text:
# Adsorption and two-body recombination of atomic hydrogen on 3He-4He mixture films

## Abstract

We present the first systematic measurement of the binding energy $`E_a`$ of hydrogen atoms to the surface of saturated 3He-4He mixture films. $`E_a`$ is found to decrease almost linearly from 1.14(1) K down to 0.39(1) K, when the population of the ground surface state of 3He grows from zero to $`6\times 10^{14}`$ cm-2, yielding the value $`1.2(1)\times 10^{15}`$ K cm2 for the mean-field parameter of H-3He interaction in 2D. The experiments were carried out with overall 3He concentrations ranging from 0.1 ppm to 5 % as well as with commercial and isotopically purified 4He at temperatures 70…400 mK. Measuring by ESR the rate constants $`K_{aa}`$ and $`K_{ab}`$ for second-order recombination of hydrogen atoms in hyperfine states $`a`$ and $`b`$ we find the ratio $`K_{ab}/K_{aa}`$ to be independent of the 3He content and to grow with temperature.

preprint: HEP/123-qed

Two-dimensional (2D) Bose systems acquire growing interest since the observation of local coherence in the weakly interacting gas of hydrogen atoms adsorbed on liquid helium surface saf98 . We found that at high quantum degeneracy the probability of three-body surface recombination of H atoms is suppressed at least by a factor of 11(2). The phenomenon was attributed to the formation of a 2D quasicondensate (QC), condensate with fluctuating phase. However, for an ideal gas three-body recombination in the condensate would be a factor of 3! less probable than in the noncondensate KSS87  and H-H interactions are expected to make the effect of QC on local correlations even smaller svist99 . The difference between the experimental and theoretical suppression factors has been accounted for on the basis of increasing delocalization of the bound state wave function in surface-normal direction with increasing density of the 2D hydrogen kagan89 ; stoof . Thus it seems desirable to experimentally separate the roles of local coherence and delocalization. Experiments with 2D hydrogen on 3He-4He mixtures are anticipated to give such an opportunity by virtue of weaker blue  and, as it will be shown here, even tunable binding of H atoms to the surface.

In this paper we report on experiments where the binding energy $`E_a`$ of hydrogen to liquid helium has been measured as a function of 3He surface coverage. $`E_a`$ is found to decrease almost linearly from 1.14(1) K to 0.39(1) K, when the 3He coverage grows from zero to about one atomic layer. We have also studied two-body recombination of H atoms in their two lower hyperfine states $`a`$ and $`b`$, since the probability of this process does not change upon the appearance of QC and thus serves as reference for three-body recombination saf98 . Our data unambiguously corroborates the prediction greben  that the recombination rate constant ratio $`K_{ab}/K_{aa}`$ increases with temperature.

In our experiments ESR operating at 128 GHz (field $`B`$ = 4.57 T) and NMR at 910 MHz have been employed, respectively, to measure and control the $`a`$ and $`b`$ state populations. The versatile combination of ESR and NMR provides well-defined conditions for studying different recombination processes. Moreover, the data analysis is simple and reliable. The ESR spectrometer has been calibrated calorimetrically with an estimated absolute accuracy of 10% and long-term stability of 2%. The minimum detectable density is about $`2\times 10^{12}`$ cm$`^3.`$

The volume of H gas in the sample cell, including the annexed ESR and NMR cavities, is $`V`$ = 4.5 cm3. The area of inner cell walls coated with helium film is $`A`$ = 22 cm2. The cell temperature $`T`$ is measured with a RuO2 thick-film resistor attached to the outer cell wall and calibrated against the 3He melting curve with an absolute accuracy of 1 mK.

At the relatively low densities considered here the H gas both in 2D and in 3D is well described by Boltzmann statistics. The recombination of hydrogen atoms takes place in the adsorbed phase, whereas the large majority of atoms is in the bulk. Then the effective rate constant of the second-order decay of the bulk density is related to the intrinsic rate constant of two-body surface recombination by the relation blue

$$K_{ij}^{\mathrm{eff}}=\frac{A}{V}\lambda ^2\mathrm{exp}\left(\frac{2E_a}{kT}\right)K_{ij},$$
(1)
where $`\lambda =\sqrt{2\pi \mathrm{}^2/mkT}`$ is the thermal de Broglie wavelength, $`m`$ is the hydrogen atomic mass and subscripts $`i`$ and $`j`$ denote the hyperfine states. Therefore, by measuring the temperature dependence of $`K_{ij}^{\mathrm{eff}}`$ one can determine both $`E_a`$ and $`K_{ij}`$ as has been done for H on 4He in many previous experiments blue . In case of equally populated states $`a`$ and $`b`$ one has

$$\frac{dn_b}{dt}=\frac{dn_a}{dt}=(K_{aa}^{\mathrm{eff}}+K_{ab}^{\mathrm{eff}})n_b^2.$$
(2)
We apply rf power to the sample saturating the $`ba`$ NMR transition to continuously equalize the two populations. Being to a high accuracy linear in time R , the measured $`1/n_b`$ gives $`K^{\mathrm{eff}}K_{aa}^{\mathrm{eff}}+K_{ab}^{\mathrm{eff}}`$. Evolution of $`1/n_a`$ observed in a separate experiment yields exactly the same values of $`K^{\mathrm{eff}}`$. In an experiment of another type short rf pulses resonant with the $`ba`$ transition are used to convert a small fraction of the otherwise $`b`$-state sample to the $`a`$-state. From the lifetime $`\tau =1/K_{ab}^{\mathrm{eff}}n_b`$ of $`a`$-atoms we obtain $`K_{ab}^{\mathrm{eff}}`$ jetp . We believe that this procedure to determine $`K_{aa}^{\mathrm{eff}}`$ and $`K_{ab}^{\mathrm{eff}}`$ is more reliable than extraction of the rate constants from multiparameter non-linear fits of the density decays to coupled rate equations.

The experiments are carried out at $`T`$ = 70…400 mK for overall 3He concentrations $`c_3`$ = 0.1, 1, 10, and 100 ppm, 0.1, 1, and 5% as well as for isotopically purified 4He ($``$ 1 ppb of 3He) and commercial helium. The total amount of liquid helium in the cell is about 11 cm3. The free surface area accessible to 3He is 57 cm2 including the film-covered low-temperature part of the H inlet tube coming from a dissiciator.

Fig. 1 shows the temperature dependence of the ratio $`K_{ab}^{\mathrm{eff}}/K_{aa}^{\mathrm{eff}}`$ obtained in this work together with the results of Statt et al. statt . In agreement with the theory of Greben et al. greben , but in contradiction with some earlier experimental results blue , the rate constant ratio grows with $`T`$. In fact, $`ab`$ recombination produces only ortho-H2 with odd angular momentum and consequently the atoms must overcome a centrifugal barrier statt . The probability of such a process vanishes at $`T`$ = 0. We also emphasize that, within experimental scatter, $`K_{ab}^{\mathrm{eff}}/K_{aa}^{\mathrm{eff}}`$ shows no systematic change upon addition of 3He and is therefore averaged over all concentrations. The error bars in Fig. 1 represent standard deviation of the data.

In Fig. 2 the temperature dependence of $`K_{aa}^{\mathrm{eff}}`$ is presented for various 3He concentrations and for commercial as well as isotopically pure 4He. Following Ref. greben, , we assume the crosslength $`l_{aa}`$ for $`aa`$ surface recombination to be temperature independent. Then $`K_{aa}=\overline{v}l_{aa}\epsilon ^2\sqrt{T}`$, where $`\epsilon 2.53\times 10^2`$T/$`B`$ is the hyperfine mixing parameter and $`\overline{v}=\sqrt{\pi kT/m}`$ the relative thermal velocity in 2D. For H on pure 4He $`E_a`$ does not vary with $`T`$. Then half of the slope of the $`\mathrm{ln}(\frac{V}{A}K_{aa}^{\mathrm{eff}}/\lambda ^2\sqrt{T})`$ versus $`1/T`$ line is $`E_a=1.14(1)`$ K and the intercept gives $`l_{aa}=0.40(10)\mathrm{\AA }`$. For $`T`$-independent $`l_{aa}`$ Fig. 1 may also be regarded as the temperature variation of the crosslength $`l_{ab}`$.

In Fig. 2 the data also for $`c_3=5\%`$ fall on a straight line. Yet the 3He surface coverage changes ES  and we cannot take $`E_a`$ to be constant. Instead we assume, to the first approximation, that the crosslength $`l_{aa}`$ does not depend on 3He content either. Then we determine $`E_a`$ for each concentration and temperature from the measured $`K_{aa}^{\mathrm{eff}}`$ using Eq. (1) with $`l_{aa}`$ fixed to its pure-4He value. The results are shown in Fig. 3, from which one notices that the behavior of $`E_a`$ resembles that of the surface tension of 3He-4He solutions ES . Both have their origin in 2D 3He bound to the surface of the liquid. Since the chemical potential of H atom inside liquid helium is large positive, even a small overlap of the wavefunctions of adsorbed H and 3He repels hydrogen atoms from the surface, i.e., raises the energy level of the single bound state of the H atom.

According to Pavloff and Treiner PT  there are at least two surface states of 3He on bulk 4He. The binding energies relative to the bulk liquid and the effective masses in zero coverage limit are $`e_{s0}=2.64`$ K and $`M_0=1.29m_3`$ for the ground state and $`e_{s1}=0.81`$ K and $`M_1=1.6m_3`$ for the excited state. Here $`m_3`$ denotes the bare mass of 3He. The variations of these quantities with 3He coverage are also given in Ref. PT, . In good agreement with Ref. PT,  the occupation of the excited surface state at $`n_{3s}3.5\times 10^{14}`$ cm-2 has been recently observed in an experiment cool . Therefore, using the above values we may calculate the populations $`n_{3s0}`$ and $`n_{3s1}`$ of the both 3He surface states for all concentrations $`c_3`$ and temperatures.

Fig. 4 presents the hydrogen adsorption energy $`E_a`$ as a function of $`n_{3s0}`$. The population of the excited state is also shown for reference. The decrease of $`E_a`$ is obviously due to interaction of adsorbed H atoms with the surface states of 3He. The slope of the $`E_a`$ vs. $`n_{3s0}`$ line is the effective mean-field parameter $`U_{30}=1.2(1)\times 10^{15}`$ K cm2. It does not seem to change at $`n_{3s0}=3.5\times 10^{14}`$ cm-2, where the occupation of the excited state begins. This points to the interaction of H with the excited state of 3He being weak, $`U_{31}U_{30}`$.

