Perrine Lachenal

Keywords: Tunisia, Revolution, Martyrs, Heroes, Thugs, Gender

Tunisia"

(Men

In this article, I show that the "rhetorical modes" (Collins, 2014) in terms of which the Tunisian uprising's actors are officially categorized have progressively changed since 2011. They are no longer understood through political repertoires but through moral ones. This discursive turn, organized around hierarchized masculine figures, reveals a depoliticization of narratives of the 2011 revolution, coherent with the manner in which the revolution has been increasingly discredited in Tunisia.1 I argue that the recent appearance of the "terrorist threat" and its strategic depiction as a consequence of the revolution have played a catalysing role in this lexical and moral shift. From now on, the Tunisian state can publicly celebrate the heroism and the martyrdom of policemen and soldiers at the expense of civilian figures by linking terrorist attacks to revolutionary history. The terrorists' emergence has strengthened the ability of hegemonic narratives to shut down disagreeing or subaltern voices.

DYING DURING THE 2011-REVOLUTION

On December 17 th 2010, Mohamed Bouazizi, a 26-year-old fruit and vegetable seller, set himself on fire on the main square of Sidi Bouzid, a small city in the centre of Tunisia. He died from his injuries two weeks later. Mohamed Bouazizi was publicly titled the first "martyr" -in Arabic "shahid"2 of the Tunisian revolution, one whose sacrifice sparked a national uprising. 3 His name and face appeared on walls, banners, and t-shirts during the first days of mobilization as masses of demonstrators took the streets all over Tunisia demanding the overthrow of the Ben Ali regime [Figure].

As demonstrations multiplied in several

Tunisian cities and as social movements intensified in December 2010 and January 2011, the number of deaths increased. Repression was especially brutal in the marginalized governorates deep inside the country from where the contestation started. This violence did not stop after Ben Ali's resignation and many young men were killed, most of them intentionally, in the troubles that followed (Amnesty International, 2011). 4 The destruction and burning of jails resulted in particularly high death counts. Even if the causes of these incidents have still not been clarified, their orchestrated nature is suspected: different camps had interests in disorganizing the country in order to discredit the revolutionary movement and justify the return of strong power. The interim government, composed of many members of the former Ben Ali regime, had to be dissolved in February 2011 due to a huge mobilization. Massive demonstrations and ensuing repressive violence continued to punctuate the year 2011. The Bouderbala Commission, which constituted the first official attempt to identify those who died and were injured during and following the Tunisian uprising, documented the killings of 338 persons, amongst them 319 civilians, 14 policemen and 5 soldiers. 5 The word "martyrs" was of major importance in post-revolutionary Tunisia and became a strategic source of legitimacy for those who wanted to play a role during the transitional period. It constituted a consensual rhetorical tool for all the political parties as though every public speech had to start and end by referring to "martyrs" and recalling the obligation to honour their memories and sacrifices. The word was often associated with the expressions "of the nation" or "of the revolution", implying nationalist and secular dimensions. This purposeful use is not surprising since the word "martyr" is historically engrained in the Tunisian national vocabulary. 6 The martyrs of the 2011 revolution were thus publicly depicted in relation to those who came before, as pursuing the same nationalist trajectory. In 2017, during a demonstration I attended in downtown Tunis, I listened to speeches that retraced this historical lineage, proclaiming a national duty to honour the blood of "our martyrs", including those of "independence", of the "revolution", and of "transition". 7 As Elisabeth Buckner and Lina Khatib argue about the "Arab springs" (2014), what seemed to distinguish the martyrs of 2011 from their pro-independence predecessors was their political function: they were not used as producers of an internal identity against a foreign occupier but as producers of a people against the oppression of a regime. Decree 97/2011, published in October 2011, regulates the ways post-Ben Ali Tunisia should go about dealing with its "martyrs" (Nawaat, December 2012). 8 The decree's first five articles focus 5 Its investigation covers the period from the 17 th of December 2010, the date of Bouazizi's self-immolation, until the 23 rd of October 2011, the day of the National Constituent Assembly's election. The Bouderbala commission, composed of 15 members, was commissioned by the interim government in 2011 to conduct investigations in jails, hospitals, and several governorates in order to register and document abuse committed during the specified timeframe. Its 1,041-page report was published in 2012. 6 One of the most important books of the Tunisian nationalist movement, published in 1920, personified the whole country as a "martyr" of colonization (Thaalbi, 1920). The word is also used to honour "freedom fighters", who died during struggles for independence throughout the 19 th and the 20 th century. After Habib Bourguiba took power and proclaimed Tunisia's independence in 1952, those martyrs became the hallmarks of the propaganda supporting his one-party rule (Georges, 2013). Each year, on April 9 th , the Day of the Martyrs commemorates demonstrators who died during pro-independence protests. 7 The transition's martyrs, as the speaker explained to me, are Chokri Belaïd and Mohamed Brahmi, two major political figures who were assassinated in 2013 by Islamists. 8 https://nawaat.org/portail/2012/12/21/tunisie-lecture-critique-du-le-decret-n972011-relatif-aux-martyrs-et-blesses-de-larevolut exclusively on the issue of "national memory" and the symbolic dimension of the martyrs' recognition.

For example, they mention erecting a monument depicting the martyrs' names and the importance of publicizing them in public spaces. A museum devoted to the revolution should be built, school curriculum and text books be rewritten in order to document and honour their sacrifice. Financial reparations were also managed in this decree. The document explains in detail how money devoted to each martyrs' family -40 000 TND, around 15 000 eurosshould be divided amongst surviving relatives under the Ministry of Social Affairs' supervision. Aside from financial retribution, less calculable forms of aid were planned to be provided: distribution of public transportation tickets, sponsorships for pilgrimages to Mecca, donation of food and meat for religious feasts and the organization of summer camps for children. The decree also initiated the process of officially listing the "martyrs and the wounded of the revolution," which was thus formulated early on in the transitional process. Being named on this list was a prerequisite to benefit from the compensation measures outlined in the decree. Decree 97/2011 precisely set out the composition of the commission responsible for generating the official list of martyrs, which included representatives of civil society and of seven ministries.

The project of generating a list can be seen as an attempt by the Tunisian state to control and standardize revolutionary narratives. Through this project, it sought to monopolize the process of determining who would be labelled a "martyr" and to produce an official version of what had happened during the revolution.

"MARTYRS" VERSUS "THUGS": TIME FOR SUSPICION

In November 2011, the first gathering of the National Constituent Assembly started with the public enumeration of the "martyrs"' names, classified by governorate, provoking immediate and violent reactions amongst the "martyrs"' families who pointed out that many names were missing. They denounced the persistence of social and spatial marginalisation in the commemoration of the revolution, ion/ illustrated by the fact that only seven names of the 27 young men who died in the city of Kasserine were quoted (Le Point, 6 December 2011). 9 The project of listing the martyrs indeed immediately appeared problematic, since it necessarily implied that not all the victims of the revolution would be recognized as such. 10 Suspicious discourses developed as soon as the Bouderbala commission released its report in January 2012. 11 Samir Dilou, at the head of the Ministry of Human Rights and Transitional Justice, immediately expressed doubts about the validity of the report and the veracity of some of the victims' stories. If the official list of the martyrs of the revolution was to be generated from the Bouderbala report, the report should first be checked in order to remove the names of individuals who did not qualify for "martyrs" status. When I asked the head of the General Committee devoted to the martyrs about the necessity of creating a new list, she explained to me: "We have to correct the (Bouderbala) list because, and that is sad, not everyone told the truth. There are people who died, but not in the context of the revolution, and their families would like to benefit from the social advantages accorded to the martyrs' families! (…) This revision will take some time because we have to check every single case in order to identify the fake martyrs. I understand the impatience of the families; it has already been five years since the revolution occurred and the names of their children are still not public.

For the families of the true martyrs, this must be disappointing."

Later on during the same interview, my interlocutor again emphasized the importance of appreciating the "true martyrs" and of erasing the names of those who do not deserve the title, not only depicting them as "liars" but also as "thugs": "We have to tell the truth and who the true heroes are. There is no way thugs' names should appear on the list; the ones who were violent, who killed, who raped, who were carrying weapons or organized looting."

These quotes significantly mobilize the categories of "heroes", "martyrs" and "thugs"; three fundamental figures of the narratives of the revolution, each one of them being cast through specific representations of violence, legitimacy, and morality. Here, the deceased under suspicion are not only depoliticizedthey had nothing to do with the revolutionbut also criminalized. The removal of their names was based on legal and moral arguments. The suspicion that affected the martyrs slowly contaminated the revolutionary narratives as a whole, as one of the main lawyers of the martyrs' case explained to me: "We are facing a critical time in Tunisia! One no longer speaks of 'revolution' or even of martyrs but rather of criminals".

Even Mohamed Bouazizi was not immune from the disqualification process: another lawyer I interviewed in May 2016, involved in defending some army officers, stated that he doubted Bouazizi immolated himself or even existed, suggesting that the Tunisian upheaval was a plot by the USA. In some newspapers, enthusiastic followers of conspiracy theories described Mohamed Bouazizi as an illiterate "tramp", a loser who used what little money he had to buy alcohol (Tunisie Secret, 15 December 2013). 12 This kind of statement sheds light on the moral dimension of the making of the martyrs.

THE MARTYRS' MORAL STATUS IN QUESTION

Beyond the political dimension, which one could reasonably have expected as far as a revolution was concerned, it was the good moralityor the lack of itof the social actors which seemed to constitute a decisive argument to label themor not -"martyrs". In "Semiotics of martyrdom", Andy Blunden indeed argues that the "moral character of the subject" is "most important in determining their role as a martyr, and in order to be recognized as such, the martyr should be someone people can positively identify with (2006: 51).

12 "Bouazizi un clochard devenu icone nationale", Tunisie Secret, 15 December 2013. www.tunisie-secret.com/Bouazizi-unclochard-devenu-icone-nationale_a750.html.

The focus on the morality of martyrs was particularly visible in the discourses surrounding the cases of the many prisoners who died in 2011 during the destruction and burning of their prisons 13 . They numbered almost one quarter of the total casualties of the Tunisian uprising. 14 As I was told in interviews by different persons in charge of generating the "final" list, it seemed problematic to publically give prisoners, who probably were sent to jail because they had committed offenses, the prestigious status of martyrs. The same reservation was expressed regarding the young men who were killed on the margins of the protests. In these cases, the disqualification was often based on the probable immorality of the youngsters, embodied through the suspicion that they died while drinking, like in the previously mentioned criticisms targeting Mohamed Bouazizi. When I met him in his office, in September 2016, one of the members of the Bouderbala commission explained to me: "Someone who was reported dead, burned alive inside the Magasin général, it is a supermarket, at midnight, was not expressing any political discontent; in the middle of the night, in a supermarket, in the spirits section (laughs)! While someone who died in front of the trade union center or in front of the Interior Ministry, it is totally different".

