Yves Deswarte
email: yves.deswarte@laas.fr

Sébastien Gambs
email: sebastien.gambs@laas.fr

Towards a Privacy-preserving National Identity Card

In this paper, we propose to replace the national identity card, currently used in many countries, by a personal device that allows its user to prove some binary statements about himself while minimizing personal information leakage. The privacy of the user is protected through the use of anonymous credentials which allows him to prove binary statements about himself to another entity without having to disclose his identity or any unnecessary information. The proposed scheme also prevents the possibility of tracing the user, even if he proves several times the same statement (unlinkability property). A tamper-proof smartcard is used to store the personal information of the user thus protecting his privacy and preventing the risks of forgery at the same time. The user identifies himself to the card via biometrics thus forbidding an unauthorized use in the situation where the card is stolen or lost. Two practical implementations of the privacy-preserving identity card are described and discussed.

Introduction

Intuitively respecting the principles of data minimization1 and data sovereignty2 when using a national identity card seems to be at odds with other obligations required in practical tasks from everyday life such as checking the nationality of the owner of the card when he crosses a border, verifying his age when he wants to obtain some discount related to it or proving that he belongs (or does not belong) to a particular group. In this paper, we advocate that this intuition is wrong by introducing the concept of privacy-preserving identity card.

Definition 1 (Privacy-preserving Identity Card) A privacy-preserving identity card is a personal device that allows its user 3 to prove some binary statements about himself (such as his right of access to some resources) while minimizing personal information leakage.

Consider for instance the following scenario that illustrates how such a card would work in practice.

Scenario 1 (Alice in Anonymityland) Alice is privacy addicted since she has read the seminal paper of Chaum on anonymity [START_REF] Chaum | Security without identification: transaction systems to make Big Brother obsolete[END_REF]. She has recently seen in an advertisement that her government now offers the possibility of using a privacy-preserving identity card. Therefore, she goes to the town hall and asks for it. The city hall checks the validity of Alice's identity, scans her biometric data and sends them in a secure manner (for instance using a protected conveyor) along with her personal information to the corresponding governmental service that will be responsible for issuing the card.

For an external observer, the card looks exactly the same as any other privacypreserving identity card, since there is no personal information written on the plastic card. Effectively, the card is a tamper-proof smartcard containing anonymous credentials that Alice can use to prove some statements about her. The card is activated by Alice's biometric features. For instance, her card allows Alice to prove her nationality when she crosses the border, to show that she is within some age interval in order to gain some discount at the theater, to certify her identity when she takes the plane or to gain access to local services restricted to her neighborhood residents.

If the card of Alice is lost or stolen, she does not need to worry about this misuse for malicious purpose, because of the biometrics authentication and the tamper-proof features of the smartcard. Instead, she simply returns to the city hall to declare the loss of her card and ask for a fresh privacy-preserving identity card.

Our proposal for the privacy-preserving national identity card is close in spirit to the project PRIME 4 (PRivacy and Identity Management for Europe) [START_REF]PRIME -Privacy and Identity Management for Europe[END_REF], whose goal was to develop a framework and tools allowing a user to manage his identity and to protect his privacy in the cyberspace. Indeed, the main purpose of the privacy-preserving identity card is to enable a person to conduct tasks in the real world without having to disclose his identity whereas PRIME was focusing exclusively on the online setting. The informal proposition of Birch for the future U.K. national identity card [START_REF] Birch | Psychic ID: A blueprint for a modern national identity scheme[END_REF], called Psychic ID, also shares several privacy features with our proposal. Indeed, the Psychic ID card respects the principle of data minimization and only reveals to a reader (or visually to an entitled person) the minimal information concerning the user that is needed for a specific purpose if the user possesses the corresponding credential, and nothing otherwise. An overview of the privacy features of the specifications of the future European electronic identity cards can be found in [START_REF]Privacy features of European eID card specifications[END_REF]. Other related works close to our approach include a protocol for the partial revelation of information related to certified identity proposed by Boudot [START_REF] Boudot | Partial revelation of certified identity[END_REF] and the development of a cryptographic framework for the controlled release of certified data due to Bangerter, Camenisch and Lysyanskaya [START_REF] Bangerter | A cryptographic framework for the controlled release of certified data[END_REF].

The outline of the paper is the following. First in Section 2, we detail in an abstract way the desirable properties that a privacy-preserving identity card should fulfill. Afterwards in Section 3, we briefly review some enabling technologies on smartcards, anonymous credentials and biometric authentication that will be the basis of our practical implementations of the card. Then in Section 4, we briefly describe of such a card might be use in practice before in Section 5 and Section 6, proposing two practical implementations of the privacy-preserving identity card. Finally, we conclude in Section 7 with a discussion on possible extensions to the privacy-preserving identity card.

Desiderata for a Privacy-preserving Identity Card

In this paper, we adopt a notation inspired from the work of Camenisch and Lysyanskaya on anonymous credentials [START_REF] Camenisch | An efficient system for non-transferable anonymous credentials with optional anonymity revocation[END_REF] (see Section 3.2 for more details). In particular, we call the owner of the privacy-preserving identity card, the user (who is likely to be a simple citizen such as Alice). The Registration Authority (RA) is a legal entity (such as the city hall) that can check the personal information of the user and register the request for a privacy-preserving identity card. The Certification Authority (CA) is a trusted third party (for instance the government) that will sign the information transmitted by the RA to certify its validity. Once the card has been issued, the RA and CA are no longer involved in the picture except if the user needs a new card or if there is a valid reason for lifting the anonymity of the user. An organization is an entity that can grant access to some of its resources to the user. (For example, in Scenario 1 an organization could be the immigration services, the theater or an airline company.) A verifier belongs to one organization and interacts with the user to check his right of access to the resources of this organization. In practice, the verifier is usually a smartcard reader device connected to the network of the organization that can communicate with the privacy-preserving identity card.

As illustrated in Scenario 1, ideally the privacy-preserving identity card should fulfill the following properties:

-No personal information leakage: in order to protect the privacy of the user, the card should disclose as little information as possible about him. Ideally, the only thing the card should reveal is one bit of information proving (or disproving) a binary statement concerning the user. -Unlinkability: it should not possible to trace and link the actions of the user of the card. For instance, even if the user proves the same statement at different occasions, it should be impossible to link the different statements as being made by the same user. -Ownership proof : only the legitimate user should be able to use his privacypreserving identity card to prove statements about himself to other entities. This means that some authentication mechanism has to take place between the user and the card. The purpose of this authentication step is to avoid an unauthorized use of the card. This authentication mechanism should also guarantee the non-transferability of the card. Otherwise, the user could sell for some money the use of his privacy-preserving identity card to somebody else, thus transferring his privileges or even his identity to illegitimate users. -Authenticity: some mutual authentication has to be performed between the card and the reader device in order to prevent the possibility of an adversary impersonating the role of a valid privacy-preserving identity card or a valid reader. This authentication will involve two-way communication between the identity card and the reader and will assert the authenticity of both the card and the reader. -Correctness: a binary statement proven by the user with the help of the privacy-preserving identity card should always5 be valid. For instance, the user should never be able to prove false statements about himself by cheating the system (soundness property). Moreover if the verifier is honest, he should always accept a binary statement about the user provided that this statement is true and the user possesses the corresponding credentials (completeness property). -Unforgeability: in order to avoid someone counterfeiting the identity card and usurping the role of the user, the card should be tamper-proof and have an inherent ability to resist hardware and logical attacks.

Apart from these fundamental requirements, the privacy-preserving identity card may also respect some additional properties such as:

-Optional anonymity removing: the actions of the user should stay anonymous at all times, except in some scenarios where it might be necessary to remove his anonymity for serious reasons. For instance in an extreme situation, it could happen that a crime (such as a murder) has been perpetrated in a room that has been accessed by only one person using a privacy-preserving identity card. In this situation, the certification authority and the verifier may want to collaborate in order to lift the anonymity of this person. On the other hand, although the possibility of lifting the anonymity is desirable in some scenarios, it could decrease the confidence of the user in his belief that his privacy will really be protected by the card. -Explicit consent: in order to increase the trust of the user in the system, the card could monitor the questions that it has been asked and display them to the user. It is even possible to imagine, that for some questions that are deemed critical regarding the privacy of the user, his confirmation may be asked before the privacy-preserving identity card replies to the question.

Enabling technologies

Enforcing in reality the properties of the privacy-preserving identity card require the combination of several hardware and cryptographic techniques that we briefly review in this section.

