format: text

text:
# Proper Motions in Compact Symmetric Objects

## 1 Introduction

The term “Compact Symmetric Objects” (CSOs) was first coined by Wilkinson et al (1994) to describe sub-kiloparsec scale sources having symmetric radio structure. Often these sources are doubles or triples (Conway et al 1992), where the central component is compact and is consistent with being the centre of activity (Taylor et al 1996). CSOs often have a radio spectrum which peaks around a few GHz and thus belong to the class of Gigahertz Peaked Spectrum (GPS) sources. However this is not universally the case, for instance the radio spectrum of the prototype CSO 2352+495 is quite flat (e.g. Readhead et al 1996 (RPX96)). This turns out to be due to the superposition of components which peak at different frequencies. GPS radio galaxies all seem to be CSOs with relatively simple structures, but more complex CSOs sometimes do not have a GPS spectrum. Most GPS quasars do not seem to have CSO structures and may be a separate class of object. The radio structures of the CSOs are similar to the large, kiloparsec and megaparsec sized, double-sided radio sources (dubbed ’classical doubles’) but are approximately 1000 times smaller.

The physical origin of Compact Symmetric Objects has been discussed for many years. While soon after the detection of the first examples it was suggested (Philips & Mutel 1982) that they are young radio sources which would evolve into large radio sources, alternative suggestions have also been proposed: CSOs could be ’frustrated’, ie. located in a dense environment that could inhibit the growth of the radio structure. CSOs could also be young radio sources, that will ’fizzle’ out and die young (Readhead et al 1994) or stages of intermittent radio activity (Reynolds & Begelman 1997).

## 2 Observations of Velocities in CSOs

CSOs usually contain compact and bright compact ‘hotspot’ components located at the extremities of the source consistent with them being the working surface of the jets as it propagates through the ISM. Using multi-epoch VLBI observations it is possible to measure or set limits on the rate of separation of their hotspots.

### 2.1 Observational Summary

The first upper limits on the rate of hotspot separation in CSOs (Tzioumis et al 1989) showed that their velocities were sub-relativistic and hence much smaller than the core-jet objects. Conway et al (1994) measured possible sub-relativistic motions in two CSOs but because these were based on only two epochs of data they were not claimed as definite detections. The first unambiguous detections of CSO expansion were reported in the CSOs 0710+439 (Owsianik & Conway 1998, OC98) and 0108+388 (Owsianik et al 1998, OCP98) based on multi-epoch VLBI observations over a decade or more. Since then, detections or upper limits on expansion have been determined for thirteen CSOs (Table 1). In the first two parts of Table 1 we show the detections and limits on the separation velocities of outer (hotspot) components. For some sources there are multiple speed estimates in the literature made at different frequencies over different time intervals, in this case the one quoted in Table 1 is the one with lowest error. The angular speed given is the rate at which outer hotspot components increase their separation, this is the relevant quantity for calculating sources ages. A few sources such as 1031+567 (Taylor et al 2000, TMP00) and 0108+388 (Owsianik et al, in prep) may also have significant side-to-side motions, so the total relative velocity between two hotspots quoted in some papers may be larger than those in Table 1. Amongst the detections the rate of expansion ranges between 0.1$`h^1c`$ and $``$0.4$`h^1c`$, the unweighted mean value being 0.19$`h^1c`$ (0.17$`h^1c`$ including the limits).

In several cases motions have been detected for components which are not at the edges of the source, these internal component velocities are listed in the third part of Table 1. In these cases we may be measuring outward velocities of jet components. These internal velocities, as expected for a jet component origin, are larger than for the hotspot components. In most cases these results are consistent with the jet components moving with Lorentz $`\gamma `$ between 2-5, but at relatively large angles to the line of sight.

The longest possible temporal coverage is obviously important in getting good speed estimates (Table 1 shows the number of epochs and the temporal coverage of the sources so far). In the sources 0710+439 (OC98), 0108+388 (OCP98) and 2352+495 (Polatidis et al 2002, POC02), the $`\lambda `$6 cm VLBI observations cover by now almost 20 years and consist of 5–7 measurements (epochs) per source (see Figure 1a for CSO 0710+439). With such data it is possible to do meaningful regression analysis from which error bars on the velocity can be estimated robustly. In these cases all the ordinary least sqares methods (e.g. Isobe et al 1990) gave consistent values (withing the errors) for the rate of expansion. In contrast measurements based on only a couple of epochs require error bars based on a priori estimates of the accuracy to which component positions can be measured (usually taken as 1/10 of a beam or the beam size/signal-to-noise ratio). For long tracks, simple sources and high enough map signal-to-noise on each component (i.e. SNR$`>20`$) regression analysis for 0710+439 and 2352+495 shows that such a priori position error estimates are plausible. However a minimum of three epochs is probably required to feel fully confident of a real velocity detection.

### 2.2 Multiple Frequencies and Temporal Variations

Measurements of the hotspot separation velocities in Table 1 have been made at different frequencies; most often at 5 GHz (e.g. OC98, OCP98, POC02, Tschager et al 2000), at 8.4 GHz (e.g Polatidis et al 1999 and this paper) or 15 GHz (e.g. TMP00). Generally if a source has been monitored at more than one frequency the derived velocities are similar. For example, for 1943+546 we report an expansion velocity (Fig 1b), from three epoch (1993.1-2000.4) measurements at 8.4 GHz, of $`v_{sep}=0.26\pm 0.04h^1`$c which is within the errors with that independently derived using four epoch (1991.7-2000.4) 5GHz VLBI observations ($`v_{sep}=0.28\pm 0.06h^1`$c).

In the case of 2352+495, TMP00, based on two epoch 15GHz observations (1994.9-1999.5), reported a velocity more than twice as large as the 20 year average at 5GHz (see POC02). However restricting the analysis to the three 5GHz epochs (and additional two 8GHz epochs) which cover a similar time period as the two 15GHz epochs (1993.3-1997.7) a consistent high velocity is found. The higher velocity found over a short period may therefore be due to real temporal variations in the hotspot advance speeds.

### 2.3 Individual Hotspot Advance Speeds

In cases where there is a strong, unambiguously identified core we can attempt to measure the advance speed of each of the two hotspots separately. In some cases apparent differences are seen. For example in 1943+546 while the eastern (and more distant from the core) hotspot moves away from the core with $`v_{hot}`$=0.25$`\pm 0.03h^1`$c. the nearer western hotspot is apparently barely moving (with a projected velocity of 0.01$`\pm 0.01h^1`$c) away from the core. Different individual hotspot advance speeds are seen in a few other sources where the core is identified (e.g. 0710+439, OC98). These measurements are very difficult, especially at 5GHz where CSO core components are weak. We should remember that if weak jet components are emerging from the core its apparent position can vary, invalidating the separate core-hotspot velocities.

If different oppositely directed hotspot transverse velocities are really being observed in 1943+546 and 0710+439 and assuming simultaneous ejection from the core then it immediately implies that hotspot advance speeds vary with time during the lifetime of the source. If they were instead constant then the hotspot velocity ratio would equal the hotspot-core-hotspot arm length ratio which is not the case. For instance the two sigma lower limit on the hotspot velocity ratio in 1943+546 is 6.8 yet the arm length ratio is only 1.68. Additional evidence for hotspot advance speed variability may also be available from observations of 2352+495 (see Section 2.2). Temporal variations in hotspot advance speed could be produced by hydrodynamically introduced internal pressure changes or changes in external density. In hydrodynamic simulations through a smooth medium Norman (1996) found variations in hotspot pressures, causing variations in hotspot advance speed of about a factor of two. Such different hotspot advance speeds are consistent with differences in the hotspot pressures within CSOs of order 5 (e.g. RPX96,OC98). In both 0710+439 and 1943+546 it is the highest pressure hotspot which is moving fastest, as expected. However the magnitude of the difference in advance speed in 1943+546 seems too large to explain by pressure variations, in this case it is more likely due to variations in external density. Perhaps in 1943+546 the eastern hotspot is moving through an intercloud medium while the western hotspot is encountering a cloud.

### 2.4 Side-to-Side motions

An assumption that is often made in source evolution models is that the pressure of the hotspot is effectively distributed over a larger area than that of the hotspot itself (the so-called “dentist’s drill” model, Scheuer 1982). In this model the hotspot has larger side-to-side motions than its forward motion, and averaged over time the area over which thrust is distributed is therefore increased. Observations of CSOs seem to show that such side-to-side motions are in fact much smaller than forward motions.(e.g POC02, Polatidis et al in prep). The possible exceptions are 0108+388 (Owsianik et al in prep) and 1031+567 (TMP00). It is important in future when reporting velocities to distinguish between the velocity components along and perpendicular to the source axis. By detecting or setting limits on perpendicular velocities the impact of side-to-side motions on source evolution can be assessed.

### 2.5 Expansion in Recurrent Sources

In general, most CSOs have no large scale radio emission which might be a sign of recurrent activity. There are however a couple of sources in which weak extended emission has been detected, e.g. 0108+388 (e.g. Owsianik et al 1998), 1345+125 and OQ208 (Stanghellini et al 2002, these proceedings). In addition to these cases there also exist extreme examples of ‘double-double’ sources in which the central double has CSO-sized dimensions. For example the z=0.107 radio galaxy 1245+676 has a triple radio morphology (0.97 Mpc in extent, Lara et al 2001) and radio luminosity typical of an FR II galaxy except for the fact that the central component dominates the flux density ($``$67% at 1.4 GHz) and hence the total radio spectrum, and is similar to the GPS sources. At parsec scale resolution, the core appears as a Compact Symmetric Object. Its 9.6 parsec structure is dominated by two mini-lobes containing hotspots; a slightly inverted spectrum, weak component, located close to the centre of the structure is tentatively identified with the core. VLBI observations at 5GHz (1989.7-2001.5) have shown that the hotspots move apart with a velocity of 0.163$`\pm 0.008h^1`$c (Marecki et al, these proceedings). This implies a kinematic age of 190 years for the core region. 1245+676 is by far the best example where the CSO appears to be the youngest phase of recurrent radio activity, hinting that at least some CSOs may be re-born radio sources.

## 3 Discussion

In the previous section we discussed the observations and specific sources. In this section we discuss more generally how the proper motions constrain the general properties of the CSO population.

### 3.1 Kinematic Ages of CSOs

The most direct result of the CSO expansion measurements are the low kinematic ages derived by dividing the projected source size by the measured projected separation velocities (see Table 1) which are all $`3\times 10^3`$ yrs. What is important here is not the exact number (which may be revised as new measurements are added) but rather the order of magnitude. This implies that CSOs are young objects. This constitutes so far the most direct way to estimate the age of an extragalactic radio source.

Before accepting these age estimates we should consider whether the measured source expansions (which represent the instantaneous hotspot separation rate) are truly representative of the mean growth rate of the sources. CSOs might conceivably expand in brief bursts when encountering a relatively low density medium, their advance being hindered by jet-cloud interactions during the rest of the time. If this were happening we would be measuring only the velocity of these brief expansion periods and hence severely underestimating their age. This is highly unlikely, given that we have measured expansion speeds in a very high fraction of the sources where we have good data (10 of 13 cases, Table 1). This implies that the instantaneously measured separation velocities are consistent with the mean hotspot separation speed and that the kinematically estimated ages are an accurate representation of the radio source lifetime.