In post-revolutionary Egypt, similar arguments were brought forwardalthough they had to do with drugs and not alcoholto discredit some lower-class young men who died in 2011, as Karl Rommel (2012) points out regarding the football supporters who were killed during the Egyptian uprising, analysing politics of martyrdom through the notion of respectability. In this regard, it is worth remembering that the policemen who beat to death Khaled Said, who became the "first" martyr of the Egyptian revolution, vainly tried to assert that he died while trying to swallow a packet of hashish. 13 The strategic use of the term "thug" to disqualify social and political actorswhich constitutes a classical rhetorical tool for leaders when facing oppositionwas already illustrated during the very first days of the Tunisian revolution. In a discourse he pronounced on the 10 th of January 2011, four days before he escaped, Ben Ali vainly compared the demonstrators to "hooded thugs", guilty of "acts of terrorism" (Franceinfo, 10 January 2011). 14 86 cases according to the Bouderbala commission.

In order to be recognized as a "martyr" or a "hero", Blunden also mentions the necessity for the subject to be an "attractive person" (2006: 2). Although he mainly refers to a moral perspectivethe fact of being a good personhis terminological choice stands as an invitation to question aesthetics of martyrdom from gender and social class perspectives. Blunden illustrates this argument through the case of Rosa Parks who became a major figure of the US-American Black social rights movement for fighting against racial segregation, having refused to give up her seat to a white passenger on the bus in December 1955. A few months earlier, a 15-year old Black woman, Claudette Colvin, was arrested for the exact same reason, but given the fact that she could not stand as a respectable figureshe was suspected of having an active sexual life -she could not embody "the face of the campaign" (2006: 3). Even if Blunden does not identify them as such, gender considerations, and especially more or less respectable models of femininity, are at the core in the making of heroic figures. The case of the martyrs of the Tunisian revolution rather involves masculinities. If the young men who died while in jail or fighting the police failed to be publicly remembered as "martyrs", it is because they embodied suspiciousbecause lowerclassmodels of masculinity. Since their social and gender performances were framed as immoral and violent, and perceived as threats to the social order by those in charge of shaping the official revolution narratives, their names have to remain unknown and their faces invisible. Such young men constitute the "not-so-photogenic" actors of the Tunisian revolution, to adopt an expression used by Lucie Ryzova (2011), "photogene" being interestingly defined by Roland Barthes (1967) as a "status" both socially and morally shaped.

As the Tunisian revolution case shows, socio-economic inequalities are translated into official narratives and iconographies. Actors' social status determines the ways their violence and political commitment are publicly depicted, and the meaning of their death. Gendered repertoires of morality and respectability constitute major tools to organize and justify the stigmatization process.

ALTERNATIVE NARRATIVES AND CANALS OF PRODUCING "MARTYRS"

Despite the official attempts to monopolize the public making of "martyrs of the revolution", counternarratives circulated, resisting the marginalization and depoliticization processes of subaltern experiences.

Not only families and relatives of the young men who were killed during the upheaval, but also some political groups defended an inclusive definition of martyrdom. Opposing the moral repertoire, they reasserted the political nature of the experiences of the contested martyrs, trying to lend rationality to their violence and meaning to their death.

One of the main argumentative strategies was based on the justification of the use of violence, depicted as a historical and necessary tool for any revolutionary movement. Some middle-class activists for instance publicly denounced the criminalization of the lower-social classes for their participation in the Tunisian revolution. In April 2014, when 130 young men were charged for vandalism, accused of having burned down police stations during the uprising, they initiated a campaign called "I also set a police station on fire" (Nawaat, June 2014) 15 . When I interviewed him in March 2016, one of the lawyers publicly committed to the "forgotten" martyrs' cause stated: "This idea of 'jasmine revolution' is completely absurd and naïve. Flowers? What's the point? A revolution cannot be peaceful. If we could have been peaceful, why would we have needed a revolution? Revolutions have always been conducted by the poor people (…), so how dare they talk about robbery or looting when we know the billions that were stolen by our leaders? (…) Yes, police stations were attacked but not for no reason; they constituted the showcases and the symbols of Ben Ali's regime."

Another strategy to claim the label "martyrs" for the young men who died on the sidelines of the demonstrations was to attribute clear political intentions to them. The same people who were officially depicted as apolitical and immoral thugs in other social spaces were portrayed, in a symmetrical counter-dynamic, as rational political actors and remarkable individuals. This strategy can be identified in the numerous statements about the "objectives"sometimes evoked as "dreams"of the martyrs when participating in the protests, and the fact that they were ready to die to achieve them. The president of Awfia, one association devoted to the martyrs of the revolution and their families, wrote in a public rapport that the protesters were demonstrating with the motto "A dignified life or a dignified death", and interpreted Mohamed Bouazizi's immolation as a way for him to challenge his social deprivation (2012: 36). In the introduction of a special issue she edited, the anthropologist Amira Mittermaier stressed on the ambiguity of these kinds of post-mortem stories (2015), contrasting Bouazizi's uncle's version, in which his nephew dreamed of sacrificing his life for freedom, and the version of his aunt, who asserted that the greatest dream he ever had was to own a pick-up (Time, 21 January 2011). 16 The suicide of Mohamed Bouazizi, and the death of hundreds that followed, seemed blocked in narratives oscillating between agency and victimhood, focusing either on the intention of the young martyrs to die for the revolutionary cause or on their innocence, harmless victims of an arbitrary regime. Both choices nevertheless constituted attempts to give a collective meaning to their early death: intentionally or un-intentionally, the young men died while participating in the Tunisian revolution. Besides this political aspect, the good morality of the young martyrs had to be asserted as well, countering the negative narratives depicting them as "thugs".

Families' stories glorified the moral qualities of the victims. Mothers painted positive portraits of their sons for journalists and researchers, insisting on their kindness and sensitivity. The narratives can be read through a gender perspective, portraying socially valorised models of masculinity associated with care and responsibility. In an interview I conducted, a mother of a 24-year old man who was killed by the army 16 "Bouazizi: The Man Who Set Himself and Tunisia on Fire", Times, 21 January 2011. content.time.com/time/magazine/article/0,9171,2044723,00.html. Social scientists surprisingly took part in the debates regarding the supposed motivations of martyrs, as if they were asked to take position. Thomas de Georges (2013) analyses the discourses imputing to martyrs the desire "to fix the bad hospitals, increase the minimum wage, and lower inflation" as attempts to give meaning to "random" and "senseless" violence (2013: 490).

in January 2011 referred to him as a "good" and "sensitive" boy, very close to her, who was helpful at home and supported gender equality in the family.

These counter-narrativesclaiming the political meaning of the death of the "contested" martyrs had graphic translations. Martyrdom's political dimension was for example aesthetically asserted through the portraits martyrs' families and relatives carried with them and waved in public events. Such portraits illustrated a determination to link the killing of their relatives to the revolution and to politicize their stories. On this picture, taken in January 2018 during a gathering of martyrs' families, the face of Qaïs Al-Mazlini, killed on the 13 th of January 2011, appears on an expressive background: an image of a demonstration on Bourguiba Avenue, a Tunisian flag and the sentence "Tunisia is free" [Figure].

These symbolic references are tools to engrain the individual story into the national one, if there were any doubt about that connection. Taoufic Haddad identifies similar aesthetic choices when analysing a large corpus of posters depicting Palestinian martyrs (2016): it is common for the families or the poster's designer choose to make the deceased person appear as an armed fighter, even if it was not the case, to include him in the core of the national struggle. This picture illustrates that the state was not the only actor able to build and broadcast martyrs' iconographies in post-revolutionary Tunisia. Despite its attempts to monopolize the public making of "The martyr Qaïs Al-Mazlini. Martyrized on the 13th January 2011". Families ' exhibition, Tunis, January 2018 (P. Lachenal) martyrs, other portraits circulated through non-official channels and families' networks. It is worth mentioning that the role of non-state actors in the making of martyrsin an exemplary way the associations of martyrs' familiesis based on practical reasons such as the democratization of access to designing and printing technologies. If disagreements have always haunted memorial practices and revolutionary iconographies, this technological shift has given them unprecedented visibility. The production of martyrs was easier to control before 2011, de Georges asserts ( 2013), since there were fewer ways to publicize their portraits. In the Tunisian case, this practical aspect of the making of martyrs was not insignificant and had major political consequences. It allowed rival iconographies to coexist, each associated with different stories of how the revolution should be remembered.

TURNING POINT: THE SECURITISATION OF REVOLUTIONARY NARRATIVES

In post-2011 Tunisia, at the same time some families continued asking for the publication of a definitive list remembering their children as "martyrs of the revolution", other kinds of martyrs were being publicly identified. Their faces were displayed in public spaces and their names carved on commemorative plaques: these were the "martyrs of the nation", meaning the members of the Tunisian security forces who lost their lives in recent years. The distinction between "martyrs of the revolution" and "martyrs of the nation", which significantly appeared in the first article of the 2011-decree organizing national martyr worship, haunted the memorialization process of the Tunisian uprising since its beginnings. When the names of all people who died during the upheaval were published in the Bouderbala report in 2012, those of policemen and soldiers were separated in a list specifically devoted to the security forces. The commemoration of the revolution had progressively focused on its uniformed victims, leaving out the civilian ones. The turn was neither instantaneous nor straight but the result of several intermingled processes.

The ability of a state to build and glorify conservative martyr figures, like those embodying order and security, mainly depends on a prior depoliticization process which is necessary to "set the stage", according to Daniel Gilman (2015). In post-revolutionary Tunisia, the depoliticization process coincided with the fragmentation and the differentiation of the martyrs into different groups. Political parties, families, associations, religious groups, municipalities, army, police, trade unions claimed ownership of certain martyrs. Depending on their resources and power, these different groups had more or less chance at success in broadcasting "their" martyrs. As Mittermaier notices (2015: 595), governments unsurprisingly often succeed in proclaiming their heroes, the state's martyrs being "the ones most loudly celebrated in the mainstream media". Beside these dynamics, the depoliticization process of the Tunisian revolutionary narratives during the last years mainly stood on the emergence and on the recognition of a "terrorist threat" which led to a growing national celebration of security forces' martyrs.

