages, we constantly need to be reminded of the richness and value of our culture.

There is no doubt in my mind that the artworks in my collection are more than superb examples of the painters' art-they have been carefully selected to contribute to the message that pervades my life's work, which is a lesson I first learnt from my grandfather who taught me the importance of working for and helping your own community; we should be proud of our heritage, we ignore our roots at our peril, and above all, we should, as these artists did, respect the cultures of the others. 46 From this follows the third component: to instill pride. One of Shafik Gabr's favorite paintings is Deutsch's The Palace Guard (c. 1900-1902), which he acquired in 2006 in New York for a mere $1.6 million. "Head aloft, shoulders thrust back, a Nubian soldier stands fearsome sentry in front of a towering carved-wood entrance, his vein-laced forearms gripping a lustrous spear." "It has intricate detail, great light," Gabr muses, pointing to the guard's imperious gaze. "That's pride." 47 The 2008 acquisition of Gérôme's chaste Jeune fille égyptienne (1877) is part of the same plan to restore Arab dignity. 48 Lofty considerations such as these do not preclude humor from having a place in the collection, for Gabr has also been taken with the facetious canvases of the Hungarian Gyula Tornai, namely Connoisseurs, painted in Tangier in 1892. According to the catalogue note, this oil canvas shows "a group of Arab men look in wonder and consternation at an Orientalist painting before them." 49 The painting depicts a stall full of copper objects and several figures-another allusion to Gabr's taste for images of merchants? Amused curiosity and perplexity seem the best words to describe the expressions on the faces of the five men as they discover and examine the painting on its easel; a box of paints lies open on the ground below. Are they intrigued to see a representation of themselves? They seem to be checking the accuracy of every detail. Depicting what might have been the end of a pose session, the painter has turned his models into live subjects, depicting in the painting itself what is "behind its scene," brilliantly capturing an extraordinary moment of truth. Realist "snapshots" such as these, the tribute rendered to local "connoisseurship" and of course the mise-en-abyme of the subject (the painting within a painting that in turn refers to other paintings in the collection) are the sort of things that delight new collectors of this pictorial genre.

The taste for ethnographic, narrative painting with a photographic substratum has probably something in it of Proust's madeleine. How could Gabr's acquisition of Gustav Bauernfeind's A Street Scene, Damascus not also owe something to memory of his own experience? That painting is one of the rare Orientalist works to depict Europeans: the painter has represented himself in the center of the crowd as if he wished to share his personal experience of the Syrian capital. Gabr says he chose this painting not only because it is an Orientalist work but also because it features the only self-portrait of the artist known to this day. I am tempted to add that the painting spoke to him with particular force because he himself has surely seen such sudden gatherings, in response to the presence of a camera or a display of pages in a drawing notebook. Multi-level identification games are also perceptible in a photograph of Shafik Gabr posing in front of a painting by Emile Deckers (1943) entitled Portrait of three men, Algiers, showing men in turbans depicted as Algerian tribal chieftains. The similarity of the four men is striking-how could the rapprochement thus effected not be intentional? So it would seem possible to resemble an Algerian chieftain, identify with a German artist in the streets of Damascus and exalt the proud bearing of an ebony-skinned palace guard. In doing these things, Gabr is playing with-and winning out against-stereotypes, which he also does in recalling the ambiguity of his own name (in Egypt he is readily assumed to be a Christian though he is in fact Muslim) or noting that his favorite artist, Ludwig Deutsch, was probably a Jew. 50 Mean spirits will be quick to mock the naiveté of Gabr's intercultural agenda and the split he establishes between art and science (between the scholarly use and artistic valorization of Middle Eastern resources); quick to point out the narcissism of this exhibition of self and the distinction strategies of which it is a part. In any case, the coherence of his undertaking is remarkable. Acquisition by acquisition, his collection comes to filter and model the way Arab reality was looked at and, by ricochet, the way Western art can be looked at, thereby giving new meaning to the paintings collected. The corrections now made to painting identifications are a side effect of Middle Eastern collectionism, with its love of veracity. A fine example is Deutsch's A gathering around the morning news (1885), initially sold in 1974 as titled A Cairo mosque (sic) before being renamed two years later A Cairo scene, and finally receiving its present title in 2006-while waiting to be given some new meaning?

