Xavier Bonnetain

Improved Low-qubit Hidden Shift Algorithms

Hidden shift problems are relevant to assess the quantum security of various cryptographic constructs. Multiple quantum subexponential time algorithms have been proposed. In this paper, we propose some improvements on a polynomial quantum memory algorithm proposed by Childs, Jao and Soukharev in 2010. We use subset-sum algorithms to significantly reduce its complexity. We also propose new tradeoffs between quantum queries, classical time and classical memory to solve this problem.

Introduction

The hidden shift problem can be stated as follows:

Let f , g be two injective functions, G a group. Given the promise that there exists s ∈ G such that, for all x, f (x) = g(xs), retrieve s. This is a generalization of the the hidden subgroup problem, which corresponds to the case f = g, and is efficiently solved by Shor's algorithm [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF] in the abelian case.

As the hidden subgroup problem, the hidden shift problem is of interest for cryptography. Notably, the security of multiple symmetric primitives [START_REF] Alagic | Quantum-Secure Symmetric-Key Cryptography Based on Hidden Shifts[END_REF][START_REF] Bonnetain | Hidden shift quantum cryptanalysis and implications[END_REF] and the security of some post-quantum isogeny-based asymmetric schemes [START_REF] Castryck | Csidh: An efficient post-quantum commutative group action[END_REF][START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF][START_REF] Feo | Seasign: Compact isogeny signatures from class group actions[END_REF][START_REF] Feo | Towards practical key exchange from ordinary isogeny graphs[END_REF] depends on its hardness.

It is also interesting for quantum computing, as solving this problem requires exponential classical time, but depending on the group structure, can be solved quantumly in either polynomial, sub-exponential or exponential time.

The first subexponential quantum algorithm for the hidden shift problem has been proposed by Kuperberg in [START_REF] Kuperberg | A Subexponential-Time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF], where he proposed multiple algorithms in 2 O( √ n) quantum time, memory and query. A polynomial quantum memory variant has been proposed by Regev in [START_REF] Regev | A Subexponential Time Algorithm for the Dihedral Hidden Subgroup Problem with Polynomial Space[END_REF], with a time cost in 2 O( √ n log 2 (n)) . This latter algorithm has been generalized and more precisely studied by Childs, Jao and Soukharev in [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF], where they prove a time cost in 2

( √ 2+o(1)) √ n log 2 (n)
for all abelian groups. In 2013, Kuperberg proposed a generalisation of his first algorithm and Regev's variant [START_REF] Kuperberg | Another Subexponential-time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF] with a heuristic cost estimate of O 2 √ 2n .

Asymptotic cost estimates provide little information on the concrete cost of the algorithm. Concrete cost estimates for groups of order a power of two for Kuperberg's original algorithm have been done in [START_REF] Bonnetain | Hidden shift quantum cryptanalysis and implications[END_REF], obtaining a cost of around 2 1.8 √ n for the cyclic case. The used algorithm has later been generalised to arbitrary cyclic groups in [START_REF] Bonnetain | Quantum security analysis of CSIDH and ordinary isogeny-based schemes[END_REF], for a cost of around 12 × 2 1.8 √ n . In this paper, we will focus on the quantum algorithm of Childs, Jao and Soukharev [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF] and show how it can be improved.

Notations

We note

L n (α, c) = 2 ((c+o(1))n α log 2 (n) 1-α ) .
We will focus here on the cyclic group Z/(N Z), and denote n = log 2 (N ). However, the algorithms can also be applied to arbitrary abelian groups, using the same approach as in [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF]. We denote L n (1/2, c) as L(c). We note • the inner product of vectors.

We denote χ(x) = exp (2iπx) in the qubit phases.

Results

In this paper, we improve the quantum hidden shift algorithm of [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF]. We use subset-sum algorithms to lower the exponent of the complexity, and propose different tradeoffs between quantum and classical cost. In particular, with c the exponent to solve a subset-sum instance, we solve the hidden shift problem in L( √ c) classical time and quantum queries, and if we want a quadratic gap between the classical time cost and the quantum query cost, we can solve it in L( c/3) quantum queries and L(2 c/3) classical time.

The results are summarized in Table 1. The quantum time is roughly the number of quantum queries, as the only non-trivial quantum operation is the oracle evaluation.

Quantum query Classical time Classical memory

Subset-sum Source Hidden shift algorithms are in two steps: the first one uses the oracles to produce some random qubits with a specific structure (the elements), which are then refined by some combination routines until we manage to extract the value of the hidden shift.

L 1/ √ 2 L √ 2 O(1) exhaustive search [7] L (1) L (1) O(1) exhaustive search Section 4.2 L 1/ √ 3 L 2/ √ 3 O (

Element Generation

Given a quantum oracle access to f and g, one can compute

x |0 |x |f (x) + |1 |x |g(x) .
After a measurement of the last register, one obtains

|0 |x 0 + |1 |x 0 + s
for a given unknown x 0 . Now, one can apply a Quantum Fourier Transform on the second register, to obtain

ℓ |0 χ x 0 ℓ N |ℓ + |1 χ (x 0 + s)ℓ N |ℓ .
Finally, one can perform a measurement on the second register, and obtain ℓ and

|ψ ℓ = |0 + χ sℓ N |1 .

Interesting Elements

If one manages to obtain |ψ 1 , . . . , |ψ 2 j , |ψ 2 n , then s can be retrieved with a Quantum Fourier Transform, as

n j=0 |ψ 2 j = 2 n ℓ=0 χ sℓ N |ℓ .
Hence, applying an inverse Quantum Fourier Transform allows to retrieve s. It is to be noted that, for groups of odd order, we only need to be able to construct |ψ 1 : the value 2 j can be obtained by multiplying all the labels by 2 -j and constructing 1 from the new labels.

The situation is slightly easier if N = 2 n . In that case, |ψ 2 n-1 = |0 + (-1) s |1 directly gives s mod 2. Likewise, as noted in [START_REF] Bonnetain | Hidden shift quantum cryptanalysis and implications[END_REF], both |ψ 2 n-2 and |ψ 3×2 n-2 allows to obtain the second bit of s if s mod 2 is known, and so on, knowing the lower bits of s allows to extract the next bit from ψ (2α+1)2 j .

