prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What kind of ultracold neutral plasmas does this study focus on?

Read the following text and answer briefly.

Context 1: \section{Introduction}

Ultracold neutral plasmas studied in the laboratory offer access to a regime of plasma physics that scales to describe thermodynamic aspects of important high-energy-density systems, including strongly coupled astrophysical plasmas \cite{VanHorn,Burrows}, as well as terrestrial sources of neutrons \cite{Hinton,Ichimaru_fusion,Atzeni,Boozer} and x-ray radiation \cite{Rousse,Esarey}   Yet, under certain conditions, low-temperature laboratory plasmas evolve with dynamics that are governed by the quantum mechanical properties of their constituent particles, and in some cases by coherence with an external electromagnetic field    

The relevance of ultracold plasmas to such a broad scope of problems in classical and quantum many-body physics has given rise to a great deal of experimental and theoretical research on these systems since their discovery in the late 90s   A series of reviews affords a good overview of progress in the last twenty years \cite{Gallagher,Killian_Science,PhysRept,Lyon}   Here, we focus on the subset of ultracold neutral plasmas that form via kinetic rate processes from state-selected Rydberg gases, and emphasize in particular the distinctive dynamics found in the evolution of molecular ultracold plasmas   

While molecular beam investigations of threshold photoionization spectroscopy had uncovered relevant effects a few years earlier \cite{Scherzer,Alt}, the field of ultracold plasma physics began in earnest with the 1999 experiment of Rolston and coworkers on metastable xenon atoms cooled in a magneto optical trap (MOT) \cite{Killian}   

This work and many subsequent efforts tuned the photoionization energy as a means to form a plasma of very low electron temperature built on a strongly coupled cloud of ultracold ions   Experiment and theory soon established that fast processes associated with disorder-induced heating and longer-time electron-ion collisional rate processes act to elevate the ion temperatures to around one degree Kelvin, and constrain the effective initial electron temperature to a range above 30 K \cite{Kuzmin,Hanson,Laha}   

This apparent limit on the thermal energy of the electrons can be more universally expressed for an expanding plasma by saying that the electron correlation parameter, $\Gamma_e$, does not exceed 0 25, where, 
\begin{equation}
\Gamma_e = \frac{e^2}{4\pi \epsilon_0 a_{ws}}\frac{1}{k_B T_e}
\label{eqn:gamma_e}
\end{equation}
defines the ratio of the average unscreened electron-electron potential energy to the electron kinetic energy   $a_{ws}$ is the Wigner-Seitz radius, related to the electron density by, $\rho_e = 1/(\frac{4}{3} \pi a_{ws}^3)$   These plasmas of weakly coupled electrons and strongly coupled ions have provided an important testing ground for ion transport theory and the study of electron-ion collision physics \cite{Strickler} 

Soon after the initial reports of ultracold plasmas formed by direct photoionization, a parallel effort began with emphasis on the plasma that forms spontaneously by Penning ionization and electron-impact avalanche in a dense ultracold Rydberg gas \cite{Mourachko}   This process affords less apparent control of the initial electron temperature   But, pulsed field-ionization measurements soon established that the photoionized plasma and that formed by the avalanche of a Rydberg gas both evolve to quasi-equilibria of electrons, ions and high-Rydberg neutrals \cite{Rolston_expand,Gallagher}   

Early efforts to understand plasmas formed by Rydberg gas avalanche paid particular attention to the process of initiation   Evolution to plasma in effusive atomic beams was long known for high-Rydberg gases of caesium and well explained by coupled rate equations \cite{Vitrant}   But, low densities and ultracold velocity distributions were thought to exclude Rydberg-Rydberg collisional mechanisms in a MOT   

In work on ultracold Rydberg gases of Rb and Cs, Gallagher, Pillet and coworkers describe the initial growth of electron signal by a model that includes ionization by blackbody radiation and collisions with a background of uncooled Rydberg atoms \cite{Mourachko,Gallagher,Li,Comparat,Tanner}  This picture was subsequently refined to include many-body excitation and autoionization, as well as attractive dipole-dipole interactions \cite{Viteau,Pillet}, later confirmed by experiments at Rice \cite{Mcquillen}   

The Orsay group also studied the effect of adding Rydberg atoms to an established ultracold plasma   They found that electron collisions in this environment completely ionize added atoms, even when selected to have deep binding energies \cite{Vanhaecke}   They concluded from estimates of electron trapping efficiency that the addition of Rydberg atoms does not significantly alter the electron temperature of the plasma   

Tuning pair distributions by varying the wavelength of the excitation laser, Weidem\"uller and coworkers confirmed the mechanical effects of van der Waals interactions on the rates of Penning ionization in ultracold $^{87}$Rb Rydberg gases \cite{Amthor_mech}   They recognized blackbody radiation as a possible means of final-state redistribution, and extended this mechanical picture to include long-range repulsive interactions \cite{Amthor_model}   This group later studied the effects of spatial correlations in the spontaneous avalanche of Rydberg gases in a regime of strong blockade, suggesting a persistence of initial spatial correlations \cite{RobertdeSaintVincent}   

Robicheaux and coworkers have recently investigated the question of prompt many-body ionization from the point of view of Monte Carlo classical trajectory calculations \cite{Goforth}   For atoms on a regular or random grid driven classically by an electromagnetic field, they find that many-body excitation enhances prompt ionization by about twenty percent for densities greater than $5 6 \times 10^{-3}/(n_0^2 a_0)^3$, where $n_0$ is the principal quantum number of the Rydberg gas and $a_0$ is the Bohr radius   They observed that density fluctuations (sampled from the distribution of nearest neighbour distances) have a greater effect, and point to the possible additional influence of secondary electron-Rydberg collisions and the Penning production of fast atoms not considered by the model, but already observed by Raithel and coworkers \cite{Knuffman}   

The Raithel group also found direct evidence for electron collisional $\ell$-mixing in a Rb MOT \cite{Dutta}, and used selective field ionization to monitor evolution to plasma on a microsecond timescale in ultracold $^{85}$Rb $65d$ Rydberg gases with densities as low as $10^8$ cm$^{-3}$ \cite{WalzFlannigan}   Research by our group at UBC has observed very much the same dynamics in the relaxation of Xe Rydberg gases of similar density prepared in a molecular beam \cite{Hung2014}   In both cases, the time evolution to avalanche is well-described by coupled rate equations (see below), assuming an initializing density of Penning electrons determined by Robicheaux's criterion \cite{Robicheaux05}, applied to an Erlang distribution of Rydberg-Rydberg nearest neighbours   

Theoretical investigations of ultracold plasma physics have focused for the most part on the long- and short-time dynamics of plasmas formed by direct photoionization \cite{PhysRept,Lyon}   In addition to studies mentioned above, key insights on the evolution dynamics of Rydberg gases have been provided by studies of Pohl and coworkers exploring the effects of ion correlations and recombination-reionization on the hydrodynamics of plasma expansion \cite{Pohl:2003,PPR}   Further research has drawn upon molecular dynamics (MD) simulations to reformulate rate coefficients for the transitions driven by electron impact between highly excited Rydberg states \cite{PVS}, and describe an effect of strong coupling as it suppresses three-body recombination \cite{Bannasch:2011}   MD simulations confirm the accuracy of coupled rate equation descriptions for systems with $\Gamma$ as large as 0 3   Newer calculations suggest a strong connection between the order created by dipole blockade in Rydberg gases and the most favourable correlated distribution of ions in a corresponding strongly coupled ultracold plasma \cite{Bannasch:2013}   

Tate and coworkers have studied ultracold plasma avalanche and expansion theoretically as well as experimentally   Modelling observed expansion rates, they recently found that $^{85}$Rb atoms in a MOT form plasmas with effective initial electron temperatures determined by initial Rydberg density and the selected initial binding energy, to the extent that these parameters determine the fraction of the excited atoms that ionize by electron impact in the avalanche to plasma \cite{Forest}   This group also returned to the question of added Rydberg atoms, and managed to identify a crossover in $n_0$, depending on the initial electron temperature, that determines whether added Rydberg atoms of a particular initial binding energy act to heat or cool the electron temperature \cite{Crockett}    

Our group has focused on the plasma that evolves from a Rydberg gas under the low-temperature conditions of a skimmed, seeded supersonic molecular beam   In work on nitric oxide starting in 2008 \cite{Morrison2008,Plasma_expan,Morrison_shock,PCCP}, we established an initial kinetics of electron impact avalanche ionization that conforms with coupled rate equation models \cite{Saquet2011,Saquet2012,Scaling,haenelCP} and agrees at early times with the properties of ultracold plasmas that evolve from ultracold atoms in a MOT   We have also observed unique properties of the NO ultracold plasma owing to the fact that its Rydberg states dissociate \cite{Haenel2017}, and identified relaxation pathways that may give rise to quantum effects \cite{SousMBL,SousNJP}   The remainder of this review focuses on the nitric oxide ultracold plasma and the unique characteristics conferred by its evolution from a Rydberg gas in a laser-crossed molecular beam   


\section{Avalanche to strong coupling in a molecular Rydberg gas}

\subsection{The molecular beam ultracold plasma compared with a MOT}

When formed with sufficient density, a Rydberg gas of principal quantum number $n_0>30$ undergoes a spontaneous avalanche to form an ultracold plasma \cite{Li,Morrison2008,RobertdeSaintVincent}   Collisional rate processes combine with ambipolar hydrodynamics to govern the properties of the evolving plasma   For a molecular Rydberg gas, neutral fragmentation, occurs in concert with electron-impact ionization, three-body recombination and electron-Rydberg inelastic scattering   Neutral dissociation combined with radial expansion in a shaped distribution of charged particles, can give rise to striking effects of self-assembly and spatial correlation \cite{Schulz-Weiling2016,Haenel2017}    

The formation of a molecular ultracold plasma requires the conditions of local temperature and density afforded by a high mach-number skimmed supersonic molecular beam   Such a beam propagates at high velocity in the laboratory, with exceedingly well-defined hydrodynamic properties, including a propagation-distance-dependent density and sub-Kelvin temperature in the moving frame \cite{MSW_tutorial}   The low-temperature gas in a supersonic molecular beam differs in three important ways from the atomic gas laser-cooled in a magneto-optical trap (MOT) 

The milli-Kelvin temperature of the gas of ground-state NO molecules entrained in a beam substantially exceeds the sub-100 micro-Kelvin temperature of laser-cooled atoms in a MOT   However, the evolution to plasma tends to erase this distinction, and the two further characteristics that distinguish a beam offer important advantages for ultracold plasma physics:  Charged-particle densities in a molecular beam can exceed those attainable in a MOT by orders of magnitude   A great many different chemical substances can be seeded in a free-jet expansion, and the possibility this affords to form other molecular ultracold plasmas, introduces interesting and potentially important new degrees of freedom governing the dynamics of their evolution 


\subsection{Supersonic molecular beam temperature and particle density}

Seeded in a skimmed supersonic molecular beam, nitric oxide forms different phase-space distributions in the longitudinal (propagation) and transverse coordinate dimensions   As it propagates in $z$, the NO molecules reach a terminal laboratory velocity, $u_{\parallel}$, of about 1400 ${\rm ms^{-1}}$, which varies with the precise seeding ratio   

The distribution of $v_{\parallel}$, narrows to define a local temperature, $T_{\parallel}$, of approximately 0 5 K   The beam forms a Gaussian spatial distribution in the transverse coordinates, $x$ and $y$   In this plane, the local velocity, $v_{\perp}(r)$ is defined for any radial distance almost entirely by the divergence velocity of the beam, $u_{\perp}(r)$   Phase-space sorting cools the temperature in the transverse coordinates, $T_{\perp}$ to a value as low as $\sim 5$ mK \cite{MSW_tutorial}   

The stagnation pressure and seeding ratio determine the local density distribution as a function of $z$   For example, expanding from a stagnation pressure of 500 kPa with a 1:10 seeding ratio, a molecular beam propagates 2 5 cm to a skimmer and then 7 5 cm to a point of laser interaction, where it contains NO at a peak density of $1 6 \times 10^{14}$ cm$^{-3}$   

Here, crossing the molecular beam with a laser beam tuned to the transition sequence, ${\rm X} ~^2 \Pi_{1/2} ~N'' = 1 \xrightarrow{\omega_1} {\rm A} ~^2\Sigma^+ ~N'=0  \xrightarrow{\omega_2} n_0 f(2)$ forms a Gaussian ellipsoidal volume of Rydberg gas in a single selected principal quantum number, $n_0$, orbital angular momentum, $\ell = 3$, NO$^+$ core rotational quantum number, $N^+ = 2$ and total angular momentum neglecting spin, $N=1$   

A typical $\omega_1$ pulse energy of 2 $\mu$J and a Gaussian width of 0 2 mm serves to drive the first step of this sequence in a regime of linear absorption   Overlapping this volume by an $\omega_2$ pulse with sufficient fluence to saturate the second step forms a Rydberg gas ellipsoid with a nominal peak density of $5 \times 10^{12}$ cm$^{-3}$  \cite{Morrison2008,MSW_tutorial}   Fluctuations in the pulse energy and longitudinal mode of $\omega_1$ cause the real density to vary   For certain experiments, we find it convenient to saturate the $\omega_1$ transition, and vary the density of Rydberg gas by delaying $\omega_2$   An $\omega_1$-$\omega_2$ delay, $\Delta t$, reduces the Rydberg gas density by a precise factor, $e^{-\Delta t/\tau}$, where $\tau$ is the 200 ns radiative lifetime of NO ${\rm A} ~^2\Sigma^+ ~N'=0$ \cite{Carter,Hancock} 


