# Proton mass decomposition: naturalness and interpretations

Xiangdong Ji<EMAIL_ADDRESS>Center for Nuclear Femtography, SURA,
1201 New York Ave. NW, Washington, DC 20005, USA  Department of Physics,
University of Maryland, College Park, MD 20742, USA

###### Abstract

I discuss the scope and naturalness of the proton mass decomposition (or sum
rule) published in PRL74, 1071 (1995) and answer a few criticisms that
appeared recently in the literature, focusing particularly on its
interpretation and the quantum anomalous energy contribution. I comment on the
so-called frame-independent or invariant-mass decomposition from the trace of
the energy-momentum tensor. I stress the importance of measuring the quantum
anomalous energy through experiments. Finally, I point out a large discrepancy
in the scalar radius of the nucleon extracted from vector-meson productions
and lattice QCD calculations.

##  I introduction

In 1995, I wrote a paper that discussed for the first time a proton mass
decomposition (or sum rule) in quantum chromodynamics (QCD) Ji (1995a). The
goal was to express the proton mass, or that of any other hadron, in terms of
quark and gluon energies corresponding to the matrix elements measurable in
experiments, in Einstein’s spirit that inertial mass is a store of energy
Hecht (2011). It received relatively little attention in the community for
more than 20 years. Recently, understanding the proton mass has become an
important topic in hadronic physics, particularly in light of new experiments
at Jefferson Lab 12 GeV facility and future Electron-Ion Collider Dudek  _et
al._ (2012); Accardi  _et al._ (2016). Three workshops have been organized by
a group of mass enthusiasts on this topic Mez (2021). In the process of
understanding better about the proton mass structure and its experimental
verification, a number of questions concerning the naturalness and
interpretations of my decomposition have emerged. The apparent discrepancies
claimed in the literature have been reduced to the question whether the
anomalous contribution to the nucleon mass is an unambiguously defined
physical quantity which can be calculated on the lattice and ultimately be
determined experimentally. Following and expanding the arguments given in Ji
(1995a), I will stress that the answer is affirmative. In doing so I will
discuss in detail alternative proposals and will explain why I do not think
that they are helpful to better understand the relevant physics.

In section II, I review the original derivation, emphasizing the key point
that mass is the rest energy and there exists a complete energy basis to
express the mass in QCD. In section III, I discuss why there is a quantum
anomalous energy contribution and comment on its natural appearance in QCD
Hamiltonian through time dilatation. In Section IV, I consider a well-known
relation involving the matrix element of the trace of the QCD energy-momentum
tensor, arguing it is not a natural frame-independent mass decomposition, but
rather about scale symmetry breaking effects. In section V, I discuss the so-
called “pressure contribution” to the mass sum rule and argue that it is based
on a questionable picture. Consideration of such an effect contradicts the
well-known concept of the quark mass contribution to the proton mass. In Sec.
VI, I make some comments about the heavy quark contribution and the structure
of the pion mass. In Sec. VII, I discuss the mass distribution recently
emphasized by Kharzeev Kharzeev (2021), pointing out the difference between
scalar and mass radii. Finally, I conclude in Sec. VIII.

##  II Original derivation: symmetry and complete energy basis

While mass is a frame-independent concept, to calculate the mass for a
composite system like the proton, it is best to take the working definition as
the energy in the rest frame Okun (1989). If one chooses a general frame, the
energy will contains both the mass effect and kinetic energy, and one has to
find ways to subtract the latter to obtain the pure mass. Such a subtraction
is neither illuminating nor fun, and hardly produce any additional insight
about the nature of mass. See Sec. IV for more discussion.

Therefore, the starting point of Ref. Ji (1995a) is simply to write the rest-
frame energy of the proton in terms of quark and gluon energies. One can of
course work out the QCD Hamiltonian from the action and examine all the terms
one gets, and ponder what they mean in terms of quarks and gluons. However,
Ref. Ji (1995a) classifies the operators in terms of Lorentz symmetry, a
tensor method that has been universally used in field theories (see for
example Ref. Buchalla  _et al._ (1996) to study the Hamiltonian for weak decay
where flavor symmetry is the key), similar to the Wigner-Eckart theorem in
quantum mechanics. Symmetry maximally protects physics interpretations of
individual parts because ultra-violet (UV) divergences introduce the scheme
and scale dependence and make the physical meaning of a decomposition not as
clear-cut as in classical physics. In fact, the result of Ref. Ji (1995a)
shows that the QCD Hamiltonian contains four independent terms with three
combinations scheme independent, and hence genuinely physical: They are the
quark mass, anomalous energy and total tensor contributions.

Here is a simple review of the derivation: The QCD energy-momentum tensor
(EMT) is the conserved currents associated with the space-time translational
symmetry from Noether’s theorem. It is a rank-2 tensor $T^{\alpha\beta}(x)$
and the conservation law requires

$\partial_{\alpha}T^{\alpha\beta}(x)=0\ .$ (1)

Furthermore, it can be improved by the Belinfante-Rosenfeld process, and hence
the EMT can also be assumed to be symmetric. A symmetric rank-2 tensor can in
general be uniquely decomposed as

$\begin{split}T^{\alpha\beta}(x)=&\bar{T}^{\alpha\beta}(x)+\hat{T}^{\alpha\beta}(x)\
,\\\ \end{split}$ (2)

with

$\hat{T}^{\alpha\beta}(x)\equiv\frac{1}{4}g^{\alpha\beta}T^{\rho}_{\rho}(x)\
.$ (3)

The trace-less part $\bar{T}^{\alpha\beta}(x)$ and the trace part
$\hat{T}^{\alpha\beta}(x)$ correspond to irreducible spin-2 and spin-0
representations of Lorentz group, respectively. They have different Lorentz
transformation and renormalization properties. The traceless part of the EMT
in massless QCD (we ignore the quark masses here for simplicity, but will
return to them later) can be written as

$\bar{T}^{\alpha\beta}(x)=\bar{T}_{q}^{\alpha\beta}(x,\mu)+\bar{T}_{g}^{\alpha\beta}(x,\mu)\
,$ (4)

where we can express either in terms of the un-renormalized or renormalized
traceless quark and gluon tensors with $\mu$ indicating renormalization scheme
and scale dependence (remembering the well-known twist-2 operators entering
deep-inelastic scattering cross section Peskin and Schroeder (1995)),

$\displaystyle\bar{T}_{q}^{\alpha\beta}(\mu)$
$\displaystyle\equiv\left(\bar{\psi}\gamma^{(\alpha}i\overleftrightarrow{D}^{\beta)}\psi\right)_{\rm{R}}(\mu)\
,$ (5) $\displaystyle\bar{T}_{g}^{\alpha\beta}(\mu)$
$\displaystyle\equiv\left(-F^{\alpha\rho}F^{\beta}_{\;\;\rho}+\frac{1}{4}g^{\alpha\beta}F^{2}\right)_{\rm{R}}(\mu)\
,$ (6)

with $()$ symmetrizing all the indices,
$\overrightarrow{D}^{\mu}=\overrightarrow{\partial}^{\mu}-igA^{\mu}$,
$\overleftarrow{D}^{\mu}=\overleftarrow{\partial}^{\mu}+igA^{\mu}$ and
$\overleftrightarrow{D}^{\mu}=1/2(\overrightarrow{D}^{\mu}-\overleftarrow{D}^{\mu})$.
The $x$ dependence is suppressed hereafter. Then the total QCD EMT can be
decomposed as

$T^{\mu\nu}=\bar{T}_{q}^{\mu\nu}(\mu)+\bar{T}_{g}^{\mu\nu}(\mu)+\hat{T}^{\mu\nu}\
.$ (7)

where the trace term is scheme and scale independent as the whole EMT is.

The matrix elements of above operators are constrained by their Lorentz
transformation properties, for instance for the total QCD EMT

$\left<P\left|T^{\mu\nu}\right|P\right>=2P^{\mu}P^{\nu}\ ,$ (8)

where the covariant normalization $\langle P|P\rangle=2E\delta^{3}(0)$ is
used, differing from the original paper by $1/2M$ with $M$ as the proton mass.
For the quark and gluon trace-less EMT

$\left<P\left|\bar{T}^{\mu\nu}_{q,g}\right|P\right>=2\left<x_{q,g}\right>\left(P^{\mu}P^{\nu}-\frac{1}{4}g^{\mu\nu}M^{2}\right)\
,$ (9)

with $\left<x_{q,g}\right>$ can be measured as the momentum fractions carried
by quarks and gluons in the infinite momentum frame and satisfy the momentum
sum rule,

$\left<x_{q}\right>(\mu)+\left<x_{g}\right>(\mu)=1\ .$ (10)

On the other hand, the trace part of the EMT satisfies

$\left<P\left|\hat{T}^{\mu\nu}\right|P\right>=\frac{1}{2}g^{\mu\nu}M^{2}\ .$
(11)

which is nothing but the well-known trace relation Shifman  _et al._ (1978),

$\langle P|T^{\alpha}_{\alpha}|P\rangle=2M^{2}\ ,$ (12)

directly from Eq. (8).

To relate the EMT decomposition to the mass sum rule, consider the Hamiltonian
$H$ that gives the energy of states, which can be expressed as the charge of
the conserved EMT as

$\begin{split}H_{\rm QCD}&\equiv\int\text{d}^{3}\vec{x}~{}T^{00}(\vec{x},t=0)\
,\end{split}$ (13)

where $t=0$ will be suppressed. Then the mass of the nucleon is simply the
energy in the rest frame

$M\equiv\left<\vec{P}=0\left|H\right|\vec{P}=0\right>/\left<\vec{P}=0|\vec{P}=0\right>\
.$ (14)

The expression on the right hand side will be denoted as $\left<H\right>$.
Using eq. (7), it then becomes

$M=\int\text{d}^{3}\vec{x}\left<\bar{T}_{q}^{00}(\mu)+\bar{T}_{g}^{00}(\mu)+\hat{T}^{00}\right>\
.$ (15)

Defines the decomposition of Hamiltonian as:

$\begin{split}H_{q}(\mu)&\equiv\int\text{d}^{3}\vec{x}~{}\bar{T}^{00}_{q}(\vec{x},\mu)\
,\\\
&=i\int\text{d}^{3}\vec{x}\left(\bar{\psi}\vec{\gamma}\cdot\overleftrightarrow{\vec{D}}\psi\right)_{\rm{R}}(\vec{x},\mu)\
,\end{split}$ (16)
$\begin{split}H_{g}(\mu)&\equiv\int\text{d}^{3}\vec{x}~{}\bar{T}^{00}_{g}(\vec{x},\mu)\
,\\\
&=\frac{1}{2}\int\text{d}^{3}\vec{x}\left(\vec{E}^{2}+\vec{B}^{2}\right)_{\rm{R}}(\vec{x},\mu)\
,\end{split}$ (17)

and Collins  _et al._ (1977); Nielsen (1977)

$\begin{split}H_{a}&\equiv\int\text{d}^{3}\vec{x}~{}\hat{T}^{00}(\vec{x})\
,\\\
&=\frac{\beta(g)}{8g(\mu)}\int\text{d}^{3}\vec{x}\left(F^{\alpha\beta}F_{\alpha\beta}\right)_{\rm{R}}(\vec{x})\
,\end{split}$ (18)

which is scale-independent and generates the quantum anomalous energy (QAE).
The total Hamiltonian is

$\begin{split}H_{\rm QCD}=H_{q}(\mu)+H_{g}(\mu)+H_{a}\ .\end{split}$ (19)

The scale dependence in $H_{q}$ and $H_{g}$ cancels.

