Fatima-Ezzahra El
email: fatimaezzahra.elorche@ens.fr

Rémi Géraud-Stewart

Peter B Rønne
email: peter.roenne@gmail.com

Gergei Bana
email: banag@missouri.edu

David Naccache
email: david.naccache@ens.fr

Peter Y A Ryan
email: peter.ryan@uni.lu

Marco Biroli

Megi Dervishi

Hugo Waltsburger
email: hugo.waltsburger@centralesupelec.fr

Time, Privacy, Robustness, Accuracy: Trade-Offs for the Open Vote Network Protocol

Keywords: Multi-party computation, open vote network, denial of service, decentralised voting

. An inherent limitation of OV-Net is its lack of robustness against denialof-service attacks, which occur when at least one of the voters participates in the first round of the protocol but (maliciously or accidentally) not in the second. Unfortunately, such a situation is likely to occur in any real-world implementation of the protocol with many participants. This could incur serious time delays from either waiting for the failing parties and perhaps having to perform extra protocol rounds with the remaining participants. This paper provides a solution to this problem by extending OV-Net with mechanisms tolerating a number of unresponsive participants, the basic idea being to run several sub-elections in parallel. The price to pay is a carefully controlled privacy loss, an increase in computation, and a statistical loss in accuracy, which we demonstrate how to measure precisely.

Introduction

Cryptographic voting protocols allow mutually-distrusting entities to verifiably compute a voting result without revealing more about the private vote inputs than the actual result. Most of these protocols involve a trusted authority responsible for running the election or tallying the results. However, there exist a number of so-called "boardroom" or "self-tallying" schemes that do away with the need for a central authority [START_REF] Kiayias | Self-tallying elections and perfect ballot secrecy[END_REF]. In such decentralised schemes, the election is an interactive protocol between the voters only and it can even be made one-round, i.e. noninteractive, in a public key setting [START_REF] Giustolisi | On the possibility of non-interactive e-voting in the public-key setting[END_REF]. Whether a centralised or decentralised protocol is better-suited to a given situation depends on practical and contextspecific concerns such as whether the trusted authority assumption makes sense. Especially, the decentralised protocol can be used in settings where there is no natural trusted third party, e.g., a company surveying privacy-sensitive data of the customers.

The open vote network (OV-Net) is a self-tallying voting scheme proposed by Hao, Ryan and Zieliński [START_REF] Hao | Anonymous voting by two-round public discussion[END_REF]. Improving upon Hao and Zielıński's earlier AV-net [START_REF] Hao | A 2-round anonymous veto protocol[END_REF][START_REF] Hao | A 2-round anonymous veto protocol[END_REF], it is a 2-round protocol which makes it an appealing candidate for largerscale elections. 7 One of OV-Net's limitations, according to Hao-Ryan-Zieliński, is that the protocol cannot handle denial-of-service (DoS) events: " (...) For example, if some voters refuse to send data in round 2, the tallying process will fail. This kind of attack is overt; everyone will know who the attackers are. To rectify this, voters need to expel the disrupters and restart the protocol; their privacy remains intact. However the voting process would be delayed, which may prove costly for large scale (countrywide) elections (...)" -[10, Sec 3.4] While the protection of privacy and the identification of culprits are desirable properties, the need to restart the protocol every time a voter drops out is a very strong limitation. This weakness is what we set out to rectify in this paper, by extending OV-Net to handle DoS events gracefully using parallel elections. Our modifications come at a cost, which we investigate quantitatively. Some earlier works have already tried to improve the security and efficiency of OV-Net. In [START_REF] Khader | A fair and robust voting system by broadcast[END_REF] fairness (i.e. preventing that voters get partial results before casting their vote) was guaranteed by committing to the vote in the first round. Further, the robustness against denial of service attacks was improved by introducing a recovery round: if some voters did not participate in the second round, the remaining voters perform a third round to achieve the partial tally for their cast votes. However this does not guarantee that there are no fallouts in the recovery round. In [START_REF] Giustolisi | On the possibility of non-interactive e-voting in the public-key setting[END_REF] it was shown that using a bilinear group setting and assuming a public key infrastructure, the voting protocol can be made noninteractive, i.e. one-round. This decreases the run time considerably, but does not in itself remove the robustness problem since the list of voters has to be determined before the election and the result cannot be computed without every eligible voter participating. Finally, in [START_REF] Mccorry | A smart contract for boardroom voting with maximum voter privacy[END_REF] the OV-Net was implemented via a smart contract that financially punishes voters who drops out of the election. This gives an economic incentive to participate in the second round, but does not prevent dedicated DoS attacks, nor involuntary dropouts e.g. due to lack of network access, and it assumes that the participants are willing to risk the economic punishment in the first place.

Preliminaries

Notations

Throughout this paper, we will use the following notations. If X is a finite set, x $ ← -X means that x is sampled uniformly at random from X. When working in a cyclic group G generated by g, we write [x] to denote g x . If q > 1 is an integer, we denote by Z q := Z/qZ the ring of integers modulo q. We denote by 1 the vector whose coordinates are all 1. BD(p, n) denotes the binomial distribution of mean p for a population n.

Note that due to the page limit a longer version of paper including proofs of the obtained results and appendices can be accessed here [START_REF] Bana | Time, privacy, robustness, accuracy: Trade offs for the open vote network protocol[END_REF].

Open vote network (OV-Net)

We recall here the OV-Net protocol in the simple case of a referendum: there are two vote choices encoded as 0 or 1 and n voters; each voter will cast a vote v i ∈ {0, 1} and the final tally will reveal the sum of all votes. Ultimately, we may set a threshold to choose a final winner based on the tally, but this is beyond the scope of OV-Net.

We assume that all participants have agreed ahead of time to use a given cyclic group G of generator g in which the decisional Diffie-Hellman problem is intractable. Let q be the order of G. Each voter i ∈ {1, . . . , n} samples a random value x i $ ← -Z q as a secret.

1. Round 1: Each voter i ∈ {1, . . . , n} publishes g xi along with a zeroknowledge proof of knowledge (ZKP) of x i , e.g. a Schnorr proof [START_REF] Schnorr | Efficient signature generation by smart cards[END_REF]. When this round finishes, each voter i ∈ {1, . . . , n} does the following:

• checks the validity of the ZKP for all g xj , j ∈ {1, . . . , n}\{i},

• computes:

g yi = i-1 j=1 g xj / n j=i+1 g xj 2.
Round 2: Each participant i ∈ {1, . . . , n} publishes g xiyi g vi and a ZKP for v i showing that v i ∈ {0, 1}. In practice, this proof can be implemented using the technique of Cramer-Damgård-Schoenmakers [5].

At the end of this procedure, each voter checks the proof of knowledge of all others, and multiplies together all the g xiyi g vi 's. Since i x i y i = 0 by the definition of y i , the result is g n i=1 vi , from which the value n i=1 v i can be recovered by solving the discrete logarithm problem in G -this is tractable because n is small (by cryptographic standards), with the total world population being less than 2 34 . Thus generic algorithms such as Pollard's ρ, with a complexity of O( √ q), can be used here.

Remark 1. The OV-Net protocol can be extended to more than two candidates by an appropriate encoding of v i [START_REF] Cramer | Multi-autority secretballot elections with linear work[END_REF][START_REF] Baudron | Practical multicandidate election system[END_REF], with the final tally requiring a (superincreasing) knapsack resolution after a discrete logarithm computation [10, Sec. 2.2].

Here we focus on the simpler case of two candidates.

Denial of Service

In the description of OV-Net, we implicitly assume that all participants are honest, to the extent that the proofs of knowledge are valid and that they follow the protocol. If one or several voters publish an incorrect proof of knowledge, or do not follow through with the protocol, then it is impossible to reach a conclusion for this particular vote event. This is called a denial of service (DoS) event.

When a DoS event occurs, the non-compliant voters can be identified and removed from a subsequent vote. However the results for that particular vote must be discarded (or cannot be computed) and a fresh vote must take place. This is troublesome for several reasons. One reason is that as n becomes large, disconnection or time-out events become more common and therefore the protocol's failure probability increases. Another reason is that accounting for protocol errors and re-voting adds complexity to real-world OV-Net implementations.

Parallel OV-Net

We consider a modification of OV-Net where users participate in several voting sessions in parallel. However, not all voters take part to all votes, as we now explain. Let n be the number of voters and M the number of parallel vote sessions. Each voter will participate in k pseudo-randomly chosen sessions amongst M .

More precisely, voter i picks k sessions before the protocol is run which we call i's selection. We assume that this selection is pseudo-random, i.e. that any given selection happens with the same probability 1/ M k . As a result not all sessions have the same number of voters, a phenomenon that we will need to account for. Remark 2. A natural question is whether we could impose a more clever rule, that would guarantee that there is always the same number of voting opportunities for each of them. Indeed, a solution is provided, in some cases, by Steiner systems [3]: a Steiner system with parameters t, k, n, written S(t, k, n), is an n-element set S together with a set of k-element subsets of S (called blocks) with the property that each t-element subset of S is contained in exactly one block.

The existence of Steiner systems is deeply connected to number-theoretic properties, and in particular the existence of a S(t, k, n + 1) system precludes that of a S(t, k, n). Thus, although we could initially form a balanced set of voters in some initial setting, it cannot be done if any of the voters bails out (or is disconnected).

