Benjamin Wesolowski

A proof of time or knowledge

This note was written in 2016. Rejected from PKC 2017, some of the ideas herein later developed into the Eurocrypt 2019 article Efficient verifiable delay functions. Other ideas, such as the construction of fading signatures, and a discussion on their (in)feasibility, never appeared in public work. In light of the recent development of time-sensitive cryptography, some of this content may have become of interest. The reader may notice that the notion of proof of time or knowledge essentially coincides with what is now known as a (trapdoor) verifiable delay function.

This paper introduces proofs of time or knowledge, a new primitive in the field of time-sensitive cryptography pioneered by Rivest, Shamir and Wagner in 1996. A party, Alice, has a pair of secret and public keys. Given a piece of data m, a proof of time or knowledge allows to generate a proof p such that anyone can easily verify that either p has been generated by Alice (i.e., she used her secret key), or the party who computed p spent a prescribed amount ∆ of wall-clock time to compute p from m. Suppose that a party, Bob, knows that the message m was not known by Alice before a point in time t0. Then, Bob can infer that Alice computed the proof p if, and only if, the point in time t0 + ∆ has not been reached yet (in this case, (m, p) has the same value as a signature of Alice on m). After point in time t0 + ∆ (or if no bound t0 is known), the pair (m, p) is an indistinguishable proof of time or knowledge, since anyone could have produced it.

Introduction

In 1996, Rivest, Shamir and Wagner [START_REF] Rivest | Time-lock puzzles and timed-release crypto[END_REF] introduced the use of time-locks for encrypting data that can be decrypted only in a predetermined time in the future. This was the first time-sensitive cryptographic primitive taking into account the parallel power of possible attackers. Other timed primitives appeared in different contexts: Bellare and Goldwasser [START_REF] Bellare | Encapsulated key escrow[END_REF][START_REF] Bellare | Verifiable partial key escrow[END_REF] suggested time capsules for key escrowing in order to counter the problem of early recovery. Boneh and Naor [START_REF] Boneh | Timed commitments[END_REF] introduced timed commitments: a hiding and binding commitment scheme, which can be forced open by a procedure of determined running time. Applications of timed commitments include time capsule signatures: a signature that becomes valid only a predetermined time after being released, or when the signer provides a trapdoor. Time capsule signatures were later reintroduced by Dodis and Yum [START_REF] Dodis | Time capsule signature[END_REF] and subsequently enjoyed further attention [START_REF] Zhang | A new construction of time capsule signature[END_REF][START_REF] Hu | Time capsule signature: Efficient and provably secure constructions[END_REF][START_REF] Libert | Practical time capsule signatures in the standard model from bilinear maps[END_REF]. The notion of slow-timed hash (or sloth, a hash function which is slow to compute but whose result is easy to verify) was introduced in [START_REF] Lenstra | Trustworthy public randomness with sloth, unicorn and trx[END_REF] and was used to provide trust to the generation of public random numbers. Among other applications, it allows the construction of a secure and verifiable random beacon: an online service that makes available fresh, unpredictable, random numbers at regular intervals, even if the service provider is not considered a trusted party. This paper introduces proofs of time or knowledge. A party, Alice, has a secret key sk. Given a piece of data m that was generated at time t 0 , a proof of time or knowledge allows to generate a message p such that anyone can easily verify that either p has been generated by Alice (using sk), or the party who computed p spent wall-clock time at least ∆ to compute p from m. In essence, the security requirements of these proofs encode the following properties:

1. If a lower bound on t 0 is publicly known (for instance, if m contains the value of a secure random beacon at time t 0 ), and if p is divulged before point in time t 0 + ∆, then p acts as a signature of Alice on m: no one else would have been able to compute p at that point in time. 2. However, if p is divulged after point in time t 0 + ∆ (or if t 0 is not publicly known), then the pair (m, p) constitutes an indistinguishable proof of the knowledge of sk or of wall-clock time ∆ worth of computation.

When someone computed p without knowledge of sk, it also implies that the computing party knew the input data m at point in time t 1 -∆, where t 1 is the time when p is revealed: the scheme can therefore also be seen as a proof that the party computing p either knows sk or knew the input m in advance. The construction we propose achieves perfect indistinguishability in the property 2 above: the proof computed by Alice is the same as the proof anyone can forge in time ∆. These properties allow for very simple and interesting protocols. Alice can prove her identity to Bob in one round, and in a perfectly zeroknowledge way as follows: Bob chooses a random challenge c, and Alice responds with a proof of time or knowledge on input c, with ∆ set to 10 minutes. Since Alice can respond immediately thanks to her secret, Bob is convinced of her identity. Anyone else can compute the response to the challenge in constant time ∆, so it is perfectly zero-knowledge with respect to Alice's secret. This approach to proving someones identity is very different from the standard approaches. Choosing ∆ to be a hundred years, a proof on any piece of data m has, in the real world, the same value as a signature of Alice on m; but this "signature" is simulatable in constant time with respect to the security parameters, whereas signatures in the classical model are inherently non-simulatable.

This notion is very close to the idea of fading signatures, a term originally coined in the opening statement of [START_REF] Ferradi | Slow motion zero knowledge identifying with colliding commitments[END_REF]. A fading signature remains valid only for a limited time: a party verifying the signature after that time limit cannot convince himself of the validity of the signature. Data signed with a fading signature can initially be trusted, but comes with no long-term proof of its authenticity. The construction of a fading signature in [START_REF] Ferradi | Slow motion zero knowledge identifying with colliding commitments[END_REF] did not allow efficient verification: verifying the validity of the signature took essentially as much time as the validity period. The construction of proofs of time or knowledge we introduce in the present paper provides an efficiently verifiable fading signature scheme. Note however that the fading properties of fading signatures are to be considered with caution, as discussed in Section 5.

Proofs of time or knowledge are also reminiscent of indistinguishable proofs of work or knowledge [START_REF] Baldimtsi | Indistinguishable proofs of work or knowledge[END_REF], with the difference that wall-clock timing is a much more delicate measurement than total workload. Note that measuring the workload rather that the time does not permit to infer anything about the identity of the party performing the computation: it does not give rise to a construction similar to that of fading signatures, which can prove the identity of the signing party under appropriate conditions.

Notation. The integer k denotes a security level (typically, k ∈ {128, 192, 256}). With k clear from the context, the cryptographic hash function H : {0, 1} * → {0, 1} 2k denotes a 2k-bit version of a secure hash algorithm. The function int : {0, 1} * → Z ≥0 maps x ∈ {0, 1} * in the canonical manner to the non-negative integer with binary representation x. Given any integer N , and any element x ∈ Z/N Z, let x be the unique integer in [0, N ) congruent to x modulo N . Given two strings s 1 , s 2 ∈ A * , denote by s 1 ||s 2 their concatenation, and by s 1 |||s 2 their concatenation separated by a special separating character in A \ H.

Proofs of time or knowledge

Let ∆ be a time duration. A party, Alice, has a public key pk and a secret key sk. Let m be a piece of data generated at time t 0 . Alice, thanks to her secret key sk, is able to quickly evaluate a function shortcut sk on m. On the other hand, other parties knowing only pk can produce a piece of data forge pk (m) at time t 0 + ∆, but not before (and important parallel computing power does not give a substantial advantage in going faster), such that the value forge pk (m) is indistinguishable from shortcut sk (m).

More formally, a proof of time or knowledge consists of the following components:

keygen → (pk, sk) is a key generation procedure, which outputs a signer's public key pk and secret key sk. As usual, the public key should be publicly available, and the secret key is meant to be kept secret. shortcut sk (m, ∆) → pro takes as input the data m ∈ M (for some input space M), and uses the secret key sk to produce a proof pro on m. The parameter ∆ is the time it should take to forge the same proof without knowledge of the secret key. forge pk (m, ∆) → pro is a procedure to forge a valid proof on m using only the public key pk, for a targeted computation time ∆. This procedure is meant to be infeasible in time less than ∆. verify pk (m, pro, ∆) → true or false is a procedure to check if pro is a valid proof on m, associated to the public key pk and the forging time ∆.

Given any key pair (pk, sk) generated by the keygen procedure, the functionality of the scheme is the following. Given any data m and time parameter ∆, if pro is either a rapid proof shortcut sk (m, ∆) or a forged proof forge pk (m, ∆), then verify pk (m, pro, ∆) outputs true.

The security relies on two aspects: on one hand, a valid proof cannot be produced in time less than ∆ without knowledge of the secret key sk; on the other hand, given X the output of shortcut sk (m, ∆) and Y the output of forge pk (x, ∆), distinguishing X from Y is infeasible. If the procedures shortcut and forge are deterministic, this second property simply translates into the fact that they have the same output. If they are not, it can be formalized by a distinguishing game, but we will restrict here to the deterministic case. The first property can be formalized via the ∆-forgery race game.

Definition 1 (∆-forgery race game).

Let A be a party playing the game. It goes as follows: at the start of the game, keygen is run and the public key pk is given to A; it is the beginning of the precomputation phase. Whenever A outputs "ready", a message m ∈ M is generated uniformly at random and given to A. Party A wins the ∆-forgery race game if it produces in time less than ∆ a value pro such that verify pk (m, pro, ∆) returns true.

Data: a secret key sk = (N, φ(N )), some data m ∈ A * , for a targeted forgery time exponential in .

Result: the proof pro. h ← HN (m) ∈ Z/N Z; for i = 1, ..., do yi ← 2 2 i -2 mod φ(N ); hi ← h y i ; end for i = 1, ..., -1 do B ← Hprime(hex(i)|||hex(hi)|||hex(i + 1)); x ← 2yi; r ← least residue of 2 2 i -2 modulo B; β ← (x -r)B -1 mod φ(N ); Pi ← (h β , h xβ ); end return pro = (h1, h2, ..., h , P1, ..., P -1 ); Algorithm 1: shortcut sk (m, ) → pro
A proof of time or knowledge is ∆-secure if any player whose precomputation phase is polynomially bounded (with respect to the implicit security parameter) wins the ∆-forgery race game with negligible probability. Observe that it is useless to allow A to adaptively ask for legitimate proofs during the precomputation phase: for any data m , the procedure forge pk (m , ∆) produces the same output as shortcut sk (m , ∆), so any proof the adversary would like to request during the precomputation phase can be replaced by a forgery doable in time O(∆).

A proof of time or knowledge

Let m ∈ A * be the input of the proof. Alice's secret key sk is a pair of distinct prime numbers p and q, and her public key pk is the RSA modulus N = pq. Define H N : A * → Z/N Z by H N (m) = int(H("residue"||m)) mod N . Also, given any string s, we denote by H prime (s) the first prime number in the sequence H("prime"||hex(j)|||s), for j ∈ Z ≥0 . The procedures to sign, verify and forge are fully described in Algorithms 1, 2 and 3 respectively, and explained in detail below.

To built the proof on m, first let h = H N (m). The basic idea is that for any t ∈ Z >0 , Alice can efficiently compute h 2 t with 2 modular exponentiations, by first computing x = 2 t mod φ(N ) where φ(N ) = (p -1)(q -1) is the order of the group (Z/N Z) × , followed by h 2 t = h x mod N . The running time is logarithmic in t. Any other party who does not know φ(N ) can also compute it by performing t sequential squarings, Data: a public key pk = N , some data m ∈ A * for a targeted forgery time exponential in , and a proof pro. Result: true if the proof pro on m is valid, false otherwise. (h1, h2, ..., h , P1, ..., P -1 ) ← pro;

h ← HN (m) ∈ Z/N Z; if h1 = h then return false; end for i = 1, ..., -1 do B ← Hprime(hex(i)|||hex(hi)|||hex(i + 1)); r ← least residue of 2 2 i -2 modulo B; (c1, c2) ← Pi; if h 2 i = c B 1 h r or hi+1 = ±c B 2 hi 2r then return false; end end return true;
Algorithm 2: verify pk (m, pro, ) → true or false with a running time linear in t. Therefore anyone can compute h 2 t but only Alice can do it fast, and any other party has to spend a time linear in t. However, verifying that the published value is indeed h 2 t takes as long as the forgery: there is no shortcut to the obvious strategy consisting in recomputing h 2 t and checking if it matches.

