text:
Vladimir Harkonnen

Baron Vladimir Harkonnen is a fictional character in the Dune franchise created by Frank Herbert. He is primarily featured in the 1965 novel Dune and is also a prominent character in the Prelude to Dune prequel trilogy (1999–2001) by Herbert's son Brian and Kevin J. Anderson. The character is brought back as a ghola in the Herbert/Anderson sequels which conclude the original series, Hunters of Dune (2006) and Sandworms of Dune (2007).

Baron Harkonnen is portrayed by Kenneth McMillan in David Lynch's 1984 film Dune. Ian McNeice plays the role in the 2000 Sci-Fi Channel miniseries Frank Herbert's Dune and its sequel, 2003's Children of Dune. Harkonnen is portrayed by Stellan Skarsgård in the 2021 Denis Villeneuve film Dune and its 2024 sequel Dune: Part Two.

Conception
Frank Herbert wanted a harsh-sounding name for the antagonistic family opposing House Atreides in Dune. He came across the name "Härkönen" in a California telephone book and thought that it sounded "Soviet", though it is in fact Finnish. In earlier drafts of Dune, the character was called "Valdemar Hoskanner".

Description
Herbert's "Appendix IV: The Almanak en-Ashraf (Selected Excerpts of the Noble Houses)" in Dune says of Harkonnen (in part): "VLADIMIR HARKONNEN (10,110–10,193) Commonly referred to as Baron Harkonnen, his title is officially Siridar (planetary governor) Baron. Vladimir Harkonnen is the direct-line male descendant of the Bashar Abulurd Harkonnen who was banished for cowardice after the Battle of Corrin. The return of House Harkonnen to power generally is ascribed to adroit manipulation of the whale fur market and later consolidation with melange wealth from Arrakis."

The character is usually described as the main antagonist of the novel. Herbert writes in Dune that the Baron possesses a "basso voice" and is so "grossly and immensely fat" that he requires anti-gravity devices known as suspensors to support his weight. He is one of the wealthiest members of the Landsraad and a bitter rival of Leto Atreides, and the Baron's "legendary evil and intellect" are unmatched by anyone else from House Harkonnen. In the novel, the Baron feigns outrage over losing control of Arrakis to Leto, but is actually conspiring to use the situation as an opportunity to destroy House Atreides once and for all.

William Hughes of The A.V. Club describes the Baron as "a decadent, monstrous gasbag of depravity and evil". As ruthless and cruel as he is intelligent and cunning, the Baron is "crafty and power-hungry" and has a talent for manipulating others and exploiting their weaknesses as well as a propensity for torture and blackmail. IGN describes the character as "cruel, sadistic, and hedonistic". Travis Johnson of Flicks.com.au says that Harkonnen is written as "a predatory homosexual given to pederasty and incest, an unrepentant rapist and murderer." The Baron's sexual preference for young men is implied in Dune and Children of Dune. It is noted, however, that he "once permitted himself to be seduced" by a Bene Gesserit in the liaison which produced his secret daughter.

Dune
As Dune begins, a longstanding feud exists between the Harkonnens of Giedi Prime and the Atreides of Caladan. The Baron's intent to exterminate the Atreides line seems close to fruition, as Duke Leto Atreides is lured to the desert planet Arrakis on the pretense of taking over the valuable melange operation there. The Baron has an agent in the Atreides household: Leto's own physician, the trusted Suk doctor Wellington Yueh. Though Suk Imperial Conditioning supposedly makes the subject incapable of inflicting harm, the Baron's twisted Mentat Piter De Vries has managed to break it using the threat of interminable torture on Yueh's captive wife Wanna.

Harkonnen also distracts Leto's Mentat Thufir Hawat from discovering Yueh by guiding Hawat toward another suspect: Leto's Bene Gesserit concubine Lady Jessica, of whom Hawat is already distrustful. The Atreides are soon attacked by Harkonnen forces, secretly supplemented by the seemingly unstoppable Imperial Sardaukar, as Yueh disables the protective shields around the Atreides palace on Arrakis. Yueh takes Leto prisoner as instructed, but provides him with a fake tooth filled with poisonous gas as a means to assassinate the Baron. De Vries kills Yueh, Leto and De Vries die from the gas, but Harkonnen survives. The Baron then manipulates Hawat into his service, by convincing Hawat that Jessica was the traitor and using Hawat's desire for revenge on her and the Emperor as motivation to assist House Harkonnen.

Jessica flees into the desert with her and Leto's son Paul Atreides, and both are presumed dead. Paul's prescience helps him determine the identity of Jessica's father, the "maternal grandfather who cannot be named"—the Baron himself. Over the next two years, Harkonnen learns that his nephews Glossu Rabban and Feyd-Rautha are conspiring against him to usurp his throne. He lets them continue to do so, reasoning that they have to somehow learn to organize a conspiracy. As punishment for a failed assassination attempt against him, Harkonnen forces Feyd to single-handedly slaughter all the female slaves who serve as Feyd's lovers. He explains that Feyd has to learn the price of failure.

The Baron's plan to assure Feyd's power is to install him as ruler of Arrakis after a period of tyrannical misrule by Rabban, making Feyd appear to be the savior of the people. However, a crisis on Arrakis begins when the mysterious Muad'Dib emerges as a leader of the native Fremen tribes, uniting them against the rule of the Harkonnens. Eventually, a series of Fremen victories against Beast Rabban threaten to disrupt the trade of the spice, inciting the Padishah Emperor Shaddam IV to intervene personally, leading several legions of Sardaukar. After the emperor's arrival on Arrakis, both Corrino and Harkonnen are shocked to learn that rather than a native Fremen warlord, their opponent Muad'Dib is the still-living Paul Atreides, and the Emperor's intervention was part of his plan.

The Imperial forces fall prey to a surprise attack by the Fremen, who let a sandstorm short out the force field shields of the transport ships, and then disable them with projectile weapons, subsequently mounting a mass assault using sandworms as siege-breakers. Their enemies are left trapped on the planet, outnumbered by the many tribes and outgunned by the sandworms. The Harkonnens' past ruthlessness further causes the enraged Fremen to give them little to no quarter. Over the course of the battle their entire army is exterminated.

The Harkonnen leadership are also all killed in the course of this battle. Rabban dies first, in the early stages of the battle. Baron Harkonnen himself is poisoned with a gom jabbar by Paul's sister Alia Atreides, a two-year-old born as a fully aware Fremen Reverend Mother, who reveals that she is his granddaughter to him just before his death. His remaining heir Feyd-Rautha is killed in ritual combat by Paul Atreides. House Harkonnen as a political entity is left virtually defunct - permanently excluded from galactic power - though Harkonnen blood is technically ascendant since Imperial House Atreides is composed entirely of Vladimir Harkonnen's descendants.

Children of Dune
Alia had been born with her ancestral memories in the womb, a circumstance the Bene Gesserit refer to as Abomination, because in their experience it is inevitable that the individual will become possessed by the personality of one of their ancestors. In Children of Dune, Alia falls victim to this prediction when she shares control of her body with the ego-memory of the Baron Harkonnen, and eventually falls under his power. Alia eventually commits suicide, realizing that Harkonnen's consciousness has surpassed her abilities to contain him.

Prelude to Dune
In the Prelude to Dune prequel series by Brian Herbert and Anderson, it is established that Baron Vladimir Harkonnen is the son and heir of Dmitri Harkonnen and his wife Victoria. Harkonnen's father had been the head of House Harkonnen and ruled the planet Giedi Prime. Trained since youth as a possible successor, Vladimir had been eventually chosen over his half-brother Abulurd, namesake of the original. Unhappy with his brother's doings, Abulurd eventually marries Emmi Rabban and renounces the family name and his rights to the title.

Under the name Abulurd Rabban, he reigns as governor of the secondary Harkonnen planet Lankiveil. Abulurd and his wife have two sons: Glossu Rabban, later nicknamed "Beast Rabban" after he murders his own father, and Feyd-Rautha. Vladimir later adopts the boys back into House Harkonnen, and Feyd becomes his designated heir. The Baron's most prominent political rival is Duke Leto Atreides. The Harkonnens and the Atreides have been bitter enemies for millennia, since the Battle of Corrin that ended the Butlerian Jihad. When Emperor Shaddam IV orchestrates a plot to destroy the "Red Duke" Leto, the Baron eagerly lends his aid.

The young Baron Vladimir Harkonnen is described as an exceedingly handsome man, possessing red hair and a near-perfect physique. The Bene Gesserit Reverend Mother Gaius Helen Mohiam is instructed by the Sisterhood to collect his genetic material, through conception, for their breeding program. As the Baron's homosexuality is something of an open secret, Mohiam blackmails him into having sexual relations with her, and conceives his child. When that daughter proves genetically undesirable, Mohiam kills her and returns to Harkonnen for a second try. At this point, he drugs and viciously rapes her. She exacts her retribution by infecting him with a rare, incurable disease that later causes his obesity. Mohiam's second child with the Baron is Jessica.

In Dune: House Harkonnen, the deteriorating Baron at first walks with the assistance of a cane, then relies on belt-mounted suspensors to retain mobility. He consults numerous doctors in the expanse of time between the Dune: House Atreides and Dune: House Harkonnen, up to and including his future instrument Dr. Yueh, all of whom are ultimately no help. To conceal this debilitation, he pretends that his obesity is due to intentional overindulgence, lest the Landsraad remove him from power. When he determines that Mohiam inflicted him with the disease, he attempts to coerce her into revealing the cure, but soon discovers that there is none. The Baron, Duke Leto, and Jessica are unaware that Jessica is secretly the Baron's daughter, or that he has even fathered one. In the year 10,176, the Baron's grandson Paul is born to Leto and Jessica.

