El Laz

Alejandro Hevia

Rezk Tamara

Tracking Information Flow by Mapping Broadcast Encryption Subgroups to Security Lattices

Keywords: Secure information flow, Broadcast encryption schemes, Static analysis BASE µ KG({v 1 , ..., v i }, k ) ⇒ [ ] µ[k := vk]

In this paper we consider scenarios in which a server broadcasts messages with different confidentiality levels to nodes subgroups holding the appropriate clearance. We build on IND-CPA broadcast encryption schemes to preserve the message's confidentiality over a network. Our proposal is that, to verify that information in the server flows to nodes with the appropriate clearances (e.g. verify the use of the correct encryption keys), we can map broadcast subgroups of nodes to levels in information flow security lattices. We implement this idea via a type system and provide a soundness proof with respect to a formally defined secure information flow property for server code.

Introduction

Security of distributed systems depends on protection mechanisms to ensure confidentiality of information traveling over an open network. Cryptography provides essential mechanisms for confidentiality. Cyptographic encryption schemes can provide strong security guarantees, such as IND-CPA or semantic security [START_REF] Goldwasser | Probabilistic encryption and how to play mental poker keeping secret all partial information[END_REF], to prevent leakage of information to attackers with polynomial computational power. However, even with plain encryption, the confidentiality of keys, plaintexts, and ciphertexts are interdependent [START_REF] Rezk | Secure Programming[END_REF]: encryption with untrusted keys is clearly dangerous, and plaintexts should never be more secret than their decryption keys.

We consider general scenarios where a server wishes to broadcast messages to nodes that have different confidentiality clearances. Broadcasted messages should only be visible to nodes with the appropriate confidentiality clearance.

Broadcast encryption schemes [START_REF] Boneh | Collusion resistant broadcast encryption with short ciphertexts and private keys[END_REF][START_REF] Fiat | Broadcast encryption[END_REF][START_REF] Lee | BESTIE: broadcast encryption scheme for tiny iot equipments[END_REF] offer an efficient solution to protect confidentiality over a network. These schemes allow a server to securely broadcast a message to a subgroup of nodes. They provide cryptographic primitives to generate a common cryptographic key for a subgroup of nodes to ensure that only members of a privileged subgroup can decrypt a message.

Yet, even by using IND-CPA broadcast encryption schemes (BES), server programs might encrypt a message with the wrong keys, thus, sending it to nodes without the appropriate clearance or send a plaintext which contains more confidential information than the one desired.

Our proposal is mapping broadcast subgroups of nodes to levels in information flow security lattices [START_REF] Denning | A lattice model of secure information flow[END_REF] to verify secure information flow in the server code. We implement this idea via a type system. Our type system checks that messages intended for a specific subgroup of nodes are not leaked to nodes in security levels with less privileges. It also checks that important variables used in the server such as cryptographic keys variables and variables that record nodes according to their security class are not erroneously or maliciously modified. We formally prove that our type system complies with a new security property based on the information flow literature [START_REF] Rezk | Verification of Confidentiality Policies for Mobile Code[END_REF].

In summary, our contributions are:

• By mapping BES subgroups to security classes, we show how to control the flow of information from the server to nodes in different classes. • A type system for server code featuring a cryptographic operation of broadcast encryption and an algorithm for generation of cryptographic keys to broadcast to group of nodes with different security clearances. • A soundness proof with respect to a new information flow security property.

Models and Goals

This section covers the system model and the attacker model. We then informally introduce the security property that we want to provide.

System Model

We consider a framework where a single infrastructure provider, a server S, controls and manages a large set of networked nodes in a distributed system that we simply indicate as set of nodes N. Such framework is suitable for many IT systems in which the nodes can vary between smart cards, cloud systems and IoT systems. The server seeks to securely communicate with nodes belonging to privileged subgroups. Indeed, the server maps subgroups of nodes into security classes that we indicate as security levels.

Attacker Model We assume passive attackers that listen to the network that the server uses to communicate with nodes. We also assume that an attacker can read all the public information but cannot prevent communications between a server and the nodes.

Security Properties

We want to provide the following security properties:

• Secure communication. A server communicates with a specific node with confidentiality guarantees. In our architecture, confidentiality is ensured via the use of a IND-CPA [START_REF] Rackoff | Non-interactive zero-knowledge proof of knowledge and chosen ciphertext attack[END_REF] BES, the correct usage of cryptographic keys on the server for nodes at a given security level. • Secure information flow. Information intended to more privileged security levels cannot flow into less privileged security levels. More specifically, messages with higher confidentiality clearances cannot be read by nodes with lower confidentiality clearances. This is ensured via a type system on the server code.

BES and Security Classes

Broadcast Encryption Schemes

Broadcast encryption schemes [START_REF] Fiat | Broadcast encryption[END_REF] allow a sender (e.g. a server) to transmit a message to a privileged group of receivers (e.g. nodes) such that only the receivers in the privileged group can decrypt it. We first a general definition of broadcast encryption scheme, then we present an instantiation based on ElGamal encryption.

Definition 1. A broadcast encryption scheme for a set of nodes S and a server consists of four primitives defining an encryption scheme and a broadcast primitive. The encryption scheme includes:

-Setup(S, λ) An initial setup algorithm that given a set S of n nodes and a security parameter λ, generates a master key K for the server (only the server has K) and n public/private pairs of keys (PK i , SK i ), one pair for each node. SK i is private to node n i . Private key SK i will be used for node n i in S to compute the decryption key whenever n i belongs to the privileged subset. -KG(L, K) A key generation algorithm used at the server that takes as input a set L ⊆ S of nodes and a master key K and generates an encryption key K L to encrypt a message for nodes in L. -Encrypt(L, K L , m) An encryption algorithm that takes as input a subset L of nodes, an encryption key K L for subset L, and a message m. The algorithm outputs a ciphertext and a header (H 1 , . . . , H n ). -Decrypt(L, SK i , H 1 , . . . , H n ,C m ) A decryption algorithm that is used in a node n i that takes as input a subset L, a private key SK i for node n i , heasers H 1 , . . . , H n for all nodes in L, and a ciphertext C m . First the algorithm calculates the decryption key for L by using SK i and public keys of nodes in L and then it outputs the decrypted message.

We denote as BEnc(L, K L , m) the primitive that broadcasts an encrypted message Encrypt(L, K L , m) to the network.

Broadcast encryption schemes can offer strong security guarantees, such as IND-CPA, while adopting small key sizes [START_REF] Boneh | Collusion resistant broadcast encryption with short ciphertexts and private keys[END_REF][START_REF] Lee | BESTIE: broadcast encryption scheme for tiny iot equipments[END_REF].

Indistinguishability against chosen-plaintext attacks (IND-CPA) for asymmetric key encryption schemes is defined by a game between a polynomial time adversary and a challenger. The adversary selects two plaintexts of his choice and sends them to the challenger, who randomly selects one of the two plaintexts, encrypts it and sends the challenge ciphertext back to the adversary. The goal of the adversary is to find out which of the two plaintexts has been encrypted by the challenger.

Definition 2 (IND-CPA). An encryption scheme is said to be IND-CPA secure if the advantage of any efficient adversary is a negligible function of the security parameter, i.e., the adversary cannot do much better than a blind guess.

|Pr IND-CPA [b = b ] - 1 2
| is negligible in the security parameter.

Even though the adversary have knowledge about m 0 , m 1 and pk, the encryption algorithm being probabilistic, means that the encryption of m b where b ∈ {0, 1} is one of several valid ciphertexts. This prevents the adversary from learning some information by encrypting m 0 and m 1 to compare the result and therefore binds the advantage of the adversary.

Example 1 (Boneh-Franklin Scheme).

In this section we provide an example of a broadcast encryption scheme. We choose to use the scheme that was proposed by A. Boneh and M. K. Franklin [START_REF] Boneh | An efficient public key traitor tracing scheme[END_REF]; which is cryptographically equivalent to ElGamal. Note that any other broadcast encryption scheme may be used for the purpose of our work.

-Setup. The server chooses a safe prime order group Z * p where p = 2 • q + 1, with p and q large primes. Let G q be the subgroup of Z * p of order q. -Key Generation. The server selects g ∈ G q to be the generator of G q . For each node n i with i = 1, ..., k, the server chooses a random r i ∈ Z q and computes h i = g r i mod p. The public key is the set (y, h 1 , ..., h k ), where y can be written in the form of

y = ∏ k i=1 h i α i = g ∏ k i=1 r i •α i for random α i ∈ Z q . A private key is an element θ i ∈ Z q such that θ i • γ (i)
is the representation of y with respect to the base < h 1 , ..., h k >. Let Γ = {γ (1) , ..., γ (k) } where each γ (i) = (γ 1 , ..., γ k ) a vector over Z 1 . The set Γ is fixed in advance and not secret. There exist several methods to compute Γ, we only show one method: for each node n 1 , the server computes γ (1) = ( α 1 α 1 , α 2 α 1 , ..., α k α 1 ). Each node n i then receives α i which will also be its decryption key θ i .

-Encryption. To broadcast a message in G q , the server first picks a random element r ∈ Z q and encrypts the message m as m • y r mod p. The server then broadcasts the following ciphertext:

(h 1 r , ..., h k r , m • y r ) = (H 1 , ..., H k ,C).
-Decryption. To decrypt, a node n i computes m as:

m = C U θ i where U = ∏ k i=1 H i γ i .

Security Classes

In order to keep track of the confidentiality clearance of nodes, we use a mapping from nodes to security classes that we formalize as elements or levels in a lattice [START_REF] Denning | A lattice model of secure information flow[END_REF]. These security levels are used for messages so that the server can identify to which subgroups messages can be securely delivered. We use a lattice structure for modeling confidentiality, i.e. a partially ordered set together with least upper bound (join operator) and greatest upper bound (meet operator) on the set. In our architecture, the set of security classes is partially ordered by ≤ in a lattice (L, ≤). A confidentiality security level ranges over τ and indicates a read level. In the lattice, τ ≤ τ means that τ has more confidentiality than τ. We write ⊥ for the lowest security level and for the highest security level in lattice L.

