B Podvin
email: podvin@limsi.fr

S Pellerin

Y Fraigneau

G Bonnavion

O Cadot

Modelling the dynamics of the wake behind a squareback Ahmed body

Keywords: Aerodynamics, Proper Orthogonal Decomposition, Reduced-order Model, Direct Numerical Simulation, Experiments

We use direct numerical simulation of the flow around a squareback Ahmed body at Re = 40000 to characterize changes in the wake dynamics. We focus in particular on the intermittent switches associated with multistability. We use Proper Orthogonal Decomposition to extract the dominant energetic modes for the pressure as well as for the velocity field. A reduced-order model for the amplitudes of the velocity POD modes is constructed in order to reproduce the dynamics of the wake. Comparison with the simulation as well as with experimental results shows that the model is able to predict the key features of the flow.

Introduction

Drag reduction strategies for aerodynamic bodies require a fine understanding of the physics of flow separation and of the near-wake of the body. The object of the present study is a squareback Ahmed body at a Reynolds number of Re = 40000, based on the incoming fluid velocity and body height. The wake behind the body is characterized by multistability: the wake is deviated in the spanwise direction two quasi-stationary states exist, each of which is symmetric of the other through spanwise reflection, and corresponds to a wake that is deviated in the spanwise direction. This phenomenon was first identified by [START_REF] Grandemange | Turbulent wake past a three-dimensional blunt body. part 1 -global modes and bi-stability[END_REF]. The wake remains near one quasi-stationary state for several thousand of convective time units, then switches abruptly towards the opposite state. Controlling these switches is of interest since it has been shown that they are associated with an increase in the base pressure, and therefore a decrease of the body drag [START_REF] Fan | Experimental and numerical analysis of the bi-stable turbulent wake of a rectangular flat-backed bluff body[END_REF][START_REF] Haffner | Mechanics of bluff body drag reduction during transient near-wake reversals[END_REF][START_REF] Bonnavion | Unstable wake dynamics of rectangular flat-backed bluff bodies with inclination and ground proximity[END_REF][START_REF] Lorite-Diez An | Experimental analysis of the effect of local base blowing on three-dimensional wake modes[END_REF]. The purpose of this communication is to report on a numerical investigation of the flow behavior during, and in-between switches.

Summary of results

Direct numerical simulation of the flow is performed using the second-order, finite-volume solver SUNFLU-IDH which has been validated for a variety of configurations ( see https://datasemeca.limsi.fr for selected examples). In a previous study [START_REF] Podvin | Proper Orthogonal Decomposition analysis and modelling of the wake deviation behind a squareback Ahmed body[END_REF], the analysis was limited to snapshots corresponding to a near quasistationary state -the simulation was not long enough to allow switches. In the present case, we focus on the switches between the quasi-stationary states. Comparison of the simulation with the experimental results of [START_REF] Bonnavion | Unstable wake dynamics of rectangular flat-backed bluff bodies with inclination and ground proximity[END_REF] is carried out.

We use Proper Orthogonal Decomposition as an analysis tool to extract the dominant features of the wake dynamics from a basis of flow snapshots, one example of which can be seen in figure 1. Comparison of the decompositions of databases excluding and limited to switching times shows that a mode becomes important during the switch. A description of the switch is given in terms of the spatio-temporal characteristics of the POD modes. Projection of the Navier-Stokes equation onto the spatial modes leads to a reduced-order system of ordinary differential equations. The model is found to reproduce key features of the wake dynamics.

Figure 1 :

 1 Figure 1: Three-dimensional view of the instantaneous flow around an Ahmed body based on isosurfaces of the Q-criterion, colored by the streamwise velocity. The flow is coming from the left.