Combination routines

We will use the combination routines of [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF] to obtain the labels we are looking for, that is, either

|ψ 1 or |ψ 2 n-1 .
The idea is to take a certain amount of elements (k), and use them to produce one better element. Recall that the elements are of the form |0 +exp 2iπ sℓi N |1 . If we tensor them, we obtain

i |ψ ℓi = j∈{0,1} k χ j • (ℓ 1 , . . . , ℓ k ) N |j .
Now, the objective of the combination routine is to perform a partial measurement on |j , in order to ensure that the remaining j have an interesting phase difference. After that, we only need to know the corresponding j, project the state on a pair, and relabel the two values of the pair to 0 and 1 in order to obtain a better element.

Algorithm 1 computes the function |j |0 → |j |j • (ℓ 1 , . . . , ℓ k ) mod 2 r and measures the second register. By definition, the remaining j have a phase identical modulo 2 r . Hence, the output label will be a multiple of 2 r . This approach can be iterated, in order to obtain multiples of increasingly big powers of 2, and allows to reach |ψ 2 n-1 .

Another approach to reach a specific element is to compute |⌊j • (ℓ 1 , . . . , ℓ k )/M ⌋ . This will produce elements with a close phase (their difference will be smaller than M ). As before, this approach can be iterated to obtain smaller and smaller labels, until we reach |ψ 1 . This is done in Algorithm 2.

Algorithm 1 Combination routine, for powers of 2

Input: The register is now

(|ψ ℓ 1 , . . . , |ψ ℓ k ) : ∀i, 2 a |ℓi, r Output: |ψ ℓ ′ , 2 r+a |ℓ ′ 1: Tensor i |ψ ℓ i = j∈{0,1} k χ j•(ℓ 1 ,...,ℓ k ) N
χ j 1 •(ℓ 1 ,...,ℓ k ) N |j1 + χ j 2 •(ℓ 1 ,...,ℓ k ) N |j2 6: Map |j1 to |0 , |j2 to |1 7: Return |0 + χ (j 2 -j 1 )•(ℓ 1 ,...,ℓ k ) N |1
Both algorithms are used in [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF], the former to tackle cyclic groups of order a power of 2, the latter for cyclic groups of odd order. The register is now Finding pairs Finding the pairs for Algorithm 1 (Step 4) consists in finding the solutions of the equation x • (ℓ 1 , . . . , ℓ k ) mod 2 r = V . This is addressed by brute-force in [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF], for a cost of 2 k . For the complexity analysis, we consider that this step costs O(2 ck ), the brute-force case being the case c = 1. This brute-force approach can also be applied to Step 4 of Algorithm 2.

Algorithm 2 Combination routine, for smaller labels

Input: (|ψ ℓ 1 , . . . , |ψ ℓ k ), (ℓ1, . . . , ℓ k ) ∈ [0; B) k , r Output: |ψ ℓ ′ , ℓ ′ < j ℓj/2 r 1: Tensor i |ψ ℓ i = j∈{0,1} k χ j•(ℓ 1 ,...,ℓ k ) N
χ j 1 •(ℓ 1 ,...,ℓ k ) N |j1 + χ j 2 •(ℓ 1 ,...,ℓ k ) N |j2 6: Map |j1 to |0 , |j2 to |1 7: Return |0 + χ (j 2 -j 1 )•(ℓ 1 ,...,ℓ k ) N |1 Algorithm 3 Projection routine Input: x∈J φ(x) |x , (j1, j2) ⊂ J. Output: φ(j1) |j1 + φ(j2) |j2 or x∈J \{j 1 ,j 2 } φ(x)
Complexity Algorithm 1 succeeds if, at step 5, we manage to project on a pair (j 1 , j 2 ). Indeed, as they are both preimages of V , we have

ℓ ′ = (j 2 -j 1 ) • (ℓ 1 , . . . , ℓ k ) = 0 mod 2 m .
In order to achieve this, we must:

1. Have at least two distinct solutions of the equation, 2. Manage to find the solutions, 3. Successfully project onto a pair.

The first point requires us to have r < k. In [START_REF] Regev | A Subexponential Time Algorithm for the Dihedral Hidden Subgroup Problem with Polynomial Space[END_REF], k = r + 4 is used, while [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF] uses k = r + 1. In both cases, we have a fixed probability to have at least 2 solutions: there are 2 r images, hence at most 2 r subsets have a sum for which there is a unique preimage, hence we have at least 2 solutions at least half the time. The third point is a problem when the number of solutions is odd: in that case, we may fail to project on a pair. As we have balanced superpositions, the probability of obtaining a singleton is half the probability of obtaining a pair. Hence, we fail to project with probability at most 1/3.

The case of Algorithm 2 is very similar. In [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF], the authors chose r = klog(k). As the output labels depend on the sum of the inputs, they can be larger, and the output space is of size k2 r . Hence, in [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF], a value of r = klog(k) is chosen, to guarantee a constant success probability. Moreover, a step of rejection sampling (still with constant probability) is added, to guarantee a uniform sampling in the smaller interval.

To summarize, the two routines take k elements, and produce with constant probability p one refined element which is r ≃ k bits better, at a cost of O(2 ck ), with c the exponent of finding the solutions in the combination routines.

CJS algorithm [7]

If we want each routine in the pipeline to be the same, we will have m routines, and we need mr ≃ n in order to succeed. The total cost is then of (k/p) m queries, km qubits (excluding the quantum oracle overhead), a classical time in

O( i<m (k/p) i 2 k ) = O((k/p) m 2 k

Subset-sum algorithms

It turns out that solving x • (ℓ 1 , . . . , ℓ k ) mod 2 r = V with x ∈ {0, 1} k for random instances can be done more efficiently than brute-force. Indeed, as we have a small number of solutions, it corresponds to a random instance of a subsetsum problem with a density close to 1, for which multiple algorithms have been proposed [START_REF] Schroeppel | A t=o(2 n/2 ), s=o(2 n/4 ) algorithm for certain npcomplete problems[END_REF][START_REF] Becker | Improved generic algorithms for hard knapsacks[END_REF][START_REF] Helm | Subset sum quantumly in 1.17 n[END_REF]. All these algorithms (classical and quantum) have an exponential complexity, in O(2 cn ), for a given constant c < 1. As we consider a polynomial-quantum memory algorithm, we will focus on the classical subsetsum algorithms. These algorithms rely on list-merging techniques: the complete solution is contructed from lists of candidate partials solutions.

A simple example is the Schroppel-Shamir algorithm [START_REF] Schroeppel | A t=o(2 n/2 ), s=o(2 n/4 ) algorithm for certain npcomplete problems[END_REF]. The space of possible solutions of The lists contains the possible partial sum on a fourth of the variables. The intermediate lists S 12 and S 34 contains the partial sums on the first and second half of the variables.