However, it is not obvious how a decentralised pool of voters could agree on such a setting in a non mutually-trusting way and without leaking private information. It also remains an interesting question whether approximately balanced block designs exist that are "stable" in the sense that they retain this property when elements are removed.

Should a voter drop out during a voting session, this particular session will be discarded, but all sessions in which this voter didn't participate will go through. Unfortunately, this also discards all the votes of honest voters in the dropped session. To overcome this exclusion we allow each voter to vote k times: in other words, each voter will cast k votes into k independent ballots amongst the M .

Our claim is that in this case, the final tally's result reflects the choice of honest voters even after discarding all the sessions that were blocked by a dishonest voter. Furthermore, when several voters are dishonest, their cumulative effect on the final tally is weighed down by the fact that they shared many vote sessions. Concretely, for k = M/2, the first dishonest voter makes about M/2 sessions invalid; but amongst the remaining sessions only about M/4 can share a second dishonest voter, etc. Hence, this setting tolerates roughly log 2 M dropouts, at the price of running M sessions.

In summary, by running several sessions, several competing phenomena occur:

1. The overall protocol's resilience against DoS events is improved as we run more sessions -more sessions however bring an additional computational and communication cost; 2. Sessions have a varying number of voters in them, and not every voter partakes in every session, which introduces a bias -we can expect this bias to become small when many sessions are run; 3. The list of participants in each session is public, therefore some information about individual voters' preferences is leaked -running more sessions results in a increased loss of privacy.

There is therefore a balance to be struck, and we must quantify these phenomena more precisely.

Parallel OV-Net DoS resilience

Let be the number of voters causing a DoS event; they cause a (random) number X of sessions to be discarded. The protocol fails when all sessions have been discarded, i.e., when X ≥ M -this cannot happen when < M/k. If ≥ M/k then it is possible to stop the protocol entirely when the selections of dropping voters cover all sessions. However, the likelihood of this happening when each selection is random and independent is low, as many of the dropping voters will have sessions in common. This is a particular variant of the famous coupon collector's problem, which has been extensively studied.

Lemma 1. The average number of DoS events necessary to cause an overall failure, when we run M parallel sessions and each voter partakes in k of them is When we have fewer than the critical number of DoS events, the remaining sessions can be tallied. We can estimate the number of remaining valid sessions as µ = M -X :

E[ | overall protocol failure] = M k M r=1 (-1) r-1 M r M k -M -r k . Proof. See Appendix A.1 in [1].
Lemma 2. E(µ) = (M -k) 1 -k M -1
Proof. See Appendix A.2 in [START_REF] Bana | Time, privacy, robustness, accuracy: Trade offs for the open vote network protocol[END_REF] Finer results about the distribution X are given in Appendix A.5 in [START_REF] Bana | Time, privacy, robustness, accuracy: Trade offs for the open vote network protocol[END_REF]. 8 The corresponding Python code is available from the authors upon request.

Tally-combining algorithms

In this section we formalise how a final result can be obtained from the parallel OV-Net protocol. It is practical at this point to use vector notations.

We make the assumptions that voters are consistent, i.e., that they make the same choice across all the voting sessions in which they participate 9 . We denote v i the choice of voter i, and collect this (unknown) information into a vector v = (v 1 , . . . , v n ). If the vote went through with no incident, we would obtain the final tally :

V = n i=1 v i = v • 1.
When a voter drops out, all the sessions in which he participated are discarded. Let 0 < µ ≤ M be the number of remaining sessions and for each session j ∈ {1, . . . , µ} let s j,i be the number of times that voter i participated in session j; hence s j,i can take values in {0, 1} with the minimum value meaning that voter i did not partake in session j, and the maximum value indicating that they voted during session j. The tally for session j is therefore t j := n i=1 s j,i v i = v • s j where s j := (s j,1 , . . . , s j,n ). By definition, s j,i = 0 if voter i dropped out, and s j is non-zero (otherwise µ = 0). At the end of the procedure, the following information is public knowledge: T := (t 1 , . . . , t µ ) S := (s 1 , . . . , s µ )

The question is now: given (S, T ), and the parameters pp = (n, k, M, µ) how well can we approximate V ? To answer this question we need a precise definition of the error.

Definition 1 (Average-and worst-case error). Let A be an algorithm taking as input S, T and (implicitly) pp, and returning a real number. We refer to A as a tally-combining algorithm, and we write δ(v, S) := V -A(S, T ) for the tallying error.

Since δ depends on a choice of v, which is not public information, and since S is a collection of randomly chosen selections, it is more meaningful to consider the average error:

π A avg := E v,S [δ(v, S)],
where v and S span all their possible values. While A may give results that are close to V on average, there may be corner cases in which the predicted value wanders substantially away from V ; this phenomenon is controlled by the worst-case error:

π A wc := max v,S |δ(v, S)| ,
where again v and S span all their possible values.

A simple tally-combining algorithm is given by averaging the tallies and rescaling to account for lost sessions, i.e.

A naïve (-, T ) = M µk (1 • T )
(we must divide by k since each voter casts k votes).

Lemma 3. The naïve tally-combining algorithm gives:

π naïve avg = 0
Proof. See Appendix A in [START_REF] Bana | Time, privacy, robustness, accuracy: Trade offs for the open vote network protocol[END_REF].

See also [START_REF] Bana | Time, privacy, robustness, accuracy: Trade offs for the open vote network protocol[END_REF] for the worst case values. More generally, let x = (x 1 , . . . , x µ ) be a vector of real coefficients, and define the weighed tally-combining algorithm A x (T ) = x • T , which gives the result

V x = x • T = v •   µ j=1 x j s j   = v • β x .
How do we choose x? The following result partially answers this question Theorem 1. A sufficient condition for the bias of A x to be zero in average is

1 • (1 -w) = 0 where w = x 1 s 1 + • • • + x µ s µ . Furthermore, under these conditions, standard deviation is proportional to 1 -w 2 2 .
Proof. See Appendix A.4 in [START_REF] Bana | Time, privacy, robustness, accuracy: Trade offs for the open vote network protocol[END_REF].

If S spans R n , then by definition of a generating family we can find {x 1 , . . . , x µ } such that w = 1. 10 Concretely, we can construct an orthonormal basis of R n from vectors of S and project 1 onto each coordinate. We dub this method of computing x the minimum variance tally-combining algorithm (MV, Table 1). When S span R n , the MV algorithm gives an exact result (zero bias and variance).

Input: S = {sj}, T , µ, n Output: Vx, x, w

1. Z ← ∅ 2. For each sj ∈ S, if sj is linearly independent from Z, Z ← Z ∪ sj 3. Z ← GramSchmidtOrthogonalisation(Z) 4. For each ẑj, let xj ← 1 • ẑj 5. w ← j xj • ẑj 6. M ← (zj • ẑ ) j, 7. x ← (M ) -1 • w 8. Vx ← x • T 9. Return Vx, x, w
Table 1. Algorithm for minimum variance tally combining (MV). 10 The average value of µ such that S spans R n is n k=1

2 k 2 k -1 .
See [START_REF] Cooper | On the rank of a random binary matrix[END_REF] for more precise results.

However, when S does not span R n , the MV algorithm can only find a vector w close to 1, namely the closest such vector in terms of Euclidean distance that can be expressed in terms of vectors in S. This is still the solution resulting in the smallest variance, but no longer the solution with the least bias! This leads us to consider the following approach: we can construct tallycombining algorithms that guarantee zero bias, and select amongst these an algorithm that minimizes variance. Indeed, the constraint 1 • (1 -w) = 0 can be guaranteed by determining x 1 as a linear function of other variables 11 . It remains to minimize 1-w 2 2 which is simply a quadratic form in µ-1 variables. Therefore its minimum is easy to find as it amounts to solving a linear system in µ-1 rational variables. We call the corresponding algorithm the zero-bias minimum variance tally-combining algorithm (ZBMV, Table 2). In table 2, "symbolic expression" refers to the notion that x 1 , . . . , x µ are not evaluated but are symbols to be manipulated formally.

Input: S = {sj}, T , µ, n Output: Vx, x 1. Let x1 be the symbolic expression 1 1•s 1 n -µ j=2 xj(1 • sj) 2. Let D be the symbolic expression 1 -µ j=1 xjsj 2 2
3. (x 2 , . . . , x µ ) ← solutions of the linear system ∇D = 0

4. x 1 ← 1 1•s 1 n -µ j=2 x j (1 • sj) 5. x ← (x 1 , . . . , x µ ) 6. Vx ← x • T 7. Return Vx, x
Table 2. Algorithm for zero-bias minimum variance tally combining.

Comparing tally-combining algorithms

Let's consider a toy example to illustrate how the three discussed tally-combining algorithms compare. Throughout this section, we take n = 4, M = 6, µ = 3, k = 3 and s 1 = (1, 1, 1, 0), s 2 = (1, 1, 0, 0), s 3 = (0, 1, 0, 1) and T = (1, 0, 0). 12The results are summarized in Table 3.

