Jean-Ferdy Susini1
email: jean-ferdinand.susini@cnam.fr

Olivier Pons
email: olivier.pons@cnam.fr

Nolwenn Guedin
email: nolwenn.guedin@unige.ch

Catherine Thevenot
email: catherine.thevenot@unil.ch

Danse-doigts, a Fine Motor Game

Keywords: Game, Rehabilitation, Hemiparesis, Numerical skills, Tablet, Web, Parallel programming

This paper describes the design, implementation and testing of "Danse-doigts", an edutainment therapeutic application for hemiplegic children. The objective of this program is twofold. Firstly, to allow them to train their fine motor skills on tablet. Secondly, to study the effect of this training on their numerical performance (counting, calculation...). The target population and the objective of evaluating numerical skills influenced the design. The software was developed using standard web technologies but is based on a new parallel programming library written in JavaScript.

Applications and libraries are free of charge and easy to install on most tablets.

Introduction

In this article we present the approach used during the implementation of "Danse-doigts", an edutainment therapeutic application for the rehabilitation of the upper limb of hemiparetic children. Our goal is twofold. Firstly to provide a training tool for hand fine motor skills. Secondly, to measure the impact of this training on numerical skills (counting, calculation...).

This duality makes the design of "Danse-doigt" particularly interesting to study. Indeed, we tried to design a game whose playful and ergonomic aspects are relevant to the target population, but also to incorporate finely therapeutic intentions, without disrupting the intended study.

The lack of accurate data on the target population (degree of motor impairment, presence and extent of spasticity, presence of associated disorders but also morphological characteristics such as size of the hand) encouraged a modular and adaptive design. The use of specific programming libraries, which we present in Section 5, greatly facilitated this design.

We made assumptions based on our own intuition and experience. We then revised them in accordance with the incremental feedback of the experiments carried out in vivo by therapists.

The next section is a short review of some applications and games involving motor skills of the hand. In the third section we present the context and the specifications. Section four specifies the assumptions and methodology used to create playful mechanism, accessible and motivating for an audience of children, while remaining compatible with the constraints of the specifications. Section five describes the main features of the framework and programming libraries developed [START_REF] Susini | Sugarcubesjs[END_REF]. Section six presents the results of a preliminary experiment conducted on two classes of schoolchildren (without disabilities). On one side, this study allowed to adapt the software to the real constraints. On the other side, it aimed at investigating the relationship between numbers and fingers. We conclude this study with a discussion of the results of the experiment, a generalization of our approach and some proposed extensions.

Existing tools

Applications to train fine motor skills on tablet are numerous, but many of them also involve a cognitive work (puzzle, pre-writing skills...). Those targeting only motor function are rarely configurable and often inaccessible for a player with upper limb motor impairment.

Among the most used applications in motor rehabilitation, two seem to stand out: 1. Fruit Ninja [START_REF]Fruit ninja[END_REF], developed by Halfbrick where you have to cut fruits by swiping your touch screen with fingers while avoiding cutting bombs. This is now a classic, which has been ported to all platforms and is available in different versions. He was initially not therapeutic but was widely used for this purpose [START_REF] Rand | The use of the ipad for poststroke hand rehabilitation; a pilot study[END_REF][START_REF] Rand | Rehab-let: touchscreen tablet for self-training impaired dexterity post stroke : study protocol for a pilot randomized controlled trial[END_REF].

The Dexteria suite, developed by BinaryLabs includes "Dexteria Fine Motor Skill

Development" [START_REF]Dexteria -fine motor skill development app[END_REF] which claims to be :« A set of therapeutic hand exercises (not games) to improve fine motor skills and pre-writing among children and adults. ».

Dexteria exercises take advantage of the multi-touch interface to train various gesture and aim to improve strength, control, and dexterity. However if their different Game Play provide inspiration, none of these applications seem to have the characteristics what are relevant to us, in terms of software development, to allow optimal use of rehabilitation applications:

-To be easily deployable at lower costs (without rewriting) on any kind of tablet -To be easily customizable and configurable according to the therapeutic or experimental constraints.

-To allow to closely monitor all interactions with the "user" at different levels of accuracy.

-To be extensible, allowing to add new features without compromising the existing.

The development platform must also be open source. Thus any research team would be allowed to tailor it in order to meet their particular needs.

Constraints of the specifications

We now present the target population and the objective of the planned study. We also study their influence on the design of the application.

The Target: the hemiparetic child

Hemiparesis is an unilateral paresis due to brain injury. Relatively common in children, with a prevalence of 1/1,000, it may be congenital or acquired. It results in various level and kind of incapacity and may be associated with other disorders (epilepsy, spatial and visual disturbances...). This diversity complicates the specification and design of specific rehabilitation applications. We only target the upper limb. In the first version of the application (dedicated to the study), we only assumed a sufficient mobility to click with different fingers. In the next versions we also assumed an (even limited) ability to pinch (thumb-index oppositions) which is one of the main difficulty for a hemiplegic hand.

Moreover, in addition to school activities a child with motor impairments is faced with a lot of regular therapeutic appointments (physiotherapy, occupational therapy, psychomotricity...). A training that complements traditional therapies must not too overloaded. Thus, it should be done at home or at school. This reinforces the imperatives of cost, deployability and ease of use already mentioned in Section 2. This also requires introducing clear guidelines in the GamePlay.

Objective of the study: fingers and numerical abilities

From the early years of learning and sometimes even into adulthood, we use our fingers to represent and communicate quantities and to perform calculations [START_REF] Ifrah | Histoire universelle des chiffres[END_REF]. Described in 1940, the Gerstmann syndrom [START_REF] Gerstmann | Syndrome of finger agnosia, disorientation for right and left, agraphia and acalculia : Local diagnostic value[END_REF] suggests a link between impaired finger gnosia and low numerical skills. More recent experimental studies investigated the nature of the relationship between finger abilities and numerical performance. They have shown that the relationship between finger use and numerical representations might be related to the anatomical proximity of relevant brain areas [START_REF] Pinel | Distributed and overlapping cerebral representations of number, size, and luminance during comparative judgments[END_REF][START_REF] Rusconi | Dexterity with numbers : rtms over left angular gyrus disrupts finger gnosis and number processing[END_REF][START_REF] Sato | Numbers within our hands: modulation of corticospinal excitability of hand muscles during numerical judgment[END_REF]. In addition to this neuronal explanation, other works tend to explain this link by the early finger use in functional motor habits like pointing objects while counting, or calculating on fingers. These motor recruitments may help the good development of numerical skills [START_REF] Brian | The mathematical brain[END_REF][START_REF] Noël | Finger gnosia : a predictor of numerical abilities in children?[END_REF]. The finger gnosia task assesses the tactile ability to recognize our own fingers without visual cues. Compared to classical neuropsychological tests, this sensorimotor task performed by fiveyear old children is a better predictor for their mathematical achievement one year latter [START_REF] Fayol | Predicting arithmetical achievement from neuro-psychological performance: A longitudinal study[END_REF]. Moreover, the spontaneous fingers use in counting tasks increases from the age of 4 until 7 and is correlated with a better success rate [START_REF] Lafay | The role of fingers in number processing in young children[END_REF]. In most cases, low finger gnosia is associated to mathematical troubles even in children from 8 to 11 years [START_REF] Noël | Finger gnosia : a predictor of numerical abilities in children?[END_REF][START_REF] Costa | A hand full of numbers : a role for offloading in arithmetics learning?[END_REF][START_REF] Reeve | Five-to 7-year-olds' finger gnosia and calculation abilities[END_REF]. However, some children with bad fingers gnosia because of their congenital hemiparesis are able to sufficiently compensate their initial numerical difficulties to finally reach the same arithmetical level as children with typical development. [START_REF] Thevenot | Numerical abilities in children with congenital hemiplegia: An investigation of the role of finger use in number processing[END_REF].

If finger abilities are linked with numerical activity, training them should lead to improvements also in mathematical tasks. Proposed actions have to stimulate fingers one by one in order to study the impact of such training in numerical tasks. To do this, we have chosen pointing actions that should be done successively with each finger from both hands. To date, only one study assessed this hypothesis with children 6 to 8 years [START_REF] Gracia-Bafalluy | Does finger training increase young children's numerical performance?[END_REF]. In this study, it was asked to point target and to follow mazes 30 minutes a day for 8 weeks. It showed improvement in mathematical performance, but the validity of these results has been questioned [START_REF] Fischer | Numerical performance increased by finger training : A fallacy due to regression toward the mean?[END_REF].

One of the main objective of the study conducted with "Danse-doigts" is to try to confirm these results and later to study the gains for children with hemiparesis.

Design constraints

We now present the constraints (sometimes contradictory) that guided the design.

Maintain the motivation

Rehabilitation activity has to be steady and continued over the long term. This can quickly become repetitive, unrewarding and tedious, resulting in demotivation of patients who are then likely to follow the protocol irregularly or even to abandon it. Game design methodologies and gamification generally propose several elements likely to maintain engagement. The main ones are: storylines, goals directed around targeted skills, rewards and feedback about goal progress, increasing levels of difficulty, individualized training, and the provision of choice [START_REF] Baranowski | Playing for real : video games and stories for health-related behavior change[END_REF][START_REF] Kapp | The gamification of learning and instruction fieldbook : Ideas into practice[END_REF].

Avoid circumvention

Motivated by the game, the patient may be tempted to divert the protocol. It can, for example, always use the index in pointing tasks or, in the case of a hemiparetic patient, using his good hand when asked to use their paretic hand. It is essential to try at least to detect these diversions and to prevent them by adding the necessary constraints to the GamePlay. To ensure the use of a specific hand on a task, we can, for example, use the other hand in parallel for a static task as in Figure 1.

FIG. 1: Two fingers of the hand that does not play should remain placed on the "stop" signs. A small hand with a crown, indicating which finger should play, will be displayed. The child clicks on the crown with the required finger (here the little finger) to display the target. When the child clicks on the target (or if the timeout is exceeded), we restart with another finger.

Avoid any bias

Since we want to study the influence of finger training on numerical skills, in order to avoid any bias, software should not use any numerical information. We cannot count points, successes or failures. We neither have to numerically estimate the number of problems or the time remaining. It was also necessary to avoid any cognitive bias such a diversion of attention (background music, parasitic event, graphic changing environment ...)