Without any other technique, the splitting would not gain anything, as the two intermediate lists would be of size 2 n/2 . The Schroeppel-Shamir algorithm gains by guessing S 12 mod 2 n/4 . With that guess, the list is expected to be of size 2 n/4 . Conversely, S 12 mod 2 n/4 imposes the value V -S 12 mod 2 n/4 for S 34 . Hence all the lists are expected to be of size O(2 n/4 ). The solution will only be found for the correct guess of the intermediate value, requiring 2 n/4 guesses overall, for a total cost of O(2 n/2 ) time, but only O(2 n/4 ) memory.

Finally, the merging in itself is the efficient generation of the intermediate lists (and of the complete solution) from the previous lists. As we want to produce a list of values with a constrained sum, we can sort the first list, and then check for each element of the second list if there is an element leading to a correct sum in the first list. The cost of the merging is the cost of sorting the input list and constructing the output list, here O(2 n/4 ).

The algorithm from [START_REF] Becker | Improved generic algorithms for hard knapsacks[END_REF] uses similar techniques, but with a different splitting. Instead of considering a subset of the variables, they considered a partial sum with a smaller number of terms in it. They also allowed the exponent of the subset sum in the intermediate step to lie in {-1, 0, 1}. With this approach, the merging has also to check for the consistency of the solutions, as the variables may overlap.

By splitting the sum in 8 and carefully choosing the size of the intermediate constraint and the ratio of -1, the authors of [START_REF] Becker | Improved generic algorithms for hard knapsacks[END_REF] obtained a complexity in O(2 0.291n ) in classical time and memory. It is also possible to devise polynomial-memory algorithms for this problem. The method in [START_REF] Becker | Improved generic algorithms for hard knapsacks[END_REF] consists in merging only two lists, using a memoryless collisionfinding algorithm, with a cost in O(2 0.72n ).

In our case, we have some instances with more than one solution. As the expected number of solutions is fixed, this does not change the asymptotic cost for constructing all the solutions.

Finally, finding the pairs for Algorithm 2 consists in finding the solutions of the slightly different equation ⌊x • (ℓ 1 , . . . , ℓ k )/2 r ⌋ = V . This equation is slightly different, but the exact same techniques can be applied, as the merging can also check for values lying in an interval. Hence, the cost is similar for both.

For the polynomial variant, we do not have an equality to check between the two lists. This can be solved by truncating the first r + 1 bits of the partial sum. In that case, two partial sums that lead to the correct interval have more than 50% chance to have the same truncated value. In the case that we missed, we only need to redo this by adding 2 r to the partial sum before truncating. We will also have a fixed proportion of false positives that we need to discard. Overall, this does not change the complexity cost of O(2 cn ).

4 Improved hidden-shift algorithms

Improving the CJS algorithm

Instead of using brute-force to compute the output qubit value of each routine, we can use a subset-sum algorithm, which costs O(2 cn ). The only difference is that the classical part cost less. With k = α n log 2 (n), we still have a quantum query cost in L(1/(2α)), but the classical time cost becomes L(1/(2α) + cα) and the optimal parameter becomes k = n log 2 (n)/(2c), leading to a quantum query complexity in L( c/2) and a classical time complexity in L( √ 2c). The classical time exponent of this hybrid algorithm is double the quantum query cost.

Minimizing the classical time

The classical cost of the previous approach is almost all in the first routine of the pipeline: the second routine is called k/p time less, the third (k/p) 2 time less, and so on. We can change the size of each routine and increase k to have each routine to cost overall roughly the same. The cost of a routine is in 2 ck , hence k can increase by log 2 (n)/(2c) for each routine. The optimal point is for k increasing from 0 to n log 2 (n)/c, by steps of log 2 (n)/(2c). With these parameters, the routine i uses k i = i log 2 (n)/(2c). We need to have i<m k i ≃ n, which implies m ≃ 2 cn/ log 2 (n). Hence, the cost of each routine will be in 2 ckm+o (km) . As k m ≃ n log 2 (n)/c, we obtain a quantum time cost in L( √ c). The first routine does nothing, hence its cost is the number of queries, which is also in L( √ c).

Enforcing a quadratic gap

Section 4.1 had an algorithm with k i = β n log 2 (n), Section 4.2 used k i = iα n log 2 (n). We can generalize this and consider It turns out the two previous approaches can be generalized, and we can consider routine input sizes of the form k i = (iα + β) n log 2 (n), and for example ensure a quadratic gap between the number of queries and the classical time. If we want to have each m routine to cost the same, we still need α = log 2 (n)/(2c). This implies m ≃ As it is similar to the classical/quantum gap of Grover's algorithm, this approach can be interesting for cases where the targeted hardness is defined with respect to some exhaustive search, as for example in the security levels 1, 3 and 5 of the NIST call for post-quantum primitives.

2c -β + β 2 + 1 c n/ log 2 (n), hence k m ≃ β 2 + 1 c n log 2 (n). The log of number of queries is in c(k m -k 1 ) = cαm = c -β + β 2 + 1 c n log 2 (n),

Minimizing the number of queries

The simplest way to minimize to number of queries is to have only one routine, and directly use Algorithm 1 or Algorithm 2 to solve the whole problem: in that case, the number of queries is in O(n) to obtain one target element, hence overall the quantum query cost is in O(n 2 ). The classical cost is in O(2 cn ). Interestingly, this beats the asymptotic cost of the best known classical algorithm if c < 1/2.

Algorithms complexity

From Section 3, we can take c = 0.291 for a memory-heavy algorithm, or c = 0.72 for a polynomial-memory algorithm. This leads to the exponents of Table 1.

If we only consider quantum algorithms (or that classical and quantum time and memory are equivalent), then we have sightly different complexities. Currently, an algorithm with the exponent c = 0.241 has been proposed in [START_REF] Bernstein | Quantum algorithms for the subset-sum problem[END_REF], and one with exponent c = 0.226 in [START_REF] Helm | Subset sum quantumly in 1.17 n[END_REF]. The costs are summarized in Table 2. It is to be noted that the non-polynomial quantum memory hidden shift algorithms we obtain perform asymptotically worse than the algorithms from [START_REF] Bonnetain | Hidden shift quantum cryptanalysis and implications[END_REF][START_REF] Kuperberg | A Subexponential-Time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF][START_REF] Kuperberg | Another Subexponential-time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF], which use a different combination routine. Using Grover's algorithm for a small number of queries produces an algorithm with the same cost as the exhaustive search, with a small number of queries. Overall, this is slightly worse than the approach of [START_REF] Ettinger | On Quantum Algorithms for Noncommutative Hidden Subgroups[END_REF], which performs an exhaustive search, but achieves a linear number of queries.

