Tuan Ngo Dac

Yakov Varshavsky

Tuan Ngo

Recent developments on compactifications of stacks of shtukas

Keywords: Mathematics Subject Classification. Primary 11R58; Secondary 11G09, 14G35 Function fields, moduli spaces, shtukas, semistable reduction, GIT

This text presents an overview of recent developments on compactifications of moduli stacks of shtukas. The aim is to explain how to tackle the problem of compactifying stacks of shtukas by two different methods: the Langton semistable reduction and the Geometric Invariant Theory.

1. Introduction 1 2. Stacks of GL r -shtukas 2 3. Generalized GL r -shtukas 8 4. Stability conditions for Drinfeld shtukas 10 5. Stability conditions for GL r -shtukas 13 6. Langton semistable reduction for GL r -shtukas 16 References 20

Introduction

Let X be a geometrically connected smooth projective curve over a finite field F q and let F denote its function field. In the seventies Drinfeld [START_REF] Drinfeld | Elliptic modules[END_REF][START_REF] Drinfeld | Elliptic modules[END_REF][START_REF] Drinfeld | Varieties of modules of F -sheaves[END_REF] invented several fundamental objects called Drinfeld modules and shtukas over this curve which are analogues of elliptic curves in the function field setting. In this setting, moduli spaces or stacks classifying these objects are analogues of Shimura varieties. Drinfeld [START_REF] Drinfeld | Varieties of modules of F -sheaves[END_REF][START_REF] Drinfeld | Proof of the Petersson conjecture for GL(2) over a global field of characteristic p[END_REF][START_REF] Drinfeld | Cohomology of compactified manifolds of modules of F -sheaves of rank 2[END_REF] studied the moduli space of Drinfeld shtukas of rank 2 and its compactifications and proved the Langlands correspondence for GL 2 over F . Subsequently, Lafforgue [START_REF] Lafforgue | Chtoucas de Drinfeld et conjecture de Ramanujan-Petersson[END_REF][START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF][START_REF] Lafforgue | Chtoucas de Drinfeld et correspondance de Langlands[END_REF] studied the moduli space of Drinfeld shtukas of arbitrary rank r and its compactifications to prove the Langlands correspondence for GL r over F .

The notion of shtukas can be generalized for other reductive groups over F . Laumon, Rapoport and Stuhler [START_REF] Laumon | D-elliptic sheaves and the Langlands correspondence[END_REF] used the moduli space of shtukas for division algebras or D-shtukas and proved the local Langlands conjecture for GL r over local fields of equal characteristic. Similar moduli stacks of D-shtukas were studied by Lafforgue [START_REF] Lafforgue | Chtoucas de Drinfeld et conjecture de Ramanujan-Petersson[END_REF], Lau [START_REF] Lau | On generalised D-shtukas[END_REF][START_REF] Lau | On degenerations of D-shtukas[END_REF], and Ngo Bao-Chau [START_REF] Ngo | D-chtoucas de Drinfeld à modifications symétriques et identité de changement de base[END_REF]. For a more general reductive group G over F , stacks of G-shtukas were introduced and studied by the second author [START_REF] Varshavsky | Moduli spaces of principal F -bundles[END_REF] (for G split) and V. Lafforgue [START_REF] Lafforgue | Chtoucas pour les groupes réductifs et paramétrisation de Langlands globale[END_REF][START_REF] Lafforgue | Shtukas for reductive groups and Langlands correspondence for function fields[END_REF].

In the aforementioned works of Drinfeld and Lafforgue, a major challenge consists of constructing compactifications of stacks of shtukas. The main goal of this paper is to report recent developments on this problem. This text is primarily based on the notes from the first author's talk at the BIRS-CMO workshop "Moduli, Motives and Bundles -New Trends in Algebraic Geometry" in Oaxaca, Mexico in 2022, as well as the authors' work on this subject. Details and proofs will appear in the paper [START_REF] Ngo Dac | On compactifications of stacks of shtukas[END_REF].

Acknowledgments.

The first author (T. ND.) would like to thank the organizers (Pedro Luis del Angel Rodriguez, Frank Neumann, and Alexander Schmitt) of the workshop for the opportunity to give the talk and for their encouragement leading to this write-up.

The first author (T. ND.) was partially supported by ANR Grant COLOSS ANR-19-CE40-0015-02 and the Excellence Research Chair "L-functions in positive characteristic and applications" financed by the Normandy Region. The second author (Y. V.) was partially supported by ISF grants 2019/21.

The preparation of this work was done while the authors were visiting the Hausdorff Research Institute for Mathematics, Germany (T. ND. and Y. V.) and KAIST, Korea (T. ND.). We are grateful to these institutions for their hospitality and financial support.

Stacks of GL r -shtukas

In this section we review the definition and basic properties of stacks of GL r -shtukas, which generalize the moduli stacks of Drinfeld shtukas studied by Drinfeld [START_REF] Drinfeld | Varieties of modules of F -sheaves[END_REF][START_REF] Drinfeld | Proof of the Petersson conjecture for GL(2) over a global field of characteristic p[END_REF][START_REF] Drinfeld | Cohomology of compactified manifolds of modules of F -sheaves of rank 2[END_REF], Lafforgue [START_REF] Lafforgue | Chtoucas de Drinfeld et conjecture de Ramanujan-Petersson[END_REF][START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF][START_REF] Lafforgue | Chtoucas de Drinfeld et correspondance de Langlands[END_REF][START_REF] Lafforgue | Cours à l'Institut Tata sur les chtoucas de Drinfeld et la correspondance de Langlands[END_REF] (see also Varshavsky [START_REF] Varshavsky | Moduli spaces of principal F -bundles[END_REF] and V. Lafforgue [START_REF] Lafforgue | Chtoucas pour les groupes réductifs et paramétrisation de Langlands globale[END_REF][START_REF] Lafforgue | Shtukas for reductive groups and Langlands correspondence for function fields[END_REF] for a more general setting).

Notation.

Let F q be a finite field with q elements. We denote by p the characteristic of F q and F q be an algebraic closure of F q .

Let X be a geometrically connected smooth projective curve over F q . Denote by F its function field. We always consider schemes and stacks over F q . Letting Y and Z be schemes or stacks over F q , we use Y × Z to denote the fiber product of Y and Z over F q and by Frob Y : Y -→ Y the absolute Frobenius morphism of Y over F q . The latter is the identity on the underlying topological space and the q-th power on the structure sheaf. For any scheme S over F q , if E is a vector bundle over X × S, then we write

E σ := (id X × Frob S ) * E.
Let r be a positive integer and G = GL r the general linear group of rank r. Let T ⊂ G be the split maximal torus of diagonal matrices and let B ⊂ G be the Borel subgroup of upper triangular matrices. We identify the set of characters and that of cocharacters with Z r as follows. A character (resp. cocharacter) of T is always of the form

t = (t 1 , . . . , t r ) → t λ 1 1 . . . t λ r r (resp. t → (t λ 1 , . . . , t λ r ))
for some λ = (λ 1 , . . . , λ r ) ∈ Z r , and we identify it with the element λ = (λ 1 , . . . , λ r ) of Z r . The natural pairing is therefore identified with the natural product Z r × Z r -→ Z. The set of roots Φ (resp. of positive roots Φ + ) with respect to our choice (B, T ) consists of the elements of the forms e i -e j with 1 ≤ i = j ≤ r (resp. with 1 ≤ i < j ≤ r). The set of simple roots ∆ consists of the elements of the forms e i -e i+1 with 1 ≤ i ≤ r -1. Let λ = (λ 1 , . . . , λ r ) ∈ Z r be a character (resp. a cocharacter). We say that λ is dominant if (λ 1 , . . . , λ r ) lies in the subset (Z r ) + of decreasing sequences of integers, i.e.,

λ 1 ≥ • • • ≥ λ r . We set deg λ := r i=1 λ i .
Further, let µ = (µ 1 , . . . , µ r ) be another character (resp. a cocharacter), we say that λ ≤ µ if and only if

λ 1 ≤ µ 1 , λ 1 + λ 2 ≤ µ 1 + µ 2 , • • • λ 1 + • • • + λ r-1 ≤ µ 1 + • • • + µ r-1 , λ 1 + • • • + λ r = µ 1 + • • • + µ r .

Vector bundles on curves.

Recall that a vector bundle of rank r over X is a locally free sheaf of rank r on X. Let Bun r be the functor which assigns a scheme S the groupoid of vector bundles of rank r over X × S, where morphisms are isomorphisms of vector bundles. This stack Bun r is called the stack classifying vector bundles of rank r over X.

Proposition 2.1. The stack Bun r is a smooth Artin stack, locally of finite type over F q .

Proof. By [21, Théorème (4.6.2.1)], Bun r is an Artin stack locally of finite type over F q . By the deformation theory, Bun r is formally smooth, and the proposition follows. Definition 2.3. By a rational Harder-Narasimhan (HN for short) polygon, we mean an element p = (p(0), p(1), . . . , p(r)) of Q r+1 such that i) p(0) = p(r) = 0, ii) p is convex, i.e., for every 1 ≤ i ≤ r, we put

∆p(i) := p(i) -p(i -1)
and we require that ∆p(i) ≥ ∆p(i + 1) for 1 ≤ i < r.

