Jean-Philippe Eisenbarth
email: jean-philippe.eisenbarth@loria.fr

Thibault Cholez
email: thibault.cholez@loria.fr

Olivier Perrin
email: olivier.perrin@loria.fr

An open measurement dataset on the Bitcoin P2P Network

Keywords: Blockchain, Bitcoin p2p network, network measurement, p2p protocol, network security

The Bitcoin blockchain is managed by an underlying peer-to-peer network. This network is responsible for the propagation of transactions carried out by users via the blocks (which contain the validated transactions), and to ensure consensus between the different nodes. The quality and safety of this network are therefore particularly essential. In this work, we present an open dataset on the peers composing the Bitcoin P2P Network that was made following a well defined and reproducible methodology. We also provide a first analysis of the dataset on three criteria: the number of public nodes and their client version and geographical distribution.

I. INTRODUCTION

During the last decade, cryptocurrencies have gained in popularity. Even if their total market capitalization is prone to much variation, they are currently valued to more than $937 billion [START_REF] Coinmarketcap | Global Charts[END_REF]. With more than 18 million of circulating tokens valued to $602 billion, Bitcoin is the most acknowledged cryptocurrency. It is based on a decentralized blockchain which is a distributed transaction ledger whose records are append-only and publicly auditable. This ledger is managed by a underlying peer-to-peer (p2p) network that agrees on a common order of the transactions using a distributed consensus. There is no trusted party to regulate this system. In its initial white paper [START_REF] Nakamoto | Bitcoin: A peer-to-peer electronic cash system[END_REF], Satoshi Nakamoto argues that this system prevents attackers to alter the ledger and double spend tokens for as long as an attacker does not control 51% or more of the computational power in the p2p network. Such a combination of a public ledger and a p2p network that participates in the consensus and can audit it is called a permissionless blockchain.

Due to the popularity and success of Bitcoin, its protocols, network and security have been widely studied [START_REF] Decker | Information propagation in the Bitcoin network[END_REF], [START_REF] Biryukov | Deanonymisation of Clients in Bitcoin P2P Network[END_REF], [START_REF] Miller | Discovering bitcoin's public topology and influential nodes[END_REF], [START_REF] Imtiaz | Churn in the Bitcoin Network: Characterization and Impact[END_REF], [START_REF] Feld | Analyzing the Deployment of Bitcoin's P2P Network under an AS-level Perspective[END_REF] [8] [START_REF] Gencer | Decentralization in Bitcoin and Ethereum Networks[END_REF] [START_REF] Deshpande | BTCmap: Mapping Bitcoin Peer-to-Peer Network Topology[END_REF]. To the best of our knowledge, even if some authors indicate their methodology, either their dataset are not publicly available or the source of the software used (crawlers, scripts to build the statistics, algorithms...) are not given, preventing reproducible results. None also proved that the crawler they used actually converges and is sound.

In this paper, we present our open dataset [START_REF] Eisenbarth | Bitcoin p2p network study dataset overview[END_REF] composed of snapshots of the Bitcoin network and make a comprehensive analysis of it. During one month, we performed daily crawls on the nodes composing the network and gathered information about them. Our dataset [START_REF] Eisenbarth | Bitcoin p2p network study dataset overview[END_REF] and all related tools [12], more precisely the crawler to make it and the scripts to analyze it are also open source, thus making our study fully reproducible and expendable, by opposition to previous studies in the domain. From our dataset, we present a first couple of metrics that characterize the network: the size of the network, the clients' distribution and the geographical localization of peers.

The rest of the paper is organized as follows. Section II presents some background on the Bitcoin network and its protocol. In Section III, we present our crawling strategy to make the dataset that is then analyzed in Section IV. Finally, Section V concludes the paper.

II. BACKGROUND

In this paper, we focus on the implementation of the Bitcoin Core client [START_REF]The Bitcoin Core developers[END_REF], which is the official implementation, documented in the Bitcoin's community documentation [START_REF]Satoshi Client Node Discovery[END_REF].

There are four main types of messages in the Bitcoin's p2p network:

• network discovery messages • transactions or blocks announcements • transactions or blocks requests • transactions or blocks deliveries We will focus on the network discovery messages (also called overlay network protocol). Now we will describe how the Bitcoin p2p network works.

There are two types of nodes in the Bitcoin p2p network: the full nodes and the lightweight nodes. A full node downloads every block and transaction and verifies that they respect all the Bitcoin's consensus rules. If it is not the case, the invalid blocks or transactions are rejected, no matter the network's global state about them. In order to use Bitcoin in a trustless and private way, a user needs to run a full node wallet. In contrast, a lightweight client only downloads the block headers to verify the authenticity of the transactions. This method is called Simplified Payment Verification (SPV). This type of client relies upon full nodes which become trusted third parties.

Essentially, when a full node starts up, it needs to connect to other active peers of the network to synchronize its local blockchain state with the one the network agreed upon. At the very first startup, a node doesn't know any other peers of the network. Most likely, it will use the DNS seeders to learn about them. Basically the DNS seeders continuously crawl the network to create a list of active reachable peers. When they receive a DNS request from a new node, they reply with a subset of chosen IP addresses they know. The list of DNS hostnames to query is hardcoded in the Bitcoin client (e.g. seed.bitcoin.sipa.be, dnsseed.bluematt.me, dnsseed.bitcoin.dashjr.org, etc.).

A node has two databases in which it stores IP addresses of other peers of the network: the new and the tried tables. These two tables are organized into buckets, 1024 buckets for the new table and 256 for the tried table. Each bucket can contain a maximum of 64 entries. The new table contains the addresses of peers to which the node has not yet tried to connect to. The tried table contains the addresses of peers to which the node has been able to connect successfully and that are known as reachable.

After the local database has been seeded with some active peers, the node tries to connect to 8 peers by default using unencrypted TCP connections (called outbound connections). Additionally, the node can be configured (port forwarding, access enabled in the firewall, etc.) to accept connections (called inbound connections) from other peers, up to 117 by default. Such a node -called a listening node -may issue unsolicited ADDR messages to advertise its neighbors that it accepts inbound connections. These neighbors may relay this message to their own neighbors and the distribution may carry on this way. A node could also request explicitly to discover other active peers in the network by sending a GETADDR message to its neighbors. To determine how many addresses a node needs to answer, it calculates m the minimum between 23% of the number of nodes contained in all the buckets and a maximum number set to 2,500. Then, it responds with ADDR messages containing information (ip, port, timestamp) of the m peers retrieved randomly from the buckets (a single ADDR message can contain up to 1000 buckets entries information). At maximum, a node would send 3 messages, each containing respectively 1000, 1000 and 500 addresses from its tables. This is how the ADDR messages are documented for the Bitcoin Core client but we noticed that it is no longer the case for the versions released after 2014 (> v0.10.0). Since then, a node sends at maximum 1000 addresses in one message. The list of addresses that contains 23% of the number of the nodes is cropped to 1000. The reason is not documented and not clear, even inside the community and they plan to remove this limitation in the future [START_REF]Cache responses to GETADDR to prevent topology leaks by naumenkogs • Pull Request #18991 • bitcoin/bitcoin[END_REF]. Also, a node maintains its connections up-to-date by verifying periodically the state of the nodes it is connected to by issuing application-level PING messages and waiting for the PONG responses. The two types of connection (inbound and outbound) are used to disseminate transaction and block messages (announcement, request and delivery).

III. MEASUREMENT STRATEGY

A. Crawling methodology

From February 7-March 2, 2020 we operated a crawling node on the Bitcoin's main network. We forked and improved the crawler used by the bitnodes.io website and we published it on Github [12]. The methodology involves first a crawler that tries to concurrently establish connections to the peers of the Bitcoin network and second, another program that runs in parallel and that keeps track of the connectivity of the discovered nodes. This program connects to all the nodes returned by the crawler and sends periodically (every 60 seconds) a PING message to the connected nodes to verify if they are still connected. When a crawl is finished, the nodes that are tagged as reachable by this program are exported with additional information such as geolocalization, hostname, Bitcoin client used, among others.

It is important to note that our infrastructure lacked an IPv6 link and a TOR proxy to test and integrate these nodes. Thus, all the discovered nodes are IPv4 nodes. They accounted for approximately 75% of the network whereas IPv6 and Tor nodes accounted for 10% and 15% of the network respectively. Please note that in the dataset we publicly released [START_REF] Eisenbarth | Bitcoin p2p network study dataset overview[END_REF], IP addresses are pseudo-anonymized following ICANN recommendations [START_REF]Recommendations on Anonymization Processes for Source IP Addresses Submitted for Future Analysis[END_REF] which offers an acceptable compromise between utility and privacy. More precisely a salted hash is provided and the last byte of the address is set to 0.

Also, nodes that are running a Bitcoin protocol version older than 70001 were not taken into account during a crawl because of compatibility issues with prior versions of the protocol. It corresponds to the Bitcoin Core v0.8.0 client (user agent Satoshi:0.8.0) and below (before February, 2013). Pappalardo et al. [START_REF] Pappalardo | Blockchain inefficiency in the Bitcoin peers network[END_REF] showed that already in 2016 the vast majority of nodes in the network were running a protocol version more recent than 70001. Consequently, we consider that the crawler could reasonably ignore the nodes that are running an older version of the protocol.