Following the revolutionary period and due to the destabilization of Libya, Tunisia had to face several Islamist terrorist attacks in the past years. Some of them strategically targeted touristic sites, while others were directed at the Tunisian security forces. As the attacks multiplied, commemorative plaques and monuments sprouted here and there. At the entrance of Ben Guerdane, a city that faced a major attack in March 2016 which left 13 members of the security forces dead, colourful murals honoured the "martyrs of the nation". On one of them, as shown in the picture, drawings of the different security forces are accompanied by the sentence "The people, the police and the army hand in hand against terrorism"

[Figure]

The terrorist threat and the state of emergency that went with it contributed to the process of securitization of Tunisian national narratives, paving the way for the celebration of militaristic and police martyrs. In May 2016, a lawyer I was interviewing interrupted me: "You want to talk about the martyrs? Well listen to me carefully: our martyrs, and there are no other martyrs than them, are the ones who fell in the line of duty fighting terrorism". In the same year, the name of the governmental Commission devoted to the "martyrs and wounded of the revolution" was significantly lengthened by the words "and of the terrorist attacks"; and Madjouline Cherni, a sister of a soldier killed in a terrorist attack in 2013, was chosen to direct it. Among the civilian martyrs' families, the fear that the crimes of the revolution would be slowly covered up and erased by the terrorist issue kept growing. Lamia, the sister of a 21 year old man killed by the army during the first days of the revolution, stated:

"Her (Madjouline Cherni) brother was a soldier. She cannot be neutral. I am not saying that the soldiers who have been recently killed do not deserve justice, but their stories have nothing to do with ours. What does 'martyrs of the revolution and of the terrorist attacks' mean? How can we deal with the two different issues together when the first group were often been killed by the second ones?"

The official answer to these questions was that the martyrs killed during the revolution and in terrorist attacks were part of the same history and that it would make no sense to deal with them separately. As Cherni explained to me in an interview: "All martyrs are equal to one another, they are all martyrs of the nation". A few minutes later, her words revealed that it might not be as simple as she claimed:

"People often ask me: 'Don't you feel angry against the martyrs of the revolution? Against the revolutionaries? Because it is because of them that terrorism appeared in Tunisia, and killed your brother?'

But no, I do not blame them".

These two excerpts illustrate what Bernhard Giesen argues regarding "heroes" and "perpetrators", suggesting that they be considered as "liminal figures in the sense that they can be imagined from 'this' side of the boundary, from inside the community. If you cross the boundary and look the other way around, the perpetrators can be seen as a heroes " (2004: 21). Boundaries between the two opposite categories are neither stable nor the positions "immutable" (2004: 7); that is why constant efforts have to be made to sharpen the lines, to avoid confusion, and to impose one's version of the storywhile knowing that others exist.

The fear of misperception due to the "fundamental ambiguity" and "interpretative malleability" of dead bodies (Verdery, 2004: 693) resembled an anxiety of contamination. In Tunis in 2016, rumours stating that terrorists' bodies were buried next to martyrs' were so powerful that they required official denials (Jawhara FM, 21 February 2017). 17 The same year, a controversy erupted around the fact that a father of a "terrorist" who died while perpetrating an attack decided to inscribe the word "martyr" on his son's grave stone. The father was given a one-year prison sentence and the stone carver was harassed (Kapitalis, 4 May 2016). 18 In his article about the attempted military "coup" that happened in 2016 in Turkey, Salih Can Açiksöz reports similar post-mortem precautions through the discursive strategies the pro-military government adopted to condemn the rebel soldiers, labelling them as "terrorists in soldier uniforms" (2017). This remarkable expression "evoked a political fantasy in which the soldier body was displaced by the terrorist body", which could justify that it should be buried in a "traitor cemetery" with no funerary services (2017: 179). In Tunis, the symbolic criminalisation of the 2011-revolution progressively drew on a similar repertoire: the young men who lost their lives and got injured were publicly pictured not only as depoliticized and immoral figures, but eventually also as potential terrorists.

The circle came back around on the Martyrs' day in April 2016, when Madjouline Cherni publicly stated that she had the evidence to prove that some "wounded of the revolution" joined terrorist groups in south of Tunisia (Business News, 8 April 2016). 19 "Terrorism has overshadowed everything", as I was told by

Imen, an activist I interviewed in Tunis in May 2017. Regarding the ways martyrs were increasingly framed in the aftermath of the Tunisian revolution, this statement could not be truer: terrorism has become 17 "Aucun terroriste n'a été enterré à côté de Socrate Cherni", Jawhara FM, 21 February 2017. www.jawharafm.net/fr/article/aucun-terroriste-n-a-ete-enterre-a-cote-de-socrate-cherni/90/49092. 18 "Un an de prison pour le père du terroriste", Kapitalis, 4 May 2016. kapitalis.com/tunisie/2016/05/04/un-an-de-prison-pourle-pere-du-terroriste-kamel-gadhgadhi/ 19 "Les sacrifices de nos martyrs resteront immortels", Business News, 8 April 2016. www.businessnews.com.tn/interview-demajdouline-cherni--les-sacrifices-de-nos-martyrs-resteront-immortels,519,63706,3 the main narrative through which security forces' martyrsand the hegemonic models of masculinity they embodywere loudly honoured in Tunisia, at the expense of civilian figures.

CELEBRATING MEN IN UNIFORMS

These last years, intensive campaigns have been underway to celebrate the commitment of the security forces to the Tunisian nation. While the dispute regarding who was or was not a martyr was taking place, the state undertook visual production glorifying the security forces. Advertisements popped up all over Tunis. This picture, which was widely disseminated in 2017, illustrates the multiple processes just described [Figure].

By mixing together different repertoires, using the notorious "Dégage"an iconic expression during the so-called "Arab springs" -in reference to "terrorism", the struggle against terrorism was integrated into the story of the revolution itself, and the military "heroes" were placed at the forefront of this history. The revolutionary moment seemed to be reabsorbed into state hegemonic narratives, through neoliberal advertising apparatus. This kind of catchy advertisements contributed to the securitization processwhich is also a virilisation one -of the Tunisian revolution commemoration. The mother of a civilian "martyr" You are the hero. We fully support you. Terrorism "Dégage" Mohamed V Avenue, downtown Tunis, September 2017 (P. Lachenal) of the revolution I interviewed stated: "Now, people speak in friendly terms about the police. It is like it was the policemen who did the revolution." This picture also confirms that being recognized as a hero is not a matter of being violent or not, as it was said about the young men who died on the side-lines of the demonstrations. Policemen and soldiers embody a clear potential of violence, symbolized by the weapons they carry with them. It is rather the meaning of the violence and its social perception which are at stake in the making of the martyrs as Blunden argues: "like almost all military heroes, martyrs can be violent, so long as people can empathize with their violent act" (2016: 21).

Uncertainty contributes to setting the stage for the celebration of victorious and heavily-armed, perceived as reassuring, models of masculinities. In time of crisis, images of counterterrorist fighters and of militarist masculinities -a part of what Salih Can Açiksöz and Zeynep Kurtulus Korkman call a "warmaking governmentality"are appealing to a large proportion of the population. In the aftermath of the attacks of the 11 th of September 2001 in New-York, Judith Lorber (2002) discussed the gendered imagery of American heroes and warriors. She underlined the celebration of exclusively masculine and uniformed "heroes", interestingly noticing that the sales of G.I. Joe dolls in the USA increased at that time. Although some women died during the rescue operations, firemen and policemen were presented as all menheroes it seemed could only belong to one specific gender.

CONCLUSION

On the occasion of the 7 th anniversary of the revolution in January 2018, several gatherings were planned in Tunis. One of them was initiated by a political group called "We do not forgive" which was joined by the martyrs' families, as well as a few wounded of the revolution. While members of the first group were holding portraits of their deceased relatives including pictures of their dead bodies, the second offered journalists images of their wheelchairs, amputated bodies and burned skin. Unconventional masculine performances were at stake, organized around fragile and damaged models of masculinity. As Hamit Bozarslan argues (2015), Mohammad Bouazizi's self-immolation could be understood along the same line, revealing a new phenomenon in the Middle East's political language which implies that the helplessness and the innocence could constitute "resources of dignity". Bozarslan suggests that immolations inaugurate a new militant repertoire breaking with the images of over-masculinized martyrs (2015). However that argument's applicability seems limited in light of this paper focusing on postrevolutionary Tunisia. Faces and names associated with unusual gender performances were progressively rendered invisible in the official narratives and memorial spaces related to the revolution, incapable of "testifying"and thereby unable to "speak" to the public. In January 2018 they were literally off the stage: the demonstration I refer to took place a few meters away from the official gathering organized by the Tunisian government and the demonstrators chants "loyalty to the martyrs' blood" were barely audible, overlaid by the powerful sound system of the official event broadcasting the national hymn and loudly celebrating the "martyrs of the nation". In post-revolutionary Tunisia, official heroes wear uniforms and die in the line of duty. The models of masculinity they embody radically differ from the ones symbolized by Bouazizi's body in flames and the fatally wounded bodies of civilian youngsters. This article dealt with the contested processes through which some deaths would be or would not be officially honoured in post-revolutionary Tunisia, showing that competing models of men, each of them being vested with different political and moral meanings, worked in depth the national narratives in the making. Grasping the political and performative dimensions of martyrdom, it revealed that the public designation of martyrs does not only influence the way the 2011-uprising is being told but more importantly its political direction. Narrating and labelling is never only about the past. Behind the objective of writing a beautiful story about the past lies the concrete question of the present and future exercise of power (Bonnecase, 2016).

More than five years after its occurrence, assessments remain at the least mitigated and many hopes have been disappointed: interior regions remain severely marginalized, the number of arrests continue to multiply and the challenge of transitional justice seems threatened by an increasing feeling of mistrust towards the institution in charge of it while former members of the Ben-Ali regime progressively reappear on the political scene.

Not unlike the Greek origin of the word "martyr" which means "witness", the Arabic word comes from the verb "testify". Literally, a "martyr" is the one whose violent death is "testimony" of his or her dedication to the (holy or political) cause.