Despite of the above assumption we can consider two reasons why the crosslength $`l_{aa}`$ might change upon addition of 3He. First, helium atoms play the role of the third body in hydrogen recombination. Clearly, the probability of collisions with helium increases in presence of 2D 3He due to a larger overlap of the wave functions. On the other hand, the surface-normal delocalization length $`d=\mathrm{}/\sqrt{2E_am}`$ of the hydrogen wavefunction grows with $`n_{3s0}`$. The latter reason causes the H-H recombination crosslength $`l_{aa}1/d\sqrt{E_a}`$ KSS87 , to decrease with growing $`n_{3s0}`$. Even if the two effects do not completely cancel each other, our results for $`E_a`$ remain practically unchanged because the variation of $`l_{aa}`$ is important when both $`T`$ and $`n_{3s0}`$ are high, i.e., for very few data points only (cp. Figs. 2 and 4).

Confiding in our techniques to monitor and manipulate the hyperfine level populations in our H samples we believe that the present work sheds new light on the long-standing discrepancies between numerous previous determinations of $`E_a`$. Unknown hyperfine polarization is one of the several possible sources of systematic error in the determination of $`E_a`$ listed by Godfried et al. harvard . Another source is 3He impurity and from Fig. 2 it is obvious that even a very small amount of 3He can considerably change the average slope typically taken as $`2E_a`$. This would also affect the value of the recombination crosslength $`l_{aa}`$ extracted from the $`T`$-dependence of the effective rate constants under the assumption of constant $`E_a`$. It is likely that in several earlier studies ”pure” 4He was, if not explicitly stated otherwise, just non-purified commercial helium with unknown 3He contamination. This is not a problem at $`T`$ 200 mK (cp. Fig. 3) or if there is no bulk helium in the sample cell but a saturated film only. In the latter case the area-to-volume ratio is so large, about $`10^5`$ cm-1, that the 3He surface coverage is at most $`10^4`$ monolayers even for $`c_3`$ = 1 ppm which is at least an order of magnitude larger than the natural abundance.

The ESR results of Statt et al. statt  for $`K_{aa}^{\mathrm{eff}}`$ and $`K_{ab}^{\mathrm{eff}}`$ at $`T`$ = 250…500 mK agree quite well with ours scaled to same magnetic field and $`A/V`$ ratio. Morrow et al. morrow  measured the zero field NMR frequency shift for H above 200 mK and found, as coupled fitting parameters, the binding energy $`E_a`$ = 1.15(5) K and the wall shift $`\mathrm{\Delta }_s`$ = -49(2) kHz. Later Pollack et al. pollack  observed simultaneously surface and bulk H atoms by NMR and directly found $`\mathrm{\Delta }_s`$ = 43.2(10) kHz, as extrapolated to $`B`$ = 0. Shinkoda and Hardy shinkoda  used ESR for a direct detection of H atoms at the surface of 4He. They had several cm3 of liquid helium in the sample cell and measured the apparent $`E_a`$ to increase from 0.75 K to 1.03 K when $`T`$ increased from 70 to 140 mK. This observation is just an extrapolation of our results for commercial helium (open diamonds in Fig. 3) to lower temperatures. Associating the results of Refs. statt, ; morrow, ; pollack, ; shinkoda, , our value $`E_a`$ = 1.14(1) K for H on isotopically pure 4He and the theoretical prediction greben  with each other we gather strong support for the assumption of a temperature independent crosslength $`l_{aa}`$. It should also be added that another potential pitfall in the $`E_a`$ determination was avoided in this work by extending the measurements over a wide enough temperature range.

It is worth comparing the lowest value of the binding energy, $`E_a=0.39(1)`$ K, measured in our experiment for $`c_3`$ = 5% with earlier results extracted from pressure measurements of density decays. The latter are 0.39(1) K for pure 3He jochemsen  and 0.34(3) K for the mixture of two parts of 3He and one part of 4He yperen .

The linear decrease of $`E_a`$ with $`n_{3s}`$ shows that H-3He interaction is well described by the mean-field approximation. This is an important observation as such, but it seems to disagree with the following arguments. Typically the Fermi energy of 2D 3He gas is much higher than temperature, $`e_{0F}=\pi \mathrm{}^2n_{3s0}/2M_0kT`$. Then elastic H-3He collisions in 2D responsible for decreasing $`E_a`$ involve 3He quasiparticles from the Fermi level only. Their density, of order $`n_{3s0}T/e_F=2M_0T/\pi \mathrm{}^2`$, is independent of $`n_{3s0}`$. On the other hand, the Fermi level rises with $`n_{3s0}`$, the corresponding wave function expands in surface-normal direction PT  and overlaps more with adsorbed hydrogen.

The present measurements of hydrogen adsorption energy $`E_a`$ as a function of 3He surface density offer a unique opportunity to perform experiments on a degenerate 2D Bose gas with tunable interaction strength which scales as $`\sqrt{E_a}`$. As such, the quantum system of a degenerate 2D Bose gas (H) coupled with a degenerate 2D Fermi gas (3He) would also be an interesting object to study. The mean-field parameter $`U_{30}`$ obtained here should play a key role in the behavior of that system.

This work is supported by Academy of Finland, INTAS (grant No 97-11981), Wihuri Foundation, the Russian Ministry of Industry, Science and Technology and RFBR (grant No 99-02-17357).


format: text

text:
# Temporary Assumptions for Quantum Multiparty Secure Computations

## I Introduction

Due to the no-go theorems of Mayers and Lo/Chau  and Lo  quantum cryptography cannot—with unconditional security—implement bit commitment, oblivious transfer and many other important two party protocols.

Here we give an analysis of the case of multiparty protocols.

We will investigate two settings. First multiparty protocols which we call partially robust, which can tolerate all forms of cheating, but can be aborted by a collusion of disruptors and secondly we will consider multiparty protocols which are robust even against disruption .

In the case without disruption classical multiparty protocols can yield unconditional security against all possible forms of cheating if a majority of the players is honest and one assumes private channels between any two parties as well as a broadcast channel . More general for every set of possibly colluding parties secure multiparty computations are possible if no two collusions cover the total set of players .

From the no-go theorems for quantum two party protocols it can be concluded that there exist functions which cannot be realized by secure quantum multiparty protocols if two sets of possibly colluding parties cover the complete set of players. If the possible collusions are only defined by their cardinality multiparty protocols using quantum cryptography become insecure if not a majority of players behave honestly.

Still quantum multiparty protocols have advantages over classical multiparty protocols. In this paper we prove that the assumptions about possible collusions can be loosened after the execution of the protocol. We present protocols where a majority may become dishonest after the protocol has terminated. Furthermore we give a limit on the collusions which are tolerable after the execution of the protocol. These bounds depend on the collusions which are tolerable during the execution of the protocol.

In the case with disruption we need that no two possible collusions cover all but one players, i. e., the cardinality of the union of two collusions never reaches $`n1`$ for $`|P|=n`$. Given this assumption we can again prove that the assumptions about possible collusions can be loosened after the execution of the protocol. We also give limits on the collusions which are tolerable after the execution of the protocol and prove that these limits are tight.

We will restrict our view mostly to realizing a bit commitment from one party (called Alice) to a party named Bob. For our impossibility results we simply prove that relative to the given assumptions there cannot exist a multiparty protocol realizing a bit commitment from Alice to Bob. This implies that under the given assumptions there exist functions which cannot be computed securely. For the constructive results it is again enough to look at bit commiment, because with a result of Yao  we can realize an oblivious transfer channel using a quantum channel and bit commitments. With such an oblivious transfer channel between every pair of players we can realize multiparty computations, even with a dishonest majority . Our concern will hence be to characterize the assumptions relative to which a bit commitment between two of the players becomes possible.

The structure of the paper is as follows. In Section II we will review definitions and known results on classical multiparty protocols and secret sharing techniques as far as we need them to prove our results. Next, in Section III we review the impossiblity of quantum bit commitment in the two party scenario . We give some generalizations to the situation of multiparty protocols. In Section IV we stress the cryptographic importance of assumptions which can be loosened after a limited time, so called temporary assumptions. Then in the Sections V,VI, VII we give protocols which allow temporary assumptions in secure multiparty computations. The main idea is to use a classical secret sharing scheme as a bit commitment protocol to force honest measurements. We show that, after the honest measurements are performed, the assumptions about possible collusions can be loosened.

## II Classical Multiparty Protocols and Secret Sharing

### A Classical Multiparty Computations

In a multiparty protocol a set $`P`$ of players wants to correctly compute a function $`f(a_1,\mathrm{},a_n)`$ which depends on secret inputs of $`n`$ players. Some players might collude to cheat in the protocol as to obtain information about secret inputs of the other players or to modify the result of the computation.

When we look at the infrastructure available for the players we are mainly interested in three settings. First, there are private and authenticated channels between every pair of players and each player has a broadcast channel, second, every pair of players is connected by an oblivious transfer channel and a broadcast channel is available for everyone, and third, which is the setting for the results of this paper, every two players are connected by a quantum channel and an insecure but authenticated classical channel plus every player has access to a broadcast channel.

In multiparty computations we have to make some assumptions about possible collusions. We model possible collusions by defining a set of collusions. Only one of these possible collusions is actually cheating. Within this set of colluding players the players share their input and take actions based on their common knowledge.

###### Definition 1

An adversary structure is a monotone set $`𝒜2^P`$, i. e., for a subset $`S^{}`$ of a set $`SP`$ the property $`S𝒜`$ implies $`S^{}𝒜`$.

The main properties of a multiparty protocol are:

1. A multiparty protocol is said to be $`𝒜`$-secure if no single collusion from $`𝒜`$ is able to obtain information about the secret inputs of other participants which cannot be derived from the result and the inputs of the colluding players.
2. A multiparty protocol is $`𝒜`$-partially correct if no party can let the protocol terminate with a wrong result.
3. A multiparty protocol is $`𝒜`$-correct whenever no single collusion from $`𝒜`$ can abort the protocol, modify its result, or deviate from the protocol in a way that an honest player obtains information about the secret inputs of another player which cannot be derived from the result and the input of this honest player.
4. A multiparty protocol is called $`𝒜`$-fair if no collusion from $`𝒜`$ can reconstruct the result of the multi party computation earlier then all honest participants together. No collusion should be able to run off with the result.