Algorithm 1 (Zero-bias minimum variance) We can express x 1 in terms of x 2 and x 3 to ensure zero bias: 3. Comparison between tally-combining algorithms on the toy example.

x 1 = 1 1 • s 1 (n -x 2 (1 • s 2 ) -x 3 (1 • s 3 )) = 1 3 (4 -2x 2 -2x 3 ) . Tally-combining algorithm Bias Variance Tally 1 • (1 -w) 1 -w 2 2 x • T Naïve algorithm -2/3 4/3 2/3 ZBMV 0 5/7 6/7 MV 1/3 1/3 1 Table
We are left to determine x 2 and x 3 , which we choose to minimize the distance of

w = x 1 s 1 + • • • + x 3 s 3 to 1, i.e. the quantity 1 -w 2 2 = n i=1 (1 -w i ) 2 = (1 -x 1 -x 2 ) 2 + (1 -x 1 -x 2 -x 3 ) 2 + (1 -x 1 ) 2 + (1 -x 3 ) 2 = 1 3 (4 + 5x 2 2 + 2x 2 (x 3 -3) + 3x 2 3 -2x 3 )
This achieves its global minimum value of 5/7 at x 2 = 4/7 and x 3 = 1/7. Therefore, we have: x = 1 7 (6, 4, 1) . In particular, w [START_REF] Hao | Anonymous voting by two-round public discussion[END_REF][START_REF] Hao | A 2-round anonymous veto protocol[END_REF][START_REF] Cramer | Multi-autority secretballot elections with linear work[END_REF][START_REF] Bana | Time, privacy, robustness, accuracy: Trade offs for the open vote network protocol[END_REF] (note that computing this vector is not necessary for the algorithm).

= x 1 s 1 + • • • + x 3 s 3 = 1 7
Algorithm 2 (Minimum variance) We begin by computing an orthonormal basis Ẑ from S:

ẑ1 = 1 √ 3 (1, 1, 0, 0) ẑ2 = 1 √ 6 , 1 √ 6 , -2 3 , 0 ẑ3 = (-1 √ 6 , 1 √ 6 , 0, 2
3 ) which gives x1 = √ 3, x2 = 0, x3 = 2/3, from which we get w = 1 3 (2, 4, 3, 2) and finally x = 1, -1 3 , 2 3 . As expected this tally-combining algorithm has smaller variance (since 1w 2 2 = 1/3), compared with the ZBMV algorithm in of Algorithm 1, but its bias is not guaranteed to be zero (since 1 • (1 -w) = 1/3).

Algorithm 3 (Naïve tally combining) Let's use the naïve tally-combining algorithm, i.e., x = M µk 1. We assume here that M = 6, µ = 3 and k = 3 so that

x = 2 3 1, yielding w = ( 4 3 , 2, 2 3 , 2 3
). The bias for this algorithm is -2/3 , however this algorithm has larger variance than the other two, since 1 -w 2 2 = 4/3.

Privacy of Parallel OV-Net

In this section we investigate the decrease in privacy which we can expect due to the multiple parallel elections which are tallied individually, thus giving the adversary extra information. As an example, let us consider a simple referendum. If the outcome is unanimous , we of course lose privacy. However, the probability of this might be small. However, if we split the voters into two elections, the probability is roughly the square root of the old probability, i.e. much higher.

Recall that M is the number of the parallel and independent elections, n is the total number of voters and k is the number of elections that each voter has randomly chosen to participate in. We denote by M i the set of voters who participated in election i and we consider that the elections are enumerated from 1 to M . Let Res(M i ) be the random variable that gives the number of 'Yes' votes in the set M i . We recall also that Y i is the random variable that gives the number of voters in the set M i .

Definitions and Assumptions

To quantify privacy, we use the δ-privacy definition for voting from [START_REF] Küsters | Ordinos: A verifiable tally-hiding remote e-voting system[END_REF] which assumes that, besides the voting elements of a voting protocol, there exists an additional party called an observer O, who can observe publicly available information. Moreover, we assume that among the n honest voters, there exists a voter V obs who is under observation. For the sake of clarity, V obs will refer at the same time to the voter under observation and to its vote. Definition 2. Let P be a voting protocol and V obs be the voter under observation. We say that P achieves δ-privacy if the difference between the probabilities

P[(π O ||π V obs (Yes)||π v ) (l) → 1] and P[(π O ||π V obs (No)||π v ) (l) → 1]
is δ-bounded as a function of the security parameter , where π O , π V obs and π v are respectively the programs run by the observer O, the voter under observation V obs and all the honest voters v (clearly without V obs ).

To calculate the privacy we use the following result from [START_REF] Küsters | Ordinos: A verifiable tally-hiding remote e-voting system[END_REF]

δ(n) = r∈M * Yes,No (A No r -A Yes r ) (1)
where M * Yes,No = {r ∈ R : A Yes r ≤ A No r }, R is the set of all possible election results and A j r denotes the probability that the choices of the honest voters yield the result r of the election given that V obs 's choice is j.

We consider a referendum with n honest voters with a uniform distribution between yes and no votes. For simplicity, we will assume that nobody abstains. We also assume that no voters are corrupted. This is reasonable, since instructing corrupted voters to vote in a special way does not give further advantage compared to simply knowing the corrupted voters' votes. Moreover, we assume that at least one of the elections in which V obs participated is surviving.

Basic Cases:

M = k = 1 and M ≥ 1, k = 1
The δ for a single referendum is :

δ(n) = 1 2 n 1 n n a=0 n a |2a -n| =    2 -n n n 2 if n is even 2 1-n n n 1+[ n 2 ] 1 + n 2 Otherwise
where the first equality holds using the result from ( 1) and the second one using the binomial theorem. The formula above refers to the case M = k = 1 where all voters had chosen to vote in the same and unique election 1. For the case M > 1 and k = 1, δ becomes a random variable and the expected value of δ of the election in which V obs is participating can be defined as follows:

δ expected (n, M ) = n n =1 P(Y i = n )δ(n ) (2)
where Y i is the random variable that gives the number of voters who participated in the election i, including V obs ; and 2) for k = 1 and M > 1 becomes:

Y i ∼ 1 + BD(n -1, k M ). Equation (
δ expected (n, M ) = n n =1 n -1 n -1 1 M n -1 1 - 1 M n-n δ(n )
Figure 2 shows that privacy is almost lost when M n.

General Case

In this part we give a general formula of δ. To this end, we consider the following. Let y = (y 1 , . . . , y M ) be an assignment of voters such that Card(M i ) = y i for i ∈ [1, M ]. We can obtain all the possible assignments of voters by respecting the condition M i=1 y i = nk. Let r = (r 1 , • • • , r M ) be a possible result corresponding to the assignment y with r i = Res(M i ) for i ∈ [1, M ]. r verifies the conditions ( M i=1 r i ) mod k = 0 and r i ≤ y i for i ∈ [1, M ]. Remember that Res(M i ) gives the number of "Yes" votes in M i . We have Res(M i ) ∼ BD(y i , 1 2 ) for i ∈ [1, M ]. Intuitively, δ can be expressed as the following:

δ(n, M, k) = y1+•••+y M =nk P(Y 1 = y 1 , . . . , Y M = y M ) • r∈M * Yes,No (A No r -A Yes r )
By definition of A j r we have A j r = P(Res(M 1 ) = r 1 , . . . , Res(M M ) = r M /V obs = j) with j ∈ {Yes, No}.

To proceed we will introduce an additional notation. Remember that M i denotes the voters in election i. Define Σ k as the subsets of {1, . . . , M } of cardinality k. For σ ∈ Σ k we define M σ = i∈σ M i , i.e. the voters participating in the elections in the set σ. Note that the assignment of voters to elections is uniformly random, i.e. each voter is assigned uniformly and uniquely to a M σ . Also Z σ is the random variable determining the number of voters in M σ .

There are c = M k possible M σ s . Suppose that σs are enumerated from 1 to c. Let z = (z σ1 , . . . , z σc ) be an assignment of voters such that

z σi = Card(M σi ), for (σ i , i) ∈ Σ k × [1, c].
All the possible assignments of voters z are obtained by respecting the condition σi∈Σ k z σi = n.