While some say that the Tunisian revolution symbolically began with the death of Mohamed Bouazizi, others insist it dates back to 2008, when violent police repression crushed an important social mobilization that took place around the Gafsa mineral field, in a marginalized region of Tunisia, and suggest considering its victims to be the first "martyrs of the revolution"[START_REF] Bendana | Le 'martryr': une variation tunisienne[END_REF]. It is not easy to piece together a revolution's chronology, nor is it easy to understand the reasons why some specific events constitute breaking points that lead to major political ruptures, especially if these events are not occurring for the first time. This is one of the main questions historians and other social movements specialists have to struggle with when examining revolutions[START_REF] Rozen | Civics Lesson: Ambivalence, Contestation, and Curricular Change in Tunisia[END_REF][START_REF] Ryzova | The Battle of Muhammad Mahmud Street: Teargas, Hair Gel, and Tramadol[END_REF]. Mohamed Bouazizi was indeed not the first young man to immolate himself. Eight months earlier, Abdessalem Trimech for example set himself on fire in Monastir and died of his injuries without receiving any further attention. Similar questions arose from the case of Khaled Saïd, whose death in one of Alexandria's police stations in June 2010 gave birth to a social movement that played a crucial role in the coming Egyptian upheaval. In Mubarak's Egypt, he was definitely not the first young man killed by police.

Report "La Tunisie en révolte. Les violences de l'État pendant les manifestations antigouvernementales", Amnesty International, February 2011. https://www.amnesty.ch/fr/pays/moyen-orient-afrique-du-nord/tunisie/docs/2011/la-tunisie-enrevolte-les-violences-de-letat-pendant-les-manifestations-antigouvernementales-francais-46-p.

"Tunisie, un an après: à Kasserine, capitale des martyrs", Le Point, 6 December 2011, http://www.lepoint.fr/monde/tunisieun-an-apres-a-kasserine-capitale-des-martyrs-06-12-2011-1404333_24.php

 10 The persons I interviewed from the "Truth and Dignity Commission"the institution in charge of implementing transitional justice in Tunisiastressed that their principle was to never use the word "martyrs", neither in reports nor in speeches, and to stick to the category of "victims" in order to not take part in the rhetorical

debates. 11 It is worth pointing out that the word "martyr" is never used in this report, except on one single incidence in the document's introduction.

"Retour de manivelle. Quand la police te la justice s'acharnent contre les jeunes de la révolution tunisienne", Nawaat, 1 June 2014, http://nawaat.org/portail/2014/06/01/retour-de-manivelle-quand-la-police-et-la-justice-sacharnent-contre-les-jeunes-dela-revolution-tunisienne/

ABSTRACT

Treating the category "martyr" as socially constructed and contested along gendered and political lines, this paper examines how heroes and martyrs have been produced and deployed in post-revolutionary Tunisia. It begins by examining governmental attempts, launched soon after the revolution, to monopolize and institutionally define who could benefit from official recognition as a martyr. The differences in definition of "martyrdom" between official institutions and families of the deceased are unpacked, arguing that "martyr" is moral category the boundaries of which are often drawn in terms of differing masculinities. The paper goes on to demonstrate how the category of "martyrs of the nation" has progressively overshadowed the category of "martyrs of the revolution" in official memorial practices, as the commemoration of the revolution has progressively focused on its uniformed victims, leaving out the civilian ones. One of the interesting features of this shift is that it demonstrates the malleability of the way the category "violence" is understood and deployed. The paper thus shows how neither state officials nor the families of deceased officers, activists or bystanders accepted that it was sufficient simply of have


J Flouquet

A Barla

R Boursier

J Derr

G Knebel

Kondo engineering : from single Kondo impurity to the Kondo lattice

Keywords: Kondo effect, Kondo lattice, spin fluctuation, magnetism, superconductivity, pseudogap

In the first step, experiments on a single cerium or ytterbium Kondo impurity reveal the importance of the Kondo temperature by comparison to other type of couplings like the hyperfine interaction, the crystal field and the intersite coupling. The extension to a lattice is discussed. Emphasis is given on the fact that the occupation number n f of the trivalent configuration may be the implicit key variable even for the Kondo lattice. Three (P, H, T ) phase diagrams are discussed: CeRu 2 Si 2 , CeRhIn 5 and SmS.

Kondo impurity : hierarchy between T K and other couplings

The new insight into the Kondo effect is that due to the strong coupling with the Fermi sea below some Kondo temperature (T K ) the entropy of a single paramagnetic impurity can collaps at T → 0 K without further coupling with the other impurities.

One of the important message given by the study of a single Kondo impurity is that the Kondo energy k B T K is the key energy in the comparison of the electronic coupling given by the Fermi sea with other sources of interactions like the electronuclear hyperfine coupling A [START_REF] Flouquet | Prog. Low. Temp. Physics VII[END_REF] or the crystal field effect C CF . [START_REF] Cornut | [END_REF] If k B T K ≤ A or C CF , the angular momentum J of the Kondo paramagnetic center will feel these inner structures, and only after the selection of a reduced effective spin, the Kondo effect will act and governs the low temperature properties.

A nice case is the hyperfine coupling between the electronic effective spin J and its nuclear spin I submitted to the combined effect of a magnetic field (H) and the Kondo exchange term (Γ) between J and s the spin of the conduction electron according to the hamiltonian

H = A I • J + g J µ B H • J + g n µ n H • I -2Γ J • s
This situation was extensively studied by the nuclear orientation method on highly diluted radioactive nuclei. So far k B T K < A, in a first step I and J are coupled exactly like in atomic physics. Then the Kondo effect will occur on the selected fundamental state F = I -J or I + J depending the sign of A. When k B T K ≥ A, the behavior of electronic spin will be first governed by the Kondo effect leading in magnetic field to an average value J z and thus an effective hyperfine field H ef f on the nuclei proportional to the magnetization. This idea is clearly demonstrated in nuclear orientation experiments realized notably on AuCe or LaCe alloys. 3 At zero pressure (P ), it was found for Au 137 Ce that the electronic spin is mainly coupled to the nuclear spin without any sensibility to any Kondo mechanism (i.e T K may be lower than mK) why already in LaCe a large reduction of H ef f is observed by comparison to a free electronuclear motion (k B T K ∼ A). Furthermore, here the measurements under pressure (see figure 1) 4 point out an increase of T K by a factor 5 from 120 mK at 0.2 GPa to 600 mK at 1 GPa. The high degree of localisation of the 4f electron on the 4f shell (occupation number n f ) is also nicely proved by the weak variation of the saturated value. An illustration of the interplay between the Kondo effect and the hyperfine coupling was

given by the study of the resistivity of AuYb realized with different isotopes and thus different hyperfine couplings. 5 Hyperfine measurements either by nuclear orientation 6 or Mössbauer A highly discussed problem is the interplay between k B T K and C CF . Experiments notably on Al 2 LaCe (see [START_REF] Cornut | [END_REF][START_REF] Steglich | Festkörperproblem (Advances in Solid State Physics)[END_REF] have shown also that provides k B T K ≤ C CF , the Kondo effect at low temperature is realized on the doublet ground state Γ 7 for this cubic material. Under pressure, as we will see later, the Kondo temperature will increase strongly while the crystal field splitting has a smooth pressure variation. The recovery of the full degeneracy under pressure at a pressure P V is an important issue in the change of a single Kondo behavior but also in the properties of the Kondo lattice.

When the impurity cannot be considered as isolated among the Fermi sea, one must discuss the interplay between the Kondo energy and the intersite coupling E ij . For an effective spin equal to 1/2 i.e for a high degree of the 4f localisation (n f ∼ 1), E ij can be mediated by the well known Ruderman, Kittel, Kasuya, Yoshida interaction (RKKY) carried out by the light electron. As a function of Γ and N (E F ) the density of states of the light electron, k B T K and E ij can be written [START_REF] Hewson | The Kondo problem to heavy fermions[END_REF] as

E ij = Γ 2 N (E F ) k B T K ∼ 1 N (E F ) exp - 1 ΓN (E F ) (1)
with ΓN (E F ) = ∆/E 0 and k B T F = N (E F ) -1 . ∆ and E 0 correspond respectively to the line width and position of the virtual 4f bound state. These two terms fix n f . When k B T K ≥ E ij at a critical pressure P C , the long range magnetism will collapse according to the popular Doniach scheme. [START_REF] Doniach | [END_REF] However, the effects in the Kondo lattice may be more subtle, when k B T K crosses C CF at P V , E ij will drop by one order of magnitude. [START_REF] Ramakrishnan | Valence fluctuations in solid[END_REF] Thus P C can never exceed P V .

Of course, now, the electronic conduction bath is not infinite by respect to the number of cerium sites.

From the impurity to the lattice

Three different views can be taken for the collapse of long range magnetism : (1) the previous Doniach scheme, [START_REF] Doniach | [END_REF] (2) the generalisation of the spin fluctuation theory successfully applied for 3d itinerant magnetism, 12 (3) a push pull mechanism between magnetic and electronic instability strongly related with a change in the occupation number. In the case (1), the Fermi surface is basically assumed to be that given under the assumption of a localized 4f electron.

In case (2), the 4f electron is considered to be already itinerant at a pressure P KL ≤ P C . However, in case (3), the quantum effects are furtive with the interferences between spin dynamics, charge motions and their localization.

If the collapse of long range magnetism is via a second order phase transition, one may expect a divergence of the magnetic coherence length ξ m at P C coupled with a collapse of a characteristic temperature. In spin fluctuation theory, the corresponding temperature T sf vanishes as (P -P C ) α with α = 1 or 3/2 for antiferromagnetism or ferromagnetism. 12 If the hidden parameter is the occupation number, one may expect a tiny discontinuity in volume and thus a first order transition with the consequence of finite value of ξ m and related low Kondo lattice energy T KL .