A first solution to this issue is discussed in [START_REF] Boneh | Timed commitments[END_REF]. Let t = 2 , and rather than just publishing h 2 2 , publish the sequence of elements

(b 1 , b 2 , b 3 , ..., b ) = h 2 , h 4 , h 16 , ..., h 2 2 ,
and prove via a zero knowledge protocol that each triple (h, b i , b i+1 ) is of the form (h, h x , h x 2 ) for some integer x. The protocol the authors describe is inspired from the classic zero-knowledge proof that (g, A, B, C) is a Diffie-Hellman tuple [START_REF] Chaum | Wallet databases with observers[END_REF]. It should be stressed that this protocol was designed to be zero-knowledge with respect to the exponents and not with respect to the group order (the exponents are secret in the Diffie-Hellman setting, and the group order is not; in the present setting, the opposite is true). The modified version in [START_REF] Boneh | Timed commitments[END_REF], contrary to what is claimed, is not perfectly zero-knowledge with respect to Alice's secret φ(N ) . Furthermore, the construction of the proof should be non-interactive; unfortunately there is no obvious way to make the suggested protocol non-interactive while still allowing timed forgeries. Therefore the following introduces a new approach, which not only is perfectly zero-knowledge with respect Data: a public key pk = N , some data m ∈ A * , for a targeted forgery time exponential in .

Result: the (forged) proof pro. h ← HN (m) ∈ Z/N Z; h1 ← h; for i = 1, ..., -1 do B ← Hprime(hex(i)|||hex(hi)|||hex(i + 1)); c1 ← forge rec(h, B, i) ; // this function is described in Algorithm 4 c2 ← c 2 2 i -1 1 ; Pi ← (c1, c2); hi+1 ← h 2 2 i+1 -2
∈ Z/N Z; end return pro = (h1, h2, ..., h , P1, ..., P -1 ); Algorithm 3: forge pk (m, ) → pro Data: an element h in a group G (with identity 1G), a prime number B and a positive integer i. Result: h β , where β is the quotient of the euclidean division of 2

2 i -2 by B. if 2 2 i -2 < B then return 1G; else x ← forge rec(h, B, i -1); y ← forge rec(x, B, i -1); α ← 2 i-1 -2 mod B -1;
r ← least residue of 2 α modulo B; q ← quotient of the euclidean division of 4r 2 by B; return y 4B x 8r h q ; end Algorithm 4: forge rec(h, B, i) → h β to φ(N ), but can also be made non-interactive while remaining perfectly zero-knowledge and forgeable.

The basic construction.

The proof on input m is the tuple (h 1 , h 2 , ..., h , P 1 , ..., P -1 ),

where , andP

h i = h 2 2 i -2 ∈ Z/N Z for i = 1, ...,
i is a (non-interactive) proof that (h, h 2 i , h i+1
) is a triple of the form (h, h x , ±h x 2 ). The algorithm is synthesised in Algorithm 1. The construction of the proofs P i will be discussed in the following paragraph.

The verifier can check that h = ±h 2 2 -2 as follows: first check that h 1 = h = H N (m); then for each i = 1, ..., -1, check the proof P i . If h i = ±h 2 2 i -2 and P i is correct, then (h, h 2 i , h i+1 ) is of the form (h, h x , ±h x 2 ), and

h i+1 = ±h 2•2 2 i -2 2 = ±h 2 2 i+1 -2 .
Therefore, by induction, if all the proofs are correct, then h = ±h 2 2 -2 . The verification procedure is synthesised in Algorithm 2.

3.2

The proofs P i .

The following focuses on the problem of proving efficiently that (h, b 1 , b 2 ) is of the form (h, h x , ±h x 2 ), without revealing any information about φ(N ). The exponent x is not meant to be secret, everybody knows it is congruent to some 2 2 i -1 (yet any other representation of that integer modulo φ(N ) should not be leaked: that would allow to compute a multiple of φ(N ), and to factor N ). But checking the form of (h, b 1 , b 2 ) simply by exponentiating by x and x 2 is inefficient. What will actually be produced is a tuple P which asserts that either P was produced by Alice, or (h, b 1 , b 2 ) is of the form (h, h x , ±h x 2 ). First, consider an interactive protocol. The verifier first receives h, b 1 and b 2 , and then sends a (large) random prime number B to the prover. The prover then computes the least residue r of x modulo B. The prover then computes c 1 = h β and c 2 = h xβ such that β ≡ (x -r)B -1 mod φ(N ), and the proof sent to the verifier is the pair P = (c 1 , c 2 ). Such a proof can be forged by a party who does not know Alice's secret; this fact might be surprising at first given that such a party cannot compute B -1 mod φ(N ). The procedure will be described later (in Subsection 3.3), but assuming that fact, the protocol is perfectly zero-knowledge since the secret is not necessary to produce the proof. The verifier simply computes r and checks that b

1 = c B 1 h r and b 2 = ±c B 2 b r 1 .
It is straightforward to check that this holds if the prover is honest.

Now, what can a dishonest prover do? In fact, given x such that b 1 = h x , only Alice can produce misleading proofs. Indeed, suppose that the proof passes the verification, i. 1 /b 2 is determined but the prover does not know already about B. Once B is revealed, the prover must be able to produce values c 1 and c 2 that will pass the tests with a good probability, which implies that c x 1 /c 2 is a B-th root of α. For a prover to cheat and succeed with good probability, it is necessary that B-th roots of α to be easily extracted for arbitrary B. This is easy if α = ±1, i.e. b 2 = ±b x 1 = ±h x 2 . It is however a difficult problem, given an RSA modulus N , to find an element α mod N other than ±1 from which B-th roots can be extracted for any B.

This can be made non-interactive by letting B be, for instance, the first prime in the sequence of integers represented by

H("prime"||hex(j)|||hex(i)|||hex(b 1 )|||hex(b 2 )),
for j ∈ Z >0 , where i is the index of P i . It is still forgeable, so still zeroknowledge. This simulates a choice of B uniform among the primes in [0, 2 2k ). Recall that given a string s, H prime (s) denotes the first prime number in the sequence H("prime"||hex(j)|||s). If H is considered to be a random function with uniform distribution, let µ denote the probability distribution of the output of H prime (s).

Definition 2 ((∆, )-exponentiation race game).

Let A be a party playing the game. The (∆, )-exponentiation race game goes as follows: first, the keygen procedure is run and the public key pk = N is given to A; it is the beginning of the precomputation phase. Whenever A outputs "ready", an element x ∈ Z/N Z is generated uniformly at random and given to A. Party A wins the (∆, )-exponentiation race game if it produces in time less than ∆ a value y = x 2 2 -2 .

The (∆, )-exponentiation race game is assumed to be difficult for = O(log ∆). I.e., the simple strategy consisting of sequential squarings is optimal (up to some optimisations by a constant factor).

Forging the proofs in time O(∆).

As B -1 mod φ(N ) cannot be computed without knowledge of the private key, an alternative strategy is needed for the forgery. Assuming the correctness of the function forge rec(h, B, i), which computes h β where β is the quotient of the euclidean division of 2 2 i -2 by B, it is easy to check that the function forge pk (m, ) described in Algorithm 3 is correct. The function forge rec(h, B, i), described in Algorithm 4 deserves more explanations. It operates by recursion on i. The base case is easy: if 2 2 i -2 is smaller than B, then β is zero, so h β is the identity element of the group. In particular, if i = 1, then 2

2 i -2 = 1 < B.
For the general step of the recursion, let β be the quotient of the euclidean division of 2 2 i-1 -2 by B, and r the remainder. Observe that

2 2 i -2 = 4 2 2 i-1 -2 2 = 4(β B + r) 2 = (4β 2 B + 8β r)B + 4r 2 .
Therefore, if q is the quotient of the euclidean division of 4r 2 by B, then β = 4β 2 B +8β r+q. We can recursively compute h β = forge rec(h, B, i-1) and h β 2 = forge rec(h β , B, i -1). Then h β can be computed as

h β = h β 2 4B h β 8r h q .
Besides the recursive calls, the most expensive step is the computation of the remainder of the euclidean division of 2 2 i-1 -2 by B. But all these remainders of 2 2 j -2 , j < i, that will be used in the recursion, can be computed at once at the beginning for a total time in O(i): simply compute all the values 2 2 j mod B, for j < i by successive squarings, multiply all of them by 2 -2 mod B (recall that B is a prime number), and store the results for later use. Therefore leaving this operation aside, as a preprocessing step, the processing time of the recursion is bounded above by a constant c (it actually depends on the bit-length of B, (almost) bounded by the bit-length of the output of the hash function H; it does not depend on the time parameter ∆). If T (i) denotes the running time of forge rec(h, B, i), then

T (i) ≤ 2T (i -1) + c ≤ 2 i-1 T (1) + (2 i-1 -1)c ≤ 2 i c.
This function is called in the forgery algorithm for any i < (with different values of B). The total time of these calls is therefore in

O(2 ) = O(∆).
It is then easy to see that the total time of the forgery is also in O(∆).

Security analysis

The following game formalises the problem of finding an integer u = 0, ±1 for which B-th roots modulo an RSA modulus N can be extracted for arbitrary B's following a distribution µ, when the factorization of N is unknown. This problem is supposedly difficult when N is large enough, and µ is the uniform distribution over the primes in (0, 2 2k ). Recall that k is the security parameter, which is implicitly passed as a parameter to keygen.

Definition 3 (The root finding game G root ). Let A be a party playing the game. The root finding game G root (A) goes as follows: first, the keygen procedure is run and the public key pk = N is given to A (N is an RSA modulus). The player A then outputs an integer u modulo N . An integer B is generated according to the distribution µ and given to A. The player A outputs an integer v and wins the game if u ≡ 0, ±1 mod N and v B ≡ u mod N .

Definition 4 (The oracle root finding game G root X ). Let A be a party playing the game, let X : A * → Z/N Z be a map, and O : A * → Z >0 a random oracle with distribution µ. The player has access to the random oracle O. The oracle root finding game G root X (A, O) goes as follows: first, the keygen procedure is run and the public key pk = N is given to A. The player A then outputs a string s ∈ A * , and an integer v modulo N . The game is won if X(s) ≡ 0, ±1 and v O(s) = X(s).

Lemma 1. If an algorithm A limited to q queries to the oracle O wins the game G root X (A, O) with probability p win , there is an algorithm B winning the game G root (B) with probability at least p win /(q + 1), and same running time, up to a small constant factor.

Proof. Let A be an algorithm limited to q oracle queries, and winning the game with probability p win . Build an algorithm A which does exactly the same thing as A, but with possibly additional oracle queries at the end to make sure the output string s is always queried to the oracle, and the algorithm always does exactly q + 1 (distinct) oracle queries.

