text:
# Constraints on Cosmological Parameters from the Analysis of the Cosmic Lens All Sky Survey Radio-Selected Gravitational Lens Statistics

## Abstract

We derive constraints on cosmological parameters and the properties of the lensing galaxies from gravitational lens statistics based on the final Cosmic Lens All Sky Survey (CLASS) data. For a flat universe with a classical cosmological constant, we find that the present matter fraction of the critical density is $`\mathrm{\Omega }_\mathrm{m}=0.31_{0.14}^{+0.27}`$ (68%) $`{}_{0.10}{}^{}{}_{}{}^{+0.12}`$ (systematic). For a flat universe with a constant equation of state for dark energy $`w=p_x(\text{pressure})/\rho _x(\text{energy density})`$, we find $`w<0.55_{0.11}^{+0.18}`$ (68%).

preprint: Phys. Rev. Lett.

Gravitational lensing, in which a background source behind a foreground object is seen as distorted and (de)magnified image(s), is well-understood by the simple physics of light deflections in a weak gravitational field. Hence, the analysis of lens statistics can provide a technique Turneretal  for constraining cosmological parameters that is both powerful and complementary to other methods Cosmology . However, for lens statistics to be useful, it is vital to have an unbiased statistical sample of sources that is complete within well-defined observational selection criteria CLASS1and2  and to properly take into account all factors in a statistical lensing model CLASS3 . The statistical properties of gravitational lensing in a sample are the total lensing rate, the image separations, the lens redshifts, the source redshifts, and the image multiplicities. These properties depend not only on cosmological parameters but also on the properties of the lensing galaxies and the distributions of the sources in redshift ($`z`$) and in luminosity in the observational selection waveband (e.g. radio here) CLASS3 .

Recent advances in observations permit us to do a reliable analysis of lens statistics to obtain limits on cosmological parameters. First, the largest radio-selected galactic mass-scale gravitational lens search project to date, the Cosmic Lens All Sky Survey (CLASS), has now been completed, resulting in the largest sample suitable for statistical analyses CLASS1and2 . Second, currently available independent data sets on the distributions of (flat spectrum) radio sources in flux density and in redshift are concordant CLASS1and2 ; CLASS3 . Third, recent large-scale observations of galaxies, in particular the Two Degree Field Galaxy Redshift Survey (2dFGRS) and the Sloan Digital Sky Survey (SDSS), have produced converging results on the total galaxy luminosity function (LF; i.e., distribution of galaxy number density in luminosity), and there exist fairly reliable observational results that permit us to extract from the total LF morphological type-specific LFs, i.e., an early-type (i.e. ellipticals and S0 galaxies) LF and a late-type (i.e. spirals and others) LF CLASS3 ; LF . In this Letter, we report the main results on cosmological parameters from a likelihood analysis of lens statistics based on these crucial sets of data. The detailed procedure of the analysis will be described in a later publication CLASS3  in which extended analyses will be presented for broader range of parameters and with an emphasis on the global properties of galaxy populations.

The CLASS statistical sample suitable for our analysis contains 8958 radio sources out of which 13 sources are multiply-imaged CLASS1and2 . The lens search looked for multiple-lensing image components of the central compact radio core in the background sources. The CLASS statistical sample is defined so as to meet the following observational selection criteria CLASS1and2 : (1) the spectral index between 1.4 GHz and 5 GHz is flatter than $`0.5`$, i.e. $`\alpha 0.5`$ with $`S_\nu \nu ^\alpha `$ where $`S_\nu `$ is flux density measured in milli-jansky (mJy; 1 mJy $``$ $`10^{29}`$ W m-2 Hz-1); (2) the total flux density of each source is $``$ 30 mJy at 5 GHz; (3) the total flux density of each source is $``$ 20 mJy at 8.4 GHz; (4) the image components in lens systems must have separations $`0.3`$ arcsec and the ratio of the flux densities of the fainter to the brighter component in double-image systems must be $`0.1`$. Number counts for sources at $`\nu =5`$ GHz are consistent with a (broken) power-law differential number-flux density relation $`|dN/dS|`$ (i.e. number of sources per flux density bin) $`(S/S^0)^\eta `$ with $`\eta =2.07\pm 0.02`$ ($`1.97\pm 0.14`$) for $`SS^0`$ ($`SS^0`$) and $`S^0=30`$ mJy. These results are consistent with the prediction of the Dunlop & Peacock (1990) free-form model number 5 radio luminosity function that is consistent with redshift data at $`S>1`$ mJy CLASS1and2 ; CLASS3 . Redshift measurements for a representative CLASS subsample and the prediction of the aforementioned Dunlop & Peacock (1990) model consistently suggest that the redshift distribution for the CLASS unlensed sources can be adequately described by a Gaussian model with mean redshift, $`z=1.27`$ and dispersion 0.95 CLASS1and2 ; CLASS3 . The properties of the 13 multiply-imaged sources are summarized in Table 1.

The luminosity function of galaxies is assumed to be well-described by a Schechter function LF  of the form

$$\frac{dn}{d(L/L_{})}=n_{}\left(\frac{L}{L_{}}\right)^\alpha \mathrm{exp}(L/L_{}),$$
(1)
where $`\alpha `$ is a faint-end slope and $`n_{}`$ and $`L_{}`$ are characteristic number density and characteristic luminosity, respectively. From Eq. (1) an integrated luminosity density $`j`$ is given by $`j=_0^{\mathrm{}}𝑑LL(dn/dL)=n_{}L_{}\mathrm{\Gamma }(\alpha +2)`$. The luminosity of a galaxy is correlated with its line-of-sight stellar velocity dispersion ($`\sigma `$) via the empirical relations,

$$\frac{L}{L_{}}10^{0.4(M_{}M)}=\left(\frac{\sigma }{\sigma _{}}\right)^\gamma ,$$
(2)
where $`M_{}`$ and $`\sigma _{}`$ are respectively characteristic absolute magnitude and characteristic velocity dispersion, and $`\gamma `$ corresponds to the Faber-Jackson (Tully-Fisher) exponent for an early-type (late-type) population FJTF ; throughout we take $`\gamma _{\mathrm{Faber}\mathrm{Jackson}}=4.0`$ and $`\gamma _{\mathrm{Tully}\mathrm{Fisher}}=2.9`$ FJTF . The 2dFGRS team and the SDSS team independently determine the Schechter parameters for galaxies at $`z0.2`$ summed over all galactic types and their results are consistent with each other LF . The converging result can be expressed in the $`b_J`$ photometric system as $`M_{}5\mathrm{log}_{10}h=19.69\pm 0.04`$ (hereafter $`h`$ is the Hubble constant $`H_0`$ in units of 100 km s-1 Mpc-1), $`\alpha =1.22\pm 0.02`$, and $`n_{}=(1.71\pm 0.07)\times 10^2`$ $`h^3`$ Mpc-3, which gives an integrated luminosity density of $`j=(2.02\pm 0.15)\times 10^8`$ $`h`$ $`L_{}`$ Mpc-3. From the total LF we extract the type-specific LFs based on measured relative type-specific LFs keeping the total luminosity density fixed. The type-specific LFs are required because the early-type and the late-type populations are dynamically different and contribute to the multiple imaging in distinctively different ways, namely that the early-type population contributes more to the total lensing rate and on average generates larger image splittings CLASS3 . We use the relative LFs obtained from the Second Southern Sky Redshift Survey (SSRS2), which is based on 5404 local ($`z0.05`$) galaxies. We obtain the following early-type ($`e`$) and late-type ($`s`$) LFs expressed in the $`b_J`$ photometric system: for the early-type population, $`M_{}^{(e)}5\mathrm{log}_{10}h=19.63_{0.11}^{+0.10}`$, $`\alpha ^{(e)}=1.00\pm 0.09`$, and $`n_{}^{(e)}=(0.64\pm 0.19)\times 10^2`$ $`h^3`$ Mpc-3; for the late-type population, $`\alpha ^{(s)}=1.22\pm 0.02`$, $`M_{}^{(s)}=19.69\pm 0.04`$, and $`n_{}^{(s)}=(1.20\pm 0.11)\times 10^2`$ $`h^3`$ Mpc-3. To break a degeneracy we have chosen $`\alpha ^{(s)}=\alpha `$ and $`M_{}^{(s)}=M_{}`$ since the total LF is dominated by late-type galaxies. For alternative type-specific LFs obtained from the 2dFGRS, the reader is referred to CLASS3 ; LF . When the alternative type-specific LFs are used, our derived limits on cosmological parameters are essentially unchanged.

The multiple imaging cross section of a galaxy can be related to and calculated from the line-of-sight velocity dispersion of the galaxy. However, the relation is not unique but depends on the mass profile and intrinsic shape of the galaxy. This dependence will be absorbed into a “dynamical normalization” factor $`\lambda (f)`$ below. It is known that projected surface densities of the inner cylindrical regions of galaxies along the line-of-sight probed by gravitational lensing are well approximated by a singular isothermal mass profile or a profile similar to it CLASS3 . In this Letter, we adopt a singular isothermal ellipsoid (SIE) as a galaxy lens model, whose projected density can be expressed in units of lensing critical surface density $`\mathrm{\Sigma }_{\mathrm{cr}}=c^2D_{\mathrm{OS}}/(4\pi GD_{\mathrm{OL}}D_{\mathrm{LS}})`$ as

$$\kappa (x,y)=\frac{r_{\mathrm{cr}}}{2}\frac{\sqrt{f}\lambda (f)}{\sqrt{x^2+f^2y^2}},$$
(3)
where $`f`$ is the apparent minor-to-major axis ratio, $`\lambda (f)`$ is the dynamical normalization factor for a given dynamical model, and

$$r_{\mathrm{cr}}=4\pi \left(\frac{\sigma }{c}\right)^2\frac{D_{\mathrm{OL}}D_{\mathrm{LS}}}{D_{\mathrm{OS}}}$$
(4)
is the critical radius for $`f=1`$. $`D_{\mathrm{OL}}`$, $`D_{\mathrm{LS}}`$ and $`D_{\mathrm{OS}}`$ are angular diameter distances between observer (O), lensing galaxy (L), and source (S). Calculations of dynamical normalizations for axisymmetric cases (i.e. oblate and prolate) can be found in CLASS3 . For the case of equal numbers of oblates and prolates, $`|\lambda (f)1|0.06`$ for $`f>0.4`$.

Let $`s_m(f)`$ be the lensing cross section for image multiplicity $`m`$ ($`=2,4`$) due to the surface density given by equation (3) in units of $`r_{\mathrm{cr}}^2`$ (Eq. 4). Then, we have $`s_m(f)=[\lambda (f)]^2\widehat{s}_m(f)`$ where $`\widehat{s}_m(f)`$ can be evaluated numerically CLASS3 . The differential probability for a source with redshift $`z_s`$ and flux density $`S`$ to be multiply-imaged with image multiplicity $`m`$ and image separation $`\mathrm{\Delta }\theta `$ to $`\mathrm{\Delta }\theta +d(\mathrm{\Delta }\theta )`$, due to a distribution of intervening galaxies of type $`g`$ ($`g=e`$, $`s`$) at $`z`$ to $`z+dz`$ modeled by SIEs and described by a type-specific Schechter LF, is given by

$`{\displaystyle \frac{d^2p_m^{(g)}}{dzd(\mathrm{\Delta }\theta )}}`$ $`=`$ $`s_m(f)8\pi ^2\gamma \left|c{\displaystyle \frac{dt}{dz}}\right|(1+z)^3\left({\displaystyle \frac{D_{\mathrm{OL}}D_{\mathrm{LS}}}{D_{\mathrm{OS}}}}\right)^2`$ (5)
$`\times n_{}\left({\displaystyle \frac{\sigma _{}}{c}}\right)^4{\displaystyle \frac{1}{\mathrm{\Delta }\theta _{}}}\left({\displaystyle \frac{\mathrm{\Delta }\theta }{\mathrm{\Delta }\theta _{}}}\right)^{(\alpha \gamma +\gamma +2)/2}`$
$`\times \mathrm{exp}\left[\left({\displaystyle \frac{\mathrm{\Delta }\theta }{\mathrm{\Delta }\theta _{}}}\right)^{\gamma /2}\right]B_m(z_s,S),`$
where $`B_m(z_s,S)`$ is a magnification bias factor (i.e., an over-representation of multiply-imaged sources because of flux amplifications) which depends on a magnification probability distribution and $`|dN/dS|`$ and can be calculated numerically CLASS3 . In Eq. (5), $`\mathrm{\Delta }\theta _{}`$ is a characteristic image (angular) separation given by

$$\mathrm{\Delta }\theta _{}=\lambda (f)8\pi \frac{D_{\mathrm{LS}}}{D_{\mathrm{OS}}}\left(\frac{\sigma _{}}{c}\right)^2.$$
(6)
The differential probability with $`\mathrm{\Delta }\theta `$ to $`\mathrm{\Delta }\theta +d(\mathrm{\Delta }\theta )`$ can be obtained from Eq. (5):

$$\frac{dp_m^{(g)}}{d(\mathrm{\Delta }\theta )}=_0^{z_s}\frac{d^2p_m^{(g)}}{dzd(\mathrm{\Delta }\theta )}𝑑z.$$
(7)
The differential probability with any $`\mathrm{\Delta }\theta >\mathrm{\Delta }\theta _{\text{min}}`$ due to galaxies at $`z`$ to $`z+dz`$ is given by