Figure 3 mimics the situation of Ce 3+ and Yb 3+ which corresponds to the trivalent configuration 4f 1 and 4f 13 . The Kondo phenomena is linked with the release of 1 -n f electron from Ce 3+ or the addition of 1 -n f electron to Yb 3+ according to the scheme:

Ce 3+ ⇆ Ce 4+ + 5d Yb 2+ ⇆ Yb 3+ + 5d
For a single impurity, the expression of T K as a function of the occupation number is given by 9

k B T K ∼ 1 -n f n f ∆ (2)
of course T K depends as n f of the value of E 0 and ∆ (the degeneracy factor N f has been dropped). In a lattice, there will be a feedback between the Kondo effect on a given site and the Fermi sea. That pushes to propose for the lattice a simple form for T 3+ KL equal to :

Yb 3+ n f Ce 3+ n f 1-n f 1-n f
T 3+ KL = (1 -n f )T F with T F ∼ D(n F ) a typical electronic bandwidth. T 3+
KL is attributed to the 3+ configuration (Ce 3+ or Yb 3+ ) during its lifetime. (The missing factor n f in formula 2 will be recovered as the average susceptibility will vary as

n f χ 3+ ∼ T -1
KL n f .) Looking only to the low carrier doping (i.e neglecting the Brillouin zone). The corresponding relation for T KL for Ce 3+ and Yb 3+ configuration will be:

k B T KL (Ce 3+ ) = (1 -n f ) 5/3 D 0 (3)
k B T KL (Yb 3+ ) = (1 -n f )n 2/3 f D 0 (4)
where D 0 is the 5d bandwidth and independent of n f . A sound discussion on the relation between T KL , n f and n c the extra conduction number in the lattice can be found in Trees et al., 13 and Ikeda and Miyake et al. 14 In this crude model, the striking point is that the dependence T KL for the Ce 3+ configuration will increase continuously as n f decreases. For the Yb 3+ one, as the original free 5d electron becomes absorbed in the 4f 14 configuration, T KL will go through a maximum. Thus slow relaxing Yb 3+ (but also Sm 3+ ) moments characteristic of the trivalent configuration can survive even for a rather weak occupation number (n f ∼ 2.7).

We want to point out, that one can expect drastic differences between Ce and Yb (or Sm) compounds in the magnetic properties near P C . Furthermore, the underlining idea is that the effective mass m * will be finite even at P C and is basically determined by T K . The nondivergence of m * appears clearly in the superconducting phase coupled with the collapse of the antiferromagnetic ordering at P c . Rather moderate values of the strong coupling parameter is required for a good fit of the upper critical field.

but the associated coherence length ℓ LK associated with T KL and m * can strongly increase near P C . Furthermore, the 5d electrons may react to the 4f correlations. So D may depend on a less trivial form on n f . For example, D(n f ) may reach a high value for n f → 1 and a weak one for n f ≤ 2.8. An illustration will be given below with the gold phase of SmS where obviously at small enough pressures (P < P ∆ see later) the 5d electron prefers to be trapped around the Sm centers. The relation of the pseudogap shape of D with n f is a central issue in strongly correlated electronic systems and will not be discussed here.

The key problem is to derive a characteristic temperature for the lattice. It is amazing that in the limit of low carrier density it was proposed that T KL varies as n 1/3 . 16 With the previous relation 4, this prediction is recovered in the Yb case remaining that T KL = T KL (Yb 3+ )/n f .

Another suggestion was that T KL goes like T 2 K , 17 an expression not so far to the initial T 5/3 K law proposed for the Ce case. An appealing possibility is that as the effective mass increases, its coherent circulation over the Kondo loop increases. If ℓ KL is proportinal to m * , the heavy particle of mass m * will travel through the full Kondo loop after a time τ KL ∼ (m * ) 2 . Of course the great novelty is that the situation is different from that found in normal rare earth intermetallic compound where the information is carried by light particles with mass near the bare electronic mass m 0 over a small atomic distance a 0 leading to a fast response τ 0 ∼ m 0 a 0 .

This slow motion over large distances may lead to unusual time and space response of the quasiparticle.

Pressure effects

Discussing the pressure variation of T K for a single impurity requires to know the relative pressure variation of ∆ and E 0 . The expression for ∆ as a function of the hybridization term v dk between the f and light electron is :

∆ = πv 2 dk N (E F )
The pressure increase of ∆ is related to the increase of the bandwidth of the Fermi sea. It is wellknown for normal metal that the volume variation of T F is governed by the increase of the atomic density leading to a Grüneisen parameter

-∂ log T F ∂ log V = Ω F = +2/3. If we assume v dk ∼ N (E F ) -1
one recover the formula suggested for the Kondo lattice as ∆ ∼ T F . The high sensitivity of the cerium impurity to P can be easily understood (assuming E 0 fixed) by the weakness of ∆/T F ∼ 10 -2 in comparison to E 0 /T F ∼ 0.2. After equation 1, with T K equal to:

T K = T F exp - E 0 2 • 10 -2 T F the Grüneisen parameter of T K becomes Ω T K = Ω T F 1 + 50E 0 T F ∼ 10Ω T F .
If E 0 is reduced of course there will be an extrasource of an amplification.

Another evaluation of Ω T K can be made via the relation 2. Of course T K depends on two parameters, n f and ∆ but assuming ∆ = T F , the main source of variation of T K arises through that of n f :

∂T K T K ∼ 1 (1 -n f ) ∂n f n f
with the crude estimate that n f varies linearly with the volume according to Vegard's law :

n f = V -V 4+ V 3+ -V 4+ V 3+
and V 4+ being the volume attribute to the 3+ and 4+ configuration. One gets

Ω T K ∼ 1 (1 -n f ) V 3+ (V 3+ -V 4+ )
for n f → 1;

For V 3+ -V 4+ = 0.5V 3+ (the 4f configuration is in fact never reached for the cerium case) , the Grüneisen parameter of T K will be Ω T K ∼ 2(1 -n f ) -1 . For cerium heavy fermion compounds

n f > ∼ 0.9, thus Ω T K > ∼ 20.
Basically, Ω T K and m * K , the local effective mass due to the Kondo effect m * K ∼ 1 T K scale each other. As pointed out, 21 a constant ratio Ω/m * K will imply a logarithmic dependence of the interaction responsible for the dressing of the quasiparticle. Recent developments in high energy spectroscopy of Kondo systems have lead to a direct charge visualization of the Kondo resonance for cerium intermetallic compounds. However, the extrapolation to the single impurity parameter is not straightforward (see Malterre et al. 18 ). Let us stress here that qualitatively the results obtained on Ce compounds agree with our previous statements. The situation is far less clear for the the Yb systems. It was already underlined that the differences reflect a smaller interconfiguration energy in the Yb case than in the Ce one. For Ce, the 4f 0 and the 4f 1 configurations are separated by 2 eV. For Yb, the separation can be less than 100 meV. 18 In temperature, the experimental Grüneisen parameter defined as the ratio of the thermal expansion α = -1 V ∂V ∂T by the specific heat C (normalized by the molar volume V and the compressibility κ) is a simple powerful tool to test if the free energy F depends only on one parameter (T * , here T K for a single impurity) as if :

F = T Φ(T /T * ) Ω(T ) = Ω 0 = constant Ω(T ) = - ∂ log T * ∂ log V = α C
V κ Typical values for Kondo impurity are around 50. The remarks of large Grüneisen parameters for heavy fermion compounds were made in., 1920 The thermal expansion is huge as it goes then as (m * ) 2 . If m * is three order larger than the bare electronic mass, the corresponding electronic thermal expansion is six times higher than the usual electronic one. That leads us to suspect that the density fluctuations are crucial in the heavy fermion problems and notably in Cooper pair pairing. When we will consider the lattice, the study of the ratio α/C in temperature is a sound cheap way to test if competing interactions occur. The slow recovery of a constant Ω(T ) is the indication to the "'tenuous"' entrance in a Fermi liquid regime. In spin fluctuation theory, the effective mass increases at P c but stays finite while Ω * (P c ) diverges. 12, 22

CeRu 2 Si 2 : an example of paramagnetic Kondo lattice

The tetragonal compound CeRu 2 Si 2 at zero pressure realized ideal conditions for the understanding of a high correlated Kondo lattice : P C ∼ -0.3 GPa will be located few kbar below P = 0, furthermore P V is near 4 GPa. 23 So a large pressure range exists for a careful study of a spin 1/2 Kondo lattice. The tuning below P C can be even achieved by expanding the lattice with lanthanum 24 or germanium substitution. In the serie Ce 1-x La x Ru 2 Si 2 , antiferromagnetism (AF) is only detected for x ≥ 0.075. The figure 4 positive, T M C ∼ 12 K, T M χ = 10 K, T M ∝ = 8.7 K the temperature of the maxima in specific heat, susceptibility and thermal expansion, T Q ∼ 0.5 K where the thermoelectric power Q reaches its T linearity and T A = 0.3K where the Fermi liquid inelastic AT 2 term is observed in resistivity. 15 The excellent quality of large crystal have allowed two important microscopic experiments.

Inelastic neutron measurements show clearly that antiferromagnetic correlations set in at T -,+ ; even at T → 0 K, the coherence length is restricted to few atomic distances. 15

De Haas van

Alphen experiments needs the itineracy of the f electrons to be explained selfconsistently with band calculations at least P KL ≤ P V . An effective mass up to 120 m 0 has been detected. 26,27 Applying pressure in CeRu 2 Si 2 leads to a strong decrease of m * (Ω * (P = 0) ∼ 190). 28 The derivation of the pressure variation of the Grüneisen parameter shows that Ω * reaches another plateau at P V ∼ 4 GPa with Ω * (0) = 80.

An external magnetic field can modify the nature of the magnetic interactions. The metamagnetic field H C characteristic of the AF (H, T ) phase diagram ends up at a critical point at P C . 29 For P ≥ P C , only a well defined crossover at H M will occur between a low field state dominated by AF correlations (H ≤ H M ) and a high field phase (H ≥ H M ) dominated by ferromagnetic (F) coupling and the progressing alignment of the cerium magnetization. That leads to drastic changes in some characteristic temperatures as T ∝ . 24 The switch from AF to F correlations, 15 , 3031 have been nicely observed in neutron scattering experiments as well as associated drastic changes of the Fermi surface through H M . 26,27 It is worthwhile to underline that P and H are generally different. Under pressure here, the dominant AF correlations are preserved, but slowly mollified on approaching P V . So the phenomena at P c for H < H M can be ranked as AF quantum critical behavior. In H there is a switch in the nature of the correlations at H M which emerges from a critical end field H c (P c ). However the change from AF to F interactions is governed by the H shift of the Fermi level inside the pseudogap structure created in this Kondo lattice. 33 Thus the quasi divergence of Ω * (H, P = 0) occurs at H M . 15 If H c will continuously collapse with T N as P → P c , the magnetic field opens the possibility to tune at low magnetic fields through P c . 32 A rich variety of(H, P, T ) puzzles with new figures can be drawn with the interplay of the crossover phase diagram of figure 6 and classical phase diagrams for magnetism and supraconductivity Towards these clear facts, the paramagnetic phase of CeRu 2 Si 2 may be the matter of new motions (magnetic current) as a tiny magnetism (sublatice magnetization near 10 -3 µ B ) has been detected around T ∼ 2K 34 with an associated signature in the thermoelectric power. 35 An appealing possibility of this furtive magnetism is that it will be a macroscopic consequence of the circulation of the quasiparticule along their special Kondo lattice loop. Another open question is the validity of the concept of a second order phase transition. New experiments on Ce 0.925 La 0.075 Ru 2 Si 2 , which is located at x = x c , shows clearly that the characteristic energy does not collapse 36 at x c . The dogma of a second order quantum critical point may be revisited.

