Nidhal Selmane
email: selmane@telecom-paristech.fr

Shivam Bhasin
email: bhasin@telecom-paristech.fr

Sylvain Guilley
email: guilley@telecom-paristech.fr

Tarik Graba
email: graba@telecom-paristech.fr

Jean-Luc Danger
email: danger@telecom-paristech.fr

WDDL is Protected Against Setup Time Violation Attacks

Keywords: AES, FPGA, Setup violation fault attacks, WDDL, Protection against faults

In order to protect crypto-systems against side channel attacks various countermeasures have been implemented such as dual-rail logic or masking. Faults attacks are a powerful tool to break some implementations of robust cryptographic algorithms such as AES and DES. Various kind of fault attacks scenarios have been published. However, very few publications available in the public literature detail the practical realization of such attacks. In this paper we present the result of a practical fault attack on AES in WDDL and its comparison with its non-protected equivalent. The practical faults on an FPGA running an AES encryptor are realized by under-powering it and further exploited using Piret's attack. The results show that WDDL is protected against setup violation attacks by construction because a faulty bit is replaced by a null bit in the ciphertext. Therefore, the fault leaks no exploitable information. We also give a theoretical model for the above results. Other references have already studied the potential of fault protection of the resynchronizing gates (delayinsensitive). In this paper, we show that non-resynchronizing gates (hence combinatorial DPL such as WDDL) are natively immune to setup time violation attacks.

I. INTRODUCTION

Side channel analysis or attacks (SCA) are attacks based on the analysis of the secret information (generally the encryption key) leaked from the physical implementation of the cryptographic system. The leakage is passively observed via timing information, power consumption, electromagnetic radiations, etc. Protection against side channel attacks is important because the attacks can be implemented quickly and at a low cost. Differential power analysis (DPA) [START_REF] Kocher | Differential Power Analysis[END_REF] and its derivatives such as correlation power analysis (CPA) [START_REF] Brier | Correlation Power Analysis with a Leakage Model[END_REF] correlate the leakages with an internal power model, which depends on the cryptographic key.

Several countermeasures have been devised to avoid SCA. Dual-rail with precharge logic (DPL) is one of the state-of-the-art countermeasure against SCA. In DPL, the idea is to make the power consumption of the device uniform, thus hiding the crucial information it conceals. Each signal is replaced by true and false representations. P recharge & Evaluation phases are alternated to ensure exactly one switching event per cycle. Wave Dynamic Differential Logic (WDDL) [START_REF] Tiri | A Logic Level Design Methodology for a Secure DPA Resistant ASIC or FPGA Implementation[END_REF] is one of the commonly used DPL. Unlike Sense Amplifier based Logic (SABL) [4], WDDL uses standard CMOS cells. Owing to this property, WDDL can be used with any design as no special library is required. Due to the same reason it can be used in FPGAs [START_REF] Tiri | Secure Logic Synthesis[END_REF], [START_REF]Synthesis of Secure FPGA Implementations[END_REF]. It is interesting to note that WDDL is prone to the "early evaluation" vulnerability [7], corrected from instance in SecLib [START_REF] Guilley | Security Evaluation of a Balanced Quasi-Delay Insensitive Library[END_REF], [START_REF] Guilley | Security Evaluation of WDDL and SecLib Countermeasures against Power Attacks[END_REF]. Despite this second-order issue, WDDL is relatively secure for a reasonable overhead. Hereafter we present our work with respect to WDDL designs.

Differential fault attacks (DFA) [START_REF] Boneh | On the Importance of Eliminating Errors in Cryptographic Computations[END_REF], [11], [START_REF] Blömer | Fault based cryptanalysis of the Advanced Encryption Standard[END_REF] also referred to as active attacks alter the functional behavior of the attacked device by injecting one or several faults. Several techniques are available to inject faults: variations of the supply voltage or clock frequency, temperature variation or irradiation by a laser beam which leads to a wrong computation result that can be exploited to perform DFA. Some countermeasures for DFA have been introduced. These countermeasures are generally based on temporal [START_REF] Bertoni | Error Analysis and Detection Procedures for a Hardware Implementation of the Advanced Encryption Standard[END_REF] or spatial [START_REF] Maistri | Double-data-rate computation as a countermeasure against fault analysis[END_REF], [START_REF] Karpovsky | Robust Protection against Fault-Injection Attacks on Smart Cards Implementing the Advanced Encryption Standard[END_REF] redundancy, either in a generic manner or taking advantage of some peculiarity of the algorithm.

Here in this paper we analyze the security of WDDL against setup violation fault attacks. We implemented AES (Singlerail & W DDL). Singlerail refers to simple version of AES and WDDL the DPL version. The sbox of the AES is implemented by calculations in composite field GF (2 4 ) as described in [START_REF] Wolkerstorfer | An ASIC Implementation of the AES SBoxes[END_REF].

The results presented in this article are obtained with an EP1S25 Altera Stratix FPGA soldered on a Parallax evaluation board. As described in [START_REF] Selmane | Setup Time Violation Attacks on AES[END_REF], [START_REF] Khelil | Fault Attack on AES FPGA Encryption Platform[END_REF], faults can practically be induced in an FPGA by under-powering the circuit. When we drive the FPGA at a voltage less than the nominal voltage, the propagation time of the signal increases as illustrated in figure 1. Such attacks are non-invasive in nature as the attacker does not need access to the silicon die and are therefore easy to implement. We recall that there is no straightforward mechanism to monitor either the power supply level or the frequency in commodity FPGAs. The permanent under-powering causes a phenomenon called "setup time violation" on one of the timing path of the design causing a faulty byte. We call this fault as a "byte-flip" fault, which is obtained by flipping of one or more bits in a byte. The number of bits flipped during a byte-flip is called the Hamming weight of the fault. Since cryptography involves highly complex computations it is very likely that the critical path is in the cryptographic part [START_REF] Faurax | Robustness of circuits under delay-induced faults: test of AES with the PAFI tool[END_REF]. Such faults can be exploited using various known attacks [START_REF] Piret | A Differential Fault Attack Technique against SPN Structures, with Application to the AES and KHAZAD[END_REF], [START_REF] Chen | Differential fault analysis on AES key schedule and some countermeasures[END_REF], [START_REF] Bar-El | The Sorcerer's Apprentice Guide to Fault Attacks[END_REF]. Here we use Piret's attack to exploit the faults and retrieve the secret key using the method described in [START_REF] Piret | A Differential Fault Attack Technique against SPN Structures, with Application to the AES and KHAZAD[END_REF].

Setup violated

Setup met Q' Q D Q' Q D clk clk V cc ↓ ⇒ T propagation ↑ Figure 1. Setup violation.
The rest of the paper is organized as follows. In section II, we explain the WDDL rationale and the design flow to implement it. Section III describes the attack setup and the faults analysis procedure. Section IV presents the comparison of a fault acquisition campaign on single-rail and WDDL version of AES, in terms of spatio-temporal localization of faults. Section V is devoted to the theoretical demonstration of the intrinsic immunity of WDDL against setup violation attack on AES. Finally, the section VI concludes the paper and opens perspectives for better protecting sensitive cryptographic implementations.

II. WAVE DYNAMIC DIFFERENTIAL LOGIC

Power consumption of a standard CMOS cell is dependent on the transition of its input. Thus for a DPA-resistant design, a possible solution could be to introduce a family of DPA resistant cells. In a WDDL cell [START_REF] Tiri | A Logic Level Design Methodology for a Secure DPA Resistant ASIC or FPGA Implementation[END_REF], one transition per cycle is observed, which is favourable for a DPA resistant logic style.

WDDL uses true and false representations of each signal (I/O of each cell). To make the power consumption fairly uncorrelated to the processed data, it is necessary that there should be the same number of transition every cycle. This condition is fulfilled by alternate cycles of precharge and evaluation. In the precharge phase all the signals are charged to the same level (e.g. 0 in WDDL) and during evaluation exactly one of the two complementary outputs is evaluated (=1). Figure 2 shows the timing diagram of WDDL AND gate. We can see that during precharge all signals are put to logic 0. During evaluation, exactly one of the two complementary inputs and outputs evaluates to 1.

In DPL, glitches make the design vulnerable to attacks [START_REF] Mangard | Successfully Attacking Masked AES Hardware Implementations[END_REF]. Indeed, without special attention, if the inputs arrive at different moments, glitches can be observed. To avoid glitches it is necessary that all the gates in the design should be positive in nature. To ensure this in WDDL, the design is synthesized with a library consisting of only positive gates (like AND, OR) [START_REF] Guilley | Evaluation of Power-Constant Dual-Rail Logic as a Protection of Cryptographic Applications in FPGAs[END_REF]. As shown in figure 3, a WDDL AND gate consists of an AND gate (G) and a complementary OR gate (G * , satisfying G * (x) . = G(x)). For sequential circuits, each flip-flop is replaced by a pair a flip-flops. This double flip-flop allows the precharge wave to propagate through the whole design as all the gates are positive. It has to be noted that inverters in WDDL are implemented by crossing the true and false signals of the same variable.

A point worth noting in figure 3 is that one flip-flop in the single-rail design is replaced by four flip-flops in the WDDL design. This is explained as follows. During the precharge phase, the combinatorial part of the circuit will be discharged to 0 and this 0 is stored to the first of the two flip-flops. The second flip-flop will store the result of the last computation. In the evaluation phase, the value stored in the second flipflop serves as input and the output is stored in the first flipflop. In the mean while, the zero stored in the first flip-flop is shifted to the second flip-flop to allow proper precharge of the circuit ahead in the next cycle. This phenomenon happens in both true and false rail. Thus the number of flipflops is quadrupled in the WDDL design.

G G Single-rail Dual-rail Q B A Q f Q t B t A t A f B f G * Figure 3. WDDL building block.
In our implementation, we use a different way to ensure all positive logic. Instead of using positive gates, we use a library containing all look-up tables (LUTs) which implement a positive function. This technique is called WDDL+ in [START_REF] Guilley | Area Optimization of Cryptographic Co-Processors Implemented in Dual-Rail with Precharge Positive Logic[END_REF].