$`{\displaystyle \frac{dp_m^{(g)}}{dz}}`$ $`=`$ $`s_m(f)16\pi ^2\mathrm{\Gamma }\left(\alpha +1+{\displaystyle \frac{4}{\gamma }}\right)\left|c{\displaystyle \frac{dt}{dz}}\right|(1+z)^3`$ (8)
$`\times n_{}\left({\displaystyle \frac{\sigma _{}}{c}}\right)^4\left({\displaystyle \frac{D_{\mathrm{OL}}D_{\mathrm{LS}}}{D_{\mathrm{OS}}}}\right)^2B_m(z_s,S)`$
$`{\displaystyle _0^{\mathrm{\Delta }\theta _{\text{min}}}}{\displaystyle \frac{d^2p_m^{(g)}}{dzd(\mathrm{\Delta }\theta )}}d(\mathrm{\Delta }\theta ).`$
Finally, the integrated probability is given by

$$p_m^{(g)}=_0^{z_s}\frac{dp_m^{(g)}}{dz}𝑑z.$$
(9)
For the sample of CLASS sources containing $`N_\mathrm{L}`$ multiply-imaged sources and $`N_\mathrm{U}`$ unlensed sources, the likelihood $``$ of observing the number and the properties of the multiply-imaged sources (Table 1) and the number of the unlensed sources given the statistical lensing model, is defined by

$$\mathrm{ln}=\underset{i=1}{\overset{N_\mathrm{U}}{}}\mathrm{ln}\left[1\underset{m=2,4}{}p_m^{(\mathrm{all})}(i)\right]+\underset{k=1}{\overset{N_\mathrm{L}}{}}\mathrm{ln}\delta p_m^{(\mathrm{one})}(k),$$
(10)
where the integrated probability (Eq. 9) $`p_m^{(\mathrm{all})}(i)=p_m^{(e)}(i)+p_m^{(s)}(i)`$ and the differential probability (Eqs. 5, 7, or 8) $`\delta p_m^{(\mathrm{one})}(k)`$ is given by

$$\delta p_m^{(\mathrm{one})}(k)=w^{(e)}(k)\delta p_m^{(e)}(k)+w^{(s)}(k)\delta p_m^{(s)}(k)$$
(11)
with $`w^{(e)}(k)+w^{(s)}(k)=1`$. If the $`k`$-th lensing galaxy type is known to be an early-type (late-type), $`w^{(e)}(k)=1`$ ($`w^{(s)}(k)=1`$). If the $`k`$-th lensing galaxy type is unknown, we use $`w^{(g)}(k)=\delta p_m^{(g)}(k)/[\delta p_m^{(e)}(k)+\delta p_m^{(s)}(k)]`$ if the lens redshift is known, and we use $`w^{(e)}(k)=0.8`$ and $`w^{(s)}(k)=0.2`$ otherwise. From Eq. (10), a “$`\chi ^2`$” is defined as

$$\chi ^2=2\mathrm{ln}.$$
(12)
We calculate the $`\chi ^2`$ (Eq. 12) over grids of the model free parameters (see below; in each grid point the $`\chi ^2`$ is minimized over the nuisance parameters) and determine the best-fit values and errors of the free parameters. We allow most of the critical parameters to be free while we fix the parameters that are well-determined by observations or to which the $`\chi ^2`$ is insensitive. The free parameters to be determined by minimizing the $`\chi ^2`$ are as follows: present matter density $`\mathrm{\Omega }_\mathrm{m}`$, present vacuum density $`\mathrm{\Omega }_\mathrm{\Lambda }`$ or dark energy density $`\mathrm{\Omega }_x`$ (all expressed as fractions of the present critical density) with its constant equation of state $`w=p_x/\rho _x`$ (where $`p_x`$ and $`\rho _x`$ are its isotropic pressure and uniform energy density), early-type and late-type characteristic velocity dispersions $`\sigma _{}^{(e)}`$ and $`\sigma _{}^{(s)}`$, and the mean apparent axial ratio of galaxies $`\overline{f}`$. A critical but fixed parameter is the early-type characteristic number density $`n_{}^{(e)}`$. However, whichever of the presently available choices of type-specific LFs we use, the derived constraints on cosmological parameters turn out to be virtually the same. One key assumption we make is that the (relatively) locally determined early-type number density $`n_{}^{(e)}`$ along with the faint-end slope $`\alpha ^{(e)}`$ have not evolved since $`z1`$. This appears to be a valid assumption based on current evidence and understanding Peebles . However, if there is any significant reduction in the early-type number density at $`z0.6`$ compared with the present epoch, our presently determined matter density (dark energy density) will be overestimated (underestimated).

We present our results based on the type-specific LFs derived using the SSRS2 LFs and a dynamical normalization assuming equal frequencies of oblates and prolates.

Figure 1 shows likelihood regions in a matter plus vacuum cosmology: we find the combination $`\mathrm{\Omega }_\mathrm{\Lambda }1.2\mathrm{\Omega }_\mathrm{m}=0.40_{0.56}^{+0.33}`$ (68%) ($`{}_{1.57}{}^{}{}_{}{}^{+0.52}`$ at 95%). Figure 2 shows the likelihood in the $`w`$-$`\mathrm{\Omega }_\mathrm{m}`$ plane with the prior that the universe is flat; we find $`w<0.55_{0.11}^{+0.18}`$ (68%). This limit is in agreement with other recent results Eqofstate . For a flat universe with a cosmological constant (i.e. for $`w=1`$), we find $`\mathrm{\Omega }_\mathrm{m}=0.31_{0.14}^{+0.27}`$ (68%) ($`{}_{}{}^{+0.75}{}_{0.23}{}^{}`$ at 95%) $`{}_{}{}^{+0.12}{}_{0.10}{}^{}`$ (systematic). The identified systematics are due to the uncertainties in the redshift distribution and the differential number-flux density relation of the sources. For the flat $`w=1`$ case, other fitted values of the parameters are: $`\sigma _{}^{(e)}=198_{37}^{+53}`$ km s-1, $`\sigma _{}^{(s)}=117_{31}^{+45}`$ km s-1, and $`\overline{f}<0.83`$, all at 95%.

In conclusion, the likelihood function (or, $`\chi ^2`$; Eq. 12) of the CLASS data has well-defined confidence regions in the parameter space defined by our cosmological and galactic parameters. Our constraint in the $`\mathrm{\Omega }_\mathrm{m}`$-$`\mathrm{\Omega }_\mathrm{\Lambda }`$ plane based solely on lens statistics agrees with that from Type Ia supernovae observations Cosmology . Our determined value of $`\mathrm{\Omega }_\mathrm{m}`$ in flat cosmologies is also in good agreement with several recent independent determinations Cosmology . Compared with previous works in lens statistics CLASS3 , our results imply not only positive but higher dark energy density. Therefore, our results, which are based on different physics, assumptions and astronomical relations, and independent sets of data, add to the evidence for a universe with low matter density and high dark-energy density.


format: text

text:
# 1 Introduction.

## 1 Introduction.

We know since Liouville that integrability means commuting Hamiltonians. It is the primary role of Lax matrices and the Yang-Baxter equation to provide non trivial such Hamiltonians. In the classical theory, additional benefits are the spectral curve $`\mathrm{\Gamma }`$ and the ability to separate variables by considering $`g=\mathrm{genus}(\mathrm{\Gamma })`$ points on it .
In the quantum theory, the analog construction is Sklyanin’s method of separation of variables and Baxter’s equations . Despite the beauty of this result, the route from a Yang–Baxter defined quantum integrable model to the separated variables is usually long and difficult, especially in the non hyperelliptic case.
Here, we show that we can reverse the strategy. We start from separated variables and consider Baxter’s equations as equations for the Hamiltonians. We then prove that these Hamiltonians commute under very general hypothesis.
By its generality, its simplicity and its close analogy to the classical case, this result could provide a good starting point to build a theory of quantum integrable systems.

## 2 The main theorem.

Consider a curve in $`C^2`$

$$\mathrm{\Gamma }(\lambda ,\mu )R_0(\lambda ,\mu )+\underset{j=1}{\overset{g}{}}R_j(\lambda ,\mu )H_j=0$$
(1)
where the $`H_i`$ are the only dynamical moduli, so that $`R_0(\lambda ,\mu )`$ and $`R_i(\lambda ,\mu )`$ do not contain any dynamical variables. If things are set up so that $`\mathrm{\Gamma }`$ is of genus $`g`$ and there are exactly $`g`$ Hamiltonian $`H_j`$ (see below for realizations of this setup), then the curve is completely determined by requiring that it passes through $`g`$ points $`(\lambda _i,\mu _i)`$, $`i=1,\mathrm{},g`$. Indeed, the moduli $`H_j`$ are determined by solving the linear system

$$\underset{j=1}{\overset{g}{}}R_j(\lambda _i,\mu _i)H_j+R_0(\lambda _i,\mu _i)=0,i=1,\mathrm{},g$$
(2)
whose solution is

$$H=B^1V$$
(3)
where

$$H=\left(\begin{array}{c}H_1\\ \mathrm{}\\ H_i\\ \mathrm{}\\ H_g\end{array}\right),B=\left(\begin{array}{ccc}R_1(\lambda _1,\mu _1)& \mathrm{}& R_g(\lambda _1,\mu _1)\\ \mathrm{}& & \mathrm{}\\ R_1(\lambda _i,\mu _i)& \mathrm{}& R_g(\lambda _i,\mu _i)\\ \mathrm{}& & \mathrm{}\\ R_1(\lambda _g,\mu _g)& \mathrm{}& R_g(\lambda _g,\mu _g)\end{array}\right),V=\left(\begin{array}{c}R_0(\lambda _1,\mu _1)\\ \mathrm{}\\ R_0(\lambda _i,\mu _i)\\ \mathrm{}\\ R_0(\lambda _g,\mu _g)\end{array}\right)$$

Here, of course, we assume that generically $`detB0`$.

###### Theorem 1

Suppose that the variables $`(\lambda _i,\mu _i)`$ are separated i.e. they Poisson commute for $`ij`$:

$$\{\lambda _i,\lambda _j\}=0,\{\mu _i,\mu _j\}=0,\{\lambda _i,\mu _j\}=p(\lambda _i,\mu _i)\delta _{ij}$$
(4)
Then the Hamiltonians $`H_i`$, $`i=1\mathrm{}g`$, defined by eq.(3) Poisson commute

$$\{H_i,H_j\}=0$$

Proof. Let us compute

$`B_1B_2\{(B^1V)_1,(B^1V)_2\}`$ $`=`$ $`\{B_1,B_2\}(B^1V)_1(B^1V)_2`$
$`\{B_1,V_2\}(B^1V)_1\{V_1,B_2\}(B^1V)_2+\{V_1,V_2\}`$
Taking the matrix element $`i,j`$ of this expression, we get

$`\left(B_1B_2\{(B^1V)_1,(B^1V)_2\}\right)_{ij}`$ $`=`$ $`\delta _{ij}{\displaystyle \underset{k,l}{}}\{B_{ik},B_{il}\}(B^1V)_k(B^1V)_l`$
$`\delta _{ij}{\displaystyle \underset{k}{}}\{B_{ik},V_i\}(B^1V)_k\delta _{ij}{\displaystyle \underset{l}{}}\{V_i,B_{il}\}(B^1V)_l+\delta _{ij}\{V_i,V_i\}=0`$
where $`\delta _{ij}`$ occurs because the variables are separated.

It can hardly be simpler. The only thing we use is that the Poisson bracket vanishes between different lines of the matrices, and then the antisymmetry. We did not even need to specify the Poisson bracket between $`\lambda _i`$ and $`\mu _i`$. The Hamiltonian are in involution whatever this Poisson bracket is. This is the root of the multihamiltonian structure of integrable systems.

Can we make it quantum? Let us consider a set of separated variables

$$[\lambda _i,\lambda _j]=0,[\mu _i,\mu _j]=0,[\lambda _i,\mu _j]=p(\lambda _i,\mu _i)\delta _{ij}$$

We want Baxter’s equation, so we start from the linear system

$$\underset{j}{}R_j(\lambda _i,\mu _i)H_j+R_0(\lambda _i,\mu _i)=0$$
(5)
Here the $`H_j`$ are on the right, and in $`R_j(\lambda _i,\mu _i)`$, $`R_0(\lambda _i,\mu _i)`$, we assume some order between $`\lambda _i,\mu _i`$, but the coefficients in these functions are non dynamical. Hence we start from the linear system

$$BH=V$$
(6)
We notice that we can define unambiguously the left inverse of $`B`$. First, the determinant $`D`$ of $`B`$ is well defined because it never involves a product of elements on the same line. The same is true for the cofactor $`\mathrm{\Delta }_{ij}`$ of the element $`B_{ij}`$ (we include the sign $`(1)^{i+j}`$ in the definition of $`\mathrm{\Delta }_{ij}`$). Define

$$B_{ij}^1(B^1)_{ij}=D^1\mathrm{\Delta }_{ji}$$

We have

$$(B^1B)_{ij}=\underset{k}{}D^1\mathrm{\Delta }_{ki}B_{kj}$$

But $`\mathrm{\Delta }_{ki}`$ does not contain any element $`B_{kl}`$, hence the product $`\mathrm{\Delta }_{ki}B_{kj}`$ is commutative, and the usual construction of the inverse of $`B`$ is still valid. Since the left and right inverse coincide in an associative algebra with unit, we have the identities

$$(BB^1)_{ij}=\underset{k}{}B_{ik}B_{kj}^1=\underset{k}{}B_{ik}D^1\mathrm{\Delta }_{jk}=\delta _{ij}$$
(7)
We write the solution of eq.(6) as

$$H=B^1V$$
(8)
###### Theorem 2

The quantities $`H_i`$ defined by eq.(8), which solve Baxter’s equations eqs.(5), are all commuting

$$[H_i,H_j]=0$$

Proof. Using that $`V_k`$ and $`V_l`$ commute, $`[V_k,V_l]=0`$, we compute

$`[H_i,H_j]`$ $`=`$ $`{\displaystyle \underset{k,l}{}}[B_{ik}^1V_k,B_{jl}^1V_l]`$
$`=`$ $`{\displaystyle \underset{k,l}{}}[B_{ik}^1,B_{jl}^1]V_kV_lB_{ik}^1[B_{jl}^1,V_k]V_l+B_{jl}^1[B_{ik}^1,V_l]V_k`$
Using

$$[A^1,B^1]=A^1B^1[A,B]B^1A^1=B^1A^1[A,B]A^1B^1$$

so that

$`[B_{ik}^1,B_{jl}^1]`$ $`=`$ $`{\displaystyle \underset{rs,r^{}s^{}}{}}B_{ir}^1B_{jr^{}}^1[B_{rs},B_{r^{}s^{}}]B_{s^{}l}^1B_{sk}^1`$
$`=`$ $`{\displaystyle \underset{rs,r^{}s^{}}{}}B_{jr^{}}^1B_{ir}^1[B_{rs},B_{r^{}s^{}}]B_{sk}^1B_{s^{}l}^1`$
the first term can be written

