Léa Guérin

Christine Frances

Alain Liné

Carole Coufort-Saudejaud

Fractal dimensions and morphological characteristics of aggregates formed in different physico-chemical and mechanical flocculation environments

Flocculation experiments were performed in a Taylor-Couette reactor in turbulent conditions characterized by the mean shear rate. A sequenced hydrodynamic protocol was applied which consists in low and high shear rates steps allowing to promote respectively aggregation and breakage processes. The particle size distribution and the 3D fractal dimension were determined on line by laser diffraction while morphological parameters were characterized off line using an automated microscope coupled with image processing. After a first aggregation-breakage cycle, the flocs formed by charge neutralization have smaller sizes than during the first aggregation step when the main aggregation mechanism is the charge neutralization whereas coarser but more resistant aggregates can be produced by bridging mechanism. During the flocculation process, high shear rates calibrate the flocs, creating small flocs having a size close to the Kolmogorov microscale. These small flocs serve as bricks to form larger flocs when lower shear rates are applied and a full reproducibility is observed after one or two cycles of the sequence depending on the aggregation mechanism. A clear correspondence was put in evidence between the shear rate conditions and the volume base mean size or fractal dimension of flocs. The morphological fractal dimension, as well as the fractal dimension derived from laser measurements, are in good agreement with the mean trend of the morphological data but cannot represent the whole diversity of floc sizes and shapes. The 3D surface base area and perimeter distributions appear as a promising tool allowing a deeper analysis of the impact of physico-chemical and shear conditions on aggregate properties during a flocculation process.

Introduction

Morphological properties of particles, gathering size and shape characteristics are key properties in a large variety of industrial applications. For example, end-use properties of ceramics or pharmaceutical powders are usually linked to particle size and shape distributions. Likewise, in water production or waste water treatment, the physical properties of the suspended particles may impact the separation process efficiency. Indeed, robust and porous flocs are best required for a filtration process, while dense and compact flocs are preferred in decantation processes [START_REF] Nan | Characteristic analysis on morphological evolution of suspended particles in water during dynamic flocculation process[END_REF][START_REF] Soos | Effect of shear rate on aggregate size and morphology investigated under turbulent conditions in stirred tank[END_REF]. Just to remind the context, during a flocculation process, particles enter in contact thanks to diffusionnal forces induced by the brownian motion or hydrodynamic forces resulting from differential sedimentation or shear effects. After the collision, particles remain together or not, depending on their surface properties and on the medium properties. The aggregation may then result from charge neutralization if salts are used or sweep flocculation in presence of a precipitate or even bridging flocculation if a polymer having a long chain is adsorbed on two or more particles at the same time. Flocculation by depletion is another mechanism occurring in presence of a free polymer that forces the particles to adhere the ones to the others. Finally the aggregate will remain stable until the hydrodynamic forces are less important than the cohesion forces. So, during an aggregation process performed under fixed hydrodynamic and physico-chemical conditions, two steps are usually observed. Initially, an increase of the mean size is induced by the strong decrease of the number of suspending particles; the aggregation events being much more frequent than the breakage ones. The mean size stabilizes then due to the increase of the breakage events. During the second stage of the aggregation process, a stationary state is finally reached either once aggregation and breakage processes have stopped or due to the the balance of the aggregation and breakage phenomena [START_REF] Spicer | Coagulation and fragmentation: the variation of shear rate and the time lag for attainment of steady state[END_REF][START_REF] Serra | Effect of the shear and volume fraction on the aggregation and breakup of particles[END_REF][START_REF] Biggs | Activated sludge flocculation: on-line determination of floc size and the effect of shear[END_REF][START_REF] Bouyer | Experimental analysis of floc size distribution and hydrodynamics in a jar-test[END_REF]. Higher the shear rate, more rapid is the growth of aggregates and their steady state mean size are lower [START_REF] Oles | Shear-induced aggregation and breakup of polystyrene latex particles[END_REF][START_REF] Serra | Aggregation and breakup of particles in a shear flow[END_REF]. Higher the shear rate, lower is also the distribution spread [START_REF] Frappier | Floc cohesive force in reversible aggregation: a couette laminar flow investigation[END_REF][START_REF] Spicer | Shear-induced flocculation: the evolution of floc structure and the shape of the size distribution at steady state[END_REF]. The aggregate mean size is then usually related in steady state conditions to the mean Kolmogorov microscale (< η >) or to the shear rate (G) on this form d mean ∼ < η > ∼ G -γ where a value of 0.5 is often considered for γ [START_REF] Biggs | Activated sludge flocculation: on-line determination of floc size and the effect of shear[END_REF][START_REF] Oles | Shear-induced aggregation and breakup of polystyrene latex particles[END_REF][START_REF] Serra | Aggregation and breakup of particles in a shear flow[END_REF][START_REF] Bouyer | Experimental analysis of hydrodynamics in a jar-test[END_REF][START_REF] Coufort | Flocculation related to local hydrodynamics in a Taylor-Couette reactor and in a jar[END_REF][START_REF] Ehrl | Dependence of aggregate strength, structure, and light scattering properties on primary particle size under turbulent conditions in stirred tank[END_REF][START_REF] Vlieghe | In situ characterization of floc morphology by image analysis in a turbulent Taylor-Couette reactor[END_REF]. More specifically, analyzing kaolin flocs generated by various mechanisms, Li et al. [START_REF] Li | Characterization of floc size, strength and structure under various coagulation mechanisms[END_REF] showed that the stable floc size exponent γ varied between about 0.4 when flocs were obtained by a bridging mechanism to about 0.6 in the case of charge neutralization or sweep flocculation mechanisms.

Furthermore, the morphology or the compactness of the aggregates may be evaluated by the fractal dimension. Such a property may be of prime importance in some industrial applications such as water treatment since the floc settling velocities varie with the fractal dimension distribution [START_REF] Vahedi | Predicting the settling velocity of flocs formed in water treatment using multiple fractal dimensions[END_REF]. Several authors reported that high shear rate conditions lead to more dense flocs having higher fractal dimensions [START_REF] Chakraborti | Changes in fractal dimension during aggregation[END_REF][START_REF] Li | The strength and fractal dimension characteristics of alum-kaolin flocs[END_REF][START_REF] Sonntag | Structure and breakup of flocs subjected to fluid stresses. I. Shear experiments[END_REF]. Some authors [START_REF] Oles | Shear-induced aggregation and breakup of polystyrene latex particles[END_REF][START_REF] Spicer | Effect of shear schedule on particle size, density, and structure during flocculation in stirred tanks[END_REF] have introduced two fractal dimensions to characterize the whole population of aggregates, one fractal dimension for the smallest entities and the second one, higher than the previous one, for the largest aggregates. To explain this result, it is claimed that the large aggregates, which are more subjected to breakage processes, lose their more fragile parts. So after several successive events during a flocculation process, they become more and more dense and their fractal dimension increases. However, opposite results were recently reported by Moruzzi et al. [START_REF] Moruzzi | Fractal dimension of large aggregates under different flocculation conditions[END_REF] considering only aggregates of large sizes. They observed that higher fractal dimensions were obtained for lower shear rates and concluded that the behaviour of the aggregate structure was dependant on the predominance of the aggregation mechanisms, either cluster-cluster or particle-cluster in relation with shear conditions. In the same vein, analyzing the particle size and their number and two fractal dimensions, based one on a characteristic size and the other one on the perimeter, several authors [START_REF] Oles | Shear-induced aggregation and breakup of polystyrene latex particles[END_REF][START_REF] Spicer | Effect of shear schedule on particle size, density, and structure during flocculation in stirred tanks[END_REF][START_REF] Bubakova | Effect of shear rate on aggregate size and structure in the process of aggregation and at steady state[END_REF] isolated the main mechanism involved among erosion, breakage and restructuring and concluded on the impact on the aggregate structure.

Furthermore, to analyze the effect of hydrodynamic conditions on aggregate properties, a sequenced protocol varying the shear rate level may be performed allowing analyzing the reversibility of the flocculation process. Applying again the same shear rate after a first aggregation/breakage cycle, Kusters [START_REF] Kusters | Aggregation kinetics of small particles in agitated vessels[END_REF] observed that the mean size of latex particles in presence of salt was reversible. However, after this pioneer work, several authors [START_REF] Li | The strength and fractal dimension characteristics of alum-kaolin flocs[END_REF][START_REF] Barbot | Coagulation of bentonite suspension by polyelectrolytes or ferric chloride: floc breakage and reformation[END_REF][START_REF] Bouyer | Experimental analysis of floc size distributions in a 1-l jar under different hydrodynamics and physicochemical conditions[END_REF][START_REF] Coufort | Analysis of floc size distributions in a mixing tank[END_REF][START_REF] Xiao | PIV characterization of flocculation dynamics and floc structure in water treatment[END_REF] reported the irreversible nature of the flocculation process. Thus, the aggregate size after a re-aggregation step is almost systematically lower than after the first aggregation step. The reversibility of floc break-up process also depends on the flocculation mechanism. Concerning the flocculation of kaolin clay, Yukselen and Gregory [START_REF] Yukselen | The reversibility of floc breakage[END_REF] reported a significant irreversibility after the breakage step in presence of salts whereas using cationic polyelectrolytes, an almost complete recovery was observed during the re-growth step. Floc structure and strength are also influenced by floc history. For instance, a gradual shear increase allows obtaining flocs having a higher fractal dimension than those produced under stable conditions when one cycle of growth-breakage-growth is applied [START_REF] Wang | Characterization of floc structure and strength: role of changing shear rates under various coagulation mechanisms[END_REF]. But, in real conditions, as in stirred vessels, aggregates are submitted to multiple steps of breakageregrowth due to the heterogeneous nature of the hydrodynamics. So, even if many works were performed on the impact of the hydrodynamic conditions on the aggregate properties, the relationship between the hydrodynamic shear conditions, in particular in turbulent conditions, the aggregate morphology and the physico-chemical conditions, which control the aggregation mechanism, is not fully clear.

The aim of this work is to analyze the combined effect of physicochemical and hydrodynamical turbulent conditions on floc properties. So the impact of different coagulation mechanisms, in particular charge neutralization and bridging flocculation, on the floc properties was investigated performing sequenced hydrodynamic flocculation experiments inside a Taylor-Couette reactor. The floc size distribution and the fractal dimension were measured on line by laser diffraction while shape distributions were obtained thanks to an image analysis treatment analyzing a great number of flocs at each sampling done over the experiments. Thus, it was possible to get reliable statistical data on both size and shape properties of flocs, as well as on their fractal dimension using different complementary methods. Finally, 3D area-perimeter distributions accounting simultaneously for both size and shape characteristics were derived. A special attention was paid on the effect of the aggregation mechanism on the morphological changes and the analysis of their reproducibility after multiple steps of breakage-regrowth under turbulent shear conditions. In complement a focus was made on the comparison of the fratal dimension deduced from laser sizer and the morphological properties of flocs based on their area and perimeter distributions.