A multiparty protocol having the properties 1., 2. and 4. is called $`𝒜`$-partially robust and a protocol having all three above properties is called $`𝒜`$-robust.

Whenever we are only concerned with partially robust protocols we will abort the protocol whenever a player complains about another player. Only robust protocols must be able to cope with conflicts between players.

Note that we allow only one collusion from $`𝒜`$ to cheat. Furthermore active cheaters are always be considered to be passively cheating, too.

Sometimes one thinks of all players being equivalent in their trustability, then adversary structures are solely defined by the cardinality of the collusions. When refering to an adversary structure which contains all subsets of $`P`$ with no more than $`t`$ players we denote the above properties by $`\left(\genfrac{}{}{0pt}{}{n}{t}\right)`$-secure, $`\left(\genfrac{}{}{0pt}{}{n}{t}\right)`$-(partially) correct, $`\left(\genfrac{}{}{0pt}{}{n}{t}\right)`$-fair, and $`\left(\genfrac{}{}{0pt}{}{n}{t}\right)`$-robust***Sometimes the terms $`t`$-secure, $`t`$-(partially) correct, $`t`$-fair, and $`t`$-robust are used for $`\left(\genfrac{}{}{0pt}{}{n}{t1}\right)`$-secure, $`\left(\genfrac{}{}{0pt}{}{n}{t1}\right)`$-correct, $`\left(\genfrac{}{}{0pt}{}{n}{t1}\right)`$-fair, and $`\left(\genfrac{}{}{0pt}{}{n}{t1}\right)`$-robust.

### B Multiparty Computations with Private Channels

We will summarize next what can be achieved by classical multiparty computations when private channels are available between any two players as well as a broadcast channel. The next result is taken from .

###### Theorem 2

Given a set $`P`$ of players with a secure and authenticated channel between each pair of players together with a broadcast cannel, then every function can be computed by an $`𝒜`$-partially robust multiparty protocol if no two sets from $`𝒜`$ cover the complete set $`P`$ of players.

###### Remark 3

There exist functions for which a multiparty protocol among players who have access to a broadcast channel and have secure and authenticated channels connecting every pair of players cannot be $`𝒜`$-robust if two collusions cover $`P\{P_i\}`$ for some player $`P_i`$.

###### Proof II.1.

If the players of two possible collusions $`A_1,A_2𝒜`$ covering $`P\{P_i\}`$ cannot cooperate then it is not clear for $`P_i`$ which collusion is cheating. To continue with the protocol all messages between players who are complaing about each other have to be exchanged over the broadcast channel or over secure channels via $`P_i`$. Obviously $`P_i`$ learns all secrets or the protocol must be aborted. In both cases the protocol is not $`𝒜`$-robust.

As a corollary we state the classic result from  which was generalized to the situation with broadcast channel in .

###### Corollary II.2.

Given $`n`$ players which have a secure and authenticated channel between each pair of players together with a broadcast cannel, then every function can be computed by a $`\left(\genfrac{}{}{0pt}{}{n}{t}\right)`$-partially robust multiparty protocol if $`t<n/2`$, i. e., if a majority is honest.

### C Secret Sharing

One important primitive of classical multiparty protocols is secret sharing which was introduced in . The aim of a secret sharing scheme is to allow a dealer to distribute shares $`s_1,s_2,\mathrm{},s_n`$, which represent one secret value $`x`$, to a set $`P`$ of players such that only certain authorized subsets of $`P`$ can reconstruct the secret $`x`$ whereas all other subsets of $`P`$ can’t get any information about $`x`$. Of course every subset of $`P`$ containing an authorized set must also be authorized. This leads to the definition of an access structure.

###### Definition II.3.

An access structure is a set $`𝒵2^P`$ for which for subsets $`S^{}S`$ of $`P`$ the property $`S𝒵`$ implies $`S^{}𝒵`$.

An acess structure is “dual” to an adversary structure. If $`𝒜`$ is an adversary structure then the set $`\{A^c|A𝒜\}`$ forms an access structure.

The first access structures which were studied were defined by the cardinality of their minimal authorized sets. Later secret sharing schemes were constructed for arbitrary access structures .

For our protocol it is especially important to be able to keep the dealer from deliberately handing out faulty shares. Shares which do not match the agreed on access structure.

This problem can be overcome by verifiable secret sharing  which allows a verifier (e. g. each individual player) to check if a share he received is a valid share.

As we will use it later we sketch a verifiable secret sharing scheme from  which can be used for every homomorphic secret sharing scheme. I. e., for every scheme where the secrets form an additive group and sharing is a group homomorphism.

Verifiable Secret Sharing$`(m)`$

1. Alice shares a secret $`m`$ with access structure$`𝒵`$.
2. for $`j=1`$ to $`k`$ do

1. Alice shares a random secret $`z`$ with the access structure $`𝒵`$.
    2. The verifier tells Alice to either open $`z`$ or $`zm`$.
    3. Alice publishes the shares for $`z`$ or $`zm`$.
3. od

If no player complains about the shares Alice publishes and if the shares published were correct shares then the verifier is convinced that all honest players hold correct shares.

It is clear that the secret $`m`$ is shared correctly if $`z`$ is shared correctly and $`zm`$ is shared correctly. A dishonest dealer will be caught cheating with a probability of $`\frac{1}{2}`$ in every of the $`k`$ iterations. Hence the probability to pass this test with an incorrectly shared secret is $`2^k`$ and thus negligible in $`k`$.

### D Multiparty Computations with Oblivious Transfer

Given an oblivious transfer channel all secure two party computations become possible with unconditional security . This result was generalized to allow multiparty computations with a dishonest majority . One obvious problem with such protocols is that if a majority of players cannot run off with the secret, i. e., they cannot reconstruct the secret on their own, then a minority of players can abort the protocol. For this reason we defined a multiparty protocol to be $`𝒜`$-partially correct if no collusion from $`𝒜`$ can make the protocol terminate with a wrong result.

The result of  can then be stated as

###### Theorem II.3.

Given an oblivious transfer channel between any two players as well as a broadcast channel, then every function can be realized by a $`\mathrm{}`$-robust, $`2^P`$-secure, $`2^P`$-fair, and $`2^P`$-partially correct multiparty protocol.

In multiparty protocols the inputs are usually shared by a secret sharing scheme and the result is computed locally on the shares and by sharing intermediate results. In  the players are committed to the shares they hold. The computation in  uses a global committed oblivious tranfer, which is constructed there, to implement NOT and AND gates directly on the commitments. As the players are unable to cheat in the global committed oblivious tranfer and the players cannot open their commitments faultily every form of cheating is detectable. The only problem is that it is not always clear who is cheating. In  more robust protocols based on oblivious transfer were analyzed. There is a trade off between robustness and security as stated in the following result which are taken from .

###### Lemma II.4.

Let $`P`$ be a set of $`n`$ players with every pair of players being connected by an oblivious transfer channel and every player having access to a broadcast channel. Let $`𝒜`$ and $`\stackrel{~}{𝒜}`$ be adversary structures, then for all functions $`𝒜`$-robust and $`\stackrel{~}{𝒜}`$-secure multiparty protocols exist if

1. the adversary structure $`𝒜`$ does not contain two sets covering $`P\{P_i\}`$ for any $`P_iP`$ and
2. the adversary structure $`\stackrel{~}{𝒜}`$ contains only the complement of one previously chosen set $`B`$ which is maximal in $`𝒜`$.

For a proof see

In the above result one can see the trade off between robustness and security. The smaller $`𝒜`$ can be chosen the larger $`\stackrel{~}{𝒜}`$ will be.

###### Corollary II.5.

The protocol of Lemma II.4 for the computation of a function $`f(a_1,\mathrm{},a_n)`$ is efficient in the number of players and the size of the circuit used to calculate $`f(a_1,\mathrm{},a_n)`$.

For a proof see .

## III No-Go Results

### A Quantum Bit Commitment Is Impossible

In this section we will shortly review the impossibility of quantum bit commitment as proven by Mayers and Lo/Chau.

###### Definition III.1.

A bit commitment protocol is a protocol consisting of two phases: commit and unveil. In the commit phase Bob obtains information from Alice which binds her to a certain bit $`b`$. In the unveil phase Alice opens $`b`$ to Bob and proves to Bob that the commitment bound her to the bit $`b`$.

A bit commitment protocol must have two properties:

1. binding, i. e., after committing Alice can, without the help of Bob, only unveil one fixed bit $`b`$.
2. concealing, i. e., without the help of Alice Bob cannot know the bit $`b`$ Alice committed to.

To show the impossibility of quantum bit commitment one proceeds in two steps

1. First one shows that for each quantum protocol there exists a protocol which keeps all actions at the quantum level and postpones all measurements and random choices until shortly before unveil. This protocol is secure (binding and concealing) if and only if the original protocol was secure.
2. Then it is proven that (in the new protocol) either Bob can from his part of the quantum state distinguish between a comitted zero and a committed one (the protocol is not concealing) or Alice can with a quantum transformation change her part of the quantum state from a superposition of commitments to zero into a superposition of commitments of one (and vice versa).

A key insight in the impossibility proofs given in  was that for each quantum protocol which involves measurements, random choices, and classical communication one can construct an equivalent protocol which has all measurements and random choices postponed to shortly before the unveil phase. With this reduction it is possible to treat the result of the commit phase as being a pure quantum state shared by Alice and Bob.

We will shortly explain the attack in more detail. Special emphasis is put on on classical communication during the protocol, as it involves measurements. But again these measurements can theoretically be delayed.

Alice behaves like she wants to honestly commit to zero and Bob behaves like an honest Bob, but all decisions which have to be made in the course of the protocol will no more be based on measurement results (or random choices), but will be done by conditional quantum gates  hence keeping all possibilities in superposition up to the measurement shortly before the unveil phase. Random choices are done in the same way, instead of fixing one value all possible values should be created in superposition. The most critical part of the reduction concerns classical communication. To get this classical data one must perform a measurement but even this measurement can be delayed to shortly before the unveil phase without changing the security of the protocol. Instead of measuring a qubit Alice entangles this qubit with two new qubits such that all three qubits give the same measurement result in the basis which should be used for the measurement (this is done by two controlled not) and sends one of these new qubits to Bob. This way Bob gets the information, and Alice can measure what information Bob got, but these measurements can be postponed without changing the security of the protocol.