Example 2. In this example, we show a confidentiality security lattice namely diamond lattice with three nodes placed as follows:

L = {n 0 , n 1 , n 2 }, M 1 = {n 0 }, M 2 = {n 1 } and H = {n 1 }. The partial order of the lattice is L ≤ M 1 ≤ H and L ≤ M 2 ≤ H.
IN the rest of the paper, we will be referring to the lattice in Figure 1.

H = {n 1 } L = {n 0 , n 1 , n 2 } M 1 = {n 0 , n 1 } M 2 = {n 1 }
Fig. 1: Security lattice Example 3. We present a numerical example where a server is willing to broadcast a message m of security clearance M 1 to a targeted subset of nodes (n 0 , n 1 ). We assume to have the confidentiality lattice in Figure 1 and the broadcast encryption scheme presented in Example 1. We show how node n 2 (that belongs to a lower security level L) cannot decrypt the message since its security level is lower than the security clearance level of the message.

Setup. The server chooses a safe prime order group Z * 11 and a generator g ∈ G 5 where G 5 is the subgroup of quadratic residues of Z * 11 [START_REF] El Laz | Security analysis of elgamal implementations[END_REF]. Key Generation. The server selects r i ∈ Z 5 for each n i and computes h i = g r i and outputs a set of public keys (y, h 0 , h 1 , h 2 ), with y = ∏ 2 i=0 h i α i and α i ∈ Z 5 . Since the server is willing to broadcast only to nodes n 0 and n 1 , he publishes Γ = {γ (0) γ (1) } and securely assign the private keys α 0 = θ 0 to n 0 and α 1 = θ 1 to n 1 .

Algorithm 1 Setup and Key Generation 1: The server selects a generator g = 4 ∈ G 5 . 2: For each node n i with (i = 0, 1), the server chooses r i ∈ Z 5 and computes h i = g r i .

a: For node n 0 , the server picks r 0 = 2 and computes h 0 = 4 2 mod 11 = 5. b: For node n 1 , the server picks r 1 = 4 and computes h 1 = 4 4 mod 11 = 3. 3: The server outputs a set of public keys as (y, h 0 , h 1 ).

a: For node n 0 , the server picks α 0 = 1. b: For node n 1 , the server picks

α 1 = 3. c: y = ∏ 1 i=0 h i α i = 3 4:
The server outputs a public set of vectors Γ = (γ (0) , γ (1) = ((1, 3), (2, 1)) calculated as follows: a: For γ (0) , the server computes ( α 0 α 0 , α 1 α 0 ) = (1, 3). b: For node γ (1) , the server computes

( α 0 α 1 , α 1 α 1 ) = (2, 1)
Broadcast. To broadcast a message 5 ∈ G 5 to nodes in n 0 and n 1 , the server first chooses are random element 4 ∈ Z 5 , then encrypts the message. The server then broadcasts the following ciphertext : Decryption. Upon receiving the broadcasted message, node n 0 and n 1 use θ 0 and θ 1 for n 1 to decrypt the ciphertext. The decryption process is described in the table below for n 0 . The node n 1 computes the same operation by using its private key. Note that node n 2 cannot compute the decryption as he does not possess its decryption key.

(h 0 r , h 1 r , m • y r ) = (H 0 , H 1 ,C).
Algorithm 3 Decryption for node n 0 1: To decrypt, n 0 uses its private key θ 0 .

a: Node n 0 computes m = C U θ 0 = 9 4 1 = 5 where U = H γ (0) 0 0 • H γ (0) 1 1 = 4.

Type System

In this section, we present a language with syntax and a formal semantics for server code featuring broadcast encryption primitives. We also define a type system and a security property for secure information flow and state a theorem that says that typable server programs are guaranteed to provide secure information flow in the system.

Syntax

In what follows, we consider the server language described below. It consists of programs, which can be expressions e or commands c. We let x, n, k range over variables and v ranges over strings, integers and boolean literals. We distinguish special variables n, n 1 , n 2 , . . . to designate nodes. We use • for basic arithmetic and boolean operations.

Commands include standard statements (assign, sequence, if, while) and special statements (sbroadcast, KG). In the broadcast statement sbroadcast({n 1 , ..., n j }, k, e), the server uses a broadcast encryption scheme to communicate a message e to a set of nodes (designated by {n 1 , ..., n j }) using an encryption key k. In the key generation statement k := KG({n 1 , ..., n i }, k ), the server uses a master key k to generate the encryption key k for a set of nodes {n 1 , ..., n i }.

Semantics

A program is related to a memory µ which is a finite function that maps variables into values. We write µ[x := v] for the memory that assigns value v to a variable x. The semantics allows us to derive judgments of the form µ e ⇒ v for expressions and µ c ⇒ t µ for commands. These judgments affirm that evaluating expressions e in memory µ results in literal v. Evaluating command c in memory µ results in a new memory µ with t being a side effect that represents the command sends a message to the network. The semantics rules are given in Figure 2. We only highlight the nonstandard rules Secure broadcast and Key generation. In the Key generation rule, the server applies a key generation algorithm KG({n 1 , ..., n i }, v), that takes in input a set of nodes {n 1 , ..., n i }, the evaluation v of key k in µ and outputs the encryption key vk.

In the Secure broadcast rule, the server takes as input a set of nodes {n 1 , ..., n i }, the evaluation vk of key k in µ and the evaluation "m" of message e. To broadcast a message, the server employs a broadcast encryption scheme. We model the ciphertext that goes to the network by the annotation BEnc({n 1 , ..., n i }, vk, "m").

Typing Rules

The types of the language are stratified as follows, where τ ranges over security levels from a confidentiality security lattice.

(Programs types) ρ ::= τ | τ var | τ cmd | τ Nvar(n) | τ Kvar (n 1 , . . . , n i ) | MKvar
Type τ var is the type of a variable, τ cmd is the type of a command, and type MKvar the type of master keys. Type τ Nvar(n) is the type of node variables. We write Γ(n) = τ Nvar(n1, ..., n i ) to specify that τ is the maximum confidentiality clearance for node n. Type τ Kvar (n 1 , . . . , n i ) is the type of encryption keys, meaning that the encryption key is used for nodes n 1 , . . . , n i , where each of these nodes have a minimal confidentiality clearance of τ.

The typing rules of our language are given in Figure 3. Typing judgments have the form: Γ p : ρ where Γ is a typing environment mapping variables to variable security types from ρ. We write Γ(x) = ρ to assign to the variable x type ρ.

Our typing system includes standard rules (Var, Assign, Sequence, If, While) for secure information flow control [START_REF] Volpano | A sound type system for secure flow analysis[END_REF] and special rules (Nvar, MKvar, Kvar-Assign, SBroadcast).

The Var rule binds the type τ var to a variable x. The MKvar rule binds the type MKvar to master key variable k. The SBroadcast rule binds each node n i to be of type τ Nvar(n i ) and e (the message to broadcast) of type τ. Moreover, it binds the key variable k to be of type τ Kvar(n 1 . . . n j ). The Kvar-Assign rule binds each node n j to be of type τ Nvar(n j ), k to be of type τ Kvar (n 1 , . . . , n i ) and the master key k of type MKvar.

Notice that since the Assign rule requires x to be of type τ var, it cannot be applied to a key variable. Hence our type system not only ensures secure information flow, but it also protects the use of keys, which ensure its integrity with respect to key generation.

The remaining rules of the type system constitute the subtyping logic and are given in the lower part of Figure 3. The Base rule states that τ is a subset of τ if τ ≤ τ . The Cmd rule states that τ cmd is a subset of τ cmd if τ is a subset of τ . The Subtype rule states that a program p of type ρ can be bound to type ρ if ρ is a subset of ρ . The S-Var rule states that a variable x of type τ var can be bound to type τ, and the S-NVar rule

LIT Γ n : τ VAR Γ(x) = τ var Γ x : τ var NVAR Γ(n) = τ Nvar(n) SBROADCAST Γ e : τ Γ n i : τ Nvar(n i ) i ∈ {1... j} Γ k : τ Kvar (n 1 . . . n j ) Γ sbroadcast({n 1 , ..., n j }, k, e) : τ cmd Subtyping rules BASE τ ≤ τ τ ⊆ τ S-VAR Γ x : τ var Γ x : τ S-NVAR τ ⊆ τ Γ τ NVar(n) ⊆ τ NVar(n) CMD τ ⊆ τ Γ τ cmd ⊆ τ cmd SUBTYPE Γ p : ρ ρ ⊆ ρ Γ p : ρ Fig. 3: Typing rules states that τ NVar(n) is a subset of τ Nvar(n) if τ is a subset of τ .
In what follows, we display some examples and show how our type system can type secure programs or catch insecure ones. We consider the confidentiality lattice in Figure 1, where

L ≤ M 1 ≤ H and L ≤ M 2 ≤ H.
Example 4. We consider a server willing to send a message m: Γ(m) = M 1 var to a set of nodes in {n 0 , n 1 }: Γ(n 0 ) = M 1 NVar(n 0 ) and Γ(n 1 ) = H NVar(n 1 ) . We also consider a master key k : Γ(k ) = MKVar and a key k: Γ(k) = M 1 KVar(n 0 , n 1 ).

We show that the following program p is typable:

k := KG({n 0 , n 1 }, m, k );sbroadcast({n 0 , n 1 }, k, m)
This program consists of a sequence of two programs p 1 and p 2 . To type p 1 , we apply the KVar-Assign rule. This rule checks (a) the type of nodes n 0 and n 1 , (b) the type of the master key k , and (c) the type of the encryption key k for nodes n 0 and n 1 such that Γ(k) = M 1 KVar(n 0 , n 1 ). In (a), we apply (a 1 ) the NVar rule that binds n 0 to Γ(n 0 ) = M 1 NVar(n 0 ) and (a 2 ) the subtype rule that binds n 1 to Γ(n 1 ) = M 1 NVar(n 1 ).