Materials and methods

Latex microspheres with a diameter about 0.2 μm commercialised by Polysciences Inc as a suspension with a solid fraction of 2.5% have been used during all the experiments presented in this article. The volume size distribution determined by laser diffraction is unimodal with sizes ranging from 0.05 to 0.5 μm. The mean volume equivalent diameter is equal to 0.18 μm and the median to 0.16 μm.The chosen dimensions of the particles (with a diameter of less than 1 μm) permit to obtain a suspension which is representative of colloidal suspensions found in many applications.

Those latex microspheres have a high concentration of sulfates groups on their surfaces. The zeta potential is equal to -54 mV ( ± 3 mV) at a temperature of 25 °C, suggesting that the latex suspension was rather stable in these conditions. All the experiments presented below have been conducted at room temperature between 20 and 25 °C with a volume fraction of primary particles of 3.5 × 10 -5 in demineralized water.

A P D 2 pf (2)
Using this definition, the morphological fractal dimension (D pf ) is equal to 1 for objects having a smooth contour and higher than 1 for an irregular contour. D pf can easily be obtained from image analysis drawing the square root of the area versus the perimeter in a log scale. It may be noticed that flocs of a few pixels, i.e those having a circle equivalent diameter smaller than 10 μm, were not taken into account in the perimeter and D pf calculations.

Results and discussion

Volume size distributions over the flocculation sequenced scheme

Whatever the chosen coagulant, the shear rate or the sequencing step, the stationary state was reached before the end of the step. relationship between the area and the perimeter is often used [START_REF] Logan | Conversion of wastes into bioelectricity and chemicals by using microbial electrochemical technologies[END_REF]: volume size distribution obtained at the end of the last step at LSR value (A3 -Fig. 1e) is similar to the one obtained at the end of step 3 (A2 -Fig. 1c). For the runs performed using aluminum sulfate or polymer, the aggregates formed after steps B2 (cf. Fig. 1d) and B3 (cf. Fig. 1f) are bigger than those obtained with sodium chloride. Unlike the case with sodium chloride, the volume size distributions also slightly evolve from one breakage step to the other in the case of the use of aluminum sulfate or the polymer. However, the distributions obtained with the polymer are much more shifted to the right than those obtained with aluminum sulfate or sodium chloride. This increase is even so important using the polymer that the mode of the distribution after step B3 (Fig. 1f) has the same value than the mean value of the Kolmogorov microscale (55 μm in that case). That points out the ability to produce larger aggregates by bridging flocculation. The successive steps of breakage and re flocculation permitted to produce in those hydrodynamic conditions aggregates that are more resistant although having larger sizes.

In order to better understand the evolution in size of the latex aggregates, a representation of the six volume size distributions obtained at steady state at the end of each step of the hydrodynamic sequence (for LSR and HSR values of respectively 34 and 350 s -1 ) are represented for each of the three coagulants on Fig. 2. The two vertical lines represent, from left to right, the values of the mean Kolmogorov microscale at HSR = 350 s -1 (< η > = 55 μm) and LSR = 34 s -1 (< η > = 170 μm).

The distributions obtained with NaCl emphasize a strong decrease of the aggregates sizes between step 1 (A1) and 3 (A2), although conducted at the same LSR value. The mode obtained at the end A1 coincides with the mean value of the Kolmogorov microscale. The three distributions obtained after the three steps conducted at HSR value (B1, B2 and B3) highlight a strong decrease of the aggregates sizes with an increase of the shear rate. Otherwise, those three distributions are nearly superimposed. Under such hydrodynamic and physico-chemical conditions, the volume size distributions at the beginning of a step do not seem to influence the distributions obtained at the end of the steps conducted at HSR value (HSR = 350 s -1 ). Similar ascertainments can be made concerning the results obtained under similar conditions with aluminum sulfate. As for the distributions obtained with the use of a polymer (polyDADMAC), they are characterized by the presence of two modes: one for distributions obtained at the end of steps conducted at LSR values and the other one obtained at the end of steps conducted at HSR values. The distribution at the end of a low shear rate step thus also appears to be independent of the initial distribution.

Other runs were performed changing the LSR values (LSR = 65 s -1 or LSR = 112 s -1 ) while the HSR was always kept constant at 350 s -1 . Whatever the coagulant, higher is the shear rate, lower are the aggregate sizes. When sodium chloride or aluminium sulfate are used, the mode of conducted with LSR and HSR values respectively of 34 s -1 and 350 s -1 . On these graphs, vertical lines represent the mean values of the Kolmogorov microscale ( < η > ) calculated on the base of the mean shear rate applied (< η > = 55 μm for HSR = 350 s -1 and < η > = 170 μm for LSR = 34 s -1 ).

Whatever the hydrodynamic step, Fig. 1 shows that the volume size distributions are monomodal with a trail on the left, emphasizing the presence of some small flocs. While the first step conducted at a LSR value of 34 s -1 gives, in the case of the use of sodium chloride or aluminum sulfate, volume size distributions whom the mode is close to the value of the mean Kolmogorov micro scale, the use of the polymer permits the growth of much bigger aggregates (cf. Fig. 1a). The following step (cf. Fig. 1b), performed under HSR value induces the breakage of aggregates, whatever the type of coagulant. The modes of the volume size distributions are then all inferior to the mean Kolmogorov microscale value but the aggregates formed using the polymer appear to be bigger than those formed by charge neutralization. Whatever the mechanism, the increase of the shear rate leads to the appearance of small aggregates (whom the size ranges between 2-10 μm). Even though the proportion of those small aggregates in the volume base distributions is low, their proportion would not be negligible looking at a number base distribution.

During the third step of the sequenced hydrodynamic experiments, at a LSR value of 34 s -1 (A2 -Fig. 1c), the volume size distributions obtained at stationary state reveal two different behaviors. W hen the aggregation mechanism is the charge neutralization, the flocs are smaller than those observed at the end of step A1 (Fig. 1a) with a mode lower than the value of the mean Kolmogorov microscale. Moreover, a substantial number of aggregates with a size of a few micrometers is remaining. Those small aggregates probably find t heir o rigin i n the production of very small flocs d uring t he p revious s tep B 1 ( Fig. 1b). These small entities did not manage to aggregate during the following step. On the opposite, when the main mechanism is the bridging flocculation in presence of polymer, the mode of the distribution is higher than the mean Kolmogorov microscale value. Otherwise, the volume size distributions obtained after step 1 (A1 -Fig. 1a) and step 3 (A2 -Fig. 1c) seem similar, as if the aggregates were able to reconstruct identically. Furthermore, at the end of step 3 (A2 -Fig. 1c), almost all the smallest aggregates (whom the size ranges from 2 to 10 μm) formed during the previous breaking step have disappeared.

During the following breakage steps (B2 -Fig. 1d and B3 -Fig. 1f), the volume size distributions obtained with sodium chloride are very close to those obtained at the end of step 2 (B1 -Fig. 1b). It seems that the flocs population did not change during those breakage steps, which suggests that a floculi population was created during step 2 (B1) and that those floculi a re r egenerated d uring e ach b reakage s tep. The 2.08. When the LSR values are 65 and 112 s -1 , it ranges between 2.25 and 2.3. Those orders of magnitude are coherent with those found in the literature [START_REF] Oles | Shear-induced aggregation and breakup of polystyrene latex particles[END_REF][START_REF] Spicer | Effect of shear schedule on particle size, density, and structure during flocculation in stirred tanks[END_REF][START_REF] Selomulya | Evidence of shear rate dependence on restructuring and breakup of latex aggregates[END_REF][START_REF] Vlieghe | QMOM-based population balance model involving a fractal dimension for the flocculation of latex particles[END_REF]. Thereafter, whatever the experiment under consideration, the change in the shear rate value is easily identifiable on the fractal dimension graph. Indeed, the fractal dimension value is higher during HSR steps than LSR steps. As it has been pointed out by several authors [START_REF] Oles | Shear-induced aggregation and breakup of polystyrene latex particles[END_REF][START_REF] Spicer | Effect of shear schedule on particle size, density, and structure during flocculation in stirred tanks[END_REF][START_REF] Selomulya | Evidence of shear rate dependence on restructuring and breakup of latex aggregates[END_REF], a correlation between the fractal dimension values and the hydrodynamic conditions in the reactor can be drawn. Aggregates submitted to strong hydrodynamic constraints are significantly denser and more compact and thus have higher fractal dimension values, closer to the sphere one. Thus, on Fig. 3, an increase in the fractal dimension value is visible during the first moments of the breaking step during which the flocs size decreases. Indeed, during the first minutes at HSR value, the aggregates formed during the breakage steps are more compact, denser and the fractal dimension grows slightly. However, the fractal dimension value thereafter continuously decreases during the breakage steps (steps B1, B2 and B3) which suggests that the aggregates are becoming less and less compact or that their surfaces become rougher. Moreover, the fractal dimension value at the end of a HSR step appears to be little dependent on the initial structure of the aggregates. Indeed, whatever the fractal dimension at the end of steps A1, A2 and A3, the fractal dimension value obtained at the end of the HSR steps remains the same. From one step to the other, it is possible to notice that the fractal dimension during the breakage steps slightly decreases. Fractal dimension values decrease from 2.25 to 2.2 between step 2 (B1) and step 6 (B3). In order to interpret those results, it is necessary to take a joint interest in the evolution across time of the aggregates sizes. It can be noticed on Fig. 3 that when the shear rate is turned on HSR value (at the beginning of steps B1, B2 or B3), the mean size suddenly drops. During these steps, the observation of the graphs does not permit to show a clear evolution in the X(4,3) values but a deeper examination reveals a slight increase in the X(4,3) value during all the breakage steps (steps B1, B2 and B3). For example, in the case of an experiment conducted under a LSR value of 112 s -1 , the X(4,3) increases from 37 to 40 μm during step B1. Thus, even if during such a step, breakage phenomenon are predominant, some aggregation events can also occur. Given the very low increase in size, it can be thought that those aggregation phenomenon probably occur between a floculi generated at the beginning of the breakage step and very small aggregates (with a diameter of only a few micrometers) which will thus have a minor impact on the volume size distribution and the mean aggregates size.

Concerning the aggregation steps A2 and A3, the fractal dimension value is even lower when the low shear rate value is low. This result is again in coherence with the literature results indicating that the more the hydrodynamic constraints are high, the more the aggregates are compact and thus have a high fractal dimension. A decrease in the D f values is also visible from one LSR step to the other (A1, A2 and A3). If such a decrease in the fractal dimension value is logically accompanied by a significant increase of the X [START_REF] Serra | Effect of the shear and volume fraction on the aggregation and breakup of particles[END_REF][START_REF] Spicer | Coagulation and fragmentation: the variation of shear rate and the time lag for attainment of steady state[END_REF] as between steps A2 and A3 conducted at a LSR value of 34 s -1 , this observation cannot always be made between steps A1 and A2 of the same experiment. The correlation between the aggregates mean size and structure is more complex than it seems. It is necessary to remain cautious concerning the evolution of the fractal dimension value during a step or between different steps conducted at a same shear rate value since the changes are very small and it is thus difficult to evaluate the accuracy of the fractal dimension values obtained by laser diffraction.