Smartcards

A smartcard is a plastic card with an embedded integrated circuit that contains some dedicated memory cells and a microprocessor that can process data stored in the memory cells or exchanged with a reader through serial link connections (for contact smartcards), or through radio links (for contactless smartcards). The memory cells can only be accessed by the microprocessor. The main purpose of the smartcard is to assure the confidentiality and integrity of the information stored on the card. For that, the smartcard must satisfy inherent tamper-proof properties (to protect the microprocessor and the memory) as well as some resistance against physical attacks and side-channel analysis6 [START_REF] Batina | Side-channel issues for designing secure hardware implementations[END_REF]. As in cryptology, there is a ongoing race in the smartcard world between the developers of attacks and the designers of counter-measures (see [START_REF] Ravi | Tamper resistance mechanisms for secure embedded systems[END_REF] for instance). Nowadays, smartcards are widely used around the world, especially in mobile phones, tokens for public transport systems or for other applications such as electronic payments. Until now, smartcards used in practice have relied mostly on symmetric encryption (by using algorithms such as triple DES or CRYPTO-1) 7 . Calmels, Canard, Girault and Sibert have recently suggested to move instead to asymmetric encryption in the future for RFID tags, both for security and practical reasons [START_REF] Calmels | Low-cost cryptography for privacy in RFID systems[END_REF]. They have also described a low-cost version of a group signature scheme thus demonstrating that such cryptographic primitive are within the reach of inexpensive smartcard technologies.

Anonymous Credentials

An anonymous credential is a cryptographic token which allows a user to prove statements about himself anonymously to verifiers anonymously. Anonymous credentials are generally based on zero-knowledge type of proofs [START_REF] Goldreich | Proofs that yield nothing but their validity for all languages in NP have zero-knowledge proof systems[END_REF] and enable the user to prove his accreditation to the verifier without revealing any additional information (such as his identity). The first system of anonymous credential is due to Chaum [START_REF] Chaum | Security without identification: transaction systems to make Big Brother obsolete[END_REF] and is based on the idea that each organization might know the same user by a different pseudonym. The organizations cannot combine their data on a particular user because they are unable to link two different pseudonyms to the same person. Private credentials can be derived from other credentials and used to prove relationships between credentials/attributes/organizations without having the risk of linking the different pseudonyms. For instance, Alice might want to prove anonymously to the public transport company that she is a student in order to get a discount on monthly travel fees. In this example, Alice wants to transfer her credentials granted by the university (organization A) to the public transport company (organization B) without revealing her identity.

Credentials can be one-show (as it is the case for e-cash) or multiple shows. When a user shows multiple times the same credential, this raises the concern of linkability if several actions can be traced to a unique user (even anonymous). One possibility for preventing this is to issue multiple one-show credentials to the same user. Another solution is to use a group signature scheme which allows multiple-show unlinkability. Group signature schemes [START_REF] Chaum | Group signatures[END_REF] have been introduced by Chaum and van Heyst to provide anonymity to the signer of the message. For that, there is a single public verification key for the group, but each member of the group receives a different private signing key from the group manager (who could be for instance the CA). A group signature scheme (with optional anonymity removing) consists in general of the four following operations:

-Registration of the user. During the Join operation, the CA assigns to the user a new private signature key, which we denote by SKG U . -Signature of a message in behalf of the group. The SignGroup operation takes as input a message m and signing key SKG U and produces a signature σ G,U (m) on this message. -Verification of a group signature. The VerifySignGroup operation allows to check the validity of a group signature. It requires as input a verification key for the group V KG, which has been setup by the CA and is publicly known, as well as a message m and a group signature on this message σ G,U (m).

VerifySignGroup produces as output either accept or reject depending on the validity of the signature. -Anonymity removing. From the point of view of the verifier, it is impossible to distinguish if two group signatures come from the same individual or not. However in exceptional situations, the CA can (in association with the verifier) retrieve the identity of a particular signer via the LiftAnonymity operation. This operation takes as input a message m and a group signature on this message σ G,U (m) and produce as output the identity of the signer U. In practice, this is often done by first finding the corresponding signature key SKG U and then retrieving the identity associated to this key.

Another possibility for implementing anonymous credentials is to use a noninteractive zero-knowledge proof [START_REF] Belenkiy | P-signatures and noninteractive anonymous credentials[END_REF] in combination with a commitment scheme. A commitment scheme is characterized by two operations:

-Commitment phase. During this phase, the Commit operation takes as input a value a and some auxiliary information aux (which corresponds generally to some form of randomness) and produces comm(a) which is a commitment to this particular value a. -Opening phase. The Open operation takes as input a commitment comm(a)

and some auxiliary information aux and reveals as output a, the committed value.

A commitment scheme is perfectly binding if there is only one a that corresponds to a particular commitment comm(a) (i.e., an adversary cannot open a commitment to several values), and computationally hiding if an adversary with bounded computational power cannot open a particular commitment without access to the auxiliary information. Suppose that a prover stores a particular value a and the CA's signature on it, σ CA (a), which certifies its validity. The prover may want to show that this value respects a particular binary statement f to a verifier in a zero-knowledge manner. To realize that, the prover sends to the verifier comm(a) ← Commit(a, aux), which is a commitment to the value a. Then, the prover issues π ← Prove((a, σ CA (a), aux)|VerifySign(a, σ CA (a), V K CA ) = accept∧a = Open(comm(a), aux)∧f (a) = true), which is a non-interactive zeroknowledge proof that the prover knows (a, σ CA (a),aux) such that (1) σ CA (a) is a valid signature of the CA on a (verified by V K CA , the public verification key of the CA); and (2) the committed value of comm(a) is effectively a; and (3) the value a respects the binary statement f .

Biometric Authentication

The biometric profile of a person is composed of a combination of some physical features that uniquely characterize him. For instance, a biometric feature can be a fingerprint or a picture of the iris. The biometric data of an individual is a part of his identity just as his name or his address. As such biometrics can be used for the purpose of identification (i.e., identifying a particular individual in a list of registered people) or authentication (verifying that the person claiming an identity is indeed the one who has been registered with this identity).

In order to verify that an individual corresponds to some registered biometric profile, a fresh sample of his biometric data is generally taken and compared with the stored template using a matching algorithm. The matching algorithm computes a dissimilarity (or distance) measure 8 that indicates how far are the two biometric samples. Two biometric samples are considered to belong to the same individual if their dissimilarity is below some well-chosen threshold, which is dependant of the natural variability within the population. A good biometric strategy tries to find a compromise between false acceptance rate or FAR (wrongly recognizing the individual as a particular registered user) and the false rejection rate or FRR (being unable to recognize the registered user). An example of biometric data is the picture of the iris that can be transformed/coded into a vector of 512 bytes called the IrisCode. Afterwards, it is fairly simple to evaluate the dissimilarity between two codewords simply by computing the Hamming distance between these two vectors. In practice, this method can lead to very low rates of false acceptance (< 0.1%) and false rejection (< 1%).

As the biometric features of an individual is an inherent part of his identity, several techniques have been developed to avoid storing explicitly the biometric profile while keeping the possibility of using it for authentication. For instance, the main idea of cancellable biometrics [START_REF] Ratha | Enhancing security and privacy in biometrics-based authentication systems[END_REF] is to apply a distortion to the biometric template such that (a) it is not easy to reconstruct the original template from the distorted version and (b) the transformation preserves the distance between two templates. Other techniques have been proposed which combine the use of error-correcting codes and hash function such as the fuzzy commitment scheme [START_REF] Juels | A fuzzy commitment scheme[END_REF]. Let b be the biometric profile of the user. For the sake of clarity, we assume that b can be represented as a binary vector of length n (i.e., b ∈ {0, 1} n ) 9 . An error-correcting code C of size n is chosen such that it can correct up to t errors where t is chosen empirically so as to lead to a good trade-off between the FAR and the FRR. A hash function h is also used by the protocol. The fuzzy commitment scheme [START_REF] Juels | A fuzzy commitment scheme[END_REF] can be applied to biometric authentication on a smartcard, with two operations:

-Enrollment phase. During this phase, the biometric template b is measured through the Enroll operation. A codeword c is drawn uniformly at random from C and z = c ⊕ b is computed. The hashed version of this codeword h(c) as well as z are stored on the card. -Verification phase. When the card wants to verify that the user is the owner of the card, the biometric sensor device10 measures a fresh biometric sample b ′ and sends it to the card at the beginning of the Verify operation. Afterwards, the card computes z ⊕ b ′ and decodes this towards the nearest codeword c ′ . The card then calculates h(c ′ ) and accepts the user if h(c ′ ) = h(c) and rejects him otherwise.

In the same spirit as the fuzzy commitment scheme, a cryptographic primitive known as fuzzy extractor has been developed in the recent years (see for instance the survey [START_REF] Dodis | Fuzzy extractors, a brief survey of results from 2004 to 2006[END_REF]). This primitive allows to extract a uniformly distributed random string rand ∈ {0, 1} l 11 from a biometric template b in a noise-tolerant manner such that if the input changes to some b ′ close to b (i.e. dist(b, b ′ ) < t), the string rand can still be recovered exactly. When initialized for the first time, a fuzzy extractor outputs a helper string called p ∈ {0, 1} * , which will be part of the input of subsequent calls to the fuzzy extractor in order to help in reconstructing rand. The string p has the property that it can be made public without decreasing the security of rand. Formally, a fuzzy extractor consists of two operations:

-Generation phase. During the first use of the fuzzy extractor, the operation Generate takes as input a biometric template b and produces as output a uniform random string rand and a helper string p. -Retrieval phase. The operation Retrieve takes as input a biometric profile b ′ which is close to the original profile b (i.e. dist(b, b ′ ) < t) as well as the helper string p and produces as output the random string rand.