Hunters of Dune
In Hunters of Dune (2006), the continuation of the original series by Brian Herbert and Kevin J. Anderson, the Baron is resurrected as a ghola (5,029 years after the death of Alia) by the Lost Tleilaxu Uxtal, acting on orders from the Face Dancer Khrone. Khrone intends to use the Baron ghola to manipulate a ghola of Paul Atreides, named Paolo. Khrone tries various torture techniques for three years to awaken the 12-year-old Baron's genetic memories; these methods fail due to the Baron's sadomasochistic nature. Khrone is successful when he imprisons the Baron in a sensory deprivation tank for a prolonged period; the Baron's memories of his former life return. The reincarnated Baron is soon haunted by the voice of Alia in his mind; the source of this inner Alia is never explained.

Cancelled 1970s film

In 1975, Orson Welles agreed to play the Baron in Alejandro Jodorowsky's ultimately unsuccessful adaptation. The film's concept art by Jean "Moebius" Giraud depicts the Baron, as well as Feyd-Rautha and Rabban, in multiple drag appearances. In the documentary Jodorowsky's Dune, the director discussed the casting:

"Orson Welles had a bad reputation ... they said that he liked to drink and eat ... and then he did not finish the movies, he was moody. But I said, 'No, Orson Welles is a genius, he is the one.' ... Therefore, I sent a secretary to ask... in all the gastronomic restaurants in Paris: 'Where does Orson Welles eat?' And we discover a restaurant and then he was eating ... I speak with all the respect, because was for me [he] was an idol. He say, 'I don't want to do it. I don't want any more.' I say to him, 'I will propose something.' If you do the picture, even if we pay what you want as an actor, I will hire the chef of this restaurant and you will eat, as here, every day. And he say, 'I do it.'"

1984 film
Baron Harkonnen is portrayed by Kenneth McMillan in David Lynch's 1984 film. The obese and disheveled Baron is overtly unstable, and covered in oozing pustules. William Hughes of The A.V. Club deemed McMillan's facial prosthetics "very memorable". Emmet Asher-Perrin of Tor.com wrote that "Lynch's attempt is infamous for really leaning on [the] codified aspects of the Baron, to the point where his sore-ridden appearance has been called out as a likely connection to the AIDS epidemic, which was a prevalent health crisis while the film was in production." Travis Johnson of Flicks.com.au noted that the Lynch film embraced "the archetype of the depraved gay sadist", which would not be acceptable in 2019. Asher-Perrin added, "Lynch also makes a point of connecting the Baron's desire for men to deviancy and violence, deliberately juxtaposing his assault of a young man with a tender love-scene between Duke Leto and Lady Jessica Atreides."

2000 miniseries
Ian McNeice plays the Baron in the 2000 Sci-Fi Channel miniseries Frank Herbert's Dune, and its sequel, 2003's Children of Dune. Asher-Perrin notes that the miniseries played down the negative aspects emphasized by the Lynch film, and writes, "[The Baron's] appearance was not altered to make him seem ill, he never physically attacks anyone, and the miniseries paid more attention to the fact that the Baron was a rapist, his preference for men being incidental." He praises McNeice as a standout among the cast, writing that he "manages to make the Baron Harkonnen—easily one of the most despicable characters in science fiction literature—every bit as conniving and vicious as he needs to be...and every bit as fascinating. McNeice has a superb sense of how to make the baron mesmerizing to watch no matter how odiously he behaves". Austin Jones of Paste writes, "McNeice commands his role as Baron Harkonnen, capturing the vile indulgence and vanity of a feudal lord".

2021 and 2024 films
Baron Harkonnen is portrayed by Stellan Skarsgård in the 2021 Denis Villeneuve film Dune and its 2024 sequel Dune: Part Two. Skarsgård called the role "small but important", and noted, "I had seven hours in make-up every day because I had to be really fat." Villeneuve said: "As much as I deeply love the book, I felt that the baron was flirting very often with caricature. And I tried to bring him a bit more dimension. That's why I brought in Stellan. Stellan has something in the eyes. You feel that there's someone thinking, thinking, thinking—that has tension and is calculating inside, deep in the eyes. I can testify, it can be quite frightening."

Merchandising and influence
A line of Dune action figures from toy company LJN was released to lackluster sales in 1984. Styled after David Lynch's film, the collection featured a figure of Baron Harkonnen, as well as other characters. In 2006, SOTA Toys produced a Baron Harkonnen action figure for their "Now Playing Presents" line.

H. R. Giger's Harkonnen Chair is a chair originally designed by the artist as set dressing for an unrealized 1970s adaptation of Dune by Alejandro Jodorowsky.

Analysis
Thomas West of Screen Rant writes that "there are few science fiction villains quite as compelling and darkly charismatic as the Baron". William Hughes of The A.V. Club calls the Baron "one of the most iconically awful villains in all of science fiction". Stuart Conover of ScienceFiction.com describes him as "one of the most insidious villains". Maude Campbell of Popular Mechanics writes that the Baron is "one of the most evil characters ever put to paper (including Darth Vader)", and Jon Michaud of The New Yorker compares "Herbert's scheming, backstabbing villain, the Baron Vladimir Harkonnen" to the villainous Lannister family of George R. R. Martin's A Song of Ice and Fire series.

Emmet Asher-Perrin suggests that "what makes the Baron truly monstrous [is] the fact that he spends all of his time plotting murder, sowing discord, and destroying populations of people to get his way". Hughes writes that the evil Harkonnen is "specifically designed to make the noble Atreides family seem that extra bit more dignified and pure". Jesse Schedeen of IGN agrees that the Baron is "as cruel and vindictive as Leto is noble and just." Hughes says that Herbert "successfully made [the Baron] so vampirically vile that he casts a (sometimes literal) shadow over the entire series." Sandy Schaefer of Screen Rant calls the Baron "a deliciously despicable antagonist".

While the novel suggests that the Baron's obesity might be the result of a genetic disease, the Prelude to Dune prequel trilogy by Brian Herbert and Kevin J. Anderson explains that Harkonnen was once a fit, attractive but vain man who is given the incurable disease intentionally by the Bene Gesserit Reverend Mother Mohiam after he drugs and rapes her. Asher-Perrin suggests that in this narrative, "the Baron's corpulence is meant to be comeuppance for doing something reprehensible, a physical punishment meant to hurt his vanity by taking away the attractiveness he so prized in himself."

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

title: Vladimir Harkonnen


text:
Diffie–Hellman key exchange

Diffie–Hellman (DH) key exchange is a mathematical method of securely exchanging cryptographic keys over a public channel and was one of the first public-key protocols as conceived by Ralph Merkle and named after Whitfield Diffie and Martin Hellman. DH is one of the earliest practical examples of public key exchange implemented within the field of cryptography. Published in 1976 by Diffie and Hellman, this is the earliest publicly known work that proposed the idea of a private key and a corresponding public key.

Traditionally, secure encrypted communication between two parties required that they first exchange keys by some secure physical means, such as paper key lists transported by a trusted courier. The Diffie–Hellman key exchange method allows two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure channel. This key can then be used to encrypt subsequent communications using a symmetric-key cipher.

Diffie–Hellman is used to secure a variety of Internet services. However, research published in October 2015 suggests that the parameters in use for many DH Internet applications at that time are not strong enough to prevent compromise by very well-funded attackers, such as the security services of some countries.

The scheme was published by Whitfield Diffie and Martin Hellman in 1976, but in 1997 it was revealed that James H. Ellis, Clifford Cocks, and Malcolm J. Williamson of GCHQ, the British signals intelligence agency, had previously shown in 1969 how public-key cryptography could be achieved.

Although Diffie–Hellman key agreement itself is a non-authenticated key-agreement protocol, it provides the basis for a variety of authenticated protocols, and is used to provide forward secrecy in Transport Layer Security's ephemeral modes (referred to as EDH or DHE depending on the cipher suite).

The method was followed shortly afterwards by RSA, an implementation of public-key cryptography using asymmetric algorithms.

Expired US patent 4,200,770 from 1977 describes the now public-domain algorithm. It credits Hellman, Diffie, and Merkle as inventors.

Name
In 2006, Hellman suggested the algorithm be called Diffie–Hellman–Merkle key exchange in recognition of Ralph Merkle's contribution to the invention of public-key cryptography (Hellman, 2006), writing:

"The system...has since become known as Diffie–Hellman key exchange. While that system was first described in a paper by Diffie and me, it is a public key distribution system, a concept developed by Merkle, and hence should be called 'Diffie–Hellman–Merkle key exchange' if names are to be associated with it. I hope this small pulpit might help in that endeavor to recognize Merkle's equal contribution to the invention of public key cryptography."

General overview
Diffie–Hellman key exchange establishes a shared secret between two parties that can be used for secret communication for exchanging data over a public network. An analogy illustrates the concept of public key exchange by using colors instead of very large numbers:

The process begins by having the two parties, Alice and Bob, publicly agree on an arbitrary starting color that does not need to be kept secret. In this example, the color is yellow. Each person also selects a secret color that they keep to themselves – in this case, red and cyan. The crucial part of the process is that Alice and Bob each mix their own secret color together with their mutually shared color, resulting in orange-tan and light-blue mixtures respectively, and then publicly exchange the two mixed colors. Finally, each of them mixes the color they received from the partner with their own private color. The result is a final color mixture (yellow-brown in this case) that is identical to their partner's final color mixture.