Build an algorithm B playing the game G root , using A as follows. Upon receiving pk, B starts running A on input pk. The oracle O is simulated as follows. First, an integer i ∈ {1, 2, ..., q + 1} is chosen uniformly at random. For the first i -1 (distinct) queries from A to O, the oracle value is chosen at random according to distribution µ. When the ith string s ∈ A * is queried to the oracle, the algorithm B outputs u = X(s), concluding the first round of the game G root . The game continues as the integer B is received, following the distribution µ. This B is then used as the value for the ith oracle query O(s), and the algorithm A can continue running. The subsequent oracle queries are handled like the first i -1 queries, by picking random integers with distribution µ. Finally, A outputs a string s ∈ A * and an integer v modulo N . To conclude the game G root (B), B returns v.

Since O simulates a random oracle with distribution µ, A outputs with probability p win a pair (s , v) such that X(s ) ≡ 0, ±1 and v O(s ) = X(s ); denote this event win A . If s = s , these conditions are exactly u ≡ 0, ±1 and v B = u, where u = X(s) is the output for the first round of G root , and O(s) = B is the input for the second round. If these conditions are met, the game G root (B) is won. Therefore Pr[B wins G root ] ≥ p win • Pr s = s |win A .

Let Q = {s 1 , s 2 , ..., s q+1 } be the q + 1 (distinct) strings queried to O by A , indexed in chronological order. By construction, we have s = s i . Let j be such that s = s j (recall that A makes sure that s ∈ Q). Then,

Pr s = s |win A = Pr [i = j|win A ]
The integer i is chosen uniformly at random in {1, 2, ..., q + 1}, and the values given to A are independent from i (the oracle values are all independent random variables with distribution µ). So Pr [i = j|win A ] = 1/(q + 1). Therefore Pr[B wins G root ] ≥ p win /(q + 1). Since B mostly consists in running A and simulating the random oracle, it is clear than both have the same running time, up to a small constant factor.

Proposition 1 (Security of the proof of time or knowledge in the random oracle model). Let A be a player winning with probability p win the ∆-forgery race game associated to the proposed scheme, assuming H N and H prime are random oracles and A is limited to q oracle queries. Then, there is a player B 1 for the (∆, )-exponentiation race game, and B 2 for the root finding game G root , with respective winning probabilities p 1 and p 2 with p 1 + (q + 1)p 2 ≥ p win , and with same running time as A (up to a constant factor).

Proof. Let A be a player winning with probability p win the ∆-forgery race game. Let p win be the probability that A wins with an output pro = (h 1 , ..., h , P 1 , ..., P -1 ) where h = ±h 2 2 -2 1 .

Constructing B 1 . Build B 1 as follows. Upon receiving pk, B 1 starts running A on input pk. The random oracles H N and H prime are simulated in a straightforward manner, maintaining a table of values, and generating a random outcome for any new request (with distribution uniform and µ respectively). When A outputs "ready", B 1 looks for a string m that has not been queried to the oracle yet, and outputs "ready". When receiving the challenge h, B 1 adds x to the table of oracle H N , for the input m (i.e., H N (m) = x). Then B 1 sends m to A and continues to run it while simulating the oracle. Whenever A outputs pro = (h 1 , ..., h , P 1 , ..., P -1 ), B 2 outputs h . The game is won with probability p 1 ≥ p win . Constructing B 2 . Instead of directly building B 2 , we build an algorithm B 2 playing the game G root X (A, O), and apply Lemma 1. Define X : A * → Z/N Z as follows: for any integers

i, b 1 , b 2 ∈ Z >0 , let X(hex(i)|||hex(b 1 )|||hex(b 2 )) = b 2 2 i -1 1 /b 2 mod N,
and let X(s) = 0 for any other string s. When receiving pk, B 2 starts running A with input pk. The oracle H N is simulated by generating random values in the straightforward way, and H prime is set to be exactly the oracle O. When A outputs "ready", B 2 generates a random message m and continues running A. Then, A outputs (h 1 , ..., h , P 1 , ..., P -1 ). Let i > 1 be the smallest index such that

h i = ±h 2 2 i -2 1 . If there is no such index, abort. Otherwise, output s = hex(i -1)|||hex(h i-1 )|||hex(h i ) and v = c 2 2 i -1 1 /c 2 , where (c 1 , c 2 ) = P i-1 .
If such an index was found, and A won the simulated forgery game, then X(s) ≡ 0, ±1, and v O(s) = X(s), so B 2 wins the game. This happens with probability p 2 ≥ Pr A wins and h = ±h Since A was limited to q oracle queries, B 2 also does not do more than q queries. Applying Lemma 1, there is an algorithm B 2 winning the game G root (B) with probability p 2 ≥ p 2 /(q + 1). To conclude the proof, we have p win ≤ p 1 + p 2 ≤ p 1 + (q + 1)p 2 .

Fading signatures and their (in)feasibility

The idea of fading signatures relies on a fairly simple idea: a signature is trustworthy only as long as a forgery is believed to be infeasible. Just like in a conventional signature scheme, the signing party, Alice, has a public key pk and a secret key sk. Her secret key allows Alice to efficiently produce signatures, while the public key allows anyone to efficiently check their validity. In the conventional setting, forging valid signatures without knowledge of sk is meant to be infeasible. Fading signatures however can be forged by anyone. The only distinction between legitimate and forged signatures comes from time constraints. Given a fading-time length ∆, a fading signature scheme provides the following guarantee: given a message m generated at point in time t 0 , Alice, thanks to sk, can quickly produce a signature shortcut sk (m) on m at time t 0 + (for a very short ), whereas other parties, knowing only pk, can produce a valid signature on m at time t 0 + ∆, but not before (and important parallel computing power does not give a substantial advantage in going faster). If Bob wants to check the authenticity of a valid signature shortcut sk (m), he should be somehow aware of the time t 0 when m was generated. Guarantees on t 0 can be provided in different ways in different contexts, the simplest of which would be to rely on a secure random beacon. At this point is should be clear that this notion of fading signature is simply another way of thinking about the previously introduces proofs of time or knowledge.

However, the intuitive idea of fading signatures which seems to have motivated the construction of [START_REF] Ferradi | Slow motion zero knowledge identifying with colliding commitments[END_REF] is more powerful: it should be a signature scheme S that would allow Alice to produce a signature σ on a message m at time t 0 , such that anyone seeing σ before time t 0 + ∆ could be sure Alice signed it, but after this delay, nobody else could be sure Alice signed it. This is not something that proofs of time or knowledge allow, and we show that it is essentially impossible to achieve.

The following approach, combining a proof of time or knowledge with a secure random beacon, would be tempting. Let r = beacon(t 0 ) be the value generated by the beacon at time t 0 . Then, Alice signs shortcut sk (r||m), and anyone can check the validity of the signature, with the guarantee that r was not known by any party before time t 0 (even by the beacon itself, if it is based on a secure and verifiable protocol as described in [START_REF] Lenstra | Trustworthy public randomness with sloth, unicorn and trx[END_REF]; the beacon therefore needs not be considered a trusted third party). Then indeed, after time t 0 +∆, Bob could not check by himself that Alice indeed produced that signature.

But -and this applies to any scheme S -if a third party, Charlie, checked that signature σ on time, and if Bob trusts Charlie, the latter can certify to Bob that Alice produced the signature. Even though Bob did not check the signature on time, he can still be convinced that Alice signed it, because he trusts Charlie. This means that assuming Charlie cannot lie, the signature cannot fade away because at any point in the future Charlie can testify.

Of course, Charlie could be a liar, and this scheme might be secure in a world where nobody can be trusted. Ironically, the existence of trust between different parties implies the impossibility of signature schemes with such properties. In the real world, Charlie could be a trusted time-stamping service. More slyly, Charlie could publish Alice's signature on a distributed public ledger, à la Bitcoin [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF], providing a convincing argument to anyone checking the ledger that the signature was indeed produced within some tight time interval.

x 1 /b 2 = (c x 1 /c 2 )

 1212 e., b 1 = c B 1 h r and b 2 = ±c B 2 b r 1 , where r is the least residue r of x modulo B. Exponentiating the first equality by x yields b x 1 = c xB 1 h xr , and the second can be written as b 2 = ±c B 2 h xr . Therefore b B . When publishing b 1 and b 2 , α = b x

2 2 - 2 1= 1 =

 21 p win -Pr A wins and h = ±h 2 2 -2 p win -p win .


Fortunat Joos

Philip Ciais

Loyd A Currie

Modeling of the global carbon cycle -isotopic data requirements

Introduction

Isotopes are powerful tools to constrain carbon cycle models. For example, the combinations of the C0 2 and the 13 C budget allows to calculate the net-carbon fluxes between atmosphere, ocean, and biosphere. Observations of natural and bomb-produced radiocarbon allow to estimate gross carbon exchange fluxes be tween different reservoirs and to deduce time scales of carbon overturning in important reservoirs. 18 0 in CO3 is potentially a tool to make the deconvolution of G fluxes within the land biosphere (assimilation vs respirations). The scope of this article is to identify gaps in our present knowledge about iso topes in the light of their use as constraint for the global carbon cycle. In the following we will present a list of some future data requirements for carbon cycle models.

Atmosphere

Isotope measurements on ice cores: Improvements in the analysis of 19 C and C0 2 in air enclosed in ice cores make it possible to document with high-precision the history of the atmospheric <J 13 C and CO3 content. This measurements allow to deconvolve the sources and sinks for atmospheric CO3 for the last centuries. Furthermore, the detailed atmospheric history of CO3 and S i3 C facilitates the initialization of carbon cycle models which will make use of the more detailed recent atmospheric records. An extension of the existing records over longer time scales and especially during times of large climate fluctuations would help to better understand the mechanisms involved in natural fluctuation of atmospheric CO? and to identify possible feedback mech anisms of the present anthropogenic perturbation of the carbon cycle and the climate system. Furthermore, existing records should be confirmed and refined by additional measurements.

Observations of isotopes in atmospheric air samples:

The extension of the monitoring of isotopes 13 C and l8 0 in atmospheric CO2 makes it now possible to explore the regional and temporal distribution of the 1 sources and sinks of anthropogenic C0 2 . Yet the existing data coverage has large gaps, especially in. tropical regions. This clearly hinders a better diagnostic of COa fluxes in these regions where strong biomas6 destruction is currently going on. 2-3 stations in the tropics, near enough to deforestation sources, would be helpful to better explore the seasonality of 18 0 and other isotopes in this region.

Ineri tracers to study the atmospheric transport:

The mass fluxes in transport models are currently validated using F-ll and w Kr. New tracers such as SF6 will bring usefulB constraints on the transport in atmo spheric models. Also, because fréons accumulation now slows down, fréons may no longer be that useful in checking the transport of models in the future. On the other hand, w Kr and SF6 still rises and time series of this tracer at many locations will be valuable, eg to check the meridional transport in 3-D models.

Ocean

Increase in the oceanic inventory of 13 C: The ocean plays a dominant role in the redistribution of anthropogenic CO2 bomb-produced radiocarbon as well as of 13 C released by fossil fuel burning. A better quantification of the rate of change in the oceanic 13 C-inventory would help to clarify the ocean's role in the uptake of anthropogenic carbon. For evaluating 13 C budgets on a regional scale better understanding of the isotopic composition of biomass burned in the tropics (C4-C3) would be valuable.