A. Design Flow for WDDL Implementation

As every digital system, cryptographic coprocessors can be separated into control and datapath parts. As the secret key is used only in the datapath part, leakage from the control part is not crucial. Thus to assure security of the design it is sufficient to implement only the datapath in WDDL. This will also save area as WDDL takes more area on the FPGA than a single-rail design. The design flow to implement a cryptographic coprocessor on an FPGA is shown in figure 4. The datapath is first synthesized using an ASIC synthesizer taking advantage of a library with only positive LUTs (the FPGA synthesis tool does not provide enough options to limit the library therefore we use an ASIC synthesizer). Then the output netlist is processed using a custom tool (called vDuplicate in figure 4) which converts a single-rail netlist into a WDDL netlist. The controller is then connected to the WDDL datapath using a wrapper. The FPGA vendor tool does synthesis, mapping, placing & routing for the whole design on the FPGA.

B. Dualization of single-rail design

As mentioned earlier, the controller of the cryptoprocessor is not converted to WDDL technology. To make the same controller work with the WDDL version of the datapath, there is a need to introduce an extra input to the controller. As the WDDL datapath will precharge in one cycle and evaluate in the next cycle, we require the controller to work every alternate cycle (evaluation) and freeze during the precharge phase. A enable signal driven at half the clock frequency is introduced to provide this functionality.

One more modification is required in the design. The I/Os of the WDDL datapath are dual-rail, while the signals from controller to datapath and the global I/Os are singlerail. Therefore we need to create a wrapper which will make the single-rail and the WDDL parts compatible. As shown in figure 5, all the inputs to the datapath (I & C) are transformed into dual-rail (true and false) signals using inverters. A signal phase is introduced to make the datapath inputs compatible with precharge and evaluation phases. When phase is precharge, both the true and false inputs are discharged to 0. During the evaluation phase, exactly one of the complementary input charges to 1. For the output (O) as shown in figure 5, the true output is ANDed with the inverted false output. Only taking the true output while leaving false output unconnected is also an option. The reason for using both the outputs is to make sure that the FPGA vendor tool doesn't remove the unconnected false output during optimization in placement and routing steps, as the optimization will create an unbalanced design. After the wrapper has integrated the WDDL datapath and the controller, it seems to work as a single-rail design from the top. Therefore now the design could be simulated, synthesized or tested as a single-rail design using the same softwares. In this way, if the results are same for singlerail and WDDL, we are ensured that the two designs are functionally equivalent.

When both the designs are synthesized, the single-rail design works at a frequency of 54.5 MHz using 10% of the FPGA logic. On the other hand, the WDDL design as expected works at a frequency of 22.01 MHz which is less than the half of the single-rail frequency due to two phase operation in WDDL. The WDDL design uses 51% of the logic blocks i.e. 5 times more than the single-rail design. The overhead of 5 times is due to the fact that 20 instantiations of sbox is used and each sbox is replaced by a true and false sbox which makes the design huge.

III. SETUP FOR FAULT ATTACKS ON FPGAS

In order to induce faults during the execution of the algorithm we drive the core of the FPGA at a non-nominal continuous voltage V cc. The power supply is remotely controlled using GPIB cable.This feature allows us to test various values of input voltage successively. For each value of V cc, the triples {message, key, ciphertext} are recorded for 1,000 encryptions at each 100 values of V cc. Once acquisition is done, we use a software for an offline analysis of the collected ciphertext in order to detect single byte errors that occur during the encryption. A modified RTL description of AES where faults can be injected at any byte of the ten rounds is used to generate a dynamic database. The database consists of all possible ciphertexts generated only by single faults for each key, message pair. Then we test if the faulty ciphertext matches an entry in the database. If so, the fault is said "covered" otherwise the fault is said "uncovered" and the ciphertext is affected by multiple byte faults. If a fault is covered, the software provides the location, the value of the faulty byte, its corresponding correct byte and the Hamming weight of the fault. The purpose of this implementation is to identify the typology of single faults that occurs in the FPGA.

If the fault is "covered" then we can identify the round and the sbox affected by the fault. This concludes that the voltage reduction generates random single faults that most differential attack models are based on. In this experiment we use a global non-invasive fault injection technique. The propagation time increases with the decrease of the power supply and faults are caused by an early latching of a combinatorial function as shown in figure 1.

IV. EXPERIMENTAL RESULTS

In this section, the fault analysis is used to find the occurrence of a single byte fault that affects the state matrix of AES. Both single-rail and WDDL versions are tested against setup violation faults. Faults detected are those occurring only in the datapath, while the key schedule is assumed here to be fault-free. Indeed, in our design, the key schedule block is not critical in timing.

Figure 7a shows the occurrence of faults in single-rail implementation. We can see that the graph of single faults has a bell-shaped distribution. As we decrease the voltage beyond a certain threshold, setup time is violated on multiple paths and faults become multiple (uncovered). The maximum percentage of single faults is 39% at a voltage of 1.256 V as shown in figure 7a. All single faults are analyzed in terms of spatio-temporal locality: Figure 8a and figure 9a. 26% of single faults occur in round 8 and 12% of them occur in round 9 (refer figure 8a). Such faults are exploitable using Piret's Attack. Thus the single-rail implementation of AES with SBOX in LUT is not protected against "setup violation" attacks.

For the WDDL version of AES, the results are shown in the figure 7b. Since we use only positive LUTs to implement WDDL, there are no glitches in the circuit. When we run the fault attack campaign on WDDL design, less than 2% of the detected faults are single and all of them fall in the last round of AES as shown in figure 8b. These faults are not exploitable and thus the key cannot be retrieved using Piret attack. The software for fault analysis allows us to see faulted bytes and its corresponding correct value (value of byte if not faulted). We find that everytime a fault occurs, the faulted value C * is less than its corresponding correct value C, in a bitwise sense: C & C * = C * . This comes down to using the partial order , defined bit by bit in the following truth table:

C C * C * C 0 0 1 0 1 0 1 0 1 1 1 1
This means that all the faults are caused when an expected '1' takes a value equal to '0'. The reason why all the faults are seen in the last round is as follows. When an XOR gate is implemented using positive logic, it is a combination of AND, OR gates and inverters (for inverted inputs). These inverters yield a mixture of true and false part of the design as per the definition of XOR. Thus a fault occurring in a true part is further corrupted by mixing with the false part and vice versa. The MixColumns operation involves a lot of XOR operations. Therefore a MixColumns operation after a fault will corrupt the fault which cannot be detected. Since the last round does not have MixColumns, the faults are detected but not exploitable. One interesting observation was that every time a byte is affected by a fault, a null byte in the ciphertext was reflected at its expected place. This means that even after successfully injecting the fault during encryption and precisely knowing the location of the fault, the output does not give any information which can be acted upon to retrieve the hidden secrets. The results observed are easily reproducible. This means that for a particular voltage lower than the nominal voltage, if the ciphertext and input message are constant, the fault is often in the same sbox. This feature gives us better flexibility for complete analysis of these faults. Therefore, a WDDL design is naturally secure against setup violation faults. This has been further explained in the section V-A.

V. THEORETICAL FAULT ANALYSIS

The purpose of this section is to show that the fault model corresponding to a setup violation time has the consequence that DFAs on AES in WDDL are impractical.

A. Fault Analysis on AES in WDDL with SubBytes in LUTs

1) Fault Model: In an under-powering or overclocking attack, faults arise from a setup time violation [START_REF] Selmane | Setup Time Violation Attacks on AES[END_REF], [START_REF] Khelil | Fault Attack on AES FPGA Encryption Platform[END_REF]. Authors of paper [START_REF] Francq | Security of several AES Implementations against Delay Faults[END_REF] argue that the effect of a glitch on the power supply increases the propagation times of all the signals, which makes this disturbance similar in effect to the global chip under-powering. As the WDDL protocol with a (0, 0) spacer starts in evaluation step with all the nodes voltage equal to zero, the evaluation consists in propagating rising transitions along exactly half of the wires. If by any means, an attacker manages to trigger a setup time violation, the consequence is an asymmetric bit flip: only 1 to 0 errors are considered. Therefore, the consequence of the fault is to leave (at least) one dual-rail signal in its (0, 0) precharge state, while the others couples of wire are in legal (0, 1) or (1, 0) evaluation state.

As already discussed in Sec. IV, the error is likely to happen for a few dual-rail signals if the stress level is low. This invalid data representation will then propagate through the next round logic. Four cases are possible:

1) the protocol error can turn into functional errors on the data or not, and 2) the protocol errors can vanish while flowing through the combinatorial logic (self protocol healing), or, at the opposite, be amplified.

Correct computation

a b at a f bt b f ct c f c 0 0 0 1 0 1 0 1 0 0 1 0 1 1 0 0 1 0 1 0 1 0 0 1 0 1 0 1 1 1 0 1 0 1 0 1 Faulted computation a b at a f bt b f ct c f c NULL 0 0 0 0 1 0 1 0 NULL 1 0 0 1 0 0 0 NULL

Faulted computation

a b at a f bt b f ct c f c NULL 0 0 0 0 1 0 0 NULL NULL 1 0 0 1 0 0 0 NULL
The next section shows that functional errors occur, corresponding to bits erasure. In addition, the erasure rate increases: one single error at the entrance of a round will trigger many invalid precharge bits to be generated, and we show that in a reasonable cryptographic algorithm (no computation is done uselessly), the erasure rate increases. The consequence is that, after some percolation in the combinatorial logic, most of the values are erased.

2) Propagation of Faults:

We start this analysis by the example of two representative gates: the AND and the XOR functions each having two inputs that we note a and b. We assume in this study that the fault occurs on input a. In evaluation, instead of having (a t , a f ) = (0, 1) when a = 0 and (a t , a f ) = (1, 0) otherwise, we simply have a t = a f = 0, which can also be expressed as a=NULL. The logic that implements the AND gate is same analysis can be carried out for the WDDL XOR gate in figure 10. The logic that implements the WDDL XOR gate is

(c t , c f ) = (a t • b t , a f + b f ).
(c t , c f ) = (a t • b f + a f • b t , (a f + b t ) • (a t + b f )).
This equation shows that if we have a faulty input (a t = a f = 0) then the output will be NULL (c t = c f = 0) . Thus the XOR gate has a maximum error propagation since the error is propagated for any value of b as shown in table II. Now, for any function f , we have this property:

Definition Let f be a positive Boolean function with inputs (a, b) then its WDDL equivalent F can be defined as:

F t (a t , b t ) = f (a t , b t ) , F f (a f , b f ) = f (a f , b f ) .
The output of f is correct when f does not depend on the faulty input, and erased otherwise.