### 3.2 Other Age Estimates and Equipartition

Age estimates for CSOs have also been made by indirect means. Readhead et al (1996) applied the classical ’waste energy basket’ argument to 2352+495 and derived an age of $``$3000 years, which is similar to the kinematical age of 3003 years (POC02). There have also been attempts to estimate the age of CSOs and the larger double sources (MSOs) via the detection of high frequency breaks in their spectra due to ageing of the electrons in the lobes. Minimum energy and equipartition conditions are also usually assumed. The estimated spectral ages (eg. RPX96, Murgia et al 1998) are 10$`{}_{}{}^{3}10^4`$ years, similar to the kinematic ages. In fact Murgia (these proceedings) derives a spectral age for 1943+546, very close to the kinematic age of 1297 years.

The close agreement of kinematic and other age estimates suggests that most CSOs are indeed young radio loud sources. The agreement also shows that particle and fields are probably close to equipartition in CSOs and that the standard model of radiative ageing is roughly correct. These are important results since it is very unclear whether equipartition and standard spectral ageing apply in classical double sources (see Blundell and Rawlings 2000, Rudnick 2002).

### 3.3 Velocity Correlations

We have searched for possible correlations (Polatidis et al, in prep) between separation velocity and luminosity, redshift, source size and arm length ratio (see Sec 3.4). We find an apparent correlation with redshift (with a correlation coefficient $`\rho `$=0.752) but no correlation with source size (see Fig 2) or luminosity. However this apparent correlation might be observationally biased. Slowly expanding sources will be hard to detect at larger z, so we would not expect the bottom right of the velocity-z graph to be filled.

### 3.4 Hotspot Advance Speeds and Source Orientations

Proper motion observations obviously give only the velocities projected on the sky plane. We would like to estimate the hotspot advance speeds through their surrounding medium which can in turn be used to constrain external densities via ram pressure arguments. The absence of superluminal motions and relativistic beaming together with the edge brightened source morphologies seems consistent with CSOs being isotropically orientated. In this case the projected hotpot advance speeds are on average half of their total speeds. Hence the mean advance speed of each hotspot through its external medium would equal the mean projected hotspot separation velocity or 0.19$`h^1c`$ (see Sect 2.1).

Assuming only light travel time effects, one could try to derive the deprojected hotspot advance velocity and the angle to the line of sight using both the arm-length ratio and the observed velocities. Fig 3a shows the measured arm-length rations and hotspot separation velocities for the nine sources with a detection in Table 1 for which the core has been identified (except for 1031+567). Figure 3b shows the deprojected hotspot advance velocities and the inferred angle to line of sight assuming all the asymmetry is due to light travel time effects. Of course it is likely that part of the arm-length asymmetry is intrinsic and not light travel time induced.

### 3.5 Evolution of CSOs

Measured CSOs expansions show that they are young sources, however the subsequent evolution of these sources is less clear. The simplest assumption is that CSOs evolve into classical double sources like Cygnus A. Alternatively CSOs could comprise a population of short lived sources which ’fizzle-out’ after a short lifetime. Answering the question of CSOs subsequent evolution requires studying the population densities of different sizes of source. However the CSO velocities also provide some constraint on models, because subsequent evolution cannot give significantly larger hotspot velocities or else relativistic effects would be seen. In addition the velocity measurements, assuming ram pressure confinement of the hotspots by the ISM, constrain the external densities at distances of a few to a few hundred parsecs from the centre of activity to be of order 1 cm<sup>-3</sup> (e.g. RPX96, OC98, Conway 2002) which implies that the external density is not power law down to parsec scales but rather has a King profile with scale length of order 1kpc. Such a turnover may also explain the redshift distribution of GPS and larger sources (Snellen et al 1999).

O’Dea & Baum (1997) found that the relative number of MSOs and large scale sources were roughly consistent with an evolution model in which sources expand into a medium with decreasing density with radius and undergo the expected negative luminosity evolution. However in this model given the external density turnover at $`<1`$kpc one would expect there to be very much fewer sub 100pc sized sources than are observed. Such an excess may imply that CSOs belong mainly to a separate population of short lived sources, however it is possible that luminosity selection effects influence this result (viz Snellen et al 1999). An alternative explanation is that for some reason small CSOs are closer to equipartition (see Section 3.2) than larger sources, which is an additional effect increasing their efficiency of converting jet energy to radio luminosity, which then boosts their representation in flux limited samples (Conway 2002).

## 4 Conclusions

The combination of proper motion studies in CSOs with other lines of evidence strongly argues that most CSOs are young objects. One of the main questions posed at the last GPS conference therefore seems to be answered.

A fundamental consequence of such CSO youth, which is often overlooked, is that narrow jets and hotspots apparently exist only a few hundred years after the start of the radio-loud activity. This very short characteristic time must strongly constrain the scales and mechanisms by which jets are formed and accelerated. If the source activity started with a wide angle wind or slowly accelerating outflow we would not see the CSO morphologies that we observe. One can summarize this as ’Jet activity starts like an electric motor and not like a steam engine’ (R.Blandford, private communication).

Having established the basic fact that CSOs are young, proper motion studies still have a lot to contribute. For instance its not yet clear whether all CSOs are young or if some are frustrated. Continued monitoring of sources with upper limits is therefore important. Finding the distribution of CSO velocities and looking for correlations with other quantities is another important goal to constrain evolution models. Long term monitoring can also reveal or set limit on hotspot accelerations/decelerations, different hotspot advance speeds in the same source or hotspot side-to-side motions; all are useful to constrain the dynamics of how radio sources evolve.

The rate at which new CSO motions are reported in the literature is encouraging for answering the above questions. We should however remember to continue to be very careful in our measurements and our interpretations (and remain very patient!) since detecting these very small angular velocities remains technically challenging.

## References

Blundell K.M., Rawlings, S., 2000, AJ, 119, 1111

Conway, J.E., et al 1992, ApJ, 396, 62.

Conway, J.E., et al, 1994, ApJ, 425, 568.

Conway, J.E., 2002, NewAR, 46, 2-7, 263

Isobe, T., et al, 1990, ApJ, 364, 104

Lara, L., et al, 2001, A&A, 370, 409

Marecki A., 2002, these proceedings

Murgia M., et al 1999, A&A, 345, 769.

Murgia M., 2002, these proceedings

Norman M., 1996, in ’Energy Transport in radio galaxies and Quasars’ PASP Conf Vol 100. p 405.

O’Dea C.P., 1998, PASP, 110, 493.

Owsianik, I., Conway, J, 1998, A&A, 337, 69 (OC98).

Owsianik, I., Conway, J., Polatidis, A., 1998, A&A, 336, L37. (OCP98)

Polatidis, A.G., Owsianik, I., Conway, J.E., 2002, A&A, sub. (POC02)

Phillips, R.B., Mutel, R.L., 1982, A&A, 106, 21

Polatidis, A.G., et al 1999, NewAR, 43/8-10, 657

Polatidis, A.G., 2001, in ”Similarities and Universalities of Relativistic Flows”, eds. M Georganopoulos et al., Logos Verlag, 96

Readhead A.C.S., et al 1994, in Proc.NRAO Workshop 23, 17

Readhead A.C.S., et al , 1996, ApJ, 460, 612. (RPX96)

Reynolds, C.S., Begelman M.C., 1997, ApJ, 487, L135.

Rudnick L., 2002, NewAR , 46, 2-7, 95.

Scheuer P., 1982, In Proc. IAU Symp 97, 163

Stanghellini C., Liu, X.,Dallacasa, D., Bondi, M., 2002a, NewAR, Vol 46, 287.

Stanghellini C., et al 2002b, these proceedings

Taylor, G.B., et al, 1996, ApJ, 463, 95

Taylor, G.B., Vermuelen, R.C., 1997, ApJ, 485, L9

Taylor, G.B., et al, 2000, ApJ, 541, 112 (TMP00)

Tschager, W. et al, 2000, A&A, 360, 887.

Tzioumis, A.K., et al, 1989, AJ, 98, 36

Wilkinson, P.N., Polatidis, A.G., et al 1994, ApJ, 432, L87.


text:
# Fast and secure key distribution using mesoscopic coherent states of light.

## I Introduction

Physical cryptography can create schemes providing two users, at distinct locations, with on-demand copies of a secure sequence of random bits of arbitrary length and at fast rates. These schemes could be of high value for commercial systems operating over long distances. Based on physical laws instead of mathematical complexities, communication with perfect secrecy could be guaranteed over an insecure channel in Vernam’s sense of a one-time-pad. Technology advances, therefore, such as enhanced computational power, should not affect the security of these schemes. The BB84 quantum protocol for key distribution bennett-brassard , the paradigm among protocols of this type, has been used in short distance applications alamos  but not in long distance networks. One fundamental reason is that the same no-cloning theorem that guarantees its security level prohibits the signal amplification necessary in long-haul communication links. No practical alternative quantum scheme using quantum repeaters or entangled states has yet been proposed although theoretical studies exist qrepeater . Other practical impediments are the slow speed of the photon sources and the large recovery time of single photon detectors.

Recently, Yuen proposed private  a ciphering scheme utilizing an $`M`$-ry bases system that was implemented for data encryption ykb ; qcmc02 . Ref. ykb  introduces the $`M`$-ry scheme and presents its first prototype-level implementation. Ref. qcmc02  gives a more complete description of these systems. Basically, in these cryptographic prototypes, known as $`\alpha \eta `$ ($`\alpha `$ standing for coherence and $`\eta `$ for efficiency) systems, the quantum noise inherent to coherent states forces different measurement results for the eavesdropper and the legitimate users that use a shared key in their measurements. This noise will increase the observational uncertainty preponderantly for the eavesdropper, Eve (E), rather than Alice (A) and Bob (B), the legitimate users. Although this noise is irreducible by nature to all observers, the knowledge of the key allows A and B to discard this noise while it points to the correct information. The very simple idea behind this is that, for each bit, the noise inherent to the stated and generated at the emitter is distributed without control among the output ports in Eve’s measurement apparatus while A and B use the key to select a single output port where the noise does not practically affect bit readings.

In this work a key distribution method is presented that also utilizes an $`M`$-ry bases ciphering scheme similar to the one described in ykb  for the purpose of data encryption. Each basis in the $`M`$-ry set of bases defines two orthogonal states whereas these bases are non-orthogonal among themselves bases . In these schemes a starting shared secret key is assumed between A and B. The phrase “key distribution” is being used here to denote that one party sends to the other random bits created by a truly random physical process. The exchange of random bits between A and B is done in such a way that the quantum noise of the light does not allow E to obtain the final random sequence shared by A and B. In contrast, a classical key expansion method could mean a process to generate mathematically –e.g., by one-way functions– two identical sets of random bits, one for each user, from a set of shared starting bits. Stream-ciphers, for example, generate a stream of pseudo-random bits from a starting key. However, this deterministic process produces correlations that can be detected by the eavesdropper. Known-plaintext attacks are particularly useful to exploit these correlations in classical cryptography. In the $`M`$-ry data encryption scheme, a stream cipher is used to generate the running key and the quantum noise of light protects against the correlations.

The key distribution method presented in this work uses physical sources to guarantee the true randomness of signals. As in the data encryption scheme, the quantum noise of light provides the ultimate basic protection against signal identification. After presenting a set of basic conditions to be obeyed by the system and the physical resources needed for A and B, the key distribution protocol will be described step-by-step. Each step will be followed by a brief description of its possible implementation using the described physical resources. Very briefly, these protocol steps describe how A and B succeed in sending new random sequences of bits from one to the other securely through judicious use of the quantum noise of light. This security is achieved by using a correct combination of average number of photons per bit and number of ciphering bases $`M`$, as will be shown. The bit encoding mechanism and the associated physical protection will then be discussed and a measure of the minimum probability of error forced by the system on the eavesdropper will be achieved. After showing that the system obeys the established conditions, conclusions will be presented.