Regional structure in ocean

Fossil fuels

The £ 13 C-content of fossil fuel in one of the major uncertainty in the deconvolution of the amtospheric 13 C content. For example, a mismatch of 3°/ o o between estimated and teal value of 6 13 G in fossil fuel, would lead to an error in the estimated global uptake of anthropogenic carbon by the biosphere of about 0.9 Gt-C yr" 1 at 1980 (see Joos et al., this volume). ^wOofC0 2 For the use of ls O in CO) as a constraint on the exchange with vegetation, we need to better quantify some basic mechanisms, e.g. in laboratory experiment. Several key parameters of models remain to be answered, Including the exact rate of equilibration of C0 2 with water in soils and the ie O composition of water vapor within the canopy in forest ecosystems-

  lS C surface values: To evaluate regional net carbon fluxes by deconvolving the atmospheric distri bution of <y 13 C and CO3, information about the local air-sea gradient in S i3 C a necessary. Additional 13 C measurements on several ocean transects would be helpful [precision target: 0.05 */ o o]. Temporal structure in ocean 13 C surface values: A fix point to explore the seasonality of 13 C in the ocean, especially in southern ocean or north atlantic basin would be valuable. [Precision target: 0.05°/ o 0, data density: weekly to biweekly] Land biosphere Carbon overturning in soils and vegetation: Crucial parameters in the determination of the long-term sequestering of carbon by the biosphere are the characteristic overturning times and mass of the soil carbon reservoir. Potentially useful would be measurements of the 14 C content of respired COj along with measurements of climatic parameters and the mass of soil organic matter and its radiocarbon content at different depth levels [Target sites: e.g. deciduous forest, tropical forest, grasslands...].


Isabel Molina

Yonghua Li-Beisson

Fred Beisson

John B Ohlrogge

Mike Pollard
email: pollard9@msu.edu

Identification of an Arabidopsis Feruloyl-Coenzyme A Transferase Required for Suberin Synthesis 1[W][OA]

All plants produce suberin, a lipophilic barrier of the cell wall that controls water and solute fluxes and restricts pathogen infection. It is often described as a heteropolymer comprised of polyaliphatic and polyaromatic domains. Major monomers include v-hydroxy and a,v-dicarboxylic fatty acids, glycerol, and ferulate. No genes have yet been identified for the aromatic suberin pathway. Here we demonstrate that Arabidopsis (Arabidopsis thaliana) gene AT5G41040, a member of the BAHD family of acyltransferases, is essential for incorporation of ferulate into suberin. In Arabidopsis plants transformed with the AT5G41040 promoter:YFP fusion, reporter expression is localized to cell layers undergoing suberization. Knockout mutants of AT5G41040 show almost complete elimination of suberin-associated ester-linked ferulate. However, the classic lamellar structure of suberin in root periderm of at5g41040 is not disrupted. The reduction in ferulate in at5g41040-knockout seeds is associated with an approximate stoichiometric decrease in aliphatic monomers containing v-hydroxyl groups. Recombinant AT5G41040p catalyzed acyl transfer from feruloyl-coenzyme A to v-hydroxyfatty acids and fatty alcohols, demonstrating that the gene encodes a feruloyl transferase. CYP86B1, a cytochrome P450 monooxygenase gene whose transcript levels correlate with AT5G41040 expression, was also investigated. Knockouts and overexpression confirmed CYP86B1 as an oxidase required for the biosynthesis of very-long-chain saturated a,v-bifunctional aliphatic monomers in suberin. The seed suberin composition of cyp86b1 knockout was surprisingly dominated by unsubstituted fatty acids that are incapable of polymeric linkages. Together, these results challenge our current view of suberin structure by questioning both the function of ester-linked ferulate as an essential component and the existence of an extended aliphatic polyester.

Suberin is a lipophilic extracellular barrier deposited on the inner side of the primary cell wall. It functions to control fluxes of water and solutes, to contribute to the strength of the cell wall, and to provide a barrier to pathogen movement [START_REF] Kolattukudy | Polyesters in higher plants[END_REF][START_REF] Nawrath | The biopolymers cutin and suberin[END_REF]. It is synthesized constitutively during development by a variety of internal and exposed plant tissues, and as a response to stresses and wounding [START_REF] Kolattukudy | Polyesters in higher plants[END_REF][START_REF] Schreiber | Effects of NO 3 deficiency and NaCl stress on suberin deposition in rhizo-and hypodermal (RHCW) and endodermal cell walls (ECW) of castor bean (Ricinus communis L.) roots[END_REF]. The role of suberin in controlling salt stress and permeability has recently been demonstrated in mutants compromised in its biosynthesis [START_REF] Beisson | The acyltransferase GPAT5 is required for the synthesis of suberin in seed coat and root of Arabidopsis[END_REF][START_REF] Ho ¨fer | The Arabidopsis cytochrome P450 CYP86A1 encodes a fatty acid omegahydroxylase involved in suberin monomer biosynthesis[END_REF][START_REF] Serra | CYP86A33-targeted gene silencing in potato tuber alters suberin composition, distorts suberin lamellae, and impairs the periderm's water barrier function[END_REF].

Suberin is often described as a heteropolymer comprised of polyaliphatic and polyaromatic (polyphenolic) domains, with embedded waxes. Monomers released by transesterification include aliphatics such as fatty acids, v-hydroxyfatty acids (OHFAs), a,vdicarboxylic acids (DCAs), and fatty alcohols, often with a significant proportion of very-long-chain saturates ($C20), plus glycerol and p-hydroxycinnamic acids (mainly ferulate; [START_REF] Matzke | A comparative-study into the chemical constitution of cutins and suberins from Picea abies (L) Karst, Quercus robur L, and Fagus sylvatica L[END_REF][START_REF] Bernards | Demystifying suberin[END_REF][START_REF] Grac ¸a | Glycerol-derived ester oligomers from cork suberin[END_REF][START_REF] Franke | Suberin-a biopolyester forming apoplastic plant interfaces[END_REF][START_REF] Pollard | Building lipid barriers: biosynthesis of cutin and suberin[END_REF]. The aromatic network is a hydroxycinnamate-derived polymer, primarily comprised of C-C and ether-linked ferulic acid, N-feruloyltyramine, cinnamic acid, p-coumaric acid, or caffeic acid [START_REF] Bernards | Hydroxycinnamic acid-derived polymers constitute the polyaromatic domain of suberin[END_REF]. Glycerolcontaining aliphatic dimers and trimers have been isolated by partial depolymerization methods [START_REF] Grac ¸a | Glycerol and glyceryl esters of omega-hydroxyacids in cutins[END_REF][START_REF] Grac ¸a | Glycerol-derived ester oligomers from cork suberin[END_REF]. These studies have also identified the esterification of v-OHFAs to each other, to DCAs, and to ferulate. Hydroxycinnamate esters with fatty alcohols that are extractable with organic solvents have been identified in many natural product studies. However, partial depolymerization studies with suberin have shown that a large portion of the ferulate is esterified to the terminal hydroxy group of long-and very-long-chain v-OHFAs (Grac ¸a and [START_REF] Grac ¸a | Suberin structure in potato periderm: glycerol, long-chain monomers, and glyceryl and feruroyl dimers[END_REF][START_REF] Grac ¸a | Glycerol-derived ester oligomers from cork suberin[END_REF]. Likewise, a 22-caffeyloxy-docosanoyl glycerol has been isolated from cotton (Gossypium hirsutum) fiber waxes [START_REF] Schmutz | A caffeoyl-fatty acid-glycerol ester from wax associated with green cotton fibre suberin[END_REF]. In these cases an v-hydroxylase must provide the aliphatic substrate for the hydroxycinnamoyl transferase. Suberin monomer compositions have been described for Arabidopsis (Arabidopsis thaliana) tissues [START_REF] Franke | Apoplastic polyesters in Arabidopsis surface tissues-a typical suberin and a particular cutin[END_REF][START_REF] Molina | The lipid polyester composition of Arabidopsis thaliana and Brassica napus seeds[END_REF][START_REF] Molina | Deposition and localization of lipid polyester in developing seeds of Brassica napus and Arabidopsis thaliana[END_REF], as have the alkyl hydroxycinnamate esters present in Arabidopsis root periderm (Li et al., 2007b).

Suberin deposition requires synthesis and assembly of metabolites from both the phenylpropanoid and acyl lipid pathways. The first genes affecting Arabidopsis aliphatic suberin and suberin-associated wax composition have been identified. These include the glycerol-3-P acyltransferase GPAT5 [START_REF] Beisson | The acyltransferase GPAT5 is required for the synthesis of suberin in seed coat and root of Arabidopsis[END_REF]Li et al., 2007b) and an orthologous pair of cytochrome P450 v-hydroxylases, CYP86A1 and CYP86A33 (Li et al., 2007a;[START_REF] Ho ¨fer | The Arabidopsis cytochrome P450 CYP86A1 encodes a fatty acid omegahydroxylase involved in suberin monomer biosynthesis[END_REF][START_REF] Serra | CYP86A33-targeted gene silencing in potato tuber alters suberin composition, distorts suberin lamellae, and impairs the periderm's water barrier function[END_REF]. However, knockout mutants of these cytochrome P450 genes do not reduce the levels of v-oxidized very-long-chain suberin monomers, so additional cytochrome P450 genes are required for this function. Here, we provide overlapping and additional information to the recent report that the P450 CYP86B1 (AT5G23190) is required for the synthesis of saturated very-long-chain a,v-bifunctional monomers [START_REF] Compagnon | CYP86B1 is required for very long chain v-hydroxyacids and a,v-dicarboxylic acids synthesis in root and seed suberin polyester[END_REF]. In addition, although feruloyl transferase activity toward v-OHFAs has been demonstrated in plant extracts [START_REF] Lotfy | Formation of omega-feruloyloxypalmitic acid by an enzyme from wound-healing potato-tuber disks[END_REF][START_REF] Lotfy | Purification and characterization of hydroxycinnamoyl-coenzyme A:v-hydroxypalmitic acid O-hydroxycinnamoyltransferase from tobacco (Nicotiana tabacum L.) cell-suspension cultures[END_REF], no genes encoding proteins with this function have been identified thus far. We describe an Arabidopsis gene (AT5G41040) that encodes such a feruloyl transferase, which we have named ALIPHATIC SUBERIN FERULOYL TRANSFERASE (ASFT). It is a member of the BAHD family of acyltransferases [START_REF] St Pierre | Evolution of acyltransferase genes: origin and diversification of the BAHD superfamily of acyltransferases involved in secondary metabolism[END_REF][START_REF] Auria | Acyltransferases in plants: a good time to be BAHD[END_REF], so named according to a letter from each of the first four biochemically characterized enzymes of the family, benzyl alcohol acetyltransferase, anthocynain-Ohydroxycinnamoyltransferase, anthranilate-N-hydroxycinnamoyl/benzoyltransferase, and deacetylvindoline 4-O-acetyltransferase.

As suberin is an insoluble heteropolymer localized within the plant cell wall, solving its structure has been a challenging problem. When observed by transmission electron microscopy (TEM), suberin frequently exhibits a lamellar structure of alternating light and dark bands. Also, at least for wound-induced potato (Solanum tuberosum) periderm, the bulk of the phenolics appear to be deposited before the aliphatics [START_REF] Lulai | Differential deposition of suberin phenolic and aliphatic domains and their roles in resistance to infection during potato tuber (Solanum tuberosum L.) wound-healing[END_REF][START_REF] Yang | Metabolite profiling of potato (Solanum tuberosum L.) tubers during wound-induced suberization[END_REF]. Most of these phenolics are oxidatively cross linked [START_REF] Bernards | Hydroxycinnamic acid-derived polymers constitute the polyaromatic domain of suberin[END_REF] and will not yield monomers by polyester depolymerization methods. Models for suberin structure of potato periderm [START_REF] Bernards | Demystifying suberin[END_REF] or cork (Quercus suber;[START_REF] Grac ¸a | Suberin: a biopolyester of plants' skin[END_REF], based as they are on earlier iterations [START_REF] Kolattukudy | Structure, biosynthesis, and biodegradation of cutin and suberin[END_REF], show some divergence, but agree that the electrontranslucent bands are aliphatic rich and that there is an aliphatic polyester. The thickness of this layer coincides with the length of the carbon chain of the aliphatic monomers [START_REF] Schmutz | Changing the dimensions of suberin lamellae of green cotton fibers with a specific inhibitor of the endoplasmic reticulum-associated fatty acid elongases[END_REF]. Components of the opaque bands, which appear to vary considerably in thickness, may include glycerol, phenolics, and possibly aliphatics. In models of both potato and cork suberin oxidative cross linking of ferulic acid provides a covalent link between suberin polyaromatic and polyaliphatic domains. The compositions of mutants can provide new perspectives on structural models. Our results with both BAHD and P450 genes suggest that, at least for seed suberin, two facets of proposed suberin structures, namely esterified ferulate as a linker between the aliphatic and aromatic domains, and the idea of an extended aliphatic polyester domain, will need to be carefully reexamined.

