Jan Petr

Jean-Christophe Ferré

Elise Bannier

Hélène Raoult

Jean-Yves Gauvrit

Christian Barillot

CONSTRUCTION AND EVALUATION OF A QUANTITATIVE ARTERIAL SPIN LABELING BRAIN PERFUSION TEMPLATE AT 3T

Keywords: arterial spin labeling, MRI, partial volume, functional MRI, atlases

Arterial spin labeling (ASL) allows non-invasive imaging and quantification of brain perfusion by magnetically labeling blood in the brain-feeding arteries. ASL has been used to study cerebrovascular diseases, brain tumors and neurodegenerative disorders as well as for functional imaging. The use of a perfusion template could be of great interest to study inter-subject regional variation of perfusion and to perform automatic detection of individual perfusion abnormalities. However, low spatial resolution and partial volume effects (PVE) issues inherent to ASL acquisitions remain to be solved. The purpose of this study is to enhance the template quality by using DARTEL non-rigid registration and by correcting for PVE. PICORE-Q2TIPS ASL datasets were acquired on 25 healthy volunteers at 3T. Four methods of creating the template were evaluated using leave-one-out cross correlation. Subsequently, these methods were applied to hyper-perfusion detection on functional ASL data of 8 healthy volunteers and compared with the standard generalized linear model (GLM) activation detection.

INTRODUCTION

ASL is a completely non-invasive MRI method that measures brain perfusion by magnetically labeling blood in brainfeeding arteries. The labeled blood goes through the vascular system reaching the imaged slice where it exchanges with the tissue contributing to tissue magnetization. A standard echoplanar imaging (EPI) dataset (labeled image) is acquired at time TI (inversion time) after the labeling. A second EPI acquisition (control image) is repeated without any labeling RF pulse. The difference between labeled and control images reflects tissue perfusion [START_REF] Parkes | Quantitative MRI of the brain: Measuring changes caused by disease, chapter ASL: Blood perfusion measurements using arterial spin labelling[END_REF].

Being non-invasive, ASL is especially well adapted for repetitive acquisitions and for studies on healthy volunteers [START_REF] Parkes | Quantitative MRI of the brain: Measuring changes caused by disease, chapter ASL: Blood perfusion measurements using arterial spin labelling[END_REF]. The drawback of ASL is its low signal to noise ratio. The difference between labeled and control images generally lies between 1% and 2% of the control image magnitude. A single control/label subtraction is therefore not sufficient to assess perfusion and around 20 to 40 pairs of images usually need to be acquired to obtain reasonable signal-to-noise-ratio (SNR). At 1.5T, the random noise affects reproducibility of measurements more than within-subject variability [START_REF] Jahng | Human brain: Reliability and reproducibility of pulsed arterial spin-labeling perfusion mr imaging[END_REF]. The situation is improved using 32-channel coil at 3T. Nevertheless in order to obtain sufficient SNR in a practical acquisition time, the resolution in ASL images is kept low with pixel sizes between 3 × 3 and 4 × 4mm 2 and slice thickness between 5 and 8mm. Besides, ASL signal comes mainly from the gray matter tissue (GM). White matter (WM) perfusion is on average 3 times smaller than GM perfusion.The images are therefore severely affected by partial volume effects (PVE).

These low spatial resolution and partial volume effects are the main issues when creating a multi-subject template. The purpose of this study is three-fold:

• First, to assess the ability of DARTEL registration [START_REF] Ashburner | A fast diffeomorphic image registration algorithm[END_REF] to improve template quality as compared to standard SPM normalization to the ICBM template; • Second, to evaluate the use of a partial volume correction algorithm to separate GM and WM contributions to perfusion by using the T1 GM/WM segmentation [START_REF] Asllani | Regression algorithm correcting for partial volume effects in arterial spin labeling MRI[END_REF] and thus increase perfusion image resolution; • Third, show a possible application for the template by detecting zones of hyper-perfusion. The results are evaluated using leave-one-out cross-correlation to measure the difference between the perfusion image and its approximation using the template. The hyper-perfusion detection using the template is then tested on 8 additional functional ASL scans of healthy volunteers and compared with the standard GLM model.

METHODS

Image acquisition

Twenty five healthy volunteers gave written informed consent to be enrolled in this study (11 males, 14 females, mean age 31.6±8.3, median age 29, age range: 23-53). Data acquisitions were performed on a 3T whole-body MRI scanner (Magnetom Verio, Siemens, Erlangen, Germany) using a 32channel head coil. An anatomical 3D T1-weighted scan was performed using the following sequence parameters: field of view 256 × 256mm 2 , acquisition matrix 256 × 256, 160 sagittal slabs, voxel size 1 × 1 × 1mm 3 , TR/TE 1900/2.98ms, flip angle 9 • in an acquisition time of 4min 26s.

Multi-slice PASL acquisitions were performed using a PI-CORE Q2TIPS sequence. Nine slices were acquired with a 7mm slice thickness and an inter-slice gap of 0.7mm. The third slice was aligned with the AC-PC plane. The PICORE labeling slab of 100mm was positioned 29.5mm below the lowest imaged slice. Sixty one labeled and control images were acquired in an interleaved fashion using a single EPI sequence, with a 192 × 192mm 2 FOV, 64 × 64 acquisition matrix, 3 × 3 × 7mm 3 voxel size, a TR/TE of 3000/25ms and a flip angle of 90 • . Crusher gradients were used to reduce intravascular signal with speed exceeding 4cm/s [START_REF] Ye | Correction for vascular artifacts in cerebral blood flow values measured by using arterial spin tagging techniques[END_REF]. Q2TIPS saturation pulse (700ms onset time, 800ms duration) was used to define the duration of the label in order for the quantification to be less sensitive to variations of blood arrival time over the whole brain [START_REF] Luh | QUIPSS II with thin-slice TI1 periodic saturation: a method for improving accuracy of quantitative perfusion imaging using pulsed arterial spin labeling[END_REF]. The inversion time (TI) between the labeling pulse and the beginning of the readout was 1700ms for all subjects. The acquisition time was 3min 6s.

The sequence parameters for the functional ASL were similar to the ones described above, apart from the number of slices ( 8) and the TE (18ms). Using a block-design experiment, seven alternating 30s-phases of rest and right hand motor tasks were recorded. The first 3 images accounting for signal stabilization were discarded in the processing. The acquisition lasted 7min 12s to acquire 143 control and labeled images.

Preprocessing

Image processing was performed using MATLAB (Math-Works,Natick, MA) and the SPM8 Toolbox [START_REF]SPM[END_REF]. Motion correction of the control and labeled images was performed to compensate for unintentional subject movements using a six-parameter 3D rigid registration. All control and labeled images were aligned to the first control image using a sum-of-square-differences cost function. The mean control image was then co-registered with the T1-weighted image of the same subject by the means of a 3D rigid-body registration with normalized mutual-information cost function and NEWUOA optimization [START_REF] Wiest-Daesslé | Evaluation of a new optimisation algorithm for rigid registration of MRI data[END_REF]. The inhomogeneity bias in the T1 images was corrected and the images were segmented to GM, WM and cerebro-spinal fluid (CSF) regions. The GM and WM partial-volume percentages for each pixel of the ASL images were calculated using this high-resolution tissue segmentation.

Perfusion quantification

A standard kinetic model [START_REF] Buxton | A general kinetic model for quantitative perfusion imaging with arterial spin labeling[END_REF] was used to quantify the perfusion from the measured data. The values of perfusion f in ml/g min are given by

f = 3 λ ∆ M e T I/T1a M T 0 T I w (1)
where λ is the blood brain partition coefficient (λ = 0.98), ∆M is the measured mean control-label subtraction in each pixel, T 1a is the T 1 of blood (T 1a = 1664ms), T I w is the width of the bolus (T I w = 700ms), T I is the inversion time (T I = 1700ms), and M T 0 is the control-image value [START_REF] Pfeuffer | Comparison of pulsed arterial spin labeling encoding schemes and absolute perfusion quantification[END_REF].

Spatial normalization

The GM/WM segmentation of each T1 image was used to align the T1 images to the ICBM-152 template [START_REF] Mazziotta | A probablistic atlas of the human brain: Theory and rationale for its development[END_REF] using the standard spatial normalization from the SPM8 toolbox [START_REF]SPM[END_REF].

There are several registration methods available all providing high precision results. Since our goal was not to compare them, we chose DARTEL registration for its convenient and public-available implementation. DARTEL registration was used to further increase the precision of the inter-subject co-registration [START_REF] Ashburner | A fast diffeomorphic image registration algorithm[END_REF]. This method takes all the segmented T1 images and aligns them to their mean GM/WM image. Then it iteratively recreates the GM/WM template and realigns the image of each subject to the template. The joint ASL/T1 and T1/template transformation was used to spatially normalize all the ASL images.

Partial volume correction

The measured value of perfusion ∆M (r) in pixel r is assumed equal to [START_REF] Asllani | Regression algorithm correcting for partial volume effects in arterial spin labeling MRI[END_REF] ∆M (r) = P GM (r)∆M GM (r

) + P W M (r)∆M W M (r), (2)
where P GM and P W M are volume fractions of GM and WM; and ∆M GM and ∆M W M are the values of tissue-specific perfusion.

According to Asllani et al [START_REF] Asllani | Regression algorithm correcting for partial volume effects in arterial spin labeling MRI[END_REF], the real tissue perfusion ∆M GM and ∆M W M can be assumed constant on a 3 × 3 pixel neighborhood. The perfusion values in each pixel are obtained by solving a system of 9 linear equations in the least-square sense. The partial volume corrected values obtained for GM and WM perfusion are then combined with the high-resolution segmentation yielding high-resolution perfusion maps. The drawback of this method is that the perfusion maps ∆ GM , ∆ W M are inherently smoothed by a 3 × 3 average filter. To overcome this limitation we used the method [START_REF] Petr | Denoising arterial spin labeling MRI using tissue partial volume[END_REF] that solves the Eq. 2 while minimizing the total variation of ∆M GM and ∆M W M .

Template evaluation framework

Four methods of template construction were evaluated. The templates were created as a mean of the 25 perfusion images after pre-processing, spatial normalization and partial volume correction:

• Template 1: perfusion images were spatially normalized to the ICBM template; They appear more clearly in e) and f). In c) and d), there are several artifacts in the posterior part of the brain that are not apparent on the anatomical images. They were propagated by interpolation from the adjacent slices. The partial volume correction methods remove these artifacts as can be seen in e) and f).