One application of fuzzy extractors is the possibility of using the biometric input of the user as a key to encrypt and authenticate the user's data. For instance, rand can act as an encryption key which can be retrieved only by the combination of the user's biometric profile and the helper string. As rand is never explicitly stored and the user's biometrics acts as a key, this guarantees that only if the correct biometric template is presented, the record of the user can be decrypted.

Operation and Use of the Privacy-preserving Identity Card

We suppose that the privacy-preserving identity card is a contact smartcard that has sufficient resistance against physical and logical attacks 12 (see Section 3.1).

The smartcard contains a processor that can compute efficiently cryptographic primitives such as asymmetric encryption and group signature verification. The card memory stores identity data similar to those printed on existing identity cards (e.g., names, date and location of birth, address, etc.), plus biometric data and other security-related information, such as public and private keys. When the smartcard is inserted into a reader device, the smartcard processor initiates a mutual authentication between the card and the reader. This phase involves using a group signature and a simple signature scheme. First, the card generates dynamically a pair of public and secret keys for the session and sends the public key along with the corresponding signature (obtained by using its private signature key of the group) to the reader. The reader checks the validity of the signature on the session public key by using the verification key of the group signature. This session public key will be used by the reader to encrypt the information it sends to the card during this session. Afterwards, the reader proves to the card that it is an authentic reader by showing that it possesses a valid credential signed by the CA. The questions that the reader is allowed to ask to the card are also part of this credential, as well as the public key of the reader that the card will use afterwards to encrypt the information it sends to the reader. The reader also sends a random challenge to the card. Then, the card proves to the reader that it is an authentic card by showing that it belongs to the group of valid smartcards/users, more precisely, by signing the random challenge issued by the reader with its private signature key (see Section 3.2).

If the mutual authentication fails, the smartcard is not activated (i.e., its processor does nothing). Contrarily, when the mutual authentication succeeds, the embedded processor initiates a biometric verification of the user, by using for instance the fuzzy commitment scheme for biometric authentication described in Section 3.3. Finally, when the biometric authentication is successful, the processor initiates a question-response protocol with the reader device. In pratice, the question of the reader could be any binary query related to an attribute of the user such as:

-"Is the user a Finnish citizen?" (for instance when crossing the border), -"Is the user under 18 years old?" (when proving that the user is within some age interval), -"Is the user firstname Alice?" (when checking the identity before boarding a plane) or -"Is the user an inhabitant of Toulouse?" (when accessing a local service restricted to municipality residents).

The question could also concern a combination of different attributes of the user (for instance "Is the user under 18 years old AND an inhabitant of Toulouse?").

If the question-response protocol is implemented through an anonymous credential system that is expressive enough to prove any combination of the logical operations AND, OR and NOT regarding the attributes of the user then it is possible in principle to check any particular binary statement regarding his identity 13 . Note that in any case, the card discloses no personal data, only a binary statement on data provided by the reader, i.e., data that already exist out of the card. For instance, for checking the first name Alice, this information must be sent by the reader to the card, either because the user has claimed it, or because it has been read on another document such as a boarding pass. The card signs the answer to the question and returns it encrypted with the public key of the reader, in such a way that it forbids a potential eavesdropper to learn this answer or to tamper with it.

Basic Implementation

The first implementation of the privacy-preserving identity card that we proposed combines the different technologies and concepts briefly reviewed in Section 3. We call it BasicPIC, which stands for Basic implementation of a Privacypreserving Identity Card (PIC). In this implementation, we suppose that the smartcard tamperproofness is "sufficient". In practice however, it is quite likely that if an adversary spends enough resources and time he will be able to break the tamper proof characteristics of the smartcard and read and/or modify the information stored on it. We address this issue by proposing a more complex implementation, called ExtendedPIC, in the next Section.

Initialisation

When the user wish to acquire a new privacy-preserving identity card, he goes to an Registration Authority (RA) who can verify the personal data of the user and register the demand. We denote by a 1 , . . . , a k , the k attributes of the user that embodies his identity. For instance, the i th attribute a i could be a name (string of characters value), a year of birth (integer value) or an address (mix of strings of characters and integers). After having checked the identity of the user, the RA scans the biometric profile of the user b (which could be for instance his fingerprints, the map of his iris or the template of his voice) and computes h(c), z ← Enroll(b), where z = b ⊕ c for c a random codeword of C and h(c) a hashed version of it. The RA sends z and h(c) in a secure manner along with the personal information of the user to the Certification Authority (CA). The secure transmission of the personal information of the user between the RA and the CA is done by communicating over an electronic secure channel or via a physical delivery whose process is under strict monitoring. The CA is responsible for issuing the privacy-preserving identity card. The CA performs the Join operation (see Section 3.2) to generate the signing key SKG U of the user for the group signature. This key is stored within the tamperproof smartcard that is the core of the privacy-preserving identity card. The attributes of the user a 1 , . . . , a k as well as z, h(c) and V K CA (the public verification key of the CA) are also stored inside the card. For an external observer, the card is "blank" and looks exactly the same as any other privacy-preserving identity card. The exact form of the smartcard can vary, depending on the chosen trade-off between the individual cost of each card that we are willing to spend and the assumptions we make on the time and means that the adversary is able to deploy. If the technology is affordable, the card could possess a biometric sensor14 and a screen. The screen could display for instance the identifier of the reader and the questions asked to the card.

Before an organization can use a reader device able to interact with privacypreserving identity cards, the organization needs first to register the device to the CA. The CA then emits a credential cr in the form of "This reader is allowed to ask the question f to a privacy-preserving identity card. The answer to this question has to be encrypted using the public encryption key EK R .". The public encryption key EK R is supposed to be specific to the reader and as such can be considered as its identifier. The CA will certify this credential by performing Sign(cr, SK CA ) which generates σ CA (cr), the signature on the credential cr using the CA secret key. The reader also knows the group verification key V KG which is public and will be used to check the authenticity of a privacy-preserving identity card during the group signature.

Mutual Authenticity Checking

Before the card will answer to questions of a particular reader, it needs to ensure that 1) the reader is an authentic device and 2) it possesses the corresponding credentials. On the other hand, the reader has to check that the card is a genuine privacy-preserving identity card but without learning any information related to the identity of the card or its user. Regarding the scheme used for signing the credential, any standard signature scheme such as DSA or ECDSA can be used to implement this functionality in practice. Efficient implementation of group signature with optional anonymity withdrawal exist such as the Camenish-Lysyanskaya signature scheme [START_REF] Camenisch | A signature scheme with efficient protocols[END_REF] which is proven secure in the random oracle model under the strong RSA assumption. The mutual authenticity checking protocol consists in three rounds of communication:

1. During the first round, the card generates dynamically for the session a pair of encryption/decryption keys (EK temp , DK temp ). The public encryption key EK temp will be used by the reader to secure the communication it sends to the card during this session while the decryption key DK temp is kept secret. The card also computes σ G,U (EK temp ) ← SignGroup(EK temp , SKG U ), which corresponds to a group signature on the encryption key EK temp . The card sends in clear EK temp and σ G,U (EK temp ) to the reader. The reader will consider the group signature as valid (and proceed to the second round) if VerifySignGroup(EK temp , σ G,U (EK temp ), V KG) outputs accept or aborts the protocol otherwise. 2. During the second round, the reader uses the card's public key to encrypt its credential cr, the signature of the CA on this credential σ CA (cr) as well as a randomly generated string of bits r, and sends this encrypted message to the card. The card performs VerifySign(cr, σ CA (cr), V K CA ) and either accept the reader and goes to the third round, or reject and aborts the protocol. The card should have a built-in mechanism that limits the number of attempts that a reader may try within some time window. 3. During the third round, the card computes σ G,U (r) ← SignGroup(r, SKG U ), which corresponds to a group signature on the random string of bits r. Afterwards, the card sends to the reader the cipher ciph ← Encrypt(σ G,U (r), EK), where ciph corresponds to the encryption of the message σ G,U (r) with the public key EK. Finally, the reader decrypts this message by performing Decrypt(ciph, DK) which reveals σ G,U (r). If VerifySignGroup(r, σ G,U (r), V KG) has for outcome accept, the reader recognizes the card has a genuine one. Otherwise, the reader aborts the protocol.