## II Basic conditions

First, a set of conditions will be defined to specify the boundaries within which the problem has to be solved:
I) The eavesdropper is allowed to have full access to the random signal sequence being generated. Granting full access to the signal should be understood as similar to an opaque attack or, giving Eve a perfect quantum copy of the signal sequence. Anyway, Eve does not need to subtly tap the channel to obtain the signals. Eve could perform arbitrary measurements on this sequence or she could generate as many realistic (imperfect) copies as she wants. The unrestricted access to the signal sequence is the best (idealized) possible condition given to the eavesdropper.
II) Eve samples all signals near the source, such that energy loss does not affect her data.

It will be initially assumed that all parties have similar detectors; the simplest possible assumption would be of noiseless detectors with efficiency 1. However, it will be shown that although the eavesdropper needs high signal resolution to distinguish between two closest bases in the $`M`$-ry system and precision to identify a sent basis, the legitimate users do not need such strict conditions. Therefore, the detectors used by A and B can be less efficient. It will be demonstrated how one can implement a secure key distribution system where the minimum bit-by-bit eavesdropping probability of error can be arbitrarily set at the pure guessing value of 1/2.

As will be shown, the protection of this scheme does not rely on an intrusion detection mechanism, but instead on the measurement advantage enjoyed by A and B over the eavesdropper, thanks to the knowledge of the key.

## III The key distribution protocol

### III.1 Basic physical resources

The basic resources necessary for implementation of this key distribution protocol are sketched in Fig. 1. Two stations, A and B, are represented where the optical channel can be either free space or a fiber channel. Both sides have identical resources to operate as emitter or receiver one way . The OM’s are optical modulator systems performing polarization or phase modulation on mesoscopic coherent pulses of light.

Each party also possesses a fast speed physical random generator (PhRG) that produces binary outputs $`𝐑`$. PCI is a PC controlled interface card that can generate $`M`$ voltage levels. PBS is a polarizing beam splitter that is followed by two detectors designated by 0 and 1. This detection system can be used for polarized light signals. In the case of phase modulation the detection system should be modified accordingly.

### III.2 The protocol

Each of the seven protocol steps will be stated briefly (in italics) and for a more complete illustration of the scheme, a short description of one possible way to implement each step will follow:

1. Parties A and B share an initial secret random sequence (of length $`L_0`$) of bits $`𝐊_0`$.
How A and B will share this initial sequence is, of course, an important matter. Although current cryptography can provide enough security for sharing the short sequence $`𝐊_0`$ at this moment, it may be vulnerable to the evolution of computational power. Just as an example, $`𝐊_0`$ could be obtained in a secure way within a few years through the slow but proved secure BB84 key distribution system. The use of satellites to distribute quantum keys have been under study (See Ref. quantph03051  and references therein) and developments in this direction can be expected to produce fruits in a near future. Unless proved otherwise, the expected rates of this quantum key distribution will be low. The scheme studied in this paper aims to create a fast distribution rate once a short sequence $`𝐊_0`$ have been obtained - even through a slow process.

2. Party A generates a sequence (of length $`L_0`$) of true random bits R.
This sequence of bits $`𝐑`$ can be obtained from the binary output of the physical random generator (PhRG) as voltages $`V_R=V_+`$ or $`V_{}`$ that are going to be associated with bits 0 and 1. A possible visualization of such a process could be the voltage outputs $`V_i(i=1,2,\mathrm{})`$ within a short time window $`\mathrm{\Delta }t`$, around $`t_i`$, produced by a fast light detector, shot-noise limited, illuminated by a coherent light beam. The sign of these pulses, $`sign_i=(V_i\overline{V_i})/(|V_i\overline{V_i}|)`$, where $`\overline{V_i}`$ is the average pulse voltage, will feed a binary voltage source to provide the random bit sequence $`𝐑`$ zbinden .

3. A sends to B the random sequence $`𝐑(𝐑_1)`$ of length $`L_0`$ in blocks of size $`K_M`$. Ciphering each of these blocks uses $`K_M`$ bits from $`𝐊_0`$. The number of blocks to be ciphered in $`L_0`$ is $`L_0/K_M`$. A coherent state carrier is used with intensity $`n/`$bit.
In order to generate each cipher basis $`k(=0,1,\mathrm{}M1)`$, $`K_M(=\mathrm{log}_2M)`$ bits are used from the random sequence of bits $`𝐊_0`$ (e.g, $`k=b(K_M)2^{M1}+b(K_{M1})2^{M2}+\mathrm{}b(K_1)2^0`$). In other words, each $`k`$ basis of the $`M=2^{K_M}`$ set will be randomly defined by $`K_M`$ bits taken from $`𝐊_0`$. Each $`k`$ will be used to cipher a block sequence of size $`K_M`$ from $`𝐑_1`$. Ciphering $`𝐑_1`$ in blocks of size $`K_M`$ keeps the length of the transmitted bits constant and equal to $`L_0`$ (See randomize ).

From the experimental point of view, the signals provided by the PhRG and by the running key ($`𝐊_0`$) define voltage levels to be applied by the PCI to the optical modulator OM. Each voltage $`V_k`$ generated is associated with a specific basis of the $`M`$-ry scheme. The pulsed mesoscopic coherent state at the input (see Fig. 1) can be seen as a linearly polarized state of light. Orthogonal polarizations define bits 0 or 1. The input pulse is modified by the action of the OM into a state (e.g., elliptically polarized light) $`𝐘(𝐑,𝐊_0)`$ that is sent to B. Without the modulation given by $`V_k`$ the output signal would show the sequence $`𝐑`$ of orthogonally linearly polarized states (bits 0 and 1) on a single basis. The $`V_k`$ modulation converts these signals to a non-orthogonal set of $`M`$-ry states. A similar line of reasoning applies to phase modulated signals, where phases 0 and $`\pi `$ provide the two bits.

4. By knowing the sequence of bits $`𝐊_0`$, Bob demodulates the received sequence obtaining $`𝐑_1`$.
At the receiving station, by applying the shared key $`𝐊_0`$ Bob demodulates the changes introduced by A and reads the resulting true random stream $`𝐑_1`$ of orthogonally polarized light states. A and B now share a fresh sequence of random bits $`𝐑_1`$.

5. Bob obtains a fresh random sequence $`𝐑_2`$ from his PhRG and sends it to A, ciphering the sequence in blocks of size $`K_M`$. Ciphering bits are taken from the earlier sequence received $`𝐑_1`$.
Each sequence of bits, of length $`K_M`$, from $`𝐑_1`$ define the ciphering basis for $`K_M`$ fresh bits in $`𝐑_2`$. By knowing $`𝐑_1`$, A reads $`𝐑_2`$ with perfection. The first cycle is complete.

6. A and B continue to exchange random sequences as described in the first cycle.
Subsequent cycles can be performed and in each cycle, blocks of size $`K_M`$ are ciphered to keep the total length in each cycle constant and equal to $`L_0`$. A and B can then share sequences of random bits obtained from the PhRGs. A shared random sequence can be used to re-start a cycle by A or B whenever an interruption occurs.

7. A and B apply information reconciliation and privacy amplification to distill a final sequence of bits.
The process of privacy amplification discards bits in the sequence and, consequently, destroys the short-ranged bit-cipher correlations due to the block ciphering. As the PhRGs present no bit correlation, the final shared random sequence will present a similar statistical property.

These steps describe the protocol without discussing security aspects. However, being a physical protocol, it would be incomplete without specifying $`n`$ and $`M`$. These parameters have to be provided, under the initial conditions presented, and a quantitative measure of the security level associated with them has to be derived. This is the subject of the following sections.

## IV Bit encoding and the physical protecting mechanism

The physical protecting mechanism in this case is the same as that on which the $`\alpha \eta `$ systems are based. Although it has already been described, with examples, in Ref. ykb , it will be presented here and discussed to clarify the security provided by the quantum noise of light to this key distribution system. A bit-by-bit proof qcmc02 , based on a Positive Operator Valued Measured theory (POVM), will follow. The choice of a POVM demonstration relies on its generality once the wave function or the density matrix that represents the physical process is chosen. The resulting analysis carries the information content in the density matrix and has broad validity. This is particularly useful because the eavesdropper should be allowed to use any technology or attack (beam-splitter, cloning, homodyne measurements and so on) and a general protection cannot be based on particular threat models.

The security analysis to be presented covers both polarization and phase modulation of optical signals. In the case of free-space implementation, the coherent states defining each bit are two orthogonal modes of polarization. In the phase ciphering, two modes separated by a phase of $`\pi `$ could be used. In the polarization case the running key specifies a polarization basis from a set of $`M`$ uniformly spaced two-mode bases spanning a great circle on the Poincaré sphere. Fig. 2 sketches the $`M`$-ry ciphering protocol as implemented in the $`\alpha \eta `$ systems ykb ; qcmc02  where closest bits are mostly distinct from each other. In this key distribution scheme, the same $`M`$-ry scheme is utilized.

Each basis represents a polarization state and its antipodal state at an angle $`\pi `$ from it (bits 0 and 1). The mapping of the stream of bits onto points of the Poincaré sphere is the key to be shared by A and B. It points precisely to the basis being used at each bit emission. Each $`k`$-basis is defined by the Poincaré angles $`\mathrm{\Theta }_k`$ and $`\mathrm{\Phi }_k`$. The number of bases $`M`$ chosen should be such that the uncertainties caused by the quantum noise of light on the polarization angles leads to a large error. This can be understood in a variety of ways; for example, by directly writing the manifold of two-state $`\{|\mathrm{\Psi }(\mathrm{\Theta }_k,\mathrm{\Phi }_k)\}`$ bases in Cartesian $`(x,y)`$ coordinates fixed at the OM physical axes (chosen at 450 from the horizontal) gives

$`|\mathrm{\Psi }(\mathrm{\Theta }_k,\mathrm{\Phi }_k)=|\alpha \gamma (\mathrm{\Theta }_k,\mathrm{\Phi }_k)_x|\alpha \delta (\mathrm{\Theta }_k,\mathrm{\Phi }_k)_y,`$ (1)
where $`\alpha `$ is the coherent amplitude and $`\gamma `$ and $`\delta `$ are the projections on $`x`$ and $`y`$.