Conclusion

In this paper, we showed how to use subset-sum algorithms to reduce significantly the cost of a quantum hidden shift algorithm, and proposed different quantum/classical cost tradeoffs, allowing to divide the exponent by roughly 2.6 compared to [START_REF] Childs | Constructing elliptic curve isogenies in quantum subexponential time[END_REF], and even by 4.5 for the quantum query cost if we allow a quadratic gap between the classical time cost and the quantum query cost.

Improving the complexity. In order to obtain more efficient algorithms, one might study what happens if the combined elements can be chosen from a larger pool, as done in the quantum-memory heavy algorithms of [START_REF] Kuperberg | A Subexponential-Time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF]. This may allow to reduce the time cost at the expense of the quantum memory, while still offering a tradeoff between classical time and quantum query. Another approach would be to apply similar techniques to the algorithm of [START_REF] Kuperberg | Another Subexponential-time Quantum Algorithm for the Dihedral Hidden Subgroup Problem[END_REF], if applicable.

|j 2 : 4 :

 24 Add an ancilla register, apply |x |0 → |x |x • (ℓ1, . . . , ℓ k ) mod 2 r 3: Measure the ancilla register, leaving with V and j•(ℓ 1 ,...,ℓ k ) mod 2 r =V χ j • (ℓ1, . . . , ℓ k ) N |j Compute the corresponding j 5: Pair them, project to a pair (j1, j2).

|j 2 : 4 :

 24 Add an ancilla register, apply |x |0 → |x ⌊x • (ℓ1, . . . , ℓ k )2 r-1 /B⌋ 3: Measure the ancilla register, leaving with V and ⌊j•(ℓ 1 ,...,ℓ k )2 r-1 /B⌋=V χ j • (ℓ1, . . . , ℓ k ) N |j Compute the corresponding j 5: Pair them, project to a pair (j1, j2).

|x 1 :

 1 Add an ancilla qubit: x∈J φ(x) |x |0 2: Apply the operator |x |0 → |x |x = j1 ∨ x = j2 3: Measure the ancilla qubit Algorithm 3 projects on |j 1 , |j 2 with probability 2/|J|, and otherwise projects to the supplementary vector space.

Remark 1 .

 1 ) and a polynomial classical memory. If k = α n log 2 (n), the query cost is in L(1/(2α), and the time cost is in L(1/(2α)+ α. The classical cost is minimized for α = 1/ √ 2, which implies k = n log 2 (n)/(2), which leads to a quantum query cost in L(1/ √ 2) and a classical time cost in LThe quantum query exponent of [7, Theorem 5.2] is not tight.

Fig. 1 :

 1 Fig. 1: Schroeppel-Shamir merging

  as all the steps cost the same. Enforcing a quadratic gap between the two means that β 2 + 1 c = 2β, hence β = 1/ √ 3c. With these values, the quantum query cost is in L c 3 , and the classical time cost is in L 2 c 3 .

Table 2 :

 2 Quantum query Quantum time Quantum memory Subset-sum Source Purely quantum algorithm costs

	L(0.5) L(1/ √ 2)	L(1) L(1/ √	2)	O(n) O(n)	Grover Section 4.1 Grover Section 4.2
	O(n 2 )	2 0.5n		O(n)	Grover Section 4.4
	L(0.283)	L(0.567)	L(0.283)	[3]	Section 4.3
	L(0.491)	L(0.491)	L(0.491)	[3]	Section 4.2
	O(n 2 )	O 2 0.241n	O 2 0.241n	[3]	Section 4.4
	L(0.274)	L(0.549)	L(0.274)	[11]	Section 4.1
	L(0.475)	L(0.475)	L(0.475)	[11]	Section 4.2
	O(n 2 )	O 2 0.226n	O 2 0.226n	[11]	Section 4.4

n i=1 ε i x i = V is split into 4 parts S 1 , S 2 , S 3 , S 4 , with S 1 = i≤n/4 ε i x i , and so on.


Joanna Wrigglesworth

Marie-Laure Ancelin

Karen A Ritchie

Joanne Ryan
email: joanne.ryan@monash.edu

Association between DNA methylation of the KITLG gene and cortisol levels under stress: a replication study

Keywords: 2, Supplementary material: supplementary methods & 2 KITLG, DNA methylation, epigenetics, stress response, cortisol, hypothalamic pituitary adrenal axis

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction:

Severe or repeated stress or trauma has been shown to result in long-term disruptions in stress signaling [START_REF] Lupien | Effects of stress throughout the lifespan on the brain, behaviour and cognition[END_REF]. This in turn has been associated with an increased risk of mental health problems over the lifetime, including mood and addictive disorders [START_REF] Gilbert | Burden and consequences of child maltreatment in high-income countries[END_REF]. It remains unclear however, how trauma can have an enduring effect on the risk of disease, which can occur years and even decades after the initial exposure.

The hypothalamic pituitary adrenal (HPA) axis plays an essential role in stress signaling. In response to stress, the HPA axis releases a cascade of hormones that stimulate the secretion of glucocorticoids (i.e. cortisol in humans), which influences a broad range of physiological processes [START_REF] Gaffey | Aging and the HPA axis: Stress and resilience in older adults[END_REF]. Cortisol secretion is thus used as an indicator of HPA axis responsiveness to stress. Disrupted cortisol secretion is a feature of a number of psychiatric disorders [START_REF] Beluche | Persistence of abnormal cortisol levels in elderly persons after recovery from major depression[END_REF][START_REF] Morris | Relations among posttraumatic stress disorder, comorbid major depression, and HPA function: a systematic review and meta-analysis[END_REF].

Abnormal cortisol secretion and blunted cortisol response have also been reported following early-life stress [START_REF] Doom | Longitudinal patterns of cortisol regulation differ in maltreated and nonmaltreated children[END_REF], and can remain stable persisting into later life [START_REF] Olff | HPA-and HPTaxis alterations in chronic posttraumatic stress disorder[END_REF].

In recent years, interest into the molecular mechanisms which account for the long-lasting and persistent effects of stress has been increasing. Accumulating evidence indicates that stress and trauma can impact the epigenome and these changes can remain stable with the potential for long-term health effects [START_REF] Gluckman | Living with the past: evolution, development, and patterns of disease[END_REF]. The epigenome, the collection of potentially reversible modifications which regulate gene activity, is responsive to environment.