« Game Design »

Reconciling constraints

The software designed for the numerical study is a fun application requiring only to point different targets using different fingers. The constraints expressed in Section 3.3 greatly reduce the fun side. We have nevertheless tried to maintain it by writing a story around repetitive tasks. Several themes are offered each containing several sub-themes. Child have to play some time before to discover a complete theme (one week in the experiment described in section 6). For example, in the nature topic for one week, children had five sorts of sub-topic, each for one day of training: "the sky", "the farm", "the garden", "the forest" and "the lake". In one-day tenminute session, the child has to do four different games, each during two minutes and an half. For example, the training "the sky" includes the games "clouds", "flakes", "sun", rain" (different target sizes).

For each challenge, when child succeed, they hear a fun sound related to the target picture (audio reinforcement). Each session ends with a congratulation message and a recompense picture with a visual summary of the four games. For example, at the end of the sub-topic "sky", the child wins a beautiful picture with rain, sun, cloud and a snowman. During the first week of the experimentation (described Section 6) it appears that the removal of any reference to the remaining playing time embarrassed children so the introduced a progress bar to avoid numerical information. The constraints of the study also limit the motor ability that we try to train. The version dedicated to the experimentation, only use pointing tasks. Activities requiring several fingers, as pinching or grasping, were not used in this first experiment (exist in new version).

The game

When the child launches the application with the theme of the week, first appear the instructions to follow during the session. Then, he can choose a subtopic (eg. "Sky"). The 4 games that compose the subtheme then appear (eg., "Rain", "Sun" ...). He then chooses the one to start first. Two "stop" signs then appear on the screen, to the right or left according to the hand that should be trained. To continue the game, child must put, two fingers on the signs (Figure 1). They must stay on the signs during the game and the game stops if they are removed.

Once the fingers in contact with "stop" signs, a picture of the other hand appears at the bottom of the screen, one finger wearing a crown. Child must then click on the crown with his own (corresponding) finger. Next he use this finger to click target that is proposed. Targets may be static or moving and have different sizes. The selected finger changes between each target so the child must remain alert and focused to distinguish its various fingers at all times. Fingers selected to click (shown by the crown) were randomly chosen from a cycle of five fingers. There is no specific order, which limits potential anticipation. Thus, discrimination of the different fingers is done without habituation to a series of repeated actions. When clicked, the target disappears and another takes its place at a different position. This is always accompanied by a "fun" sound ( related to target picture). This combination of image and sound provides better stimulation of children because the effects of the observation are increased when the inputs are multimodal [START_REF] Alaerts | Interaction of sound and sight during action perception : evidence for shared modality-dependent action representations[END_REF]. This allows better learning process.

Software Design and development

We now present some technical elements concerning the implementation of the application. We discuss in particular the programming libraries developed to ease the implementation of reactive game applications.

Technical implications

If the constraints 1 and 3 described in section 3.3 are mainly within the application design, we estimated that compliance with constraint 2 must be partly guaranteed by the application itself. The specification assumes that we have to continuously monitor the behavior of children's hands. Modulo some simple assumptions, detecting multiple points of contact on touchscreen allows, to some extent, to comply with this requirement.

However, during the experiment, our design assumptions are validated by visual inspection of an adult. Thus, to control the immobilized hand, our application monitors two points of contact "sufficiently" distant from each other. Those points are not in the screen area used by the game.

Working with a single targets, at evrery moment we should observe only one single point of contact corresponding to the finger clicking the target. Our application can detect multiple points of contact in the playing area and warn about non-compliance whith the instructions ("use only one finger to click"). However, in our experiments we only focused on the success of the exercise, ie detecting contact point within the target area. Other possible points of contact are ignored. But technically we could decide to record these unexpected contacts.

Notice that our application is also able to follow sliding touch points eg when performing exercises such pinching to merge two targets or to close fingers on a specific target.

To summarize, our application should be able to:

continually monitor at least 3 contact points;

detect any unexpected points of contact in the playing area;

follow moving points of contacts in the playing area;

manage graphical applications (displaying static targets, trajectories of moving targets, displaying instructions, progress bar ...)

coordinate the broadcast of rewards sounds and audio instructions;

observe all interactions to get statistical data.

This large number of activities to manage simultaneously (in parallel), led us to consider a parallel programming paradigm to ease implementation. As discussed in the subsection V-C, we chose the programming language JavaScript to write our application. JavaScript is present in any Web browser, but can not easily handle parallelism (in its standard version). So we used our SugarCubesJS framework that brings this dimension to JavaScript.

Parallelism and reactive programming library

The SugarCubesJS library allows to write programs designed as an aggregate of tasks executed in parallel. This library is based on the synchronous reactive programing model "à la" Boussinot. [START_REF] Boussinot | La programmation réactive -Application aux systèmes communicants[END_REF] In short, this programming model proposes to split the execution of a computer system in parts of finite time executed one after the other. Time is considered logically as a sequence of (instantaneous) steps. This allows to see the execution as a succession of logical instants. This sequence is called a clock and drives the system execution. The concept of clock, make it possible to consider the program as a set of elementary tasks running in parallel in the same instant. In this programming model, synchronization of parallel tasks becomes a natural property. Indeed, the programming model itself supports the complexity of communication between tasks and the complexity of the synchronization. This makes programming very easy, simply write small independent tasks and then to put in parallel with each other.

According to this paradigm, the SugarCubesJS framework proposes a particular notion of events that differs from conventional Javascript events. An event is a global object (accessible by all parallel components) characterized by its presence or absence during an instant. At each instant of execution, an event is either present or absent. We say that these events are instantly broadcasted because they are accessible by all parallel tasks (broadcast) during the same instant (instantaneous). When present at an instant, an event can have a list of associated objects (list of value accessible by all interested components). The coherence of the state of a given event in a logical instant ensures that all components access the same list of values associated exactly at the same logical instant. The list of values is only accessible during the instant where it is defined. At each insant, a new list of values is be defined if the event is present. Interactions between parallel tasks are managed by the instantaneous broadcast of events.

During the development of "Danse-doigt", the use of this reactive paradigm has greatly facilitated the programming of parallel monitoring of contact points (some simple tasks in parallel can generate events reporting the supposed behavior of the player). It also make aesier to manage the combinatoric coming from the game logic, the animations and the sounds (audio reinforcement on success, instructions ...).

Another very important advantage, this facilitate the introduction of observers behaviors. It is thus very simple to add observer programs in parallel in a reactive system. They listen to the data sent by the initial system (observed system). Observers manage in parallel listened data to filter, analyze and store, without disrupting the system observed.

The collect of experimental data can be implanted with SugarCubesJS completely independently of the program managing the game and of tasks controlling the player behavior. The tasks collecting data are written as parallel activities simply listening to events emitted by the other tasks (manager of contact points, manager of game logic, animation,...). Depending on the expected statistical data, tasks that collect them may also perform aggregations, correlations and various other pretreatments on the data before transmission to the collect server. All this treatments never affects the development of the game or the interaction with the user. The SugarCubesJS tasks are independent of each other, our application can be run with or without the task collecting data. The tasks of the game broadcast their events without ever having "conscience" of the existence of other tasks running in parallel (technically, you never manipulate references to other tasks). The presence or absence of the collect task does not affects the behavior of the application. To illustrate this we pushed our experimentation to develop the collect tasks on an independent server.

« WebApp » development

To facilitate the deployment of the application on most tablets, we choosed a solution independent from systems, platforms and manufactureur. This solution is a "WebApp". It uses only HTML, CSS and Javascript, and provides easy access to the application (via a web browser). The well-established standards of the Web industry make easier to write applications that can be deployed without extra cost, on tablets used in families of children participating in the experiment.

The integration on Android and iOS system is enhanced through the use of a particular web browser one each platform: Chrome for Android and Safari for iOS. Indeed, after-loading the app's Web page in the browser, it can be installed on the tablet home screen, Creating a shortcut, simulating the behavior of a native application. When the user launches the app from this shortcut, the interface of our web application, is exposed in full screen, looking like a native application.

Besides the ease of access, this technical solution also makes it fairly easy to manage updates by correcting files directly on the web server. Our framework also allows to use the application outside internet connection. However, an Internet connection is still required for the collect of statistical data. In temporary absence of connection, our framework plans to save data in the tablet data, the time to regain network access.

Experience and extensions

A pilot study [START_REF] Nogier | Entraînement des gnosies digitales et influence sur des tâches numériques[END_REF][START_REF] Picard | Projet d'amélioration des compétences numériques chez l'enfant par entraînement des habiletés et des gnosies digitales sur tablette tactille[END_REF] of 9 weeks was led with children with typical development in first and second years of primary school. Two groups were constituted: a training group who played with tablets and a control group. Seventeen children were in each group and were equally distributed according to their finger gnosia level. The mean age was of 6.6 years. The training was done during school time, four times a week, with a session of 10 minutes per day. Children played in the computer room with audio headsets in order to follow oral instructions at individual rhythms.

Several tests were assessed before and after the training (Nine-Hole Peg Test, Finger gnosia task and evaluation of numerical skills). In the assessment of the finger gnosia, children have to identify which of their fingertips the experimenter touches. In our adaptation of the task, children wore fingerless gloves, with the three central fingers of each glove of different colors. Children were asked to place their hands palm down through a lateral aperture of a covered box. The examiner touched one fingertip through an opposite aperture and rapidly opened the cover of the box. Then, children had to name the color corresponding to the touched fingers.

Digital skills were evaluated on non-symbolic material (quick comparison of dot clouds) on semi-symbolic quantities (recognition of digital configurations) and finally on symbolic representations (additions). Statistical analyses with adequate ANOVA did not show any significant progress in numerical skills even not in finger abilities. This lack of improvement could be due to a shorter time of training.

We also experimented some extensions that have not yet been studied on children:

-Use two fingers (the thumb and an opposable finger) to pinch. The child must touch two targets (one finger on each target) and slide his fingers on the screen to merge target.

-A variation of previous exercise is to ask to the child to close the pinch on a static target.