\subsection{Penning ionization}

The density distribution of a Rydberg gas defines a local mean nearest neighbour distance, or Wigner-Seitz radius of $ a_{ws} =  \left(3/4 \pi \rho \right)^{1/3} $, where $\rho$ refers to the local Rydberg gas density   For example, a Rydberg gas with a density of $ \rho_0=0 5 \times 10^{12}$ cm$^{-3} $ forms an Erlang distribution \cite{Torquato 1990} of nearest neighbour separations with a mean value of $ 2 a_{ws}=1 6$  $\mu$m   

A semi-classical model \cite{Robicheaux05} suggests that 90 percent of Rydberg molecule pairs separated by a critical distance, $ r_c = 1 8 \cdot 2 n_0^2 a_0 $ or less undergo Penning ionization within 800 Rydberg periods   We can integrate the Erlang distribution from $ r=0 $ to the critical distance $r = r_c$ for a Rydberg gas of given $n_0$, to define the local density of Penning electrons ($ \rho_e$ at $t=0$) produced by this prompt interaction, for any given initial local density, $\rho_0$ by the expression:
\begin{equation}
\rho_e(\rho_0,n_0) = \frac{0 9}{2} \cdot 4 \pi \rho_0 ^2\int_0^{r_{c}} r^2 \mathrm{e}^{-\frac{4\pi}{3}\rho_0 r^3}\mathrm{d}r \quad 
\label{eqn:Erlang}
\end{equation}

Evaluating this definite integral yields an equation in closed form that predicts the Penning electron density for any particular initial Rydberg density and principal quantum number 
\begin{equation}
\rho_e(\rho_0,n_0) =\frac{0 9 \rho_0}{2}(1-\mathrm{e}^{-\frac{4\pi}{3}\rho_0 r_c^3}) \quad 
\label{Eq:PenDens}
\end{equation}
\begin{figure}[h!]
\centering
\includegraphics[scale=0 33]{Penning_Latice pdf}
\caption{Distributions of ion-ion nearest neighbours following Penning ionization and electron-impact avalanche simulated for a predissociating molecular Rydberg gas of initial principal quantum number, $n_0$, from 30 to 80, and density of 10$^{12}$ cm$^{-3}$   Dashed lines mark corresponding values of $a_{ws}$  Calculated by counting ion distances after relaxation to plasma in 10$^6$-particle stochastic simulations  Integrated areas proportional to populations surviving neutral dissociation }
\label{fig:PL}
\end{figure}

Prompt Penning ionization acts on the portion of the initial nearest-neighbour distribution in the Rydberg gas that lies within $r_c$   When a molecule ionizes, its collision partner relaxes to a lower principal quantum number, $n'<n_0/\sqrt{2}$   This close-coupled interaction disrupts the separability of Rydberg orbital configurations in the Penning partner   This causes mixing with core penetrating states that are strongly dissociative   Penning partners are thus very likely to dissociate, leaving a spatially isolated distribution of ions   We refer to the spatial correlation that results as a Penning lattice \cite{Sadeghi:2014}   The extent of this effect varies depending on the local density and the selected initial principal quantum number   Figure \ref{fig:PL} shows the degree to which Rydberg gases with initial principal quantum numbers from 30 to 80 form a Penning lattice for an initial density of $1 \times 10^{12} ~{\rm cm}^{-3}$   

\subsection{Spontaneous electron-impact avalanche}

The electrons produced by prompt Penning ionization start an electron impact avalanche   The kinetics of this process are well described by a set of coupled rate equations that account for state-to-state electron-Rydberg inelastic scattering, electron-impact ionization and three-body ion-electron recombination \cite{PPR,Saquet2011,Saquet2012,Scaling} using detailed rate coefficients,  $k_{ij}$, $k_{i,ion}$ and $k_{i,tbr}$ validated by MD simulations \cite{PVS}   
\begin{eqnarray}
-\frac{d\rho_i}{dt}&=&\sum_{j}{k_{ij}\rho_e\rho_i}-\sum_{j}{k_{ji}\rho_e\rho_j} \nonumber\\
&& +k_{i,ion}\rho_e\rho_i-k_{i,tbr}\rho^3_e 
  \label{level_i}
\end{eqnarray}
\noindent and,
\begin{equation}
\frac{d\rho_e}{dt}=\sum_{i}{k_{i,ion}\rho_e^2}-\sum_{i}{k_{i,tbr}\rho^3_e}
  \label{electron}
\end{equation}

The relaxation of Rydberg molecules balances with collisional ionization to determine an evolving temperature of avalanche electrons to conserve total energy per unit volume  
\begin{equation}
E_{tot}=\frac{3}{2}k_BT_e(t)\rho_e(t)-R\sum_i{\frac{\rho_i(t)}{n_i^2}},
  \label{energy}
\end{equation}
Here, for simplicity, we neglect the longer-time effects of Rydberg predissociation and electron-ion dissociative recombination \cite{Saquet2012} 

Such calculations show that the conversion from Rydberg gas to plasma occurs on a timescale determined largely by the local Penning electron density, or Penning fraction, $P_f = \rho_e/\rho_0$, which depends on the local density of Rydberg molecules and their initial principal quantum number   

Avalanche times predicted by coupled rate equation calculations range widely   For example, in a model developed for experiments on xenon, simulations predict that a Rydberg gas with $n_0 = 42$ at a density of $8 8 \times 10^8 ~{\rm cm}^{-3}$ ($P_f = 6 \times 10^{-5}$) avalanches with a half time of  40 $\mu$s \cite{Hung2014}   At an opposite extreme, rate equations estimate that a Rydberg gas of NO with $n_0=60$ at a density of $1 \times 10^{12} ~{\rm cm}^{-3}$ ($P_f = 0 3$) rises to plasma in about 2 ns \cite{Saquet2012}   

\begin{figure}[h!]
\centering
\includegraphics[width=  49 \textwidth]{SFI_n=49 pdf}
   \caption{Contour plots showing SFI signal as a function the applied field for an $nf(2)$ Rydberg gas with an initial principal quantum number, $n_0=49$   Each frame represents 4,000 SFI traces, sorted by initial Rydberg gas density   Ramp field beginning at 0 and 150 ns (top, left to right), and  300 and 450 ns (bottom) after the $\omega_2$ laser pulse   The two bars of signal most evident at early ramp field delay times represent the field ionization of the $49f(2)$ Rydberg state respectively to NO$^+$ X $^1\Sigma^+$ cation rotational states, $N^+=0$ and 2   The signal waveform extracted near zero applied field represents the growing population of plasma electrons   
   }
\label{fig:SFI}
\end{figure}

Selective field ionization (SFI) probes the spectrum of binding energies in a Rydberg gas   Applied as a function of time after photoexcitation, SFI maps the evolution from a state of selected initial principal quantum number, $n_0$, to plasma \cite{Haenel2017}   Figure \ref{fig:SFI} shows SFI spectra taken at a sequence of delays after the formation of $49f(2)$ Rydberg gases of varying density     

Here, we can see that a $49f(2)$ Rydberg gas with an estimated initial density $\rho_0 = 3 \times 10^{11} ~{\rm cm}^{-3}$ relaxes to plasma on a timescale of about 500 ns   Observations such as these agree well with the predictions of coupled rate-equation calculations   We can understand this variation in relaxation dynamics with $\rho_0$ and $n_0$ quite simply in terms of the corresponding density of prompt Penning electrons these conditions afford to initiate the avalanche to plasma   

Figure \ref{fig:scaled_rise} illustrates this, showing how rise times predicted by coupled rate-equation simulations for a large range of initial densities and principal quantum number match when plotted as a function of time scaled by the ultimate plasma frequency and fraction of prompt Penning electrons   The dashed line gives an approximate account of the scaled rate of avalanche under all conditions of Rydberg gas density and initial principal quantum number in terms of the simple sigmoidal function:

\begin{equation}
\frac{\rho_e}{\rho_0} = \frac{a}{b+e^{-c\tau}},
  \label{scaledEq1}
\end{equation}
where,
\begin{equation}
\tau = t \omega_e P_f^{3/4},
  \label{scaledEq2}
\end{equation}
in which $\omega_e$ is the plasma frequency after avalanche, $P_f$ is the fraction of prompt Penning electrons, and $a = 0 00062$,  $b =   0 00082$ and $c =     0 075$ are empirical coefficients   

\begin{figure}[h!]
\centering
\includegraphics[width=  4 \textwidth]{sim_analytical_density pdf}
   \caption{Rise in fractional electron density as a function of time scaled by the plasma frequency, $\omega_e$ and fraction, $\rho_e(t=0)/\rho_0 = P_f$, of prompt Penning electrons   Simulation results shown for $n_0 = 30$, 50 and 70 with initial densities, $\rho_0 = 10^9,~10^{10},~10^{11},~{\rm and}~10^{12}~{\rm cm}^{-3}$   
   }
\label{fig:scaled_rise}
\end{figure}


\subsection{Evolution to plasma in a Rydberg gas Gaussian ellipsoid}

As outlined above, the local density and principal quantum number together determine the rate at which a Rydberg gas avalanches to plasma   Our experiment crosses a 2 mm wide cylindrically Gaussian molecular beam with a 1 mm diameter TEM$_{00}$ $\omega_1$ laser beam to produce a Gaussian ellipsoidal distribution of molecules excited to the A $^2\Sigma^+$ $v=0, ~N'=0$ intermediate state   A larger diameter $\omega_2$ pulse then drives a second step that forms a Rydberg gas in a single $n_0f(2)$ state with the spatial distribution of the intermediate state   

We model this shaped Rydberg gas as a system of 100 concentric ellipsoidal shells of varying density \cite{haenelCP}   Coupled rate equations within each shell describe the avalanche to plasma   This rate process proceeds from shell to shell with successively longer induction periods, determined by the local density as detailed above   The rising conversion of Rydberg molecules to ions plus neutral dissociation products conserves the particle number in each shell   We assume that local space charge confines electrons to shells, conserving quasi-neutrality   Electrons exchange kinetic energy at the boundaries of each shell, which determines a single plasma electron temperature   

\begin{figure}[h!]
\centering
\includegraphics[width=  5 \textwidth]{shell_model_100}
   \caption{(top frame) Cross-sectional contour diagram in the $x,y$ plane for $z=0$ describing the distribution of ion plus electron density over 100 shells of Gaussian ellipsoid with initial dimensions, $\sigma_x= 0 75$ mm and $\sigma_y= \sigma_z = 0 42$ mm and an initial $n_0 = 50$ Rydberg gas density, $\rho_0 = 2 \times 10^{11}$ cm$^{3}$ after an evolution time of 100 ns   (bottom frame) Curves describing the (dashed) ascending ion and (solid) descending Rydberg gas densities of each shell as functions of evolution time, for $t=20$, 40, 60, 80 and 100 ns   
   }
\label{fig:shell}
\end{figure}

The upper frame of Figure \ref{fig:shell} shows contours of NO$^+$ ion density after 100 ns obtained from a shell-model coupled rate-equation simulation of the avalanche of a Gaussian ellipsoidal Rydberg gas of nitric oxide with a selected initial state, $50f(2)$ and a density of $2 \times 10^{11}$ cm$^{-3}$   Here, we simulate a relaxation that includes channels of predissociation at every Rydberg level and redistributes the energy released to electrons, which determines a uniform rising electron temperature for all shells   

For comparison, the lower frame plots curves describing the ion density of each shell as a function of time from 20 to 100 ns, as determined by applying Eq \ref{scaledEq1} for the local conditions of initial Rydberg gas density   This numerical approximation contains no provision for predissociation   Coupled rate-equation simulations for uniform volumes show that predissociation depresses yield to some degree, but has less effect on the avalanche kinetics \cite{Saquet2012}   Therefore, we can expect sets of numerically estimated shell densities, scaled to agree with the simulated ion density at the elapsed time of 100 ns to provide a reasonable account of the earlier NO$^+$ density profiles as a function of time    


\begin{figure}[h!]
\centering
\includegraphics[width=  4 \textwidth]{Shell_pop}
   \caption{Global population fractions of particles as they evolve in the avalanche of a shell-model ellipsoidal Rydberg gas with the initial principal quantum number and density distribution of Figure \ref{fig:shell}
   }
\label{fig:shell_yields}
\end{figure}

For each time step, the difference, $\rho_0 - \rho_e$ defines the neutral population of each shell   We assign a fraction of this population to surviving Rydberg molecules, such that the total population of NO$^*$ as a function of time agrees with the prediction of the shell-model simulation, as shown in Figure \ref{fig:shell_yields}   We consider the balance of this neutral population to reflect NO$^*$ molecules that have dissociated to form N($^4$S) $+$ O($^3$P)   Figure \ref{fig:shell} plots these surviving Rydberg densities as a function of radial distance for each evolution time   At the initial density of this simulation, note at each time step that a higher density of Rydberg molecules encloses the tail of the ion density distribution in $x$    

\subsection{Plasma expansion and NO$^+$ - NO$^*$ charge exchange as an avenue of quench}

We regard the ions as initially stationary   The release of electrons creates a radial electric potential gradient, which gives rise to a force, $-e\nabla \phi_{k,j}(t)$, that accelerates the ions in shell $j$ in direction $k$ according to \cite{Sadeghi 2012}:

\begin{align}
\frac{-e}{m'}\nabla \phi_{k,j}(t) = & \frac{\partial u_{k,j}(t)}{\partial t} \notag  \\
= & \frac{k_BT_e(t)}{m'\rho_j(t)} \frac{\rho_{j+1}(t) - \rho_j(t)}{r_{k,j+1}(t) - r_{k,j}(t)},
  \label{dr_dt}
\end{align}