If a third party listened to the exchange, they would only know the common color (yellow) and the first mixed colors (orange-tan and light-blue), but it would be very hard for them to find out the final secret color (yellow-brown). Bringing the analogy back to a real-life exchange using large numbers rather than colors, this determination is computationally expensive. It is impossible to compute in a practical amount of time even for modern supercomputers.

Cryptographic explanation
The simplest and the original implementation, later formalized as Finite Field Diffie-Hellman in RFC 7919, of the protocol uses the multiplicative group of integers modulo p, where p is prime, and g is a primitive root modulo p. These two values are chosen in this way to ensure that the resulting shared secret can take on any value from 1 to p–1. Here is an example of the protocol, with non-secret values in blue, and secret values in red .

 * 1) Alice and Bob publicly agree to use a modulus  p  = 23 and base  g  = 5 (which is a primitive root modulo 23).
 * 2) Alice chooses a secret integer  a  = 4, then sends Bob  A  =  g  a  mod  p
 * 3) *  A  = 5 4  mod 23 = 4 (in this example both A and a have the same value 4, but this is usually not the case)
 * 4) Bob chooses a secret integer  b  = 3, then sends Alice  B  =  g  b  mod  p
 * 5) *  B  = 5 3  mod 23 = 10
 * 6) Alice computes  s  =  B  a  mod  p
 * 7) *  s  = 10 4  mod 23 = 18
 * 8) Bob computes  s  =  A  b  mod  p
 * 9) *  s  = 4 3  mod 23 = 18
 * 10) Alice and Bob now share a secret (the number 18).

Both Alice and Bob have arrived at the same values because under mod p,

 * $${\color{Blue}A}^{\color{Red}b}\bmod {\color{Blue}p} = {\color{Blue}g}^{\color{Red}ab}\bmod {\color{Blue}p} = {\color{Blue}g}^{\color{Red}ba}\bmod {\color{Blue}p} = {\color{Blue}B}^{\color{Red}a}\bmod {\color{Blue}p}$$

More specifically,

 * $$({\color{Blue}g}^{\color{Red}a}\bmod {\color{Blue}p})^{\color{Red}b}\bmod {\color{Blue}p} = ({\color{Blue}g}^{\color{Red}b}\bmod {\color{Blue}p})^{\color{Red}a}\bmod {\color{Blue}p}$$

Only a and b are kept secret. All the other values – p, g, ga mod p, and gb mod p – are sent in the clear. The strength of the scheme comes from the fact that gab mod p = gba mod p take extremely long times to compute by any known algorithm just from the knowledge of p, g, ga mod p, and gb mod p. Such a function that is easy to compute but hard to invert is called a one-way function. Once Alice and Bob compute the shared secret they can use it as an encryption key, known only to them, for sending messages across the same open communications channel.

Of course, much larger values of a, b, and p would be needed to make this example secure, since there are only 23 possible results of n mod 23. However, if p is a prime of at least 600 digits, then even the fastest modern computers using the fastest known algorithm cannot find a given only g, p and ga mod p. Such a problem is called the discrete logarithm problem. The computation of ga mod p is known as modular exponentiation and can be done efficiently even for large numbers. Note that g need not be large at all, and in practice is usually a small integer (like 2, 3, ...).

Secrecy chart
The chart below depicts who knows what, again with non-secret values in blue, and secret values in red . Here Eve is an eavesdropper – she watches what is sent between Alice and Bob, but she does not alter the contents of their communications.

 *  g , public (primitive root) base, known to Alice, Bob, and Eve.  g  = 5
 *  p , public (prime) modulus, known to Alice, Bob, and Eve.  p  = 23
 *  a , Alice's private key, known only to Alice.  a  =  6
 *  b , Bob's private key known only to Bob.  b  =  15
 *  A , Alice's public key, known to Alice, Bob, and Eve.  A  =  g a  mod  p  = 8
 *  B , Bob's public key, known to Alice, Bob, and Eve.  B  =  g b  mod  p  = 19

Now  s  is the shared secret key and it is known to both Alice and Bob, but not to Eve. Note that it is not helpful for Eve to compute  AB , which equals  g  a +  b  mod p.

Note: It should be difficult for Alice to solve for Bob's private key or for Bob to solve for Alice's private key. If it is not difficult for Alice to solve for Bob's private key (or vice versa), then an eavesdropper, Eve, may simply substitute her own private / public key pair, plug Bob's public key into her private key, produce a fake shared secret key, and solve for Bob's private key (and use that to solve for the shared secret key). Eve may attempt to choose a public / private key pair that will make it easy for her to solve for Bob's private key.

Generalization to finite cyclic groups
Here is a more general description of the protocol:

 * 1) Alice and Bob agree on a natural number n and a generating element g in the finite cyclic group G of order n. (This is usually done long before the rest of the protocol; g and n are assumed to be known by all attackers.) The group G is written multiplicatively.
 * 2) Alice picks a random natural number a with 1 < a < n, and sends the element ga of G to Bob.
 * 3) Bob picks a random natural number b with 1 < b < n, and sends the element gb of G to Alice.
 * 4) Alice computes the element $(g^{b})^{a} = g^{ba}$ of G.
 * 5) Bob computes the element $(g^{a})^{b} = g^{ab}$ of G.

Both Alice and Bob are now in possession of the group element gab = gba, which can serve as the shared secret key. The group G satisfies the requisite condition for secure communication as long as there is no efficient algorithm for determining gab given g, ga, and gb.

For example, the elliptic curve Diffie–Hellman protocol is a variant that represents an element of G as a point on an elliptic curve instead of as an integer modulo n. Variants using hyperelliptic curves have also been proposed. The supersingular isogeny key exchange is a Diffie–Hellman variant that was designed to be secure against quantum computers, but it was broken in July 2022.

Ephemeral and/or static keys
The used keys can either be ephemeral or static (long term) key, but could even be mixed, so called semi-static DH. These variants have different properties and hence different use cases. An overview over many variants and some also discussions can for example be found in NIST SP 800-56A. A basic list:

 * 1) ephemeral, ephemeral: Usually used for key agreement. Provides forward secrecy, but no authenticity.
 * 2) static, static: Would generate a long term shared secret. Does not provide forward secrecy, but implicit authenticity. Since the keys are static it would for example not protect against replay-attacks.
 * 3) ephemeral, static: For example, used in ElGamal encryption or Integrated Encryption Scheme (IES). If used in key agreement it could provide implicit one-sided authenticity (the ephemeral side could verify the authenticity of the static side). No forward secrecy is provided.

It is possible to use ephemeral and static keys in one key agreement to provide more security as for example shown in NIST SP 800-56A, but it is also possible to combine those in a single DH key exchange, which is then called triple DH (3-DH).

Triple Diffie-Hellman (3-DH)
In 1997 a kind of triple DH was proposed by Simon Blake-Wilson, Don Johnson, Alfred Menezes in 1997, which was improved by C. Kudla and K. G. Paterson in 2005 and shown to be secure.

The long term secret keys of Alice and Bob are denoted by a and b respectively, with public keys A and B, as well as the ephemeral key pairs x, X and y, Y. Then protocol is: The long term public keys need to be transferred somehow. That can be done beforehand in a separate, trusted channel, or the public keys can be encrypted using some partial key agreement to preserve anonymity. For more of such details as well as other improvements like side channel protection or explicit key confirmation, as well as early messages and additional password authentication, see e.g. US patent "Advanced modular handshake for key agreement and optional authentication".

Extended Triple Diffie-Hellman (X3DH)
X3DH was initially proposed as part of the Double Ratchet Algorithm used in the Signal Protocol. The protocol offers forward secrecy and cryptographic deniability. It operates on an elliptic curve.

The protocol uses five public keys. Alice has an identity key IKA and an ephemeral key EKA. Bob has an identity key IKB, a signed prekey SPKB, and a one-time prekey OPKB. Bob first publishes his three keys to a server, which Alice downloads and verifies the signature on. Alice then initiates the exchange to Bob. The OPK is optional.

Operation with more than two parties
Diffie–Hellman key agreement is not limited to negotiating a key shared by only two participants. Any number of users can take part in an agreement by performing iterations of the agreement protocol and exchanging intermediate data (which does not itself need to be kept secret). For example, Alice, Bob, and Carol could participate in a Diffie–Hellman agreement as follows, with all operations taken to be modulo p:

 * 1) The parties agree on the algorithm parameters p and g.
 * 2) The parties generate their private keys, named a, b, and c.
 * 3) Alice computes $g^{a} mod p$ and sends it to Bob.
 * 4) Bob computes $(g^{a})^{b} mod p = g^{ab} mod p$ and sends it to Carol.
 * 5) Carol computes $(g^{ab})^{c} mod p = g^{abc} mod p$ and uses it as her secret.
 * 6) Bob computes $g^{b} mod p$ and sends it to Carol.
 * 7) Carol computes $(g^{b})^{c} mod p = g^{bc} mod p$ and sends it to Alice.
 * 8) Alice computes $(g^{bc})^{a} mod p = g^{bca} mod p = g^{abc} mod p$ and uses it as her secret.
 * 9) Carol computes $g^{c} mod p$ and sends it to Alice.
 * 10) Alice computes $(g^{c})^{a} mod p = g^{ca} mod p$ and sends it to Bob.
 * 11) Bob computes $(g^{ca})^{b} mod p = g^{cab} mod p = g^{abc} mod p$ and uses it as his secret.

An eavesdropper has been able to see $g^{a} mod p$, $g^{b} mod p$, $g^{c} mod p$, $g^{ab} mod p$, $g^{ac} mod p$, and $g^{bc} mod p$, but cannot use any combination of these to efficiently reproduce $g^{abc} mod p$.