Suppose that the reader stores in a list all the pairs of random strings and group signatures (r, σ G,U (r)) that he has seen along with other information such as a time stamp. As such this list is of no use for it to break the privacy of users as it is not even able to recognize if two different signatures belong to the same individual or not. However in some extreme situation where there is a clear necessity of lifting the anonymity of a particular signature, the reader may hand over the pair (r, σ G,U (r)) to the CA which will be able to retrieve SKG U by performing LiftAnonymity(r, σ G (r)) and thus also the identity of U .

Biometric Verification

The privacy-preserving identity card is activated by the verification of the biometrics of its user. During this phase, a fresh biometric sample b ′ of the user is acquired by the biometric sensor and sends to the card which then performs the Verify operation upon it. This operation consists in computing z ⊕ b ′ , decoding this towards the nearest codeword c ′ and calculating h(c ′ ) to the card. The outcome of Verify is either accept or reject depending on whether or not h(c ′ ) = h(c). If the user passes the verification test, the card is considered activated and enter the question-response protocol. Otherwise, the card refuses to answer to external communication.

Question-Response Protocol

Let f (a i ) be the binary answer to a boolean question f about the attribute a i of the user (or a combination of attributes). For instance, the semantic of the bit f (a i ) could be true if its value is 1 and false if its value is 0. The question f as well as the public encryption key EK of the reader have been transmitted as part of the credential cr. First, the card concatenates the answer bit f (a i ) with the random string r sent by the reader during the mutual authentication phase to obtain f (a i )||r and signs it, which generates σ G,U (f (a i )||r). The card computes the cipher ciph ← Encrypt(f (a i )||r||σ G,U (f (a i )||r), EK), where ciph corresponds to the encryption of the message f (a i )||r||σ G,U (f (a i )||r) with the public key EK. Afterwards, the reader decrypts this message by performing Decrypt(ciph, DK) which reveals f (a i )||r and σ G,U (f (a i )||r). The reader first verifies the validity of the signature σ G,U (f (a i )||r) with the verification key of the group and believes the answer f (a i ) only if this verification succeeds. Note that in the implementation BasicPIC , the correctness of answer f (a i ) relies partly on the assumption that the card is tamperproof and therefore cannot be made to misbehave and lie to a question asked by the reader.

Consider an adversary that would like to play a relay attack by transmitting the communication normally between a genuine card and a genuine reader during the mutual authentication phase and then hijacks the session during the question-response protocol by acting as the card. If the answer bit was not signed with the private signature key of the card, the adversary could set the answer to the reader's question to his own choice.

The encryption scheme used has to be semantically secure 15 in order to avoid the possibility of an adversary having an advantage in guessing whether the an-swer of the card to the reader's question is 0 or 1. As a semantically secure encryption is necessary also probabilistic, this ensures that even if the card answers twice to the same question it will not be possible for an eavesdropper to distinguish whether these two answers where produced by the same privacy-preserving identity card or two different cards. In practice, this encryption scheme could be for instance the Cramer-Shoup cryptosystem [START_REF] Cramer | A public-key cryptosystem provably secure against adaptive chosen ciphertext attack[END_REF] which has been one of the first proven to satisfy the IND-CAA2 property.

Analysis of the Implementation

In this Section, we will describe informally why the implementation BasicPIC fulfills the desiderata of a privacy-preserving identity card (as listed in Section 2) and analyze its cost. In details, the implementation BasicPIC respects the following properties:

-No personal information leakage: due its tamper-proof aspect, the attributes describing the user are safely stored on the smartcard and only one bit of information regarding the user is revealed every time the card answers a question. -Unlinkability: the use of a group signature prevents the possibility of linking the proofs of two different statements to the same user. Moreover, there is no such thing as a pseudonym or an identifier used in our description of BasicPIC (with exception of the group signing key SKG U , which is never disclosed by the card). In particular, there is no identity card number, which could be used to trace all the card uses and the public key for the session EK temp is generated dynamically at random by the card and has no link with its identity. -Ownership proof : before its activation, the card will check that the current user is effectively the legitimate owner of the card by verifying his biometrics. -Authenticity: the reader will prove its authenticity and its right to ask a particular question by showing the corresponding credential signed by the CA. The card will prove its authenticity by showing that it can sign a randomly generated message on the behalf of the group of genuine privacy-preserving identity card. -Correctness: in this implementation, the correctness of a statement proven by the card relies mainly on the fact that the tamper-proof properties of the smartcard forbids a dishonest user from changing its designed behaviour. Indeed, the card can be seen as a kind of oracle that never lies to a question asked to it. To change the behaviour of the oracle would require breaking the smartcard, which would violate the tamper-proof assumption. Moreover as the answer is encrypted using a non-malleable asymmetric encryption scheme using the public key of the reader, it is impossible for a potential adversary to flip the answer bit without being detected. Finally, as the answer bit is signed

(see [START_REF] Shoup | Why chosen ciphertext security matters[END_REF] for instance). This property has been proven to also guarantee the nonmalleability property and thus the threat of an adversary flipping the bit of the answer transmitted.

with the key of the card, this prevents an adversary from impersonating a valid card during the question-response protocol. -Unforgeability: this property is ensured by the tamper-proofness of the smartcard, as well as by the verification of the credential issued by the CA. -Optional anonymity removing: in extreme situations, the anonymity of the actions of the user of a privacy-preserving identity card can be lifted by having the CA cooperating with a verifier and applying the LiftAnonymity operation on the corresponding pair of random string and associated signature. -Explicit consent: in most situations, the user expresses his consent by inserting his card in the reader: we can consider that, since the reader has to be certified by the CA, it is trustworthy enough, i.e., tamper proof and able to display correctly the question on a screen (part of the reader). Then if the user accepts the question, he just confirms it by pushing a switch, else he just withdraws his card from the reader. If the reader cannot be trusted and if the question can be too sensitive, the card should be equipped with embedded screen and switch.

Regarding practical considerations, the error-correcting codes used to construct the fuzzy commitment schemes generally admit efficient decoding procedures, which means that the decoding of z ⊕ b ′ towards the nearest codeword c ′ can also be done efficiently (even if the biometric sensor is directly integrated within the card). Efficient versions of group signatures for smartcards also exist and can be implemented with current technologies.

Extended Implementation

The main drawback of BasicPIC is that a great part of its security relies on the tamper-proof aspect of the smartcard. If this assumption is broken, for instance if the adversary is able to access the memory of the smartcard, this can greatly endanger security properties such as no personal information leakage, authenticity, unforgeability and correctness. To overcome this limitation, we propose in this section an extended implementation of the privacy-preserving identity card that we call ExtendedPIC. The main idea of this implementation is to complement the functionalities of BasicPIC with the use of fuzzy extractors to protect the information stored in the card and non-interactive zero-knowledge proofs as a privacy-preserving proof of statements related to the user's data.

Initialisation

The CA is responsible for signing the user's information in order to produce the anonymous credentials. The credentials emitted by the CA take the form of the CA's signature on the attributes of the user. Specifically, we denote these credentials by σ CA (a 1 ), . . . , σ CA (a k ), where σ CA (a i ) is the signature on the i th attribute of the user using the CA secret key. The operation of the fuzzy extractor Generate is performed on the biometric profile of the user b and produces as output a random string rand and an helper string p. The random string rand will be use as the key to encrypt 16 the attributes of the user, a 1 , . . . , a k , and the signatures of the CA on these attributes σ CA (a 1 ), . . . , σ CA (a k ). The attributes and their associated signatures are stored encrypted inside the card but the helper string p can be stored unprotected.

Although it would be also possible to store an encrypted version of the signing key of the user SKG U as well as z and h(c), we suppose for the sake of clarity that it is not the case and that the mutual authenticity checking as well as the biometric verification are performed in the same manner as in BasicPIC (Sections 5.2 and 5.3). In practice however, SKG U could also be encrypted using the key extracted from the fuzzy extractor, which requires that the biometric profile of the user is acquired first during the Retrieve operation in order for the mutual authenticity protocol to succeed. In this situation, it is possible to combine in a natural manner the biometric verification and the mutual authenticity checking into a single protocol. This protocol would fail if the biometric profile acquired during the Retrieve operation does not correspond to that of the valid owner of the card or if the card does not possess a valid private signature key SKG U17 .

Privacy-preserving Proof of Statements

In our setting, the card wants to prove to the reader some function related to the attributes of the user and also that these attributes have been signed (certified) by the CA. However, we want to go beyond simply sending an answer bit, by issuing a zero-knowledge proof. This can be done as follows:

1. We suppose that the binary question asked by the reader is related to the i th attribute of the user. The card performs Retrieve by taking as input a fresh biometric sample of the user b ′ and the helper string p stored on the card. The output of the Retrieve operation is the random string rand which is used as a key to decrypt the values of the attribute a i and its associated signature σ CA (a i ) from their encrypted versions stored on the card. 2. The card computes comm(a i ) ← Commit(a i , aux), where comm(a i ) is a commitment on the value of the i th attribute a i and aux is some auxiliary information needed to open the commitment. In practice, we propose to use the Groth-Sahai commitment scheme [START_REF] Groth | Efficient non-interactive proof systems for bilinear groups[END_REF], which is perfectly binding (thus forbidding that the card can change afterwards the value of the attribute committed and therefore prove a false statement) and computationally hiding (thus preventing a reader to learn the value of the attribute committed unless he can break some computational assumption).