The proof is straightforward. If the output does not depend on the faulty input, the computation is correct for both the true and the false outputs, because the protocol violation does not impact the result. On the contrary, for the configuration of non-faulty inputs b such as F depends on the faulty input bit, then we have four cases:

1) F t = F f = 1: impossible since F is positive and the inputs are lower than a legal value, that is either (1, 0) or (0, 1), 2) F t = 1 and F f = 0. In this case,

1 = f (0, b) [equation for F t ] and 0 = f (0, b) = f (1, b) [equation for F f ] , i.e. 1 = f (1, b). Therefore f (0, b) = f (1, b)
. However, we assumed that F does depend on the first faulty input, hence a contradiction.

3) F t = 0 and F f = 1: for the same reason, this case is incompatible with the input configuration such that F does depend on the faulty input. 4) Consequently, the only possibility is that F t = F f = 0, hence a NULL propagation. Let us now study a random function, modeling the byte substitution table (SubBytes) of the AES. If there is a NULL fault at the input, then:

• for one half of the input data, a specific output bit will depend on this input, and

• for the other half, the targeted output bit does not depend on the input. Therefore, statistically, one half of the output bits are erased to NULL. Notice that this result is independent of the exact functional decomposition in a positive dual gates netlist. Similarly, if two inputs are erased, then 3/4 of the outputs will also be NULL. And of course, when seven or eight

a 4 a 3 ⊕ a 7 a 4 ⊕ a 3 ⊕ a 7 a ′ 3 a 3 a 2 ⊕ a 7 a 3 ⊕ a 2 ⊕ a 7 a ′ 2 a 2 a 1 a 2 ⊕ a 1 a ′ 1 a 1 a 0 ⊕ a 7 a 1 ⊕ a 0 ⊕ a 7 a ′ 0 a 0 a 7 a 0 ⊕ a 7

Table IV TRUTH TABLE FOR THE UNIVERSAL GATE AND.

AND '0'

'1' 'U' '0' '0' '0' '0' '1' '0' '1' 'U' 'U' '0' 'U' 'U'
errors are presented at the input, all the output bits become NULL.

We have already shown in section V-A2 that with XOR gates the fault propagation is maximal. The MixColumns transformation is a multiplication of a polynomial over GF (2 8 ) with the fixed polynomial a(x) [START_REF] Kocher | Differential Power Analysis[END_REF], reduced modulo x 4 + 1.

a(x) = (0x03)x 3 + (0x01)x 2 + (0x01)x + (0x02) (1)
The equations for the byte multiplications involved in this multiplication are written down in Tab. III. Hence we see that the MixColumns operation is implemented as a tree of XOR gates. This ensures a maximum propagation of NULL.

In an SPN (substitution permutation network) like AES, the fault number can only grow at each step. Indeed, for every block f , if a fault is stopped, then: f ('U', x) is certain, for a given input x. Now, this means that f ('0', x) = f ('1', x), and this implies that f is not bijective. Therefore, differential attacks become difficult as the attacker observes an erased value, and cannot backtrack from the faulty ciphertext. The best case being when all the output bits are erased and thus no information that can be useful to generate the key is available.

Unlike byte-flips induced by a laser, the setup time violation on WDDL causes no computation to be wrong. Instead, when an input is partially NULL, the logic evaluates the bits that can be correct for sure, but answers NULL if it cannot decide. Therefore, the propagation model is that of 'U' in VHDL [START_REF]IEEE Standard VHDL (Very High Speed Integrated Circuits Description Language) Reference Manual[END_REF]. The logic tries to evaluate bits that would not be wrong if any correct value ('0' or '1') were used instead of 'U'. We recall in Tab. IV the extended truth table of the universal gate AND over {'0', '1', 'U'} 2 .

x f x t x As shown in Fig. 11, the conversion of the dual-rail signals to single-rail turns a NULL into a '0'. This circuit makes use of both true and false signal halves, so as to prevent the CAD tool from simplifying half of the logic and balance the true and false networks. Therefore, if a fault occurs during the computation, it can be observed. This difference could be exploited by an attack, as done in the attack of Gilles Piret. However, the computed differential will not disclose any information about the last round key, since the XOR function used to mix it propagates a NULL.

All the considerations detailed regarding WDDL rely on the fact the gates are positive. Indeed, the gates will stick to zero unless valid values are produced. This is not true for delay insensitive gates which stay in a zero state and jam the computation. Notice that in WDDL the results are independent of the type of spacer used. It can be N U LL0 . = (0, 0), N U LL1 . = (1, 1), used as constants or interleaved alternatively or randomly.

3) Generalization to Arbitrary Fault Models: We consider two categories of faults: 1) Asymmetric faults, where bits can only be flipped from 1 to 0. This type of faults is typical encountered in WDDL circuits stressed by a global perturbation, such as under-voltage or over-clocking. Glitch attacks can lead to the same symptom, because it manifests in adding a delay globally to all wires. Flash of white light have been reported in [28, §12, page 163] to zero selectively the output of some operations. Equally, laser shots on SRAM-based FPGAs tend to favor 1 → 0 bit-flips over 0 → 1 [START_REF] Maingot | Configuration errors analysis in SRAM-based FPGAs: software tool and practical results[END_REF]. Notice that in DPL with a (1, 1) spacer, the opposite transition occurs when trying non-invasive attacks. We do not detail this situation as it is the exact opposite of the 1 to 0 case. 2) Symmetric faults, where bits are susceptible of toggling in both directions. Laser shots can trigger both 1 to 0 and 0 to 1 transitions. This fault is thus semiinvasive, as opposed to the previous ones. Therefore, it models a more powerful attacker, at least able to chemically prepare the sample to attack.

In the context of asymmetric faults, DPL circuits are natively protected as such. In this respect, it is interesting to compare the pros and the cons of synchronous and asynchronous circuits. When exposed to under-voltage, asynchronous circuits will continue to work, down to a voltage value where the gates will not be supplied enough to produce a strong one. Below this threshold, errors of type "stuck at zero" will manifest, exactly as in the case of synchronous circuits. Overclocking is not an attack that applies to asynchronous circuits that are, by definition, clockless. However, we have noticed that this perturbation is ineffective is exposing secrets. Therefore, a synchronous circuit will be less reliable in the presence of non-invasive faults, but as secure as an asynchronous circuit. A trade-off between the two approaches can be reached by considering synchronous circuits with jitter on the clock. The jitter can have a large variance, since even if it conducts to a setup time violation, the secrets remain safe. Therefore, with DPL, it is secure when used in addition with aggressive clock jitter.

If the attacker has the means to inject symmetric faults, then three types of protections must be considered:

1) When the fault induction is gentle, single bit flips is the most likely fault model. In this case, even if the fault is a 0 to 1 transition occurring during the evaluation stage, the only risk is to create a (1, 1), also called NULL1. However, in a dual way of the case study of the propagation of NULL0 values, we can show that the propagation of NULL1 consist in an erasure of the data, so that the syndrome does not convey any single bit of information about the faulty circuit internal state. DPL style thus forces the attacker to be less furtive. 2) With a more intense stress, the attacker will start to induce multiple faults with low multiplicity. In this case, a DPL gate can output completely false values. For instance, an AND gate for which the inputs are NULL0 and NULL1 evaluates to the correct value 0 (with respect to WDDL valid states), even if the two unfaulty inputs were both equal to 1. To protect the implementation against those attacks, additional detection hardware must be added so as to cross-check the computation. A little gain can however be obtained: As the DPL style is protected against single faults, a datapath of n bits can be checked with code words of only n -1 bits without risking to weaken the security level. A protection method at the technological level such as the one presented in [START_REF] Torrens | An SRAM SEU Hardening Technique for Multi-Vt Nanometric CMOS Technologies[END_REF] could be extended from SRAM points to DFFs and combinatorial gates. By using high-VT P transistors (those that compute the '1') and low-VT N transistors (those that compute the '0'), the designer could make the faults 1 → 0 much more likely than the opposite 0 → 1. 3) When the stress is very strong, then we expect the faults to be very frequent. Hence the recommendation to use physical captors spread on the chip surface. Now, if we consider only asymmetric faults, we could think that power analysis could be made possible by the fault injection. Indeed, if DFA does not expose the key, it at least indicate to the attacker that a fault has happened. More precisely, we could imagine to correlate the amount of detected faults to a side-channel, in a view to establish correlations. Indeed, in nominal operation conditions, the activity is constant: half of the gates commute in each clock cycle. When a fault is injected, the activity will become lower:

• in a fault position dependent fashion (for sure), as illustrated in Fig. 12,

• but perhaps also in a data dependent fashion. However, such an attack cannot be mounted, since if a sensible variable is faulty, irrespectively of its value, the fault will generate a NULL0. Therefore, after the fault, the system has forgotten its value, and computation (in terms of number of toggles) will continue in similar ways. This argument is confirmed by the practical observation of power consumption of WDDL AES as shown in figure 13. We can see that the power consumption of the device is abruptly reduced as soon as the fault occurs approximately at time 2130 ps. The power consumption further reduces after two cycles and remains constant till the end of encryption. It takes exactly 2 cycles (1 ShiftRows and 2 MixColumns) for NULL0 to diffuse through the whole design. This holds even if the DPA protection has a second order flaw, such as early evaluation. The only way to take advantage of such a flaw is to exploit it without faults. Indeed, to rephrase why DFA does not help the DPA, with faults, the distinctions of power curves at second order simply disappear. We cannot show any experimental curve to illustrate this point since we have no mean to deduce the bit concerned with the fault based on the sole knowledge of the ciphertext.

Finally, we attract the reader's attention to the fact that vulnerability analysis of WDDL against faults exploitation or DPA in the presence of faults has been argued in the precharge to evaluation step. However, it can be transposed without any change to the case of evaluation to precharge step. Indeed, the circuit's behavior is unchanged, except that 0 → 1 transitions are replaced with 1 → 0. And the attacker has less insight, since he cannot observe the faults occurring in the precharge stage, that are filtered out by the WDDL circuit wrapper described in Sec. II-B.