(a 2 ) Γ(n 1 ) = H NVar(n 1 ) Γ n 1 : H NVar(n 1 ) M 1 ⊆ H Γ H NVar(n 1 ) ⊆ M 1 NVar(n 1 ) Γ n 1 : M 1 NVar(n 1 )
Since all the constraints are valid, then p 1 is typable. To type p 2 , we apply the SBroadcast. The SBroadcast rule checks (a) the type of the message to broadcast m, (b) the type of the nodes variables n 0 , n 1 , and (c) that the type of the encryption k corresponds to the type of nodes variable. In (a), we apply the S-Var then the Var rule that bind m to Γ(m) = M 1 Var. Concerning (b), we apply the Nvar rule on nodes n 0 and n 1 that check their types ((b) for n 0 and (b ) for n 1 ). In (c), the rule binds the encryption key to be of type M 1 KVar(n 0 , n 1 ).

(SBROADCAST) (a) Γ(m) = M 1 Var Γ m : M 1 Var Γ m : M 1 (b) Γ(n 0 ) = M 1 NVar(n 0 ) Γ n 0 : M 1 NVar(n 0 ) (b ) Γ(n 1 ) = M 1 NVar(n 1 ) Γ n 1 : M 1 NVar(n 1 ) (c) Γ sbroadcast({n 0 , n 1 }, k, m) : M 1 cmd
Since all the constraints are valid, then p 2 is typable and the sequence p 1 ; p 2 is typable.

Example 5. In contrast with Example 4, we consider a server willing to send a message m to a set of nodes in {n 0 , n 1 } but generates a key also for a node n 2 . We show that the following program is not typable:

k := KG({n 0 , n 1 , n 2 }, k );sbroadcast({n 0 , n 1 }, k, m)
In fact, the server program contains an error in the key generation (generating key also for n 2 ), which leads to a problem since n 2 will also read a message intended to n 0 and n 1 only. Hence, such error is detected by our type system. Example 6. In this example, we consider a server willing to send a message m: Γ(m) = L var to a set of nodes {n 0 , n 1 , n 2 } but does not generate a key for node n 2 . We show that the following program is not typable:

k := KG({n 0 , n 1 }, k ); sbroadcast({n 0 , n 1 , n 2 }, k, m )
The server program contains an error in the key generation (does not generate a key for n 2 ), which leads to a problem since n 2 will not be able to decrypt. Therefore, our type systems detects such error.

Example 7. In this example, we consider a server willing to send a message m : Γ(m ) = L var to a set of nodes {n 0 , n 1 , n 2 }. We show that the following program is not typable:

k := KG({n 0 , n 1 , n 2 }, k ); m := m; sbroadcast({n 0 , n 1 , n 2 }, k, m )
This program consist of a sequence of three programs p 1 , p 2 and p 3 . Despite the fact that the p 1 and p 3 are typable and the broadcast in p 3 seems to be secure; p 2 is not typable since it assigns a high value M 1 var to a lower value L var and therefore, the entire program is not typable. Indeed, our type system detects this error, otherwise, the broadcast may leak confidential information M 1 var to nodes with lower confidentiality clearance L Nvar(n i ), i ∈ {0, 1, 2}.

Security Properties and Main Results

We define confidentiality (securely flowing between nodes of different security levels) as a new noninterference property [START_REF] Sabelfeld | Language-based information-flow security[END_REF].

We parametrize the definition by an attacker observation level, τ. For our security definition, it is useful to define an equivalence between memories. Intuitively, the definition τ -Equal memories states that two memories are equal from the view point of an attacker that can observe only parts of the memory with security level less or equal than τ.

Definition 3 (τ -Equal Memories). Two memories µ 0 , µ 1 are τ -Equal for Γ, written µ 0 = Γ τ µ 1 , iff dom(µ 0 ) = dom(µ 1 ) ∧ ∀x ∈ µ 0 such that if Γ(x) = τ var ∧ τ ≤ τ, then µ 0 (x) = µ 1 (x).
We say that two memories µ 0 and µ 1 are τ -Equal, µ 0 = Γ τ µ 1 if they contain the same variables that have value less or equal than τ. Two memories are τ -Equal if the mapping of the same variables of the same type τ or lower have the same value in both memories. This definition considers only variables of type τ var.

For our security property, we also need to consider messages that are sent to different groups of nodes. In the semantics of server programs, messages that are broadcasted are given as traces that parametrize the semantics relation. We define a filtering function to project parts of the broadcasted messages that are sent to nodes mapped to security levels less or equal than the attacker observation level. We are now ready to formalize secure information flow in our architecture. Intuitively this definition states that for an attacker that observes memories and messages on the network at τ, the system starting with τ -Equal memories will lead to memories which are τ -Equal. Thus, the attacker cannot distinguish the executions and will broadcast the same messages to nodes less or equal than τ in both executions.

Definition 5 (NonInterference). A server program p is NI at

τ for Γ, written NI Γ τ (p), iff ∀µ 0 , µ 1 such that µ 0 = Γ τ µ 1 ∧ µ 0 p ⇒ t 0 µ 0 ∧ µ 1 p ⇒ t 1 µ 1 , then µ 0 = Γ τ µ 1 ∧ filter(t 0 ) = filter(t 1 ).
Our main result follows: a well-typed program is noninterferent at τ for Γ.

Theorem 1. Let Γ be a typing environment and τ ∈ L a security label. If Γ p then p is NI Γ τ .

We prove this theorem by induction on the height of the typing derivation tree of Γ p. The proof is available on the following anonymous url: https://anonymous. 4open.science/r/Typing-System-Proof.

Example 8. Concerning the security property, we show that the program p of Example 4 is noninterferent at M 1 . We let two memories µ 0 = {k := vk 0 , k := vk 0 , n 0 = "n 0 ", n 1 = "n1", m := v} and µ 1 = {k := vk 1 , k = vk 1 , n 0 = "n 0 ", n 1 = "n1", m := v}. Notice that µ 0 = Γ M 1 µ 1 . By Definition 3, µ 0 = Γ M 1 µ 1 since only variables of type τ var (in our example m) should be equal. After executing p, the value of m does not change in the resulting memories µ 0 and µ 1 . Since only variables of type τ var are considered, then µ 0 = Γ M 1 µ 1 . In order to satisfy the full hypothesis in Definition 5, we need to prove that filter M 1 (t 0 ) = filter M 1 (t 1 ). Actually, t 0 and t 1 are the traces of the messages broadcasted over the network through the Secure Broadcast rule in Figure 2: BEnc({n 1 , ..., n k }, k, v). For an execution that starts with µ 0 , t 0 = BEnc({n 0 , n 1 }, vk 3 , v), thus filter M 1 (t 0 ) = [{n 0 , n 1 }, v]. For an execution that starts with µ 1 , t 1 = BEnc({n 0 , n 1 }, vk 4 , v) and filter

M 1 (t 1 ) = [{n 0 , n 1 }, v]. Hence, filter M 1 (t 0 ) = filter M 1 (t 1 ) and p is NI Γ M 1 .
Example 9. We show that the program p of Example 7 does not comply with NI Γ L according to Definition 5. Let two memories µ 0 = {k := vk 3 , k := vk 3 , n 0 = "n 0 ", n 1 = "n1", m := 4, m := 2} and µ 1 = {k := vk 4 , k = vk 4 , n 0 = "n 0 ", n 1 = "n1", m := 5, m := 2}. The memories µ 0 and µ 1 are L-Equal since the value of m is the same in both memories, and m is the only variable of type L var. The resulting memories of the execution of p are µ 0 = {k := vk 3 , k := vk 3 , n 0 = "n 0 ", n 1 = "n1", m := 4, m := 4} and µ 1 = {k := vk 4 , k = vk 4 , n 0 = "n 0 ", n 1 = "n1", m := 5, m := 5}. Notice that the final memories µ 0 and µ 1 are not L-Equal since the value of m is different, and filter

L (t 0 ) = [{n 0 , n 1 , n 2 }, 4] = filter L (t 1 ) = [{n 0 , n 1 , n 2 }, 5]. Therefore p is not NI Γ L .
Broadcast Encryption and security classes. The concept of broadcast encryption was proposed by Fiat and Naor [START_REF] Fiat | Broadcast encryption[END_REF] who presented a scheme that allows the sender to broadcast a message to all the users except the revoked ones (users with compromised keys).

The security notion required that any coalition of users (up to a threshold) can not obtain any secret about the other users or the content of the broadcast. After that seminal work, several schemes were proposed to get good tradeoffs between key storage cost and transmission cost [START_REF] Agrawal | Optimal broadcast encryption from pairings and LWE[END_REF][START_REF] Boneh | Collusion resistant broadcast encryption with short ciphertexts and private keys[END_REF][START_REF] Boneh | Low overhead broadcast encryption from multilinear maps[END_REF][START_REF] Delerablée | Fully collusion secure dynamic broadcast encryption with constant-size ciphertexts or decryption keys[END_REF]. Further improvements were done in the context of multicast protocols [START_REF] Canetti | Multicast security: A taxonomy and some efficient constructions[END_REF]. In these types of protocols, participants must agree on one or more keys to achieve confidentiality as well as authentication, with potentially many senders. For such settings, clients are no longer stateless (they must keep state beyond group information) but that allows protocols to cope with more diverse scenarios, like authentication in dynamic groups with or without group managers. For the case of confidentiality under single source broadcast, the scheme by Fiat and Naor [START_REF] Fiat | Broadcast encryption[END_REF] provides a simple and efficient solution for the case of dynamic groups (ie. user revocation in [START_REF] Canetti | Multicast security: A taxonomy and some efficient constructions[END_REF]).

In terms of security notions, several schemes have been shown to achieve IND-CPA and IND-CCA [START_REF] Boneh | Collusion resistant broadcast encryption with short ciphertexts and private keys[END_REF][START_REF] Chen | Adaptively secure efficient broadcast encryption with constantsize secret key and ciphertext[END_REF][START_REF] Yang | Broadcast encryption based non-interactive key distribution in manets[END_REF][START_REF] Zhang | Adaptively secure identity-based broadcast encryption with constant size private keys and ciphertexts from the subgroups[END_REF].