Dialogue of the deaf Shafik Gabr is not the only collector in Egypt to defend Orientalist painting as a kind of visual ethnography capable of capturing and magnifying a cultural essence. As the great Cairo art dealer Sherwet Shafei, specialist of painters of Egyptian modernity, put it in 2010:

It was through the orientalists that we became aware of the essence and magic of the orient and the way in which they discovered and translated that essence to their works. They were enchanted by the light of the orient, and the civilization, traditions, and architecture of Egypt whether it was pharaonic, Coptic, or Islamic. [START_REF] Volait | La 'Belle Epoque' en Egypte: registres, rhétoriques et ressorts d'une invention patrimoniale[END_REF] Nonetheless, what it expresses is a clear view of Orientalism as a kind of historical veracity and a means of transmitting Oriental culture. One smiles to see European art history and criticism engaging in contortions of quite the opposite sort in their attempt to renew Orientalism's virginity after the attacks it was subjected to at the hands of "critical theory" enthusiasts; i.e., working to reconstruct ties between Orientalism and the avant-garde, putting forward the notion that the painting of Matisse, Klee or Kandinsky is characterized by "modernist" Orientalism, an Orientalism tending toward abstraction and perhaps the very source of that artistic development. [START_REF] Benjamin | Le voyage en Orient: de l'orientalisme moderniste[END_REF] This point of view has also led to magnifying the mediating role played by the discovery of Islamic art in the shaping of Abstraction seen as a genre resulting from artistic encounters with the East, whether that encounter is called Orientalist of not. [START_REF] Labrusse | Révélations,' Selon Matisse; selon Klee[END_REF] But whatever one thinks of these aesthetic revisions, the fact remains that they are quite remote from the motivating concerns of Middle Eastern collectors smitten with Orientalism.

Current events in pictorial Orientalism thus represent a new dialogue of the deaf between the two shores of the Mediterranean. The question of the nude in painting and its place in these collections is another illustration. Who has not heard it said that the taboo of immodesty cannot be overcome in the Arab world and that nudes are simply not painted there, much less shown? Officials at the Louvre Abu Dhabi are ritually questioned on the supposed impossibility of such acquisitions for the future collection, and on the importance of keeping Christian iconography to a minimum-two received ideas that simply are not borne out by the purchases made. [START_REF]Laurence des Cars at the EHESS[END_REF] It is true that cloths may be tied around sculptures of nudes in Egypt-in a school context, for example. 56 Private parts may be blurred in published material. [START_REF] Tahra | a Gem in a Majestic Garden[END_REF] 65 -date from before his stay in Alexandria, whereas Said's Egyptian landscapes and popular iconography were strictly contemporaneous with that stay. Nonetheless, this man who would later become a patron of the arts and messenger of cultural tolerance and universalism 66 was willing to include nudes in his collection. It is amusing to note that for today's European experts this set of paintings by Said attests to "the universal language of 1930s international modernism," whereas yesterday's art critics in Egypt found it to be finely executed Orientalism-rather than the junky variety. 67 A "revolution" in the sense of "circle" has taken place in the eastern Mediterranean with regard to Orientalist painting, and the rotation has been in virtually the opposite direction from the one in Europe. Disqualified after independence, the genre has made a come-back in many ways, propelled by new readings. The way Orientalist painting is currently received in the Middle East may be perceived as a kind of well-deserved return to the lands that inspired it-a civilized version of the restoration of antiques clamorously demanded by the political authorities. Meanwhile, the young Egyptian artist Yussef Nabil's colorized photographs, with

  Drame pictural et rôle du spectateur dans l'art de Jean-Léon Gérôme," lecture by Marc Gotlieb (Williams College, Clark Art Institute) delivered at the Institut National d'Histoire de l'Art, February 26, 2010. 3 Lynne Thornton, "Le marché des orientalistes," Les Cahiers de l'Orient 19 (1990); Roger Benjamin, "Postcolonial taste: non-Western markets for Orientalist art," in Orientalism, Delacroix to Klee, ed. Roger Benjamin (Sydney: The Art Gallery of New South Wales, 2001 [1997]), pp. 32-40; Nicholas Tromans, "Bringing it home? Orientalist Painting and the Art Market," in The Poetics and Politics of Place: Ottoman Istanbul and British Orientalism, ed. Zeynep Inankur, Reina Lewis and Mary Roberts (Istanbul: Pera Museum, 2011), pp. 65-74 (extensive bibliography).