B. Counter-Measures against Non-Invasive Attacks

A straightforward countermeasure against non-invasive attacks on various circuits (not only DPL) consists in inserting into the circuit some logic in charge of detecting abnormal situations before the critical parts of the designs become faulty. For instance, in Fig. 14, a setup consisting of an even number of inverters between two registers is presented. The source register invert its value every cycle and the combinatorial chain of even number of inverters computes always the same value. At the end of the chain, a destination register checks that the value computed by the chain. The setup time of the invertor chain is violated if the monitored (output) value is different than the input. Hopefully, if the chain is designed to be longer than the critical path, an alarm is raised before the cryptographic parts of the design become faulty.

VI. CONCLUSION

Information masking and hiding are two concurrent protection techniques against side-channel attacks. Last year at FDTC, Arnaud BOSCHER and Helena HANDSCHUH showed that masking does not protect against fault attacks [START_REF] Boscher | Masking Does Not Protect Against Differential Fault Attacks[END_REF]. On the contrary, we have demonstrated theoretically and shown practically that information hiding (such as DPL) makes it difficult to mount fault attacks, since faulty outputs reveal no information about the keys. Unlike the "differential behavioral attack" (DBA), where a simultaneous observation of the faulty message and of the power curve empowers an attacker into mounting an attack, in the case of WDDL the attacker cannot learn anything from power curve corresponding to a faulty encryption.

We show, for the first time, that asymmetric fault attacks in general being not a threat for DPL circuits. As a perspective, we can study whether or not more traditional faults model (such as the byte-flip caused by a laser spot) also leads to unsuccessful attacks. Provided this analysis turns out to be correct, all previously proposed countermeasures against DFA for WDDL would be useless: for instance, the alarm (namely the ('1', '1') state) propagation scheme presented in [START_REF] Moore | Balanced self-checking asynchronous logic for smart card applications[END_REF] warns of a possible attack against which the circuit is already natively immune.

Figure 4 .

 4 Figure 4. WDDL design flow.

Figure 5 .

 5 Figure 5. Basic architecture of WDDL wrapper.

Figure 6 .

 6 Figure 6. Experimental platform.

  When a faulty, the Tab. I function degenerates to AND(a * , b) = 0 if b = 0, NULL otherwise.

Figure 9b .Figure 10 .

 9b10 Figure 7a. Occurrence of Fault -Singlerail.

Figure 11 .

 11 Figure 11. Dual-to-single rail circuitry usable in the case of a NULL0 spacer.

Figure 12 .

 12 Figure 12. Power dependence of a WDDL circuit in the faults.

Figure 13 .

 13 Figure 13. Practical power consumption of a WDDL circuit in the faults.

Figure 14 .

 14 Figure 14. Counter-measure based on the insertion of a monitoring logic with a propagation time larger than the critical path of the rest of the circuit.

Table I MODIFIED

 I FUNCTIONALITY OF AN AND GATE IN THE PRESENCE OF ERASURE FAULTS.

Table II MODIFIED

 II FUNCTIONALITY OF AN XOR GATE IN THE PRESENCE OF ERASURE FAULTS.

Table III EQUATIONS

 III FOR THE BYTES TRANSFORMATIONS ×01, ×02 AND ×03.

	a ′	a × 01	a × 02	a × 03
	a ′ 7	a 7	a 6	a 7 ⊕ a 6
	a ′ 6	a 6	a 5	a 6 ⊕ a 5
	a ′ 5	a 5	a 4	a 5 ⊕ a 4
	a ′ 4

ACKNOWLEDGMENTS

The authors would like to acknowledge the support of French National Research Agency (ANR) SeFPGA https: //sefpga.enst.fr/ project for this study. Some precious advices also came from the outputs of the MARS (http://projects. comelec.enst.fr/mars/) ANR project. Finally, we are very grateful to the collaboration with STMicroelectronics AST division (Rousset, France) dealing with hardware cryptoprocessors security improvements.


teaching and research institutions in France or abroad, or from public or private research centers.

Les catégories de genre à l'épreuve de la non-binarité Arnaud ALESSANDRIN 1 Introduction Parler de genre a longtemps relevé d'une dynamique bi-dimentionelle. Qu'il s'agisse de l'inextinguible question des inégalités femmes-hommes, des violences de genre ou bien encore des questions transidentitaires, il a le plus souvent été question d'opposition, de domination, de comparaison, de transition : bref de binarité.

Les travaux contemporains sur le genre et les minorités sexuelles et sexuées ont néanmoins mis en avant des figures, des cultures, des trajectoires venant rompre avec cette dualité. Les drag-queens ou les drag-kings 2 , plus encore les drag-queers 3 , font notamment partie de ces tentatives d'extirper le genre de cette binarité. D'un point de vue plus identitaire, la visibilité des personnes queers, gender fluid ou non-binaires fait glisser cet au-delà de la binarité d'une perspective scénique et artistique vers des agendas politiques plus classiques comme ceux de l'éducation (avec des enjeux scolaires vifs), de la santé (avec la question des prises en charge des mineurs non-binaires par exemple) ou de l'aménagement du territoire qu'il s'agisse de toilettes, de vestiaires ou bien encore d'espaces de loisirs).

Pour autant, nous ne savons pas grand-chose des personnes non-binaires ou gender fluid. Dans la littérature francophone 4 disponible, on soulignera la publication de travaux centraux sur les jeunes non-binaires 5 , l'école et leur (non)inclusion 6 , l'évolution de leurs terminologies d'usage 7 , ou bien encore des essais tentant de cerner les contours de cette nouvelle façon d'être au genre 8 .

Pour saisir ce qui se dessine comme un nouvel enjeu autour des personnes LGBTIQ 9 , il est nécessaire de définir en amont ce que nous entendons par « non-binarité ». Bien que le terme de « non-binarité » soit récent, les identités qui permettent de dire « un au-delà » des catégories masculines et féminines sont nombreuses. La multiplication des façons « faire genre » est une tendance qui semble s'accélérer du moins si l'on se fie aux recherches les plus 1 Arnaud Alessandrin est sociologue de l'université de Bordeaux où il enseigne la sociologie du genre, de la santé et des discriminations. Il a notamment publié « Sociologie des transidentités » (Cavalier bleu, 2018, 2de édition 2023) ; « Parcours de santé / Parcours de genre » (codir., PUM, 2019), « Santé LGBT » (codir., Bord de l'eau, 2020) « Déprivilégier le genre » (Double ponctuation 2021). 2 Moins visibles dans la littérature nationale, les écrits autour de la pratique et de la communauté « king » sont bien documentés par Lucas Greco, notamment : Dans les coulisses du genre. La fabrique de soi chez les dragkings. Lambert-Lucas, 2018. 3 Arnaud Alessandrin, « Drag in the city : éléments pour une analyse du paysage Drag Queen français », Le sujet dans la cité, vol. 12, no. 2, 2021, pp. 235-248. 4 Il convient de noter les publications bien plus nombreuses du côté de la littérature internationale autour de ces populations. 5 Annie Pullen Sansfaçon, Denise Medico, Jeunes trans et non binaires : De l'accompagnement à l'affirmation Remue-Menage, 2021 6 Richard Gabrielle et Clément Reversé. « La vulnérabilité scolaire des jeunes LGBTQI en France. Penser la marginalisation accrue des élèves trans, non binaires et intersexes », Agora débats/jeunesses, vol. 91, no. 2, 2022, pp. 21-35. 7 Arnaud Alessandrin, "Au-delà du troisième sexe : expériences de genre, classifications et débordements", Socio, 9 | 2017, 201-214. 8 Louisa Mackenzie, Vinay Swamy, Devenir non-binaire, Le Manuscrit, 2021. 9 Lesbiennes Gays Bi-sexuel.le.s, Trans, Interexes et Queer récentes sur cette question10 . Cependant toutes les définitions de la non-binarité ne se superposent pas complétement. D'une part, dans la littérature contemporaine des gender studies nous trouvons des définitions génériques, tendant à traduire la non-binarité de genre comme des « styles de féminités et de masculinités » 11 , qui ne se laissent pas réduire aux expériences et aux identités binaires. D'autre part, certaines approches soulignent que la nonbinarité de genre est aussi une posture politique de refus des assignations normatives 12 . Dans cette perspective, on trouve de nombreux travaux issus de la théorie queer qui relient les expressions et les revendications non binaires à des manifestations subversives de déconstruction. Si le présent chapitre n'a pas pour objectif de trancher cette controverse, il convient néanmoins de remarquer que le terme de « non-binarité » peut parfois apparaître comme un terme parapluie renvoyant à une diversité d'expériences, d'identités ou de revendications qui, par leur fluidité, défont les traditions genrées. À cet égard, nous notons que la non-binarité se déploie tantôt comme « un en dehors du genre », tantôt comme une oscillation entre les rôles traditionnels assignés au masculin et au féminin. Plus encore, aux côtés du terme de non-binarité, nous trouvons d'autres appellations comme celles de personne « agenre », « gender queer » ou « gender fluide » pouvant recouvrir des réalités similaires (ce qui n'aide évidemment pas les lectures statistiques de ces multiples identités) 13 .

A cet égard, nous pourrions nous interroger sur la porosité définitionnelle entre la non-binarité et la transidentité. En effet, si cette dernière se définit comme une distance (allant de la négociation au refus) du sexe assigné à la naissance, peut-on dire que la non-binarité est une forme de transidentité ? 14 En creux, à quelles conditions la non-binarité peut-elle être superposable à une forme de cis-identité 15 ?

Pour les besoins de ce chapitre, nous ne porterons pas notre attention sur les nuances d'expériences et de représentations que recouvre ce fourmillement nominal, bien que ces enjeux semblent prendre une importance de plus en plus significative.

C'est pourquoi notre attention se portera plus spécifiquement sur ce que l'apparition de ce terme, et les expériences décrites à travers lui, font et défont de la catégorie « femme » qui, à l'image de la masculinité, est ici rediscutée. Pour cela, nous reviendrons sur les tentatives de définitions précitées en les explorant plus intensivement, notamment au travers d'entretiens. Trois mouvements argumentatifs nous intéresseront. Nous regarderons premièrement du côté d'une non-binarité comme oscillation de genre (l'un et l'autre genre) avant de s'intéresser à la non-binarité comme agencement (l'un et l'autre genre) puis comme extériorité du genre (ni l'un ni l'autre).