BE can also be built on top of other primitives such as identity-based Encryption (IBE), which allows the sender to specify an arbitrary string as public key. This flexibility comes at the expense of requiring a central authority which, using a master key, can compute private keys for any identity. In hierarchical identity-based encryption (HIBE) [START_REF] Gentry | Hierarchical id-based cryptography[END_REF][START_REF] Horwitz | Toward hierarchical identity-based encryption[END_REF], a collection of authorities is arranged in a organizational hierarchy (a tree). Any authority at level k in the hierarchy can issue private keys for any descendant in the hierarchy but cannot decrypt messages intended for identities. It turns out that HIBE schemes can be converted into public-key broadcast encryption schemes with a dynamic set of receivers (albeit with rather large ciphertext length [START_REF] Boneh | Collusion resistant broadcast encryption with short ciphertexts and private keys[END_REF][START_REF] Naor | Revocation and tracing schemes for stateless receivers[END_REF]). None of these constructions, however, seem to exploit the underlying hierarchy to BE schemes with interesting properties among groups of receivers.

Secure information flow. Information flow policies [START_REF] Denning | Certification of programs for secure information flow[END_REF][START_REF] Sabelfeld | Language-based information-flow security[END_REF] mainly focus on controlling the leak of information from secret data to public data through a program. Particularly, secure information flow can protect the confidentiality and integrity of data flows. To prevent insecure flows, one may use static information flow enforcement [START_REF] Volpano | A sound type system for secure flow analysis[END_REF] or dynamic enforcement [START_REF] Askarov | Tight enforcement of information-release policies for dynamic languages[END_REF][START_REF] Bielova | A taxonomy of information flow monitors[END_REF]. Both static and dynamic enforcements can be applied to our architecture; we choose to apply an static mechanism to enforce secure information flow through a type system. Several works propose type systems for secure information flow in distributed systems [START_REF] Bastys | Prudent design principles for information flow control[END_REF][START_REF] Cecchetti | Nonmalleable information flow control[END_REF][START_REF] Fournet | Information-flow types for homomorphic encryptions[END_REF][START_REF] Ferraiuolo | Secure information flow verification with mutable dependent types[END_REF][START_REF] Fournet | A security-preserving compiler for distributed programs: from information-flow policies to cryptographic mechanisms[END_REF][START_REF] Fournet | Cryptographically sound implementations for typed information-flow security[END_REF][START_REF] Magazinius | A lattice-based approach to mashup security[END_REF][START_REF] Matos | Information flow in a distributed security setting[END_REF][START_REF] Murray | Special issue on verified information flow security[END_REF][START_REF] Russo | Dynamic vs. static flow-sensitive security analysis[END_REF][START_REF] Zdancewic | Secure information flow and CPS[END_REF][START_REF] Zheng | Dynamic security labels and static information flow control[END_REF]. In the literature of secure information flow, several works consider combining cryptography to information flow [START_REF] Askarov | Cryptographic enforcement of languagebased information erasure[END_REF][START_REF] Fournet | Information-flow types for homomorphic encryptions[END_REF][START_REF] Fournet | A security-preserving compiler for distributed programs: from information-flow policies to cryptographic mechanisms[END_REF][START_REF] Fournet | Cryptographically sound implementations for typed information-flow security[END_REF][START_REF] Gregersen | A dependently typed library for static information-flow control in idris[END_REF][START_REF] Laud | Semantics and program analysis of computationally secure information flow[END_REF] including our work. None of these works consider the association of security classes to subgroups of nodes in distributed systems and combine them with BES.

By mapping subgroups of nodes to security classes, and associating broadcast encryption keys to these, we propose enforcement of secure information flow between a server broadcasting messages to a set of nodes. We build a type system for server code and prove its soundness with respect to a new secure information flow property. To the best of our knowledge, we are the first to propose the association of security classes to cryptographic keys in BES in order to verify secure information flow.

Algorithm 2 1 :

 21 Broadcast The server selects a message m = 5 ∈ G 5 and a random element r = 4 ∈ Z 5 . 2: To encrypt the m, the server computes C = Encrypt({n 0 , n 1 }, 3, 5) = 5 • 3 4 mod 11 = 9. 3: The server then computes H 0 = 5 4 = 9 and H 1 = 3 4 = 4 4: The server broadcasts (H 0 , H 1 ,C) = (9, 4, 9).

(Fig. 2 :

 2 Fig. 2: Semantics

  Definition 4 (Filtering). Let filter τ (t) = filter τ (t, [ ] ) and filter τ ( [ ] , t) = t. filter τ (BEnc({n 1 , ..., n k }, vk, v ) • t , t) = filter τ (t , t • ({n 1 , ..., n k }, v )) if Γ(n 1 ) Γ(n 2 )... Γ(n k ) ≤ τ filter τ (t , t) Otherwise

Γ n : τ Nvar(n) MKVAR Γ(k) = MKvar Γ k : MKvar KVAR-ASSIGN Γ(k) = τ Kvar(n 1 . . . n i ) Γ n j : τ Nvar(n j ) j ∈ {1...i} Γ k : MKvar Γ k := KG({n 1 . . . n i }, k ) : τ cmdOP Γ e : τ Γ e : τ Γ e • e : τ ASSIGN Γ x : τ var Γ e : τ Γ x := e : τ cmd SEQUENCE Γ c : τ cmd Γ c : τ cmd Γ c; c : τ cmd IF Γ e : τ Γ c : τ cmd Γ c : τ cmd Γ if e then c else c : τ cmd WHILE Γ e : τ Γ c : τ cmd Γ while e do c : τ cmd


Aditya Goenka
email: a.goenka@bham.ac.uk

Lin Liu
email: lin.liu@liverpool.ac.uk

Manh-Hung Nguyen
email: manh-hung.nguyen@tse-fr.eu

Covid-19 and a Green Recovery? *

Keywords: Covid-19, pollution, environmental policy, infectious disease, Green Recovery, dynamic Pigovian taxes. JEL Classification: I15, I16, Q53, H23, E22, C61

Preliminary evidence indicates that pollution increases severity and likelihood of Covid-19 infections as is the case for many other infectious diseases. This paper models the interaction of pollution and preventive actions on transmission of infectious diseases in a neoclassical growth framework where households do not take into account how their actions affects disease transmission and production activity results in pollution which increases likelihood of infections. Household can take private actions for abatement of pollution as for controlling disease transmission. Disease dynamics follow SIS dynamics. We study the difference in health and economic outcomes between the decentralized economy, where households do not internalize the externalities, and the socially optimal outcomes, and characterize the taxes and subsidies that will decentralize the socially optimal outcomes. Thus, we examine the question whether there are sufficient incentives to reduce pollution, both at the private and public levels, once its effects on disease transmission is taken into account.

Introduction

Preliminary evidence from China, Italy, USA and other countries has shown that the presence of pollution, PM (particulate matter), NOx (nitrogen oxides) and ground level ozone increases the severity and likelihood of Covid-19 infections [START_REF] Conticini | Can atmospheric pollution be considered a cofactor in extremely high level of SARS-Cov-2 lethality in Northern Italy?[END_REF], [START_REF] Martelleti | Air pollution and the novel Covid-19 disease: A putative disease risk factor[END_REF], [START_REF] Wu | Exposure to air pollution and Covid-19 mortality in the US: A nationwide cross-sectional study[END_REF], [START_REF] Yongjian | Association between short-term exposure to air pollution and Covid-19 infection: Evidence from China[END_REF]. Some studies also suggest that higher pollution increases aerosol transmission [START_REF] Setti | Airborne transmission route of Covid-19: Why 2 meters/6 feet of inter-personal distance may not be enough[END_REF], [START_REF] Qin | Longitudinal survey of microbiome associated with particulate matter in a megacity[END_REF]). These pollutants are also known to increase other infections especially acute lower respiratory infections including pneumonia, bronchitis, and influenza (Cienciwicki and Jaspers (2007), [START_REF] Horne | Short-term elevation of fine particulate matter air pollution and acute lower respiratory infection[END_REF], [START_REF] Huang | Acute effects of air pollution on influenza-like illness in Nanjing, China: A population-based study[END_REF], [START_REF] Kampa | Human health effects of air pollution[END_REF], [START_REF] Kelly | Air pollution and airway disease[END_REF], Lian, et al. (2014), [START_REF] Mehta | Ambient particulate air pollution and acute lower respiratory infections: a systematic review and implications for estimating global burden of disease, Air Quality[END_REF], [START_REF] Tasci | Relationship of meteorological and air pollution parameters with Pneumonia in elderly patients[END_REF]). 1 Thus, to control Covid-19 or other infectious diseases there are two mechanisms -preventive health expenditures which prevent infections and a pollution abatement policy which by reducing pollution reduces disease transmission. The Covid epidemic has raised expectations of a "Green recovery" where the understanding the role of pollution will increase the impetus for less polluting technologies. This paper adds to the thinking of how likely is it that pollution abatement will result once the additional channel of pollution affecting transmission of Covid-19 and other infectious diseases is taken into account.