1 Suzanne Pagé, preface to Passions privées: collections particulières d'art moderne et contemporain en France (Paris: Musée d'Art Moderne de la Ville de Paris, 1995), p. 11. 2 "

  [START_REF] Germaner | Constantinople and the Orientalists[END_REF] The purchases are said to have been recommended by Gérôme himself. Académie des Beaux-Arts in 1949 in gratitude for his successful organizing of an exhibition of Orientalist and Egyptian painting in Paris that same year. 20 Educated at Cairo's Lycée français and therefore fluent in French, an avid collector and advised in his purchases by his French wife, Emilienne Luce, whom he had met while studying law at the Sorbonne, Mamluk and Ottoman architecture, rather than to a purely fictional Orient, abound. Strict archeological historicism is often preferred to the extravagances of eclecticism.[START_REF]L'orientalisme architectural, entre imaginaires et savoirs[END_REF] Geographical and semantic shiftsWith decolonization, the world of Egyptian art lovers-the persons themselves and their objets-d'arts-collapsed. The 1950s, the years of Bandung and Suez, were dismal years for buying paintings, even of the Orientalist genre. Confiscations and nationalizations dispossessed the reigning families and established fortunes; limited access to hard currency reduced transactions and circulation altogether. It was only with the 1970s' oil crisis that the market took off again. The end of Europe's thirty-year economic boom sent European countries hunting for new sources of wealth. Great Britain organized an ongoing cultural event to introduce the British public to Islamic civilization in all its facets, mobilizing the support of 32 Muslim countries. The protean World of Islam Festival of 1976 combined exhibitions-of a total of 6000 objects from 250 public and private collections, ranging from Islamic crafts to up-to-the-minute contemporary painting-with public lectures, scholarly presentations and events. Gallery owners discovered the existence of interests-and pecuniary resources-they had never suspected. BrianMacDermot (1930), a financier in contact with new Gulf State fortunes, opened a gallery called the Mathaf (Arabic for "museum") in London in 1975 to take full advantage of the festival dynamic. Initially planning to promote contemporary Arab art, what the Mathaf Gallery encountered was immense Middle Eastern demand for Orientalist art. Arab collections are said to have furnished forty percent of loans to the first major Orientalist painting exhibition, Eastern encounters: Orientalist painters of the nineteenth century, held in London in July 1978 at The Fine Art Society.

	he later became a senator and president of the Egyptian senate, and that he was elected to
	France's Muhammad Mahmûd Khalîl was a founding member of the Société des Amis de l'Art, which
	organized an annual painting salon in Cairo from 1925. At his death he left behind an
	impressive collection of over 300 paintings, including works by Van Gogh, Gauguin, Degas
	and others, and approximately 50 sculptures, which he had had installed in a special gallery
	annex to his Cairo home. Emilienne Luce donated the collection to the Egyptian state in 1960.
	After a series of vicissitudes, and after being shown in Paris as part of the Oubliés du Caire
	Orientalist paintings were also well-represented in Egyptian palaces, alongside eighteenth-exhibition, the collection was opened to the public in 1995 upon creation of the Mahmoud
	century minor masters, Aubusson tapestries and Sèvres porcelain. Each new exhibition or Khalil and His Wife Museum. 21
	inventory makes it clear how widespread the phenomenon was. The Oubliés du Caire
	exhibition (1994) showed paintings belonging to the prince-regent Muhammed Ali Tawfiq The Orientalist paintings from the Mahmûd Khalîl collection shown in 1998 illustrate two
	(1875-1955) that were kept in his Manyal Palace in Cairo (now a museum open to the topoi of the genre that are particularly appreciated today in Egypt and elsewhere: the nude and
	public) 15 ; they included L'exécution du janissaire by Henri Regnault and Gérôme's La prière. the Oriental landscape. The first of these was represented by an Ingres odalisque-Odalisque-
	Special rooms created by the prince-regent in 1938 within his palace also contained paintings Fatima-and the second by a Marilhat landscape entitled Vieux
	by Brest, Belly, Clairin, Girardet and others. 16 A recent publication on the Khedival palace of
	'Abdîn, built in Cairo between 1863 and 1874, indicates that most of its painting collection
	was Orientalist, including works by Alexandre-Gabriel Decamps, Théodore Frère, Henri
	Riou, the Briton Horsley and the American George Yevell. 17
	A selection of Orientalist works from the Gazîra museum (closed to the public) that used to
	figure in Cairo's Modern Art Museum collections (that museum opened in 1931 and closed in
	1963) together with works impounded in the 1950s was shown in 1998 for the opening of the
	Cairo Palace of Arts, devoted to modern art. This exhibition yielded a precious glimpse into
	the rich collections of Orientalist paintings of Egyptian subjects assembled by the local elite
	in the nineteenth and twentieth centuries: oil canvases by Carl Vernet, Eugène Fromentin,
	Théodore Frère, Alexandre-Gabriel Decamps, Narcisse Berchère, Théodore Chassériau, Henri
	Régnault, James Tissot, the Belgian painter Jean Portaels (Caravane de bédouins, 1849),
	"archaeological" drawings by Adrien Dauzats, and others. 18 Most had not been shown in
	decades, if ever. The exhibition was presented as a sign of "an incontested Cultural Apogee in
	Egypt," and the catalogue stressed the vital role these painters had played in the genesis of
	modern Egyptian art. 19
	Some of the paintings shown in 1998 were from a sizeable collection assembled by
	Muhammad Mahmûd Khalîl (1877-1953), a jurist and politician who began buying
	Impressionist and Orientalist art on the Paris and Cairo markets in the 1920s and considerably
	increased his acquisitions after the 1940s. We know little of the man, who was not very
	talkative, except that he organized the Egypt pavilion at the 1937 World's Fair in Paris, that