Furthermore, the above data corresponding to values obtained in steady-state conditions at the end of the aggregation (A3) and breakage events (B3) in presence of aluminium sulfate follow a power law between the particle size X(4,3) and the shear rate G. The power law coefficient is equal to 0.51 in good agreement with the data reported in the literature [START_REF] Biggs | Activated sludge flocculation: on-line determination of floc size and the effect of shear[END_REF][START_REF] Oles | Shear-induced aggregation and breakup of polystyrene latex particles[END_REF][START_REF] Serra | Aggregation and breakup of particles in a shear flow[END_REF][START_REF] Bouyer | Experimental analysis of hydrodynamics in a jar-test[END_REF][START_REF] Coufort | Flocculation related to local hydrodynamics in a Taylor-Couette reactor and in a jar[END_REF][START_REF] Ehrl | Dependence of aggregate strength, structure, and light scattering properties on primary particle size under turbulent conditions in stirred tank[END_REF][START_REF] Vlieghe | In situ characterization of floc morphology by image analysis in a turbulent Taylor-Couette reactor[END_REF], also putting in evidence the good relationship between the mean size and the Kolmogorov microscale.

The same analysis was made with the other coagulants and the fractal dimensions obtained at the end of each step in the case where LSR = 34 s -1 and HSR = 350 s -1 for the three coagulants are compared on Fig. 4. Fig. 4 clearly puts in evidence the shift of the fractal dimensions from low values when a LSR value is applied to higher values corresponding to HSR steps. This first result may be directly correlated with the floc size. Larger are the flocs, less compact or spherical they are. Moreover, whatever the step, lowest fractal dimensions are obtained for the runs performed in presence of polymer, for which the largest aggregates were also observed as seen before. These coarse aggregates are thus less dense and compact than those formed by charge neutralization. This observation may be related to the bridging flocculation mechanism leading to the formation of poorly dense flocs as reported by Gregory [START_REF] Gregory | The density of particle aggregates[END_REF]. The comparison of the fractal dimensions for the flocs produced by the two coagulants mainly acting by charge neutralization reveals higher values during HSR steps when sodium chloride is used, while smaller aggregates were observed (see the right column on Fig. 1). This behaviour may again simply reflects a size effect. Finally, if we compare the fractal dimensions for these two coagulants during LSR steps, a higher value is obtained for aluminium sulfate for the first aggregation step (A1) coinciding as expected with slightly smaller aggregates (Fig. 1a). However rather similar values of the fractal dimensions for both coagulants are get for the next two aggregation steps (A2) and (A3) whereas significantly different size distributions were observed (Fig. 1c ande). In that case, the fractal dimension of those rather disperse or even multimodal populations of flocs probably introduce compensating effect. Again, the sensitivity of the fractal dimension and its complex link with the size characteristics of flocs may be put forward.

Morphological analysis of flocs based on area and perimeter

Let's consider now the morphological results obtained from image analysis. It is possible for each floc to determine its area and perimeter and then to get the area and perimeter distributions analysing the whole population of flocs. As an example, Fig. 5a andb report respectively the surface base area and perimeter distributions at steadystate at the end of each step of the hydrodynamic sequencing scheme in the case of aluminium sulfate. On these graphs, the area (or perimeter) are indicated on the x-axis in a logarithmic scale and on the y-axis is reported the surface fraction, which is the sum of the surfaces of all flocs whose the area (or perimeter) belongs to a specific class divided by the total area of flocs. The area and perimeter distributions are similarities since both of them are related to the floc size. However, for a given area, strong disparities on perimeter may be observed and vice versa. So, 3D area-perimeter distributions allowing to analyse the change over the hydrodynamic conditions of the population of flocs appeared as an reliable tool to observe the impact of physico-chemical or hydrodynamical conditions on floc size and shape properties. The area and perimeter distributions obtained by image analysis could be integrated into a bidimensionnel population balance modelling in order to track both size and shape properties of aggregates over a flocculation process.

Fig. 1 .

 1 Fig. 1. Comparison of the volume size distribution of flocs obtained at the end of each hydrodynamic sequencing step for the three coagulants (LSR = 34 s -1 and HSR = 350 s -1 ). : Polymer : NaCl : Al 2 SO 4 : = LSR s 34 1

Fig. 2 .

 2 Fig. 2. Volume size distributions of latex aggregates at the end of each sequencing step (LSR = 34 s -1 and HSR = 350 s -1 ) for the three coagulants. : A1 : A2 : A3 : = LSR s 34 1

Fig. 4 .

 4 Fig. 4. Comparison of the steady fractal dimensions at the end of each step of the hydrodynamic sequencing scheme for LSR = 34 s -1 and HSR = 350 s -1 for the three coagulants. ▴: NaCl △: Al 2 SO 4 •: Polymer

Fig. 6 .

 6 Fig. 6. Isovalues of the surface base distribution on a 2D graph drawing the square root of the area versus the perimeter -Data related to the run performed at LSR = 34 s -1 and HSR = 350 s -1 for the three coagulants for an aggregation step (A3) and a breakage step (B3). : Based on morphological fractal dimension (1/D pf ) : Based on laser diffraction fractal dimension (D f /3)

Appendix A. Supplementary data

Supplementary material related to this article can be found, in the online version, at doi:https://doi.org/10.1016/j.colsurfa.2018.10.017.


Loïc Bernard

Guilhem Michon

Rached El Fatmi

Bruno Castanié
email: bruno.castanie@insa-toulouse.fr

STATIC AND DYNAMIC ANALYSIS OF BENDING-TORSION COUPLING OF A CFRP SANDWICH BEAM

The bending-torsion coupling for a sandwich beam is analysed from the static and vibrational point of view. Off-axis orientations in the skin and transverse graded core are proposed to perform the coupling. Solutions are first compared numerically from a static point of view using a complete beam theory. The natural frequencies and mode shapes are then studied experimentally and numerically. An experimental assembly test rig is presented, where a sandwich beam is embedded on the shaker and measurements are taken with a scanning vibrometer. These results are then compared to those calculated by a finite element model in order to verify the accuracy of the model and its ability to consider all the physical phenomena involved.

Introduction

Laminated composite beams have been used in numerous engineering applications in many fields such as aeronautics, wind energy, and automotive engineering. These structures, composed of composite materials, have lower weight, better fatigue life and higher strength and stiffness than those composed of metallic materials. Moreover, composite structures can be tailored to different needs by using different stacking sequences, local reinforcements, and many coupling deformations, which take advantage of the anisotropy of the materials. These abilities have permitted composite materials to replace metallic materials on a large scale. The rise of composite components in Airbus Aircraft, from the A319 to the A350, is a good illustration of such evolution.

The aim of this paper is to focus on how bending-torsion coupling can be created and what its impact will be on dynamic behaviour in the case of a sandwich beam. In the literature, bending-torsion coupling of beams is mainly considered in the aeronautical and wind energy fields. In the field of helicopters, this coupling has been largely investigated for rotor stability, vibration reduction and flutter issues. Panda and Chopra [START_REF] Panda | Dynamics of Composite Rotor Blades in Forward Flight[END_REF] highlighted the great potential of bending-torsion coupling for rotor stability and vibration level. Chandra and Chopra [START_REF] Chandra | Structural Response of Composite Beams and Blades with Elastic Couplings[END_REF] proposed an analytical model based on Vlasov theory to take static deformation due to elastic couplings into account. Then Chopra and Smith [START_REF] Chopra | Aeroelastic Response, Loads, and Stability of a composite Rotor in Forward Flight[END_REF] investigated the impact of elastic couplings on blade aeroelastic response and dynamic loads in the case of a soft-in-plane hingeless rotor. In their works, they applied elastic couplings on the upper and lower walls of the torsional box, which is part of the internal blade structure. To optimize bending-torsion coupling of the structural boxes, an optimization function based on vibration level and rotor stability parameters has been developed to obtain the best box walls stacking sequence combination, composed of un-balanced plies set at 15°. Ganguli and Chopra [START_REF] Ganguli | Aeroelastic Optimization of a Helicopter Rotor with Two-Cell Composite Blades[END_REF][START_REF] Ganguli | Aeroelastic Optimization of a Helicopter Rotor to Reduce Vibration and Dynamic Stresses[END_REF] developed and tested a new internal structure for the blade, which was composed of two horizontal torsional boxes. They managed to reduce the vibration levels and dynamic loads at the rotor hub even further. They then added design variables to the optimization function [START_REF] Ganguli | Aeroelastic Tailoring of Composite Couplings and Blade Geometry of a Helicopter Rotor Using Optimization Methods[END_REF], including ply angles of the laminated walls of the box beam, sweep, anhedral and planform taper, and non-structural mass. Murugan and Ganguli [START_REF] Murugan | Aeroelastic Stability Enhancement and Vibration Suppression in a Composite Helicopter Rotor[END_REF] updated the optimization procedure to decrease the vibration level of a four-bladed soft-in-plane rotor, by 15%, by using bending-torsion effects. Guo et al. [START_REF] Guo | The Effect of Laminate Lay-Up on the Flutter Speed of Composite Wings[END_REF] studied the effect of bending-torsion coupling on the flutter speed. They managed to show a significant improvement of the wing flutter speed in presence of coupling in the central wing torsion box. They used an asymmetric lay-up for all torsional box walls, composed of plies at 30° and -30° for the front and rear spars.

In the renewable energy field, wind turbine blades also need to be tailored to different situations. The main issues are to maintain constant energy production under wind gusts or a wind speed gradient between the ground and the top of the turbine. Bending-torsion coupling is used to passively twist the blade so that it adapts to wind variations. The first work on tailoring wind turbine blades was performed by Koraolis et al. [START_REF] Koraolis | Active and Passive Aeroelastic Power Control using Asymmetric Fibre Reinforced Laminates for Wind Turbine Blades[END_REF], who tested various orientations of blade skin layers to tailor the rotor in order to overcome wind turbine overloading. Kooijman [START_REF] Kooijman | Bending-Torsion Coupling of a Wind Turbine Rotor Blade[END_REF] based his work on [START_REF] Koraolis | Active and Passive Aeroelastic Power Control using Asymmetric Fibre Reinforced Laminates for Wind Turbine Blades[END_REF] to study the effect of bending-torsion coupling on wind turbine efficiency. He succeeded in increasing the wind turbine efficiency by 10% without any change to the blade's angle of attack or the rotor speed. De Goeij et al [START_REF] Goeij | Implementation of Bending-Torsion Coupling in the Design of a Wind-Turbine Rotor-Blade[END_REF] showed the interest of bending-torsion coupling for the blade fatigue life. They compared three different torsional box architectures and showed that a vertically coupled torsional box was more efficient to introduce coupling. Griffin [START_REF] Griffin | Evaluation of Design Concepts for Adaptive Wind Turbine Blades[END_REF] proposed a new architecture for blade structure by introducing a mix of off-axis orientated skin plies composed of glass fabric and carbon fabric, and a coupled torsional box. The skin was composed of carbon fabrics orientated at 20°and glass fabrics at -70°. Nicholls-Lee et al. [START_REF] Nicholls-Lee | Application of Bend-Twist Coupled Blades for Horizontal Axis Tidal Turbines[END_REF] studied the application of bending-torsion coupling to tidal turbines. Their objectives were to increase the turbine fatigue life and the power captured. They used a torsional box tailored by setting the outer plies at 90°, the middle plies at 20° and the inner plies at 45°. An increase of 2.5% was achieved for the energy captured and a decrease of thrust loading of about 10% was obtained.