With the matrix elements in eq. (9) and eq. (11), the mass can be written with

$\begin{split}M_{q}(\mu)\equiv\left<H_{q}(\mu)\right>=\frac{3}{4}M\left<x_{q}\right>(\mu)\
,\end{split}$ (20)
$\begin{split}M_{g}(\mu)\equiv\left<H_{g}(\mu)\right>=\frac{3}{4}M\left<x_{g}\right>(\mu)\
,\end{split}$ (21)

and

$\begin{split}M_{a}\equiv\left<H_{a}\right>=\frac{1}{4}M\ .\end{split}$ (22)

Then the total mass can be written as a sum of three terms

$\displaystyle M$ $\displaystyle=$ $\displaystyle M_{q}+M_{g}+M_{a}$ (23)
$\displaystyle=$
$\displaystyle\frac{3}{4}M\left<x_{q}\right>(\mu)+\frac{3}{4}M\left<x_{g}\right>(\mu)+\frac{1}{4}M\
.$

If the quark masses are non-zero, one ends up with a decomposition with four
terms, each of which are related to experimental observables and calculable in
lattice QCD Chen  _et al._ (2006); Abdel-Rehim  _et al._ (2016); Alexandrou
_et al._ (2017); Yang  _et al._ (2018); He  _et al._ (2021). The largest error
comes from the anomalous energy calculation He  _et al._ (2021), and the
state-of-art verification of the above sum rule is at 10% level. A discussion
of the relevant physics has been made recently in instanton vacuum picture in
which the anomalous energy is related to the compressiblity of the instantons
Zahed (2021). While the $M_{q}(\mu)$ and $M_{g}(\mu)$ can be measured in deep
inelastic scattering, $M_{a}$ is related to the matrix element of $F^{2}$ in
the proton which can be potentially probed through a color dipole in
experiments such as threshold $J/\psi$ photo or electro production Kharzeev
_et al._ (1999); Hatta and Yang (2018); Mamo and Zahed (2020); Wang  _et al._
(2020); Boussarie and Hatta (2020); Meziani and Joosten (2020). The form
factor of the anomalous energy can also be measured through deeply virtual
Compton scattering.

##  III Quantum anomalous energy contribution

It must be a bit surprising to notice for the first time that there is a new
source of energy coming from the quantum trace anomaly in field theories
Collins  _et al._ (1977); Nielsen (1977). After all, the energy sources in QCD
are the same as those in quantum electrodynamics (QED): there is an energy
from electromagnetic fields similar to what’s in Eq. (17) from the traceless
EMT. The electron’s kinetic energy is also well-known through solving
relativistic Dirac equation in an external Coulomb field in advanced quantum
mechanics. The electron’s mass contribution to energy is associated with the
scalar density $\bar{\psi}\psi$ which becomes the number of electrons in non-
relativistic limit. All these exist in classical electromagnetism. On the
other hand, the quantum anomalous energy (QAE) is a new source which exists
only in quantum theory of fields, and hardly has been discussed in the
literature in the past. It arises from the breaking of scale symmetry due to
UV divergences in quantum field theories.

One could argue the derivation of the previous section is mathematically
correct, and so QAE must be there. Or, the QCD Hamiltonian along with its
various energy sources is completely determined once the action is known, and
one just need to go through the renormalization and show that it is present.
However, there is a physically more enlightening way to reveal its existence
Ji and Liu (2021).

Once there is an action in space and time, the conserved energy is associated
with its time-translation symmetry. One can actually derive the Hamiltonian as
the response of the action under a time-dependent translation, $t\rightarrow
t+\delta\lambda t$, which amounts a re-scaling in time Di Francesco  _et al._
(1997),

$S\rightarrow S+\delta\lambda\int dtH\ .$ (24)

For example, for the pure gauge theory, in terms of the time re-scaled field
variables
$A_{\mu}^{\prime}(t^{\prime},\vec{x})=A_{\mu}(t,\vec{x})(1+\delta^{\mu
0}\delta\lambda)$, the action transforms to

$\displaystyle S^{\prime}=\frac{1}{2g_{0}^{2}}\int
d^{4}x^{\prime}\bigg{(}-\frac{1}{1+\delta\lambda}({\vec{B}}^{\prime})^{2}+(1+\delta\lambda)(\vec{E}^{\prime})^{2}\bigg{)}\
,$ (25)

where $g_{0}$ is the bare coupling. The contribution at order $\delta\lambda$
is nothing but the well-known canonical Hamiltonian in Eq. (17).

However, in quantum theory, one needs a regulator to regularize the UV
divergences, resulting in the scale dependence or running of the couplings. In
a class of regulators which break the time-scaling symmetry such as the
lattice cutoff, the running of couplings can be induced through such a
breaking. Then a new and anomalous contribution to the Hamiltonian appears
naturally, although the anomaly itself is regulator independent. With such a
regulator, $g_{0}$ in Eq. (25) depends on $\delta\lambda$ Karsch (1982), the
new term in the Hamiltonian corresponds to the derivative of $g_{0}$ with
respect to $\delta\lambda$ Rothe (1995),

$\displaystyle H_{a}=\frac{1}{4}\int
d^{3}\vec{x}\frac{\beta(g_{0})}{2g_{0}}F^{2}\ ,$ (26)

which reflects the logarithmic running of couplings $g_{0}$ with the UV cut-
off scale through the beta function $\beta(g_{0})$. If quarks have masses,
there is also a term with the mass anomalous dimension $\gamma_{m}$. The above
agrees with Ref. Ji (1995a) where this term is derived from the trace anomaly.
In regulators which do not break time-translation symmetry such as dimensional
regularization, the anomaly term is hidden in the classical form of the
Hamiltonian.

Therefore, QED does have an anomalous term in the Hamiltonian Ji and Lu
(1998). Since the covariant field theory formulation does not involve
identifying the Hamiltonian, the role of the anomalous energy is implicit.
However, the QAE contribution to the Lamb shift in the hydrogen atom has been
calculated recently Sun  _et al._ (2020); Ji and Liu (2021).

The Hamiltonian in Ref. Metz  _et al._ (2020) does not contain the explicit
anomalous term due to the use of dimensional regularization (see Eq. (53-56)).
However, it is not absent but hidden in Eq. (55). Their definition of the
renormalized $\int d^{3}x(E^{2}+B^{2})_{R}$ is from the full gluon EMT which
contains the trace anomaly in quantum theory. If one uses the trace-less EMT
to define the gluon energy as in the classical case Luke  _et al._ (1992); Ji
(1995a); Kharzeev (1996), the anomaly term in their Hamiltonian becomes
obvious. As a further confirmation of the anomaly in Ref. Metz  _et al._
(2020), the matrix element of Eq. (55) is in Eq. (76) which contains the $1-b$
from the anomaly ($x=0$ and $y=\gamma_{m}$), after implementing Eq. (69). The
sum of three contributions in Ref. Metz  _et al._ (2020) exactly reproduces
the full result in Ref.Ji (1995a).

As explained in Ref.Ji and Liu (2021); Ji (1995a), the anomaly contribution is
scale independent in chiral limit, and contains the key information about the
scale generation of the proton mass, reflected through a Higgs-like mechanism.
As is manifest in Eq. (69), it has the same role in providing an independent
scale to the proton mass as the quark masses, which have been recognized and
explicitly separated in Eq. (54) of Ref. Metz  _et al._ (2020). In the
instanton liquid picture of the QCD vacuum Shuryak (1999), the QAE is related
to the QCD vacuum compressibility Zahed (2021); in the MIT bag model, it is
related to the scalar energy density or the bag constant inside the nucleon
Chodos  _et al._ (1974). Combining the novel QAE contribution to the proton
mass together with the ordinary $\int d^{3}x(E^{2}+B^{2})_{R}$ contribution,
which is measurable by a different experiment and is scheme dependent due to
mixing with quarks, likely misses the fundamental insight on the origin of the
proton mass. See further comments in Sec. V.

##  IV Toward Lorentz-invariant mass decomposition

Since mass is a scalar, a frame-independent understanding might be more
fundamental Roberts and Mezrag (2017). However, this appears misleading. For a
massive particle, even for a pseudo Goldstone boson like pion, the rest frame
is special, where all energies are internal. When the particle moves, it has
kinetic energy, $K=E-m/c^{2}$ (take $c=1$). The relation
$m^{2}=(K+m)^{2}-P^{2}$ ensures the mechanical energy is properly subtracted
so that only the internal energy as mass is left. In this view, a frame-
independent concept of mass only implies a proper subtraction procedure for
the kinetic contribution, and does not necessarily provide a better insight.
Nonetheless, it is worth to investigate if a frame-independent subtraction can
be made and, at the same time, any additional feature can be learned along the
way.

A natural starting point is the QCD mass Casimir $\hat{P}^{\mu}\hat{P}_{\mu}$
(from now on I use an hat on a symbol to denote an operator, and that without
is an eigenvalue). Take its expectation value in the nucleon state as the
definition of frame-independent mass,

$M^{2}=\frac{\langle P|\hat{P}^{\mu}\hat{P}_{\mu}|P\rangle}{\langle
P|P\rangle}\ .$ (27)

Note that this expression is independent of the state normalization. Some
insight on the invariant mass may be gleaned from studying the general
operator structure of the Casimir. One can proceed by expressing one or both
$\hat{P}_{\mu}$ as quark and gluon operators: if one replaces both operators
by kinetic eigenvalues, one ends up with a totality. On the other hand, if
both $\hat{P}^{\mu}$ remain as dynamical operators, one ends up with a very
complicated expression which may not be very illuminating. No one has gone
down this path in the literature.

A more interesting approach is to replace one of $\hat{P}^{\mu}$ as kinetic
eigenvalue and expand the other as dynamical operator. This is attractive
because in the rest frame, it naturally reduces to the matrix element of the
QCD Hamiltonian as in Sec. II. In the general frame, one has the matrix
element of a linear combination of the Hamiltonian and momentum operators,

$M=\langle\gamma(H-\vec{\beta}\cdot\vec{P})\rangle\ ,$ (28)

where $\gamma,\vec{\beta}$ are Lorentz-boost factors. The linear combination
above is just the Lorentz transformation of the Hamiltonian operator in the
nucleon’s rest frame. One can use the tensor decomposition as in Sec. II to
write it in terms of three different contributions (again ignore the quark
mass),

$M=\langle\gamma(H_{q}-\vec{\beta}\cdot\vec{P_{q}})\rangle+\langle\gamma(H_{g}-\vec{\beta}\cdot\vec{P_{g}})\rangle+\gamma\langle
H_{a}\rangle$ (29)

The combination $\gamma H_{q}-\vec{\beta}\cdot\vec{P_{q}}$ gives a
contribution independent of frame,

$\displaystyle\langle\gamma(H_{q}-\vec{\beta}\cdot\vec{P_{q}})\rangle$
$\displaystyle=$ $\displaystyle\langle
x\rangle_{q}M\left[\gamma(\gamma-1/(4\gamma))-\gamma^{2}\beta^{2}\right]$ (30)
$\displaystyle=$ $\displaystyle\frac{3}{4}\langle x\rangle_{q}M$

It shall be remarked that the classical electromagnetic field contribution to
the electron mass obeys exactly this 3/4 rule under Lorentz transformation
Feynman  _et al._ (1963). On the other hand, $\gamma\langle H_{a}\rangle$ is a
scalar and contribute $M/4$. Therefore the decomposition in Sec. II has a
Lorentz-invariant interpretation. In the infinite momentum frame, Eq. (28)
reduces to the light-front Hamiltonian $P^{-}$ plus a kinetically-suppressed
$P^{+}$ term. The decomposition of light-front energy $P^{-}$ in terms of
twist-four operators have been studied in Ji (2020); Hatta and Zhao (2020).
The fact that the infinite momentum frame mass contains both kinematic and
dynamic contributions is similar to the proton’s transverse spin which
contains both twist-2 and twist-3 sum rules Guo  _et al._ (2021).