RESULTS

BAHD and CYP86B1 Genes Correlated with the Expression of Suberin-Associated Genes

The recent identification of two Arabidopsis genes, GPAT5 and CYP86A1, with confirmed roles in suberin biosynthesis provided an opportunity to apply transcript coresponse analysis to identify additional suberin-associated genes under common or related transcriptional control. These genes encode the acyltransferase GPAT5 [START_REF] Beisson | The acyltransferase GPAT5 is required for the synthesis of suberin in seed coat and root of Arabidopsis[END_REF] and the cytochrome P450 monooxygenase CYP86A1, a fatty acyl v-hydroxylase (Li et al., 2007a;[START_REF] Ho ¨fer | The Arabidopsis cytochrome P450 CYP86A1 encodes a fatty acid omegahydroxylase involved in suberin monomer biosynthesis[END_REF]. Using these two genes as the bait set, correlation analysis of gene expression across all microarray data sets [START_REF] Wei | Transcriptional coordination of the metabolic network in Arabidopsis[END_REF]) identified a number of other genes with a strong correlation (Supplemental Table S1), including two members of the BAHD gene family, AT5G41040 (ASFT) and AT5G63560. Furthermore, the homolog of ASFT is among the list of genes that are both highly specific and highly expressed in cork phellem [START_REF] Soler | A genomic approach to suberin biosynthesis and cork differentiation[END_REF]. The BAHD gene family is a large family of acyltransferases with 61 members in Arabidopsis [START_REF] St Pierre | Evolution of acyltransferase genes: origin and diversification of the BAHD superfamily of acyltransferases involved in secondary metabolism[END_REF][START_REF] Auria | Acyltransferases in plants: a good time to be BAHD[END_REF]. To date all studied members of this family utilize relatively hydrophilic acyl-CoAs, including hydroxycinnamoyl-CoAs, as acyl donors in natural product synthesis. The purification of a tobacco (Nicotiana tabacum) feruloyl transferase activity utilizing 16-hydroxypalmitate as acyl acceptor clearly showed the activity to be soluble [START_REF] Lotfy | Purification and characterization of hydroxycinnamoyl-coenzyme A:v-hydroxypalmitic acid O-hydroxycinnamoyltransferase from tobacco (Nicotiana tabacum L.) cell-suspension cultures[END_REF], consistent with expectations for enzymes of the BAHD family. An analysis of the Arabidopsis BAHD family shows 11 clades (Supplemental Fig. S1). Three genes cluster together in clade H, namely ASFT, AT5G63560, and AT3G48720. This clustering is also noted in a recent phylogenetic analysis of BAHD proteins [START_REF] Yu | BAHD superfamily of acyl-CoA dependent acyltransferases in Populus and Arabidopsis: bioinformatics and gene expression[END_REF]. While expression of both ASFT and AT5G63560 correlate highly with the suberin bait set, expression of AT3G48720 shows correlations with some genes of cutin biosynthesis. In summary, the expression data, combined with phylogenetic analysis and known general biochemical function made AT5G41040 (ASFT) and AT5G63560 strong candidates for a putative feruloyl transferase. In fact, AT5G41040 is clearly a feruloyl transferase that controls almost all the esterlinked ferulate deposition, and is described here. The function of AT5G63560 is still under investigation in our lab. Because ferulate is likely to be esterified to very-long-chain v-hydroxy fatty acids we also investigated an uncharacterized P450 gene, CYP86B1 (AT5G23190), that was shown to be correlated with the suberin bait set (Supplemental Table S1; see below).

ASFT Is Expressed in Tissues of Seeds and Roots Where Suberization Occurs Suberin is found in periderm of stems and of underground organs. In primary roots, it is present in endodermal, rhizodermal, and hypodermal cells [START_REF] Ma | Current insights into the development, structure, and chemistry of the endodermis and exodermis of roots[END_REF]. It also may be deposited in seed coat layers during seed development [START_REF] Espelie | Composition, ultrastructure and function of the cutin-and suberin-containing layers in the leaf, fruit peel, juice-sac and inner seed coat of the grapefruit (Citrus paradisi Macfed.)[END_REF][START_REF] Molina | Deposition and localization of lipid polyester in developing seeds of Brassica napus and Arabidopsis thaliana[END_REF]. To investigate the tissue specificity and temporal pattern of expression of ASFT in detail, transcriptional fusions were made by adding the 2-kb putative promoter sequence of ASFT upstream of the eYFP gene, which encodes the yellow fluorescent reporter protein, and this fusion was used to produce stable transgenic Arabidopsis plants. Analysis by confocal laser-scanning microscopy (CLSM; Fig. 1) revealed gene expression in seed coats (Fig. 1, A-C) and roots (Fig. 1, D andE), but not in other plant parts. These results agree with and extend to the cellular level microarray data for ASFT from the AtGenExpress project [START_REF] Schmid | A gene expression map of Arabidopsis development[END_REF]. In seed coats, eYFP was detected in the inner layer of the outer integument (oi1) beneath the oi2 (columellae) layer, at the beginning of the desiccation stage (Fig. 1, A-C). This observation is reminiscent of GPAT5 promoter activity shown both with YFP [START_REF] Molina | Deposition and localization of lipid polyester in developing seeds of Brassica napus and Arabidopsis thaliana[END_REF] and GUS [START_REF] Beisson | The acyltransferase GPAT5 is required for the synthesis of suberin in seed coat and root of Arabidopsis[END_REF] reporters, and to CYP86A1 expression (data not shown). As desiccation proceeds, strong ASFT expression was also observed at the chalazal region (Fig. 1A), as described for GPAT5 expression. In primary roots of seedlings grown in agar for 1 or 2 weeks, YFP fluorescence was observed in the endodermis (Fig. 1, D andE); in 4-to 6-week-old seedlings, YFP expression was detected in the periderm of the zone of the roots that underwent secondary thickening (Fig. 1F), and in the endodermis of root parts in primary developmental stage. CYP86A1 has been shown to have a similar pattern of root expression [START_REF] Ho ¨fer | The Arabidopsis cytochrome P450 CYP86A1 encodes a fatty acid omegahydroxylase involved in suberin monomer biosynthesis[END_REF]. Taken together, our observations indicate that ASFT is expressed in tissues and cell layers where suberin is being deposited.

ASFT Is Required for the Deposition of Ferulate Monomer in Suberin

Two mutant alleles of ASFT were selected by PCR screening of genomic DNA from segregating popula- tions of T-DNA insertion lines. These are designated asft-1 (SALK_048898) and asft-2 (SALK_017725; Supplemental Fig. S2A). Since this gene is expressed in roots and seeds, but its expression is negligible in other organs, mRNA from asft-1, asft-2, and wild-type roots was isolated and subjected to reverse transcription (RT)-PCR. No transcripts of this gene were present in the mutant roots, confirming these lines carry null mutations (Supplemental Fig. S2B).

Wild-type and mutant plants grown side by side showed similar phenotypes. Monomers released by transesterification of delipidated seed residues (Fig. 2) revealed an almost complete loss of ferulate in seeds of both knockout alleles. An additional important observation when comparing asft mutants against wild type was that the reduction in ferulate of 1.55 mmol g 21 seeds for each allele was accompanied by a similar reduction in hydroxy-containing monomers, namely 1.35 mmol g 21 seeds in asft-1 and 2.25 mmol g 21 seeds in asft-2. This observation suggests an approximate stoichiometric correlation between the losses of these two components. A substantial part of the reduction in aliphatics comes from C22 and C24 v-OHFAs. In addition, a compensatory 50% increase in DCAs was observed for asft-1. Thus the total aliphatic monomer content in the asft-1 allele was the same as wild type (8.89 mmol g 21 seeds), and reduced only by 10% in asft-2 (Fig. 2B). Analysis of lipid polyesters in roots of 7-week-old plants (Supplemental Fig. S3) indicated that the ferulate amount is also greatly reduced in root suberin monomers released by transesterification. However, ferulate represents only 3% (w/w) of total root lipid polyester monomers. Aliphatic monomers containing a primary hydroxyl group did not appear to give a commensurate reduction, as in seeds, but minor changes in monomer levels may be masked by the higher variation usually observed in root polyester analysis.

The Deposition of Alkyl Hydroxycinnamate Esters of Suberin-Associated Waxes Is Not Altered in asft Roots

Endogenous waxes that are extracted by rapid chloroform dipping of roots contain alkyl trans-hydroxycinnamate esters, predominantly of coumarate and caffeate, with ferulate in lesser proportion (Li et al., 2007b). The alkyl groups are C18 to C22 saturated 1-alkanols. The relative amount of individual root wax compounds in the asft mutants was indistinguishable from wild type (Fig. 3). This result indicated that the synthesis of alkyl ferulates, and more generally of alkyl hydroxycinnamate esters, is not affected in root suberin waxes of the knockouts. By comparison, the suberin-associated acyltransferase GPAT5 has been shown to participate in the deposition of both suberin waxes and polyester, indicating a biosynthetic overlap between extractable and insoluble components of suberin (Li et al., 2007b). Expression of AT5G41040 under the control of its native or 35S promoters also produced no change in the composition of the root waxes (data not shown). Thus we expect that another BAHD enzyme, and possibly AT5G63560, might have a different specificity and be largely responsible for suberin wax formation in the root periderm. This hypothesis remains to be tested.

Loss of Ferulate Monomer Does Not Affect Suberin Lamellar Structure of Root Periderm Cells

Models describing the lamellar structure of suberin require esterified ferulate to covalently link aliphatic polyesters to the cross-linked aromatic domain(s) [START_REF] Bernards | Demystifying suberin[END_REF][START_REF] Grac ¸a | Suberin: a biopolyester of plants' skin[END_REF]. Because the chemical phenotype of asft is loss of ferulate, we investigated whether this loss would cause a change in the characteristic lamellar structure of suberin observed by TEM. Roots were chosen over seeds for ultrastructural analysis because Arabidopsis seeds are very small and in our hands their highly compacted seed coats made sample preparation problematic for TEM analysis and subsequent image interpretation. Arabidopsis root suberin presents the characteristic lamellar distribution [START_REF] Franke | Apoplastic polyesters in Arabidopsis surface tissues-a typical suberin and a particular cutin[END_REF] described in other species. Root ultrastructure was analyzed in asft-1 and asft-2 knockout mutants and, as a control, in cyp86a1 knockout mutants. As noted earlier, CYP86A1 is a suberin-associated P450 gene (Li et al., 2007a;[START_REF] Ho ¨fer | The Arabidopsis cytochrome P450 CYP86A1 encodes a fatty acid omegahydroxylase involved in suberin monomer biosynthesis[END_REF]. Its knockout shows a strong reduction in aliphatic suberin monomer amount, but a relatively small reduction in ferulate. However, TEM identifies a strong perturbation in suberin structure for cyp86a1 (Supplemental Fig. S4), also observed in the periderm of potato RNA interference lines where the homologous gene has been silenced [START_REF] Serra | CYP86A33-targeted gene silencing in potato tuber alters suberin composition, distorts suberin lamellae, and impairs the periderm's water barrier function[END_REF]. Figure 4 shows the results obtained for thin sections from 6-week-old asft-1 roots. Surprisingly, no changes were observed in the fine structure of suberin deposited in periderm cells of this mutant (Fig. 4B), compared to wild type (Fig. 4A). This observation implies that the ferulate released by transmethylation does not contribute to the TEM-observable ultrastructure of wild-type root periderm suberin.