AND Dima Grigoriev
email: dmitry.grigoryev@univ-lille.fr

Mariya Bessonov
email: mbessonov@citytech.cuny.edu

Vladimir Shpilrain

PROBABILITY THEORY AND PUBLIC-KEY CRYPTOGRAPHY

Introduction

Suppose Alice sends a secret bit c to Bob over an open channel, in the presence of a computationally unbounded (passive) adversary Eve. Let P B and P E be the probabilities for Bob and Eve, respectively, to correctly recover c. It is well known that if P B = 1, then a straightforward encryption emulation attack gives P E = 1 as well. In this note, we address a common misconception that this can be somehow "generalized" to the case P B < 1, i.e., emulating encryption (or decryption, or both) can give P E = P B . The basic reason why this is wrong is that Eve can never fully emulate Alice or Bob since Eve's probability space is inherently different from that of Alice or Bob. When P B = 1, this does not matter because "always correct" means "always correct", no matter what the probability space is. However, if P B < 1, then the probability space does play a role.

In [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF], we have gone where no cryptographer had gone before and suggested that it might be possible to build a public-key cryptographic protocol entirely based on probability theory, without using any algebra or number theory. This was met with skepticism (to put it mildly) based on a strong belief in impossibility of having P B > P E . This skepticism has materialized in a preprint by Panny [START_REF] Panny | Guess what?! On the impossibility of unconditionally secure public-key encryption[END_REF] who courageously delved into the depths of elementary probability theory and tried to actually compute some probabilities instead of just saying "this is impossible because this cannot possibly be possible" like most other believers in "flat Earth" do. His preprint is in two independent parts: theoretical, where he does probability computations attempting to prove P E ≥ P B , and (completely unrelated) experimental part where he offers a statistical attack on ciphertext in our protocol in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF] making Eve succeed (in recovering Alice's secret bit) with an unspecified probability P E > 1 2 . The fact that this probability (or, rather, an experimental approximation thereof) was not specified is unfortunate since it leaves open the question of whether or not this particular attack yields P E ≥ P B for the protocol in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF].

The main purpose of this short note is to show (in Section 3) that there is no "generic" algorithm (like emulating encryption, or decryption, or both) for Eve to guarantee P E ≥ P B . Of course, for any particular protocol, there might be an "intelligent", protocol-specific attack, that might give P E ≥ P B , but the question of whether or not there is always a protocol-specific attack that succeeds with probability P E ≥ P B remains open. For the record:

• We admit that in our scheme in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF], P E > 1 2 . We explain in Section 2 below why and how Eve can achieve that.

• The P B > P E claim for the general, "framework", scheme in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF] still stands. In Section 2, we reproduce this framework and give some argument in support of this claim.

• In Section 3, we give an explanation of why typical "proofs" of P E = P B (or even of P E ≥ P B ) are flawed. We also specifically address the decryption emulation attack, to answer a popular concern along the lines of "if Eve is computationally unbounded, she can just emulate Bob and be at least as successful as Bob is in recovering Alice's plaintext". Section 2 also explains why in schemes like the one in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF], P B inherently cannot be larger than 0.75. Regretfully, this probability appears to be not large enough to be useful in any meaningful real-life scenario, as far as we can see.

Finally, we encourage curious readers to read about the famous Monty Hall problem [START_REF]Monty Hall problem[END_REF], to appreciate the importance of the probability space, and not just "random coins", in computing probabilities. A quote from Wikipedia [START_REF]Monty Hall problem[END_REF]: "Paul Erdös, one of the most prolific mathematicians in history, remained unconvinced until he was shown a computer simulation..." shows that nonbelievers in a (sometimes crucial) role of the probability space are in a good company.

We realize that firm believers in "flat Earth" will not even read our note because it is much easier to accuse of heresy than to search for the truth, but we hope that more open-minded readers will be curious enough to find out how probability theory just a little bit beyond the first course in discrete mathematics can be used in cryptographic constructions.

