Vincent Giraud Ingenico
email: vincent.giraud@ens.fr

Guillaume Bouffard
email: guillaume.bouffard@ens.fr

Faulting original McEliece's implementations is possible How to mitigate this risk?

Keywords: White-box attack model, Post-quantum cryptography, Binary Instrumentation, McEliece

Private and public actors increasingly encounter use cases where they need to implement sensitive operations on mass-market peripherals for which they have little or no control. They are sometimes inclined to attempt this without using hardware-assisted equipment, such as secure elements. In this case, the white-box attack model is particularly relevant and includes access to every asset, retro-engineering, and binary instrumentation by attackers. At the same time, quantum attacks are becoming more and more of a threat and challenge traditional asymmetrical ciphers, which are treasured by private and public actors.

. We disclose the first fault injection based attack and we discuss on how to modify the original McEliece cryptosystem to make it resilient to fault injection attacks.

Introduction

For many sectors, the implementation of sensitive operations, such as authentication, payment, or protection of intellectual property, increasingly targets personal embedded devices such as smartphones. These kinds of peripherals are often called Customer Off-The-Shelf (COTS) devices, since they aim for the general public, and are designed with mass-market constraints such as a strong sale price limitation. Hence, despite the potentially high number of executable sources present on the platform, they often do not have hardware security mechanisms such as secure elements or secure enclaves. Even when these features are embedded in the system, they may not be accessible to third-party industrial actors, for commercial reasons. Such stakeholders might thus try to develop alternative ways to address the lack of trust in these environment, which is also relevant with the rapid growth of Bring Your Own Device (BYOD) policies allowing employees to use their own personal devices, such as smartphones, laptops, and tablets, for work-related activities.

Providing sensitive operations mainly implies exploitation of cryptographic assets. They can be used to encrypt, decrypt, or sign a content. A company choosing not to rely on hardware security mechanisms must endorse full responsibility for the protection of these mechanisms. This situation led to the definition of the white-box attack model, which refers to attackers having all powers on the execution environment. In essence, it refers to the case of trying to protect assets on a platform where a hostile actor is root, with the ability to read, write, or instrument everything [START_REF] Bos | Differential Computation Analysis: Hiding Your White-Box Designs is Not Enough[END_REF]. In particular, we refer to the implementation of cryptographic algorithms in this context as the White-Box Cryptography (WBC) security model [START_REF] Chow | A White-Box DES Implementation for DRM Applications[END_REF]. Companies operating these algorithms face a significant challenge: preventing attackers from recovering secrets in this type of scenario. In the case of the AES, contests [START_REF] Estuardo | Security Assessment of White-Box Design Submissions of the CHES 2017 CTF Challenge[END_REF] have shown that implementations that are not broken in less than two weeks in the WBC attack model are very rare. To increase this time period, protections will be embedded against reverse engineering and binary instrumentation; however, these measures tend to significantly increase the resulting binary size, decrease performance, and thus, impact usability. In concrete use cases, developers will put in place a complete replacement of the sensitive code on a regular basis [START_REF] Thomas | DroidGuard: A Deep Dive into SafetyNet[END_REF]; however, these updates are not easy to maintain owing to mobile network limitations, mainly availability, cost and bandwidth. Another problem affecting implementation of cryptography in the white-box model is code porting, meaning efforts to copy them on another device to circumvent protections.

In parallel in recent years, the risks associated to cryptographic attacks by quantum computers received an increasing attention with the release of the first quantum hardware. This mode of functioning disrupts the conventional premises of computations and the axioms of cryptography. In this context, called post-quantum cryptography, traditional asymmetrical ciphers are affected, especially RSA, while the impact on symmetrical ciphers is rather limited. In response, the National Institute of Standards and Technology (NIST) initiated a process to determine public key algorithms suitable for this model [START_REF]Post-Quantum Cryptography Standardization[END_REF]. Both French [START_REF]ANSSI views on the Post-Quantum Cryptography transition[END_REF] and German [START_REF]Migration zu Post-Quanten-Kryptografie[END_REF] information security agencies have introduced the need to transition from the current cryptosystems to post-quantum-compatible ones.

In light of these elements, systems and services developed today should consider this threat.

At this point, industrials wishing to implement asymmetrical cryptographic algorithms in an uncontrolled environment or in COTS face many challenges: resisting as long as possible against attackers able to fully instrument their implementation, resisting against quantum attacks, producing sufficiently lightweight binaries, and updating them regularly through mobile networks.

In this study, we explored the security of the McEliece cryptosystem which is an interesting candidate that is quantum-safe and seems be more suitable on uncontrolled environments. In our study, we focused on the possibility of using McEliece and the security problems of using this cryptosystem in the white-box context. For the rest of this article, McEliece cryptosystem refers to the original McEliece.

The McEliece Cryptosystem

Introduced in 1978 [START_REF] Mceliece | A Public-Key Cryptosystem Based On Algebraic Coding Theory[END_REF], the McEliece cryptosystem is an asymmetric cipher that employs a (n,k)-linear errorcorrecting code C (correcting up to t errors) with a fast decoding algorithm and linear operations, as illustrated in Figure 1, where M a,b (F 2 ) denotes a matrix of size a, b, containing elements in the finite field of order 2. In this era, its large key sizes have made it less favored than RSA; however, this criterion is now less significant because of hardware developments, and we can now observe implementations tailored for micro-controllers [START_REF] Eisenbarth | MicroEliece: McEliece for Embedded Devices[END_REF]. To encrypt a clear-text block m, it must be considered as a vector of k bits, and multiply it with a (public) matrix G ′ = S × G × P of size k, n, which is the multiplication between three distinct ones: a random k × k invertible matrix S used to scramble the data; G, a generator matrix for C; and a random n × n permutation matrix P (i.e. having a single nonzero entry in each row and column). Errors are then added voluntarily with a random vector e of Hamming weight below t to compute the encrypted block c = mG ′ + e. To decrypt a cipher-text block c, one must be in possession of the three secret matrices S, G and P separately, to first cancel the permutation, i.e. compute a = cP -1 , (quickly) decode b from a with the error-correcting code C, and then unscramble the data i.e., compute m = bS -1 . An attacker intercepting the message c would have to find the nearest codeword of the code generated by G ′ seen as a general linear code, which is known to be NP-hard [START_REF] Berlekamp | On the inherent intractability of certain coding problems (Corresp.)[END_REF]. An alternative offensive approach consists in attempting to recover the structure of the underlying code C. The original proposal relies on binary Goppa codes, which so far remain one of the few families of codes which have largely resisted attempts at devising such structural attacks.

×M k,n (F 2 ) +M 1,n (F 2 ) ×M n,n (F 2 ) Decoding ×M k,k (F 2 )
In all cases, since the McEliece cryptosystem mainly consists of linear applications that can be modeled as matrix multiplications, it has significant performance potential. These operations can be accelerated by dedicated hardware, such a Graphics Processing Units (GPUs), or by suitable instruction set extensions, particularly Single Instruction on Multiple Data (SIMD) ones. These features are widely popular in different research topics and can be applied directly in this context. However, many devices targeted by McEliece implementations do not provide them, especially inexpensive micro-controllers.

The asymmetry of this algorithm is valued in the industry: having distinct public and private keys provides more flexibility when designing use cases, and is useful when conceiving secure communications or content delivery services, for example. This attribute has been presented by many other ciphers based on factorization or lattices. However, these paradigms create many difficulties when considering white-box implementations. To the best of our knowledge, this mode of execution usually relies heavily on precomputed intermediate variables; however, these are too large for the aforementioned algorithms. For example, factorization implies operation on very large numbers. For both computation time and storage size reasons, precomputing them is completely out of reach, making translation to the white-box model complex. The McEliece cryptosystem, which embeds linear operations, provides opportunities to address this issue.

State-of-the-art McEliece Cryptosystem Security

When exploring ciphers deemed reliable in a postquantum context, the McEliece cryptosystem is a frequent candidate. In the fourth round of the aforementioned NIST contest, which began at the end of 2016 [START_REF]Post-Quantum Cryptography Standardization[END_REF], one candidate that still remained, Classic McEliece, was inspired by the McEliece specification. In the meantime, PQCRYPTO, a research group specialized in cryptography in the postquantum context, recommended the use of the original McEliece cryptosystem, with only bigger keys than usual to consider the threat of quantum-based attacks [20, section 4]. Additionally, the Bundesamt für Sicherheit in der Informationstechnik (BSI) also mentions it in its recommendations concerning quantum-safe cryptography [14, page 29].