If both parties follow this technique to keep everything at the quantum level, then the protocol will deliver, after the commit phase, a pure state shared by Alice and Bob.

This pure state $`|\mathrm{\Psi }_0`$ appears on Alice side as a mixture $`\rho _{Alice,0}`$ (the index zero reminds us that Alice has committed to zero, the states $`|\mathrm{\Psi }_1`$ and $`\rho _{Alice,1}`$ correspond to a commitment of one). On Bobs side the pure state appears as $`\rho _{Bob}`$.

Now we can import a result from .

###### Theorem III.1 (Hughston, Jozsa, and Wootters).

Given two pure quantum states $`|\psi `$ and $`|\varphi `$ shared between Alice and Bob which appear as the same state $`\rho `$ on Bob’s side, then there exists a unitary transform $`U_{|\psi ,|\varphi }`$ which acts on Alices part of the quantum system only and changes $`|\psi `$ to $`|\varphi `$.

This result was generalized by Mayers to the case where $`|\psi `$ and $`|\varphi `$ do not appear as the same state on Bob’s side but as states which are very close to each other .

In the case of bit commitment this says that either the bit can be measured on Bob’s side, i. e., $`\rho _{Bob}`$ looks different for $`|\mathrm{\Psi }_0`$ and $`|\mathrm{\Psi }_1`$, or Alice can change from $`|\mathrm{\Psi }_0`$ to $`|\mathrm{\Psi }_1`$ by a unitary transform $`𝒰_{0,1}`$ on her part of the quantum system.

We can conclude the impossibility result from .

###### Theorem III.1 (Mayers, Lo/Chau).

A quantum protocol for bit commitment cannot be binding and concealing.

To cheat in the actual protocol it is of course not necessary that both parties keep their decisions at the quantum levels. It is enough if the party being able to cheat does so. See also Lemma III.7.

### B Bounds on Tolerable Adversary Structures During the Execution of a Protocol

With the impossibility results for the two party case one can as well show that quantum cryptography cannot enhance classical bounds for the set of tolerable adversaries .

###### Corollary III.2.

Let $`P`$ be a set of players and let $`𝒜`$ be an adversary structure. If there exist two possible collusions $`A_1,A_2𝒜`$ with $`A_1A_2=P`$ then not all functions can be computed $`𝒜`$-partially robustly by a quantum multiparty protocol.

###### Proof III.3.

We show that it is impossible to realize a bit commitment for a party Alice $`A_1`$ and Bob $`A_2`$. This is simple as we are almost in the two party scenario: Assume the collusion $`A_2`$ can by no means measure the bit Alice committed to, then the collusion $`A_1`$ can, by keeping every action at the quantum level cheat analogously to the two party situation, i.e., there exists a unitary transform $`U_{01}`$ which can change the bit Alice is committed to. The transform $`U_{01}`$ must be jointly applied by all players in $`A_1`$

###### Corollary III.4.

There exist functions which cannot be computed $`\left(\genfrac{}{}{0pt}{}{n}{t}\right)`$-partially robustly by a quantum multiparty protocol if $`tn/2`$.

If we consider robustness we have to take into account more deviations from the protocol. A collusion of players could for example leak their secret (quantum) data to a player not in the collusion. Such an attack further limits the set $`𝒜`$ of possible collusions.

###### Corollary III.5.

Let $`P`$ be a set of players and let $`𝒜`$ be an adversary structure. If there exist two possible collusions $`A_1,A_2𝒜`$ with $`A_1A_2=P\{P_i\}`$ for any player $`P_i`$, then not all functions can be computed $`𝒜`$-robustly by a quantum multiparty protocol.

###### Proof III.6.

Assume there exists a $`P_iP`$ with $`P=A_1A_2\{P_i\}`$ for $`A_1,A_2𝒜`$. We would like to implement a bit commitment from a player from $`A_2`$ to the player $`P_i`$. To prevent the players from $`A_2`$ to jointly change the committed bit it must be possible for the players of $`A_1\{P_i\}`$ to measure the committed bit. Only the assumption that $`P_i`$ does not collude with the players of $`A_1`$ makes this attack impossible. If the player $`P_i`$ is honest but curious and keeps everything at the quantum level, then he would be able to measure the committed bit if all players of the set $`A_1`$ would together keep all their actions at the quantum level and later on give all their quantum information to the player $`P_i`$.

Even though the player $`P_i`$ does not collude with the players from $`A_1`$ we cannot keep the players from $`A_1`$ from deviating from the protocol in giving away their secret data.

### C Bounds on Tolerable Adversary Structures After the Protocol Terminated

During the execution of a protocol we must use the same assumptions as in classical multiparty protocols to obtain unconditional security. We will next prove bounds on the set of tolerable collusions after a protocol has been finished. In our case: after the commit phase of a commitment protocol has terminated. Interestingly these bounds are different.

To apply the attack of Mayers and Lo/Chau Alice need not keep every action at the quantum level. She can perform measurements which yield not enough information to, together with the quantum information Bob has, be able to distinguish between the commitments zero and one. In short Alice can perform any measurement whose result she could tell Bob without giving away her secret commitment.

###### Lemma III.7.

: Let $`|\mathrm{\Psi }_b`$ be a pure quantum state shared between Alice and Bob which is the result of a quantum bit commitment protocol which was executed at the quantum level.

If Alice can change the bit she committed to by a unitary transform $`U_{01}`$ on her part of $`|\mathrm{\Psi }_b`$ then she can still change the bit after she performed a measurement on her part of the quantum state if the information obtained by this measurement together with the quantum information Bob holds does not allow to distinguish between the commitments zero and one.

###### Proof III.8.

One can define a bit commitment protocol where Alice has to perform this measurement and send the information measured to Bob. As Bob can still not distinguish between the commitments zero and one the attack of Mayers, Lo/Chau applies and there exists a unitary transform changing the bit.

This simple result helps us to prove that temporarily having an honest but curious third party does not allow us to implement bit commitment .

###### Lemma III.9.

Bit commitment may be implemented between Alice and Bob if we introduce a trusted third party, but the assumption of having an honest but curious third party is not a temporary assumption.

###### Proof III.10.

If the honest but curious party remains independent of the two parties Alice and Bob bit commitment can be implemented by classical multiparty protocols.

Now assume the honest but curious third party joins Alice or Bob after the commit phase is completed.

The honest but curious third party will follow the protocol, but leave everything in superposition which need not be sent away as classical data. So the third party will perform some measurements. The third party can join Bob afterwards and Bob should still be unable to recover Alices bit. Hence the third party did only obtain measurement results which are of no use for Bob. Hence if the third party joins Alice we are in the situation of Lemma III.7. Alice together with the third party can jointly perform a unitary transform which changes the bit Alice committed to.

Lemma III.9 can be generalized to the multiparty scenario.

###### Proposition III.11.

There exist functions for which no quantum multiparty protocol, which is partially robust against the adversary structure $`𝒜`$ can afterwards become secure against an adversary structure which contains two complements of sets in $`𝒜`$.

###### Proof III.12.

Let $`A_1,A_2𝒜`$ denote two sets of possibly colluding players and let $`\stackrel{~}{𝒜}`$ be an adversary structure containing the complements of $`A_1`$ and $`A_2`$. We show that it is impossible to implement an oblivious transfer from Alice $`A_1`$ to Bob $`A_2`$ which is $`𝒜`$-partially robust and $`\stackrel{~}{𝒜}`$-secure after termination. Assume such an oblivious transfer were possible then we could with it implement a bit commitment from Alice to Bob which is $`𝒜`$-partially robust during the commit phase and $`\stackrel{~}{𝒜}`$-partially robust up to the unveil phase. This is easy to see as after termination of the commit phase security is the only critical issue. The data computed during the commit phase cannot be changed any more and fairness is not of interest until the unveil phase.

It remains to be proven that a bit commitment from the player Alice $`A_1`$ to the player Bob $`A_2A_1`$ is impossible. We look at the sets $`A_1`$, $`A_2A_1`$ and $`P(A_1A_2)`$ and prove the impossibility analogously to Lemma III.9. During the execution of the commit phase the protocol is $`𝒜`$-partially robust hence we can assume that the players in $`A_1`$ or the players in $`A_2A_1`$ collude and we still get a valid commitment from $`A_1`$ to $`A_2A_1`$. Now we assume the protocol to become $`\stackrel{~}{𝒜}`$-partially robust afterwards. Then all players from $`P(A_1A_2)`$ may join the players from $`A_2A_1`$ and the bit commitment remains concealing even if the players from $`A_2A_1`$ were colluding. Hence all quantum information in the posession of the players from $`P(A_1A_2)`$ are of no use to Bob. According to Lemma III.7 the players from $`A_1P(A_1A_2)=PA_2=A_2^c`$ can change the committed bit. Hence the bit commitment is not $`\stackrel{~}{𝒜}`$-partially robust between commit and unveil.

###### Corollary III.13.

There exist functions for which no $`\left(\genfrac{}{}{0pt}{}{n}{t}\right)`$-robust quantum multiparty protocol can become $`\left(\genfrac{}{}{0pt}{}{n}{nt}\right)`$-robust after its execution.

## IV Temporary Assumptions

Usually assumptions have to be made very carefully, because they implicitely try to predict future developements. The assumptions must be valid as long as the secret information is critical.

Temporary assumptions are hence very promising. There was little research into temporary assumptions in quantum cryptography after it became clear that computational assumptions cannot be used only temptorarily .

But quantum cryptography allows assumptions which are independent of computational assumptions. Such assumptions can be temporary.

The key idea to get temporary assumptions is to not try to make the transformation $`𝒰_{0,1}`$, which can change the committed bit, impossible, but to make it impossible for the parties (at least for the party able to cheat) to keep all actions at the quantum level.

E. g. Alice can trivially not cheat in the protocol of  if she has no quantum storage, even if quantum storage became available to her after the commit phase.

Assumptions which have the same effect are: limited quantum storage capacity and limited storage time for quantum bits as well as assumptions about decay introducing errors. Such assumptions need only hold during the execution of the protocol.

## V Forcing Measurements with Secret Sharing

In  Yao proved that it is possible to obtain oblivious transfer from a black box bit commitment and a quantum channel. The idea goes back to Crepeau  and was generalized to quantum channels which can have noise by Mayers .