Most of this literature reports work done on bending-torsion coupling, in engineering fields, focused on the torsional box. In aeronautics, sandwich structures are widely used, in panels for example, and constitute an interesting alternative line of investigation.

All couplings can be identified in extra-diagonal terms of the beam stiffness matrix (Figure 1).

The couplings are largely influenced by the sectional geometry as well as in-and out-of-plane warping, Poisson's effect and transverse shear. For this reason, an accurate composite beam theory able to calculate the stiffness matrix and beam deformation for an arbitrary beam cross section is required for this investigation of sandwich elastic coupling.

Figure 1 here

In this paper only bending-torsion coupling will be treated. Two types of this kind of coupling can be extracted from the stiffness matrix. The first one, called structural coupling, is illustrated by the K 45 term and the second one, called inertial coupling, can be symbolized by the K 34 term. These two parameters have great significance for the design of rotor blades.

Structural bending-torsion coupling can be presented as in Figure 2. The centre of gravity (CG) and centre of torsion (CT) are at the same point. If bending momentum is applied to the structure, rotation of the section is induced.

Figure 2 here

Inertial coupling is illustrated in Figure 3. In this case, the centre of gravity (CG) and centre of torsion (CT) are not at the same position. If a shear force is applied to the structure, an induced torsion rotation of the section is created.

Figure 3 here

Finding way of calculating 2D cross-sectional properties which is able to take coupling effects, and in-plane and out-of-plane warping, into account is an important problem in composite structural design. An efficient composite beam theory must also be able to express the 3D deformation behaviour by including transverse shear effects, constrained warping, cross sectional distortion, Poisson's effects and the influences of all boundary conditions. A large number of composite beam theories have been developed in recent decades. Only three of them will be briefly presented here.

The first theory comes within the framework of high order composite beam theory and was developed in the late 1990's by Barrau et al. [START_REF] Sudre | Determination du Tenseur Complet des Contraintes dans des Poutres Composites. 10ième[END_REF][START_REF] Taufik | Composite Beam Analysis with Arbitrary Cross Section[END_REF]. This theory does not consider any homogenization of the composite material's properties and an out-of-plane warping function is introduced in the displacement field. The displacement is split into a rigid and a variable part. The rigid part allows the determination of six coefficients, which can be found through 2D finite element method analysis. Once these coefficients have been calculated, the global problem can be solved. This method gives good results but the warping effects are approximated and the Poisson's coefficient effects are not taken into account. This theory can only be applied to straight beams of arbitrary cross section, with no twist.

The second theory is "Variational asymptotic beam theory" developed by Hodges and his coworkers [START_REF] Cesnik | VABS: A New Concept for Composite Rotor Blade Cross-Sectional Modeling[END_REF]. It is based on a variational asymptotic method [START_REF] Berdichevsky | Variational-Asymptotic Method of shell Theory Construction[END_REF] which consists of splitting the 3D problem into a 2D linear and a 1D non-linear problem. In this theory, assumptions are also made on the displacement field, which is based on the generalized Timoshenko form.

The 2D cross section analysis is made via a finite element calculation. The 1D non-linear problem is an approximation of the 3D body strain energy. This gave birth to software named VABS, which is able to calculate twisted, curved beams with arbitrary cross sections. It has been updated many times to improve the accuracy [START_REF] Yu | Variational Asymptotic Beam Sectional Analysis -An Updated Version[END_REF].

The third theory is "Exact composite beam theory" developed by Ladevèze and Simmonds [START_REF] Ladevèze | New Concepts for Linear Beam Theory with Arbitrary Geometry and Loading[END_REF] and extended by El Fatmi [START_REF] El Fatmi | A Numerical Method for the Exact Elastic Beam Theory. Applications to Homogeneous and Composite Beams[END_REF][START_REF] El Fatmi | Higher order composite beam theory built on Saint-Venant's solution. Part-I: Theoretical developments[END_REF][START_REF] Ghazouani | Higher order composite beam theory built on Saint-Venant's solution. Part-II: Built-in effects influence on the behavior of end-loaded cantilever beams[END_REF]. This theory is based on the 3D Saint Venant's problem. Far from the boundary conditions, the local equilibrium equation is the exact solution of the 1D Saint-Venant's problem. The beam 3D strain and stress is obtained using the 1D displacement without any hypothesis. To solve the 1D problem, a pair of linear operators need to be calculated. El Fatmi found a way to obtain these linear operators using finite elements and computed the entire theory in his own software called Csection/Cbeam [START_REF] Fatmi | A new tool for composite beam computation[END_REF]. This software is able to take account of in-and out-of-plane warping, Poisson's effects and disruptions produced by boundary conditions. Moreover, this theory is suitable for any arbitrary cross section of straight beams. Thus, Csection seems to be the most appropriate software for studying interactions between structural and inertial bending-torsion couplings. It can be applied to various cross sectional geometries without making any displacement hypothesis for static stresses.

According to the literature, in the case of a box beam, off-axis plies are an efficient solution, which will also be tested in our case. A more original technique is the use of a horizontally graded core to enhance the coupling coefficients. The authors have not found any reference to this possibility except in the aim of smoothing the stress around inserts in sandwich structures [START_REF] El Fatmi | A Matlab Tool to Compute the Mechanical Characteristics of Any Composite Section[END_REF]. In fact, most authors have focused on a vertically graded core [START_REF] Bozhevolnaya | Structurally graded core inserts in sandwich panels[END_REF][START_REF] Venkataraman | Elasticity Solution for Stresses in a Sandwich Beam with Functionally Graded Core[END_REF][START_REF] Zhu | A Combined Fourier Series-Galerkin Method for the Analysis of Functionally Graded Beams[END_REF][START_REF] Rahmani | Free Vibration Analysis of Sandwich Structures with a Flexible Functionally Graded Syntactic Core[END_REF] and most often from a static point of view. In the next subsection, the bending-coupling of some sections will analysed from a static point of view to find the best design. The third part of the paper will explore the association of structural and inertial bending-torsion coupling in dynamic response for a range of selected sandwich beams. An original campaign of dynamic experiments without intrusive experimental measurements is proposed to validate the numerical results. Finally some conclusions will be drawn.

Static investigation

A numerical static investigation was first performed to assess the capability and the relative performance of the designs proposed. Three configurations with horizontally graded cores (box, elliptical and sandwich) are illustrated in The literature shows that most coupling angles for carbon plies are set between 15° and 30°.

In this work, the off axis angle was set at 20°. The association of low density foam with high density foam was chosen to characterize the vertically graded core.

In this static numerical campaign, all beams were in a clamp-free configuration. A single upward force was applied along the geometric centre axis on the upper surface, at the beam tip (Figure 5).

Figure 5 here

Stiffness matrixes were calculated using [START_REF] Fatmi | A new tool for composite beam computation[END_REF] to investigate the effects of both off-axis ply and vertically graded core on the cross section geometries. Inertia and structural bending-torsion coupling were expressed according to the torsional stiffness of the section in order to highlight coupling in proportion (Table 1).

Table 1 here

In Table 1, the box section structure can be seen to have the lowest measured beam twist rate because of its natural torsional stiffness. Moreover the inertia bending-torsion term is almost zero. In the elliptical configuration the torsional stiffness is slightly lower than in the box configuration. The comments that can be made for this cross section are similar to those for the box configuration. The sandwich section is less rigid in torsion because it is, in fact, an open section and is the only configuration that allows the graded core to express itself. The K 43 term is relatively small compared to the K 45 term but at least it is not close to zero. The K 45 term also has a higher value than the other two configurations.

The respective contributions of the off axis ply and the horizontally graded core to the beam twist rate are given in Table 2.

Table 2 here

This shows that closed box structures generate quite a low beam twist rate, whereas the sandwich structure generates a much higher one. The high torsional stiffness and the weak value of the K 34 term induced by box and elliptical configurations (Table 1) feed through to the influence on the beam twist rate. Thus, the horizontally graded core has no influence on the total beam twist rate. In the case of the sandwich structure, the total twist rate is twice that of the other configurations. Moreover, the influence of the graded core is significant in creating such coupling.

This study shows that the sandwich configuration seems to be the best for studying interactions between inertia and structural bending-torsion coupling. So, four configurations were selected (Figure 6). The first configuration, called the "reference" beam, was a simple sandwich beam with 0/90° angle for the outer ply and ±45° for the inner ply of both skins. In this configuration, the sandwich core was composed only of low density foam. All the other configurations were compared to this reference beam. In the second configuration, the outer ply of both skins was made of woven carbon fabric orientated at +20°/-70°. The third configuration was composed of two foams with different mechanical properties within the width of the sandwich core. Finally, the fourth configuration was a combination of both technical solutions. This skin/core arrangement was identified as the most coupled configuration with the highest induced twist rate in the static campaign.

Specimen manufacturing

The specimens were manufactured using the following procedure: o Foam blocks were first precisely machined.

o Two sacrificial foam blocks coated with release films were added, one on either side.

The objective was to have more precise control over the shape and the dimensions of the skins after curing and trimming.

o Upper and lower carbon plies were set on the top and bottom of the beam.

o An aluminium pad was added at the beam root to clamp the beam without destroying the structure.

o The aluminium pad and foam blocks were stuck together (Figure 7) using a Redux film.

Figure 7 here

Then the assembly was prepared for curing: o All sandwich beam elements were placed between two rigid metallic plates surrounded by a plastic film so that a vacuum could be applied.

o The role of the vacuum was to keep all the elements together during curing in order to use the extra resin of the pre-peg to stick the carbon plies and foam blocks together.

o The conditioned beam assembly was then placed in the oven and a specific curing cycle was applied.

Once the sandwich beam had been cured, the foam blocks were removed from both sides and the extra width of carbon plies was cut off to obtain the final result (Figure 8).