In the literature, it has often been stated that there is a frame-independent
mass sum rule

$2M^{2}=\left\langle
P\left|(1+\gamma_{m})m\bar{\psi}\psi+\frac{\beta(g)}{2g}F^{2}\right|P\right\rangle\
,$ (31)

which is Eq. (12) except with the explicit trace operator Shifman  _et al._
(1978). The operator is a scalar and here the state is normalized covariantly
$\langle P|P\rangle=2E(2\pi)^{3}\delta^{3}(0)$. However, as I argue, one
cannot find a natural connection between the above equation and the invariant
mass operator in Eq. (27). I will try to go through the derivation below, but
there a number of arbitrary steps in the middle, and hence one cannot claim
that it provides a natural insight about the nucleon mass, other than that it
provides one of many qualities involving the mass.

To derive Eq. (31) from the mass operator, one first splits up the energy from
the momentum,

$M^{2}=\langle\hat{H}^{2}\rangle-\langle\hat{P}^{2}_{i}\rangle\ ,$ (32)

where $\langle...\rangle$ is a short hand with normalization factor in the
denominator taken into account. One can replace one of $\hat{H}$ by its
eigenenvalue $E$, and keep the other as operator expressed in term of $T^{00}$

$\displaystyle\langle H^{2}\rangle$ $\displaystyle=$ $\displaystyle
E\left\langle\int d^{3}xT^{00}\right\rangle$ (33) $\displaystyle=$
$\displaystyle EV\langle T^{00}\rangle$ $\displaystyle=$ $\displaystyle\langle
P|T^{00}|P\rangle/2\ ,$

where $V=(2\pi)^{3}\delta^{3}(0)$ and in the final line the state is
normalized covariantly.

Now in order to get a trace as in Eq. (31), one cannot substitute the QCD
operator for $\hat{P}_{i}$ directly in there, because it is directly related
to $\hat{T}^{0i}$ not $\hat{T}^{ii}$. Therefore, one has to first replace
$\hat{P}^{i}$ by its eigenvalue, and then replace the eigenvalue by another
matrix element through the $(ii)$ component of Eq. (8),

$2(P_{i})^{2}=\langle P|T^{ii}|P\rangle\ .$ (34)

These substitutions are mathematically correct but do not make a lot of sense
in physics. It certainly is not an explanation what the momentum is. Combining
Eqs. (33) and (34), one gets Eq. (31). Since the above derivation involves
arbitrary steps, the result is hardly an explanation what the invariant mass
is.

My view is that the above equation simply expresses a relationship. One can
derive other similar relations, such as

$M=\frac{4}{3}\left(M_{q}(\mu)+M_{g}(\mu)\right)\ .$ (35)

These relations do not provide a direct explanation on the nature of mass as
the sum of all parts. In fact there is something unusual about Eq. (31): an
explanation of mass depends on the normalization of a state. If one uses a
different normalization, the relation changes and then one needs to
explanation why there is an extra factor. One of course can argue that the
covariance fixed the factor of $E$, but still one could have an arbitrary
numerical factor and then one has to carefully fixed the factor through energy
conservation in the original equation.

Eq. (31), however, is useful in two senses. First of all, it expresses a
relation between mass-squared and the matrix element of scale symmetry
breaking terms. In the chiral limit, there is only one scalar, $F^{2}$, that
breaks the scale symmetry and sets the scale of QCD. Then the equation
expresses the fact that QCD relates all dimensional quantities to this scale.
The nucleon mass is non-vanishing because of the presence of this symmetry
breaking term. Like the spectrum of hydrogen atoms, as well as chemical and
biological energies, all are proportional to the mass of the electron. If the
electron mass were to vanish, all these energies vanish. But the electron mass
does not give an explanation why the hydrogen spectrum is the way it is. It is
the proportional coefficient that is controlled by the underlying physics.
When the quarks are massive, there is an additional scale breaking term
$m\bar{\psi}\psi$. The relative magnitudes of the quark mass and anomaly terms
are fixed through their importance as the scale-symmetry breaking sources in a
hadron.

Quantitatively, Eq. (31) express the proton mass entirely in terms of the
scalar energy. The nucleon mass contains both scalar and tensor energies,
$M=E_{T}+E_{S}$ Ji and Liu (2021). Using a virial theorem $E_{T}=3E_{S}$, one
can replace the tensor energy in favor of the scalar one, resulting

$M=4E_{S}\ ,$ (36)

where $E_{S}$ is the scalar energy including the quark masses and is frame
independent. As in a harmonic oscillator where $E=T+V$, $\langle
T\rangle=\langle V\rangle$, the meaning of the above equation or Eq. (31), is
the similar to equations $\langle E\rangle=2\langle T\rangle$ or $\langle
E\rangle=2\langle V\rangle$ for the oscillator.

Therefore, Eq. (31) is neither a frame-independent explanation of the proton
mass, nor a mass sum rule because the individual terms cannot be identified
properly as the proper components of the mass. Nonetheless, it is an
interesting and useful relation.

Finally, it has been suggested that the anomaly in $T^{\mu}_{\mu}$ can be
split into contributions from the quark and gluon parts of the EMT separately
Hatta  _et al._ (2018); Tanaka (2019). This splitting is scheme dependent:
even in the context of dimensional regularization, it depends on if the
separate trace obtained from the unrenormalized EMT or the renormalized
version although the sum is the same. Physical meaning of the separation,
including the martix elements and contributions to the mass, is unclear as
both parts depend on the same set of renormalized operators.

##  V Pressure Effect in Proton Mass?

As explained in Sec. II, the goal of Ref. Ji (1995a) was modest: identifying
distinct and complete energy operators in the QCD Hamiltonian, and relate
their contributions to the proton mass to experimental observables. I did not
try to come up with a model or a picture for these independent contributions
other than to take at face value of the operator structures. Because the
nucleon wave function is complicated and unknown, any attempt for a serious
interpretation of the expectation values must deem incomplete. However, the
decomposition is solid in QCD, as there are no superfluous operators present.
Moreover, there are many ways to arrive at the same result, although the
tensor decomposition is the quickest.

In Ref. Lorcé (2018), the author appears to misunderstand the intent and
content of Ref. Ji (1995a), claiming that the “the pressure effects” have been
overlooked. The author advocated “a semi-classical picture”, “an effective
two-fluid picture…described in terms of their own energy‘ densities and
pressures”, arriving at a surprising conclusion that “the so-called quark mass
and trace anomaly contributions (to mass) appear to be purely conventional.”

There is a large gap between the expectation value of the Hamiltonian in the
ground state of a quantum many-body system and a fluid model. In the former
case, it is a result involving complicated quantum wave function which
entangles all degrees of freedom. In the latter, the energy-momentum tensor is
used as dynamical variables of the system after certain local averages can be
meaningfully made. For example, in the classical textbooks of Landau Landau
and Lifshitz (1984), conditions have been explicitly stated for an effective
description in terms of pressure and internal energy. One of those is that the
particle’s mean free path must be much smaller than volume elements which are
taken as fundamental degrees of freedom. In QCD, only at high-temperature and
density, a fluid description of the combined quark and gluon plasma might make
sense Shuryak (2017).

Physics models aside, what Ref. Lorcé (2018) actually criticised is the tensor
decomposition shown in Sec.II. The author compared the expectation value of
$\langle P|T^{\mu\nu}|P\rangle$ with the EMT of a perfect fluid, and
identified the contribution of $T^{ii}$ as “mechanical pressure”. Therefore
the author concluded that tensor decomposition mixes in the pressure
contribution in internal energy. Considering the $T^{00}$ operator, and if one
makes a traceless and traceful separation, one writes

$T^{00}=\frac{1}{4}\left(3T^{00}+T^{ii}\right)+\frac{1}{4}\left(T^{00}-T^{ii}\right)\
.$ (37)

In this equation, it appears that one artificially introduces the stress
tensor operator $T^{ij}$, which would smirch the physics interpretation of two
separate terms, as $T^{ii}$ does not seem to have to do with the “internal
energy” of the system.

While such criticism might be true in general, it cannot be lodged against an
analysis at a fundamental level. First of all, the tensor decomposition does
not introduce any new operator structures. It is simply a method to group the
terms already present in the Hamiltonian. Endowing the quantum operators in a
field theory with the meanings of physical observables in a thermal system
generates exotic interpretations: For instance, the energy momentum tensor of
the quarks is $T^{\mu\nu}=\bar{\psi}\gamma^{\mu}iD^{\nu}\psi$. Following Ref.
Lorcé (2018), Dirac equation

$i(\gamma^{0}D^{0}-\gamma^{i}D^{i}-m)\psi=0\ ,$ (38)

shall be interpreted as “internal-energy/pressure” balance equation, with the
mass term as the residue. Moreover, in the relativistic Hamiltonian

$H=\psi^{\dagger}(i\vec{\alpha}\cdot\vec{D}+m\beta)\psi\ ,$ (39)

the kinetic energy comes from the pure “pressure”! Unfortunately, these
interpretations hardly bring in any new insight: “pressure” and “internal
energy” add no additional physical significance at the fundamental level.

Adopting the logic of Ref. Lorcé (2018), one can only talk about the separate
quark and gluon “internal energy” contributions to mass without scalar and
tensor separation, $M=U_{q}+U_{g}$. According to Eq. (57-60), the author
suggested that only the following combinations have no “pressure effect”,

$\displaystyle U_{q}$ $\displaystyle=$ $\displaystyle\langle
H_{q}\rangle=M_{q}+M_{m}=A_{q}(0)+\bar{C}_{q}(0)$ (40) $\displaystyle=$
$\displaystyle\left[\frac{3}{4}A_{q}(0)+\left(\frac{1}{4}A_{q}(0)+\bar{C}_{q}(0)\right)\right]M\
,$ $\displaystyle U_{g}$ $\displaystyle=$ $\displaystyle\langle
H_{g}\rangle=M_{g}+M_{a}=A_{g}(0)+\bar{C}_{g}(0)$ (41) $\displaystyle=$
$\displaystyle\left[\frac{3}{4}A_{g}(0)+\left(\frac{1}{4}A_{g}(0)+\bar{C}_{g}(0)\right)\right]M\
,$

where $A_{q,g}(t)$ and $\bar{C}_{q,g}(t)$ are form factors defined in Ref. Ji
(1997). In the second lines of the above equations, we have shown the trace-
less and trace separation. It is unclear what new insight can be brought to
the understanding of the proton mass through the process of regrouping if any.
To the contrary, this rearrangement stands to lose much:

  * •

The decomposition of the mass in $U_{q}(\mu)$ and $U_{g}(\mu)$ is less
physical due to complicated scheme dependence. In fact, according to Ref.
Hatta  _et al._ (2018), $\bar{C}_{q}(\mu)$ and $\bar{C}_{g}(\mu)$ can have
additional scheme dependence, and they mixes among themselves, rendering
interpretation of $U_{q}$ and $U_{g}$ less straightforward.

  * •

One can no longer isolate the quark mass contribution to the proton mass,
which is scale invariant and has been studied for many decades in chiral
perturbation theory Gasser and Leutwyler (1985). It can also be measured
through experiments and calculable through lattice QCD Yang  _et al._ (2018);
Alexandrou  _et al._ (2020).

  * •

One can no longer isolate the anomaly contribution to the proton mass which is
a result of scale symmetry breaking due to UV fluctuations. It is scale
invariant and can be measured experimentally and calculable independently on
the lattice He  _et al._ (2021). The quark mass and quantum anomalous energy
have the same status according to Eq.(31).

Therefore, while the four term decomposition in Sec. II tells us a lot about
the proton mass structure, the suggestion made in Ref. Lorcé (2018) lead to
the unfortunate conclusion that the scale and scheme independent quark mass
and quantum anomaly contributions are “purely conventional”. This shall miss
some of the most important physics about the proton mass.