\noindent where $\rho_j(t)$ represents the density of ions in shell $j$   

The instantaneous velocity, $u_{k,j}(t)$ determines the change in the radial coordinates of each shell, $r_{k,j}(t)$, 
\begin{equation}
\frac{\partial r_{k,j}(t)}{\partial t}=u_{k,j}(t) = \gamma_{k,j}(t) r_{k,j}(t),
  \label{dr_dt}
\end{equation}
\noindent which in turn determines shell volume and thus its density, $ \rho_j(t)$    
The electron temperature supplies the thermal energy that drives this ambipolar expansion   Ions accelerate and $T_e$ falls according to: 

\begin{equation}
\frac{3k_B}{2}\frac{\partial T_e(t)}{\partial t}= -\frac{m'}{\sum_{j}{N_j}}\sum_{k,j}{N_j u_{k,j}(t)\frac{\partial u_{k,j}(t)}{\partial t}},
  \label{dr_dt}
\end{equation}
\noindent where we define an effective ion mass, $m'$, that recognizes the redistribution of the electron expansion force over all the NO$^+$ charge centres by resonant ion-Rydberg charge exchange, which occurs with a very large cross section \cite{PPR}   
\begin{equation}
m' =\left (1+ \frac{\rho^*_{j}(t)}{ \rho_j(t)}\right) m ,
  \label{dr_dt}
\end{equation}
\noindent in which $\rho^*_{j}(t)$ represents the instantaneous Rydberg density in shell $j$ 

The initial avalanche in the high-density core of the ellipsoid leaves few Rydberg molecules, so this term has little initial effect   Rydberg molecules predominate in the lower-density wings   There, momentum sharing by charge exchange assumes a greater importance   

We see this most directly in the $\omega_2$ absorption spectrum of transitions to states in the $n_0 f(2)$ Rydberg series, detected as the long-lived signal that survives a flight time of 400 $\mu$s to reach the imaging detector   The balance between the rising density of ions and the falling density of Rydberg molecules depends on the initial density of electrons produced by prompt Penning ionization   As clear from Eq \ref{Eq:PenDens}, this Penning fraction depends sensitively on the principal quantum number, and for all principal quantum numbers, on the initial Rydberg gas density   

\begin{figure}[h!]
\centering
\includegraphics[width=  4 \textwidth]{w2_spectra}
   \caption{Double-resonant spectra of nitric oxide Rydberg states in the $nf$ series converging to NO$^+$ $v=0$, $N^+=2$ (designated, $nf(2)$), derived from the late-peak signal obtained after a flight time of 400 $\mu$s by scanning $\omega_2$ for $\omega_1$ tuned to NO A $^2\Sigma^+$ $v=0$, $N'=0$ for initial $nf(2)$ densities from top to bottom of 0 07, 0 10, 0 13, 0 19, 0 27, 0 30, 0 32 and $3 \times 10^{12}$ cm$^{3}$   
  }
\label{fig:w2_spectra}
\end{figure}

Figure \ref{fig:w2_spectra} shows a series of $\omega_2$ late-signal excitation spectra for a set of initial densities   Here, we see a clear consequence of the higher-order dependence of Penning fraction - and thus the NO$^+$ ion - NO$^*$ Rydberg molecule balance - on $n_0$, the $\omega_2$-selected Rydberg gas initial principal quantum number   This Penning-regulated NO$^+$ ion - NO$^*$ Rydberg molecule balance appears necessary as a critical factor in achieving the long ultracold plasma lifetime required to produce this signal   We are progressing in theoretical work that explains the stability apparently conferred by this balance   


\subsection{Bifurcation and arrested relaxation}

Ambipolar expansion quenches electron kinetic energy as the initially formed plasma expands   Core ions follow electrons into the wings of the Rydberg gas   There, recurring charge exchange between NO$^+$ ions and NO$^*$ Rydberg molecules redistributes the ambipolar force of the expanding electron gas, equalizing ion and Rydberg velocities   This momentum matching effectively channels electron energy through ion motion into the overall $\pm x$ motion of gas volumes in the laboratory   The internal kinetic energy of the plasma, which at this point is defined almost entirely by the ion-Rydberg relative motion, falls   Spatial correlation develops, and over a period of 500 ns, the system forms the plasma/high-Rydberg quasi-equilibrium dramatically evidenced by the SFI results in Figure \ref{fig:SFI}   

\begin{figure}[h!]
\centering
\includegraphics[width=  4 \textwidth]{Bifurcation pdf}
   \caption{$x,y$ detector images of ultracold plasma volumes produced by 2:1 aspect ratio ellipsoidal Rydberg gases with selected initial state, $40f(2)$ after a flight time of 402 $\mu$s over a distance of 575 mm   Lower frame displays the distribution in $x$ of the charge integrated in $y$ and $z$   Both images represent the unadjusted raw signal acquired in each case after 250 shots   
   }
\label{fig:bifurcation}
\end{figure}

In the wings, momentum redistribution owing to cycles of ion-Rydberg charge transfer retards radial expansion \cite{Pohl2003,PPR}   By redirecting electron energy from ambipolar acceleration to $\pm x$ plasma motion, NO$^+$ to NO$^*$ charge exchange dissipates electron thermal energy   This redistribution of energy released in the avalanche of the Rydberg gas to plasma, causes the ellipsoidal Rydberg gas to bifurcate \cite{Schulz-Weiling2016,Haenel2017}, forming very long-lived, separating charged-particle distributions   We capture the electron signal from these recoiling volumes on an imaging detector as pictured in Figure \ref{fig:bifurcation}   Here, momentum matching preserves density and enables ions and Rydberg molecules to relax to positions that minimize potential energy, building spatial correlation   

The semi-classical description of avalanche and relaxation outlined above forms an important point of reference from which to interpret our experimental observations   The laser crossed molecular beam illumination geometry creates a Rydberg gas with a distinctively shaped high-density spatial distribution   This initial condition has an evident effect on the evolution dynamics   We have developed semi-classical models that explicitly consider the coupled rate and hydrodynamic processes governing the evolution from Rydberg gas to plasma using a realistic, ellipsoidal representation of the ion/electron and Rydberg densities \cite{haenelCP}   No combination of initial conditions can produce a simulation that conforms classically with the state of arrested relaxation we observe experimentally  


\subsection{A molecular ultracold plasma state of arrested relaxation}

Thus, we find that spontaneous avalanche to plasma splits the core of an ellipsoidal Rydberg gas of nitric oxide  As ambipolar expansion quenches the electron temperature of this core plasma, long-range, resonant charge transfer from ballistic ions to frozen Rydberg molecules in the wings of the ellipsoid quenches the ion-Rydberg molecule relative velocity distribution  This sequence of steps gives rise to a remarkable mechanics of self-assembly, in which the kinetic energy of initially formed hot electrons and ions drives an observed separation of plasma volumes  These dynamics redistribute ion momentum, efficiently channeling electron energy into a reservoir of mass-transport  This starts a process that evidently anneals separating volumes to a state of cold, correlated ions, electrons and Rydberg molecules  

We have devised a three-dimensional spin model to describe this arrested state of the ultracold plasma in terms of two, three and four-level dipole-dipole energy transfer interactions (spin flip-flops), together with Ising interactions that arise from the concerted pairwise coupling of resonant pairs of dipoles \cite{SousMBL,SousNJP}   

The Hamiltonian includes the effects of onsite disorder owing to the broad spectrum of states populated in the ensemble and the unique electrostatic environment of every dipole   Extending ideas developed for simpler systems \cite{Burin1,Sondhi}, one can make a case for slow dynamics, including an arrest in the relaxation of NO Rydberg molecules to predissociating states of lower principal quantum number 

Systems of higher dimension ought to thermalize by energy transfer that spreads from rare but inevitable ergodic volumes (Griffiths regions) \cite{Sarang2, Roeck_griffith, RareRegions_rev, Thermal_inclusions}   However, a feature in the self-assembly of the molecular ultracold plasma may preclude destabilization by rare thermal domains:  Whenever the quenched plasma develops a delocalizing Griffiths region, the local predissociation of relaxing NO molecules promptly proceeds to deplete that region to a void of no consequence 

In summary, the classical dynamics of avalanche and bifurcation appear to create a quenched condition of low temperature and high disorder in which dipole-dipole interactions drive self-assembly to a localized state purified by the predissociation of thermal regions   We suggest that this state of the quenched ultracold plasma offers an experimental platform for studying quantum many-body physics of disordered systems  \\

\section{Acknowledgments}
This work was supported by the US Air Force Office of Scientific Research (Grant No  FA9550-17-1-0343), together with the Natural Sciences and Engineering research Council of Canada (NSERC), the Canada Foundation for Innovation (CFI) and the British Columbia Knowledge Development Fund (BCKDF)  


Context 2: \section{Introduction\label{sct::intro}}
Symmetric, public-key (asymmetric) and hash-based cryptography constitute a fundamental pillar of modern cryptography  
Symmetric cryptography includes symmetric-key encryption, where a shared secret key is used for both encryption and decryption  Cryptographic hash functions map arbitrarily long strings to strings of a fixed finite length  Currently deployed public-key schemes are
used to establish a common secret key between two remote parties  They are based on factoring large numbers or solving the discrete logarithm problem over a finite group  For more details about modern cryptography the interested reader can consult one of the many excellent references on the topic, e g ~\cite{Katz:2007:IMC:1206501} 

In contrast to asymmetric schemes based on factoring or solving the discrete logarithm problem and which are completely broken by a quantum adversary via Shor's algorithm~\cite{SJC 26 1484}, symmetric schemes and hash functions are less vulnerable to quantum attacks  The best known quantum attacks against them are based on Grover's quantum search algorithm~\cite{PhysRevLett 79 325}, which offers a quadratic speedup compared to classical brute force searching  Given a search space of size $N$, Grover's algorithm finds, with high probability, an element $x$ for which a certain property such as $f(x)=1$ holds, for some function $f$ we know how to evaluate (assuming such a solution exists)  The algorithm evaluates $f$ a total of $\mathcal{O}(\sqrt{N})$ times  It applies a simple operation in between the evaluations of $f$, so the $\mathcal{O}(\sqrt{N})$ evaluations of $f$ account for most of the complexity  In contrast, any classical algorithm that evaluates $f$ in a similar ``black-box'' way requires on the order of $N$ evaluations of $f$ to find such an element 

Any quantum algorithm can be mapped to a quantum circuit, which can be implemented on a quantum computer  The quantum circuit represents what we call the ``logical layer"  Such a circuit can always be decomposed in a sequence of ``elementary 
gates", such as Clifford gates (CNOT, Hadamard etc ~\cite{NC00}) augmented by a non-Clifford gate such as the T gate 

Running a logical circuit on a full fault-tolerant quantum computer is highly non-trivial  The sequence of logical gates have to be mapped to 
sequences of surface code measurement cycles (see e g ~\cite{PhysRevA 86 032324} for extensive details)  By far, the most resource-consuming (in 
terms of number of qubits required and time) is the T gate\footnote{Clifford gates are ``cheap", i e  they require relatively small overhead for implementation in the surface code, but are not universals, hence a non-Clifford gate is required  One such gate is the T gate  There are other possible choices, however all of the non-Clifford gates require special techniques such as magic state distillation~\cite{1367-2630-14-12-123011,PhysRevA 86 052329} and significant overhead (order of magnitudes higher than Clifford gates) to be implemented in the surface code  In fact, to a first order approximation, for the purpose of resource estimation, one can simply ignore the overhead introduced by the Clifford gates and simply focus only on the T gates }  
In comparison with surface code defects and braiding techniques~\cite{PhysRevA 86 032324}, novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} reduce the spatial overhead required for implementing T gates via magic state distillation by approximately a factor of 5, while also modestly improving the running time  

In this paper we first analyze the security of symmetric schemes and hash functions against large-scale fault-tolerant quantum adversaries, using surface code defects and braiding techniques  We take into account the time-space trade-offs with parallelizing quantum search, down to the fault-tolerant layer  Naively, one might hope that $K$ quantum computers (or quantum ``processors'', as we will call them later in the paper) running in parallel reduce the number the circuit depth down to $\mathcal{O}(\sqrt{N})/K$ steps, similar to the classical case of distributing a search space across $K$ classical processors  However quantum searching does not parallelize so well, and the required number of steps
for parallel quantum searching is of the order $\mathcal{O}(\sqrt{N/K})$~\cite{quantph 9711070}  This is a factor of $\sqrt{K}$ larger than $\mathcal{O}(\sqrt{N})/K$   As shown in~\cite{quantph 9711070}, the optimal way of doing parallel quantum search is to partition the search space into $N/K$ parts, and to perform independent quantum searches on each part 

Secondly, we investigate the security of public-key cryptographic schemes such as RSA and ECC against 
quantum attacks, using the latest developments in theory of fault-tolerant quantum error correction, i e  novel lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} 

The remainder of this paper is organized as follows  In Sec ~\ref{sct::method}, we provide an overview of the methodology used in our analysis  In Sec ~\ref{sct::ciphers} we investigate the security of the AES family of modern symmetric ciphers  In Sec ~\ref{sct::hash} we analyze the security of the SHA family of hash functions  In Sec ~\ref{sct::bitcoin} we investigate the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work consensus mechanism  We conclude our investigation of symmetric and hash-based cryptographic schemes in Sec ~\ref{sct::intrinsic_parallel_grover}, where we evaluate the intrinsic cost of running the Grover algorithm with a trivial oracle (i e , an oracle with a unit cost of 1 for each invocation) 