Experimental setting

In order to test the bending-torsion coupling in vibration, the sandwich beam had to be excited only in pure bending to obtain the induced torsion response. Therefore the sandwich beam was embedded on a horizontal plate directly connected to an electrodynamic shaker (Figure 9). In that way, the excitation along the z axis was directly applied to the clamp and no parasite excitation occurred. The input signal was considered as a pure bending excitation.

Compared to a modal test, this setup did not introduce the local mass and stiffness due to fixation of the shaker on the studied zone that usually changes the dynamic response of the beam.

Figure 9 here

The system was controlled by an accelerometer set directly on the clamp. Another accelerometer was installed to measure the beam response and thus find the beam Frequency Response Function (FRF). An initial sine sweep from 0 Hz to 1000 Hz was performed to extract the natural frequency according to the response at a single output point. To obtain the mode shapes, a second test used pure sinusoidal excitation on each previously identified natural frequency. The modal deformation was obtained by means of a laser vibrometer that scanned 36 points of a predefined mesh. Here, only the first six mode shapes will be treated.

Numerical modelling

A finite element model was developed to be able to study the coupling with other beam configurations numerically. The 3D model, developped with Samcef Software [29], used solid elements to mesh the sandwich core and composite solid elements for both carbon skins.

The integration rule for the thickness was applied layer by layer to obtain a better transverse shear stress and normal stress gradient in the skins. A convergence study (by comparison with the results of Subsection 2) was performed and led to 8 elements in the thickness of the core and one element for each skin. 20 elements were used in the width, leading to a model with 200 000 degrees of freedom, see Figure 10. o The Repdyn module performs harmonic excitation to obtain the Frequency Response Function (FRF). The resolution method is based on the Lanczos method, in which resolution is extremely quick and does not imply high CPU cost. This method is well suited for mode shape calculations of models with high numbers of DOF. The computational time is about 10 min on 4 cores.

The assumption was made that none of the material was frequency-sensitive. This assumption was verified for the two foams with Dynamic Material Analysis (DMA) tests that are not reported here. This finite element methodology will be validated in the next section.

Results and discussions

Frequency Response Function

The FRFs were obtained following the experimental protocol described previously. The excitation was performed directly at the clamp in the y direction only, in order to simulate an excitation in bending. The FRF was measured at the top left corner of the clamped beam by the vibrometer. The same position was chosen on the numerical model.

Figure 11 here

In the set of FRF graphs (Figure 11), simulation and experimental curves were superposed and showed good agreement between experiment and the 3D model. In most cases, peak amplitudes were slightly overestimated in the model. Natural frequencies were correctly positioned and will be detailed numerically in the next section. Note that the presence of the graded foam core significantly changed the FRF curve profile (Types 3 and4). An extra peak appeared at around 250 Hz and around 800 Hz.

Natural frequencies were compared in terms of number and to quantify the gap between experimental and simulation results. Table 3 shows simulated eigenfrequencies for all the types of configurations related to experiment. As described above, the gap between experimental and simulated eigenfrequencies was very small. It is interesting to note that the first results obtained displayed a larger gap for Type 3 and 4 sandwich beams. After further investigations, it appeared that the high density foam had not been adequately characterized and induced larger differences, of about 15%. After re-testing by DMA, a new value of the stiffness coefficient for high density foam was found and the gap dropped to less than 3%. It can thus be concluded that the foam core plays a very important role in sandwich beam dynamics.

Table 3 here.

From Table 3 and the FRF curves of Figure 11, it can be seen that the ply oriented at 20° did not influence the positions of the frequency modes except for the first mode, as attested by the eigenfrequencies of type 1 and type 2 beams. Modes 3 and 6 are not represented on the FRF curves meaning that those modes are superposed by mode 2 and 5. In the presence of a graded core, the FRF profiles changed significantly. The FRF curve of type 3 beam shows 3 rd and 6 th mode peaks. The added mass and the higher stiffness introduced by the high density foam increased all eigenfrequencies modes and increased the gap between modes 2 and 3 and between 5 and 6.

Mode shape analysis

Experimental and numerical mode shapes were compiled on the same graph so that they could be compared visually as illustrated in Figure 12 and Figure 13. In this section, only the modal deformations of the Type 1 (uncoupled) (Figure 12) and Type 4 configurations (fully coupled) (Figure 13) are displayed. Strong similarities of the modal deformations of Type 2 and 3 configurations with those of the Type 4 configuration allow us to display only those given by the fully coupled arrangement.

Figure 12 here

Note that torsional deformations are not shown in Figure 12. The lack of coupling between bending and torsion and the pure excitation in bending led to very weak excitation of torsional modes.

Figure 13 here

Concerning the fully coupled configuration, good mode shape correlation between experiment and simulation was reached for the first 6 modes (Figure 13). Introduction of coupling solutions in a sandwich beam structure proved that bending-torsion coupling could be generated. The difficulty lay in the quantification of the amount of bending and torsion deformation within the eigenmode.

Usually the Modal Assurance Criterion (MAC) is used to correlate modal deformation between simulation and experiment. The use of this criterion is based on eigenvectors as in the following equation [START_REF] Allemang | The Modal Assurance Criterion (MAC): Twenty Years of Use and Abuse[END_REF][START_REF] Girard | Dynamique des Structures Industrielles[END_REF].

The MAC matrix gives a good overall view of the shape correlation and this is the basis of the derived MAC method, called the identification matrix, to quantify coupling deformation within an Eigen mode. The technique uses a non-coupled sandwich beam as the reference with which each coupled beam is compared. The matrix is also expressed in percentages for a better representation.

Input parameters to the identification matrix come from: In Table 4, the reference deformation shape is symbolized by one letter and one number. The letter T stands for Torsion deformation and B for Bending deformation. The number that follows determines the mode numbers. For example B2 means the second mode of bending.

, = , , , : ℎ : ℎ !
Using the visualization of coupled mode from the previous paragraph, the MAC matrix for each configuration is presented below. These matrices and their comparisons will contribute to an understanding of the influence of the orientated ply and the graded foam core on the amount of bending and torsion within the first 6 modes.

Tables 4,5, 6 here.

With this method, it is easy to determine the amount of bending and torsion in each mode. For example, the second mode of the Type 2 beam (Table 4) is composed of 55% of torsional deformation and 45% of bending deformation. In the case of a type 3 beam (Table 5) mode 2 is composed of 65% of torsional deformation and 35% of bending deformation. Another specificity of a type 2 beam is the creation of bending-torsion coupling for modes 5 and 6.

This coupling is not present for the beam without orientated ply as shown by the MAC matrix for type 3 beams. This coupling is also present in type 4 sandwich beams (Table 6) with the same proportions, which means that it is a pure effect of off-axis plies and is not affected by the vertically graded core. However, for this configuration, an uncoupling phenomenon occurs for modes 2 and 3. For example mode 2 is now mainly composed of bending deformation (85% of B2 and 15% of T1) and mode 3 of torsional deformation (85% of T1 and 15% of B2). Such behaviour is called mode veering. This phenomenon occurs when two eigenmodes are very close in frequency as described in Gallina's work [START_REF] Gallina | Enhanced Meta-Modelling Technique for Analysis of Mode Crossing, Mode Veering and Mode Coalescence in Structural Dynamics[END_REF].

According to the identification matrix, mode 2 of the type 4 beam looks very similar to mode 3 of the sandwich beam composed of either the orientated ply or gradient foam core.

To recover strong coupling for the beam with both technologies, another configuration was tested. The orientated ply was reoriented to -20°/70, which meant that the ply angle of rotation was anticlockwise and both foams kept the same position as shown in Figure 14.

Figures 14 and 15 here

The FRFs curves of Figure 15 illustrate the changes the new skin plies orientation (Type 5)

and the inversion of the graded foam core (Type 6). The new ply orientation involves almost no changes on the FRF profile whereas the inverse graded foam core (GFC) significantly modifies the amplitude of coupled modes 2, 3 and 6. In type 4 and 5 FRF curves, mode 3 has smaller amplitude than mode 2 whereas, in type 6, the amplitude of mode 3 is clearly higher.

The same phenomenon can be observed for the coupling between modes 5 and 6.

The identification matrix thus becomes (Table 7).

Table 7 here.

The changes made in type 5 and type 6 configurations significantly modified the bendingtorsion coupling for modes 2 and 3. The distribution was then 40% torsion deformation and 60% bending deformation for mode 2. However, mode veering was still present. The second degree of bending-torsion coupling between modes 5 and 6 kept the same proportion as in the type 2 beam configuration and remained unchanged whatever the configuration.

Conclusion

The aim of the paper was to present a way to generate bending-torsion coupling for a sandwich beam structure. This coupling was introduced into the sandwich structure by means of an outer, orientated carbon fabric ply in both skins and a horizontally graded foam core having 2 different foam characteristics. An experimental protocol for measuring beam deformations, FRF and mode shapes accurately were also presented. This original setup, in which the beam was excited directly at its clamp, allowed the induced torsion of the coupled structure to be expressed. Good correlation was obtained between the 3D numerical model and experimental results. Different configurations were tested to better understand the influence of each nature of bending-torsion coupling and their associations. This experimental process highlighted a mode veering phenomenon when both technologies were introduced in the structure. The identification matrix method allowed to quantify bending-torsion coupling for each configuration and highlighted the fact that fully coupled static configurations may not be suitable for optimum dynamic coupling. Another configuration was found to restore strong modal coupling within the sandwich structure with both technologies.

Figure 4 .

 4 The stacking was composed of a balanced 45° fabric ply (TC 45°) made of carbon with an epoxy resin and an off-axis ply (TC θ°) made of the same material. Two different densities of foams were used: 65 and 200 kg/m3

Figure 4 here

 4 Figure 4 hereThe beam dimensions used for this static campaign were the following:

Figure 6 here 3

 63 Figure 6 here

Figure 8

 8 Figure 8 here

Figure 10 hereo

 10 Figure 10 hereThe dynamic behaviour of the sandwich was computed using the Samcef Dynam and Repdyn

FIGURES

  FIGURES

Figure 1 :Figure 2 :Figure 3 :Figure 4 :Figure 5 :

 12345 Figure 1 : Representation of the stiffness matrix

Figure 6 :Figure 7 :Figure 8 :

 678 Figure 6 : Sandwich beam configurations studied

Figure 9 :Figure 10 :Figure 11 :Figure 12 :Figure 13 :Figure 14 :

 91011121314 Figure 9 : Dynamic Experimental setup

Figure 15 :

 15 Figure 15: FRF curves of Type 4 (black curves), Type 5(blue curve left) and Type 6 (blue curve right) beam configurations


Fabien Laguillaumie

Damien Vergnaud
email: damien.vergnaud@di.ens.fr

On the Soundness of Restricted Universal Designated Verifier Signatures and Dedicated Signatures How to prove the possession of an Elgamal/DSA signature

Keywords: Universal designated verifier signatures, zero-knowledge proof, Elgamal signatures

In 2006, Huang, Susilo, Mu and Zhang proposed the concept of restricted universal designated verifier signatures while Klonowski, Kubiak, Kutylowski and Lauks proposed independently the dual primitive of dedicated signatures. In both notions, a signature holder can convince one or more verifiers of his knowledge of a digital signature, but cannot exploit this knowledge without being punished for that. In this paper, we state that a signature holder may generically provide a proof that it has a certain signature without being punished and that consequently both primitives cannot fulfill their alleged security goals. To demonstrate the feasibility of this claim, we propose the first non-interactive universal designated verifier proof of the possession of an Elgamal or a DSA signature in the random oracle model. This construction may be of independent interest.