To extend this mechanism to larger groups, two basic principles must be followed:

 * Starting with an "empty" key consisting only of g, the secret is made by raising the current value to every participant's private exponent once, in any order (the first such exponentiation yields the participant's own public key).
 * Any intermediate value (having up to N−1 exponents applied, where N is the number of participants in the group) may be revealed publicly, but the final value (having had all N exponents applied) constitutes the shared secret and hence must never be revealed publicly. Thus, each user must obtain their copy of the secret by applying their own private key last (otherwise there would be no way for the last contributor to communicate the final key to its recipient, as that last contributor would have turned the key into the very secret the group wished to protect).

These principles leave open various options for choosing in which order participants contribute to keys. The simplest and most obvious solution is to arrange the N participants in a circle and have N keys rotate around the circle, until eventually every key has been contributed to by all N participants (ending with its owner) and each participant has contributed to N keys (ending with their own). However, this requires that every participant perform N modular exponentiations.

By choosing a more desirable order, and relying on the fact that keys can be duplicated, it is possible to reduce the number of modular exponentiations performed by each participant to $log_{2}(N) + 1$ using a divide-and-conquer-style approach, given here for eight participants:

 * 1) Participants A, B, C, and D each perform one exponentiation, yielding $g^{abcd}$; this value is sent to E, F, G, and H. In return, participants A, B, C, and D receive $g^{efgh}$.
 * 2) Participants A and B each perform one exponentiation, yielding $g^{efghab}$, which they send to C and D, while C and D do the same, yielding $g^{efghcd}$, which they send to A and B.
 * 3) Participant A performs an exponentiation, yielding $g^{efghcda}$, which it sends to B; similarly, B sends $g^{efghcdb}$ to A. C and D do similarly.
 * 4) Participant A performs one final exponentiation, yielding the secret $g^{efghcdba}$ = $g^{abcdefgh}$, while B does the same to get $g^{efghcdab}$ = $g^{abcdefgh}$; again, C and D do similarly.
 * 5) Participants E through H simultaneously perform the same operations using $g^{abcd}$ as their starting point.

Once this operation has been completed all participants will possess the secret $g^{abcdefgh}$, but each participant will have performed only four modular exponentiations, rather than the eight implied by a simple circular arrangement.

Security and practical considerations
The protocol is considered secure against eavesdroppers if G and g are chosen properly. In particular, the order of the group G must be large, particularly if the same group is used for large amounts of traffic. The eavesdropper has to solve the Diffie–Hellman problem to obtain gab. This is currently considered difficult for groups whose order is large enough. An efficient algorithm to solve the discrete logarithm problem would make it easy to compute a or b and solve the Diffie–Hellman problem, making this and many other public key cryptosystems insecure. Fields of small characteristic may be less secure.

The order of G should have a large prime factor to prevent use of the Pohlig–Hellman algorithm to obtain a or b. For this reason, a Sophie Germain prime q is sometimes used to calculate p = 2q + 1, called a safe prime, since the order of G is then only divisible by 2 and q. Sometimes g is chosen to generate the order q subgroup of G, rather than G, so that the Legendre symbol of ga never reveals the low order bit of a. A protocol using such a choice is for example IKEv2.

The generator g is often a small integer such as 2. Because of the random self-reducibility of the discrete logarithm problem a small g is equally secure as any other generator of the same group.

If Alice and Bob use random number generators whose outputs are not completely random and can be predicted to some extent, then it is much easier to eavesdrop.

In the original description, the Diffie–Hellman exchange by itself does not provide authentication of the communicating parties and can be vulnerable to a man-in-the-middle attack. Mallory (an active attacker executing the man-in-the-middle attack) may establish two distinct key exchanges, one with Alice and the other with Bob, effectively masquerading as Alice to Bob, and vice versa, allowing her to decrypt, then re-encrypt, the messages passed between them. Note that Mallory must be in the middle from the beginning and continuing to be so, actively decrypting and re-encrypting messages every time Alice and Bob communicate. If she arrives after the keys have been generated and the encrypted conversation between Alice and Bob has already begun, the attack cannot succeed. If she is ever absent, her previous presence is then revealed to Alice and Bob. They will know that all of their private conversations had been intercepted and decoded by someone in the channel. In most cases it will not help them get Mallory's private key, even if she used the same key for both exchanges.

A method to authenticate the communicating parties to each other is generally needed to prevent this type of attack. Variants of Diffie–Hellman, such as STS protocol, may be used instead to avoid these types of attacks.

Denial-of-service attack
A CVE released in 2021 (CVE-2002-20001) disclosed a denial-of-service attack (DoS) against the protocol variants use ephemeral keys, called D(HE)at attack. The attack exploits that the Diffie-Hellman key exchange allows attackers to send arbitrary numbers that are actually not public keys, triggering expensive modular exponentiation calculations on the victim's side. Another CVE released in 2022 (CVE-2022-40735) disclosed that the Diffie-Hellman key exchange implementations may use long private exponents that arguably make modular exponentiation calculations unnecessarily expensive. An attacker can exploit both vulnerabilities together.

Practical attacks on Internet traffic
The number field sieve algorithm, which is generally the most effective in solving the discrete logarithm problem, consists of four computational steps. The first three steps only depend on the order of the group G, not on the specific number whose finite log is desired. It turns out that much Internet traffic uses one of a handful of groups that are of order 1024 bits or less. By precomputing the first three steps of the number field sieve for the most common groups, an attacker need only carry out the last step, which is much less computationally expensive than the first three steps, to obtain a specific logarithm. The Logjam attack used this vulnerability to compromise a variety of Internet services that allowed the use of groups whose order was a 512-bit prime number, so called export grade. The authors needed several thousand CPU cores for a week to precompute data for a single 512-bit prime. Once that was done, individual logarithms could be solved in about a minute using two 18-core Intel Xeon CPUs.

As estimated by the authors behind the Logjam attack, the much more difficult precomputation needed to solve the discrete log problem for a 1024-bit prime would cost on the order of $100 million, well within the budget of a large national intelligence agency such as the U.S. National Security Agency (NSA). The Logjam authors speculate that precomputation against widely reused 1024-bit DH primes is behind claims in leaked NSA documents that NSA is able to break much of current cryptography.

To avoid these vulnerabilities, the Logjam authors recommend use of elliptic curve cryptography, for which no similar attack is known. Failing that, they recommend that the order, p, of the Diffie–Hellman group should be at least 2048 bits. They estimate that the pre-computation required for a 2048-bit prime is 109 times more difficult than for 1024-bit primes.

Encryption
Public key encryption schemes based on the Diffie–Hellman key exchange have been proposed. The first such scheme is the ElGamal encryption. A more modern variant is the Integrated Encryption Scheme.

Forward secrecy
Protocols that achieve forward secrecy generate new key pairs for each session and discard them at the end of the session. The Diffie–Hellman key exchange is a frequent choice for such protocols, because of its fast key generation.

Password-authenticated key agreement
When Alice and Bob share a password, they may use a password-authenticated key agreement (PK) form of Diffie–Hellman to prevent man-in-the-middle attacks. One simple scheme is to compare the hash of s concatenated with the password calculated independently on both ends of channel. A feature of these schemes is that an attacker can only test one specific password on each iteration with the other party, and so the system provides good security with relatively weak passwords. This approach is described in ITU-T Recommendation X.1035, which is used by the G.hn home networking standard.

An example of such a protocol is the Secure Remote Password protocol.

Public key
It is also possible to use Diffie–Hellman as part of a public key infrastructure, allowing Bob to encrypt a message so that only Alice will be able to decrypt it, with no prior communication between them other than Bob having trusted knowledge of Alice's public key. Alice's public key is $$(g^a \bmod{p}, g, p)$$. To send her a message, Bob chooses a random b and then sends Alice $$g^b \bmod p$$ (unencrypted) together with the message encrypted with symmetric key $$(g^a)^b \bmod{p}$$. Only Alice can determine the symmetric key and hence decrypt the message because only she has a (the private key). A pre-shared public key also prevents man-in-the-middle attacks.

In practice, Diffie–Hellman is not used in this way, with RSA being the dominant public key algorithm. This is largely for historical and commercial reasons, namely that RSA Security created a certificate authority for key signing that became Verisign. Diffie–Hellman, as elaborated above, cannot directly be used to sign certificates. However, the ElGamal and DSA signature algorithms are mathematically related to it, as well as MQV, STS and the IKE component of the IPsec protocol suite for securing Internet Protocol communications.

General references

 * The History of Non-Secret Encryption JH Ellis 1987 (28K PDF file) (HTML version)
 * The First Ten Years of Public-Key Cryptography Whitfield Diffie, Proceedings of the IEEE, vol. 76, no. 5, May 1988, pp: 560–577 (1.9MB PDF file)
 * Menezes, Alfred; van Oorschot, Paul; Vanstone, Scott (1997). Handbook of Applied Cryptography Boca Raton, Florida: CRC Press. ISBN 0-8493-8523-7. (Available online)
 * Singh, Simon (1999) The Code Book: the evolution of secrecy from Mary Queen of Scots to quantum cryptography New York: Doubleday ISBN 0-385-49531-5
 * An Overview of Public Key Cryptography Martin E. Hellman, IEEE Communications Magazine, May 2002, pp. 42–49. (123kB PDF file)
 * Menezes, Alfred; van Oorschot, Paul; Vanstone, Scott (1997). Handbook of Applied Cryptography Boca Raton, Florida: CRC Press. ISBN 0-8493-8523-7. (Available online)
 * Singh, Simon (1999) The Code Book: the evolution of secrecy from Mary Queen of Scots to quantum cryptography New York: Doubleday ISBN 0-385-49531-5
 * An Overview of Public Key Cryptography Martin E. Hellman, IEEE Communications Magazine, May 2002, pp. 42–49. (123kB PDF file)

title: Diffie–Hellman key exchange


text:
Destry Rides Again

Destry Rides Again is a 1939 American Western comedy film directed by George Marshall and starring Marlene Dietrich and James Stewart. The supporting cast includes Mischa Auer, Charles Winninger, Brian Donlevy, Allen Jenkins, Irene Hervey, Billy Gilbert, Bill Cody Jr., Lillian Yarbo, and Una Merkel.