2. How P B can possibly be larger than P E : a simple generic example Let Alice be the sender of a secret bit c and Bob the receiver. Suppose Alice has two (private) disjoint probability spaces, S 1 and S 2 , to pick her encryption key from. Assume, for simplicity of the analysis, that S 1 and S 2 are public (although they are typically not) and that Alice will select between S 1 and S 2 with probability 1 2 . Suppose that if Alice picks her encryption key from S 1 , then Bob decrypts correctly with probability q 1 , and if she picks her encryption key from S 2 , then Bob decrypts correctly with probability q 2 . Then Bob decrypts correctly with probability 1 2 (q 1 + q 2 ). Suppose q 2 > q 1 and q 2 + q 1 > 1. The latter condition implies that, in some instances, encryption key from S 1 produces the same ciphertext as some encryption key from S 2 does. Denote by S 12 ⊆ S 1 the set of these "special" encryption keys.

Let τ 1 be the probability of the following event: Alice picked an encryption key from S 12 , conditioned on (Alice picked an encryption key from S 1 and Bob decrypted correctly). Why do we need this weird-looking condition? It is needed to express, in terms of q 1 , the probability for Bob to decrypt correctly in case Alice picked an encryption key from S 12 (after choosing to pick it from S 1 ). Indeed, this probability is equal to τ 1 q 1 by the probability of the intersection of two events formula. The two events here are (both conditioned on Alice having picked her encryption key from S 1 ): (1) Alice picked her encryption key from S 12 ; (2) Bob decrypted correctly.

How is Eve going to decrypt? The most obvious way is to narrow down the selection of decryption key (while emulating Bob's randomness) by assuming that Alice has picked her encryption key from S 2 (since q 2 > q 1 gives Bob a better chance for success in that case). Then, Eve would emulate Bob's randomness in the hope that this will give her the correct decryption of Alice's bit with probability q 2 > 1 2 (q 2 + q 1 ). However, since Alice selects S 2 with probability 1 2 , the actual probability for Eve to decrypt Alice's bit correctly (if she uses this strategy) is

P E = 1 2 q 2 + 1 2 τ 1 q 1 .
Here q 2 is the probability for Eve to decrypt correctly (by emulating Bob's randomness) in case Alice selected S 2 to pick her encryption key from, and τ 1 q 1 is the probability for Eve to decrypt correctly in case Alice selected S 1 (see above). Then we have:

• The probability for Bob to decrypt Alice's bit correctly is P B = 1 2 (q 2 + q 1 ). • The probability for Eve to decrypt Alice's bit correctly (if she uses the above strategy) is P E = 1 2 (q 2 + τ 1 q 1 ). Thus, if q 2 + τ 1 q 1 > 1, then P E > 1 2 .

• P E < P B . This is because τ 1 q 1 < q 1 . Indeed, obviously one cannot have τ 1 q 1 > q 1 , and τ 1 q 1 = q 1 , or τ 1 = 1, would defy the purpose for Alice to have a separate S 1 in the first place. Thus, this most obvious attack does not give P E ≥ P B if Alice is able to select S 1 and S 2 such that q 2 > q 1 , q 2 + q 1 > 1, and τ 1 < 1. An example of such selection was given in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF]. It is straightforward to see that other strategies for Eve to select between S 1 and S 2 for a supposed encryption key will result in an even lower probability P E of success.

In particular instantiations of this general idea there might be instantiation-specific statistical attacks on Bob's public key or Alice's ciphertext, but the point we are trying to make here is that, contrary to what skeptics claim, there is no "universal" (e.g. encryption/decryption emulation) attack on such a scheme that would guarantee P E ≥ P B . We will establish this more formally in the next section.

To conclude this section, we note that we were unable to find an instantiation of this general scheme where both q 2 and q 1 would be greater than 1 2 , so it appears that P B = 1 2 (q 2 + q 1 ) < 3 4 in any instantiation of this scheme. In the instantiation offered in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF], P B is approximately 0.55.