The variables Z σ , σ ∈ Σ k correspond to the problem of putting n indistinguishable balls into c distinguishable boxes, i.e. the vector Z = (Z σ1 , . . . , Z σc ) follows a multinomial distribution with equal parameters p i = 1/c, and σ∈Σ z σ = n including V obs . We can now calculate the probability for the assignment of the voters, and rewrite our formula as:

δ(n, M, k) = z1+•••+zc=n P(Z σ1 = z σ1 , • • • , Z σc = z σc ) • r∈M * Yes,No (A No r -A Yes r )
Let r = (r σ1 , . . . , r σc ) such that r σi = Res(M σi ) for (σ i , i) ∈ Σ k × [1, c]. The variables Res(M σ ), σ ∈ Σ k , are independent and follow the binomial distribution of parameters z σ and 1/2. In the case M = c, which means k = M -1 or k = 1, there is a one-to-one correspondence between the sets (M i ) i∈[1,M ] and (M σ ) σ∈Σ k . However this is not true in general and we have a relation between r and r defined by the function f as follows:

   r 1 . . . r M    = B •    r σ1 . . . r σc    = f (r σ1 , • • • , r σc ) where B = (b iσ ) 1≤i≤M σ∈Σ k and b iσ = 1 i∈σ .
We can now calculate the probability A v r as: A v r = r |r=f (r ) A v r and we have:

A v r = P(Res(M σ1 ) = r σ1 , • • • , Res(M σc ) = r σc /V obs = v) Suppose that V obs is in the subset M σ1 . It is symmetric to choose any other subset. We have: A v r = 1 2 zσ 1 -1 •h(z σ1 , r σ1 )• c i=2 1 2 zσ i • zσ i r σ i where h(x, y) = x-1 y-1 if v = "Yes" x-1 y if v = "No" Remember that: M * Yes,No = {r : A Yes r ≤ A No r }, and A No r ≥ A Yes r is true when r σ1 ∈ [0, [ zσ 1 2 ]]. We have [ zσ 1 2 ] r 1 =0 (A No r -A Yes r ) = 1 2 zσ 1 r 1 =0 |A No r -A Yes r |.
Since V obs is in M σ1 , the vector to consider is Z = (Z σ1 -1, Z σ2 , • • • , Z σc ). The formula of δ becomes:

δ(n, M, k) = a n • n zσ 1 =1 E(z σ1 ) z σ1 ! n zσ 2 =0 • • • n zσ c =0 δ σ∈Σ zσ,n z σ2 ! • • • z σc ! = a n • n z=1 E(z) z! • (c -1) n-z (n -z)! with a n = (n -1)! c n-1 • 1 2 n , E(z) = 2 n-z+1 z [ z 2 ]
• z 2 and δ i,j is the Kroenecker delta function.

Conclusions and Further Research

Conclusions In this paper, we presented a new version of the protocol OV-Net which run several elections in parallel to achieve robustness against DoS failures without having to resort to time-consuming extra rounds. We computed quantitatively the increase in robustness from having M parallel elections with each voter participating in k of these, and demonstrated that robustness can be significantly improved. The improvement in time and robustness comes at a cost in terms of accuracy and privacy. We stress that our protocol is well fitting for decision-making applications where accuracy and privacy is not of ultimate importance. We presented three different algorithms on how to optimally compute the tally using this new OV-Net version and we quantitatively measured the privacy decrease that is expected due to the multiple partial election results. The results allow the protocol initiator to choose parameters to carefully balance the wanted robustness with a controlled privacy loss, statistical loss in accuracy, as well as increased computation.

Future work An idea to consider is redistribution i.e. elections are conducted in several electoral districts. Unlike general elections, where the final result is known for the entire country only, in redistributed elections results are consolidated per district and only then added up. This could confine problematic voters to a district of their own, as follows: partition the n voters into d districts of n = n/d voters, then run a vote in each of them. Then recompose the result by adding up the final tally. This strategy confines the DoS problem to districts that do not influence each other. However, DoS tolerance is not exactly multiplied by d because each district is not allowed to exceed k unresponsive voters. In other words, tolerance is multiplied by d as long as the constraint that there are no more than k unresponsive voters per district is respected.

Figure 1

 1 Figure 1 compares simulation results to the formula of Lemma 1, showing excellent agreement. The simulation is for M = 50 and k varying from 1 to 49, over 10 5 runs 8 . Using this information, we can choose parameters M and k to accommodate a given number of potential drop-outs.

Fig. 1 .

 1 Fig. 1. Simulated and predicted minimum number of DoS events necessary to cause an overall protocol failure, for M = 50 and k = 1, 2, . . . , 49.

4 Fig. 2 .

 42 Fig. 2. The relationship between M and δ expected for different values of n = 10, 10 2 , 10 3 , 10 4 .

  Fig. Privacy leakage as function of n for the cases (M, k) = (3, 2), (4, 2).

As comparison, the self-tallying protocol of Groth[START_REF] Groth | Efficient maximal privacy in boardroom voting and anonymous broadcast[END_REF] has n + 1 rounds for n voters, which makes it impractical to use for larger elections.

This makes our analysis simpler, but in practice a voter casting inconsistent votes simply weakens his own position.

There is nothing special about s1, any other vector of S can be used. Note that 1 • s1 = 0.

Note that in this example, knowing the tallies t1 and t2 reveals one participant's vote. This privacy issue is addressed later in the paper.

8 Acknowledgements PYAR acknowledge support from the Luxembourg National Research Fund (FNR) under the CORE project EquiVox (C19/IS/13643617/EquiVox/Ryan) and FEEO was supported by the FNR grant PRIDE15/10621687/ SPsquared. This work received funding from the France 2030 program managed by the French National Research Agency under grant agreement No. ANR-22-PECY-0006.


Igor P Gloriozov

Piotr I Dem'yanov

Nikolay S Zhulyaev

Mikhail S Nechaev

Yuri F Oprunenko

Franck Gam

Dr Jean-Yves Saillard
email: jean-yves.saillard@univ-rennes1.fr

Dr Aleksey E Kuznetsov
email: aleksey.kuznetsov@usm.cl

DFT Investigation of the η(6) η(6)-Inter-ring Haptotropic Rearrangement of the Group 8 Metals Complexes [(graphene)MCp

Keywords: Cyclopentadienyliron(II), cyclopentadienylruthenium(II), cyclopentadienylosmium(II), graphene-like complexes, inter-ring haptotropic rearrangement (IRHR), DFT calculations