The card computes

π ← Prove((a i , σ CA (a i ), aux)|VerifySign(a i , σ CA (a i ), V K CA ) = accept ∧ a i = Open(comm(a i ), aux) ∧ f (a i ) = true)
, where V K CA is the public verification key of the CA that can be used to check the validity of the CA's signature, σ(a i ) is the signature by the CA of attribute a i and f (a i ) is a boolean question regarding a i . Effectively, π is a non-interactive zero-knowledge proof of the following statement "The user of this privacypreserving identity card knows how to open the commitment comm to some value a i , and this value has been signed by the CA, and when the boolean function f is computed on a i it returns true" which could be summarized as "The CA certifies that the user of this privacy-preserving identity card satisfies the boolean question f when it is applied on his th attribute". The boolean question f could be any binary property related to an attribute of the user. The idea of using a zero-knowledge proof can also be extended so as to prove a binary statement regarding several attributes at the same time, such as a conjunction. 4. The card sends Encrypt(comm||π, EK) to the reader which then decrypts it and verifies the validity of the proof and outputs accept or reject.

For the practical implementation of the privacy-preserving proof of statements, we suggest to use the recent non-interactive zero-knowledge proofs developed by Belenkiy, Chase, Kohlweiss and Lysyanskaya [START_REF] Belenkiy | P-signatures and noninteractive anonymous credentials[END_REF]. These proofs are an extension of the CL-signatures [START_REF] Camenisch | A signature scheme with efficient protocols[END_REF] and have been proven secure on the common reference string model. These non-interactive zero-knowledge proofs are based partly on the Groth-Sahai commitment scheme [START_REF] Groth | Efficient non-interactive proof systems for bilinear groups[END_REF] that has some interesting non-trivial properties such as being f -extractable, which means it is possible to prove that the committed value satisfies a certain property without revealing the value itself, and allows randomizability, which means that a fresh independent proof π ′ of the same statement related to the committed value can be issued from a previous proof π of this statement. In the context of the privacy-preserving identity card, the f -extractability property allows to show that an attribute of the user satisfies some binary property without disclosing the attribute itself whereas the randomizability property ensures that even if the card prove several times the same statement, the reader will see each time a different proof of this statement, thus avoiding the risk of linkability between them.

Analysis of the Implementation

The implementation ExtendedPIC fulfills the desiderata of a privacy-preserving identity card as it respects the following properties:

-No personal information leakage: the attributes of the user are stored in the smartcard encrypted and can only be decrypt if the user biometric profile is presented as input to the fuzzy extractor in conjunction with the helper string. Moreover, the card answers to a question of the card by showing a non-interactive zero knowledge proof which leaks nothing but one bit of information about the validity of a particular binary statement.

-Unlinkability: the use of a group signature prevents the possibility of linking the proofs of two different statements to the same user. Moreover, there is no such thing as a pseudonym or an identifier used in our description of ExtendedPIC (with exception of the group signing key SKG U , which is never disclosed by the card). The randomizability property of the non-interactive zero-knowledge proof also ensures that even if the card proves several times the same statement, the proofs generated will be different and look as if they were independent. -Ownership proof : before its activation, the card will check that the current user is effectively the legitimate owner of the card by verifying his biometrics.

The biometric template of the user is also used as input to the fuzzy extractor when it is time to decrypt the data stored on the card during the privacypreserving proof of statements. -Authenticity: the reader will prove its authenticity and its right to ask a particular question by showing the corresponding credential signed by the CA. The card will prove its authenticity by showing that it can sign a randomly generated message on the behalf of the group of genuine privacypreserving identity card, and also indirectly by showing the non-interactive zero-knowledge proof that it possesses the signature of CA on the attributes of the user. -Correctness: the correctness of a statement proven by the card is a direct consequence of the soundness and completeness properties of the non-interactive zero-knowledge proof used. Moreover as the answer is encrypted using a nonmalleable asymmetric encryption scheme using the public key of the reader, it is impossible for a potential adversary to flip the answer bit without being detected. -Unforgeability: this property is ensured by the tamper-proofness of the smartcard, as well as the fact that the data of the user is stored encrypted on the card, plus by the verification of the credential issued by the CA and the signatures of the CA on the attributes of the user. -Optional anonymity removing and explicit consent: these properties are ensured in the same manner than for the implementation BasicPIC (see Section 5.5 for more details).

Possible extensions and Conclusion

Potential applications of the privacy-preserving identity card may include access to online services such as e-government services. In this context, the card could be plugged to a standard personal computer via an external trusted USB reader certified and sold by the government. In this case, all the communication between the reader and the e-government platform hosting the online services should be encrypted to prevent potential information leakage, e.g. to a spyware that would have infected the user's personal computer. Of course, in this virtual context it may more difficult for a user to keep an explicit control on how his data are used and we may have to cope with more threats than in the simple card-reader interaction scenario.

A possible extension to the privacy-preserving identity card is to embed it directly in a device such as a cellular phone. Of course, this raises the question of how much trust can be put in such a device. Another extension is to use the privacy-preserving identity card as an electronic wallet by drawing on techniques such as one-use credentials. In such a scenario, the content of the card could be updated regularly via a terminal that is certified by the CA. For instance, when Alice buys a ticket concert from a vending machine she could upload the corresponding one-time credential on her privacy-preserving identity card.

Such extensions would require an in-depth security analysis to ensure that they can be safely integrated in a privacy-preserving identity card. But with the basic and extended implementations that we have described in Sections 5 and 6, it is technically feasible to develop and deploy a privacy-preserving identity card with currently available technologies. Whether governments and law enforcement authorities would accept such a card to be deployed is another question.

The data minimization principle states that only the information necessary to complete a particular application should be disclose (and no more). This principle is a direct application of the legitimacy criteria defined by the European data protection directive (Article 7, [14]).

[START_REF] Batina | Side-channel issues for designing secure hardware implementations[END_REF] The data sovereignty principle states that the data related to an individual belong to him and that he should stay in control of how these data are used and for which purpose. This principle can be seen as an extension of many national legislations on medical data that consider that a patient record belongs to the patient, and not to the doctor that creates or updates it, nor to the hospital that stores it.

In this paper, we use the word "user" to denote at the same time both the owner and the effective user of the card. Indeed as the user needs to authenticate to the card before he can use it, the user of the card will effectively always be also his owner.

https://www.prime-project.eu/

In this paper when we use the terms "always" or "never", it means respectively that this event occurs or does not occur, except with negligible probability (for instance exponentially small with respect to a security parameter). In the same manner, in all this paper we consider that an adversary has only bounded computational power.

The same kind of tamper-proofness techniques can be applied to USB keys, smartcard readers or other hardware devices for similar purposes.

[START_REF] Camenisch | An efficient system for non-transferable anonymous credentials with optional anonymity revocation[END_REF] This assertion is true at least for low-cost smartcards, even if public-key cryptosystems are available on many more smartcards, including JavaCards.

The dissimilarity measure used can be for instance the Hamming distance, the set difference or the edit distance.

In practice, this might not be true when the matching of templates relies on geometric information (for instance in fingerprints), in which case the error-correcting approach has to be adapted to this situation.

Such a sensor can be implemented on the privacy-preserving identity card itself, but in practice it may also be part of the smartcard reader device.

In the basic version l, the length of the random string generated, is smaller than n, the length of the biometric profile. However, this is not really a problem as it is possible to use rand as a seed of a good pseudorandom number generator to generate an almost uniformly random string of arbitrary size.

We also assume that the smartcard reader device that will interact with the privacypreserving identity card possesses similar tamper-proof properties.

See for instance[START_REF] Camenisch | Efficient attributes for anonymous credentials[END_REF] for an efficient implementation of anonymous credentials that allowed to prove AND, OR and NOT statements regarding the attributes encoded.

Some companies, such as Novacard, have started to sell smartcard integrating a fingerprint sensor directly on the card since at least 2004. If the privacy-preserving card is integrated within the cell-phone of the user, it is also possible to imagine that iris recognition could be easily implemented if the cell-phone possesses a camera.

Ideally, the encryption scheme should even fulfill a stronger security requirement called indistinguishability under adaptive chosen ciphertext attack (IND-CCA2)

For example, the encryption scheme used can be a symmetric scheme where rand acts as the key for encrypting and decrypting data. For instance l, the size in bits of rand can be set to be the size of an AES key (128 or 256 bits).

An additional benefit of this protocol is to remove the need of using the fuzzy commitment scheme.

Acknowledgments

We would like to thanks the anonymous experts who reviewed a previous version of the paper for their insightful comments which have helped us improve the quality of this paper.