Adult females reporting childhood adversities had an increased risk of developing depression and were also found to have lower methylation levels of the monoamine oxidase A (MAOA) gene, involved in the metabolism of neurotransmitters [START_REF] Melas | Genetic and epigenetic associations of MAOA and NR3C1 with depression and childhood adversities[END_REF]. Most consistently reported however, has been the association between early-life stress and increased glucocorticoid receptor DNA methylation (NR3C1), another major component of HPA-axis signalling. For example, retrospective reporting by adults of parental loss, lack of parental care or maltreatment in childhood, has been associated with increased NR3C1 DNA methylation in blood [START_REF] Tyrka | Childhood adversity and epigenetic modulation of the leukocyte glucocorticoid receptor: preliminary findings in healthy adults[END_REF]. Furthermore, differential NR3C1 DNA methylation in adulthood has also been linked to an attenuated cortisol stress response [START_REF] Tyrka | Childhood adversity and epigenetic modulation of the leukocyte glucocorticoid receptor: preliminary findings in healthy adults[END_REF]. Recently, findings have been published from the first study to investigate DNA methylation patterns associated with cortisol stress reactivity, using an epigenome-wide approach (rather than focusing on specific candidate genes) [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF]. The investigators identified a locus (KITLG) where DNA methylation was significantly correlated with cortisol stress reactivity in a cohort of 85 healthy adults aged 18 to 69 years. The KITLG protein, otherwise referred to as stem cell factor (SCF), mast cell growth factor or steel factor, promotes cell survival, proliferation, differentiation, adhesion and functional activation [START_REF] Ashman | The biology of stem cell factor and its receptor C-kit[END_REF]. It is essential for haematopoiesis, melanogenesis and fertility. It appears to be important for mast cells, which are cells of the immune system that increase their activity in response to cortisol [START_REF] Ashman | The biology of stem cell factor and its receptor C-kit[END_REF][START_REF] Nautiyal | Brain mast cells link the immune system to anxiety-like behavior[END_REF]. DNA methylation at this loci was also observed to mediate the association between increased childhood trauma and lower cortisol reactivity in adulthood [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF]. This finding furthers our understanding of how KITLG methylation may help regulate the stress response, and provides a mechanism that could possibly explain the varying resilience to toxic environments that has been observed within the population. To date no other study has reported replication of these findings. The primary aim of this study is to determine whether KITLG DNA methylation continues to be associated throughout life with cortisol response by examination of an older cohort. If a significant association is observed, a secondary aim is to determine whether retrospective reporting of childhood trauma is also associated with KITLG DNA methylation.

Methods:

Study participants:

The data for this analysis was derived from a large, on-going prospective population study; the ESPRIT study (Enquete de Sante Psychologique -Risques, Incidence et Traitement) [START_REF] Ritchie | Prevalence of DSM-IV psychiatric disorder in the French elderly population[END_REF]. Community dwelling participants aged 65 years and over were randomly selected from the electoral rolls of the Montpellier district, in France. When inclusion criteria were not met, or a participant did not accept the offer to participate, a further random sample was selected from the same electoral roll in order to maintain a representative sample. After providing written informed consent, participants responded to general and health questionnaires, and completed standardized neurological and psychiatric examinations [START_REF] Ritchie | Prevalence of DSM-IV psychiatric disorder in the French elderly population[END_REF]. Biological samples, including whole blood for DNA methylation analysis, were also extracted at the time of this examination. The ESPRIT study protocol was approved by the Ethical Committee of the University Hospital of Kremlin-Bicetre, and all procedures were undertaken with verbal and written consent of the participants. The ESPRIT study is ongoing with continual follow-up of participants.

After obtaining written informed consent from all participants, they were administered interviews by trained staff and underwent a number of clinical examinations at baseline and every two years thereafter.

This study is based on a sub-sample of 142 participants who participated in the salivary cortisol study, had complete and valid data for these measures and also provided blood samples for DNA extraction and KITLG DNA methylation analysis (see Supplemental Methods).

Childhood adversity:

The Childhood Adversity Questionnaire [START_REF] Ritchie | Association of adverse childhood environment and 5-HTTLPR Genotype with late-life depression[END_REF] was administered to the participants at the third wave of assessment (four years after recruitment) by which time a close relationship had been formed between participants and the interviewers, permitting the request for sensitive information. The questionnaire lists 25 adverse childhood events and the participants indicated whether or not had experienced these. For this analysis we considered two of the major events which were experienced by a number of participants: physical and/or sexual abuse and death (including suicide) of a parent. We also considered the total number of adverse events from the 25-items.

KITLG DNA methylation:

The KITLG gene encodes the ligand of the tyrosine-kinase receptor. This gene is pleiotropic.

In utero it is involved in neural cell development, while in adults is required for haematopoiesis.

Using the Epidesigner software (http://www.epidesigner.com/), an assay was designed to amplify a 258bp region of the gene, just downstream of the CpG island (Ch37hp19; chr12: 88973136-88974846) (Supplementary Figure 1). This region was chosen to include the CpG site identified by [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF]. The measure of DNA methylation is described in the Supplemental methods.

Statistical analysis:

All statistical analyses were performed using Stata 15 (StataCorp, College Station, TX, USA).

A paired t-test with equal variance was used to measure potential differences between participant's cortisol levels under basal and stress conditions. A univariate linear regression model was used to determine the association between KITLG methylation (%), at each of the seven CpG units, and cortisol levels (morning, evening (ng/dL) and diurnal (AUC)) (Model 1).

A number of a priori covariates were then included in a multivariate regression analysis: initially age and sex (Model 2) as key covariates, and then depression (Model 3) [START_REF] Ancelin | Angiotensin-converting enzyme gene variants are associated with both cortisol secretion and late-life depression[END_REF], thus replicating covariates modelled by [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF]. To reduce the risk of false positive findings a more stringent p-value of 0.01 was applied.

The association between participant's experiences of childhood trauma (e.g. parental death, or childhood abuse) and KITLG methylation (log-transformed to normalise) was first investigated using an independent t-test with unequal variances, an ANOVA (for the three categorical variable of number of adverse events) or a simple linear regression model (when the number of adverse events were treated as a continuous variable). As no significant associations were observed, no further analysis was performed.