Note méthodologique

Afin de rendre compte du contexte de récolte des données qualitatives utilisées dans ce chapitre, il convient de signaler deux enquêtes durant lesquelles des entretiens et des focus groupes ont été réalisés avec -notamment-des personnes non-binaires. Ce sont ces recherches qui nous permettent de présenter cette réflexion.

La première recherche (intitulée « Santé LGBT »16 ) a été réalisée entre 2017 et 2019. Elle se décline méthodologiquement sous la forme d'un questionnaire, que nous ne mobiliserons pas ici, et d'une série d'entretiens portant sur quatre parcours de santé : la santé scolaire, les parcours bariatriques, la cancérologie et le vieillissement. C'est principalement du côté des éléments relatifs à la santé scolaire qu'ont été empruntés les entretiens retranscrits pour cette démonstration. Cela entraine fatalement une analyse portant sur des populations jeunes (lycée -université). Mais cette caractéristique sociodémographique répond également à la sociologie des personnes non binaires qui, d'après de nombreuses enquêtes, épousent un profil plus jeune que le reste de la population17 . Une indication explicative à ce phénomène pourrait se situer de côté de la nouveauté relative de ce terme18 (et non du ressenti), s'inscrivant par la même plus immédiatement dans les récits de vie des personnes plus jeunes. Une autre explication provient probablement des phénomènes d'identifications (sans que cela soit péjoratif) qu'inaugurent les réseaux sociaux et les figures médiatiques non-binaires. Leur présence permet alors un usage du terme et l'expression facilitée d'une identité jusque-là silenciée.

La seconde recherche à partir de laquelle sont extraits les entretiens présents dans ce chapitre porte sur les « souvenirs du mariage pour tous »19 . Cette recherche est elle aussi constituée autour d'une méthode mixte : qualitative et quantitative20 . Dans son volet qualitatif, la recherche permit de réaliser des focus groupes (des entretiens collectifs) autour de la thématique du mariage pour tous. Parmi les participantes, des personnes non-binaires se sont exprimées. Ce sont leurs présentations et les discussions autour de la non-binarité avant ou après les focus-groupe qui sont ici retranscrites.

Les entretiens analysés ont été sélectionnés en fonction des « auto-identifications 21 » des personnes. Il ne s'agit pas ici de tester la robustesse définitionnelle de l'emploi des termes par les personnes mais de les prendre comme tels, c'est-à-dire comme des expressions de genre singulières.

Enfin, pour l'ensemble des témoignages, une anonymisation a été effectuée.

21 Sur cette question des autocatégorisations et de l'auto-identification des personnes trans, lire par exemple : Emmanuel Beaubatie, « L'espace social du genre. Diversité des registres d'action et d'identification dans la population trans' en France », Sociologie, vol. 10, no. 4, 2019, pp. 395 Les normes de genre s'inscrivent dans la binarité. La sociologie de l'éducation, des loisirs, des milieux professionnels ou de la sexualité débordent de descriptions en la matière 23 . De plus, qu'il s'agisse des filles ou des garçons, les recherches autour du genre s'inscrivent également dans le constat d'une production de la binarité. De la sorte, nous pourrions dire que s'il y eut des écoles de filles et des écoles distinctes de garçons, ce n'était probablement pas parce que la nature avait fait des filles et des garçons ; mais plutôt car il fallait socialement produire de la différence. Si cette socialisation dans la différence passe aujourd'hui par différentes modalités, elle n'en demeure pas moins vraie. Ces assignations font de la non-binarité, comme des transidentités avant elle 24 , des expressions de genre nouvelles. A ce stade, notons 22 Pour les besoins de ce chapitre d'ouvrage, l'écriture non genrée sera privilégiée afin de rendre compte des identités non-binaires. 23 A cet égard, des encyclopédies et abécédaires du genre proposent d'éclairer plusieurs de ces thématiques. On pensera notamment à : Juliette Rennes (dir). Encyclopédie critique du genre. La Découverte, 2016 ; Arnaud Alessandrin et Brigitte Esteve-Bellebeau, Genre : l'essentiel pour comprendre, Des ailes sur un tracteur, 2014. 24 Arnaud Alessandrin, « Transidentités : du biologique au sociologique », Sexe et Genre: de la Biologie à la Sociologie (H. Berry dir.), PUF, pp : 149-159, 2019 que si l'expression de genre non-binaire semble récente, des travaux historiques 25 inscrivent l'identité de genre non binaire (c'est-à-dire le sentiment d'être non-binaire) dans des perspectives de plus long terme -comme ont pu le faire les anthropologues avant eux 26 . Ce constat s'appuie également sur l'augmentation tendancielle des publications autour de cette question 27 , de sorte que le sujet ne soit plus uniquement de l'ordre de l'identité individuelle mais bel et bien du phénomène social.

Parmi les personnes non binaires rencontrées, la composition de son genre reste une interrogation centrale aux vues des injonctions nombreuses à se situer dans une case du genre -et une seule. Cette pression de l'assignation se ressent dans de nombreux témoignages qui, en choisissant d'être « parfois » du côté du masculin et « parfois » du côté du féminin, font avec les exigences sociales.

« En réalité, je suis plus féminine que masculine en ce moment. Mais c'est peut-être aussi du fait du télétravail. Je peux plus investir cette partie de moi. Au boulot je ne suis pas certain que ce soit possible. Ça va, je le vis pas mal, je me vois pas être « 100% » masculine ou bien « 100% » féminine. Mais bon, être loin des collègues ça aide (rires) » (Léa, graphiste, 32ans) Dans ce cas de figure, les questions d'opportunité et de contraintes sont entremêlées. Les notions de discrimination et de transphobie, réelles ou appréhendées 28 , sont au centre de ces stratégies. Léa poursuit : « Peut-être qu'il y aurait eu de la transphobie de quelques collègues, mais en vrai, je ne sais même pas…. Après, c'est sûr que je préfère ne pas tenter donc comme c'est maintenant, c'est très bien. Je suis bien comme ça et j'évite des problèmes. » Cependant, toutes les oscillations de genre de la non-binarité ne semblent pas s'effectuer en fonction de contraintes et d'opportunités aussi nettes que celles de la protection contre la transphobie. Dans certains récits, la non binarité que nous décrivons (tantôt masculine, tantôt féminine) s'inscrit aussi dans des parcours de vie et des incertitudes. Les temporalités de cette oscillation sont parfois condensées, dans une semaine ou dans une journée : « Y'a cette question de l'opération que tout le monde te pose. Toi aussi tu te la pose. Sauf que j'en sais rien moi. Alors je me dis que si je peux être parfois Lina, parfois Andrew c'est bien aussi. méditerranéennes, vol. 97, no. 1, 2018, pp. 159-172. 27 Lire par exemple : Louisa Mackenzie et Vinay Swamy, Devenir non binaire, Le manuscrit, 2021. 28 Comme toutes les discriminations, la transphobie peut-être « directe » ou « indirecte », relever d'un fait avéré ou bien appréhendée (le « sentiment de discrimination »). Dans un cas comme dans l'autre, la potentialité même de la discrimination fait peser sur les parcours et les identités une menace qui traverse les représentations et les pratiques des individus. Concernant la transphobie, lire : Arnaud Alessandrin, « La transphobie en France : insuffisance du droit et expériences de discrimination », Cahiers du Genre, vol. 60, no. 1, 2016, pp. 193-212. Etre un homme ou une femme en fonction de stratégies, d'opportunités ou de parcours de vie (et donc de temporalités) n'est cependant qu'une manière d'être à la non-binarité. D'autres récits, d'autres rapports au genre, proposent d'autres équilibres. Féminin•e•s et masculin•e•s à la fois, ces personnes non-binaires vivent dans une signature singulière au genre sans qu'une identité de genre ne prenne réellement le dessus ou sans qu'une temporalité ne devienne une parenthèse de genre. On pourrait peut-être à cet égard noter que les personnes que nous avons interrogées, tout comme les personnes qui ont répondu au questionnaire d'ailleurs sont dans des filières et des parcours scolaires assez spécifiques : plus de filières littéraires que scientifiques, plus de filières sciences humaines et sociales que juridiques ou médicales. On observe là une tension interprétative. D'une part, certain•e•s théoricien•ne•s (ouvertement opposés aux transitions de genre chez les mineurs) parleront de phénomène de mode ou d'influence sociale 29 . La théorie de « l'identité de genre rapide » 30 défend alors l'idée selon laquelle nous serions face à une « contamination » 31 de transidentités chez les mineurs alors même que ces dernier•e•s seraient trop jeunes pour savoir qui ils et elles sont vraiment. Mais, à l'opposé, d'autres théoriciennes et théoriciens soutiennent que ces différences d'éclosion des termes en fonction des parcours scolaires relèvent de l'opportunité de saisir le vocabulaire et d'exprimer une identité non-binaire : dans ce cas-là l'identité de genre précédé l'orientation scolaire. De plus, le développement psychosexué classique des individus atteste qu'à 7ans l'enfant connaît le « groupe de genre » auquel il se sent appartenir. Cela est vrai pour les jeunes cisgenres (garçons ou filles) : pourquoi n'en serait-il pas de même pour les jeunes personnes trans ou non-binaires. Evidemment, la « non-binarité » n'est pas une fixation définitive de son genre. A l'image de la sexualité, celle-ci peut changer à travers les âges de la personne, sans toutefois qu'apparaissent des changements perpétuels.