Bram Van Der Linden

Tadeus Hogenelst

Roland Bliem

Kateřina Dohnalová

Corentin Morice

Electronic and structural properties of crystalline and amorphous (TaNbHfTiZr)C from first principles

ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

I. INTRODUCTION

Disorder in solids can be present in various forms. Usually, the concept is associated with structural disorder, which starts with defects in single crystals and culminates in liquid-like, glassy assemblies of atoms. The lack of long-range structural order in amorphous solids causes the electronic structure of a material, as well as the mechanical, optical, thermal or magnetic properties to differ notably from those of crystalline solids [START_REF] Suryanarayana | Bulk Metallic Glasses[END_REF][START_REF] Trexler | Mechanical properties of bulk metallic glasses[END_REF][START_REF] Hunderi | Optical properties of disordered and amorphous metal films[END_REF][START_REF] Stachurski | On structure and properties of amorphous materials[END_REF]. In particular, amorphous alloys show superior corrosion resistance [START_REF] Scully | Corrosion and related mechanical properties of bulk metallic glasses[END_REF][START_REF]Esca study of the passive film on an extremely corrosion-resistant amorphous iron alloy[END_REF], mechanical strength [START_REF] Chen | Glassy metals[END_REF][START_REF] Gilman | Metallic glasses[END_REF], and low permeability for diffusion [START_REF] Barbour | Amorphous ni-zr alloys as barriers for self-diffusion[END_REF].

Another type of disorder that can strongly affect the properties of a solid is configurational disorder, which is best illustrated by the example of the novel class of highentropy materials (HEMs), compounds with five or more principal elements [START_REF] Cantor | Microstructural development in equiatomic multicomponent alloys[END_REF][START_REF] Yeh | Nanostructured High-Entropy Alloys with Multiple Principal Elements: Novel Alloy Design Concepts and Outcomes[END_REF]. Distributing this large number of constituent elements among well-defined positions of a crystalline lattice allows the material to maximize its configurational entropy, resulting in a tendency to form a single-phase solid solution. The properties of HEMs have been shown experimentally to be superior to the superposition of its constituents [START_REF] Braic | Nanostructured multi-element (TiZrNbHfTa)N and (TiZrNbHfTa)C hard coatings[END_REF][START_REF] Castle | Processing and properties of high-entropy ultra-high temperature carbides[END_REF]. The remarkable effect of configurational disorder was first demonstrated for metallic alloys [START_REF] Cantor | Microstructural development in equiatomic multicomponent alloys[END_REF][START_REF] Yeh | Nanostructured High-Entropy Alloys with Multiple Principal Elements: Novel Alloy Design Concepts and Outcomes[END_REF], but further extends to ceramic materials (e.g. carbides, oxides or silicides) [START_REF] Oses | High-entropy ceramics[END_REF]. High-entropy ceramics typically consist of two sublattices: an ionic or covalent backbone (e.g. C, O, or Si) with an interstitial lattice occupied by five or more principal elements, typically metals. For example, in a rocksalt high-entropy metal carbide (HEMC) all metals occupy the central sites in octahedra of an fcc lattice of carbon, but their arrangement on this sublattice is random. Experimental and computational studies [START_REF] Oses | High-entropy ceramics[END_REF] suggest that HEMCs have excellent application-oriented properties. One such example is (TaNbHfTiZr)C that exhibits a great combination of phase purity and stability [START_REF] George | High-entropy alloys[END_REF][START_REF] Harrington | Phase stability and mechanical properties of novel high entropy transition metal carbides[END_REF], as well as predictions of enhanced hardness [START_REF] Sarker | High-entropy high-hardness metal carbides discovered by entropy descriptors[END_REF][START_REF] Wang | Enhanced hardness in high-entropy carbides through atomic randomness[END_REF] and low thermal conductivity [START_REF] Yan | Hf0.2Zr0.2Ta0.2Nb0.2Ti0.2)C high-entropy ceramics with low thermal conductivity[END_REF].

In addition to the effects of configurational disorder, structural disorder is recognized to have a strong influence on materials properties and is often used intentionally to adjust the performance of a material to its application. In cases of materials without configurational disorder, such as, e.g., structurally disordered transition metal carbides, tuneable [START_REF] Sánchez-López | Tribological behaviour of titanium carbide/amorphous carbon nanocomposite coatings: from macro to the micro-scale[END_REF] tribological properties have been demonstrated, as well as functionality for energy storage applications [START_REF] Bi | Multilayered zr-c/a-c film on stainless steel 316l as bipolar plates for proton exchange menbrane fuel cells[END_REF]. In many cases such disordered carbides are not amorphous at the atomic scale but have a composite structure of nanocrystalline metal carbide particles embedded in amorphous graphite [START_REF] Lewin | Sputter deposition of transition-metal carbide films -a critical review from a chemical perspective[END_REF][START_REF] Folkenant | Synthesis and Characterizations of Amorphous Carbide-based Thin Films[END_REF][START_REF] Nedfors | Structural, mechanical and electrical-contact properties of nanocrystallinenbc/amorphous-c coatings deposited by magnetron sputtering[END_REF][START_REF] Zhao | Microstructure evolution, wear and corrosion resistance of cr-c nanocomposite coatings in seawater[END_REF][START_REF] Magnuson | Electronic structure and chemical bonding of nanocrystalline-tic/amorphous-c nanocomposites[END_REF]. The addition of weak carbide-forming alloying elements aids in the full amorphization of these materials [START_REF] Lewin | Sputter deposition of transition-metal carbide films -a critical review from a chemical perspective[END_REF]. Additionally, electronic and mechanical properties of amorphous transition metal carbides have shown to depend significantly on the bond distribution between C and metals [START_REF] Lewin | Sputter deposition of transition-metal carbide films -a critical review from a chemical perspective[END_REF][START_REF] Nedford | Characterization of amorphous and nanocomposite nb-si-c thin films deposited by dc magnetron sputtering[END_REF] and elastic moduli of amorphous coatings may be modified by changing the transition metal M [START_REF] Nedford | Characterization of amorphous and nanocomposite nb-si-c thin films deposited by dc magnetron sputtering[END_REF]. Compared to a single-crystalline structure, amorphous transition metal carbide coatings are considered less prone to cleavage fracture and decohesion of grain boundaries, reducing the brittleness of a functional coating by reduction of average bond energy [START_REF] Kaloyeros | Amorphous transition metal carbides[END_REF]. This indicates that modifying the level of disorder is a pathway to tune electronic and mechanical properties in transition metal carbide coatings. Disorder is thus highly relevant in applications, and the relation between disorder and material properties calls for its introduction as a design parameter.

In this work we investigate the effects of disorder on the mechanical properties and the electronic structure of high-entropy refractory metal carbides. Both configurational and structural disorder are introduced by studying the HEMC (TaNbHfTiZr)C in its crystalline and fully amorphous form at identical compositions. We approach the challenge to model amorphous systems from first principles using stochastic quenching [START_REF] Kádas | Structural properties of amorphous metal carbides: Theory and experiment[END_REF] and density functional theory (DFT) [START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF].

II. METHODS

For convenience, in this paper we use the same naming convention for (TaNbHfTiZr)C as in [START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF]. The crystal structure of crystalline (TaNbHfTiZr)C was modelled using 2 × 2 × 2 supercells in the rock-salt structure (Fig. 1 (a)), following [START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF]. Each supercell includes 32 transition metal atoms, and can therefore not be fully stoichiometric. For this reason we analyse several samples with small variations to the stoichiometry, to study how small variations in composition influence material properties. For this we randomly generated nine supercells with slightly different stoichiometries (see Table I), and also ran calculation on the supercell used in [START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF], for a total of 10 supercells.

To analyse the additional effects of structural disorder, we also generated ten amorphous supercells with exactly the same stoichiometry as their crystalline counterparts (e.g. Fig. 1(b)). Amorphous structures were obtained using stochastic quenching [31], as follows: first, atoms were placed randomly in a cubic supercell with periodic boundary positions and a side length L = 9.04 Å, which is twice the lattice constant. To make sure that we keep the energy of supercells reasonably low, we constrained the distance between every two atoms to be larger than 0.4 Å [START_REF] Kádas | Structural properties of amorphous metal carbides: Theory and experiment[END_REF]. Second, we relaxed the atomic coordinates. To lower the cost of the ab-initio calculations, we used first a low-precision method -a steepest descent algorithm and a Mie potential [START_REF] González-López | Mechanical disorder of stickysphere glasses. i. effect of attractive interactions[END_REF]-to minimize the force on each atom, and set the convergence criterion to 10 -10 × f 0 where f 0 is the typical force, defined as

f 0 = 1 N k ∂U LJ (r k ) ∂r k 2 (1)
with r k the distance between two particles of pair k and N the number of atoms in the amorphous supercell. Final relaxation of the unit cell size and atomic coordinates, as well as calculation of the electronic properties, were performed using DFT, as implemented in CP2K [START_REF] Kühne | CP2K: An electronic structure and molecular dynamics software package -Quickstep: Efficient and accurate electronic structure calculations[END_REF] using the Perdew-Burke-Ernzerhof (PBE) exchangecorrelation functional [START_REF] Perdew | Generalized Gradient Approximation Made Simple[END_REF], the Goedecker-Teter-Hutter (GTH) pseudopotentials [START_REF] Goedecker | Separable dualspace Gaussian pseudopotentials[END_REF] and short range Gaussian basis functions [START_REF] Vandevondele | Gaussian basis sets for accurate calculations on molecular systems in gas and condensed phases[END_REF]. Four real-space grids were used, with a cut-off energy of the finest grid of 900 Ry and a cut-off controlling the distribution of products of Gaussians on the different grids of 60 Ry. Reciprocal space was sampled using a 3 × 3 × 3 Monkhorst-Pack grid [START_REF] Monkhorst | Special points for Brillouin-zone integrations[END_REF]. All the parameters were thoroughly tested for convergence.