Recombinant ASFTp Functions as a Feruloyl Transferase

To determine the enzyme reaction catalyzed by ASFT, cell-free extracts of the recombinant protein expressed in Escherichia coli were used in enzyme assays to test for feruloyl transferase activity. Feruloyl-CoA was generated in situ by adding a recombinant tobacco 4-coumarate:coenzyme A ligase [START_REF] Beuerle | Enzymatic synthesis and purification of aromatic coenzyme a esters[END_REF] plus ferulate, ATP, and CoASH to the reaction mixture. Primary alcohols of various chain lengths (C12-C18) and 15-hydroxypentadecanoic acid methyl ester were tested as acyl acceptors. Chloroform-soluble products were analyzed by gas chromatography-mass spectrometry (GC-MS). Figure 5 illustrates that the ASFTp catalyzes the formation of hexadecyl ferulate ester. The product peak at 38.5 min was only present when all the assay components were added (Fig. 5). In particular, the lack of any activity when either CoASH, ATP, or the 4-coumarate:coenzyme A ligase was omitted from the assay implies that the acyl donor for the reaction is indeed feruloyl-CoA. The corresponding electron impact (EI) spectrum showed the expected molecular ion of the silylated derivative (mass-to-charge ratio [m/z] = 490), plus diagnostic ions derived from the feruloyloxy group at m/z = 266, 265, and 249 (Fig. 5, inset). The ferulate ester was also formed using 15-hydroxypentadecanoic acid methyl ester (Supplemental Fig. S5) as acyl acceptor. Higher conversions were noted for dodecan-1-ol, tetradecan-1-ol, and methyl 15-hydroxypentadecanoate, when compared to hexadecan-1-ol, whereas octadecan-1-ol showed only a trace of product. In all cases the substrate of the coupled assay was predominantly trans-ferulate and the product retained this stereochemistry. Thus we show that ASFT exhibits feruloyl-CoA-dependent feruloyl transferase activity toward substrates with a primary fatty alcohol functional group.

CYP86B1 Is Required for the Synthesis of Very-Long-Chain v-Oxidized Suberin Monomers Among cytochrome P450 monooxygenase CYP86 family members only expression of CYP86A1 and CYP86B1 is strongly correlated to the suberin bait set of genes (Supplemental Table S1). CYP86A1 does not appear to be responsible for the high levels of verylong-chain a,v-bifunctional suberin monomers in seeds (Li et al., 2007a;[START_REF] Ho ¨fer | The Arabidopsis cytochrome P450 CYP86A1 encodes a fatty acid omegahydroxylase involved in suberin monomer biosynthesis[END_REF]. Thus we investigated whether CYP86B1 (AT5G23190) would provide this function. As 24-hydroxytetracosanoate is the major v-OHFA of suberin in the outer integument of the seed coat [START_REF] Molina | Deposition and localization of lipid polyester in developing seeds of Brassica napus and Arabidopsis thaliana[END_REF] it might be a major site for ferulate esterification. A homozygous mutant allele was screened from the T-DNA insertion line SALK_130265 (cyp86b1; Supplemental Fig. S2C). The absence of CYP86B1 transcripts in mRNA isolated from cyp86b1 roots confirmed the selected line carried a null mutation of the gene (Supplemental Fig. S2D). No vegetative growth phenotype could be observed between the knockout mutant and wild type. Analysis of seeds for polyester monomers showed a very large reduction in a,v-bifunctional C22 to C24 saturated suberin components (Fig. 6), with a corresponding increase in unsubstituted fatty acids. Reduction in very-long-chain monomers was also observed in polyester monomer analysis of mutant roots (Supplemental Fig. S6). To prove the changes in polyester monomers of the mutant are due to mutation of the gene CYP86B1, we also complemented the mutant plants with 35S::CYP86B1 (Supplemental Fig. S6). Furthermore, proof of the function of this P450 was provided by an ectopic in planta expression experiment wherein CYP86B1 was coexpressed with GPAT5 under control of the 35S promoter. When cutin was analyzed, only the pairing of GPAT5 and CYP86B1 produced cutin monomer profiles containing very-Figure 4. Transmission electron micrographs of Arabidopsis roots in the later stages of secondary thickening. The fine structure of suberin in the asft-1 knockout mutant (B) is similar to the wild type (A). Samples were treated with hydrogen peroxide before the staining procedure [START_REF] Heumann | A simple method for improved visualization of the lamellated structure of cutinized and suberized plant-cell walls by electron-microscopy[END_REF]. Scale bar = 100 nm (A), 50 nm (B). CW, Cell wall; PC, peridermal cell; S, suberin. long-chain a,v-bifunctional monomers (Fig. 7), confirming in vivo function.

DISCUSSION

ASFT Is a Feruloyl Transferase Involved in Suberin Biosynthesis

The BAHD gene ASFT was identified as playing a role in suberin biosynthesis based on chemical analy-sis of mutants, on very specific cell-type expression patterns, and from in vitro activity of the recombinant enzyme. The promoter:eYFP expression experiments in Arabidopsis showed that the expression of this gene is localized to outer integument layer 1 of the seed coat and to the endodermis of young roots (Fig. 1), clearly defining it as a gene active only in suberin-synthesizing cells. Because mutation of ASFT reduces ferulate monomer associated with suberin by over 90% (Fig. 2) there is minimal functional redundancy with AT5G63560. Thus, ASFT controls the major portion of ester-linked ferulate in suberin.

Several lines of evidence point to the in vivo function of ASFT as an O-acyltransferase required for the synthesis of aliphatic-aromatic ester linkages in suberin. We consider it unlikely that ASFT is directly involved in ferulate biosynthesis. Apart from its demonstrated activity as a feruloyl transferase to an aliphatic acyl acceptor, analysis of the genetic relationships in the BAHD gene family shows it is not closely related to the hydroxycinnamoyl transferase(s) that are implicated in monolignol biosynthesis (Supplemental Fig. S1; [START_REF] Hoffmann | Purification, cloning, and properties of an acyltransferase controlling shikimate and quinate ester intermediates in phenylpropanoid metabolism[END_REF][START_REF] Hoffmann | Silencing of hydroxycinnamoy-coenzyme A shikimate/quinate hydroxycinnamoyltransferase affects phenylpropanoid biosynthesis[END_REF]. Cell wall ferulate appears to share a common biosynthetic pathway with monolignols [START_REF] Chen | Multi-site genetic modulation of monolignol biosynthesis suggests new routes for formation of syringyl lignin and wall-bound ferulic acid in alfalfa (Medicago sativa L.)[END_REF]. Also, if ASFT was to function in ferulate biosynthesis we might expect a large reduction in 3#-hydroxylated phenylpropanoids. However, reductions in caffeate and ferulate and increases in coumarate are not seen in the root periderm waxes of asft mutants (Fig. 3). Tyramine is sometimes listed as an aromatic component of suberin, being found as amide with phenylpropanoid acids [START_REF] Kolattukudy | Polyesters in higher plants[END_REF][START_REF] Bernards | Demystifying suberin[END_REF]. However, genes for hydroxycinnamoyl-CoA:tyramine N-hydroxycinnamoyl transferases have been cloned and the proteins are members of the diamine acetyltransferase family [START_REF] Farmer | Identification and characterization of cDNA clones encoding hydroxycinnamoyl-CoA: tyramine N-hydroxycinnamoyltransferase from tobacco[END_REF][START_REF] Schmidt | Cloning and expression of a potato cDNA encoding hydroxycinnamoyl-CoA:tyramine N-(hydroxycinnamoyl)transferase[END_REF], so there is no need to postulate ASFT as an N-acyltransferase. Our Arabidopsis seed polyester monomer analyses were set up to recover tyramine, but none was observed [START_REF] Molina | The lipid polyester composition of Arabidopsis thaliana and Brassica napus seeds[END_REF]. Furthermore, based on the kinetics of product release during NaOMe-catalyzed transmethylation we inferred that most of the ferulate monomer released from Arabidopsis seed coats is from ester and not amide linkages [START_REF] Molina | The lipid polyester composition of Arabidopsis thaliana and Brassica napus seeds[END_REF].

Feruloyl transferase activity utilizing feruloyl-CoA as the acyl donor and v-OHFA as acyl acceptor has been shown in extracts from potato tubers [START_REF] Lotfy | Formation of omega-feruloyloxypalmitic acid by an enzyme from wound-healing potato-tuber disks[END_REF] and tobacco cell suspensions [START_REF] Lotfy | Purification and characterization of hydroxycinnamoyl-coenzyme A:v-hydroxypalmitic acid O-hydroxycinnamoyltransferase from tobacco (Nicotiana tabacum L.) cell-suspension cultures[END_REF]. During purification the tobacco activity behaved as a soluble enzyme, with an apparent molecular mass of 55 kD by size exclusion chromatography and a pI of 4.6. However, the proteins or their corresponding genes responsible for the hydroxycinnamoyl-transferase reaction have remained unidentified. Our enzymology esults prove that ASFT can function as an O-acyltransferase that produces v-feruloyloxy aliphatics. The fact that there is an approximately mole-for-mole reduction in ferulate and aliphatic molecules containing a primary alcohol functional group in the knockout mutants lends credence to the proposal that this activity observed in vitro is also operating in vivo. The fact that the deduced Arabidopsis ASFTp has an estimated molecular mass of 51 kD and pI of 5.5 is very consistent with the data obtained for the tobacco enzyme.

So far we have been unable to scale down the partial depolymerization methods that work on large suberin samples (such as cork) to Arabidopsis seeds. Such methods have allowed a tentative accounting of oligomers. Feruloyl groups appear to be esterified to v-hydroxy groups of aliphatic monomers with an order of magnitude greater frequency than to the hydroxyl groups of glycerol (Grac ¸a andPereira, 1999, 2000). Even as we postulate that the in vivo function of ASFT is the synthesis of v-feruloyloxy aliphatics, and show that it can synthesize alkyl ferulate in vitro (Fig. 5) and that it is expressed in root periderm cells (Fig. 1), the knockout mutant of ASFT has no effect on the deposition of the alkyl coumarates, caffeates, and ferulates of the suberin-associated waxes of the root periderm (Li et al., 2007b). Thus we hypothesize that another BAHD enzyme, and possibly AT5G63560, might have a different specificity and might be largely responsible for suberin wax formation in the root periderm.