##  VI Heavy Quark and Pion

The heavy quark contribution to the proton mass has been computed on lattice,
particularly for the charm quark Gong  _et al._ (2013); Alexandrou  _et al._
(2020). The nominal contribution is large: $\langle P|m_{c}\bar{c}c|P\rangle$
is on the order of 100 MeV. However, the anomaly will cancel it mostly Shifman
_et al._ (1978). One estimation of the anomaly contribution associated with
charm flavor is on the order of $-65$ MeV. Therefore the total contribution
from charm quark is around 35 MeV, perhaps smaller than the strange quark
contribution. The bottom quark contribution is smaller, and the top will be
entirely negligible.

Finally, I would like to make a comment on the mass structure of the pion. Its
mass decomposition using the same method has been considered in Ref. Ji
(1995b), where it was found that the QAE contributes about 1/8 of the pion
mass

$\langle H_{a}\rangle_{\pi}=m_{\pi}/8\ .$ (42)

Therefore the gluon part of the wave function shall approach that of the QCD
vacuum in the chiral limit. Likewise, the standard gluon energy contribution
also vanishes in this limit,

$\langle H_{g}\rangle_{\pi}\sim 3m_{\pi}/8\ .$ (43)

for the experimental data on the parton momentum distribution. While the quark
mass contributes roughly 1/2 of the mass through chiral perturbation theory,
the quark kinetic and potential energy contribution is small

$\langle H_{q}\rangle_{\pi}\sim 0\ .$ (44)

Therefore, in the chiral limit all contributions vanish smoothly without any
fine tuning. The above results provide important constraints on any realistic
picture of the pion mass.

##  VII Mass, scalar and tensor Radii

Three nucleon gravitational form factors can be defined from the full QCD
energy-momentum tensor Pagels (1966); Ji (1997),

$\begin{split}&\left<P^{\prime}\left|T^{\mu\nu}\right|P\right>=\bar{u}\left(P^{\prime}\right)\bigg{[}A\left(Q^{2}\right)\gamma^{(\mu}\bar{P}^{\nu)}\\\
&+B\left(Q^{2}\right)\bar{P}^{(\mu}i\sigma^{\nu)\alpha}q_{\alpha}/2M\\\
&\;\;+C\left(Q^{2}\right)\left(q^{\mu}q^{\nu}-g^{\mu\nu}q^{2}\right)/M\bigg{]}u(P)\
,\end{split}$ (45)

where $q^{\mu}=P^{\prime\mu}-P^{\mu}$ is the four-momentum transfer,
$\bar{P}^{\mu}=(P^{\prime\mu}+P^{\mu})/2$, and $Q^{2}=-q^{2}$. All three
$A(Q^{2})$, $B(Q^{2})$, and $C(Q^{2})$ are scheme and scale independent, as
the electromagnetic Dirac and Pauli form factors, and hence are completely
physical. The above equation indicates the traceless and trace parts of form
factors are closely related by energy-momentum conservation. The trace part
defines the dilatation or scalar form factor,

$\left<P^{\prime}\left|T^{\mu}_{\mu}\right|P\right>=\bar{u}\left(P^{\prime}\right)u(P)G_{s}(Q^{2})\
,$ (46)

where,

$G_{s}(Q^{2})=\left[MA(Q^{2})-B(Q^{2})\frac{Q^{2}}{4M}+C(Q^{2})\frac{3Q^{2}}{M}\right]\
.$ (47)

In the chiral limit, the scalar form factor can be obtained from the trace
anomaly contribution Kharzeev (1996). On the other hand, the (00) component
defines the mass form factor in the Breit frame,

$\left<P^{\prime}\left|T^{00}\right|P\right>=\bar{u}\left(P^{\prime}\right)u(P)G_{m}(Q^{2})\
.$ (48)

where

$G_{m}(Q^{2})=\left[MA\left(Q^{2}\right)-B(Q^{2})\frac{Q^{2}}{4M}+C(Q^{2})\frac{Q^{2}}{M}\right]\
.$ (49)

All form factors $A$, $B$ and $C$ can be in principle measured from the deep-
exclusive processes like deeply-virtual Compton scattering through sum rules
derived for generalized parton distributions $E$ and $H$ Ji (1997); Ji  _et
al._ (1997).

For large $M$, the scalar and form factors are the same and are related to
$A(Q^{2})$ only, as stressed in Kharzeev (2021). However, for finite $M$, the
two form factors are different. If defining the radii in terms of

$\langle r^{2}\rangle_{s,m}=-6\frac{dG_{s,m}(Q^{2})/M}{dQ^{2}}\ ,$ (50)

we have

$\displaystyle\langle r^{2}\rangle_{s}$ $\displaystyle=$
$\displaystyle-6\frac{dA(Q^{2})}{dQ^{2}}-18\frac{C(0)}{M^{2}}\ ,$
$\displaystyle\langle r^{2}\rangle_{m}$ $\displaystyle=$
$\displaystyle-6\frac{dA(Q^{2})}{dQ^{2}}-6\frac{C(0)}{M^{2}}\ ,$ (51)

where we used the fact that $B(0)=0$ Pagels (1966); Ji (1997). So the
difference between scalar and mass radius is

$\langle r^{2}\rangle_{s}-\langle r^{2}\rangle_{m}=-12\frac{C(0)}{M^{2}}\ ,$
(52)

where $C(0)=C_{q}+C_{g}$ is a sum of the quark and gluon contributions.

Recently, there have been extractions of the scalar radius from $J/\psi$,
$\phi$ and $\omega$ productions near threshold using Vector Dominance Model
(VDM) Kharzeev (2021); Wang  _et al._ (2021). Neglecting the finite quark mass
effect in the trace of QCD EMT, it was found from the GlueX $J/\psi$ data that
Kharzeev (2021)

$\langle r^{2}\rangle_{s}=(0.55\pm 0.03~{}\rm fm)^{2}\ ,$ (53)

and from $\phi$ and $\omega$ data Wang  _et al._ (2021),

$\langle r^{2}\rangle_{s}=(0.64\pm 0.03~{}\rm fm)^{2}\ .$ (54)

Both results are smaller than the charge radius. Alternatively, it has been
suggested that the GlueX data is related to $A$ form factor only in the
holographic model Mamo and Zahed (2021), which produces a radius $\langle
r^{2}\rangle_{A}=(~{}0.61\rm fm)^{2}$.

There have been lattice QCD calculations of the quark form factors $A_{q}(0)$
and $C_{q}(0)$ Hagler  _et al._ (2008); Hagler (2010) and more recently the
gluon ones Shanahan and Detmold (2019) from the traceless part of the EMT.
Although the quark masses in these works are somewhat heavier compared with
the physical ones (with pion mass 450$\sim$ 490 MeV), it is interesting to
extract the scalar and mass radii from these calculations. Since $A_{g}$ is
softer than $A_{q}$, the radius from $A$-form factor is dominated by the gluon
contribution,

$\langle r^{2}\rangle_{A}=-6\frac{dA(Q^{2})}{dQ^{2}}=(0.47~{}\rm fm)^{2}$ (55)

where the quark contribution includes only the connected contractions from up
and down quarks. Meanwhile, $C(0)$ has a considerable uncertainty but a large
central value,

$C(0)\equiv(D_{q}(\mu)+D_{g}(\mu))/4\sim-1.25\ ,$ (56)

where the scheme and scale dependence cancels in the sum. This yields,

$\langle r^{2}\rangle_{s}\sim(1.1\rm~{}fm)^{2}\ ,$ (57)

which is considerably bigger than those in Eqs. (53,54), and might be
reasonable if considered as a bag radius in the MIT bag model Chodos  _et al._
(1974). The mass radius is

$\langle r^{2}\rangle_{m}\sim(0.74\rm~{}fm)^{2},$ (58)

a bit smaller than the charge radius. If these lattice results are taken
seriously, they might imply that the VDM extractions have a large unknown
systematics.

On the other hand, if the sign of $C(0)$ is definitely negative Polyakov and
Schweitzer (2018), the scalar radius must be larger than the mass radius. This
is reasonable because it is generally expected that the $0^{++}$ scalar
excitation has a lower mass than $2^{++}$ which also contributes to the mass
form factor Chen  _et al._ (2006); Mamo and Zahed (2021). Assuming the mass
radius is not negative, Eq. (52) puts a constraint

$\langle r^{2}\rangle_{s}\geq-12\frac{C(0)}{M^{2}}\ .$ (59)

If one uses $C(0)=-1.25$, the right hand side is $(0.81~{}\rm fm)^{2}$. If the
extracted experimental value is trust-able, it clearly violates the above
bound. Then the gluonic $C(0)$ from lattice should be much smaller than that
in Ref. Shanahan and Detmold (2019). Indeed, if one uses $(0.55~{}\rm fm)^{2}$
as the upper limit for the $C(0)$, one has

$|C(0)|\leq 0.57$ (60)

which constrains $|D_{q}(0)+D_{g}(0)|\leq 2.3$, a result can be checked in
future high-precision lattice calculations.

Finally, one can also define a tensor radius $\langle r^{2}\rangle_{t}$
through (see Eq. (37))

$\langle r^{2}\rangle_{m}=\frac{3}{4}\langle
r^{2}\rangle_{t}+\frac{1}{4}\langle r^{2}\rangle_{s}\ .$ (61)

We have then,

$\langle r^{2}\rangle_{t}=-6\frac{dA(Q^{2})}{dQ^{2}}-2\frac{C(0)}{M^{2}}\ ,$
(62)

The lattice data give

$\langle r^{2}\rangle_{t}=(0.58~{}\rm fm)^{2}\ .$ (63)

One can also see

$\langle r^{2}\rangle_{s}-\langle r^{2}\rangle_{t}=-16\frac{C(0)}{M^{2}}\ ,$
(64)

and thus $C(0)$ also determines the difference between scalar and tensor
radii. Assuming the dipole form of the form factors,
$G_{t,s}(t)=M/(1-t/m_{t,s}^{2})^{2}$, one gets the following relation between
the scalar and tensor masses,

$\frac{1}{m_{s}^{2}}-\frac{1}{m_{t}^{2}}=-\frac{4C(0)}{3M^{2}}$ (65)

The lattice data yield: $m_{s}=620$ MeV, and $m_{t}=1.18$ MeV.

##  VIII conclusion

In this paper, I argue that the most natural way to study the mass structure
of the proton is through its rest frame energy. It contains four terms with
three combinations being scheme independent and thus physical, and the
decomposition can be made frame independent or Lorentz covariant. Other
variants of this decomposition, two terms or three terms, are discussed but
appear less natural. Moreover, the so-called frame-independent mass structure
from the EMT trace equation does not appear to provide additional insight on
the mass. Measuring the anomaly contribution experimentally is important,
which may help to explain the origin of the proton mass through a Higgs-like
mechanism. Finally, I comment on the discrepancy in the scalar radius of the
nucleon extracted from vector-meson production and lattice QCD calculations.

Acknowledgment.—We thank K. F. Liu, Y. Z. Liu, D. Kharzeev, A. Metz, Z.-E.
Meziani, B. Pasquini, S. Rodini, A. Schaefer, F. Yuan, and I. Zahed for
discussions and comments on the manuscript, and Y. Guo and Y. Su for help. I
particularly thank Y. Z. Liu for helping with the gravitational form factors.
This material is supported by the U.S. Department of Energy, Office of
Science, Office of Nuclear Physics, under contract number DE-SC0020682, and by
Southeastern Universities Research Association.