• Template 2: perfusion images were spatially normalized to the DARTEL template; • Template 3: DARTEL normalization and simple partial volume correction [START_REF] Asllani | Regression algorithm correcting for partial volume effects in arterial spin labeling MRI[END_REF]; • Template 4: DARTEL normalization and partial volume correction using total variation [START_REF] Petr | Denoising arterial spin labeling MRI using tissue partial volume[END_REF]. The values in each perfusion image were normalized by dividing by the mean perfusion in pixels with GM partial volume exceeding 70%. To assess the quality of the four templates they were inversely transformed to align them with the perfusion image of each subject. For each subject, the corresponding perfusion image was excluded from the template and only the 24 remaining subjects were used. The mean squared difference between the template and the perfusion image was calculated.

Functional ASL processing

The SPM software [START_REF]SPM[END_REF] was used to detect task related activated areas using the standard GLM model with convolution with the canonical HRF and statistical significance p < 0.001. Regions corresponding to primary motor and supplementary motor cortex were manually selected. For each subject, the activated ASL images were created by averaging only those images acquired during the phases of activity. This average activated image was aligned with the perfusion template and hyper-perfused areas were extracted by comparison with the template (p < 0.001). The same method was applied to assess the zones of hyper-perfusion on the set of 25 volunteers.

RESULTS

The qualitative comparison of the templates (Figure 1) shows blurred structures in the first template. The registration is improved by using the DARTEL registration with template 2. However there is still significant spatial blurring due to the interpolation of the low resolution ASL data. The partial volume correction compensates for this as shown on templates 3 and 4, where regions with different perfusion are much better delimited. The Figure 2 shows the low-resolution perfusion images of the first subject and the corresponding approximation using the template. Slight improvement of the GM structures is visible when using PVE correction with the total variation [START_REF] Petr | Denoising arterial spin labeling MRI using tissue partial volume[END_REF] over the standard correction [START_REF] Asllani | Regression algorithm correcting for partial volume effects in arterial spin labeling MRI[END_REF]. Confirming qualitative observations, mean template SNR are 12.3 dB, 13.6 dB, 13.9 dB and 14.4 dB for template 1 to 4 respectively, as shown on Figure 3. The ratio of false detection of hyper-perfusion using the template measured on the 25 resting subjects was below 1% for all four templates. The group results with functional ASL show that the comparison enables to detect for templates 1 to 4, respectively 81.6%, 84.4%, 86.4%, 87% of the ground-truth primary motor cortex region obtained by standard GLM analysis. Percentages for the supplementary motor cortex were respectively 74.4%, 76.2%, 80.3% and 79.9%. In one subject, the supplementary motor cortex was not detected using the GLM model and this datasets was not taken into account (see Figure 4).

DISCUSSION AND CONCLUSIONS

This study demonstrates how non-rigid registration and partial volume correction can be used to improve the quality of a brain perfusion template. We have shown that using prior knowledge on the perfusion spatial distribution does increase both visual quality and template precision. The use of a template on the functional ASL data proves that DARTEL registration and partial volume correction increase the ratio of hyper-perfusion zones detected. There are two hypothesis why the standard functional analysis produces slightly larger activation regions. First, the SPM method smooths the data with FWHM 6mm Gaussian kernel which can possibly enlarge the detected zones. Although it should be noted that recent developments in fMRI enable the analysis of spatially unsmoothed data. Secondly, the data analyzed using SPM contains both resting and activated phases where only the activated phase was compared to the template. Future work will focus on further increasing the quality of the perfusion template by using a more sophisticated method for intensity normalization.

Fig. 1 .

 1 Fig. 1. a) T1 image of the first subject. b) Mean GM segmentation of all subjects. c) -f) Perfusion templates 1-4. The GM structures are distinctly blurred in d) and especially in c).They appear more clearly in e) and f). In c) and d), there are several artifacts in the posterior part of the brain that are not apparent on the anatomical images. They were propagated by interpolation from the adjacent slices. The partial volume correction methods remove these artifacts as can be seen in e) and f).

Fig. 2 .

 2 Fig. 2. a) Perfusion image of the first subject. b)-e) Templates 1-4 co-registered with the image a) and subsampled to the same resolution. In the first two templates, we can observe structures that are not in a) (marked by the white box in a)). These artifacts are caused by the low resolution of the ASL images and propagation of structures from adjacent slices by interpolation.

Fig. 3 .Fig. 4 .

 34 Fig. 3. Template/individual subject difference in SNR.


MD Sönke ; Detlefsen
email: s.detlefsen@gmx.net

Jan Hinrich Bräsen

Giuseppe Zamboni

Paola Capelli

Günter Klöppel

Deposition of complement C3c, IgG4 and IgG at the basement membrane of pancreatic ducts and acini in autoimmune pancreatitis

Keywords: Autoimmune pancreatitis, IgG4, granulocytic epithelial lesions (GELs), immune complex, complement C3 Autoimmune pancreatitis, IgG4, granulocytic epithelial lesions (GELs), complement C3, immune complex, immunopathology AIP, autoimmune pancreatitis, BM, basement membrane, CK7, cytokeratin 7, FITC, fluorescein isothyocyanate, GELs, granulocytic epithelial lesions, HPF, high power field, IF, immunofluorescence

INTRODUCTION

Autoimmune pancreatitis (AIP) is a special type of chronic pancreatitis whose clinical, serological and histological features suggest that immune mechanisms are involved in its pathogenesis. Histologically, lymphoplasmacytic infiltrates focusing on pancreatic ducts and acini are the most prominent feature of AIP. [START_REF] Detlefsen | Autoimmune pancreatitis: expression and cellular source of profibrotic cytokines and their receptors[END_REF][START_REF] Klöppel | Fibrosis of the pancreas: the initial tissue damage and the resulting pattern[END_REF][START_REF] Klöppel | Autoimmune pancreatitis: histo-and immunopathological features[END_REF][START_REF] Weber | Lymphoplasmacytic sclerosing pancreatitis: inflammatory mimic of pancreatic carcinoma[END_REF][START_REF] Zamboni | Histopathological features of diagnostic and relevance in autoimmune pancreatitis: a study on 53 resection specimens and 9 biopsy specimens[END_REF][START_REF] Kojima | Autoimmune pancreatitis: frequency, IgG4 expression, and clonality of T and B cells[END_REF] Immunohistochemically, there is usually a predominance of CD4-positive Th1 cells over Th2 cells [START_REF] Okazaki | pancreatitis is associated with autoantibodies and a Th1/Th2-type cellular immune response[END_REF] and the expression of HLA-DR on pancreatic epithelial cells. [START_REF] Ectors | Non-alcoholic duct destructive chronic pancreatitis[END_REF] AIP patients in Japan show a particular HLA two-loci haplotype, DRB1*0405-DQB1*0401. [START_REF] Kawa | HLA DRB10405-DQB10401 haplotype is associated with autoimmune pancreatitis in the Japanese population[END_REF] Moreover, autoimmune antibodies such as antinuclear antibody (ANA), anti-lactoferrin (ALF) and anti-carbonic anhydrase II (ACA-II) [START_REF] Okazaki | pancreatitis is associated with autoantibodies and a Th1/Th2-type cellular immune response[END_REF] have been observed serologically in AIP patients.

In 2001, Hamano et al. reported that IgG4 serum levels were markedly elevated in patients with AIP. [START_REF] Hamano | High serum IgG4 concentrations in patients with sclerosing pancreatitis[END_REF] Subsequently, Kamisawa and coworkers observed a diffuse infiltration of IgG4-positive plasma cells not only in the pancreas of AIP patients, but also in other organs and proposed the existence of a new clinicopathological entity of IgG4-related sclerosing disease that included autoimmune pancreatitis, retroperitoneal fibrosis, sclerosing sialadenitis and sclerosing cholangitis. [START_REF] Kamisawa | Close relationship between autoimmune pancreatitis and multifocal fibrosclerosis[END_REF][START_REF] Kamisawa | IgG4-related sclerosing disease incorporating sclerosing pancreatitis, cholangitis, sialadenitis and retroperitoneal fibrosis with lymphadenopathy[END_REF] Finally, tubulointerstitial nephritis, sometimes forming pseudotumors, membranous nephropathy and IgG4-related diffuse pulmonary inflammatory nodules were added to the spectrum of IgG4-related disorders. [START_REF] Cornell | Pseudotumors due to IgG4 immunecomplex tubulointerstitial nephritis associated with autoimmune pancreatocentric disease[END_REF][START_REF] Deshpande | Autoimmune pancreatitis: a systemic immune complex mediated disease[END_REF][START_REF] Hirano | High-rate pulmonary involvement in autoimmune pancreatitis[END_REF][START_REF] Imai | IgG subclasses in patients with membranoproliferative glomerulonephritis, membranous nephropathy, and lupus nephritis[END_REF][START_REF] Saeki | nephritis associated with IgG4related systemic disease[END_REF][START_REF] Saeki | Membranous nephropathy associated with IgG4-related systemic disease and without autoimmune pancreatitis[END_REF][START_REF] Takeda | IgG4-associated idiopathic tubulointerstitial nephritis complicating autoimmune pancreatitis[END_REF][START_REF] Tsushima | Pulmonary involvement of autoimmune pancreatitis[END_REF] The pathogenic role of IgG4 in the IgG4-related disease complex is so far unknown.