$`{\displaystyle \underset{k,l}{}}[B_{ik}^1,B_{jl}^1]V_kV_l`$ $`=`$ $`{\displaystyle \frac{1}{2}B_{ir}^1B_{jr^{}}^1[B_{rs},B_{r^{}s^{}}]\left(B_{s^{}l}^1B_{sk}^1+B_{s^{}k}^1B_{sl}^1\right)V_kV_l}`$
$`=`$ $`{\displaystyle \frac{1}{2}B_{jr^{}}^1B_{ir}^1[B_{rs},B_{r^{}s^{}}]\left(B_{sk}^1B_{s^{}l}^1+B_{sl}^1B_{s^{}k}^1\right)V_kV_l}`$
Using that $`[B_{rs},B_{r^{}s^{}}]=\delta _{rr^{}}[B_{rs},B_{rs^{}}]`$ and is therefore antisymmetric in $`ss^{}`$, and setting

$$K_{ss^{}}=\underset{k,l}{}\left(B_{s^{}l}^1B_{sk}^1+B_{s^{}k}^1B_{sl}^1B_{sl}^1B_{s^{}k}^1B_{sk}^1B_{s^{}l}^1\right)V_kV_l$$

we get

$`{\displaystyle \underset{k,l}{}}[B_{ik}^1,B_{jl}^1]V_kV_l`$ $`=`$ $`{\displaystyle \underset{rss^{}}{}}{\displaystyle \frac{1}{4}}B_{ir}^1B_{jr}^1[B_{rs},B_{rs^{}}]K_{ss^{}}`$
$`=`$ $`{\displaystyle \underset{rss^{}}{}}{\displaystyle \frac{1}{4}}B_{jr}^1B_{ir}^1[B_{rs},B_{rs^{}}]K_{ss^{}}`$
$`=`$ $`{\displaystyle \underset{rss^{}}{}}{\displaystyle \frac{1}{8}}[B_{ir}^1,B_{jr}^1][B_{rs},B_{rs^{}}]K_{ss^{}}`$
The last two terms in eq.(2) are simpler, we get

$`{\displaystyle \underset{k,l}{}}B_{jl}^1[B_{ik}^1,V_l]V_kB_{ik}^1[B_{jl}^1,V_k]V_l={\displaystyle \underset{rsk}{}}[B_{ir}^1,B_{jr}^1][B_{rs},V_r]B_{sk}^1V_k`$
The quantities $`H_i`$ will commute if

$$[B_{ir}^1,B_{jr}^1]=0,i,j,r$$
(10)
This is true as shown in the next Lemma.

The condition eq.(10) says that the elements on the same column of $`B^1`$ commute among themselves. In a sense this is a condition dual to the one on $`B`$. It is true semiclassically because

$$\{B_{ir}^1,B_{jr}^1\}=\underset{a,a^{},b,b^{}}{}B_{ia}^1B_{ja^{}}^1\{B_{ab},B_{a^{}b^{}}\}B_{br}^1B_{b^{}r}^1=\underset{a,b,b^{}}{}B_{ia}^1B_{ja}^1\{B_{ab},B_{ab^{}}\}B_{br}^1B_{b^{}r}^1=0$$

where in the last step we use the antisymmetry of the Poisson bracket. We show that it is also true quantum mechanically333The same Lemma already appeared in . Our two proofs are different and independent however. We thank B. Enriquez for drawing our attention to his work..

###### Lemma 1

Let $`B`$ be a matrix whose elements commute if they do not belong to the same line

$$[B_{ik},B_{jl}]=0\mathrm{if}ij$$

Then the inverse $`B^1`$ of $`B`$ is defined without ambiguity and moreover elements on a same column of $`B^1`$ commute

$$[B_{ir}^1,B_{jr}^1]=0$$

Proof. We want to show that

$$\mathrm{\Delta }_{ri}B_{jr}^1=\mathrm{\Delta }_{rj}B_{ir}^1$$

denote by $`\beta _i^{(r)}`$ the vector with components $`B_{ki}`$, $`kr`$. Then we have (with $`j>i`$)

$`\mathrm{\Delta }_{ri}B_{jr}^1`$ $`=`$ $`(1)^{r+i}\beta _1^{(r)}\beta _2^{(r)}\mathrm{}\widehat{\beta _i^{(r)}}\mathrm{}\beta _j^{(r)}\mathrm{}\beta _g^{(r)}B_{jr}^1`$
$`=`$ $`(1)^{r+i+gj}\beta _1^{(r)}\beta _2^{(r)}\mathrm{}\widehat{\beta _i^{(r)}}\mathrm{}\widehat{\beta _j^{(r)}}\mathrm{}\beta _g^{(r)}\beta _j^{(r)}B_{jr}^1`$
$`=`$ $`(1)^{r+i+gj+1}\beta _1^{(r)}\beta _2^{(r)}\mathrm{}\widehat{\beta _i^{(r)}}\mathrm{}\widehat{\beta _j^{(r)}}\mathrm{}\beta _g^{(r)}{\displaystyle \underset{kj}{}}\beta _k^{(r)}B_{kr}^1`$
$`=`$ $`(1)^{r+i+gj+1}\beta _1^{(r)}\beta _2^{(r)}\mathrm{}\widehat{\beta _i^{(r)}}\mathrm{}\widehat{\beta _j^{(r)}}\mathrm{}\beta _g^{(r)}\beta _i^{(r)}B_{ir}^1`$
$`=`$ $`(1)^{r+j}\beta _1^{(r)}\beta _2^{(r)}\mathrm{}\beta _i^{(r)}\mathrm{}\widehat{\beta _j^{(r)}}\mathrm{}\beta _g^{(r)}B_{ir}^1`$
$`=`$ $`\mathrm{\Delta }_{rj}B_{ir}^1`$
where in the third line we used eq.(7). In the above manipulations, we never have two operators $`B_{ij}`$ on the same line so we can use the usual properties of the wedge product. Moreover it is important that the line $`r`$ is absent in the definition of $`\beta ^{(r)}`$. Remark that this equation can also be written $`\mathrm{\Delta }_{ri}D^1\mathrm{\Delta }_{rj}=\mathrm{\Delta }_{rj}D^1\mathrm{\Delta }_{ri}`$ which is a Yang–Baxter type equation.

With this Lemma, we have completed the proof of our theorem. It is remarkable that, again, only the separated nature of the variables $`\lambda _i,\mu _i`$ is used in this construction, but the precise commutation relations between $`\lambda _i,\mu _i`$ does not even need to be specified. This is the origin of the multi Hamiltonian structure of integrable systems, here extended to the quantum domain.

## 3 Choosing the right number of dynamical moduli.

Let us explain how one can set up things in order that the number of dynamical moduli is equal to the genus of the Riemann surface. To understand the origin of the conditions we will write, let us explain first what happens in the setting of general rational Lax matrices described in . Quite generally, a Lax matrix $`L(\lambda )`$ depending rationally on a spectral parameter $`\lambda `$, with poles at points $`\lambda _k`$ can be written as

$`L(\lambda )=L_0+{\displaystyle \underset{k}{}}L_k(\lambda )`$ (11)
where $`L_0=\mathrm{Diag}(a_1,\mathrm{},a_N)`$ is a constant diagonal matrix and $`L_k(\lambda )`$ is the polar part of $`L(\lambda )`$ at $`\lambda _k`$, ie. $`L_k(\lambda )=_{r=n_k}^1L_{k,r}(\lambda \lambda _k)^r`$. In order to have a good phase space to work with, we assume that $`L_k(\lambda )`$ lives in a coadjoint orbit of the group of $`N\times N`$ matrix regular in the vicinity of $`\lambda =\lambda _k`$, i.e.

$$L_k=\left(g_kA_kg_k^1\right)_{}$$

Here $`A_k(\lambda )`$ is a diagonal matrix with a pole of order $`n_k`$ at $`\lambda =\lambda _k`$, and $`g_k`$ has a regular expansion at $`\lambda =\lambda _k`$. The notation $`()_{}`$ means taking the singular part at $`\lambda =\lambda _k`$. This singular part only depends on the singular part $`(A_k)_{}`$ and the first $`n_k`$ coefficients of the expansion of $`g_k`$ in powers of $`(\lambda \lambda _k)`$. The matrix $`(A_k)_{}`$ is an orbit invariant which specifies the coadjoint orbit, and is not a dynamical variable. It is in the center of the Kirillov bracket which as shown in  induces the Poisson bracket eq.(4), with $`p(\lambda _i,\mu _i)=1`$, on the separated variables. The physical degrees of freedom are contained in the first $`n_k`$ coefficients of $`g_k(\lambda )`$. Note however that since $`A_k`$ commutes with diagonal matrices one has to take the quotient by $`g_kg_kd_k`$ where $`d_k(\lambda )`$ is a regular diagonal matrix, in order to correctly describe the dynamical variables on the orbit. The dimension of the orbit of $`L_k`$ is thus $`N(N1)n_k`$ so that $`L(\lambda )`$ depends on $`_kN(N1)n_k`$ degrees of freedom. Finally, the form and analyticity properties of $`L(\lambda )`$ are invariant under conjugation by constant matrices. To preserve the normalization, $`L_0`$, at $`\mathrm{}`$ these matrices have to be diagonal (if all the $`a_i`$’s are different). Generically, these transformations reduce the dimension of the phase space by $`2(N1)`$, yielding:

$$\mathrm{dim}=(N^2N)\underset{k}{}n_k2(N1)$$

The spectral curve is

$`\mathrm{\Gamma }:R(\lambda ,\mu )det(L(\lambda )\mu \mathrm{𝟏})=(\mu )^N+{\displaystyle \underset{q=0}{\overset{N1}{}}}r_q(\lambda )\mu ^q=0`$ (12)
The coefficients $`r_q(\lambda )`$ are polynomials in the matrix elements of $`L(\lambda )`$ and therefore have poles at $`\lambda _k`$. The curve is naturally presented as a $`N`$–sheeted covering of the $`\lambda `$-plane. We call $`\mu _j(\lambda )`$ the $`N`$ branches over $`\lambda `$. Using the Riemann–Hurwitz formula, we can compute the genus of $`\mathrm{\Gamma }`$ :

$$g=\frac{N(N1)}{2}\underset{k}{}n_kN+1=\frac{1}{2}\mathrm{dim}$$

It is important to observe that the genus is half the dimension of phase space. So the number of action variables occurring as independent parameters in the eq.(12) should also be equal to $`g`$. Let us verify it. Since $`r_j(\lambda )`$ is the symmetrical function $`\sigma _j(\mu _1,\mathrm{},\mu _N)`$, it is a rational function of $`\lambda `$. It has a pole of order $`jn_k`$ at $`\lambda =\lambda _k`$. Its value at $`\lambda =\mathrm{}`$ is known since $`\mu _j(\lambda )a_j`$. Hence it can be expressed on $`j_kn_k`$ parameters namely the coefficients of all these poles. Altogether we have $`\frac{1}{2}N(N+1)_kn_k`$ parameters. They are not all independent however. Above $`\lambda =\lambda _k`$ the various branches can be written:

$$\mu _j(\lambda )=\underset{n=1}{\overset{n_k}{}}\frac{c_n^{(j)}}{(\lambda \lambda _k)^n}+\mathrm{regular}$$
(13)
where all the coefficients $`c_1^{(j)},\mathrm{},c_{n_k}^{(j)}`$ are fixed and non–dynamical because they are the matrix elements of the diagonal matrices $`(A_k)_{}`$, while the regular part is dynamical. This implies on $`r_j(\lambda )`$ that the coefficients of its $`n_k`$ highest order pole terms are fixed. Summing over $`j`$, we get $`Nn_k`$ constraints and we are left with $`\frac{1}{2}N(N1)_kn_k`$ parameters, that is $`g+N1`$ parameters. It remains to take the quotient by the action of constant diagonal matrices. The generators of this action are the Hamiltonians $`H_n=(1/n)\mathrm{res}_{\lambda =\mathrm{}}\mathrm{Tr}(L^n(\lambda ))d\lambda `$, i.e. the term in $`1/\lambda `$ in $`\mathrm{Tr}(L^n(\lambda ))`$. Setting

$$\mu _j(\lambda )=a_j+\frac{b_j}{\lambda }+\mathrm{}$$
(14)
around the point $`Q_j=(\mathrm{},a_j)`$, we have $`H_n=_ja_j^{n1}b_j`$. After Hamiltonian reduction these quantities are to be set to fixed (non–dynamical) values. So, both $`a_i`$ (by definition) and $`b_i`$ are non dynamical. On the functions $`r_j(\lambda )`$ this implies that their expansion at infinity starts as $`r_j(\lambda )=r_j^{(0)}+\frac{r_j^{(1)}}{\lambda }+\mathrm{}`$, with $`r_j^{(0)}`$ and $`r_j^{(1)}`$ non dynamical. Hence when the system is properly reduced we are left with exactly $`g`$ action variables.