The interesting perspective is that the magnetic instability is associated with a change in the localization of the particle (i.e in a discontinuity of n f ). Indeed for CeIn 3 , 37 CePd 2 Si 2 38 and CeRh 2 Si 2 , 39 P C = P V and first order transitions at P c are observed 37,39 or strongly suspected. 38 Of course, the transition may be weakly first order as large fluctuations are generally observed in the specific heat. It is worthwhile to compare with the first order liquid-solid transition of 3 He where on the melting curve at P ∼ 34 bar the volume discontinuity is near 5%. For heavy fermions, P c is often around 3 GPa, i.e. three orders of magnitude larger than in 3 He. Thus a volume discontinuity of 5 × 10 -5 will give a comparable mechanical work (P ∆V ) than in 3 He on its melting curve. Tiny first order transitions may correspond to a 10 -7 or less effect on the volume contraction.

To go back on the hyperfine coupling, it is worthwhile to point out that for Ce only an even stable isotope exists. There is no hyperfine coupling. However for natural Yb, four isotopes exist two even (I = 0) 172 Yb and 174 Yb but two odd, 171 Yb (I = 1/2) and 173 Yb (I = 5/2). If T KL ≤ A, the full electronuclear dynamic must be considered. Even, an unusual magnetic ordering may be boosted by the nuclear spin. This may lead to new features for the Yb compounds in comparison to the cerium heavy fermion compounds. Surprisingly for YbRh 2 Si 2 even with a very low Néel temperature T N ∼ 70 mK and tiny ordered moments (see 31 ), a very nice specific heat anomaly occurs while in Ce Kondo lattice, tiny calorimetric signature is only visible. 15 Recent experiments on YbRh 2 Si 2 with the 174 Yb isotope shows the persistence of magnetic ordering. 40 The different behavior between the CeRu 2 Si 2 serie and YbRh 2 Si 2 may be due to 4f -5d correlations not included in the usual Kondo approaches.

Magnetism and superconductivity

In heavy fermion compounds, superconductivity appears related with magnetic and valence instabilities (P C and P V ). The P and H tunings of the electronic correlations give unique tools in the interplay between magnetism and superconductivity. Furthermore due to the weakness of the parameters (T KL ∼ 1 K, H M ∼ 10 T) experiments can be realized with small scale equipments. In the previous case of CeRu Recently, careful ac calorimetric experiments 43 were done on the new discovered 115

CeRhIn 5 compound. 44 The great experimental interest of this material is that the optima of their magnetic ordering at T N and superconductivity at T C temperatures are comparable and located in a easy range of temperature (T ∼ 2 K). As shown in figure 6, AF disappears via a first order transition. In good agreement with this statement, AF never succeeds to superconductivity on cooling. Below P C , the opposite occurs but the superconducting phase is gapless. Our proposal is that specific heterogeneities occurs when T N starts to decrease deeply. Here bulk superconductivity and antiferromagnetism may be antagonist.

Valence, conduction and magnetism : SmS

One of the fascinating facet of the Kondo lattice illustrated in SmS experiments, 44 , 45 , 46 is that the physical properties may look that of a specific configuration Sm 2+ (J = 0) or Sm 3+

(J = 5/2) despite the fact the occupation number n f if far from unity. New results on SmS demonstrate the curious dressing of the heavy electrons. SmS is a key matter as the previous equilibrium:

Sm 2+ ⇆ Sm 3+ + 5d
governs the release of a 5d itinerant electron.

In the divalent black (B) phase, Sm 2+ S --is an insulating non magnetic as J = 0 for the 4f 6 Sm 2+ configuration. In the intermediate valent gold (G) phase, the valence v is near 2.7

(v = 2+n f ) right at the first order phase transition at P B-G ∼ 1.2 GPa ; the high temperature behavior corresponds to the disordered regime of a Kondo lattice but at low temperature up to P ∆ ∼ 2 GPa the ground state ends up in a non magnetic insulating phase : D depends on n f . Above P ∆ for v ∼ 2.8, SmS is a metal at T → 0 K ; its metallic behavior is quite analogue to that reported for ordinary heavy fermion compounds.

The simultaneous achievement of a macroscopic ac specific heat measurements 46 and of a microscopic nuclear forward, 4748 scattering experiments (NFS) gives now a complete view of the interplay between valence, electronic conduction and magnetism. Right at P ∆ , evidences were found below NFS for the slow spin motions of a Γ 8 ground state of Sm 3+ above T N F S ≥ T N . 46,47 The surprise is that P ∆ = P C i.e magnetic ordering occurs far below the pressure P 3+ where the trivalent state will be reached at P 3+ ≥ 10 GPa 49 (see figure 8).

Conclusion

The concept of Kondo impurity gives a huge impact in the physics of quantum complex systems. Its extension to Kondo lattice is already successful at least for the experimentalists.

With slight modifications (insertion of a pseudogap i.e. strong n f dependence of D), it appears possible to track the problem of the consistency between spin and charge motion and to follow some routes in the search for new effects and the discovery of new materials. Of course, in materials sciences, the Kondo engineering label covers also the domain of artificial Kondo nanostructures. We can argue of course on the validity of the engineering addenda to Kondo.

At least, it reinforces that the fundamental open questions remain. Experimentalists can built or look to new electronic and magnetic architectures or devices. In any case, the common points are that the initial potential has an atomic origin, the correlation length reaches nanometric size and high purity material with an electronic mean free path above 1000 Å can be achieved. Clean experiments have been already achieved and excellent perspectives exist to go behind the standard accepted concepts to enjoy fancy spin and charge motion and even to open new windows for applications. It may be also worthwhile to mention that the goal to elucidate fundamental problems has boosted the development of new instrumentations which have now wide applications from astrophysics cosmology to nanophysics and material siences.

The Kondo problem was a clear challenge which has required new concepts but also huge progress in the observation of low temperature physics.

JF thanks Profs. J. Friedel, T. Kasuya, K. Miyake, R. Tournier and Drs J.P. Brison, P.

Haen and D. Jaccard for stimulating discussions.

Fig. 1 .

 1 Fig.1. Nuclear orientation data for LaCe at 0.2 and 1 GPa. The solid and dash dotted curves were taken at 0.2 GPa before and after cycling to 1 GPa respectively (after Benoit et al.).4

effect 7 Fig. 2 .

 72 Fig. 2. The square and triangle points describe the Au 171 Yb resistivity of a 415 ppm alloy, the circle the Au 174 Yb resistivity of a 396 ppm alloy. The residual logarithmic slope of Au 171 Yb reflects only the presence of parasitic 5 ppm impurities of ion. The important feature is for Au 171 Yb, the maximum in the Kondo scattering coincides with the temperature where the singlet electron nuclear state becomes isolated from the triplet excited level (after Hebral et al.). 5

Fig. 3 .

 3 Fig. 3. It is the tiny departure from n f = 1 by the release of (1 -n) 4f electrons for the trivalent Ce impurity or the absorption of 1 -n f electrons for Yb ion which leads to the Kondo effect.

Fig. 4 .Fig. 5 .

 45 Fig. 4. Specific heat of Ce 1-x La x Ru 2 Si 2 on the both side of the critical concentration x c = 0.075.For x = 0.13, antiferromagnetism is observed. For x = 0.05, paramagnetism exists down to 0K.

Figure 6

 6 represents the deep minima reached by T α at H M : T α (H M ) ∼ 0.3 K i.e roughly the value of T A at H = 0.

Fig. 6 .

 6 Fig. 6. Field dependence of the temperature of the optimum of the thermal expansion measured at different field α H (T ). The full line describes the low field paramagnetic phase dominated by AF correlations, the dashed lines the high field phase dominated by a F coupling.

Fig. 7 .

 7 Fig. 7. Phase diagram of CeRhIn 5 as determined by specific heat (• and •) and susceptibility (△). In addition T C (P) from resistivity measurements after. 45 (×) marks the first order phase boundary between antiferromagnetism (AF) and superconductivity (SC).

Fig. 8 .

 8 Fig. 8. Phase diagram of SmS in the gold phase. Slow relaxation is observed in NFS experiments at T N F S , ac calorimetric measurements has located the ordering temperature T N . Short range magnetic correlations persists in the low pressure (P ≤ P ∆ ) of the gold phase where a gap occurs for the electronic conduction. Above P V , the ground state is AF and metallic. The trivalent state is reached far above 10 GPa, 4849

2

  Si 2 , no superconductivity has been detected under pressure. That may emphasize at P C either the weakness of the pairing mechanism for Ising spin as Ce in CeRu 2 Si 2 15 or as observed for CeRh 2 Si 2 39 a sharp superconducting domain right at P C . Around P V , new careful pressure experiments must be realized to test if another superconducting domain may exist as found for CeCu 2 Si 2 41 and CeCu 2 Ge 2 . 42


Marco Baldi

Jean-Christophe Deneuville
email: jean-christophe.deneuville@enac.fr

Edoardo Persichetti
email: epersichetti@fau.edu

Paolo Santini
email: p.santini@univpm.it

Cryptanalysis

Cryptanalysis of a code-based signature scheme without trapdoors

Keywords: Code-based cryptography, cryptanalysis, digital signature, zero-knowledge identification scheme

Introduction

encryption schemes are varied, well-represented and made it to the third (and likely final) round with three promising candidates [START_REF] Albrecht | Classic McEliece: conservative code-based cryptography[END_REF][START_REF] Aragon | BIKE: Bit Flipping Key Encapsulation[END_REF][START_REF] Aguilar Melchor | HQC (Hamming Quasi-Cyclic[END_REF], only three candidates for code-based signature schemes were presented to the first round to begin with, and they have all since been either broken, or withdrawn.