B. Technical setup

The machine we used is an Ubuntu 18.04 LTS computer with an Intel Xeon Processor E5-2420 v2 6 cores, 16GB RAM and a 1 Gb/s network link that established connections to all the IPv4 reachable peers -i.e. listening nodes -of the Bitcoin peer-to-peer network. To handle the large number of network connections needed, we had to increase the opened files limit of our GNU/Linux system to 1,000,000. We also set some network kernel settings as specified below. The machine operated the crawling node 24/7 for the whole period.

net.core.rmem_default=33554432 net.core.wmem_default=33554432 net.core.rmem_max=33554432 net.core.wmem_max=33554432 net.ipv4.tcp_rmem=10240 87380 33554432 net.ipv4.tcp_wmem=10240 87380 33554432 net.ipv4.ip_local_port_range=2000 65500

C. Validation

In order to validate the quality and the consistency of our measurements, we want to assess that a crawl ends when all possible peers are discovered. A crawl proceeds as follows:

1) the crawling node is bootstrapped by receiving a small subset of the reachable nodes from known DNS seeders which addresses 1 are hardcoded in the client ; 2) it tries to establish a connection to the newly discovered nodes ; 3) then it sends GETADDR messages to all the nodes it is connected to ; 4) the crawling node disconnects from a node once it received the ADDR messages in response to its GETADDR message ; 5) it loops back to step 2 until the crawling node does not discover new nodes (one it did not process yet) in a certain amount of time. More precisely, the newly discovered nodes are stored as pending and the crawling node tries to establish a connection to them. These nodes are retrieved from the GETADDR sent by the nodes the crawler is connected to. This list of addresses is filtered in order to dismiss stale nodes (lastly seen online more than 8 hours from the current time of crawl) for efficiency purpose (older nodes are not likely to be connected). A crawl stops when there are no pending nodes left (checked every 10 seconds). In practice a crawl did not exceed 3 minutes and the program was set to restart a new crawl every 4 minutes. As shown in Fig. 1, a crawl stops learning new nodes after 2 to 3 minutes and the number of new nodes discovered over time is decreasing after a peak at the beginning. Also, we deployed five independent ground-truth Bitcoin Core nodes (straight v0.20.1). They joined the p2p network and four of them had approximately 30 active connections whereas the fifth node had roughly 70 active connections. The crawler was able to find all of them. The methodology of the crawler can reasonably be considered effective in finding almost all accessible nodes in the Bitcoin p2p network.

IV. FIRST ANALYSIS OF THE BITCOIN'S NETWORK DATASET

In this section, we analyze several metrics that are derived from the crawls of the Bitcoin network.

A. Number of nodes

As shown in Table I, the crawler was able to discover in average 7, 218 unique IPv4 nodes in the p2p network during a single crawl. The minimum number of reachable nodes found was 6, 856 2 and the maximum 8,103. The program responsible to keep the connection opened with all the previously discovered nodes was connected in average to 7, 783 nodes throughout the period. The difference between the discovered and reachable nodes can be explained by the fact that a small portion of the nodes can be missed by a particular crawl but found by the others and the program that keep track of the reachable nodes is regularly updated with the newly discovered node by the crawler.

We also have an overall picture of the total number of nodes referenced in the p2p network (not only the reachable ones). As usual, the crawler sends a single GETADDR message to a newly discovered reachable node, that responds with 1000 nodes contained in all its buckets (see II). We consider here the unique nodes discovered per crawl with no consideration regarding their reachability, and we found that there are 200,000 unique nodes in average retrieved from the buckets of all reachable nodes. Due to overlapping in the buckets of all the nodes, we can deduct that this number, yet an approximate, should be representative of the average size of the whole p2p network (public and non public nodes). 2 To calculate the minimum we have omitted the data for the 21 February because we had to restart the program and it needed several crawls to connect to the accurate number of reachable nodes of the p2p network. If we had kept these data, the minimum, maximum, average and median would have been 6, 393 (2020-02-21 10:04 UTC+1, date of the restart), 8, 103 (unchanged), 7, 785, and 7, 869, respectively.

B. Client distribution

The reachable nodes we discover are all public nodes (i.e. the user that deployed a node did properly configure the firewall and/or port forwarding if necessary) but we cannot conclude on whether they are full or lightweight nodes with only the information that they are public.

To answer this, we classified the public nodes discovered according to which client (also named user agent) they used. The official full node client Bitcoin Core (its user agent is Satoshi) is the most widely deployed client we found, with up to 98.36% of the nodes that are running this client. There are dozens of versions for this client in use. Throughout the whole period of crawl, there are three versions that are the most popular ones: 0.18.0 (May, 2019), 0.18.1 (August, 2019) and 0.19.0.1 (November, 2019). Their relative order varies during the period but these three versions alone represent approximately 65% of the crawled network.

There are other clients that are present in the dataset but in a very small percentage (less than 1%). Their user agents are bcoin, btcd and bitcoin_unlimited. We also found even less significant number of other clients that we could not classify because we could not find trustful information about them. Their user agents are for example: Aurum, CKCoind, therealbitcoin.org, BitflateCore, MultiChain...

We can deduct that a very vast majority (approximately 99%) of the discovered public nodes are full nodes and this majority is running the official Bitcoin client.

C. Geographical distribution

The previous section showed that public nodes are full nodes, and we can wonder if they are geographically stable during a whole day.

We show in Fig. 2 the number of reachable nodes on February 15th in the world divided in three areas: Europe / Africa / Middle East, North / South America and Asia / Oceania. We used the time zones as the criteria to gather the areas. As we can see, the number of up nodes over time is quite constant in the three areas. The public full nodes are not shut down by nightfall. They are most likely running on servers rather than on users' personal computers because the periodic daily churn per zone inherent to p2p file sharing networks cannot be seen here. We can also notice that, unlike the geographical distribution of mining nodes, there are more public full nodes deployed in the European continent or in the North America than in Asia. For example, in our entire dataset at any given time, there are in average approximately 3900 nodes hosted in Europe, 2150 in North America and 1200 nodes hosted in Asia. The absence of daily pattern as well as a balanced geographical distribution are good properties for distributed systems making them more robust to failures.

V. CONCLUSION AND FUTURE WORK

We presented our an open measurement dataset on the Bitcoin p2p network. The dataset contains in-vivo measurements over one month of the Bitcoin's public nodes p2p network. We assessed our crawler soundness and made it available as well as the scripts we used to perform analysis in an attempt to provide facilities to reproduce and extend our study. In this paper, we also provided a first insight on the dataset, showing that the size of the Bitcoin p2p network is very stable with approximately 7800 reachable nodes, that more than 98% of the peers execute the official client, and that peers composing the network are well balanced throughout the world.

Nevertheless, it is important to note that the analysis we showed in this paper concerns the public nodes (namely reachable full nodes) in the Bitcoin p2p network and it cannot be trivially generalized to all the nodes in the network (wallets, lightweight nodes, miners. . . ). Yet, these public nodes are crucial, since they act as a backbone of the complete Bitcoin network: wallets and lightweight clients need the public full nodes to connect to the network and retrieve the blocks and transactions.

We already started to further analyze the p2p network data with other metrics that can be derived from our dataset such as the churn rate, the popularity of peers, the list of software vulnerabilities that affect clients' versions or their distribution among the reachable nodes. In our future work, we will pursue our investigation of our dataset to gain even more knowledge on the Bitcoin p2p network.

Fig. 1 .

 1 Fig. 1. Number of new reachable nodes discovered throughout five crawls.

Fig. 2 .

 2 Fig. 2. Geographical distribution of the public nodes over one day

  1 dnsseed.bitcoin.dashjr.org, dnsseed.bluematt.me, seed.bitcoin.sipa.be, seed.bitcoinstats.com, seed.bitcoin.sprovoost.nl and seed.bitnodes.io

	TABLE I THE NUMBER OF NODES DISCOVERED FOR ONE CRAWL AND THE TOTAL NUMBER OF REACHABLE NODES AT ONE POINT (THE TIMEZONE IS UTC+1)
		Minimum	Maximum	Average	Median
	Discovered nodes	5,506 (2020-02-11 12:26)	7,623 (2020-02-9 22:14)	7,218	7,310
	Reachable nodes	6,856 (2020-02-17 14:32)	8,103 (2020-02-10 2:03)	7,783	7,870

Acknowledgement

This project has received funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No 830927 .


Antoinette Baujard
email: antoinette.baujard@univ-st-etienne.fr.

Values in Welfare economics

Keywords: Welfare economics, facts and values, value judgement, welfarism, transparency, demarcation, normative and positive, neutrality B41, D60, D63 Welfare economics, facts and values, value judgement, welfarism, transparency, demarcation, normative and positive, neutrality JEL Codes. B41, D60, D63

teaching and research institutions in France or abroad, or from public or private research centers.

Introduction

Welfare economics provides a general theoretical framework intended to be used to evaluate social states and to assist in public decision-making, with the underlying aim of improving social welfare. In terms of content, welfare economics draws heavily from microeconomics, which notably furnishes its two fundamental theorems, as well as the basis for cost-benefit or equity analyses. Welfare economics is thus used to evaluate the consequences of alternative situations or public policies as regards social welfare, generally considering social welfare as tightly linked to individual well-being.