In this section, let κ be an algebraically closed field and let E be a vector bundle of rank r over X × κ. For a subbundle F of E, the normalized degree of F is defined by We are ready to introduce the notion of Harder-Narasimhan stratification of vector bundles. Proposition 2.5. There exists a canonical filtration

ndeg E F := deg F - rk F rk E deg E.
0 =: E 0 E 1 • • • E n := E such that for every 0 ≤ i ≤ n -1 we have 1) deg E i rk E i > deg E i+1 rk E i+1 , 2) E i+1 /E i is semistable. Remark 2.6. 1) It follows that the set of points {(rk E i , deg E i ) : 0 ≤ i ≤ n} (resp. {(rk E i , deg E i -rk E i deg E rk E ) : 0 ≤ i ≤ n})
defines a convex polygon. This is called the Harder-Narasimhan polygon (resp. the normalized Harder-Narasimhan polygon) associated to the vector bundle E. The canonical filtration is also called the Harder-Narasimhan filtration of E.

2) Another consequence is that for every subbundle F of E, the point (rk F, deg F) lies below the Harder-Narasimhan of E.

3) If we consider a family of vector bundles on X, then the Harder-Narasimhan polygon can only get bigger under specialization. We introduce the Hecke stack of modifications Hecke r following Beilinson and Drinfeld [START_REF] Beilinson | Quantization of Hitchin's integrable system and Hecke eigensheaves[END_REF]. Definition 2.9. The Hecke stack Hecke r is the stack over the category of schemes which, for every scheme S, classifies the data E = (x, E, E , ϕ) where i) x ∈ X(S) called the leg of E, ii) E and E are vector bundles of rank r over X × S, iii) ϕ : E| X×S-Γx

∼

-→ E | X×S-Γx is an isomorphism of these vector bundles outside the graph Γ x of x.

Let κ be an algebraically closed field and let E = (x, E, E , ϕ) be a κ-point of Hecke r . We denote by O x the completion of O X×κ at x and by F x its fraction field. Then ϕ x allows us to identify E| Spec Fx and E | Spec Fx which are both vector spaces of dimension r over F x . Consider two lattices E| Spec Ox and E | Spec Ox in this vector space. Let x be a uniformizing element of O x . By the theory of elementary divisors, there exist a basis (e 1 , e 2 , . . . , e r ) of E| Spec Ox and a dominant coweight λ = (λ 1 , . . . , λ r ) ∈ (Z r ) + such that ( λ 1

x e 1 , . . . , λ r x e r ) is a basis of E | Spec Ox . We denote λ by inv(E). Remark that we always have the equality deg

E = deg E + deg inv(E).
Definition 2.10. Let λ ∈ (Z r ) + be a dominant coweight of GL r . It is well-known (see [START_REF] Beilinson | Quantization of Hitchin's integrable system and Hecke eigensheaves[END_REF]) that there is a closed reduced substack Hecke r,λ of Hecke r such that for every algebraically closed field κ, Hecke r,λ (κ) consists of E = (x, E, E , ϕ) ∈ Hecke r (κ) such that inv(E) ≤ λ.

Iterated version of Hecke stacks.

Notation 2.11. From now on we will fix an integer n ≥ 1 and denote by I the finite set {1, . . . , n}. Further, we fix a collection λ = (λ i ) i∈I of dominant coweights of GL r such that

(2.1) deg λ := n i=1 deg λ i = 0.
Definition 2.12. We define the iterated Hecke stack Hecke r,λ which, to every scheme S classifies the data

((x i ) i∈I , E 0 , . . . , E n , (ϕ i ) i∈I )
(or (x, E, ϕ) for short) where for i ∈ I, we require that

(x i , E i-1 , E i , ϕ i ) ∈ Hecke r,λ i (S).
It should be noted that there is a non-iterated version of these stacks that consider only one modification. This can be found in [29, Definition 2.4].

Stacks of shtukas.

Definition 2.13. a) For every scheme S, the stack Sht r,λ of shtukas of rank r with modifications bounded by λ classifies the data

E = ((x i ) i∈I , E 0 , . . . , E n , (ϕ i ) i∈I , ψ) (or (x, E, ϕ, ψ) for short) such that i) (x, E, ϕ) ∈ Hecke r,λ (S), ii) ψ : E σ ∼ -→ E is an isomorphism of vector bundles of rank r over X × S.
b) For every integer d, we define Sht d r,λ to be the substack of Sht r,λ classifying the data (x, E, ϕ, ψ) with deg E 0 = d. Remark 2.14. 1) Recall that we have assumed (see (2.1))

deg λ := n i=1 deg λ i = 0.
This condition is needed in order to get a non-empty stack Sht r,λ (see [START_REF] Varshavsky | Moduli spaces of principal F -bundles[END_REF]Proposition 2.16 (d)]).

2) The stacks Sht r,λ , Sht d r,λ (d ∈ Z) are Artin stacks locally of finite type.

3) We have a cartesian diagram

Sht d r,λ ---→ Bun r     Hecke d r,λ ---→ Bun r × Bun r , where • the upper horizontal map is E = ((x i ) i∈I , E 0 , . . . , E n , (ϕ i ) i∈I , ψ) → E 0 ,
• the lower horizontal map is

((x i ) i∈I , E 0 , . . . , E n , (ϕ i ) i∈I ) → (E 0 , E n ),
• the left vertical map is

E = ((x i ) i∈I , E 0 , . . . , E n , (ϕ i ) i∈I , ψ) → ((x i ) i∈I , E 0 , . . . , E n , (ϕ i ) i∈I ),
• the right vertical map is

E 0 → (E 0 , E σ 0 ). Proposition 2.15. Let Sht ≤p r,λ (resp. Sht d,≤p r,λ
) be the substack of Sht r,λ (resp. Sht d r,λ ) classifying shtukas of rank r bounded by p, i.e., the data E = (x, E, ϕ, ψ) such that the Harder-Narasimhan polygon of the corresponding vector bundle E 0 is bounded by p. Then it is an open substack of Sht r,λ and the connected components Sht d,≤p r,λ of this substack are of finite type.

Proof. See [START_REF] Varshavsky | Moduli spaces of principal F -bundles[END_REF]Proposition 2.16] where a more general result is proved.

Example: stacks of Drinfeld shtukas.

When I = {1, 2} and λ = (λ 1 , λ 2 ) where λ 1 = (1, 0, . . . , 0) ∈ Z r and λ 2 = (0, . . . , 0, -1) ∈ Z r , the corresponding stack is known as the stack Sht r classifying Drinfeld shtukas of rank r, studied by Drinfeld [START_REF] Drinfeld | Varieties of modules of F -sheaves[END_REF][START_REF] Drinfeld | Proof of the Petersson conjecture for GL(2) over a global field of characteristic p[END_REF][START_REF] Drinfeld | Cohomology of compactified manifolds of modules of F -sheaves of rank 2[END_REF] for r = 2 and by Lafforgue [START_REF] Lafforgue | Chtoucas de Drinfeld et conjecture de Ramanujan-Petersson[END_REF][START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF][START_REF] Lafforgue | Chtoucas de Drinfeld et correspondance de Langlands[END_REF] for general r. For every scheme S, Sht r (S) classifies the following data

E → E ← E ∼ ←-E σ
where E, E and E are vector bundles of rank r over X × S and E → E and E → E are injective homomorphisms of vector bundles such that

• the supports of these maps are the graphs of morphisms ∞ : S → X and 0 : S → X, respectively, • the cokernels of these maps are locally free of rank 1 as O Smodules.

Compactifying stacks of shtukas.

For every HN polygon p, the substack Sht ≤p r,λ (resp. Sht d,≤p r,λ ) is an open substack of finite type of Sht r,λ (resp. Sht d r,λ ). However, they are not proper.

In the works of Drinfeld and Lafforgue, a major challenge lies in constructing compactifications for the corresponding substacks Sht ≤p r,λ of the stack of Drinfeld shtukas Sht d r (as discussed in §2.7). In the general case, it would be interesting to construct compactifications for the substack Sht d,≤p r,λ of Sht d r,λ .

To do so, we follow the strategy of Drinfeld [START_REF] Drinfeld | Cohomology of compactified manifolds of modules of F -sheaves of rank 2[END_REF] and Lafforgue [START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF][START_REF] Lafforgue | Cours à l'Institut Tata sur les chtoucas de Drinfeld et la correspondance de Langlands[END_REF] which can be described as follows.