-Caire in the Egyptian exhibition and Mosquée du Sultan Hasan et bazar au Caire in Oubliés du Caire. The landscape is one of Marilhat's most "topographical" compositions, as he was also given to painting imaginary landscapes. Nude and veduta are combined in Fromentin's Nil (1876), also in the Mahmûd Khalîl collection; a bare-breasted peasant woman occupies the foreground. Mahmûd Khalîl also owned paintings by Chassériau, Frère, Delacroix, Gérôme, Berchère, Crapelet, Belly, Dauzats and Emile Bernard.

22

What explains the presence of Orientalist paintings in an otherwise primarily Impressionist collection? A concern for balance? Acquisition opportunities? Though prized by new American fortunes in the late nineteenth century, the academic style no longer had many customers in Europe after the 1920s. Were Mahmûd Khalîl's purchases due to national sentiment, a system of identification? We know that the vast majority of Orientalist paintings in the Mahmûd Khalîl Museum are of Egyptian subjects; indeed, national "tropism" is a feature of many collections. The British have a tendency to buy John Frederick Lewis and David Roberts; Italians, Alberto Pasini and Fabio Fabbi; Americans, Frederick Bridgman, and so forth. It is hard to get beyond the "national school" idea, the conventional basis for pictorial classifications. In the Middle East, the painting subject is what "nationalizes" a work and makes it seem to belong to the country's visual heritage. Egyptians buy views of Cairo; Turks, images of the Bosphorus; Moroccans, landscapes by Majorelle; Algerians, Etienne Dinet's Bou-Saada baigneuses.

23

When the collections of Algiers' Musée des Beaux-Arts were being shared out after independence, the Algerian government laid claim to Orientalist paintings as full-fledged components of the national iconography.

24

And in Egypt the taste for Orientalism was not limited to painting. And there are several examples of Orientalist architecture in which precise references to 20 Exposition Egypte-France, Musée des Arts Décoratifs, Paris, October-November 1949, catalogue.

21

Mohamed Salmawy and Mustafa El-Razaz, Mohamed Mahmoud Khalil: l'homme et le Musée (Cairo: 1995); Geneviève Lacambre, Introduction to Les oubliés du Caire, pp. 17-24; Volait, Fous du Caire, p 197.

22

Muhammad Sidqî al-Gabâkhangî, Muqtanayyât Muhammad Mahmûd Khalîl al-faniyya [The art acquisitions of Muhammad Mahmûd Khalîl] (Cairo: 1995).