In examining the monomer profile of asft (Fig. 2), it should be noted that in wild-type seeds ferulate deposition probably does not fully overlap with aliphatic monomer deposition. This is the case in Brassica napus [START_REF] Molina | Deposition and localization of lipid polyester in developing seeds of Brassica napus and Arabidopsis thaliana[END_REF], where the onset of ferulate and aliphatic deposition are identical but where fatty alcohol and v-OHFA accumulation continues well after ferulate and DCA deposition has stopped. In allele asft-1 (Fig. 2) the increase in very-long-chain DCA monomer levels as v-OHFAs are reduced implies an indirect compensatory effect, suggesting that feruloyl transfer and further v-oxidation to DCA compete for the same pool of v-OHFA. An interesting parallel exists with an experiment using inhibitors of phenylpropanoid biosynthesis in green cotton fibers [START_REF] Schmutz | Changing the dimensions of suberin lamellae of green cotton fibers with a specific inhibitor of the endoplasmic reticulum-associated fatty acid elongases[END_REF], where a reduction of hydroxycinnamic acids in suberin was accompanied by a decrease in v-OHFAs and an increase in DCAs. Furthermore, the approximately equimolar loss of ferulate and an aliphatic group in the asft knockout mutants implies that a feruloyloxy aliphatic is a biosynthetic unit required for suberin assembly and that feruloylation accelerates flux through that branch of the aliphatic pathway.

CYP86B1 (AT5G23190) Is Required for Very-Long-Chain a,v-Bifunctional Monomer Synthesis in Seed Suberin

Our results and those of a very recent study [START_REF] Compagnon | CYP86B1 is required for very long chain v-hydroxyacids and a,v-dicarboxylic acids synthesis in root and seed suberin polyester[END_REF] identify CYP86B1 (AT5G23190) as a gene required for suberin verylong-chain a,v-bifunctional monomer synthesis. The ectopic coexpression experiment with GPAT5 and CYP86A1 shows that CYP86A1 produces C16 to C22 monomers in cutin (Li et al., 2007a), while the same experiment with GPAT5 and CYP86B1 shows that CYP86B1 produces C18 to C24 monomers (Fig. 7). However, in seeds it is CYP86B1 that is required for the biosynthesis of most of the C22:0 and C24:0 v-OHFAs and DCAs (Fig. 6). The knockout of this gene results in the accumulation of the corresponding C22:0 and C24:0 fatty acids, which may or may not be the immediate acyl precursor for the v-hydroxylase. As we have previously noted, defining the exact biochemical pathway on the basis of changes in monomer distribution of mutants is extraordinarily difficult [START_REF] Pollard | Building lipid barriers: biosynthesis of cutin and suberin[END_REF]. CYP86B1 surely functions as an v-hydroxylase and requires GPAT5 for function, but whether it also functions as an v-oxidase to produce DCAs, and whether the hydroxylation precedes or succeeds either GPAT5-catalyzed acyl transfer or the fatty acid elongase(s) remains to be determined.

The reduction in ferulate when C22:0 and C24:0 v-OHFAs are reduced by cyp86b1, and the reduction in C22:0 and C24:0 v-OHFAs when ferulate is reduced by asft, suggest that a significant portion of ferulate in wild type is esterified to C22:0 and C24:0 v-OHFAs. In our studies of Arabidopsis and B. napus seed polyesters we were able to localize the monomers to three distinct locations in the seed [START_REF] Molina | Deposition and localization of lipid polyester in developing seeds of Brassica napus and Arabidopsis thaliana[END_REF]. These studies were based on seed dissections, a mutant impaired in the formation of the outer integument of the seed coat, and promoter:GFP-based localization of gene expression. 9,10,18-Trihydroxyoctadecenoate and C18:2 DCA, which are cutin monomers, were dominantly associated with the inner layer of the seed coat inner integument and the embryo, respectively. The remaining monomers were those typical of suberin and were localized to the inner layer of the outer integument. Using this information we can subtract the contributions of the two major cutin monomers from the total seed monomer profile to give an approximate composition of suberin monomers of the seed coat outer integument. Thus we classify the monomers detailed in Figure 6A as shown in Figure 6B. There is little precedence in the natural products literature for hydroxycinnamic acids to be esterified through their phenolic hydroxyl groups. This is hardly surprising, since their main biological function is predicated through free radical formation from the free phenolic hydroxyl group, to allow oxidative coupling reactions. Thus we count ferulate as monofunctional in this suberin monomer classification. Ferulate, which accounts for about 13.7 mol % of monomers in total polyesters of wild-type seed, becomes 16.5 mol % of just the suberin monomers. If we classify monofunctional monomers as normal fatty acids and fatty alcohols, and ferulate, and subtract out the cutin component, then the monofunctional monomers in seed suberin account of 35.6 mol % in wild type, but rise to 63.2 mol % in cyp86b1, mainly through the accumulation of tetracosanoic acid.

Implications for Models of Suberin Structure

A model describing the lamellar suberin structure for potato periderm has a ferulate-monolignol polyphenolic domain embedded in the primary cell wall and covalently linked to a glycerol-based polyaliphatic domain [START_REF] Bernards | Demystifying suberin[END_REF]. The aliphatic polyesters extend across multiple electron-translucent bands. The opaque bands may correspond to glycerol, esterified phenolics, and waxes. A model for cork suberin (Grac ¸a and Santos, 2007) presents a single aliphatic-chain-wide translucent domain where the polyacylglycerol mainly folds back on itself, and a wider, variablewidth electron-rich domain that contains the crosslinked hydroxycinnamic acids. In both models ferulic acid has been suggested to provide crucial covalent links between polyaromatics and the suberin aliphatic polyester. These links are esterification through the ferulate carboxylate group and one electron oxidation of the phenolic group to allow radical coupling of the ferulate to produce nonester bonded dimers and oligomers. In both models there is an implication of overlapping aliphatic and aromatic precursor biosynthesis. In view of our observation that, at least in root tissue, the suberin lamellae appear largely unaffected by the at5g41040 mutant, the importance of esterlinked ferulate in the formation of the lamellae must be reconsidered. Whether the reduction in ferulate released by transesterification does or does not affect the lamellar structure of suberin in tissues other than roots remains to be determined. Histochemical analyses [START_REF] Lulai | Differential deposition of suberin phenolic and aliphatic domains and their roles in resistance to infection during potato tuber (Solanum tuberosum L.) wound-healing[END_REF] and principal component analysis of precursors [START_REF] Yang | Metabolite profiling of potato (Solanum tuberosum L.) tubers during wound-induced suberization[END_REF] during potato wound suberization support the view that deposition of the aromatic domain is the first event in suberization. Indeed, [START_REF] Lulai | The importance of phellogen cells and their structural characteristics in susceptibility and resistance to excoriation in immature and mature potato tuber (Solanum tuberosum L.) periderm[END_REF] have proposed that there is no covalent connectivity between the polyaromatic and polyaliphatic domains. Our observation that ferulate deposition ceases as aliphatics are still being laid down in Brassica seeds [START_REF] Molina | Deposition and localization of lipid polyester in developing seeds of Brassica napus and Arabidopsis thaliana[END_REF] is consistent with polyaromatic deposition preceding polyaliphatic deposition.

An important observation is that the suberin aliphatic monomer amount has not been greatly reduced in asft mutants. A corollary is that the loss of ferulate does not impact the insolubility of the suberin polyester. The fact that suberin aliphatic deposition in late-stage Brassica seeds does not overlap ferulate deposition is consistent with this deduction [START_REF] Molina | Deposition and localization of lipid polyester in developing seeds of Brassica napus and Arabidopsis thaliana[END_REF]. This raises questions concerning the role of ferulic acid in attaching aliphatics to the cell wall. Even if most of the ferulate is incorporated into suberin as v-feruloyloxy aliphatics, a very small amount of cross linking might cause suberin insolubility. Ferulate derivatives that have been oxidatively cross linked [START_REF] Bernards | Hydroxycinnamic acid-derived polymers constitute the polyaromatic domain of suberin[END_REF] will either not be released from the polymer matrix by transmethylation, or if they are released, they will not be detected by our GC-MS analysis. Thus it remains possible that ASFT or another enzyme may attach ferulate to other sites in suberin currently unknown but possibly glycerol, and where oxidation to form cross links is prevalent. Further studies are required to assess the breadth of acyl acceptor specificity of ASFT, both for potential v-OHFA substrates such as free acids, acylglycerols, and acyl-CoAs, and to test whether acceptors other than aliphatics with a primary OH group might also be substrates. However, it is clear that ASFT and AT5G63560 have nonredundant functions, at least in regards to the presence of ferulate released by transmethylation. Thus it is possible AT5G63560 might function to provide ferulate for cross linking, or to provide sufficient redundancy with ASFT in asft knockout lines, to keep the suberin insoluble.

Even as our results for ASFT require that we reconsider the role of ferulate in suberin structure and its properties, our results with CYP86B1 are inconsistent with the concept of an extended polyaliphatic domain, at least for Arabidopsis seed suberin. In a condensation polymer monofunctional monomers terminate a polymer chain. An v-OHFA cannot cause cross linking, but a combination of glycerol and a,v-DCAs may result in cross linking [START_REF] Pollard | Building lipid barriers: biosynthesis of cutin and suberin[END_REF]. If we allow a condensation polymer to form between just the observed monomers and glycerol, wild-type suberin clearly has the potential to form an extended polyaliphatic domain. However, in cyp86b1, where the suberin is still an insoluble product, the large mole fraction of monofunctional monomers ($60%) should preclude polymer formation, let alone cross-linked polymer formation. Thus either an additional contribution from a hidden aliphatic component (suberan) or an additional matrix is required to describe suberin. Furthermore, if we suggest that wild-type suberin really does not exist as an extended polyaliphatic, the idea that a very-low density of cross-linked ferulates could anchor the material, causing its insolubility, also seems less likely. Clearly, suberin structure needs a reinvestigation.

MATERIALS AND METHODS

Plant Materials and Growth Conditions

Arabidopsis (Arabidopsis thaliana) wild-type (Columbia-0) and mutant seeds were germinated and grown as described by Li et al. (2007a). Transgenic seeds were stratified and germinated on Murashige and Skoog (MS) medium supplemented with either with 50 mg mL 21 kanamycin or 30 mg mL 21 hygromycin or a combination of both in the case of double overexpressors. Selected plants were transferred to soil and grown as indicated above.

Mutant Isolation

Seed stocks of three T-DNA insertion lines [START_REF] Alonso-Blanco | Analysis of natural allelic variation at seed dormancy loci of Arabidopsis thaliana[END_REF] for ASFT (AT5G41040; SALK_048898 and SALK_017725) and for CYP86B1 (AT5G23190; SALK_130265) were obtained from the Arabidopsis Biological Resource Center seed collection (http://www.biosci.ohiostate.edu). Primers to amplify the wild-type gene were ASFT-F1 and ASFT-R1, and CYP86B1-scF and CYP86B1-scR, respectively (Supplemental Table S2). To check for the insertion, the primer set used was ASFT-R2, specific for the 3#-untranslated region gene sequence, or CYP86B1-scR and the T-DNA left-border-specific primer LBa1. For the RT-PCR, RNA was isolated from 100 mg of 3-week-old Arabidopsis roots using the RNeasy plant mini kit (Qiagen), following manufacturer's instructions. SuperScript III reverse transcriptase (Invitrogen) was used to synthesize the first-strand cDNA, following manufacturer's protocol. Two-microliter aliquots of the RT reactions were used as template for PCR. Primers for ASFT amplification were ASFT-F3 and ASFT-R3, for CYP86B1, CYP86B1-F and CYP86B1-R (Supplemental Table S2). The housekeeping eukaryotic eIF4A gene was used as a control.

eYFP Reporter Construct Design and Plant Transformation

The reporter gene eYFP was amplified by PCR and cloned into BamHI-SacIdigested pBI101. The primers used for the amplification were YFP-F (forward) and YFP-R (reverse; Supplemental Table S2). The 2.0-kb 5# sequence of the ASFT DNA was amplified by PCR using genomic DNA as template (PRO Asft ) and subcloned in pGEM-T easy vector (Promega Corporation) for sequencing. Cloning primers were ASFT-F (forward) and ASFT-R (reverse; Supplemental Table S2). All amplifications used a proofreading DNA polymerase (Platinum Pfx). To generate the PRO Asft ::eYFP construct, the promoter sequences were released from pGEM-T easy vectors and ligated into SalI-BamHI-digested pBI101-eYFP, upstream of the eYFP sequence. The binary plasmid was introduced into Agrobacterium tumefaciens strain C58C1 by electroporation. Arabidopsis Columbia-0 wild-type transformation was performed by the vacuum-infiltration method [START_REF] Bechtold | In planta Agrobacterium-mediated gene transfer by infiltration of adult Arabidopsis thaliana plants[END_REF]. T2 seeds from several individual kanamycin-resistant plants were analyzed by CLSM to evaluate YFP expression.