In addition to its estimated robustness in a postquantum context, this cryptosystem provides good resistance against attacks by leveraging fault injection. Indeed, when exploiting the private key during the decryption process, a major operation is decoding the intermediary data using a linear code, as illustrated in Figure 1. If one naively applies corruption during the computation, the errors might be inherently corrected, thus voiding the intrusion. On the one hand, this strength of the McEliece cryptosystem is reflected in the scientific literature [START_REF] Cayrel | McEliece/Niederreiter PKC: Sensitivity to Fault Injection[END_REF] where authors focused on the theoretical resistance of the algorithm against fault injection attack. They did not succeeded in obtaining the private key. To the best of your knowledge, this work is the only one where the original McEliece cryptosystem algorithm is studied against hardware fault attacks.

On the other hand, NIST candidate Classic McEliece, has been the subject of such attacks [START_REF] Cayrel | Habilitation à Diriger des Recherches[END_REF] [19] [START_REF] Xagawa | Fault-Injection Attacks against NIST's Post-Quantum Cryptography Round 3 KEM Candidates[END_REF]. The Goppa codes of a Niederreiter cryptosystem, which are derived from McEliece, have been the subject of a fault injection based attack explained in [START_REF] Danner | A fault attack on the Niederreiter cryptosystem using binary irreducible Goppa codes[END_REF]. These elements make it opportune to follow the PQCRYPTO recommendations and focus on the original McEliece cryptosystem.

The threat of hardware attacks on the White-Box Cryptography model

The white-box security model assumes that attackers possess complete control over an implementation, requiring various features to impede secret extraction and make it as challenging and costly as possible. Binary obfuscation [START_REF] Schlögel | Loki: Hardening Code Obfuscation Against Automated Attacks[END_REF] is a feature that significantly complicates reverse engineering. In the white-box model, robustness is essential to enable implementations to maintain their reliability over an extended period, resulting in fewer replacements and lower usage of mobile networks.

Hardware attacks form the basis of many effective offensives against white-boxes implementations [START_REF] Bos | Differential Computation Analysis: Hiding Your White-Box Designs is Not Enough[END_REF]. When these attacks are translated into the software world, they can often bypass the complexity and obfuscation mentioned earlier, thereby jeopardizing the overall feasibility of white-box implementations. As a result, what may have taken days or weeks to break can be achieved in less than one day. Differential Fault Analysis (DFA) on Advanced Encryption Standard (AES) serves as an example and is applicable to both hardware [START_REF] Dusart | Differential Fault Analysis on A[END_REF] and software [START_REF] Sanfelix | Practical attacks against Obfuscated Ciphers[END_REF]. From perspective of an attacker, while the former provides an offensive against an uncontrolled platform, the latter offers a significant operational shortcut despite the controlled platform.

Research about execution perturbation is essential to reinforce today's implementation prototypes. As part of this effort, offensive investigations have been conducted on the McEliece cryptosystem because preventing fault attacks is crucial. To simulate fault injection attacks easily, binary instrumentation tools such as Rainbow 1 and QBDI 2 can be employed. These tools enable the efficient scrutiny of specific behaviors and precise modifications at specific times. Moreover, these features can be leveraged to satisfy user-specified real-time conditions.

Contribution

Our main contributions are divided into three parts:

1) we present a new fault injection based attack against a typical, common implementation [START_REF] Petrvalsky | Countermeasure against the SPA attack on an embedded McEliece cryptosystem[END_REF] of the McEliece cryptosystem on ARM targets; 2) we discuss the applicability of this attack; 3) we propose a variant of the McEliece cryptosystem expected to be intrinsically resistant to our attack and thus more suitable for use in uncontrolled environments as expected in The remainder of this article is organized as follows. In Section 2, we present an attack based on fault injection that targets ARM reference implementation [START_REF] Petrvalsky | Countermeasure against the SPA attack on an embedded McEliece cryptosystem[END_REF] of the McEliece cryptosystem. Section 3 discusses how our findings impact McEliece implementations in the WBC security model. In Section 4, we introduce a variant of McEliece cryptosystem to be immuned to our attack. Finally, Section 5 offers concluding remarks and describes our future works.

Faulting McEliece implementation

We conducted an investigation into the vulnerability of the McEliece cryptosystem for fault injection. As mentioned previously, this cipher is known for its robustness against such efforts, and this aspect has already been studied. However, because successful attempts are aimed at the NIST candidate named Classic McEliece, or towards the Niederreiter cryptosystem, we decided, to push further the research into the original McEliece cryptosystem, to target implementations. This initiative was linked to the study of the possibility to implement it in uncontrolled environment. As explained in subsection 1.3, many successful attacks on these implementations result from identical attacks intended for application on hardware. Identifying a vulnerability through a fault injection attack will require protecting software implementation against exploitation of this attack.

Obstacles against efficient fault injections attacks

In [START_REF] Petrvalsky | Countermeasure against the SPA attack on an embedded McEliece cryptosystem[END_REF], Petrvalsky et al. demonstrated that a side channel attack can be conducted during the decryption process when matrix multiplications are implemented using the conventional method. In the power traces, one can identify the pattern corresponding to modulo 2 addition. When a vector with a Hamming weight of 1 is inputted, it is possible to infer the position of the only set bit of the corresponding line in the permutation matrix owing to the temporal position of this pattern. Once the permutation matrix is recovered, the rest of the private key can be mathematically computed.

We studied how matrix multiplication in the McEliece cryptosystem reacts to fault injections. The main difficulty for an attacker is that the recovery of information on intermediate data seems impossible, as there are only two possibilities that can be observed at the global output of the decryption process: either (1) the decoding operation corrects the errors, making it appear as if the fault never happened, or (2) we have modified the data too much, resulting in an invalid or corrupted output. To overcome this difficulty, we developed an offensive process that allows the acquisition of information based on the final output of the algorithm, either a correct or an error message.

The first step of the decryption process involves applying a permutation matrix that has only one bit set in each row or column. The attacker's goal is to determine the matrix. A fundamental property of these linear applications is that they do not alter the Hamming weight, which means that the output will have the same number of set bits as the input. Furthermore, we know the size of this matrix, which is the ciphered block, denoted by n. Another important parameter of a specific implementation of the McEliece cryptosystem is t, the maximum number of bit errors the code can correct.

If we were able to scrutinize the output of this matrix, its recovery would be easy. It would be sufficient to use an input vectors with only one-bit set and to observe where they end up in the output. However, this is not possible because the internals of the algorithm are either impossible to reach or intentionally complex. Therefore, we investigated methods to infer information about this part based on the state of the global output. However, this possibility seems mathematically out of question, because the McEliece cryptosystem specifies the use of a scrambling matrix to provide diffusion in the data, along with a decoding operation, which is a surjective function.

Attack methodology

Figure 2 illustrates the multiplication of a vector by a permutation matrix, which should be considered. The conventional method of implementation is to loop over each bit element of the vector and perform, if the current bit is set, a XOR operation between the corresponding line of the matrix, and an accumulator. It is important to use the XOR operation specifically rather than addition, because we are working in the F 2 finite field. As previously mentioned, the Hamming weight of the accumulator vector at the end of this process should be the same as that of the input. This way of implementing matrix multiplications is common and is described in [START_REF] Petrvalsky | Countermeasure against the SPA attack on an embedded McEliece cryptosystem[END_REF]. We are targeting this implementation with the scope of fault injection attacks. 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0

                          0 0 0 1 0 0 0 0 0 1 0 0 × Figure 2:
Illustration of multiplication between a vector and a permutation matrix, here with n = 12.

As a side note, since the McEliece cryptosystem involves keys with significant sizes, optimizing memory management is paramount. For example, using the standard bool type, or a whole variable to store each of the bits would be wasteful: on a 32-bit processor, it would imply to ignore 31 out of the 32 bits of variables.

Instead, a preferred approach is to fill the whole variables with useful bits only, even if it means using bitwise operations, and bit masking. This method is more efficient, and becomes mandatory on a target platform with memory limitations. This is often the case on 8-bit systems, which have been targeted by some implementations [START_REF] Eisenbarth | MicroEliece: McEliece for Embedded Devices[END_REF]. While these constraints are not as hard on more powerful or usual platforms, such as computers based on a x86 processor, wasting 31 bits out of 32 is still quite inefficient. In this article, the size of the variables in bits will be denoted as p.