The opening credits list the story as "Suggested by Max Brand's novel Destry Rides Again", but the movie is almost completely different. It also bears no resemblance to the 1932 adaptation of the novel starring Tom Mix, which is often retitled as Justice Rides Again. In 1996, Destry Rides Again was selected for preservation in the United States National Film Registry by the Library of Congress as being "culturally, historically, or aesthetically significant".

Plot
Saloon owner Kent, the unscrupulous boss of the fictional Western town of Bottleneck, has the town's sheriff, Mr. Keogh, killed when Keogh asks one too many questions about a rigged poker game. Kent and Frenchy, a cheap saloon tramp who is his girlfriend, now have a stranglehold over the local cattle ranchers. The town's crooked mayor, Hiram J. Slade, who is in collusion with Kent, appoints the town drunk, Washington Dimsdale, as the new sheriff, assuming that he will be easy to control and manipulate. However, Dimsdale, a deputy under the famous lawman Tom Destry, promptly swears off drinking, and is able to call upon the latter's equally formidable son, Tom Destry Jr., to help him make Bottleneck a lawful, respectable town.

Destry arrives in Bottleneck with Jack Tyndall, a cattleman, and his sister, Janice. Destry initially confounds the townsfolk by refusing to strap on a gun and maintaining civility in dealing with everyone, including Kent and Frenchy. This quickly makes him a disappointment to Dimsdale and a laughingstock to the townspeople; he is mockingly asked to "clean up" Bottleneck by being given a mop and bucket. However, after a number of rowdy horsemen ride into town shooting their pistols in the air, he demonstrates uncanny expertise in marksmanship and threatens to jail them if they do it again, earning the respect of Bottleneck's citizens.

Through the townsmen's evasive answers regarding the whereabouts of Keogh, Destry gradually begins to suspect that Keogh was murdered. He confirms this by provoking Frenchy into admitting it, but without a location for the body, he lacks any proof. Destry therefore deputizes Boris, a Russian immigrant whom Frenchy had earlier humiliated, and implies to Kent that he had found the body outside of town "in remarkably good condition". When Kent sends a member of his gang to check on Keogh's burial site, Boris and Dimsdale follow, capture, and jail him.

Although the gang member is charged with Keogh's murder (in the hope that he would implicate Kent in exchange for clemency), Mayor Slade appoints himself judge of the trial, making an innocent verdict a foregone conclusion. To prevent this, Destry calls in a judge from a larger city in secret, but the plan is ruined after Boris accidentally gives away the other judge's name in the saloon. Kent orders Frenchy to invite the deputy to her house while other gang members storm the sheriff's office and cause a breakout; now in love with Destry, she accepts. When shots are fired, he rushes back, to find the cell empty and Dimsdale mortally wounded. Destry returns to his room and puts on his gun belt, abandoning his previous commitment to nonviolence.

Under Destry's command, the honest townsmen form a posse and prepare to attack the saloon, where Kent's gang is fortified, while Destry enters through the roof and looks for Kent. At Frenchy's urging, the townswomen march in between the groups, preventing further violence, before breaking into the saloon and subduing the gang. Kent narrowly escapes, and attempts to shoot Destry from the second floor; Frenchy takes the bullet for him, killing her, and Destry kills Kent.

Some time later, Destry is shown to be the sheriff of a now lawful Bottleneck, repeating to children the stories that Dimsdale told him of the town's violent history. He jokingly tells a story about marriage to Janice, implying a marriage between them will soon follow.

Cast
As appearing in screen credits:

 * Marlene Dietrich as Frenchy, the saloon singer
 * James Stewart as Thomas Jefferson "Tom" Destry Jr., the new deputy
 * Mischa Auer as Boris Stavrogin, the henpecked Russian married to Lily Belle
 * Charles Winninger as Washington "Wash" Dimsdale, the new sheriff
 * Brian Donlevy as Kent, the saloon owner
 * Allen Jenkins as "Gyp" Watson
 * Warren Hymer as "Bugs" Watson
 * Irene Hervey as Janice Tyndall
 * Una Merkel as Lily Belle, "Mrs. Callahan"
 * Billy Gilbert as Bartender "Loupgerou"
 * Samuel S. Hinds as Judge Slade, the mayor
 * Jack Carson as Jack Tyndall
 * Tom Fadden as Lem Claggett
 * Virginia Brissac as Sophie Claggett
 * Edmund MacDonald as Rockwell
 * Lillian Yarbo as Clara, Frenchy's maid
 * Joe King as Sheriff Keogh
 * Dickie Jones as Claggett's boy
 * Ann E. Todd as Claggett's girl

Songs
Dietrich sings "See What the Boys in the Back Room Will Have" and "You've Got That Look", written by Frank Loesser, set to music by Frederick Hollander, which have become classics, as well as a revised version of Little Joe the Wrangler.

Production
Western writer Max Brand contributed the novel, Destry Rides Again, but the film also owes its origins to Brand's serial "Twelve Peers", published in a pulp magazine. In the original work, Harrison (or "Harry") Destry was not a pacifist. As filmed in 1932, with Tom Mix in the starring role, the central character differed in that Destry did wear six-guns.

The film was James Stewart's first Western (he would not return to the genre until 1950, with Winchester '73, followed by Broken Arrow). The story featured a ferocious cat-fight between Marlene Dietrich and Una Merkel, which apparently caused a mild censorship problem at the time of release. The film also represented Dietrich's return to Hollywood after a string of flops at Paramount ("Angel", "The Scarlet Empress", "The Devil is a Woman") caused her, and a number of other stars, to be labelled "box office poison". While vacationing at Cap d'Antibes with her family, her mentor Josef von Sternberg and her lover Erich Maria Remarque, she received an offer from Joe Pasternak to come to Universal at half the salary she had been receiving for most of the 1930s. Pasternak had previously tried to sign Dietrich to Universal while she was still in Berlin. Unsure of what to do she was advised by von Sternberg "I made you into a Goddess. Now show them you have feet of clay".

According to writer/director Peter Bogdanovich, Marlene Dietrich told him during an aircraft flight that she and James Stewart had an affair during shooting and that she became pregnant but had a surreptitious abortion without telling Stewart.

Internationally, the film was released under the alternative titles Femme ou Démon in French and Arizona in Spanish.

Reception
Destry Rides Again was generally well accepted by the public, as well as critics. It was reviewed by Frank S. Nugent in The New York Times, who observed that the film did not follow the usual Hollywood type-casting. On Dietrich's role, he characterized: "It's difficult to reconcile Miss Dietrich's Frenchy, the cabaret girl of the Bloody Gulch Saloon, with the posed and posturing Dietrich we last saw in Mr. Lubitsch's 'Angel'." Stewart's contribution was similarly treated, "turning in an easy, likable, pleasantly humored performance."

Other versions

 * Universal Pictures released an earlier film, also titled Destry Rides Again (1932), directed by Benjamin Stoloff and starring Tom Mix and ZaSu Pitts. Apart from the title, the story has no connection with the later film and is sometimes retitled as Justice Rides Again.
 * A Lux Radio Theater version of the story was aired November 5, 1945, starred Jimmy Stewart and Joan Blondell, and can be heard on YouTube.
 * An almost shot-for-shot remake of the 1939 production, Destry (1954), was also directed by George Marshall and stars Audie Murphy and Thomas Mitchell.
 * A Broadway musical version of the story, Destry Rides Again, opened in New York City at the Imperial Theatre on April 23, 1959, and played 472 performances. Produced by David Merrick, the show had a book by Leonard Gershe, music and lyrics by Harold Rome, and starred Andy Griffith as Destry and Dolores Gray as Frenchy.
 * ABC aired a short-lived television series in 1964, Destry, based on the 1939 and 1954 films, starring John Gavin as the son of the movie's title character.

In popular culture
Marlene Dietrich's character, Frenchy, was the inspiration for the character of Lili Von Shtupp in the Western parody Blazing Saddles.

title: Destry Rides Again


text:
Derivative

The derivative is a fundamental tool of calculus that quantifies the sensitivity of change of a function's output with respect to its input. The derivative of a function of a single variable at a chosen input value, when it exists, is the slope of the tangent line to the graph of the function at that point. The tangent line is the best linear approximation of the function near that input value. For this reason, the derivative is often described as the instantaneous rate of change, the ratio of the instantaneous change in the dependent variable to that of the independent variable. The process of finding a derivative is called differentiation.

There are multiple different notations for differentiation, two of the most commonly used being Leibniz notation and prime notation. Leibniz notation, named after Gottfried Wilhelm Leibniz, is represented as the ratio of two differentials, whereas prime notation is written by adding a prime mark. Higher order notations represent repeated differentiation, and they are usually denoted in Leibniz notation by adding superscripts to the differentials, and in prime notation by adding additional prime marks. The higher order derivatives can be applied in physics; for example, while the first derivative of the position of a moving object with respect to time is the object's velocity, how the position changes as time advances, the second derivative is the object's acceleration, how the velocity changes as time advances.