-It is possible to complicate the previous exercise by transforming the static target into a moving target ( with a predictable trajectory ) -It is also very easy to increase the number of fingers simultaneously working. But the tablet must be able to detect all contact points. Most tablets recognize at least 5 points of contact (allowing to work with 3 fingers, two contacts being used by the immobilization constraint on the other hand). More modern tablets recognize a dozen contacts which is more than enough for this kind of exercise.

-Finally, we can easily perform pointing or sliding exercises whit 5 fingers (if the hardware actually supports)

Tracking all signals from the user action allows to analyze action with different levels of precision.

Discussion & Conclusion

Various versions of the application "Danse-doigt" [START_REF] Susini | Danse-doigts[END_REF] and the programming library SugarCubesJS [START_REF] Susini | Sugarcubesjs[END_REF] are available online.

The game was well received and seems easy to pick up and play for both children and supervisors. The experiment conducted in regular classes did not confirm the expected results. This may be due to too short a training time. However, the study should be continued with hemiplegic patients. Moreover, user feedback in the first week of use has helped to refine the constraints and to correct some design mistakes. These incremental updates helped to extensively test the framework. SugarCubesJS demonstrated that it is a mature framework easy to maintain, optimize, and extend.

We also want to study the effectiveness of training with our various variants of exercises using classical motor assessments scales. For this, the use of the SugarCubesJS library and the framework developed for the experiments allow to quickly develop new versions to train other skills or for a specific study.

Thanks

We thank the organisation "Association Hémiparésie" who initiates the project and the staff and children of the Tivoli school in Dijon where experiments were conducted.

AMSE JOURNALS-AMSE IFRATH Publication -2016-Modelling C; Vol. 77; N° 2; pp 182-192 Submitted Sept. 2016;Accepted Oct. 31, 2016


Jonas Milani
email: jonas.milani@epfl.ch

Basile Vuichoud

Aurélien Bornet

Roberto Melzi

Sami Jannin

Geoffrey Bodenhausen

Hyperpolarization of Nitrogen-15 Nuclei by Cross Polarization and Dissolution Dynamic Nuclear Polarization

Dynamic Nuclear Polarization (DNP) is often achieved by direct transfer of polarization from electrons to nuclei such as 13 C, induced by microwave saturation of the wings of narrow EPR lines of radicals like trityl. In the indirect approach on the other hand, DNP is used to transfer the polarization from the electrons of radicals such as nitroxides that have broad EPR lines to nuclear spins I = 1 H, followed by cross-polarization (CP) from I = 1 H to S = 13 C or other nuclei with low gyromagnetic ratios. This approach is particularly attractive for S = 15 N, since direct DNP yields modest polarizations P( 15 N) < 4% with build-up times that can be as long as tDNP( 15 N) > 2 hours. In this paper we show that CP from 1 H to 15 N at 1.2 K can yield P( 15 N) = 25% with tCP-DNP( 15 N) = 10-15 min. After rapid dissolution and transfer to a solution-state NMR spectrometer, a polarization P( 15 N) = 20% was observed at 300 K. The longitudinal relaxation times in solution can be as long as T1( 15 N) > 800 s in favorable cases.

Introduction

Dissolution dynamic nuclear polarization (d-DNP) [1] allows one to enhance NMR signals in solution by more than four orders of magnitude compared to thermal equilibrium. Most applications to metabolic imaging exploit the enhancement of carbon-13 nuclei, [2], but nitrogen-15 has also been successfully enhanced by d-DNP [3][4][5][6]. In small molecules where 15 N is bound to protons, T1( 15 N) is typically on the order of 60 s; but when 15 N is not directly bound to any protons, very long relaxation times 200 < T1( 15 N) < 800 s have been observed near 300 K [5]. This makes d-DNP particularly attractive for nitrogen-15. Early studies of 15 N d-DNP report a modest efficiency of direct 15 N DNP when using trityl or nitroxide radicals, resulting in disappointing polarizations P( 15 N) < 4% [5] and exceedingly long build-up times, typically 𝜏DNP( 15 N) > 2 hours. Building on our recent work on low temperature cross-polarization (CP) to carbon-13 under d-DNP conditions [7][8][9], we have extended the method to nitrogen-15 and we have achieved polarization levels on the order of P( 15 N) = 20 % at 1.2 K and 6.7 T with short build-up times 𝜏CP-DNP( 15 N) ≈ 10-15 min .

Experimental design

We have designed and built a novel CP-DNP probe for cross-polarization from 1 H to 15 N at 6.7 T and 1.2 K compatible with our home-built d-DNP polarizer [10,11]. The probe can accommodate a sample insertion stick with a sample holder in a cavity where both DNP and CP can be performed simultaneously with suitable microwave and radiofrequency irradiation. The probe design is shown in Fig. 1. After CP-DNP, a dissolution stick can be is inserted to rapidly dissolve the sample to yield a hyperpolarized injectable solution. The Q factors and 90° pulse lengths were measured for both channels at 4.2 K (Table 1.) The probe has been optimized for B0 = 6.7 T, with microwave irradiation near 188 GHz, and for CP with Larmor frequencies ν( 1 H) = 285.2 MHz and ν( 15 N) = 28.9 MHz, using an adiabatic multiple-contact pulse sequence described elsewhere for 13 C [9]. Figure 1 The DNP probe comprises (1) a brass probe body that fits into the cryostat (cold bore with 45 mm inner diameter) and accommodates (2) a sample insertion stick made of G10 fiberglass that supports (3) a VESPEL sample holder. The gold-plated brass cavity (4a) is equipped with (4b) two concentric mirrors to focus the microwave field onto the sample. The 188 GHz microwaves are guided towards the sample through (5a) a 90° miter bend, followed by (5b) an oversized circular waveguide (5 mm inner diameter, 1.1 m long), terminated by (5c) another 90° miter bend. The RF coils are made of a pair of concentrically mounted perpendicular outer coils (6b) that are inductively coupled with a pair of inner coils (6a). A schematic view of the inner coils is shown in (6c). After CP-DNP, a dissolution stick (7) can be used to inject hot water to melt the sample and push the liquid hyperpolarized solution to an NMR or MRI system.

CP optimization

The CP sequence used in our study consists of two adiabatic inversions of the magnetization synchronized on both NMR channels, as previously described. The nutation frequencies of the I and S spins in the doubly rotating frame are equal to fulfill the Hartmann-Hahn condition (7). The length of the CP contact pulses is optimized to balance polarization transfer and T1ρ relaxation. This pulse length obviously depends of the magnitude of the 1 H-15 N dipole-dipole (DD) coupling. The best pulse lengths for glycine, urea and TMPA are shown in Fig. 4. Conversely, for TMPA where the protons are three bonds away from 15 N, contact pulses of 8 ms are optimal (longer pulses are not recommended to avoid arching).

Solution-state NMR at 300 K

After CP-DNP, when the polarization had reached a maximum, 5 ml of hot deuterated water at 453 K (180°C) pressurized at 1 MPa (10 bar) was injected to dissolve the frozen samples. Deuterated solvents are preferred for dissolution to attenuate relaxation due to dipolar couplings between protons, especially when protons are polarized. He gas at 6.10 5 Pa (6 bar) was used to push the solution though a 1.5 mm inner diameter PTFE tube of 5 m length. This tube was enclosed in a magnetic tunnel [12] and connected to an 11.7 T NMR spectrometer (51 MHz for 15 N, 500 MHz for protons) with a standard 5 mm NMR sample tube. The transfer time was 5 s and the injection after 2 s used a homemade injector. A 5° pulse was applied every 10 s to measure the decaying hyperpolarized 15 N signals.

Polarizations and relaxation times measured for glycine, ammonium, urea, choline and TMPA in natural abundance after dissolution are shown in Table 3. The hyperpolarized liquid-state spectra of

Conclusions

Using DNP of protons by saturating the electrons of TEMPOL, followed by cross polarization from 1 H to 15 N, one can achieve remarkably high polarizations up to P( 15 N) = 25% with a short build-up time constant tCP-DNP( 15 N) = 7-16 min, using a simple custom-built CP-DNP probe described herein.

Such high levels of polarization were never attained before. The resulting high NMR sensitivity associated with the long relaxation times T1( 15 N) observed in several compounds in solution makes nitrogen-15 an interesting candidate for hyperpolarization studies.

  Fig 2 describe the setup of the two perpendicular channel used for CP-DNP experiments.

Figure 2 (

 2 Figure 2 (A) Schematic representation of one of the two channels, composed of two inductively coupled coils. A transmission line of about 1.2 m length connects the top of the probe to the cavity in the cryostat. (B) The two perpendicular outer coils are printed on PCB foils and connected by copper wires to the external tuning and matching boxes. (C) The two concentric inductively coupled inner saddle coils have an opening angle of 120° to optimize the B1 field in the sample space.

Figure 3 .

 3 Figure 3. Build-up of the polarization P( 15 N) measured at 1.2 K and 6.7 T in 75 % deuterated ammonium, urea, glycine and TMPA in d6-DMSO/D2O/H2O (60/30/10 v/v) with 50 mM TEMPOL, assisted by multiple-contact CP (black lines) and by direct DNP without CP (red lines).

Figure 4 .

 4 Figure 4. The optimum duration of the CP contact depends on the strength of the 1 H-15 N dipole-dipole (DD) couplings. Strong couplings occur in urea and glycine where protons are only one or two bonds away from 15 N, respectively, so that short contact pulses of 1 or 2 ms are found to be optimal.

Table 3 .

 3 15 N-enriched TMPA and Urea are shown in Fig.5. It is possible to record hyperpolarized 15 N spectra of non-enriched samples in a single scan, as shown for Choline in Fig.6. One advantage is that T1( 15 N) is quite long in solution, so that the polarization P( 15 N) can be preserved for prolonged periods. The magnetization can then be transferred from15 N to 1 H by a reverse INEPT sequence. Polarization P( 15 N) in 32 mM solutions of various samples with isotopic 15 N enrichment after dissolution, measured at 51 MHz (11.7 T) and 300 K. (a) The thermal polarization and hence P( 15 N) could not be determined because of poor sensitivity. (*) Glycine was measured at pH > 8.

Figure 5 .