• The notion of generalized shtukas. Drinfeld and Lafforgue start by introducing the concept of generalized shtukas, which expands that of shtukas by considering pseudo-complete homomorphisms instead of isomorphisms. The stacks classifying these generalized shtukas have a stratification, with the open stratum corresponding to Sht r,λ . • Stability conditions. The next and crucial step is to find stability conditions for the truncating substacks to ensure properness. There are two methods to find stability conditions:

(1) The semistable reduction à la Langton. One approach is the semistable reduction à la Langton, which involves educated guessing and the use of the valuative criterion for properness. This method was successfully applied by Langton [START_REF] Langton | Valuative criteria for families of vector bundles on algebraic varieties[END_REF] to prove the properness of moduli spaces of semistable vector bundles on a smooth projective curve (even variety) over a field. We refer the reader to the works of Heinloth [START_REF] Heinloth | Semistable reduction for G-bundles on curves[END_REF][START_REF] Heinloth | Addendum to "Semistable reduction of G-bundles on curves[END_REF] for another semistable reduction proof of this result using the affine Grassmannian. (2) The Geometric Invariant Theory (GIT). Another method uses the GIT theory developed by Munford among others (see for example [START_REF] Mumford | Geometric invariant theory[END_REF]), which is a powerful and conceptual approach. Stability conditions are derived from the Hilbert-Mumford criterion from GIT, although this is a difficult and lengthy task in many cases. Again this method was successfully applied by Seshadri [START_REF] Seshadri | Space of unitary vector bundles on a compact Riemann surface[END_REF] to prove the properness of moduli spaces of semistable vector bundles on a smooth projective curve over a field. In what follows we explain how to employ both of these methods to tackle the problem of compactifying stacks of shtukas.

Generalized GL r -shtukas

In this section we review the notion of generalized GL r -shtukas, introduce stacks classifying these objects and present their basic properties.

Pseudo-complete homomorphisms.

We recall the scheme of complete homomorphisms given in [START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF] (see also [19, §4]) and that of pseudo-complete homomorphisms. As noticed in loc. cit., this scheme is closely related to the De Concini-Procesi wonderful compactification [START_REF] Concini | Complete symmetric varieties[END_REF] and the Vinberg semigroup [START_REF] Vinberg | On reductive algebraic semigroups. In Lie groups and Lie algebras: E. B. Dynkin's Seminar[END_REF].

We consider the immersion

GL r ×G r-1 m → r i=1 End(∧ i A r ) × A r-1 ,
which sends (g, α 1 , . . . , α r-1 ) ∈ GL r ×G r-1 m to (u 1 , . . . , u r , α 1 , . . . , α r-1 ) where

u 1 = g, ∧ 2 u 1 = α 1 u 2 , ∧ 3 u 1 = α 2 1 α 2 u 3 , . . . ∧ r u 1 = α r-1 1 α r-2 2 . . . α r-1 u r .
We observe that the image of GL r ×G r-1 m lies in r i=1 End(∧ i A r ) -{0} × A r-1 . Definition 3.1. a) We define the scheme V 0 GLr of complete homomorphisms to be the schematic closure of GL r ×G r-1 m in r i=1 End(

∧ i A r )- {0} × A r-1 .
b) We define the scheme V GLr of pseudo-complete homomorphisms to be the schematic closure of GL r ×G r-1 m in r i=1 End(∧ i A r ) × A r-1 . Let r = (r 1 , . . . , r k-1 ) be a strictly increasing sequence of integers between 0 and r, i.e., 0 < r 1 < • • • < r k-1 < r. Put r 0 = 0 and r k = r. Denote by V 0 GLr,r the locally closed subscheme of V 0 GLr defined by requiring that α i = 0 for every i ∈ r and that α i is invertible for every i / ∈ r. Then V 0 GLr,r admits a modular interpretation (see [12, §1, Proposition 1]).

Stacks of generalized shtukas.

Definition 3.2. We define the stack of generalized shtukas GenSht r,λ which for every scheme S, classifies the data (x 1 , . . . , x n , E 0 , . . . , E n , ϕ 1 , . . . , ϕ n , L 1 , . . . , L r-1 , l 1 , . . . , l r-1 , u 1 , . . . , u r ) (or (x, E, ϕ, L, l, u) for short) where i) (x, E, ϕ) is an object of Hecke r,λ (S),

ii) for every 1

≤ i ≤ r -1, L i is a line bundle over S and l i is a global section of L i , i.e., (L i , l i ) ∈ [A 1 /G m ](S), iii) u is a pseudo-complete homomorphism E σ 0 ⇒ E n over (L ⊗(q-1)
, l q-1 ), i.e., for every 1 ≤ i ≤ r,

u i : ∧ i E 0 ⊗ 1≤j<i L i-j j σ -→ ∧ i E n ⊗ 1≤j<i L i-j j
is a homomorphism of vector bundles such that the following conditions hold: a) For any choice of trivialization of E 0 , E n and L i locally on X × S, the family (u 1 , . . . , u r , l 1 , . . . , l r-1 ) lies in V GLr .

b) If we identify E 0 and E n outside the union of the graphs of x j (j ∈ I), then for all 1 ≤ i ≤ r, u i can be iterated and we require that none of u i are nilpotent at any geometric point of S.

For every integer d, let GenSht d r,λ be the substack of GenSht r,λ classifying the data (x, E, ϕ, L, l, u) with deg E 0 = d.

Stratification.

The stratification of [A 1 /G m ] r-1 induces a stratification of GenSht r,λ as follows. Let r = (r 1 , . . . , r k-1 ) be an increasing sequence of integers between 0 and r. We put r 0 = 0. Let GenSht r,λ,r be the locally closed substack of GenSht r,λ such that l i = 0 for every i ∈ r and l i is invertible for every i / ∈ r. Let κ be an algebraically closed field. Let E = (x, E, ϕ, L, l, u) be a κ-point of GenSht r,λ,r . We will say that E is of type r. We choose a trivialization of line bundles L r i over κ. Then the pseudo-complete homomorphism u : E σ 0 ⇒ E n over (L ⊗(q-1) , l q-1 ) gives rise to the data consisting of i) a decreasing filtration

E 0, * = (E 0,0 = E σ 0 E 0,1 • • • E 0,k-1 E 0,k = 0) by subbundles E 0,i of E σ 0 of rank r -r i , ii) an increasing filtration E n, * = (0 = E n,0 E n,1 • • • E n,k-1 E n,k = E n ) by subbundles E n,i of E n of rank r i ,
iii) for every 1 ≤ i ≤ k, an isomorphism over the generic point

v i : E 0,i-1 /E 0,i → E n,i /E n,i-1
of vector bundles of the same rank.

Remark 3.3. 1) For all 1 ≤ i ≤ k we always have an injection

det E 0 /E 0,i → det E n,i .
2) Since E n is obtained from E 0 by a chain of modifications, the increasing filtration E n, * induces an increasing filtration

E 0, * = (0 = E 0,0 E 0,1 • • • E 0,k-1 E 0,k = E 0 )
by subbundles E 0,i of E 0 of rank r i . The nilpotent conditions of u i are equivalent to the fact that for every 1 ≤ i ≤ k, we have

E 0,i ∩ E σ 0,i = 0.

Stability conditions for Drinfeld shtukas

In this section we work with Drinfeld shtukas given as in §2.7 and review the stability conditions introduced by Drinfeld [START_REF] Drinfeld | Cohomology of compactified manifolds of modules of F -sheaves of rank 2[END_REF] for r = 2 and Lafforgue [START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF] for general r.

Notation.

Recall that I = {1, 2} and λ = (λ 1 , λ 2 ) where λ 1 = (1, 0, . . . , 0) ∈ Z r and λ 2 = (0, . . . , 0, -1) ∈ Z r . We will use the notation of Lafforgue: a Drinfeld shtuka of rank r is represented by the data

(E → E ← E ∼ ←-E σ ),
and a generalized Drinfeld shtuka of rank r is represented by the data

E = (E → E ← E ⇐ E σ , (L, l)).
We will drop the subscriptions λ and denote the stacks classifying Drinfeld shtukas of rank r and generalized Drinfeld shtukas of rank r by Sht r and GenSht r respectively. 4.2. Stratification and stability conditions. 4.2.1. Stratification. Let r = (r 1 , . . . , r k-1 ) be an increasing sequence of integers between 0 and r. We put r 0 = 0. Let κ be an algebraically closed field. Let

E = (E → E ← E ⇐ E σ , (L, l))
be a κ-point of GenSht r,r , so it is of type r. We choose a trivialization of line bundles L r i over κ and will drop (L, l) in the data of E. Then the pseudo-complete homomorphism E σ ⇒ E gives rise to i) a decreasing filtration

E * = (E = E σ E 1 • • • E k-1 E k = 0) by subbundles E i of E σ of rank r -r i ,
ii) an increasing filtration

E * = (0 = E 0 E 1 • • • E k-1 E k = E ) by subbundles E i of E of rank r i ,
iii) for every 1 ≤ i ≤ k, an isomorphism over the generic point

v i : E i-1 /E i → E i /E i-1
of vector bundles of the same rank.