Transition metal complexes are well known for their catalytic applications in the design of novel derivatives and technological precursors (e.g., for polymers) or advantageous materials for various areas of science and industry (sensors, catalysts, etc.). [START_REF] Davies | Organotransition Metal Chemistry: Applications to Organic Synthesis[END_REF][START_REF] Alberico | Aryl-Aryl Bond Formation by Transition-Metal-Catalyzed Direct Arylation[END_REF][START_REF] Bae | Early Transition Metal Complexes with Triphenolamine Ligands: Synthesis and Applications[END_REF][START_REF] Lerayer | Highly Functionalized Ferrocenes[END_REF][START_REF] Reznikov | Recent Developments in Highly Stereoselective Michael Addition Reactions Catalyzed by Metal Complexes[END_REF][START_REF] Quintana | Transition Metal Complex/Gold Nanoparticle Hybrid Materials[END_REF][START_REF] Shvydkiy | Reactions of Arene Replacement in Transition Metal Complexes[END_REF][START_REF] Yamamoto | Organotransition-Metal Chemistry: Past Development and Future Outlook[END_REF] Catalytic properties of (MCp) + complexes of polyaromatic hydrogenated hydrocarbons are mainly associated with their structural peculiarities along with their capacity for inter-ring haptotropic rearrangements (IRHRs) that occur usually via intra-molecular mechanisms. [START_REF] Oprunenko | Inter-Ring Haptotropic Rearrangements in π-Complexes of Transition Metals with Polycyclic Aromatic Ligands[END_REF][START_REF] Gridnev | Fluxional Organometallic and Coordination Compounds[END_REF] IRHRs consist of the shifting of the MLn organometallic group (OMG) along the PAH plane, from one six-membered ring to another. In the course of such rearrangements, the metal acquires unsaturation and therefore can easily seize additional substrates and/or reagents into its coordination sphere. In general, the  n  n -IRHRs of the MLn OMGs have been observed for many transition metal complexes with PAHs (Scheme 1, e.g., n = 6, M = Cr, [START_REF] Oprunenko | Regioselective Synthesis of π-Complexes of Substituted Polycyclic Aromatic Compounds. Experimental (NMR) and Theoretical (DFT) Studies of  6 , 6 -Haptotropic Rearrangements in Naphthalenechromiumtricarbonyl Complexes[END_REF][START_REF] Albright | Haptotropic Rearrangements of Polyene-MLn Complexes. 2. Bicyclic Polyene-MCp, M(CO)3 Systems[END_REF][START_REF] Ustynyuk | Indenyl-and Fluorenyl-Transition Metal Complexes: XI. Intramolecularity of the Haptotropic η 6 ⇌η 5 Rearrangements in Fluorenylchromium Tricarbonyl Anions by Crossover Experiments[END_REF] Ru; [START_REF] Perekalin | Cyclopentadienyl Ruthenium Complexes with Naphthalene and Other Polycyclic Aromatic Ligands[END_REF][START_REF] Gloriozov | DFT Study of Inter-Ring Haptotropic Rearrangement in CpRu + Complexes of Polycyclic Aromatic Ligands[END_REF][START_REF] Fetisov | Influence of Ion Pairing in Inter-Ring Haptotropic Rearrangements in Cationic Cyclopentadienyl Complexes of Ruthenium with Naphthalene: a DFT Investigation[END_REF][START_REF] Fetisov | Private communication[END_REF][18] n = 4, M = Ir; [START_REF] Oprunenko | Intramolecular Inter-Ring Haptotropic Rearrangement in Iridium Naphthalene Complexes: a DFT Study[END_REF] n = 2, M = Ni [START_REF] Oprunenko | Intra-and Inter-Ring Haptotropic Rearrangements in Naphthalene and Anthracene Nickel Complexes: a DFT Study[END_REF] ), but have been principally investigated for  6  6 -IRHR of chromium tricarbonyl complexes. [START_REF] Oprunenko | Regioselective Synthesis of π-Complexes of Substituted Polycyclic Aromatic Compounds. Experimental (NMR) and Theoretical (DFT) Studies of  6 , 6 -Haptotropic Rearrangements in Naphthalenechromiumtricarbonyl Complexes[END_REF][START_REF] Albright | Haptotropic Rearrangements of Polyene-MLn Complexes. 2. Bicyclic Polyene-MCp, M(CO)3 Systems[END_REF][START_REF] Ustynyuk | Indenyl-and Fluorenyl-Transition Metal Complexes: XI. Intramolecularity of the Haptotropic η 6 ⇌η 5 Rearrangements in Fluorenylchromium Tricarbonyl Anions by Crossover Experiments[END_REF] In the course of such IRHRs, the 12-electron MLn OMG migrates along the periphery of a polyaromatic plane, as shown by Albright et al. [START_REF] Albright | Haptotropic Rearrangements of Polyene-MLn Complexes. 2. Bicyclic Polyene-MCp, M(CO)3 Systems[END_REF] These migrations could be induced not only thermally [START_REF] Oprunenko | Regioselective Synthesis of π-Complexes of Substituted Polycyclic Aromatic Compounds. Experimental (NMR) and Theoretical (DFT) Studies of  6 , 6 -Haptotropic Rearrangements in Naphthalenechromiumtricarbonyl Complexes[END_REF][START_REF] Albright | Haptotropic Rearrangements of Polyene-MLn Complexes. 2. Bicyclic Polyene-MCp, M(CO)3 Systems[END_REF][START_REF] Ustynyuk | Indenyl-and Fluorenyl-Transition Metal Complexes: XI. Intramolecularity of the Haptotropic η 6 ⇌η 5 Rearrangements in Fluorenylchromium Tricarbonyl Anions by Crossover Experiments[END_REF] but also chemically, [START_REF] Ustynyuk | Indenyl-and Fluorenyl-Transition Metal Complexes: XI. Intramolecularity of the Haptotropic η 6 ⇌η 5 Rearrangements in Fluorenylchromium Tricarbonyl Anions by Crossover Experiments[END_REF] photochemically [START_REF] Perekalin | Cyclopentadienyl Ruthenium Complexes with Naphthalene and Other Polycyclic Aromatic Ligands[END_REF][START_REF] Gloriozov | DFT Study of Inter-Ring Haptotropic Rearrangement in CpRu + Complexes of Polycyclic Aromatic Ligands[END_REF][START_REF] Fetisov | Influence of Ion Pairing in Inter-Ring Haptotropic Rearrangements in Cationic Cyclopentadienyl Complexes of Ruthenium with Naphthalene: a DFT Investigation[END_REF][START_REF] Fetisov | Private communication[END_REF] or electrochemically. 18 Scheme 1. Some examples of  n  n -IRHRs in OMG complexes of naphthalene or substituted naphthalene (n = 6: MLn = Cr(CO)3, [START_REF] Oprunenko | Regioselective Synthesis of π-Complexes of Substituted Polycyclic Aromatic Compounds. Experimental (NMR) and Theoretical (DFT) Studies of  6 , 6 -Haptotropic Rearrangements in Naphthalenechromiumtricarbonyl Complexes[END_REF][START_REF] Albright | Haptotropic Rearrangements of Polyene-MLn Complexes. 2. Bicyclic Polyene-MCp, M(CO)3 Systems[END_REF][START_REF] Ustynyuk | Indenyl-and Fluorenyl-Transition Metal Complexes: XI. Intramolecularity of the Haptotropic η 6 ⇌η 5 Rearrangements in Fluorenylchromium Tricarbonyl Anions by Crossover Experiments[END_REF] (RuCp) + ; [START_REF] Perekalin | Cyclopentadienyl Ruthenium Complexes with Naphthalene and Other Polycyclic Aromatic Ligands[END_REF][START_REF] Gloriozov | DFT Study of Inter-Ring Haptotropic Rearrangement in CpRu + Complexes of Polycyclic Aromatic Ligands[END_REF][START_REF] Fetisov | Influence of Ion Pairing in Inter-Ring Haptotropic Rearrangements in Cationic Cyclopentadienyl Complexes of Ruthenium with Naphthalene: a DFT Investigation[END_REF][START_REF] Fetisov | Private communication[END_REF][18] n = 4: MLn = Ir(PR3)2 ; 19 n = 2, MLn = Ni(PR3)2 [START_REF] Oprunenko | Intra-and Inter-Ring Haptotropic Rearrangements in Naphthalene and Anthracene Nickel Complexes: a DFT Study[END_REF] ).

In spite of the fact that the Group 8 (MCp) + complexes of PAHs and their dynamic behavior are quite important in such applications as catalysis [START_REF] Perekalin | Cyclopentadienyl Ruthenium Complexes with Naphthalene and Other Polycyclic Aromatic Ligands[END_REF][START_REF] Ashraf | The Hydration of Chloroacetonitriles Catalyzed by Mono-and Dinuclear Ru II -and Os II -Arene Complexes[END_REF][START_REF] Jeans | Arene-Ruthenium Complexes of 1,1'-Bis(ortho-carborane): Synthesis, Characterization, and Catalysis[END_REF][23][START_REF] Matsinha | Water-Soluble Half-Sandwich Ru-II-Arene Complexes: Synthesis, Structure, Electrochemistry, DFT Studies, and Aqueous Phase Hydroformylation of 1-Octene[END_REF][START_REF] Neumeier | Combined Photoredox and Iron Catalysis for the Cyclotrimerization of Alkynes[END_REF][START_REF] Gonzalez-Fernandez | Cymene-Osmium(II) Complexes with Amino-Phosphane Ligands as Precatalysts for Nitrile Hydration Reactions[END_REF][START_REF] Coverdale | Easy to Synthesize, Robust Organo-osmium Asymmetric Transfer Hydrogenation Catalysts[END_REF][START_REF] Soriano | Synthesis and Characterization of Ru(Arene) Complexes of Bispyrazolylazines: Catalytic Hydrogen Transfer of Ketones[END_REF] or antitumor agents, [START_REF] Mendoza-Ferri | Influence of the Arene Ligand, the Number and Type of Metal Centers, and the Leaving Group on the In Vitro Antitumor Activity of Polynuclear Organometallic Compounds[END_REF][START_REF] Peacock | Medicinal Organometallic Chemistry: Designing Metal Arene Complexes as Anticancer Agents[END_REF][START_REF] Thangavel | Characterization, Antiproliferative and Molecular Docking Study of New Half Sandwich Ir(III), Rh(III) and Ru(II) Complexes[END_REF][START_REF] Sayin | Investigation of Anticancer Properties of Caffeinated Complexes via Computational Chemistry Methods[END_REF][START_REF] Yan | Organometallic Chemistry, Biology and Medicine: Ruthenium Arene Anticancer Complexes[END_REF][34][START_REF] Pettinari | Cytotoxicity of Ruthenium-Arene Complexes Containing Beta-Ketoamine Ligands[END_REF][START_REF] Zhang | Advances in the Design of Organometallic Anticancer Complexes[END_REF] only a very small number of  6  6 -IRHRs of these OMGs have been observed so far. Moreover, they are restricted to Ru 18,37 and so far no data concerning Fe or Os have been obtained. [START_REF] Kündig | Synthesis of Transition Metal η 6 -Arene Complexes[END_REF][START_REF] Kündig | Personal communication[END_REF] For example, such IRHRs were observed for ruthenium complexes of non-planar PAHs, namely the concave acecorannulene 40 and the propeller-like rubrene 41 (Scheme 2).

Scheme 2. IRHRs for (RuCp) + and (RuCp*) + complexes of non-planar PAHs.

The reaction kinetics of these rearrangements were followed by NMR spectroscopy, giving estimated free energy barriers (ΔG # ) of 25-30 kcal/mol. [START_REF] Seiders | Hexahapto Metal Coordination to Curved Polyaromatic Hydrocarbon Surfaces: The First Transition Metal Corannulene Complex[END_REF] Surprisingly, the (RuCp) + complex of the unsubstituted corannulene (related to acecorannulene, but somewhat more planar) shows no variable-temperature 1 H dynamic NMR effects up to 140°C (in C2D2Cl4). This rules out the intramolecular movement of the arenophile (RuCp) + OMG around the corannulene surface. [START_REF] Seiders | Hexahapto Metal Coordination to Curved Polyaromatic Hydrocarbon Surfaces: The First Transition Metal Corannulene Complex[END_REF] In fact, all attempts to detect IRHRs in the (RuCp) + complexes of planar PAHs such as pyrene, acenaphthylene and fluoranthene in polar solvents were unsuccessful, which was proved by the lack of NMR signal broadening in CH3NO2 even at the complex decomposition temperature (90 o C).