Derivatives can be generalized to functions of several real variables. In this generalization, the derivative is reinterpreted as a linear transformation whose graph is (after an appropriate translation) the best linear approximation to the graph of the original function. The Jacobian matrix is the matrix that represents this linear transformation with respect to the basis given by the choice of independent and dependent variables. It can be calculated in terms of the partial derivatives with respect to the independent variables. For a real-valued function of several variables, the Jacobian matrix reduces to the gradient vector.

As a limit
A function of a real variable $$ f(x) $$ is differentiable at a point $$ a $$ of its domain, if its domain contains an open interval containing $$ a $$, and the limit $$L=\lim_{h \to 0}\frac{f(a+h)-f(a)}h $$ exists. This means that, for every positive real number $$\varepsilon$$, there exists a positive real number $$\delta$$ such that, for every $$ h $$ such that $$|h| < \delta$$ and $$h\ne 0$$ then $$f(a+h)$$ is defined, and $$\left|L-\frac{f(a+h)-f(a)}h\right|<\varepsilon,$$ where the vertical bars denote the absolute value. This is an example of the (ε, δ)-definition of limit.

If the function $$ f $$ is differentiable at $$ a $$, that is if the limit $$ L $$ exists, then this limit is called the derivative of $$ f $$ at $$ a $$. Multiple notations for the derivative exist. The derivative of $$ f $$ at $$ a $$ can be denoted $$f'(a)$$, read as "$$ f $$ prime of $$ a $$"; or it can be denoted $\frac{df}{dx}(a)$, read as "the derivative of $$ f $$ with respect to $$ x $$ at $$ a $$" or "$$ df $$ by (or over) $$ dx $$ at $$ a $$". See below. If $$ f $$ is a function that has a derivative at every point in its domain, then a function can be defined by mapping every point $$ x $$ to the value of the derivative of $$ f $$ at $$ x $$. This function is written $$ f' $$ and is called the derivative function or the derivative of $$ f $$. The function $$ f $$ sometimes has a derivative at most, but not all, points of its domain. The function whose value at $$ a $$ equals $$ f'(a) $$ whenever $$ f'(a) $$ is defined and elsewhere is undefined is also called the derivative of $$ f $$. It is still a function, but its domain may be smaller than the domain of $$ f $$.

For example, let $$f$$ be the squaring function: $$f(x) = x^2$$. Then the quotient in the definition of the derivative is $$\frac{f(a+h) - f(a)}{h} = \frac{(a+h)^2 - a^2}{h} = \frac{a^2 + 2ah + h^2 - a^2}{h} = 2a + h.$$ The division in the last step is valid as long as $$h \neq 0$$. The closer $$h$$ is to $$0$$, the closer this expression becomes to the value $$2a$$. The limit exists, and for every input $$a$$ the limit is $$2a$$. So, the derivative of the squaring function is the doubling function: $$f'(x) = 2x$$.

The ratio in the definition of the derivative is the slope of the line through two points on the graph of the function $$f$$, specifically the points $$(a,f(a))$$ and $$(a+h, f(a+h))$$. As $$h$$ is made smaller, these points grow closer together, and the slope of this line approaches the limiting value, the slope of the tangent to the graph of $$f$$ at $$a$$. In other words, the derivative is the slope of the tangent.

Using infinitesimals
One way to think of the derivative $\frac{df}{dx}(a)$ is as the ratio of an infinitesimal change in the output of the function $$f$$ to an infinitesimal change in its input. In order to make this intuition rigorous, a system of rules for manipulating infinitesimal quantities is required. The system of hyperreal numbers is a way of treating infinite and infinitesimal quantities. The hyperreals are an extension of the real numbers that contain numbers greater than anything of the form $$1 + 1 + \cdots + 1 $$ for any finite number of terms. Such numbers are infinite, and their reciprocals are infinitesimals. The application of hyperreal numbers to the foundations of calculus is called nonstandard analysis. This provides a way to define the basic concepts of calculus such as the derivative and integral in terms of infinitesimals, thereby giving a precise meaning to the $$d$$ in the Leibniz notation. Thus, the derivative of $$f(x)$$ becomes $$f'(x) = \operatorname{st}\left( \frac{f(x + dx) - f(x)}{dx} \right)$$ for an arbitrary infinitesimal $$dx$$, where $$\operatorname{st}$$ denotes the standard part function, which "rounds off" each finite hyperreal to the nearest real. Taking the squaring function $$f(x) = x^2$$ as an example again, $$ \begin{align} f'(x) &= \operatorname{st}\left(\frac{x^2 + 2x \cdot dx + (dx)^2 -x^2}{dx}\right) \\ &= \operatorname{st}\left(\frac{2x \cdot dx + (dx)^2}{dx}\right) \\ &= \operatorname{st}\left(\frac{2x \cdot dx}{dx} + \frac{(dx)^2}{dx}\right) \\ &= \operatorname{st}\left(2x + dx\right) \\ &= 2x. \end{align} $$

Continuity and differentiability
If $$ f $$ is differentiable at $$ a $$, then $$ f $$ must also be continuous at $$ a $$. As an example, choose a point $$ a $$ and let $$ f $$ be the step function that returns the value 1 for all $$ x $$ less than $$ a $$, and returns a different value 10 for all $$ x $$ greater than or equal to $$ a $$. The function $$ f $$ cannot have a derivative at $$ a $$. If $$ h $$ is negative, then $$ a + h $$ is on the low part of the step, so the secant line from $$ a $$ to $$ a + h $$ is very steep; as $$ h $$ tends to zero, the slope tends to infinity. If $$ h $$ is positive, then $$ a + h $$ is on the high part of the step, so the secant line from $$ a $$ to $$ a + h $$ has slope zero. Consequently, the secant lines do not approach any single slope, so the limit of the difference quotient does not exist. However, even if a function is continuous at a point, it may not be differentiable there. For example, the absolute value function given by $$ f(x) = |x| $$ is continuous at $$ x = 0 $$, but it is not differentiable there. If $$ h $$ is positive, then the slope of the secant line from 0 to $$ h $$ is one; if $$ h $$ is negative, then the slope of the secant line from $$ 0 $$ to $$ h $$ is $$ -1 $$. This can be seen graphically as a "kink" or a "cusp" in the graph at $$x=0$$. Even a function with a smooth graph is not differentiable at a point where its tangent is vertical: For instance, the function given by $$ f(x) = x^{1/3} $$ is not differentiable at $$ x = 0 $$. In summary, a function that has a derivative is continuous, but there are continuous functions that do not have a derivative.

Most functions that occur in practice have derivatives at all points or almost every point. Early in the history of calculus, many mathematicians assumed that a continuous function was differentiable at most points. Under mild conditions (for example, if the function is a monotone or a Lipschitz function), this is true. However, in 1872, Weierstrass found the first example of a function that is continuous everywhere but differentiable nowhere. This example is now known as the Weierstrass function. In 1931, Stefan Banach proved that the set of functions that have a derivative at some point is a meager set in the space of all continuous functions. Informally, this means that hardly any random continuous functions have a derivative at even one point.

Notation
One common symbol for the derivative of a function is Leibniz notation. They are written as the quotient of two differentials $$ dy $$ and $$ dx $$, which were introduced by Gottfried Wilhelm Leibniz in 1675. It is still commonly used when the equation $$y=f(x)$$ is viewed as a functional relationship between dependent and independent variables. The first derivative is denoted by $\frac{dy}{dx} $, read as "the derivative of $$ y $$ with respect to $$ x $$". This derivative can alternately be treated as the application of a differential operator to a function, $\frac{dy}{dx} = \frac{d}{dx} f(x).$ Higher derivatives are expressed using the notation $ \frac{d^n y}{dx^n} $  for the $$n$$-th derivative of $$y = f(x)$$. These are abbreviations for multiple applications of the derivative operator; for example, $\frac{d^2y}{dx^2} = \frac{d}{dx}\Bigl(\frac{d}{dx} f(x)\Bigr).$ Unlike some alternatives, Leibniz notation involves explicit specification of the variable for differentiation, in the denominator, which removes ambiguity when working with multiple interrelated quantities. The derivative of a composed function can be expressed using the chain rule: if $$u = g(x)$$ and $$y = f(g(x))$$ then $\frac{dy}{dx} = \frac{dy}{du} \cdot \frac{du}{dx}.$

Another common notation for differentiation is by using the prime mark in the symbol of a function $$ f(x) $$. This is known as prime notation, due to Joseph-Louis Lagrange. The first derivative is written as $$ f'(x) $$, read as "$$ f $$ prime of $$ x $$", or $$ y' $$, read as "$$ y $$ prime". Similarly, the second and the third derivatives can be written as $$ f $$ and $$ f' $$, respectively. For denoting the number of higher derivatives beyond this point, some authors use Roman numerals in superscript, whereas others place the number in parentheses, such as $$f^{\mathrm{iv}}$$ or $$ f^{(4)}.$$ The latter notation generalizes to yield the notation $$f^{(n)}$$ for the $n$-th derivative of $$f$$.

In Newton's notation or the dot notation, a dot is placed over a symbol to represent a time derivative. If $$ y $$ is a function of $$ t $$, then the first and second derivatives can be written as $$\dot{y}$$ and $$\ddot{y}$$, respectively. This notation is used exclusively for derivatives with respect to time or arc length. It is typically used in differential equations in physics and differential geometry. However, the dot notation becomes unmanageable for high-order derivatives (of order 4 or more) and cannot deal with multiple independent variables.