The basic idea is to force measurements to avoid the attacks of Mayers and Lo/Chau and Lo . In the course of the protocol one party has to commit to the measurment bases used and to the results obtained. Then a random subset of these measurments are opened. If there are not too many discrepancies one can be sure that the committing party did measure most of the qubits. This already suffices to make the delay of all measurements impossible hence avoiding the attacks of Mayers and Lo/Chau and Lo . But one has to be careful if the bit commitment used is strong enough to force measurements. The unconditionally secure bit commitment of Kent  is not suitable as Kent proved in .

The main requirement for a bit commitment to be able to force measurments is that committing to a bit $`b`$ must be equivalent to giving the classical bit $`b`$ to a trusted third party. Committing to a measurement result according to  implies an irreversible measurement as otherwise the cheater and the trusted third party together could violate the Heisenberg uncertainty.

In this section we will show that secret sharing can be used like a black box bit commitment to force measurements using the protocols of .

If we use, instead of bit commitment, secret sharing with an access structure $`𝒵`$ and let $`𝒜`$ be the set $`\{A|A^c𝒵\}`$ then we have the following properties:

1. the bit commitment based on secret sharing is concealing given only a collusion of $`\{A|A𝒵\}`$ is cheating.
2. The bit commitment based on secret sharing is binding if only one collusion of $`𝒜`$ is cheating.
3. The bit commitment based on secret sharing is equivalent to announcing the bit to a trusted third party whenever only one collusion of $`𝒜`$ is cheating.

The first two points of this enumeration follow directly from the properties of secret sharing schemes. Now we look at the third point. According to the assumption that only one collusion of $`𝒜`$ cheats we know that there exists a set $`M`$ of honest players able to reconstruct the shared secret. As all players of $`M`$ are honest the committing player (Alice) had to honestly transmit all the shares of the players of $`M`$. These shares already fix the committed bit and hence handing out those shares is equivalent to announcing the bit to a trusted third party. From this the next result follows without further proof.

###### Lemma V.1.

Let $`𝒜`$ be an adversary structure and let $`𝒵`$ be an access structure such that $`𝒜=\{A|A^c𝒵\}`$. Then secret sharing with access structure $`𝒵`$ can be used to obtain $`𝒜`$-partially robust oblivious transfer from any player to the dealer. The protocol is $`\{A|A𝒵\}`$-secure.

After the measurements are irreversibly performed and the quantum attacks are impossible the bit commitment used need not be binding any more. Only the concealing property is still needed. For secret sharing the requirements for binding and concealing are different as seen in the enumeration above. So after all measurements are performed, especially after termination of the protocol, only collusions from $`\{A|A𝒵\}`$ can cheat in the oblivious transfer.

Of course we want oblivious transfer not only from one party to a set of players, but between every pair of players. The next section will give a detailed analysis of this situation.

## VI Partially Robust Protocols for Oblivious Transfer

We will next give a detailed analysis of the situation where we have a set $`P`$ of players together with an adversary structure $`𝒜`$ and every player should be able to share a secret among the other players.

We are only concerned with partially robust protocols here. Whenever a player complains about another player we will abort the protocol. Robust protocols will be presented in the next section.

###### Lemma VI.1.

Let $`P`$ be a set of players for which each pair of players is connected by an authenticated secure channel and every player has access to a broadcast channel. Let $`𝒜`$ be an adversary structure for which no two collusions cover the set $`P`$ of players. Then a bit commitment between any pair of players is possible which is $`𝒜`$-partially robust and $`\{A^c|A𝒜\}`$-secure.

###### Proof VI.2.

We will let Alice commit to a bit string $`m\{0,1\}^k`$.

Commit via Secret Sharing($`m`$)

1. Alice sends Bob a random string $`r\{0,1\}^k`$.
2. Alice shares the string $`mr`$ using a secret sharing scheme with access structure $`𝒵=\{Z|Z^c𝒜\}`$.

This protocol shares Alices secret $`m`$ with the access structure $`𝒵\{MP|\mathrm{Bob}M\}`$. If the receiver Bob is honest this protocol can be used to force measurements $`𝒜`$-partially robustly (Lemma V.1) and if Bob is not honest then we cannot prevent a dishonest sender from colluding and changing the committed bit together with the receiver of the bit commitment. No bit commitment scheme can.

The unveil protocol is essentially a reconstruction of the shared secret.

Unveil

1. Alice announces the shares she sent. The players from $`P`$ confirm the shares and Bob can then reconstruct $`m`$ from his knowledge of $`r`$.

We can improve the security a little bit further by not allowing every player to commit a bit via secret sharing. To obtain oblivious transfer between every pair of players it is enough that for every pair of players one of them can commit to the other as oblivious transfer can be inverted .

###### Lemma VI.3.

Let $`P`$ be a set of players for which each pair of players is connected by an authenticated secure channel and every player has access to a broadcast channel. Let $`𝒜`$ be an adversary structure for which no two collusions cover the set $`P`$ of players and let $`M`$ be any maximal set in $`𝒜`$. Then for every pair of players a bit commitment is possible for one of the players to the other player which is $`𝒜`$-partially robust and $`\{A^c|A𝒜\}M^c`$-secure.

###### Proof VI.4.

The partial robustness is the same as claimed by Lemma VI.1 so we need to prove only the improved security.

We have to see first that $`\{A^c|A𝒜\}M^c`$ is an adversary structure. The set $`\{A^c|A𝒜\}`$ is an adversary structure and it contains all proper subsets of $`M^c`$. Hence the set $`\{A^c|A𝒜\}M^c`$ is an adversary structure, too.

To obtain the higher security we choose for every pair of players one player who shall commit to the other. Let Alice and Bob be a pair of players for which either Alice, Bob$`M`$, Alice, Bob$`M`$ or Alice$`M`$ and Bob$`M`$. Otherwise exchange the names of the players.

We will see that the bit commitment from Lemma VI.1 between any two players Alice and Bob is $`\{A^c|A𝒜\}M^c`$-secure if used in the above defined direction. As Lemma VI.1 already proves the $`\{A^c|A𝒜\}`$-security we are left with proving the security against the possible collusion $`M^c`$.

A collusion can only cheat if it is an authorized set able to recover a shared secret and if it contains the receiver of the bit commitment as the shared secret is encrypted by a key $`r`$ only known to the sender and the receiver of the bit commitment. If the collusion contains the sender of the bit commitment then the committed bit can already be derived from the inputs of the colluding players and no security is lost.

The direction of the bit commitment is chosen in a way that $`M^c`$ either contains the sender of the bit commitment or it does not contain the receiver of the bit commitment and hence $`M^c`$ is not able to reconstruct a secret bit in the bit commitment protocol.

From Lemma V.1, Lemma VI.3 , and  we get the following result about oblivious transfer.

###### Corollary VI.5.

Let $`P`$ be a set of players for which each pair of players is connected by an authenticated secure channel and every player has access to a broadcast channel. Let $`𝒜`$ be an adversary structure for which no two collusions cover the set $`P`$ of players and let $`M`$ be any maximal set in $`𝒜`$. Then an oblivious transfer is possible between every pair of players which is $`𝒜`$-partially robust and $`\{A^c|A𝒜\}M^c`$-secure.

## VII Robust Protocols for Oblivious Transfer

In this section we will additionally consider players who try to disrupt the bit commitment protocol. In addition to the forms of cheating partially robust protocols can cope with we have that some players can leak out information to players not contained in their collusion or some players can claim that some other players do not follow the protocol or they can themselves refuse to send or to receive messages.

If one looks at a secret sharing scheme step by step the only deviations of the protocol possible, which do not immediately give away the identity of the disruptor, are:

1. Some players might not keep their shares secret.
2. Some players complain that the sender presents different shares in the reconstruction phase then these players originally received.
3. Some players can claim to not receive any proper shares, e. g. empty shares.

This enumeration remains complete even if we consider verifiable secret sharing as we essentially iterate secret sharing together with some local computations (see Subsection II C).

If a disruption yields that the sender and the receiver of a bit commitment are in conflict then we will abort this bit commitment. We will not yet realize bit commitments between players who are in conflict with each other. We will later use multiparty protocols to obtain bit commitment and oblivious transfer between players who are in conflict.

Next we will give a bit commitment scheme based on verifiable secret sharing which can cope with disruption. Shares of complaining players will be published, but we will see that this does not harm the security. Thye number $`k`$ is a security parameter.

Commit via Secret Sharing$`(m)`$

1. Alice shares the secret $`mr`$ with the access structure $`𝒵`$ and sends $`r`$ to Bob.
2. A set $`A`$ complains about the shares they receive. These shares will be published by Alice
3. $`A_{old}:=A`$
4. repeat

1. for $`j=1`$ to $`k`$ do

    1. Alice shares a random secret $`z`$ with the access structure $`𝒵`$.
        2. Bob tells Alice to either open $`z`$ or $`zmr`$.
        3. Alice publishes the shares for $`z`$ or $`zmr`$. A set $`A_j`$ of players complains about these shares.
        4. $`A:=AA_j`$
    2. od
    3. If $`A𝒜`$ then Alice is detected cheating else Alice has to publish the shares for the secret $`mr`$ for all players in $`A`$.
5. until $`A_{old}=A`$.

###### Lemma VII.1.

Let $`P`$ be a set of players and let $`𝒜`$ be an adversary structure for which no two collusions cover the set $`P\{P_i\}`$ for any player $`P_i`$ and let $`M`$ be any maximal set in $`𝒜`$. Then a secret which is shared among the players of $`P`$ according to the above protocol with access structure $`𝒵=\{Z|Z^c𝒜\}`$ remains to be $`\{A^c|A𝒜\}M^c`$-secure even if a collusion of $`𝒜`$ publishes their shares.

###### Proof VII.2.

The security of a bit commitment scheme is only relevant if the sender is honest. So we can assume throughout the proof that the secret is properly shared.

Because no two collusions of $`𝒜`$ cover $`P\{P_i\}`$ every set of the access structure $`𝒵=\{Z|Z^c𝒜\}`$ contains at least two honest players. So even if all players of a collusion $`A𝒜`$ leak their shares the secret remains shared among at least two honest players and no single honest but curious player gets to know a secret.