As before, we denote by E * and E * the increasing filtration of E and E respectively induced by E * . Recall that for every 1 ≤ i ≤ k, we have E 0,i ∩ E σ 0,i = 0. 4.2.2. Iterated shtukas. Following Lafforgue [12, §1, Part c)], we introduce the notion of iterated shtukas. Definition 4.1. Let E be a generalized Drinfeld shtuka of rank r and of type r over κ as in §4.2.1. We say that E is an iterated shtuka if the following conditions hold:

(1) For every 1 ≤ i ≤ k, the morphism

v i : E i-1 /E i → E i /E i-1
is an isomorphism of vector bundles of the same rank. (2) For every 1

≤ i ≤ k, the injection E i → E i is an isomorphism. (3) For every 1 ≤ i ≤ k, the morphism E i → E /E is surjective. (4) For every 1 ≤ i < k, we have E i + E σ i+1 = E σ .
The stack classifying iterated (Drinfeld) shtukas of rank r will be denoted by Sht r . Remark 4.2. It is important to note that for iterated shtukas, the maps v i are isomorphisms rather than isomorphisms over the generic point. This distinction arises from the specific choice of λ for Drinfeld shtukas and has significant implications for the geometric properties of the stack of Drinfeld shtukas and its compactifications. 4.2.3. Good objects of an iterated shtuka. We keep the above notation and suppose that E = (E → E ← E ⇐ E σ ) is an iterated shtuka of rank r and of type r over κ. By definition, a good object of E consists of a pair (F, F ) of subbundles of E and E respectively such that

• F → F and rk F = rk F ;

• there exists some 1

≤ i ≤ k such that E i-1 F ⊆ E i and E i-1 F ⊆ E i ; • the injection E i-1 /E i ∼ -→ E i /E i-1 → E i /E i-1 sends the quotient F σ ∩ E i-1 /F σ ∩ E i to F ∩ E i /F ∩ E i-1 .
Let (F, F ) be a good object of E. Then we say that

• it is of type I if either i = 1 or F σ + E i-1 = E σ ; • it is of type II if i > 1 and F σ + E i-1 E σ .
It should be noted that if r = 2 which is the case studied by Drinfeld, every good object of E is of type I. 4.2.4. Stability conditions. Let p be a HN polygon. We define Sht ≤p r,r to be the substack of Sht r,r such that E belongs to Sht ≤p r,r (κ) if the following conditions hold:

• For all 1 ≤ i ≤ k, p(r i ) -1 < deg E i - rk E i rk E deg E ≤ p(r i ).
• For all good objects (F, F ) of E which is of type I,

deg F - rk F rk E deg E ≤ p(rk F).
• For all good objects (F,

F ) of E which is of type II, deg F - rk F rk E deg E ≤ p(rk F) -1.

Compactifications and Langton semistable reduction.

The main theorem of Lafforgue in [START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF] which generalizes the work of Drinfeld [START_REF] Drinfeld | Cohomology of compactified manifolds of modules of F -sheaves of rank 2[END_REF] reads (see [12, 2) Suppose that p is sufficiently convex. Then the morphism

Sht ≤p r → X × X is proper.
The proof of the theorem for the properness of the moduli stack of shtukas is based on the semistable reduction technique introduced by Langton [START_REF] Langton | Valuative criteria for families of vector bundles on algebraic varieties[END_REF]. The valuative criterion for properness is used in the proof, and the main steps for the existence part are explained below. For a more detailed proof, we refer the reader to [START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF][START_REF] Lafforgue | Chtoucas de Drinfeld et correspondance de Langlands[END_REF].

• Step 1: Extend a shtuka on the generic fiber.

We first focus on the generic fiber with a shtuka E bounded by p that we have to degenerate, with its ϕ-space structure, and introduces the notion of an iterated lattice in this ϕ-space. Drinfeld showed that there are infinitely many iterated lattices M , that each induces a degeneration E(M ) of the shtuka and that our task is to show that one has the properties dictated by the chosen polygon p.

• Step 2: Find a modification of a generalized shtuka.

We then introduce the procedure of elementary transformations to move from one iterated lattice to another. If the special fiber E M does not belong to the substack Sht ≤p r , the procedure can be applied to find a suitable modification E(M ) of E, corresponding to an elementary transformation M of M .

• Step 3: Show that after a finite number of elementary transformations, we get a generalized shtuka bounded by p. In Langton's original paper [START_REF] Langton | Valuative criteria for families of vector bundles on algebraic varieties[END_REF] and in various works using his semistable reduction, a quantity β(M ) ∈ Z is associated to each lattice M . This quantity has the property that β(M ) ≤ 0 if and only if the lattice M is the desired one. The proof shows that after a suitable modification, the new lattice M is "less stable", meaning β(M ) ≤ β(M ). After a finite number of modifications, a strict inequality must be obtained, thus completing the proof.

However, defining the quantity β(M ) is a difficult task, and the proof described in [START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF][START_REF] Lafforgue | Chtoucas de Drinfeld et correspondance de Langlands[END_REF] is much more intricate than the simplified explanation presented here.

Stability conditions for GL r -shtukas

In the study of stacks GenSht r,λ that classify GL r -shtukas with arbitrary modifications, finding stability criteria is very challenging even with educated guessing. However, the application of the GIT machinery, as discussed in [START_REF] Dac | Compactification des champs de chtoucas et théorie géométrique des invariants[END_REF], provides a means to obtain stability conditions for these stacks. The use of GIT allows stability conditions to be deduced from the Hilbert-Mumford criterion, although this is still a difficult and lengthy task. 5.1. Stratification and stability conditions. 5.1.1. Stratification. We use the notation of §3.3. Let r = (r 1 , . . . , r k-1 ) be an increasing sequence of integers between 0 and r. We put r 0 = 0. Let κ be an algebraically closed field. Let E = (x, E, ϕ, L, l, u) be a κ-point of GenSht r,λ,r . We choose a trivialization of line bundles L r i over κ. Recall that we have i) a decreasing filtration

E 0, * = (E 0,0 = E σ 0 E 0,1 • • • E 0,k-1 E 0,k = 0) by subbundles E 0,i of E σ 0 of rank r -r i , ii) an increasing filtration E n, * = (0 = E n,0 E n,1 • • • E n,k-1 E n,k = E n ) by subbundles E n,i of E n of rank r i ,
iii) for every 1 ≤ i ≤ k, an isomorphism over the generic point

v i : E 0,i-1 /E 0,i → E n,i /E n,i-1
of vector bundles of the same rank.

The increasing filtration E n, * induces an increasing filtration

E 0, * = (0 = E 0,0 E 0,1 • • • E 0,k-1 E 0,k = E 0 )
by subbundles E 0,i of E 0 of rank r i . It is required that for every 1 ≤ i ≤ k, we have E 0,i ∩ E σ 0,i = 0. Definition 5.1. In the above notation, for every HN polygon p and every subbundle F of E 0 , we define

p E (F) := k i=1 ∆p(r i-1 + 1) + • • • + ∆p(r i-1 + rk(F σ ∩ E 0,i-1 /F σ ∩ E 0,i )) .
The p-defect of F is defined by

def p F := ndeg E 0 F -p E (F) = deg F - rk F r deg E 0 -p E (F).
Remark 5.2. In our recent work [START_REF] Ngo Dac | On compactifications of stacks of shtukas[END_REF], the notion of p-defect is introduced and is shown to play a central role in that paper. The details of this concept and its significance will be explained in the subsequent section of the paper.

5.1.2. Stability conditions. Let p be a HN polygon as in Definition 2.3. We define GenSht ≤p r,λ to be the largest substack of GenSht r,λ such that a geometric point E = (x, E, ϕ, L, l, u) of GenSht r,λ lies in GenSht ≤p r,λ if and only if for every subbundle F of E 0 , we have the inequality

ndeg E 0 F ≤ p E (F)
where we recall that ndeg E 0 F = deg Frk F r deg E 0 . In this case, we will say that the generalized shtuka (x, E, ϕ, L, l, u) is bounded by p. We we also denote by GenSht ≤p r,λ,r (resp. GenSht d,≤p r,λ ) the intersection of GenSht ≤p r,λ with GenSht r,λ,r (resp. GenSht d r,λ ).

Proposition 5.3. The stack GenSht ≤p r,λ is an open substack of GenSht r,λ . Moreover, it contains Sht ≤p r,λ as an open substack. 5.2. Compactifications and GIT. Definition 5.4. Let d be an integer and let p be a HN polygon. We will say that p is d-generic if for every integer 0 < k < r and for every sequence of integers (r 1 , . . . , r k ) such that 0

< r 1 • • • < r k ≤ r, the number k r d + ∆p(r 1 ) + • • • + ∆p(r k )
is not an integer.

In [START_REF] Dac | Compactification des champs de chtoucas et théorie géométrique des invariants[END_REF] the first author uses the Hilbert-Mumford criterion from GIT to prove the following result (see [START_REF] Dac | Compactification des champs de chtoucas et théorie géométrique des invariants[END_REF]Théorème VII.3.3]): Theorem 5.5. Let d be an integer and p be a d-generic, sufficiently convex HN polygon. Suppose that q is sufficiently big. Then the morphism GenSht d,≤p r,λ -→ X n is proper.

The proof of this theorem regarding the properness of the mentioned stack is known to be long and involves complicated calculations. The interested reader can refer to [START_REF] Dac | Compactification des champs de chtoucas et théorie géométrique des invariants[END_REF] for a detailed explanation and the complete proof of the theorem.