Renal biopsy specimens from AIP patients with tubulointerstitial nephritis revealed that granular deposits at the tubular basement membranes (BMs) contain IgG4. [START_REF] Deshpande | Autoimmune pancreatitis: a systemic immune complex mediated disease[END_REF] Pancreatic tissue that was examined in the same study also showed electron dense granular deposits at basal membrane structures, although neither the affected tissue components nor the biochemical composition of the deposits were clarified. [START_REF] Deshpande | Autoimmune pancreatitis: a systemic immune complex mediated disease[END_REF] In a subsequent study, Deshpande's group identified not only IgG4 in the deposits at the renal tubular BMs but also complement C3, and occasionally IgG1, IgG2 and IgG3. [START_REF] Cornell | Pseudotumors due to IgG4 immunecomplex tubulointerstitial nephritis associated with autoimmune pancreatocentric disease[END_REF] Recently, it was reported that 6/10 patients with hypocomplementemia of unknown aetiology had elevated serum-IgG4 levels, [START_REF] Saeki | Hypocomplementemia of unknown etiology: an opportunity to find cases of IgG4-positive multi-organ lymphoproliferative syndrome[END_REF] and, conversely, that of 28 patients with IgG4-related systemic disease nine had hypocomplementaemia and 15 increased serum levels of circulating immune complexes. [START_REF] Yamamoto | Proteomics analysis in 28 patients with systemic IgG4-related plasmacytic syndrome[END_REF] Interestingly, Aoki and colleagues reported data indicating that there are tissue-specific IgG4 autoantibodies in the sera of patients with AIP. 23 They demonstrated that epithelial cells of the pancreas, bile duct, salivary gland and stomach in tissue specimens obtained from patients without an autoimmune disease stained positive for IgG4 after incubation with the sera of AIP Because the above data suggest that AIP may be a systemic immune complexmediated disease related to the expression of IgG4, our study attempted to identify IgG4positive immune complexes in pancreatic tissue specimens from AIP patients. We therefore performed double immunofluorescence microscopy for C3c, IgG4 and IgG combined with cytokeratin 7 (CK7), trypsin, collagen IV, CD31 and CD79a and immunofluorescence microscopy for C1q, IgA and IgM in frozen pancreatic tissue from six patients with the clinical and morphological diagnosis of AIP and in one patient with IgG4-positive sclerosing cholangitis as extrapancreatic manifestation of AIP. A comparison of the results with those from seven patients with alcoholic chronic pancreatitis (ACP) revealed that the findings were specific to AIP patients.

MATERIALS AND METHODS

Patients and tissues

In the archives and the consultation files of the Departments of Pathology of the University Hospital Schleswig-Holstein, Campus Kiel, Germany, and the University of Verona, Italy, 88 pancreatic resection specimens with a postoperative diagnosis of AIP were identified in the period between 1987 and 2009. Snap-frozen tissue and paraffin-embedded formalin-fixed tissue blocks were obtained from surgical specimens from six patients (three men and three women; mean age 64.5 years; range 49 to 76 years), who had undergone pancreaticoduodenectomy between 2000 and 2009 and presented with a mass-forming lesion located in the head of the pancreas. Additional frozen and paraffin-embedded tissues were obtained from a cholecystectomy and extrahepatic bile duct resection specimen from a 63year-old male patient with jaundice. All patients were treated surgically because of suspected pancreatic or bile duct cancer. The well established criteria for the morphological diagnosis of this disease, [START_REF] Weber | Lymphoplasmacytic sclerosing pancreatitis: inflammatory mimic of pancreatic carcinoma[END_REF][START_REF] Zamboni | Histopathological features of diagnostic and relevance in autoimmune pancreatitis: a study on 53 resection specimens and 9 biopsy specimens[END_REF][START_REF] Chari | A diagnostic strategy to distinguish autoimmune pancreatitis from pancreatic cancer[END_REF][START_REF] Notohara | Idiopathic chronic pancreatitis with periductal lymphoplasmacytic infiltration: clinicopathologic features of 35 cases[END_REF] which are included in both the first version of the HISORt criteria and the proposal for revised HISORt criteria (Mayo Clinic, Rochester, USA) for the diagnosis of AIP, were used. [START_REF] Chari | A diagnostic strategy to distinguish autoimmune pancreatitis from pancreatic cancer[END_REF][START_REF] Chari | of autoimmune pancreatitis: the Mayo Clinic experience[END_REF] Histopathological examination of the resected tissue revealed AIP in six patients. In 5/6 patients there were increased numbers (>20 per HPF) of IgG4-positive plasma cells infiltrating the pancreatic tissue. The sixth patient with AIP who showed granulocytic epithelial lesions (GELs) had only very few (<2 per HPF) IgG4-positive plasma cells. The For comparison with the AIP tissues, snap-frozen tissue and paraffin-embedded formalin-fixed tissue blocks from pancreatic resection specimens from seven patients (four women and three men; mean age 50.4 years; range 37 to 64 years) whose pancreatic changes fulfilled the morphological criteria for the diagnosis of alcoholic chronic pancreatitis (ACP) and who had a history of chronic alcohol abuse were examined. [START_REF] Detlefsen | Fibrogenesis in alcoholic chronic pancreatitis: the role of tissue necrosis, macrophages, myofibroblasts and cytokines[END_REF][START_REF] Etemad | Chronic pancreatitis: diagnosis, classification, and new genetic developments[END_REF][START_REF] Homma | Diagnostic criteria for chronic pancreatitis by the Japan Pancreas Society[END_REF][START_REF] Klöppel | The morphological basis for the evolution of acute pancreatitis into chronic pancreatitis[END_REF][START_REF] Klöppel | Progression from acute to chronic pancreatitis. A pathologist's view[END_REF] These patients were all treated by pancreaticoduodenectomy between 1999 and 2009 because of intractable pain, jaundice and/or suspected pancreatic cancer. In addition, a snap-frozen tissue block containing normal pancreatic tissue was obtained from a left-sided pancreatic resection specimen, which was removed together with the stomach and spleen in a case of advanced gastric cancer.

Histology and immunohistochemistry

The sections from the paraffin blocks were stained with hematoxylin & eosin. In addition, one section per AIP case was immunostained for IgG4 using a monoclonal mouse antibody (The Binding Site, Birmingham, UK, clone HP6025, 1:100) and the EnVision staining technique (Dako A/S, Glostrup, Denmark). The sections were first pretreated for antigen demasking by boiling in citrate-buffered saline for 3.5 min. Endogenous phosphatase activity was blocked with 1 mM levamisole in the substrate solution. Normal tonsillar tissue as well as autoimmune pancreatitis tissue served as controls.

Immunofluorescence microscopy

On 7 µm thick sections of snap frozen tissues from the seven AIP patients, the seven ACP patients and the normal pancreatic specimen, immunofluorescence microscopy for C1q, C3c, IgA, IgG, IgG4 and IgM and immunofluorescence double staining for C3c, IgG and IgG4 together with CK7, trypsin, collagen IV, CD31 and CD79a were performed. After cutting, the sections were air dried for 30 min and fixed in cold acetone for 10 min. They were rinsed twice for 5 min in phosphate-buffered saline at pH 7. The intensity of the immunofluorescence signal was scored as 0 if there was no immunoreactivity at the BM of ducts and acini; 1 if there was focal and weak immunoreactivity; 2 if the immunoreactivity was focal and strong; 3 if it was diffuse and weak; and 4 if it was diffuse and strong.

Statistical analysis

The nonparametric Mann-Whitney U test was used for intergroup differences. P values of <0.05 were considered significant. All statistical tests were performed using SPSS 10.0 for Windows (SPSS Inc., Chicago, IL, USA).

RESULTS

Clinical follow-up of the AIP patients

During follow-up (mean follow-up period 33 months, range 5 to 96 months), 2/6 AIP patients developed other immune-related disorders. One had asthma (see also Table 1), and the second patient had both Crohn's disease in the ileum and psoriatic arthritis, for the latter of which he was treated with methotrexate. Serum-IgG4 levels were measured in three AIP patients and proved to be elevated in 2/3 (i.e. above 140 mg/dL). In the third patient in whom IgG4 was

Histology and immunohistochemistry

Histologically, intense lymphoplasmacytic infiltration, particularly around medium-sized ducts, was observed in the tissues of all six AIP patients from whom pancreatic tissue was available (Figure 1A and Table 1). In five of these six AIP patients a dense infiltration with IgG4-positive plasma cells in the pancreatic tissue (>20 IgG4 positive plasma cells per high power field (HPF)) was observed (Figure 1C and Table 1). Granulocytic epithelial lesions (GELs) of the pancreas [START_REF] Zamboni | Histopathological features of diagnostic and relevance in autoimmune pancreatitis: a study on 53 resection specimens and 9 biopsy specimens[END_REF] were only detected in the AIP patient who lacked strong infiltration with IgG4-positive plasma cells (Figure 1D and Table 1). In the patient with IgG4-positive sclerosing cholangitis, dense infiltration with IgG4-positive plasma cells was found in the wall of the extrahepatic bile duct (Figure 1B). All cases showed moderate to severe fibrosis and venulitis. The pancreatic tissues from the seven patients with ACP displayed predominantly interlobular fibrosis of varying extent (Table 2). Moreover, they had irregularly dilated ducts with protein plugs and/or calculi, areas of fat tissue necrosis in resorption, pseudocysts and sparse aggregates of lymphocytes and some macrophages.

Diffuse and/or periductal lymphoplasmacytic infiltration and GELs were lacking.

Immunofluorescence microscopy

Table 1 summarizes the clinical and pathological findings in the AIP patients together with the scored intensity of the immunofluorescence signals. Granular deposits of complement C3c and granular and linear deposits of IgG4 (in addition to IgG4-positive plasma cells) were detected at the base of interlobular and intralobular pancreatic duct cells labelled by cytokeratin 7, and focally also along the base of acini labelled by trypsin in all and 5/6 AIP patients, respectively (Figure 2 and3). The patient with IgG4-positive sclerosing cholangitis had granular C3c-and granular/linear IgG4-positive deposits in the BM area of the peribiliary tubular glands in the wall of the extrahepatic bile duct. Figure 4 IgA, IgM or C1q consistently failed to label BM areas in the pancreatic tissues. C1q and IgM positivity, however, was observed in the wall of blood vessels in all pancreatic tissues and in some fibrotic foci in the pancreas of AIP and ACP patients. In addition, there were scattered IgA-and IgM-positive plasma cells in the AIP and ACP specimens.