The standard approach to social welfare in welfare economics is welfarist, i.e., social welfare is thought to depend only on individual utility and on no other information. It is fair to say that the term "welfarism"-notably introduced by [START_REF] Hicks | Essays in world economics[END_REF], and formally defined and popularized by Amartya [START_REF] Sen | On weights and measures: Informational constraints in social welfare analysis[END_REF]Sen ( , 1979a,b,b)-was intended precisely as a tool to critique the use of welfarism in welfare economics; and there are indeed major issues in welfare economics connected to the welfarist framework, including the link between theory and practice, the definition of social welfare, and the foundations of the judgements used in welfare economics. While there exist a substantial number of distinct definitions of welfarism, each associated with specific lines of criticism or debate, philosophical approaches to welfare economics have in common the questioning of which information is to be judged relevant or legitimate for the determination of social welfare, and they seek in particular to tackle the hot issue of value judgements. The assessment of welfarism ultimately belongs to the wider debates regarding the axiological neutrality of sciences (see chapter 3 on scientific objectivity, Reiss and Sprenger 2014), and the possibility of a demarcation between positive and normative economics (see chapter on positive and normative economics).

The present discussion hence focuses on whether welfare economics is a normative science, and how welfare economics should tackle normative objectives such as social welfare, given that promoting social welfare is its main end. As Atkinson (2009: 791) recalled, "economists frequently make judgments about economic welfare, but there is today little discussion of the foundations of welfare economics. It is assumed either that there is unanimity of interests, or that there is general acceptance of utilitarianism. This means that economics cannot address many key policy issues and that important differences in ethical views cannot be recognized." There are indeed several approaches to the issue of values in welfare economics, reflecting distinct lines of argumentation, and philosophical inquiry calls upon us to classify these approaches. Drawing on [START_REF] Mongin | Value judgments and value neutrality in economics[END_REF], we here present and assess the principal positions on the spectrum between the extreme view that welfare economics is entirely neutral and the counterview that it is an entirely ideological practice. The aim is to set out what is at stake for each of these positions: rather than pretending there exist specific literatures corresponding to each of the views here canvassed, we instead focus on their inner rationales and key consequences. For the purposes of analysis, we single out for discussion four archetypal positions: value neutrality (section 1), the value confinement ideal (section 2), the transparency requirement (section 3), and the value entanglement claim (section 4). This classification is meant to help us better understand not only how the welfarist framework is defined and why it has been called into question, but more generally how each proposition in welfare economics fares with the issue of value neutrality, and how it tackles the problem of ethical value judgements.

I-The value-neutrality claim I-i) Objectivity

Economics presents itself as a science in the mould of the natural sciences, and one of the objectivity requirements associated with such scientific ambition is that economics should be neutral with respect to judgements concerning ethical values. Seeing ethics as a matter of mere convention, subjectivity, or metaphysics, [START_REF] Robbins | An essay on the nature and significance of Economic Science[END_REF] claims it is not liable to proof by observation or introspection, and he defends the influential view that ethics falls outside the scope of science-and hence of economics. In particular, there is no test that can be employed "in comparing the satisfaction of different people", and intercomparisons of utilities "cannot be justified by appeal to any kind of positive science", such that "it would be totally illegitimate to argue" that any recommendation may be warranted by economics: thus, he concludes, "propositions involving 'ought' are on an entirely different plane from propositions involving 'is'" (Robbins 1932: 140-143). Economics should be neutral towards different ends and cannot pronounce on the validity of ultimate judgments of value (Robbins 1932: 147). The two areas of inquiry, economics and ethics, should therefore be considered disjoint, and at no time should economists hold ethical values.

I-ii) Behaviourism

The efforts of economics to establish itself as a value-neutral science has had deep and regrettable consequences for the conditions, the existence, and the reach of welfare economics. The exclusion of normative considerations and the focus on neutral observable phenomena have had direct consequences for the interpretation and the properties of individual utilities [START_REF] Baujard | L'économie du bien-être est morte. Vive l'économie du bien-être ! In Philosophie économique[END_REF]. Hedonic or moral utilities, in contrast with choices, are not observable. In revealed preference theory, utility is simply the numerical representation of choices, i.e. the ranking of alternatives derived from observed choice situations. Hence microeconomics, and subsequently welfare economics, has focused on utility under such a behavioural interpretation. Within such an interpretation, it is meaningless to talk about the intensity of utility or the comparison of utility between different individuals, such that welfare economics must as a consequence focus on ordinal and non-comparable utilities.

At the collective level, the only meaningful criteria for the ranking of social states at the collective level based on ordinal non-comparable utility is the Pareto criterion. 4 According to the Pareto criterion, if everybody is at least equally better off in a state with the policy than without, and at least one individual is strictly better off with the policy, then the social state is better with the policy than without it. In every case where decisions may impact different individuals in a heterogenous way, i.e. where there are both losers and winners, welfare economics is not able to derive recommendations concerning whether the policy should be adopted. These situations are not comparable according to the Pareto criterion.

Thus, in most cases, the banishment of ethical values, and of interpersonal comparisons of utility in particular, automatically impedes the use of any normative premises, and hence any prescriptive assertions: no recommendations which enable us to decide among policies could be derived from an allegedly value-neutral welfare economics [START_REF] Hicks | The foundations of welfare economics[END_REF][START_REF] Little | A critique of welfare economics[END_REF].

I-iii) The potential Pareto criterion

Welfare economics has not-to say the least-attained such a desired state of valueneutrality; yet nor did it remain content to debar itself from prescriptive judgement. [START_REF] Kaldor | Welfare propositions of economics and interpersonal comparisons of utility[END_REF] and [START_REF] Hicks | The foundations of welfare economics[END_REF] developed certain alternative methods in welfare economics designed to circumvent the preclusion of recommendations, appealing to the Weberian notion of the separation of the roles and tasks of politics and scientists. Imagine that losers lose less than winners win, and that transfers from the former to the latter are likely to elicit an improvement that may be unanimously acclaimed. In such a case, everybody is likely to be better off with the policy than without it, provided the transfers are actually implemented. Economists qua economists are able to assert that the policy is making a potentially universal improvement, while politicians are empowered to decide whether the transfers should or should not be effected. The separation of tasks between economists and politicians is here preserved, and recommendations may be proffered; but it is now questionable whether welfare economics still lives up to its ambition to issue recommendations without detouring through ethical judgements. "To say that a policy which meets the Kaldor-Hicks criterion increases the 'efficiency' of society is, in effect, to recommend it. Whereas if the value judgments implicit in the criterion are barred, it is unlikely to find favour with many people. […] Compensation tests, consumers' and producers' surpluses suffer not only from the distributional complications common to comparisons based on such tests but also from difficulties in their measurement, largely owing to their essentially partial character" (Mishan 1960: 250-51). Some even conclude that, in its ambition to produce value-neutral recommendations, welfare economics should be considered as a failure (Chipman and Moore 1978: 548, 581).

From the perspective of the history of welfare economics, this debate on the place of ethical values within welfare economics has driven the evolution of the discipline from the old to the new welfare economics, and from welfare economics to contemporary theories of equity [START_REF] Baujard | L'économie du bien-être est morte. Vive l'économie du bien-être ! In Philosophie économique[END_REF]. But from a philosophical perspective these two observations should come as no surprise. As a consequence of Hume's guillotine, no recommendations can be formulated without normative premises, and hence value-neutrality impedes the very recommendations which were the raison d'être of welfare economics. Conversely, any recommendation must derive from some normative premises, hence the pretention of producing value-neutral recommendations is inconsistent. In so far as the aim of welfare economics is evaluation or recommendation, it is constrained to suppose that there is such a thing as a substantial notion of 'good' or 'better'.

Among the views which countenance normative premises in economics, we may distinguish two versions of an intermediate neutrality claim: the value confinement ideal and the transparency requirement.

II-The value confinement ideal

Rather than targeting the chimeric ambition of value-neutrality, economics may seek to associate itself with a value-free ideal, i.e. to seek to minimize the importance of ethical values on scientific reasoning. In practice, such a search for 'more' neutrality than 'less' amounts to confining oneself to a reduced number of ethical principles, which, although they are admittedly normative, should not generally be considered controversial.

II-i) A consensual focus on utility

With the emergence of modern standard microeconomics in the interwar and Cold War periods, individual utility has come to be cautiously associated with subjective ordinal preferences. This concept of utility does not convey any substantial definition of well-being: it derives only from what individuals themselves judge to be relevant and valuable. This focus on subjectivity conforms with the respect for "consumer sovereignty" and manifests a strong resistance to paternalism (Amadae 2003, Desmarais-Tremblay 2020a,b), having emerged at a moment in history when freedom, individualism, and market competition appeared as the alternative to fascism and communism. Except for the individuals concerned, there is no reason why anybody should be entitled to say what is best for people. By trusting individuals' own ability to define their own version of well-being, economists would at least succeed in avoiding taking any stance in this regard themselves. Utility for microeconomics is defined in terms of subjective, ordinal, and non-comparable preferences; in order to fit with the value-containment ideal, welfare economics must also focus on this information. Note, however, that the assumption that subjective utility amounts to substantial well-being, or that it even satisfactorily reveals well-being, requires that individuals are sufficiently consistent, that their tastes and values are constant over the period studied, and that they are rational in seeking out the best strategies to serve their well-being. If these conditions are not met, as notably brought to light by behavioural economics, the assumption that subjective utility properly reveals real wellbeing remains debatable (see chapter on behavioural normative economics and the reconciliation problem).