Relations with the works of Drinfeld and Lafforgue.

We work again with Drinfeld shtukas, i.e., I = {1, 2} and λ = (λ 1 , λ 2 ) where λ 1 = (1, 0, . . . , 0) ∈ Z r and λ 2 = (0, . . . , 0, -1) ∈ Z r . Let d be an integer and p be a d-generic, sufficiently convex HN polygon. For all 0 < k < r we set

q(k) := p(k) - k r d + k r d,
where . denotes the floor function. In particular, q(k) < p(k) < q(k)+ 1 as p is d-generic.

In [START_REF] Dac | Compactification des champs de chtoucas et théorie géométrique des invariants[END_REF] it is also shown that the family of compactifications constructed by Lafforgue as presented in §4 lies in the family of compactifications given in the previous section if the polygon p is well chosen. More precisely, it is proved that (see [26, Théorème VI.1.1]): Theorem 5.6. We keep the above notation. We suppose that {p(k)q(k)} 0<k<r is a decreasing sequence. Let E = (E → E ← E ⇐ E σ , (L, l)) ∈ GenSht r,r (κ) be a generalized Drinfeld shtuka over an algebraically closed field κ. Then the following conditions are equivalent:

(1) For every subbundle F of E, we have the inequality

deg F - rk F r deg E ≤ p E (F)
where we recall that p E (F) is given by

p E (F) = k i=1 ∆p(r i-1 + 1) + • • • + ∆p(r i-1 + rk(F σ ∩ E i-1 /F σ ∩ E i )) .
(2) E belongs to Sht ≤p r,r (see §4.2.4). Remark 5.7. It is important to note that stability conditions implies that E verifies the list of conditions for iterated shtukas listed in Definition 4.1. This implication follows from the specific choice of λ for Drinfeld shtukas.

Langton semistable reduction for GL r -shtukas

In this section, we provide a concise overview of our recent work where we present a proof of the previous theorem using the semistable reduction technique inspired by Langton. Further, we improve Theorem 5.5 by removing the technical condition that q is sufficiently big. Theorem 6.1. Let d be an integer and let p be a d-generic, sufficiently convex HN polygon. Then the morphism GenSht d,≤p r,λ -→ X n is proper.

We sketch some ideas of the proof. Details and proofs will be given in [START_REF] Ngo Dac | On compactifications of stacks of shtukas[END_REF]. The key concept used in our proof is the notion of the defect of a subbundle, as defined in Definition 5.1. Notably, even for stacks of Drinfeld shtukas, our proof offers a more direct and conceptual approach compared to the works of Lafforgue [START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF][START_REF] Lafforgue | Chtoucas de Drinfeld et correspondance de Langlands[END_REF]. Additionally, the semistable reduction method allows us to immediately extend our results to construct compactifications of stacks of shtukas for division algebras or D-shtukas, thus addressing a problem previously investigated by Lafforgue [START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF], Lau [START_REF] Lau | On generalised D-shtukas[END_REF][START_REF] Lau | On degenerations of D-shtukas[END_REF], and Ngo Bao-Chau [START_REF] Ngo | D-chtoucas de Drinfeld à modifications symétriques et identité de changement de base[END_REF].

Setup.

Let A be a discrete valuation ring (DVR) whose quotient field is denoted by K and whose residue field is κ which is supposed to be algebraically closed. Let π be a uniformizer and v the valuation of A.

We consider the regular surface X ⊗ A. Denote by A X the local ring in X ⊗ A of the generic point of the special fiber X ⊗ κ. It is a DVR. The quotient field K A X of A X is the function field of the generic fiber X ⊗ K and the residue field κ A X of A X is the function field of the special fiber X ⊗ κ. The element π is still a uniformizer of A X . Denote by A X (resp. K A X , κ A X ) be the completion of A X (resp. K A X , κ A X ).

Let E = (x, E, ϕ, L, l, u) be a shtuka in Sht d,≤p r,,λ over Spec K and we want to extend it and get a generalized shtuka in GenSht d,≤p r,,λ over Spec A.

6.2.

Step 1: Extend a shtuka on the generic fiber.

6.2.1. Lattice and extension of vector bundles. Since X ⊗ A is a regular surface, the following result is well-known (see for example [17, §3, Proposition 6]): Proposition 6.2. The functor which to every vector bundle on X ⊗ A associates its restriction E on the generic fiber X ⊗ K and its fiber M on Spec A X , is an equivalence of categories between the category of vector bundles of rank r on X ⊗ A and that of pairs (E, M ) where i) E is a vector bundle of rank r on the generic curve X ⊗ K, ii) M is an A X -lattice in the generic fiber V of E, which is a vector space of dimension r over K A X .

The above functor admits a quasi-inverse functor denoted by (E, M ) → E(M ).

We denote by E M the induced vector bundle on the special fiber X ⊗ κ whose generic fiber is V M = M/πM . 6.2.2. Iterated lattices. Recall that E = (x, E, ϕ, L, l, u) be a shtuka in Sht d,≤p r,,λ over Spec K. Let V be the generic fiber of E 0 . It is a vector space of dimension r over the field K A X . Then the morphism ϕ appearing in E induces an isomorphism ϕ : V σ ∼ -→ V viewed as a semilinear map ϕ : V -→ V . We define V := V ⊗ K A X K A X and denote by ϕ the induced semilinear map ϕ : V -→ V . Then the map M → M ⊗ A X A X is a bijection between A X -lattices in V and A X -lattices in V . Definition 6.3. Let M be an A X -lattice in V which is stable by ϕ.

a) We say that M is a non-degenerated lattice (with respect to ϕ) if A X ϕ(M ) = M . Otherwise, we say that M is degenerated.

b) We say that M is an admissible lattice if the reduction map ϕ : M/πM -→ M/πM is not nilpotent. c) We say that M is an iterated lattice if there exist non-negative integers d 1 , d 2 , . . . , d r-1 such that, if for every 1 ≤ i ≤ r, we set u s = 1≤i<s π d i (s-i) -(q-1) ∧ s ϕ, 0 -→ E M 0,W -→ E M 0 -→ E M 0,W -→ 0.

6.3.2. Modified iterated lattices. We suppose further that M is an iterated lattice in V . Let W a subspace of V M and M = Mod W (M ). In general, this modified lattice M is not necessarily an iterated lattice. We now present an important class of subspaces of V M such that the corresponding modified lattice is always an iterated one. Letting W a subspace of V M , we say that W is very good if there exists i such that

V M i-1 W ⊂ V M i and the isomorphism v i : V M i-1 /V M i ∼ -→ V M i /V M i-1 induces an isomorphism W σ ∩ V M i-1
∼ -→ W/V M i-1 . Lemma 6.6. Let W be a very good subspace of V M . Then the modified lattice M := Mod W (M ) is an iterated lattice of V . 6.3.3. Defect and modification. For the rest of this section we are in the situation of Notation 6.5. Recall that the notion of defect for subbundles of E M 0 is given as in Definition 5.1. We define def p M := max

F {def p F}
where F runs through the set of subbundles of E M 0 . Observe that def p M ≥ 0 and def p M = 0 if and only if E M lies in GenSht d,≤p r,λ (κ). In [START_REF] Ngo Dac | On compactifications of stacks of shtukas[END_REF] we prove Proposition 6.7. There exists a unique subbundle F max of E M 0 such that def p F max is maximal.

Suppose that E M does not belong to GenSht d,≤p r,λ (κ), i.e., def p M > 0. Let W be the generic fiber of F max . It is a proper subspace of V M . Then we show that M := Mod W (M ) is still an iterated lattice of V . We will call E(M ) the modification of the generalized shtuka E(M ).

6.4.

Step 3: Show that the modified shtuka is less stable.

We can prove that the modified shtuka E(M ) is less stable than E(M ). More precisely, To conclude, we must show that after a finite number of modifications, the modified shtuka is strictly less stable. The idea of the proof is as follows. Suppose that this is not the case. Then Proposition 6.8 implies that the transformation Mod W can be repeated infinitely.

For every integer n ≥ 0, we define M (n) := Mod n W (M ). Denote by F (n) be the unique subbundle of E M (n) 0 of maximal p-defect. In particular, we have def p F (n) = def p M (n) = def p M > 0.

Further, the morphism E M (n)

0

-→ E M (n-1) 0 induces an isomorphism F (n) ∼ -→ F (n-1) for all n ≥ 1. Repeating the argument of [12, §2, Proposition 14] (see also [START_REF] Langton | Valuative criteria for families of vector bundles on algebraic varieties[END_REF]Lemma 2]), we see that there exists a subbundle F K of E 0 over the generic fiber X × K such that rk F K = rk F (n) and deg F K = deg F (n) . Thus we obtain ndeg E 0 F K -p(rk F K ) = def p F (n) = def p M > 0, which contradicts the fact that E belongs to Sht d,≤p r,λ (K).

  Théorème 12, page 1015]): Theorem 4.3. 1) There exists a unique open substack Sht ≤p r of Sht ≤p r whose trace in each stratum Sht r,r is Sht ≤p r,r .