DISCUSSION

Since Hamano demonstrated in 2001 that AIP is associated with changes in the serum levels of IgG4 10 and Kamisawa described an IgG4-related disease complex affecting not only the pancreas but a number of other organs, the pathogenetic significance of IgG4 in AIP has been intensively discussed. [START_REF] Kamisawa | IgG4-related sclerosing disease incorporating sclerosing pancreatitis, cholangitis, sialadenitis and retroperitoneal fibrosis with lymphadenopathy[END_REF][START_REF] Kamisawa | Autoimmune pancreatitis: proposal of IgG4-related sclerosing disease[END_REF] Using double immunofluorescence microscopy for the identification of C3c, IgG4 and IgG together with CK7 (ductal cells), trypsin (acinar cells), collagen IV (BMs), CD31 (endothelium of vessels) or CD79a (B-lymphocytes/plasma cells), we determined that tissue from the pancreas of our five IgG4-positive AIP patients and the extrahepatic bile duct of our IgG4-positive sclerosing cholangitis patient contained deposits of complement C3c, IgG4 and IgG (but not C1q, IgA and IgM), which colocalized with BMassociated collagen IV of ducts and acini. This suggests that IgG4 may be bound to immune complexes deposited at structures that are heavily involved in and altered by the fibroinflammatory process characterizing AIP and the commonly associated IgG4-positive sclerosing cholangitis. A clear limitation of this study is the small number of patients examined. This is due to the fact that the immunofluorescence study performed required snap frozen tissue from resected pancreas specimens, which was only available in a few patients of our series of 88 cases. However, since the results are rather uniform in our patients, we believe that our data may contribute to our understanding of the pathogenesis of AIP. The study revealed the deposition of C3c, IgG4 and IgG at BMs that stained for collagen IV, one of the main components of BMs. These findings were present in all tissue specimens from five patients with IgG4-positive AIP and one patient with AIP-related IgG4-positive sclerosing cholangitis of the extrahepatic bile duct. Of these patients, those in whom serum-IgG4 levels were measured also had elevated IgG4 serum levels. The data proved to be specific to AIP, since no BM deposition of IgG4 and IgG and only weak immunofluorescence signals (in 3/7 ACP patients) for C3c were found at the BM in the pancreatic tissues from seven patients with ACP or in normal pancreatic tissue. Pancreatic resection specimens from ACP patients were chosen as control tissue because ACP represents the most common type of chronic pancreatitis in the Western world.

The C3c-positive immunofluorescence signals identified granular deposits, which are typical for complement as a component of immune complexes. The IgG4-positive signals formed a mixed granular-linear pattern, as was also observed for IgG. These deposits were densest along the interlobular pancreatic ducts and the ducts of the accessory glands in the mucosa-submucosa of the extrahepatic bile duct. In cases that also showed intense involvement of the acinar tissue by inflammation and fibrosis, the deposition of C3c, IgG4 and IgG was also pronounced at this site.

The massive deposition of C3c in AIP tissue coincides with the recently reported hypocomplementemia observed in a number of patients with IgG4-positive AIP. [START_REF] Saeki | Membranous nephropathy associated with IgG4-related systemic disease and without autoimmune pancreatitis[END_REF][START_REF] Saeki | Hypocomplementemia of unknown etiology: an opportunity to find cases of IgG4-positive multi-organ lymphoproliferative syndrome[END_REF][START_REF] Yamamoto | Proteomics analysis in 28 patients with systemic IgG4-related plasmacytic syndrome[END_REF] Since increased concentrations of circulating immune complexes were also found in AIP patients, [START_REF] Saeki | Membranous nephropathy associated with IgG4-related systemic disease and without autoimmune pancreatitis[END_REF][START_REF] Saeki | Hypocomplementemia of unknown etiology: an opportunity to find cases of IgG4-positive multi-organ lymphoproliferative syndrome[END_REF][START_REF] Yamamoto | Proteomics analysis in 28 patients with systemic IgG4-related plasmacytic syndrome[END_REF] it seems that C3c-containing IgG4-positive immune complexes are deposited at the BMs of organs involved in IgG4-related sclerosing disease. The duct changes and the loss of acinar tissue in association with intense lymphoplasmacytic infiltration and fibrosis in AIP suggest that these structures are particularly involved in immune complex-mediated damage to pancreatic tissue. However, both the exact interactions between IgG4 and complement and the role of the IgG4-and C3c-positive deposits in the ongoing inflammatory tissue alterations are still unclear. IgG4 is the only subclass of human IgG that is unable to activate complement by the classical pathway. However, in mice it has been shown that non-complement activating [START_REF] Murata | Synergistic deposition of C4d by complementactivating and non-activating antibodies in cardiac transplants[END_REF] Moreover, IgG4 has the tendency to interact with other immunoglobulins such as the rheumatoid factor [START_REF] Zack | Localization of an Fc-binding reactivity to the constant region of human IgG4. Implications for the pathogenesis of arthritis[END_REF] and reveals an intrinsic affinity for IgG when coated to a solid phase . [START_REF] Rispens | Human IgG4 binds to IgG4 and conformationally altered IgG1 via Fc-Fc interactions[END_REF] These findings suggest that, if IgG4 is not only a bystander in the immune process along the BMs of pancreatic ducts and acini, it might use non-classical pathways for complement activation.

It is also still unclear toward which antigen the immunoglobulins in the deposits along the BMs of pancreatic ducts and acini are directed. Lactoferrin, carbonic anhydrase II and trypsinogen have been discussed as antigens, because these proteins characterize the specialized secretory epithelium that is involved in AIP and other AIP-associated diseases, such as IgG4-positive sclerosing cholangitis, sclerosing sialadenitis or tubulointerstitial nephritis. [START_REF] Okazaki | pancreatitis is associated with autoantibodies and a Th1/Th2-type cellular immune response[END_REF] Furthermore, neonatal mice have been shown to develop histopathological features of AIP after thymectomy and immunization with lactoferrin and carbonic anhydrase II. [START_REF] Uchida | Experimental immune-mediated pancreatitis in neonatally thymectomized mice immunized with carbonic anhydrase II and lactoferrin[END_REF] In a recent proteomic analysis, an yet unidentified 13.1 kDa protein was detected that may represent an antigen playing a pathogenic role in the development of IgG4-related systemic disease. [START_REF] Yamamoto | Proteomics analysis in 28 patients with systemic IgG4-related plasmacytic syndrome[END_REF] Moreover, Aoki et al. reported that epithelial cells of the pancreas, bile duct, salivary gland and stomach in tissue specimens obtained from patients without an autoimmune disease stained positive for IgG4 after incubation with the sera of AIP patients. 23 Recently Frulloni et al. identified in 94% of AIP patients but only in 5% of pancreatic cancer patients IgG antibodies to a plasminogen-binding protein (PBP) that is homologous to the human ubiquitin-protein ligase E3 component n-recognin 2 (UBR2), which is expressed in pancreatic acinar cells. [START_REF] Frulloni | Identification of a novel antibody associated with autoimmune pancreatitis[END_REF] However, all the potential antigens mentioned reside in the cytoplasm of pancreatic cells and are not associated with the BMs where we found the deposits of C3c, IgG4 and IgG. This implies that these antigens might only be secondarily involved in the AIP immune process, as it is directed toward still unknown antigens in pancreatic BMs. Alternatively, the BM deposits might be a secondary phenomenon to an immune process in which the primary event and immune reaction remain to be identified.

Our study included one patient whose clinical features were indistinguishable from those of the other AIP patients of our series and who, in addition to the histopathological features of AIP, showed changes of the ducts and acini that have been called GELs (i.e. granulocytic epithelial lesions). [START_REF] Zamboni | Histopathological features of diagnostic and relevance in autoimmune pancreatitis: a study on 53 resection specimens and 9 biopsy specimens[END_REF] Furthermore, the number of IgG4-positive plasma cells was very low in the lymphoplasmacytic infiltrate, compared to that of the other AIP patients of our series, in which it was increased. Also the serum-level of IgG4 was in the normal range. Due 11 to these criteria, this patient can be classified as belonging to a subgroup which has recently been called AIP type 2, [START_REF] Chari | The diagnosis of autoimmune pancreatitis: a Western perspective[END_REF][START_REF] Park | Recent advances in autoimmune pancreatitis[END_REF] and which has been separated from the more common type 1 AIP showing high serum and tissue IgG4-positivity and GEL-negativity. [START_REF] Zamboni | Histopathological features of diagnostic and relevance in autoimmune pancreatitis: a study on 53 resection specimens and 9 biopsy specimens[END_REF][START_REF] Notohara | Idiopathic chronic pancreatitis with periductal lymphoplasmacytic infiltration: clinicopathologic features of 35 cases[END_REF][START_REF] Zhang | IgG4-positive plasma cell in the diagnosis of autoimmune pancreatitis[END_REF][START_REF] Detlefsen | Diagnosis of autoimmune pancreatitis by core needle biopsy: application of six microscopic criteria[END_REF] Interestingly, this patient failed to show any IgG4-positive deposits associated with the BMs of the ducts and acini, but remained positive for deposits of C3c and IgG. If this so far unique finding is confirmed in future studies, it would imply that in type 2 AIP the pathomechanisms leading to the changes in the ducts and acini and the development of are independent of the effects of IgG4. This again raises the question as to whether plays a primary and active role in the pathogenesis of AIP or whether it represents a secondary phenomenon.

In conclusion, our study shows that the deposition of C3c, IgG4 and IgG in association with the BMs of ducts and acini of the pancreas appears to be a feature of the immunopathology of AIP. Because the ducts and acini represent the main targets of the inflammatory tissue damage in AIP, these findings suggest that the C3c-, IgG4-and IgGpositive deposits may be involved in the pathogenesis of the disease, although their significance is still unclear and needs to be elucidated. We are grateful for your positive evaluation of our manuscript and the valuable critique of the reviewers.

Attached please find the revised manuscript that we would like to resubmit. All changes that were made are marked in red. Besides, some small changes in the spelling and wording were made, but these are not marked in red.

Our point-by-point response to the comments of the two reviewers is as follows:

Referee: 1 Point 1: "It is accepted that the alcoholic pancreatitis group was a well defined clinical group. Would it have been possible to include other types of pancreatitis? Perhaps the authors could explain why they only included alcoholic pancreatitis in their control group."

On page 9, at the end of paragraph 1, we have added an explanation why pancreatic tissues from patients with alcoholic chronic pancreatitis were chosen as control material. Point 3: "A few US spellings are used. These need to be altered (e.g., "etiology" on page 3)."

We changed a few US spellings to British spelling.

Point 4: "Some minor typographical errors are present, e.g., misplaced full stops on page 10. "

We apologize for the typographical errors and hope to have eliminated all of them in the revised manuscript.