The constraints eqs.(13, 14) can be summarized in a very elegant way . Introduce the differential $`\delta `$ with respect to the dynamical moduli. Then our constraints mean that the differential $`\delta \mu d\lambda `$ is regular everywhere on the spectral curve because the coefficients of the various poles being non dynamical, they are killed by $`\delta `$:

$`\delta \mu d\lambda =\mathrm{holomorphic}`$
Since the space of holomorphic differentials is of dimension $`g`$, the right hand side of the above equation is spanned by $`g`$ parameters which are the $`g`$ independent action variables we were looking for. Notice that these action variables are coefficients in the pole expansions of the functions $`r_j(\lambda )`$, and thus appear linearly in the equation of $`\mathrm{\Gamma }`$. Hence eq.(12) can be written in the form eq.(1). Clearly, these considerations can be adapted by considering more general conditions such as

$`{\displaystyle \frac{\delta \mu }{\mu ^n}}{\displaystyle \frac{d\lambda }{\lambda ^m}}=\mathrm{holomorphic}`$
## 4 Examples.

Let us show how well known models fit into our scheme. For the hyperelliptic ones, things are so simple that we can directly check the commutation of the Hamiltonians.

### 4.1 Neumann model.

The spectral curve can be written in the form :

$$\mu ^2=\frac{\underset{i=1}{\overset{N1}{}}(\lambda b_i)}{_{i=1}^N(\lambda a_i)}=\frac{P(\lambda )}{Q(\lambda )}$$
(15)
Performing the birational transformation $`s=\mu Q(\lambda )`$, we get:

$$s^2=Q(\lambda )P(\lambda )$$
(16)
which is an hyperelliptic curve of genus $`g=N1`$. The polynomial $`Q(\lambda )`$ is non dynamical. We have $`(N1)`$ independent dynamical quantities, namely the $`(N1)`$ symmetrical functions of the $`b_i`$, coefficients of $`P(\lambda )`$. We have

$`\delta \mu d\lambda ={\displaystyle \frac{\delta P(\lambda )}{2\mu Q(\lambda )}}d\lambda ={\displaystyle \frac{\delta P(\lambda )}{2s}}d\lambda =\mathrm{holomorphic}`$
Asking that a curve of the form eq.(15) passes through the $`g`$ points $`(\lambda _i,\mu _i)`$ determines the polynomial $`P(\lambda )`$. The solution of Baxter’s equations

$$P(\lambda _i)=Q(\lambda _i)\mu _i^2$$

simplifies in this case because the matrix $`B`$ depends only on the $`\lambda _i`$. It is equivalent to Lagrange interpolation formula:

$$P(\lambda )=P^{(0)}(\lambda )+P^{(2)}(\lambda )$$

with

$$P^{(0)}(\lambda )=\underset{i}{}(\lambda \lambda _i),P^{(2)}(\lambda )=\underset{j}{}S_j(\lambda )Q(\lambda _j)\mu _j^2,S_j(\lambda )=\frac{\underset{kj}{}(\lambda \lambda _j)}{_{kj}(\lambda _j\lambda _k)}$$

Introducing the canonical commutation relations

$$[\mu _j,\lambda _k]=i\mathrm{}\delta _{jk}$$

so that

$`[\mu _j,f(\lambda _j)]=i\mathrm{}_{\lambda _j}f(\lambda _j),[\mu _j^2,f(\lambda _j)]=2i\mathrm{}_{\lambda _j}f(\lambda _j)\mu _j+(i\mathrm{})^2_{\lambda _j}^2f(\lambda _j)`$
We can check that $`[P(\lambda ),P(\lambda ^{})]=0`$ is a consequence of $`_{\lambda _j}P^{(0)}(\lambda )=_{kj}(\lambda _j\lambda _k)S_j(\lambda )`$, and the identities

$$S_j(\lambda )_{\lambda _j}^nS_i(\lambda ^{})S_j(\lambda ^{})_{\lambda _j}^nS_i(\lambda )=0,n>0$$

These identities follow from the remark that, if we define the translation operators $`t_j\lambda _i=\lambda _j+\sigma \delta _{ij}`$, then

$$S_j(\lambda )t_jS_i(\lambda ^{})S_j(\lambda ^{})t_jS_i(\lambda )=\frac{\underset{ki,j}{}(\lambda \lambda _k)\underset{ki,j}{}(\lambda ^{}\lambda _k)}{_{kj}(\lambda _j\lambda _k)_{ki}(\lambda _i\lambda _k)}(\lambda _i\lambda _j)(\lambda \lambda ^{})$$
(17)
is independent of $`\sigma `$.

### 4.2 Toda Chain.

The spectral curve can be written in the form :

$`\mu +\mu ^1=2P(\lambda )`$ (18)
where $`2P(\lambda )=\lambda ^{n+1}_{i=1}^{n+1}p_i\lambda ^n+\mathrm{}`$ is a polynomial of degree $`(n+1)`$. The spectral curve is hyperelliptic since it can be written as

$`s^2=P^2(\lambda )1,\mathrm{with}s=\mu P(\lambda )`$ (19)
The polynomial $`P^2(\lambda )`$ is of degree $`2(n+1)`$ so the genus of the curve is $`g=n`$. The number of dynamical moduli is $`g=n`$ in the center of mass frame $`_{i=1}^{n+1}p_i=0`$. We have

$`{\displaystyle \frac{\delta \mu }{\mu }}d\lambda ={\displaystyle \frac{2\delta P(\lambda )}{\mu \mu ^1}}d\lambda ={\displaystyle \frac{\delta P(\lambda )}{s}}d\lambda =\mathrm{holomorphic}`$
Asking that the curve eq.(18) passes through the $`n`$ points $`(\lambda _i,\mu _i)`$, we get Baxter’s equations.

$$2P(\lambda _i)=\mu _i+\mu _i^1$$

Their solution is again given by Lagrange interpolation formula:

$$2P(\lambda )=P^{(0)}(\lambda )+P^{(1)}(\lambda )$$

where

$$P^{(0)}(\lambda )=(\lambda +\underset{i}{}\lambda _i)\underset{i=1}{\overset{n}{}}(\lambda \lambda _i),P^{(1)}(\lambda )=\underset{i}{}S_i(\lambda )(\mu _i+\mu _i^1)$$

The polynomial $`P^{(0)}(\lambda )`$ is of degree $`n+1`$, vanishes for $`\lambda =\lambda _i`$ and has no $`\lambda ^n`$ term. Let the commutation relations of the separated variables be given by:

$$\mu _j\lambda _j=q\lambda _j\mu _j,\mu _j\lambda _i=\lambda _i\mu _j,ij$$

Then again $`[P(\lambda ),P(\lambda ^{})]=0`$ as a result of eq.(17), where $`t_j`$ is interpreted as $`t_j\lambda _j=q\lambda _j`$, and the facts that

$`S_j(\lambda )t_j^{\pm 1}P^{(0)}(\lambda ^{})S_j(\lambda ^{})t_j^{\pm 1}P^{(0)}(\lambda )`$ $`=`$ $`P^{(0)}(\lambda ^{})S_j(\lambda )P^{(0)}(\lambda )S_j(\lambda ^{})`$
$`={\displaystyle \frac{\underset{kj}{}(\lambda \lambda _k)\underset{kj}{}(\lambda ^{}\lambda _k)}{_{kj}(\lambda _j\lambda _k)}}(\lambda +\lambda ^{}+{\displaystyle \underset{ij}{}}\lambda _i)(\lambda ^{}\lambda )`$
### 4.3 A non–hyperelliptic model.

We consider the model studied in  . The spectral curve can be written in the form:

$$R(\lambda ,\mu )\mu ^N+t^{(1)}(\lambda )\mu ^{N1}+\mathrm{}t^{(N)}(\lambda )=0$$
(20)
The polynomials $`t^{(k)}(\lambda )`$ are such that $`\mathrm{degree}t^{(k)}(\lambda )kn1`$ and $`\mathrm{degree}t^{(N)}(\lambda )=Nn1`$ for some integer $`n`$. The genus of this curve is

$$g=\frac{1}{2}(N1)(Nn2)$$

Assuming that there is no singular point at finite distance, the homomorphic differentials are

$$\omega _{kl}=\frac{\mu ^l\lambda ^k}{_\mu R(\lambda ,\mu )}d\lambda ,0l<N1,0k<(Nl1)n1$$

We have

$$\delta \mu \frac{d\lambda }{\lambda }=\underset{k=1}{\overset{N}{}}\frac{\delta t^{(k)}(\lambda )\mu ^{Nk}}{_\mu R(\lambda ,\mu )}\frac{d\lambda }{\lambda }$$

This will be holomorphic if $`\delta t^{(1)}(\lambda )=0`$ and

$$\delta t^{(k)}(\lambda )=\delta H_1^{(k)}\lambda +\mathrm{}+\delta H_{(k1)n1}^{(k)}\lambda ^{(k1)n1}$$

Baxter’s equations and the commutation of the Hamiltonians where proved in this case, starting from the definition of the quantum model through it Lax matrix and the Yang–Baxter equation. Our approach gives a very simple proof of this result.

## 5 Conclusion.

We have shown that starting from the separated variables, one can give an easy definition of a quantum integrable system. The next step is to reconstruct the Lax matrix and the original dynamical variables of the model. While this is a well understood problem in the classical theory , (it is the essence of the classical inverse scattering method), its quantum counterpart will require a deeper understanding of the quantum affine Jacobian .

Acknowledgements. We thank D. Bernard and F. Smirnov for discussions.


text:
# Dephasing by extremely dilute magnetic impurities revealed by Aharonov-Bohm oscillations

## Abstract

We have probed the magnetic field dependence of the electron phase coherence time $`\tau _\varphi `$ by measuring the Aharonov-Bohm conductance oscillations of mesoscopic Cu rings. Whereas $`\tau _\varphi `$ determined from the low-field magnetoresistance saturates below 1 K, the amplitude of Aharonov-Bohm $`h/e`$ oscillations increases strongly on a magnetic field scale proportional to the temperature. This provides strong evidence that a likely explanation for the frequently observed saturation of $`\tau _\varphi `$ at low temperature in weakly disordered metallic thin films is the presence of extremely dilute magnetic impurities.

Understanding the sources of decoherence is of fundamental importance in all quantum systems that interact with their environment. In mesoscopic physics, quantum phase coherence of conduction electrons in disordered metals and semiconductors gives rise to a wide variety of novel transport phenomena observed at low temperature meso ; decoherence sets the limit on the lengthscale over which such effects are observable. In metallic thin films below about 1 K, the dominant source of decoherence is thought to be electron-electron interactions. For narrow wires, the phase coherence time for that process was calculated by Altshuler, Aronov, and Khmelnitskii AAK  in 1982, and diverges at low temperature as $`\tau _\varphi T^{2/3}`$.

This theoretical picture was deeply shaken in 1997 when two different experiments suggested that electrons in mesoscopic metallic wires interact with each other much more strongly than predicted by theory. One experiment MJW  showed that $`\tau _\varphi `$ determined from the low field magnetoresistance of mesoscopic Au wires, systematically saturates at low temperature, rather than continuing to increase as a power law. The other experiment PRLrelax  showed that the energy exchange rate between electrons measured in several Cu wires exceeded the prediction for electron-electron interactions AAK  and obeyed a different energy dependence.

More recently, it was found that the measured energy exchange rate and dephasing rate are sample dependent and tightly correlated to the source material purity: samples fabricated using a very pure (99.9999%) Ag or Au source agreed with the theoretical prediction for electron-electron interactions, whereas samples fabricated with a source of lesser purity, or with Cu, showed a smaller phase coherence time and a larger energy exchange rate PierreAg ; Gougam ; PierrePesc ; PierrePHD ; PierrePRBWL .

There have been several theoretical suggestions regarding the source of the excess dephasing. Several of those suggestions, such as the possibility of electromagnetic interference coming from outside the cryostat AAG , can be ruled out purely on experimental grounds, since different samples measured in the same cryostat show different behaviors Gougam . The controversial theory by Golubev, Zaikin, and Schön of zero temperature dephasing by high energy electromagnetic modes Zaikin  is able to account for only a subset of the experimental results published in references MJW ; Gougam ; PierrePesc ; Natelson , using the overall prefactor of the dephasing rate as an adjustable parameter. In our opinion, the only two explanations that have not been ruled out by experiment are dephasing by two-level systems IFS  and dephasing by paramagnetic impurities dephasingMI . We aim to demonstrate in this letter that all the data showing $`\tau _\varphi `$ saturation in weakly disordered metallic thin films published to date might be explainable by the presence of paramagnetic impurities at extremely low concentration JJLin .

How can we determine whether a sample which exhibits a saturation of $`\tau _\varphi `$ indeed contains unexpected magnetic impurities and that $`\tau _\varphi `$ is really limited by spin-flip scattering from these extrinsic degrees of freedom?

Probing the presence of unknown magnetic impurities at a concentration of 1 part per million (ppm) or smaller is a difficult challenge. For instance, the logarithmic contribution to the resistance by Kondo impurities Kondo  at such small concentrations can not be reliably detected through the measurement of $`R(T)`$: it is very small and often hidden by the $`1/\sqrt{T}`$ contribution due to electron-electron interaction AAK ; AleinerWav . Since the dephasing rate is so sensitive to magnetic impurities, it is natural to use the dephasing rate itself to detect extremely small amounts of such impurities. In the presence of a sufficiently large magnetic field spin-flip collisions are frozen out, hence $`\tau _\varphi `$ should return to the value expected from electron-electron interaction. One method is to measure the weak-localization contribution to the perpendicular magnetoresistance in the presence of a parallel field large enough to freeze the spins. However this requires an accurate alignment of the parallel field with the wire’s axis, and the residual magnetic flux through the wire’s cross section complicates the data analysis Giordano . Another possibility is to measure the universal conductance fluctuations (UCF) of a metallic wire as a function of magnetic field $`B`$. But the weak dependence on $`\tau _\varphi `$ and broad width in $`B`$ of UCF are not well suited to probe the presence of very dilute magnetic impurities at low temperature. We have chosen a third method. We fabricate a ring-shaped sample with connecting leads, and measure the Aharonov-Bohm (AB) oscillations in the magnetoconductance of the ring. Such measurements were pioneered by Webb and coworkers in the 1980’s, and observed by several other groups at about the same time WebbAB . To obtain the largest possible AB oscillations, the rings measured at this time had a very small diameter thereby reducing their sensitivity to the value of $`\tau _\varphi `$. Hence, it is not surprising that the AB oscillations were found independent of the magnetic field except on a few samples purposely contaminated with a relatively very large ($`100`$ ppm of Mn in Au) concentration of magnetic impurities WebbABMI .