Dans cette configuration, le féminin (comme le masculin) sont des boîtes à outil et le genre apparaît comme prothétique. Il serait néanmoins faux de considérer que, contrairement au premier profil décrit, des éléments stratégiques de protection face à la transphobie par exemple, n'apparaissent pas. Au contraire, peut-être encore plus à ces jeunes âges selon de nombreuses enquêtes, la question de la transphobie est centrale et peut même provoquer un changement dans la façon de vivre son identité non-binaire. 29 Céline Masson, Caroline Eliacheff, La fabrique de l'enfant transgenre, L'observatoire, 2022. 30 Littman L, « Rapid-onset gender dysphoria in adolescents and young adults: A study of parental reports ». PLoS ONE 13(8), 2018. 31 On remarquera que ces interrogations avaient déjà été soulevées concernant l'homosexualité et les premières données portant sur les parcours professionnels des minorités sexuelles. Sur la notion de contamination des questions trans, on retrouve encore des traces de ce champ lexical dans des écrits récents : Elisabeth Roudinesco, Soi-même comme un roi : essai sur les dérives identitaires, Seuil, 2021. 32 A cet égard on remarque une porosité entre le discours militant et la théorisation des questions trans. Voir par exemple : Emmanuel Beaubatie, Transfuges de sexe, La découverte, 2021.

Une dernière proposition de non-binarité se dessine du côté d'une posture politique à l'égard des normes de genre : s'en extraire est un genre de subversion qui annonce non seulement un refus des assignations mais, bien souvent, un engagement associatif ou militant (physique ou numérique) concomitant.

« Le genre c'est politique. Y'a plein de gens qui reproduisent les normes hérétosexistes et cisgenres et ça leur pose pas de problème. Mais moi j'ai pas envie de cautionner ça. Etre non-binaire, au gender fluide, comme tu veux, c'est dire non à ce système (tu peux écrire « cis » -« theme » me dit-iel en riant). » Dans un contexte ou l'apprentissage des termes s'effectue aussi par porosité militante, il n'est pas étonnant que les personnes concernées choisissent des termes identificatoires qui s'éloignent le plus possible de ceux qu'ils ou elles jugent pathologisants ou normatifs. Cela avait déjà été le cas avec le terme « transsexuel » qui s'était progressivement vu remplacé par des termes comme « trans » ou « transgenre » 33 . Les récits de la non-binarité sont, dans cette perspective, ceux d'une émancipation vis-à-vis des assignations. Le témoignage de Louis l'illustre : il s'agit de « combattre » ou « s'opposer », de « ne pas être catalogué » dans les normes de genre.

Ce « ni masculin / ni féminin » trouve cependant des limites concrètes dans les espaces et les interactions du quotidien, et la reconnaissance du pronom « iel » 34 n'est pas la libération tant espérée (même si elle ouvre des univers lexicaux inédits). « Y'a toujours des moments ou t'es obligé de te genrer ou alors on te fait bien comprendre que ce n'est pas normal. Et puis si tu ne veux pas te genrer quand même c'est les autres qui le font à ta place. On est dans une société où tu ne peux pas être libre d'être toi-même, sans tout ça, sans le masculin, sans le féminin. C'est dans la langue, c'est dans l'histoire. Et en France on galère à accepter des corps et des genres qui ne sont pas…. Prisonniers de ça ! » (Louis) De façon très durkheimienne, l'extériorité des normes de genre nous renseigne alors plus sur leur force d'imposition que sur la possibilité concrète qu'elles puissent être extérieure aux personnes. Cette proposition politique de la non-binarité butte sur un constat : s'il existe des pas de côté vis-à-vis des normes (de genre, mais d'autres pourraient être ici mobilisées), il n'existe pas d'extérieur à elles. Certes, les normes de genre ne sont jamais totales, mais elles s'imposent suffisamment pour qu'il ne puisse perdurer d'espaces neutres très longtemps. Pour paraphraser François Dubet 35 : si le genre nous socialise partout, il ne nous socialise jamais complétement. C'est ce « jamais complétement », cette possibilité de plier les normes sans les faire plier totalement, qui s'offre ici aux personnes non binaires.

Conclusion

33 Lire par exemple : Arnaud Alessandrin, "Au-delà du troisième sexe : expériences de genre, classifications et débordements", Socio, 9 | 2017, 201-214. 34 Loison, Marie, Gwenaëlle Perrier, et Camille Noûs. « Introduction. Le langage inclusif est politique : une spécificité française ? », Cahiers du Genre, vol. 69, no. 2, 2020, pp. 5-29. 35 François Dubet, L'expérience sociologique, La decouverte, 2007.

La non-binarité devient progressivement un élément des expressions et des expériences de genre qui entre en écho avec les préoccupations des professionnel•le•s, notamment de l'éducation nationale (comme nous avons pu le voir eu égard aux âges des personnes concernées). Néanmoins, on trouve depuis peu des incursions de ce terme dans la littérature scientifique et médicale de façon tout à fait significative. C'est le cas du DSM (Diagnostic and statistical manuel) qui se détache progressivement de la tradition binaire du « transsexualisme » pour élargir l'assiette de reconnaissance en termes de diversité des genres 36 . Cette inclusion nouvelle porte en son sein une promesse de prise en charge sans pathologisation des identités non-binaires.

Si cet élan de reconnaissance semble assez net, même s'il est naissant, d'autres fronts d'oppositions persistent voire se durcissent. C'est entre autres le cas des tensions apparentes entre « féminisme » et « transidentités ». Dans cette opposition sectorielle, représentée par le mouvement TERF (Trans-exclusionary radical feminist) qui sont des « féministes » excluant les femmes trans des luttes féministes sous prétexte que socialisées en tant qu'hommes, elles le resteraient 37 . Le dépassement des catégories de genre par la « non binarité » montre la limite d'une opposition entre « femmes trans » et « féminisme » et souligne la nécessité de repenser le combat pour l'égalité de façon inclusive, souple, en déprise avec les catégories binaires.

36 Lire à cet égard : Arnaud Alessandrin, « Ce que le DSM V fait aux variances de genre », Socio-Logos [en ligne], n.9, 2014. 37 Emmanuel Beaubatie, « Des trans' chez les féministes. Retour critique sur cinquante ans de controverse », Revue du Crieur, vol. 16, no. 2, 2020, pp. 140-147.

  […] Pour l'instant je suis Lina le week-end, quand j'ai envie, pas tout le temps. Pour des sorties plutôt. C'est étrange car ça provoque une sorte d'anonymat. Y'a des gens, je les connais, je les croise, et ils ne me reconnaissent pas. C'est étrange. Ça me plait assez. » (Lina, étudiant•e en alternance, 27ans) 25 Lire par exemple Clovis Maillet, Les genres fluides, de Jeanne d'Arc aux saintes trans, Arkh, 2019. 26 Thamy Ayouch, « Du binaire au multiple : subjectivations de genre dans le Candomblé », Cliniques

  2° LA NON BINARIE COMME AGENCEMENT (L'UN ET L'AUTRE) : LA CATEGORIE FEMME COMME OUTIL DE CONSTRUCTION DE SOI « J'ai besoin des deux. Je sais pas te dire si je suis plus l'un ou l'autre. Je suis les deux. Vraiment. » Phil (32ans, Chorégraphe) « J'ai choisi un microdosage hormonal pour ça : pour ne pas être trop marqué d'un côté du genre sans être non plus trop marqué d'un autre. Mais je ne suis pas agenre non plus. Je reste non binaire » Louis.e (étudiant•e non binaire) C'est très certainement le cas le plus fréquemment rencontré, notamment lorsqu'on interroge les jeunes non binaires adolescent•e.s (lycéen•ne•s et étudiant•e•s) : celui d'une simultanéité du genre masculin et féminin. Cet agencement n'est pas d'un seul tenant : il prend les plis d'éléments du genre existant (maquillage, tenues vestimentaires, pronoms, attitudes corporelles) et s'harmonise différemment selon les corps, des âges, les expériences passées et ou les situations d'expression.Il n'y a donc pas de non-binarité au singulier. Dans ce nouvel équilibre au genre, le féminin comme le masculine sont présents de façon plus ou moins prononcé en fonction des assignations de genre à la naissance. Ainsi, on retrouvera parfois d'éléments traditionnellement attribués au féminin du côté des personnes assignée garçon à la naissance et qui se réclament de la non-binarité.« Mon maquillage c'est pour dire : je suis un garçon et je suis féminin. Alors suisje vraiment un garçon. C'est pareil pour mes bagues ou mes colliers. » (Tim, 18ans, lycéen.ne) « J'ai pas envie qu'on m'identifie comme un homme. J'ai pas non plus envie qu'on m'identifie clairement comme une fille. Alors j'ai créé un personnage un peu garçon et un peu fille. C'est un mélange entre Christine and the queens, indochine et Ranma ½ (rires) »(Simon, 22ans, étudiant•e)

«

  Au début, comme je suis non binaire, je suis parti•e au collège comme je voulais, avec une nouvelle couleur de cheveux et tout. Et puis je me suis vite rendu•e compte qu'il fallait mieux que j'attende le lycée. Je me changeais chez moi, mais en public, à part quelques ami•e•s, personne ne savait » (Louis, 17ans) Les manières d'être non-binaires ne sont donc pas exclusives les unes les autres. Il convient plutôt de les considérer comme des rapports au genre toujours susceptibles d'être remis en cause. 3° LA NON BINARITE COMME EXTERIORITE (NI L'UN NI L'AUTRE) : LA CATEGORIE FEMME COMME ASSIGNATION SUBIE « Etre non binaire c'est politique. C'est comme être un.e transfuge de sexe 32 décidé » Carine, 47ans (Militante trans)

  -414.

	1° LA NON BINARITE COMME OSCILLATION (L'UN OU L'AUTRE) : LES
	CATEGORIES DE GENRE COMME POLARITE POTENTIELLE
	« Je sais que quand on parle de non binarité
	on pense à des personnes qui ne sont ni
	féminines ni masculines. Mais moi, je sais pas,
	mais j'ai été assigné.e 22 garçon à la naissance.
	Alors ces codes du masculin, je les connais. Et
	tous ne me dérangent pas tu vois… »
	Anna, 21ans (étudiant.e non-binaire)
	« Je crois que ça dépend des moments. Parfois
	je me sens plus fille et parfois je me sens plus
	garçon. Je ne sais pas comment t'expliquer.
	C'est comme si j'avais besoin de savoir qu'il y
	a les deux… si besoin »
	Lois, 19ans (étudiant.e non binaire)
	« Je ne suis plus en couple lesbien… je ne sais
	pas comment dire. Ma femme se dit non-
	binaire maintenant. Je suis en couple
	« queer » je peux dire. Mais, selon ses propres
	mots, elle pourrait très bien redevenir « ma
	femme » plus tard »
	Géraldine, 38ans (épouse d'une personne non
	binaire)

Lire par exemple : Willems Geoffrey. « Le genre non binaire et fluide consacré par la Cour constitutionnelle : faut-il flexibiliser ou abolir l'enregistrement civil du sexe ? (obs. sous Cour const. (b.), arrêt no 99/2019, 19 juin 2019) », Revue trimestrielle des droits de l'Homme, vol. 124, no. 4, 2020, pp. 895-920 (pour la dimension

Enquête financée par la DILCRAH (Délégation Interministérielle de Lutte Contre les Discriminations) et publié dans l'ouvrage : Arnaud Alessandrin, Dagorn Johanna, Richard Gabrielle, Meidani Anastasia et Toulze Marielle, Santé LGBT, Bord de l'eau, 2020.