Another notation is D-notation, which represents the differential operator by the symbol $$D.$$ The first derivative is written $$D f(x)$$ and higher derivatives are written with a superscript, so the $$n$$-th derivative is $$D^nf(x).$$ This notation is sometimes called Euler notation, although it seems that Leonhard Euler did not use it, and the notation was introduced by Louis François Antoine Arbogast. To indicate a partial derivative, the variable differentiated by is indicated with a subscript, for example given the function $$u = f(x, y),$$ its partial derivative with respect to $$x$$ can be written $$D_x u$$ or $$D_x f(x,y).$$ Higher partial derivatives can be indicated by superscripts or multiple subscripts, e.g. $D_{xy} f(x,y) = \frac{\partial}{\partial y} \Bigl(\frac{\partial}{\partial x} f(x,y) \Bigr)$ and $D_{x}^2 f(x,y) = \frac{\partial}{\partial x} \Bigl(\frac{\partial}{\partial x} f(x,y) \Bigr)$.

Rules of computation
In principle, the derivative of a function can be computed from the definition by considering the difference quotient and computing its limit. Once the derivatives of a few simple functions are known, the derivatives of other functions are more easily computed using rules for obtaining derivatives of more complicated functions from simpler ones. This process of finding a derivative is known as differentiation.

Rules for basic functions
The following are the rules for the derivatives of the most common basic functions. Here, $$ a $$ is a real number, and $$ e $$ is the mathematical constant approximately 2.71828.

 * Derivatives of powers:
 * $$ \frac{d}{dx}x^a = ax^{a-1} $$

 * Functions of exponential, natural logarithm, and logarithm with general base:
 * $$ \frac{d}{dx}e^x = e^x $$
 * $$ \frac{d}{dx}a^x = a^x\ln(a) $$, for $$ a > 0 $$
 * $$ \frac{d}{dx}\ln(x) = \frac{1}{x} $$, for $$ x > 0 $$
 * $$ \frac{d}{dx}\log_a(x) = \frac{1}{x\ln(a)} $$, for $$ x, a > 0 $$

 * Trigonometric functions:
 * $$ \frac{d}{dx}\sin(x) = \cos(x) $$
 * $$ \frac{d}{dx}\cos(x) = -\sin(x) $$
 * $$ \frac{d}{dx}\tan(x) = \sec^2(x) = \frac{1}{\cos^2(x)} = 1 + \tan^2(x) $$

 * Inverse trigonometric functions:
 * $$ \frac{d}{dx}\arcsin(x) = \frac{1}{\sqrt{1-x^2}} $$, for $$ -1 < x < 1 $$
 * $$ \frac{d}{dx}\arccos(x)= -\frac{1}{\sqrt{1-x^2}} $$, for $$ -1 < x < 1 $$
 * $$ \frac{d}{dx}\arctan(x)= \frac{1} $$

Rules for combined functions
Given that the $$ f $$ and $$ g $$ are the functions. The following are some of the most basic rules for deducing the derivative of functions from derivatives of basic functions.
 * Constant rule: if $$f$$ is constant, then for all $$x$$,
 * $$f'(x) = 0. $$
 * Sum rule:
 * $$(\alpha f + \beta g)' = \alpha f' + \beta g' $$ for all functions $$f$$ and $$g$$ and all real numbers $$\alpha$$ and $$\beta$$.
 * Product rule:
 * $$(fg)' = f 'g + fg' $$ for all functions $$f$$ and $$g$$. As a special case, this rule includes the fact $$(\alpha f)' = \alpha f'$$ whenever $$\alpha$$ is a constant because $$\alpha' f = 0 \cdot f = 0$$ by the constant rule.
 * Quotient rule:
 * $$\left(\frac{f}{g} \right)' = \frac{f'g - fg'}{g^2}$$ for all functions $$f$$ and $$g$$ at all inputs where g ≠ 0.
 * Chain rule for composite functions: If $$f(x) = h(g(x))$$, then
 * $$f'(x) = h'(g(x)) \cdot g'(x). $$

Computation example
The derivative of the function given by $$f(x) = x^4 + \sin \left(x^2\right) - \ln(x) e^x + 7$$ is $$ \begin{align} f'(x) &= 4 x^{(4-1)}+ \frac{d\left(x^2\right)}{dx}\cos \left(x^2\right) - \frac{d\left(\ln {x}\right)}{dx} e^x - \ln(x) \frac{d\left(e^x\right)}{dx} + 0 \\ &= 4x^3 + 2x\cos \left(x^2\right) - \frac{1}{x} e^x - \ln(x) e^x. \end{align} $$ Here the second term was computed using the chain rule and the third term using the product rule. The known derivatives of the elementary functions $$ x^2 $$, $$ x^4 $$, $$ \sin (x) $$, $$ \ln (x) $$, and $$ \exp(x) = e^x $$, as well as the constant $$ 7 $$, were also used.

Higher-order derivatives
Higher order derivatives means that a function is differentiated repeatedly. Given that $$ f $$ is a differentiable function, the derivative of $$ f $$ is the first derivative, denoted as $$ f' $$. The derivative of $$ f' $$ is the second derivative, denoted as $$ f $$, and the derivative of $$ f $$ is the third derivative, denoted as $$ f''' $$. By continuing this process, if it exists, the $ n $-th derivative as the derivative of the $ (n - 1) $-th derivative or the derivative of order $$ n $$. As has been discussed above, the generalization of derivative of a function $$ f $$ may be denoted as $$ f^{(n)} $$. A function that has $$ k $$ successive derivatives is called $$ k $$ times differentiable. If the $ k $-th derivative is continuous, then the function is said to be of differentiability class $$ C^k $$. A function that has infinitely many derivatives is called infinitely differentiable or smooth. One example of the infinitely differentiable function is polynomial; differentiate this function repeatedly results the constant function, and the infinitely subsequent derivative of that function are all zero.

In one of its applications, the higher-order derivatives may have specific interpretations in physics. Suppose that a function represents the position of an object at the time. The first derivative of that function is the velocity of an object with respect to time, the second derivative of the function is the acceleration of an object with respect to time, and the third derivative is the jerk.

Vector-valued functions
A vector-valued function $$ \mathbf{y} $$ of a real variable sends real numbers to vectors in some vector space $$ \R^n $$. A vector-valued function can be split up into its coordinate functions $$ y_1(t), y_2(t), \dots, y_n(t) $$, meaning that $$ \mathbf{y} = (y_1(t), y_2(t), \dots, y_n(t))$$. This includes, for example, parametric curves in $$ \R^2 $$ or $$ \R^3 $$. The coordinate functions are real-valued functions, so the above definition of derivative applies to them. The derivative of $$ \mathbf{y}(t) $$ is defined to be the vector, called the tangent vector, whose coordinates are the derivatives of the coordinate functions. That is, $$ \mathbf{y}'(t)=\lim_{h\to 0}\frac{\mathbf{y}(t+h) - \mathbf{y}(t)}{h}, $$ if the limit exists. The subtraction in the numerator is the subtraction of vectors, not scalars. If the derivative of $$ \mathbf{y} $$ exists for every value of $$ t $$, then $$ \mathbf{y} $$ is another vector-valued function.

Partial derivatives
Functions can depend upon more than one variable. A partial derivative of a function of several variables is its derivative with respect to one of those variables, with the others held constant. Partial derivatives are used in vector calculus and differential geometry. As with ordinary derivatives, multiple notations exist: the partial derivative of a function $$f(x, y, \dots)$$ with respect to the variable $$x$$ is variously denoted by

among other possibilities. It can be thought of as the rate of change of the function in the $$x$$-direction. Here ∂ is a rounded d called the partial derivative symbol. To distinguish it from the letter d, ∂ is sometimes pronounced "der", "del", or "partial" instead of "dee". For example, let $$f(x,y) = x^2 + xy + y^2$$, then the partial derivative of function $$ f $$ with respect to both variables $$ x $$ and $$ y $$ are, respectively: $$ \frac{\partial f}{\partial x} = 2x + y, \qquad \frac{\partial f}{\partial y} = x + 2y.$$ In general, the partial derivative of a function $$ f(x_1, \dots, x_n) $$ in the direction $$ x_i $$ at the point $$(a_1, \dots, a_n) $$ is defined to be: $$\frac{\partial f}{\partial x_i}(a_1,\ldots,a_n) = \lim_{h \to 0}\frac{f(a_1,\ldots,a_i+h,\ldots,a_n) - f(a_1,\ldots,a_i,\ldots,a_n)}{h}.$$

This is fundamental for the study of the functions of several real variables. Let $$ f(x_1, \dots, x_n) $$ be such a real-valued function. If all partial derivatives $$ f $$ with respect to $$ x_j $$ are defined at the point $$ (a_1, \dots, a_n) $$, these partial derivatives define the vector $$\nabla f(a_1, \ldots, a_n) = \left(\frac{\partial f}{\partial x_1}(a_1, \ldots, a_n), \ldots, \frac{\partial f}{\partial x_n}(a_1, \ldots, a_n)\right),$$ which is called the gradient of $$ f $$ at $$ a $$. If $$ f $$ is differentiable at every point in some domain, then the gradient is a vector-valued function $$ \nabla f $$ that maps the point $$ (a_1, \dots, a_n) $$ to the vector $$ \nabla f(a_1, \dots, a_n) $$. Consequently, the gradient determines a vector field.