23

Benjamin, "Post-colonial taste"; François Pouillon, Les deux vies d'Etienne Dinet, peintre en Islam (Paris: Balland, 1997), pp. 29-30.

24

Jean-Pierre Peroncel-Hugoz, "Le Musée national des Beaux-arts rénové retrouve l'ensemble de ses collections," Le Monde, Apr.

16, 1970.

Cairo's

[START_REF] Benjamin | Post-colonial taste." 27 Auction sale no[END_REF]

The 1999 dispersion of the Akram Ojjeh collection (1918-1991, a Saudi weapons dealer of Syrian birth) offered an idea of what these first non-Western collections contained. Acquired between 1975 and 1986 either at auction or directly from Paris gallery owners, the collection's works included paintings by two Austrian artists whose realist brushwork would later fetch handsome prices: Ludwig Deutsch (The chess game

[1896]

, purchased in 1977) and Rudolf Ernst (Lessons of the Koran [undated], purchased in 1981).

27

  Even more striking is how Middle Eastern collecting of Orientalist painting has come out into the light of day in the last few years. There is no dearth of signs that Middle Eastern collectors are making multiform moves into the public sphere. In 2008 the Egyptian Shafik Gabr, one of the biggest buyers of Orientalist painting in the Middle East, brought out a complete catalogue of his collection, a luxury edition published by ACR, 34 the initials of the publisher, Ahmed Chaouki Rafif, a Moroccan expert to whom we owe most of the monographs on Orientalist painting published in the last three decades.35 When Thames and Hudson undertook to publish the names of the Top 100 Arab, Turkish, and Iranian personalities involved in art patronage in all its forms at home as well as in diaspora (102 names actually), few collectors or patrons chose to remain anonymous.36 It became possible to put a name and a face to some of the individuals responsible for the prices of Orientalist art, and to appreciate the paintings in situ; e.g., in the apartments of Sheikha Salama bint Hamdan al-Nahyan, first lady of Abu Dhabi, where a Picasso may be seen in close proximity to a Rudolf Ernst (La cueillette des 31 For example, the Gros et Delettrez sale of June 21-22, 2010, in Paris, which brought together Islamic objects, Orientalist paintings and paintings by Turkish and Algerian artists. 32 Sheila S. Blair and Jonathan M. Bloom, "The Mirage of Islamic Art: Reflections on the Study of an Unwieldy Field," The Art Bulletin 85, no. 1 (Mar. 2003), pp. 152-184.

Moreover, trade in Orientalist painting has recently relocated to the eastern Mediterranean and the Arabian Peninsula, to get closer to its clientele. In 2009 Sotheby's opened a branch in Istanbul, and that same year (March 18-19, 2009) held its first auction of Islamic, contemporary and Orientalist art in Qatar. Other major houses have developed similar strategies: Christie's has been operating in Dubai since 2006; Bonhams since 2007. And there is the more recent invention of the acronym MENASA (Middle East, North Africa, South Asia), used now by gallery owners to promote their quest for emerging markets. The first MENASA art fair was held in Beirut from July 11 to 13, 2011. 33

The emergence of a new public space?

33

Information kindly transmitted to me by Marie-Hélène Bayle.

34

Dina Nasser-Khadivi, ed., The Shafik Gabr Collection (Paris: ACR, 2008). A new edition has been announced for fall 2011, to be entitled Masterpieces of the Shafik Gabr Collection.

35

Adrian Dannatt, "Orientalism and the art market," Artnet Magazine, March 17, 2009; http://www.artnet.com/magazines/features/dannatt/dannatt3-17-09.asp, consulted April 5, 2010.

36

Hossein Amirsadeghi, ed., Art and Patronage: The Middle East (London: Thames and Hudson, 2010).