In this attack, we target the XOR operation between the accumulator and specific lines of the matrix. In the ARM instruction set [START_REF] Limited | ARMv8-A Architecture Reference Manual[END_REF], instruction representation contains a 4-bit long operation codes located between the 21st and 24 th bits, as shown in Figure 3. The operation code for XOR operation, called EOR, has a value 0001. By making a single bit change, we can switch it to an RSB instruction with the value 0011, which performs subtraction between the operands. The use of the XOR operation is responsible for preserving the Hamming weight property, as there is only one bit set in each row of the matrix. For each one in the input vector, one and only one bit is set in the result. Replacing it with subtraction eliminates this property. The XOR operation is performed between the accumulator and specific lines of the matrix. A naive implementation is shown in Listing 1, with p = 32, and n = 1024. For each bit in the input vector, we check if it is set, and if so, we XOR the corresponding line of the matrix with the accumulator variable by variable. Listing 1: Naive vector-matrix multiplication in C-code. By changing only one bit, we can shift from EOR instruction (0xe0212003) to RSB instruction (0xe0612003), whose provides a subtraction between the operands. Thus, our goal is to cause corruption at the end of the global output, depending on attributes of the multiplication result. The considered fault model implies a one-bit change in the program's instructions, either before they are loaded in volatile memory (in RAM), or in the processor caches, because we have both temporal and spatial proximity: the selected instruction is likely to be in a for loop executed many times, with few other manipulations inside.

An important property of linear correcting codes is that a bit vector filled with zeros is inevitably a valid code. Because the coding operation can be performed using only matrix multiplication, it is necessary the case that a null vector is the only code that can possibly represents a null vector.

During normal operations, sending input vectors with a Hamming weight of less than t should not provoke any error or message corruption. With the modified instruction, this is completely possible. We thus propose the following approach:

1) send an input vector with an Hamming weight of t p ;

2) observe the occurrence or absence of corruption or error.

In step 1, the positions of the set bits can be randomly selected. In step 2, the algorithm's failure to produce correct results indicates that the set bits in the rows of the permutation matrix corresponding to the input vector are not grouped together in the same p columns. Specifically, if the set bits were in the same group, it would be impossible to end up with an accumulator that has a Hamming weight above t.

This approach provides crucial data about the permutation matrix. By repeating it many times with different inputs, one can considerably reduce the size of the possible matrices, and each of the remaining matrices can be tested by decrypting valid vectors with a high Hamming weight and looking for errors. If one knows the permutation matrix, it becomes possible to attack the error-correcting and scrambling matrices, as described in [START_REF] Petrvalsky | Countermeasure against the SPA attack on an embedded McEliece cryptosystem[END_REF], enabling complete recovery of the private key.

Details on a single iteration

In order to ease understanding, let's focus on an example multiplication with small parameters: n = 12, p = 4, and t = 5. Since we have ⌈ 5 4 ⌉, we need to input vectors with a Hamming weight of 2. This is shown in Figure 2, which illustrates an unmodified process. As expected, the output vector has the same Hamming weight as the input. Now let's consider a process that has encountered a fault, indicated by the replacement of the XOR instruction with an RSB. This operation is depicted in Figure 4. For each row processed in the matrix, 4 bits will be subtracted from the accumulator at a time. The Hamming weight of the output vector has been modified. In Figure 4a, the 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0

                          1 1 1 1 0 0 0 0 1 1 0 0 RSB (a)
0 0 0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 first bit set in the input vector now generates 2 ones, because 0-4 = -4, and the second one generates 4 ones, because 0-1 = -1. Note that in ARM, negative numbers are represented using two's complement. Conceptually, we can also consider these as 4-bit unsigned variable. Despite the integer overflow, the resulting bits are the same. Additionally, carries are not applied between variables, so empty groups will remain empty.

                          0 0 0 0 0 0 0 0 1 0 1 0 RSB (b)
The Hamming weight of the output vector has increased to 6, which is above t, and will result in an error or corruption at the end of the global algorithm. This indicates that the matrix's lines corresponding to the ones in the input vector have their set bits in different 4-bit columns. In Figure 4b, we illustrate a case where the set bits of the relevant rows are in the same 4-bit group, resulting in an output vector with only two set bits. The maximum Hamming weight we could theoretically have in the output is p, since only one variable would be affected. In such a case, the correcting code would be able to retrieve the null vector.

By reiterating this operation with various input vectors with the same weight, one can group the matrix's rows going in the same group, without knowing which ones. This represents a significant reduction in the space of the possible permutation matrices.

Resulting metrics

By exploiting this attack, the key space can be significantly reduced. The extent of reduction varies greatly depending on the algorithm's parameter and the size of data on the target platform. As for the permutation matrix, it has a size of n × n bits. Due to its nature, the associated entropy is not log 2 (2 n 2 ) as it would be with a regular matrix, but log 2 (n!), which is the number of possible permutations of the elements of an n-bit vector. In the McEliece cryptosystem, the original specification provides example parameters with n = 1024 [START_REF] Mceliece | A Public-Key Cryptosystem Based On Algebraic Coding Theory[END_REF], but today, bigger sizes are commonly used. The PQCRYPTO recommendations mention parameters with n = 6960 [20, section 4].

The above approach determines whether the selected rows each have their set bit in different groups of p columns. However, by repeatedly iterating it, sets of rows having their set bit in the same group can be formed without being able to identify which rows belong to which set. With enough iterations, obtaining a complete partition becomes achievable. In this case, the remaining entropy is log 2 (p! n p × n p !) when n p is an integer. As expected, the entropy decreases with smaller variables size. Figure 5 shows entropy values for the parameter n = 1024, which is the one suggested in the original McEliece specification, but for different variables size. The ∅ value represents the entropy before the attack. Even with 64-bit registers, a significant reduction in possibilities occurs.

The relative proportions of remaining entropy remain in the same order of magnitude even when n varies, as observed in Figure 6, which shows the results for n = 6960, the suggested size in the PQCRYPTO recommendations [20, section 4].

In our experiments, only the RSB instruction has been considered as it is the only operation code reachable with only one bit change having desirable effects. Indeed, AND and TEQ cannot induce any Hamming weight change in the accumulator variable. Such an injection has been demonstrated as possible in hardware [START_REF] Cayrel | Habilitation à Diriger des Recherches[END_REF]. It is also reproducible in software using binary instrumentation tools. In the latter case, there is no reason to restrict the change to one bit. Exploring all the other operation codes can possibly lead to increased performances, by developing and exploiting a different routine. In hardware attacks, affecting multiple bits is plausible, and expecting bigger changes in the operation code can be conceivable.

The transposition of this hardware-based attack to the software context is not only feasible but raises many questions, particularly on its impact over white-box implementations.

Exploitation of the fault attack on implementation of the McEliece cryptosystem

We introduced the first fault injection based attack on the McEliece cryptosystem. This presented attack in the previous sections can be applied since an attacker is able to shift a bit, on the one hand, on the typical implementation on a component through fault injection attack [START_REF] Breier | How Practical Are Fault Injection Attacks[END_REF] or, on the other hand, with binary instrumentation on software application on an uncontrolled environment. Our attack does not target the McEliece cryptosystem specification, but rather a conventional method of implementing it [START_REF] Petrvalsky | Countermeasure against the SPA attack on an embedded McEliece cryptosystem[END_REF], specifically the depermutation of the input.

When one is in possession of an unobfuscated executable applying the decryption, recovering the key is trivial. Hardware attacks are necessary when it is embedded on a platform on which we cannot run debuggers, for example. With the advent of the white-box security model, however, many industrial actors released obfuscated executables with anti-instrumentation measures, with the hope that an attacker with binary exploitation tools could not recover secrets. If these are not advanced enough, the attack presented here can circumvent them.

Implementation of cryptographic algorithms following the WBC security model are usually based on internal encoding applied to precomputed tables. In such cases, an attack based on data manipulation is called into question: do the modifications still hold through random bijections? When the attack is based on instructions manipulation, it seems jeopardized when considering implementations based on precomputation. The targeted instructions are not in the executable, but are exploited in advance during generation of the software. Therefore, it needs to be converted to an attack based on data.

When considering a table of precomputed data, recomputing it can be envisioned. Indeed, the results are the content itself, and one of the two operands of the associated operation is the corresponding index of each value. Using the same example of the XOR instruction, one can simply apply an exclusive-or between the result and its index to recover the second parameter, and eventually recompute the whole table in a faulty way as explained if necessary. This technique is applicable, notably at the end of a WBC protected algorithm without external encoding. It should be noted that it is possible when an implementation follows an open specification: the knowledge required is not only the result and one operand, but also the operation applied itself.

An attack such as the one presented in this study is very likely to affect naively obfuscated implementations without precomputed intermediary results. Control-flow obfuscation and the addition of useless calculation around the desired one do not prevent the existence of the XOR instruction, which is our target of choice.