###### Lemma VII.3.

Let $`P`$ be a set of players for which each pair of players is connected by an authenticated secure channel and every player has access to a broadcast channel. Let $`𝒜`$ be an adversary structure for which no two collusions cover the set $`P\{P_i\}`$ for any player $`P_i`$ and let $`M`$ be any maximal set in $`𝒜`$. Then for every pair of players, who will not be in conflict after the protocol, a bit commitment is possible from one of the players to the other player which is $`𝒜`$-robust and $`\{A^c|A𝒜\}M^c`$-secure.

###### Proof VII.4.

We are proving our claim using the above protocol. Whenever the receiver of the bit commitment complains about the sender then we need not be able to implement a bit commitment hence in the following we analyse only conflicts between the sender of the bit commitment and players other than the receiver.

We consider two cases.

First: Alice is honest, then every complaint about Alice comes from a cheater and Alice publishes the share the cheater complained about. So every complain about an honest Alice is equivalent to a leak of the share of the cheating player and we have seen that this does not harm the security of the secret sharing (Lemma VII.1). The correctness of the secret sharing, which implies the binding property of the bit commitment, cannot be harmed by shares which become publicly known.

Second: Alice is dishonest. Then Bob must be honest or we cannot expect a bit commitment to work. All shares the public ones as well as the only privately known ones pass the verifiable secret sharing test whenever the protocol has terminated and Alice has not been detected cheating. Hence every honest player is convinced that if Bob is honest then the secret is properly shared. This follows directly from the properties of the verifiable secret sharing scheme of  which was sketched in Subsection II C. The security of the protocol is not an issue if Alice is dishonest.

From the same arguments as used in Lemma V.1 it is clear that the above bit commitment can be used to force measurements. As the direction of an oblivious transfer can be inverted  the directions of the bit commitments do not matter any more. Hence we can conclude the following.

###### Corollary VII.5.

Let $`P`$ be a set of players for which each pair of players is connected by a quantum channel and an authenticated insecure channel and every player has access to a broadcast channel. Let $`𝒜`$ be an adversary structure for which no two collusions cover the set $`P\{P_i\}`$ for any player $`P_i`$ and let $`M`$ be any maximal set in $`𝒜`$. Then for every pair of players, who will not be in conflict after the protocol, an oblivious transfer is possible which is $`𝒜`$-robust and $`\{A^c|A𝒜\}M^c`$-secure.

In the next section we will use the oblivious transfer of this corollary to implement multiparty computations.

### A Main Results

This section is separated in two subsections the first considering only partially robust protocols, i. e., protocols which are aborted whenever a conflict occurs and the second subsection deals with robust protocols tolerating every form of cheating and disruption.

### B Partially Robust Protocols

Combining the results of Corollary III.2, Corollary VI.5, and  we get the following result without further proof.

###### Theorem VII.5.

Let $`P`$ be a set of players each having access to a broadcast channel and let every pair of players of $`P`$ be connected by a quantum channel and an insecure but authenticated classical channel. Then $`𝒜`$-partially robust quantum multiparty protocols for all functions exist if and only if no two collusions of $`𝒜`$ cover $`P`$.

These protocols are $`\stackrel{~}{𝒜}`$-secure after termination if and only if the adversary structure $`\stackrel{~}{𝒜}`$ contains at most one complement of a previously chosen set from $`𝒜`$.

Secret sharing need not be efficient, but all other protocols used require only polynomial resources.

###### Corollary VII.6.

If secret sharing can be implemented efficiently for the access structure $`𝒵=\{A^c|A𝒜\}`$ then the protocols of Theorem VII.5 can be efficient.

### C Robust Protocols

To obtain robust protocols we must according to Lemma III.5 choose $`𝒜`$ such that no two possible collusions together contain all but one players. In this situation we can use Lemma II.4 together with Corollary VII.5 and obtain the following result without further proof.

###### Theorem VII.6.

Let $`P`$ be a set of players each having access to a broadcast channel and every pair of players of $`P`$ being connected by a quantum channel and an insecure but authenticated classical channel. Then $`𝒜`$-robust quantum multiparty protocols for all functions exist if and only if no two collusions of $`𝒜`$ cover $`P\{P_i\}`$ for any player $`P_i`$.

These protocols are $`\stackrel{~}{𝒜}`$-secure after termination if and only if the adversary structure $`\stackrel{~}{𝒜}`$ contains at most one complement of a previously chosen set from $`𝒜`$.

If we are interested in robustness after termination and not security after termination we can use the following result from  (for a proof see ).

###### Lemma VII.7.

A multi party protocol which is $`𝒜`$-secure after termination is $``$-robust after termination for $`=\{B|A𝒜:BA\mathrm{and}BA\}`$.

Again we need only polynomial resources if secret sharing is efficient.

###### Corollary VII.8.

If secret sharing can be implemented efficiently for the access structure $`𝒵=\{A^c|A𝒜\}`$ then the protocols of Theorem VII.6 can be efficient.


text:
# Overview: Energy Absorption by Driven Mesoscopic Systems

## Abstract

There are three regimes in the theory of energy absorption: The adiabatic regime, the linear-response (Kubo) regime, and the non-perturbative regime. The mesoscopic Drude formula for electrical conductance, and the wall formula for friction, can be regarded as special cases of the general formulation of the dissipation problem. The overview is based on a research report for 1998-2000.

The wall formula for the calculation of friction in nuclear physics , and the Drude formula for the calculation of conductance in mesoscopic physics, are just two special results of a much more general formulation of ‘dissipation theory’. The general formulation is as follows: Assume a time-dependent chaotic Hamiltonian $`(Q,P;x(t))`$ with $`x(t)=Vt`$. Assume also that $`V`$ is slow in a classical sense. For $`V=0`$ the energy is constant of the motion. For non-zero $`V`$ the energy distribution evolves, and the average energy increases with time. This effect is known as dissipation.

Ohmic dissipation means $`d/dt=\mu V^2`$, where $`\mu `$ is defined as the dissipation coefficient. Ohmic dissipation, with an associated (generalized) Fluctuation-Dissipation relation for the calculation of $`\mu `$, can be established within the framework of classical mechanics  using general classical considerations . See \[P2\] for detailed presentation, and for discussion of validity conditions.

Fig.1. Two examples where the general theory of dissipation can be applied. The left illustration is for the ‘wall formula’, and the right illustration is for the ‘Drude formula’. See text for explanations.

The two leading examples where the above general formulation can be applied are illustrated in Fig.1. In case of the wall formula, $`(Q,P)`$ is a particle moving inside a chaotic ‘cavity’, and $`x`$ controls the deformation of the boundary. Ohmic dissipation (in the sense defined above) implies a friction force which is proportional to the velocity, where $`\mu `$ is the ‘friction coefficient’, and $`\mu V^2`$ is the ‘heating’ rate. In case of the mesoscopic Drude formula, $`(Q,P)`$ is a charged particle moving inside a chaotic ‘ring’, and $`x`$ is the magnetic flux through the hole in the ring. Ohmic dissipation implies Ohm law, where $`V\dot{x}`$ is the electro-motive-force, $`\mu `$ is the conductance, and $`\mu V^2`$ is the ‘heating’ rate.

The rate of energy absorption of driven chaotic cavities has been studied \[P5,P6\] with A. Barnett and E. Heller. For various reasons a satisfactory theory for the frequency dependent dissipation coefficient $`\mu (\omega )`$ has not been introduced in past studies of nuclear friction. It is somewhat surprising that to ‘shake’ a cavity is not an effective way to heat up the ‘gas’ inside it (Fig.2).

Fig.2. Consider a system of non-interacting particles confined inside a chaotic cavity. Assume periodic driving $`x(t)=A\mathrm{sin}(\omega t)`$, where $`x`$ controls the deformation of the boundary. For special type of deformations $`\mu (\omega )`$ vanishes for $`\omega 0`$. A numerical calculation for a stadium shaped cavity is displayed on the right. DI is dilation around the center, while GN is generic deformation. Thick lines are for classical calculation while thin lines are for quantum mechanical (linear response) calculation. Note the remarkable agreement.

A renewed interest in the wall formula is anticipated in the field of mesoscopic physics. Quantum dots can be regarded as small 2D cavities whose shape is controlled by electrical gates. In such case we can use our improved version of the wall formula \[P6\], and incorporate other corrections \[to be published\] that take the nature of the dynamics into account.

Driving a quantum dot by time-dependent magnetic field (Fig.3) is an obvious option. We already have mentioned the ring geometry (Fig.1, right) where the dissipation coefficient $`\mu `$ is just the conductance. However, there is nothing special about ‘rings’. One may consider a simple two dimensional quantum dot driven by a time-dependent homogeneous magnetic field. For the latter geometry it is better not to use the term conductance while referring to $`\mu `$.

Fig.3. We consider non-interacting electrons driven by electro motive force which is induced by a time-dependent magnetic field. Rather than ring geometry (a) we have a chaotic dot (b). The numerical result can be regarded as a mesoscopic version of Drude formula. The log-log inset on the right demonstrates the large frequency $`1/\omega ^2`$ behavior.

It is important to realize that the quantum-mechanical (QM) version of linear response theory (LRT) is in remarkable correspondence with the classical result (see eg Fig.2). One wonders whether QM effects are important. This subject has been addressed in \[P1-P4\]. The main observation is that in the theory of quantum dissipation there are three distinct regimes (Fig.4):

* The QM-adiabatic regime.
* The linear response (Kubo) regime.
* The non-perturbative regime.

Fig.4. This diagram illustrates the various $`V`$ regimes in the theory of quantum dissipation for linear driving $`x(t)=Vt`$. The more complicated diagram for the case of periodic driving is presented in Fig.5 and discussed below.

Past studies of quantum dissipation were focused on the QM-adiabatic regime (extremely slow driving), and have dealt with either the Landau-Zener mechanism  or else with the Debye relaxation absorption mechanism  for dissipation. The appearance of the QM-adiabatic regime is related to the existence of a finite mean level spacing $`\mathrm{\Delta }`$.

The surprising message of \[P1-P4\] is that there is a new regime in the theory of quantum dissipation, where QM LRT fails. This failure is not related to having finite mean level spacing $`\mathrm{\Delta }`$, but rather to having finite bandwidth $`b\times \mathrm{\Delta }`$ of the perturbation matrix. A well known semiclassical relation  relates the bandwidth to the dropoff frequency of the classical $`\mu (\omega )`$. Namely $`b\mathrm{\Delta }=\mathrm{}\omega _{\text{cl}}`$. In the context of mesoscopic physics the bandwidth is known as the Thouless energy. Another observation of \[P1-P3\] is that the semiclassical regime is contained inside the non-perturbative regime.