Confocal Microscopy Analysis of eYFP Reporter Expression

Imaging of whole-developing transgenic seeds and roots mounted in water was performed with Zeiss Pascal confocal laser-scanning microscope (Carl Zeiss International), using a 203 Plan-Neofluar Carl Zeiss objective. Samples were excited with 488-nm argon ion laser line and emission was detected after passing through a BP 505 to 530 (digitally colored green), and long-pass 650-nm filter (digitally colored red). Individual optical sections were used to create extended focus images using LSM 5 Pascal (version 3.0) software. Images were overlaid to derive a two-color image. All samples were treated with 0.5 mg mL 21 aqueous propidium iodide (Sigma) for 10 min to visualize cell walls. Images were transformed to TIFF format files and processed with Adobe Photoshop CS2.

TEM

Root samples (1 mm 2 size) were fixed with 0.1 M cacodylate buffer containing 2.5% glutaraldehyde and 2% paraformaldehyde, post fixed with 1% buffered osmium tetroxide, and dehydrated through a graded acetone series. Samples were then infiltrated with Poly/Bed 812 resin. After placing in silicone moulds, embedded samples were polymerized for 24 h at 60°C. Silvergold ultrathin sections were prepared with a diamond knife on a Power Tome_XL microtome (Boeckeler Instruments) and placed on copper-mesh grids. Samples on grids were treated with 10% hydrogen peroxide for 10 min, and stained with 10% uranyl acetate in methanol for 8 min, and Reynold's lead citrate for 10 min. This modified staining procedure enables to enhance the contrast of both cutin and suberin [START_REF] Heumann | A simple method for improved visualization of the lamellated structure of cutinized and suberized plant-cell walls by electron-microscopy[END_REF]. Specimens were examined with a JEOL 100CX transmission electron microscope, and images processed with Adobe Photoshop CS2.

Lipid Analysis

Sodium methoxide catalyzed depolymerization and GC-MS or GC-flame ionization dectector analyses were performed on whole-delipidated seed, stem, or root tissues following the protocol detailed in [START_REF] Molina | The lipid polyester composition of Arabidopsis thaliana and Brassica napus seeds[END_REF]. The major ferulate isomer is always the trans-isomer ($92 mol %). The contribution of the minor cis-ferulate isomer is not included in composition tabulations. Root wax extraction and analyses were performed according to Li et al. (2007b). The alkyl hydroxycinnamate esters are predominantly the transisomers. These stereochemical assignments are based on the observation that the alkyl esters of cis-ferulate always elute ahead of the trans-isomers on nonpolar GC columns.

Recombinant Protein Expression

The ASFT cDNA designed de novo to optimize the codon usage for Escherichia coli was synthesized by GenScript. The synthetic ASFT cDNA was cloned into pGS-21a expression vector (GenScript) using NcoI and XhoI restriction sites. A His tag/glutathione S-transferase epitope was fused in frame at the N terminus. E. coli BL21 (DE3) LysS (Novagen) cells were transformed by heat shock with 0.2 mg of plasmid and grown in Luria-Bertani plates containing 100 mg mL 21 carbenicillin and 34 mg mL 21 chloramphenicol. A single bacterial colony was used to inoculate a liquid culture, which was in turn used to inoculate a subculture of Luria-Bertani medium containing 100 mg mL 21 carbenicillin, which was grown at 20°C with shaking. When OD = 0.6, isopropyl b-D-thiogalactopyranoside (0.8 mM) was added for induction of protein expression, and culture was grown for 24 h. Procedures for protein extraction and subsequent purification are described elsewhere [START_REF] Beuerle | Enzymatic synthesis and purification of aromatic coenzyme a esters[END_REF]. The soluble recombinant protein was purified by Ni +2 chelating chromatography, and the presence of the fusion protein was confirmed by SDS-PAGE and western blot.

Feruloyl Transferase Assay

Feruloyl-CoA substrate was generated by incubating a reaction mixture (1 mL) containing 50 mM Tris-HCl pH 7.5, 2.5 mM MgCl 2 , 2.5 mM ATP, 0.2 mM ferulic acid, 0.2 mM CoA, and 10 mL of purified recombinant 4-coumarate ligase [START_REF] Beuerle | Enzymatic synthesis and purification of aromatic coenzyme a esters[END_REF] for 1 h at 30°C. To initiate ester synthesis, 10 mL of recombinant ASFT-tagged protein, 1 mM dithiothreitol, and 1 mM fatty alcohol or methyl 15-hydroxypentadecanoate were added. After incubation overnight at 30°C the reaction was stopped by addition of 2 mL chloroform:methanol (2:1, v/v). The organic phase was removed and dried under N 2 stream. Samples were silylated by heating at 110°C for 10 min with N,O-bis(trimethylsilyl)trifluoroacetamide:pyridine (1:1, v/v) and analyzed by GC-MS(EI) on a HP-5MS capillary column temperature programmed from 130°C to 330°C at 5°C/min.

CYP86B1 Overexpression Construct Design, Complementation, and Plant Transformation

Genomic DNA was prepared from Arabidopsis leaf tissue using a plant mini DNA kit according to the manufacturer's instructions (Qiagen). Genomic DNA sequences encoding the CYP86B1 gene (AT5G23190) were amplified by PCR using primers CYP86B1-cF and CYP86B1-cR (Supplemental Table S2).

The PCR product was cloned as a BglII-SpeI fragment into binary vector pCAMBIA1302 (CAMBIA). The construct was named as 35S::CYP86B1. This construct and also the 35S::GPAT5 construct (Li et al., 2007b) were individually introduced into A. tumefaciens strain C58C1 for Arabidopsis vacuum infiltration [START_REF] Bechtold | In planta Agrobacterium-mediated gene transfer by infiltration of adult Arabidopsis thaliana plants[END_REF]. Wild-type Arabidopsis plants were dipped into MS Suc solution containing transgenic agrobacteria harboring 35S:: CYP86B1; plants were also dipped into cultures containing equal amounts of 35S::CYP86B1/35S::GPAT5. Transgenic plants were then selected on MS agar plates containing 30 mg mL 21 hygromycin alone for CYP86B1 transformants, or selected on MS plates containing both 30 mg mL 21 hygromycin and 50 mg mL 21 kanamycin for double transformants. For complementation, cyp86b1 mutant plants were infiltrated with agrobacterium harboring 35S::CYP86B1.

Figure 1 .

 1 Figure 1. Analysis of ASFT promoter activity in Arabidopsis developing seeds and roots. Living transgenic seeds and roots from plants transformed with Pro Asft ::eYFP were analyzed by CLSM. A and B, Confocal sections of transgenic seeds entering desiccation stage show YFP expression in the outer integument 1 (oi1) and the chalazal region of the seed coat. C, Magnification of the seed section shown in B. The YFP expression is beneath the columellae of the mucilage cells (oi2). D and E, Extended focus fluorescence images compiled from 26 (D) and 12 (E) optical sections of 2-week-old transgenic roots. YFP expression is localized to the endodermis. F, Extended focus fluorescence image compiled from 11 optical sections of a 5-week-old transgenic root showing YFP fluorescence in peridermal cells. Red fluorescence in the embryo corresponds to chlorophyll; red fluorescence in seed coat columellae and root cell walls is produced by propidium iodide dye. Scale bar = 100 mm (A and D), 50 mm (B), 20 mm (C, E, and F). en, Endodermis; ep, epidermis; pe, peridermis.

Figure 2 .

 2 Figure 2. Comparison of lipid polyester monomer composition for wild-type (WT) and asft seeds. A, Individual monomers. Means of triplicate determinations and SD are indicated. Asterisks denote a significant difference from wild type (t test, two-sided P , 0.05). B, Total monomer amounts, with monomers grouped in four classes.

Figure 3 .

 3 Figure 3. Root wax composition of wild-type (WT) and asft mutants. Composition of chloroformextracted root waxes, expressed as mass % respect to total monomer amounts for each line. Means of triplicate determinations and SD are indicated. FAs, Free fatty acids; MAGs, monoacylglycerols; PAs, primary alcohols.

Figure 5 .

 5 Figure 5. Formation of hexadecyl ferulate ester by the recombinant ASFT enzyme in cell-free extracts. Recombinant ASFT protein was incubated with ferulate, ATP, CoASH, recombinant 4-coumarate ligase, and 1-hexadecanol. The GC-MS chromatogram of the extracted product shows a peak at 38.5 min that is absent if any of the above assay components are not present (blank). Insets: EI mass spectrum and molecular structure deduced from the fragmentation pattern of hexadecyl ferulate trimethylsilyl ether. Diagnostic ions: m/z 490, molecular ion; 266, [TMSiferulyloxy + H] + ; 265, [TMSi-ferulyloxy] + ; 249, [TMSi-feruloyl] + .

Figure 6 .

 6 Figure 6. Comparison of lipid polyester monomer composition for wild-type and cyp86b1 (at5g23190) seeds. A, Individual monomers. Means of triplicate determinations and SD are indicated. Asterisks denote a significant difference from wild type (WT; t test, two-sided, P , 0.05). B, Total monomer amounts, with monomers grouped into five classes. The cutin designation comprises 1,18-octadecadiene dioate and 9,10-,18-trihydroxyoctadecenoate, which are found in the cutin layers of the seed coat inner integument and the embryo, respectively. The other four classes comprise monomers from the suberized outer integument of the seed coat.

Figure 7 .

 7 Figure 7. Changes in cutin content and composition in the stems of the single and coexpressors of GPAT5 and CYP86B1. Means of three experiments and SE are shown (8-week-old plants). WT, Wild type.

Figure S3 :Figure S5 :Figure S6 :

 S3S5S6 Figure S3: Root suberin monomer composition of WT and asft mutants. Composition of suberin monomer loads from seven-week old roots. Means of triplicate determinations and SD are indicated.

Plant Physiol.Vol. 151, 2009

Feruloyl-CoA Transferase Required for Suberin Synthesis Plant Physiol.Vol. 151, 2009

Plant Physiol.Vol. 151, 2009

ACKNOWLEDGMENTS

We thank Alicia Pastor (Michigan State University Advanced Microscopy Center) for her assistance in sectioning samples for TEM and Dr. Eran Pichersky (University of Michigan) for providing us with an E. coli strain expressing a tobacco 4-coumarate ligase.

1 This work was supported by the U.S. Department of Agriculture (grant no. 2005-35318-15419) and the National Science Foundation (grant no. MCB-0615563). Unite ´Mixte de Recherche 5200, Centre National de la Recherche Scientifique/University of Bordeaux, F-33076

Supplemental Data

The following materials are available in the online version of this article. Supplemental Table S1. Correlation of gene expression using suberinassociated genes as bait: some representative results.

Supplemental

Supplemental Table S2. Primer sequences.