These implications have major consequences in the exploitation of embedded wireless network capabilities. All industrial actors have interests in providing solutions with a low use of the mobile network usage, as it is expensive for the end-user and its availability cannot be assumed. The existence of white spots makes it hard to rely too much on such communications. The whitebox implementation of an algorithm is thus expected to provide many features, such as low data size to reduce the burden of its downloads and robustness, since an easily attackable executable will need to be changed more often, and this will imply more downloads too. These features are all related to the stakes around telecommunications use, and they draw a direct, consequential link between security and mobile networks constraints.

A variant of the McEliece cryptosystem immuned to our attack

Our work focuses on decryption in the McEliece specification. Since encryption relies on a public key, attempting to protect it with a WBC security model is unproductive. Therefore, we aim at protecting the private key during the deciphering process. As illustrated in Figure 1, this involves hiding the permutation matrix P , the scrambling matrix S, and the generator matrix G of the underlying linear code.

One might be tempted to simply merge the permutation and scrambling matrices each with random linear applications that could be cancelled outside of the algorithm. However, this method introduces risks towards attacks based on interpolation. To properly protect these assets, the techniques used cannot rely exclusively on linear fusions.

Linear mathematical operations, which make up almost all of the McEliece cryptosystem, are easily precomputable, despite the potentially large size of the associated matrices. This was done, for example, in the original proposition for a white-box version of the AES [START_REF] Chow | White-Box Cryptography and an AES Implementation[END_REF] when considering the MixColumns operation.

The usual technique involves decomposing the entire matrix into smaller ones, as shown in Figure 7, with a matrix named M , where a is the number of submatrices rows, and b is the number of submatrices columns. Their corresponding linear applications are then precomputed. The size of the submatrices is completely up to the designer and will influence usability: larger submatrices will result in larger precomputed tables and thus a larger white-box implementation. Choosing a submatrix size that is not a total matrix size divider is possible. The resulting tables can be used consecutively by adding their results. If we consider a vector u multiplied with M on its left, then resulting u × M is composed of b concatenated subvectors:

                                          [ ] M 0,0 [ ] M 0,1 [ ] M 1,0 [ ] M 0,b [ ] M a,0 [ ] M a,b M =
u × M = a i=0 u i × M i,0 ∥ a i=0 u i × M i,1 ∥ ... ... ∥ a i=0 u i × M i,b
The addition themselves should also be precomputed, so that the entire linear application consists solely of tables. Each subvector thus becomes the root result of a precomputed tree. In the context of the McEliece cryptosystem, the XOR operations are used for additions. A tables tree of this kind can be deployed to handle the permutation and scrambling matrix. However, precomputation is not possible on decoding step in the decryption process, since it operates on an input that is often at least 1024 bits long. As a result, adaptation work is necessary to implement the McEliece cryptosystem in a WBC security model.

One possible approach, illustrated in Figure 8, is to use multiple small correcting codes instead of a single large one. Each code would be associated with its own permutation, but they would all share a common scrambling matrix that would mix the data across the subcodes. However, implementing this method would require modifications not only on the decryption side but also to the encryption process. On the later, the differences are almost invisible to the final user: the subcodes are embedded in the public key, and encrypting still essentially consists in multiplying by one large matrix. However, adding errors must be applied considering each subcode. To protect the private key during the deciphering step, internal encoding based on random bijections, here named H, could be applied at the end of the subcodes, with their inverses at the beginning of the common unscrambling application. The subpermutations and subcodes could be merged and precomputed together, while the scrambling matrix would be subdivided and precomputed alone.

One crucial aspect to consider in this approach is that the permutation matrices, which are critical to the security of the McEliece cryptosystem, may have less entropy than the large equivalent one. This is due to the fast growth of the factorial function that describes their complexity based on their size. Therefore, the size of the permutation matrices must be chosen carefully, taking into account both security and usability constraints. To ensure the robustness of this idea, many offensive approaches still need to be undertaken.

In this section, we introduce a variant of McEliece cryptosystem aiming at being protected against binary instrumentation, our variant should now be proved to be resistant. This complex part is still an ongoing work.

Conclusion

In this article, we described the first fault injection based attack on ARM implementation of the McEliece cryptosystem [START_REF] Petrvalsky | Countermeasure against the SPA attack on an embedded McEliece cryptosystem[END_REF] where we are able to retrieve the private key. Our attack can be exploited anywhere where one can modify a bit: through hardware attack on component or by binary instrumentation on software executed in an uncontrolled environment. Our attack successfully allows a substantial reduction of key space, regardless of the chosen parameters.

We discussed how such an attack could be ported to afflict implementations working in a WBC security model. Given the numerous, powerful, and accessible binary instrumentation tools available, we described how fault injection and side channel attacks can be simulated and their consequences, to find new vulnerability to mitigate.

We presented suggestions to mitigate the exploitability of our attack in an uncontrolled environment. We also proposed ideas of variants on the McEliece cryptosystem expected to lead to immune implementations so that they can protect keys for a time long enough to allow practical use in real contexts, such as embedded open devices fully mastered by malicious users. Network constraints and limitations on binary updates sizes were major considerations in our design process. However, precomputed tables and their associated sizes can still represent a downside for effective use, notably due to bandwidth constraints. Addressing this issue is crucial to find the most lightweight solution that can effectively hold against binary instrumentation attacks.

Our proposed variant need further works to attest its viability in terms of security. Also, more efforts could be dedicated into the estimation and the management of this implementation's size: being able to make an informed judgment about the trade-off between size, usability and security would be very useful.

Figure 1 :

 1 Figure 1: Representation of the operational principles in the McEliece cryptosystem. Above is the encryption, below is the decryption.

Figure 3 :

 3 Figure 3: Representation of a 32-bits instruction designed for ARM processors [1].

Figure 4 :

 4 Figure 4: Illustration of faulty multiplications between a vector and a permutation matrix, with EOR replaced by RSB.Figure 4a triggers an error or corruption, whereas Figure 4b does not.

  Figure 4atriggers an error or corruption, whereas Figure4bdoes not.

Figure 5 :

 5 Figure 5: Comparison of the permutation matrix's entropy before and after the attack, with multiple p values, for n = 1024.The ∅ value occurred prior to the attack.

Figure 6 :

 6 Figure 6: Comparison of the permutation matrix's entropy before and after the attack, with multiple p values, for n = 6960.The ∅ value occurred prior to the attack.

Figure 7 :

 7 Figure 7: Visualization illustrating the decomposition of a matrix in order to make the precomputation of its associated transformation possible.

Figure 8 :

 8 Figure 8: Representation of the operational principles of one explored McEliece cryptosystem modification. Above is the encryption, below is the decryption. In this example, the number of subcodes is set to 3.

Acknowledgements

The authors wish to thank David Naccache for his guidance and support all along this work. They would also like to thank Aline Gouget and Sébastien Varrette for their valuable comments.


Alireza Dashti
email: alireza.dashti@insa-rouen.fr

Clément Keller

Benoit Vieille

Alain Guillet

Calogero Gallo

Anne-Marie Habraken

Laurent Duchêne

Impact of hardening law on the FEM prediction of residual stresses in copper-clad aluminum wires

Keywords: Wire drawing, Bimetallic composite, Copper, Aluminum, Finite element analysis, isotropickinematic hardening

Near-surface axial tensile residual stresses (from manufacturing) are reportedly detrimental to the yield strength of cold-drawn wires. Therefore, a reliable evaluation of their magnitude is necessary. The size and geometry of electrical wires can pose challenges for experimental measurement of those residual stresses. For that reason, the finite element analysis can prove useful. However, great care must be taken with the right choice of strain hardening law for a sound assessment of residual stresses. Given the complex loading condition during cold drawing, cyclic loading arises through the wire cross section even in single-pass drawing. As a result, it is of crucial importance to account for associated backstresses. The current study makes a comparison between two different hardening laws' prediction of axial residual stress profiles in numerically cold-drawn Cu-Al composite wires of various Al volume fractions. The impact of die geometry on this prediction was also examined for a 25%Al-wire. To that end, a combined isotropic-kinematic law and a pure isotropic constitutive equation were considered. The results imply a possible overestimation of residual stresses by the pure isotropic model at relatively low Al volume fractions. The difference between the maximum magnitudes of tensile or compressive residual stresses (predicted by the two models) could be as large as about 100 MPa (larger than the yield strength of the starting materials). Furthermore, the tooling geometry minimally affects the prediction of the hardening models. In conclusion, backstresses are not to be overlooked for accurate estimations of drawing residual stresses at low Al volume fractions.