Referee: 2 Point 1: "In the 'Abstract', the authors describe findings of previous work on IgG4-related interstitial nephritis within the 'Aims' section. However, the fact that this is previous work and not work from the current study needs to be made clear, with improved wording."

We have improved the wording in the introduction of the abstract, making it clear that we refer to work of others. We have left the wording of the sentence of the bottom of page 4 unchanged, since we think it reads better then the proposal by referee two.

We hope that our changes meet your expectations.

Besides, I wish to state that (a) the work is original; (b) the work has not been, and will not be published, in whole, or in part, in any other journal; (c) and all the authors have agreed to the contents of the manuscript in its submitted form.

Kind regards, sincerely yours, Sönke Detlefsen

  However, Aoki et al. also concluded that yet no AIP-specific antigens have been identified.

  diagnosed with IgG4-positive (>20 IgG4-positive plasma cells per HPF) sclerosing cholangitis as extrapancreatic manifestation of AIP.

3 .

 3 The sections were then incubated with 100 µl of the fluorescein isothyocyanate (FITC)-conjugated polyclonal rabbit antibody directed against C1q (Dako A/S, F0254, working dilution 1:20), C3c (Dako A/S, F0201, working dilution 1:80), IgA (Dako A/S, F0204, working dilution 1:30), IgG (Dako A/S, F0202, working dilution 1:30) and IgM (Dako A/S, F0203, working dilution 1:20) for 60 min at room temperature and subsequently rinsed in phosphate-buffered saline for 10 min in the was detected indirectly, using the monoclonal mouse antibody mentioned above, followed by incubation for 30 min in the dark with donkey Fab fragment anti-mouse IgG antibody conjugated with Cy 2 (Dianova, Hamburg, Germany, Code 715-226-150, diluted 1:100).For the immunofluorescence double stainings, the incubation with the FITCconjugated antibodies to C3c and IgG and the incubation with the antibody to IgG4 followed by incubation with the Cy 2-conjugated anti-mouse IgG antibody was preceded by incubation with mouse antibodies to CK7 (Medac, Hamburg, Germany, clone OV-TL12/30, working dilution 1:50)), collagen IV (Medac, Hamburg, Germany, clone PHM-12+CIV22, working dilution 1:50), CD31 (Dako A/S, clone JC70A, working dilution 1:50), CD79a (Dako A/S, clone JCB117, working dilution 1:50), or trypsin (Ventrex Laboratories, Portland, OR, USA, working dilution 1:100). These slides were afterwards incubated with anti-mouse donkey IgG antibodies conjugated with Alexa 555 (Invitrogen, Karlsruhe, Germany, A-31570, 1:50) in the dark for 30 min and then rinsed in phosphate-buffered saline for 10 min. All slides were mounted with Vectashield Hard Set Mounting Medium with DAPI (Vector Laboratories, Burlingame, USA (H -1500)).

  level was in the normal range. This was the patient who lacked strong infiltration with IgG4-positive plasma cells (see below) and instead showed granulocytic epithelial lesions (GELs) in the pancreatic tissue. One patient was treated with steroids prior to surgery but showed only a partial response. No malignant disease was diagnosed in any of the patients.

  illustrates the colocalization of C3c and IgG4 with collagen IV (representing the main type of collagen in BMs) in the BM area of small pancreatic ducts and acini. IgG-positive deposits were observed in all examined They were distributed diffusely and in the wall of vessels. However, weak IgG-positivity in the BM areas of pancreatic ducts was only detected in AIP patients, including the patient with GELs (Figure5D-F). This patient had also granular deposits of C3c in the BM area of ducts and acini (Figure5A-C).Table2summarizes the clinical and pathological findings in the ACP patients together with the scored intensity of the immunofluorescence signals. Of the ACP patients only three displayed a few weakly C3c-positive deposits in the BM areas. In the remaining ACP patients and in the normal pancreatic tissue, weak C3c-positivity was only observed in the wall of blood vessels. The difference in the IF scores for the deposition of C3c at the BM in AIP versus ACP was statistically significant (p<0.005). None of the non-AIP pancreatic tissues showed any IgG4 deposits associated with epithelial cells or plasma cells. In these tissues, staining was only observed in the wall of blood vessels. Similarly, IgG-positivity was lacking in the BM areas of pancreatic ducts of non-AIP tissues. The difference in the IF scores for the depositions of IgG4 and IgG in AIP versus ACP was statistically significant (p<0.005).

5

 5

  may synergize with other IgG subclasses to activate complement through the lectin pathway.

Figure 1 .

 1 Figure 1. Histopathology of the pancreas and the extrahepatic bile duct in patients with autoimmune pancreatitis: A, Pancreatic tissue showing periductal and diffuse lymphoplasmacytic infiltration (hematoxylin and eosin, original magnification x 50). B, Bile duct mucosa with lymphoplasmacytic infiltration (hematoxylin and eosin, original magnification x 50). C, Periductal lymphoplasmacytic infiltration with many IgG4-positive plasma cells (original magnification x 200). D, Pancreatic duct with granulocytic epithelial lesion (GEL) (hematoxylin and eosin, original magnification x 200).

Figure 2 .

 2 Figure 2. immunofluorescence microscopy in an AIP patient showing granular deposits of complement C3c surrounding a CK7-labelled medium-sized pancreatic duct (A-C, original magnification x 1000), a CK7-labelled small pancreatic duct (D-F, original magnification x 1000), and a group of acini labelled by trypsin (G-I, original magnification x 1000).

Figure 3 .

 3 Figure 3. Double immunofluorescence microscopy in A-C, an AIP patient with infiltration of IgG4-positive plasma cells showing granular deposits of IgG4 surrounding a small CK7labelled pancreatic duct (original magnification x 1000), and D-F, a patient diagnosed with IgG4-positive sclerosing cholangitis showing deposits of IgG4 surrounding CK7-labelled peribiliary tubular glands in the wall of the extrahepatic bile duct (original magnification x 1000).

Figure 4 .

 4 Figure 4. Double immunofluorescence microscopy in an AIP patient with infiltration of IgG4-positive plasma cells showing colocalization of granular deposits of C3c (A-C, original magnification x 1000) or IgG4 (D-F, magnification x 400) with collagen IV labelled basement membranes of small pancreatic ducts and acini.

Figure 5 .

 5 Figure 5. Double immunofluorescence microscopy in an AIP patient without IgG4-positive plasma cells showing granular deposits of complement C3c (A-C, original magnification x 400) or IgG (D-F, original magnification x 1000) surrounding small pancreatic ducts labelled by CK7.

  membrane; F, female; IF, immunofluorescence; M, male.

  www.ouh.dk HISTOP-01-10-0046 -"Deposition of complement C3c, IgG and IgG4 at the basement membrane of pancreatic ducts and acini in autoimmune pancreatitis" Dear Professor Wells,

Point 2 :

 2 "The pictures are clear and illustrate the findings well. In the abstract it is stated that "......IgG and IgG4 were deposited at the collagen IV positive basement membrane of small and medium-sized pancreatic and bile ducts and also of acini." It is accepted that the IgG4 may be present along the BM, assuming that subepithelial localisation indicates BM deposition. However, double staining for IgG4 and basement membrane antigens is not recorded or shown. Was it done? Again the text of the results section concludes that there was BM localisation of IgG4. The evidence that IgG4 is indeed present in the BM or, specifically, in the collagen IV positive basement membrane, should perhaps be discussed in a little more detail. Similarly, the methods and results section might elaborate on the way in which the basement membrane was identified. Is subepithelial localisation a completely reliable guide? Unless there is stronger evidence that the IgG4 is localised in the collagen IV positive BM, a more cautious statement may be appropriate, particularly in the abstract."We have added a new series of illustrations (Figure4D-F in the revised manuscript), showing the colocalization of C3c and IgG4 with BM-associated collagen IV in AIP. Figure 3G-I of the original manuscript (showing already the colocalization of C3c with collagen IV) is now labelled Figure 4A-C, and Figure 4 of the original manuscript is labelled Figure 5.

Point 2 :

 2 "In the 'Patients and Methods', it could be made slightly clearer at the bottom of page 4 if the seventh patient was described with a phrase such as 'In addition, a seventh patient was included, diagnosed with ....', or similar wording."

Table 2 .

 2 Clinical and pathological data on seven patients with alcoholic chronic pancreatitis.

	Histological features	Score of IF of BM deposits

Published on behalf of the British Division of the International Academy of Pathology Histopathology

Published on behalf of the British Division of the International Academy Pathology Histopathology

ACKNOWLEDGEMENTS

We thank Professor Bence Sipos for contributing tissue specimens for this study, and Professor Torben Steiniche for making some of the technical equipment available. Moreover, we are grateful to Tanja Engel and Maike Pacena for their excellent technical assistance and to Kay Dege for editing the manuscript. This work was supported by a grant from the Health Research Fund of Central Denmark Region.


Jérémy Parriaux
email: jeremy.parriaux@esstin.uhp-nancy.fr

Philippe Guillot
email: philippe.guillot@univ-paris8.fr

Gilles Millérioux
email: gilles.millerioux@esstin.uhp-nancy.fr

A Spectral Approach for Characterizing the Self-Synchronization of Stream Ciphers

This paper addresses the problem of characterizing the functions that can be used in the design of self-synchronizing stream ciphers. We propose a general framework based on a spectral characterization through the Walsh transform. Two modes of self-synchronization are discussed: the finite time one and the statistical one.

Introduction

Stream ciphers are cryptosystems specifically devoted to the transmission of data streams over public channels. The basic principle can be described as follows. At the transmitter side, the ciphertext is carried out by adding a plaintext symbol with a symbol of a pseudorandom stream. At the receiver side, the decryption consists in subtracting the ciphertext symbol with a symbol of, again, a pseudorandom stream. Proper decryption is achieved provided that the pseudorandom streams generated at the transmitter and receiver sides are the same. In other words, the pseudorandom generators have to be synchronized. There are two ways to ensure the synchronization. The first one is to use an external protocol in order to initialize the two generators with the same seed. The protocol must also be able to resynchronize the generators if the synchronization is lost. The resulting ciphers are known as synchronous stream ciphers. The second method relies on systems for which synchronization is due to a structural property. The corresponding ciphers are called self-synchronizing stream ciphers (SSSC for short). The absence of synchronization protocol makes them particularly appealing when high throughputs are required. As it turns out, very few works have paid attention to them. Let us mention [START_REF] Daemen | Cipher and Hash function design, strategies based on linear and differential cryptanalysis[END_REF][START_REF] Joux | Chosen-ciphertext attacks against mosquito. Fast Software Encryption[END_REF] for an exception. This work aims at characterizing new functions which can be involved in self-synchronizing stream ciphers. The interest of enlarging the class of candidates functions lies in that they can potentially lead to systems of reduced size or with better cryptographic properties than the existing ones. The characterization is performed in the spectral domain and thereby allows to connect the results to the usual cryptographic criteria.