This paper studies the interaction of these two instruments in a dynamic general equilibrium analysis by extending the economic epidemiological model of [START_REF] Goenka | Infectious diseases and economic growth[END_REF] and Goenka and Liu (2019) to model the interaction of pollution with health where the disease dynamics are of SIS type used to model Covid-19. Pollution is modeled as a flow (consistent with evidence on PM and NOx ( [START_REF] Varotsos | Scaling properties of air pollution in Athens, Greece and Baltimore, Maryland[END_REF], Windsor and Toumi (2001), [START_REF] Zeka | Short term effects of particulate matter on cause specific mortality: Effects of lags and modification by city characteristics[END_REF])) which increases with productive activity. The contact rate in the SIS model2 is increased by pollution and decreased by preventive health expenditures. The health investment is chosen to maximize discounted welfare along with current consumption and investment in physical capital. Thus, the interaction between pollution and health is endogenized and depends on optimal decisions. In the model, there are two externalities. One is the pollution externality where the pollution resulting from production increases disease transmission. The second is the disease externality, i.e. a household in deciding its optimal plans does not take into account the effect of their decsions on the evolution of the infectious disease (see [START_REF] Geoffard | Rational Epidemics and Their Public Control[END_REF], [START_REF] Gersovitz | The economical control of infectious diseases[END_REF], and Goenka and Liu (2019) for modeling of disease externalities). We study the decentralized dynamic equilibrium and contrast it with the social planner's efficient outcome that internalizes both these externalities.

We show that there can be two steady states: a disease free steady state (which is essentially the neoclassical steady state) and a disease endemic steady state if in equilibrium, the disease is infective enough. As the model is complex to solve analytically we study to what extent the outcomes are affected by the externalities through numerically analyzing the model. Since there is insufficient information so far to calibrate the effect of diseases and preventive health expenditures on disease evolution we fix the other parameters and vary the elasticity of pollution on the contact rate, the elasticity of pollution abatement and the TFP to get a sense of the qualitative properties of the model. We also characterize the dynamic Pigovian taxes that will decentralize the efficient outcomes. Analogous to the first set of numerical exercises we study how the taxes will change as we vary the two elasticities and the TFP. Several interesting results emerge. First, even if there are two externalities, two instruments are insufficient to decentralize the efficient outcome since pollution affects the economy through multiple channels. Second, the subsidy on health expenditure and pollution abatement are the same even though their effects on disease transmission need not be. The intuition is that in equilibrium, the marginal benefit of pollution abatement and health expenditure are equal as they both effect the economy only through the effect on the contact rate. Third, in the efficient outcome even if there is more abatement and health expenditures and better health outcomes, pollution is higher than in the decentralized. While there is more abatement undertaken the effect of the higher output -due to increased labor supply and output mainly due to higher labor -dominates. Thus, there is no "disease dividend" from controlling the disease in controlling pollution. This is consistent with the evidence that emission levels have gone up and even exceeded pre-lockdown levels in many regions that have controlled Covid infections (see [START_REF] Myllyvirta | China's air pollution overshoots pre-crisis levels for the first time[END_REF] for study of emissions in China). Fourth, countries with higher TFP will have higher pollution as the incentive to tax capital reduces. Thus, faster growing economies will have lower incentive to control pollution. The last two implications are consistent with the evidence that the Green Recovery that was hoped after the Covid outbreak may be evanescent (see [START_REF] Harvey | Revealed Covid recovery plans threaten global climate hopes[END_REF]).

The papers most close to this paper are Bosi andDesmarchelier (2018, 2019) and Goenka and Liu (2020). These papers use SIS dynamics in a growth model and model the disease externality. While Bosi and Desmarchelier (2018) has pollution affecting disease transmission directly as the current paper, Goenka and Liu (2019) have health capital (as does Goenka, Liu and Nguyen (2014)) and a negative effect of capital stock which can be interpreted as pollution. [START_REF] Bosi | Pollution and infectious diseases[END_REF] treat pollution as a pure externality, while the Goenka and Liu (2020) also considers health interventions. [START_REF] Bosi | Pollution effects on disease transmission and economic stability[END_REF] extend their earlier paper by making utility depend on pollution and by considering abatement of pollution which is modeled as a stock rather than flow. This paper studies the effect of both pollution and health and includes health responses as well as abatement activity.

The plan of the paper is as follows. Section 2 develops the model, Section 3 analyzes the decentralized equilibria, Section 4 the centralized equilibria where the social planner internalizes the externalities, Section 5 does the numerical analysis of the steady state equilibria, Section 6 the dynamic Pigovian taxes which decentralize the planning outcomes, and Section 7 concludes.

Model

Epidemiology We use the SIS model to study the spread of the disease. While this was the most common modeling choice to model Covid-19 (see [START_REF] Ferguson | Impact of non-pharmaceutical interventions (NPIs) to reduce COVID-19 mortality and healthcare demand[END_REF] it is not well understood for how long is disease related immunity conferred for coronaviruses such as Covid-19. The evidence is preliminary, but there is emerging evidence that subsequent immunity may not be long lasting. [START_REF] Long | Clinical and immunological assessment of asymptomatic SARS-CoV-2 infections[END_REF] 2020) use an SIRS model for medium run projections. As we are concerned about the medium to longer run in this paper we abstract from the temporary immunity phase (i.e. the state R). 3 4 The key epidemiology variables are the contact rate, α, i.e. the average number of adequate contacts of a person to catch the disease per unit time and γ, the recovery rate from the disease. In this paper we endogenize α by making it depend on health expenditures and on pollution. We treat γ as exogenous to keep the model tractable. Antivirals and anti-inflammatory drugs are now known to reduce severity of the Covid illness but these are inexpensive and widely available prior to the outbreak. Goenka, Liu and Nguyen (2014) endogenize the recovery rate in a model without pollution. The proportions of susceptible and infective is given by s t = S t N t , i t = I t N t . The population growth rate is given by

dN t /dt = (b -d)N t , b ≥ 0, d ≥ 0, b -d ≥ 0.
We assume bd ≥ 0 so that the population is not declining. As s + i = 1 and ṡ + i = 0 we can describe the epidemiology dynamics by the following equation, the law of motion of the infectives:

i = αi(1 -i) -(b + γ)i.
There are two steady states in the pure-epidemiology model, the disease free steady state

(s * , i * ) = (1, 0)
and the disease endemic steady state

(s * , i * ) = b + γ α , α -(b + γ) α .
The disease free steady state always exists, and the disease endemic steady state exists only if α > (b + γ). If this inequality is satisfied, then the disease free steady state is unstable and the disease free steady state is stable, otherwise the disease free steady state is stable. There is a trans-critical bifurcation when α = (b + γ). The basic reproduction number, R 0 = α b + γ in this model.

Production and Pollution

There are many perfectly competitive firms that maximize profit by choosing physical capital, k, and labor, l, as inputs taking the real interest rate, R, and the wage rate, W , as given. The assumptions on the production function, f (k, L) are standard and as follows.

Assumption 1. The production function f (k, l) : R 2 + → R + is C 2 , homogeneous of degree one, and

1. f 1 > 0, f 11 < 0, f 2 > 0, f 22 < 0, 2. lim k t →0 f 1 = ∞, lim k t →∞ f 1 = 0 and f (0, l) = f (k, 0) = 0.
Profit maximization implies the following marginal conditions:

R = f 1 (k, 1 -i) (1) W = f 2 (k, 1 -i)
Production also results in a flow of pollution. By pollution we mean primarily PM and NO x which have been shown to affect transmission of Covid-19 (Conticini, et

)). In the decentralized economy, this is treated as an externality. The evolution of pollution is given below.

Assumption 2. The level of pollution is a function of output y and abatement q -that is, P(y, q) where P : R 2 + → R + is C 2 . We assume

• P 1 (y, q) > 0 and P 2 (y, q) < 0.

In the paper we will model both the private choice of abatement as well as the optimal amount of abatement. In the decentralized economy, the pollution level is given as:

P = P( Ȳ , q) = P( f (k, 1 -i), q), (2)
where the Ȳ denotes that the output is taken as given so that pollution is an externality.

Labor supply: We assume that the labor force (l) consists of healthy people: l = s . Then l inherits the dynamics of l = 1i. 5 We are assuming for simplicity that all infected workers do not work (see Goenka and Liu (2020) and Goenka, Liu and Nguyen (2020a) for further discussion of this assumption).

Economic epidemiology model

In this paper we endogenize the contact rate, α. As there are no special therapies for treatment of Covid-19 other than available therapies that reduce severity of the infection, we treat γ as exogenous. 6 The contact rate depends on preventive health expenditure h and pollution P. In this paper we are treating health expenditures as only a flow of expenditures that does not accumulate as opposed to a stock of capital. This is consistent with the modeling in [START_REF] Eichenbaum | The macroeconomics of epidemics[END_REF] where NPIs that reduce infections act as a tax on consumption -what we label as health expenditures or infection preventing acitivities. 7 Thus, the contact rate is the function α(h, P).

Assumption 3. The contact rate function: α(h, P) : R + → R + is a C 2 function with • α 1 (h, P) < 0 and α 2 (h, P) > 0.
Thus, in the model the only role of pollution is to increase the contact rate. Pollution, indeed, has other affects in the economy: it can create production and consumption externalities, and increase the non-infectious mortality rate. We abstract from these effects as these have been modeled in dynamic general equilibrium models and we want to concentrate on the interaction of pollution, infectious disease transmission and preventive health measures. 8Households: We assume the economy is populated by a continuum of non-atomic identical households who are the representative decision-making agents. The size of the population in each household grows over time at the rate of bd ≥ 0, where b is the birth rate and d is the death rate. We treat the demographic parameters, b and d, as exogenous and abstract from the fertility-mortality nexus. Within each household, an individual is either susceptible (healthy and not yet infected by the disease) or infective (infected and capable of transmitting it to others).

Each household is assumed to be sufficiently large so that the proportion of the household in each disease status is identical to the corresponding population proportion. Thus, within a household, the proportion of healthy individuals is s, proportion of infected individuals is i, and proportion of recovered individuals is r. Each household understands and anticipates how the disease evolves and is fully forward-looking with regard to its possible future states as well as its present situation. However, following Gersovitz and Hammer (2004) the household considers itself small relative to the population and believes that the disease status within the household does not affect the proportion of infectives in the entire population. In particular, the household takes as given the proportion of the population that is infected, denoted as Π, and thinks the probability for the healthy individuals to contract disease is αΠ, rather than αi. As a result, the disease transmission dynamics perceived by the households is now given as follows:

i = α(h, P( Ȳ , q))Π(1 -i) -γi -bi. (3)
This captures the idea that the household is small relative to the population and does not take into account the externality on disease transmission. It is competitive "disease taking" looking only at private benefits/costs and not social benefits/costs. This distinguishes the competitive model from the social optimum where this externality is taken into account. Furthermore, the household taking the level of output as given, Ȳ chooses the amount of private abatement.