We applied this technique, with carefully designed rings, to probe the magnetic field dependence of $`\tau _\varphi `$ in two Cu samples, labelled Cu3 and Cu4 (see Table 1). The choice of copper followed from three observations. First, as illustrated in Fig. 1, all of the samples we have made with this material show a saturation of $`\tau _\varphi (B0)`$ at low temperature, regardless of the source purity (see also Gougam ; PierrePRBWL ). Second, whereas it is possible to attain an apparent saturation of $`\tau _\varphi `$ over a limited temperature range from a combination of electron-electron interaction and spin-flip scattering PierrePRBWL , the flat and small $`\tau _\varphi `$ in samples Cu3 and Cu4 is difficult to reproduce in this manner. Third, no trace of Kondo magnetic impurities could be detected in the temperature dependence of the resistance, shown for sample Cu4 in the inset of Fig. 1. These three observations cast doubt on our proposal that the saturation of $`\tau _\varphi `$ at low temperature in Cu could be explained by magnetic impurities, hence Cu is an ideal candidate for this experiment.

We measured the magnetoconductance of two rings of radius $`r=0.5`$ and $`r=0.75`$ $`\mu `$m, located respectively on samples Cu3 and Cu4. A scanning electron microscope picture of the ring in sample Cu4 is shown in Fig. 2. In addition to the ring, the samples Cu3 and Cu4 contain a long meander line used to extract $`\tau _\varphi (B0)`$ by fitting the low-field magnetoresistance with the prediction of weak localization theory AleinerWav . The fit procedure is detailed in fitWL . All the Cu samples were deposited on a silicon substrate, through a suspended mask fabricated using standard e-beam lithography, in a thermal evaporator used only for nonmagnetic metals Ag, Al, Au, Cu, Ti. The evaporation rate ranges between 0.2 and 0.5 $`\mathrm{nm}/\mathrm{s}`$, under a pressure that stays below $`10^6`$ mbar. The source material and boat were replaced before each evaporation and manipulated using plastic tweezers. Before the actual deposition on the Si substrate we melt the Cu source, evaporate 10-20 nm onto a shutter, and pump the chamber down again for about 15 mn. This pre-evaporation covers the walls of the evaporator with a clean layer of Cu and makes it possible to maintain a very low pressure during the sample fabrication. The samples were immersed in the mixing chamber of a dilution refrigerator and measured through filtered electrical lines. Resistance measurements were performed using a standard ac four-terminal technique with a lock-in amplifier. The ac voltage excitation $`V_{ac}`$ across the sample satisfies $`eV_{ac}k_BT`$ to avoid heating of electrons.

The most important result of this article is visually striking in the raw magnetoconductance data, as illustrated on Fig. 3 for sample Cu4 at $`T=100`$ mK. Whereas the Aharonov-Bohm oscillations can hardly be seen at small magnetic field $`B`$ (left inset in Fig. 3), they are obvious at large $`B`$ (right inset in Fig. 3). For a given geometry and temperature, the amplitude of AB oscillations depends only on $`\tau _\varphi `$, which means, without further analysis, that $`\tau _\varphi `$ increases with magnetic field in this sample. A similar behavior was observed in sample Cu3.

To put this qualitative observation on solid ground we analyzed the data by taking the Fourier transforms of magnetoconductance data segments of width 0.2 T, using a Welch window. We define the amplitude of the AB $`h/e`$ oscillations $`\mathrm{\Delta }G_{h/e}`$ as the square root of the power integrated over a narrow interval surrounding the frequency $`1/\mathrm{\Delta }B\pi r^2/(h/e)`$. Figure 4 shows the results for sample Cu4 at $`T=40`$ and 100 mK, as a function of the reduced magnetic field $`2\mu _BB/k_BT`$. Apart from confirming quantitatively the increase of AB oscillations with the magnetic field, Fig. 4 shows that the magnetic field scale on which the AB $`h/e`$ oscillations increase is proportional to the temperature. This proves that the increase of AB oscillations at large field results from the freezing of paramagnetic degrees of freedom in the sample.

We can compare the measured amplitude of AB $`h/e`$ oscillations with the prediction NoteAB

$$\mathrm{\Delta }G_{h/e}=C\frac{e^2}{h}\frac{L_T}{\pi r}\sqrt{\frac{L_\varphi }{\pi r}}\mathrm{exp}[\pi r/L_\varphi ],$$
(1)
where $`L_T=\sqrt{\mathrm{}D/k_BT}`$ is the thermal length, $`D`$ is the diffusion coefficient, $`T`$ is the temperature, $`L_\varphi =\sqrt{D\tau _\varphi }`$, $`r`$ is the ring radius and $`C`$ is a factor of order 1 that depends on the sample geometry in the vicinity of the ring. The total dephasing rate $`1/\tau _\varphi `$ is the sum of contributions from electron-electron AleinerWav  and spin-flip scattering:

$$\frac{1}{\tau _\varphi }=\frac{1}{\tau _{ee}}+\frac{1}{\tau _{sf}}.$$
(2)
Whereas $`1/\tau _{ee}`$ is independent of $`B`$, the spin-flip scattering rate vanishes at large field as Falko

$$\frac{\tau _{sf}(B=0)}{\tau _{sf}(B)}=\frac{g\mu _BB/k_BT}{\mathrm{sinh}(g\mu _BB/k_BT)},$$
(3)
where $`g`$ is the renormalized gyromagnetic factor of the magnetic impurities.

The continuous line in Fig. 4 is a fit of $`\mathrm{\Delta }G_{h/e}(B)`$ at $`T=100`$ mK using Eqs. (1), (2) and (3) with the gyromagnetic factor $`g=1.05`$ and the overall multiplicative constant $`C=0.13`$ as the only fit parameters. The dotted line is the calculated $`\mathrm{\Delta }G_{h/e}`$ at $`T=40`$ mK using the same values for $`g`$ and $`C`$, and taking into account the non negligible noise level of the measurement at this temperature. We used the predicted contribution for electron-electron interactions AleinerWav : $`\tau _{ee}=7.4`$ ns and 5.4 ns, respectively at $`T=40`$ and 100 mK, and we used the values $`\tau _{sf}(B=0)\tau _\varphi (B0)`$ NoteTausf  obtained from the low field magnetoresistance of the long wire.

What can be these paramagnetic “impurities” in our samples? It is important to emphasize that the sample purity is not automatically identical to the source material purity. Indeed, the residual pressure in the evaporator is not small enough to rule out extra contamination at the level of one ppm during evaporation. The nature of such contaminants depends on the evaporator history. However, our best candidate is the surface oxide of Cu Shirane . It was already pointed out in the late 1980’s that the surface of Cu may cause dephasing Haesendonck . By comparing the value of $`\tau _\varphi (B0)`$ at low temperature with the unitary limit ($`T=T_K`$) of spin-flip scattering in the Kondo regime NagSuhl ; PierrePRBWL , we estimate the concentration of Kondo magnetic impurities in samples Cu1, Cu2, Cu3 and Cu4 to be respectively 0.75, 0.3, 1.5 and 1 ppm. Note that these would be lower bounds on the concentrations if the paramagnetic impurities are on the surface, with a distribution of Kondo temperatures.

To conclude, we have measured the Aharonov-Bohm $`h/e`$ oscillations to probe the presence of very dilute, low Kondo temperature, magnetic impurities. By applying this technique to copper wires, we showed that the saturation of the low-field phase coherence time is due to spin-flip scattering by magnetic impurities. Recent measurements of energy exchange in a magnetic field demonstrate that magnetic impurities are also responsible for the anomalous energy exchange previously observed in mesoscopic wires Anthore .

We are grateful to I. Aleiner, A. Anthore, Y. Blanter, M.H. Devoret, D. Esteve, V.I. Fal’ko, L.I. Glazman, H. Pothier, and M. Vavilov for valuable discussions. This work was supported by NSF grants DMR-9801841 and 0104178, and by the Keck Microfabrication Facility supported by NSF DMR-9809688.


text:
# Quantum authentication with unitary coding sets

## I Introduction

Providing a way to check the integrity of information transmitted over or stored in an unreliable medium is of prime concern to the fields of open computing and communications. Mechanisms that provide such integrity check are called message authentication schemes Menezes et al. , (1996). They were originally proposed by Gilbert and co-workers Gilbert et al. , (1974), while the general theory of unconditional authentication was developed by Simmons (see e.g. Simmons, (1992)).

In the analysis of any message authentication scheme one has to consider three participants: A transmitter (Alice), a receiver (Bob), and an opponent (Eve). Alice wishes to communicate some information (the plain-text) to Bob using a public communications channel; Bob, in turn, would like to be confident that any information received actually came from Alice, rather than from some third party (Eve). Much as in the usual encryption scenario, classical cryptography provides two different approaches to authentication: secret-key and public-key authentication. In this paper we will focus on the first scenario, the secret-key setting, and therefore we shall assume that Alice and Bob share some secret key previously established in a secure manner. This key allows Alice to select an encoding rule (a one-to-one function between the set of plain-texts and the set of messages, also called cipher-texts), chosen from a predetermined set, and encode the plain-text to obtain the message, which is then sent to Bob through the channel. The encoding rule, which is usually changed every time a new message is transmitted, defines a set of valid messages. Upon receiving a message, Bob accepts it as being authentic (i.e. as coming from Alice) if and only if it belongs to that set, in which case he will recover the plain-text applying the corresponding decoding rule. This decoding rule is well-defined since each encoding rule is one-to-one.

A special class of secret-key message authentication schemes are message authentication codes (MACs), which contain the plain-text in the clear. In this case, each encoding rule generates, depending on the value of the actual plain-text, an authenticator or tag that is appended to the plain-text before actually sending it. MACs decoding rules return, depending on the plain-text and the tag, a bit indicating when Bob must regard the message as authentic, and accepting it as coming from Alice, and when he must discard it. The basic requirement is that the tags, which are produced by the encoding rule, must be accepted as valid when the matching decoding rule is used on reception. When an authentication protocol fulfills this requisite it is said to provide perfect deterministic decoding. Wegman and Carter Wegman & Carter, (1981) introduced several information-theoretic secure constructions for such schemes. Basically, their techniques use universal hash families as the coding set. To generate the tag, Alice uses a particular hash function, selected from the universal hash family by the secret key. This action compresses the plain-text to a smaller string of bits. The string of bits can be later encrypted using the Vernam cipher Vernam, (1926). This last step allows to re-use the encoding rules, since Eve cannot obtain any information about the particular hash function used by Alice and Bob.

The possibility of employing quantum resources to obtain more efficient classical-message quantum authentication schemes is still an open issue. In Curty & Santos, (2001) the authors showed that, using quantum effects, the authentication of a binary classical message is possible with a key of length shorter than the one required by classical schemes. However, it is not clear yet whether more efficient quantum techniques exist for longer messages.

While the authentication of classical messages is a fundamental topic in classical communications networks, the analogous quantum problem, the authentication of quantum states, could also become important in future quantum information communication systems. Leung has addressed this question partially in Leung, (2002). Her proposal is based on a modification of the private quantum channel Ambainis et al. , (2000); Boykin & Roychowdhury, (n.d.). The authentication process requires a classical secret key, a quantum communications channel, and an authenticated two-way classical one. Another classical secret-key quantum authentication protocol, but without additional classical communication, has been proposed in Barnum et al. , (n.d.). This scheme uses stabilizer purity testing codes, and its error probability decreases exponentially with the length of the quantum tag. Rather surprisingly, the authors also showed that any protocol that guarantees unconditionally secure authenticity must encrypt the quantum plain-text almost perfectly. This fact contrasts with classical MACs, where encryption of the plain-text is not necessary for unconditional security. More recently, Gea-Banacloche Gea-Banacloche, (2002) has approached data authentication from an steganographic perspective, making use of standard quantum correcting code techniques.

In this paper we analyse a special class of authentication schemes for quantum messages. In particular, we study those which use classical secret keys and coding sets composed of unitary operations. Our main goal is to find the minimal conditions that must be satisfied by any unitary coding set so as to make quantum authentication possible. We analyse the security of the scheme under two general attacks. In the first one, the unitary attack, Eve, who knows both the coding and decoding sets, tries to modify the cipher-text by means of a unitary operation. In the second, the forgery attack, Alice has not initiated the transmission yet (or it may have been blocked by Eve), and Eve attempts to prepare a new fake quantum message with the purpose of passing Bob’s verification test.

The paper is organized as follows. In Sec. II we describe general authentication schemes for quantum messages, and we introduce those which use unitary coding sets. We also present some notation used in the paper. Sec. III analyzes the unitary attack, and Sec. IV focuses on the forgery attack. In Sec. V we discuss the restrictions that these two attacks impose upon both coding sets. Finally, we present our conclusions in Sec. VI.

## II Authentication of quantum messages

Suppose Alice needs to send a certified quantum message to Bob. Her goal is to make Bob confident about the authenticity of the message and sender. If we consider an scenario where both participants share a quantum secret key (for example, a set of EPR pairs), and they have access to an authenticated classical channel, then the solution is quite simple: Alice can just use quantum teleportation Bennett et al. , (1993) to send the quantum plain-text. However, the reliable storage and manipulation of entangled quantum objects is not technologically available yet, so a more practical situation arises when the secret key shared by the two partners is classical.