The outline of this paper is the following: Section 2 is devoted to the problem statement. Section 3 recalls the usual material devoted to spectral analysis and Boolean functions. Section 4 deals with the spectral characterization of the self-synchronizing property and is the core of the paper. Section 5 investigates the reachability of the states in terms of probability law. Finally, Section 6 is devoted to an illustrative example.

Problem Statement

Let us first introduce the notations. The two elements field is denoted F 2 . The plaintext symbol to be ciphered at time t ∈ N is m t ∈ F 2 , the corresponding ciphertext is c t ∈ F 2 and the corresponding recovered plaintext is m t ∈ F 2 . In stream-ciphers, the ciphertext c t is obtained from the plaintext m t by adding a random symbol z t ∈ F 2 . The original message m t is recovered by subtracting the symbol z t ∈ F 2 from the ciphertext c t . In the canonical representation of a self-synchronizing stream cipher, the random symbols z t and z t are generated using the same keyed function g θ : F n 2 -→ F 2 whose arguments are a finite sequence of some past ciphertexts, namely c t-1 , . . . , c t-n . The parameter θ is the key of the system. The decryption is properly performed, that is m t = m t , whenever z t = z t . It is guaranteed if both the cipher and the decipher have the same key and if the ciphertexts c t-1 , . . . , c t-n are properly transmitted. The equations of the canonical form of self-synchronizing stream ciphers are

z t = g θ (c t-1 , . . . , c t-n ) c t = m t + z t (Cipher equation) (1)
z t = g θ (c t-1 , . . . , c t-n ) m t = c t -z t (Decipher equation) (2)
The canonical form admits an equivalent recursive form involving an internal state x ∈ F n 2 which is an n-dimensional Boolean vector. Its value at time t is x t = (c t-1 , . . . , c t-n ). Its i th coordinate is denoted (x t ) i . The corresponding block diagram is depicted in Figure 1. The equations read

   (x t+1 ) i = (x t ) i-1 if i > 0, c t if i = 0 z t = g θ (x t ) c t = m t + z t (Cipher equation) (3)
   ( x t+1 ) i = ( x t ) i-1 if i > 0, c t if i = 0 z t = g θ ( x t ) m t = c t -z t (Decipher equation) (4)
g θ ⊕ ct mt zt n ct-n • • • ct-1 x k g θ ct mt zt n ct-1 • • • ct-n x k
Fig. 1: Canonical recursive form of self-synchronizing stream ciphers

The canonical recursive form (3)-( 4) is directly obtained from the canonical form (1)-( 2). The state updating transformation is a mere shift register fed with the previous ciphertexts. Thus, the initial state is eliminated in a shift-like way and all the complexity of the system lies in the function g θ . More interesting schemes are obtained when considering a keyed state updating transformation f θ : F 2 × F n 2 -→ F n 2 more complex than a shift. In this situation, the shift next state function and the output function g θ are replaced by a function f θ and an output function h θ : F n 2 -→ F 2 . This setup is referred to as the generalized recursive form and its block diagram is depicted in Figure 2. The corresponding equations are

   x t+1 = f θ (c t , x t ) z t = h θ (x t ) c t = m t + z t (Cipher equation) (5)    x t+1 = f θ (c t , x t ) z t = h θ ( x t ) m t = c t -z t (Decipher equation) (6)
In order to guarantee the self-synchronization property of the system, the function f θ cannot be chosen arbitrarily. It must have the property that, after a fixed number, denoted t c , of iterations, the pseudorandom symbols z t and z t are equal for all t > t c . In the general case, this is achieved if and only if the current state of the decipher is equal to the current state of the cipher, x t = x t regardless of the initial states x 0 and x 0 . Clearly, given the system described by ( 5)-( 6), the self-synchronization can be studied by focusing exclusively on the function f θ . Besides, the fact that this recursive form is more general than a mere shift, it allows to relax the constraint that the synchronization is achieved within a finite amount of time. That leads to so-called statistical self-synchronizing stream ciphers. They will be detailed and motivated later on in this paper. This paper does not intend to study how the key θ is involved in the system. Therefore, for simplification purposes and hereafter, the subscript θ will be omitted, the parameterization with the key of the functions will be implicit. In the sequel, a function from the vector space F n 2 to F 2 will be referred to as a (n)-function. We will call a (n, m)-function a function from the vector space F n 2 to the vector space F m 2 . Indeed, a (n, m)-function f is nothing but a m-dimensional vector where each coordinate is a (n)-function. The j th coordinate is denoted by f j and named the coordinate function. We recall a definition introduced by Klimov and Shamir in [START_REF] Klimov | A new class of invertible mappings[END_REF].

Definition 1 (T -function).

A (n, n)-function is called a T-function if the coordinate function f j depends only on the variables x i with i = 0, . . . , j. [START_REF] Klimov | A new class of invertible mappings[END_REF]. We however prefer not to use this name because it might be confusing in some situations.

Having a look at the literature, it can be noticed that, so far, all the self-synchronizing stream ciphers use the same principle in order to guarantee that the current state at time t no longer depends on the initial state, that is to guarantee the self-synchronization. The state updating function is such that its coordinate functions depend on the bits of the internal state with strictly lower indexes than their own index. In other words, the state updating function is based on strict T -functions.

The main purpose of this paper is to pinpoint more general classes of functions which guarantee the self-synchronization property besides the strict T -functions. Self-synchronization properties are addressed from a spectral point of view as motivated in the introduction.

Preliminaries

This section introduces a formal definition of self-synchronization and then recalls the strict necessary prerequisites on spectral analysis of Boolean functions from which our results will be derived.

Self-synchronization

Let us first formally define some self-synchronization related notions. In the paper, (c) is a sequence of the ciphertexts c 0 , . . . , c t for some discrete time t, they are generated by [START_REF] Carlet | Boolean Models and Methods in Mathematics, Computer Science, and Engineering, chapter Vectorial Boolean Functions for Cryptography[END_REF]. Thus, the length of the sequence at time t is t + 1 and according to (5), c 0 is only a function of the initial state x 0 , they are related by c 0 = h(x 0 ). Definition 3 (Self-synchronizing sequence). A sequence (c) is self-synchronizing for the next state (n + 1, n)-function f of the system (5)-( 6) if there exists an integer t c so that for all initial states x 0 ∈ F n 2 and

x 0 ∈ F n 2 ∀t ≥ t c , x t = x t (7)
Definition 4 (Finite time self-synchronization). The system (5)-( 6) is finite time selfsynchronizing if the minimum value t c is upper bounded for all possible sequences (c). The upper bound t c is called the self-synchronization delay of f . Remark 2. Finite time self-synchronization means that there is an integer t c such that any sequence of length at least t c is a self-synchronizing sequence. The synchronization delay depends on the pair of initial states x 0 and x 0 . The delay t c is defined as the maximum delay over all initial state pairs. Definition 5 (Finite time self-synchronizing function). A (n + 1, n)-function f is called finite time self-synchronizing function if, when used as a next state function in the system (5)-( 6), the resulting system is finite time self-synchronizing.

Spectral Analysis

The rest of this section recalls the basics about Boolean spectral analysis. If f is a (n)-function, we denote by f its Fourier transform, which is by definition the real valued mapping

F n 2 -→ R defined, for any u ∈ F n 2 , by f (u) = x∈F n 2 f (x)(-1) x•u (8)
where

x • u = x 0 u 0 + • • • + x n-1 u n-1 .
This transform is invertible and the inverse is given by:

f = 2 n f (9)
Let us recall Parseval's theorem (see [START_REF] Carlet | Boolean Models and Methods in Mathematics, Computer Science, and Engineering, chapter Boolean Functions for Cryptography and Error-Correcting Codes[END_REF]):

Theorem 1 (Parseval's theorem). For any Boolean function f : F n 2 -→ F 2 , the following relation holds:

u∈F n 2 f (u) 2 = 2 n x∈F n 2 f (x) 2 (10)
When dealing with Boolean functions, we rather resort to the Walsh transform which gets nicer properties than the Fourier transform in most cases. The Walsh transform of a Boolean function f is the Fourier transform of its sign function f χ where

f χ = (-1) f (x) = 1 -2f (x) that is, f χ (u) = x∈F n 2 (-1) f (x)+x•u (11)
As shown in [START_REF] Carlet | Boolean Models and Methods in Mathematics, Computer Science, and Engineering, chapter Boolean Functions for Cryptography and Error-Correcting Codes[END_REF], the correspondence between the Fourier and Walsh transforms is given by

∀u ∈ F n 2 , f χ (u) = 2 n δ 0 (u) -2 f (u), (12)
where δ 0 (u) is the Kronecker symbol. It is equal to 1 if u is the n-dimensional zero vector and equals to 0 elsewhere. The Walsh matrix of any (n, m)-function is the 2 m × 2 n dimensional matrix

W f = w f u,v
so that (see [START_REF] Carlet | Boolean Models and Methods in Mathematics, Computer Science, and Engineering, chapter Vectorial Boolean Functions for Cryptography[END_REF]):

∀u ∈ F m 2 , ∀v ∈ F n 2 , w f u,v = x∈F n 2 (-1) u•f (x)+v•x (13)
The row u ∈ F m 2 of the matrix W f is the Walsh transform of the linear combinations of the coordinates of f defined by x -→ u • f (x). The coefficients of the Walsh matrix of a function is called the spectrum of that function.

N.B. Matrices indexes may be without ambiguity either an integer or a binary vector being the binary expansion of this integer. An interesting property relates the Walsh matrices of composed functions.