In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  In the subsequent sections  we analyze public-key cryptographic schemes  In Sec ~\ref{sct::rsa} and Sec ~\ref{sct::ecc} we examine the most common public-key establishment schemes, such as RSA and ECC, respectively  Finally we summarize our findings and conclude in Sec ~\ref{sct::conclusion} 
\section{Methodology\label{sct::method}}

\subsection{Symmetric cryptography and hash functions\label{sct::symmetric}}
The methodology, sketched in Fig ~\ref{fgr:flowchart_lite} and Fig ~\ref{fgr:full_algorithm}, follows the same lines as the one described in great detail in our earlier paper~\cite{10 1007/978-3-319-69453-5_18}, which we refer the interested reader to for more details 
\begin{figure}[htb]
	\centering
         \includegraphics[width=0 35\textwidth]{figures/flowchart_lite pdf}
         \caption{Analyzing an attack against a symmetric cryptographic function with a fault-tolerant quantum adversary  Our resource estimation methodology takes into account several of the layers between the high level description of an algorithm and the physical hardware required for its execution  Our approach is modular should assumptions about any of these layers change, and hence it allows one to calculate the impact of improvements in any particular layer }
         \label{fgr:flowchart_lite}
\end{figure}
\begin{figure}
	\centering
	 \includegraphics[width=0 46\textwidth]{figures/grover_vertical pdf}
          \caption{Grover searching with an oracle for $f : \{0,1\}^k \rightarrow \{0,1\}^k$  The algorithm makes $\lfloor \frac{\pi}{4} 2^{N/2}\rfloor$ calls to
$G$, the \emph{Grover iteration}, or, if parallelized on $K$ processors, $\lfloor \frac{\pi}{4} 2^{N/(2K)}\rfloor$ calls to $G$  The Grover iteration has two
subroutines  The first, $U_g$, implements the predicate $g : \{0,1\}^k
\rightarrow \{0,1\}$ that maps $x$ to $1$ if and only if $f(x) = y$  Each call to $U_g$ involves two calls to a reversible implementation of $f$ and one call to a comparison circuit that checks whether $f(x) = y$ }
          \label{fgr:full_algorithm}
\end{figure}

We assume a surface-code based fault-tolerant architecture~\cite{PhysRevA 86 032324}, using Reed-Muller distillation schemes~\cite{Fowler:2013aa}  For each scheme we vary the possible physical error rates per gate from $10^{-4}$ to $10^{-7}$  We believe that this range of physical error rates is wide enough to cover both first generation quantum computers as well as more advanced future machines 
In comparison to surface code defects and braiding methods~\cite{PhysRevA 86 032324}, lattice surgery 
techniques~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} mostly impact the physical footprint of the fault-tolerant layer required to run a specific quantum algorithm, reducing the distillation overhead by approximately a factor of 5  The temporal overhead (i e  the number of surface code cycles) is reduced less drastically  For this reason, lattice surgery has less significant effects in estimating the security of symmetric schemes or hash functions, reducing the security parameter\footnote{The security parameter is defined as the logarithm base two of the number of fundamental operations (in our case surface code cycles) required to break the scheme } by at most 1 and decreasing the spatial overhead by at most a factor of 5  Therefore when estimating the security of symmetric and hash-based cryptographic schemes we use surface code defects and braiding techniques 

For each cryptographic primitive, we display four plots, in the following order:
\begin{enumerate}
\item We plot the total number of surface code cycles per CPU (where a CPU is a quantum computer capable of executing a single instance of Grover's quantum search algorithm) as a function of the number of CPUs  We directly tie the quantum security parameter to the total number of surface code cycles (see~\cite{10 1007/978-3-319-69453-5_18} for more details)  We also add to the plot the theoretical lower bound achievable by quantum search in the cases of: a) considering the oracle a black box of unit cost (lower line), and b) considering the oracle as composed of ideal quantum gates, each of unit cost (upper line)  Note that the difference between b) and a) represents the intrinsic cost of logical overhead (i e  the overhead introduced by treating the oracle as a logical circuit and not a blackbox), whereas the difference between the upper lines and b) represents the intrinsic cost introduced by the fault-tolerant layer 

\item We plot the total wall-time per CPU (i e  how long will the whole computation take on a parallel quantum architecture) as a function of the number of CPUs  The horizontal dashed line represents the one-year time line, i e  the $x$ coordinate of the intersection point between the ``Total time per CPU'' line and the one-year time line provides the number of processors required to break the system within one year (in $\log_2$ units) 

\item We plot the total physical footprint (number of qubits) per CPU, as a function of the number of CPUs 
\item Finally we plot the total physical footprint (number of qubits) of all quantum search machines (CPUs) running in parallel 
\end{enumerate}

In the following sections we proceed to analyze symmetric ciphers (AES, Sec ~\ref{sct::ciphers}), hash functions (SHA-256, SHA3-256, Sec ~\ref{sct::hash}, Bitcoin's hash function, Sec ~\ref{sct::bitcoin}), and finally the minimal resources required for running Grover's algorithm with a trivial oracle~\ref{sct::intrinsic_parallel_grover} (e g  the identity gate) on search spaces of various sizes 

Note that in some ranges of the plots from sections~\ref{sct::ciphers},~\ref{sct::hash},~\ref{sct::intrinsic_parallel_grover} and~\ref{sct::bitcoin} the total physical footprint increases slightly with the number of processors, which may seem counter-intuitive  This happens due to the fact that with more processors the required code distances decrease, and in some instances one can pipeline more magic states factories in parallel into the surface code, which in effect causes an increase in the overall physical footprint  Note that the total time per CPU is monotonically decreasing, as parallelizing distilleries does not increase the wall time  For more details see~\cite{10 1007/978-3-319-69453-5_18}  

\subsection{Public-key cryptography\label{sct::pk}}

Most of the recent progress in quantum cryptanalysis is related to the fault-tolerant layer in Fig ~\ref{fgr:flowchart_lite}  New methods and techniques
based on surface code lattice surgery~\cite{2018arXiv180806709F,1808 02892,1367-2630-14-12-123011} allow a significant decrease of the overall 
footprint (number of qubits, or space) taken by the quantum computation, and also a relatively modest decrease in time, in comparison with  methods based on surface code defects and braiding~\cite{PhysRevA 86 032324,Fowler:2013aa} 

We consider the best up-to-date optimized logical quantum circuits for attacking RSA and ECC public-key 
schemes~\cite{1706 06752,PhysRevA 52 3457,cuccaro04,Beauregard:2003:CSA:2011517 2011525} then perform a physical footprint resource estimation
analysis using lattice surgery techniques  We remark that the overall time required to run the algorithm depends on the level of parallelization 
for the magic state factories\footnote{Every T gate in the circuit must be implemented by a specialized magic state factory, each of which occupies a 
significant physical footprint  One can implement more magic states in parallel if one is willing to increase the physical footprint of the computation }  

For each public-key cryptogrpric scheme, we analyze the space/time tradeoffs and plot the results on a double logarithmic scale  We fit the data using a third degree 
polynomial\footnote{A third degree polynomial fits the data very precisely, providing a coefficient of determination $R^2$ greater than 0 997 } and obtain an analytical closed-form formula for the relation between the time and the number of qubits required to attack the scheme, in 
the form

\begin{equation}\label{eqn1}
y(x) = \alpha x^3 + \beta x^2 + \gamma x + \delta,
\end{equation}
where $y$ represents logarithm base 2 of the number of qubits and $x$ represents the logarithm base 2 of the time (in seconds)  For example,
the quantity 
\begin{equation}\label{eqn2}
y\left(\log_2(24\times 3600)\right) \approx y(16 3987)
\end{equation}
represents how many qubits are required to break the scheme in one day (24 hours) for a fixed physical error rate per gate $p_g$, assuming a 
surface code cycle time of 200ns  Note that the computation time scales linearly with the surface code cycle time, e g  a 1000ns surface code cycle 
time will result in a computation that is 5 times longer than a $200ns$ surface code cycle time  Therefore, for a specific cryptographic scheme for 
which we plotted the space/time tradeoffs using a surface code cycle time of $200ns$ and a fixed physical error rate per gate $p_g$, the number of 
qubits required to break a specific scheme in a time $t$ using an alternative surface code cycle time $t_c$ is given by

\begin{equation}\label{eqn3}
y\left(\log_2\left(\frac{200ns}{t_c}t\right)\right),
\end{equation}
where $t$ is expressed in seconds and $t_c$ is expressed in nanoseconds 

We assume a surface code cycle time of 200ns, in conformance with~\cite{PhysRevA 86 032324}  For each scheme we analyze, we compare its security using the more conservative (and realistic in the short term) $p_g=10^{-3}$ and also the more optimistic  $p_g=10^{-5}$  Note that assuming the more optimistic assumption from a quantum computing perspective is the more conservative assumption from a cybersecurity perspective 

Furthermore, in this analysis, we are reporting the full physical footprint, including the memory required for magic state distillation 
Using present-day techniques, the memory required for generating these generic input states accounts for a substantial fraction of the total memory cost and thus we are including these in the total cost estimate and will track the impact of improved methods 

\section{Symmetric ciphers\label{sct::ciphers}}
Below we analyze the security of AES family of symmetric ciphers against large-scale fault-tolerant quantum adversaries  We used the highly optimized logical circuits produced in
\cite{10 1007/978-3-319-29360-8_3}  

\subsection{AES-128}

        \includegraphics[width=0 429\textwidth]{figures/AES-128_cycles pdf}
      	\captionof{figure}{AES-128 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale)  The bottom brown line (theoretical lower bound, black box) represents the minimal number of queries required
	by Grover's algorithm, the cost function being the total number of queries to a black-box oracle, each query assumed to have unit cost, and a completely error-free circuit  The purple line (ideal grover, non-black-box) takes into consideration the structure of the oracle, the cost function being the total number of gates in the circuit, each gate having unit cost; the quantum circuit is assumed error-free as well  Both brown and magenta lines are displayed only for comparisons; for both of them, the $y$ axis should be interpreted as number of logical queries (operations, respectively) 	
The curves above the purple line show the overhead introduced by fault tolerance (in terms of required surface code cycles, each surface code cycle assumed to have unit cost)  More optimization at the logical layer will shift the purple line down, whereas more optimization at the fault-tolerant layer will move the upper curves closer to the purple line  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_cycles}
	
	For example, the plots in Fig ~\ref{fgr:aes_128_cycles} tells us that if we have $2^{50}$ quantum computers running Grover's algorithm in parallel, with no physical errors, then it would take about $2^{63}$ gate calls (where the purple line intersects the vertical line at $50$), where we assume each gate to have unit cost  Still with no errors, a trivial cost for implementing the cryptographic function (oracle) would bring the cost down to about $2^{38}$ oracle calls per quantum computer  Keeping the actual function implementation, but adding the fault-tolerant layer with a physical error rate of $10^{-7}$ (with appropriate assumptions and using state-of-the-art quantum error correction) pushes the cost up to around $2^{76}$ surface code cycles per quantum computer (where now each code cycle is assumed to have unit cost)  Similar remarks hold for the remaining plots in this manuscript 
        \includegraphics[width=0 429\textwidth]{figures/AES-128_time pdf}
      	\captionof{figure}{AES-128 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The horizontal dotted line indicates one year  The $x$-axis is deliberately extended to show the necessary number of CPUs for a total time of one year  Thus the figure shows that it would take, with the stated assumptions, over $2^{80}$ parallel quantum searches to break AES-128 in a year  Similar remarks to the above hold for the remaining plots in this manuscript }
      	\label{fgr:aes_128_time}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys pdf}
	\captionof{figure}{AES-128 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/AES-128_phys_total pdf}
	\captionof{figure}{AES-128 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_128_phys_total}

\subsection{AES-192}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_cycles pdf}
      	\captionof{figure}{AES-192 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_time pdf}
      	\captionof{figure}{AES-192 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys pdf}
	\captionof{figure}{AES-192 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_192_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-192_phys_total pdf}
	\captionof{figure}{AES-192 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_192_phys_total}


\subsection{AES-256}

	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_cycles pdf}
      	\captionof{figure}{AES-256 block cipher  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_cycles}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_time pdf}
      	\captionof{figure}{AES-256 block cipher  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_time}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys pdf}
	\captionof{figure}{AES-256 block cipher  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:aes_256_phys}
	
        \includegraphics[width=0 429\textwidth]{figures/AES-256_phys_total pdf}
	\captionof{figure}{AES-256 block cipher  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:aes_256_phys_total}

\section{Hash functions\label{sct::hash}}
In this section we study the effect of parallelized Grover attacks on the SHA-256~\cite{SHA2} snd SHA3-256~\cite{SHA3} family of hash functions  We used the highly optimized logical circuits produced in~\cite{10 1007/978-3-319-69453-5_18} 

\subsection{SHA-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA-256_cycles pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_time pdf}
      	\captionof{figure}{SHA-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256_phys_total pdf}
	\captionof{figure}{SHA-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_phys_total}