$`\gamma `$ $`=`$ $`[(1i)e^{i\mathrm{\Phi }_k/2}\mathrm{cos}(\mathrm{\Theta }_k/2)+(1+i)e^{i\mathrm{\Phi }_k/2}\mathrm{sin}(\mathrm{\Theta }_k/2)],`$
$`\delta `$ $`=`$ $`[(1+i)e^{i\mathrm{\Phi }_k/2}\mathrm{cos}(\mathrm{\Theta }_k/2)+(1i)e^{i\mathrm{\Phi }_k/2}\mathrm{sin}(\mathrm{\Theta }_k/2)].`$
For example, on a great circle set by $`\mathrm{\Theta }_k=\mathrm{\Theta }_p=\mathrm{\Theta }_0`$, the overlap $`\mathrm{\Psi }(\mathrm{\Theta }_k,\mathrm{\Phi }_k)|\mathrm{\Psi }(\mathrm{\Theta }_p,\mathrm{\Phi }_p)`$ between states $`k`$ ($`\mathrm{\Phi }_k=\frac{\pi }{M}k`$) and $`p`$ ($`\mathrm{\Phi }_p=\frac{\pi }{M}p`$) gives

$`|\mathrm{\Psi }(\mathrm{\Phi }_k)|\mathrm{\Psi }(\mathrm{\Phi }_p)|^2=e^{2n\left[1\mathrm{cos}\left(\frac{\mathrm{\Phi }_p\mathrm{\Phi }_k}{2}\right)\right]}.`$ (2)
This will define the polarization angle uncertainty produced by the shot noise associated with the coherent states. For large $`n`$ the periodic functions in Eq. (2) can be expanded around $`\mathrm{\Phi }_p`$, as $`\mathrm{\Phi }_k\mathrm{\Phi }_p+\mathrm{\Delta }\mathrm{\Phi }`$, giving $`|\mathrm{\Psi }(\mathrm{\Theta }_k,\mathrm{\Phi }_k)|\mathrm{\Psi }(\mathrm{\Theta }_p,\mathrm{\Phi }_p)|^2\mathrm{exp}\left[\mathrm{\Delta }\mathrm{\Phi }^2/(2\sigma ^2)\right]`$. $`\sigma ^2=1/n`$ is the uncertainty associated with the Poincaré’ angle. This uncertainty is directly associated with light’s shot noise and cannot be overcome regardless of one’s precision capabilities. Without knowing the precise basis sent (or angle), E cannot obtain the bit that is sent. Her measurement of the polarization angle becomes uncertain by the uncorrelated noise ykb ; qcmc02  in the two axes ( $`n_1n_2=n_1n_2`$ ). It will be shown that this noise can be used judiciously to prevent an eavesdropper from accessing the information while the legitimate receiver B can control it. This access is given by the knowledge of the key: the legitimate receiver projects the received signal completely onto one of the physical axes of the receiving system (e.g. the PBS in Fig. 1) and this way the associated noise becomes irrelevant to his binary determination (See Refs. ykb ; qcmc02  for experimental results). Receiver B can even support moderate misalignments of his bases system because whenever most of the light falls into one of his detectors this would indicate the correct bit. In contrast, for Eve, apart from the uncertainty caused by the noise, even a small misalignment will give her an incorrect basis. Furthermore, her measurement system needs high resolution and precision to obtain reliable data for analysis. The number of bases $`N_\sigma `$ within $`\sigma `$ is $`N_\sigma =M\sigma /\pi =M/(\pi \sqrt{n})`$. The system should be designed, as it will be shown, such that $`N_\sigma `$ covers a reasonable number of adjacent bases.

Phase modulation of the signals can be utilized by creating two pulses delayed by a fixed amount of time and introducing a phase difference $`\varphi _b`$ between them to represent bits 0 or 1 (e.g., $`\varphi _b=0`$ and $`\pi `$). An extra phase difference $`\varphi _k`$ is provided by the $`K_M`$ shared bits. At the receiver, these pulses can be made to interfere and by subtracting the phase $`\varphi _k`$, B can recover each random bit sent. Formally, this phase encoding could be written starting from a coherent state $`|\alpha `$ that is split into a two-mode coherent state $`|\mathrm{\Psi }_0=|\alpha /\sqrt{2}_1|\alpha /\sqrt{2}_2`$. Bit encoding using the two-mode state, represented by annihilation operators $`a_1`$ and $`a_2`$, can be done by

$`|\mathrm{\Psi }_b=e^{iJ_z\phi _b}|\mathrm{\Psi }_0=|e^{i\phi _b/2}{\displaystyle \frac{\alpha }{\sqrt{2}}}_1|e^{i\phi _b/2}{\displaystyle \frac{\alpha }{\sqrt{2}}}_2,`$ (3)
where $`J_z=\left(a_1^{}a_1a_2^{}a_2\right)/2`$. This phase modulation can also be interpreted as a relative one, with the zero reference taken at one of the states . A crucial ingredient in the security demonstration is that the modulation operations have to be unitary or energy conserving. In this way, the input energy associated to each pulse will have to be distributed between the two modes. Precise information about the energy content in each mode is not needed, but one is assured that all energy is being accounted for in the demonstration. Although losses are unavoidable in real systems, this condition also reflects the fact that technical losses are expected to decrease with advances in technology and so they can be considered asymptotically negligible. Therefore, for a modulation system that is not energy conserving in principle, the following demonstration does not apply.

In the phase modulation case, one can associate an index $`\nu `$, in general, to the ciphering angle $`\varphi _\nu `$ to represent a possible applied modulation. This index $`\nu `$ could represent a discrete or a continuous variable determined by a general distribution. In this $`M`$-ry scheme $`\nu =k`$.

A ciphered bit in the two-mode state will be written

$`|\mathrm{\Psi }_{b\nu }=e^{iJ_z(\phi _b+\varphi _\nu )}|\mathrm{\Psi }_0`$
$`=|e^{i(\phi _b+\varphi _\nu )/2}\alpha /\sqrt{2}_1|e^{i(\phi _b+\varphi _\nu )/2}\alpha /\sqrt{2}_2,`$ (4)
where $`\phi _b(=0,\pi )`$ specifies the bit being “sent” and $`\varphi _\nu `$ is the ciphering phase. The overlap of $`|\mathrm{\Psi }_{b\nu }`$ and $`|\mathrm{\Psi }_{b\mu }`$ leads to an equation similar to (2).

## V Eavesdropper’s minimum probability of error

To show that this key distribution scheme is secure two basic points have to be demonstrated:
1) For a fresh bit sent, the minimum probability of error $`P_e^E`$ that an eavesdropper can achieve in the bit determination must be guaranteed to be arbitrarily close to $`1/2`$,
2) The use of a given random sequence $`2\times K_M`$, one time as a “message” and the second time as a cipher for the fresh random sequence, still allows one to set $`P_e^E1/2`$.

As a starting point for the first part of the demonstration, the density matrix $`\rho `$ for all possible two-mode states resulting from ciphering a bit $`b`$ is written as

$`\rho _b={\displaystyle \frac{1}{L}}{\displaystyle _0^L}P_{\varphi _\nu }|\mathrm{\Psi }_{b\nu }\mathrm{\Psi }_{b\nu }|𝑑\nu ,`$ (5)
where $`L`$ is the space spanned by $`\nu `$ and $`P_{\varphi _\nu }`$ describes a general phase distribution. The optimal POVM for discriminating between $`\rho _0`$ and $`\rho _1`$ (or $`\mathrm{\Delta }\rho =\rho _1\rho _0`$), in the polarization case, was first applied in Ref qcmc02 .

Calling $`\mathrm{\Pi }_1`$ and $`\mathrm{\Pi }_0`$ ($`\mathrm{\Pi }_1+\mathrm{\Pi }_0=`$I) the projectors over eigenstates with the positive and negative eigenvalues of $`\mathrm{\Delta }\rho `$, the probability of error $`P_e^E`$ is

$`P_e^E=\mathrm{Tr}[p_1\mathrm{\Pi }_0\rho _1+p_0\mathrm{\Pi }_1\rho _0],`$ (6)
where $`p_1`$ and $`p_0`$ are a-priori probabilities to find a state in $`\rho _1`$ or $`\rho _0`$, respectively. $`P_e^E`$ defines the minimum probability of error that is caused by a wrong choice of bases by Eve when she tries to determine a bit sent. Of course, error levels higher than the one given by Eq. (6) can be found but the interest here is to find Eve’s lower bound of error in a bit-by-bit determination.

$`P(\varphi _{\nu =k})`$ randomly establishes the index $`k`$ associated with discrete phase values $`\varphi _k`$ in the ciphering wheel shown in Fig 2 where adjacent bits to a given $`k`$ are mostly distinct bits from the $`k^{\text{th}}`$ bit. For this implementation the location of the two-state bases are given by

$`\varphi _k=\pi \left[{\displaystyle \frac{k}{M}}+{\displaystyle \frac{1(1)^k}{2}}\right],k=0,1,\mathrm{},M1.`$ (7)
For equal a-priori probabilities $`p_1=p_0=1/2`$, Eq. (6) reduces to

$`P_e^E={\displaystyle \frac{1}{2}}\mathrm{Tr}[\mathrm{\Pi }_0\rho _1+\mathrm{\Pi }_1\rho _0]={\displaystyle \frac{1}{2}}\left(1\mathrm{Tr}[\mathrm{\Pi }_1\mathrm{\Delta }\rho ]\right)`$
$`={\displaystyle \frac{1}{2}}(12{\displaystyle \underset{j}{}}\lambda _j),`$ (8)
where $`\lambda _j`$ are the positive eigenvalues to be obtained from

$`\mathrm{\Delta }\rho ={\displaystyle \frac{1}{M}}{\displaystyle \underset{\nu =k=0}{\overset{M1}{}}}e^{iJ_z\varphi _\nu }\left(|\mathrm{\Psi }_1\mathrm{\Psi }_1||\mathrm{\Psi }_0\mathrm{\Psi }_0|\right)e^{iJ_z\varphi _\nu }.`$ (9)
Eq. (9) can be expanded as

$`\mathrm{\Delta }\rho ={\displaystyle \underset{q=\mathrm{}}{\overset{\mathrm{}}{}}}{\displaystyle \underset{q^{}=\mathrm{}}{\overset{\mathrm{}}{}}}\mathrm{\Delta }\rho _{q,q^{}}|\mathrm{\Phi }_q\mathrm{\Phi }_q^{}|,`$ (10)
where

$`\mathrm{\Delta }\rho _{q,q^{}}=2ie^{|\alpha |^2}\sqrt{I_{2|q|}\left(|\alpha |^2\right)I_{2|q^{}|}\left(|\alpha |^2\right)}\times `$
$`\mathrm{sin}\left[(q^{}q)\pi /2\right]e^{i(q^{}q)\pi /2}{\displaystyle \frac{1}{M}}{\displaystyle \underset{k=0}{\overset{M1}{}}}e^{i\varphi _k(q^{}q)},`$ (11)
where $`I_j`$ is a Modified Bessel function,

$`|\mathrm{\Phi }_q={\displaystyle \frac{1}{\sqrt{I_{2|q|}(|\alpha |^2)}}}{\displaystyle \underset{J=|q|}{\overset{\mathrm{}}{}}}{\displaystyle \frac{\left(\alpha /\sqrt{2}\right)^{2J}}{\sqrt{\left(Jq\right)!\left(J+q\right)!}}}|J,q`$ (12)
$`\text{and}|J,q=|Jq|J+q.`$ (13)
From the positive eigenvalues of Eq. (V), the minimum probability of error, Eq. (V), can be calculated.

Eq. (9) can be expanded in several ways, the adopted expansion uses the angular momentum basis $`|J,q=|Jq|J+q`$, that is a natural basis to deal with angular rotations.

Assuming that $`k`$ values have uniform probability of occurrence one can show that the number of a-priori probabilities for the number of occurrence of even-$`k`$ or odd-$`k`$ lines, given $`M`$, is

$`p_{evenk}(M)={\displaystyle \frac{1(1)^M+2M}{4M}},`$
$`p_{oddk}(M)={\displaystyle \frac{1+(1)^M+2M}{4M}}.`$ (14)
For simplicity and without loss of generality, let us adopt bases even in $`M`$, where $`p_{evenk}(M)=p_{oddk}(M)=1/2=p_1=p_2`$, to show numerical examples. Figure 3 shows the minimum probability of error as a function of the number of ciphering levels $`M`$. $`P_e^E`$ goes very fast to the asymptotic pure-guessing limit of $`1/2`$ as $`M`$ increases.