Atomic positions and lattice parameters were relaxed using the conjugate gradient algorithm. The conver-gence criteria for the maximum and the root-mean square atomic force were set to 0.001 Ha/Bohr, and the ones for the difference with respect to the previous optimization step were set to 0.001 Bohr. In every crystalline and amorphous supercell, the atomic positions and cell size were relaxed at the same time, and the cells were required to remain cubic. Additionally, the pressure was converged to be (1 ± 10) atm after relaxation. Density of states (DOS) and bulk modulus calculations were performed at zero pressure.

Bulk moduli at zero-pressure were calculated by fitting the total energy as a function of the unit cell volume to the third-order Birch-Murnaghan equation of state [START_REF] Birch | Finite Elastic Strain of Cubic Crystals[END_REF][START_REF] Murnaghan | Finite Deformations of an Elastic Solid[END_REF]:

E(V ) = E 0 + 9V 0 B 0 16    V 0 V 2/3 -1 3 B 0 + V 0 V 2/3 -1 2 6 -4 V 0 V 2/3    ( 2
)
where E is the total energy of the supercell, V is the supercell volume, E 0 the equilibrium energy, V 0 the equilibrium volume, B 0 the zero-pressure bulk modulus, and B 0 its pressure derivative. Each supercell was set to five or seven different volumes around the equilibrium volume, to obtain a good fit to eq. 2.

We also calculated the DOS of the relaxed supercells. CP2K can only perform DOS calculations at the Γ-point, therefore we repeated the supercell three times in each Cartesian directions, which we found to be well converged. We used a Gaussian smearing with a standard deviation of 0.001 Ha.

III. RESULTS

III.1. Structural properties

The DFT-relaxed lattice constant for one rock-salt unit cell in the crystalline supercell was calculated to be (4.519 ± 0.006) Å. This is very close to the experimentally measured values 4.5084 Å [START_REF] Zhou | High-entropy carbide: A novel class of multicomponent ceramics[END_REF], 4.5180 Å [START_REF] Yan | Hf0.2Zr0.2Ta0.2Nb0.2Ti0.2)C high-entropy ceramics with low thermal conductivity[END_REF], 4.497 Å[41], 4.500 Å [START_REF] Sarker | High-entropy high-hardness metal carbides discovered by entropy descriptors[END_REF] and (4.60±0.3) Å [START_REF] Braic | Nanostructured multi-element (TiZrNbHfTa)N and (TiZrNbHfTa)C hard coatings[END_REF]. The uncertainty found in this work is small compared to the spread in the reported experimental values, where the smallest and largest lattice constant differ by 0.103 Å. In addition, the variation between supercells is of the order of the typical variation in relaxed lattice parameters between different DFT codes [START_REF] Lejaeghere | Reproducibility in density functional theory calculations of solids[END_REF], pointing towards a low sensitivity of the relaxed lattice constant to the variations in the crystal's stoichiometry.

To be able to quantify the influence of the stoichiometry on the relaxed lattice constant, we consider the binary carbides TaC, NbC, HfC, TiC and ZrC which crystallize into rock-salt structures and can be considered as "building blocks" for the (TaNbHfTiZr)C crystal. For each of these binary carbides, the average volume per transition metal and carbon atom is (a T M C ) 3 /4 where a T M C is the lattice constant of the binary carbide. So, for each supercell, the binary carbides (BC) can be used to define a volume

V BC = 1 4 T M N T M • (a T M C ) 3 (3)
where T M ∈ {Ta, Nb, Hf, Ti, Zr} and N T M is the number of transition metals in a supercell. For each transition metal species, we calculated V BC using the lattice constants a T M C in [START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF]. Fig. 2a displays the relaxed lattice constants of the crystalline and amorphous supercells as a function of V BC . The amorphous lattice constant was found to be (4.65 ± 0.02) Å, about 0.15 Å larger than for the crystalline cells, exceeding the standard deviation due to the changes in configuration and stoichiometry. In addition, we observe a clear linear trend in the crystalline case, showing that the stoichiometry dependence is well quantified by V BC . This trend is not clearly visible in the amorphous case, which could be related to the fact that the volume is larger because of the amorphous configuration, hence the different sizes of the metallic elements play a smaller part.

Out of the ten (crystalline or amorphous) supercells, as a control sample, we designed two pairs of supercells to have the same stoichiometry and hence the same V BC . Fig. 2b shows that the crystalline lattice constants corresponding to these supercells are remarkably close to each other, compared to the other supercells. However this is not the case in the amorphous case, as displayed in Fig. 2a.

III.2. Mechanical properties

To summarise our results for all the crystalline and amorphous supercells energy dependence on volume, we present the average fit to the Birch-Murnaghan equation of state together with the standard deviations in Fig. 3.

The zero-pressure bulk modulus in the crystalline case is B 0 = (271.13 ± 2.04) GPa. The standard deviation of our results is a factor hundred smaller than the average, therefore the influence of the differences in the stoichiometry is, as for the lattice constant, very limited in the crystalline case. Our result is comparable to other theoretical work: Y. Yang et al. [START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF] fitted with Eq. ( 2), resulting in B 0 = 264.26 GPa, whereas Q. Zhang [START_REF] Zhang | Understanding the electronic structure, mechanical properties, and thermodynamic stability of (TiZrHfNbTa)C combined experiments and first-principles simulation[END_REF] and P. Sarker et al. [START_REF] Sarker | High-entropy high-hardness metal carbides discovered by entropy descriptors[END_REF] calculated elastic constants and used these and the Voigt-Reuss-Hill approximation to show that B = 254 GPa and B = 262 GPa, respectively. Experimental work, in which (TaNbHfTiZr)C with roughly 10% carbon vacancies is studied, found a bulk modulus of (205 ± 7) GPa using an ultrasonic pulser/receiver [START_REF] Wen | Thermophysical and mechanical properties of novel highentropy metal nitride-carbides[END_REF]. The mismatch with our result can be attributed to the sample's porosity, in which case nanohardness and elastic modulus measured with nanoindentation would have better resembled the theoretical values than the quantities measured with the ultrasonic pulser [START_REF] Wen | Thermophysical and mechanical properties of novel highentropy metal nitride-carbides[END_REF].

In the amorphous case, we calculated the zero-pressure bulk modulus to be B 0 = (162.89 ± 13.83) GPa, with a standard deviation one order of magnitude larger than in the crystalline case. This can be understood by the large structural variations between the supercells for the amorphous configurations.

Interestingly, the average bulk modulus in the amorphous case is much lower than in the crystalline case. This can be related to the fact that the equilibrium volume of the amorphous supercells is found to be larger with respect to the crystalline supercells, which would result in lower interaction between the atoms. Fig. 3 confirms the lower compressibility of the crystalline phase: a change in volume V (e.g. from V 0 to V 0 + 20 Å3 ) leads to a larger increase in energy of the crystalline supercells compared to the corresponding amorphous ones.

Importantly, Fig. 4 shows that the bulk modulus and V BC , quantifying the differences in stoichiometry, are not strongly correlated not only in the amorphous, but also in the crystalline case. This is in contrast to the lattice constant, where a stoichiometry dependence, although weak, was observed. Still, crystalline cells with the same stoichiometry have a similar bulk modulus. In the crystalline case, the standard deviation is too small to be distinguished.

III.3. Electronic properties

The DOS was calculated using DFT for all the crystalline and amorphous supercells. We also calculated its elemental and orbital contributions by calculating the projected DOS (PDOS). In particular, we evaluate the PDOS on the s and p orbitals of carbon atoms, and the d orbitals of the transition metal atoms. Data for all the stoichiometries were averaged and are plotted together with their standard deviations shown in Figs. 5 and6, separately for the crystalline and amorphous supercells.