 5 Figure 5. (A) 15 N-spectrum of 15 N-enriched of trimethylphenylammonium chloride (CD3)3NC6H5Cl (TMPA) observed in solution at 51 MHz (11.7 T, 500 MHz for protons) in a single scan with a 5° pulse immediately after D-DNP (red line) and after complete return to thermal equilibrium overnight, by accumulating 128 transients with 5° pulses at 600 s intervals in 24 hours (black line). The hyperpolarization P( 15 N) = 16.8 % was determined by comparing with the thermal equilibrium signal. The singlet results from the isolated 15 N in TMPA. (B) 15 N-spectrum of 15 N-enriched Urea (ND2COND2) observed in solution at 28.91 MHz immediately after D-DNP (red line), and after complete return to thermal equilibrium overnight, by accumulating 300 measurements with 5° pulses at 600 s intervals in 62 hours (2.6 days) (black line). The hyperpolarization was found to be P( 15 N) = 19.2 %. The 1:2:3:2.1 multiplet is due to 1 J( 15 N, 2 D) = 14 Hz couplings with two deuterium nuclei which exchange with the solvent, since the molecule is completely deuterated after dissolution with D2O.

Figure 6 .

 6 Figure 6. Proton-decoupled 15 N spectrum of solution of 0.12 M Choline (NH4 + CH2CH2Cl -) in D2O with 0.36% natural abundance observed at 51 MHz (11.7 T, 500 MHz for protons) with a 5° pulse immediately after D-DNP.

Table 1

 1 Parameters of the resonant circuits for 1 H and 15 N of the DNP probe at 4.2 K and 6.7 T.

		1 H channel (285.25 MHz)	15 N channel (28.91 MHz)
	Q factor	197.0	136.7
	90° pulse	6 µs with 50 W	10 µs with 200 W

Table 2 :

 2 Table 2 shows the maximum polarizations achieved with and without CP, i.e., P( 15 N) CP and P( 15 N) direct , and their associated apparent build-up times 𝜏CP-DNP( 15 N) CP and 𝜏DNP( 15 N) direct . From these parameters, we determined amplification and acceleration factors brought about by CP, εCP = P( 15 N) CP /P( 15 N) direct and κCP = 𝜏DNP( 15 N) direct /𝜏DNP( 15 N) CP respectively. For Glycine, we could not determine the thermal equilibrium polarization, but we could nevertheless determine εCP and κCP. Indirect

		P( 15 N) CP	τCP-DNP( 15 N) CP	P( 15 N) direct	τDNP( 15 N) direct	εCP =P CP /P direct	κCP = τDNP direct /τDNP CP
	Ammonium	17 ± 2.6 %	15.9 ± 1.2 min 2.3 ± 2.6 %	27.4 ± 4.5 min 7.4 ± 0.2	1.72 ± 0.4
	Urea	23 ± 1.8 %	7.6 ± 0.5 min	1.4 ± 1.8 %	43.9 ± 1.8 min 16.4 ± 0.2	5.8 ± 0.6
	TMPA	25 ± 2.0 %	12.7 ± 0.5 min 0.7 ± 2.0 %	43.5 ± 8.6 min 35.7 ± 0.6	3.4 ± 0.8
	Glycine	N.A	7.6 ± 0.4 min	N.A	25 ± 2.2 min	21.5 ± 1.6	3.2 ± 0.5

polarizations assisted by CP and direct polarizations with their associated build-up times, amplification and acceleration factors, measured at 1.2 K in 15 N-enriched ammonium, urea, TMPA and glycine solutions in d6-DMSO/D2O (60/40 v/v) with 50 mM TEMPOL.


Abderrahmane Nitaj
email: abderrahmane.nitaj@unicaen.fr

Emmanuel Fouotsa
email: emmanuelfouotsa@yahoo.frwww.emmanuelfouotsa-prmais.org

A New Attack on RSA and Demytko's Elliptic Curve Cryptosystem

Keywords: RSA, Cryptanalysis, Coppersmith's method, Elliptic Curve Method, Demytko's scheme

Let N = pq be an RSA modulus and e be a public exponent. Numerous attacks on RSA exploit the arithmetical properties of the key equation ed -k(p -1)(q -1) = 1. In this paper, we study the more general equation eu -(p -s)(q -r)v = w. We show that when the unknown integers u, v, w, r and s are suitably small and p -s or q -r is factorable using the Elliptic Curve Method for factorization ECM, then one can break the RSA system. As an application, we propose an attack on Demytko's elliptic curve cryptosystem. Our method is based on Coppersmith's technique for solving multivariate polynomial modular equations.

Introduction

In 1976, Diffie and Hellman [START_REF] Diffie | New directions in cryptography[END_REF] invented the concept of the public-key cryptosystem. Since then, various schemes have been proposed as public-key cryptosystems.

In 1978, Rivest, Shamir, and Adleman [START_REF] Rivest | A Method for Obtaining digital signatures and public-key cryptosystems[END_REF] proposed RSA, the most widely used public-key cryptosystem. The public parameters in RSA are the modulus N = pq and the public exponent e satisfying gcd(e, (p -1)(q -1)) = 1 where p, q are large prime numbers of the same bit-size. The decryption exponent is the integer d such that ed ≡ 1 (mod (p -1)(q -1)).

In 1985, Koblitz [START_REF] Koblitz | Elliptic curve cryptosystems[END_REF] and Miller [START_REF] Miller | Use of elliptic curves in cryptography[END_REF] independently suggested the use of elliptic curves in cryptography, mainly for the Diffie-Hellman [START_REF] Diffie | New directions in cryptography[END_REF] key exchange protocol and the El Gamal cryptosystem [START_REF] El Gamal | A public key cryptosystem and signature scheme based on discrete logarithms[END_REF]. Elliptic curves have been also used for primality testing, factorisation, construction of many novel protocols [START_REF] Kakelli | New secure routing protocol with elliptic curve cryptography for military heterogeneous wireless sensor networks[END_REF]. Several models of elliptic curves exist such as Weierstrass model, Edward model, or level four theta model [START_REF] Fouotsa | The Theta model of Elliptic Curve[END_REF]. Some models are really interesting due to their suitability for computing pairings in an efficient way [START_REF] Fouotsa | Parallelizing pairings on Hessian elliptic curves[END_REF]. Let p > 3 be a prime number and a, b be two integers such that gcd(4a 3 + 27b 2 , p) = 1. The elliptic curve E p (a, b) over the field F p is the set of points P = (x, y) such that y 2 ≡ x 3 + ax + b (mod p) together with the point at infinity. The number of points in E p (a, b) is #E p (a, b) = p + 1 -t p where t p is an integer satisfying the Hasse bound |t p | ≤ 2 √ p. Elliptic curves can be extended over the ring Z/nZ

where n is a composite integer. Such elliptic curves can serve to find small prime factors of n as in the Elliptic Curve Method (ECM) for factorization [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF].

In 1994, Demytko [START_REF] Demytko | A new elliptic curve based analogue of RSA[END_REF] developed a cryptosystem using an elliptic curve E N (a, b) over the ring Z/N Z where N = pq is an RSA modulus. In the Demytko system, the public parameters are N , a, b together with a public exponent e satisfying gcd e, p 2 -t 2 p q 2 -t 2 q = 1. The decryption exponent is an integer d satisfying ed ≡ 1 (mod lcm(p + 1 ± t p , q + 1 ± t q )) where t p = p + 1 -#E p (a, b) and t q = q + 1 -#E q (a, b).

The RSA cryptosystem is deployed in many commercial systems for providing privacy and authenticity. If RSA is deployed in a device with small computing power, it is desirable to use a small public exponent e or a small private exponent d. Unfortunately, in 1990, Wiener [START_REF] Wiener | Cryptanalysis of short RSA secret exponents[END_REF] showed that RSA is insecure if d < 1 3 N 1 4 . In 1999, Boneh and Durfee [START_REF] Boneh | Cryptanalysis of RSA with private key d less than N 0.292[END_REF] improved this bound up to d < N 0.292 . Their method is based on Coppersmith's method [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] for solving modular polynomial equations and uses the RSA key equation ed -k(p -1)(q -1) = 1. Afterwards, many attacks on RSA or variants of RSA have been presented using Coppersmith's method or other techniques (see [START_REF] Hinek | Cryptanalysis of RSA and its variants[END_REF], [START_REF]Using LLL-reduction for solving RSA and factorization problems: a survey[END_REF], [START_REF] Blömer | A generalized Wiener attack on RSA[END_REF]).

In this paper, using a variant RSA equation, we present a new attack on RSA by combining Coppersmith's method and the Elliptic Curve Method for factorization ECM. Let B be a positive integer. An integer n is said to be Bsmooth if all prime factors are less than B. We say that B is an efficiency bound for ECM if every prime factor less than B of an integer n can be found by ECM.

Suppose that the public exponent e = N β satisfies a variant equation of the form eu -(p -s)(q -r)v = w with suitably small unknown integers 0 < u < N δ , 0 < v, |w| < N γ , |r| < N α and |s| < N α with α < 1 4 . We show that the RSA modulus N = pq can be factored under two conditions. The first condition is that p -s is B-smooth for some efficiency bound B of ECM and the second condition is that δ satisfies the following inequality

δ < 7 6 + 1 3 α -γ - 1 3 (2α + 1)(2α + 6β -6γ + 1) -ε,
where ε is a small positive constant. Our method is based on combining Coppersmith's method and ECM. We use Coppersmith's method to find the small solutions (u, v, w, (p -s)(q -r)) of the equation eu -(p -s)(q -r)v = w and ECM to factor (p -s)(q -r) and to extract the value of p -s from the B-smooth part of (p -s)(q -r). Finally reusing Coppersmith's method, we can find p from the value of p -s.

and that p + 1 ± t p or q + 1 ± t q is B-smooth. Then applying the new method as for RSA, one can factor the RSA modulus N = pq. The rest of this paper is organized as follows. In Section 2, we review Coppersmith's method, the theory of elliptic curves, Demytko's elliptic curve cryptosystem and the Elliptic Curve Method ECM for factorization. In Section 3, we present the new attack on RSA, and in Section 4, we present the new attack on Demytko's scheme. We conclude in Section 5.

Preliminaries

The following classical result is useful for the proof of our new attack (see [START_REF] Nitaj | Another generalization of Wiener's attack on RSA[END_REF]).

Lemma 1. Let N = pq be an RSA modulus with q < p < 2q. Then √ 2 2

√ N < q < √ N < p < √ 2 √ N .