Analogously to the classical setting, quantum authentication with a classical secret key can be performed in three phases:

1. Tagging: To certify her message (the plain-text), Alice appends to it a particular public-known quantum state that we shall call, following the standard classical notation, a tag. Specifically, we will assume that both message and tag quantum states belong, respectively, to the state spaces $``$ ($`\mathrm{dim}()=M`$), and $`𝒯`$ ($`\mathrm{dim}(𝒯)=T`$). The space of tagged messages is defined, therefore, as $`=𝒯`$. Alice and Bob also openly agree in a particular splitting of the tag space $`𝒯`$ in the direct sum of two subspaces $`𝒯=𝒱𝒱^{}`$, where $`𝒱`$ is considered the subspace of valid tags and $`𝒱^{}`$ the subspace of invalid tags. This splitting of $`𝒯`$ leads naturally to the direct sum $`=𝒞𝒞^{}`$, where $`𝒞=𝒱`$ will be the subspace of valid messages (usually called the code space; $`\mathrm{dim}(𝒞)=C`$), and $`𝒞^{}=𝒱^{}`$ will be the subspace of invalid messages ($`\mathrm{dim}(𝒞^{})=D`$). The original tagged message has the general form $`\rho _{}=\rho _{}\rho _𝒯`$, with $`\rho _{}`$ the plain-text quantum message and $`\rho _𝒯`$ any state in $`𝒱`$.
2. Encoding: After the tagging procedure has been completed, Alice, depending on the value of the $`n`$-bit key, $`k`$, shared with Bob, performs an encoding rule on the tagged message. In principle, encoding (and decoding) rules could be trace-preserving completely positive maps (TPCP), but in this paper we will restrict ourselves to the case of unitary rules. Therefore, the encoding rule, $`U(k)`$, is selected from the unitary coding set $`\{U(0),\mathrm{},U(K1)\}`$, where $`K=2^n`$ and, without loss of generality, we set $`U(0)=I`$. If the tagged message is $`\rho _{}`$, then the state of the message Alice sends to Bob is given by

$$\rho _{}(k)=U(k)\rho _{}U^{}(k).$$
(1)
Thus, a tagged message encoded by Alice with $`U(k)`$ will necessarily belong to $`𝒞_k`$, the subspace of all the tagged messages transformed by $`U(k)`$.
3. Verification: To verify the authenticity of the received message, Bob needs to check whether it belongs to $`𝒞_k`$ or not. In the latter case, he should regard the message as invalid and so discard it. One way in which Bob can make this check is performing the matching decoding rule $`U^{}(k)`$ (from the decoding set $`\{U^{}(0),\mathrm{},U^{}(K1)\}`$) on the received encoded tagged message, and then measure the tag portion to see whether the resulting tagged message belongs to $`𝒞`$ or to $`𝒞^{}`$. If it belongs to $`𝒞`$, and no forgery on the encoded tagged message has taken place in transit, he could unambiguously recover the original plain-text, just tracing out the tag system.

In the next two sections we shall analyse the minimal conditions that any unitary coding set must satisfy in order to make authentication possible. It should be clear from the outset that we are not looking for the optimal coding sets, defined as those which make the probability of failure of the protocol minimal. Therefore, our scheme will be secure if Eve can only break it in a probabilistic way. We shall study two general attacks. In the unitary attack we shall regard Eve capable of modifying the state in the channel by means of a unitary operation; in the case of forgery we shall assume that Eve can intercept the state travelling from Alice to Bob, discard it, and forge a new tagged message. In both cases we shall frequently use operators acting on the space $``$, and we shall be interested in describing how these operators act on the $`𝒞`$ and $`𝒞^{}`$ subspaces. If we define the orthogonal projection operators $`P_i`$ and $`P_o`$ as the ones that, respectively, project a state from $``$ into $`𝒞`$ or $`𝒞^{}`$, an arbitrary operator $`A_{}`$ can be written as

$$A_{}=A_{ii}+A_{io}+A_{oi}+A_{oo},$$
(2)
where $`A_{jk}=P_jA_{}P_k`$, with $`j,k=i,o`$. If the decomposition (2) is used in operator expressions of the form $`\chi _{}=A_{}\rho _{}A_{}^{}`$, the corresponding ‘i-o’ operators are related by the matrix equation

$$\left(\begin{array}{cc}\chi _{ii}& \chi _{io}\\ \chi _{oi}& \chi _{oo}\end{array}\right)=\left(\begin{array}{cc}A_{ii}& A_{io}\\ A_{oi}& A_{oo}\end{array}\right)\left(\begin{array}{cc}\rho _{ii}& \rho _{io}\\ \rho _{oi}& \rho _{oo}\end{array}\right)\left(\begin{array}{cc}A_{ii}^{}& A_{oi}^{}\\ A_{io}^{}& A_{oo}^{}\end{array}\right),$$
(3)
where $`A_{jk}^{}=P_kA_{}^{}P_j`$.

## III The unitary attack

Let us assume that Eve performs a unitary quantum operation $`F_{}`$ on the encoded tagged message in transit between Alice and Bob. This operation changes the state of the encoded message from $`\rho _{}(k)`$ to $`F_{}\rho _{}(k)F_{}^{}`$. Bob, ignorant about this malicious action, will perform his decoding operation on the encoded tagged message received, obtaining as the decoded tagged message the state

$$\rho _{}^E(k)=U^{}(k)F_{}\rho _{}(k)F_{}^{}U(k)=Q(k)\rho _{}Q^{}(k),$$
(4)
where $`Q(k)=U^{}(k)F_{}U(k)`$. Thus, Eve will be successful in her attack if, when the $`k`$ key was used, $`\rho _{}^E(k)𝒞`$. This condition can also be written in terms of the action of the $`P_i`$ operator as

$$P_i\rho _{}^E(k)P_i=\rho _{}^E(k).$$
(5)
Since Eve does not know either which key Alice and Bob used or the actual message sent, $`\rho _{}`$, the probability of her action being unnoticed is one if and only if

$$\rho _{}^E(k)𝒞,k,\rho _{}𝒞.$$
(6)
Using Eq. (4) in Eq. (5), one can rewrite (6) as

$$Q_{oi}(k)=0,k.$$
(7)
Given the unitarity of the $`Q(k)`$ operators, Eq. (7) implies that $`Q_{io}(k)=0,k`$. In particular, for $`k=0`$, we have that $`Q_{oi}(0)=Q_{io}(0)=0`$, which, since $`U(0)=I`$, requires that $`F_{oi}=F_{io}=0`$. All these restrictions on $`F_{}`$ can be summarized in the following commutators:

$`[F_{},P_i]`$ $`=`$ $`0,`$ (8)
$`[F_{},P_i(k)]`$ $`=`$ $`0,k0,`$ (9)
where the $`P_i(k)=U(k)P_iU^{}(k)`$ are the projectors resulting from the transformation of the $`P_i`$ by the unitary operations $`U(k)`$. The commutator (8) requires Eve to use a block-diagonal unitary operator in her attack. The block structure of $`F_{}`$ depends on how Alice and Bob decided to split $``$ into $`𝒞`$ and $`𝒞^{}`$. This information is public, so we shall assume that Eve can always fulfill (8). But, can she always fulfill the $`K1`$ commutators in (9)? The $`P_i(k)`$ in these commutators can be written, making use of the ‘i-o’ decomposition, as

$$\left(\begin{array}{cc}U_{ii}(k)U_{ii}^{}(k)& U_{ii}(k)U_{oi}^{}(k)\\ U_{oi}(k)U_{ii}^{}(k)& U_{oi}(k)U_{oi}^{}(k)\end{array}\right)\left(\begin{array}{cc}G_{ii}(k)& H(k)\\ H^{}(k)& G_{oi}(k)\end{array}\right).$$
(10)
Assuming the block-diagonal form for $`F_{}`$, and using the notation introduced in (10), the commutators in (9) can be expressed in block form as:

$`[F_{ii},G_{ii}(k)]`$ $`=`$ $`0,`$ (11)
$`[F_{oo},G_{oi}(k)]`$ $`=`$ $`0,`$ (12)
$`F_{ii}H(k)`$ $`=`$ $`H(k)F_{oo},`$ (13)
$`F_{oo}H^{}(k)`$ $`=`$ $`H^{}(k)F_{ii},`$ (14)
$`k0`$. Therefore, Eve would be always successful in her attack if she could find two unitary operators $`F_{ii}`$ and $`F_{oo}`$ obeying (11)–(14).

### III.1 A simpler case: $`K=2`$

The problem posed by Eqs. (11)–(14) is quite complex. In order to gain some insight into its possible solution, we shall begin studying the simpler case $`K=2`$ (Alice and Bob share a key of just one bit). In this case, Eqs. (11)–(14) reduce to

$`[F_{ii},G_{ii}]`$ $`=`$ $`0,`$ (15)
$`[F_{oo},G_{oi}]`$ $`=`$ $`0,`$ (16)
$`F_{ii}H`$ $`=`$ $`HF_{oo},`$ (17)
$`F_{oo}H^{}`$ $`=`$ $`H^{}F_{ii}.`$ (18)
Since $`G_{ii}`$ and $`G_{oi}`$ are Hermitian operators, and because one can always find an operator that commutes with an Hermitian operator Horn & Johnson, (1985), we could begin solving the equations above selecting the $`F_{ii}`$ that fulfills (15) or, alternatively, selecting the $`F_{oo}`$ that fulfills (16). Then we could obtain $`F_{oo}`$ (or $`F_{ii}`$) from (17). This last step, however, requires a previous discussion about the nonsingular character of $`H`$. First, note that $`H`$ need not be square (it would be square if dim($`𝒞`$)=dim($`𝒞^{}`$); i.e. if $`C=D`$); also note that we do not know the rank of $`H`$. To “invert” $`H`$ in these circumstances we have to apply the Singular-Value Decomposition Theorem for general matrices Horn & Johnson, (1985). Let us consider separately the cases of maximum and non maximum rank.

#### III.1.1 The rank of $`H`$ is maximum

If $`C=D`$, then $`\mathrm{rank}(H)=C`$, $`\mathrm{det}(H)0`$, and therefore $`H`$ is nonsingular. If $`CD`$, we can use the Singular-Value Decomposition of $`H`$ to show that:

1. If $`C<D`$, there exists an operator $`J`$ such that $`HJ=I_{C\times C}`$.
2. If $`C>D`$, there exists an operator $`J`$ such that $`JH=I_{D\times D}`$.

In both cases it can be shown that Eqs. (15)–(18) have a non-trivial solution for $`F_{ii}`$ and $`F_{oo}`$. For example, if $`C<D`$ we could select a non-trivial $`F_{oo}`$ obeying (16), then $`F_{ii}`$ would be uniquely obtained from (17), and it is not difficult to show that they would also obey (15) and (18).

#### III.1.2 The rank of $`H`$ is not maximum

Suppose $`\mathrm{rank}(H)=N<CD`$. The Singular-Value Decomposition leads in this case to $`H=V\mathrm{\Sigma }W^{}`$, where $`V`$ and $`W`$ are unitary matrices, and $`\mathrm{\Sigma }`$ is the diagonal matrix containing in its diagonal the singular values of $`H`$. Note that, since $`\mathrm{rank}(H)<C`$, part of the singular values will be zero. Therefore, it is straightforward to see that one can find in this case a matrix $`J`$ such that

$$HJ=V\left(\begin{array}{cc}I_{N\times N}& 0\\ & \\ 0& 0\end{array}\right)V^{}.$$
(19)
This would be the “inversibility” condition for $`H`$ in this case. Although the algebra is a little bit more complicated now, also in this case one can show that Eqs. (15)–(18) have a non-trivial solution for $`F_{ii}`$ and $`F_{oo}`$. The same conclusion can be reached if $`\mathrm{rank}(H)=N`$ and $`C>D`$. Note, however, that now the family of solutions is bigger than in the former case, because, given $`F_{oo}`$, there is more than one $`F_{ii}`$ fulfilling (17).

In summary, we have shown that when $`K=2`$ (Alice’s and Bob’s keys are one-bit long), Eve can always successfully manipulate Alice’s message and pass Bob’s verification test. Therefore, one-bit keys, independently of the length of the tag appended to the message and of the length of the message itself, cause the failure of the protocol. This result generalizes our conclusion in Curty et al. , (2002) to arbitrary message and tag spaces.

### III.2 $`K>2`$

In the preceding Subsection we have seen that Eve can select a unitary quantum operation, $`F_{}`$, such that conditions (11)–(14) are satisfied for $`k1`$. Let us see whether she can select a $`F_{}`$ obeying also (11)–(14) $`k>1`$. Consider the first of the conditions, Eq. (11). This equation, for the case of the preceding Subsection ($`k1`$), is $`[F_{ii},G_{ii}(1)]=0.`$ Since $`G_{ii}(1)`$ is Hermitian, it can be written in diagonal form:

$$G_{ii}(1)=\left(\begin{array}{ccc}\lambda _{ii}^1(1)& & \mathrm{𝟎}\\ & \mathrm{}& \\ \mathrm{𝟎}& & \lambda _{ii}^C(1)\end{array}\right),$$
(20)
where the $`\lambda _{ii}^r(1)`$ ($`r=1,\mathrm{},C`$) are the eigenvalues of $`G_{ii}(1)`$. If we denote the $`p,q`$ element of $`F_{ii}`$ as $`a_{ii}(p,q)`$, the condition $`[F_{ii},G_{ii}(1)]=0`$ requires that

$$\lambda _{ii}^p(1)=\lambda _{ii}^q(1),pq;p,q=1,\mathrm{},C,$$
(21)
or

$$a_{ii}(p,q)=0,pq;p,q=1,\mathrm{},C.$$
(22)
Eq. (21) is a requirement on Alice and Bob, so they, in order to protect themselves from Eve’s attack, can by design avoid it, just selecting $`G_{ii}(1)`$ with all its eigenvalues different. This can be done only in the case that $`CD`$, because if $`C>D`$ the unitarity of $`U(1)`$ shows that at least $`CD`$ eigenvalues have to be equal to one. Thus, from now on we will impose $`CD`$ and consider separately the cases $`C=D`$ and $`C<D`$. In both cases, however, Eve will have to choose $`F_{}`$ obeying (22), i.e. $`F_{}`$ must be diagonal in the same base in which $`G_{ii}(1)`$ is diagonal:

$$F_{ii}=\left(\begin{array}{ccc}a_{ii}^1& & \mathrm{𝟎}\\ & \mathrm{}& \\ \mathrm{𝟎}& & a_{ii}^C\end{array}\right),$$
(23)
where $`|a_{ii}^r|=1`$ ($`r=1,\mathrm{},C`$).