Introduction

In order to control the dissemination of digital signatures, many schemes have been proposed to protect the privacy of the signer or the holder of a signature. We can cite for instance undeniable signatures [START_REF] Chaum | Undeniable Signatures[END_REF], confirmer signatures [START_REF] Chaum | Designated Confirmer Signatures[END_REF] and designated verifier signatures [START_REF] Jakobsson | Designated Verifier Proofs and Their Applications[END_REF]. In particular, some constructions aim at modifying a traditional signature into a signature with special properties (for instance a signature with controlled verification, like universal designated verifier signatures [START_REF] Steinfeld | Universal Designated-Verifier Signatures[END_REF]).

In 2006, Huang, Susilo, Mu and Zhang proposed the concept of restricted universal designated verifier signatures while Klonowski, Kubiak, Kutylowski and Lauks proposed independently, the dual primitive of dedicated signatures. In both notions, a signature holder can convince one or more verifiers of his knowledge of a digital signature, but cannot exploit this knowledge without being punished for that. The main purpose of the present paper is to state that that both primitives do not achieve their purported security goals.

Background. In the electronic world, digital signatures are used to verify whether one message really comes from the alleged signer. Like handwritten signatures, standard digital signatures are non-repudiable and universally verifiable. However, universal verifiability might not suit the circumstances under which verifying signature is a valuable action.

In 1989, Chaum and van Antwerpen [START_REF] Chaum | Undeniable Signatures[END_REF] introduced the concept of undeniable signature scheme in which anyone has to interact with the signer to verify the validity/invalidity of a signature. The important property of non-repudiation still holds because the signer cannot disavow a signature through a denial protocol unless the signature is indeed invalid.

Jakobsson, Sako and Impagliazzo [START_REF] Jakobsson | Designated Verifier Proofs and Their Applications[END_REF] proposed designated verifier signatures in 1996. A designated verifier signature scheme provides authentication of a message without providing the non-repudiation property of traditional signatures and can be used to convince only one third party (i. e. the designated verifier and only him can be convinced about its validity or invalidity). This is due to the fact that the designated verifier can always create a signature intended for himself that is indistinguishable from an original signature.

Steinfeld, Bull, Wang and Pieprzyk [START_REF] Steinfeld | Universal Designated-Verifier Signatures[END_REF] proposed the extended concept of universal designated-verifier signatures in 2003. These signatures are ordinary digital signatures with the additional functionality that any holder of a signature is able to convert it into a designated verifier signature specified to a designated verifier of his choice. Steinfeld et al. also showed how to construct efficient deterministic universal designated-verifier signature schemes from bilinear group-pairs and many constructions have been proposed compatible with popular digital signature schemes (e. g. [START_REF] Laguillaumie | Universal Designated Verifier Signatures Without Random Oracles or Non-Black Box Assumptions[END_REF][START_REF] Laguillaumie | Designated Verifier Signatures: Anonymity and Efficient Construction from any Bilinear Map[END_REF][START_REF] Steinfeld | Efficient Extension of Standard Schnorr/RSA signatures into Universal Designated-Verifier Signatures[END_REF][START_REF] Vergnaud | New Extensions of Pairing-based Short Signatures into Universal Designated Verifier Signatures[END_REF]).

In 2006, Huang, Susilo, Mu and Zhang [START_REF] Huang | Restricted Universal Designated Verifier Signature[END_REF] proposed the concept of restricted universal designated verifier signature. In this construct, a signature holder can convince up to t verifiers that he actually knows a signature, and the convincing statement is designated to these verifiers. However, when the signature holder uses the signature t+1 times, then the signature becomes publicly available. This primitive can potentially be used in a service such as an Internet trial-browsing service in which a user is allowed to access the service up to t times without any charge, but will be charged on the t + 1 count of access.

In [START_REF] Klonowski | How to Protect a Signature from Being Shown to a Third Party[END_REF], Klonowski, Kubiak, Kutylowski and Lauks introduced a new kind of signatures, in a sense dual of the previous ones, that they called dedicated signatures. In their scheme, the signer can construct a signature in such a way that the recipient cannot show this signature to third parties without being punished for that. Namely, in this protocol, the signer gives the recipient a dedicated signature; the verifier derives a standard signature from it and if the verifier presents this signature to third parties, the signature together with the dedicated signature reveal the private key of the verifier. In the present paper, we prove that these two primitives are not sound since generically they cannot fulfill their alleged security goals.

Contributions of the paper. In this paper, we prove that a signature holder may generically provide a proof that it has a certain signature without being punished and that consequently both primitives are not sound. The result comes from the well-know fact that if non uniform one-way function exist then there exists a computational zero-knowledge proof system of membership for all languages having an interactive proof system of membership [START_REF] Goldreich | Proofs that Yield Nothing But Their Validity or All Languages in NP Have Zero-Knowledge Proof Systems[END_REF].

As a practical example to defeat the first realization of the concept of restricted universal designated verifier signatures, we remind an efficient proof of possession of a Boneh-Lynn-Shacham signature [START_REF] Boneh | Short signatures from the Weil pairing[END_REF] (BLS signature for short) due to Hufschmitt, Lefranc and Sibert [START_REF] Hufschmitt | A Zero-Knowledge Identification Scheme in Gap Diffie-Hellman Groups[END_REF].

Finally, to demonstrate the feasibility of this attack on the primary dedicated signature scheme proposed by Klonowski et al., we also propose the first efficient non-interactive designated verifier proof of the possession of an Elgamal signature [START_REF] Brassard | A Public-Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms[END_REF] in the so called random oracle model. This result is of independant interest, as it does not exist, as far as we know, any concrete proof of knowledge of an Elgamal or a DSA signature, but a specialization of the inefficient proofs given in [START_REF] Nguyen | Zero-Knowledge Proofs of Possession of Digital Signatures and its Applications, Information and Communication Security[END_REF] by Nguyen, Bao, Mu and Varadharajan.

Definitions

In this section, we give the definition of (restricted) universal designated verifier signature scheme and dedicated signature scheme.

Notations

The set of n-bit strings is denoted by {0, 1} n and the set of all finite binary strings (or messages) is denoted by {0, 1} * . Concatenation of two strings x and y is denoted by x y. Let A be a probabilistic Turing machine running in polynomial time (a PPTM, for short), and let x be an input for A. The probability space that assigns to a string σ the probability that A, on input x, outputs σ is denoted by A(x). The support of A(x) is denoted by A[x]. Given a probability space S, a PPTM that samples a random element according to S is denoted by x R ← -S. For a finite set X, x R ← -X denotes a PPTM that samples a random element uniformly at random from X.

Universal designated verifier signatures

In this subsection, we recall the definition of universal designated verifier signature (UDVS) schemes [START_REF] Steinfeld | Universal Designated-Verifier Signatures[END_REF], together with the security model, that we will need to present the new Elgamal scheme in Section 3. Definition 1. A universal designated verifier signature scheme Σ is an 8-tuple Σ = (Setup, SKeyGen, VKeyGen, Sign, Verify, Designate, Fake, DVerify) such that -(Setup, SKeyGen, Sign, Verify) is a signature scheme:

• Σ.Setup is a probabilistic polynomial-time Turing machine (PPTM) which takes an integer k as input. The output are the public parameters Υ . k is called the security parameter. • Σ.SKeyGen is a PPTM which takes the public parameters as input. The output is a pair (sks, pks) where sks is called a signing secret key and pks a signing public key. • Σ.Sign is a PPTM which takes the public parameters, a message, and a signing secret key as inputs and outputs a bit string. • Σ.Verify is a PPTM which takes the public parameters, a message m, a bit string σ and a signing public key pks. It outputs a bit. If the bit output is 1 then the bit string σ is said to be a signature on m for pks. -Σ.VKeyGen is a PPTM which takes the public parameters as input. The output is a pair (skv, pkv) where skv is called a verifying secret key and pkv a verifying public key. -Σ.Designate is a polynomial-time Turing machine (PTM) which takes the public parameters, a message m, a signing public key pks, a signature σ on m for pks and a verifying public key as inputs and outputs a bit string. -Σ.Fake is a PPTM which takes the public parameters, a message, a signing public key and a verifying secret key as inputs and outputs a bit string. -Σ.DVerify is a deterministic PPTM which takes the public parameters, a message m, a bit string τ , a signing public key pks, a verifying public key pkv the matching verifying secret key skv as inputs. It outputs a bit. If the bit output is 1 then the bit string τ is said to be a designated verifier signature on m from pks to pkv.

Σ must satisfy the following properties, for all

k ∈ N, all Υ ∈ Σ.Setup[k], all (pks, sks) ∈ Σ.SKeyGen[Υ ], all (pkv, skv) ∈ Σ.

VKeyGen[Υ ] and all messages m:

-Correctness of Signature:

∀σ ∈ Σ.Sign[Υ, m, sks], Σ.Verify[Υ, m, σ, pks] = {1}.
-Correctness of Designation:

∀σ ∈ Σ.Sign[Υ, m, sks], ∀τ ∈ Σ.Designate[Υ, m, pks, σ, pkv], Σ.DVerify[Υ, m, τ, pks, pkv, skv] = {1}.
-Source Hiding:

Σ.Designate(Υ, m, pks, Σ.Sign(Υ, m, sks), pkv]) = Σ.Fake(Υ, m, pks, skv).

The correctness properties insure that a properly formed (designated verifier) signature is always accepted by the (designated) verifying algorithm. The source hiding property states that given a message m, a signing public key pks, a verifying public key pkv and a designated verifier signature τ on m from pks to pkv it is infeasible to determine if τ was produced by Σ.Designate or Σ.Fake.

The unforgeability notion is an extention of the classical notion of exitential unforgeability under a chosen-message attack as defined in [START_REF] Goldwasser | A Digital Signature Scheme Secure Against Adaptive Chosen-Message Attacks[END_REF].

Definition 2. A universal designated verifier signature scheme is said strongly existentially unforgeable if no adversary (PPTM) F has a non-negligible advantage in the following game:

1. The challenger C takes as input a security parameter k and executes

Υ ← UDVS.Σ.Setup(k), (sk ⋆ S , pk ⋆ S ) ← UDVS.Σ.KeyGen(k, Υ ), (sk ⋆ V , pk ⋆ V ) ← UDVS.VKeyGen(k, Υ ).