Coppersmith's method

In 1996, Coppersmith [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF] describes a technique to find small modular roots of univariate polynomials and small integer roots of bivariate polynomials. This method has been extended to more variables and has many surprising results in cryptanalysis. A typical example is the following result [START_REF] May | New RSA Vulnerabilities using Lattics Reduction Methods[END_REF].

Theorem 1 (Coppersmith). Let N = pq be an RSA modulus with q < p < 2q. Let S be an approximation of an unknown multiple pr of p with r = q and |pr -S| < N 1 4 . Then one can factor N in polynomial time.

Let h(x, y, z) ∈ Z[x, y, z] be a polynomial with ω monomials of the form

h(x, y, z) = i,j,k a i,j,k x i y j z k .
The Euclidean norm of h(x, y, z) is defined as

h(x, y, z) = i,j,k a 2 i,j,k .
Under some conditions, a modular polynomial equation can be solved over the integers as presented in the following result [START_REF] Howgrave-Graham | Finding small roots of univariate modular equations revisited[END_REF].

Theorem 2 (Howgrave-Graham). Let e be a positive integer and h(x, y, z) ∈ Z[x, y, z] be a polynomial with at most ω monomials. Suppose that h (x 0 , y 0 , z 0 ) ≡ 0 (mod e m ) and h(xX, yY, zZ) < e m √ ω ,

where |x 0 | < X, |y 0 | < Y , |z 0 | < Z.
Then h (x 0 , y 0 , z 0 ) = 0 holds over the integers.

To find polynomials with small coefficients that can be used in Howgrave-Graham's Theorem 2, Coppersmith's method uses a lattice and a lattice reduction algorithm such as the LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF]. This reduction algorithm can be applied to find a basis of lattice vectors with relatively small norms (see [START_REF] May | New RSA Vulnerabilities using Lattics Reduction Methods[END_REF]).

Theorem 3 (LLL). Let L be a lattice spanned by a basis (u 1 , . . . , u ω ), then the LLL algorithm produces a new basis

(b 1 , . . . , b ω ) satisfying b 1 ≤ . . . ≤ b i ≤ 2 ω(ω-1)
4(ω+1-i) det(L)

1 ω+1-i , i = 1, . . . , ω -1.
Under the condition of Howgrave-Graham's Theorem, some modular polynomial equations derived from the reduced basis can be transformed to polynomial equations over the integers. For multivariate modular equations, solving the system of these polynomials is heuristic and depends on some extra assumptions such as the following one.

Assumption 1 Let h 1 , h 2 , h 3 ∈ Z[x, y, z] be the polynomials that are found by Coppersmith's method. Then the ideal generated by the polynomial equations h 1 (x, y, z) = 0, h 2 (x, y, z) = 0, h 3 (x, y, z) = 0 has dimension zero.

Under this assumption, a system of polynomials sharing the root can be solved by using Gröbner basis computation or resultant techniques (see [START_REF] Bauer | Toward a rigorous variation of Coppersmith's algorithm on three variables[END_REF] for more details).

Elliptic curves

Let N = pq be an RSA modulus and let a and b be two integers such that gcd(4a

3 + 27b 2 , N ) = 1. An elliptic curve E N (a, b) is the set of points (x, y) such that y 2 ≡ x 3 + ax + b (mod N ),
together with the point at infinity O. It is well known that chord-and-tangent method in the case of elliptic curves E p (a, b) defined over the finite filed F p still hold for E n (a, b) unless the inversion of a non-zero number Q does not exist modulo N . This case would lead to find a factor of N by computing gcd(Q, N ).

When the prime factors p, q in N = pq are large, then with overwhelming probability the inversion of a non-zero number will exist modulo N . Let p be a prime number. Under modulo p, the cardinality of E p (a, b) is denoted #E p (a, b) and satisfies the following result (see [START_REF] Silverman | The Arithmetic of Elliptic Curves[END_REF], p. 131).

Theorem 4 (Hasse). The order of an elliptic curve

E p (a, b) over F p is given by #E p (a, b) = p + 1 -t p , where |t p | ≤ 2 √ p.
When the prime number p and the elliptic curve E p (a, b) are given, one can find the value of t p using computational methods such the Schoof-Elkies-Atkin algorithm (SEA) (see [START_REF] Schoof | Counting points on elliptic curves over finite fields[END_REF]). Conversely, let p be a prime number and t an integer with |t| < 2 √ p. Let H(d) denote the Kronecker class number (see Section 1.6

of [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF]). Deuring's theory of CM-elliptic curves implies that there are H(t 2 -4p) elliptic curves on Z/pZ having p+1-t points. Note that when |t| < √ p, H(t 2 -4p)

satisfies the following inequalities (see Proposition 1.9 of [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF])

c 1 √ p log p < H(t 2 -4p) < c 2 √ p(log p)(log log p) 2 ,
where c 1 and c 2 are effectively computable positive constants. This shows that the number of elliptic curves with known cardinality is non negligible. Let p be a prime number and E p (a, b) be an elliptic curve with equation

y 2 ≡ x 3 + ax + b (mod p) and cardinality #E p (a, b) = p + 1 -t p . The twist of E p (a, b) is the elliptic curve E p (a, b) defined by the equation cy 2 ≡ x 3 + ax + b (mod p) where c is a fixed quadratic non-residue modulo p. Then the cardinality of E p (a, b) is #E p (a, b) = p + 1 + t p .

Demytko's elliptic curve cryptosystem

In 1994, Demytko [START_REF] Demytko | A new elliptic curve based analogue of RSA[END_REF] proposed a new cryptosystem defined over the field Z/N Z where N = pq is an RSA modulus such that p ≡ q ≡ 2 (mod 3). Demytko's scheme uses fixed integers a and b and a fixed modulus N . Demytko's scheme uses only the x-coordinate of a point P = (x, y) ∈ E N (a, b) to compute a multiple eP ∈ E N (a, b) (see Lemma 2 in [START_REF] Kurosawa | Low exponent attack against elliptic curve RSA, Low exponent attack against elliptic curve RSA[END_REF]). Demytko's scheme can be summarized as follows.

Key Generation:

• Choose two distinct prime numbers p and q of similar bit-length.

• Compute N = pq.

• Select two integers a, b < p such that gcd n, 4a 3 + 27b 2 = 1.

• Choose e such that gcd e, p 2 -t 2 p q 2 -t 2 q = 1. • Keep p, q secret and publish N, e, a, b.

Encryption:

• Transform the message m as the x-coordinate of a point P = (m x , m y ) on the elliptic curve

E N (a, b). • Compute the ciphertext point C = eP = (c x , c y ) = e(m x , m y ) on the elliptic curve y 2 = x 3 + ax + b (mod N ). 3. Decryption: • Compute u = c 3 x + ac x + b (mod N ).
• Compute the Legendre symbols u p = u p and u q = u q .

• If (u p , u q ) = (1, 1), then compute d ≡ e -1 (mod lcm(p+1-t p , q+1-t q )).

• If (u p , u q ) = (1, -1), then compute d ≡ e -1 (mod lcm(p + 1 -t p , q + 1 + t q )). • If (u p , u q ) = (-1, 1), then compute d ≡ e -1 (mod lcm(p + 1 + t p , q + 1t q )). • If (u p , u q ) = (-1, -1), then compute d ≡ e -1 (mod lcm(p + 1 + t p , q + 1 + t q )). • Compute m as the x-coordinate of dC = deP = P = (m x , m y ) on the elliptic curve

y 2 = x 3 + ax + b (mod N ).
A variant of Demytko's scheme is to consider d ≡ e -1 (mod (p+1±t p , q+1±t q )) instead of modulo lcm(p + 1 ± t p , q + 1 ± t q ). Then e and d satisfy an equation of the form

ed -k (p -s) (q -r) = 1, s = ∓t p -1, r = ∓t q -1.
This equation matches the RSA variant key equation that will be studied in this paper.

The Elliptic Curve Method

An integer m is said to be B-smooth if all the prime factors of m are less than or equal to B. Smooth numbers are used in cryptography by many factoring and discrete logarithm algorithms (see [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] and [START_REF]The Development of the Number Field Sieve[END_REF]). The counting function of B-smooth numbers in an interval [1, x] is defined as

ψ(x, B) = # {m : 1 ≤ m ≤ x, m is B-smooth} .
In the particular case x = B u , Hildebrand [START_REF] Hildebrand | On the number of positive integers ≤ x and free of prime factors ≤[END_REF] gave the asymptotic formula ψ(x, B) = xρ(u) where ρ(u) is the Dikman rho-function defined as the solution of the differential equation uρ (u) = -ρ(u -1) for u ≥ 1 with the initial condition ρ(u) = 1 for 0 ≤ u ≤ 1. For 1 ≤ u ≤ 2, the Dikman function satisfies ρ(u) = 1 -log u so that ψ(x, B) = x(1 -log u). The Elliptic Curve method (ECM) is a probabilistic method for integer factorization and was discovered by H.W. Lenstra [START_REF] Lenstra | Factoring integers with elliptic curves[END_REF] in 1987. It is a fast partially factoring algorithm, especially for finding small prime factors p, in a heuristic running time O exp c(log p) 1/2 log log p) 1/2 , for some constant c > 0. The ECM algorithm is based on the property of the Chinese Remainder Theorem, that is, for

any elliptic curve E(a, b), if n = p e1 1 p e2 2 • • • p e k k , then E (Z/nZ) = E (Z/p e1 1 Z) × E (Z/p e2 2 Z) × • • • × E (Z/p e k k Z) .
Suppose that the order of E (Z/p e1 1 Z) is B-smooth and let m be a multiple of |E (Z/p e1 1 Z)|, typically m = lcm(2, . . . , B). Then, for every P ∈ E (Z/nZ), we have mP = (0 : 1 : 0) (mod p 1 ). Consequently, computing mP where P ∈ E (Z/nZ), using the addition formulas on E (Z/nZ), we must get mP = (x : y : z) = (0 : 1 : 0) (mod p 1 ). This implies that z ≡ 0 (mod p 1 ) and that gcd(z, n) = p r 1 for some positive integer r which will reveal p 1 .