There is a two-way interaction between the economy and the disease. On the one hand, diseases have direct adverse effects on the economy by reducing the labor force participation. Being infected with a disease affects the productivity of an individual. As make the simplifying assumption that an infected individual is incapacitated by the disease or that the productivity falls to zero, For each household labor supply L is given by the proportion of the healthy individuals, i.e. L = S and dynamics inherits the dynamics of (1i).

The representative household's preferences are given as:

∞ 0 e -ρt u(C)N t dt = ∞ 0 e -(ρ-b+d)t u(C)N 0 dt, (4)
where ρ is the discount factor with ρ > bd, and the initial size of household is assumed to be one. The assumptions on the felicity function are given below. We further assume there is full insurance within each household and all individuals have the same consumption irrespective of their health status. This is indeed optimal, if the household welfare aggregator is concave.

Assumption 4. The household's felicity function, u : R ++ → R is C 2 with u c > 0 and u cc < 0, jointly with the limit conditions: lim c→0 + u c = ∞ and lim c→+∞ u c = 0.

Households take the interest rate R and wage W as given, rent out physical capital K and choose how much to consume, c, how much to invest in capital, v, spend in disease prevention activities, h, and in pollution abatement, q. Thus, the budget constraint is:

C + v + h + q = Rk +W l. ( 5
)
The evolution of the capital stock is given by:

k = v + δ k -k(b -d) (6) (7)
where δ k ∈ (0, 1] is the depreciation rates of physical capital.

The equation ( 6) can be written as

k = Rk +W l -c -h -q -δ k -k(b -d)
Given Π, Ȳ , R,W the representative household maximizes the intertemporal utility. Therefore, each household solves the following maximization problem:

max {c,h,q} ∞ 0 e -(ρ-b+d)t u(C)N 0 dt (8) k = Rk +W (1 -i) -c -h -q -δ k -(b -d)k i = α(h, P( Ȳ , q))Π(1 -i) -γi -bi
The control variables are c, h, q, the state variables are k, i.

Decentralized economy

We define the competitive equilibrium in the decentralized economy. It is a standard definition with the condition that the perceived proportion of infected by households, Π is equal to the actual proportion of infected in the population, i, and Ȳ = Y .

Definition 1. A competitive equilibrium is a feasible allocation {c, k, h, q, i} and given {Π, Ȳ , R,W } 1. Households solve the maximization problem (8).

2. Firms maximize profits, given by equation (1).

3. The capital market, labor market and goods market clear.

Pollution satisfies (2) with

Ȳ = f (k, 1 -i).
5. Since each household is representative of the population, in equilibrium, Π = i.

We now characterize the dynamical system that defines the dynamic general equilibrium of the economy.

The current value Lagrangian for the optimization household problem is:

L = u(c) + λ 1 [Rk +W (1 -i) -c -h -q -δ k -(b -d)k] + λ 2 [α(h, P( Ȳ , q))Π(1 -i) -γi -bi] + µ 1 i + µ 2 h
Incorporating the equilibrium conditions

R = f 1 (k, 1 -i) W = f 2 (k, 1 -i) P = P( Ȳ , q) = P( f (k, 1 -i), q) Π = i
we can write the conditions for an equilibrium in the economy.

The equilibrium in the decentralized economy is determined by the following equations (the first order conditions and the transversality conditions to the household problem incorporating the equilibrium conditions):

k = f (k, 1 -i) -c -h -q -δ k -(b -d)k (9) i = α(h, P( f (k, 1 -i), q))i(1 -i) -γi -bi (10) u (c) = λ 1 ( 11
)
λ 1 = λ 2 α 1 (h, P( f (k, 1 -i), q))i(1 -i) (12)
λ 1 = λ 2 α 2 (h, P( f (k, 1 -i), q))P 2 ( f (k, 1 -i), q)i(1 -i) (13) λ1 = λ 1 [ρ + δ + b -d -f 1 (k, 1 -i)] (14) λ2 = ρλ 2 + λ 1 f 2 (k, 1 -i) + λ 2 [α(h, P( f (k, 1 -i), q))i + γ + b] (15)
µ 1 ≥ 0, i ≥ 0, µ 1 i = 0, µ 2 ≥ 0, h ≥ 0, µ 2 h = 0, lim t→∞ e -θt λ 1 k = lim t→∞ e -θt λ 2 i = 0.
As the economy is a neo-classical economy with a bounded capital stock and i lies in a bounded interval, the transversality conditions are satisfied, and in the subsequent discussion we suppress these.

Note that the optimization problem has non-convex constraints on the state variable i and the usual Arrow and Mangasarian condition do not apply. Goenka, Liu and Nguyen (2014) have however, shown existence and sufficiency for the SIS model and we concentrate on studying the first order conditions which will characterize the dynamical system of the economy. 9

Steady states

We know characterize the steady state competitive equilibria for the decentralized economy. As in the pure epidemiology model there are two equilibria which depend on the basic reproduction number, i.e. determined by the contact rate. However, unlike the pure epidemiology model it is endogenous depending on the abatement and disease preventive activities.

Proposition 1. There always exists a unique disease free steady state with i * = 0, h * = 0 and q * = 0. The economic variables k * and c * are determined by

f 1 (k, 1) = ρ + δ + b -d f (k, 1) = c + δ k + (b -d)k.
In the disease free steady state pollution plays no role in role the determination of equilibrium, and the economy is in the neoclassical steady state. In the disease free steady state, there is no abatement as the only effect of pollution in this model is on disease transmission. As there is no disease prevalence, there is also no health preventive expenditure. Let us call this ᾱ. If ᾱ < b + γ the disease is eradicated and the steady state is locally stable, and if ᾱ. If ᾱ > b + γ the disease free steady state is unstable.

The disease endemic steady state is a solution to the system of equations (9 -15). It will exist if when the contact rate is high enough so that s * < 1, i.e. α(h * , P * ) > b + γ or the equilibrium endogenous contact rate R * 0 > 1.

Proposition 2. There exists a disease endemic steady state where i * , k * , h * , q * and c * are determined by:

i = 1 - b + γ α(h, P( f (k, 1 -i), q)) (16)
α 1 (h, P( f (k, 1 -i), q)) = α 2 (h, P( f (k, 1 -i), q))P 2 ( f (k, 1 -i), q) (17)
f 1 (k, 1 -i) = ρ + δ + b -d (18)
-

f 2 (k, 1 -i)α 1 (h, P( f (k, 1 -i), q))i(1 -i) = ρ + α(h, P( f (k, 1 -i), q)) (19)
f (k, 1 -i) = c + h + q + δ k + (b -d)k (20)
Proof. From equation (10) i = 0, we have either i * = 0 or i * = 1 -b+γ α(h,P) . Note that this implies α(h, P)i = α(h, P) -(b + γ).

From equation ( 12) and ( 13), we have α 1 (h, P) = α 2 (h, P)P 2 (y, q).

In equilibrium the marginal benefit of health expenditure h should be the same as the marginal benefit of pollution abatement q as both health expenditure and pollution abatement only affect the economy through their impact on the contact rate α.

From λ1 = 0, we have

f 1 (k, 1 -i) = ρ + δ + b -d,
which is the standard marginal benefit of physical capital equals to its marginal cost. From λ2 = 0, we have

λ 1 f 2 (k, 1 -i) = -λ 2 ρ -λ 2 [α(h, P)i + γ + b],
which implies the marginal benefit of disease controlling (one unit of reduction in i -the proportion of the infected) equals to its marginal cost. The L.H.S of the above equation is the marginal benefit, as with one unit of reduction in the proportion of the infected i, the labor force increases by one unit and generates the marginal product f 2 (k, 1i). The R.H.S is the marginal cost of disease controlling. Note that the shadow value of the infectedλ 2 is negative. When there is one unit of reduction in the proportion of the infected, the proportion of the susceptible increases by one unit.

As there are more susceptible around, there are more infections.

Then, we substitute into equation ( 12), and we have

-f 2 (k, 1 -i)α 1 (h, P)i(1 -i) = ρ + α(h, P).
Note, that in equilibrium from ( 16) we have R * 0 > 1. Thus, in the competitive equilibrium the disease is endemic. Whether this is the case depends on not only the disease characteristics, i.e. the function α, but also the deeper economic parameters which determine whether it is in the interest of the households to take sufficient actions to bring the contact rate below the threshold. There is a tension on what will happen once the contact rate drops below 1, whether the economy will converge to a disease free steady state. It depends on whether the disease free steady state is stable or not and depends on the bifurcation when the contact rate is 1. In this paper, we focus on the difference between the private and public actions and do not investigate this issue in further depth. The paper Goenka and Liu (2013) and Goenka, Liu and Nguyen (2014) study these issues in further depth in a model without pollution in discrete time and continuous time respectively.