II-ii) Welfarism

By focusing on individual utility, the value-containment ideal entails that welfare economics is welfarist, in the sense that the welfare of the community depends on the welfares of the individuals comprising it and on nothing else, with the further restriction that individual utility is nothing but the numerical representation of subjective ordinal non-comparable preferences. Under this definition, welfarism appears to be the only source of ethical values in welfare economics. resources, advantages, opportunities, capabilities, etc. (see section 3 in this chapter, and chapter on well-being)

Hence, within the value free-ideal, the normativity is imported not only through the use of the welfarist framework itself, but also in the choice of a given theory of well-being, insofar as there are indeed a number of alternative potential theories of well-being.

II-iii) Paretianism

Since welfare economics is required to derive recommendations at the collective level, there ought also to be a collective ethical principle besides that of welfarism. The Pareto criterion (strictly speaking) ultimately seems a reasonable candidate for the value containment claim, because it does not require any greater ethical load than the simple statement that improving individual well-being (whatever it is) is a good thing-and hence claims no more than welfarism as such (see next section on formal welfarism). Stating that individuals would be better off with than without a policy, with no losers, ought to be a matter of consensus, in so far as far as nobody has any reasonable interest in rejecting the claim and individual interest is considered as valuable. However, since almost any public policy generates both losers and winners, adjudicating for or against the policy implies a trade-off between different parties with diverging interests. In such a context the Pareto criterion is mute, due to the exclusion of interpersonal comparisons, and more generally because of the exclusion of any further significant ethical commitment. Like the value-neutrality claim, the value-confinement claim fails to allow welfare economics to generate recommendations.

III-The transparency requirement

Any normative assertion requires some normative premises; in their absence, no recommendation may be formulated. Seeking neutrality, or even seeking more neutrality, in welfare economics is nothing but an illusion. And since value judgements are needed, the only alternative is to accept them as such, which first and foremost requires that we circumvent the difficulties induced by the role of values in economics.

Among the difficulties with the role of values in science-and economics is no exception in this regard-the possibility that the scientist's values might influence the outcome of her or his research is a significant source of scepticism about the reliability of scientific research outcomes. Considering that the scientist is only a specific individual, the potential role of her emotions, private interests, personal values, or illegitimate pressures may engender distrust of her particular scientific assertions. By contrast, scientific analysis is considered as reliable when assertions are void of any subjective bias on the part of those who formulate them. The goal of neutrality as regards values ought thus to be discarded; we should rather support the view that scientific assertions should be invariant to the individuality of different scientists.

The second difficulty with ethical values in science is that any debate on the desirability or appropriateness of ends for a society properly pertains to the role of elected officials within individual income, the list of private goods and public amenities to which an individual has access, the number of kilometers that must be traversed in order to access water, etc. Such states may be described and measured similarly by different external observers. In this respect, capabilities appear to be an individual basis of information that is objectively measurable, albeit distinct for each individual, and which may be used as the individual well-being ingredient in the formal welfarist framework. the domain of politics (whose actors we may call politicians), rather than to the domain of science (whose producers we may call scientists, among whom number the economists). Science has no legitimacy to decide upon political values (e.g. [START_REF] Robbins | An essay on the nature and significance of Economic Science[END_REF], Sugden 2008). As remarked in passing above, this echoes the famous thesis defended by Max Weber (1904) regarding the separation of tasks between politicians and scientists. However, given a set of political values given a priori, social science (and welfare economics in particular) may be able to provide insightful recommendations on the best strategies to reach the ends decided upon by politicians: economics "is incapable of deciding the desirability of different ends. [. . . ] It makes clear to us the implications of the different ends we may choose" (Robbins 1932: 152). The politicians' ends, once identified, should be able to be taken as given by economists. In other words, values should be given transparently by politicians and treated neutrally by scientists, such that any other set of scientists under the influence of different subjective biases would be able to derive the same conclusion.

As a provisional conclusion on this version of the non-neutrality view, there are three conditions which must be met for welfare economics to respect scientific standards while also engaging with value judgements: value transparency, intersubjective neutrality, and separation of tasks. The view deriving from these three requirements, which we call 'the transparency requirement', comes with certain consequences.

III-i) Demarcation among a diversity of potential values

Firstly, value judgments should be made transparent, not least because they are inescapable. Robbins (1932: 156) stated that, in the matter of policies, we need to choose among ends, and for this, "economics brings the solvent of knowledge. It enables us to conceive the far-reaching implications of alternative possibilities of policy. It does not, and it cannot, enable us to evade the necessity of choosing between alternatives". Little, for instance, also affirms that value judgments, and in particular judgments about distribution, whatever they are, cannot be avoided in welfare economics, but should at least be made explicit: "Since we believe that the essential purpose of the economics of wealth, happiness, or welfare is to make recommendations, and to influence people, it follows that it should be put on an explicit, and not merely an implicit value basis" (Little 1950: 116; see also [START_REF] Mishan | A survey of welfare economics, 1939-1959[END_REF].

The transparency standard implicitly assumes there is a diversity of a priori equally acceptable ethical value judgements. The task of normative economics is "to examine the consequences of different ethical positions" (Atkinson 2009: 791). This definition manifests a sharp and acknowledged contrast with the common underlying suppositions that there may be welfare recommendations without any ethical commitments, that there exists such a thing as a consensual ethical position, or that we could rely on a more decisive ethical position, e.g. on the utilitarianism which is sometimes employed by economists without any debate or reflection. As Atkinson (2009: 803) remarks, "Many of the ambiguities and disagreements stem not from differences of view about how the economy works but about the criteria to be applied when making judgments […] People can legitimately reach different conclusions because they apply different theories of justice. This may seem self-evident to non-economists, but the economics profession in recent years has tended either to assume away welfare judgements or to assume that there is a general agreement"; and he goes on to regret "the disappearance from economics of discussion of the principles underlying normative statements" (Atkinson 2001: 193). Hence we first need to take for granted that there is a diversity of acceptable value judgements; the role of economics is to derive the subsequent recommendations and unveil the consequences of given value judgements.

Diversity comes with the need to be explicit about which ethical judgement has been selected, and this requires the demarcation of facts and values. If demarcation were possible, we could then factor out the descriptive and the evaluative components, as suggested by Hare (1952). Yet certain judgements are not straightforwardly and exclusively prescriptive or evaluative: saying that some behaviour is 'rude' or 'cruel' entails both descriptive and evaluative judgements. Hare (1952), rather, proposed to consider such statements to be entirely descriptive, at least if we agree that we can judge an action to be rude, say, if it conforms to some pregiven norms of rudeness and politeness in society: we then need only describe such 'compliance' to the norm. Similarly, we could describe certain notions of fairness as equity, or of certain versions of utilitarianism, in terms of compliance to a norm, such that the consideration of these ethical values becomes just another descriptive ingredient included in our judgement. The transparency of values, then, is the other side of the demarcation claim.

III-ii) The quantifying device of intersubjective neutrality

Secondly, the means by which we make value judgements explicit should be introduced into economics in a manner which is itself neutral. Intersubjective neutrality may be obtained through devices that are able to formalize the normative criteria: this involves quantifying them, and, in particular, assigning a list of desirable normative criteria to these tools (and only to them).

Equity and welfare theories, henceforth called the "social welfare approach", have been developed in the context of the Bergson-Samuelson school of the New Welfare Economics, and in the wake of social choice theory. The social welfare approach seeks to analyse situations and rank them according to clear normative criteria [START_REF] Adler | Measuring Social Welfare: An Introduction[END_REF]. Social welfare functions are tools in theoretical welfare economics, whose currency is not income or wealth but rather well-being and social welfare. The social welfare approach is characterized by two components: on the one hand, it assigns to each individual some inclusive measure of well-being, supposed to depend on every welfare-relevant dimension; for instance, well-being is defined as subjective utility, which ultimately depends on one's own consumption, or on opportunity or some objective index of well-being (see chapter on individual well-being). On the other hand, it provides a rule to rank these lists of measures at a collective level, taking into account a number of normative criteria of aggregation, e.g. utilitarian vs. egalitarian. This allows the policy analyst to represent and rank each possible outcome of a policy, for different contexts or for different alternative policy choices. Indeed, a social welfare function depends both on the normative choices concerning the relevant information about every individual's well-being, and on how to aggregate the list of individual well-beings into a collective judgment.

Allowing that some normative ingredients are amenable to being embedded within the tools of economics without importing any bias, the normative load of the social welfare function can then be assimilated to the ethical interpretation of those ingredients, typically as derived from some well-established philosophical theory. A specific approach today commonly called 'axiomatics', which is typical of normative economics, aims precisely at identifying these ingredients, and conversely, at choosing the proper devices given the desirable ingredients. At a high level of generality, axiomatics allows the deductive formalization of a given theory, whose propositions belong either to primary conditions called axioms or to derived propositions called theorems. Applied to welfare economics, it consists in the following steps: the primary conditions (including normative premises and descriptive elements) that collective evaluative rules should ideally satisfy are first captured by formal language; then we describe, by deduction, the logical consequences of the association of the different conditions, as the set of rules able to satisfy them exactly. If this set is empty, we have proven an impossibility result, which is itself interesting as a means to highlight the inconsistency of the desired conditions; if this set is not empty, there is a theorem which characterizes a solution.