3 The Attack on RSA

In this section, we present an attack on RSA when the public key (N, e) satisfies an equation eu -(p -s)(q -r)v = w with suitably small parameters u, v, w, r, s under the condition that one of the factors (p -s) or (q -r) is B-smooth for some ECM-efficiency bound B.

The attack

Theorem 5. Let N = pq be an RSA modulus and e = N β be a public exponent.

Suppose that e satisfies the equation eu

-(p -s)(q -r)v = w with |r|, |s| < N α < N 1 4 , 0 < u < N δ , 0 < v and |w| < N γ . If δ < 7 6 + 1 3 α -γ - 1 3 (2α + 1)(2α + 6β -6γ + 1) -ε,
where ε is a small positive constant, then, under assumption (1), one can find (p -s)(q -r) in polynomial time.

Proof. Suppose that N = pq is an RSA modulus and e is a public exponent satisfying eu -(p -s)(q -r)v = w. Since (p -s)(q -r) = N -pr -qs + rs, then -v(N -pr -qs + rs) -w ≡ 0 (mod e), which can be rewritten as v(pr + qsrs) -N v -w ≡ 0 (mod e). Consider the polynomial f (x, y, z) = xy -N x + z, Then (x, y, z) = (v, pr + qs -rs, -w) is a solution of the modular polynomial equation f (x, y, z) ≡ 0 (mod e). The small solutions of this modular equation can be found by applying Coppersmith's method [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF]. Let m and t be two positive integers. Consider the polynomials

G k,i1,i2,i3 (x, y, z) = x i1-k z i3 f (x, y, z) k e m-k , for k = 0, . . . m, i 1 = k, . . . , m, i 2 = k, i 3 = m -i 1 , H k,i1,i2,i3 (x, y, z) = y i2-k z i3 f (x, y, z) k e m-k , for k = 0, . . . m, i 1 = k, i 2 = k + 1, . . . , i 1 + t, i 3 = m -i 1 .
Let L denote the lattice spanned by the coefficient vectors of the polynomials G k,i1,i2,i3 (Xx, Y y, Zz) and H k,i1,i2,i3 (Xx, Y y, Zz). We can get a left triangular matrix if the ordering of the rows follows the ordering of the k's and the ordering of the the monomials of a polynomial follows the natural ordering following the i 1 's, then the i 2 's, then the i 3 's. Hence, using the triangular form of the matrix, the determinant of L is in the form det(L) = e ne X n X Y n Y Z n Z . For m = 2 and t = 1, the coefficient matrix for L is presented in Table 1. The non-zero elements are marked with an ' '. Table 1. The coefficient matrix for the case m = 2, t = 1.

To find the values of the exponents, define S(x) to be

S(x) = m k=0 m i1=k k i2=k m-i1 i3=m-i1 x + m k=0 k i1=k i1+t i2=k+1 m-i1 i3=m-i1
x.

Using the construction of the polynomials G and H, we get

n e = S(m -k) = 1 6 m(m + 1)(2m + 3t + 4), n X = S(i 1 ) = 1 6 m(m + 1)(2m + 3t + 4), n Y = S(i 2 ) = 1 6 (m + 1) m 2 + 3mt + 3t 2 + 2m + 3t , n Z = S(i 3 ) = 1 6 m(m + 1)(m + 3t + 2), ω = S(1) = 1 2 (m + 1)(m + 2t + 2).
(

) 1
Let t = τ m for some positive τ to be optimized later. The dominant terms of the exponents in [START_REF] Bauer | Toward a rigorous variation of Coppersmith's algorithm on three variables[END_REF] are

n e ≈ 1 6 (3τ + 2)m 3 + o(m 3 ), n X ≈ 1 6 (3τ + 2)m 3 + o(m 3 ), n Y ≈ 1 6 3τ 2 + 3τ + 1 m 3 + o(m 3 ), n Z ≈ 1 6 (3τ + 1)m 3 + o(m 3 ), w ≈ 1 6 (6τ + 3)m 2 + o(m 2 ).
(

) 2
Applying the LLL algorithm 3 to the lattice L, we get a reduced basis where the three first vectors h i , i = 1, 2, 3 satisfy

h 1 ≤ h 2 ≤ h 3 ≤ 2 ω(ω-1) 4(ω-2) det(L) 1 ω-2 .
To apply Howgrave-Graham's Theorem 2 to h 1 , h 2 and h 3 , we set 2 ω(ω-1)

4(ω-2) det(L) 1 ω-2 < e m √ ω .
This can be transformed to

det(L) < 2 -ω(ω-1) 4 1 ( √ ω) ω-2 e m(ω-2) ,
or equivalently

e ne X n X Y n Y Z n Z < 2 -ω(ω-1) 4 1 ( √ ω) ω-2 e m(ω-2) . (3)
Suppose that e = N β , 0 < u < N δ , |w| < N γ and max(|r|, |s|)

< N α < N 1 4 . Since q < p < √ 2 √ N by Lemma 1, then p|r+q|s+|rs| < 3 max(p|r|, q|s|, |rs|) < 3 max √ 2 √ N • N α , N 2α = 3 √ 2N 1 2 +α .
This gives

(p -r)(q -s) = N -pr -qs + rs > N -(p|r + q|s + |rs|) > N -3 √ 2N 1 2 +α > 1 2 N.
Using 0 < v and |w| < eu < N β+δ , we get

0 < v = eu -w (p -s)(q -r) < eu + |w| (p -s)(q -r) < 2eu 1 2 N < 4N β+δ-1 , (4)
Let X = 4N β+δ-1 , Y = 3 √ 2N 1
2 +α and Z = N γ . Then the target solution (x, y, z) satisfies |x| < X, |y| < Y and |z| < Z. Using the approximations of n e , n X , n Y , n Z and ω given in (2), the inequality (3) can be transformed into

(3τ +2)β+(3τ +2)(β+δ-1)+ 3τ 2 + 3τ + 1 1 2 + α +(3τ +1)γ < (6τ +3)β-ε 1 ,
where ε 1 collects all constant terms in e, X, Y and Z. It is a small positive constant that depends only on N . The optimal value for τ is

τ 0 = 1 -2δ -2α -2γ 2(1 + 2α) ,
and, plugging this value in the former inequality, we obtain

4α 2 + 16αβ + 8αδ -8αγ -12δ 2 -24δγ -12γ 2 -4α + 8β + 28δ + 20γ -15 < -ε 2 ,
where ε 2 is another small positive constant. The former equation is valid for

δ < 7 6 + 1 3 α -γ - 1 3 (2α + 1)(2α + 6β -6γ + 1) -ε,
where ε is a small positive constant. Under this condition, the LLL algorithm applied to the lattice L outputs three vectors v i , i = 1, 2, 3. These vectors represent the coefficients of three polynomials h i (Xx, Y y, Zz), i = 1, 2, 3 sharing the root (x, y, z) = (v, pr + qs + rs, -w). Then, applying Gröbner basis computations, we get the expected solution, from which we deduce (p-s)(q-r) = N -(pr+qs+rs). Since all the former steps can be done in polynomial time, then the method is a polynomial time algorithm. This terminates the proof.

Remark 1. If r = s = w = 1, then the equation eu -(p -s)(q -r)v = w is the classical RSA key equation ed -(p -1)(q -1)k = 1 with d < N δ . Using α = 0, β = 1 and γ = 0, the bound of Theorem 5 gives δ < 7 6 - √ 7
3 . This retrieves the classical bound on the private exponent d (see [START_REF] Boneh | Cryptanalysis of RSA with private key d less than N 0.292[END_REF]).

Using [START_REF] Demytko | A new elliptic curve based analogue of RSA[END_REF], we get log

√ N -N α < ω(p-s) i=1 x i log p i < log √ 2N + N α .
The former inequalities can be solved by applying linear programming algorithms such as PSLQ [START_REF] Ferguson | A polynomial time, numerically stable integer relation algorithm[END_REF] and LLL [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], and using a solution (x 1 , . . . , x ω(p-s) ), we compute d = ω(p-s) i=1

p xi i which is then a candidate for p -s. Since |s| < N α < N 1 4 , then d is an approximation of the prime factor p of N with an error term less than N 1 4 . Hence, using Theorem 1, this leads to the exact value of p if d is the good candidate. Repeating this process sequentially for the factors d of (p -s)(q -r) in the range √ N -N α < d < √ 2N + N α , we will find p and then get q = N p . This achieves the factorization of the RSA modulus.

A numerical example for RSA

We experimented our method with various sizes. In all cases, the assumption (1) was true and the method was successful to find the factorization of the RSA modulus.

As a numerical example, consider the following RSA 265 bit-size modulus N with the public exponent e, N =431152655066872264361967287569597072664021583942612947594581 39340520129183826747, e =442910968337832163537316435435954401939549665933793683113289 7706681971178351139.

Suppose that N = pq with unknown factorization and e satisfies an equation eu -(p -s)(q -r)v = w with the suitably small unknown parameters u, v, w, r and s. Then applying the method of Theorem 5 to solve the equation eu -(p -s)(q -r)v = w, with the bounds

u < N δ = N 0.15 , |w| < N γ = N 0.15 , |r|, |s| < N α = N 0.15 , e = N β = N 0.987 , we get v =8330878683394 w =2516643, ps + qr -rs =45624103499453346715225639044829688941453657147, Since (p -s)(q -r) = N -(pr + qs -rs), we get (p -s)(q -r) =4311526550668722643619672875695966164229865894091457953 3819094510831187730169600.
Then, using the Elliptic Curve Method with the bound B = N 1 10 ≈ 91931238, we get the factorization

(p -s)(q -r) = 2 8 • 3 • 5 2 • 13 • 23 • 53 • 89 • 181 • 1663 • 2833 • 2969 • 5197 • 5233• 6481 • 12007 • 18439 • 36973 • 435876180528100336114933071348569.
Using the factorization of (p -s)(q -r), we can find the set of the factors

d such that √ N -N α < d < √ 2N + N α .
Such divisors are candidate for p -s, that is p -s = d for one of these factors. Then by applying Coppersmith's Theorem 1, we can find p using the correct candidate. For the divisor d = 6672224014662340178579721474326728185600, we apply Coppersmith's Theorem 1 and find p = 6672224014662340178579721474326734152749. Then q = N p = 6461903169309154483833797011785886506503.