It is then shown that the minimum probability of error $`P_e^E1/2`$, at a fixed average number of photons $`|\alpha |^2`$, can be achieved by increasing the number of bases $`M`$ adequately. This demonstrates that in this scheme an eavesdropper cannot obtain the individual bits sent, regardless the precision of her devices. The physical origin causing this impossibility for Eve to obtain an angle $`\varphi _k`$ and therefore the associated bit, rests in the source emission itself. Although a deterministic angle can be applied to the modulator the resulting light output is probabilistic in nature and in single shot measurements with mesoscopic states the resulting field does not carry this applied angle $`\varphi _k`$ but presents a distinct $`\varphi _k^{}`$. This is a Nature’s fact that cannot be changed regardless the measurement applied (homodyne, heterodyne, and so on). This completes the first part of the demonstration.

For the second part of the demonstration, one has to show how repetitions of the cipher to encode the distinct bits generated in the random process increase the resolution achievable by the eavesdropper over the signal sent. One should recall that cipher repetition are used in the block ciphering described in step 3 of the protocol. As discussed in randomize , these repetitions are not necessary because the ciphering procedure can be randomized bit-by-bit through use of a stream cipher using the $`K_M`$ sequences as seed keys.

One could ignore this perfectly possible randomization an calculate a much more drastic case, one where both cipher and bit were repeated $`r`$-times. This can be seen as an overestimated upper bound for the actual situation because each random bit sent is a fresh bit in the sequence being sent. As photon numbers in distinct coherent pulses of same amplitude fluctuates in an uncorrelated way, in $`r`$-repetitions of a signal the resolution achieved for extraction of this signal increases with the number of repetitions. This is quantitatively obtained from the $`r`$-product of Eq. (2): $`P(r;k|p)P(k|p)^r\mathrm{exp}\left[r\mathrm{\Delta }\mathrm{\Phi }^2/(2\sigma ^2)\right]`$. This Gaussian process gives the standard deviation $`\sigma ^{}=\sigma /\sqrt{r}`$ associated with the angle uncertainty in a measurement process. This uncertainty $`\sigma ^{}`$ is equivalent to the one obtained from a single shot measurement with the photon number $`rn`$. In other words, a single shot using $`r`$-times the laser power will give the same signal resolution for a bit reading as the $`r`$-repeated sequence with $`n`$. Consequently, for a fixed $`M`$, the $`r`$repetition of the random sequence then reduces $`P_e^E`$ from $`P_e^E(n)`$ to $`P_e^E(rn)`$. The dependence of $`P_e^E`$ can be calculated as a function of $`n`$ and $`M`$ for arbitrary numbers. Therefore, the system can be designed to a desired security level $`P_e^E`$, through the correct choice of $`n`$ and $`M`$. As a numerical example consider, say, $`M=32`$ (or $`K_M=5`$ bits) with $`n=100`$ to achieve $`P_e^E=0.476`$ in a single shot (see Fig. 3). To guarantee the same security level ($`P_e^E=0.476`$), due to the $`r=2\times K_M=10`$ repetitions, one should use $`M=90`$ ($`K_M7`$) corresponding to $`n=10\times 100=1000`$. The conclusion is general regardless of the specific numerical example. Proper scaling can be done for other intensity levels adequate for the sensitivity of the detection system. Although this is an overestimated calculation it is adequate for our purposes to show that the protection level can be increased according it is needed. The alternate encryption described in randomize  reduces this overhead substantially because each level used to cipher each bit is close to have occurred in a truly random.

It has been shown that the transmission stages A$``$B and B$``$A can be made secure under individual bit attacks. The quantity $`P_e^E`$ can be connected to the bit-error-rate probability and entropy measurements such as mutual information or relative entropy, can be directly derived from it.

The following section discusses some aspects of attacks on this scheme. As there are no ciphertext or known-plaintext involved in the transmission of random bits, attacks on the transmitted random sequences to obtain the key $`K_0`$ have to start considering a guessing probability of $`1/2`$ for each bit or $`1/2^{L_0}`$ for any complete sequence sent. Considering that for each new bit sent the random noise may produces $`N_\sigma `$ possible outcomes in a measurement process, the number of possibilities to be considered grows exponentially depending on $`L_0`$ and $`N_\sigma !`$. This indicates that an unsurmountable computational problem would occur for a large number of bits sent.

## VI Eve’s record, correlations and drawbacks

Next, one has to show that the security level calculated also holds under the basic conditions already defined: I) The eavesdropper is allowed to have full access to the random signal sequence being generated. II) She would work near the source to avoid signal losses.

### VI.1 Bit-cipher block correlations

In general, any degree of correlation in a bit sequence can be explored by Eve to decrease her degree of uncertainty. While use of true random numbers eliminate intrinsic correlations in the generation process the $`K_M`$ block cipher utilized introduces a short range bit-cipher correlation. The increased number of levels $`M`$ utilized was aimed to increase Eve’s bit-by-bit probability of error to the guessing levels even under the block ciphering used. Although Eve cannot obtain the random bits sent from the measured signals one may argue that some correlation may be detected due to the bit-cipher correlation. As one can see from the given numerical examples, the condition $`N_\sigma >K_M`$ can be easily applied to the communication scheme with mesoscopic states. This condition assures that the uncertainty produced by the noise overcomes the amount of knowledge associated to these correlations. In a linear algebraic system it corresponds to a number of unknowns larger than the number of available equations. Nevertheless, information reconciliation and privacy amplification cachin  distill a random sequence about which Eve has a negligible amount of information and also has the additional effect of destroying the short bit-cipher correlations. Basically, the fact that the information known by the legitimate parties differs from that obtained by the eavesdropper is what allows A and B to achieve the secrecy goal.

### VI.2 Homodyne and delay line

Homodyne and heterodyne techniques can be also utilized by Eve to obtain the signals with better precision than a direct detection measurement. With knowledge of the key sequence Bob and Alice always utilize the proper quantum measurement basis for their optimal binary detection, assuring a resolution superior to the one obtained by Eve. In principle, if the seed key is available to Eve, after her records were created, she could apply rotations over the recorded signals to obtain the correct sequence. This has to be performed in a sequential operation due to the lack of structure in the PhRGs generation of random numbers. This differs from performing a mathematical operation with a deterministic function to obtain a result $`x_{n1}`$ given $`x_n`$, up to $`x_0`$. Nevertheless, assuming that this inversion is possible in principle, Eve could obtain the random sequence once the starting key is available eric . This will be equivalent to a futuristic optical delay line that could be tapped on demand and Eve could wait as long as necessary until the shared starting key is made available to her and only then perform her measurements perfectly mimicking Bob’s measurement over her copy of the signals. With the key, E does not need the same resolution as before and the applied rotations would lead her close enough to the correct axis orientation and to bit identification. Therefore, the shared starting key has to be protected at all times. This is the fundamental drawback of this system key disclosure , although it is not important in the current state of technology . In essence, assuming a protected starting key, this method can be described as a one-time-pad extender.

The futuristic delay line discussed led to the protection of the starting key at all-times because there are no in-principle impediments for creation of such a device. One could also invoke a perfect photon number cloning so that Eve could obtain multiple perfect copies of each signal sent. Perfect copies would allow Eve to obtain the correct bit sequence but perfect cloning violates the no-cloning theorem. Realistic amplification schemes with linear optical amplifiers introduce spontaneous noise that decreases Eve’s signal resolution. Imperfect cloning lutkenhaus  using realistic number distribution consisting of mixtures of stimulated and spontaneous thermal processes are akin to linear optical amplification and degrades signal resolution.

### VI.3 Phase measurement bounds

Even without reference to a particular setup, it is worth comparing the obtained numerical results with the bounds on phase measurements imposed by the smallest detectable phase shifts usually considered (See barnett-fabre-maitre  and references therein). They are: 1) the standard quantum limit ($`SQL`$), given by $`\mathrm{\Delta }\varphi _{SQL}1/\sqrt{N}`$, 2) Squeezed light limit ($`Sqz`$), given by $`\mathrm{\Delta }\varphi _{Sqz}1/N^{3/4}`$, and 3) “Heisenberg” limit $`\mathrm{\Delta }\varphi _H1/N`$. A homodyne setup to identify a given phase that uses, say, a squeezed field has to scan the phase interval of interest to probe for the best resolution region where the phase measurements lapse below shot noise condition. In the case of interest in this paper, each signal pulse will be set randomly in one basis chosen among $`M`$ bases. The minimum interval between bases is $`\mathrm{\Delta }\varphi _{min}=\pi /M`$. A uniform scan on the semicircle ($`\pi `$) with maximum efficiency will find the particular basis sent within a fraction $`\mathrm{\Delta }\varphi _{min}/\pi =1/M`$ of the pulse containing $`N`$ photons. One could therefore impose the condition for indistinguishability of the sent phase using the lowest limit given by $`\mathrm{\Delta }\varphi _H`$:

$`\mathrm{\Delta }\varphi _H>\mathrm{\Delta }\varphi _{min}.`$ (15)
Writing $`\mathrm{\Delta }\varphi _H`$ to take into account the optimized fraction of the pulse, one has

$`\mathrm{\Delta }\varphi _H={\displaystyle \frac{1}{(1/M)N}},`$ (16)
and therefore

$`M>\sqrt{\pi N}.`$ (17)
This condition is satisfied under the conditions exemplified in Fig. 3, in agreement with obtained results.

### VI.4 Speed costs and other aspects

The main cost for the security obtained in this scheme is the $`M`$-ry number of levels needed. An increased number of levels demands an increased number of bits to provide the necessary resolution and a wider dynamic range for the waveform generators to provide such modulations at high speeds. For example, in case one assumes the overestimated $`2K_M`$ repetition this will decrease the bit output rate from, say, 10GHz, to 10GHz/$`2K_M`$. For a nonrepeated cipher, if one uses $`M=1000`$ ($`K_M10`$), and $`n=10^4`$ the number of levels covered $`N_\sigma =M/(\pi \sqrt{n})3.18`$. To keep the same number of levels $`N_\sigma `$ covered under the $`2\times K_M`$ repetition, equivalent to a single shot with the intensity $`2\times K_M`$ higher, the number of levels necessary is $`M_{new}4472`$. This reduces the speed to 10GHz/$`2K_{M_{new}}=0.4`$GHz from 10GHz. Although this large increase in the number of levels is not necessary randomize  it emphasizes the overhead involved when one increases the number of levels $`M`$.

Exploratory physical attacks by the eavesdropper, such as injection of a strong signal to detect the weak reflections from the surface of the OM modulator, and from these to obtain the modulation applied, can be easily detected by signal splitting. Specific analysis for the physical attacks could be applied on a case-by-case basis. The robustness of the signals under signal jamming by an enemy, for example, may be of interest for some applications. In this case, one could superpose on the ciphering levels phase and amplitude modulations and even utilize emission at distinct wavelengths to provide a set of conditions that the legitimate parties could use to extract the signals. Again, specific issues require case-by-case responses. These questions are not related to the security aspects of interest here. In the same way, computer attacks schneier  and general attacks outside the optical channel are not the focus this work.

### VI.5 Signal amplification

The presented key distribution scheme aims to defeat Eve’s actions at the source, where no losses occurred. Amplification processes always degrade signal resolution for Eve or Bob. As Eve is already defeated at the source, she cannot obtain any improvement through amplification. On the contrary, the knowledge of the key allows Bob to distinguish signals as long as he has a good signal-to-noise ratio. Therefore, amplification is possible for the legitimate receivers because they need a smaller resolution degree than Eve. It works as long as A and B can identify signals in orthogonal bases. A and B apply simple binary decisions to distinguish between orthogonal bases while Eve, on the other hand, needs high resolution to distinguish between adjacent levels of the $`M`$-ry scheme. This is why an increased noise for A and B due to the amplification process does not have the same effect on Eve’s measurement. With the signal protected at the source, noise created by amplifiers can be acceptable for A and B until their error bit rate exceeds a toleration level.