The various $`(\omega ,A)`$ regimes for periodic driving $`x(t)=A\mathrm{sin}(\omega t)`$ are illustrated in Fig.5. The QM-adiabatic regime (excluding the narrow stripes of resonances) is defined by having vanishing first-order probability to go to other levels. In the LRT regime it is assumed that there is strong response for $`\omega <\omega _{\text{cl}}`$ and vanishingly small response otherwise. Quantal non-perturbative response appears provided the driving amplitude $`A`$ is large enough. The theory has been tested \[P4\] in collaboration with T. Kottos for a RMT model.

Fig.5. Upper: Diagram illustrating the various $`(\omega ,A)`$ regimes in the theory of quantum dissipation for periodic driving. Lower: The results of RMT simulations (Wigner model). The dependence of $`\mu (\omega )`$ on the driving amplitude $`A`$ is displayed. $`\mu =\text{const}`$ behavior is implied by LRT. The observed failure of LRT, and the horizontal scaling with respect to the bandwidth $`b`$, are in accordance with the theoretical expectations.

References:

J. Blocki et all. Ann. Phys. 113, 330 (1978).

M. Wilkinson, J. Phys. A 23, 3603 (1990).

C. Jarzynski, Phys. Rev. E 48, 4340 (1993).

E. Ott, Phys. Rev. Lett. 42, 1628 (1979).

Y. Gefen and D.J. Thouless, Phys. Rev. Lett. 59, 1752 (1987).

M. Wilkinson, J. Phys. A 21, 4021 (1988).

R. Landauer and M. Buttiker, Phys. Rev. Lett. 54, 2049 (1985).

M. Feingold and A. Peres, Phys. Rev. A 34, 591 (1986).

Publications:

D. Cohen, ”Quantum Dissipation due to the interaction with chaotic degrees-of-freedom and the correspondence principle”, Phys. Rev. Lett. 82, 4951 (1999).

D. Cohen, ”Chaos and Energy Spreading for Time-Dependent Hamiltonians, and the various Regimes in the Theory of Quantum Dissipation”, Annals of Physics 283, 175 (2000).

D. Cohen, ”Chaos, Dissipation and Quantal Brownian Motion”, Proceedings of the International School of Physics ‘Enrico Fermi’ Course CXLIII “New Directions in Quantum Chaos”, Edited by G. Casati, I. Guarneri and U. Smilansky, IOS Press, Amsterdam (2000).

D. Cohen and T. Kottos, ”Quantum-mechanical non-perturbative response of Driven Chaotic Mesoscopic Systems, cond-mat/0004022, Phys. Rev. Lett. (2000, in press).

A. Barnett, D. Cohen and E.J. Heller, ”Deformations and dilations of chaotic billiards, rate of dissipations, and quasi-orthogonality of the boundary wavefunctions”, Phys. Rev. Lett. 85, 1412 (2000).

A. Barnett, D. Cohen and E.J. Heller, ”Rate of energy absorption for a driven chaotic cavity”, nlin.CD/0006041, J. Phys. A (2000, to be published).

Preprints and publications are available via
http://monsoon.harvard.edu/$``$doron


text:
# Ginsparg-Wilson relation with 𝑅=(𝑎𝛾₅𝐷)^{2𝑘}

## 1 INTRODUCTION

In general, the Ginsparg-Wilson relation  for a lattice Dirac operator $`D`$ can be written as

$`D\gamma _5f(D)+g(D)\gamma _5D=0,`$ (1)
where $`f`$ and $`g`$ are analytic functions. Then the fermionic action $`𝒜_f=\overline{\psi }D\psi `$ is invariant under the generalized chiral transformation

$`\psi `$ $``$ $`\mathrm{exp}[\gamma _5\theta f(D)]\psi ,`$ (2)
$`\overline{\psi }`$ $``$ $`\overline{\psi }\mathrm{exp}[\theta g(D)\gamma _5],`$ (3)
where $`\theta `$ is a global parameter. In particular, for $`f(D)=\text{1I}aRD`$ and $`g(D)=\text{1I}aDR`$, (1) becomes

$`D\gamma _5+\gamma _5D=aD(R\gamma _5+\gamma _5R)D,`$ (4)
where $`R`$ is any operator. Since $`(R\gamma _5+\gamma _5R)`$ commutes with $`\gamma _5`$, without loss, we can set $`R`$ to commute with $`\gamma _5`$,

$`R\gamma _5=\gamma _5R.`$ (5)
Then (4) becomes the usual form of the GW relation

$`D\gamma _5+\gamma _5D=2aDR\gamma _5D.`$ (6)
In the continuum, the massless Dirac operator $`𝒟=\gamma _\mu (_\mu +iA_\mu )`$ is chirally symmetric and anti-hermitian, i.e.,

$`𝒟\gamma _5+\gamma _5𝒟=0,`$ (7)
$`𝒟^{}=𝒟,`$ (8)
which imply that $`𝒟`$ is $`\gamma _5`$-hermitian, i.e., $`𝒟^{}=\gamma _5𝒟\gamma _5`$.

On the lattice, a lattice Dirac operator $`D`$ cannot satisfy (7) or (8) without losing its other essential properties. However, we can still require $`D`$ to satisfy the $`\gamma _5`$-hermiticity,

$`D^{}=\gamma _5D\gamma _5.`$ (9)
Multiplying $`\gamma _5`$ on both sides of (6), and using (9), we obtain $`D^{}+D=2aD^{}RD`$, which gives $`R^{}=R`$.

Thus we conclude that, in general, $`R`$ is a Hermitian operator commuting with $`\gamma _5`$. From (6), the GW fermion propagator ( in the trivial sector ) satisfies $`D^1\gamma _5+\gamma _5D^1=2aR\gamma _5`$, which immediately suggests that $`R`$ should be as local as possible, i.e., $`R\text{1I}`$. Otherwise, it may cause additive mass renormalization to $`D^1`$, which of course is undesirable. In fact, it has been demonstrated that the most optimal $`R`$ is $`R=r\text{1I}`$ with some constant $`r`$ .

Nevertheless, theoretically, it is rather interesting to consider $`R`$ as a function of $`D`$, and to see how $`D`$ behaves with respect to $`R`$. It turns out that, in general, the independent variable in the functional form of $`R`$ must be $`(a\gamma _5D)^2`$, if $`D`$ is normal and $`\gamma _5`$-hermitian. In particular, for $`R(t)=t^n,n=0,1,\mathrm{}`$, the sequence of topologcially-proper $`D`$ (27) tend to a nonlocal Dirac operator in the limit $`n\mathrm{}`$. This suggests that the locality of a lattice Dirac is irrelevant to its index.

First, recall that for any $`D`$ which is normal ( $`DD^{}=D^{}D`$ ) and $`\gamma _5`$-hermitian, its eigensystem ( $`D\varphi _s=\lambda _s\varphi _s`$ ) has the following properties  :
(i) eigenvalues are either real or come in complex conjugate pairs.
(ii) the chirality ( $`\chi _s=\varphi _s^{}\gamma _5\varphi _s`$ ) of any complex eigenmode is zero.
(iii) each real eigenmode has a definite chirality.
(iv) sum of the chirality of all real eigenmodes is zero ( chirality sum rule ).

Assume that the eigenvalues of $`D`$ lying on a simple closed contour in the complex plane. Then (i) implies that the real eigenvalues of $`D`$ can only occur at two different points, say at zero and $`a^1`$. Then the chirality sum rule reads

$`{\displaystyle \underset{\lambda _s=0,a^1}{}}\varphi _s^{}\gamma _5\varphi _s=0,`$ (10)
which immediately gives

$`n_+n_{}+N_+N_{}=0.`$ (11)
where $`n_\pm `$ denotes the number of zero modes of $`\pm `$ chirality, and $`N_\pm `$ the number of nonzero real ( $`a^1`$ ) eigenmodes of $`\pm `$ chirality. Then we immediately see that any zero mode must be accompanied by a real ( $`a^1`$ ) eigenmode with opposite chirality, and the index of $`D`$ is

$`\text{index}(D)n_{}n_+=(N_{}N_+).`$ (12)
It should be emphasized that the chiral properties (ii), (iii) and the chirality sum rule (11) hold for any normal $`D`$ satisfying the $`\gamma _5`$-hermiticity, as shown in Ref. . However, in nontrivial gauge backgrounds, whether $`D`$ possesses any zero modes or not relies on the topological characteristics  of $`D`$, which cannot be guaranteed by the conditions such as the locality, free of species doublings, correct continuum behavior, $`\gamma _5`$-hermiticity and the GW relation.

Therefore, we must require that $`D`$ is normal and $`\gamma _5`$-hermitian,

$`D^{}D=DD^{},D^{}=\gamma _5D\gamma _5.`$
These two equations immediately give

$`\gamma _5(\gamma _5D)^2=(\gamma _5D)^2\gamma _5.`$ (13)
Thus we have found an example of $`R=(a\gamma _5D)^2`$ which is Hermitian and commutes with $`\gamma _5`$. In general, $`R`$ can be any analytic function of $`(a\gamma _5D)^2`$, i.e.,

$`R=f[(a\gamma _5D)^2],\text{ }f\text{ : analytic function.}`$ (14)
In particular, for $`f(x)=x^n`$, it becomes

$`R=(a\gamma _5D)^{2k},k=0,1,2,\mathrm{}`$ (15)
Substituting (15) into the GW relation (6), we obtain

$`\gamma _5D+D\gamma _5=2aD(a\gamma _5D)^{2k}\gamma _5D,`$ (16)
which is equivalent to Fujikawa’s proposal

$`\gamma _5(\gamma _5D)+(\gamma _5D)\gamma _5=2a^{2k+1}(\gamma _5D)^{2k+2}.`$ (17)
## 2 A CONSTRUCTION OF $`D`$

So far, the only viable way to construct a topologically-proper lattice Dirac operator is the Overlap

$`D={\displaystyle \frac{1}{2a}}(\text{1I}+\gamma _5ϵ),ϵ^2=\text{1I}`$ (18)
which satisfies the GW relation (6) with $`R=1`$. Since $`D`$ (18) is normal and $`\gamma _5`$-hermitian, its eigenmodes satisfy the chiral properties (i)-(iv). There are many different ways to implement the Hermitian $`ϵ`$ in (18). However, it is required to be able to capture the topology of the gauge background. That means, one-half of the difference of the numbers ( $`h_\pm `$ ) of positive ( $`+1`$ ) and negative ( $`1`$ ) eigenvalues of $`ϵ`$ is equal to the background topological charge $`Q`$,

$`{\displaystyle \underset{x}{}}\text{tr}(a\gamma _5D(x,x))={\displaystyle \frac{1}{2}}{\displaystyle \underset{x}{}}\text{tr}(ϵ)={\displaystyle \frac{1}{2}}(h_+h_{})=Q`$
where tr denotes the trace over the Dirac and color space. Otherwise, the axial anomaly of $`D`$ cannot agree with the topological charge density in a nontrivial gauge background.