Introduction

Rising copper prices and its shortage [START_REF] Schipper | Estimating global copper demand until 2100 with regression and stock dynamics[END_REF] have led manufacturers to partially replace copper for different electrical applications. Lighter, cheaper and highly conductive aluminum is a good choice for partial replacement of pure copper. Cu-Al conductors of various compositions and configurations, such as busbar, rod and wire, are currently available. There are a variety of techniques for manufacturing these bimetallic composites. Rotary swaging, caliber rolling, hydrostatic extrusion, and wire drawing [START_REF] Kunčická | Deformation behaviour of Cu-Al clad composites produced by rotary swaging[END_REF]- [START_REF] Dashti | Novel approach to optimize the mechanical properties of Cu-Al composite wires[END_REF] are among them. Cold wire drawing is commonly used to manufacture copper-clad aluminum wires, abbreviated as CCA. Wire drawing involves reducing the cross-sectional area of a wire by pulling it through conical dies [START_REF]THEORY OF WIREDRAWING[END_REF]. Non-uniform plastic deformation during this process gives rise to a triaxial residual stress state with radial, tangential and axial components [START_REF] Atienza | The role of residual stresses in the performance and durability of prestressing steel wires[END_REF].

Several researches have investigated the adverse effect of axial tensile residual stresses on the tensile strength and fatigue properties of cold-drawn wires. Atienza et al. [START_REF] Atienza | Residual stresses and durability in cold drawn eutectoid steel wires[END_REF] associate tensile surface residual stresses with the number of cycles to rupture of eutectoid steel wires. They suggest post-drawing treatments such as stabilizing, rolling and skin pass to enhance the wire's fatigue resistance against environmentally assisted cracking (EAC). Atienza and Elices [START_REF] Atienza | Influence of residual stresses in the tensile test of cold drawn wires[END_REF] also argue that the aforementioned residual stress component lowers the yield strength of drawn steel wires. Dashti et al. [START_REF] Dashti | Novel approach to optimize the mechanical properties of Cu-Al composite wires[END_REF] report that so-called architectured Cu-Al composite wires have a higher yield strength than conventional CCA and full-copper counterparts in the as-drawn state (without heat-treatment). They ascribe it to lower-magnitude near-surface axial tensile residual stresses in architectured wires. Ripoll et al. [START_REF] Ripoll | Reduction of tensile residual stresses during the drawing process of tungsten wires[END_REF] attribute cracking of drawn tungsten wires to surface residual stresses. They introduce an optimized die geometry and post-drawing bending operations to resolve the issue. It is common practice to use the finite element method (FEM) to predict wire drawing-induced residual stresses. Usually, isotropic hardening is adopted to describe the elastoplastic behavior of materials. However, it should be noted that isotropic hardening is generally not sufficient where non-proportional loading is involved [START_REF] Ottosen | Nonlinear kinematic hardening under non-proportional loading[END_REF]. Wire drawing is performed under complex loading conditions and cyclic loading happens even in single-pass drawing [START_REF] Panteghini | Effects of the strain-hardening law in the numerical simulation of wire drawing processes[END_REF]. This can result in discrepancies between isotropic and kinematic hardening models' prediction of manufacturing residual stresses. Panteghini and Genna [START_REF] Panteghini | Effects of the strain-hardening law in the numerical simulation of wire drawing processes[END_REF] suggest isotropic hardening as inadequate for accurate calculation of residual stress profiles in steel wires. They argue that an isotropic hardening law significantly overestimates residual stresses and, therefore, kinematic hardening must be adopted. Souza et al. [START_REF] De Souza | Comparison between Neutron Diffraction measurements and numerical simulation of residual stresses of a Wire-Drawing process[END_REF] compare the numerically-predicted residual stress profiles of a cold-drawn AISI 1045 steel wire against those of neutron diffraction measurements. There is a considerable difference between the simulation and experimental results. They ascribe it to the fact that anisotropy and kinematic hardening are unaccounted for. Therefore, an appropriate choice of the hardening model seems inevitable for reliable evaluations of residual stresses.

The present work is an attempt to address the unavailability of literature on the hardening lawresidual stress profile relationship in copper-clad aluminum wire or CCA. For that purpose, a numerical study was conducted to investigate how different hardening laws' predictions of residual stresses differ from one another as a function of the Cu/Al volume fraction and the tooling geometry (for the volume fraction 25%Al). The von Mises yield criterion was used with I-pure isotropic and II-combined isotropic-kinematic hardening models. The following sections provide further details about the materials, backstress calculation and the hardening model constants used to simulate wire drawing. Moreover, the residual stress profiles along the wire diameter are presented for all cases together with the corresponding contour plots. Finally, the results and implications are discussed and concluded.

Materials and methods

Experimental procedure

Pure OFHC (Oxygen Free High Conductivity) copper and 99.5% pure Al were first annealed, for 3 hours at 500 and 300 °C, respectively, to have a fully-recrystallized defect-free initial microstructure. In order to obtain the corresponding stress-strain curves, both materials were, then, tensile-tested using a 10 kN-universal testing machine 'MTS Criterion Model 43'. Tensile tests were carried out at room temperature, in a displacement-controlled mode. Specimens were strained at an initial strain rate of 0.004 s -1 to avoid possible viscous effects. A conventional 25 mm-gage length extensometer measured the axial strain. However, cold drawing often induces larger strains than the maximum total strain achievable in a tensile test (commonly between 20-30%), even during a single pass [START_REF] Chinh | A new constitutive relationship for the homogeneous deformation of metals over a wide range of strain[END_REF]. For instance, in this work, single-pass drawing of Cu-Al wires of different Al volume fractions, with an initial diameter of 12 mm, is numerically modelled for a cross-sectional area reduction of 20%. Starting Cu and Al phases were in the annealed state with zero friction assumed at their interface. The preceding reduction ratio corresponds to a plastic strain of about 22% according to the following equation:

𝜀 = 2ln 𝐷 0 𝐷 (1)
ε, D0 and D are, respectively, the amount of plastic strain, initial and final wire diameters. Therefore, both pure Cu and pure Al tensile curves were extrapolated to larger strains in order to provide a better description of the material behavior (Fig. 1). Extrapolation was performed with the Sigmoidal fit function available in Igor whose horizontal asymptote better describes the asymptotic or saturation value of flow stress in pure Cu and pure Al [START_REF] Chinh | A new constitutive relationship for the homogeneous deformation of metals over a wide range of strain[END_REF]. In order to estimate the backstress evolution with strain for copper, loading-unloading tensile tests were performed according to the procedure previously described in Ref [START_REF] Marnier | Fatigue of OFHC pure copper and 316L stainless steel subjected to prior tensile and cyclic prestrains[END_REF], briefly explained as follows. Dumbbell-shaped samples with OFHC copper of a gage length of 18 and a total length of 70 mm were loaded and unloaded cyclically (Fig. 2) in a strain-controlled tensile test (strain rate = 0.0005 /s). Each loading-unloading loop was then analyzed in terms of its center and radius. The center is assumed to be related to the development of backstress in the material (kinematic hardening) whereas the radius is associated with the effective stress (representing isotropic hardening). A plastic strain offset of 0.0005 was considered to mark the end of elasticity during the unloading sequence. In order to calculate the backstress, a common relationship being in use since 1980s [START_REF] Dickson | A comparison of two simple methods for measuring cyclic internal and effective stresses[END_REF], was employed where the sum of initial unloading stress (σu0) and unloading yield stress (σu) is divided by two, as shown in figure 2 (c). Further references are provided in the caption. Backstress in pure copper arises due to heterogeneous dislocation structures (such as tangles, walls, cells) and strain incompatibilities between grains [START_REF] Marnier | Fatigue of OFHC pure copper and 316L stainless steel subjected to prior tensile and cyclic prestrains[END_REF]. As reported in the literature, heavily strained pure copper develops a steady state microstructure [START_REF] Chinh | A new constitutive relationship for the homogeneous deformation of metals over a wide range of strain[END_REF]. Consequently, a mathematical formula predicting the saturation level was employed to extrapolate backstress [START_REF] Marnier | Fatigue of OFHC pure copper and 316L stainless steel subjected to prior tensile and cyclic prestrains[END_REF]. An average of 50% was considered as the backstress portion of the total stress up to experimentally measured total strains of about 30%, based on the loadingunloading loops of the cyclic loading test performed on pure Cu as shown in figure 2 (c). Having assumed that a steady state reaches, the backstress evolution up to large strains was extrapolated for cold-drawing simulations. For aluminum, the backstress data was taken from the literature for an annealed commercially pure aluminum with the backstress portion of stress being about 16% [START_REF] Gao | Significant Bauschinger effect and back stress strengthening in an ultrafine grained pure aluminum fabricated by severe plastic deformation process[END_REF]. The Bauschinger effect is more significant in low stacking fault energy materials. Pure Al has a higher stacking fault energy than pure Cu and, thus, a lower backstress portion of stress [START_REF] Saleh | On the evolution and modelling of lattice strains during the cyclic loading of TWIP steel[END_REF]. True strain [START_REF] Yang | Back stress strengthening and strain hardening in gradient structure[END_REF], [START_REF] Kuhlmann-Wilsdorf | Dislocation behavior in fatigue II. Friction stress and back stress as inferred from an analysis of hysteresis loops[END_REF]