Application to Demytko's Scheme

In this section, we show how to apply the technique of Theorem 5 and Theorem 6 to break the Demytko scheme in some situations and provide a numerical example.

The attack on Demytko's Scheme

In Demytko's scheme, the RSA modulus is N = pq and the elliptic curve E N (a, b) is such that #E p (a, b) = p + 1 -t p and #E q (a, b) = q + 1 -t q where, according to Hasse Theorem, |t p | < 2 √ p and |t q | < 2 √ q. Also, the public exponent e and the private exponent d satisfy one of the four equations eu -(p + 1 ± t p )(q + 1 ± t q )v = w.

These equations can be transformed into one of the form eu -(p -s)(q -r)v = w where s = ∓t p -1 and t = ∓t q -1, which can be studied using the technique of Theorem 5 and Theorem 6. 4 , 0 < u < N δ , < v and |w| < N γ . Let B be an ECM-efficiency bound for the Elliptic Curve Method. If p + 1 ± t p or q + 1 ± t q is B-smooth and

(p + 1 ± t p )(q + 1 ± t q )v = w with | ± t p -1|, | ± t q -1| < N α < N 1
δ < 7 6 + 1 3 α -γ - 1 3 (2α + 1)(2α + 6β -6γ + 1) -ε,
then, under assumption (1), one can find p and q in polynomial time.

Proof. Since the equation eu -(p + 1 ± t p )(q + 1 ± t q )v = w can be transformed into eu -(p -s)(q -r)v = w with s = ∓t p -1 and t = ∓t q -1, then this equation can be solved under the conditions of Theorem 5 and Theorem 6 when |t p -1| < N α and |t q -1| < N α . We suppose that e satisfies the equation eu -(p + 1 ± t p )(q + 1 ± t q )v = w with t p , t q < N α = N 0.

Conclusion

In this paper, we consider an instance of RSA where the public exponent satisfies a generalized key equation with many unknown parameters. Under suitable conditions, we combine Coppersmith's method and the Elliptic Curve Method for factorization ECM, we solve the equation and find the prime factors of the RSA modulus. We apply the same technique to launch an attack on Demytko's Elliptic Curve Cryptosystem when the secret parameters are suitably small.

Corollary 1 .

 1 Let (N, e, a, b) the public parameters of a Demytko's instance where N = pq. Suppose that e = N β satisfies an equation of the form eu -

4. 2 A

 2 numerical example for Demytko Let us consider the Demytko public parameters (N, e, a, b) where N is an 510-bit RSA modulus with the elliptic curve E N (a, b) with equation y 2 ≡ x 3 +9 (mod N ).

1 . 2 •

 12 Then applying the method of Theorem 5 to solve the equation eu -(p -s)(q -r)v = w where s = ∓t p -1 and r = ∓t p -1, we get fore = N β ≈ N , u < N δ = N 0.1 , |w| < N γ = N 0.1 v =6889077569105,w =2916646, pr + qs -rs =7843579993396182200943116363500139031658267071337633, 244222164466922717093026565590439040792, Then N -(pr + qs -rs) = (p -s)(q -r) Curve Method for factorization with the bound B = 2 80 ≈ N 0.16 , we get the factorization(p -s)(q -r) =3 6 • 5 2 • 7 2 • 13 3 • 43 2 • 103 2 • 277 • 674 2 • 1021 • 4177 • 15061 • 21737 2 • 27109 2 • 52291 2 • 84991 • 90841 • 132661 • 347329 3834631 • 29327821 • 69689551 • 30404961633073956301 • 305196537135675591605491.Any divisor d of (p -s)(q -r) is a candidate for p -s or q -r. Using the divisord =3 3 • 13 2 • 277 • 1021 • 15061 • 21737 2 • 27109 2 • 52291 2 • 90841 • 305196537135675591605491,as a candidate for p -s in Coppersmith's Theorem 1, we get p and then q = factorization of N .

A part of this paper was written while Emmanuel Fouotsa was spending a year in Caen financed by the French SIMPATIC (SIM and PAiring Theory for Information and Communications security), ANR-12-INSE-0014. He also acknowledges the support of the Lirima-MACISA project and the PREMA project in subsaharan Africa sponsored by the Simons Foundation (USA) Demytko's scheme.

Theorem 6. Let N = pq be an RSA modulus and e = N β be a public exponent. Suppose that e satisfies the equation eu -(p -s)(q -r)v = w with |r|, |s| < N α < N 1 4 , 0 < u < N δ , 0 < v and |w| < N γ . Let B be an ECM-efficiency bound for the Elliptic Curve Method. If (p -s) or (q -r) is B-smooth and

then, under assumption (1), one can find p and q in polynomial time.

Proof. Suppose that, in the equation eu

and that the exponent parameters satisfy δ < 7 6

Then, by applying Theorem 5, we can find the exact value of (p-s)(q -r). Next, suppose that (p -s) is B-smooth where B is a bound for the efficiency of the Elliptic Curve Method (ECM). Hence, ECM will reveal a partial factorization of (p -s)(q -r) as

were ω((p -s)(q -r) is the number of distinct prime factors of (p -s)(q -r) less than B and M is such that M = 1 or all prime factors of M are greater than B. The average order of the number of prime factors of an integer n is ω(n) ≈ log n log log n (see [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF], pp. 355). Since |r|, |s| < N α and

Hence, the average number of the prime factors of (p -s)(q -r) satisfies

On the other hand, according to the factorization

the number of distinct divisors of p -s is exactly ω(p-s) i=1

(e i + 1). However, the average number of divisors of an integer n is log n (see Theorem 319 of [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]). Hence, the average number of divisors of p -s is approximately log(p -s) ≈


Olivier Sandre

Christine Menager

Jerome Prost

Valerie Cabuil

Jean-Claude Bacri

Andrejs Cebers

Oblate-Prolate Transition of Ellipsoidal Giant Magnetoliposomes: Experiments showing an Anisotropic Spontaneous Curvature

Introduction

The shape of fluid lipid vesicles is governed by the bending elasticity of their membrane characterized by a bending modulus K c and a spontaneous curvature c 0 [1]. The latter exists only for bilayers separating non symmetric aqueous media. Recently Döbereiner et al described an experimental method based on the thermal fluctuations of giant vesicles to measure c 0 precisely and use it as a control parameter in phase diagrams [2]. We use here particular non symmetric giant vesicles called 'magnetoliposomes' as a tool for the observation of new shape transitions. Magnetoliposomes are giant liposomes filled up with a colloidal dispersion of magnetic particles. As usual liposomes, magnetoliposomes exhibit thermal fluctuations. The effect of a magnetic field is to flatten the fluctuations and to induce a shape deformation even at low field intensity. Two types of deformations are reported here depending on the characteristics of the encapsulated magnetic solution. They are explained by a modification of c 0 induced by the application of the magnetic field.

Liposome preparation

Magnetoliposomes are obtained by filling usual giant liposomes with an aqueous magnetic fluid (ferrofluid). They are suspended in a non-magnetic aqueous phase. The ferrofluid is a colloidal suspension of magnetic nanoparticles (iron oxide grains γ-Fe 2 O 3 ) [3]. Particle diameter is about 10 nm and the iron oxide surface is coated by tri-sodium citrate species in order to have negative surface charges at pH 7, which ensure the colloidal stability even in physiological media [4]. There is an equilibrium between the citrate species adsorbed on the grains and the non-adsorbed tri-sodium citrate in the bulk. This electrolyte has a concentration C s which is monitored by dialysis and controlled by measuring the conductivity of the ferrofluid. The phospholipid constituting the membrane of the magnetoliposomes is 1,2-dioleoyl-sn-glycero-3-phosphocholine (DOPC from Avanti Polar Lipids, USA, used as purchased).

For the preparation of giant liposomes, we use the spontaneous swelling of a dense phospholipidic film because it enables to encapsulate a ferrofluid inside giant vesicles with a high efficiency. The ferrofluid is firstly prepared and its ionic strength C s is adjusted by dialysis. A small amount of lipid powder (1 mg) is mixed with 10 µL of this aqueous ferrofluid (pH=7, volume fraction in magnetic particles is 0.05) and sheared on a glass support to obtain a dense lamellar phase. Then tridistilled water is added in excess (4 mL) to allow the spontaneous swelling of the liposomes during one hour incubation at 40°C. Most of the liposomes prepared by this way are spherical with diameter ranging from 10 to 100 µm (Fig. 1). They are red colored and they exhibit thermal fluctuations. Fig. 1: A giant magnetoliposome without any magnetic field. The membrane is fluctuating as observed with differential interference contrast microscopy (DIC). Length of the bar is 20 µm.

Observations

Cells made of two glass slides separated by a 200 µm spacer are filled by aliquots of the magnetoliposomes suspension and observed under an optical microscope (Leica ×40, NA 0.65). Pictures are taken with a CCD camera and digitized on a computer.

The magnetoliposomes are sensitive to an applied magnetic field of low intensity, typically 400 G. Two types of deformations have been observed. An initially spherical magnetoliposome is either elongated by the field (Fig. 2) or on the contrary compressed at the poles (Fig. 3). The shape is always described by an ellipsoid with rotational symmetry along the field direction: a is the semi-axis parallel to the magnetic field  H and b is the value of the two other semi-axes perpendicular to  H .

Fig. 2:

The liposome shown in Fig. 1 submitted to a magnetic field (direction given by the arrow). The deformation is prolate and the membrane fluctuations vanish. Please note that the ionic strength is high (Cs=85 mM). Length of the bar is 20 µm.

Fig. 3:

A magnetoliposome filled with a low ionic strength magnetic fluid (Cs=7.75 mM) and submitted to a magnetic field (direction given by the arrow). The deformation is oblate. Length of the bar is 10 µm.

The type of deformation and its amplitude are described by the ellipsoid eccentricity:

e 2 = 1- b 2 a 2 .
For an elongated liposome (prolate ellipsoid), e 2 is positive, and for a compressed one (oblate ellipsoid), e 2 is negative. A combination of the two deformations is also observed and described as a 'spinning top' shape (Fig. 4). (direction given by the arrow). The liposomes are always axisymmetric around the field direction but combine elongations both at the poles and at the equator ('spinning top' shapes). The values of can be nearly zero (a), negative (b) or positive (c). In that last case the sharp shape is only transient and relaxes to a more rounded one, but with membrane buckling (d). Length of the bar is always 10 µm.