It gives pk ⋆

S and pk ⋆ V to the forger F and keeps sk ⋆ S and sk ⋆ V to itself. 2. The forger F can issue the following queries: i) a signing query for some message m; the challenger C executes

σ ← UDVS.Σ.Sign(k, Υ, m, sk ⋆ S )
and hands σ to F; ii) a verification query for pairs (m, σ) of his choice; C returns to F the value UDVS.DVerify(k, Υ, m, σ, pk, (sk ⋆ V , pk ⋆ V )); 3. F outputs a V -designated verifier signature σ⋆ for a message m ⋆ .

The adversary F succeeds if UDVS.DVerify k, Υ, pk ⋆ S , (sk ⋆ V , pk ⋆ V ) = 1 and if σ⋆ has not been obtain from the signing oracle. An attacker F is said to (τ, q s , q v , ε)break the unforgeability of the UDVS scheme if he succeeds in the game within running time τ and with probability ε after having made q s signing queries and q v verification queries.

We will propose in Section 3 a new UDVS scheme compatible with standard Elgamal or DSA signatures, reaching these security notions. Another important security requirement concerning the undeniable signature familly is the notion of anonymity (roughly speaking, an anonymous designated verifier signature is indistinguishable from a random string.). Is has been precisely defined in [START_REF] Laguillaumie | Designated Verifier Signatures: Anonymity and Efficient Construction from any Bilinear Map[END_REF] in terms of privacy of signer's identity for designated verifier signatures, but we will not need this property for our purpose.

Restricted universal designated verifier signatures

According to [START_REF] Huang | Restricted Universal Designated Verifier Signature[END_REF], a restricted UDVS scheme is comprised of three procedures namely sign-up, designation and open. In the sign-up procedure, a user obtains a signature σ from the signer. This signature is publicly verifiable, but this is kept by the user (and hence, the signature holder) to be used in the designation procedure. . . . In the designation procedure, the signature holder can designate the signature to up to t verifiers. The verifiers will be convinced with the authenticity of the signature, but they cannot convince any other third party about this fact. When the signature holder uses the signature to convince the t + 1 verifier, the open procedure can be invoked to reveal the signature . . . . One of our purpose in this paper is to disprove the relevancy of this primitive. Therefore, it is necessary to describe formally this primitive. Definition 3. Let t be a positive integer. A t-restricted universal designated verifier signature scheme Σ is a 9-tuple Σ = (Setup, SKeyGen, VKeyGen, Sign, Verify, Designate, Fake, DVerify, Open) such that -(Setup, SKeyGen, VKeyGen, Sign, Verify, Designate, Fake, DVerify) is a universal designated signature scheme; -Σ.Open is a PPTM which takes the public parameters, a message, t + 1 bit strings, a signing public key and t + 1 verifying public keys and outputs a bit string.

Σ must satisfy the following property for all messages m:

-Opening:

∀k ∈ N, ∀Υ ∈ Σ.Setup[k], ∀(pks, sks) ∈ Σ.SKeyGen[Υ ], ∀σ ∈ Σ.Sign[Υ, m, sks], ∀(pkv, skv) = [(pkv 1 , skv 1 ), . . . , (pkv t+1 , skv t+1 )] ∈ Σ.VKeyGen[Υ ] t+1 ∀τ 1 ∈ Σ.Designate[Υ, m, pks, σ, pkv 1 ], . . . ∀τ t+1 ∈ Σ.Designate[Υ, m, pks, σ, pkv t+1 ] #{τ 1 , . . . , τ t+1 } = t + 1 ⇒ Σ.Open[Υ, m, τ 1 , . . . , τ t+1 , pkv, pks] = {σ}.
This property formalizes the (erroneous, as we will see) fact that when the signature is designated to convince t + 1 verifiers, the open procedure can be invoked to reveal the original signature.

In [START_REF] Huang | Restricted Universal Designated Verifier Signature[END_REF], Huang et al. presented a restricted UDVS scheme based on BLS signatures.

Dedicated signatures

The definition of dedicated signatures is not given explicitly and formally, but can be readily easily deduced from this informal description from [START_REF] Klonowski | How to Protect a Signature from Being Shown to a Third Party[END_REF]. We give here a formal definition (although the concept is pointless as we will see). The first property can be restated as follows: (Setup, SKeyGen, Sign, Verify) is a signature scheme, where Sign is the PPTM which takes the public parameters, a message m, a signing key pair (sks, pks) and a verifying key pair (skv, pkv) as inputs, obtains τ by executing Σ.DDSCreate(Υ, m, sks, pkv) and returns σ obtained by executing Σ.Retrieve(Υ, m, τ, pks, skv). The second property means that the verifier loses his own secrets when exhibiting the signature.

In [START_REF] Klonowski | How to Protect a Signature from Being Shown to a Third Party[END_REF], Klonowski et al. proposed a realization of this primitive based on Elgamal signatures. It is well known, that the original Elgamal signature scheme is existentially forgeable (see [START_REF] Roy | Security Arguments for Digital Signatures and Blind Signatures[END_REF] for instance). As in [START_REF] Klonowski | How to Protect a Signature from Being Shown to a Third Party[END_REF], we consider only, in this paper, the variant of Elgamal scheme where a collision-resistant hash function is applied to the message to be signed and only the digest is actually "signed". This "hashed Elgamal signatures" has not been proven existentially unforgeable but there exist arguments in favor of their security in the so-called generic group model [START_REF] Brown | Generic Groups, Collision Resistance, and ECDSA Des[END_REF].

It is worth noting that this scheme presented is very similar to the anonymous designated verifier signature scheme proposed in 2003 by Saeednia, Kremer and Markowitch [START_REF] Saeednia | An Efficient Strong Designated Verifier Signature Scheme[END_REF].

3 Universal designated verifier Elgamal and DSA signatures

Description of the scheme

We present in this section the first efficient universal designated verifier Elgamal and DSA signatures. We describe our new scheme with the Elgamal signature for simplicity. It works as follows:

-UDVS.Σ.Setup: public parameters include the output of a DL-parametergenerator as well as an integer n, a collision-resistant hash function h : {0, 1} * → Z * p : Υ := {n, p, Z * p , g, h}.

-UDVS.Σ.SKeyGen: a signer's private key is a randomly chosen a R ← Z * p ; his public key consists of a group element y A = g a mod p.

-UDVS.Σ.Sign: given a message m ∈ {0, 1} * , the signer picks k R ← Z * p and sets u = g k mod p and v = k -1 (h(m) -au) mod p -1. The signature is σ = (u, v).

-UDVS.Σ.Verify: a plain signature σ = (u, v) on m is accepted if y u A u v = g h(m) mod p.

-UDVS.VKeyGen : a designated verifier's private key is a random element b R ← Z * p ; the matching public key is y B = g b mod p. -UDVS.Designate: the holder of a signature σ = (u, v), who chooses B as designated verifier produces the designated verifier signature τ = (u, P) where P is the non-interactive zero-knowledge proof of knowledge of one discrete logarithm among two HVZKPK log u (g h(m) y -u A ) ∨ log g (y B ) , derived from the interactive the proof described in Fig. 1. More precisely, the holder of the signature σ computes e = h(c 1 ||c 2 ||m||u), with y 1 = u, y 2 = g, α 1 = g h(m) y -u A mod p and α 2 = y B . Then τ is the 5-tuple (u, e 1 , e 2 , s 1 , s 2 ).

Prover Verifier r1, e2, s2 ∈R Z * p c1 = y r 1 1 mod p c2 = α e 2 2 y s 2 2 mod p c1, c2 -----------→ e ∈R Z * p e ← ----------- e1 = e2 -e mod p -1 s1 = r1 -e1x1 mod p -1 (e1, s1), (e2, s2) -----------→ c1 ? = α e 1 1 y s 1 1 mod p c2 ? = α e 2 2 y s 2 1 mod p e ? = e1 + e2 mod p -1
The prover knows x1 = log y 1 (α1).

Fig. 1. HVZKPK `log y 1 (α1) ∨ log y 2 (α2) -UDVS.Fake: the designated verifier produces the designated verifier signature τ = (u, P) where u is a random element u R ← Z p and P is the noninteractive variant of the proof HVZKPK log u (g h(m) y -u A ) ∨ log g (y B ) (performed thanks to the knowledge of log g (y B )).

-UDVS.DVerify: given a purported signature τ = (u, P), the designated verifier checks the correctness of the non-interactive proof P = (e 1 , e 2 , s 1 , s 2 ) by computing c 1 = (g h(m) y -u A ) e1 u s1 and c 2 = y e2 B g s2 and checking that h(c 1 ||c 2 ||m||u) = e 1 + e 2 mod q.

DSA signatures. The difference between Elgamal signatures and DSA signatures lies essentially in the fact that computation are done modulo a prime q dividing p -1 instead of working modulo p -1. Therefore, the technique previously described can be trivially adapted in the case of the DSA signatures. The resulting scheme is also the first universal designated verifier signature scheme based on DSA.

Remark 1. A UDVS scheme reaches the source-hiding property if and only if the designated verifier can produce one bitstring that is indistinguishable from one that was generated by the signature holder. In the Elgamal-based scheme, that we have described this property is fulfilled. However, it remains an open problem to design an efficient UDVS scheme compatible with Elgamal/DSA signatures with the stronger property that the designated verifier can always produce identically distributed transcripts that are indistinguishable from the one generated by the signature holder:

∀k ∈ N, ∀Υ ∈ Σ.Setup[k], ∀(pks, sks) ∈ Σ.SKeyGen[Υ ], ∀(pkv, skv) ∈ Σ.VKeyGen[Υ ], ∀m ∈ {0, 1} τ R ← -Σ.
Sign(Υ, m, sks); Σ.Designate(Υ, m, pks, τ, pkv]) = Σ.Fake(Υ, m, pks, skv).

Security analysis

Theorem 1 (Unforgeability). Let F be a forger that (t, q s , q v , ε)-breaks the Elgamal UDVS scheme in the q h -random oracle model, with ε > 7q H /2 k . There exists a (t ′ , ⌈(14q

H + 2)q s /ε⌉, ε ′ )-EF-CMA algorithm A against hashed Elgamal signature such that ε ′ ≥ 1/9 after running F by 2 ε + 14q h ε times.
Proof. The proof relies on the well-known forking technique proposed in 1996 by Pointcheval and Stern [START_REF] Roy | Security Arguments for Digital Signatures and Blind Signatures[END_REF]: assuming that an attacker can forge a designated verifier signature, another algorithm could obtain, by replaying sufficiently many times this attacker with randomly chosen hash functions (i.e. random oracles), two forged designated verifier signatures of the same message and with the same randomness. Then, these two forged signatures could be used to solve some computational problem which is assumed to be intractable: producing an Elgamal forgery or computing a discrete logarithm.