The Centralised Economy

In the centralized economy, the social planner takes into account both pollution externalities and disease externalities, i.e. the true law of motion for the disease and affect of output on pollution are taken into account. Therefore, the social planner solves the following maximization problem:

max {c,h,q} max {c,h,q} ∞ 0 e -(ρ-b+d)t u(C)N 0 dt k = f (k, 1 -i) -c -h -q -δ k -(b -d)k i = α(h, P( f (k, 1 -i), q))i(1 -i) -γi -bi
The equilibrium in the centralized economy is determined by the following equations (suppressing the transversality conditions):

k = f (k, 1 -i) -c -h -q -δ k -(b -d)k (21) i = α(h, P( f (k, 1 -i), q))i(1 -i) -γi -bi (22) u (c) = λ 1 ( 23
)
λ 1 = λ 2 α 1 (h, P( f (k, 1 -i), q))i(1 -i) (24)
λ 1 = λ 2 α 2 (h, P( f (k, 1 -i), q))P 2 ( f (k, 1 -i), q)i(1 -i) (25) λ1 = λ 1 [ρ + δ + b -d -f 1 (k, 1 -i)] + [-λ 2 α 2 (h, P)P 1 (y, q) f 1 (k, 1 -i)(1 -i)i] (26) λ2 = ρλ 2 + λ 1 f 2 (k, 1 -i) + λ 2 [α(h, P( f (k, 1 -i), q))i + γ + b] + +[λ 2 α 2 (h, P)P 1 (y, q) f 2 (k, 1 -i)(1 -i)i] + [-λ 2 α(h, P)(1 -i)] (27)
Note that there is an additional term in ( 26) as compared to [START_REF] Goenka | Infectious diseases and economic growth[END_REF] in the decentralized economy which arises from taking the effect of output on pollution and hence, disease transmission; and two additional terms in ( 27) as compared to (15) that arise from taking into account the effects of infections on labor supply, and hence output, pollution and disease transmission and the second which internalizes the disease externality.

Steady states

There always exists a unique disease free steady state with i * = 0, h * = 0 and q * = 0. This is exactly the same as the one in decentralized economy as it is the neoclassical steady state with h * = q * = 0.

As in the decentralized economy there is also a disease endemic steady state.

Proposition 3. There exists a disease endemic steady state where i * , k * , h * , q * and c * are determined by:

i = 1 - b + γ α(h, P( f (k, 1 -i), q)) (28)
α 1 (h, P( f (k, 1 -i), q)) = α 2 (h, P( f (k, 1 -i), q))P 2 ( f (k, 1 -i), q) (29)
f 1 (k, 1 -i) = ρ + δ + b -d + [- P 1 ( f (k, 1 -i), q) f 1 (k, 1 -i) P 2 ( f (k, 1 -i), q) ] ( 30
) -f 2 (k, 1 -i)α 1 (h, P( f (k, 1 -i), q))i(1 -i) + [α(h, P( f (k, 1 -i), q))(1 -i)] = (31) = ρ + α(h, P( f (k, 1 -i), q)) + [α 2 (h, P( f (k, 1 -i), q))P 1 ( f (k, 1 -i), q) f 2 (k, 1 -i)(1 -i)i] f (k, 1 -i) = c + h + q + δ k + (b -d)k (32)
Proof. The proof is the similar as the one in decentralized economy and thus omitted here.

Compared with the decentralized economy, there are two differences. One difference is equation [START_REF] Qin | Longitudinal survey of microbiome associated with particulate matter in a megacity[END_REF], which says the marginal social benefit of physical capital should equal to the marginal social cost. In the centralized economy, the social planner takes into account the negative externality of pollution on disease transmission, and thus there is an additional cost to physical capital investment. When physical capital increases, output increases, which leads to more pollution and higher contact rate for disease transmission. This is captured by the term [-P 1 ( f (k,1-i),q) f 1 (k,1-i)

P 2 ( f (k,1-i),q)
]. The other difference is equation [START_REF] Ripperger | Orthogonal SARS-CoV-2 serological assays enable surveillance of low-prevalence communities and reveal durable humoral immunity[END_REF], which says the marginal social benefit of disease controlling equals to the marginal social cost. In the centralized economy, there are two additional terms in equation [START_REF] Ripperger | Orthogonal SARS-CoV-2 serological assays enable surveillance of low-prevalence communities and reveal durable humoral immunity[END_REF]. When the social planner takes into account the negative externality of pollution there is additional cost of an increase in labor input or reduction in the proportion of the infected. When the proportion of the infected decreases, the proportion of the susceptible or the labor force increases, which leads to more output and pollution, and then higher contact rate for disease transmission. This is captured by the term [α 2 (h,

P( f (k, 1 -i), q))P 1 ( f (k, 1 -i), q) f 2 (k, 1 -i)(1 -i)i].
Moreover, the social planner takes into account the disease externality. That is, there is additional benefit from controlling disease, as the social planner further takes into account the behavior is going to affect the proportion of the infected. This is captured by the term α(h, P( f (k, 1i), q))(1i). Thus, compared with the decentralized economy, the centralized economy takes into account both negative pollution externalities and positive disease controlling externality. To compare the abatement and health expenditures in the centralized and decentralized economies we have to use numerical methods as the system of non-linear equations are too complex to compare directly.

Model Simulations

As the model is too complex for closed form solutions or doing comparative statics analytically, in this section, we calibrate the model and do comparative statics numerically to understand the interaction of the different components. We focus on examining the parameters where pollution can affect the disease transmission. That is, we vary the elasticity of pollution on the disease contact rate, the elasticity of pollution abatement, and the productivity in the economy. The last is important as it tries to ascertain whether more productive economies will have different responses and outcomes. The analysis here focuses on the equilibrium steady states before and after the change as we want to capture the medium to longer term effects when investment and returns to labor and capital have adjusted.

The following functional forms and parameters are chosen in line with the literature. The production function is assumed to be Cobb Douglas:

y = f (k, 1 -i) = Ak β (1 -i) 1-β with A = 1 and β = 0.36.
Physical capital depreciates at the rate δ = 0.05 and discount rate ρ = 0.055. The utility function is of the CES form U(c) = c 1-σ 1-σ and we choose σ = 1, that is, the utility function is log utility. We set the birth rate b = 3% and death rate d = 1.5%. The recovery rate is γ = 0.2.

We do not have enough empirical evidence in suggesting for functional form for contact rate function α(h, P) and pollution function P(y, q). Therefore, the contact rate function is chosen in line with the assumption on α(h, P) and large enough to generate an endemic steady state in the simulation. We assume contact rate function is a power function:

α(h) = ε 0 (h + ε 1 ) ε 2 (P + ε 3 ) ε 4 with ε 0 = 0.2, ε 1 = 0, ε 2 = -0.2, ε 3 = 0 and ε 4 = 0.2 in
the baseline specification. The pollution function is also chosen in line with the assumptions. We assume P(y, q) = φ 0 f (k, 1i)φ 1 (q + φ 2 ) φ 3 with φ 0 = 1, φ 1 = 1, φ 2 = 0 and φ 3 = 0.5 in the baseline specification.

Figure 1, 2 and 3 are the simulation results for varying the elasticity of pollution on contact rate function (ε 4 ), the elasticity of abatement on pollution (φ 3 ) and the productivity (A), respectively. The parameters are chosen such that disease endemic steady states exist for both the decentralized and centralized economy. So we can focus on how changes in those parameters change economic variables. The solid line is the decentralized economy (where the disease and pollution externalities have not been internalized). The dashed line is the centralized economy (where the disease externality and pollution externalities have been internalized). Across all the three figures, if we compare the decentralized economy with the centralized economy, the pictures are very similar. The social planner when taking the externalities into account is able to achieve lower contact rates in equilibrium with higer health expenditures. As a result, the labor force is larger and output higher. The capital stock is lower in the planning solution. While the abatement is higher in the planning solution, paradoxically pollution is also higher. This is being driven by the fact that in the planning solution, the output is higher and even thought there is greater abatement, the net effect of the higher output dominates and pollution is higher. Thus, even when the planner takes into account the deleterious effect of pollution on health outcomes, the efficient outcome has higher pollution. If an economy has higher TFP or not does not change the qualitative effects, except that a more productive economy will have better economic outcomes as well as higher pollution. The health outcomes and the abatement is not affected by a change in TFP.

In the pure epidemiology model, disease free steady state always exists, and disease endemic steady state only exists when contact rate is high enough, that is, α > b + γ or R 0 = α b+γ > 1. When there is only one disease free steady state, it is stable. When both disease free and disease endemic steady states co-exist, disease free steady state is unstable and disease endemic steady state is stable. The same applies to the economic epidemiological models here for both decentralized economy and centralized economy. The only difference is that the contact rate α or R 0 is endogenous, and thus the cut-off points of the contact rate for the existence of disease endemic steady state are different in the decentralized and centralized economies. Since the social planner takes the externalities into account, and is able to achieve lower contact rates in equilibrium, with the same parameter values it is more likely to have disease eradicated in the centralized economy. That is, the cut-off point of the contact rate parameter for the existence of disease endemic steady state in the centralized economy is higher than the one in the decentralized economy. To show this, we have chosen the recovery rate γ = 0.5 such that when we vary the contact rate parameter ε 0 from 0.01 to 0.3, there are changes in steady states in both decentralized and centralized economy. The simulation results is shown in Figure 4. We can see that the cut-off points to have disease endemic steady state is ε 0 = 0.08 for the decentralized economy and ε 0 = 0.12 for the centralized economy. When the contact rate parameter ε 0 is small enough (below 0.08) such that α < b + γ, we can see there is disease free steady state in both decentralized and centralized economy, The proportion of the infected is zero and all variables are the same in both economies. When ε 0 is between 0.08 and 0.12, that is, the contact rate rises, in the centralized economy, as α < b + γ there is only one disease free steady state, and disease endemic steady state does not exist. In contrast, in the decentralized economy, disease endemic steady state exists. 10 For the disease endemic steady state in the decentralized economy, the fraction of the infected is positive and physical capital, output and consumption are lower, compared with the centralized economy. When ε 0 is above 0.12, for both decentralized and centralized economies, as the contact rate is high enough, disease endemic steady state exists. 11

Public Policy

We study the dynamic Pigovian taxes that will decentralize the efficient competitive equilibrium. Even though there are two externalities: the disease externality and the pollution externality we need four taxes and subsidies to decentralize the efficient outcome. The reason is that these the externalities affect the economy in a complex way: pollution not only affects the contact rate, as the private abatement is not at the efficient level, but also through the change in labor supply through disease incidence the marginal product of labor. Thus, there are two wedges introduced by the pollution externality. The disease externality affects the private health expenditures. A fourth tax is needed to meet the balanced budget or self-financing nature of the tax-subsidy policy.