\subsection{SHA3-256}

        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_cycles pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_time pdf}
      	\captionof{figure}{SHA3-256 cryptographic hash function  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha3_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA3-256_phys_total pdf}
	\captionof{figure}{SHA3-256 cryptographic hash function  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha3_256_phys_total}
\section{Bitcoin~\label{sct::bitcoin}}
In this section we analyze the security of Bitcoin's~\cite{satoshi:bitcoin} proof-of-work protocol, which is based on finding a hash\footnote{The hash function being used by the protocol is H($x$) := SHA-256(SHA-256($x$) } pre-image which that starts
with a certain number of zeros  The latter is dynamically adjusted by the protocol so that the problem is on average solved by
the whole network in 10 minutes  Currently, it takes around $2^{75}$ classical hashing operations~\cite{btc_difficulty} for finding a desired hash pre-image successfully via brute-force search with specialized hardware 
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_cycles pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_cycles}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_time pdf}
      	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_time}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:sha_256_bitcoin_phys}
        \includegraphics[width=0 429\textwidth]{figures/SHA-256-Bitcoin_phys_total pdf}
	\captionof{figure}{Bitcoin's cryptographic hash function H($x$) := SHA-256(SHA-256($x$))  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:sha_256_bitcoin_phys_total}


\section{Intrinsic cost of parallelized Grover's algorithm\label{sct::intrinsic_parallel_grover}}

More efficient quantum implementations of AES and SHA imply more efficient cryptanalysis  In this section, we aim to bound how much further optimized implementations of these cryptographic functions could help  We do so by assuming a trivial cost of $1$ for each function evaluation 

\subsection{Searching space of size $2^{56}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale)  The dotted horizontal line indicates one year  }
      	\label{fgr:minimal_grover_56_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_56_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover56bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{56}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_56_phys_total}

\subsection{Searching space of size $2^{64}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_64_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover64bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{64}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_64_phys_total}

\subsection{Searching space of size $2^{128}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_time pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_128_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover128bits_phys_total pdf}
	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{128}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_128_phys_total}


\subsection{Searching space of size $2^{256}$}

        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_cycles pdf}
      	\captionof{figure}{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required surface clock cycles per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_cycles}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_time pdf}
      	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Required time per processor, as a function of the  number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_time}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Physical footprint (physical qubits) per processor, as a function of the number of processors ($\log_2$ scale) }
      	\label{fgr:minimal_grover_256_phys}
        \includegraphics[width=0 429\textwidth]{figures/MinimalGrover256bits_phys_total pdf}
	\caption{Running Grover's algorithm with a trivial oracle, for a searching space of size $2^{256}$  Total physical footprint (physical qubits), as a function of the number of processors ($\log_2$ scale)  Note that the qubits are not correlated across processors }
      	\label{fgr:minimal_grover_256_phys_total}


\section{RSA schemes\label{sct::rsa}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on factoring large numbers, 
namely RSA-1024, RSA-2048, RSA-3072, RSA-4096, RSA-7680 and RSA-15360 
For each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively 

\subsection{RSA-1024}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 01\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $5 86\times 10^{13}$  The quantity $R^2$ represents the coefficient of determination (closer to 1, better the fitting)  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024a} 

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA1024 png}
\captionof{figure}{RSA-1024 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 14\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 01\times 10^{11}$, the corresponding number of logical qubits is 2050, and the total number of surface code cycles is $2 93\times 10^{13}$  The classical security parameter is approximately 80 bits }
\label{fgr:rsa1024b}


\subsection{RSA-2048}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 72\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $4 69\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048a}



\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA2048 png}
\captionof{figure}{RSA-2048 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 9 78\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 41\times 10^{12}$, the corresponding number of logical qubits is 4098, and the total number of surface code cycles is $2 35\times 10^{14}$  The classical security parameter is approximately 112 bits }
\label{fgr:rsa2048b}


\subsection{RSA-3072}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 41\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $1 58\times 10^{15}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA3072 png}
\captionof{figure}{RSA-3072 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 55\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 12\times 10^{12}$, the corresponding number of logical qubits is 6146, and the total number of surface code cycles is $7 91\times 10^{14}$  The classical security parameter is approximately 128 bits }
\label{fgr:rsa3072b}


\subsection{RSA-4096}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 18\times 10^9$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $3 75\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA4096 png}
\captionof{figure}{RSA-4096 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 5 70\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 92\times 10^{13}$, the corresponding number of logical qubits is 8194, and the total number of surface code cycles is $1 88\times 10^{15}$  The classical security parameter is approximatively approximately 156 bits }
\label{fgr:rsa4096b}


\subsection{RSA-7680}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 70\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 64\times 10^{16}$  The classical security parameter is approximately 192 bits }
\label{fgr:rsa7680a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA7680 png}
\captionof{figure}{RSA-7680 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 41\times 10^{9}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 27\times 10^{14}$, the corresponding number of logical qubits is 15362, and the total number of surface code cycles is $2 47\times 10^{16}$  The classical security parameter is approximately 192 bits }
\label{fgr:rsa7680b}


\subsection{RSA-15360}

\includegraphics[width=0 475\textwidth]{figures/10minus3/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 85\times 10^{12}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $2 24\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/RSA15360 png}
\captionof{figure}{RSA-15360 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 7 64\times 10^{10}$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $1 01\times 10^{15}$, the corresponding number of logical qubits is 30722, and the total number of surface code cycles is $1 98\times 10^{17}$  The classical security parameter is approximately 256 bits }
\label{fgr:rsa15360b}


\section{Elliptic curve schemes\label{sct::ecc}}
In the following section we compute the space/time tradeoffs for attacking public-key cryptographic schemes based on solving the discrete logarithm 
problem in finite groups generated over elliptic curves, namely NIST P-160, NIST P-192, NIST P-224, NIST P-256, NIST P-384 and NIST P-521  For 
each scheme, we plot the space/time tradeoff points then fit it with a third degree polynomial, for $p_g=10^{-3}$ and $p_g=10^{-5}$, respectively  We 
used the logical circuits from~\cite{1706 06752} 

\subsection{NIST P-160}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 81\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $4 05\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P160 png}
\captionof{figure}{NIST P-160 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 38\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $2 08\times 10^{11}$, the corresponding number of logical qubits is 1466, and the total number of surface code cycles is $2 03\times 10^{13}$  The classical security parameter is 80 bits }
\label{fgr:p160b}


\subsection{NIST P-192}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 37\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $7 23\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P192 png}
\captionof{figure}{NIST P-192 space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 18\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 71\times 10^{11}$, the corresponding number of logical qubits is 1754, and the total number of surface code cycles is $3 62\times 10^{13}$  The classical security parameter is 96 bits }
\label{fgr:p192b}


\subsection{NIST P-224}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 91\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $1 15\times 10^{14}$  The classical security parameter is 112 bits }
\label{fgr:p224a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P224 png}
\captionof{figure}{NIST P-224 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 3 24\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $5 90\times 10^{11}$, the corresponding number of logical qubits is 2042, and the total number of surface code cycles is $5 75\times 10^{13}$  The classical security parameter is 112 bits }
\label{fgr:p224b}


\subsection{NIST P-256}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 77\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $1 72\times 10^{14}$  The classical security parameter is 128 bits }
\label{fgr:p256a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P256 png}
\captionof{figure}{NIST P-256 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 4 64\times 10^6$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $8 82\times 10^{11}$, the corresponding number of logical qubits is 2330, and the total number of surface code cycles is $8 60\times 10^{13}$  The classical security parameter is 128 bits }
\label{fgr:p256b}


\subsection{NIST P-384}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 27\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $6 17\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P384 png}
\captionof{figure}{NIST P-384 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 1 28\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $3 16\times 10^{12}$, the corresponding number of logical qubits is 3484, and the total number of surface code cycles is $3 08\times 10^{14}$  The classical security parameter is 192 bits }
\label{fgr:p384b}

\subsection{NIST P-521}

\includegraphics[width=0 475\textwidth]{figures/10minus3/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-3}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 6 06\times 10^8$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $1 56\times 10^{15}$  The classical security parameter is 256 bits }
\label{fgr:p521a}

\includegraphics[width=0 475\textwidth]{figures/10minus5/P521 png}
\captionof{figure}{NIST P-521 elliptic curve space/time tradeoffs with physical error rate per gate $p_g=10^{-5}$  The scale is logarithmic (base 2)  Approximately $y(16 3987) \approx 2 30\times 10^7$ physical qubits are required to break the scheme in one day (24 hours)  The number of T gates in the circuit is $7 98\times 10^{12}$, the corresponding number of logical qubits is 4719, and the total number of surface code cycles is $7 78\times 10^{14}$  The classical security parameter is 256 bits }
\label{fgr:p521b}




\section{Summary and conclusions}\label{sct::conclusion}
We analyzed the security of several widely used symmetric ciphers and hash functions against parallelized quantum adversaries  We computed the security parameter, wall-time and physical footprint for each cryptographic primitive  Our attack model was based on a brute force searching via a parallelized version of Grover's algorithm, assuming a surface-code fault-tolerant architecture based on defects and braiding techniques 

It is worth noting that throughout we are assuming that brute-force search where we treat the cryptographic function as a black-box is essentially the optimal attack against SHA and AES, which is currently believed to be the case 

Some symmetric key algorithms are susceptible in a model that permits ``superposition attacks''~\cite{quantph 1602 05973}  In most realistic instances, these attacks are not practical, however they do shed light on the limitations of certain security proof methods in a quantum context, and remind us that we shouldn't take for granted that non-trivial attacks on symmetric key cryptography may be possible 
For example, very recently, there have been several cryptanalysis results~\cite{1712 06239} and~\cite{1802 03856} that attempt to reduce breaking some symmetric algorithms to solving a system of non-linear equations   Solving these non-linear equations is then attacked using a modified version of the quantum linear equation solver algorithm~\cite{PhysRevLett 103 150502}  The results are heavily dependent on the condition number of the non-linear system, which turns to be hard to compute (it is not known for most ciphers and hash functions such as AES or SHA)  Provided the condition number is relatively small, then one may get an  advantage compared to brute-force Grover search  However at this time it is not clear whether this is indeed the case, and we do not have large-scale quantum computers to experiment with 

The quantum security parameter (based on our assumptions of using state-of-the-art algorithms and fault-tolerance methods) for symmetric and hash-based cryptographic schemes is summarized in Table~\ref{tbl1}  For more details about space/time tradeoffs achievable via parallelization of Grover's algorithm please see the corresponding Sec ~\ref{sct::ciphers}, Sec ~\ref{sct::hash} and Sec ~\ref{sct::bitcoin}, respectively 
\begin{table}[h!]
\begin{tabular}{ll}
\hline
Name    & qs  \\
\hline
AES-128 & 106 \\
AES-192 & 139 \\
AES-256 & 172 \\
\hline
SHA-256 & 166 \\
SHA3-256	 &167 \\
Bitcoin's PoW & 75\\
\hline
\end{tabular}
\caption{Quantum security parameter ($qs$) for the AES family of ciphers, SHA family of hash functions, and Bitcoin, assuming a conservative physical error rate per gate $p_g=10^{-4}$ }
\label{tbl1}
\end{table}

We also analyzed the security of asymmetric (public-key) cryptography, in particular RSA and ECC, in the light of new improvements in fault-tolerant 
quantum error correction based on surface code lattice surgery techniques  We computed the space/time tradeoff required to attack 
every scheme, using physical error rates of $10^{-3}$ and $10^{-5}$, respectively  We fitted the data with a third degree polynomial, which resulted in an analytical formula of the number of qubits required to break the 
scheme as a function of time 

The total number of physical qubits required to break the RSA schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in Table~\ref{tbl2}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::rsa} of the manuscript 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name      & nq                    & Tc                    & scc           & s        \\
\hline
RSA-1024  & $3 01 \times 10^7$    & $3 01 \times 10^{11}$ & $5 86 \times 10^{13}$ & 80\\
RSA-2048  & $1 72 \times 10^8$    & $2 41 \times 10^{12}$ & $4 69 \times 10^{14}$ & 112\\
RSA-3072  & $6 41 \times 10^8$    & $8 12 \times 10^{12}$ & $1 58 \times 10^{15}$ & 128\\
RSA-4096  & $1 18 \times 10^9$    & $1 92 \times 10^{13}$ & $3 75 \times 10^{15}$ & 156\\
RSA-7680  & $7 70 \times 10^{10}$ & $1 27 \times 10^{14}$ & $2 64 \times 10^{16}$ & 192\\
RSA-15360 & $4 85 \times 10^{12}$ & $1 01 \times 10^{15}$ & $2 24 \times 10^{17}$ & 256\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the RSA schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$) 
We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl2}
\end{table}

The total number of physical qubits required to break the ECC schemes in 24 hours, together with the required number of $T$ gates, corresponding number of surface code cycles and corresponding classical security parameter is summarized in in Table~\ref{tbl3}  For more details about possible space/time tradeoffs please see the corresponding Section~\ref{sct::ecc} of the manuscript  As observed before in~\cite{1706 06752}, breaking RSA schemes demands more quantum resources in comparison with elliptic curve-based schemes, for the same level of classical security 
\begin{table}[]
\begin{tabular}{lllll}
\hline
Name  & nq                 & Tc                    & scc          & s          \\
\hline
P-160 & $1 81 \times 10^7$ & $2 08 \times 10^{11}$ & $4 05 \times 10^{13}$ & 80\\
P-192 & $3 37 \times 10^7$ & $3 71 \times 10^{11}$ & $7 23 \times 10^{13}$ & 96\\
P-224 & $4 91 \times 10^7$ & $5 90 \times 10^{11}$ & $1 15 \times 10^{14}$ & 112\\
P-256 & $6 77 \times 10^7$ & $8 82 \times 10^{11}$ & $1 72 \times 10^{14}$ & 128\\
P-384 & $2 27 \times 10^8$ & $3 16 \times 10^{12}$ & $6 17 \times 10^{14}$ & 192\\
P-521 & $6 06 \times 10^8$ & $7 92 \times 10^{12}$ & $1 56 \times 10^{15}$ & 260\\
\hline
\end{tabular}
\caption{The total physical footprint ($nq$) required to break the ECC schemes in 24 hours, together with the required number of $T$ gates ($Tc$), the corresponding number of surface code cycles ($scc$), and the corresponding classical security parameter ($s$)  We assume a very conservative physical error rate per gate $p_g=10^{-3}$, more likely to be achievable by the first generations of fault-tolerant quantum computers }
\label{tbl3}
\end{table}

Recent developments in the theory of fault-tolerant quantum error correction have great impact on evaluating the effective strength of cryptographic
schemes against quantum attacks, as the fault-tolerant layer of a quantum computation is the most resource-intensive part of running a quantum  
algorithm  Therefore, monitoring the advances in the theory of quantum error correction is of crucial importance when estimating the strength (or 
weakness) of a cryptographic scheme against a quantum adversary  This work serves as a benchmark against which the impact of future advances can be compared 

\begin{acknowledgments} 
Most of this work is based on research supported by the Global Risk Institute for its members 
We also acknowledge support from NSERC and CIFAR  IQC and the Perimeter Institute are supported in part by the 
Government of Canada and the Province of Ontario   Vlad Gheorghiu thanks Austin Fowler for helpful discussions 
and clarifications regarding lattice surgery methods 
\end{acknowledgments}

\bibliographystyle{aipnum4-1}





ground_truth: A subset that form via kinetic rate processes from state-selected Rydberg gases.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What is the security parameter for the AES-256 block cipher?