The deductive part is either true or false: it can be proven or infirmed, but is not a matter of debate. The formal language does not convey any meaningful interpretation at all, at least until the axiomatics is given an external anchor point, e.g. an external theory able to make sense of the symbols (Mongin 2003: 101). Some premises, which should originate only from the politicians, may be value-laden, but their normativity is only conveyed, not transformed by the deductive process conducted by the scientist: "the axiomatization would allow us to disentangle the logical inference from the interpretations, and hence to exercise greater control over the latter than any other formalization process would" [START_REF] Mongin | L'axiomatisation et les théories économiques[END_REF]: 121, my translation). As a consequence of this clear separation of interpretation on the one hand, and formal deduction on the other, it becomes irrelevant who the scientist is, and the axiomatic approach is thus supposed to guarantee the neutrality of the treatment of the normative ingredients.

Just as Hare considered that 'rude' was only a descriptive judgement because it implied some compliance to the norm defining rudeness, [START_REF] Fleurbaey | Théories économiques de la justice[END_REF] considers the axiomatic approach to welfare and equity as entirely positive in so far as it does not require any personal commitment from the researcher. For instance, this approach enables Fleurbaey, qua scientist, to explain the consequences of a utilitarian theory in a given context just as any committed utilitarian would do, although he, as a person, would certainly value a greater dose of egalitarianism.

III-iii) Separation of tasks

Thirdly, the transparency requirement supposes that the legitimacy of a given value judgement can differ depending on the perspective: judgements are of equal value from the scientific point of view, even while from the political point of view their value and social acceptability sharply varies.

The selection from among different potential normative criteria should not be done by scientists, but by those who have legitimacy to perform this function-hence either the persons themselves, or those who are representative of their interests (whom we above called politicians, after Weber). There is a diversity of possible views here, which formal devices may help us to objectivize and disentangle. In the archetypal transparency requirement, therefore, we observe a three-stage process of reasoning: politicians choose ethical values; scientists associate the politicians' values (and no others) within the social welfare functions through axiomatics; and policy analysts apply the chosen social welfare functions in the given context and derive normative conclusions. The use of axiomatics explicates the normative load of a chosen social welfare function; the application of this social welfare function to a specific situation then enables us to generate an evaluative or prescriptive judgement, which closely derives from the chosen values, but does not depend on the scientist. From this it follows that a similar situation may be judged differently by different philosophical theories, but equally by different analysts considering a given theory. A given sponsor may ask different scientists and still get the same 'neutral' answer to their normative question.

IV-The entanglement claim

The model offered by contemporary normative economics seems to meet the transparency requirement, although certain debates concerning the actual possibility of demarcation may still persist. Some, indeed, defend the thesis of an irreducible entanglement of facts and values; and as a consequence, the transparency of the normative load of any scientific assertion is not fully attainable, or will be potentially misleading.

IV-i) The case of epistemic values

According to [START_REF] Putnam | The Collapse of the Fact/Value Dichotomy and Other Essays[END_REF], values pervade scientific assertions. Descriptions always depend on the values or norms scientists may need to include in making their statements. He concludes that there is no such thing as a pure description of a reality waiting to be discovered by scientists, and that scientists' statements necessarily always include some normative content.

This recalls the argument made by [START_REF] Rudner | The scientist qua scientist makes value judgments[END_REF] that scientists are constrained to make value judgements: he underlines that "the scientist as scientist accepts or rejects hypotheses", which presupposes "the necessary selection of a confidence level or interval" (Rudner 1953: 2, 3), and hence the application of epistemic values. And this is indeed desirable, as it is the function of scientists in a society to uphold such epistemic value judgements. To fail to be aware of this is "to leave an essential aspect of the production of knowledge out of control", and hence what we need is a "science of ethics" (Rudner 1953: 6): "A science of ethics is a necessary requirement if science's progress toward objectivity is to be continuous. […] A first step is surely comprised of the reflective self-awareness of the scientist in making the value judgements he must make."

Any tool that is able to make the values included in science transparent would be a positive step in the direction of building a science of ethics. This was precisely what was proposed in the previous section of this chapter: axiomatics is a device for transparency, and formal welfarism is the framework that allows a systematic analysis in welfare economics in particular. In formal welfarism we describe the normative content of an ethical claim on the basis of two ingredients: the normative choice of a theory of individual well-being on the one hand, and the normative choice of a specific aggregating device on the other. Fully describing the normative load of an assertion with no bias only holds conditionally upon the requirement that these two ingredients are independent of each other, however; otherwise, the dependency between the two levels would import other unexpected normative issues. 6And they are indeed not independent, since the aggregation rule enforces or requires certain properties of the informational basis: using a utilitarian sum requires cardinal utilities, and, conversely, ordinal utilities are compatible only with the Pareto criterion [START_REF] Baujard | L'économie du bien-être est morte. Vive l'économie du bien-être ! In Philosophie économique[END_REF]. Pursuing this line of thought, in providing a systematic analysis of this dependency for the case of voting rules, I have considered the individual informational basis as the voter's preferences as captured through a given form of ballot-which may be either the single name of a candidate, a list of approved names, names associated with nominal or cardinal grades for various given scales, etc.-and the aggregative part as the aggregative component of the voting rule-which may be the sum, but also the mean or the median [START_REF] Baujard | Le bien-être et les valeurs en économie. Perspectives historique, expérimentale et philosophique[END_REF]. While in a welfarist framework, the analysis of the normative load of a voting rule should be independently based on these two successive steps, I have shown that the ballot information depends on and influences the aggregative rule used through a mechanical effect, e.g. certain aggregative procedures are only compatible with certain forms of ballots. The dependency also obtains through psychological and behavioural effects: the strategic incentives or the ability for expression induced by the aggregative device, for instance, modifies the voter's expression of their preferences (see notably [START_REF] Baujard | How voters use grade scales in evaluative voting[END_REF][START_REF] Baujard | Some regrettable grading scale effects under different versions of evaluative voting[END_REF]); hence the ballot is not given independently of the voter's preferences, but also depends on the aggregative device.

As a consequence of the dependency between the two stages in formal welfarism, the possibility of demarcation is disrupted even in the case of axiomatics. Instead of concluding that there is an irreducible entanglement, some claim rather that it shifts the problem onward, and propose to modify the target of the axiomatic analysis: Ceron and Gonzalez (2020) propose to include the two levels simultaneously in their axiomatic analysis, and undertake a new research program in this regard. It is too early to say whether axiomatics may reveal itself to be the science of ethics that is likely to achieve a full normative analysis in this sense; but we can still assert that, as a device to factor out the descriptive and evaluative components of assertions at this stage, it is a good candidate to reduce the impact of the entanglement problem.

IV-ii) The contextual dependency of facts and values

Distinguishing between 'thick' and 'thin' concepts, [START_REF] Williams | Truth in ethics[END_REF] observes that thin judgement admits only evaluative content ('good' or 'bad', 'right' or 'wrong') and remains very general, while a thick concept combines evaluative and non-evaluative description ('cruel', 'generous', 'courageous') and implies some description of the context. But Williams also observes that such description can never be objective, as it always requires a perspective from which one wants to look at the world, 7 hence he supports a relativistic thesis. Putnam (2002:34-45) questions his relativist conclusion, and rather supports the view that, because in thick concepts the evaluative and descriptive aspects are intertwined, there is an irreducible dependency between values and facts. [START_REF] Sen | The nature and classes of prescriptive judgments[END_REF] insists on the importance of distinguishing 'compulsive' and 'noncompulsive' judgements among the diversity of value judgements. Compulsive judgements are imperative prescriptions, i.e. those that must be done whatever happens; non-compulsive evaluations are not absolutely obligatory, and may be neglected e.g. for lack of other potentially relevant information concerning the context. He then introduces a distinction between 'basic' and 'non-basic' statements. Some judgements may be basic if they always hold whatever the context: 'you should not kill, whatever happens'. Sen, however, very much doubts that any judgement can ever be considered as non-basic, and this doubt especially concerns those judgements likely to be relevant for welfare economics. Indeed it is hard to make sense of assertions such as: 'one should lower taxes, in every situation', or 'the local government should build a swimming pool, whatever the public finance and the tastes of the population'. By contrast, after a thorough descriptive analysis of the economic, social, and cultural situation, it may be meaningful to assert that 'in this specific case, it would serve aim A or conform with value B to lower taxes', or that 'considering the financial situation and the project, considering the cultural and sports policy goals of the new elected officials, considering the expected economic, social, and personal benefits of the pool set out in model z of agency β, building a swimming pool would provide more social benefits than less'. As these examples illustrate, all evaluative statements depend in some sense on descriptive judgements. Conversely, descriptions are chosen based upon the specific aim of the value judgement embedded in the evaluation. [START_REF] Sen | Plural utilities[END_REF] called this "description as choice", stating that any description supposes an active process of selection of some specific relevant information among an ocean of potentially relevant information. The description hence depends on this selection, which is driven by some values and goals.