Results:

The 142 participants included in this study ranged in age from 65 to 80 and nearly half were female (Table 1). A small number of individuals (n = 22) had clinically significantly depression. Of the 128 participants providing a measure of childhood adversity, a total of 20.3% participants indicated their parents had died during childhood, and 14.8% of individuals reported childhood physical or sexual abuse. The mean levels of cortisol measured in the morning, evening or total cortisol across the day (AUC), under both basal (non-stress) and stress conditions, are also shown in Table 1.

[Table 1 near hear]

The KITLG assay quantified methylation at seven CpG units located within a 258bp region of the gene. Overall, mean methylation was low (2.4 ± 3.0%), with CpG unit 2.3 having the highest mean methylation (5.0 ± 7.9%) and CpG unit 5 the lowest (0.6 ± 1.1%) (Figure 1).

[Figure 1 near hear]

None of the seven CpG units were associated with basal cortisol levels (Supplementary Table 1). On the other hand, CpG 2.3 was significantly negatively associated with morning cortisol levels under the stressful condition (Supplementary Table 2, Figure 2a), even after applying a more stringent p-value (p<0.01). In multivariate models, this association between CpG 2.3 KITLG DNA methylation and morning cortisol levels remained after adjusting for age and sex, as well as further adjustment for clinical depression (Table 2). However, when adjusting for multiple testing (p<0.01), this association is no longer significant.

[Table2 near hear]

Similarly, a significant negative association was observed between CpG 2.3 KITLG DNA methylation and total cortisol secretion across the day (AUC) under the stress condition (Supplementary Table 2, Figure 3b). Despite remaining significant when controlling for age and sex, adjusting for multiple testing deemed this association no longer significant (Table 2).

[Figure 2 near hear]

No association were found between childhood trauma and KITLG DNA methylation, at any of the CpG units (Table 3). This includes no significant association between the number of adverse events experienced (in four categories) and KITLG methylation (p between 0.099 and 0.893 for each of the CpG units). These results remained non-significant when adverse events was treated as a continuous variable (p between 0.116 and 0.93 for each of the CpG units).

[Table 3 near hear]

Discussion:

Severe or chronic stress and trauma can result in long lasting disruptions in cortisol secretion which negatively impact health outcomes. The molecular mechanism accounting for these persistent effects is unclear, but accumulating evidence suggests a role for epigenetic processes, including DNA methylation, which can result in stable changes in gene expression.

As the first study to investigate epigenome-wide DNA methylation patterns correlated with cortisol levels, [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF] measured saliva cortisol over a 90 min period in a cohort of 85 healthy Dutch individuals (mean age 33 years), given a stress induction task [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF]. This task, a version of the Trier Social Stress Test (TSST), involved public speaking and completing an arithmetic task. The researchers identified that a locus within the KITLG gene (cg27512205), was most strongly associated with cortisol stress reactivity, with increased methylation corresponding to lower cortisol levels (AUCi). While this association was not significant when adjusted for multiple testing, they replicated these findings in blood samples from a multiethnic cohort of 45 adults (mean age 28 years), and in buccal cells from 255 caucasian adolescents (mean age 17 years) [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF]. The investigators further determined that childhood trauma (a 25 item self report questionaire) was positively associated with KITLG DNA methylation, and that DNA methylation mediated 32% (p = 0.05) of the association between childhood trauma and cortisol stress reactivity. This latter finding, however, was only identified in one of their cohorts consisting of 85 healthy Dutch individuals, without major depression.

We have conducted the first independent study in an attempt to replicate these findings. In our study of older community-dwelling Caucasians, KITLG DNA methylation was negatively associated with cortisol levels under naturalistic stress conditions. Associations were found with both total cortisol throughout the day (AUC) and morning cortisol levels, but not with evening cortisol levels. Interestingly, the latter appears to be more susceptible to environmental influences [START_REF] Ancelin | Angiotensin-converting enzyme gene variants are associated with both cortisol secretion and late-life depression[END_REF]. Our study thus provides the first independent replication of findings published in the younger cohort [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF], however, the exact site of differential methylation varied; CpG 2.3 in our analysis, whereas the locus identified previously corresponds to our CpG 1. The reasons for these differences remain unclear.

Overall, KITLG DNA methylation levels in our study were much lower than those in [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF]; specifcally at CpG1 the mean level of methylation in our study was 1.6% compared to 15.0% in the prior study. These could be true differences, reflecting the unique features of the two cohorts, including our sample aged over 65 years, however it could also be due to the different methodolgies used to measure DNA methylation. Methylation was quantified using a probe based array method (Illumina HumanMethylation 450k) in Houtepen et al (2016) whereas we applied a candidate gene approach with Mass Spectroscopy (Sequenom MassARRAY). Both studies also differ regarding the type of stress (laboratorytype stress versus our naturalistic condition), and protocol for cortisol sampling (afternoon versus our diurnal cortisol sampling). However, despite these differences, as well as populations with different ages (with the HPA-axis becoming more vulnerable to dysregulation in later life and with increased cortisol response to challenge in the elderly [START_REF] Otte | A metaanalysis of cortisol response to challenge in human aging: importance of gender[END_REF], comparable patterns of associations were observed.

Interesting, the association between CpG 2.3 methylation and cortisol was weakend and less significant when clinical depression was included as a covariate. In the study by Houtepen et al, current major depression was only significantly associated with childhood trauma, although they did not include cases of significantly high depressive symptomatology which did not meet criteria for a major depressive episode, and thus reducing generalizability to the wider population.

We found no association between retrospective reporting of childhood trauma and KITLG DNA methylation, which contrasts with the previous findings [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF]. In both studies, childhood trauma was measured using a self-report, retrospective questionnaire, although these asked a different set of questions and were considered binary variables (yes/no trauma), whereas Houtpen's scores were on a continuous scale. Furthermore, their measure of childhood trauma was a total score, the sum of individual questions, whereas we examined specific types of trauma (severe and abuse), as well as the number of traumatic events. However, despite the lack of significance, there was some evidence of a weak association between the experience of severe trauma and DNA methylation at a number of CpGs (i.e. 2.3,4,5,6,9 & 22), in the direction that those who experienced death of a parent, severe trauma or abuse were more likely to have higher levels of KITLG methylation.

In both our study and the initial report, these retrospective childhood questionnaires are subject to recall bias and under-reporting. The longer time since the occurrence of these events may further reduce accuracy in an older cohort, although death of a parent and physial abuse are highly unlikely to be forgotten. Other possible limitations of our study need to be considered when interpreting the results. Despite being a reasonably sized sample and larger than the discovery cohort of the original publication we were replicating, our sample was still underpowered to detect very small differences in KITLG DNA methylation between groups.