## References

  * Ji (1995a) X.-D. Ji, Phys. Rev. Lett. 74, 1071 (1995a), arXiv:hep-ph/9410274 .
  * Hecht (2011) E. Hecht, Am. J. Phys. 79, 591 (2011).
  * Dudek  _et al._ (2012) J. Dudek _et al._ , Eur. Phys. J. A 48, 187 (2012), arXiv:1208.1244 [hep-ex] .
  * Accardi  _et al._ (2016) A. Accardi _et al._ , Eur. Phys. J. A 52, 268 (2016), arXiv:1212.1701 [nucl-ex] .
  * Mez (2021) Third Workshop on Proton Mass: Origin and Perspective,https://indico.phy.anl.gov/event/2 (2021).
  * Kharzeev (2021) D. E. Kharzeev, (2021), arXiv:2102.00110 [hep-ph] .
  * Okun (1989) L. B. Okun, Phys. Today 42, 31 (1989).
  * Buchalla  _et al._ (1996) G. Buchalla, A. J. Buras, and M. E. Lautenbacher, Rev. Mod. Phys. 68, 1125 (1996), arXiv:hep-ph/9512380 .
  * Peskin and Schroeder (1995) M. E. Peskin and D. V. Schroeder,  _An Introduction to quantum field theory_ (Addison-Wesley, Reading, USA, 1995).
  * Shifman  _et al._ (1978) M. A. Shifman, A. I. Vainshtein, and V. I. Zakharov, Phys. Lett. B 78, 443 (1978).
  * Collins  _et al._ (1977) J. C. Collins, A. Duncan, and S. D. Joglekar, Phys. Rev. D 16, 438 (1977).
  * Nielsen (1977) N. K. Nielsen, Nucl. Phys. B 120, 212 (1977).
  * Chen  _et al._ (2006) Y. Chen _et al._ , Phys. Rev. D 73, 014516 (2006), arXiv:hep-lat/0510074 .
  * Abdel-Rehim  _et al._ (2016) A. Abdel-Rehim, C. Alexandrou, M. Constantinou, K. Hadjiyiannakou, K. Jansen, C. Kallidonis, G. Koutsou, and A. Vaquero Aviles-Casco (ETM), Phys. Rev. Lett. 116, 252001 (2016), arXiv:1601.01624 [hep-lat] .
  * Alexandrou  _et al._ (2017) C. Alexandrou, M. Constantinou, K. Hadjiyiannakou, K. Jansen, C. Kallidonis, G. Koutsou, A. Vaquero Avilés-Casco, and C. Wiese, Phys. Rev. Lett. 119, 142002 (2017), arXiv:1706.02973 [hep-lat] .
  * Yang  _et al._ (2018) Y.-B. Yang, J. Liang, Y.-J. Bi, Y. Chen, T. Draper, K.-F. Liu, and Z. Liu, Phys. Rev. Lett. 121, 212001 (2018), arXiv:1808.08677 [hep-lat] .
  * He  _et al._ (2021) F. He, P. Sun, and Y.-B. Yang, (2021), arXiv:2101.04942 [hep-lat] .
  * Zahed (2021) I. Zahed, (2021), arXiv:2102.08191 [hep-ph] .
  * Kharzeev  _et al._ (1999) D. Kharzeev, H. Satz, A. Syamtomov, and G. Zinovjev, Eur. Phys. J. C 9, 459 (1999), arXiv:hep-ph/9901375 .
  * Hatta and Yang (2018) Y. Hatta and D.-L. Yang, Phys. Rev. D 98, 074003 (2018), arXiv:1808.02163 [hep-ph] .
  * Mamo and Zahed (2020) K. A. Mamo and I. Zahed, Phys. Rev. D 101, 086003 (2020), arXiv:1910.04707 [hep-ph] .
  * Wang  _et al._ (2020) R. Wang, J. Evslin, and X. Chen, Eur. Phys. J. C 80, 507 (2020), arXiv:1912.12040 [hep-ph] .
  * Boussarie and Hatta (2020) R. Boussarie and Y. Hatta, Phys. Rev. D 101, 114004 (2020), arXiv:2004.12715 [hep-ph] .
  * Meziani and Joosten (2020) Z.-E. Meziani and S. Joosten, in  _Probing Nucleons and Nuclei in High Energy Collisions: Dedicated to the Physics of the Electron Ion Collider_ (2020) pp. 234–237, doi:10.1142/9789811214950_0048.
  * Ji and Liu (2021) X. Ji and Y. Liu, (2021), arXiv:2101.04483 [hep-ph] .
  * Di Francesco  _et al._ (1997) P. Di Francesco, P. Mathieu, and D. Senechal,  _Conformal Field Theory_, Graduate Texts in Contemporary Physics (Springer-Verlag, New York, 1997).
  * Karsch (1982) F. Karsch, Nucl. Phys. B 205, 285 (1982).
  * Rothe (1995) H. J. Rothe, Phys. Lett. B 364, 227 (1995), arXiv:hep-lat/9508005 .
  * Ji and Lu (1998) X.-D. Ji and W. Lu, (1998), arXiv:hep-ph/9802437 .
  * Sun  _et al._ (2020) B.-d. Sun, Z.-h. Sun, and J. Zhou, (2020), arXiv:2012.09443 [hep-ph] .
  * Metz  _et al._ (2020) A. Metz, B. Pasquini, and S. Rodini, (2020), arXiv:2006.11171 [hep-ph] .
  * Luke  _et al._ (1992) M. E. Luke, A. V. Manohar, and M. J. Savage, Phys. Lett. B 288, 355 (1992), arXiv:hep-ph/9204219 .
  * Kharzeev (1996) D. Kharzeev, Proc. Int. Sch. Phys. Fermi 130, 105 (1996), arXiv:nucl-th/9601029 .
  * Shuryak (1999) E. V. Shuryak, (1999), arXiv:hep-ph/9909458 .
  * Chodos  _et al._ (1974) A. Chodos, R. Jaffe, K. Johnson, C. B. Thorn, and V. Weisskopf, Phys. Rev. D 9, 3471 (1974).
  * Roberts and Mezrag (2017) C. D. Roberts and C. Mezrag, EPJ Web Conf. 137, 01017 (2017), arXiv:1611.09863 [nucl-th] .
  * Feynman  _et al._ (1963) R. P. Feynman, R. B. Leighton, and M. Sands,  _The Feynman Lectures on Physics, Vol. II, Chapt.28_ (1963).
  * Ji (2020) X. Ji, Nucl. Phys. B, 115181 (2020), arXiv:2003.04478 [hep-ph] .
  * Hatta and Zhao (2020) Y. Hatta and Y. Zhao, Phys. Rev. D 102, 034004 (2020), arXiv:2006.02798 [hep-ph] .
  * Guo  _et al._ (2021) Y. Guo, X. Ji, and K. Shiells, (2021), arXiv:2101.05243 [hep-ph] .
  * Hatta  _et al._ (2018) Y. Hatta, A. Rajan, and K. Tanaka, JHEP 12, 008 (2018), arXiv:1810.05116 [hep-ph] .
  * Tanaka (2019) K. Tanaka, JHEP 01, 120 (2019), arXiv:1811.07879 [hep-ph] .
  * Lorcé (2018) C. Lorcé, Eur. Phys. J. C 78, 120 (2018), arXiv:1706.05853 [hep-ph] .
  * Landau and Lifshitz (1984) L. D. Landau and E. M. Lifshitz,  _Fluid Mechanics_ (Pergamon Press, 1984).
  * Shuryak (2017) E. Shuryak, Rev. Mod. Phys. 89, 035001 (2017), arXiv:1412.8393 [hep-ph] .
  * Ji (1997) X.-D. Ji, Phys. Rev. Lett. 78, 610 (1997), arXiv:hep-ph/9603249 .
  * Gasser and Leutwyler (1985) J. Gasser and H. Leutwyler, Nucl. Phys. B 250, 465 (1985).
  * Alexandrou  _et al._ (2020) C. Alexandrou, S. Bacchio, M. Constantinou, J. Finkenrath, K. Hadjiyiannakou, K. Jansen, G. Koutsou, and A. Vaquero Aviles-Casco, Phys. Rev. D 102, 054517 (2020), arXiv:1909.00485 [hep-lat] .
  * Gong  _et al._ (2013) M. Gong _et al._ (XQCD), Phys. Rev. D 88, 014503 (2013), arXiv:1304.1194 [hep-ph] .
  * Ji (1995b) X.-D. Ji, Phys. Rev. D 52, 271 (1995b), arXiv:hep-ph/9502213 .
  * Pagels (1966) H. Pagels, Phys. Rev. 144, 1250 (1966).
  * Ji  _et al._ (1997) X.-D. Ji, W. Melnitchouk, and X. Song, Phys. Rev. D 56, 5511 (1997), arXiv:hep-ph/9702379 .
  * Wang  _et al._ (2021) R. Wang, W. Kou, and X. Chen, (2021), arXiv:2102.01610 [hep-ph] .
  * Mamo and Zahed (2021) K. A. Mamo and I. Zahed, (2021), arXiv:2103.03186 [hep-ph] .
  * Hagler  _et al._ (2008) P. Hagler _et al._ (LHPC), Phys. Rev. D 77, 094502 (2008), arXiv:0705.4295 [hep-lat] .
  * Hagler (2010) P. Hagler, Phys. Rept. 490, 49 (2010), arXiv:0912.5483 [hep-lat] .
  * Shanahan and Detmold (2019) P. E. Shanahan and W. Detmold, Phys. Rev. D 99, 014511 (2019), arXiv:1810.04626 [hep-lat] .
  * Polyakov and Schweitzer (2018) M. V. Polyakov and P. Schweitzer, Int. J. Mod. Phys. A 33, 1830025 (2018), arXiv:1805.06596 [hep-ph] .


# Asymmetric Cryptosystem Using Careful Synchronization

Jakub Ruszil  Jagiellonian University
Cracow
Poland

(February 2023)

###### Abstract

We present public-private key cryptosystem which utilizes the fact that
checking whether a partial automaton is carefully synchronizing is
$PSPACE$-complete, even in the case of a binary alphabet.

##  1 Introduction

Cryptography is essential branch of mathematics since the ancient times. It’s
main purpose is to ensure the privacy of information between sender and
receiver sent through a possibly observed channel. Nowadays we differ
symmetric cryptography - where the key used to cipher the message is the same
as the one to decipher it - and asymmetric, where the key to cipher the
message is commonly known and the one to decipher it is known only to the
receiver of the message. In other words asymmetric cryptography is referred to
as a public key cryptography, or a public-private key cryptography. The idea
of public key cryptography was first mentioned in a confidential report GCHQ
[4] (UK Government Communications Headquarters) and later independently by
Diffie and Hellman in 1976 [27] along with the first practical public key
cryptosystem based on knapsack problem. The mostly known asymmetric
cryptosystem (RSA) was invented by Rivest, Shamir and Adleman in 1978 [17] and
is applicable since then to encryption and digital signatures.
The concept of synchronization of finite automata is essential in various
areas of computer science. It consists in regaining control over a system by
applying a specific set of input instructions. These instructions lead the
system to a fixed state no matter in which state it was at the beginning. The
idea of synchronization has been studied for many classes of complete
deterministic finite automata (DFA) [1, 2, 5, 9, 10, 16, 18, 20, 23, 22, 24,
25] and non-deterministic finite automata [7, 14]. One of the most famous
longstanding open problems in automata theory, known as Černý Conjecture,
states that for a given synchronizing DFA with $n$ states one can always find
a synchronizing word of length at most $(n-1)^{2}$. This conjecture was proven
for numerous classes of automata, but the problem is still not solved in
general case. The concept of synchronization has been also considered in
coding theory [3, 8], parts orienting in manufacturing [5, 15], testing of
reactive systems [19] and Markov Decision Processes [11, 12].