Those values and goals should certainly not be swept under the carpet. They may even be specified as transparently as possible, as I have previously claimed in applying the "description as choice" argument to the axiomatic approach of formal welfarism [START_REF] Baujard | Value judgments and economics expertise[END_REF]). We said above that the use of axiomatics is able to strive towards being value-free as it conveys values which are not held by the scientist: this proposal might be acceptable if confined within a theory. Nevertheless, in the case of economics expertise, when applying the formal analysis to specific contexts experts need to include goals and values when describing relevant information concerning the context. The choice of description is intertwined with the choice of values. To go beyond the thesis of entanglement, therefore, we need not only a science of ethics but also a science of the art of choosing the right models and data in the context of expertise. This is yet to come; and until then, the entanglement claim, at least in so far as it concerns welfare economics in the making, still has a robust future.

V-Conclusion

Whether welfare economics is or is not value-laden is not a matter of debate: since welfare economics is not liable to issue in any recommendations without a prior reference to values, whether epistemic or ethical, it must be seen as pervaded with values. But depending on how the debate over ethical values has been approached-whether from the value confinement ideal, the value transparency requirement, or the entanglement claim-certain important restrictions and developments have taken place. Let us recognize that the neutrality claim is still very present in the economists' beliefs. The value confinement ideal has led to a strong restriction of focus to ordinal utilities, a narrowing of the number of value judgements, and, potentially, the silent inclusion of certain other ethical judgements. It is fair to say that the axiomatic devices elaborated in the transparency requirement as a means to make values transparent and clearly demarcate them from descriptive statements have not yet achieved generalized application in applied welfare economics; nevertheless, it seems to have constituted a first step in the reduction-if not the resolution-of the issues raised by the entanglement claim.

Now that we have established the different rationales as to how values may be considered within welfare economics, the major question for welfare economics-namely, what social welfare is-can be studied with fresh eyes. Being directly related to values, welfare economics is first required to define or decide what social welfare depends on, and which values should be considered as legitimate in this process. Choosing the relevant description of the social states entails an ethical commitment, which appears to be a fundamentally political issue. This chapter has intended to contribute to the clarification of the debate in this regard.

References to "chapters" are references to the content of the Handbook of Philosophy of Economics.

Notice that, throughout the history of welfare economics, the Pareto criterion has been considered by economists both as a positive and as a normative view. Berthonnet and Declite (2014) have shown that its use evolved from a normative to a positive concept in the course of the second half of the 20th century.

This implies, on the one hand, ethical individualism: a social state is assessed only on the basis of how that state affects individuals, to the exclusion of any other source of ethical values. We cannot assign an intrinsic importance to social phenomena, collective objects, or externalities apart from their individual parts.On the other hand, welfarism supposes a stable focus on a given theory of individual utility. Welfare economics has long defended the superiority of subjective ordinal utility, instead of its alternative. But note that the selection of one notion of well-being could nevertheless be considered as a significant normative choice. Each notion is consistent with the formal welfarist framework, while also setting specific constraints upon it; it corresponds to distinct social theories of justice. Well-being could designate utility,[START_REF] Baujard | Value judgments and economics expertise[END_REF] or primary goods,[START_REF] Baujard | Value judgments and economics expertise[END_REF] Utility on the one hand may refer to a state of mind. Hedonic theories, as in classical Utilitarianism, consider well-being as the experience of happiness, the balance between pains and pleasures, or as flourishing. This notion of well-being has been seen as insufficiently measurable or comparable to be serviceable for the new welfare economics. An alternative is to see utility as the mere numerical representation of preferences: if individual i prefers x to y, this means her utility is higher with x than with y. Under the revealed preference theory, i prefers x to y if and only if she chooses x when she has the opportunity to choose among x and y. Philosophers would require that preferences be rational, informed, and based on true beliefs (see chapter on well-being, Hausman, and other issues on normative behavioural economics). When utility is interpreted on the basis of preferences alone, it is only ordinal and non-comparable. On the other hand, utility may refer to a state of the world, e.g. the level of

Gharbi and Meinard (2020) use a similar argument when, reflecting on the fact that formal welfarism has pretentions to neutrality, they maintain that the dependency of the two stages compromises this neutrality.

By contrast,[START_REF] Sen | Internal consistency of choice[END_REF][START_REF] Sen | The idea of justice[END_REF] considers this fact as the context for forming an objective positional view, at least if it can still be made context-dependent although personally invariant.


Mohamed Elshamy

Haralampos-G Stratigopoulos

Neuron-PUF: Physical Unclonable Function Based on a Single Spiking Neuron

We propose a novel Physical Unclonable Function (PUF) concept based on a single spiking neuron. The inherent variability of the neuron results in a chip-unique analog spiking pattern that is digitized to produce a chip-unique digital key. A stability booster is also employed based on self-masking to obtain a fully stable digital key. The PUF is area and power effective since a single PUF cell is used to produce an arbitrarily sized digital key. We demonstrate PUF quality metrics close to ideal values and argue that the PUF is resilient against various physical attacks.

I. INTRODUCTION

Physical Unclonable Functions (PUFs) are a class of hardware security primitives that find several applications [START_REF] Herder | Physical unclonable functions and applications: A tutorial[END_REF], [START_REF] Gao | Physical unclonable functions[END_REF]. A PUF is a circuit that leverages statistical manufacturing variations of circuit parameters to generate a chip-unique signature. When queried with an input, referred to as challenge, it generates an output, referred to as response, that typically is a bitstring composing a digital key. Ideally, a PUF should be reliable, i.e., in the presence of temperature and voltage variations, noise, and aging the key-bits should be stable. It should also be random providing a chip-unique response, i.e., PUFs into any two different chips should give different responses for the same challenge. An additional demand is resiliency against attacks, i.e., modeling attacks that leverage machine learning and side-channel information to model the PUF behavior [START_REF] Rührmair | Modeling attacks on physical unclonable functions[END_REF], [START_REF] Xu | Hybrid side-channel/machine-learning attacks on PUFs: A new threat?[END_REF] and memory attacks aiming at stealing the key [START_REF] Helfmeier | Cloning physically unclonable functions[END_REF]. PUFs are also characterized by the energy per bit and area per bit, which are especially important metrics for PUFs embedded in resource-constrained devices.

PUF applications include among others device authentication, secret key generation, hardware anti-piracy, security in Internet-of-Things (IoT) devices, etc. In device authentication, the PUF is used as a silicon biometric to generate a unique fingerprint or ID per chip [START_REF] Suh | Physical unclonable functions for device authentication and secret key generation[END_REF], [START_REF] Sadeghi | Enhancing RFID security and privacy by physically unclonable functions[END_REF]. In secret key generation, a PUF is used to generate the key on-the-fly at power-on, thus avoiding explicit key storage [START_REF] Suh | Physical unclonable functions for device authentication and secret key generation[END_REF]. In hardware anti-piracy, the PUF can be used to provide each chip an ID such that it can be traced along its lifetime for anti-counterfeiting purposes [START_REF] Guajardo | Brand and IP protection with physical unclonable functions[END_REF], [START_REF] Guin | Counterfeit integrated circuits: A rising threat in the global semiconductor supply chain[END_REF]. In addition, a PUF can be used in the key management scheme of chip locking techniques [START_REF] Roy | Ending piracy of integrated circuits[END_REF]- [START_REF] Yasin | Trustworthy Hardware Design: Combinational Logic Locking Techniques[END_REF]. In a resourceconstrained smart IoT edge device, a PUF can be used for lightweight low-cost authentication protocols [START_REF] Chatterjee | RF-PUF: IoT security enhancement through authentication of wireless nodes using in-situ machine learning[END_REF], [START_REF] Mahmod | Robust, lowcost and secure authentication scheme for IoT applications[END_REF].

The PUF concept was originally introduced in [16]- [START_REF] Gassend | Silicon physical random functions[END_REF] and several silicon PUF implementations have been proposed since then. The most popular PUFs are delay-based PUFs, such as the arbiter [START_REF] Gassend | Silicon physical random functions[END_REF]- [START_REF] Sahoo | A multiplexer-based arbiter PUF composition with enhanced reliability and security[END_REF] and ring oscillator (RO) [START_REF] Suh | Physical unclonable functions for device authentication and secret key generation[END_REF], [START_REF] Gassend | Silicon physical random functions[END_REF], [START_REF] Maiti | A large scale characterization of RO-PUF[END_REF] PUFs, and memory-based PUFs, such as the SRAM [START_REF] Guajardo | FPGA intrinsic PUFs and their use for IP protection[END_REF]- [START_REF] Liu | A 373-F 2 0.21%-native-BER EE SRAM physically unclonable function with 2-D power-gated bit cells and Vss bias-based dark-bit detection[END_REF], flipflop [START_REF] Maes | Intrinsic PUFs from flip-flops on reconfigurable devices[END_REF], [START_REF] Van Der Leest | Hardware intrinsic security from D flip-flops[END_REF], and latch [START_REF] Kumar | Extended abstract: The butterfly PUF protecting IP on every FPGA[END_REF], [START_REF] Su | A digital 1.6 pJ/bit chip identification circuit using process variations[END_REF] PUFs. Delay-based PUFs exploit some race condition that is built-up inside the circuit, while memory-based PUFs exploit the natural tendency of a memory cell towards one of its two states. There exist several variations of those PUFs, as well as several other PUF designs based on different concepts [START_REF] Helinski | A physical unclonable function defined using power distribution system equivalent resistance variations[END_REF]- [START_REF] Yu | iPUF: Interconnect PUF with self-masking circuit for performance enhancement[END_REF].