The algorithm A takes as inputs the public parameters Υ , an Elgamal signing public-key pks = y and has access to a signing oracle S A that it can query up to ⌈(14q H +2)q S /ε⌉ times. It produces a verifying public key pkv in such a way that if it obtains in the simulation the discrete logarithm of pkv in base g, then it will also know the discrete logarithm of pks in base g and therefore can readily forge a signature (i. e. pkv = y r for a known r ∈ [[1, p -1]] picked uniformly at random). The adversary A executes the forger F many times (at most ⌈(14q h + 2)ε -1 ⌉) on the entries (Υ, pks, pkv) with different random tapes and/or random oracles. The algorithm A will run in two stages.

First stage: The forger F, with random tape ̟, can make q S queries to the signing oracle S F and q H queries to the random oracle H. We denote by (e 1 , . . . , e q H ) the list of the q H answers of the random oracle. Therefore, we can see a random choice of the random oracle as a random choice of such a vector e. In his first stage, A executes the forger F at most (2/ε) times with different random tapes and random oracles, until it outputs a valid forgery. For each execution, the queries made by F to the signing oracle S F are simply transfered to S A and the returned signatures are stored by A.

Eventually, in one execution F outputs a forged message/signature pair (m ⋆ , τ ⋆ ) where

τ ⋆ = (u ⋆ , e ⋆ 1 , e ⋆ 2 , s ⋆ 1 , s ⋆ 2 )
under the public keys (pks, pkv). The probability that F outputs a valid forgery at the end of one execution is ε. Since H is a random oracle, the probability that F succeeds and has not submitted

(c ⋆ 1 ||c ⋆ 2 ||m ⋆ ||u ⋆ ) (where c ⋆ 1 = (g h(m) y -u ⋆ A ) e ⋆ 1 u s ⋆ 1 and c ⋆ 2 = y e ⋆ 2 B g s ⋆ 2
) to H is less than 10 2 -k . Therefore, the probability that F returns a forged message/signature which has been queried to the random oracle in one execution is at least 6ε/7. We define Ind(̟, e) to be the index of this query. We then define the sets

S i = {(̟, e)|F S F ,e (̟) succeeds & Ind(̟, e) = i} for i ∈ [[1, q H ]
] and S = q H i=1 S i . We have Pr[S] ≥ 6ε/7. Therefore, A at the end of the first stage will get at least one pair (̟, e = (e 1 , . . . , e q H )) (and a corresponding list of signatures) leading to a forgery with probability at least 1 -exp(-12/7) ≥ 4/5 after having queried S A at most ⌈2q S /ε⌉ times. Let us denote γ = Ind(̟, e) the index of query of the forged message to the random oracle. Let I be the set consisting of the most likely indices i:

I = {i ∈ [[1, q H ]], Pr[S i |S] ≥ 1/2q H }.
It is easy to see [17, Lemma 3], that in case of success, the index γ lies in I with probability at least 1/2. Moreover, with probability greater than 1/5 the pair (̟, e) belongs to S γ .

Second stage: In the second stage, A executes F with the random tape ̟ which led to the forgery in the first step and different random oracles e ′ = (e ′ 1 , . . . , e ′ q H ) such that e i = e ′ i for i < γ, e ′ γ is picked uniformly at random in [[1, p -1]] \ {e γ } and the e ′ j 's are picked uniformly at random in [[1, p -1]] for j > γ. A uses the recorded in the first step to answer F signature queries before the γ-th random oracle query and its own signing oracle S A after that point.

After running F ⌈14q H /ε⌉ times, A will obtain, if (̟, e) ∈ S γ , with probability at least 3/5 (see [17,

(g h(m) y -u ⋆ A ) e ⋆ 1 u s ⋆ 1 = (g h(m) y -u ⋆ A ) e † 1 u s † 1 mod p and y e ⋆ 2 B g s ⋆ 2 = y e † 2 B g s † 2 mod p.
If e ⋆ 1 = e † 1 mod p, then A can readily obtain a valid Elgamal signature on m ⋆ as (u ⋆ , v ⋆ ) where

v ⋆ = (s ⋆ 1 -s † 1 )/(e ⋆ 1 -e † 1 ) mod p.
Similarly, e ⋆ 2 = e † 2 mod p, then A can retrieve the discrete logarithm of pkv in base g, and therefore the discrete logarithm of pks in base g and can easily produce a Elgamal signature on the message of his choice.

⊓ ⊔

The complexity assumption used in the previous theorem is the best we can hope for. Indeed, if there exists a polynomial time EF-CMA adversary against hashed Elgamal signature then there exists a forger that breaks the Elgamal UDVS scheme with the same advantage in the same running time.

The results from [START_REF] Paillier | Discrete-Log Based Signatures May Not Be Equivalent to Discrete-Log[END_REF] show that it is very unlikely that the existential unforgeability of hashed Elgamal signatures can be reduced to the discrete logarithm problem in the standard security model. However, it is worth noting that the hashed Elgamal signature scheme is a special case of the protocol AbstractDSA which has been proposed and analyzed3 by Brown in 2005 [START_REF] Brown | Generic Groups, Collision Resistance, and ECDSA Des[END_REF]. Let us recall the Theorem 3 from [START_REF] Brown | Generic Groups, Collision Resistance, and ECDSA Des[END_REF] which asserts the existential unforgeability of the scheme in the generic group model:

Theorem 2 ([2]
). If there exists an (ǫ F , τ F , q F )-forger F of AbstractDSA in the generic group model with uniform hash function h and an almost-invertible conversion function f in the generic group model for A n , then there exists an (ǫ C , τ C )-collision-finder C h and (ǫ Z , τ Z )-zero-finder where

ǫ C + ǫ Z ≥ ǫ F + τ 2 F 2n and τ C , τ Z ≤ 2τ F .
For the specific instance of AbstractDSA investigated in this paper, the conversion function is the identity map which is trivially almost invertible [2, § 2.2.2] and therefore it can be argued that this theorem applies to hashed Elgamal signatures.

On the weakness of restricted universal designated verifier and dedicated signatures

As mentioned above, the dedicated verifier may provide a zero-knowledge proof that it has a certain signature without presenting it. In many legal systems it would suffice in the court to present such a proof in order to derive legal consequences of the signed document. The weakness and eventually the meaningless of these two concepts of signatures comes from the following theorem. It is among the most important results in zero-knowledge protocols and state the possible construction, using commitment schemes, of a zero-knowledge proof system for all languages in NP. This theorem was proved in [START_REF] Goldreich | Proofs that Yield Nothing But Their Validity or All Languages in NP Have Zero-Knowledge Proof Systems[END_REF] by Goldreich, Micali and Widgerson. Theorem 3. If non-uniform one-way functions exist, then there exists a computational zero-knowledge proof system of membership for all languages having an interactive proof system of membership.

The impact of the theorem on the two kinds of signature is described below.

The case of restricted UDVS: proving the possession of a BLS signature

In Huang et al. paper, the authors propose a pairing-based scheme. A user receive a BLS signature, and should convince only a given number of third parties of the validity of this signature. We argue that these restriction is not possible since the signature holder can always prove the validity of the BLS signature he holds by applying the zero-knowledge proof of the possession of a BLS signature described in Fig. 2. In Klonowski et al. paper [START_REF] Klonowski | How to Protect a Signature from Being Shown to a Third Party[END_REF], the authors propose a scheme based on Elgamal signatures. In this scheme, the signer is suppose to construct his signature in such a way that the recipient cannot show the signature to third parties without being punished (for instance, his secret key is revealed). The sent signature is called a dedicated signature, but the recipient can derive a true Elgamal signature from it. Therefore once the holder has computed this Elgamal signature, he can use our new protocol defined in Section 3 to convince any third party without being punished. Indeed, the signature holder can transform the Elgamal signature into a signature designated to the third party.

Conclusion

Signatures of knowledge allow a prover to prove the knowledge of a secret with respect to some public information noninteractively. In our case, this helps to defeat some concepts which aim at controlling the holder of a signature. To this purpose, we propose for the two concepts of restricted universald designated verifier signatures and dedicated signatures two proofs which permit the signature holder to prove his knowledge of a signature without being troubled. The first one is a classical proof of a BLS signature. The second one is the first efficient designated verifier proof of an Elgamal signature.

An interesting open problem would be to have an efficient zero-knowledge proof of the possession of an Elgamal (or DSA) signature. What we proposed is an efficient designated verifier proof, which might not be relevant in some special cases. Moreover, the concept of punishing a signature holder who unauthorizedly disclose a signature is still open. The presence of an authority seems necessary to design such a scheme.

Definition 4 .

 4 A dedicated signature scheme Σ is an 7-tuple Σ = (Setup, SKeyGen, VKeyGen, DDSCreate, Retrieve, Verify, Punish) such that -Σ.Setup is a PPTM which takes an integer k as input. The output are the public parameters Υ . k is called the security parameter. -Σ.SKeyGen is a PPTM which takes the public parameters as input. The output is a pair (sks, pks) where sks is called a signing secret key and pks a signing public key. -Σ.VKeyGen is a PPTM which takes the public parameters as input. The output is a pair (skv, pkv) where skv is called a verifying secret key and pkv a verifying public key. -Σ.DDSCreate is a PPTM which takes the public parameters, a message, a signing secret key and a verifying public key as inputs and outputs a bit string. -Σ.Retrieve is a PPTM which takes as input the public parameters, a message, a bit string, a signing public key and a verifying secret key as input. The output is a bitstring. -Σ.Verify is a PTM which takes the public parameters, a message m, a bit string σ and a signing public key pks. It outputs a bit. If the bit output is 1 then the bit string σ is said to be a signature on m for pks. -Σ.Punish is a PPTM which takes the public parameters, a message, two bit strings, a signing public key and a verifying public key and outputs a bit string. Σ must satisfy the following properties, for all k ∈ N, all Υ ∈ Σ.Setup[k], all (pks, sks) ∈ Σ.SKeyGen[Υ ], all (pkv, skv) ∈ Σ.VKeyGen[Υ ] and all messages m: -Correctness of Retrieval: ∀τ ∈ Σ.DDSCreate(Υ, m, sks, pkv), ∀σ ∈ Σ.Retrieve(Υ, m, τ, pks, skv), Σ.Verify[Υ, m, σ, pks] = {1}. -Punishement: ∀τ ∈ Σ.DDSCreate(Υ, m, sks, pkv), ∀σ ∈ Σ.Retrieve(Υ, m, τ, pks, skv), Σ.Punish[Υ, m, τ, σ, pks, pkv] = {skv}.

rFig. 2 . 4 . 2

 242 Fig.2. Proof of knowledge of a BLS signature[START_REF] Hufschmitt | A Zero-Knowledge Identification Scheme in Gap Diffie-Hellman Groups[END_REF]

We refer to[START_REF] Brown | Generic Groups, Collision Resistance, and ECDSA Des[END_REF] for the definitions of uniform hash function, almost-invertible conversion function and zero-finder adversary.

⋆ This work was done while this author was a postdoctoral fellow in the Computer Security group of the Bonn