Proposition 6 . 8 .-

 68 a) We keep the above notation. Then we always have an inequality def p M ≤ def p M. b) Suppose that def p M = def p M . Let F be the unique subbundle of E M 0 of maximal p-defect, then the morphism E M 0

  The interested reader can refer to[10, §1 and §2],[20, §2.3], and [24, Theorem 2.67] for different proofs of this proposition. These texts offer additional approaches to prove the proposition mentioned. Proposition 2.2. For any integer d ∈ Z, we denote by Bun d r the substack of Bun r classifying vector bundles of rank r and of degree d. Then the connected components of Bun r are exactly Bun d r (d ∈ Z).

	Proof. See for example [29, Lemma 2.2 and Appendix A.1] where a
	more general statement is proved.
	2.3. Harder-Narasimhan truncation.

then each u s induces a well-define map u s : ∧ s M -→ ∧ s M and the reduction u s : ∧ s V M -→ ∧ s V M satisfies u s = 0 and u s is not nilpotent.

We define the type r of the iterated lattice M the sequence of indices (r 1 , . . . , r k-1 ) such that 0 < r 1 < • • • < r k-1 < r and that, for every 1 ≤ i < k, r i ∈ r if and only if d r i ≥ 1. We put r 0 = 0 and r k = r.

Drinfeld showed that among the set of lattices in V which are stable by ϕ, there is a unique maximal one. Further, if a lattice is nondegenerated, then it is maximal. By [START_REF] Drinfeld | Cohomology of compactified manifolds of modules of F -sheaves of rank 2[END_REF] (see also [12, §2, Part a)]), after some finite extension of K, the new maximal lattice is admissible. Then we deduce that after some finite extension of K, there exists an iterated lattice in V (see [START_REF] Lafforgue | Une compactification des champs classifiant les chtoucas de Drinfeld[END_REF][START_REF] Concini | Complete symmetric varieties[END_REF]Proposition 4]). 6.2.3. Extension of shtukas. We observe (see [12, §2, Part b)]) that to extend a shtuka E over K to a generalized shtuka (resp. a shtuka) over A is equivalent to choose an iterated lattice M (resp. a non-degenerated lattice) of V . By the previous discussion there is at most one nondegenerated lattice. Thus we get Proposition 6.4. The stack Sht r,λ is separated. Notation 6.5. Let M be an iterated lattice of V . We will denote the corresponding generalized shtuka over A by E(M ) and its restriction to the special fiber X × κ by E M . We consider the generalized shtuka E(M ) over A and the generalized shtuka E M over the residue field κ. Then r is the type of E M , and we get i) a strictly decreasing filtration

iii) these filtrations are equipped with isomorphisms between successive quotients v i :

Step 2: Find a modification of a generalized shtuka. 6.3.1. Modified lattices. Let M be a lattice of V and W a subspace of V M . Following Langton [START_REF] Langton | Valuative criteria for families of vector bundles on algebraic varieties[END_REF] we define the new lattice M of V by

and we write M = Mod W (M ). We denote by W the subspace of V M given by W = ker(V M -→ W ). Then we have two short exact sequences (see [17, §4]):


Shivam Bhasin

Jean-Luc Danger

Florent Flament

Tarik Graba

Sylvain Guilley

Yves Mathieu

Maxime Nassar

Laurent Sauvage

Nidhal Selmane

Combined SCA and DFA Countermeasures Integrable in a FPGA Design Flow

Keywords: Side-Channel Analysis (SCA), Differential Power Analysis (DPA), Dual-rail with Precharge Logic (DPL), Early Evaluation (EE), Differential Fault Analysis (DFA), Wave Dynamic Differential Logic

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

I. INTRODUCTION

Embedded systems that contain cryptographic modules are becoming commonplace with the generalization of privacy, authentication and integrity in digital communications. The cryptographic hardware is very resource consuming because it relies on complex operations needed to prevent illegitimate users from spying, impersonating or altering the communications. Therefore, many studies focus on the optimization of cryptographic blocks. In parallel, new threats -not of cryptanalytic nature -have shown up: it has been suggested and demonstrated that an attacker can break the logical security conveyed by the cryptography by merely observing or perturbing it on the physical layer. The common point between those two exaction strategies is their aim to defeat the security by retrieving some secret elements (such as keys) from which the security features stem.

On the one hand, observation attacks are also known as sidechannel attacks (SCAs [START_REF] Kocher | Differential Power Analysis[END_REF]), in that they exploit a physical leakage of the device to gain information about its internal secrets. On the other hand, perturbation attacks consist in altering the state of the device so as to retrieve faulted outputs, that together with nominal outputs, can disclose or negate relationships within the secret bits normally concealed into the hardware; these attacks are referred to as differential fault analyses (DFAs [START_REF] Biham | Differential Fault Analysis of Secret Key Cryptosystems[END_REF], [START_REF] Piret | A Differential Fault Attack Technique against SPN Structures, with Application to the AES and KHAZAD[END_REF]). The main strength of SCAs is their furtivity. As they are virtually impossible to detect, an adequate countermeasure must be vigilant each time the cryptographic engine is in use. On the contrary, the first prerequisite for a DFA to be successful is to actually modify the device's state. A detection strategy can thus be enforced to check for the device operations' integrity. However, the careful check of all components of an embedded system is very fastidious and error-prone. In addition, even if any sensitive data is carefully monitored for integrity, the faults coverage remains an issue. Indeed, if detecting one single error (of unitary bit entropy) is easy using simple parity codes, the detection of multiple errors is more difficult to address. In general, the detection logic complexity is exponential with the faults multiplicity, which quickly becomes deterrent in practical applications.

One device can be claimed tamper-resistant only if it is protected, at least to some extent, against both SCA and DFA simultaneously. It must be noticed that the efforts to deploy in protection depends on the threat. To be successful, the best attacks known so far require to garner some thousands1 of side-channel traces recording (SCAs) [START_REF] Kocher | Differential Power Analysis[END_REF] but only a couple of faults (DFAs) [START_REF] Biham | Differential Fault Analysis of Secret Key Cryptosystems[END_REF], [START_REF] Piret | A Differential Fault Attack Technique against SPN Structures, with Application to the AES and KHAZAD[END_REF] from an unprotected device. As a consequence, the need for protection is more stringent against DFA than it is against SCA. This asymmetry is one reason for which the countermeasures against DFA and SCA are nowadays studied separately: this partitioning makes it possible for a designer team to tune the countermeasure efficiency according of the threat urgency, while keeping the flexibility to combine them at the final stage of integration. Another reason why countermeasures against DFA and SCA are considered independently is linked with our state-of-art in defense. The protection against DFA is naturally achieved at an algorithmic level, with the introduction of redundancy in data representation and processing. However, the effective protection against SCA is more subtle, since it requires the removal for any source of leakage through physical sidechannels. Therefore, the widespread methodology consists in using dedicated logic gates along with ad hoc backend steps. As we know how to resist against DFA before the logic synthesis and to resist against DPA after synthesis, it is implicitly considered obvious that the protection against DFA and DPA should be built one on top of each other.

In this article, we advocate that this methodology is neither natural nor efficient. Basically, we show that a class of strong countermeasures against SCA, namely all variants of dualrail with precharge logic (DPL) styles which do not suffer from early evaluation (EE), are already protected against the state-of-the-art fault injection techniques. Thus, by subsuming the individual issues of securization against SCA and DFA into a unique problem, we arrive to an original solution that is economic in resources because of its duality w.r.t. both the SCA and the DFA threats. In addition, we show that the countermeasure is all the more efficient as the faults multiplicity is high, which is a property out of reach of traditional protections based on coding theory. Some previous works have already attempted to provide joint countermeasures against SCA and DFA, but thanks to specific features of FPGAs. For instance, the two papers [START_REF] Chaudhuri | FASE: An Open Run-Time Reconfigurable FPGA Architecture for Tamper-Resistant and Secure Embedded Systems[END_REF], [START_REF] Mentens | Power and Fault Analysis Resistance in Hardware through Dynamic Reconfiguration[END_REF] show how to resist SCA and DFA when dynamic partial reconfiguration is available. In our article, we achieve the same result even on low-cost FPGAs that cannot be reconfigured at run-time.

The rest of the article is organized as follows. Section II presents the DPL protection against SCA, and motivates for the preference of DPL without EE. In section III, the protection potential of DPL (w/ or w/o EE) against DFA is explained. The section IV presents a methodology for mapping this protection into FPGAs, and details its performances in terms of resources usage. Finally, conclusions are discussed in section V.

II. DUAL-RAIL WITH PRECHARGE LOGIC STYLES

AGAINST SCAS The goal of a protection against SCAs is to prevent any attacker from the retrieving any information from any internal bit. Various solutions have been proposed to address this requirement. Side-channel masking consists in making the activity of sensitive bits random by rewritting the algorithm in such a way that those variables depend on a external entropy source. Side-channel hiding adds redundant logic so as to end up with a constant activity when sensitive bits are manipulated. Each solution has its own pros and cons; some logic styles, based on "masked DPL gates", even mix the two for an improved security. Still, the comparison between these securization options is beyond the scope of this article.