Allowing no outgoing transitions from some states for certain letters helps us
to model a system for which certain actions cannot be accomplished while being
in a specified state. This leads to the problem of finding a synchronizing
word for a finite automaton, where transition function is not defined for all
states. Notice that this is the most frequent case, if we use automata to
model real-world systems. In practice, it rarely happens that a real system
can be modeled with a DFA where transition function is total. The transition
function is usually a partial one. This fact motivated many researchers to
investigate the properties of partial finite automata relevant to practical
problems of synchronization.
We know that, in general case, checking if a partial automaton can be
synchronized is PSPACE-complete [13] even for binary alphabet [26] and those
facts are essential in our latter considerations.
In this paper we present a public key cryptosystem utilizing fact, that
checking if the PFA is carefully synchronizing is PSPACE-complete. This is
however not the first attempt of trying to develop asymmetric cryptosystems
with the notion of finite automata. Public key cryptography on finite automata
with output is discussed in [21] and uses the notion of invertible automata to
provide the hard computational problem, inevitable to design such
cryptosystem.
The paper is organized as follows. In the section 2 we provide with the basic
notions and facts about synchronization of automata. In the sections 3 and 4
we present basic method of encryption and decryption using our cryptosystem.
In the section 5 we state couple of additional improvements to ensure better
security. Finally we conclude the paper in the section 6 along with possible
further research to the topic.

##  2 Preliminaries

_Partial finite automaton_ (PFA) is an ordered tuple
$\mathcal{A}=(Q,\Sigma,\delta)$, where $\Sigma$ is a finite set of letters,
$Q$ is a finite set of states and $\delta:{Q\times\Sigma^{*}}\rightarrow{Q}$
is a transition function, possibly not everywhere defined. In this definition
we omit initial and final states, since they are not relevant to the problem
of synchronization. For $\emph{w}\in\Sigma^{\ast}$ and $\emph{q}\in Q$ we
define $\delta(\emph{q},\emph{w})$ inductively: $\delta(\emph{q},\epsilon)=q$
and $\delta(\emph{q},\emph{aw})=\delta(\delta(\emph{q},\emph{a}),\emph{w})$
for $a\in\Sigma$, where $\epsilon$ is the empty word and
$\delta(\emph{q},\emph{a})$ is defined. A word $\emph{w}\in\Sigma^{\ast}$ is
called _carefully synchronizing_ if there exists $\overline{q}\in Q$ such that
for every $\emph{q}\in Q$, $\delta(\emph{q},\emph{w})=\overline{q}$ and all
transitions $\delta(q,w^{\prime})$, where $w^{\prime}$ is any prefix of $w$,
are defined. A PFA is called _carefully synchronizing_ if it admits any
carefully synchronizing word. For a given $\mathcal{A}$ we define its _power
automaton_ (which is itself a PFA) as
$\mathcal{P}(\mathcal{A})=(2^{Q},\Sigma,\tau)$, where $2^{Q}$ stands for the
set of all subsets of $Q$, and $\Sigma$ is the same as in $\mathcal{A}$. The
transition function $\tau:{2^{Q}\times\Sigma}\rightarrow{2^{Q}}$ is defined as
follows. Let $Q^{\prime}\subseteq Q$. For every $a\in\Sigma$ we define
$\tau(Q^{\prime},a)=\bigcup_{q\in Q^{\prime}}\delta(q,a)$ if $\delta(q,a)$ is
defined for all states $q\in Q^{\prime}$, otherwise $\tau(Q^{\prime},a)$ is
not defined. We also note $Q.w$ as an action of a word $w$ on a set of states
$Q$ under the function $\delta$. Let $S\subseteq Q$. Then we denote $S.w^{-1}$
as a preimage of $S$ under the action of a word $w$.
We note that the above concepts can also be considered for deterministic
finite automata (DFA), for which the transition function is total. We define
an $a$-cluster to be a DFA $\mathcal{A}=(Q,\\{a\\},\delta)$ such that the
automaton is connected. In other words it means that such automaton is a cycle
on letter $a$ with paths that leads to the states of that cycle. The set of
states that induce a cycle in the $a$-cluster is referred to as the center of
the cluster. The depth of the cluster is the length of the longest path to the
center of the cluster. If $q$ belongs to the center of the $a$-cluster, the
branch of the state $q$ are the states that has a path to $q$ that does not
have any other state belonging to the center. Destination of the branch is a
state in the center that has an in-transition from the last state of the
branch. Example of the $a$-cluster is depicted on Figure 1.

aaaaaaa1234756 Figure 1: Example of the $a$-cluster

Center of that $a$-cluster is the set $\\{3,4,5,6\\}$, the depth is $2$ and
there are two branches: $b_{1}=\\{1,2\\}$ and $b_{2}=\\{7\\}$. Destination of
the branch $b_{1}$ is the state $3$ and of the branch $b_{2}$ is state $4$.

We define the sum of two automata $\mathcal{A}=(Q_{1},\Sigma_{1},\delta_{1})$
and $\mathcal{B}=(Q_{2},\Sigma_{2},\delta_{2})$ as
$\mathcal{A}\cup\mathcal{B}=(Q_{1}\cup
Q_{2},\Sigma_{1}\cup\Sigma_{2},\delta_{1}\cup\delta_{2})$. We can now state
the obvious fact, useful to decide whether a given PFA is carefully
synchronizing.

######  Fact 1.

Let $\mathcal{A}$ be a PFA and $\mathcal{P(A)}$ be its power automaton. Then
$\mathcal{A}$ is carefully synchronizing if and only if for some state $q\in
Q$ there exists a path in $\mathcal{P(A)}$ from $Q$ to $\\{q\\}$. The shortest
synchronizing word for $\mathcal{A}$ corresponds to the shortest such path in
$\mathcal{P(A)}$.

An example of a carefully synchronizing automaton $\mathcal{A}_{car}$ is
depicted in Fig. 2. One of its carefully synchronizing words is
$aa(ba)^{3}bbab$.

aaaaaa,baaaa,baaaaabbbbbbb123456798101211131415 Figure 2: A carefully
synchronizing automaton $\mathcal{A}_{car}$.

We recall the result of Vorel [26] about the complexity of deciding whether a
PFA is carefully synchronizing.

######  Theorem 1.

Given a PFA $\mathcal{A}=(Q,\Sigma,\delta)$, checking if $\mathcal{A}$ is
carefully synchronizing is $PSPACE$-complete even for $|\Sigma|=2$.

Further we assume that $\Sigma=\\{a,b\\}$ and the letter $a$ is defined for
all the states wherever not mentioned otherwise. Having that we can go to the
description of our method.

##  3 Basic encryption

Let a plain text be the word $u\in\\{0,1\\}^{*}$. Choose a public key to be a
carefully synchronizing PFA $\mathcal{A}=(Q,\Sigma,\delta)$ and a private key
to be any word $w$ that carefully synchronizes $\mathcal{A}$. For simplicity
of further statements we note $\mathcal{A}_{i}=(Q_{i},\Sigma,\delta_{i})$ to
be isomorphic to $\mathcal{A}$ for any $i\in\mathbb{N}$. First we describe a
construction that is a ciphertext.
Define an automaton
$\mathcal{P}=(\\{p_{1},p_{2},..,p_{|u|+1}\\},\\{0,1\\},\gamma)$ where $\gamma$
is defined as follows: for $i\in\\{1,..,|u|+1\\}$ set
$\gamma(p_{i-1},u_{i})=p_{i}$, where $u_{i}$ is $i$-th letter of a word $u$.
In other words we encode our plaintext in the form of a directed path, where
consecutive edges correspond to the consecutive letters of the word $u$.
Encryption consists of four steps:

  1. 1.

Compute $\mathcal{B}=\bigcup_{i=1}^{|u|+1}\mathcal{A}_{i}$ and denote
$\bigcup_{i=1}^{|u|+1}\delta_{i}=\rho$, $P=\bigcup_{i=1}^{|u|+1}Q_{i}$

  2. 2.

for any transition $(p_{i},p_{j})$ in $\mathcal{P}$, labelled with a letter
$x\in\\{0,1\\}$ choose any pair of states $q^{i}\in Q_{i}$ and $q^{j}\in
Q_{j}$, and set $\rho(q^{i},x)=q^{j}$,

  3. 3.

for all $i\in\\{1,..,|u|+1\\}$ and for every letter $a\in\Sigma$, if $q^{i}\in
Q_{i}$ and $\delta(q^{i},a)$ is undefined, then choose any $j$ and any state
$q^{j}\in Q_{j}$ and set $\rho(q^{i},a)=q^{j}$,

  4. 4.

for all $i\in\\{1,..,|u|+1\\}$ choose $k_{i}\in\mathbb{N}$. Choose $k_{i}$
pairs $(q_{p}^{i},q_{r}^{i})$ and a letter $x\in\\{0,1\\}$ and define
$\rho(q_{p}^{i},x)=q_{r}^{i}$

Automaton $\mathcal{B}$ is our ciphertext. It is straightforward from the
construction, that computing such automaton is polynomial in terms of
$Q,\Sigma$ and length of the plaintext. We also state two obvious
observations.

######  Fact 2.

After removing letters $x\in\\{0,1\\}$ from automaton $\mathcal{B}$ we obtain
a DFA over $\Sigma$.

######  Fact 3.

After removing letters $a\in\Sigma$ from automaton $\mathcal{B}$ we obtain a
digraph labelled with letters $x\in\\{0,1\\}$ with longest path between the
vertices of length 1.

Procedure of encrypting the word $01$ is depicted on figures 3, 4, 5 and 6. As
a public key we take the automaton depicted on Figure 2.

aaaaaa,baaaa,baaaaabbbbbbb1a2a3a4a5a6a7a9a8a10a12a11a13a14a15aaaaaaa,baaaa,baaaaabbbbbbb1c2c3c4c5c6c7c9c8c10c12c11c13c14c15caaaaaa,baaaa,baaaaabbbbbbb1b2b3b4b5b6b7b9b8b10b12b11b13b14b15b
Figure 3: First step of encryption.

The first step involves summation of three copies of the public key that
correspond to the three vertices of the word $01$ encoded as a labeled path.
The first vertex of the path corresponds to the automaton induced by the
states with suffix $a$, the second - by the states with the suffix $b$, and
the third - by the suffix $c$.

aaaaaa,baaaa,baaaaabbbbbbb1a2a3a4a5a6a7a9a8a10a12a11a13a14a15aaaaaaa,baaaa,baaaaabbbbbbb1c2c3c4c5c6c7c9c8c10c12c11c13c14c15caaaaaa,baaaa,baaaaabbbbbbb1b2b3b4b5b6b7b9b8b10b12b11b13b14b15b01
Figure 4: Second step of encryption.

The second step involves adding the transitions $0$ and $1$ to the states of
automata that correspond to the in and out vertices of the transition. In the
above example we define transition $\rho(5a,0)=2b$, which corresponds to the
first transition of the encoded word, and $\rho(12b,1)=9c$, which corresponds
to the second transition of the encoded word. Transitions added in this step
are bolded.

aaaaaa,baaaa,baaaaabbbbbbb1a2a3a4a5a6a7a9a8a10a12a11a13a14a15aaaaaaa,baaaa,baaaaabbbbbbb1c2c3c4c5c6c7c9c8c10c12c11c13c14c15caaaaaa,baaaa,baaaaabbbbbbb1b2b3b4b5b6b7b9b8b10b12b11b13b14b15b01bbbbbbbb
Figure 5: Third step of encryption.

The third step involves adding transitions from $\Sigma$ to those states in
$\mathcal{B}$, which have undefined transitions for letters from $\Sigma$. In
that case we add only $b$ letters. For example we defined $\rho(1a,b)=2b$. We
should act similarly for all states, for which $b$ is undefined, but we have
only added some of the necessary transitions so the figure is readable.

aaaaaa,baaaa,baaaaabbbbbbb1a2a3a4a5a6a7a9a8a10a12a11a13a14a15aaaaaaa,baaaa,baaaaabbbbbbb1c2c3c4c5c6c7c9c8c10c12c11c13c14c15caaaaaa,baaaa,baaaaabbbbbbb1b2b3b4b5b6b7b9b8b10b12b11b13b14b15b01bbbbbbbb0100
Figure 6: Fourth step of encryption.