Numerical simulations indicate that A and B can utilize amplifiers up to distances of $`500`$km before signal regeneration becomes necessary. These simulations consider the spontaneous decay in amplifiers onto the mode to be amplified as well as onto the mode orthogonal to the carrier. These added noise sources degrade signal resolution for the users and increase the bit error rate. Other error sources exist such as acoustic and thermal fluctuations but they occur in a much slower time scale.

It is important to observe that any advantage obtained by A and B over E, at the source, leads to an increased communication distance for A and B. Although B can support losses as long as this system presents a low bit error rate, his superiority over Eve decreases and ceases at the moment where Eve can have an equal or larger amount of information than Bob horace . These differences can be estimated by calculating $`P_e^E(0)/P_e^B`$, where $`P_e^E(0)`$ is Eve’s error probability at the source and $`P_e^B`$ is calculated after the amplification stages. Ideally, $`P_e^E(0)/P_e^B1`$. Therefore, any randomization that can be further introduced by Alice at the source amplifying Eve’s uncertainty will reflect as an increased range for secure communication horace . Randomization can be increased by several means; however, increasing the randomization level usually has a cost associated to the process that has to be weighted with respect to the gain to be achieved.

Summarizing, signal amplification is essential for Internet and this key distribution scheme can be tailored for some of these applications.

## VII Mutual Information

The concept of mutual information $`I(X:Y(X))`$, concerning the amount of information on $`X`$ giving the observable Y, allows one to extract basic information on this key distribution system. The minimum probability of error for Eve, bit-by-bit, derived in Eq. (6), $`P_e^E`$, gives the bit-error-rate for Eve in the binary entropy $`H(R|Y_e(R))`$. The mutual information $`I_E(R:Y_e(R))=H(R)H(R|Y_e(R))=1+P_e^E\mathrm{log}_2P_e^E+(1P_e^E)\mathrm{log}_2(1P_e^E)`$ describes the amount of information Eve could obtain in a bit-by-bit attack on $`R`$. Fig. 4 shows this dependence as a function of $`M`$ and some values of $`n`$. $`H(R)=1/`$per bit (or $`L_0`$ for a perfect random stream of length $`L_0`$).

Although an individual bit-by-bit attack is only a limited attack from Eve it shows the increasingly difficulty the attacker finds as a function of the variables used.

The presented key distribution process intends to perform a distribution between two users of a fresh sequence of random numbers generated by one or more PhRG’s. While the final shared sequence is truly random, as it was thoroughly discussed, each sequence was obtained using the former sequence to cipher it. The whole process was then dependent on the secrecy of the fist key sequence $`K_0`$ (of length $`L_0`$). As long as one chain in the sequence is not compromised, the whole sequence results secure. In other words, although A and B may share an arbitrarily long sequence of random numbers, the security of the process relies in a single element of the chain. This is distinct from processes described as fresh key generation in the conventional nomenclature where one aims to create keys that are unconditionally secure even after the starting key is compromised. This goal has not yet been achieved outside from single photon protocols and it is a constant matter of study horace .

This intuitive dependence of the security of the chained sequence of keys on a single element of the chain can be formalized as follows. Using the definition of mutual information utilized above,

$`I(R:Y(R))=H(R)H(R|Y(R)),`$ (18)
and writing the difference between the mutual informations between B and E at each cycle of length $`L_0`$ :

$`\mathrm{\Delta }I`$ $`=`$ $`I_BI_E`$ (19)
$`=`$ $`[H(R)H(R|Y_B(R))][H(R)H(R|Y_E(R))]`$
$`=`$ $`H(R|Y_E(R))H(R|Y_B(R)).`$
From the fact that, at best, $`H(R|Y_B(R))=0`$ and $`H(R|Y_E(R))=L_0`$ in the first cycle, one sees that $`\mathrm{\Delta }IL_0`$, what shows that the uncertainty may be kept at the first sequence $`L_0`$ with a level given by $`L_0`$ itself. The conditions that Bob reads without errors the random numbers sent ($`H(R|Y_B(R))=0`$) in a sequence of length $`L_0`$ and that the secrecy of the shared key for Eve is perfect ($`H(R|Y_E(R))=L_0`$) are basic and reasonable assumptions. To complete the derivation, one may write the chaining rule nielsen\_chuang  $`H(L_1,L_2,\mathrm{},L_n|Y_E)=_{i=1}^nH(L_i|Y,L_1,\mathrm{},L_{i1})`$ to see that

$`H(L_1,L_2,\mathrm{},L_n,\mathrm{}|Y_E)=`$
$`H(L_1|Y_E)+H(L_2|Y_E,L_1)+H(L_3|Y_E,L_1,L_2)+\mathrm{}`$ (20)
One can see from this rule that in the first round where $`L_1`$ (or $`\{𝐑_1,\mathrm{}𝐑_{K_M}\}`$) is ciphered with $`K_0`$, unknown to Eve, Eve’s entropy knowing $`Y_E`$ is $`H(L_1|Y_E)=K_0`$, as long as no information on $`K_0`$ is leaked to her. However, in case Eve knows $`L_1`$ and $`Y_E`$ she could know $`L_2`$, that is to say $`H(L_2|Y_E,L_1)=0`$ because this provides her with the same information that Bob has, and so on with the subsequent terms. Therefore $`\mathrm{\Delta }I=K_0`$ or, in other words, Eve’s uncertainty is $`K_0`$ (length $`L_0`$). In case Eve is unable to obtain $`L_1`$, $`L_2\mathrm{}`$ this result does not apply, of course, and Eve’s knowledge on the whole sequence of transmitted random numbers is null. This analysis stands for any length $`L_0`$, that has to be tailored according one needs. For $`L_0=10^9`$, as an example, implies that to break the sequence Eve has to order correctly $`10^9`$ bits, what gives her a probability for success of $`1/(2^{10^9})`$. Privacy amplification steps further decreases $`P_e^E`$ as well as destroys short range correlations in original random streams. Even periodic replacements of the starting keys can be introduced and the whole process can be tailored to any advances in computational capabilities.

### VII.1 Quantum noise

One should understand that the inherent quantum noise in the system sometimes invalidates conventional techniques one could use in a noiseless system. For example, in the case of a classical $`M`$-ry ciphering, or ciphering with intense coherent signals, Alice could send repeatedly a given bit $`r`$ to Bob fixed in any basis of the $`M`$-ry detection system. Bob measures successively $`r_1=r,r_2=r,r_3=r,\mathrm{}`$. The following properties then holds: 1) Any pair of $`r`$ obeys $`rr=0`$. Therefore, 2) If a message bit $`x`$ is ciphered as $`y=xr`$ by Alice, Bob is able to recover $`x`$ using any obtained $`r`$ by performing $`yr=x`$. This holds because $`r`$ is obtained noiseless and, therefore, $`rr=0`$ . Classical one-time pad applications are “noiseless”. Quite distinctly, when using a mesoscopic coherent state, a repeatedly sent bit $`r`$ will be read by a receiver that does not know the basis to be used, as $`r_1=r+\mathrm{\Delta }_1`$, $`r_2=r+\mathrm{\Delta }_2`$, …, where $`\mathrm{\Delta }_j`$ express the effect of the noise in the channel. In this case, 1) Any pair of $`r`$ obeys $`r_ir_j=\mathrm{\Delta }_1+\mathrm{\Delta }_2`$ instead of $`rr=0`$ ; 2) If a message bit $`x`$ is ciphered as $`y=(xr)_i`$ by Alice and Bob has $`r_j`$, he obtains $`yr_j=x+\mathrm{\Delta }_i+\mathrm{\Delta }_j`$ instead of $`x`$. This only stresses that the knowledge of the bases used to transmit the random sequences or keys is a crucial step for this key distribution system. One should realize that the channel noise, inherent to the light field, has its source at the emitter itself, ignoring all technical noises eventually present.

## VIII Conclusions

It has been demonstrated that a fast key distribution scheme between two stations can be implemented where the practical physical limitations are set by the speed of the electro-optic modulators and acquisition electronics available through current technology. A secure random sequence obtained can be utilized in “Vernam’s one-time-pad” sense, for applications that demand unconditional security. Fundamentally, the system allows for signal amplification, as in the $`\alpha \eta `$ systems. The system works as long as the receiver has a good signal-to-noise ratio after the last amplification stage and the occurred losses do not give him an information level worst than Eve’s. The possibility of amplification paves the way for long distance key-distribution protocols protected by the quantum noise of light, offering a practical advantage over single-photon protocols.

Acknowledgements – The author has been supported under grants DARPA/AFRL-F30602-01-2-0528 and NSF-PHY-0219382. The views and conclusions contained herein should not be interpreted as representing any endorsement from the cited agencies and just represents a personal view on this problem. Thanks are due to Horace P. Yuen for enlightening discussions on cryptography and to Prem Kumar, sharing his expertise and experimental knowledge in the development of the $`\alpha \eta `$ systems. G. Mauro D’Ariano and M. G. A. Paris are acknowledged for the joint work on the POVM demonstration for the polarization case ykb . Eric Corndorf is acknowledged for useful discussions.


text:
# Recent Results on Quarkonium Production and Decay

## 1 Some Successes of the NRQCD Factorization Approach

Since its formulation, the NRQCD factorization approach has enjoyed a number of successes in predicting inclusive decay rates and production cross sections for quarkonium states.

The initial success of the NRQCD factorization method was in the computation of infrared-finite predictions for the inclusive decay rates of $`P`$-wave quarkonium states. A subsequent global fit to the $`P`$-wave charmonium data has yielded a $`\chi ^2`$ per degree of freedom of $`15.0/10`$ and values of the nonperturbative NRQCD matrix elements that are in good agreement with lattice determinations and with estimates based on the NRQCD velocity-scaling rules.

In the area of quarkonium production, the first success of the NRQCD factorization approach was in explaining the Tevatron data for the inclusive production of $`J/\psi `$, $`\chi _c`$, $`\psi (2S)`$, $`\mathrm{{\rm Y}}`$, and $`\mathrm{{\rm Y}}(2S)`$ states. Previous calculations in the color-singlet model had yielded results that were smaller than the data by more than an order of magnitude. In the NRQCD predictions, the unknown NRQCD matrix elements were determined from fits to the data. Nevertheless, the comparison with the Tevatron data gives a nontrivial confirmation of the NRQCD factorization approach because the extracted matrix elements satisfy the velocity-scaling rules, and the shape of the data as a function of $`p_T`$ is consistent with NRQCD factorization, but not with the color-singlet model.

A recent success of the NRQCD factorization approach is in predicting the cross section for $`\gamma \gamma J/\psi +X`$ at LEP. In this case, the prediction makes use of NRQCD matrix elements extracted from the Tevatron data, and hence, provides a test of the predicted universality of the matrix elements. The principal theoretical uncertainties arise from uncertainties in the renormalization and factorization scales and from estimates of the color-octet matrix elements. The data from the Delphi experiment are consistent with the NRQCD factorization prediction and clearly disfavor the prediction of the color-singlet model.