No PUF is inherently robust and a percentage of PUF cells may generate unstable bits that should be handled accordingly. Stability boosting techniques include temporal majority voting to stabilize noisy bits, burn-in hardening to accelerate aging, self-masking of "dark" bits that are unstable across varying operating conditions, and error correcting codes (ECCs) circuits [START_REF] Mathew | A 0.19pJ/b PVT-variation-tolerant hybrid physically unclonable function circuit for 100% stable secure key generation in 22nm CMOS[END_REF], [START_REF] Maes | PUFKY: A fully functional PUF-based cryptographic key generator[END_REF]- [START_REF] Colombier | Key reconciliation protocols for error correction of silicon PUF responses[END_REF]. For this reason, PUFs typically generate an excess number of bits which can be thereafter down-sampled to a fully stable key.

Another categorization of PUFs takes into consideration the number of challenge-response pairs (CRPs) that the PUF can support. A PUF that can support only a small number of CRPs is called a weak PUF, while a PUF that can support a very large number of CRPs that cannot be tried out in a reasonable time frame is called a strong PUF.

In this paper, we propose a novel PUF class, called neuron-PUF, that uses a single spiking neuron as the source of entropy. A spiking neuron produces a pulse wave whose preset duty cycle and periodicity will depend on random process variations. This analog signature is processed by a key extractor to generate the digital key. A stability-enhancement technique based on self-masking is used to drop native unstable bits identified during testing. Neuron-PUF uses a composite and multidimensional challenge which makes it a candidate for implementing a strong PUF.

Previously proposed PUFs use space redundancy, i.e., multiple PUF cells, to generate the PUF response. For example, the arbiter uses n delay path circuits built by a serial connection of multiplexers to generate an n-bit PUF response. The RO PUF consists of N ROs from which a maximum of n = log(N !) PUF response bits can be extracted. For SRAM PUFs, an n-bit PUF response can be extracted by selecting the logic state of n SRAM cells. In contrast, the proposed neuron-PUF uses a single PUF cell based on a single spiking neuron and extracts an arbitrarily long PUF response in a serialized fashion using temporal redundancy. Therefore, the proposed neuron-PUF significantly reduces area and power overheads.

The rest of the paper is structured as follows. In Section II, we discuss spiking neurons focusing on the specific spiking neuron that we employed. In Section III, we present the neuron-PUF architecture. In Section IV, we present the PUF quality metrics used to characterize the proposed PUF. In Section V, we present the results. Section VI concludes the paper.

II. SPIKING NEURONS

Spiking neurons are biologically-inspired neuron models that serve as the fundamental building block of neuromorphic systems. Neuromorphic systems aim at emulating the brain functionality for efficiently solving cognitive tasks, i.e., visual recognition and motion control. A large number of neuromorphic systems have been demonstrated in the recent years [START_REF] Furber | The SpiNNaker Project[END_REF]- [START_REF] Camuñas-Mesa | A configurable event-driven convolutional node with rate saturation mechanism for modular convnet systems implementation[END_REF]. Spiking Neural Networks (SNNs) constitute the third generation of neural networks aiming at bridging the gap between the biological brain and machine learning in terms of recognition speed and power consumption [START_REF] Maass | Networks of spiking neurons: The third generation of neural network models[END_REF], [START_REF] Camuñas-Mesa | Spiking neural networks and their memristor-CMOS hardware implementations[END_REF].

There are several spiking neuron models of different complexities, ranging from biophysical models to phenomenological models, such as the most popular Integrate & Fire (I&F) model, which can have a hardware-friendly implementation and can still be designed to reproduce a large variety of spiking firing patterns observed in biological neurons [START_REF] Indiveri | Neuromorphic silicon neuron circuits[END_REF]. An I&F spiking neuron receives and integrates input spikes from neurons in the previous layer via the synaptic connections. If its state reaches a certain threshold, then it fires a spike of its own that propagates to the neurons in the next layer via the synaptic connections. In addition, it resets its state so that it can fire again.

There are several hardware implementations of I&F spiking neurons of different complexities [START_REF] Indiveri | Neuromorphic silicon neuron circuits[END_REF]. For the purpose of this work, as a proof of concept, we use the axon hillock circuit proposed in [START_REF] Mead | Analog VLSI and Neural Systems[END_REF], whose schematic is shown in Fig. 1(a).

When V start = 0, the input is disconnected and the capacitor C 1 is discharged to 0. When V start = V dd , the switch S 2 turns on and the switch S 1 turns off. The input current I in starts charging the capacitor C 1 , which models the membrane capacitance of the neuron's cell. When the membrane voltage V m reaches the threshold V of the first inverter, then the inverters switch state and the output fires a pulse, i.e., V out goes to V dd . The capacitor C 2 models the inherent positive feedback of the neuron cell. As V out increases, V m increases due to the positive feedback even faster. Setting a V bias higher than the threshold voltage of transistor M 2 introduces a leaking mechanism that helps the neuron to reset itself once it has fired a spike. In particular, when V out increases to V dd , C 1 starts discharging to 0 via the current I r flowing through transistors M 1 and M 2 , until a point where V m drops below the inverter's threshold. At this point, the output voltage goes rapidly to ground and the pulse is terminated. Then, for a constant input current the neuron starts again the integration process to fire another pulse. A simulation of this circuit is shown in Fig. 1(b).

It can be shown that the spike duration is given by

T high C 2 × V dd I r (V bias ) -I in , (1)
and the time between two consecutive spikes is given by

T low C 1 + C 2 I in V . (2)

III. NEURON-PUF ARCHITECTURE

The architecture of the proposed neuron-PUF is illustrated in Fig. 2. It consists of the PUF core, which takes the challenge as input and produces the PUF raw response, and the stability booster, which enhances the stability of the PUF final response.

The PUF core consists of the spiking neuron, which generates an analog signature, and the key extractor, which processes the analog signature to generate the digital PUF response. In more detail, the PUF starts generating its response when V start goes high. The spiking neuron integrates a current I in , and produces at its output a spiking pattern in the form of a pulse wave, whose duty cycle and periodicity are defined by T high and T low in Eqs. ( 1)-( 2). The key extractor consists of a linearfeedback shift register (LFSR) and an edge triggered flip-flop. The flip-flop receives its input from the LFSR and is clocked with the pulse wave, producing a serialized raw digital PUF response in the form of a bitstring.

Since the sampling is non-coherent, the raw response can be arbitrarily long. Therefore, fixed time windows on the raw response starting with any delay t d with respect to V start can be considered to extract an n r -bit raw response. The time window equals n r /f s , where f s is the system clock. Notice that the time window could also be divided into multiple intervals. The main source of entropy is process variations within the spiking neuron affecting capacitor values, leakage current I r , and inverter threshold V , which in turn alter the period and duty cycle of the firing pattern as shown in Eqs. ( 1)-( 2).

The stability booster consists of a linear drop-out (LDO) regulator and a self-masking circuit. The LDO regulator stabilizes the supply for all the sub-blocks against temperature and external power supply variations. An already existing LDO inside the chip can be used to power the PUF. In our implementation, we use a standard LDO architecture composed of a sub-bandgap reference (SBGR) voltage generator, an error amplifier implemented with an operational transconductance amplifier (OTA), a power p-MOS transistor, and a feedback resistor network [START_REF] Elshamy | Hardware trojan attacks in analog/mixed-signal ICs via the test access mechanism[END_REF]. The bitmask is chip-specific and is computed during testing time. In particular, the chip is exercised by varying temperature and power supply and the n r -bit PUF response is collected several times. The bitmask is a bitstring of length n r that has 1 when the corresponding bit has been shown to be stable and 0 otherwise. The bitmask is stored inside the chip in a non-volatile memory (NVM) and loaded into a shift-register at power-up. When the time window starts, the raw PUF response is driven into a shift-register that is clocked with the bitmask. Thus, only the stable bits are serially shifted into the register, while the unstable bits are dropped. At the completion of the time window, the stable n-bit PUF response, where n ≤ n r , is latched using negative edge-triggered flipflops.

The advantageous property of the proposed neuron-PUF is that it uses a single compact cell to produce an arbitrarily long key, thus it can offer significant power and area cost savings compared to existing PUFs that use one cell per key-bit.

Since the neuron-PUF generates serially the key and the keybits are closely spaced, the key cannot be easily correlated to power traces, thus reading-out the key at run-time via side-channel analysis is unworkable. The neuron also presents complex dynamics albeit having a simple structure, i.e., the challenge is related to the derivative of the membrane potential that defines the spike firing. These two properties, combined with the composite and very large CRP space, make the neuron-PUF highly resilient against modelling attacks. Finally, the neuron-PUF is resilient to memory attacks for stealing the key. Stealing the bitmask from the NVM only reveals the position of stable bits and not the key itself, but this also requires knowing part of the challenge, i.e., the delay t d .