These results were supported by DFT calculations. [START_REF] Rioja | η 5 -C5Me5)Ru] + Fragments Ligated to Polyaromatic Hydrocarbons: An Experimental and Computational Approach to Pathways for Haptotropic Migration[END_REF] However, it has been shown by DFT calculations additionally to experimental data that nonpolar solvents can facilitate IRHRs of [(PAH)MCp] + complexes, because they favor the formation of contact ion pairs (CIPs) with the counter-anion. In such CIPs, anions tend to stabilize the IRHR unsaturated intermediates and transition states. On the other hand, in polar solvents where separated ion pairs (SIPs) are formed, such stabilization cannot occur. [START_REF] Fetisov | Influence of Ion Pairing in Inter-Ring Haptotropic Rearrangements in Cationic Cyclopentadienyl Complexes of Ruthenium with Naphthalene: a DFT Investigation[END_REF][START_REF] Fetisov | Private communication[END_REF] Indeed, the  6  6 -IRHR is sufficiently rapid (hours) in CH2Cl2 solution and extremely slow (weeks) in the much more polar acetone. This is consistent with the well-known fact that reaction rates of many processes involving organometallic salts depend on solvent polarity and the ion pair structure. [START_REF] Macchioni | Elucidation of the Solution Structures of Transition Metal Complex Ion Pairs by NOE NMR Experiments[END_REF][START_REF] Bellachioma | NMR Investigation of Non-Covalent Aggregation of Coordination Compounds Ranging from Dimers and Ion Pairs up to Nano-Aggregates[END_REF][46] In particular, we have shown by DFT calculations that the interactions between the PF6 -counterion and the Ru-center of [( 6 -naphthalene)RuCp] + in nonpolar solvents can considerably reduce the IRHR activation barriers, thus making the process possible at reasonable temperatures. [START_REF] Fetisov | Influence of Ion Pairing in Inter-Ring Haptotropic Rearrangements in Cationic Cyclopentadienyl Complexes of Ruthenium with Naphthalene: a DFT Investigation[END_REF][START_REF] Fetisov | Private communication[END_REF] In our opinion, there exists another important approach to facilitate the  6  6 -IRHRs in the Group 8 (MCp) + complexes, apart for varying the solvent polarity. This approach has first been suggested in our preliminary work on the (CpRu) + complexes. [START_REF] Gloriozov | DFT Study of Inter-Ring Haptotropic Rearrangement in CpRu + Complexes of Polycyclic Aromatic Ligands[END_REF] It consists of increasing the size of the PAH because in that case the metal-PAH bonding becomes weakened, allowing an easier metal migration along the PAH surface. This was already proven for tricarbonyls of the Group 6 metals (Cr, Mo, W) with the middle-sized kekulene and coronene [START_REF] Zhulyaev | DFT Study of Chromium Tricarbonyl Complexes of Coronene and Kekulene[END_REF] as well as with large-sized graphene [START_REF] Gloriozov | Chromium Tricarbonyl and Chromium Benzene Complexes of Graphene, Their Properties, Stabilities, and Inter-Ring Haptotropic Rearrangements -A DFT Investigation[END_REF][START_REF] Zhulyaev | Organometallic Chemistry of New Carbon Materials. Structure and Dynamic Behavior of Group 6 Metal Tricabonyl Complexes of Graphene and Perforated Graphene: a DFT Study[END_REF] and nanotubes [START_REF] Nunzi | Coordination and Haptotropic Rearrangement of Cr(CO)3 on (n,0) Nanotube Sidewalls: A Dynamical Density Functional Study[END_REF][START_REF] Zhulyaev | DFT Study of 6 Group Metal Complexes of Polyaromatic Ligands from Coronene to Graphene[END_REF] in comparison with PAH of small size such as naphthalene. [START_REF] Oprunenko | Regioselective Synthesis of π-Complexes of Substituted Polycyclic Aromatic Compounds. Experimental (NMR) and Theoretical (DFT) Studies of  6 , 6 -Haptotropic Rearrangements in Naphthalenechromiumtricarbonyl Complexes[END_REF] Sato et al., who compared (CpRu) + coronene complexes to smaller PAHs, [START_REF] Sato | Solvation Structure of Coronene-Transition Metal Complex: a RISM-SCF Study[END_REF] also noted this trend from their theoretical results. However, no experimental or theoretical studies of the effects of this approach have been performed so far for the OMGs of the Group 8 metals.

Here we report the results of the first comprehensive computational study on the effect of the further increase of the PAH model size on the mobility of the Group 8 (MCp) + complexes on the PAH surface. The PAH model was increased by adding two additional outer shells of six-member rings around the initial central coronene core. The resulting 4-shell model of graphene (Gr4) features a C96H24 PAH of D6h symmetry (Fig. 1). The two most inner rings of the large Gr4 were chosen to be complexed by (CpM) + in order to mimic realistic graphene species. Although the MLn OMGs prefer to coordinate with peripheral rings of PAH, [START_REF] Kündig | Synthesis of Transition Metal η 6 -Arene Complexes[END_REF][START_REF] Kündig | Personal communication[END_REF][START_REF] Nunzi | Coordination and Haptotropic Rearrangement of Cr(CO)3 on (n,0) Nanotube Sidewalls: A Dynamical Density Functional Study[END_REF][START_REF] Zhulyaev | DFT Study of 6 Group Metal Complexes of Polyaromatic Ligands from Coronene to Graphene[END_REF][START_REF] Sato | Solvation Structure of Coronene-Transition Metal Complex: a RISM-SCF Study[END_REF] this choice was driven by the statistical significance of the central location in pristine graphene. [START_REF] Gloriozov | DFT Study of Inter-Ring Haptotropic Rearrangement in CpRu + Complexes of Polycyclic Aromatic Ligands[END_REF] Moreover, it has been previously shown that IRHR activation barriers depend poorly on the OMG localization on the sheet of large PAH ligands, [START_REF] Gloriozov | Chromium Tricarbonyl and Chromium Benzene Complexes of Graphene, Their Properties, Stabilities, and Inter-Ring Haptotropic Rearrangements -A DFT Investigation[END_REF][START_REF] Zhulyaev | Organometallic Chemistry of New Carbon Materials. Structure and Dynamic Behavior of Group 6 Metal Tricabonyl Complexes of Graphene and Perforated Graphene: a DFT Study[END_REF] which further justifies our choice of the MLn OMGs localization.

The investigated [( 6 -C96H24)MCp] + (M = Fe, Ru, Os) complexes (1 and 2) are shown in Fig. 1. To study the ground states, reaction intermediates and transition states of the  6  6 -IRHRs of these complexes, the density functional theory using scalar-relativistic approach was employed.

Furthermore, it is important to note that large PAHs such as graphene and nanotubes were shown to have intrinsic anticancer activity, [START_REF] Iannazzo | Graphene Quantum Dots: Multifunctional Nanoplatforms for Anticancer Therapy[END_REF][START_REF] Markovic | In Vitro Comparison of the Photothermal Anticancer Activity of Graphene Nanoparticles and Carbon Nanotubes[END_REF] and many arene complexes of Ru and Os have been proven to possess anticancer activity as well. [START_REF] Yan | Organometallic Chemistry, Biology and Medicine: Ruthenium Arene Anticancer Complexes[END_REF][START_REF] Zhang | Advances in the Design of Organometallic Anticancer Complexes[END_REF][START_REF] Zeng | The Development of Anticancer Ruthenium(II) Complexes: from Single Molecule Compounds to Nanomaterials[END_REF][START_REF] Moreno | Studies of the Antiproliferative Activity of Ruthenium(II) Cyclopentadienyl-Derived Complexes with Nitrogen Coordinated Ligands[END_REF] Therefore, we suppose that coordinating Ru or Os to very large PAHs could synergistically increase the anticancer activity, thus reinforcing the interest for the stability, bonding and dynamical properties of the complexes 1 and 2. To the best of our knowledge, it is the first computational study that addresses the structural and dynamic behavior of the metalcyclopentadienyl complexes (MCp) + (M = Fe, Ru, Os) of a large polyaromatic hydrogenated hydrocarbon (PAH) (C96H24) as a model for pristine graphene. The energy barriers of the  6  6 interring haptotropic rearrangement (IRHR) of the (MCp) + unit between sixmembered rings 1 2 were found to be 30, 27, and 29 kcal/mol for M = Fe, Ru, and Os, respectively. These values are significantly lower than the values found previously theoretically and experimentally for smaller PAHs. Solvent effects in two solvents, nonpolar cyclohexane and polar acetonitrile, were evaluated as well and were shown not to have significant effects on these energy barriers.