In this article, we focus on the hiding styles. Indeed, as will be made clear in Sec. III, those styles combine harmoniously with DFA protection, whereas masking styles do not, as demonstrated in [START_REF] Boscher | Masking Does Not Protect Against Differential Fault Attacks[END_REF]. Information hiding at the bit level can be achieved by a large variety of ad hoc encodings and protocols. However, the most convenient ones rely on a so-called dualrail with precharge representation. Every bit a involved in the algorithm is actually mapped into a couple of wires, named (a F , a T ), and called the 'false' and 'true' halves of the dual-rail variable a. The couple (a T , a F ) alternates between two values: 1) (0, 0) or (1, 1), called NULL0 or NULL1, and designated as a NULL token, playing the role of spacer, and 2) (1, 0) or (0, 1), called VALID0 or VALID1, and designated as a VALID token, carrying the value of a.

One DPL computation alternates NULL and VALID tokens, with the remarkable property that exactly one bit toggle occurs in each transition. A pair of gates (f F , f T ) respects the DPL convention if:

• It propagates the NULL values, i.e., if all the inputs are NULL, then (f F , f T ) is also NULL.

• It propagates the VALID values, i.e., if all the inputs are VALID, then (f F , f T ) is also VALID.

Wave dynamic differential logic (WDDL [START_REF] Tiri | A Logic Level Design Methodology for a Secure DPA Resistant ASIC or FPGA Implementation[END_REF]) has been the first logic style to implement these conditions. WDDL has the nice property to be separable, meaning that f F (resp. f T ) depends only on the false (resp. the true) inputs half. However, some other properties have been added afterwards to ensure a secure operation of WDDL. First of all, it has been noticed that on the way from all NULL to all VALID values, glitches could occur if the functions (f F , f T ) were not positive [START_REF] Guilley | Evaluation of Power-Constant Dual-Rail Logic as a Protection of Cryptographic Applications in FPGAs[END_REF]. Afterwards, many authors notice concomitantly that the evaluation time depends on the inputs values [START_REF] Kulikowski | Power Attacks on Secure Hardware Based on Early Propagation of Data[END_REF], [START_REF] Saeki | Security Evaluations of MRSL and DRSL Considering Signal Delays[END_REF]. An up-to-date list of known DPLs styles used for side-channel information hiding countermeasure is given in Tab. I. The salient features of these logic styles are briefly described below:

• WDDL is the less complex DPL style because it is separable, which makes it possible to reduce the overhead of each dual network.

• MDPL adds some logic on top of WDDL to swap randomly the logic interconnect pairs, in a view to balance the routing mismatches. Indeed, this problem is not addressed directly by WDDL but is left to the layouter [START_REF] Tiri | Place and Route for Secure Standard Cell Design[END_REF], [START_REF] Guilley | The "Backend Duplication" Method[END_REF].

• iMDPL fixes the leakage conveyed by data-dependant evaluation and precharge dates in WDDL and MDPL.

• DRSL combines masking and early evaluation protection, and is optimized to be compact using one standard ASIC cell (OAI222) and all RSL [START_REF] Suzuki | Random Switching Logic: A Countermeasure against DPA based on Transition Probability[END_REF], [START_REF]Random Switching Logic: A New Countermeasure against DPA and Second-Order DPA at the Logic Level[END_REF] gates.

• STTL is a non-masked improvement of WDDL style free of early evaluation. STTL is however not balanced in structure, as WDDL, and is limited in speed by the slow validation path, by design longer than the path of the data signal pairs. This limitation seriously impedes the throughput of STTL. Eventually, we underline that STTL requires the routing of three wires per logical signal.

• SecLib is non-masked computation style that fixes the EE issue and features a balanced structure. To be exhaustive, we should also mention the NCL (Null Convention Logic) that is a generalization of SecLib albeit deprived from any balance effort.

• WDDL w/o EE is a logic style dedicated to FPGA that removes the EE without computing a rendezvous. Instead, each functional half gate receives the true and false inputs, and decides to output the VALID value only when all the inputs are VALID. This behavior can be achieved by a purely combinatorial gate, as depicted in Tab. II. The detailed rationale behind the "WDDL w/o EE" style is the following:

-The gate outputs NULL{0,1} when the inputs are NULL{0,1} or transitional from this value. -The gate outputs VALID only when all the inputs are VALID. -In case of inconsistent values w.r.t. the DPL convention, the gate outputs an arbitrary NULL value. This logic does not evaluate early by design, and propagates errors: if any input is stuck to NULL or if the input is out of specifications, then the output always remains to NULL too. In addition, this logic does not generate glitches even if the functionality is not positive, and can be inverting. Therefore, the synthesis is more optimized than for plain WDDL.

III. POTENTIAL OF DPL W/O EE FOR PROTECTION AGAINST DFAS

A. Fault Model

We assume in the sequel that multiple faults can be generated locally (by means of a laser or an electromagnetic injection [START_REF] Quisquater | Radio frequency attacks[END_REF]), but decorrelated one from each other.

B. Early Evaluation Prevention and Faults Transformations

This article is based on [START_REF] Selmane | WDDL is Protected Against Setup Time Violation Attacks[END_REF], that has already shown that WDDL is immune against multiple asymmetric faults such as those caused by setup violations. Basically, the idea is that asymmetric faults turn a VALID token into a NULL one. The NULL token can propagate until the outputs, being even amplified. However, the NULL wave propagation acts as an eraser, which means that the outputs have eventually lost any information about the faulted values. A parallel is done in [START_REF] Selmane | WDDL is Protected Against Setup Time Violation Attacks[END_REF]

0 1 1 1 1 1 Transitional from NULL1 1 0 0 0 0 C 0 A Transitional from NULL0 1 0 0 1 0 1 All VALID: (a, b) = (1, 0) 1 0 1 0 1 0 All VALID: (a, b) = (1, 1) 1 0 1 1 1 1 Transitional from NULL1 1 1 0 0 1 F 1 F Faulty 1 1 0 1 1 1 Transitional from NULL1 1 1 1 0 1 1 Transitional from NULL1 1 1 1 1 1 1 All NULL1
between asymmetrical faults and the logical propagation of 'U' value in the 9-valued type std_ulogic of VHDL (IEEE standard number 1076). We add in this paper that all dual-rail with precharge logics (DPLs) are actually protected against setup violation attacks. Indeed, they never disclose the faulty result in the presence of a setup violation. Instead, they have two different kinds of behavior:

1) WDDL and MDPL compute results given the inputs, and propagate NULL spacers for the outputs whose values are non decidable. This is the logic behavior of 'U' in VHDL. One could say that faults in these logics are recessive w.r.t. VALID values. 2) iMDPL, DRSL, STTL, SecLib and WDDL w/o EE propagate the NULL on the fault fanout, even if a VALID value could have been deduced. This is the logic behavior of 'X' in VHDL. Along with the former phenotypic metaphor, faults in this second class of logics are dominant, or rather contaminating, as their propagation is indeed an unexpected avalanche effect.

The implication is that DPL in itself does not provide a good protection against symmetrical faults. As a matter of fact, it can filter out a NULL (see Fig. 1(a)) and generate a faulted VALID from NULL tokens (see Fig. 1(b)). In contrast, the DPL styles that are EE-free propagate the NULL unconditionally; this feature is even part and parcel of the WDDL w/o EE specification. Additionally, the NULL (behaving like an 'X') always absorbs other VALID faults, as shown in Tab. 2.

C. Propagation of NULL Values Through Substitution Boxes

The fault propagation in logics with EE is exploding in substitution boxes (sboxes). The average number of NULL tokens at the output of various sboxes when one or several NULL tokens of the same type (either NULL0 or NULL1) are at the input has been computed in Tab. III for any logic style subject to EE, such as WDDL or MDPL.

In DPL w/o EE, the propagation is also independent on the implementation. It is also more straightforward as it does not depend on the data: the propagation through a gate occurs iff the output depends on the given input. This is case of all nontrivial gates. Notably, any fault, even single, on the input of an sbox, corrupts the entire sbox output: the propagation is maximal.

D. Analysis of the DFA Protection of the Proposed Logic

Single bit faults are inefficient against DPL because they turn a VALID data into a NULL token, that propagates and leads to an unexploitable error since it hides the faulted value. This is the typical scenario described in paper [START_REF] Selmane | WDDL is Protected Against Setup Time Violation Attacks[END_REF]. Highly multiple faults generate randomly a large quantity of NULL values along with some more unlikely but devastating bit-flips. However, as NULL values are systematically propagated, they proliferate very quickly after some combinatorial logic layers traversal. And as they have the nice property to contaminate VALID values, the risky coherent bit-flips (simultaneous 0 * → 1 and 1 * → 0 one dual-rail couple), they jam their propagation hopefully before they reach the algorithm output. This absorption property is all the more efficient as the number of NULL generated by the multiple faults is high. Therefore, the only way to inject a poisonous fault is to stress the circuit sufficiently enough to have multiple faults, without nonetheless creating too many faults so as to leave a chance for them not to be absorbed during their percolation towards the outputs. But, hopefully, in this opportunity window of low stress (generation of 2, 3, or maximum 4 errors because of the high diffusion of cryptographic algorithms), efficient coding schemes can be used in supplement to the DPL w/o EE protection.