  According to the 1991 catalogue raisonné, the Najd contains 156 works, including 24 by Gérôme, 28 by Ludwig Deutsch and another 28 by Rudolf Ernst.39 Brian MacDermot, founder and director of the Mathaf, sheds some light on the raison d'être of this collection in his preface to the catalogue. The owner's aim was to choose paintings representing "true customs and traditions of the Arab peoples." The author of the catalogue notes specifies that Deutsch's The Chess players (1904), of which the Najd collection contains one of many existing versions, is "probably a mixture of personal experience and clever reconstruction from objects and photographs collected at home." 40 "Surely these paintings executed in such splendid detail by European artists form part of Arab heritage," MacDermot adds.41 In the end it matters whether this is pure sales hype or expresses the owner-client's profound conviction. What counts is that it is a commonly held view of art lovers and connoisseurs today, outside the narrow academic circles of post-colonial critique. Orientalist painting captivates by what it restores, indirectly, of the Middle Eastern past. The Arabic stamp used to mark Najd collection pieces is quite explicit: "Madjmû'a al-Najd lil-Lawhât al-Charqiyya": "Najd collection of Oriental paintings." Orientalism has been Orientalized.The most extreme example of external mediation in assembling a set of Orientalist works is the Dahesh collection, located in New York City. The Dahesh Museum of Art is named after Salim Moussa Achi(1909-1984), a curious figure born in Jerusalem and raised in Beirut who discovered at a very young age that he was endowed with supernatural powers, a conviction that led him to take the pseudonym "Dahesh"-"inspiring wonder" in Arabic-in the 1930s and to develop a universalistic, trans-denominational spiritual doctrine that provoked the hostility of the Catholic Church, leading to the loss of his Lebanese citizenship in 1944 and forcing him into exile. When he recovered his citizenship in 1953, Dr Dahesh was able to return to Lebanon, but he continued to travel a great deal. He died in an accident in New York, where he still has followers. The traditional account is that in the 1930s he began acquiring paintings by nineteenth-century academic artists and other material concerning them, continuing to do so throughout his life thanks to the resources brought in by his spiritual publications. The idea of creating a fine arts museum in Lebanon seems to have taken shape in the 1940s, at a time when Beirut had only a museum of Oriental antiquities. The outbreak of civil war in the country precluded realizing this project. In 1975 the collection was sold to close relatives, the Zahid family. Mervat Zahid, who is of Turkish origin and married to a Saudi businessman, was living with her children in Beirut at the time. The family emigrated to the United States the following year, taking the collection with it. In 1984 Dr Dahesh died, leaving Mervat Zahid's a substantial enough inheritance to carry out his museum project. The Dahesh Museum of Art was legally created in 1987 but did not open to the public until 1995.

Provenance indications for paintings loaned in 2011 to the Gérôme retrospective at the Musée d'Orsay or the traveling De Delacroix à Kandinsky exhibition offer tangible evidence of this new willingness to be known. Lenders' names now figure not only in catalogue acknowledgments but in painting identification information: "New York, Wassim Rassamny" for The dream by Fabio Fabbi (c.

1880-1914)

or "Doha, Orientalist Museum" for another Dream (1875), this one by José Villegas y Cordero. And private collectors are preoccupied by the question of their social role. On January 15, 2011, a few great collectors of the region, including the Iranian Farhat Farjam and the Emirati Sultan Saoud al-Qassemi, held a roundtable discussion in Sharjah, UAE, on the social responsibility of art collectors in contexts where there are no public structures for presenting art. Is a kind of public space emerging out of the wings of auction rooms, galleries and artistic foundations, all structures whose numbers are growing in the Middle East?

What the collectors have to say: the Najd, Dahesh, Gabr collections Now that collectors have made their identities known, what do they have to say? Or rather, what are they said to have to say, since others often speak for them? One of the oldest substantial Orientalist painting collections assembled after the market took off is the Najd collection, today stored in Geneva. The owner is a Saudi businessman whose identity has never been made public; the collection was developed by the Mathaf Gallery in the 1980s.

37

Ibid., pp. 122-123.

38

Quoted in Michael Wise, "Bridging the Gulf: Is Doha, Qatar, the new cultural capital of the Middle East?" Travel + Leisure, July 2007; http://www.michaelzwise.com/articleDisplay.php?article_id=96, consulted Aug. 10, 2011. 39 Caroline Juler, Najd collection of Orientalist paintings (London: Manara, 1991). 40 Ibid., p. 43. 41 Ibid., p. 1. little