Gr4 [(c-Gr4)MCp] + (1) [(n-Gr4)MCp] + (2)

RESULTS AND DISCUSSION

General Features of the Complexes 1 and 2. The DFT-optimized structures of 1 and 2 are basically the same for the three metals (Fig. 1). Zooms on the local metal coordination sphere are shown in Fig. 2, with numbering of the key atoms. Relevant computed bond distances and bond orders are provided in Tables 1 and2. As can be seen, in the complexes 1 all the 6 M-C bond distances are for each of three metals considered essentially the same, and the complexes 2 the 6 M-C bond distances are divided into two distinctive groups for each of three metals, with bond distance differences within 0.006⎯0.009 Å. These results are consistent with the expected regular  6 -structures of 1 and 2. Their calculated geometries agree well with the X-ray structures of [( 6naphthalene)MCp] +14 and with the DFT results for other (MCp) + PAH complexes. [START_REF] Gloriozov | DFT Study of Inter-Ring Haptotropic Rearrangement in CpRu + Complexes of Polycyclic Aromatic Ligands[END_REF][START_REF] Fetisov | Influence of Ion Pairing in Inter-Ring Haptotropic Rearrangements in Cationic Cyclopentadienyl Complexes of Ruthenium with Naphthalene: a DFT Investigation[END_REF][START_REF] Fetisov | Private communication[END_REF] As expected, 3). The coordination mode of these three stationary points (Fig. 3) is best described as  4 , as can be seen from the M-C distances and bond orders given in 4). Generally, the Mulliken bond orders in the IM, TS1 and TS2, as expected, are lower than in 1 and 2 (cf. Tables 123). Also, these bond orders for Ru are slightly lower in general than for Fe, and for Os they are higher compared to two other metals. In these three closely related structures, the MCp group lies on top of C1, a carbon atom common to the two C6 rings involved in the IRHR. Thus, the metal in stationary points TS1, IM and TS2 is in closest bonding contact with C1 as well as with the three other carbon atoms, namely C2, C6 and C7, participating in the rearrangement. Noteworthy, the computed IRHR activation barriers ΔG #  28-30 kcal/mol (see Table 4) are significantly lower than the activation barriers computed for the similar processes in (MCp) + (M = Fe, Ru, Os) complexes of the middle size PAHs (ΔG #  36-41 kcal/mol). [START_REF] Perekalin | Cyclopentadienyl Ruthenium Complexes with Naphthalene and Other Polycyclic Aromatic Ligands[END_REF][START_REF] Koefod | Ring Shift Isomerization Reaction of Monocyclopentadienylruthenium(II) Complexes of Rubrene. Kinetic and Thermodynamic Studies of Metal-Arene Binding Selectivity[END_REF] In the Group 8 triad, the largest activation barrier is found for Fe and the lowest for Ru, the Os case being intermediate. This is in line with what we found earlier for the similar systems of the Group 6 metals (Cr, Mo, W): the second metal of the triad affords the smallest IRHR activation barrier. [START_REF] Gloriozov | Chromium Tricarbonyl and Chromium Benzene Complexes of Graphene, Their Properties, Stabilities, and Inter-Ring Haptotropic Rearrangements -A DFT Investigation[END_REF][START_REF] Zhulyaev | Organometallic Chemistry of New Carbon Materials. Structure and Dynamic Behavior of Group 6 Metal Tricabonyl Complexes of Graphene and Perforated Graphene: a DFT Study[END_REF] Energy Decomposition Analysis Results. A deeper insight into the bonding variations along the IRHR process is provided by the energy decomposition analysis (EDA) carried out with the ADF program (see Methods). In this analysis various contributions in the interactions between the Gr4 ligand and the (MCp) + (M = Fe, Ru, Os) OMG are considered. The EDA components of the five stationary points for the three considered metals are provided in Table 5. Unsurprisingly, the total bonding energies (TBE) variation along the IRHR pathways follow the corresponding ΔE and ΔG variations shown in Table 4, with nearly degenerate TS1 and TS2 transition states.

It can be seen that the TBE absolute values computed for M = Ru are the lowest of the triad.

These results are explained by the combination of the lower values of the absolute value of the Eorb component (smaller than for Fe and noticeably smaller than for Os), noticeable values of the Pauli repulsion EPauli component (higher than for Fe but smaller than for Os), and the electrostatic repulsion energy Eelstat values which are again intermediate between the values for Fe and Os. This indicates weaker covalent interactions for Ru. Thus, unsurprisingly, the less strongly bonded metal shows the lowest overall energy variation during the IRHR process, and consequently the lowest activation energy.

On the other hand, the largest TBE absolute value is computed for Os, with which not the largest but the intermediate energy barrier is associated. In fact, the Fe/Os ordering depends also on the relative variation of all the EDA components. In the case of Os, the largest variation (weakening) of the EPauli and Eelstat components can be noted when going from 1 to TS1 or TS2, which is clearly the result of a metal size effect. Therefore, the fact that the lowest energy barrier is found for M = Ru can be explained by the compensation of several effects.

In the (MCp) + (M = Fe, Ru, Os) complexes at the Gr4 model, starting from the configuration 1, the OMG can continue, of course, to shift through successive  6  6 -IRHRs over the plane of Gr4 to the periphery of the ligand. Thus, the metal can spread over the whole surface of the graphene model according to statistic and thermodynamic preferences. From the obtained results we can draw the conclusion that for the  6 -graphene complexes of (CpM) + (M = Fe, Ru, Os), thermally induced  6  6 -IRHR at relatively low temperatures (70-90 o C) is possible and should proceed experimentally with high rate thus distributing OMG over the surface of graphene.

Solvent Effects on the Barrier Heights. We also evaluated the change of the activation energies in the presence of two different solvents: polar acetonitrile and non-polar cyclohexane (see Methods). It turns out that taking into account the implicit solvent effects modifies the energy barriers only slightly. Thus, in acetonitrile the activation energy was calculated to increase by 1.3, 1.1 and 1.4 kcal/mol for M = Fe, Ru, Os, respectively, and in cyclohexane it was computed to 10 increase by 1.0, 1.1 and 1.0 kcal/mol for M = Fe, Ru, Os, respectively, in comparison with the gas phase. These small values computed on non-relaxed geometries are even likely to be slightly overestimated. Previously, Sato et al. found that, in the case of [( 6 -coronene)(CpRu)] + , the difference between the activation barriers in the gas and dichloromethane solution (2.5 kcal/mol) is larger than ours, but still relatively small. [START_REF] Sato | Solvation Structure of Coronene-Transition Metal Complex: a RISM-SCF Study[END_REF] This can be explained by a stronger binding of (CpRu) + to the smaller coronene, as compared to graphene.

CONCLUSIONS

The [START_REF] Fetisov | Influence of Ion Pairing in Inter-Ring Haptotropic Rearrangements in Cationic Cyclopentadienyl Complexes of Ruthenium with Naphthalene: a DFT Investigation[END_REF][START_REF] Fetisov | Private communication[END_REF] and coronene (32 kcal/mol). [START_REF] Iannazzo | Graphene Quantum Dots: Multifunctional Nanoplatforms for Anticancer Therapy[END_REF][START_REF] Markovic | In Vitro Comparison of the Photothermal Anticancer Activity of Graphene Nanoparticles and Carbon Nanotubes[END_REF] Model PAH S1-S6).

The geometries of ground states, reaction intermediates and transition states were optimized without any constraints in the frame of density functional theory (DFT) with the use of the PRIRODA04 program written by Laikov. [START_REF] Laikov | A New Class of Atomic Basis Functions for Accurate Electronic Structure Calculations of Molecules[END_REF][START_REF] Laikov | Fast Evaluation of Density Functional Exchange-Correlation Terms Using the Expansion of the Electron Density in Auxiliary Basis Sets[END_REF][START_REF] Laikov | PRIRODA-04: a Quantum-Chemical Program Suite. New Possibilities in the Study of Molecular Systems with the Application of Parallel Computing[END_REF] All stationary points on the potential energy surface (PES) were identified by analyzing the energy Hessians. The Gibbs free energies (G) at 298.15 K were calculated using the approximation of restricted rotator and harmonic oscillator. The generalized gradient approximation PBE functional [START_REF] Perdew | Generalized Gradient Approximation Made Simple[END_REF][START_REF] Perdew | Errata: Generalized Gradient Approximation Made Simple[END_REF] and scalar-relativistic theory were employed, the latter employing the four-component spin-free Hamiltonian derived by Dyall Os. [START_REF] Laikov | A New Class of Atomic Basis Functions for Accurate Electronic Structure Calculations of Molecules[END_REF][START_REF] Laikov | Fast Evaluation of Density Functional Exchange-Correlation Terms Using the Expansion of the Electron Density in Auxiliary Basis Sets[END_REF][START_REF] Laikov | PRIRODA-04: a Quantum-Chemical Program Suite. New Possibilities in the Study of Molecular Systems with the Application of Parallel Computing[END_REF] Since the L1 and L2 basis sets provided very similar results, only the data obtained with the larger L2 set are discussed in the paper. Results obtained with the L1 set are provided in the SI (Tables S1-S5). All reaction paths were found by the intrinsic reaction coordinate (IRC) method. [START_REF] Gonzalez | Reaction Path Following in Mass-Weighted Internal Coordinates[END_REF] The calculations were performed using the MBC100k cluster at the Joint Supercomputer Center (JSCC) (Moscow, Russia). The interactions between the (MCp) + and Gr4 fragments were investigated also within the Morokuma-Ziegler energy decomposition analysis (EDA) framework 64- 66 by single-point calculations with the ADF program [START_REF] Fonseca Guerra | Towards an Order-N DFT Method[END_REF][68] at the ZORA scalar-relativistic level of approximation [START_REF] Van Lenthe | Relativistic Total Energy Using Regular Approximations[END_REF] on the PRIRODA04-optimized structures, employing the PBE functional 60-61 and

Fig. 1 .

 1 Fig. 1. The ligand Gr4 (C96H24) and its (CpM) + complexes 1 (c -central position) and 2 (n -near central position) considered in this work.

2 Fig. 2 .

 22 Fig. 2. Metal coordination sphere in complexes 1 and 2 (M = Fe, Ru, Os).

 6 -IRHR corresponding to the 1 2

 2 interconversion through the OMG shift between two neighboring carbon rings was found to occur for all three metals via an intermediate IM flanked by two transition states TS1 and TS2 (Scheme 3). The imaginary frequencies of the TS1 and TS2 steadily become more negative from Fe and further to Os. Interestingly, for both Fe and Os the imaginary frequency value becomes more negative from the TS1 to TS2, whereas for Ru both TSs have the same imaginary frequency values (Table

Scheme 3 .Fig 3 .