The difficulty of producing secure and efficient code-based signatures is, in a sense, inherent to the setting. In fact, "hash-and-sign" schemes à la CFS [START_REF] Courtois | How to achieve a McEliece-based digital signature scheme[END_REF] have to somehow deal with the fact that it is not straightforward to find a preimage (decode) with the required characteristics (low Hamming weight), given a random input; this results in very slow signing times, besides the large public keys which are typical of code-based cryptography in general. A new approach, that uses rejection sampling and ternary vectors of very high weight [START_REF] Debris-Alazard | Wave: A new family of trapdoor one-way preimage sampleable functions based on codes[END_REF], still presents very large keys, despite the improvement in signing time and the very short signature size. Another approach to the design of code-based digital signature schemes is that of deriving them from zeroknowledge code-based identification schemes [START_REF] Stern | A new identification scheme based on syndrome decoding[END_REF][START_REF] Véron | Improved identification schemes based on error-correcting codes[END_REF][START_REF] Cayrel | A zero-knowledge identification scheme based on the q-ary syndrome decoding problem[END_REF][START_REF] Biasse | LESS is more: Code-based signatures without syndromes[END_REF] through the well-known Fiat-Shamir transformation. This generally results in a quite large signature size, which is a consequence of the multiple repetitions necessary to reach the desired (negligible) soundness error. In this scenario, it would be a boon to be able to devise a scheme following the Schnorr-Lyubashevsky approach [START_REF] Lyubashevsky | Lattice signatures without trapdoors[END_REF], which has been extremely successful for the lattice case [13]; unfortunately, despite the similarities between the two settings, this has been an insurmountable task so far, at least for the Hamming metric. A first attempt was given in [START_REF] Persichetti | Improving the Efficiency of Code-Based Cryptography[END_REF], where a negative result is presented, concluding that a straightforward adaptation (including a rank-metric version) was unlikely to succeed. A subsequent work [START_REF] Persichetti | Efficient one-time signatures from quasi-cyclic codes: A full treatment[END_REF], that used quasi-cyclic codes, was cryptanalyzed in [START_REF] Deneuville | Cryptanalysis of a code-based one-time signature[END_REF][START_REF] Santini | Cryptanalysis of a one-time code-based digital signature scheme[END_REF], despite offering only a one-time solution. New adaptations were proposed again [START_REF] Song | A new code-based signature scheme with shorter public key[END_REF] and again [START_REF] Song | A code-based signature scheme from the Lyubashevsky framework[END_REF], always with the same negative outcome [START_REF] Aragon | Cryptanalysis of a rank-based signature with short public keys[END_REF][START_REF] Aragon | Cryptanalysis of a code-based full-time signature[END_REF].

In this work, we cryptanalyze the latest installment in this long series of unsuccessful attempts [START_REF] Li | A new code based signature scheme without trapdoors[END_REF]. This new scheme, which we shorten to LXY (using the authors initials), incorporates a rejection sampling component, as in the original work of Lyubashevsky [START_REF] Lyubashevsky | Lattice signatures without trapdoors[END_REF]. Furthermore, as another difference with its ancestors, the authors propose to use a denser noise vector to hide the secret key structure into a produced signature. In order to accommodate such choices, the parameters grow considerably, and the rejection rate is quite high, resulting in a scheme with very slow signing times and very long signatures. Unfortunately, it appears not even these extreme measures are enough to guarantee the security of the scheme. Indeed, we show that the considered rejection sampling does not guarantee indistinguishability of the signatures, since it only takes into account their weight and not their supports. Starting from this observation, we first describe why the signatures are correlated with the secret key, and then how the secret key can be fully recovered after a very limited number of observations. As a result, the scheme can be considered, at best, as one-time secure, and therefore, considering the performance aspects mentioned above, not interesting in practice.

The paper is organized as follows. In Section 2 we introduce the notation we use throughout the paper, and remind the LXY scheme. In Section 3 we explain why produced signatures leak information on the secret key, and in Section 4 we exploit this leakage to mount a successful key recovery attack.

Notation and background

In the rest of the paper, we denote with F 2 the finite field with two elements. Vectors will be denoted with bold small letters, while capital bold letters will be used for matrices. For a vector a, we indicate the Hamming weight as wt(a), and the support (i.e. the set of indices of non-null entries) as Supp(a).

Given two integers a, b, we denote with [a; b] the range of integers from a to b. If a and b are, in general, reals, we use [[a; b]] to denote the set of integers from a to b . For n ∈ N, we denote as R = F 2 [x]/(x n + 1) the ring of binary polynomials modulo x n + 1, and represent each element of R as the corresponding vector of coefficients with entries over F 2 and length n. We use Rot j to denote the operator that applies a cyclic-shift of j positions; in other words, for a = (a 0 , a 1 , • • • , a n-1 ), we have

Rot j (a) = (a j , a j+1 , • • • , a n-1 , a 0 , a 1 , • • • , a j-1 ).
Finally, we use L to denote the lifting of a vector from F 2 to {0, 1} ⊆ Z.

We will use B m τ to denote the distribution of length-m vectors where each entry follows a Bernoulli distribution with parameter τ (i.e. is set with probability τ and is null with probability 1 -τ ). The Probability Distribution Function (PDF) of the weight of such vectors is as follows

f m τ (x) = 0 if x ∈ [0; m], m x τ x (1 -τ ) m-x otherwise.
Furthermore, we denote with B m ξ,τ the distribution of vectors sampled from B m τ and whose weight is in [[mτ -ξ; mτ + ξ]]. The PDF of the weight of such vectors follows the so-called truncated binomial distribution, given by

f m ξ,τ (x) =    0 if x ∈ [[mτ -ξ, mτ + ξ]], f m τ (x) mτ +ξ i= mτ -ξ f m τ (i)
otherwise.

The LXY scheme

In [14, Section 4], the authors describe a general setting for their signature scheme, which already incorporates the rejection sampling in the signature generation. Such a construction is then specialized in [14, Section 6], using quasi-cyclicity and codes with rate 1/d, where d ≥ 2. Note that parameters are provided only for the case of d = 2 (i.e. code with rate 1/2). Hence, we mainly focus on such a variant, and will refer to it as the LXY scheme; in Section 4.1 we will briefly comment on the security of the more general setting. Algorithms 1, 2 and 3 recall the functioning of the LXY scheme. We have used H to denote a so-called Weight Restricted Hash Function, i.e. a hash function that outputs digests of length n and weight w. The rejection sampling in the signing algorithm is performed through the instructions in lines 6-9. The function ϕ(ω) is such that the PDF of the signature weight ω is tuned to be indistinguishable from the truncated binomial distribution f 2n ξ,τ . For details about how ϕ(ω) is computed, we refer the interested reader to [14, Section 3].

Algorithm 1 KeyGen

Input: Public parameters n, u ∈ N. Output: h ∈ R 1: Choose s1, s2 ∈ R with weight u 2: h ← s2s -1 1 3: sk ← (s1, s2), pk ← h 4: return pk, sk

Algorithm 2 Sign

Input: pk = h, sk = (s1, s2), message m, WRHF H, rejection function ϕ and parameters n, ξ ∈ N, τ ∈ R.

Output: Signature (z1, z2, c) ∈ R 3 on message m.

1: Sample e1, e2 from B n τ 2: y ← he1 + e2 3: c ← H (y, m) 4: z1 ← cs1 + e1, z2 ← cs2 + e2 5: ω ← wt(z1) + wt(z2) 6: if ω ∈ [[2nτ -ξ, 2nτ + ξ]] then 7:
Output z1, z2, c with probability ϕ(ω), else restart 8: else

9: Restart

Algorithm 3 Verify

Input: pk = h, message m, signature (z1, z2, c), WRHF H and parameters n, ξ ∈ N, τ ∈ R.

Output: Accept if (z1, z2, c) is valid, Reject otherwise 1: w ← wt(z1) + wt(z2) 2: if w ∈ [[2nτ -ξ, 2nτ + ξ]
] and H (hz1 + z2, m) == c then return Accept

3: else return Reject

It is easy to see that an honest signature always gets accepted. Indeed, rejection sampling guarantees that the weight of a signature is in the range [[2nτ -ξ; 2nτ + ξ]] and, for a valid signature (z 1 , z 2 , c), the following holds

hz 1 + z 2 = c(hs 1 + s 2 ) + he 1 + e 2 = he 1 + e 2 = y, since hs 1 = s 2 s -1 1 s 1 = s 2 .
So, the digest of hz 1 + z 2 is identical to c. The parameter sets recommended in [START_REF] Li | A new code based signature scheme without trapdoors[END_REF] are reported in Table 1, where λ denotes the claimed security level in bits. The public key size corresponds to n bits, while the signature size is given by 2n+w log 2 (n) bits (2n bits for z, and additional w log 2 (n) bits to represent the support of c). Hence, the resulting public key and signature sizes are 8.31 kB and 16.63 kB, respectively, for the instance with 80-bit security, while they are 31.07 kB and 62.16 kB, respectively, for the instance with 128-bit security.

Information leakage

Signatures produced by the LXY scheme have essentially the same structure as those of Persichetti's one-time scheme [START_REF] Persichetti | Efficient one-time signatures from quasi-cyclic codes: A full treatment[END_REF]. Indeed, for both schemes, the signature is z 1 , z 2 , c , where z i = cs i + e i and c, s i and e i are somehow sparse. The vector e i acts as a noise term, and its role is that of hiding cs i into z i . Note that the support of each z i is contained in

Supp(e i ) ∪ {j + mod n | j ∈ Supp(c), ∈ Supp(s i )}.
In Persichetti's scheme, s i and e i are very sparse and their weights are close, so that most of the set entries in a signature come from the product cs i . This gives the possibility of mounting attacks based on the correlation due to quasi-cyclicity. More precisely, an adversary can compute all vectors Rot j (z i ), for j ∈ Supp(c), and consider the positions of the entries that are set in a large number of such vectors: these positions belong to the support of s i with high probability.

As shown in [START_REF] Santini | Cryptanalysis of a one-time code-based digital signature scheme[END_REF], this procedure allows retrieving a significant amount of information about the secret key (the remaining portion can be recovered via Information Set Decoding).