Furthermore, only a sample of the original ESPRIT cohort was included in this analysis, as these were the individuals where we had completed KITLG DNA methylation as well as duirnal cortisol levels. The heterogeneity of cell types in whole blood, which was used to measure KITLG DNA methylation, must be kept in mind when interpreting these findings [START_REF] Bakulski | Epigenetic Research in Neuropsychiatric Disorders: the "Tissue Issue[END_REF]. However, Houtepen et al replicated their findings from whole blood in buccal tissue, which suggests that the observed KITLG methylation results may not be tissue specific. In the context of an older population, both salivary cortisol and whole blood provide a non-invasive, flexible, less stressful approach to measuring cortisol and DNA methylation The KITLG gene encodes the ligand that activates the receptor tyrosine kinase KIT [START_REF] Mirabello | Promoter methylation of candidate genes associated with familial testicular cancer[END_REF], which is responsible for promoting proliferation, migration, survival and differentiation of hematopoietic progenitors, melanocytes and germ cells [START_REF] Lennartsson | Stem cell factor receptor/c-Kit: from basic science to clinical implications[END_REF]. Only a few previous studies have investigated KITLG DNA methylation. Lower methylation has been associated with a specific form of cancer [START_REF] Mirabello | Promoter methylation of candidate genes associated with familial testicular cancer[END_REF], as well as with psychiatric disorders such as schizophrenia and bipolar disorders [START_REF] Houtepen | Genome-wide DNA methylation levels and altered cortisol stress reactivity following childhood trauma in humans[END_REF]. It is also unclear what the exact functional consequences of DNA methylation in this region would have on gene expression. However, the location of the KITLG CpG 2.3 sites are within a region enriched for H3K27 acetylation. This is a histone modification more commonly associated with promoters and enhancers (i.e. active regulatory elements), and is considered to play an important role in gene expression [START_REF] Creyghton | Histone H3K27ac separates active from poised enhancers and predicts developmental state[END_REF]. This suggests that methylation of this gene region could play a functionally significant role.

However, it should be noted that the site analysed by Houtepen is located within the CpG island shore, a region commonly associated with gene expression, whilst CpG 2.3 was located within the island itself. Nonetheless, the increased expression of the glucorticoticoid receptor (GRα), a functionally important receptor of the stress response system, when erythroid precursors are exposed to the KITLG protein (i.e. full length human KITL) further supports this, and suggests a possible role of KITLG during the stress response [START_REF] Varricchio | The expression of the glucocorticoid receptor in human erythroblasts is uniquely regulated by KIT ligand: implications for stress erythropoiesis[END_REF].

In conclusion, we report a significant association between increased KITLG methylation and decreased cortisol stress response in an older population. This independently replicates the correlation previously measured in a younger cohort, thus suggesting that KITLG gene may continue to regulate the stress response throughout the life-span. On the other hand, we were not able to replicate the correlation between childhood trauma and KITLG methylation. Further studies are required to better understand the relevance of this gene in mediating stress reactivity, and the potential of KITLG methylation to cause a lasting modulation of cortisol secretion.

excluded. Measures of salivary cortisol were derived from direct radioimmunoassay (Diagnostic Systems Laboratories-Webster, Texas) with intra-assay and inter-assay coefficients of variation averaging 5%.

Given that the protocol involved non-fixed time sampling, cortisol levels were calculated at fixed times from regression of the four log-transformed cortisol values on the sampling times [START_REF] Ancelin | Angiotensin-converting enzyme gene variants are associated with both cortisol secretion and late-life depression[END_REF]. Diurnal cortisol (AUC) was calculated between 0800 and 2200 hours, for each subject and both conditions (basal vs. stressful), using standardized values extrapolated from the equation of the regression line, on the hour of sample collection, as previously described [START_REF] Beluche | Persistence of abnormal cortisol levels in elderly persons after recovery from major depression[END_REF].

KITLG DNA methylation:

DNA was extracted from whole blood sampled at baseline using a salt and ethanol-induced precipitation method. Five hundred nano-grams of extracted DNA underwent bisulphite conversion using the EZ-96 DNA methylation-Lightning tm MagPrep, as per the manufacturer's instructions (Zymo Research, Irvin, CA, USA). The target KITLG region was amplified in technical triplicate using Polymerase Chain Reaction (PCR), thus controlling for technical variability. Primers F: 5'-GTTTTTATTTTTTTTGAAATGGAAAAAGG-3' R: 5'-GGGTTATATAAATAAATTTGAGTGAGA-3' contained an adapter (5'-aggaagagag) and T7 tag (5'-cagtaatacgactcactatagggagaaggct) to facilitate in vitro transcription. DNA methylation was quantified using the SEQUENOM MassARRAY EpiTYPER platform (Sequenom, San Diego, California), via the distinction of a mass difference between DNA fragments. A total of seven CpG units could be measured with this assay.

Mean methylation was determined from technical triplicates for each of the seven predicted CpG units (1, 2.3, 4, 5, 6.8, 9 and 22). Values deviating 10% above or below the median methylation were removed. 64.40 (6.88) 1 A Mini-International Neuropsychiatric Interview (MINI, French version 5.00) [START_REF] Sheehan | The Mini-International Neuropsychiatric Interview (M.I.N.I.): the development and validation of a structured diagnostic psychiatric interview for DSM-IV and ICD-10[END_REF] diagnosis of major depressive disorder according to DSM-IV criteria, and/or high levels of depressive symptomatology according to the Centre for Epidemiological Studies Depression Scale (CES-D), with a score ≥16 [START_REF] Radloff | The CES-D Scale: A Self-Report Depression Scale for Research in the General Population[END_REF]. 2 History of cardiovascular ischemic pathologies (angina pectoris, myocardial infarction, stroke, cardiovascular surgery, arteritis). 3 MMSE: Mini-Mental State Examination. 4 From a total of n = 128. 5 From a list of 25-items, including physical, sexual and verbal abuse [START_REF] Ritchie | Association of adverse childhood environment and 5-HTTLPR Genotype with late-life depression[END_REF]. 6 Ln of cortisol concentration (expressed as ng/dl).

Figure 1 .

 1 Figure 1. Distribution of KITLG Methylation levels at each of the seven CpG units (a) raw methylation data; (b) log transformed methylation data which gives a better indication of the distribution of the data.

Figure 2 .

 2 Figure 2. Scatterplot indicating the association between KITLG DNA methylation at unit CpG 2.3 and stress reactivity cortisol levels (a) morning cortisol; (b) diurnal cortisol levels (AUC).