Thus, we introduce tax policies -capital income tax τ k and labor income tax τ l , and subsidies -health expenditure subsidy τ h and pollution abatement subsidy τ q . The decentralized economy with public polices is as the follows:

max {c,h,q} ∞ 0 e -ρt u(c)dt k = (1 -τ k )Rk + (1 -τ l )W (1 -i) -c -(1 -τ h )h -(1 -τ q )q -δ k -(b -d)k i = α(h, P( Ȳ , q))Π(1 -i) -γi -bi
Then, we incorporate equilibrium conditions, which is the same as those in decentralized economy. Moreover, there is a balance budget constraint:

τ k Rk + τ l W (1 -i) = τ h h + τ q q. ( 33
)
The equilibrium in the decentralized economy with public policies is determined by the following equations:

k = f (k, 1 -i) -c -h -q -δ k -(b -d)k i = α(h, P( f (k, 1 -i), q))i(1 -i) -γi -bi u (c) = λ 1 λ 1 = λ 2 α 1 (h, P( f (k, 1 -i), q))i(1 -i) 1 1 -τ h λ 1 = λ 2 α 2 (h, P( f (k, 1 -i), q))P 2 ( f (k, 1 -i), q)i(1 -i) 1 1 -τ q λ1 = λ 1 [ρ + δ + b -d -(1 -τ k ) f 1 (k, 1 -i)] λ2 = ρλ 2 + λ 1 (1 -τ l ) f 2 (k, 1 -i) + λ 2 [α(h, P( f (k, 1 -i), q))i + γ + b]
Proposition 4. In the decentralized economy with public policies, there exists a disease endemic steady state where i * , k * , h * , q * and c * are determined by: i

= 1 - b + γ α(h, P( f (k, 1 -i), q)) (34)
α 1 (h, P( f (k, 1 -i), q)) 1 1 -τ h = α 2 (h, P( f (k, 1 -i), q))P 2 ( f (k, 1 -i), q) 1 1 -τ q (35) (1 -τ k ) f 1 (k, 1 -i) = ρ + δ + b -d (36) - 1 -τ l 1 -τ h f 2 (k, 1 -i)α 1 (h, P( f (k, 1 -i), q))i(1 -i) = ρ + α(h, P( f (k, 1 -i), q)) (37) f (k, 1 -i) = c + h + q + δ k + (b -d)k (38)
Next, we are going to show how we design tax and subsidy policies, such that the decentralized economy can replicate the allocations from the centralized economy. If we compare equation ( 29) with [START_REF] Varotsos | Scaling properties of air pollution in Athens, Greece and Baltimore, Maryland[END_REF], it is easy to see that the subsidy for health expenditure τ h should be equal to the subsidy for pollution abatement τ q :

τ h = τ q . ( 39
)
Note that this is independent of elasticities of pollution and health expenditures on the contact rate.

Then, by comparing equation ( 30) with [START_REF] Wajnberg | Humoral immune response and prolonged PCR positivity in a cohort of 1343 SARS-CoV 2 patients in the New York City region[END_REF], we can derive capital income tax:

τ k = - P 1 ( f (k, 1 -i), q) P 2 ( f (k, 1 -i), q) . ( 40
)
Since P 1 > 0 and P 2 < 0, the capital income tax τ k > 0. If we compare equation ( 31) with (37), we get τ hτ l 1τ h = α 2 (h, P( f (k, 1i), q))P 1 ( f (k, 1i), q) f 2 (k, 1i)iα(h, P( f (k, 1i), q)) f 2 (k, 1i)α 1 (h, P( f (k, 1i), q))i .

Thus, we have the following proposition.

Proposition 5. The tax and subsidy policies (τ k , τ l , τ h , τ q ) are determined by equation ( 33), ( 39), ( 40) and [START_REF] Yongjian | Association between short-term exposure to air pollution and Covid-19 infection: Evidence from China[END_REF], where the economic variables i, k, h, q and c are the equilibrium allocations from the centralized economy.

To understand the taxes and subsidies we do a similar exercise as in the previous section of varying the elasticity of pollution, the elasticity of abatement and the TFP. Interestingly, for each of the exercises, the subsidy on health and abatement decrease and the primary mechanisms are the direct taxes on labor and capital income. The effect of increasing elasticity of pollution and contact rate and on abatement rate is different. As elasticity of pollution on contact rate increases, the capital income is taxed at a higher rate and labor income at a lower rate. However, when elasticity of abatement increases, i.e. abatement is more effective, capital income is taxed at a lower rate but to maintain budget balance, labor income taxes are increased. As TFP increases,

Conclusion

This paper studies the interaction of pollution with transmission of diseases. In a decentralized economy there is the pollution externality and a disease transmission externality. As one would expect, the level of abatement of pollution and preventive health expenditures are lower than the centralized situation where the externalities are internalized. While the centralized outcomes can be decentralized through dynamic Pigovian taxes, with higher productivity the level of pollution in fact goes up in the efficient outcome. The control of the disease interacts with higher productivity, and even though more is spent on abatement, the net effect is that pollution goes up. This is consistent with the recent evidence where during lockdown as mobility and activity declined, so did pollution levels. However, this was temporary and since then pollution levels have gone up [START_REF] Kumari | Impact of lockdown on air quality over major cities across the globe during COVID-19 pandemic[END_REF]). Thus, expectation of a Green Recovery may be illusory.

  using data from China find evidence consistent with steep decline in 2-3 months. Similar results were found in Ibarrando, et al. (2020), Isho, et al. (2020), Riperger, et al. (2020), Ward, et al. (2020). On the other hand Wajnberg, et al. (2020) and Sekine, et al. (2020) find evidence suggesting longer immunity. As a modeling stategy Kissler, et al. (

  al. (2020), Martelleti and Martelleti (2020), Setti, et al. (2020), Qin, et al. (2020), Wu, et al. (2020), and Yongjian, et al. (2020)) and increase other infections such as acute lower respiratory infections including pneumonia, bronchitis and influenza (Cienciwicki and Jaspers (2007), Horne, et al. (2018), Huang, et al. (2016), Kampa and Castanas (2008), Kelly and Fussell (2011), Lian, et al. (2014), Mehta, et al. (2013), Tasci, et al. (2018)). We treat this as a flow, i.e. it does not accumulate, as evidence suggests that it does not accumulate (Varotsos et al. (2005), Windsor and Toumi (2001), Zeka et al. (

Figure 1 .

 1 Figure 1. The simulation results -varying the elasticity of pollution on contact rate

Figure 2 .

 2 Figure 2. The simulation results -varying the elasticity of abatement on pollution

Figure 3 .

 3 Figure 3. The simulation results -varying productivity

Figure 4 .

 4 Figure 4. The simulation results -disease free and disease endemic steady states

Figure 5 .

 5 Figure 5. Tax and subsidy policies -varying the elasticity of pollution on contact rate

Figure 6 .

 6 Figure 6. Tax and subsidy policies -varying the elasticity of abatement on pollution

Figure 7 .

 7 Figure 7. Tax and subsidy policies -varying productivity

  . The population (N t ) is divided in two classes: susceptible, healthy and who can catch the disease (S t ) and infective, those infected and capable of transmitting the disease (I t ). with S t + I t = N t .dS t /dt = bN t -dS t -αS t I t /N t dI t /dt = αS t I t /N t -γI t -dI t S t , I t , N t ≥ 0, ∀t; S 0 , I 0 , N 0 > 0 with N 0 = S 0 + I 0 ,where b is the exogenous birth rate, d is exogenous death rate, we assume that d ≤ b. One of the features of Covid-19 is disease related mortality. The case fatality rate (CFR) is estimated to be around 1.4%, i.e. the percentage of the individuals who are known to be infected die from the disease. This has deep implications for thinking about the control of Covid-19. Our paper studies the trade-offs between controlling pollution and disease prevention and in this we abstract from it. See Goenka, Liu and Nguyen (2020a) on modeling mortality in a SIS model without pollution.

Pollution also increases incidence non-communicable diseases such as asthma, COPD, and other respiratory diseases as well cardiovascular diseasese. SeeGoenka, et al. (2020) for dynamic models studying nexus of pollution and non-communicable diseases but this is not the focus of this paper.

[START_REF] Bosi | Pollution effects on disease transmission and economic stability[END_REF] This modeling choice is discussed in detail in the following section

This is also consistent with many of the other infectious diseases that are the main sources of disease related mortality, in particular malaria, tuberculosis, dengue, and influenza also do not have disease related immunity. While an individual may have immunity to a particular strain of influenza for a short period, the virus mutates and there is no lasting immunity. HIV/AIDS is a disease of SI class and its epidemiology is not captured by either SIS or SIR models.

Goenka, Liu and Nguyen (2020b) model the effect of disease mortality in a SIR model.

We take labor supply by the healthy workers as inelastic. If labor supply is elastic then under standard assumption of preferences u(c, l) > 0 the qualitative features of the model are not affected. (see[START_REF] Goenka | Infectious diseases and endogenous fluctuations[END_REF] for a SIS model with elastic labor supply. If we drop this assumption then labor supply can be an independent source of non-linear dynamics and cycles.

[START_REF] Goenka | Infectious diseases and economic growth[END_REF] we modelled γ as a function of h.

Bosi and Desmarchellier (2018) have α(P), Goenka, Liu and Nguyen (2014) model this as α(h), Goenka and Liu (2019) have α(h, k, e) where k, h, e are stocks of physical, health and human capital in an endogenous growth model.

[START_REF] Goenka | Pollution, mortality and time consistent abatement taxes[END_REF] study optimal policies when pollution increases mortality through noncommunicable diseases.

The sufficiency conditions have been extended to account for mortality in Goenka, Liu and Nguyen (2020a) and for the SIR model with mortality in Goenka, Liu and Nguyen (2020b).

Note that there is also disease free steady state (not shown in the figure).

Note that there is also disease free steady state (not shown in the figure).

* Manh-Hung Nguyen acknowledges support from ANR under grant ANR-17-EURE-0010 (Investissements d'Avenir program). We thank participants at the Economic Modelling Workshop especially Angus Chu,