Another prediction that makes use of the NRQCD matrix elements extracted from the Tevatron data is that for quarkonium production in deep-inelastic scattering at HERA. Again, the theoretical uncertainties arise mainly from uncertainties in the renormalization and factorization scales and in the color-octet matrix elements. Data from the H1 experiment plotted as functions of $`p_T`$ or $`Q^2`$ favor the prediction of NRQCD factorization over that of the color-singlet model. Neither prediction is entirely consistent with the data as a function of $`z`$. It should be noted that the most recent calculation disagrees with a number of previous theoretical results, and that these disagreements have not yet been resolved fully.

## 2 Some Problematic Comparisons with Experiment

There are some processes for which the comparisons between the experimental data and the NRQCD factorization predictions are less satisfactory.

The production of transversely polarized quarkonium at the Tevatron is potentially a “smoking gun” for the color-octet production mechanism, which is an integral part of the NRQCD factorization formalism. For quarkonium production at large $`p_T`$ ($`p_T>\mathrm{\hspace{0.33em}4}m_c`$ for $`J/\psi `$), gluon fragmentation into quarkonium via the color-octet mechanism is the dominant process. At large $`p_T`$, the fragmenting gluon is nearly on mass shell, and, so, is transversely polarized. NRQCD predicts that the polarization is largely transferred to the $`J/\psi `$, although it is diluted somewhat by non-fragmentation processes, radiative corrections, and feeddown from higher quarkonium states. The data from the CDF experiment show no evidence for the predicted increase of transverse polarization with increasing $`p_T`$. However, the error bars are large, and only the highest-$`p_T`$ data point is actually inconsistent with the prediction. There are also large theoretical uncertainties, primarily from corrections of higher order in $`\alpha `$ and $`v`$, including $`v^2`$ effects in the polarization transfer.

Another problematic process is inelastic quarkonium photoproduction at HERA. The HERA data are just barely compatible with the prediction. The color-octet mechanism leads to a prediction of increasing rate with increasing energy fraction $`z`$. This is not observed. However, theoretical uncertainties arising from corrections of higher order in $`\alpha _s`$ and $`v`$, uncertainties in $`m_c`$, and the breakdown of the $`v`$ expansion near $`z=1`$ have not been addressed or have been addressed incompletely. It should be noted that the experimental data differential in $`p_T`$ are compatible with color-singlet production alone, even at large $`p_T`$.

A recent striking result from the Belle collaboration concerns production of a double $`c\overline{c}`$ pair in $`e^+e^{}`$ collisions: $`\sigma (e^+e^{}J/\psi c\overline{c})/\sigma (e^+e^{}J/\psi X)=0.59_{0.13}^{+0.15}\pm 0.12`$. Perturbative QCD plus the color-singlet model leads to the prediction $`\sigma (e^+e^{}J/\psi c\overline{c})/\sigma (e^+e^{}J/\psi X)0.1`$. This seems to be a major discrepancy between theory and experiment.

## 3 General Difficulties in the Theory

There are several difficulties that arise when one attempts to make accurate theoretical predictions for quarkonium production and decay processes.

Foremost among these is the fact that the color-octet NRQCD matrix elements are poorly determined. For some processes, only linear combinations of color-octet matrix elements can be determined from the data with reasonable accuracy. Different linear combinations are fixed by different processes—a situation that makes it difficult to test the universality of the color-octet matrix elements.

A further difficulty in making accurate theoretical predictions is the fact that corrections to the short-distance coefficients of next-to-leading-order (NLO) in $`\alpha _s`$ are often large. For example, for the process $`J/\psi \gamma \gamma \gamma `$, the NLO correction is $`12.62\alpha _s/\pi `$, relative to the leading-order coefficient. A related problem is that the dependence of the calculated short-distance coefficients on the renormalization scale is often large. These issues raise doubts about the convergence of the perturbation expansion for the short-distance coefficients. For some key processes, such as $`J/\psi `$ production in hadronic collisions, the NLO corrections have not yet been computed. For certain processes, resummations of large logarithms of $`p_T^2/M_\psi ^2`$, $`M_Z^2/M_\psi ^2`$, and $`z^2`$ have been carried out. In some instances, resummations of logarithms of $`1x`$ and $`x`$ may also be required.

Another significant source of inaccuracy in theoretical predictions is the existence of large relativistic corrections. For example, for the process $`J/\psi \gamma \gamma \gamma `$, the order-$`v^2`$ correction is $`5.32v^2`$. Since $`v^20.3`$ for charmonium and $`v^20.1`$ for bottomonium, one can question whether the $`v`$ expansion converges. Furthermore, for many processes, the order-$`v^2`$ corrections have not yet been computed.

In the remainder of this paper, I describe some recent progress in confronting these obstacles to accurate theoretical predictions.

## 4 Relativistic Corrections to Gluon Fragmentation into $`𝑺`$-wave Quarkonium and to $`𝑺`$-wave Quarkonium Decay

Motivated by the importance of the fragmentation process for $`S`$-wave quarkonium production at large $`p_T`$, J. Lee and I calculated the order-$`v^2`$ corrections to that process. Our preliminary results are that the correction to the color-singlet process is approximately 74% for the $`J/\psi `$, and the correction to the color-octet process is approximately -54% for the $`J/\psi `$. The correction to the color-singlet process reduces the predicted value of the transverse polarization parameter $`\alpha `$ by about 10% at large $`p_T`$. The corrected prediction is still far above the highest-$`p_T`$ CDF data point. The correction to the color-octet process directly affects the value of the $`{}_{}{}^{3}S_{1}^{}`$ color-octet matrix element that is obtained by fitting to the Tevatron data.

A. Petrelli and I have computed the coefficients of color-singlet operators of order $`v^4`$ for S-wave quarkonium decays. This is the first decay or production calculation at next-to-next-to-leading order in $`v`$. The series for $`{}_{}{}^{1}S_{0}^{}`$ decay into two photons and for the color-singlet part of $`{}_{}{}^{1}S_{0}^{}`$ decay into light hadrons are $`11.33v^2+1.51v^4+\mathrm{}`$, the series for $`{}_{}{}^{3}S_{1}^{}`$ decay into $`e^+e^{}`$ is $`11.33v^2+1.61v^4+\mathrm{}`$, and the series for the color-singlet part of $`{}_{}{}^{3}S_{1}^{}`$ decay into light hadrons is $`15.32v^2+7.62v^4+\mathrm{}`$. All of these series seem to be converging in order $`v^4`$, even the one for $`{}_{}{}^{3}S_{1}^{}`$ decay into light hadrons, which receives a large contribution in order $`v^2`$. It is known that color-octet contributions in the first non-trivial order ($`v^3`$ and $`v^4`$) are large. The hope is that these, too, will receive small corrections in the next order in $`v`$.

## 5 Lattice Computation of Bottomonium Decay Matrix Elements

D.K. Sinclair, S. Kim, and I have recently computed matrix elements for bottomonium decay on the lattice, using two dynamical light quarks. The essential steps in this computation are to measure matrix elements in a lattice simulation, to use perturbation theory (at the cutoff scale $`m_b`$) to relate the lattice and continuum matrix elements, and to extrapolate to three light-quark flavors and to physical light-quark masses. For the matrix element of the color-singlet $`S`$-wave operator in the $`\mathrm{{\rm Y}}`$ state, we obtain $`4.10(1)(9)(41)\text{ GeV}^3`$, which compares well with the phenomenological value $`3.86(14)\text{ GeV}^3`$ extracted from the measured rate for $`\mathrm{{\rm Y}}e^+e^{}`$. We also obtained values for matrix elements of the color-singlet $`P`$-wave operator and the color-octet $`S`$-wave operator in the $`\chi _b`$ state, which can be used to make predictions for the decays of $`\chi _b`$ states. The matrix element of the order-$`v^2`$ color-singlet $`S`$-wave operator in the $`\mathrm{{\rm Y}}`$ state is poorly determined, owing to large lattice-to-continuum corrections. The values of all of these matrix elements are strongly affected by the inclusion of light dynamical quarks in the calculation.

## 6 Resummation of QCD Corrections to Quarkonium Decay Rates

In this Section I describe work carried out in collaboration with Y.-Q. Chen.

Expressions for the decay rates of the $`\eta _c`$ into light hadrons (two gluons in perturbation theory) and two photons are both known through NLO in $`\alpha _s`$ and $`v`$. Each expression depends on two NRQCD matrix elements. However, if we take the ratio of the rates, the dependence on the matrix elements cancels:

$`R^{\mathrm{NLO}}(\mu )`$ $`=`$ $`{\displaystyle \frac{\mathrm{\Gamma }(\eta _cgg)}{\mathrm{\Gamma }(\eta _c\gamma \gamma )}}=R_0\{1+[({\displaystyle \frac{199}{6}}{\displaystyle \frac{13\pi ^2}{8}}){\displaystyle \frac{8}{9}}n_f]{\displaystyle \frac{\alpha _s(\mu )}{\pi }}`$ (1)
$`+2\beta _0\alpha _s\mathrm{ln}{\displaystyle \frac{\mu ^2}{4m_c^2}}+O(\alpha _s^2)+O(v^3)\},`$
where $`R_0=9\alpha _s^2(\mu )/(8\alpha _{em}^2)`$, and $`\beta _0=(332n_f)/(6\pi )`$.

One might hope that Eq. (1) would yield an accurate prediction for the ratio. Unfortunately, the term in Eq. (1) proportional to $`\alpha _s`$ is approximately $`1.1R_0`$, casting doubt on the convergence of the perturbation expansion. Ignoring this difficulty and setting $`\mu =2m_c`$, we obtain $`R^{\mathrm{NLO}}(2m_c)=2.1\times 10^3.`$ The experimental value is $`R^{\mathrm{Exp}}=(3.3\pm 1.3)\times 10^3`$. The agreement is reasonable, however the $`\mu `$ dependence of the theoretical result is strong. For example, using BLM scale setting we obtain $`\mu _{\mathrm{BLM}}0.52m_c`$. This leads to an NLO term that is $`0.5`$ times the leading term, and, so, the convergence appears to be better. However, the agreement with experiment is poor: $`R^{\mathrm{NLO}}(\mu _{\mathrm{BLM}})=9.9\times 10^3`$.

It is instructive to re-write Eq. (1) in terms of $`\beta _0`$:

$`R^{\mathrm{NLO}}(\mu )`$ $`=`$ $`R_0\left\{1+\left[\left({\displaystyle \frac{37}{2}}{\displaystyle \frac{13\pi ^2}{8}}\right)+\pi \beta _0\left({\displaystyle \frac{16}{3}}+2\mathrm{ln}{\displaystyle \frac{\mu ^2}{4m_c^2}}\right)\right]{\displaystyle \frac{\alpha _s(\mu )}{\pi }}\right\}.`$
The terms proportional to $`\alpha _s`$ that do not contain a factor $`\beta _0`$ have a value $`2.5R_0`$, while the terms proportional to $`\beta _0`$ have a value $`12R_0`$ for $`\mu ^2=4m_c^2`$. The fact that the terms proportional to $`\beta _0`$ dominate in the NLO correction suggests that we should resum the contributions proportional to $`(\alpha _s\beta _0)^n`$ to all orders in $`\alpha _s`$. To do this, we make use of the method of naive non-Abelianization (NNA). That is, we sum the fermion-loop vacuum-polarization contributions and then take gluon loops into account by replacing the fermion-loop contribution to $`\beta _0`$ with the full $`\beta _0`$.