Directional derivatives
If $$ f $$ is a real-valued function on $$ \R^n $$, then the partial derivatives of $$ f $$ measure its variation in the direction of the coordinate axes. For example, if $$ f $$ is a function of $$ x $$ and $$ y $$, then its partial derivatives measure the variation in $$ f $$ in the $$ x $$ and $$ y $$ direction. However, they do not directly measure the variation of $$ f $$ in any other direction, such as along the diagonal line $$ y = x $$. These are measured using directional derivatives. Choose a vector $$ \mathbf{v} = (v_1,\ldots,v_n) $$, then the directional derivative of $$ f $$ in the direction of $$ \mathbf{v} $$ at the point $$ \mathbf{x} $$ is: $$ D_{\mathbf{v}}{f}(\mathbf{x}) = \lim_{h \rightarrow 0}{\frac{f(\mathbf{x} + h\mathbf{v}) - f(\mathbf{x})}{h}}.$$

If all the partial derivatives of $$ f $$ exist and are continuous at $$ \mathbf{x} $$, then they determine the directional derivative of $$ f $$ in the direction $$ \mathbf{v} $$ by the formula: $$ D_{\mathbf{v}}{f}(\mathbf{x}) = \sum_{j=1}^n v_j \frac{\partial f}{\partial x_j}. $$

Total derivative, total differential and Jacobian matrix
When $$ f $$ is a function from an open subset of $$ \R^n $$ to $$ \R^m $$, then the directional derivative of $$ f $$ in a chosen direction is the best linear approximation to $$ f $$ at that point and in that direction. However, when $$ n > 1 $$, no single directional derivative can give a complete picture of the behavior of $$ f $$. The total derivative gives a complete picture by considering all directions at once. That is, for any vector $$ \mathbf{v} $$ starting at $$ \mathbf{a} $$, the linear approximation formula holds: $$f(\mathbf{a} + \mathbf{v}) \approx f(\mathbf{a}) + f'(\mathbf{a})\mathbf{v}.$$ Similarly with the single-variable derivative, $$ f'(\mathbf{a}) $$ is chosen so that the error in this approximation is as small as possible. The total derivative of $$ f $$ at $$ \mathbf{a} $$ is the unique linear transformation $$ f'(\mathbf{a}) \colon \R^n \to \R^m $$ such that $$\lim_{\mathbf{h}\to 0} \frac{\lVert f(\mathbf{a} + \mathbf{h}) - (f(\mathbf{a}) + f'(\mathbf{a})\mathbf{h})\rVert}{\lVert\mathbf{h}\rVert} = 0.$$ Here $$ \mathbf{h} $$ is a vector in $$ \R^n $$, so the norm in the denominator is the standard length on $$ \R^n $$. However, $$ f'(\mathbf{a}) \mathbf{h} $$ is a vector in $$ \R^m $$, and the norm in the numerator is the standard length on $$ \R^m $$. If $$ v $$ is a vector starting at $$ a $$, then $$ f'(\mathbf{a}) \mathbf{v} $$ is called the pushforward of $$ \mathbf{v} $$ by $$ f $$.

If the total derivative exists at $$ \mathbf{a} $$, then all the partial derivatives and directional derivatives of $$ f $$ exist at $$ \mathbf{a} $$, and for all $$ \mathbf{v} $$, $$ f'(\mathbf{a})\mathbf{v} $$ is the directional derivative of $$ f $$ in the direction $$ \mathbf{v} $$. If $$ f $$ is written using coordinate functions, so that $$ f = (f_1, f_2, \dots, f_m) $$, then the total derivative can be expressed using the partial derivatives as a matrix. This matrix is called the Jacobian matrix of $$ f $$ at $$ \mathbf{a} $$: $$f'(\mathbf{a}) = \operatorname{Jac}_{\mathbf{a}} = \left(\frac{\partial f_i}{\partial x_j}\right)_{ij}.$$ <!-- The existence of the total derivative $$ f(\mathbf{a}) $$ is strictly stronger than the existence of all the partial derivatives, but if the partial derivatives exist and are continuous, then the total derivative exists, is given by the Jacobian, and depends continuously on $$ \mathbf{a} $$.

The definition of the total derivative subsumes the definition of the derivative in one variable. That is, if $$ f $$ is a real-valued function of a real variable, then the total derivative exists if and only if the usual derivative exists. The Jacobian matrix reduces to a 1×1 matrix whose only entry is the derivative $$ f'(x) $$. This 1×1 matrix satisfies the property that $$ f(a+h) \approx f(a) + f'(a)h.$$ Up to changing variables, this is the statement that the function $$x \mapsto f(a) + f'(a)(x-a)$$ is the best linear approximation to $$ f $$ at $$ a $$.

The total derivative of a function does not give another function in the same way as the one-variable case. This is because the total derivative of a multivariable function has to record much more information than the derivative of a single-variable function. Instead, the total derivative gives a function from the tangent bundle of the source to the tangent bundle of the target.

The natural analog of second, third, and higher-order total derivatives is not a linear transformation, is not a function on the tangent bundle, and is not built by repeatedly taking the total derivative. The analog of a higher-order derivative, called a jet, cannot be a linear transformation because higher-order derivatives reflect subtle geometric information, such as concavity, which cannot be described in terms of linear data such as vectors. It cannot be a function on the tangent bundle because the tangent bundle only has room for the base space and the directional derivatives. Because jets capture higher-order information, they take as arguments additional coordinates representing higher-order changes in direction. The space determined by these additional coordinates is called the jet bundle. The relation between the total derivative and the partial derivatives of a function is paralleled in the relation between the $ k $-th order jet of a function and its partial derivatives of order less than or equal to $$ k $$.

By repeatedly taking the total derivative, one obtains higher versions of the Fréchet derivative, specialized to $$ \R^p $$. The $ k $-th order total derivative may be interpreted as a map $$ D^k f: \mathbb{R}^n \to L^k(\mathbb{R}^n \times \cdots \times \mathbb{R}^n, \mathbb{R}^m), $$ which takes a point $$ \mathbf{x} $$ in $$ \R^n $$ and assigns to it an element of the space of $ k $-linear maps from $$ \R^n $$ to $$ \R^m $$ — the "best" (in a certain precise sense) $ k $-linear approximation to $$ f $$ at that point. By precomposing it with the diagonal map $$ \Delta $$, $$ \mathbf{x} \to (\mathbf{x}, \mathbf{x}) $$, a generalized Taylor series may be begun as $$\begin{align} f(\mathbf{x}) & \approx f(\mathbf{a}) + (D f)(\mathbf{x-a}) + \left(D^2 f\right)(\Delta(\mathbf{x-a})) + \cdots\\ & = f(\mathbf{a}) + (D f)(\mathbf{x - a}) + \left(D^2 f\right)(\mathbf{x - a}, \mathbf{x - a})+ \cdots\\ & = f(\mathbf{a}) + \sum_i (D f)_i (x_i-a_i) + \sum_{j, k} \left(D^2 f\right)_{j k} (x_j-a_j) (x_k-a_k) + \cdots \end{align}$$ where $$ f(\mathbf{a}) $$ is identified with a constant function, $$ x_i - a_i $$ are the components of the vector $$ \mathbf{x}- \mathbf{a} $$, and $$ (Df)_i $$ and $$ (D^2 f)_{jk} $$ are the components of $$ Df $$ and $$ D^2 f $$ as linear transformations.-->

Generalizations
The concept of a derivative can be extended to many other settings. The common thread is that the derivative of a function at a point serves as a linear approximation of the function at that point.
 * An important generalization of the derivative concerns complex functions of complex variables, such as functions from (a domain in) the complex numbers $$\C$$ to $$\C$$. The notion of the derivative of such a function is obtained by replacing real variables with complex variables in the definition. If $$\C$$ is identified with $$\R^2$$ by writing a complex number $$z$$ as $$x+iy$$, then a differentiable function from $$\C$$ to $$\C$$ is certainly differentiable as a function from $$\R^2$$ to $$\R^2$$ (in the sense that its partial derivatives all exist), but the converse is not true in general: the complex derivative only exists if the real derivative is complex linear and this imposes relations between the partial derivatives called the Cauchy–Riemann equations – see holomorphic functions.
 * Another generalization concerns functions between differentiable or smooth manifolds. Intuitively speaking such a manifold $$M$$ is a space that can be approximated near each point $$x$$ by a vector space called its tangent space: the prototypical example is a smooth surface in $$\R^3$$. The derivative (or differential) of a (differentiable) map $$f:M\to N$$ between manifolds, at a point $$x$$ in $$M$$, is then a linear map from the tangent space of $$M$$ at $$x$$ to the tangent space of $$N$$ at $$f(x)$$. The derivative function becomes a map between the tangent bundles of $$M$$ and $$N$$. This definition is used in differential geometry.
 * Differentiation can also be defined for maps between vector space, such as Banach space, in which those generalizations are the Gateaux derivative and the Fréchet derivative.
 * One deficiency of the classical derivative is that very many functions are not differentiable. Nevertheless, there is a way of extending the notion of the derivative so that all continuous functions and many other functions can be differentiated using a concept known as the weak derivative. The idea is to embed the continuous functions in a larger space called the space of distributions and only require that a function is differentiable "on average".
 * Properties of the derivative have inspired the introduction and study of many similar objects in algebra and topology; an example is differential algebra. Here, it consists of the derivation of some topics in abstract algebra, such as rings, ideals, field, and so on.
 * The discrete equivalent of differentiation is finite differences. The study of differential calculus is unified with the calculus of finite differences in time scale calculus.
 * The arithmetic derivative involves the function that is defined for the integers by the prime factorization. This is an analogy with the product rule.

title: Derivative