Proposition 1 (see [START_REF] Carlet | Boolean Models and Methods in Mathematics, Computer Science, and Engineering, chapter Vectorial Boolean Functions for Cryptography[END_REF]). If f is a (n, m)-function and g is a (p, n)-function then

W f •g = 1 2 n W f × W g (14)
After these necessary preliminaries, we are now in a position to characterizing the selfsynchronization property from a spectral point of view.

Spectral Characterization of the Self-Synchronization Property

In this section, we focus on characterizing the self-synchronizing property of the system (5)- [START_REF] Radjavi | Simultaneous Triangularization[END_REF]. As motivated earlier, we can exclusively focus on the next-state function f . It is a (n + 1, n)function. Let us denote by f 0 (respectively f 1 ) the (n, n)-function which is the restriction of f to the input bit c t = 0 (respectively to c t = 1). The function f can be written as

f (c t , x t ) = f 0 (x t ) if c t = 0 f 1 (x t ) if c t = 1 (15)
For our purpose, we must define the function φ t , the t th order iterated function of f . It is the (n + t + 1, n)-function defined by

φ t (c, x 0 ) = f ct • • • • • f c 0 (x 0 ) for t > 0
with φ 0 = f . For a prescribed ciphertext sequence (c) of length t + 1 and an initial state x 0 , the function φ t delivers the value of the internal state at time t + 1.

In this section, we characterize the self-synchronizing property in terms of Walsh coefficients. We first focus on self-synchronizing sequences and then apply their properties to address the finite time and statistical self-synchronization issues of the system ( 5)-( 6).

Self-synchronizing sequences

Let us denote by φ c t (x) the (n, n)-function which is the restriction of φ t (c, x) to the specific sequence (c) of length t + 1.

Proposition 2. The sequence (c) is self-synchronizing if and only if the Walsh matrix of φ c t is a 2 n × 2 n Walsh matrix of the form

W φ c t =      2 n 0 • • • 0 ±2 n 0 • • • 0 . . . . . . . . . ±2 n 0 • • • 0      (16)
Proof. By definition, if (c) is a self-synchronizing sequence, φ c t (x) does not depend on x thus, φ c t is a constant function. And yet, any linear combination of the coordinate functions of φ c t is also a constant function. It turns out that any row of ( 16) is the Walsh transform of a constant function. The converse can be derived by using the inverse Fourier transform formula [START_REF] Bajic | Statistical analysis of search for set of sequences in random and framed data[END_REF].

The matrix W φ c t can easily be determined from the knowledge of the Walsh matrices of f 0 and f 1 . Proposition 3. The expression of the Walsh matrix W φ c t is

W φ c t = 1 2 n•t W f c t × • • • × W f c 0 (17)
Proof. The proof is a direct consequence of Proposition 1.

In the following, we use these results to derive some characteristics of the Walsh matrices of the functions that have the self-synchronization property.

Finite Time Self-Synchronization

Let us first notice some important features of Walsh matrices. In the sequel, we consider W as a square Walsh matrix of dimension q × q with q = 2 n .

W =      q 0 • • • 0 w 1,0 w 1,1 • • • w 1,q-1 . . . . . . . . . w q-1,0 w q-1,1 • • • w q-1,q-1      (18)
The matrix W can be rewritten

W = A + N with A =      q 0 • • • 0 w 1,0 0 • • • 0 . . . . . . . . . w q-1,0 0 • • • 0      N =      0 0 • • • 0 0 w 1,1 • • • w 1,q-1 . . . . . . . . . 0 w q-1,1 • • • w q-1,q-1     
A matrix is said to be of type A if the only non zero coefficients are located on the first column.

A matrix is said to be of type N if all the coefficients of the first row and first column are zero.

It is straightforward to verify the following remark:

Remark 3.
the product of any two matrices of type A is a matrix of type A; the product of any matrix of type A with any matrix of type N is a zero matrix; the product of any matrix of type of N with any matrix of type A is a matrix of the type A; the product of any two matrices of type N is a matrix of type N .

Proposition 4. Consider a Boolean sequence (c) of length t + 1 and the Walsh matrices of the two (n, n)-functions f 0 and f 1 :

W f 0 = A f 0 + N f 0 and W f 1 = A f 1 + N f 1 . The product W = W f c t × • • • × W f c 0 is of type A if and only if the matrix N f c t × • • • × N f c 0 is null. Proof. W = W f c t × • • • × W f c 0 = (A f c t + N f c t ) × • • • × (A f c 0 + N f c 0 ) (19)
By expanding the expression and using Remark 3, W can be rewritten W = A + N with A a type A matrix and N = N f c t × • • • × N f c 0 a type N matrix. Because of its structure, A cannot cancel the non zero coefficients of N . Therefore, W is a type A matrix if and only if N is null.

The self-synchronization property in the spectral domain can have an algebraic interpretation. It is based on the concept of semigroup.

A semigroup is a set together with an associative multiplication. For instance the set of the 2 n × 2 n Walsh matrices together with the multiplication defined by ( 14) is a semigroup. A nilpotent element e is an element such that there exists a large enough positive integer k such that e k = 0. A semigroup is said to be generated by a family of elements E = {e 0 , . . . , e n } if any element of the semigroup can be expressed in terms of a product of finite length of elements of E. A nilpotent semigroup is a semigroup with a zero element and in which each element is nilpotent. The nilpotency class of a semigroup S is the smallest positive integer k such that ∀e ∈ S, e k = 0. Proposition 5. The system (5)-( 6) is finite time self-synchronizing if and only if the matrices N f 0 and N f 1 span a nilpotent semigroup.

Proof. According to Remark 2, a system is finite time self-synchronizing if and only if there is a positive integer t c such that any sequence of length greater than t c is self-synchronizing. That is, in view of Proposition 2 and Parseval's Theorem [START_REF] Nyberg | Multidimensional Walsh Transform and a Characterization of Bent Functions[END_REF], for t > t c , any Walsh matrix W φ c t is of type A. The expression of W φ c t given by ( 17) is, up to a constant factor, the product of t + 1 elements of the pair {W f 0 , W f 1 }. According to Proposition 4 this product is of type A if and only if whatever is c ∈ F t+1 2 , the product N f c t × • • • × N f c 0 is null. This is the case if and only if {N f 0 , N f 1 } spans a nilpotent semigroup of nilpotency class at most t + 1. Now, we aim at pinpointing different classes of self-synchronizing functions. To this end, let us recall an interesting theorem stated in [START_REF] Radjavi | Simultaneous Triangularization[END_REF] (Theorem 2.1.7).

Theorem 2 (Levitski's theorem). Any semigroup of nilpotent matrices is triangularizable.

For any square Walsh matrix W of dimension 2 n , let us define its reduced matrix W * of dimension (2 n -1) × (2 n -1) which is the matrix W in which the first row and column have been removed.

W * =    w 1,1 • • • w 1,q-1 . . . . . . w q-1,1 • • • w q-1,q-1    Remark 4.
Note that the reduced matrix of N is W * as well.

Next proposition makes a classification of the possible situations that allow the system ( 5)-( 6) to be finite time self-synchronizing. It clearly gives a characterization of the functions that can be used in the design of finite time SSSC. Proposition 6. The system (5)-( 6) with the next-state function f (and the associated (n, n)functions f 0 and f 1 ) is finite time self-synchronizing if and only if the reduced Walsh matrices W * f 0 and W * f 1 are nilpotent and fulfill one of the following cases: Case 1 Both matrices W * f 0 and W * f 1 are lower triangular; Case 2 Both matrices W * f 0 and W * f 1 are not lower triangular but can be simultaneously triangularized by a change of basis whose matrix is the reduced Walsh matrix W * p of some (n, n)function p. This matrix has to be invertible. In this situation, the following equalities hold:

W * p W * f 0 (W * p ) -1 = W * f 0 and W * p W * f 1 (W * p ) -1 = W * f 1 with W * f 0 and W * f 1 two
lower triangular matrices with zeros on the diagonal; Case 3 Both matrices W * f 0 and W * f 1 are not lower triangular. They can be however simultaneously triangularized like in Case 2 but unlike Case 2, W * p does not correspond to a Walsh matrix.

Proof. Proposition 5 states that the system ( 5)-( 6) is finite time self-synchronizing if and only if N 0 f and N 1 f span a nilpotent semigroup. In view of Remark 4, the same holds for the matrices W * f 0 and W * f 1 . Then, in view of Theorem 2, they can be simultaneously triangularized. Cases 1, 2 and 3 are exclusive and describe all the possible situations.

Case 1 corresponds to the case when f 0 and f 1 are strict T -functions. Indeed, the reduced Walsh matrix is lower triangular with zeros on diagonal except on the first row if and only if the corresponding function is a strict T -function (see Proposition 11 [START_REF] Parriaux | Synchronization of boolean dynamical systems: A spectral characterization[END_REF]). Therefore Case 1 refers to functions which have been already proposed through the open literature.

Case 2 corresponds to the situation when f 0 and f 1 are not strict T -functions but functions of the form

f 0 = p • f 0 • p -1 and f 1 = p • f 1 • p -1
where f 0 and f 1 are strict T -functions and p a bijection over F n 2 . Indeed, since the invertible Walsh matrices are exactly the Walsh matrices of the bijections over

F n 2 . Moreover, if p is a bijective (n, n)-function, (W * p ) -1 = W * p -1 .
Therefore, this case is nothing but Case 1 in which the functions f 0 and f 1 have been both left-composed with the same bijective function p and right composed with p -1 . Thus, this case is equivalent to Case 1 up to an invertible transformation of the internal states.

Case 3 corresponds to self-synchronizing functions that are not based on strict T -functions. This case is the most interesting one insofar as it defines new classes of self-synchronizing functions. An example of such a function is given in Section 6.

Remark 5. It is interesting to note that the synchronization delay t c precisely corresponds to the nilpotency class of the semigroup spanned by W * f 0 and W * f 1 . Moreover, since Cases 1 and 2 are based on strict T -functions, the maximum nilpotency class is bounded by n in these situations. In Case 3 the maximum nilpotency class is the dimension of the matrices which is 2 n -1. Therefore, if two reduced Walsh matrices W * f 0 , W * f 1 span a nilpotent semigroup of nilpotency class greater than n, it necessary corresponds to Case 3.