The last step involves adding some number of transitions under letters from
the alphabet $\\{0,1\\}$ between states belonging to the same copy of a public
key in $\mathcal{B}$. In that case we have added transition $\rho(9a,0)=10a$
(first copy), transitions $\rho(7b,1)=10b$ and $\rho(8b,1)=3b$ (second copy)
and transition $\rho(12c,0)=7c$ (third copy).

##  4 Basic decryption

For that section we assume that we have a ciphertext automaton
$\mathcal{B}=(P,\Sigma,\rho)$ constructed from a public key
$\mathcal{A}=(Q,\Sigma,\delta)$, and that we know a private key $w$ which is a
carefully synchronizing word for the automaton $\mathcal{A}$. First we state a
lemma.

######  Lemma 1.

Let $Q.w=q_{l}$. After removing letters $x\in\\{0,1\\}$ from automaton
$\mathcal{B}$ we have that $P.w=\\{q_{l}^{1},q_{l}^{2},..,q_{l}^{|u|+1}\\}$.

###### Proof.

It is immediate from construction, since we have not removed any transitions
from $\Sigma$ within any $Q_{i}$, that for any $Q_{i}\in P$ holds
$Q_{i}.w=q_{l}^{i}$, since $w$ carefully synchronizes $\mathcal{A}$ and each
$Q_{i}$ on $\Sigma$ induces an isomorphic copy of $\mathcal{A}$. So we have,
that $\\{q_{l}^{1},q_{l}^{2},..,q_{l}^{|u|+1}\\}\subseteq P.w$. To prove that
$P.w\subseteq\\{q_{l}^{1},q_{l}^{2},..,q_{l}^{|u|+1}\\}\subseteq P.w$ it
suffices to notice, that, from fact 2 automaton $\mathcal{B}$ is deterministic
and for any prefix $w^{\prime}$ of $w$ if
$Q.w^{\prime}=\\{q_{k_{1}},..,q_{k_{s}}\\}$, then
$Q_{i}.w^{\prime}=\\{q_{k_{1}}^{i},..,q_{k_{s}}^{i}\\}$. ∎

######  Lemma 2.

There exist an algorithm with $O(|P||w|)$ time complexity and $O(|P||w|)$
space complexity which computes a partition of $P$ on sets $Q_{1}$, $Q_{2}$,
…, $Q_{|u|+1}$.

###### Proof.

We describe a desired algorithm. Suppose we have an array with $|P|$ columns
and $|w|+1$ rows. Put every element of $P$ in a different column of a first
row. Then we fill the $i$-th row by taking a state from the $(i-1)$-th row of
the corresponding column and applying to it the $i$-th letter of a word $w$
until the end of the row. After this procedure, from lemma 1, the last row
contains only the states from the set
$\\{q_{l}^{1},q_{l}^{2},..,q_{l}^{|u|+1}\\}$. We can now compute each $Q_{i}$
by taking those states from the first row that lie in the same columns as the
state $q_{l}^{i}$. ∎

With these two lemmas we are ready to present a decryption method:

  1. 1.

using Lemma 1 compute the set $\\{q_{l}^{1},q_{l}^{2},..,q_{l}^{|u|+1}\\}$,

  2. 2.

using Lemma 2 compute the partition of $P$ on sets $Q_{1}$, $Q_{2}$, …,
$Q_{|u|+1}$,

  3. 3.

for every transition $x\in\\{0,1\\}$ in $\mathcal{B}$ if $x$ joins a states
from different sets, say $Q_{i}$ and $Q_{j}$, then join $q_{l}^{i}$ and
$q_{l}^{j}$ with transition $x$, otherwise remove the transition.

Observe, that after applying that procedure to the ciphertext $\mathcal{B}$ we
end up with a graph that was our plaintext, what can be concluded directly
from the encryption procedure. In general one can decipher the message only by
knowing any carefully synchronizing word for $\mathcal{A}$ or computing every
possible induced subautomaton isomorphic to $\mathcal{A}$.

##  5 Extensions

As the ciphertext which is a result of our encryption method consists of $n$
copies of isomorphic automaton with added transitions between those copies one
can think of more ”sophisticated” method of creating a ciphertext. As
mentioned in the previous section a potential attacker can decipher the
message computing every possible induced subautomaton isomorphic to a public
key. However, the problem of determining for two given graphs say $G$ and $H$,
whether $G$ has a copy of $H$ as an induced subgraph is $NP$-complete [6]. In
this section we present two lemmas that can be used to obfuscate the
ciphertext even more. The first one involves adding the state to the public
key and the second one adding arbitrary number of $a$-clusters to the
ciphertext.

######  Lemma 3.

Let $\mathcal{A}=(Q,\Sigma,\delta)$ be a PFA with carefully synchronizing word
$w$. Further, let $q\in Q$ be such that there exists $p\in Q$ such that $q\in
p.a^{-1}$. Let also
$\mathcal{A}^{\prime}=(Q\cup\\{q^{\prime}\\},\Sigma,\delta^{\prime})$ where
$\delta^{\prime}$ is defined as $\delta$ on $Q$ and
$\delta^{\prime}(q^{\prime},a)=q$. Then $w$ carefully synchronizes
$\mathcal{A}^{\prime}$.

###### Proof.

Since $a$ is defined for all states of $Q^{\prime}$, and $|\Sigma|=2$, then
the first letter of $w$ must be $a$. Let $w^{\prime}$ be the word $w$ without
the first letter. Since $\delta^{\prime}(q^{\prime},a)=q$ and we assumed that
there exist $p\in Q$ such that $q\in p.a^{-1}$ it is straightforward, that
$Q^{\prime}.a=Q.a$. Since we have not added any other transitions to
$\mathcal{A}^{\prime}$ and $\delta^{\prime}$ is defined as $\delta$ on $Q$, we
obtain that $Q^{\prime}.aw^{\prime}=Q.aw^{\prime}=Q.w$ and that concludes the
proof. ∎

For the next lemma we assume notation as in former part of the paper.

######  Lemma 4.

Let $\mathcal{B}=\bigcup_{i=1}^{k}\mathcal{A}_{k}$ and $m\in\mathbb{N}$ be the
smallest integer such that $Q.a^{m}=Q.a^{m+1}$. Define $B_{i}=Q_{i}.a^{m}b$
and let
$\mathcal{C}_{1}=(S_{1},\\{a\\},\eta_{1}),\ldots,\mathcal{C}_{l}=(S_{l},\\{a\\},\eta_{l})$
be $a$-clusters with depth $1$ and centers $K_{1},\ldots,K_{l}$ respectively.
Let
$\mathcal{B}^{\prime}=\mathcal{B}\cup\bigcup_{i=1}^{l}\mathcal{C}_{i}=(P^{\prime},\Sigma,\rho^{\prime})$.
If we define $b$ transitions for all states $q\in\bigcup_{i=1}^{l}K_{i}$ such
that there exists $0<j<k+1$ such that $\rho^{\prime}(q,b)\in B_{j}$ then
$P^{\prime}.w=\\{q_{l}^{1},...,q_{l}^{k}\\}$.

###### Proof.

Since $a$ is the only letter defined for all states in $\mathcal{A}$ and
$Q.a^{m}=Q.a^{m+1}$ then $w$ starts with a word $a^{m_{1}}b$ for
$0<m_{1}<m+1$. Note $w=a^{m_{1}}bw^{\prime}$ Observe that $Q.a^{i+1}\subseteq
Q.a^{i}$ for all $i\geq 0$. From that we have, that $Q.a^{m}\subseteq
Q.a^{m_{1}}$ and further for all copies of $\mathcal{A}$ in
$\mathcal{B}^{\prime}$ we obtain that $B_{i}\in Q_{i}.a^{m_{1}}.b$. Also,
since the depth of any cluster $\mathcal{C}_{i}$ is $1$, we have that
$P_{j}.a^{m_{1}}=K_{j}$ for all $0<j<m+1$. Notice that
$P^{\prime}=\bigcup_{i=1}^{k}Q_{i}\cup\bigcup_{i=1}^{l}S_{i}$, so

$P^{\prime}.w=\bigcup_{i=1}^{k}Q_{i}.w\cup\bigcup_{i=1}^{l}S_{i}.w=\bigcup_{i=1}^{k}Q_{i}.a^{m_{1}}bw^{\prime}\cup\bigcup_{i=1}^{l}S_{i}.a^{m_{1}}bw^{\prime}$

which gives

$P^{\prime}.w=\bigcup_{i=1}^{k}B_{i}w^{\prime}\cup\bigcup_{i=1}^{l}K_{i}bw^{\prime}.$

But we know, that for all $q\in\bigcup_{i=1}K_{i}$ there exists $0<i<k+1$ such
that $\delta^{\prime}(q,b)\in B_{i}$. From that we obtain

$P^{\prime}.w=\bigcup_{i=1}^{k}B_{i}w^{\prime},$

and since each $B_{i}=Q_{i}.a^{m}b$ then
$B_{i}.w^{\prime}=Q_{i}.a^{m}bw^{\prime}=Q_{i}.w=\\{q_{l}^{i}\\}$ and that
concludes the proof. ∎

Using these two lemmas we can move on to the description of the extended
method of encryption and decryption. In the next two subsections we follow the
notation provided in sections 3 and 4.

###  5.1 Extended encryption

The extension consists of adding two stages between the 1 and 2 stage of
encryption method, defining sets $Q_{i}^{\prime}$ and substitute them for
$Q_{i}$ in latter stages. Let us state two additional stages:

  1. 1.

add $l$ $a$-clusters with depth $1$ to automaton obtained in stage 1 and
define letters $b$ for centers of those clusters to fulfill assumptions of
lemma 4 in $\rho$ function (defined in section 3)

  2. 2.

for each copy $\mathcal{A}_{i}$ of public key in automaton obtained in
previous stage add $k_{i}$ states and define transitions as in lemma 3 and
note the set of the added states in this stage as $A_{i}$ for each
$\mathcal{A}_{i}$

Now let us define sets $Q_{i}^{\prime}$. For clusters
$\mathcal{C}_{1}=(S_{1},\\{a\\},\gamma_{1}),\ldots,\mathcal{C}_{l}=(S_{l},\\{a\\},\gamma_{l})$
(from stage 1) with centers $K_{1},\ldots,K_{l}$ respectively we define sets
$C_{1},\ldots,C_{|u|+1}$, such that if for $q\in K_{i}$ it holds $\rho(q,b)\in
B_{j}$ (notation from lemma 4), then $q$ and its branch belong to the set
$C_{j}$. Then define $Q_{i}^{\prime}=Q_{i}\cup A_{i}\cup C_{i}$. It is a
simple exercise to prove that the sets
$Q_{1}^{\prime},\ldots,Q_{|u|+1}^{\prime}$ form a partition of
$P=\bigcup_{i=1}^{|u|+1}Q_{i}\cup A_{i}\cup C_{i}$ which is the set of all
states of our ciphertext. The latter stages remain as in section 3.

###  5.2 Extended decryption

Algorithm of deciphering is similar to the one described in section 4. We
state lemmas being in a strict correspondence with those proven in section 4.

######  Lemma 5.

Let $\mathcal{B}$ be a ciphertext computed by extended encryption method using
public key $\mathcal{A}=(Q,\Sigma,\delta)$ and $Q.w=q_{l}$. After removing
letters $x\in\\{0,1\\}$ from automaton $\mathcal{B}$ we have that
$P.w=\\{q_{l}^{1},q_{l}^{2},\ldots,q_{l}^{|u|+1}\\}$.

###### Proof.

Observe that after stage 1 we can apply Lemma 4 and we obtain that
$(\bigcup_{i=1}^{|u|+1}Q_{i}\cup
C_{i}).w=\\{q_{l}^{1},q_{l}^{2},..,q_{l}^{|u|+1}\\}$. Notice that after stage
2 we can apply Lemma 3 to any copy of public key that was modified by that
stage and also $P.w=\\{q_{l}^{1},q_{l}^{2},..,q_{l}^{|u|+1}\\}$. The rest of
the proof is similar to the proof of Lemma 1. ∎

######  Lemma 6.

There exist an algorithm with polynomial time complexity (depending on $|P|$
and $|w|$) which computes a partition of $P$ on sets $Q_{1}^{\prime}$,
$Q_{2}^{\prime}$, …, $Q_{|u|+1}^{\prime}$.