Read the following text and answer briefly.

Context 4: Transport Aircraft for IAF - Page 67 - Bharat Rakshak
Transport Aircraft for IAF
Re: Transport Aircraft for IAF
Postby abhik » 17 Nov 2014 05:55
+1, Air India recently sold their entire fleet of Boeing 777s 
afaik the A330 MRTT does not make any structural mods or add anything internally in cargo or passenger cabin  it just relies on the intrinsic 110 tons of fuel  external refueling pods are added and internally the control station and cameras for the operator i guess 
so its a easy conversion from a passenger layout to the AAR mode - mostly ripping out the passenger cabin of all extra stuff and retuning the FCS for any changes in COG 
this should have been pursued years ago
the IL78 adds a palletized drum tank system inside its cargo bay due to paucity of intrinsic fuel but it can be removed and a/c converted back to cargo hauling or send off to russia for Phalcon structural mods if we want it that way  they will however need to change engines to PS90 as they have the old engines
http://www airplane-pictures net/images     7/5616 jpg
the RAF is already gone that route in 2011
http://www defensenews com/article/2011     -Refuelers
LONDON - Airbus Military has delivered the first of 12 A330-200 airliners due to be converted into in-flight refueling planes for the British Royal Air Force by Cobham Aviation Services 
The aircraft, part of an order of 14 jets, will be modified with aerial refueling pods and other equipment at Cobham's newly refurbished facility in Bournemouth, England  The first two aircraft have already been converted by Airbus in Spain 
The multirole tanker aircraft are being provided to the RAF under a private finance initiative service deal led by Airbus parent EADS 
Seven of the planes will be operated full time by the RAF  The remainder will be available for lease in the third-party market, with the proviso that they can be returned to British military service to meet any surge in demand 
All of the aircraft, to be known as the Voyager in RAF service, will be fitted with two wing-mounted refueling pods, while half the fleet will also be fitted for, but not necessarily with, a center-line mounted unit  The refueling units are being supplied by Cobham 
The first aircraft will become operational in a passenger and freight transport role by the end of this year to start relieving pressure on the RAF's hard-pressed assets 
Despite the increasing fragility of current RAF in-flight refueling operations, the new capability is not contracted to start being used in this role until 2015 
All 14 Voyagers are scheduled to be available for RAF operations by the middle of the decade  The A330 will replace the increasingly ancient Tristar and VC-10 refuelers now in service 
Push the 6 Il-476 from refueler to AEW duty  Phalcon them up
Not sure if that is a good path to follow  For one they all should be sent to pasture in about 8 years  Then if the are to be phalconed up - the requires major structural changes  Not worth that cost 
Whatever happened ot the two new ones that were supposed ot be ordered?
the IL78 can be easily converted back to IL76 cargo hauling  only the fuel tank inside cargo bay needs removal   infact that was even mentioned in initial days as swing role fuel/cargo 
Postby Cybaru » 17 Nov 2014 07:55
I am talking about the new il78 that we ordered recently in refueling role  Sorry for the mix up  They are the same platform, that I why i used 476 or 76 to identify it 
777 carries more internal fuel than the A330  We suck!
From the KC-777 program 
http://www globalsecurity org/military/     kc-777 htm
"the KC-777 would be 209 feet long with a wingspan of 212 feet, 7 inches  That's the same size as the 777-200LR commercial jet  The KC-777 would be able to carry far more fuel, cargo and passengers than either the KC-767 or the Airbus A330 tanker  The KC-767 offers more operational flexibility, while the KC-777 would be better suited for long-range strategic missions in which more cargo needs to be delivered  The KC-777 would be able to carry more than 350,000 pounds (160,000 kilograms) of fuel and offload more than 220,000 pounds (100,000 kg) of it on a mission of 500 nautical miles (900 kilometers)  On the other hand, the KC-767 can lift off with more than 200,000 pounds (90,000 kg) of fuel and offload more than 130,000 pounds (60,000 kg) in a similar mission  The KC-777 would be able to deliver 200 percent more fuel after flying 1,000 nautical miles than older Air Force KC-135s  The KC-777 could carry up to 37 pallets of cargo, compared to the 19 pallets for the KC-767 "
Postby Cosmo_R » 18 Nov 2014 04:31
Viv S wrote: From Ajai Shukla's article -
HAL points out that, since each Avro flies barely 350 hours every year, most of them have a residual life of about 80,000 hours  In a request for information (RFI) released on August 15, HAL has proposed replacing the aircraft’s engines (Rolls Royce Dart) with “modern fuel efficient engines” 
So, the IAF's Avros have a residual life of 228 years at the current rate of usage  Ain't life grand?
At zero up time, it could reach infinity 
Relax Cy  Kc777 has no client  Usaf is going with kc767 and almost everyone else with a330 
We don't have the number of heavies and long missions of usaf else I would say convert an124 
KC777 will be extremely expensive given the demand/backlog for the 777 and the 777x  Any buyer would have to virtually pay for the increase in capacity 
I think the 767 production line is closed  so the proposed KC767 Boeing is supposed to deliver 18 by 2017  that can be managed from mothballed and cargo hauler airframes on the market 
but to meet the final order of around 180 will they not have to open the production line unless such a huge number were available on the market?
I do get the spider feel this program again will be cancelled in favour of a in-production plane like the 777X ?
I wasn't suggesting we get the KC777  All I was doing was comparing what possibly the 777 could offload compared to A330  It carries 171000 liters of fuel versus 130000 liters that the A330 carries  If we had older 777s in stock, we could have quite easily converted them to this config  The cost to us would be miniscule just the refurbishing cost vs acquiring a new type 
Singha wrote: I think the 767 production line is closed  so the proposed KC767 Boeing is supposed to deliver 18 by 2017  that can be managed from mothballed and cargo hauler airframes on the market 
The Line is open, they have a backlog of around 50 (All Fed ex), with Fed Ex placing a small order this year  The Pegasus order is for all new builds, and so will the follow on order  The only reason for any nation to buy the 767 tanker is going to be because of the ability to hard bargain with Boeing given that the commercial future of the 767 is dead  This also allows a potential buyer to purchase cheap spares from the open market, or club its logistical and inventory purchase with that of the USAF  Other than that and perhaps availability (which would be doubtful once USAF pushes through a larger order) there is really no technical reason to purchase the this tanker over the A330 which by all accounts is a superior tanker in addition to being a much much better airliner in general 
IAI is doing conversations for the 767 and its called the 767 MMTT
http://www iai co il/sip_storage/FILES/1/38471 pdf
Cybaru wrote: I wasn't suggesting we get the KC777  All I was doing was comparing what possibly the 777 could offload compared to A330  It carries 171000 liters of fuel versus 130000 liters that the A330 carries  If we had older 777s in stock, we could have quite easily converted them to this config  The cost to us would be miniscule just the refurbishing cost vs acquiring a new type 
The cost of converting a commercial airliner to a tanker, certifying it and running a full fledged test program is by no means small  There is absolutely no justification for that sort of cost over and above the capability that that A330 provides  If it were a certified and tested conversion, that would be a different matter 
Postby Kartik » 21 Nov 2014 12:27
Cybaru wrote:
Why? If the airframe can handle more flight hours, why not?
because it is a very very old airframe as is  Maintenance spares won't be available easily even as of now, then imagine how it'll be 20-30 years from now   and as things stood anyway, the HS-748 offered very little in terms of payload and range versus a C-295 class aircraft  The C-295 offers a very credible light transport, whereas the HS-748's role in the IAF was more akin to a transport trainer and for communication duties with little operational use  Having seen a dozen or so HS-748s parked at Vadodara airport all through my childhood, I never once saw one in the air  They just seemed to be stored out in the open  Upon asking an IAF transport pilot who was my friend's father, he remarked "zyaada kaam ke nahi hain yeh" 
Why would you expend more capital on what is essentially an obsolete airframe, even if theoretically it had not yet reached its service life? You'd have to re-engine it, put new avionics on board and even that wouldn't suffice for para dropping requirements  it was operationally never suitable for para dropping, which is an important mission for transport aircraft and had deficiencies in hot and high climes as well 
Unfortunately, the 748 was never meant to be a military transport  At the request of IAF, its door was enlarged to enable larger cargo items to be loaded and to allow para dropping without hitting the tail plane  However, to load a jeep in it, a 30-ft long ramp was required  The jeep would drive in and insert its front wheels into the aircraft  Then it had to be manually lifted and turned to get it in  Unloading it was just as difficult  Para dropping of troops or cargo even from the aircraft with the enlarged door was considered too dangerous with the risk of hitting the tail plane  The aircraft's performance at hot and high airfields was hopelessly inadequate  Eventually IAF acquired the tail-loading An-32s which were powered specifically for IAF's need for operating in the Himalayas 
BRF article -Avro in IAF service
Now unless you want to overcome all these through a costly, time consuming engineering re-design program, that too without access to original documents since this airplane was designed in the 1960s, there is no question of keeping them going for another 40 years  By which time the original design would be over 80 years old and with no one on earth but the IAF as an operator and HAL as the agency supporting it  Hardly a situation anyone would want 
abhik wrote: +1, Air India recently sold their entire fleet of Boeing 777s 
Only 5 of the Boeing 777-200LR, to Etihad Airways, which IMO was a bad decision  they could have reconfigured the airplanes with just 2 classes and continued to fly them to the US, non-stop 
The remaining 3 777-200LR were offered for lease but are still a part of AI's fleet since they didn't find any takers  This particular model hardly sold much and was developed for ultra-long range flights  it was the least successful 777 model and clearly AI goofed up on the configuration by going for these in place of the 300ER  The economics however didn't make too much sense for AI eventually 
there are 13 777-300ER as a part of their fleet ahd their economics is much better 
Govt  to decide tomorrow on whether to go ahead and allow the IAF to verify the technical details of the C-295 bid by Tata-Airbus instead of scrapping the tender due to single vendor situation 
The government will decide on Saturday whether to press ahead with the Rs 13,000 crore mega project for the private sector to supply 56 medium transport aircraft to the IAF despite only a single bidder, the Tata-Airbus consortium, being in the fray 
Though the defence acquisitions council (DAC) chaired by Manohar Parrikar will take the final decision, MoD sources on Tuesday said the "emerging dominant view" is that green signal should be given to the crucial project designed to promote Indian private sector's entry into the domestic aerospace arena with foreign collaboration 
"The Tata-Airbus technical and commercial bid is a credible offer submitted in a competitive environment  The other seven contenders backed out for one reason or the other," said a source 
IAF has now sought the clearance of the DAC -- the first such meeting to be chaired by Parrikar after becoming defence minister on November 10 -- to begin technical evaluation of the C-295 aircraft offered by Airbus Defence & Space and Tata Advanced Systems 
Though it has become a single-vendor situation, the DAC can approve it if it wants as per existing procurement procedures  Of the eight foreign aviation majors that got the global tender, American Boeing and Lockheed-Martin as well as Brazilian Embraer said they did not manufacture the class of aircraft being sought by IAF 
Refusing to take part in the tender, Russian Rosoboronexport said it wanted a fresh design and development project  Antonov of Ukraine wanted yet another extension of the bid submission deadline due to the ongoing conflict in Crimea  Swedish Saab said it had shut down its assembly line for such aircraft 
Then, Alenia Aermacchi was linked to Italian conglomerate Finmeccanica, which has been slapped with "a partial ban" after the infamous VVIP helicopter scandal  "All this left only the European consortium Airbus  The DAC will have to take a call since re-tendering may lead to the same situation," said the source 
Incidentally, it was the Modi government's first DAC in July -- then headed by Arun Jaitley - which revived the Avro replacement project after it was put on hold by the UPA-2 regime last year due to strong opposition from the powerful PSU lobby and ministers like Praful Patel, as reported by TOI earlier 
Apart from the critical need to encourage the private sector to enter defence production in a big way, especially in the aerospace arena where Hindustan Aeronautics enjoys a monopoly, its felt the defence PSU's order books are already overflowing with projects 
Fingers crossed  Hopefully sense will prevail 
Why was lr got? Er is capable of Dubai to sfo nonstop 
Lr is overkill unless we want Delhi to Peru  
Singha wrote: Why was lr got? Er is capable of Dubai to sfo nonstop 
they wanted it for non-stop routes from India to the west coast of the US  But with fuel prices going higher and with the lower seat count on the 777-200LR, the seat mile costs grew too high  A 3 class configuration only made matters worse  A higher density configuration with more economy class seats and just 12-15 Business class seats would have been better perhaps, especially if they didn't have very high First Class load factors 
LR and ER is better if you want to have a better payload down below for long haul  Ultimately, the best bet is going to come form the 787's that take a fewer people (so you can do the longer routes) with still a competitive CASM, and the B and F class folks will pay good money for newer aircraft 
Postby Kartik » 04 Dec 2014 12:55
Lets see if there is any forward movement on the stalled MTA project once Putin arrives in New Delhi
Major defence deals to be signed during Putin-Modi summit
In this connection, it is expected that during the summit, Russia and India may ultimately resolve several long-delayed agreements on military-technical cooperation projects between the two countries and sign them finally for their implementation  These agreements, above all, include joint Fifth Generation Fighter Aircraft (FGFA) project and joint development of Multi-role Transport Aircraft (MTA) 
A final deal on FGFA for production has been delayed because the Indian Air Force (IAF) did not approve the design and work-share  Now Russia has reportedly agreed that the jet would be a two-seat design, not a one-seater  India’s work-share would also be increased from18 percent to 25 percent, and even up to 40-50 percent in the near future, in view of the steady development of the Indian aviation industry 
Defence and SecurityAccording to the agreement, India’s stealth air-to-air missile “Astra” along with Indo-Russian BrahMos supersonic cruise missile will be mounted on the FGFA 
The preliminary design agreement on FGFA had been signed in 2010 between Indian HAL and Russian Sukhoi Design Bureau to build the jet for the use by both countries



ground_truth: 172.

prompt_front: Now, answer the following question based on the text below, only give me the answer and do not output any other words.