#### III.2.1 The case $`C=D`$

Let us see if the diagonal form of $`F_{ii}`$ is compatible with, for instance, the condition $`[F_{ii},G_{ii}(2)]=0`$. If we denote by $`g_{ii}^{(2)}(p,q)`$ the $`p,q`$ element of $`G_{ii}(2)`$, this commutator is zero when

$$a_{ii}^p=a_{ii}^q,pq,$$
(24)
or

$$g_{ii}^{(2)}(p,q)=0,pq.$$
(25)
Again, Eq. (25) is a requirement on Alice and Bob, and they can, by design, avoid it. This means that Eve, in order to be successful in her attack, would have to fulfill (24). But this condition implies that $`F_{ii}=\mathrm{exp}(i\alpha )I_{C\times C}`$, with $`\alpha `$ any angle. Since $`C=D`$ and $`\mathrm{rank}[H(1)]`$ is maximum (which depends only on Alice and Bob), $`F_{oo}`$ is uniquely determined by (17) and must also have the form $`F_{oo}=\mathrm{exp}(i\alpha )I_{C\times C}`$. In conclusion, $`F_{}`$ would be a module-one multiple of the identity operation, but this is the trivial solution (Eve does not modify the state in the channel).

In summary, we have shown that if Alice and Bob select the splitting of $`=𝒞𝒞^{}`$, $`U(1)`$ and $`U(2)`$ such that

1. $`\mathrm{dim}(𝒞)=\mathrm{dim}(𝒞^{})`$
2. $`\mathrm{rank}[H(1)]`$ and $`\mathrm{rank}[H(2)]`$ are maximum,
3. $`G_{ii}(1)`$ and $`G_{ii}(2)`$ have all their eigenvalues different,
4. and $`G_{ii}(1)`$ and $`G_{ii}(2)`$ do not share any eigenvector,

then Eve cannot, performing a unitary operation on the state in the channel, produce the failure of the protocol in a deterministic way. Thus two bits of key are sufficient to make the probability of Eve being unnoticed less than one.

The four conditions above can be analysed from a geometric perspective. The first one says that half of the tag space is considered valid by Alice and Bob, which in fact is equivalent to having just one qubit of tag. In the second condition $`H(1)=U_{ii}(1)U_{oi}^{}(1)`$, so its rank is maximum and equal to $`C`$ only if the rank of $`U_{ii}(1)`$ and $`U_{oi}(1)`$ are also $`C`$. This means that $`𝒞_1`$, the subspace of valid messages transformed by $`U(1)`$, is such that no state in $`𝒞_1`$ has null projection over $`𝒞`$ nor $`𝒞^{}`$. In other words, $`𝒞_1`$ is maximally spread over the original valid and invalid message subspaces, and the same holds for $`U(2)`$. In the third condition, $`G_{ii}(1)=U_{ii}(1)U_{ii}^{}(1)`$, thus the basis where $`G_{ii}(1)`$ is diagonal represents a basis of $`𝒞`$ with the following property: its image under $`U^{}(1)`$, projected over $`𝒞`$, is a $`C`$-dimensional set of orthogonal vectors, and the norm of each projected vector is given by the corresponding eigenvalue of $`G_{ii}(1)`$. If the eigenvalues are all different then this basis is unique up to some arbitrary global factors. Finally, the fourth condition says that the above bases for $`G_{ii}(1)`$ and $`G_{ii}(2)`$ are maximally spread one over the other.

#### III.2.2 The case $`C<D`$

If $`C<D`$ $`F_{oo}`$ is not uniquely determined by (17) and the situation is more complex. From now on we shall assume that $`D`$ is a multiple integer of $`C`$, so $`D=qC`$, $`q>1`$. This is in fact the natural situation when using qubits, since both $`D`$ and $`C`$ are powers of two. Following the argument of the preceding section, in the bases of $`𝒞`$ and $`𝒞^{}`$ where $`G_{ii}(1)`$ and $`G_{oi}(1)`$ are respectively diagonal, from (13), with $`k=1`$, we get:

$$F_{oo}=\left(\begin{array}{cc}\mathrm{exp}(i\alpha )I_C& 0\\ & \\ 0& W_1\end{array}\right),$$
(26)
with $`W_1`$ an arbitrary unitary operator in a $`(q1)C`$ dimensional space. But we may obtain further restrictions on $`W_1`$ from (12)–(14). First, note that $`[F_{oo},G_{oi}(1)]=0`$ for all $`W_1`$. The reason is that, although $`G_{oi}(1)`$ is diagonal, $`W_1`$ does not have to since $`G_{oi}(1)`$ has at least $`(q1)C`$ zero eigenvalues (recall that it is a $`qC`$-dimensional hermitian operator and its maximum rank is $`C`$). Let us write the matrix representation of $`G_{oi}(1)`$ as

$$G_{oi}=\left(\begin{array}{cc}\mathrm{\Lambda }_{oi}(1)& 0\\ & \\ 0& O_{(q1)C}\end{array}\right),$$
(27)
where $`\mathrm{\Lambda }_{oi}(1)`$ is the diagonal $`C`$-dimensional matrix containing the non-zero eigenvalues of $`G_{oi}(1)`$, and $`O_{(q1)C}`$ is the zero, $`(q1)C`$-dimensional matrix. Now Alice and Bob, in order to choose a $`U(2)`$ such that $`G_{oi}(1)`$ and $`G_{oi}(2)`$ do not share any eigenvector, would like to restrict $`W_1`$ as much as possible. But, since both operators have $`(q1)C`$ zero eigenvalues (i.e. $`\mathrm{dim}\left(\mathrm{ker}[G_{oi}(1)]\right)=\mathrm{dim}\left(\mathrm{ker}[G_{oi}(2)]\right)=(q1)C`$), this cannot be done. The reason is that the total space where $`G_{oi}(k)`$ acts has dimension $`qC`$, so $`\mathrm{dim}\left\{\mathrm{ker}[G_{oi}(1)]\mathrm{ker}[G_{oi}(2)]\right\}(q2)C`$. Thus, $`G_{oi}(1)`$ and $`G_{oi}(2)`$ share at least $`(q2)C`$ eigenvectors.

For simplicity, although this might not be the optimal situation, let us further assume that Alice and Bob choose $`U(2)`$ such that $`G_{oi}(1)`$ and $`G_{oi}(2)`$ are diagonal in the same basis, but $`G_{oi}(2)`$ has its $`C`$ non-zero eigenvalues shifted in the following way:

$$G_{oi}(2)=\left(\begin{array}{ccc}O_C& 0& 0\\ & & \\ 0& \mathrm{\Lambda }_{oi}(2)& 0\\ & & \\ 0& 0& O_{(q2)C}\end{array}\right).$$
(28)
If the eigenvalues of $`G_{ii}(2)`$ are all different, the unitarity of $`U(2)`$ makes the eigenvalues of $`G_{oi}(2)`$ to be also different (in fact, each pair sums up to 1). Then $`[F_{oo},G_{oi}(2)]=0`$ if and only if $`W_1`$ has the following block diagonal form:

$$W_1=\left(\begin{array}{cc}\mathrm{\Omega }_C& 0\\ & \\ 0& W_2\end{array}\right),$$
(29)
with $`\mathrm{\Omega }_C`$ a unitary, diagonal, $`C`$-dimensional matrix, and $`W_2`$ any unitary $`(q2)C`$-dimensional operator. Using the result above, together with $`F_{ii}=\mathrm{exp}(i\alpha )I_C`$, in (13) or (14) with $`k=2`$, gives $`\mathrm{\Omega }_C=\mathrm{exp}(i\alpha )I_C`$, so we have:

$$F_{oo}=\left(\begin{array}{ccc}\mathrm{exp}(i\alpha )I_C& 0& 0\\ & & \\ 0& \mathrm{exp}(i\alpha )I_C& 0\\ & & \\ 0& 0& W_2\end{array}\right).$$
(30)
Following the same line of reasoning, it is not difficult to see that, in order to make $`F_{oo}=\mathrm{exp}(i\alpha )I_{qC}`$, Alice and Bob need $`q+1`$ unitary encoding operators, $`U(0),\mathrm{},U(q)`$ such that:

1. $`\mathrm{rank}[H(k)]`$ is maximum $`k>0`$;
2. $`G_{ii}(k)`$ has all its eigenvalues different $`k>0`$;
3. for at least two values of $`k`$, say $`r,s0`$, $`G_{ii}(r)`$ and $`G_{ii}(s)`$ do not share any eigenvector;
4. and $`kk^{}`$, $`k,k^{}0`$, the range of $`G_{oi}(k)`$ and $`G_{oi}(k^{})`$ span disjoint, orthogonal, $`C`$-dimensional subspaces of $`𝒞^{}`$.

In the particular case in which we have messages of $`m`$ qubits, a tag of $`t`$ qubits, and just a one-dimensional valid tag subspace, $`C=2^m`$ and $`D=(2^t1)C`$, so $`q+1=2^t`$, and the number of bits of the classical key equals the number of tag qubits.

## IV The forgery attack

Assume now that Eve has the power to replace the tagged message in transit between Alice and Bob with a forged tagged message of her own, $`\rho _E`$. From this tagged message, Bob will decode the state

$$\rho _{}^E(k)=U^{}(k)\rho _EU(k),$$
(31)
if the value of the key shared with Alice is $`k`$. The probability of Eve being undetected is one when Eq. (6) is satisfied, where $`\rho _{}(k)=U^{}(k)\rho _EU(k)`$. This condition can be restated as

$$P_iU^{}(k)\rho _EU(k)P_i=U^{}(k)\rho _EU(k),k.$$
(32)
If we rewrite this equation in terms of the ‘i-o’ decompositions of its operators, one finds that the $`k=0`$ case requires $`\rho _E`$ to be necessarily of the form

$$\rho _E=\left(\begin{array}{cc}\rho _{ii}& 0\\ 0& 0\end{array}\right),$$
(33)
and that, in the rest of the cases ($`k0`$), $`U_{io}^{}(k)\rho _{ii}=0`$, or, equivalently,

$$\rho _{ii}\underset{k0}{}\mathrm{ker}[U_{io}^{}(k)].$$
(34)
In order to make Eve’s attack unsuccessful, Alice and Bob should choose the $`U_{io}^{}(k)`$ such that $`_{k0}\mathrm{ker}[U_{io}^{}(k)]=\{\mathrm{}\}`$. One possibility is that $`\mathrm{ker}[U_{io}^{}(k)]=\{\mathrm{}\}`$, $`k0`$. This can be accomplished if the dimensions of the spaces $`𝒞`$ and $`𝒞^{}`$, $`C`$ and $`D`$, respectively, are such that $`CD`$, since, in this case, Alice and Bob can always make the rank of $`U_{io}^{}(k)`$ equal to $`C`$, $`k0`$. Geometrically, this condition says that no state in $`𝒞`$ has null projection over $`𝒞^{}`$ after it has been transformed by $`U^{}(k)`$. In other words, the subspace $`𝒞_k`$ is different from $`𝒞`$, $`k>0`$.

## V Discussion

In the preceding sections we have shown the feasibility of quantum authentication schemes based on unitary coding sets. We have given the conditions that a particular family of unitary operations $`\{U(k)\}`$, $`k=0,\mathrm{},K1`$, has to fulfill in order to make, under unitary and forgery attacks, Eve’s probability of success less than one. In the case of the unitary attack we have shown that $`\mathrm{log}(q+1)`$ bits of classical key are enough when the ratio between the dimensions of the invalid and valid tag subspaces is $`q`$, independently of the number qubits of the original message. This result may seem surprising, but not too practical since one would expect the effectiveness of such a protocol to be very low. In fact, to quantitatively study the security of an authentication protocol based on this scheme, one should find an appropriate family $`\{U(k)\}`$ and obtain lower bounds for $`P_e^f`$ and $`P_e^u`$, the error probabilities under forgery and unitary attacks, respectively.

In the case of the forgery attack,

$$P_e^f=\frac{1}{K}\underset{k=0}{\overset{K1}{}}\text{tr}_{}\left[P_iU(k)^{}\rho _EU(k)\right]=\frac{1}{K}\underset{k=0}{\overset{K1}{}}\text{tr}_{}\left[P_i(k)\rho _E\right],$$
(35)
with $`P_i(k)=U(k)P_iU^{}(k)`$ the projector over $`𝒞_k`$, and $`\rho _E`$ any state in $``$ selected by Eve. The above probability is bounded by the maximum eigenvalue of the hermitian operator $`_{k=0}^{K1}P_i(k)`$, so Alice and Bob’s goal is to minimize the maximum eigenvalue of this operator. For simplicity, assume the dimension of the total Hilbert space $``$ is an integer multiple of the dimension of the code subspace $`𝒞`$, $`E=pC`$, $`p>1`$. If Alice and Bob choose a family $`\{U(k)\}`$ with $`Kp`$, such that the projectors $`\{P_i(k)\}`$ are mutually orthogonal, then the maximum eigenvalue of $`_{k=0}^{K1}P_i(k)`$ is minimized to one, and $`P_e^f1/K`$.