Why all "proofs" of

P E = P B fail
Below is a short version of a typical "proof" of P E = P B . In what follows, Alice is the sender of a secret plaintext K A and Bob the receiver who, upon decrypting Alice's ciphertext, obtains K B and wants K B = K A , with probability P B > 1 2 . The adversary Eve wants to recover K A , with probability P E ≥ P B . Our main goal in this section is to show that emulation attacks (be it emulation of encryption, or decryption, or both) cannot give P E = P B in any meaningful instantiation of the general scheme from Section 2, including the one in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF]. First we briefly reproduce a typical claim, with a "proof". Proposition 1. Let R A be Alice's randomness, R B Bob's randomness, and T the (public) transcript of communication. Suppose R A conditioned on T and R B conditioned on T are independent. Let K A be Alice's plaintext, K B the result of Bob's decryption, and p = P B the probability of having K B = K A after the communication protocol execution. Then unbounded Eve, on input T , can generate a value K C such that Below we point out some issues with this proof that show that the proof is, at the very least, incomplete if p < 1. If p = 1, the claim of the proposition is well known to be true, as established by a straightforward encryption emulation attack.

P E = P r(K C = K A ) = p. Proof. Let K A = f (R A ,
We note, in passing, that R A and R B include not only "random coins", but also probability spaces. Random coins of Alice and Bob are, indeed, independent in any meaningful public-key communication model. Probability space of the sender, on the other hand, can be dependent on the receiver's public key and therefore on his randomness; this happens even in some well-established schemes, e.g. in PollyCracker. This is not a serious issue though, just something to keep in mind.

Serious issue. Assume, for the sake of argument, that the claim "The triples (R A , R B , T ) and (R A , R B , T ) are identically distributed" in the above proof is correct under appropriate independence conditions. Even that, however, does not prove the claim of the proposition, which is: "Then unbounded Eve, on input T , can generate value K C such that P r(K C = K A ) = P r(K B = K A ) = p". How can Eve do that? Assume for simplicity that K A is just a single bit.

What the above proof suggests is basically an "encryption/decryption emulation attack". That is, Eve generates all possible Alice's (plaintext, ciphertext) pairs and all possible Bob's decryption keys, with all possible randomness, that would match the public key and the protocol description. Then Eve selects all (plaintext, ciphertext, decryption key) triples that give K B = K A . (Recall that K A is Alice's plaintext and K B is the result of decrypting Alice's ciphertext by Bob.) Some of these triples will have K B = K A = 0, while others will have K B = K A = 1. Then what? Select a triple from this pool uniformly at random (or using whatever other distribution)? Then Eve's probability space will be very different from Bob's, and therefore there is no reason for P E to be equal to P B with this strategy. Thus, the above proof is at least incomplete since it does not mention any algorithm for Eve to make that choice and actually generate a value K C that would be equal to K A with probability P B .

To be fair, our argument above only shows that there is no algorithm for Eve to achieve P E = P B . But what about P E ≥ P B ? To achieve this, the best strategy for Eve is probably to just forget about Bob's algorithms, emulate Alice's encryption algorithm, create a probability distribution on the set of all possible (plaintext, ciphertext) pairs, for all possible values of Bob's public key, and then, when given a ciphertext, select the plaintext that corresponds to it with higher probability. This basically takes us to the situation considered in Section 2: this strategy will guarantee P E > 1 2 , but P E ≥ P B is still questionable because Alice's (private) probability space is narrower than Eve's. To illustrate how this matters, here is a simple Example 1. [START_REF]Boy or Girl paradox[END_REF] In a city where every family has two children, Alice and Eve walk down the street and meet Bob with a little boy in a stroller; this boy is Bob's public key. Bob tells them that he has two children, but the other child (Bob's private key) is at home now, and Bob suggests that Alice and Eve try to guess whether the other child is a boy or a girl. While Eve walks away building a probability distribution on the set of all possible gender pairs, Alice finds out that the boy in the stroller was born on a Tuesday. This, of course, did not give Alice any information whatsoever about the other child's gender, but it changed Alice's probability space!

The result is: Eve comes to the conclusion that the other child is a girl with probability 2 3 (because the pairs (BG), (GB), (BB) are assumed to be equally likely in a random family with two children), whereas Alice comes to the conclusion (using Bayes' formula) that the other child is a girl with probability 14 27 , which is quite different from 2 3 .