Arnaud Alessandrin et Anastasia Meidani, « Santé non-binaire : de quoi parle-t-on ? », Santé Publique, 2022 [à paraître]

Lire par exemple : Annie Pullen Sanfaçon et Denise Medico, Jeunes trans et non binaires, Remue Ménage ed., 2020.

Enquête financée par la Fondation Jean Jaures, l'ARESVI et le soutien de l'IRTS Nouvelle Aquitaine et le CEF de Bergerac, en partenariat avec Flora Bolter et Denis Quinqueton.

Pour lire les résultats de cette recherche : Arnaud Alessandrin, Bolter Flora, Quinqueton Denis, Mariage pour tous : violences d'une conquête » Bord de l'eau, 2023.


F Paquin-Lefebvre

S Toste

D Holcman

How large the number of redundant copies should be to make a rare event probable

The redundancy principle provides a framework to study how rare events are made possible with probability 1 in accelerated time, by making many copies of similar random searchers. However, what is a large n? To estimate large n with respect to the geometrical properties of a domain and the dynamics, we present here a criterion based on splitting probabilities between a small fraction of the exploration space associated with an activation process and other absorbing regions where trajectories can be terminated. We obtain explicit computations especially when there is a killing region located inside the domain that we compare with stochastic simulations. We also present examples of extreme trajectories with killing in dimension 2. For a large n, the optimal trajectories avoid penetrating inside the killing region. Finally we discuss some applications to cell biology.

Introduction. The redundancy principle in biology expresses the need of having many redundant copies of the same particles (molecules, proteins, ions, etc.) moving randomly to trigger a rare event such as a physiological function. The key step consists in a small target being found by the fastest particles, falling into extreme statistics [1,2]. The target can be a single receptor, channel, or activator molecule or a complex ensemble of receptors, channels, or activator molecules [3,4]. The large copy number is used to transform such a rare event, which would take a very long time compared with the other time scales involved in the system, into a fast event triggered by the fastest particles arriving at a hidden target. This principle is at the basis of many cellular processes such as signal transduction [START_REF] Fain | Sensory transduction[END_REF] or specific promoter gene selection in the nucleus [START_REF] Alberts | Essential cell biology[END_REF]. In general, the arrival time of the fastest particle is studied by extreme statistic approaches [START_REF] Bray | [END_REF][START_REF] Schehr | First-passage phenomena and their applications[END_REF][START_REF] Majumdar | [END_REF][10]. The redundancy theory [3,[START_REF] Holcman | Stochastic Narrow Escape in Molecular and Cellular Biology: Analysis and Applications[END_REF][START_REF] Coombs | [END_REF][13] applies not only to the molecular level but also to cells such as spermatozoa [14] (Fig. 1). Yet, theoretical computations for the time of these rare events for diffusion or anomalous diffusion [15,16] often rely on asymptotic approaches based on Laplace's method, when the number of players n is large. However, this method does not provide an order of magnitude for the number n. Laplace's method and related approaches provide a formal expansion and do not allow a comparison of n with physical quantities, as it assumes that we begin with an n that is large. The goal of this paper is to propose a computational framework to compare large n with the scales originating from the stochastic dynamics and the small subspace configuration defining rare events. We first present the framework to quantify large values of n using the probability of finding a small target. Second, to illustrate this framework, we estimate the order of magnitude for the number of copies in two cases: (1) when the search by the fastest Brownian particle has multiple choices to escape and (2) when there is a degradation source that interferes with the exploration of the space. When the killing process occurs in a subregion of the domain, we obtain an explicit expression for the escape (or splitting) probability and an estimate of n. Interestingly, the fastest trajectories concentrate along the shortest path or solution of a variational problem, as obtained by the large deviation principle [START_REF] Freidlin | Markov processes and differential equations: asymptotic problems[END_REF][START_REF] Freidlin | Random perturbations of dynamical systems[END_REF]: For large n, the optimal trajectory avoids the killing region while staying sufficiently close. Finally, we discuss several applications in cellular biology. Compensating a rare event by increasing the copy number n. To make a rare event probable when it is triggered by the arrival at a small target, one possibility is to increase the copy number n of the independent identical Brownian particles. We consider here the continuous case, but the dynamics could occur on a discrete ensemble, a graph, or any other topological structures, and the target is a small fraction of the phase space. There are at least two fates for Brownian particles: Either they find the small target after a long time, or they get lost through a different absorbing window or are simply degraded by a killing field. Hence we propose a criterion to estimate the copy number n based on the splitting probability P s , here defined as the conditional probability of finding the desired target before degradation or hitting a different absorbing window happens. Now the probability that at least one out of n Brownian particles successfully escapes is 1 -(1 -P s ) n , and for this event to occur with probability 1 we need that

1 -(1 -P s ) n ≈ 1.
(1)

Thus if the probability P s is small, then the number n needs to be large enough to compensate, yielding the following elementary criterion:

n ≈ 1 P s . (2)
In general the splitting probability P s is small and almost constant far away from the narrow target window [4,[START_REF] Schuss | [END_REF]20]. In the rest of this paper, we present specific estimates for n in comparison with geometrical and dynamical characteristics.

Defining the stochastic model. The stochastic dynamics follows

ẋ = b(x) + √ 2B(x) ẇ for x ∈ Ω, (3)
where b(x) is a smooth drift vector, B(x) is a diffusion tensor, and w is a vector of independent standard Brownian motions. A killing field k(x) is added in the domain Ω with boundary ∂Ω = ∂Ω a ∪ ∂Ω r , where ∂Ω r is reflecting and ∂Ω a = ∪ Nw k=1 ∂Ω a k is an absorbing region composed of N w well-spaced narrow windows. The transition probability density function (pdf) of the process x(t) with killing is the pdf of the trajectories that have neither been killed nor been absorbed in ∂Ω a by time t, satisfying

p(x, t | y) dx = Pr{x(t) ∈ x + dx, τ k > t, τ e > t | y}, (4)
where τ k (τ e ) is the time for one particle to be killed (absorbed). The pdf is the solution of the Fokker-Planck equation (FPE) [START_REF] Schuss | Diffusion and Stochastic Processes. An Analytical Approach[END_REF]

∂p(x, t | y) ∂t = L x p(x, t | y)-k(x)p(x, t | y) for x, y ∈ Ω, (5) where
L x p(x, t | y) = d i,j=1 ∂ 2 σ i,j (x)p(x, t | y) ∂x i ∂x j - d i=1 ∂b i (x)p(x, t | y) ∂x i , (6)
and σ(x) = 1 2 B(x)B T (x). The flux density vector is given by L x p(x, t | y) = -∇ • J (x, t | y), where the components of the flux density vector are i = 1, 2, . . . , d

J i (x, t | y) = - d j=1 ∂σ i,j (x)p(x, t | y) ∂x i + b i (x)p(x, t | y). (7)
The initial and boundary conditions are (10) where n(x) is the outward unit vector normal to ∂Ω. Large n when there are several absorbing patches. We first consider the case of N w absorbing patches with neither drift nor killing processes interfering with the dynamics inside the domain Ω. Here the large number n can be estimated by the reciprocal of the splitting probability of reaching the first small target ∂Ω a1 , which triggers a key event, before any other exit sites ∂Ω a k with k > 1, where no action is taken. Setting b(x) = 0 and k(x) = 0, we find that the splitting probability P (x) when starting in x ∈ Ω is the solution of the boundary value problem [START_REF] Karlin | A Second Course in Stochastic Processes[END_REF] ∆P (x) = 0, x ∈ Ω, [START_REF] Holcman | Stochastic Narrow Escape in Molecular and Cellular Biology: Analysis and Applications[END_REF] where ∆ is the Laplacian operator, and with P (x) = 1 on ∂Ω a1 and P (x) = 0 on Ω a k for k > 1 and no-flux boundary condition imposed on the reflecting part ∂Ω r .

p(x, 0 | y) = δ(x -y) for x, y ∈ Ω (8) p(x, t | y) = 0 for t > 0, x ∈ ∂Ω a , y ∈ Ω (9) J (x, t | y) • n(x) = 0 for t > 0, x ∈ ∂Ω r , y ∈ Ω,
The solution depends on the local geometry near the windows [START_REF] Holcman | Stochastic Narrow Escape in Molecular and Cellular Biology: Analysis and Applications[END_REF]. In dimension 2 for well-spaced absorbing windows of size ε k with a smooth boundary, the splitting probability to the first window is approximated to leading order by P s = 1/ log(ε1) k 1/ log(ε k ) . Absorbing windows could be found at the end of a funnel or cusp-shaped narrow passages affecting both the search time and the splitting probability. If each window is located at the end of a cusp of curvature l k , then

P s = √ ε1/l1 k √ ε k /l k
. Similar asymptotic formulas in dimension 3 are P s = 1/ε1 k 1/ε k for narrow windows located on a flat boundary and

P s = √ ε 3 1 /l1 k √ ε 3 k /l k
when they are located at the end of a cusp. To conclude, the large number of stochastic particles n depends on the size of the critical window to be reached versus the other exits. For equal-size windows we get n ∼ O(N w ), and the copy number is of the order of the number of windows.