 33 Scheme 3. Mechanism of  6 -1  6 -2 IRHR (M = Fe, Ru, Os).

  on initial benzene gradual increase of the size by adding rows of linearly fused-benzene rings along one direction of PAH size. Such model converges to the pristine graphene in the course of the n increase. Criteria of such convergence should be (1) stabilization of dissociation energy from the center of the ligand, (2) decrease of the difference of dissociation energies between complexes at the center and neighbor cycles, and (3) stabilization of the activation barrier between central and neighboring (Supporting Information for n from 1 to 12, Tables

Table 1 .

 1 Metal

-carbon bond lengths (in Å) in 1, with corresponding Mulliken bond orders in parentheses.

Table 2 .

 2 Metal

		Fe	Ru	Os
	M-C1	2.146 (0.11)	2.294 (0.09)	2.288 (0.14)
	M-C2	2.146 (0.11)	2.294 (0.09)	2.289 (0.14)
	M-C7	2.144 (0.10)	2.291 (0.09)	2.287 (0.13)
	M-C8	2.137 (0.11)	2.285 (0.09)	2.281 (0.14)
	M-C9	2.137 (0.11)	2.285 (0.09)	2.281 (0.14)
	M-C10	2.143 (0.11)	2.291 (0.09)	2.287 (0.14)

-carbon bond lengths (in Å) in 2, with corresponding Mulliken bond orders in parentheses.

Transition States and Intermediates of the  6

 6 -IRHR. The  6

Table 3 .

 3 For all three metals, the intermediate IM and two transition states TS1 and TS2 have quite similar structures and are very close in energy (Table

Table 3 .

 3 Metal-carbon-bond lengths (in Å) in TS1, IM, and TS2, with corresponding Mulliken bond orders in parentheses. The unique imaginary vibrational frequency found for every transition state is given in cm -1 .

	Metal		Fe			Ru			Os
	bond lengths	TS1 (ωim = 14i)	IM	TS2 (ωim = 34i)	TS1 (ωim = 95i)	IM	TS2 (ωim = 95i)	TS1 (ωim = 93i)	IM	TS2 (ωim = 100i)
	M-C1 1.980 (0.10) 1.942 (0.08) 1.987 (0.10) 2.139 (0.08) 2.113 (0.07) 2.150 (0.11) 2.121 (0.13) 2.064 (0.13) 2.124 (0.14)
	M-C2 2.289 (0.12) 2.314 (0.11) 2.283 (0.12) 2.479 (0.10) 2.494 (0.11) 2.473 (0.11) 2.414 (0.15) 2.447 (0.15) 2.411 (0.15)
	M-C6 2.290 (0.12) 2.323 (0.11) 2.549 (0.08) 2.479 (0.10) 2.496 (0.11) 2.651 (0.11) 2.414 (0.15) 2.450 (0.15) 2.710 (0.09)
	M-C7 2.530 (0.08) 2.346 (0.11) 2.296 (0.12) 2.623 (0.10) 2.517 (0.11) 2.487 (0.11) 2.701 (0.10) 2.462 (0.16) 2.421 (0.16)

Table 4 .

 4 Relative total (ΔE) and free (ΔG) energies, kcal/mol, of all the stationary points on the  6 -

	1	 6 -2 reaction pathway.
			Fe		Ru		Os
			L1	L2	L1	L2	L1	L2
		1	0	0	0	0	0	0
		IM	30.8 (28.8)	31.1 (29.2)	28.3 (25.0) 28.4 (26.5)	28.7 (26.6)	29.0 (27.8)
		TS1 31.3 (29.9)	31.5 (30.0)	28.2 (25.5) 28.6 (27.1)	29.9 (29.1)	30.3 (29.5)
		TS2 31.7 (30.2)	31.9 (30.4)	28.7 (23.0) 29.0 (28.4)	30.3 (29.4)	30.7 (29.2)
		2	-2.2 (-2.5)	-2.1 (-2.3)	-1.6 (-2.5)	-1.8 (-1.8)	-2.0 (-1.4)	-1.9 (0.0)

Table 5 .

 5 Morokuma-Ziegler EDA results for the species 1

, TS1, IM, TS2 and

								9
	M			Fe					Ru					Os
		1	TS1	IM	TS2	2	1	TS1	IM	TS2	2	1	TS1	IM	TS2	2
	EPauli b	5.89	4.52	5.04	4.44	5.97	7.17	5.15	5.54	4.98	7.33	9.02	6.74	7.84	6.67	9.18
	Eelstat c	-3.59 -3.04	-3.35	-3.00 -3.64 -4.39 -3.45 -3.67 -3.34 -4.49 -5.55 -4.49 -5.21 -4.45 -5.65
	Eorb d	-6.71 -4.50	-4.78	-4.45 -6.83 -6.63 -4.23 -4.43 -4.13 -6.80 -8.15 -5.51 -6.03 -5.45 -8.31
	TBE e	-4.41 -3.02	-3.09	-3.00 -4.50 -3.85 -2.53 -2.56 -2.49 -3.95 -4.68 -3.26 -3.40 -3.24 -4.77
																9

2 for M = Fe, Ru and Os. a Values are given in eV. a The considered fragments are Gr4 and (MCp) + ; b EPauli= Pauli repulsion energy; c Eelstat = electrostatic interaction energy; d Eorb = orbital interaction energy; e TBE = (total bonding energy) = EPauli + Eelstat + Eorb.

   6  6 -IRHRs of the (MCp) + (M=Fe, Ru, Os) complexes of the large model graphene molecule Gr4 (C96H24, D6h symmetry) have been first time investigated by means of DFT calculations, both in the gas phase and in two implicit solvents, polar acetone and nonpolar cyclohexane. The metal migration on the graphene ligand was shown to proceed through one intermediate IM and two transition states TS1 and TS2, which were calculated to have significantly lower energies compared with the migrations of the (MCp) + complexes on the smaller PAHs. Thus, increasing the PAH size has been demonstrated to lead to the noticeable reduction of the activation barriers of the thermally induced  6 6 -IRHRs and therefore to facilitate migration of the (MCp) + group on the graphene surface. The activation barrier was calculated to have the smallest height for the second metal of the Group 8 triad, Ru, as previously was found for the related Group could be expressed as ΔG # = 30, 27 and 29 kcal/mol, for M = Fe, Ru, Os, respectively, and 32 kcal/mol (for Ru on corenene). We made such a conclusion taking into account the compromise between calculation expenditures and accuracy of dissociation energies and activation barrier determination (see data in Supporting Information for n from 1 to 12). These values are much lower than barriers in naphthalene (46.2, 39.4, 45.9 kcal/mol, for Fe, Ru, Os, respectively)

	6 tricarbonyl species. Implicit solvent effects, both from polar and nonpolar solvents, were found to
	have negligible contributions to the activation barriers. These finding can have considerable
	significance for design of novel catalytic systems based on the graphene-supported organometallic
	complexes of the Group 8 metals as well as development of novel compounds with potential
	anticancer activity.
	METHODS
	Modeling of graphene based on PAH of general formula	6n H C 2	6n	, n = 1, 2, 3, 4, 5… etc. with

the use of DFT was done. Such model showed that activation barrier values of  6  6 -IRHR of (MCp) + from the central part of PAH to the neighboring ring at n = 4 (C96H24) with the high degree 11 of accuracy

  [START_REF] Dyall | An Exact Separation of the Spin-Free and Spin-Dependent Terms of the Dirac-Coulomb-Breit Hamiltonian[END_REF] and applied variationally. The all-electron basis sets L1 and L2 were used, where L1 and L2 stand for double and triple set size, respectively. The numbers of contracted and primitive Gaussians used in L1 are respectively {2,1}/{6,2} for H, {3,2,1}/{10,7,3} for C, {6,5,3,1}/{21,16,11,5} for Fe, {7,6,4,1}/{26,23,16,5} for Ru, and {8,7,5,2}/{30,29,20,14} for Os. The numbers of contracted and primitive Gaussians used in L2 are {3,2,1}/{8,4,2} for H, {4,3,2,1}/{12,8,4,2} for C, {8,7,5,3,1}/ {25,20,14,8,4} for Fe, {9,8,6,3,1}/{29,26,18,9,5} for Ru, and {10,9,7,4,1}/{33,32,22,17,4} for

ACKNOWLEDGMENTS

The authors (YFO, IPG) thank Alexander von Humboldt Stiftung (Bonn, Germany) for providing the workstation and some other software accessories on which DFT calculations were partially performed. Part of this work done by Nechaev M. S. in the frame of TIPS RAS State Plan. 12 the standard TZ2P basis set. 66 Within the EDA analysis, the total bonding energy (TBE) between two fragments is expressed as the sum of three components, the Pauli (or exchange) repulsion (EPauli), the electrostatic interaction energy (EElstat), and the orbital interaction energy (Eorb). Solvent effects (cyclohexane and acetonitrile) were evaluated through single-point calculations with the ADF program by using the conductor-like screening model (COSMO) of solvation. [70][71]