Question: What experimental techniques were used to study the quantum dot structures in this research?

Read the following text and answer briefly.

Context 3: \section{Introduction}

Despite the rise of graphene and other 2D materials, semiconducting single-walled carbon nanotubes (SWNT) are still regarded as strong candidates for the next generation of high-performance ultrascaled transistors~\cite{Cao_IBM_2015,IBM_2017,3D_CNT_FET} as well as for opto-electronic devices~\cite{Review_Avouris,CNT_photonics} such as chip-scale electronic-photonic platforms~\cite{Pernice_2016} or low-threshold near-infrared tunable micro-lasers~\cite{Graf_2017}  
Engineering a quantum dot (QD) along a (suspended) semiconducting SWNT foreshadows promising opportunities in the field of quantum information processing and sensing through recently proposed schemes such as detection and manipulation of single spins via coupling to vibrational motion~\cite{Palyi_2012}, optomechanical cooling~\cite{Wilson_Rae_2012} as well as all optical manipulation of electron spins~\cite{Galland_all_optical_2008}  Furthermore, the quasi one-dimensional geometry of SWNTs allows for defining tunable p-n junctions induced by electrostatic doping through local gates~\cite{Buchs_JAP,tunable_pn_2011}  Combining a well-defined QD within such a p-n junction structure could constitute a crucial building-block for the realization of highly desirable electrically driven, on-demand single photon emitters operating at telecom wavelength, based $e g $ on a turnstile device architecture~\cite{turnstile_1994,turnstile_1999} 
In practice, QDs in carbon nanotubes have been reported predominantly for two different confinement structures: i) Engineered tunneling barriers at metal-nanotube contacts~\cite{Pablo04nat} and/or by gate electrodes, used \emph{e g } to manipulate single electron spins~\cite{Laird:2015}, ii) Unintentional localization potentials stemming from environmental disorder~\cite{Hofmann_2016}, allowing for single-photon emission mediated by localization of band-edge excitons to QD states~\cite{CNT_photonics,Hoegele_2008,Walden_Newman_2012,Hofmann_2013,Pernice_2016_2}  Both types of structures are usually operated at cryogenic temperature due to small energy scales ranging from a few to few tens of millielectronvolts 
\\
\indent Another technique for achieving confinement in SWNTs makes use of artificial defects such as covalently bound oxygen or aryl functionalization groups on the side walls of semiconducting SWNTs, inducing deep exciton trap states allowing for single-photon emission at room temperature~\cite{Htoon_2015,tunable_QD_defects}  Also, carrier confinement between defect pairs acting as strong scattering centers has been reported for mechanically induced defects~\cite{Postma_SET} as well as for ion-induced defects with reported level spacings up to 200 meV in metallic SWNTs~\cite{Buchs_PRL}  The latter technique, combined with recent progress in controlling defects structure and localization~\cite{Robertson_2012,Yoon_2016,Laser_writing_2017} offers a high potential for engineering a broad set of SWNT-based quantum devices operating at room temperature  
\\
\indent Here, we demonstrate confinement of electrons and holes in sub-10 nm QD structures defined by ion-induced defect pairs along the axis of semiconducting SWNTs  Using low temperature scanning tunneling microscopy and spectroscopy (STM/STS), bound states with level spacings of the order of 100 meV and larger are resolved in energy and space  By solving the one-dimensional Schr\"odinger equation over a piecewise constant potential model, the effects of asymmetric defect scattering strength as well as the influence of the Au(111) substrate such as terrace edges on the bound states structure are remarkably well reproduced  By means of ab-initio calculations based on density functional theory and Green's functions, we find that single (SV) and double vacancies (DV) as well as chemisorbed nitrogen ad-atoms are good candidates to produce QDs with the experimentally observed features  These simulations also allow to study the scattering profile as a function of energy for different defect combinations 

\section{Experimental section}

The experiments have been performed in a commercial (Omicron) low temperature STM setup operating at $\sim5$~K in ultra high vacuum  Topography images have been recorded in constant current mode with a grounded sample, using mechanically cut Pt/Ir tips  Differential conductance $dI/dV$ spectra, proportional in first approximation to the local density of states (LDOS)~\cite{Tersoff85} have been recorded using a lock-in amplifier technique  The LDOS spatial evolution along a nanotube axis is obtained by $dI/dV(x,V)$ maps built by a series of equidistant $dI/dV$ spectra  Spatial extent mismatches between topography images and consecutive $dI/dV(x,V)$ maps have been systematically corrected~\cite{Buchs_Ar}, and the metallic nature of the tip has been systematically checked on the gold substrate to prevent any tip artefacts before recording STM or/and STS data sets  
\\
\indent Nanotube samples were made of extremely pure high-pressure CO conversion (HiPCo) SWNTs~\cite{Smalley01} with a diameter distribution centered around 1 nm, FWHM $\sim$ 0 3 nm~\cite{Buchs_conf}  The measured intrinsic defect density was below one defect every 200 nm  SWNTs were deposited on atomically flat Au(111) surfaces from a 1,2-dichloroethane suspension, followed by an in-situ annealing process~\cite{Buchs_APL_07,Buchs_Ar} 
\\
\indent Local defects in SWNTs have been created in-situ by exposure to: (i) Medium energy $\sim$ 200 eV argon ions (Ar$^{+}$) produced by an ion gun \cite{Buchs_Ar,Buchs_PRL}, (ii) Low energy (few eV's) nitrogen ions (N$^{+}$) produced by a 2 45 GHz ECR plasma source~\cite{Buchs_APL_07,Buchs_NJP_07}  In both cases, the exposure parameters have been calibrated to reach an average defect separation along the SWNTs of about 10 nm~\cite{Buchs_Ar,Buchs_APL_07} 