Numerical procedure

The finite element code, LAGAMINE, developed at the University of Liège, was used to model single-pass wiredrawing of an initially 12 mm-diameter Cu-Al wire whose cross-section decreases by 20% in one pass. As mentioned above, annealed Cu and Al phases with zero interfacial friction were assumed as the starting materials. Using the von Mises criterion, the simulations were run with both mixed isotropic-kinematic and pure isotropic hardening models for Cu-Al wires of three different volume fractions: 25%, 50%, and 75% Al. The commonly used Armstrong-Frederick equation (Equ. 2), after integration (Equ. 3), and the Voce (Equ. 4) equation (able to predict the stress saturation level) were fitted to the experimental data (Figs. 3 and4) to identify the material parameters (listed in Table 2) for the kinematic and isotropic hardening models, respectively. Table 1 presents the parameters in the equations below.

𝑋 ̇= 𝐶 𝑋 (𝑋 𝑠𝑎𝑡 𝜀̇𝑝 𝑙𝑎𝑠𝑡𝑖𝑐 -𝜀̇𝑝 𝑙𝑎𝑠𝑡𝑖𝑐 . 𝑋) (2)
𝑋 = 𝑋 𝑠𝑎𝑡 (1 -𝑒𝑥𝑝(-𝐶 𝑋 . ε ̅ 𝑝𝑙𝑎𝑠𝑡𝑖𝑐 )) (3)
𝜎 𝐹 = 𝜎 0 + 𝐾(1 -𝑒𝑥𝑝(-𝑛. 𝜀̅ 𝑝𝑙𝑎𝑠𝑡𝑖𝑐 ))

(4) Figs. 3 and4 display the curve-fitting results for pure Cu and pure Al (over a strain range of 0-0.5) to obtain the isotropic and kinematic parameters (fitting constants) for the mixed isotropic-kinematic law. The fitting constants for both mixed and pure isotropic models are presented in Table 2. Given the symmetric configuration of the Cu-Al composite wires, a quarter of them with an initial length of 30 mm was created through the finite-element mesh generator, Gmsh [START_REF]Gmsh: a three-dimensional finite element mesh generator with built-in pre-and postprocessing facilities[END_REF], for all the volume fractions investigated here. The wires were entirely meshed via reducedintegration linear hexahedron elements with their outer surfaces covered with a layer of reduced-integration linear quadrilateral elements to model the wire-die contact. A wire drawing die of a semi-angle of 8° was also designed and meshed with triangular elements. The wire drawing assembly was then introduced to LAGAMINE through a Gmsh-LAGAMINE interface. Fig. 5 shows the assembly including a quarter of a deformable 25%Al-CCA wire (assuming a perfect Cu-Al bond) together with a rigid body shell representing the interior of the die. The inner faces of the quarter were fixed one in the X-and the other in the Y-direction with the die restrained in all directions. A 50 mm-displacement was applied on the front end of the wire to move it through the die until the other end exits. The experimentally manufactured CCA wires in the authors' preceding studies [START_REF] Keller | Microstructure and mechanical properties characterization of architectured copper aluminum composites manufactured by cold-drawing[END_REF], [START_REF] Dashti | Experimental and Finite Element Analysis of the Tensile Behavior of Architectured Cu-Al Composite Wires[END_REF] were cold-drawn using a semi-industrial bench with powdered soap as the lubricant, whose friction coefficient is rather small, ranging between 0.033 and 0.061 [START_REF]Friction in: WIRE DRAWING[END_REF]. Therefore, the friction coefficient was set to zero in the current simulations. Moreover, since the temperature rise during cold drawing was insignificant, the effect of viscosity and drawing velocity were assumed minimal. As already mentioned, the von Mises yield criterion was considered, without accounting for the potential intrinsic elastoplastic anisotropy of the materials (annealed pure Cu and Al). Backstress-induced anisotropy, alone, can provide accurate enough predictions of the residual stress profile in some cases [START_REF] Panteghini | Effects of the strain-hardening law in the numerical simulation of wire drawing processes[END_REF]. The axial residual stress profile along the wire diameter was then plotted for the three volume fractions 25, 50, and 75% Al. A further investigation was carried out to determine how the tooling geometry (die angle and reduction ratio) could possibly affect the difference between the predictions of the axial residual stress profiles, with the above hardening models. The 25%Al-CCA wire was studied among the three volume fractions, for the reasons given later in the text. Accordingly, the 20% area reduction of the 25%Al-composite wire was achieved with 6° and 10° die semi-angles (in addition to the original 8°) in separate simulations. Additionally, the reduction ratio effect was examined within a range of 10-20%, with 5% steps (10, 15, and 20%), with a die angle of 8°. The axial residual stress profiles through the wire cross section were next plotted to show their dependence on the die design. The results and their implications will be discussed in the following paragraphs. As seen in Fig. 7, the smaller the Al volume fraction (core material) is, the more different (in terms of magnitude) the axial residual stress profiles predicted by pure isotropic and mixed isotropic-kinematic hardening models will be. The difference between the maximum tensile and compressive axial residual stresses of the two profiles may be as large as 100 MPa or even more for the 25%Al-CCA wire. However, the discrepancy diminishes as the Al core becomes larger in diameter (i.e. volume fractions, 50 and 75%). Table 4 provides a comparison between the maximal values of tensile and compressive components of axial residual stress for different cases.

𝜀̅ 𝑝𝑙𝑎𝑠𝑡𝑖𝑐

Equivalent plastic strain

Results

Table 4. Maximal values of axial residual stresses predicted by pure isotropic and mixed hardening models.

Figs. 9 and 10 illustrate the impact of die semi-angle (α in Fig. 8) and reduction ratio (R 2 /R0 2 as shown in Fig. 8) on the different hardening models' prediction of axial residual stresses (profiled along the diameter of the 25%-Al wire). The results were obtained according to the explanation given earlier in the subsection, 2.2. As mentioned in section 2, the effect of tooling geometry was investigated for the 25%Al-CCA wire. This choice was made in order to study the impact of die semi-angle and reduction ratio for the sample showing the greatest discrepancy between the pure isotropic and mixed hardening models' predictions (see table 4).

Axial residual stress (MPa)

Fig. 8. Simple schematic of the die semi-angle, initial and final radii of the wire

As seen in the above figures, the axial residual stress profiles overlap each other within both studied ranges of die semi-angle and reduction ratio. The difference between the maximum magnitude of tensile and compressive residual stresses, predicted by both hardening models, remain between 90-140 MPa for all cases. The residual stress distribution trend and slope, also, remains almost the same. As is shown in Figs. 9 and 10, a sharp variation of the axial residual stress arises in the copper phase of wires simulated with a pure isotropic hardening model. However, the distribution is relatively smooth in both phases for the wires with mixed isotropickinematic hardening. The difference between the two hardening models' prediction of axial residual stresses and the negligible impact of the tooling geometry on that will be discussed in the next section followed by the conclusions.

Discussion

As introduced earlier, even single-pass wire drawing involves cyclic loading and therefore backstress and kinematic hardening need to be accounted for. Thus, a proper estimation of residual stresses requires the use of a realistic enough hardening model to correctly simulate the manufacturing process. Kinematic hardening is often found in conjunction with isotropic hardening [START_REF] Rouhaud | Finite elements model of shot peening, effects of constitutive laws of the material[END_REF]. As a result, a mixed isotropic-kinematic hardening model was adopted based on the experimental and literature data for copper and aluminum, respectively. The axial residual stress profiles from the wire drawing simulation of Cu-Al wires of different Al volume fractions (using mixed hardening) were then compared against those predicted by a pure isotropic hardening model as outlined above. In addition to that, the impact of die geometry (semi-angle and reduction ratio) on the different hardening models' prediction of axial residual stress was considered. The subsequent sections discuss the results.