In order to carry this out, one must compute all cuts through the two final-state complete gluon propagators, where each propagator consists of a chain of free gluon propagators and vacuum-polarization bubbles. The result is

$`R^{\mathrm{Bub}}=`$ $`{\displaystyle \underset{n,m}{}}[{\displaystyle _0^1}{\displaystyle \frac{dx}{2\pi x}}{\displaystyle _0^1}{\displaystyle \frac{dy}{2\pi y}}f(x,y)I_R^{(n)}(x)I_R^{(m)}(y)\theta (1\sqrt{x}\sqrt{y})`$ (3)
$`+2G_V^{(n)}{\displaystyle _0^1}{\displaystyle \frac{dx}{2\pi x}}f(x,0)I_R^{(m)}(x)+f(0,0)G_V^{(n)}G_V^{(m)}],`$
where $`x=k^2/(4m_c^2)`$, $`y=l^2/(4m_c^2)`$, $`k`$ and $`l`$ are the gluon momenta, $`f(x,y)`$ is the phase-space and heavy-quark factor ($`f(0,0)=1`$), $`I_R^{(n)}(x)=2\mathrm{Im}[i\mathrm{\Pi }(x)]^n`$ is the sum of quark cuts of the complete gluon propagator in $`n`$th order, $`G_V^{(n)}=[i\mathrm{\Pi }(0)]^n`$ is the sum of gluon cuts of the complete gluon propagator in $`n`$th order, and $`\mathrm{\Pi }_{\mu \nu }(x)=(k^2g_{\mu \nu }k_\mu k_\nu )\mathrm{\Pi }(x)`$ is the one-loop vacuum polarization. In Eq. (3), the first, second, and third terms correspond to the $`qq`$, $`qg`$, and $`gg`$ cuts, respectively.

The individual terms in Eq. (3) are infrared divergent, but we can write $`R^{\mathrm{Bub}}=G_1^2+G_2`$, where

$$G_1=\underset{n}{}_0^1\frac{dx}{2\pi x}f(x,0)I_R^{(n)}(x)+\underset{n}{}G_V^{(n)},$$
(4)
and

$`G_2{\displaystyle \underset{n,m}{}}[`$ $`{\displaystyle _0^1}{\displaystyle \frac{dx}{2\pi x}}{\displaystyle _0^1}{\displaystyle \frac{dy}{2\pi y}}f(x,y)I_R(x)^{(n)}I_R^{(m)}(y)\theta (1\sqrt{x}\sqrt{y})`$ (5)
$`{\displaystyle _0^1}{\displaystyle \frac{dx}{2\pi x}}f(x,0)I_R^{(n)}(x){\displaystyle _0^1}{\displaystyle \frac{dy}{2\pi y}}f(0,y)I_R^{(m)}(y)].`$
$`G_1`$ is infrared finite because of the KLN theorem, and $`G_2`$ is infrared finite because the integrands in its two terms become identical when $`x`$ or $`y`$ vanishes.

Let us first consider the properties of a single vacuum-polarization-bubble chain, as manifested in $`G_1`$. A calculation of $`G_1`$ yields

$`G_1(\mu )=`$ $`{\displaystyle \frac{1}{\pi \alpha _s(\mu )\beta _0}}\mathrm{arctan}{\displaystyle \frac{\pi \alpha _s(\mu )\beta _0}{1\alpha _s(\mu )\beta _0d}}`$ (6)
$`{\displaystyle \frac{1}{\pi }}{\displaystyle \underset{n=1}{\overset{\mathrm{}}{}}}{\displaystyle _0^1}𝑑x\mathrm{Im}[\alpha _s(\mu )\beta _0\left(d\mathrm{ln}x+i\pi \right)]^n,`$
where $`d`$ is a renormalization-scheme-dependent constant. Now, integration of $`\mathrm{ln}^nx`$ down to $`x=0`$ produces factorial growth: $`_0^1𝑑xx^m\mathrm{ln}^nx=(1)^nn!/(m+1)^{n+1}`$. Therefore, the second term of $`G_1`$ may contain contributions that grow as $`n!`$. This is an indication that, owing to the failure of asymptotic freedom at small $`x`$, the perturbation series may diverge. Factorial growth in the perturbation series is characteristic of the presence of a renormalon—a singularity in the Borel transform of the decay rate—that signals the importance of nonperturbative effects.

However, when the imaginary part of Eq. (6) is computed, a seemingly miraculous cancellation of the factorial growth occurs. The singularity in the Borel transform also vanishes in the imaginary part. In order to understand why this happens, let us re-write the second term of $`G_1`$ as a contour integral:

$$\underset{n}{}_0^1\frac{dx}{\pi }\mathrm{Im}[\alpha _s\beta _0(\mathrm{ln}x+d+i\pi )]^n=\underset{n}{}_C\frac{dx}{2\pi }[\alpha _s\beta _0(\mathrm{ln}x+d)]^n,$$
(7)
where the contour runs from $`1`$ to $`0`$ to $`1`$ around the cut in $`\mathrm{ln}x`$. We can deform the contour out of the region of small $`x`$ into a circle of radius unity. Now the entire contour lies in a region in which perturbation theory applies. No factorial growth occurs. The series is bounded by a geometric series and, hence, is convergent.

Suppose that, for the second term of $`G_1`$, we carry out the perturbation summation before performing the integration. Then, summing the resulting geometric series, we obtain

$$_0^1\frac{dx}{\pi }\mathrm{Im}\left[\frac{1}{1\alpha _s\beta _0(\mathrm{ln}x+d+i\pi )}\right].$$
(8)
This differs from the expression (7) by a small, but nonzero, amount: $`[1/(\alpha _s\beta _0)]\mathrm{exp}\{1/[\alpha _s(\mu )\beta _0]+d\}e^d\mathrm{\Lambda }_{\mathrm{QCD}}^2/(\alpha _s\beta _0\mu ^2)`$, which has the typical form of a nonperturbative contribution. Both orders of operations lead to convergent expressions. However, $`\mathrm{log}x`$ becomes unbounded at small $`x`$, and, so, the convergence is not uniform, and different orders of limits can produce different results. If we carry out the summation before performing the integration, as in the expression (8), there is a Landau pole at in the integrand at $`x_0=\mathrm{exp}[1/(\alpha _s\beta _0)+d]`$. The residue at this pole is the difference between the expressions with different orders of operations.

This raises a question as to which order of limits, if either, is correct. In the unintegrated expression, for $`x`$ sufficiently small, we are outside the radius of convergence of the perturbation series, and the perturbation sum is unreliable. In the integrated expression, at any finite order in $`\alpha _s`$, we can deform the $`x`$ contour to get out of the region of small $`x`$. Then, the perturbation expansion converges, and we can take the $`n\mathrm{}`$ limit. Hence, this latter order of limits is the only one of the two that leads to a perturbation expansion that is not obviously unreliable.

Now let us consider the properties of two vacuum-polarization-bubble chains, as manifested in $`G_2`$ \[Eq. (5)\]. For $`x1`$, kinematics force $`y`$ to be in the nonperturbative region near 0. But, $`x1`$ implies that $`\sqrt{k^2}`$ is large compared with $`l`$ or with the three-momentum of the heavy quark. Then, in NRQCD, the propagator carrying $`k`$ can be shrunk to a point. The result is a one-loop correction to the color-octet operator $`𝒪_8({}_{}{}^{3}S_{1}^{})`$. We subtract this nonperturbative piece from the perturbative calculation and absorb it into the quarkonium matrix element of $`𝒪_8({}_{}{}^{3}S_{1}^{})`$. After these subtractions, the $`x`$ and $`y`$ contours can be deformed out of the nonperturbative region. Note that the contour-deformation argument is crucial. Without it, there would be contributions from the nonperturbative region in which both $`x`$ and $`y`$ are small. Such contributions would not have the form of a contribution to an NRQCD operator matrix element and would invalidate the NRQCD factorization formula.

Combining NNA resummation with the complete NLO calculation, we obtain $`R^{\mathrm{NNA}}=(3.01\pm 0.30\pm 0.34)\times 10^3`$, for $`\alpha _s(2m_c)=0.247\pm 0.012`$. This is about 50% larger than $`R^{\mathrm{NLO}}(2m_c)`$ and is in good agreement with experiment. The first uncertainty arises from the uncertainty in $`\alpha _s(2m_c)`$. The second uncertainty comes from a velocity-scaling estimate of the unknown matrix element of $`𝒪_8({}_{}{}^{3}S_{1}^{})`$, which we simply treat as an error of order $`v^3`$. In the resummed expression, the uncertainty from the choice of $`\mu `$ is reduced to about 11% because the bubble sum is a renormalization-group invariant (at leading order in the $`\beta `$ function), and, hence, only the residual non-bubble-sum contribution depends on $`\mu `$. As is the case with any resummation, the result depends on the choice of resummation scheme. We can check that our choice is reasonable by comparing with a different resummation scheme, namely, the use of the background-field-gauge gluon vacuum polarization instead of naive non-Abelianization. This scheme yields a very similar result: $`R^{\mathrm{BFG}}=(3.26\pm 0.31\pm 0.47)\times 10^3`$.

One may ask why the BLM method, which is supposed to account for vacuum-polarization corrections, yields a different result than NNA resummation. The BLM method approximately resums the vacuum-polarization correction through a choice of scale. A change of scale generates a geometric series: $`\alpha _s(\mu ^{})\alpha _S(\mu )[1+2\alpha _s(\mu )\beta _0\mathrm{ln}(\mu /\mu ^{})+\mathrm{}]`$. However, in the NNA resummation, the geometric series in the integrand may not yield a geometric series after integration over the gluon virtualities. For example, $`G_1(2m_c)=1+1.91\alpha _s(2m_c)+2.47\alpha _s^2(2m_c)+0.97\alpha _s^3(2m_c)4.49\alpha _s^4(2m_c)11.76\alpha _s^5(2m_c)+\mathrm{}`$, which is nothing like a geometric series.

## 7 Summary and Discussion

The NRQCD factorization approach has had significant successes in predicting the rates for a number of processes. Among these are inclusive $`P`$-wave quarkonium decays, quarkonium production at the Tevatron, $`\gamma \gamma J/\psi +X`$ at LEP, and quarkonium production in deep-inelastic scattering at HERA. Other processes are, so far, more problematic. The predictions of NRQCD factorization are unconfirmed for quarkonium polarization at the Tevatron, inelastic quarkonium photoproduction at HERA, and double $`c\overline{c}`$ production at Belle. For the former two processes, owing to large error bars, there is no real discrepancy at present.

More precise theoretical predictions are hampered by uncertainties in the NRQCD matrix elements and large corrections in NLO in $`\alpha _s`$ and $`v`$, which have cast some doubt on the convergence of the series in $`\alpha _s`$ and $`v`$. Lattice calculations can help to pin down the decay matrix elements. It is not yet known how to formulate the calculation of production matrix elements on the lattice. Calculations of higher order in $`v`$ are still lacking for many processes, but there is now hope that the $`v`$ expansion settles down in order $`v^4`$. In general, resummation of large corrections to the $`\alpha _s`$ series are needed. Standard methods exist for dealing with logarithmic corrections. The bubble resummation method is a promising technique for dealing with nonlogarithmic corrections associated with vacuum-polarization contributions. However, other types of large nonlogarithmic corrections are not yet understood. A possible clue to their analysis may lie in the fact that large order-$`\alpha _s`$ corrections seem to be correlated with large order-$`v^2`$ corrections.

It is clear that there are still many interesting and challenging problems in heavy-quarkonium physics that remain to be solved.

### 7.1 Acknowledgements

This work in the High Energy Physics Division at Argonne National Laboratory is supported by the U.S. Department of Energy, Division of High Energy Physics, under Contract W-31-109-ENG-38.