Large n when searching for a narrow target with a killing field. We now estimate the large number n when there is a killing field that can destroy particles at an exponential rate before they arrive at the target, thus leaving few particles alive. To calculate the splitting probability P s of reaching the absorbing boundary ∂Ω a before being killed, we integrate the Fokker-Planck equation ( 5) with respect to time, and upon introducing p(x|y) = ∞ 0 p(x, t|y)dt we get the boundary value problem

L x p(x | y) -k(x)p(x | y) = -δ(x -y) for x, y ∈ Ω p(x | y) = 0 for x ∈ ∂Ω a , y ∈ Ω J (x | y) • n(x) = 0 for x ∈ ∂Ω r , y ∈ Ω, (12)
which, after setting y = 0 and defining p(x) ≡ p(x|0), reduces to

D∆p(x) -k(x)p(x) = -δ(x) for x ∈ Ω (13) p(x) = 0 for x ∈ ∂Ω a ∂ p(x) ∂n = 0 for x ∈ ∂Ω r ,
where D is the diffusion coefficient. The splitting probability P s is then given by We then take Ω to be a disk of radius R, with on the boundary a single narrow absorbing target ∂Ω a of radius a that is centered in x a . Brownian particles can only be destroyed within a sub-region Ω ϵ consisting of a small disk of radius ϵ centered in x ϵ , located on the radial segment connecting the origin to the absorbing window (Fig. 2A). Thus inside Ω ϵ the killing field is equal to a large constant, while outside it vanishes, and using the indicator function we write k(x) ≡ kI Ωϵ (x). In the limit of small radius ϵ, we can approximate the solution of ( 13) within the killing region by a constant, yielding, for the splitting probability, the following relation:

P s = Ω Pr{τ e < τ k | δ(y)} dy = 1- Ω k (
P s ≈ 1 -πϵ 2 p(x ϵ ) . (15)
We evaluate below p(x ϵ ), using the 2-D Neumann-Green's function G(x; y), the solution of

D∆G(x; y) = 1 |Ω| -δ(x -y) , x, y ∈ Ω, (16)
with the boundary conditions: ∂G(x, y)/∂n = 0 , x ∈ ∂Ω , y ∈ Ω and Ω G(x; y)dx = 0. For a disk domain of radius R, the solution is [START_REF] Cheviakov | [END_REF][24][25] G(x; y) = -

1 2πD log 1 R ∥x -y∥ + V (x; y) , (17)
where V (x, y) is the regular part when ∥y∥ < R, given by

V (x; y) = - 1 2πD log 1 R 2 x∥y∥ - y ∥y∥ - 1 2R 2 ∥x∥ 2 + ∥y∥ 2 + 3 4π . (18)
By applying Green's identity to the solutions of ( 13) and ( 16) we obtain that

p(y) = 1 |Ω| Ω p(x)dx + ∂Ωa G(x, y)D ∂ p ∂n dx + G(0, y) -k Ωϵ G(x, y)p(x)dx , (19)
and upon using the identity p(x a ) = 0 as well as the radii ϵ and a as small parameters, we can calculate the asymptotic formula

p(x ϵ ) = 1 kπϵ 2 log R a + 9 8 + πD (G(0, x ϵ ) -G(0, x a ) -G(x a , x ϵ )) D kϵ 2 + 1 2 log R ϵ + log R a + 11 8 + πD (V (x ϵ ; x ϵ ) -2G(x ϵ , x a )) . ( 20
)
Then, substituting ( 20) within ( 15) yields the expression below for the splitting probability:

P s = D kϵ 2 + 1 2 log R ϵ + 1 4 + πD (V (x ϵ ; x ϵ ) -G (x a ; x ϵ ) + G (0; x a ) -G (0; x ϵ )) D kϵ 2 + 1 2 log R ϵ + log R a + 11 8 + πD (V (x ϵ ; x ϵ ) -2G (x a ; x ϵ )) . ( 21
)
This formula reveals the role of each parameter and in particular, for large 1 kϵ 2 , we get

P s ≈ D kϵ 2 + 1 2 log R ϵ D kϵ 2 + 1 2 log R ϵ + log R a . ( 22
)
To study the range of validity of the asymptotic solution ( 21) we compare with stochastic simulations for 1000 runs, with discrete time step ∆t = 0.001. Brownian particles are released at the origin of a disk of radius R = 2, and a parameter sweep of the killing rate k is performed over the range [1 10 25 50 75 90].

The other geometrical parameters are as indicated in the caption of Fig. 2. We also compute the splitting probabilities directly by solving the system ( 13) with the finite-element solver COMSOL [START_REF]COMSOL Multiphysics (Version 5.2a)[END_REF]. This is done by approximating the killing field by a smooth function k(x) ≡ k 2 1 + tanh ϵ-∥x-xϵ∥ Γ with Γ = 0.0001 controlling the slope and approximating the Dirac delta function δ(x) by a 2-D Gaussian

1 2πσ 2 exp -x T x 2σ 2
with small variance σ = 0.01. Good agreements between the numerical and asymptotic solutions are obtained both when the killing region is well separated from the boundary and when it is tangent to the boundary (Fig. 2B). To conclude, the number of redundant copies should be of the order of

n ≈ D kϵ 2 + 1 2 log R ϵ + log R a D kϵ 2 + 1 2 log R ϵ , (23)
which not only decreases with the radius a of the absorbing window but also depends on the killing parameters. Note that this formula is valid for k fixed with ϵ tending to zero. Optimal exit paths for the fastest particle with a killing field. In the absence of a killing field, according to the large deviation principle [START_REF] Freidlin | Markov processes and differential equations: asymptotic problems[END_REF], the fastest particles use a path toward the absorbing window well concentrated near the shortest geodesic as the number of particles increases. With a killing region, we expect a deviation such that the shortest geodesic should avoid this area when the killing rate is large. To estimate this optimal path of the fastest particle, we use arguments from the large deviation principle. We recall that the fluctuations of the diffusion process with small-amplitude noise D around the deterministic function F are given by the action functional in the time interval [0, T ], [START_REF] Schehr | First-passage phenomena and their applications[END_REF][START_REF] Majumdar | [END_REF][START_REF] Weber | [END_REF],

Pr max

t∈[0,T ] |x(t) -F (t)| > D ≍ exp - S F (T ) D , (24)
where x(t) is a Brownian motion with diffusion coefficient D and zero mean and

S F (T ) = 1 4 T 0 | Ḟ (s)| 2 ds. (25)
To account for the killing field k(x), we use the Feynman-Kac representation for the solution of the FPE

p(x, T ) = E f (x(T )) exp - T 0 k(x(s))ds x(0) = x , (26)
where f is the initial distribution, here corresponding to the Dirac delta centered at the origin. The survival probability is given by

∞ 0 Ω p(x, t)dx n dt ≈ ∞ 0 {x(s) paths from 0 to ∂Ωa} exp -n 4D t 0 | ẋ(s)| 2 ds -n t 0 k(x(s))ds dD(x(s)) dt. (27)
The contribution of the integral for large n occurs at the minimum of the functional:

min {x(0)=x, X(T )∈∂Ωa } 1 4D t 0 | ẋ(s)| 2 ds + t 0 k(x(s))ds . (28)
Applying Euler's Lagrange principle, we obtain that the minimum occurs along the optimal trajectory, the solution of the differential equation:

-ẍ + 2D∇k(x(s)) = 0, (29)
with x(0) = x and x(T ) ∈ ∂Ω a . As shown by the Brownian simulations, the trajectories of the fastest particles starting from the origin are concentrated along the path of the solution of Eq. ( 29). The optimal paths avoid the killing region as the killing rate increases (Fig. 3A). Interestingly, as the killing region become tangent to the absorbing window, the density of the fastest particles spreads around the origin and also inside the entire domain (yellow) (Fig. 3B). To conclude, the large deviation principle allows us to derive an optimal problem from which we show that the fastest trajectories avoid the killing region. Discussion and concluding remarks. Multiplying the number of copies of random molecules, ions, proteins, or cells is a key process to make a rare event frequent. It is at the basis of the redundancy principle [3]. Although the principle acknowledges that a large number is needed, it does not specify the order of magnitude. In this paper, we presented a computational framework to estimate the number of copies to guarantee that the rare event will at least occur with one arrival particle. The rare event is described by the splitting probability to find the activation before escaping through a much more probable place, or before being degraded. Explicit and asymptotic computations of the probability allow us to determine the role of the geometry and the dynamics in the estimation of the large number of copies n. In the process of neuronal transmission at synapses, the splitting probability between small receptors located on the post synaptic region and the lateral opening of the synaptic cleft is of the order of P act ≈ 10 -3 . Interestingly, the number of neurotransmitters is of the order of a few thousand (2000-3000) [START_REF] Kandel | Principles of neural science[END_REF]. Modulating this number is key for controlling neurotransmission, and a reduction by 20% [START_REF] Juge | [END_REF] resulting from a ketogenic diet can stop some epileptic crises. However, the most classical example is certainly the fertility process, where hundreds of millions of spermatozoa are required to guarantee that fertilization is possible: The large number compensates for the long distance, which cannot be recovered by other mechanisms such as chemotaxis, rheotaxis, or thermotaxis [30].

Here the large redundancy is particularly required, as a decline by 1020% is associated with infertility. Finally, it would be interesting to generalize the present large n estimation approach to different random motions (fractional Brownian motion, Levy flight), or any other anomalous diffusion processes.

FIG. 1 .

 1 FIG. 1. Fastest escape trajectory under splitting or killing. (A) The fastest trajectory can escape trough exit 1 (relevant choice) or through exit 2 (bad choice). (B) The fastest calcium ions can arrive at the base of a dendritic spine's type domain or be absorbed on their way. (C) The fastest spermatozoa can arrive directly at the egg or be degraded.

FIG. 2 . 1 FIG. 3 .

 213 FIG. 2. Splitting probability vs killing. (A) Scheme of the domain: a disk Ω of radius R containing a killing region Ωϵ (red) of size ϵ. Particles starting at the center either can escape through a window ∂Ωa (blue) of narrow radius a and centered in xa or can be terminated (red) inside the domain Ωϵ. (B) Splitting probability vs the killing rate k when the killing region is located inside (left) and tangent to (right) to the absorbing window for stochastic simulations (red line), the asymptotic solution (21) (dashed blue line) and the numerical solution of the partial differential equation (13) (dashed black line). The parameters are R = 2, D = 1, ϵ = 0.25, a = 5πR/180, xa = (R, 0) T , and xϵ = (1, 0) T (left) or xϵ = (1.75, 0) T (right).