Mixed vs pure isotropic hardening model: axial residual stress profiles

Axisymmetric forming operations, including wire drawing, cause residual stresses to develop since a material element tends to move faster through the die the farther it is from the toolworkpiece interface. Hence, residual stresses form due to elastic recovery after non-uniform plastic strains [START_REF] Dehghani | Mechanical Engineering Department[END_REF], [START_REF] Dehghani | Computer simulation of hydrostatic co-extrusion of bimetallic compounds[END_REF]. When it comes to composite materials, differing mechanical properties of the components, such as yield strength (σ0), also introduce some degree of deformation nonuniformity [START_REF] Marr | Ti-Al composite wires with high specific strength[END_REF]. Fig. 6 shows how the gradient of axial stresses acting upon the wires during cold drawing gives rise to inhomogeneous plastic deformation and consequently residual stresses. Table 4 details the maximal values of axial residual stresses predicted by pure isotropic and mixed hardening models and the difference between the two predictions. Fig. 7 indicates that the 25%Al-CCA shows the most discrepant axial residual stress profiles (predicted by mixed and pure isotropic models) among the three volume fractions studied. This could be explained by two arguments. Firstly, the loading condition in cold drawing is cyclic as opposed to monotonic. The mixed hardening law employed here accounts for cyclic loading by reproducing the Bauschinger effect. Accordingly, the larger the volume fraction of aluminum, whose backstress portion of stress is significantly smaller than copper (≈ 16% vs ≈ 50%), the smaller the residual stress profile discrepancies will be. The mechanism through which kinematic hardening brings about lower-magnitude axial residual stresses with smoother variations can possibly be associated with the plastic-strain-induced anisotropy, represented by backstress. This anisotropy, arising from a translation of the yield surface, possibly lowers the heterogeneity of plastic deformation during wire drawing leading to reduced axial residual stresses with a regular distribution.

Secondly, the deformation heterogeneity during wire drawing extends through a greater thickness in the copper cladding of the 25%Al-CCA. Nevertheless, the plastic deformation nonuniformity evolves over a thinner copper sleeve with the increase of Al volume fraction (50 and 75%). Consequently, a less steep gradient arises in the copper phase from the wire surface to the Cu-Al interface. Therefore, the mixed and pure isotropic hardening models' prediction of magnitude and distribution of axial residual stresses, in the pure Cu sleeve, would not greatly differ from one another at smaller Cu volume fractions. This has interesting industrial implications for standard classes of copper-clad aluminum wires, containing 10-15% Cu, [START_REF]Standard Specification for Copper-Clad Aluminum Wire[END_REF] in the sense that a pure isotropic model can presumably predict residual stress with sufficient accuracy.

Die geometry and hardening law: 25%Al-CCA

As stated in "Materials and methods", followed by the corresponding results in the previous section, 25%Al-CCA was chosen in order to look into how different hardening laws' numerical prediction of axial residual stresses can potentially change as a function of the die geometry. The above specimen was opted because of showing a rather remarkable difference between the residual stress profiles depending on the hardening model used to simulate its drawing (isotropic-kinematic or pure isotropic). Wire drawing energy is composed of homogeneous, friction, and redundant work. Homogeneous work is the useful work to reduce cross section.

Friction work was assumed insignificant as stated earlier. Redundant work occurs due to changes in the direction of flow of the metal in the die and causes internal shearing and distortion. The last component (redundant work) is closely related to the die geometry [START_REF]THEORY OF WIREDRAWING[END_REF], [START_REF] Srinivasan | Coextrusion[END_REF].

According to Figs. 9 and 10, which illustrate the axial residual stress profiles of wires with different die semi-angle and reduction ratio, as explained in the "Results" section, varying the tooling geometry within common ranges has a negligible impact on the axial residual stress profiles of 25%Al-CCA wires predicted by both pure isotropic and mixed isotropic-kinematic hardening models. The difference between the maximum magnitude of tensile and compressive residual stresses, predicted by both hardening models, remains between 90-140 MPa for all cases, and the residual stress distribution trend and slope also remain almost the same. The composite nature of the studied cold-drawn wires conceivably describes these numerical observations. This can be attributed to the fact that the mechanical incompatibility between the pure Cu and pure Al phases prevails any moderate changes of the tooling geometry in determining the axial residual stress profiles, irrespective of the hardening law. It may be argued that die geometry modifications, within above limits, slightly influences the redundant portion of the total energy of cold drawing of Cu-Al wires. However, it should be noted that the above argument is valid as long as the earlier made assumptions of perfect Cu-Al bond and zero friction at the die/workpiece are valid. Generally, sound co-drawing/extrusion is achieved with low die angles, low friction at the die/workpiece, and high interfacial friction between the clad and core [START_REF] Srinivasan | Coextrusion[END_REF]. The closer the co-drawing/extrusion operation is to the ideal conditions, the closer the experimental results will be to the above numerical observations.

Conclusions

The present study is aimed at comparing pure isotropic and mixed isotropic-kinematic hardening models with respect to their estimation of axial residual stresses in numerically drawn Cu-Al composite wires of different Al volume fractions. Further to that, the impact of tooling geometry on the hardening laws' prediction of axial residual stresses was investigated for a given volume fraction (25%Al). The conclusions are as follows:

• The higher the volume fraction of pure Cu is in copper-clad aluminum wires (the thicker the Cu sleeve), the more significantly mixed and pure isotropic hardening models will deviate from one another in terms of numerically predicted maximal values of axial residual stresses.

• A pure isotropic hardening model may provide sufficiently accurate estimates of axial residual stresses in CCA wires of relatively large Al volume fractions (70-90%) without needing to consider kinematic hardening

• The mechanical incompatibility between pure Cu and pure Al plays a more determining role than moderate die geometry modifications with regard to predicted axial residual stress profiles, regardless of the hardening model.

2 Fig. 1 .Fig. 2 .

 212 Fig. 1. Experimental pure Cu and pure Al stress-strain curves

Fig. 3 .

 3 Fig. 3. Experimental and fitted curves of the isotropic segment of pure Cu (≈ 50%) and pureAl (≈ 84%) stress-strain curves

Fig. 5 .

 5 Fig. 5. Wire drawing assembly of a 25%-Al CCA along with the die interior

Fig. 6 Fig. 6 .Fig. 7 .

 667 Fig. 6 exhibits quarters of the above-mentioned CCA wires of different Al volume fractions, showing the evolution of axial stresses at a particular stage during drawing. The axial residual stress component developed in different cases (at the end of the drawing process) is profiled along the diameter of numerically drawn wires in Fig. 7 for comparison purposes. The paths, over which the profiles are plotted, were taken from the relatively uniform middle part of the contour, away from the ends to avoid possible edge effects. The Cu and Al phases are delineated in both Figs. 6 and 7.

Fig. 10 .Fig. 9 .

 109 Fig. 10. Axial residual stress profiles of 25%Al-composite wires (CCA), numerically cold-drawn with different reduction ratios and different hardening models (die semi-angle = 8°)

Table 1 .

 1 The Armstrong-Frederick and Voce equation parameters.

	Parameter	Description
	𝑋 ̇	Backstress rate tensor
	𝐶 𝑋	Kinematic hardening saturation rate
	𝑋 𝑠𝑎𝑡	Kinematic hardening saturation value
	𝜀̇𝑝 𝑙𝑎𝑠𝑡𝑖𝑐	Plastic strain rate tensor
	𝜀̇𝑝 𝑙𝑎𝑠𝑡𝑖𝑐	Equivalent plastic strain rate
	𝑋	Backstress tensor
	𝜎 𝐹	Flow stress
	𝜎 0	Yield stress
	𝐾	Hardening factor
	𝑛	Hardening exponent

Table 2 .

 2 Armstrong-Frederick and Voce equation parameters (fitting constants).

Table 3 .

 3 The Young's modulus (E), shear modulus (G), and Poisson's ratio (𝜈) values for Cu and Al.

Maximum tensile residual stress Maximum compressive residual stress CCA wire

		Isotropic-Kinematic	Pure isotropic	ΔT	Isotropic-Kinematic	Pure isotropic	ΔC
	25%Al-CCA	42.5	134.7	92.2	-89.8	-227.7	-137.9
	50%Al-CCA	134.7	165.9	31.2	-140.2	-209.8	-69.6
	75%Al-CCA	180.4	177.4	-3	-148.1	-187.9	-39.8

Acknowledgements

The authors wish to thank the PhD students Carlos Rojas Ulloa and Ehssen Betaieb from the University of Liège's Department of Architecture, Geology, Environment and Constructions (ArGEnCo) for their kind help and technical advice with the finite element code "LAGAMINE".