The problem of determining if any two (n, n)-functions f 0 and f 1 can be used to design finite-time self-synchronizing systems as defined by ( 5)-( 6) amounts to check whether or not their reduced Walsh matrices W * f 0 and W * f 1 span a nilpotent semigroup. From Proposition 5, if this is the case they can be simultaneously triangularized. The book [START_REF] Radjavi | Simultaneous Triangularization[END_REF] provides interesting approaches to determine whether or not a set of matrices can be simultaneous triangularized. An algorithm that simultaneously triangularizes a set of matrices is given in the paper [START_REF] Dubi | An algorithmic approach to simultaneous triangularization[END_REF]. The algorithm can be applied to any set of matrices, it simply fails when no common triangularization basis exists. In the next paragraph, an extension of the finite time self-synchronization is proposed. It is called statistical self-synchronization.

Statistical Self-Synchronization

In this paragraph, in order to enlarge the class of potential candidate functions, we relax the finite time self-synchronization constraint and extend Definition 4. Indeed, in practice, it is acceptable that the synchronization delay t c is not bounded, but may be a random variable with a probability law that decreases to zero as time goes to infinity. In other words, the probability of being synchronized reaches one while the length of the stream (c) increases as illustrated by Figure 3. In order for this concept to be practical, clearly, the probability of being synchronized must be sufficiently close to one for some reasonable length. Such systems are called statistical SSSC. If (c) is a random sequence then, the synchronization delay t c is a random variable. In such a case, it is denoted T c . Definition 6 (Statistical self-synchronization). The system (5)-( 6) is statistically selfsynchronizing if lim t→+∞ Pr(T c ≤ t) = 1. The random variable T c is called the random synchronization delay for the random sequence (c). Remark 6. It is interesting to note that if the probability of synchronization is one for some constant delay, Definition 6 reduces to Definition 4. Therefore, finite time self-synchronization is nothing but a special case of statistical self-synchronization.

Even though Remark 6 states that finite time self-synchronization is a special case of statistical self-synchronization, in general, by statistical self-synchronization, it is meant statistical self-synchronization which is not finite time self-synchronization.

We now focus on statistical self-synchronizing systems. According to Section 4.2, when the pair {W * f 0 , W * f 1 } spans a nilpotent semigroup, the associated function f is finite time selfsynchronizing. If the pair does not span a nilpotent semigroup, the synchronization delay cannot Fig. 3: Synchronization probability with respect to time. Solid line: finite-time selfsynchronization. Dotted line: statistical self-synchronization be bounded anymore since some sequences are not self-synchronizing. The probability of synchronization at time t is upper bounded by the probability that a self-synchronizing sequence appears for the first time at time t in the stream (c) since some non self-synchronizing sequences might synchronize the system for some specific pairs of initial states x 0 and x 0 . Note that, determining the probability that a specific sequence appears for the first time in a uniform random sequence of a given length is not trivial. This is mainly due to the fact that two different sequences even with equal length do not necessary have the same probability of appearing in a uniform random sequence. However, when considering all the self-synchronizing sequences of a specific length, we can resort to the result provided in the paper [START_REF] Bajic | Statistical analysis of search for set of sequences in random and framed data[END_REF].

State Probability

Ensuring the self-synchronizing property is a first feature required for the design of SSSC. The security has to be further assessed. From this perspective, it should be interesting to determine the probability that a given state can be reached after a fixed number of iterations. Clearly, all the states have to be reachable and with almost the same probability (ideally the same). It is the purpose of this section.

Let us first consider the following matter. Given a (n, m)-function g and a vector x ∈ F n 2 whose value is described by the probability law p : F n 2 -→ R, express the probability law of y = g(x) ∈ F m 2 defined by q : F m 2 -→ R. For the F n 2 valued random variable X, the function p is defined by p(x) = Pr[X = x] and the function q is defined by q(y) = Pr[g(X) = y]. Without ambiguity, the notation p (respectively q) refers either to the function or to the 2 n (respectively 2 m ) column vector whose component index x ∈ F n 2 (respectively y ∈ F m 2 ) has the value p(x) (respectively q(y)). The same holds for p and q which are the Fourier transforms of p and q. Proposition 7. Let W g be the Walsh matrix of g. Applying the function g to a variable whose value is chosen according to the probability law described by p gives a vector whose value is described by the probability law q. They are related by the relation

q = 1 2 n W g p (20)
Proof. Let us first relate q and p.

q(y) = x∈F n 2 |g(x)=y p(x) = 2 -m x∈F n 2 p(x) u∈F m 2 (-1) u(g(x)+y) = 2 -m u∈F m 2 x∈F n 2 (-1) u•y p(x)(-1) u•g(x)
We now express the Fourier transform of q.

q(s) = y∈F m 2 q(y)(-1) s•y = 2 -m u∈F m 2 ,x∈F n 2 y∈F m 2 (-1) u•y+s•y    2 m if u = s 0 else p(x)(-1) u•g(x) = x∈F n 2 p(x)(-1) s•g(x) = 2 -n x∈F n 2 p(x) z∈F n 2 (-1) s•g(z) v∈F n 2 (-1) v•(x+z) = 2 -n v∈F n 2 x∈F n 2 p(x)(-1) v•x p(v) z∈F n 2 (-1) s•g(z)+v•z w g s,v
where w g s,v is as defined by [START_REF] Millérioux | Self-synchronizing stream ciphers and dynamical systems: state of the art and open issues[END_REF]. The result holds.

The following corollary can be stated

where w g s,0 is the coefficient of the Walsh matrix of g of the s th row and of the first column.

Proof. If we assume a uniform distribution of the initial state, p is the constant function ∀x ∈ F n 2 , p(x) = 2 -n . Its Fourier transform p is p(u) = 1 if u = 0 0 otherwise From Proposition 7, the equality q(u) = w g u,0 holds. Using the inverse Fourier transform formula (9) completes the proof.

It could be interesting to relate Proposition 7 and Corollary 1 to [START_REF] Nyberg | Multidimensional Walsh Transform and a Characterization of Bent Functions[END_REF] since they extend Lemma 1 of the latter paper. They are more general in the sens that we do not consider any specific probability distribution.

Till now, we have always considered that the initial state x 0 is chosen according to the uniform probability. We have also assumed that the symbols of the ciphertext stream (c) are uniformly

Example

As an illustration of the finite time SSSC described by Case 3 in Section 4.2, let us show that the set of functions described by Case 3 is not empty. We consider n = 3. The next-state function f is described by its restrictions f 0 and f 1 as defined by [START_REF] Klimov | Cryptographic applications of t-functions[END_REF]:

   f 0 0 (x) = x 1 + x 0 x 1 + x 2 + x 0 x 2 f 0 1 (x) = x 1 + x 0 x 1 + x 0 x 2 + x 1 x 2 + x 0 x 1 x 2 f 0 2 (x) = x 2 + x 0 x 2
Two kinds of self-synchronization have been defined. Finite time self-synchronization has been characterized from the spectral analysis point of view. It has been shown that it is possible to achieve finite time self-synchronization using functions which are not strict T -functions. Three cases have been pinpointed. The known strict T -function case, the case when strict T -functions have been left and right composed with a permutation and its inverse and the case which is not based on strict T -functions. The latter case is interesting due to its novelty, algebraic characterization in terms of nilpotent semi-groups has been performed. We have then discussed statistical self-synchronization as a generalization of finite time self-synchronization. These characterizations will prove constructive to the task of finding classes of keyed families functions for cryptographic purposes. A deeper insight is required to fully specify selfsynchronizing stream ciphers so as to achieve security in the context of performance constraints.

Fig. 2 :

 2 Fig. 2: Generalized recursive form of self-synchronizing stream ciphers

Corollary 1 . 2 (- 1 )

 121 Let X follows the uniform distribution and g be a (n, n)-function. The probability distribution, after applying the function g to X reads∀x ∈ F n 2 , Pr[g(X) = x] = 2 -2ns∈F n s•x w g s,0

  Some special T -functions of interest in our study are called strict T -functions. Their definition is the following: Definition 2 (Strict T -function). A T -function such that the coordinate function f j depends only on the variable x i with i = 0, . . . , j -1 is called a strict T -function. Remark 1. It should be mentioned than what we call strict T -function is nothing but what is called parameter in

Acknowledgment

This work was partially supported by the PEPS project AutoCrypt, Institut des Sciences et de l'Ingénierie des Systèmes, CNRS

distributed. Let us stress that even though this assumption makes sense in cryptography since the stream (c) should not be distinguishable from a true uniform random stream, it should be considered with caution. Indeed, the uniformity of (c) depends on the uniformity of (z) which in turn depends on the function f and h.

We now focus on the evolution of the probability law modified by the next-state function f . Proposition 8. Let (C) be a uniform random sequence and assume a uniform random distribution of the initial state X 0 . Then, the probability that the iterated function φ t returns the state

Proof. Since (C) is a uniform random sequence of length t + 1, the probability of having this specific sequence in t + 1 iterations is 2 -t-1 .

Then, in view of Proposition 1 and Corollary 1

Proposition 9. Assuming a random sequence (C) of length t + 1 and a random initial state X 0 , the system (5)-( 6) has an equal probability to be in each state if and only if the first column of the matrix W f 0 + W f 1 t+1 denoted w 0 is given by

Proof. Proving this result amounts to solving a linear algebra problem. Let ν be the 2 ndimensional column vector whose coefficients at row x is the probability of being in the state x.

In our case, we set the value of each coefficient to 2 -n . Considering Proposition 8, denoting by H the 2 n -dimensional Hadamard matrix defined by H = (h s,x ) = (-1) s•x for s, x ∈ F n 2 and by k the constant 2 -2n-n•t-t-1 , the problem can be written ν = kHw 0 where w 0 is the unknown. Since both k and H are invertible, the system can be solved and has a unique solution.

Remark 7. The fact that each state is reached with an equal probability for a random sequence of length t + 1 does not mean that each state is reached with an equal probability with a uniform random sequence of length t + 2. Remark 8. Proposition 9 states that assuming a uniform distribution of the initial state X 0 and a uniform random sequence (C), the uniform distribution of the internal state at time t is achieved if and only if the first column vector of W f 0 + W f 1 t+1 is given by the relation (23).

Under this condition, a uniform distribution is achieved at any time if and only if f is balanced.

Since the first column of W f 0 + W f 1 is the same as the first column of W f , if f is balanced, the condition w f 0 s,0 = -w f 1 s,0 if s = 0 holds.