One can say that in this example, Alice got information not available to Eve (even though this information is irrelevant to Bob's private key), and this seems to be prohibited by theoretical cryptography rules of engagement (a.k.a. Kerckhoffs's principles). However, in actual cryptographic scenarios (including the one in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF]), Alice can "artificially" change her own probability space to her liking. Eve, of course, is aware of all possible probability space choices by Alice, but all she can do is "average out" their probability distributions, which will almost for sure result in different probability distributions on the set of (plaintext, ciphertext) pairs for Alice and for Eve; sometimes it may even reverse the preference of one plaintext (given a ciphertext) over another. This phenomenon is sometimes called Simpson's paradox [START_REF]Simpson's paradox[END_REF], although of all famous paradoxes of probability theory it is probably the least counterintuitive: a trend can appear in several different groups of data but disappear or reverse when these groups are combined.

Finally, we consider decryption emulation attack. If the probability distribution used by Bob to generate his public key is known to the public (which was the case in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF]), then decryption emulation attack may seem like a reasonable strategy for Eve, i.e., Eve can generate all possible Bob's private keys, then generate all possible Bob's public keys corresponding to each of his private keys, and then select all (private key, public key) pairs with public key matching the one actually published by Bob. This will yield a probability distribution (conditioned on T ) on the set of all possible Bob's private keys, and Eve can select one of the private keys that occurs with highest probability in this distribution. The probability P E = P r(K C = K B ) might then be larger than 1 2 , but this probability has little to do with P B = P r(K B = K A ) = p since the latter probability is largely controlled by Alice. Below we show that if Eve achieves P E = P r(K C = K B ) > 1 2 , then, in fact, P E < P B provided P B > 1 2 . Emulating Bob will result in the following success probability P E for Eve to recover K A in the case where K A is a single bit (assuming that K B and K C , too, can only take values 0 or 1):

P E = P r(K C = K A ) = P r(K C = K B ) • P r(K A = K B ) + P r(K C = K B ) • P r(K A = K B ).
All probabilities here are conditioned on T . Also, we assume that, since Eve emulates just Bob, Eve's and Alice's randomness are independent (conditioned on T ), hence the events K C = K B and K A = K B (conditioned on T ) are independent.

Denote P r(K B = K A ) = p, P r(K C = K B ) = σ. Then we have:

P E = P r(K C = K A ) = σp + (1 -σ)(1 -p) = 1 2 (2σ -1)(2p -1) + 1 2 .
If p > 1 2 and σ > 1 2 , then P E > 1 2 , but we claim that P E is less than p in this case. Indeed, 1 2 (2σ -1)(2p -1) + 1 2 < p is equivalent to (2σ -1)(2p -1) < 2p -1, which is true since σ < 1. The latter holds because in a scenario similar to that in Section 2, typically (in particular, in the scheme in [START_REF] Bessonov | A framework for unconditionally secure public-key encryption (with possible decryption errors[END_REF]), to the same Bob's public key, any private (decryption) key from the pool of all private keys can be associated with nonzero probability. In particular, there will be private keys that yield K B = 1, as well as those that yield K B = 0. Thus, while there might be an instantiation-specific statistical attack on Bob's public key, it will have nothing to do with emulation attack(s) suggested by the above proof of Proposition 1. This also explains why the two parts (theoretical and experimental) in [START_REF] Panny | Guess what?! On the impossibility of unconditionally secure public-key encryption[END_REF] are completely unrelated and perhaps also why the probability P E in the experimental part of [START_REF] Panny | Guess what?! On the impossibility of unconditionally secure public-key encryption[END_REF] is not specified.

  T ) and K B = g(R B , T ). Conditioned on T , Eve can sample Bob's coins. Let R B denote Bob's randomness emulated by Eve. Output the value K C = g(R B , T ), which is what Bob would output on input (R B , T ). The triples (R A , R B , T ) and (R A , R B , T ) are identically distributed. Hence the values of p are identical.