The LXY scheme differs from Persichetti's scheme in two major aspects:

i. the weight of each e i is much larger than that of both s i and cs i . Then, an overwhelming majority of the set entries in each z i corresponds to those of e i ; ii. with the rejection sampling in the signing algorithm, the PDF of the weight of the signatures is tuned to the truncated binomial distribution f 2n ξ,τ (i.e. that of vectors sampled from B 2n ξ,τ ). Because of these two features, in [14, Section 7.2], the authors claim immunity against known attacks such as [START_REF] Deneuville | Cryptanalysis of a code-based one-time signature[END_REF][START_REF] Santini | Cryptanalysis of a one-time code-based digital signature scheme[END_REF]; technically, they affirm that, as an effect of rejection sampling, the produced signatures are indistinguishable from vectors that are randomly sampled according to B 2n ξ,τ . The security proof follows from this statement. We are able to refute this claim and prove that the signatures in the LXY scheme leak information about the secret key. We show that e i cancels a non trivial, but still not large enough, portion of cs i : this opens up for the possibility of statistical attacks as in [START_REF] Santini | Cryptanalysis of a one-time code-based digital signature scheme[END_REF]. The reason lies in the fact that rejection sampling in the LXY scheme only takes into account the weights of z 1 and z 2 , but not their supports. As a result, the support of each z i contains a moderately large portion of the support of cs i , in which the positions of set entries are correlated due to quasi-cyclicity. As in Persichetti's scheme, this bias allows to gather information about the secret key.

Measuring the information leakage

To keep the computation as simple as possible, we introduce some elementary and plausible simplifications:

A) we assume that the weight of each z i , which we denote with ω i , follows a truncated binomial distribution B n ξ/2,τ ; B) we assume that the product cs i always has maximum weight uw.

Note that, in principles, both z 1 and z 2 can have any weight in [[0; 2nτ + ξ]]. However, we expect their weight distribution to be rather concentrated around the average value (which is nτ ), so that very low or high weights appear with negligible probability. Hence, it seems natural to use the distribution B n ξ/2,τ for both ω 1 and ω 2 . This guarantees that ω = ω 1 + ω 2 is not outside the range [[2nτ -ξ; 2nτ + ξ]] and follows a binomial distribution with average value 2nτ . Assumption B comes from the fact that both c and s i are extremely sparse: one expects that cancellations are very rare, and that their product has maximum weight with very high probability.

Let us now consider a signature (z 1 , z 2 , c), and define -ω i as the number of elements that are contained in both Supp(cs i ) and Supp(e i ); -ω i as the number of elements that are in Supp(e i ) but not in Supp(cs i ).

Note that ω i corresponds to the number of set entries of cs i that are cancelled by e i , while ω i corresponds to the amount of set entries in z i which are due to e i . Furthermore, we have wt(z i ) = wt(cs i ) -ω i + ω i . Because of assumption B, we have wt(cs i ) = uw, so that

ω i = uw -ω i + ω i .
When ω i = a ∈ [[nτ -ξ/2; nτ + ξ/2]], the probability that ω i has value x ∈ [0; uw] is given by

Pr[ω i = x | ω i = a] = f uw τ (x)f n-uw τ (a + x -uw) uw b=0 f uw τ (b)f n-uw τ (a + b -uw) .
Hence, summing over all possible ω i , we obtain the expression of the PDF of ω i , that is

Pr[ω i = x] = nτ +ξ/2 a= nτ -ξ/2 Pr[ω i = a]Pr[ω i = x | ω i = a] = nτ +ξ/2 a= nτ -ξ/2 f n ξ/2,τ (a)Pr[ω i = x | ω i = a]. (1)
A validation of the above formula is shown in Figure 1, where we compare the theoretical PDF of ω i with the one we have obtained empirically, by measuring the number of cancellations on a large number of produced signatures. As we see, the experimental PDF closely matches the theoretical one; this also provides evidence that assumptions A and B introduced earlier have no practical impact on our analysis. Let be the ratio between the average value of ω i and the weight of cs i , that is

= uw j=0 j • Pr [ω = j] uw .
Note that corresponds to the fraction of entries of cs i that are canceled by e i and, by definition, ∈ [[0; 1]]: thus, we can use it as the probability that a set entry in cs i will not be set in the final z i . For j ∈ Supp(c), let z (j) i = Rot j (z i ); we have the following two situations: -if ∈ Supp(s i ), then the -th entry of z (j) i is set with probability ρ = 1 -.

In fact, it will be set unless e i cancels it (i.e. e i has a one in the same position); -if ∈ Supp(s i ), then the -th entry of z

(j) i is set with probability ρ = τ n -uw n + (1 -) uw n = τ (1 -uw/n) + (1 -)uw/n.
Since uw n, we have ρ ≈ τ .

For the proposed parameters for the LXY scheme, the values of ρ and ρ are significantly different:

-for the 80-bits parameters set, we have = 0.23831, so that ρ = 0.7617 and ρ = 0.24156; -for the 128-bits parameters set, we have = 0.24252, so that ρ = 0.75748 and ρ = 0.24769.

The gap between ρ and ρ allows to distinguish whether a position is in Supp(cs i ) or not.

Starting from this observation, in the next section we present a full key-recovery attack (in a fashion similar to that proposed in [START_REF] Santini | Cryptanalysis of a one-time code-based digital signature scheme[END_REF]).

Fig. 1. Validation of (1) through numerical simulations. To empirically estimate the PDF, we have used approximately 10,000 signatures for the 80-bit parameters set, and 2,000 signatures for the 128-bit one.

Cryptanalysis results

Our key-recovery attack on the LXY scheme is reported in Algorithm 4. Basically, the procedure consists in collecting signatures and exploiting the aforementioned bias in the signature support to retrieve the secret s 1 and s 2 . For each new collected signature, we produce a candidate for the secret key as (s 1 , s2 ). To test it, we compute h = s1 s-1 2 and check if it is equal to the public key pk = h.

Algorithm 4 Key-recovery attack

Input: u ∈ N, public key pk = h Output: s1, s2 ∈ R with weight u, such that s2 s-1 1 = h 1: Set h ∈ R as the null element 2: Set a1, a2 ∈ Z n as null vectors 3: while h = h do 4:

Collect a new signature (z1, z2, c) 5:

for i ∈ {1, 2} do 6:

for j ∈ Supp(c) do 7:

ai ← ai + L Rotj(zi)

8:

Si ← u positions with largest values in ai 9:

si ← vector with support Si 10: h = s1 s-1 It is clear that Algorithm 4 runs in polynomial time, and a rough estimate of its complexity is as follows

N 2wn + 2u + n 2 + n 3 ,
where N is the number of required signatures. Indeed, for each new collected signature, we update a 1 and a 2 with a cost of 2wn operations and create s1 and s2 with approximately 2u operations (we assume the cost is equal to the number of entries we set). Finally, to compute h, we use n 3 operations to invert s-1 2 and n 2 operations to multiply it by s1 . We note that, in principle, the algorithm may return a pair (s 1 , s2 ) which is different from the actual secret key sk. This may happen only when equivalent keys exist, i.e., pairs (s 1 , s1 ) = sk, with s1 and s2 having weight u and such that h = s1 s-1

2 . Yet, any of such pairs can be used to construct signatures that will get accepted by the verification algorithm. Indeed, it is enough to run Algorithm 2, using s1 and s1 instead of s 1 and s 2 to obtain a valid signature.

We have implemented our algorithm 4 , building upon the authors' implementation5 of their signature scheme. Experimentally, the number N of signatures necessary to successfully perform a key recovery ranges from 4 to 9, for both parameter sets given in Table 1. Other results are reported in Table 2. The results were obtain on Intel R Xeon R Gold 6230 @ 2.10GHz running SageMath version 9.0. It is worth noting that once the signature scheme is set and enough signatures have been collected, the cryptanalysis in itself is quite efficient.

Comments on possible variants

In [START_REF] Li | A new code based signature scheme without trapdoors[END_REF], the authors also consider some possible variants for the scheme, although they do not recommend concrete parameters or provide any implementation. Yet, we are able to briefly comment about these possible generalizations.

Changing the code rate The LXY scheme may be instantiated with QC codes of rate 1/d, with d being an integer ≥ 2 (see [START_REF] Li | A new code based signature scheme without trapdoors[END_REF]Algorithms 5,[START_REF] Barg | Some new NP-complete coding problems[END_REF][START_REF] Berlekamp | On the inherent intractability of certain coding problems (corresp.)[END_REF]); in such a case, the signature z is made of d polynomials. For d = 2 (the only case for which parameters are recommended), the scheme corresponds to the one we have analyzed in this paper. Notice that, for d > 2, signatures are constructed in exactly the same way (i.e. they are of the form cs i + e i and are the output of a rejection sampling involving analogous distributions): hence, we believe that the same security issues will arise.

Using unstructured codes In [14, Algorithms 1,2,3] the authors describe a general version of the scheme, based on unstructured codes. Again, they neither propose concrete parameters nor provide an implementation for this variant. Yet, we believe that also this version can be attacked with techniques similar to that in [START_REF] Aragon | Cryptanalysis of a code-based full-time signature[END_REF]. Indeed, in this case the signature is in the form cS + e, where S is a very sparse matrix, c is the very sparse public digest and e is a moderately sparse random vector. Basically, if we consider two signatures with digests sharing a common set entry (say, the one in position j), then the corresponding signatures will be both obtained by summing the j-th row of S to other sparse terms. The rejection sampling will not guarantee a sufficient number of cancellations in the term cS, so that a large portion of its support will still appear in the output signature. Hence, there will still be correlation in the produced signatures, and collecting a sufficiently large number of signatures will still allow mounting a statistical attack to each row of S. Thus, we argue that also this variant should be considered secure, at best, only for the one-time use.

Conclusion

In this paper we have cryptanalyzed a code-based signature scheme constructed upon the Schnorr-Lyubashevsky framework. This scheme, which has a construction that is very similar to that of Persichetti's one-time scheme, comes with a different parameter choice and an ad-hoc rejection sampling step in the signing algorithm. However, it suffers from analogous weaknesses of other broken schemes, and its secret key can be successfully recovered upon collection of a relatively small number of output signatures. Hence, according to our results, the scheme can be deemed secure only for the one-time usage case.

2 11 :

 11 return (s1, s2)

Table 1 .

 1 LXY instances proposed in[START_REF] Li | A new code based signature scheme without trapdoors[END_REF]

	λ	n	u	w	τ	ξ
	80	66,467	49	6	0.23925	70
	128	248,579	75	8	0.24305	135

Table 2 .

 2 Cryptanalysis results, sampling, keygen, signature and cryptanalysis timings in seconds, along with the average number Nmean of necessary signatures λ t samp t keygen t sign t cryptanalysis N mean

	80 82.47 1.34 108.48	17.07	6.76
	128 626.38 5.77 1425.56	63.75	5.96

Available at https://github.com/deneuville/cryptanalysis_LXY

Available at https://github.com/zhli271828/rand_code_sign

The work of Edoardo Persichetti has been partially supported by NSF Grant CNS 1906360.