We find that both the crystalline and amorphous phases are metallic. The DOS of the amorphous cells shows a dip close to the Fermi energy, but otherwise looks relatively featureless. The crystalline cells have a gap in the DOS from roughly -7 eV to -9 eV. This gap and the finite DOS at the Fermi energy in the crystalline case confirm theoretical calculations done in [START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF] and [START_REF] Zhang | Understanding the electronic structure, mechanical properties, and thermodynamic stability of (TiZrHfNbTa)C combined experiments and first-principles simulation[END_REF].

From -7 eV to +5 eV, the contribution to the DOS of the crystalline phase is negligible for C(s) whereas it is significant for C(p). From -9 eV to -11 eV, the contributions are swapped. For the amorphous cells, the PDOS of C(p) is much larger than C(s) between -7.5 eV and +5 eV whereas both are indistinguishable from -7.5 eV to -11 eV.

For the d orbitals of the transition metals, the PDOS is similar between all the elements, with a slight dominance of the d orbital of titanium above the Fermi energy in both the crystalline and amorphous cases. This dominance is clearly more pronounced than the standard deviation and is therefore not a consequence of the details of the stoichiometry. This dominance of Ti(d) and the significant contribution from C(s) below -9 eV were also found in [START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF] and [START_REF] Zhang | Understanding the electronic structure, mechanical properties, and thermodynamic stability of (TiZrHfNbTa)C combined experiments and first-principles simulation[END_REF], in the crystalline case.

IV. DISCUSSION

Previous work on disordered binary metal carbide systems has shown that their properties are tuneable. In the amorphous phase, the relative bond content determines hardness, resistivity and elasticity [START_REF] Andersson | Deposition and characterization of magnetron sputtered amorphous cr-c films[END_REF][START_REF] Furlan | Structure and bonding in amorphous iron carbide thin films[END_REF][START_REF] Nedfors | Nb-b-c thin films for electrical contact applications deposited by magnetron sputtering[END_REF]. Amorphicity may lower cleavage fracture susceptibility and grain boundary decohesion [START_REF] Kaloyeros | Amorphous transition metal carbides[END_REF], which lowers corrosion through a reduced ability of oxygen to diffuse through grain boundaries. This can also be related to the flattening of the DOS as a function of energy that we calculated in the amorphous case and which can be attributed to the increased disorder in bond energy, as observed in a previous work on amorphous transition metal carbides [START_REF] Kádas | Structural properties of amorphous metal carbides: Theory and experiment[END_REF].

In turn we show that amorphicity also lowers the bulk modulus as compared to the single-crystalline case. This implies that the structural disorder acts as a tuning knob between, on one side, the improvement of surface properties such as cleavage fracture susceptibility and corrosion, and hardness on the other side. This tuning knob can be adjusted depending on target applications. The bulk modulus was chosen in our comparative study because it is a measure of the elastic properties of a material that can easily be translated from ordered solids to liquids and disordered solids. The tunability of the bulk modulus with disorder is relevant to applications requiring high or low compressibility of the material or the storage of mechanical energy and suggests that also other mechanical properties such as hardness, Young's modu- lus, or shear modulus depend on structural disorder in a comparable way.

The aforementioned dependence of material properties on bond distribution in the amorphous phase of metal carbides [START_REF] Nedford | Characterization of amorphous and nanocomposite nb-si-c thin films deposited by dc magnetron sputtering[END_REF][START_REF] Andersson | Magnetron sputtering of zr-si-c thin films[END_REF] implies a range of tuneable material properties by varying the degree of disorder present in a metal carbide coating. Our work, calculating properties in the fully crystalline and fully amorphous limits, gives bounds on the available tuning range.

Apart from the change in flatness of the DOS, its value at the Fermi level is also strongly affected by the structural disorder. This can be related to experimental work showing a strong increase in resistivity with increasing relative amount of metal-to-carbon bonds in the amorphous phase [START_REF] Nedford | Characterization of amorphous and nanocomposite nb-si-c thin films deposited by dc magnetron sputtering[END_REF][START_REF] Andersson | Magnetron sputtering of zr-si-c thin films[END_REF]. However, in these experiments, amorphicity is obtained by adding silicon to the system, which may be a further source of the raised resistivity, in addition to the inhibition of band formation by disorder. Nevertheless, it is not strictly necessary to introduce additional elements, such as Si [START_REF] Nedford | Characterization of amorphous and nanocomposite nb-si-c thin films deposited by dc magnetron sputtering[END_REF][START_REF] Andersson | Magnetron sputtering of zr-si-c thin films[END_REF] or B [START_REF] Nedfors | Nb-b-c thin films for electrical contact applications deposited by magnetron sputtering[END_REF], to drive the amorphization in metal carbides, since amorphized yet metalloid-free ternary metal carbides have been reported previously [START_REF] Furlan | Structure and bonding in amorphous iron carbide thin films[END_REF][START_REF] Trindade | Amorphous phase forming ability in (w-c)-based sputtered films[END_REF][START_REF] Magnuson | Electronic structure and chemical bonding of amorphous chromium carbide thin films[END_REF][START_REF] Olovsson | Structure and bonding in amorphous cr1-xcx nanocomposite thin films: X-ray absorption spectra and first-principles calculations[END_REF]. In the specific case of transition metal carbide films, TEM-amorphous CrC [START_REF] Magnuson | Electronic structure and chemical bonding of amorphous chromium carbide thin films[END_REF] and WC-based films [START_REF] Trindade | Amorphous phase forming ability in (w-c)-based sputtered films[END_REF] have been synthesized and their electronic structure has been characterized experimentally. In this context, our calculations show that changes in electronic properties are at least partially intrinsic to variations in the level of structural disorder in carbides. The large change in the DOS at the Fermi level, for example, directly connects to experimental observations on transition metal carbides.

V. CONCLUSION

We calculated the lattice constant, bulk modulus and DOS of (TaNbHfTiZr)C in ten crystalline and ten amorphous configurations with slightly varying stoichiometries, using DFT and stochastic quenching. To model the random arrangement of transition metal atoms, we randomly generated 2 × 2 × 2 supercells, with stoichiometries approaching the nominal one.

We found that the crystalline supercells have smaller relaxed lattice constants compared to amorphous supercells, and that the relaxed lattice constants for crystalline supercells are correlated with an average volume per transition metal specie, which can be used to quantify I. The stoichiometries of the nine cells and the reference cell from [START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF].

the influence of stoichiometry.

The bulk modulus depends strongly on the crystalline or amorphous nature of the crystal structure: it is (271.13 ± 2.04) GPa in the crystalline case and (162.89 ± 13.83) GPa in the amorphous case, making the crystalline phase of (TaNbHfTiZr)C much less compressible than its amorphous counterpart. This agrees with the larger relaxed volume of the amorphous supercells.

The DOS of the crystalline and amorphous phases of (TaNbHfTiZr)C is of metallic character, with all the species contributing to the DOS at the Fermi level. The DOS for crystalline configurations displays sharp features, including a small peak at the Fermi level, while the one for amorphous configurations is almost featureless.

All the structural, mechanical and electronic properties we calculated are only impacted in a limited way by variations between supercells, thus showing that 2 × 2 × 2 supercells with approximate stoichiometries can be reliably used in ab-initio calculations of materials properties of transition metal high-entropy carbides.

FIG. 1 .

 1 FIG. 1. Crystal structures of a crystalline supercell (a) and its amorphous counterpart (b) with the same stoichiometry. Both are relaxed with DFT. The magenta cube in (a) represents the rock-salt unit cell, the distance between two grid lines in (b) is 2 Å.

FIG. 2 .FIG. 3 .

 23 FIG. 2. (a) Calculated relaxed lattice constant of the crystalline and amorphous supercells as a function of VBC , as defined in Eq. (3), where the lattice constants of elemental carbides are taken from [30]. Arrows indicate supercells with the same stoichiometry. Note that only see one blue point is visible in these two cases, because the results are too close. (b) Repeated data from (a) for the crystalline case, showing a clear linear trend as a function of VBC , indicating that the VBC is a good quantification parameter for the stoichiometry's role in lattice constant size.

FIG. 4 .

 4 FIG.4. Zero-pressure bulk modulus calculated for all (a) crystalline and (b) amorphous supercells as a function of VBC , representing stoichiometry, as defined in Eq. (3), where the lattice constants of elemental carbides are taken from[START_REF] Yang | Structural, mechanical and electronic properties of (TaNbHfTiZr)C high entropy carbide under pressure: Ab initio investigation[END_REF]. The average bulk modulus is indicated by the dashed black line.

. 6 .

 6 FIG.6. PDOS for the transition metal d-orbitals for the crystalline and amorphous cells close to the Fermi energy EF ermi. The solid line is the PDOS averaged over all the respective supercells. The standard deviation is shown by the wider coloured area. For comparison we plot the total DOS in gray (divided by 4).

ACKNOWLEDGMENTS

We thank Edan Lerner for kindly providing the Lennard-Jones relaxation code. This work was carried out on the Dutch national e-infrastructure with the support of SURF Cooperative.