An explicit realization of $`ϵ`$ in (18) is the Neuberger-Dirac operator  with

$`ϵ={\displaystyle \frac{H_w}{\sqrt{H_w^2}}}`$ (19)
where

$`H_w=\gamma _5(\gamma _\mu t_\mu +Wm_0a^1),0<m_0<2`$ (20)
$`t_\mu (x,y)={\displaystyle \frac{1}{2a}}[U_\mu (x)\delta _{x+\widehat{\mu },y}U_\mu ^{}(y)\delta _{x\widehat{\mu },y}]`$ (21)
$`W(x,y)={\displaystyle \frac{1}{2a}}{\displaystyle \underset{\mu }{}}[2\delta _{x,y}U_\mu (x)\delta _{x+\widehat{\mu },y}U_\mu ^{}(y)\delta _{x\widehat{\mu },y}]`$
To generalize this construction for $`k>0`$, we multiply both sides of the GW relation (6) by $`R`$ and redefine $`D^{}=RD`$, then we have

$`D^{}\gamma _5+\gamma _5D^{}=2D^{}\gamma _5D^{}.`$ (22)
It can be shown that $`D^{}`$ is $`\gamma _5`$-hermitian. Now (22) is in the same form of the GW relation with $`R=1`$. Thus, one can construct $`D^{}`$ in the same way as the Overlap

$`D^{}=RD={\displaystyle \frac{1}{2a}}(\text{1I}+\gamma _5ϵ),ϵ^2=\text{1I},`$ (23)
provided that a proper realization of $`ϵ`$ can be obtained. Using (5), we obtain

$`D^{}=RD=a^1\gamma _5(a\gamma _5D)^{2k+1},`$ (24)
which immediately yields

$`D=a^1\gamma _5(a\gamma _5D^{})^{1/(2k+1)},`$ (25)
where the $`(2k+1)`$-th real root of the Hermitian operator $`(a\gamma _5D^{})`$ is assumed. Then (25) suggests that if the $`ϵ`$ in (23) is expressed in terms of a Hermitian operator $`H`$, i.e., $`ϵ=\frac{H}{\sqrt{H^2}}`$, then $`H`$ is required to behave as $`(\gamma _\mu 𝒟_\mu )^{2k+1}`$ in the continuum limit such that $`D`$ can become $`\gamma _\mu 𝒟_\mu `$ after taking the $`(2k+1)`$-th root in (25). Thus, $`H`$ must contain the term $`(\gamma _\mu t_\mu )^{2k+1}`$, where $`\gamma _\mu t_\mu `$ is the naive lattice fermion operator defined in (21). Then another term must be added in order to remove the species doublers in $`(\gamma _\mu t_\mu )^{2k+1}`$. So, we add the Wilson term to the $`(2k+1)`$-th power, i.e., $`W^{2k+1}`$. Finally, a negative mass term $`\frac{1}{2}a^{(2k+1)}`$ is inserted such that $`ϵ`$ is able to detect the topological charge $`Q`$ of the gauge background, i.e.,

$`{\displaystyle \frac{1}{2}}{\displaystyle \underset{x}{}}\text{tr}\left({\displaystyle \frac{H}{\sqrt{H^2}}}\right)=Q.`$ (26)
Putting all these terms together, we have

$$H=\gamma _5\left[(1)^k(\gamma _\mu t_\mu )^{2k+1}+W^{2k+1}\frac{a^{(2k+1)}}{2}\right]$$

which, at $`k=0`$, reduces to the $`H_w`$ in Eq. (20). Then (25) can be rewritten as

$`D=a^1\left({\displaystyle \frac{1}{2}}\right)^{\frac{1}{(2k+1)}}\gamma _5\left(\gamma _5+{\displaystyle \frac{H}{\sqrt{H^2}}}\right)^{\frac{1}{(2k+1)}}`$ (27)
which agrees with Fujikawa’s construction . Note that (27) can also be written in the form $`D=D_c(\text{1I}+aRD_c)^1`$, where $`D_c`$ is dependent on the order $`k`$. The general properties of $`D`$ have been derived in . In particular, the index of $`D`$ is independent of the order $`k`$, and the eigenvalues of $`D`$ fall on a closed contour with their real parts bounded between zero and $`a^1`$. In Fig. 1, the eigenvalues of $`D`$ are plotted for $`k=0,1,2`$ respectively, with the same background gauge field.

## 3 IN THE LIMIT $`k\mathrm{}`$

One of the salient features of the sequence of topologically-proper Dirac operators (27) is that the amount of chiral symmetry breaking ( i.e., r.h.s. of (6) ) decreases as the order $`k`$ increases. However, at finite lattice spacing, the chiral symmetry breaking of $`D`$ cannot be zero even in the limit $`k\mathrm{}`$, since $`D`$ satisfies the GW relation (6). In the limit $`k\mathrm{}`$, the only possibility for $`D`$ to break the chiral symmetry is that $`D(p)`$ becomes a piecewise continuous function in the Brillouin zone, with discontinuities somewhere at $`|p|a^1`$, and $`\gamma _5D(p)+D(p)\gamma _5=0`$ for $`|p|<a^1`$. Since such a $`D(p)`$ is non-analytic at infinite number of $`p`$, the corresponding $`D(x,y)`$ must be nonlocal in the position space.

If $`D(x,y)`$ is nonlocal in the free fermion limit ( i.e., $`U_\mu (x)1`$ ), then it must be nonlocal in any smooth gauge background. So, it suffices to examine the non-analyticity of $`D(p)`$ in the free fermion limit.

In the free fermion limit, the GW Dirac operator (27) in momentum space can be written as

$`D(p)=D_0(p)+i\gamma _\mu D_\mu (p),`$ (28)
where

$`D_0(p)=a^1\left[{\displaystyle \frac{1}{2}}\left(1+{\displaystyle \frac{u(p)}{N(p)}}\right)\right]^{\frac{k+1}{2k+1}},`$
$`D_\mu (p)=D_0(p)\sqrt{{\displaystyle \frac{1}{a^2t^2(p)}}\left({\displaystyle \frac{N(p)u(p)}{N(p)+u(p)}}\right)}\mathrm{sin}(p_\mu a),`$
$`u(p)=a^{(2k+1)}\left(\left[{\displaystyle \underset{\mu }{}}(1\mathrm{cos}(p_\mu a))\right]^{2k+1}{\displaystyle \frac{1}{2}}\right)`$
$`t^2(p)=a^2{\displaystyle \underset{\mu }{}}\mathrm{sin}^2(p_\mu a),`$
$`N(p)=\sqrt{[t^2(p)]^{2k+1}+[u(p)]^2}.`$
At the zeroth order ( $`k=0`$ ), $`D(p)`$ is analytic in the Brillouin zone. However, in the limit $`k\mathrm{}`$, $`D(p)`$ tends to a nonanalytic function with discontinuities at each point on two concentric hypersurfaces inside the Brillouin zone . In four dimensions, the inscribed hypersurface is specified by the equation

$`{\displaystyle \underset{\mu =1}{\overset{4}{}}}s_\mu ^2=1,`$
while the circumscribing one by

$`6+{\displaystyle \underset{\mu =1}{\overset{4}{}}}c_\mu (c_\mu 4)+{\displaystyle \underset{\mu =1}{\overset{3}{}}}{\displaystyle \underset{\nu >\mu }{\overset{4}{}}}c_\mu c_\nu =0,`$
where $`c_\mu =\mathrm{cos}(p_\mu a)`$ and $`s_\mu =\mathrm{sin}(p_\mu a)`$. This implies that $`D(x,y)`$ is nonlocal in the limit $`k\mathrm{}`$.

On the other hand, $`D(x,y)`$ is local at the zeroth order ( $`k=0`$ ), for gauge backgrounds which are sufficiently smooth at the scale of the lattice spacing . Since the index of $`D`$ (27) is independent of the order $`k`$, this suggests that the locality of a lattice Dirac operator is irrelevant to its index. In other words, if a GW Dirac operator which is $`\gamma _5`$-hermitian, doubler-free, and has correct continuum behavior in the free fermion limit, but always has zero index , then the cause may not be due to its nonlocality.

To summarize, we have provided a nontrivial example of $`D`$ (27), which is topologically-proper but tends to a nonlocal operator in the limit $`k\mathrm{}`$. Unlike the nonlocal and chirally-symmetric Dirac operator

$`D_c=a^1{\displaystyle \frac{\sqrt{H_w^2}+\gamma _5H_w}{\sqrt{H_w^2}\gamma _5H_w}}`$ (29)
which has poles ( i.e., the nonzero real eigenmodes ) for nontrivial background gauge fields ( as a consequence of the chirality sum rule  ), the present example (27) breaks the chiral symmetry according to the GW relation, thus its nonzero real ( $`a^1`$ ) eigenmodes are well-defined for any order $`k`$.


text:
# A Massive Dark Object in the S0 galaxy NGC 4350

## References

Ferrarese, L. & Merritt, D. 2000, ApJ, 539, L9

Fisher, D. 1997, AJ, 113, 950

Gebhardt, K., Bender, R., Bower, G., Dressler, A. et al. 2000, ApJ 539, L13

Ho, L. 1999, in Observational Evidence for the Black Holes in the Universe, Conference held in Calcutta, January 11-17th, 1998, 157

Pignatelli, E. & Galletta, G. 1999, A&A, 349, 369

Pignatelli, E., Salucci, P., Danese, L. 2000, MNRAS, in press (astro-ph/0008429)