###### Proof.

Using approach from the proof of Lemma 2 we can compute similar matrix, say
$M$, in time $O(|P||w|)$. From Lemma 6 we know the last row contains only the
states from the set $\\{q_{l}^{1},q_{l}^{2},\ldots,q_{l}^{|u|+1}\\}$ and we
can compute sets $\bar{Q}_{1},\ldots,\bar{Q}_{|u|+1}$ such if column of the
first row containing $q$ is the same as the column of the last row containing
$q_{l}^{i}$, then $q\in\bar{Q}_{i}$. Notice that there are three cases, when
$q\in\bar{Q}_{i}$:

  * •

$q\in Q_{i}$

  * •

$q\in A_{i}$

  * •

$q\in S_{m}$ such that there exist $p\in C_{i}\cap S_{m}$ (notation from Lemma
4)

First two cases are straightforward. To prove the theorem for the third case
observe that if $q\notin Q_{i}\cup A_{i}$, then $q\notin A_{j}$ and $q\notin
Q_{k}$ for any $j,k\neq i$ otherwise $\mathcal{B}$ would be non-deterministic.
So we deduce that $q\in S_{m}$ for some $m$. For the sake of contradiction
suppose that $C_{i}\cap S_{m}=\varnothing$. But that means, that $q.a^{m}b\in
B_{j}$ for $j\neq i$ and further $q.ab^{m}w^{\prime}=q.w=q_{l}^{j}$ what is a
contradiction. From these considerations we are able to determine for each $i$
the sets $A_{i}$ and $Q_{i}$ that are subsets of the set $Q_{i}^{\prime}$. In
order to compute the sets $C_{i}$ we first compute
$S_{1}^{\prime},..,S_{n}^{\prime}$ inducing all $a$-clusters in $\mathcal{B}$
by removing $b,0,1$ transitions and determine all connected components of the
resulting structure. Now we examine three cases for a cluster
$S_{j}^{\prime}$:

  * •

$S_{j}^{\prime}\cap\bar{Q}_{i}=\varnothing$

  * •

$S_{j}^{\prime}\subseteq\bar{Q}_{i}$

  * •

$S_{j}^{\prime}\cap\bar{Q}_{i}\neq\varnothing$ and
$S_{j}^{\prime}\not\subset\bar{Q}_{i}$

Notice, that if the first case holds we know that no state of $S_{j}^{\prime}$
belongs to $C_{i}$. If the second case holds, we must check if
$S_{j}^{\prime}\subseteq Q_{i}\cup A_{i}$. If this is not true, then we have
found a cluster $\mathcal{C}_{m}$, such that for all $q\in K_{m}$ it holds
$\rho(q,b)\in B_{i}$ and we determined the $a$-cluster that belongs to
$C_{i}$. In the third case we know that some of the states of the cluster
$S_{j}^{\prime}$ are in $C_{i}$ and some are not. To compute those that are
let us take the center of the $a$-cluster $S_{j}^{\prime}$, say
$K_{j}^{\prime}$, and observe that $q\in C_{i}$ if, and only if $q\in\\{p\in
K_{j}^{\prime}:\rho(p,b)\in B_{i}\\}=K_{j}^{\prime\prime}$ or $q$ belongs to
some branch with destination in $K_{j}^{\prime\prime}$. That concludes the
proof. ∎

Using two former lemmas, decryption method is similar as in 4. Extended step
is depicted on Figure 7. If we choose the public key to be the automaton on
Figure 2, then notice, that in Lemma 4 we have $m=2$, and
$Q.a^{2}b=\\{2,3,7,12,13\\}$.

aaaaaa,baaaa,baaaaabbbbbbb1a2a3a4a5a6a7a9a8a10a12a11a13a14a15aaaaaaa,baaaa,baaaaabbbbbbb1c2c3c4c5c6c7c9c8c10c12c11c13c14c15caaaaaa,baaaa,baaaaabbbbbbb1b2b3b4b5b6b7b9b8b10b12b11b13b14b15b765aaa4a1a2a1abbb
Figure 7: Extended step of encryption.

Observe that we can apply Lemma 3 to states $1,2,3$. We also added cluster
that consists of states $4,5,6,7$ so we can apply Lemma 4. In the former
method we had that
$Q_{1}=\\{1a,..,15a\\},Q_{2}=\\{1b,..,15b\\},Q_{3}=\\{1c,..,15c\\}$ and now
$Q_{1}^{\prime}=Q_{1}\cup\\{1\\},Q_{2}^{\prime}=Q_{2}\cup\\{2,4,5\\},Q_{3}^{\prime}=Q_{3}\cup\\{3,6,7\\}$.

##  6 Conclusions and further work

We proposed a method of utilizing careful synchronization to provide brand new
public key cryptosystem. In sections 3 and 4 we presented core idea of our
method and provided an example that illustrates it. As the ciphertext in that
method consists of $n$ copies of the same automaton, those two sections are
included to so the reader could understand the method presented in section 5.
It should be also mentioned that lemmas 4 and 3 are only examples of
extensions of that cryptosystem. Indeed, observe that Lemma 4 provides a
possibility to add ”free” $a$-clusters to a ciphertext. The disadvantage of
that extension is that we only can add $b$ transitions to states that are some
specified states of the copy of the public key. It is possible also to add the
extension, that allows us to define the $a$-clusters for which we can define
$b$ transition outside of that specific sets $B_{i}$ but to whatever state we
want, even the other added $a$-cluster. However this extension would cause
that in Lemma 5 it would be only $\\{q_{l}^{1},..,q_{l}^{|u|+1}\\}\in P.w$ so
the number of states added in such extensions would have been bounded by
$\text{min}(|Q_{1}^{\prime}|,..,|Q_{l}^{\prime}|)$ and also demanded
modifications in Lemma 6 so we omitted that extension.
Observe also that point 2 of encryption procedure can be modified in many
ways. For example one can choose to define more than one transition between
copies of automata and in decryption section choose the one that has odd or
even number in a ciphertext. We end up with several questions and open
problems:

######  Question 1.

What is the most reasonable way to define lacking transitions in point 3?

It is straightforward that if all lacking transitions in a copy of a public
key are defined within the same copy, it would result with $|u|+1$ connected
automata which are not connected between each other, and that simplifies the
attack on the cryptosystem.

######  Question 2.

What is the most reasonable way to define transitions in point 4?

We have defined step 4 in an abstract way, so to investigate many versions of
adding those ”obfuscating” $\\{0,1\\}$ transitions.

######  Question 3.

Find an algorithm that generates pairs of public and private keys.

We believe that the most promising approach will be to construct a PFA that is
carefully synchronized by a given $w$. We also want to investigate if it is
possible to design an algorithm that for a given word $w$ generates $n$ non-
isomorphic PFA’s that are carefully synchronized by $w$. Having that one could
take as a public key a tuple of $n$ automata that are synchronized by the same
word $w$. In that case, all methods presented in the paper would need only
slight modifications to work properly.

## References

  * [1] M. Berlinkov.  On Two Algorithmic Problems about Synchronizing Automata.  Language and Automata Theory and Applications, pages 61–67, 2014\.
  * [2] M. Berlinkov and M. Szykuła.  Algebraic Synchronization Criterion and Computing Reset Words.  Information Sciences, 369:718–730, 2016.
  * [3] M. T. Biskup and W. Plandowski.  Shortest Synchronizing Strings for Huffman Codes.  Theoretical Computer Science, 410:3925–3941, 2009.
  * [4] J. H. Ellis.  The Possibility of Non-Secret Digital Encryption.  1970\.
  * [5] D. Eppstein.  Reset Sequences for Monotonic Automata.  SIAM J. of Computing, 19:500–510, 1990.
  * [6] M. R. Garey and D. S. Johnson.  Computers and Intractability; A Guide to the Theory of NP-Completeness.  W. H. Freeman & Co., USA, 1990.
  * [7] B. Imreh and M. Steinby.  Directable Nondeterministic Automata.  Acta Cybern., 14:105–115, 1999.
  * [8] H. Jürgensen.  Synchronization.  Information and Computation, 206:1033–1044, 2008.
  * [9] J. Kari.  A Counter Example to a Conjecture Concerning Synchronizing Word in Finite Automata.  EATCS Bulletin, 73:146–147, 2001.
  * [10] J. Kari.  Synchronizing Finite Automata on Eulerian Digraphs.  Theoretical Computer Science, 295:223–232, 2003.
  * [11] T. Massart L. Doyen and M. Shirmohammadi.  Robust Synchronization in Markov Decision Processes.  CONCUR, pages 234–248, 2014.
  * [12] T. Massart L. Doyen and M. Shirmohammadi.  The Complexity of Synchronizing Markov Decision Processes.  J. Comput. Syst. Sci., 100:96–129, 2019.
  * [13] P. Martyugin.  Computational Complexity of Certain Problems Related to Carefully Synchronizing Words for Partial Automata and Directing Words for Nondeterministic Automata.  Theory Comput Syst, 54:293–304, 2014.  doi:10.1007/s00224-013-9516-6.
  * [14] M.Ito and K. Shikishima-Tsuji.  Some Results in Directable Automata.  Theory Is Forever. Essays Dedicated to Arto Salomaa on the Occasion of His 70th Birthday [Lect. Notes Comp. Sci 3113], pages 125–133, 2004.
  * [15] B. K. Natarajan.  An Algorithmic Approach to the Automated Design of Parts Orienters.  Foundations of Computer Science, 27th Annual Symposium on, pages 132–142, 1986.
  * [16] J. E. Pin.  On Two Combinatorial Problems Arising from Automata Theory.  Proceedings of the International Colloquium on Graph Theory and Combinatorics, 75:535–548, 1983.
  * [17] L. Adleman R.L. Rivest, A. Shamir.  A Method for Obtaining Digital Signatures and Public-Key Cryptosystems.  Communications of the ACM., 21:120–126, 1978.
  * [18] I. K. Rystsov.  Reset Words for Commutative and Solvable Automata.  Theoretical Computer Science, 172:273–279, 1997.
  * [19] S. Sandberg.  Homing and Synchronizing Sequences.  Model-Based Testing of Reactive Systems, 3472:5–33, 2005.
  * [20] M. Szykuła.  Improving the Upper Bound on the Length of the Shortest Reset Word.  STACS 2018, pages 56:1–56:13, 2018.
  * [21] R. Tao.  Finite Automaton Public Key Cryptosystems, pages 347–393.  Springer Berlin Heidelberg, Berlin, Heidelberg, 2009.  doi:10.1007/978-3-540-78257-5_9.
  * [22] A. Trahtman.  The Černý Conjecture for Aperiodic Automata.  Discrete Math. Theor. Comput. Sci., 9:3–10, 2007.
  * [23] J. Černý.  Poznámka k homogénnym eksperimentom s konečnými automatami.  Mat.-Fyz. Cas. Slovens.Akad. Vied., 14:208–216, 1964.
  * [24] M. Volkov.  Synchronizing Automata and the Černý Conjecture.  Language and Automata Theory and Applications, 5196:11–27, 2008\.
  * [25] M. Volkov.  Slowly Synchronizing Automata with Idempotent Letters of Low Rank.  Journal of Automata, Languages and Combinatorics, 24:375–386, 2019\.
  * [26] V. Vorel.  Subset synchronization and careful synchronization of binary finite automata.  Jour. Found. Comput. Sci., 27:557–578, 2016.
  * [27] M.E. Hellman W. Diffie.  New Directions in Cryptography.  IEEE Transactions on Information Theory., 22:644–654, 1976.