To be more accurate, we present a simple model that provides a convincing proof of our assertion. Let us consider a dual-rail circuit that is attacked with a perturbation that focalized on 2n wires, and that has an intensity sufficient enough to cause m ≤ 2n simultaneous faults. We also make the optimistic hypothesis that the m faults are equidistributed over the 2n wires, and that the flips are truly symmetrical, i.e. it is as likely to flip to a 0 and to a 1. Those conditions modelize a worst case from the defense view point, because they foster coherent bit-flips susceptible to turn a VALID value into a VALID * one, by the mean of two antinomic flips on two wires pertaining to the same dual-rail couple. To further simplify the modelization, we also assume that the attacked block has a perfect diffusion: in practice, this is not exactly true for one round of an algorithm, but for at least two of them (and exactly two in the case of AES). Nevertheless, it helps us grasp more intuitively the idea of the proof without introducing overcomplicated considerations. Therefore, for a fault to successfully propagate through the round, no single NULL shall be generated. Otherwise, the NULL wave catches the fault, because of the perfect diffusion, as already depicted in Fig. 2. The first constatation is that for VALID faults to be generated, m must be even. Indeed, they are generated by pairs. If, on the contrary, m is odd, then at least one NULL (bit-flip of one wire in a pair) is generated, leading to the VALID fault absorption. Then, a VALID fault is generated iff, given a unique fault, a second one occurs in the paired wire. For m = 2 faults, this happens with probability 1/(2n -1). For more faults, the generation of solely paired faults consists in always pairing the remaining faults. Then, the probability to generate at least one VALID fault that survives until the output is equal to:

p(2n, m) . =    n m/2 2n m if m is even, 0 otherwise.
This probability becomes very small starting from a multiplicity of 4 when m increases up to n 2 . This is to be contrasted with schemes involving a coding with error detection. They are basically able to detect:

• all the faults of multiplicity smaller than the error detection capability r 3 , but

• only a ratio of 1 -1/2 r faults for m > r. The figure 3 compares the rate of successful faults injection depending on the multiplicity, for an n = 8 set of wires, respectively for the proposed scheme based on DPL w/o EE and for a classical integrity check with a linear code detecting r = 2 bits of error.

The authors would like to insist that this is the first time that a countermeasure against DFA proves efficient even in the context of a large number of faults. As a matter of fact, usual schemes, based on spatio-temporal or coding, can be defeated with high probability if the number of faults is greater than the detection capacity. Smartly enough, the implementations using DPL w/o EE take advantage of three properties that all contribute to destroy the VALID faults:

1) faults are very likely to alter only one wire in a pair, especially if the stress is badly localized, thus creating much more NULL tokens than wrong VALID pairs, 2) because of the protection against EE, NULL values win against VALID ones, hereby hiding in particular VALID fault propagation, 2 When m is too large, starting from n, the probability increases, because of the property: p(2n, m) = p(2n, 2n -m).

3 Faults of multiplicity m ≤ r mutate a code word into a non-code word. 3) as the algorithms implement cryptography, they have a high diffusion, which helps the NULL values meet (and thus eat) the possibly faulted VALID values still alive.

IV. CAD FLOW FOR THE PROPOSED COUNTER-MEASURE As every digital system, cryptographic coprocessors can be separated into control and datapath. The datapath contains the secret key related operations. Thus to assure security of the design it is sufficient to secure the datapath only. A design flow to implement a cryptographic coprocessor on an FPGA is shown in Fig. 4. Since DPL designs are redundant by nature, we have to use customised tool for processing. The goal of this synthesis is to remove the unnecessary logic redundancy while keeping the redundancy needed for DPL style. This cannot be achieved by a standard design flow. An ASIC synthesizer is used to synthesize the design with a library containing only those gates which respect the DPL style constraints. Then the output netlist is processed using a custom tool which converts a single-rail netlist into a DPL netlist. The controller is then connected to the datapath using a wrapper. Thereafter, a legacy FPGA vendor tool does synthesis, mapping, placing & routing for the whole design on the FPGA. Although the design flow is shown for Altera FPGAs, it has also been tested apt for Xilinx FPGAs.

As stated earlier, to secure a design against SCA and DFA we can use a DPL style which is free from EE. WDDL is a DPL style most suited for FPGA designs but it is prone to EE. In [START_REF] Selmane | WDDL is Protected Against Setup Time Violation Attacks[END_REF], authors implement a WDDL design in FPGAs using a library containing four-input functions which are positive in nature. We use the same methodology in this paper. To make WDDL protected against EE, we limit the library to two-input gates, implemented as per Tab. II.

We have applied these syntheses on an AES [START_REF]Advanced Encryption Standard (AES)[END_REF] datapath in the Stratix family of Altera. More precisely, we used an EP1S25B672C7 device. The table IV summarizes the area of an unprotected datapath, the same datapath protected with an EE-prone logic (namely WDDL) and with an EEfree logic (namely WDDL w/o EE). Both protected designs are embedded in EveSoC [START_REF]EveSoC, a side-channel eavesdropping system-on-chip[END_REF], and run at similar maximal frequency (27.24 vs 27.36 MHz).

The implementation size of the "WDDL w/o EE" style is only slightly greater than that of the original "WDDL",

V. CONCLUSION

This paper shows that, in addition to increasing the resistance against SCAs, the DPL styles also help resist against DFAs. Indeed, single faults consist in turning a VALID token into a NULL one, which conceals the value of the (sensible) data before corruption. The DPL styles that protect against the EE side-channel analysis ensure in addition that the NULL propagation contaminates all the data it crosses in the combinatorial logic cones. Thus, in the case of multiple faults, both VALID faults and NULL tokens are generated, but the NULL tokens destroy the VALID faults prior they arrive at the algorithms inputs. Therefore, we show for the first time that a SCA counter-measure is, as such, already an excellent counter-measure against DFA.

We also introduce WDDL w/o EE, a simple logic style that enhances the plain WDDL style by making it EE-free and having it avoid non-VALID inputs propagation. In addition, the synthesis of WDDL w/o EE is efficient because even noninverting and non-positive functions are allowed. We provide a mapping of this new logic into LuT4-based FPGAs.

  (a, b) = (0, 1)

Figure 1 .Figure 2 .

 12 Figure 1. Two DPL w/ EE drawbacks to fight DFAs, illustrated on the example of a WDDL AND gate. In this figure and in the subsequent ones, the asterisk character (*) symbolizes the faults. VALID * → VALID *

Figure 3 .

 3 Figure 3. Probability that m faults injected on n wires be innocuous due to the protection conveyed by two different countermeasures: either a detection by an informational redundancy scheme or an annihilation of the faulted data by one or several VALID * → NULL token transformations.

Figure 4 .

 4 Figure 4. Design-flow for proposed counter-measure.

Table II LOOK

 II -UP-TABLE (LUT) MASKS ENCODING FOR 4-INPUT LUTS IMPLEMENTING THE AND FUNCTION IN WDDL W/O EARLY EVALUATION.

Table III NUMBER

 III OF NULL TOKENS PROPAGATED ON AVERAGE THROUGH THE SBOXES OF AES (8 → 8) AND DES (6 → 4) IN DPL WITH EE.

	Fault	AES Sbox	DES Sboxes
	multiplicity (SubBytes) #1 #2 #3 #4 #5 #6 #7 #8
	0	0.00	0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
	1	4.04	2.48 2.53 2.65 2.46 2.53 2.60 2.63 2.50
	2	7.04	3.88 3.90 3.92 3.93 3.91 3.93 3.93 3.91
	3	7.94	4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00
	4	8.00	4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00
	5	8.00	4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00
	6	8.00	4.00 4.00 4.00 4.00 4.00 4.00 4.00 4.00
	7	8.00

N.A. N.A. N.A. N.A. N.A. N.A. N.A. N.A. 8 8.00 N.A. N.A. N.A. N.A. N.A. N.A. N.A. N.A.

Table IV AREA

 IV OF AN AES DATAPATH SYNTHESIZED FOR THE STRATIX FPGA. it is at the same time more secure against SCAs and completely secure against any type of DFAs. The reason why WDDL w/o EE is only 13% larger than WDDL w/ EE is that AES is comprised of many XOR gates, that require the same number of LuTs in WDDL w/o & w/ EE. Finally, we emphasize that the traditional way of protecting a WDDL circuit against faults would have been to use some sort of redundancy (for instance with detection codes), that would for sure represent an overhead in area similar or greater than 13%. This definitely demonstrates that protecting at backend-level (against SCA) a logical detection mechanism (against DFA) is not as efficient in terms of surface as the sole usage of a DPL w/o EE style for both SCA and DFA resistance.

	Logic style	Reference	WDDL w/ EE	WDDL w/o EE
	LuT4 count	2,396	12,530	14,126

however

And sometimes only a few hundreds can be enough, as exemplified in the DPA contest[START_REF]DPA Contest[END_REF].