  They recorded their work in magnificent paintings, sculptures, and lithographs. The works by orientalist and foreign painters who lived in Egypt include some by Ervand Demirdjian, Pierre Beppi-Martin, Roger Bréval, Charles Boeglin, Nicola Forcella, and Milo De Ross. Their works recorded scenes from everyday life in Cairo, Alexandria, Luxor, and Aswan as well as the Nilotic scenery that was predominant in their work. Scenes of café life and market places provide examples of how Egyptians as well as foreigners lived in Egypt at the turn of the twentieth century. These artists […] depicted the various parts of Fatimid Cairo, its souks, mosques, wikalas, and alleyways, in an enchanting manner that remains their most enduring legacy to the world of modern Egyptian art, at both the local and international levels.[START_REF] Abaza | Twentieth-Century Egyptian Art: the Private Collection of Sherwet Shafei[END_REF] No doubt this ode to Orientalist painting and European artists living in Egypt in the twentieth century (Bréval lived in Cairo from 1920 to 1945, Beppi-Martin from 1922 to 1954) is characteristic of the nostalgia for the "Belle Epoque" that made itself felt in the 1980s and constituted a major component of the discourse of broad if marginal swaths of Egyptian society all the way up to the Arab spring of 2011. A reaction to Nasserism and the authoritarianism that ensued; nostalgia for some lost "golden age" of the Middle East corresponding, for those who feel it, to precisely that fin de siècle period.

  But all the major Middle Eastern collections include and have included nudes. Akram Ojjeh had a nude by Bouguereau (La vague, 1896) in his collection, dispersed, as mentioned above, in 1999. Gérôme's comely Almeh 58 (1873; now at the New York Metropolitan Museum on long-term loan), her breasts not exactly concealed by a swath of transparent muslin, is part of the Najd collection. And as Kirsten Scheid has shown for Lebanon from the 1920s to 1940s, paintings of nudes were not hidden from Beirutis or eschewed as shameful.59 Mohammed Saïd Farsi (1935), a Saudi architect and urbanist who was mayor of Jedda from 1972 to 1986, also had paintings of nude women in his collections, as attested by catalogues on pieces put up for sale in 2010.60 Dr Farsi (given name Mohammad Salah al-Farès but he finds the shorter version more convenient), who commissioned great public works from European and Arab sculptors-including Joan Miro, Henry Moore, Hans Arp, Alexander Calder, Salah Abdulkarim and Aref El-Rayess-for Jedda's public squares, 61 was a great lover of modern Egyptian art,[START_REF] Al-Sharouny | A Museum in a Book: the Farsi Art Collection, the Egyptian Works Owned by Dr. Mohammed Said Farsi[END_REF] particularly the works of Mahmoud Said, a painter who worked in Alexandria from 1956 to 1963, where, like many young Arab men of his generation, Farsi had come to study architecture. "Experiencing the enchanted atmosphere of 1950s Alexandria deeply influenced my artistic sensibility," he recently explained.[START_REF]Tableaux orientalistes et art modern arabe et iranien, auction at Christie's Paris[END_REF] Is the "carnal Egypt"[START_REF] Boctor | Mahmoud Saïd[END_REF] he fell in love with then still a reality or already only a memory? In fact, the voluptuous nudes by Mahmoud Said that figure in Dr Farsi's collection-Nu sur sofa vert (1938), Nu accoudé au divan vert (1943), Nu aux bracelets en or(1946)

Auction, Christie's London, July 2, 2008, lot 42; acquired by the Doha Orientalist Museum (inventory OM

696). Shown in 2011 in Paris (Jean-Léon Gérôme (1824-1904), L'histoire en spectacle [Paris: ESFP, 2010, cat. no. 158], p. 276), the work has belonged to a collection in Jordan since 1997. 6 Linda Nochlin, "The imaginary Orient," in The Politics of Vision: Essays on Nineteenth-century Art and Society (New York: Harper and Row, 1989), pp. 33-59.

Krzysztof Pomian, "L'art vivant, les collectionneurs et les musées," in Passions privées, pp. 31-38; Dominique Poulot, "Musées, collections, collectionneurs," in "Musées et collections: pour une histoire de la patrimonialité," Histoire de l'art 62 (2008), pp. 3-9.

This information, obtained in the interview-based investigation into the institution (see Alia Nour-Elsayed, The Making of the Dahesh Museum of Art: an Account of its Founding, Ten-Year History, Academic Art Collection and Exhibitions, Master's thesis in Museum professions, Seton Hall University, 2005, 102pp), rectifies information available on internet.

See http://gabr.com/art/index.html for a press kit on the collection.