Table 1 .

 1 Participant characteristics (n=142)

	Tables:
	Characteristic

Table 3 .

 3 The association between childhood stressful events and KITLG DNA methylation Death

of a parent (yes vs no) Physical or sexual abuse (yes vs no) KITLG DNA methylation (%)

	Supplementary	Mean difference (SE)	p	t	Mean difference (SE)	p	t
	CpG 1	-0.05 (0.13)	0.70 -0.38	-0.16 (0.13)	0.22	-1.24
	CpG 2.3	0.24 (0.16)	0.13	1.52	0.25 (0.16)	0.12	1.59
	CpG 4	-0.006 (0.11)	0.96 -0.05	0.11 (0.10)	0.26	1.13
	CpG 5	-0.10 (0.09)	0.27 -1.12	0.01 (0.07)	0.90	0.13
	CpG 6.7.8	-0.10 ( 0.08)	0.22 -1.24	-0.02 (0.09)	0.82	-0.22
	CpG 9	0.05 (0.12)	0.68	0.41	-0.05 (0.11)	0.67	-0.43
	CpG 22	-0.12 (0.12)	0.32 -1.00	0.02 (0.10)	0.86	0.18
	SE: Standard Error.

Table 1 .

 1 Unadjusted linear regression models for the association between cortisol levels measured under basal conditions (nonstress) and KITLG DNA methylation. ß: the beta coefficient from the linear regression model; SE: Standard Error. The exact number of participants with data for each CpG site varies, and is indicated.

	KITLG DNA methylation	Morning cortisol		Evening cortisol		Diurnal cortisol (AUC)
		ß (SE)	p	t	ß (SE)	p	t	ß (SE)	p	t
	CpG 1 (n=88)	-4.60 (2.80)	0.11	-1.64	1.30 (4.12)	0.75	0.31	-23.11 (36.27)	0.53	-0.64
	CpG 2.3 (n=107)	-0.60 (0.71)	0.40	-1.61	-0.13 (1.10)	0.12	0.04	-5.08 (9.66)	0.60	-0.82
	CpG 4 (n=90)	2.63 (3.75)	0.48	0.70	-0.92 (5.44)	0.87	-0.17	11.95 (48.37)	0.80	0.25
	CpG 5 (n=135)	8.10 (4.31)	0.06	1.73	5.73 (6.83)	0.40	0.86	96.70 (58.28)	0.09	1.62
	CpG 6.7.8 (n=93)	5.00 (3.04)	0.10	1.64	-2.30 (4.42)	0.60	-0.52	18.92 (39.48)	0.63	0.48
	CpG 9 (n=92)	2.90 (2.75)	0.29	1.06	-0.12 (3.97)	0.98	-0.03	19.44 (35.27)	0.58	0.55
	CpG 22 (n=91)	7.87 (8.48)	0.36	0.93	13.76 (12.4)	0.27	1.11	151.43 (109.53)	0.17	1.38

AUC was standardized and calculated using the extrapolated values from the equation of the regression line of the three cortisol values measured between 08 h and 22 h(Chaudieu et al., 2008).

Acknowledgements:

The authors would like to thank the ESPRIT participants for their involvement in the study.

Funding details:

The ESPRIT project is financed by the regional government of Languedoc-Roussillon, the Agence Nationale de la Recherche Project 07 LVIE 004, and an unconditional grant from Norvartis. This work was also supported by France Alzheimer. JR is the recipient of a Dementia Leadership Fellowship from the National Health & Medical Research Council, Australia (APP1135727). The funders had no role in the design and conduct of the study; in data collection, management, analysis or interpretation of the data and were not involved with the writing, preparation, review or approval of the manuscript.

Availability of data and materials:

The datasets analysed during the current study are available from the corresponding author on reasonable request.

Declaration of interest statement:

The authors report no conflicts of interest.

Lay summary:

The significant negative association between KITLG DNA methylation and morning cortisol, measured under a stressful condition, suggests that individuals with higher KITLG methylation will secrete lower levels of cortisol whilst under stress.

Authors' contributions:

MLA and KR lead the ESPRIT study, obtained funding for the collection of data, including cortisol measures and biological samples. JR generated the DNA methylation data. JW and JR designed the study, JW performed all of the analyses and JW, JR and MLA were responsible for the interpretation of the data. JW drafted the manuscript and all authors were involved in revising it critically for important intellectual content. All authors gave final approval to the submitted manuscript version and agreed to be accountable for all aspects of this work.

Supplementary materials:

Supplemental methods:

Study participants:

Clinical depression was defined as those being diagnosed with major depressive disorder (MDD), as measured by the Mini-International Neuropsychiatric Interview (MINI, French version 5.00) [START_REF] Sheehan | The Mini-International Neuropsychiatric Interview (M.I.N.I.): the development and validation of a structured diagnostic psychiatric interview for DSM-IV and ICD-10[END_REF], according to DSM-IV criteria, and/or having high levels of depressive symptomatology (score ≥16 ) according to the Centre for Epidemiological Studies Depression Scale (CES-D) [START_REF] Radloff | The CES-D Scale: A Self-Report Depression Scale for Research in the General Population[END_REF]. Compared to the full ESPRIT population, participants included in this analysis were younger, less likely to be female and lower rates of clinical depression (p<0.01). However, the frequency of childhood events reported were similar between excluded and included individuals.

Cortisol measure:

Salivary cortisol was measured at four points during the day under two contrasting conditions; at home, considered a basal measure, and on the day of clinical examinations for the study, considered a naturalistic stress condition [START_REF] Beluche | Persistence of abnormal cortisol levels in elderly persons after recovery from major depression[END_REF]. Given the normal fluctuation of cortisol across the day, which increases shortly after awakening and then decreases across the day, participants were asked to collect their first sample one hour or more after awakening.

Samples were then subsequently collected after an additional 3hrs (midday cortisol), 7hrs (afternoon cortisol) and 14hrs (evening cortisol). This non-fixed, four sample protocol was selected to help ensure compliance in this older population. For all samples, individuals were instructed not to eat, drink or smoke at least 30 mins prior to saliva collection. As expected, cortisol levels were significantly higher in the stress versus basal conditions [START_REF] Ancelin | Angiotensin-converting enzyme gene variants are associated with both cortisol secretion and late-life depression[END_REF]. Individuals without a typical eucortisolemic pattern, including a decline throughout the day, or who were being treated with mediations know to influence cortisol levels, were