IV. PUF QUALITY METRICS

There are several PUF quality metrics proposed in the literature [START_REF] Katzenbeisser | PUFs: Myth, fact or busted? a security evaluation of physically unclonable functions (PUFs) cast in silicon[END_REF], [START_REF] Maiti | A systematic method to evaluate and compare the performance of physical unclonable functions[END_REF]. Herein, we use a distinct set of metrics that are the most vital for characterizing the reliability and randomness of a PUF. The set of metrics includes uniformity, uniqueness (or inter-PUF variation), diffuseness, and stability (or intra-PUF variation). The first three metrics also characterize the unpredictability of the PUF against modeling attacks.

We use the following notation in describing PUF metrics:

• N is the number of PUFs evaluated on N different chips.

• n is the number of bits in the PUF response.

• m is the number of challenges of the PUF.

• r ijk is bit j in the PUF response of chip i for challenge k. Uniformity estimates how uniform the proportion of 0 and 1 is in the PUF response bits. For a given chip i and challenge k it is expressed as:

• R ik is the n-bit PUF response of chip i for challenge k, i.e., R ik = [r i1k , • • • , r ink ]. • T
Uniformity = 1 n n j=1 r ijk × 100%. (3)
Ideally, uniformity should be equal to 50%. Uniqueness represents the ability of a PUF to uniquely distinguish a chip among a set of identical chips. For a given challenge k it is expressed as:

Uniqueness = 1 N 2 N -1 i=1 N j=i+1 HD(R ik , R jk ) n × 100% (4)
Ideally, uniqueness should be equal to 50%. Diffuseness measures the difference in the PUF responses when the PUF is queried with different challenges. For a given chip i it is expressed as:

Diffuseness = 1 m 2 m-1 k1=1 m k2=k1+1 HD(R ik1 , R ik2 ) n × 100% (5)
Ideally, diffuseness should be equal to 50%. Stability captures the capability of the PUF to reproduce its response bits under temperature variations, power supply fluctuations, noise, and aging. For a given chip i and challenge k it is expressed as:

Stability = 1 - 1 T T t=1 HD(R 0 ik , R t ik ) n × 100%, (6)
where R 0 ik denotes an enrollment of the PUF response at nominal operating condition and is used as a reference. Ideally, stability should be equal to 100%.

V. RESULTS

The neuron-PUF is designed in the 65nm CMOS technology by STMicroelectronics. For the purpose of simplicity, in our demonstration we consider that the PUF challenge is defined only based on I in , i.e., V bias , seed of LFSR, and delay t d of the time window with respect to V start are fixed.

For the spiking neuron we use minimum size transistors so as to increase the impact of process variations. We set I in = 14.6µA and V bias = 0.6V .

We used an LFSR with feedback polynomial x 5 + x 4 + 1 and seed "01110", resulting in a pattern that is repeated every 22 clock cycles. It turns out that the choice of the LSFR, i.e., length, polynomial, and seed, affects the PUF metrics. For example, increasing the LFSR length from 3 to 6 bits increases uniqueness by 10-25% and changing the seed can offer a further 4-7% improvement. The chosen LFSR results by performing such trials, but this is a quick analysis since PUF metrics close to their ideal values can be obtained in just a handful of trials.

We opt for generating a 256-bit raw PUF response. Considering a clock period of 2.56ns, this sets the time window to 0.4µs. We consider that the rising edge of the time window comes t d = 3 clock cycles after V start goes high.

The output of the LDO stabilizes around V LDO = 1.2V for the nominal power supply V dd = 1.6V. In particular, it shows a 33.4mV variation when V dd varies from 1.4V to 3V and a 10mV variation when temperature varies from -55 • C to 125 • C. The transient response for a variation of load current from 50mA to 0mA and then from 0mA to 50mA, shows a maximum overshoot of 44.9mV and settles after 875ns, while the maximum undershoot is 53.2mV and response settles after 800ns.

Fig. 3 shows a transistor-level transient simulation of the neuron-PUF using the above settings. We plot all the relevant signals and at the bottom we show the raw PUF response and cross out the unstable bits. Bit α 1 corresponds to the output of the first flip-flop of the shift register, as shown in Fig. 2. When the bit of the bitmask is 1, α 1 is shifted by one position, i.e., α 2 = α 1 , and α 1 is updated to store the bit of the current raw PUF response. When the bit of the bitmask is 0, α 1 retains its value. Thus, the first bit in the α 1 bitstring shown in Fig. 3 corresponds to bit b n of the stable PUF response, and the last bit in the α 1 bitstring shown in Fig. 3 corresponds to bit b 1 of the stable PUF response.

A set of N = 100 PUF instances emulating PUFs from 100 different chips is generated by performing a Monte Carlo (MC) analysis with 100 runs, considering both mismatch and interdie variations, and using the actual statistical process design kit (PDK) of the technology.

Uniqueness and average uniformity and diffuseness across the 100 PUF instances are calculated by simulating the PUF instances at nominal conditions of 25 • C and V dd = 1.6V. For diffuseness, we change I in from 13.8µA to 15.3µA with step size of 0.15µA. Stability for each instance is calculated by changing temperature from -25 • C to 100 • C in steps of 25 • C and V dd from 1.3V to 1.9V in steps of 0.1V. Thereafter, we report average stability across all instances. The four PUF quality metrics are summarized in Table I considering the PUF raw response at the output of the PUF core, and the PUF response after stability boosting using the LDO only and the complete stability booster. As it can be seen, for the complete system, uniformity, uniqueness and diffuseness are 47.49%, 48.42%, and 46.25%, respectively, i.e. close to their ideal 50% value. Without the stability booster uniformity increases to 53.38% and diffuseness increases to 54.07%. Without the stability booster, the percentage of stable bits under V dd and temperature variations is around 60.5% and 61%, respectively. Adding the LDO enhances the stability by around 35.6% and 29% against V dd and temperature variations, respectively. With the complete stability booster in place, we obtain a fully stable 199-bit PUF response.

The PUF core consumes only 44.39nW/bit or 0.114fJ/bit, considering a clock period of 2.56ns and that there are 256 raw bits. For the same technology node, corresponding reported values for SRAM and RO PUFs are 1100fJ/bit and 474.8fJ/bit, respectively [START_REF] Alvarez | Static physically unclonable functions for secure chip identification with 1.9-5.8% native bit instability at 0.6-1V and 15 fJ/bit in 65nm[END_REF]. Using the stability booster, power consumption raises to 0.64µW/bit, but a stability booster is needed in all PUF architectures and can be excluded from the direct comparison.

Finally, the layout area of the PUF core is 13.4µm×20.2µm.

Considering that there are 199 stable bits, area per bit is 322F 2 , where F=65nm is the minimum feature size. For the same technology node, corresponding reported values for SRAM and RO PUFs are 806F 2 and 39000F 2 , respectively, computed as the ratio of the array area and the number of stable bits [START_REF] Alvarez | Static physically unclonable functions for secure chip identification with 1.9-5.8% native bit instability at 0.6-1V and 15 fJ/bit in 65nm[END_REF]. In summary, the neuron-PUF offers significant reductions in area and power overheads compared to SRAM and RO PUFs.

VI. CONCLUSIONS

We proposed neuron-PUF, a novel PUF design that uses a single spiking neuron as the source of entropy. Neuron-PUF is a single-cell PUF that uses temporal redundancy to generate a digital key of arbitrary size. It has a composite and large CRP space making it a candidate for implementing a strong PUF. Simulation results show that the neuron-PUF achieves close to ideal PUF metrics. It also has high potential for resisting modeling and memory attacks. The single-cell property results in minimum energy per bit and area per bit compared to all popular PUFs.

In terms of future work, we are planning to continue the verification and experimental validation towards proving PUF robustness and resilience to mainstream attacks. We are also planning to investigate the use of different types of spiking neurons [START_REF] Indiveri | Neuromorphic silicon neuron circuits[END_REF] in the context of the neuron-PUF architecture.

Fig. 1 .

 1 Fig. 1. The axon hillock circuit: (a) schematic; (b) transient response.

Fig. 2 .

 2 Fig. 2. Neuron-PUF architecture.

Fig. 3 .

 3 Fig. 3. Transient simulation of neuron-PUF showing relevant signals.

  is the number of PUF response measurements over time and different operating conditions, i.e., changes in ambient temperature and supply voltage fluctuations. • HD(R ik , R jk ) is the Hamming distance (HD) of the PUF responses in chips i and j for challenge k. Similarly, HD(R ik1 , R ik2 ) is the HD of the PUF responses in chip i for two different challenges k 1 and k 2 , and HD(R t1 ik , R t2 ik ) is the HD of the PUF responses in chip i for challenge k for two different measurements t 1 and t 2 .

TABLE I NEURON

 I -PUF QUALITY METRICS.

		Uniformity	Uniqueness	Diffuseness	Stability	Stability
					(T )	(V dd )
	PUF core	53.83%	48.54%	54.07%	61%	60.51%
	With LDO only	53.8	48.54%	49.43%	90.04%	96.11%
	With complete stability booster	47.49%	48.42%	46.25%	100%	100%

ACKNOWLEDGMENTS

This work has been carried out in the framework of the ANR STEALTH project with N o ANR-17-CE24-0022-01.