Funding

The authors gratefully acknowledge the funding from The Region of Normandy.

Conflicts of interest

The authors declare that they have no conflict of interest.

Authors' contributions

Not applicable


Jean-Frédéric Blanc
email: j.edeline@rennes.unicancer.fr

Difficulties for providing evidence in Hepatocellular Carcinoma with Child-Pugh B liver function

Conflict of interest statement: JE and JFB

Accepted manuscript

In this issue of Liver International, Jeon et al present a study regarding the treatment of Hepatocellular Carcinoma (HCC) in patients with Child-Pugh (CP) B liver function [START_REF] Jeon | Treatment patterns for HCC in patients with Child-Pugh class B and their impact on survival: A Korean nationwide registry study[END_REF] . Despite the high prevalence of this situation in daily practice (for example, it represented 23% of all HCC cases recorded in the BRIDGE global cohort [START_REF] Park | Global patterns of hepatocellular carcinoma management from diagnosis to death: the BRIDGE Study[END_REF] ), this population remains understudied, and providing higher level of evidence is of paramount importance. The authors investigated the data from the Korean Central Cancer Registry from 2008 and 2016, focusing on the 2,318 patients included in the Korean Primary Liver Cancer Registry with CP B and describing their outcomes depending on the first treatment received, categorized whether it respected the BCLC algorithm. Their conclusions are that regardless of BCLC stage, transarterial chemoembolization (TACE) was the most frequently used treatment, and that for BCLC A and B stages, treatment according to recommendations was associated with the best outcomes, but that in BCLC C stages treatment with systemic therapies provided poor outcomes. To note, more than half of the CP B population was classified as BCLC C (n=1,454) in this registry.

The main strengths of the study are the use of a population-based registry, with high coverage of the Korean population, the use of the Korean Primary Liver Cancer Registry part of this registry, ensuring that data required for HCC management (such as BCLC stages, liver function…) were available (which might not be the case for non-specialized registries), and the large number of patients analyzed. The main limitations, acknowledged by the authors, are the absence of randomization, making comparisons of treatment choices uncertain (possibly influenced by unknown confounding factors), some data important for treatment decision (portal hypertension, comorbidities) were lacking. Also, there was no data on treatment tolerance or liver function worsening, which are of major importance in this population. The difference of population and management of HCC between East and West might also make the conclusions less applicable in a Western population. Finally, despite the high overall numbers, some subgroups are small (for example, n=17 for curative treatment in BCLC B), questioning the validity of some results when selection bias could not be definitively ruled out.

Accepted manuscript

Apart from the conclusions of the authors, which should be balanced by the unknown selection biases and the absence of data on safety, other very important messages could be illustrated by this study. Firstly, it confirms in real-life the major prognostic impact of liver function in HCC. In the BCLC B group, median Overall Survival (OS) was 15 months for patients treated with TACE, and in the BCLC C group, median OS was only 3 months for patients treated with systemic therapy (presumably mostly sorafenib due to the study period), both considerably lower than what is expected in a CP A population. Thus, despite the exclusion of CP B of most clinical trials, there remains a huge unmet need for this population.

Secondly, the authors' conclusions tend to support an aggressive approach to treatment, comparable to those of CP A population, and even suggest to use locoregional treatment in patients with BCLC C stage and CP B liver function. However, we believe we should be more cautious about these conclusions. As discussed by the authors, the very low median OS in patients treated with systemic therapy, while comparing to the relatively higher median OS of 9 months in patients treated with TACE, might suggest a selection bias with more advanced patients treated with systemic therapy as compared to TACE. Moreover, locoregional treatment are often associated with decrease of liver function, and should then be used with caution in this population [START_REF] Hiraoka | Hepatic Function during Repeated TACE Procedures and Prognosis after Introducing Sorafenib in Patients with Unresectable Hepatocellular Carcinoma: Multicenter Analysis[END_REF] . In this study as in others, subclassification of CP B population either comparing B7 vs B8-9 or using ALBI grade 1-2 vs ALBI grade 3 might help to better define population at risk of toxicity, and increased benefit from the treatment [START_REF] Lescure | ALBI Score Is a Strong Predictor of Toxicity Following SIRT for Hepatocellular Carcinoma[END_REF][START_REF] Blanc | Phase 2 trial comparing sorafenib, pravastatin, their combination or supportive care in HCC with Child-Pugh B cirrhosis[END_REF] .

Furthermore, liver dysfunction might be more at risk in patients with other etiologies than Hepatitis B Virus.

Thirdly, this registry illustrates the discordance between BCLC recommendations and everyday practice. As was previously described not specifically for the CP B population, TACE remains the most frequently proposed first treatment, with very similar frequencies as resection in the BCLC A in the global BRIDGE study of practice, and higher frequency of use in China and South Korea as compared with other countries 2 . There are two directions for interpreting these discordances between Accepted manuscript recommendations and actual practice: the first is to emphasize the potential loss of chance of not adhering to guidelines, as illustrated by the non-application of curative treatment in BCLC A patients.

Of course, appropriate management of HCC patients, including discussion within specialized multidisciplinary team meeting adhering to validated guidelines, should always be favored [START_REF] Sangiovanni | Treatment of hepatocellular carcinoma: beyond international guidelines[END_REF] . However, the other direction is to consider that in some aspects the BCLC algorithm might not always be applicable to everyday patients. The CP B population is a good example of this difficulty: it was at some point included beside CP A in the main BCLC algorithm, despite the lack of evidence validating any treatment in this population usually excluded from clinical trials; currently, the phrasing is "preserved liver function", with explicit exclusion of patients with decompensation (jaundice, ascites, encephalopathy), but no further discussion within the CP B population. Interestingly, the last versions of the BCLC algorithm introduced the notion of treatment stage migration, and for example the possibility to apply TACE in BCLC A patients for which curative treatment are not feasible or failed. This makes the BCLC algorithm more applicable, for example for a CP B patient for which the surgeon judges the operating risk too high, and whose lesion is in a location of difficult access to ablation.

Clearly, HCC is a strong example of the need for an individualized decision for each patient diagnosed with cancer, and the need for multidisciplinary discussion to provide an evaluation of the feasibility of every treatment modality possible.

Finally, and most importantly, we must continue to build evidence in the CP B population presenting with HCC. During the more than 10 years of availability of sorafenib as first-line treatment, we were able to complete only one randomized trial with this drug, the PRODIGE 21 trial [START_REF] Blanc | Phase 2 trial comparing sorafenib, pravastatin, their combination or supportive care in HCC with Child-Pugh B cirrhosis[END_REF] . In this phase 2 trials that randomized 160 patients, we suggested that sorafenib might be associated with clinicallyrelevant OS benefit only in patients with either CP B7 or ALBI grade 1-2 liver function. Other attempts to demonstrate benefit failed due to lack of accrual [START_REF] Labeur | Sorafenib for Patients with Hepatocellular Carcinoma and Child-Pugh B Liver Cirrhosis: Lessons Learned from a Terminated Study[END_REF][START_REF] Daniele | A randomized phase III trial comparing sorafenib plus best supportive care (BSC) versus BSC alone in Child-Pugh B patients (pts) with advanced hepatocellular carcinoma (HCC): The BOOST study[END_REF] , illustrating the difficulty of randomizing such population, with some investigators reluctant to treat these patients with aggressive therapies due to their poor liver function, and others reluctant to provide best supportive care alone… However, in the context of lack of evidence and potential toxicity, it is still important to conduct prospective Accepted manuscript studies in this population, such as was made for nivolumab [START_REF] Kudo | CheckMate 040 cohort 5: A phase I/II study of nivolumab in patients with advanced hepatocellular carcinoma and Child-Pugh B cirrhosis[END_REF] and is currently planned for durvalumabtremelimumab or tislelizumab (clinicaltrials.gov identifier NCT05622071). Innovative trial designs, such as synthetic controls or emulated trials, might help to overcome resistance to randomization in this context [START_REF] Hernán | Using Big Data to Emulate a Target Trial When a Randomized Trial Is Not Available[END_REF] .

In conclusion, the analysis of the Korean registry illustrates the high unmet need of the CP B population. This population, as every HCC patients but highlighted by to lack of adequately evidencebased recommendations, requires an individualized approach as regards to treatment decisions.

Continuation of efforts of clinical research should be a priority for our community.

received funding from Beigene for conducting a study in