But unfortunately this family of encoding operators is clearly insecure against the unitary attack. The complete expression for $`P_e^u`$, the probability of Eve being unnoticed when Alice prepared $`\rho _{}`$ under the unitary attack is:

$$P_e^u=\frac{1}{K}\underset{k=0}{\overset{K1}{}}\text{tr}_{}\left[P_iU^{}(k)F_{}\rho _{}(k)F_{}^{}U(k)\right]=\frac{1}{K}\underset{k=0}{\overset{K1}{}}\text{tr}_{}\left[P_i(k)F_{}\rho _{}(k)F_{}^{}\right],$$
(36)
with $`\rho _{}(k)=U(k)\rho _{}U^{}(k)`$. Because the subspaces $`𝒞_k`$ obtained after transforming $`𝒞`$ with the $`U(k)`$ above are all orthogonal, disjoint subspaces of $``$, if Eve chooses a unitary operator $`F_{}`$ acting inside each subspace separately with the general form:

$$F_{}=\underset{l=0}{\overset{K1}{}}P_i(l)F_{}P_i(l),$$
(37)
then its action on $`\rho _{}(k)`$ gives $`F_{}\rho _{}(k)F_{}^{}=P_i(k)F_{}\rho _{}(k)F_{}^{}P_i(k)`$, which is invariant under projection over $`P_i(k)`$. Therefore,

$$P_e^u=\frac{1}{K}\underset{k=0}{\overset{K1}{}}\text{tr}_{}\left[F_{}\rho _{}(k)F_{}^{}\right]=1.$$
(38)
Finding a family $`\{U(k)\}`$ producing an acceptable bound for $`P_e^u`$ is not easy. One possible family, using the formalism of quantum stabilizer error correcting codes, has been given by Barnum Barnum et al. , (n.d.) with $`P_e(2+2m/t)/(2^t+1)`$ for a key of length $`2m+O(t)`$ bits. Intuitively, the nature of the conditions on the $`\{U(k)\}`$ given in the preceding Section seems to indicate that $`P_e^u`$ would decrease with the overlapping between the subspaces $`𝒞_k`$; however, that overlapping cannot be too big, because if, in the limiting case, the subspaces $`𝒞_k`$ are actually the same subspace, then the probability of failure under both types of attacks would be one. Specifically, in the forgery case, $`U(k)P_iU^{}(k)=P_i`$ $`k`$, and therefore $`P_e^f=\frac{1}{K}_{k=0}^{K1}\text{tr}_{}\left(P_i\rho _E\right)=1`$ for any $`\rho _E𝒞`$. In the case of the unitary attack, if Eve chooses $`F_{}`$ such that $`[F_{},P_i]=0`$ then,

$$P_e^u=\frac{1}{K}\underset{k=0}{\overset{K1}{}}\text{tr}_{}\left[P_iF_{}\rho _{}(k)F_{}^{}\right]=\frac{1}{K}\underset{k=0}{\overset{K1}{}}\text{tr}_{}\left[P_i\rho _{}(k)\right]=1,$$
(39)
where the last equality is obtained using the fact that if $`\rho _E(k)𝒞`$, then $`P_i\rho _{}(k)=\rho _{}(k)`$, $`k`$. Thus we would be looking for an intermediate situation, in which the $`𝒞_k`$ are not orthogonal neither coincident $`C`$-dimensional subspaces inside $``$. But what family of $`\{U(k)\}`$ is optimal remains an open problem. It might even be the case that no optimal strategy to handle at the same time the two types of attack can be found: Loosely speaking, if we represent $`P_e^u`$ and $`P_e^f`$ against some type of measure of the overlapping between the subspaces $`𝒞_k`$, then one would expect $`P_e^f`$ to increase from its minimus value to one as the overlapping increases, and $`P_e^u`$ to have at least one minimus in an intermediate point between zero and total overlapping. But the two curves might not cross, or cross in different ways, making the decision on which is the optimal family of encoding operators not obvious.

## VI Conclusion

We have addressed the problem of how to authenticate quantum messages between two partners (Alice and Bob) connected by an ideal quantum communication channel. Any authentication process requires a previous secret between the communicating partners, and we have assumed that Alice and Bob share a classical secret key. Our authentication scheme uses a tagging procedure in the transmitting end, and unitary operations selected by the key (encoding and decoding rules), on both ends of the channel. In our feasibility analysis, failure can be caused by an undesired unitary manipulation of the information in transit between the partners, or by impersonation (forgery of a fake authentication message). We have shown the conditions that the sets of encoding and decoding rules must satisfy to make authentication possible. These conditions are better stated in terms of geometrical relations between the subspaces of valid tagged messages selected by each unitary rule. Specifically, to protect against forgery, we have shown that no pair of subspaces has to be coincident; in fact, the failure probability reaches its minimum, which is inverse in the key length, when the spaces are all disjoint and orthogonal. On the other hand, to protect against the unitary attack, the restrictions on the encoding rules are much more involved. Briefly, an intermediate situation, one in which the encoding subspaces are neither coincident nor disjoint, seems to be the desired setting. In particular, a key length of order $`D/C`$, the ratio between the dimension of the invalid and valid message subspaces, is enough.

Many open questions related to the quantum authentication schemes analysed deserve further investigation. First, one would like to find the optimal family of encoding rules protecting against the unitary or even more general (those based on TPCP maps) attacks, and to give an explicit expression for the probability of failure in terms of the encoding rules employed. This may require a more practical definition of the probability of failure. For instance, Eve might, with high probability, transform the original message, but only in a way such that the fidelity between the original and the transformed state be still very high. It could also be the case that she could strongly transform, without being noticed, messages inside a particular subspace of the valid message space, and be noticed if she transforms messages outside it. All these situations would have to be considered by Alice and Bob in any practical implementation of the protocol. Another important practical issue is whether an optimal family of encoding rules against both types of attacks exists.

###### Acknowledgements.

This work was partially supported by Xunta de Galicia (Spain, grant No. PGIDT00PXI322060PR) and the Spanish Government (grant No. TIC2001-3217).


text:
# Energy Dependence of Λ and Λ̄ Production at CERN-SPS Energies

## 1 Introduction

Anomalies in the energy dependence of strangeness production have been predicted as a hint for the onset of deconfinement . Since $`\mathrm{\Lambda }`$ hyperons contain between 30 and 60$`\%`$ of the total strangeness produced in hadronic interactions their measurements allows to study simultaneously strangeness production and the effect of net baryon density.

## 2 Analysis

The data sets used for the present analysis are the 7.2 $`\%`$, 7.2 $`\%`$ and 10 $`\%`$ most central Pb-Pb events at 40, 80 and 158 A$``$GeV beam energy, corresponding to 8.73, 12.3 and 17.3 GeV c.m. energy per nucleon nucleon pair. The NA49 experiment  identifies neutral strange baryons by reconstructing their characteristic V0 decay topology $`\mathrm{\Lambda }p+\pi ^{}`$, $`\overline{\mathrm{\Lambda }}\overline{p}+\pi ^+`$ and $`\mathrm{K}_s^0\pi ^++\pi ^{}`$. The $`\mathrm{\Lambda }`$ hyperons contain the short-lived $`\mathrm{\Sigma }^0`$, which decay electro-magnetically into $`\mathrm{\Lambda }\gamma `$.

The charged decay products are measured with four time projection chambers (TPCs), two of them are located inside two large dipole magnets, the other two downstream of the magnets symmetrically to the beam line .

In figure 1, the invariant mass distribution of $`\mathrm{K}_s^0`$ at 158 A$``$GeV is shown. An agreement between the peak position and the nominal $`\mathrm{K}_s^0`$ mass, indicated by the arrow, is observed. The invariant mass distributions of $`\mathrm{\Lambda }`$ and $`\overline{\mathrm{\Lambda }}`$ are shown in reference . The mass resolution ($`\sigma _\mathrm{m}`$) is 2 MeV/$`c^2`$ for the lambdas and 4 MeV/$`c^2`$ for $`\mathrm{K}_s^0`$.

## 3 Spectra

Corrections, described in detail in reference , are applied bin by bin in rapidity and transverse momentum for geometrical acceptance and tracking efficiency. The rapidity distributions are obtained by integrating the measured $`p_\mathrm{T}`$-spectra and by extrapolation into unmeasured regions. In figure 2, the rapidity distributions of $`\mathrm{\Lambda }`$ and $`\overline{\mathrm{\Lambda }}`$ are summarized for all three energies. It is found that the distribution of the $`\mathrm{\Lambda }`$ is broader than that of the $`\overline{\mathrm{\Lambda }}`$. The $`\mathrm{\Lambda }`$ rapidity distribution becomes broader with increasing energy. The total lambda multiplicities are obtained by integration of the rapidity spectra with small extrapolations into unmeasured regions using a Gaussian fit for the $`\overline{\mathrm{\Lambda }}`$ at all three energies and the $`\mathrm{\Lambda }`$ at 40 A$``$GeV. A double Gaussian is used for the $`\mathrm{\Lambda }`$ at 80 A$``$GeV. For the $`\mathrm{\Lambda }`$ rapidity distribution at 158 A$``$GeV an extrapolation is made using realistic estimates of the tails (e.g. $`\mathrm{\Lambda }`$ from central S+S and net-proton distribution at 158 A$``$GeV ).

The corrections and the analysis procedure were checked by extracting the $`\mathrm{K}_s^0`$ meson at 158 A$``$GeV and comparing them to the charged kaons . The charged kaons are identified with a different method (dE/dx). The comparison between the rapidity distribution of $`\mathrm{K}_s^0`$ and the charged kaons (using isospin symmetry: $`\mathrm{K}_s^0=(\mathrm{K}^++\mathrm{K}^{})/2`$) is shown in figure 1 (right). Good agreement is observed. The total $`\mathrm{K}_s^0`$ multiplicity, quantified using a Gaussian fit to extrapolate the unmeasured regions yields $`\mathrm{K}_s^0`$ = 75 $`\pm `$ 4 .

## 4 Energy Dependence

The maximum of the $`\mathrm{\Lambda }`$ rapidity distribution decreases with increasing collision energy, as shown in figure 2. This effect is even enhanced in the $`\mathrm{\Lambda }/\pi `$ ratio (see figure 3(a)). The pions are calculated according to $`\pi =3/2(\pi ^++\pi ^{})`$ . The data at AGS energies (triangles) are taken from reference . The $`\mathrm{\Lambda }/\pi `$ ratio steeply increases at AGS energies, reaches a maximum and drops at SPS energies. In comparison, the $`\overline{\mathrm{\Lambda }}/\pi `$ ratio shows a monotonic increase up to RHIC energies  without significant structure (see figure 3(b)). The same behavior is visible for the total multiplicities $`\mathrm{\Lambda }/\pi `$ and $`\overline{\mathrm{\Lambda }}/\pi `$ as shown in figure 3(c) and (d). These differences can be attributed to different production mechanism for $`\mathrm{\Lambda }`$ and $`\overline{\mathrm{\Lambda }}`$ and to the effect of net-baryon density.

Since the $`\mathrm{K}^+`$ carry about 80$`\%`$ of the produced $`\overline{\mathrm{s}}`$ quarks we expect the $`\mathrm{K}^+/\pi ^+`$ ratio to show a similar behavior as the $`\mathrm{\Lambda }/\pi `$ ratio (using strangeness conservation) which is indeed the case .

In figure 3, the measurements are compared to model predictions from UrQMD , HSD , RQMD  and the statistical model of reference . All models describe the general trend of the experimental data correctly. The microscopic models under-predict and the statistical model over-predicts the measured $`\mathrm{\Lambda }/\pi `$ ratios.

The $`\overline{\mathrm{\Lambda }}/\mathrm{\Lambda }`$ ratio at mid-rapidity rises steeply from AGS  to RHIC energies  (see figure 4, left). The numerical values are 0.027 $`\pm `$ 0.0025 for 40, 0.079 $`\pm `$ 0.01 for 80 and 0.149 $`\pm `$ 0.016 for 158 A$``$GeV, respectively. The same trend is measured for the $`\overline{\mathrm{p}}/\mathrm{p}`$ ratio , but the numerical values are smaller than for the corresponding $`\overline{\mathrm{\Lambda }}/\mathrm{\Lambda }`$ ratio. (0.0079 $`\pm `$ 0.0008, 0.028 $`\pm `$ 0.0025, 0.060 $`\pm `$ 0.005, respectively). Total yields for p and $`\overline{\mathrm{p}}`$ will give more insight into this problem.

The $`\overline{\mathrm{\Lambda }}/\overline{\mathrm{p}}`$ ratio allows to study the interplay of production and annihilation processes. In the SPS energy range this ratio indicates an increase with decreasing energy as illustrated in figure 4, right. The data at lower and higher energies are taken from .

In summary, the ratio $`\mathrm{\Lambda }/\pi `$ shows a maximum between top AGS energies and 40 A$``$GeV whereas the $`\overline{\mathrm{\Lambda }}/\pi `$ ratio increases monotonically with increasing energy. The upcoming measurements at 20 and 30 A$``$GeV will give more details for this energy range.

Acknowledgements: The author thanks E.L. Bratkovskaya, K. Redlich and N. Xu for providing the model predictions. This work was supported by the Director, Office of Energy Research, Division of Nuclear Physics of the Office of High Energy and Nuclear Physics of the US Department of Energy (DE-ACO3-76SFOOO98 and DE-FG02-91ER40609), the US National Science Foundation, the Bundesministerium fur Bildung und Forschung, Germany, the Alexander von Humboldt Foundation, the UK Engineering and Physical Sciences Research Council, the Polish State Committee for Scientific Research (2 P03B 130 23 and 2 P03B 02418), the Hungarian Scientific Research Foundation (T14920 and T32293), Hungarian National Science Foundation, OTKA, (F034707), the EC Marie Curie Foundation, and the Polish-German Foundation.