Analysis of the deformations under a magnetic field

The experimental parameters that are relevant for the observed shape transitions are (a) the initial radius R 0 of the liposome measured on the video frame and (b) the two characteristics of the encapsulated solution, namely its magnetic susceptibility χ and the free salt concentration C S .

An in situ measurement of χ is provided by magnetophoresis, i.e. the migration of a liposome submitted to a controlled gradient of magnetic field. A magnetic field gradient is performed perpendicularly to an applied magnetic field with the set-up described in Fig. 5. The magnetic force which causes the migration of a magnetoliposome submitted to a magnetic field gradient is:



F m = χVH x  ∇ y H x ( ) (Eq. 1)
where

V = 4 3
πab 2 is the volume of the liposome and  ∇ is the gradient operator. It is balanced by a viscous force, which was calculated by J. Perrin [5] in the case of an ellipsoid elongated in the O-x direction and moving along O-y in a medium of viscosity η :

 F v = 16πη a 2 ln 2a b       + 1  v (Eq. 2)
The viscosity of the suspending solution of the vesicles is η=10 -2 P. The magnetophoretic velocity results from the balance of the two forces:

 v = b 2 2ln 2a b       + 1       8η χH x  ∇ y H x ( ) (Eq. 3)
The measurement of the liposome velocity leads to the value of χ characterizing the ferrofluid encapsulated in a given liposome. The concentration C P of nanoparticles inside the liposome is then calculated using Langevin's law of superparamagnetism :

χ = C p V p 2 m s 2 3kT (Eq. 4)
where m s =360 G is the magnetization at saturation of γ-Fe 2 O 3 and V P is the volume of a nanoparticle [6]. In the following we use V P corresponding to a particle diameter of 12 nm, taking into account that the ferrofluid is polydisperse and that χ is ruled by the tail of the distribution.

Please note that R 0 and C P vary a lot among the population of liposomes due to the swelling process. Their values are measured thereafter. The concentration of tri-sodium citrate salt in the ferrofluid is adjusted to a known value by dialysis through a cellulose membrane (Spectra/Por MWCO 12-14000 g•mol -1 from ROTH, France). Final concentrations C S ranging from 5 mM to 85 mM are measured from the electrical conductivity of the ferrofluid.

The experimental values of R 0 and χ are measured on a large amount of magnetoliposomes prepared with ferrofluids of different C S . Some of them are given as examples in Table 1. On Fig. 6 experimental data illustrate the influence of the three parameters R 0 , χ and C S on the observed deformations. Vesicles which are larger, more magnetic and filled with a high ionic strength magnetic fluid exhibit prolate deformation under a magnetic field, whereas smaller vesicles filled with a low ionic strength magnetic fluid and less magnetic become oblate. Two domains corresponding to both types of deformation are well defined on this 'topological' phase diagram, the oblate one being in the region of low values of R 0 , χ, and C S . C s is the concentration of tri-sodium citrate electrolyte in the ferrofluid, R 0 the radius of the initial spherical shape, e the eccentricity of the ellipsoidal deformation and χ the magnetic susceptibility. The concentration C p of magnetic particles in situ is calculated from χ using Eq. 4. The shadowed lines correspond to prolate deformations (e 2 >0), the other to negative ones (e 2 <0).

C S (mol•L -1 ) χ C P (cm -3 ) R 0 (µm) 2 2 2 1 = - b e a 5×10 -

Interpretation

When submitted to an applied magnetic field, a liposome encapsulating a ferrofluid of susceptibility χ gets a bulk magnetization (proportional to R 0 3 ); as a consequence, the interface between inner magnetic and outer non-magnetic media (i.e. the bilayer) is stressed. The deformation of an initially spherical object by a magnetic stress should always be a prolate ellipsoid, whatever the sign of χ, so that magnetic droplets and magnetic holes (eg. air bubbles) have the same behavior [7]. This was observed for magnetoliposomes and used in [8] in order to determine the bending modulus K c of the bilayer from the analysis of the liposomes deformation as a function of the magnetic field intensity. Therefore the observation of an oblate deformation by a slight change of the experimental parameters is a tricky result. Please note that the inner compartment of the magnetoliposomes is a complex colloidal solution. It includes both a 3:1 electrolyte (trisodium citrate) with concentration C s and a colloidal suspension of nanometric γ-Fe 2 O 3 particles (giving χ). The latter are both nanoscopic magnets and macro-ions, the net charge per nanoparticle being Z ≈ -20 [4]. The importance of decreasing C S to obtain an oblate deformation suggests that there are electrostatic interactions between the particles and the bilayer. Indeed some electrophoresis experiments on large unilamellar liposomes (diameters about 200 nm) made of phospholipids with a phosphocholine head group have reported values of the ζ-potential ranging from -4 mV for natural egg-lecithin [9] to about -10 mV for synthetic lipids like 1,2-dimysristoyl-sn-glycero-3-phosphocholine (DMPC) [10]. The ζpotential varies with temperature, ionic strength and specific adsorption of anions [11]. We retain for the present study that the bilayer and the magnetic nanoparticles are both negatively charged and so repel each other.

The shape of magnetoliposomes submitted to a magnetic field results from a competition between the magnetic energy of the bulk and the bending energy of the bilayer. The magnetic energy always favors the prolate shape, but we shall show that the bending energy can stabilize the oblate deformation. The contribution to the bending energy of the bilayer due to a surface charge density has been extensively studied theoretically [12,13,14], but to our knowledge only experiments on small unilamellar vesicles (diameters about 10 nm) have been reported [15]. The shape of liposomes is known to be strongly dependent on the spontaneous curvature of the bilayer (c 0 ). In the case of magnetoliposomes, c 0 originates from the asymmetry between the aqueous compartments (ferrofluid inside, non-magnetic solution outside). Winterhalter and Helfrich [12] have introduced a method to derive the elasticity constants of a bilayer bearing two different charge densities on its both sides. If we use the same approach, considering that the screening length of the electrostatic potential is κ i -1 inside the liposome and κ o -1 outside, the spontaneous curvature can be written:

c 0 = κ o 3 3 1 κ o 2 - 1 κ i 2       (Eq. 5)
The effect of the magnetic field (intensity H 0 ) on the spontaneous curvature c o is due to the modification it implies on the particles concentration profile in the vicinity of the bilayer. Qualitatively the depletion in nanoparticles is reduced near the magnetic poles because of magnetic attraction. The effect of this phenomenon on c 0 can be quantitatively described introducing an angular dependence in the expression of the decay factor of the electrostatic potential away from the bilayer:

κ i 2 (θ) = κ o 2 1 + d 1 + 4πχ 2 H 0 2 C p kT cos 2 (θ)           (Eq. 6)
where θ is the angle between the field direction and the normal to the bilayer and d is the ratio

Z 2 C p
12C s [16]. Thus, when a magnetic field is applied, c 0 becomes lower near the poles (θ=0 and θ=180°) than at the equator. But the angular contribution of κ i according to Eq. 6 depends on the amount of magnetic materials through C P and χ, and on the ionic strength through d. This explains the driving role of these parameters in the experiments (Fig. 6). The dotted line between the two domains of prolate and oblate deformations is only a guide for the eye; (b) Effect of product χR 0 at given salt concentration (C S =25 mM) on two neighboring liposomes with opposite deformations under a magnetic field. The prolate one is large and highly colored (high χR 0 ) while the oblate one is smaller and appears more dilute in magnetic particles (low χR 0 ). Length of the bar is 10 µm. The arrow indicates the direction of the field. For example a decrease of C S (by dialysis of the ferrofluid) raises up the anisotropy of the spontaneous curvature. Hence the oblate shape minimizes the bending energy because it develops a less curved bilayer at the magnetic poles where c 0 is decreased. If the concentration of magnetic oxide is not too high, so that the bending energy prevails over the magnetic one, then the oblate shape is favored. This explains the tendency of oblate deformation under a magnetic field for magnetoliposomes encapsulating a ferrofluid diluted both in electrolyte and in nanoparticles.

Fig. 4 (

 4 Fig. 4 (a to d): Magnetoliposomes inside which salt concentration is intermediate (Cs=25 mM) and submitted to a magnetic field(direction given by the arrow). The liposomes are always axisymmetric around the field direction but combine elongations both at the poles and at the equator ('spinning top' shapes). The values of can be nearly zero (a), negative (b) or positive (c). In that last case the sharp shape is only transient and relaxes to a more rounded one, but with membrane buckling (d). Length of the bar is always 10 µm.

Fig. 5 :

 5 Fig.5: Experimental set-up to produce a controlled magnetic field gradient (the field lines get closer toward increasing y coordinate).The sample containing the magnetoliposomes is placed between the two coils in the cell described in the text.

Fig. 6 :

 6 Fig. 6: (a) 'Topological' phase diagram of the magnetoliposomes under a magnetic field where product χR 0 is plotted versus tri-sodium citrate salt concentration C S in the ferrofluid.

Table 1 :

 1 Examples of experimental data about magnetoliposomes.

	3	7.1×10 -5	8.2×10 13	25.2	-0.397
	7.75×10 -3	1.1×10 -4	1.3×10 14	13.3	-0.596
	7.75×10 -3	7.5×10 -5	8.7×10 13	21.4	-1.17
	2.5×10 -2	7.3×10 -5	8.4×10 13	24.6	-0.845
	2.5×10 -2	1.2×10 -4	1.4×10 14	22.5	0.496
	2.5×10 -2	6.5×10 -5	7.6×10 13	50.4	0.343
	3.5×10 -2	3.6×10 -5	4.2×10 13	21.1	-1.31
	4.5×10 -2	5.5×10 -5	6.4×10 13	31.6	0.466
	6.5×10 -2	1.1×10 -3	1.2×10 15	14.1	0.536
	8.5×10 -2	1.4×10 -4	1.7×10 13	13.0	0.586

We have described in this article a new shape transition of magnetoliposomes. We interpret this experimental result by a coupling between magnetostatics and electrostatics. A complete theoretical model will be proposed in a forthcoming paper. The main point of our results at the present time is that even a small charge density on the phospholipidic membrane can induce a coupling with charged encapsulated species.