\section{Results and discussion}
\subsection{Experimental LDOS patterns}
\begin{figure}
  \includegraphics[width=8cm]{Figure_1 pdf}
  \caption{\label{exp_data_1} (a)-(b) 3D topography images (processed with WSXM~\cite{WSXM}) of SWNT I with Ar$^{+}$ ions-induced defects, with sample-tip bias voltage ($V_\mathrm{S}$) 1 V and tunneling current $I_\mathrm{S}$ 0 1 nA  (c) Corresponding $dI/dV(x,V)$ map recorded along the horizontal dashed lines in (b), with $V_\mathrm{S}=1$ V, $I_\mathrm{S}=0 2$ nA  Spatial resolution $\sim$ 0 3 nm  (d) 3D topography image of SWNT II with N$^{+}$ ions-induced defects, with $V_\mathrm{S}=1$ V, $I_\mathrm{S}=128$ pA  (e) Corresponding $dI/dV(x,V)$ map recorded along the horizontal dashed lines in (d), with $V_\mathrm{S}=1 5$ V, $I_\mathrm{S}=0 3$ nA  Spatial resolution $\sim$ 0 2 nm }
\end{figure}
In Fig ~\ref{exp_data_1} (a) and (b), we show 3D STM images of the same semiconducting SWNT (referred as SWNT I in the following) with Ar$^{+}$ ions-induced defect sites labeled $d1-d5$   Panel (d) shows a 3D STM image of a second semiconducting SWNT (referred as SWNT II) with N$^{+}$ ions-induced defect sites labeled $d6-d7$  In both cases, defect sites typically appear as hillock-like protrusions with an apparent height ranging from 0 5~{\AA} to 4~{\AA} and an apparent lateral extension varying between 5~{\AA} and 30~{\AA}~\cite{Buchs_NJP_07,Buchs_Ar,Thesis_Buchs}  
\\
\indent The resulting $dI/dV(x,V)$ maps recorded along the horizontal dashed line drawn in the STM images (b) and (d) are displayed in panels (c) and (e) in Fig ~\ref{exp_data_1}, respectively  Defect signatures in the LDOS in both cases are characterized by deep in-gap states at the defects positions  This is consistent with the expected defect structures, $i e $ mainly SVs, DVs and combinations thereof for collisions with Ar$^{+}$ ions~\cite{Buchs_Ar} and bridgelike N ad-atom for collisions with N$^{+}$ ions~\cite{Thesis_Buchs,Nitrogen_prb_07}  Note that gap states at energy levels $\sim$~0 2 eV and $\sim$~0 05 eV in panels (c) and (e), respectively, are shifted to the right from $d3$ by about 1 nm and to the right from $d6$ by about 2 nm  This indicates the presence of intrinsic or ion-induced defects on the lateral or bottom side wall of the SWNTs~\cite{Kra01prb}, not visible in the topographic images  These defects are labelled $d3'$ and $d6'$, respectively   
\\
\begin{figure}
  \includegraphics[width=12cm]{Figure_2 pdf}
  \caption{\label{exp_data_Ar} (a)-(b) QD I detailed $dI/dV(x,V)$ maps in conduction and valence bands  Lower subpanels contain QD states linecut profiles and stationary wave-like fits in left and right QD parts  Right subpanels contain experimental energy dispersion relation data sets $k_\mathrm{n}(E_\mathrm{n})$ and tight-binding calculations  (c)-(d) Resulting LDOS calculated from a one-dimensional piecewise constant potential model featuring potential barriers and a potential step (gray area), with position of the potential step: 5 09 nm from the right barrier's center, potential step heigth: $U_\mathrm{C}=V_\mathrm{L}-V_\mathrm{R}=60$ meV, barrier heights: $V_\mathrm{d3'}=1$ eV, $V_\mathrm{d4}=0 85$ eV, barrier widths: $a_\mathrm{d3'}=a_\mathrm{d4}=3 4$ nm   Valence band: $V_\mathrm{d3'}=-0 4$ eV, $a_\mathrm{d3'}=a_\mathrm{d4}=2 5$ nm, $V_\mathrm{d4}=-0 4$ eV  $E_\mathrm{g}$ stands for bandgap energy }
\end{figure}
\begin{figure}
  \includegraphics[width=12cm]{Figure_3 pdf}
  \caption{\label{exp_data_N} (a) QD II detailed $dI/dV(x,V)$ map  Lower subpanels contain QD states linecut profiles and stationary wave-like fits in the left and right QD parts  Right subpanel contains experimental energy dispersion relation data sets $k_\mathrm{n}(E_\mathrm{n})$ and tight-binding calculations  (b) Resulting LDOS calculated from a one-dimensional piecewise constant potential model featuring potential barriers and a potential step (gray area) with position of the potential step: 4 7 nm from the right barrier's center, potential step heigth: $U_\mathrm{C}=V_\mathrm{L}-V_\mathrm{R}=60$ meV, barrier heights: $V_\mathrm{d6'}=0 6$ eV, $V_\mathrm{d7}=0 6$ eV, barrier widths: $a_\mathrm{d6'}=1 5$ nm, $a_\mathrm{d7}=2 6$ nm }
\end{figure}
\indent Remarkably, the $dI/dV(x,V)$ maps in Fig ~\ref{exp_data_1} exhibit several broad discrete states in the conduction bands of SWNT I, II (white dashed boxes in panel (c) and (e), respectively) and in the valence band of SWNT I (white dashed box in panel (c)), characterized by a modulation of the $dI/dV$ signals in the spatial direction between pairs of consecutive defect sites $d3'-d4$ and $d6'-d7$  Enlarged plots of these boxed regions are displayed in Fig ~\ref{exp_data_Ar}(a)-(b) and Fig ~\ref{exp_data_N}(a) for SWNTs I and II, respectively  In the conduction bands, cross-sectional curves recorded along the black horizontal dashed lines labelled m1--m3 in Fig ~\ref{exp_data_Ar}(a) and m1--m4 in Fig ~\ref{exp_data_N}(a) are plotted below the LDOS panels  These clearly reveal one to three and respectively one to four spatially equidistant maxima  The number of maxima increases for increasing $\left|V_\mathrm{bias}\right|$ and the measured level spacings between consecutive discrete states is of the order of 100 meV and larger for both cases  This indicates that defect sites $d3'-d4$ and $d6'-d7$, respectively separated by 12 1 nm and 11 2 nm, act as strong scattering centers able to confine carriers in semiconducting SWNTs~\cite{Buchs_PRL,Bercioux_prb_2011}  Such intrananotube QD structures will be referred as QD I (in SWNT I) and QD II (in SWNT II) in the following  We estimated the level spacings in the conduction band of QD I to 98 meV (m1-m2) and 116 meV (m2-m3)  For QD II, we measured 122 meV (m1-m2), 185 meV (m2-m3) and 210 meV (m3-m4) 
\\
\indent In the valence band of SWNT I, discrete states with level spacings of the order of 80-90 meV, with one clear maximum at the level m-1, can also be distinguished between defect sites $d3'-d4$ in Fig ~\ref{exp_data_Ar}(b)  The discretization of the states indicates that this QD structure also confines holes  Discrete states starting from m-2 and lower show less well defined structures compared to the conduction band states  In the case of SWNT II, no clear discrete states are observed in the valence band (see supplementary information)  These observations are most probably the result of an energy dependent scattering strength of the defects, respectively $d3'$-$d4$ and $d6'$-$d7$, leading here to a weaker confinement in the valence band  Such energy dependence is well known for metallic SWNTs~\cite{Chico96,vac_2007,mayrhofer:2011,Bockrath_Science01} and is corroborated by our ab-initio calculations  Note that mixing effects with defect states and substrate-induced effects~\cite{substrate_effects} cannot be ruled out 
\\
\indent Another remarkable feature in the LDOS is the strong spatial asymmetry of the lowest energy states m1 and m-1 in QD I and m1 in QD II  In QD I, m1 is shifted to the right side of the dot while m-1 is shifted to the left side  Higher states m2 and m3 show more symmetry in terms of position of the maxima relative to the center of the QD  In QD II, m1 is shifted to the right side of the QD  We attribute the observed lowest energy states asymmetry (for electrons as well as for holes) in part to their strong sensitivity to weak potential modulations within the QD structure (as we will show in section \ref{1D})  For QD I, this assertion is supported by the observation of a 0 25 nm high Au(111) terrace edge located around the center of the QD, leading to a supported-suspended interface (see white dashed lines in Fig ~\ref{exp_data_1}(b) and more topographic details in Fig ~S2(a)-(d) in supplementary information)  Such configurations have been reported to induce a rigid shift in the SWNT bands~\cite{Clair_2011}, for instance here a down-shift in the right side of QD I corresponding to the "suspended" portion between two terraces  In QD II, we attribute the spatial shift of m1 to a potential modulation induced by a layer of disordered impurities, most probably residua from the 1,2-dichloroethane suspension, lying between the gold substrate and the SWNT (see Fig ~\ref{exp_data_1}(d) and Fig ~S2(e)-(h) in supplementary information)  
\\
\indent Also, the LDOS in QD I and II (Fig ~\ref{exp_data_Ar}(a) and Fig ~\ref{exp_data_N}(a), respectively) reveals asymmetric patterns with curved stripes oriented from top left to bottom right for QD I and from bottom left to top right for QD II  These are characteristic signatures for defect pairs with different scattering strengths~\cite{Bercioux_prb_2011,Buchs_PRL}  For instance here, the left defect in QD I ($d3'$) has a larger scattering strength than the right one ($d4$), while the right defect in QD II ($d7$) has a larger scattering strength than the left one ($d6'$)  
\\
\indent The exact atomic structure of the defects could in principle be determined from a comparison of $dI/dV$ spectra with simulated first-principle LDOS signatures of expected defect types  In reality, this is hampered by the large number of possible geometries to simulate, including complex multiple defect structures~\cite{Buchs_Ar}, together with the large unit cells of the semiconducting chiral SWNTs studied here 
\\
\subsection{1D piecewise constant potential model}
\label{1D}
To better understand the physical origins of the non-trivial signatures of the quantized states, we model the experimental $dI/dV$ maps by solving the time independent one-dimensional Schr\"odinger equation over a piecewise constant potential model of QD I and QD II  The scattering centers are approximated by semi-transparent rectangular tunneling barriers leading to a square confinement potential~\cite{Laird:2015}  This is supported by previous results on defect-induced confinement in metallic SWNTs using the same experimental conditions~\cite{Buchs_PRL} and is consistent with ab-initio simulations presented later in this work  The potential modulation within the QD is approximated by a potential step  The resulting potential geometries are illustrated with gray shaded areas in Fig ~\ref{exp_data_Ar} (c) and (d) and Fig ~\ref{exp_data_N}(b)  Dispersion relations $E(k)$ can be extracted experimentally from the quantized states wavefunctions by measuring the energy and corresponding momenta in the left and right sides of the QDs  The wavevectors $k$ are determined using stationary wave-like fitting functions~\cite{Buchs_PRL} displayed with dashed red curves in Figs ~\ref{exp_data_Ar}(a)-(b) and ~\ref{exp_data_N}(a))  From this procedure, the potential step height and position can be estimated (see supplementary information)  The experimental data sets $E(k)$ are plotted in the right panels of Figs ~\ref{exp_data_Ar}(a) and \ref{exp_data_N}(a) together with dispersion relations from a third-nearest neighbor tight-binding calculation closely approximating ab-initio results~\cite{Reich_TB_2002}  These chirality-dependent tight-binding dispersion relations, calculated within an extended Brillouin zone resulting from the defect-induced breaking of the translation invariance~\cite{Bercioux_prb_2011}, are used in the Hamiltonian of our one-dimensional model  Taking into account the measured chiral angle, diameter distribution~\cite{Buchs_conf} and measured bandgaps, we find the best match with chiralities $(7,6)$ for QD I and $(11,1)$ for QD II (see supplementary information)  
\\
\indent Once chiralities together with potential step heights and positions are optimized, one can fit the height and width of the rectangular tunneling barriers in order to reproduce the experimental level spacings and general LDOS patterns  On a qualitative ground, a symmetric double barrier system results in the formation of spatially symmetric discrete bound states  Increasing both barrier heights simultaneously shifts the bound state energy levels and level spacings up  This leads to sharper bound states as the confinement in the QD is made stronger thus increasing the lifetime of the confined electrons  Increasing the barrier thickness with constant inner edge separation does not affect much the level spacings but further sharpens the bound states  Any asymmetry introduced by a change in the width or height of one single barrier leads to broader bound states  The presence of a potential step modifies the LDOS in lifting the levels of the bound states, with a more pronounced effect on the lower states  In QD I and II, the center of each barrier is aligned with the center of the gap states ($d3'$-$d4$ for QD I and $d6'$-$d7$ in QD II) and the width ratio is kept proportional to the ratio of the spatial extent of the gap states  Thus, by increasing the width of the barriers, we decrease the length of the QD leading to higher level spacings, and vice versa  The experimental level spacings can then be approximated by tuning both barrier widths in the same ratio and the heights individually, knowing that the scattering strength of $d3'$ ($d7$) is larger than $d4$ ($d6'$) according to the observed asymmetry in the LDOS described above \footnote{The transmission probability through a rectangular tunneling barrier is given by $T=\left( 1+\frac{V^{2}\sinh^{2}\left( a \cdot \sqrt{2m^{*}(V-E)}/\hbar \right)}{4E(V-E)} \right)^{-1}$, where $V$ and $a$ are respectively the barrier height and width  For the argument in the $\sinh$ sufficiently small such that $\sinh(x)\simeq x$, it can be shown that $a$ and $V$ can be coupled such that the transmission probability becomes a function of the area under the barrier $A=a\cdot V$, with $T=\left( 1+ \frac{m^{*}A^{2}}{2\hbar^{2}E} \right)^{-1}$  In our case, this condition is not satisfied and thus the barrier geometries are tuned empirically to fit the experimental level spacings }  
\\
\indent For QD I, we find a good match in the conduction band for the barrier heights $V_\mathrm{d3'}=1$ eV and $V_\mathrm{d4}=0 85$ eV, widths $a_\mathrm{d3'}=a_\mathrm{d4}=$ 3 4 nm,  and potential step $V_\mathrm{L}-V_\mathrm{R}=60$ meV  With these parameters, the spatial profile of the obtained quantized states (see lower subpanels in Fig ~\ref{exp_data_Ar}(a) and (c)) reproduces the experimental modulation features remarkably well  Also, the simulated LDOS displays a pattern with curved stripes oriented from top left to bottom right, as observed experimentally, due to a left barrier with a larger scattering strength  In the valence band, although modes m-2 and lower do not show a well defined structure in the spatial direction, thinner barriers with dimensions $a_\mathrm{d3'/d4}=2 5$ nm, $V_\mathrm{d3'/d4}=-0 4$ eV, leading to a slightly longer QD length (9 6 nm compared to 8 7 nm in the conduction band) can reproduce the measured level spacings very well  
\\
\indent For QD II, we observed that the measured energy levels are overestimated by a factor $\alpha\sim1 29$, presumably due to a voltage division effect induced by the impurity layer mentioned above (see details in supplementary information)  We find a good agreement with the experimental LDOS with the parameters: $V_{d3'}=V_{d4}\simeq$ 0 47 eV, $a_\mathrm{d6'}=1 5$ nm, $a_\mathrm{d7}=2 6$ nm and $U_\mathrm{C}=V_\mathrm{L}-V_\mathrm{R}\simeq 47$ meV  Note that in Fig ~\ref{exp_data_N}(b) the barrier and potential heights are multiplied by $\alpha$ to allow a direct comparison with the experimental LDOS  The simulated LDOS shows a pattern with curved stripes oriented from bottom left to top right, as observed experimentally, due to a right barrier exhibiting a larger scattering strength  Also, the spatial profile of the obtained bound states (see lower subpanels in Fig ~\ref{exp_data_N}(a) and (b)) reproduces the experimental features quite well  Note also that one can distinguish an isolated state in the experimental LDOS at an energy level between m1 and m2, about in the middle of the QD  This state that prevented an accurate fit of the state m2 in the right QD part is attributed to a spatial feature visible in the STM topography image in Fig ~\ref{exp_data_Ar}(d) (see also supplementary information, Fig S2(f)), probably a physisorbed impurity which does not affect the LDOS significantly 
\\
\subsection{Ab-initio calculations}
\begin{figure}
  \includegraphics[width=16cm]{Figure_4 pdf}
  \caption{\label{num_data} (a)-(c) LDOS ab-initio simulations of a semiconducting $(16,0)$ SWNT with combinations of vacancies defects separated by 11 1 nm  Subpanels display QD state linecut profiles  (d) Tight-binding (black curve) and ab-initio dispersion relations (green circles) for a pristine $(16,0)$ SWNT with $E_\mathrm{n}(k_\mathrm{n})$ data sets extracted from (a)-(c)  (e)-(g) LDOS ab-initio simulations of a semiconducting $(17,0)$ SWNT with combinations of N ad-atoms and vacancies defects separated by 10 7 nm  (h) Tight-binding (black curve) and ab-initio dispersion relations (green circles) for a pristine $(17,0)$ SWNT with $E_\mathrm{n}(k_\mathrm{n})$ data sets extracted from (e)-(g) }
\end{figure}
In order to elucidate the physical nature of the electron/hole confining scattering centers, we performed ab-initio simulations based on a combination of density functional theory~\cite{pbe,paw,vasp_paw,VASP2}, maximally localized Wannier orbitals~\cite{transportwannier90} and Green's functions (see supplementary information)  Without loss of generality, we have simulated short unit cell semiconducting zigzag SWNTs with different combinations of the most probable defect structures  Results for vacancy defects likely being induced by 200 eV Ar$^{+}$ ions, separated by about 11 nm in a $(16,0)$ SWNT are shown in Fig ~\ref{num_data}(a)-(c) with DV-DV, DV-SV and SV-SV pairs, respectively  The LDOS displays midgap states at the defect positions as expected as well as defect states in the valence band~\cite{Buchs_Ar}  Most importantly, clear quantized states with a number of maxima increasing with energy are observed between the defects in the conduction band, emphasizing the ability of SVs and DVs to confine carriers  For the asymmetric configuration DV-SV, one can distinguish faint curved stripe patterns oriented from top left to bottom right, indicating a larger scattering strength for DVs compared to SVs  This is consistent with observations in transport experiments~\cite{Gomez05nm}  On the other hand, the patterns in the valence band strongly depend on the defect types  Discrete states can be distinguished for the DV-DV case, with m-2 being mixed with defect states  For the DV-SV case, clear curved stripe patterns oriented from bottom left to top right indicate again a stronger scattering strength for DV  Also, broader states are observed, indicating that the scattering strength of DVs and SVs is weaker in the valence band compared to the conduction band 
\\
\indent More insight on the energy dependent scattering strength for each defect pair configuration can be obtained by extracting the wavevector $k_\mathrm{n}(E_\mathrm{n})$ for each resonant state  This data set is plotted in Fig ~\ref{num_data}(d) for the conduction and valence bands together with the $(16,0)$ dispersion relations calculated from the third-nearest neighbor TB model and from the ab-initio calculation for the pristine nanotube  A first observation is the excellent agreement between TB and ab-initio results, further validating the method used in Figs ~\ref{exp_data_Ar}(a)-(b) and ~\ref{exp_data_N}(a)  The vertical dashed lines indicate the limiting $k_\mathrm{n,\infty}=\frac{\pi \cdot n}{L}$ values corresponding to the closed system (infinite hard walls potential) with $L=11 1$ nm being the defect-defect distance  In the conduction band, we find that $k_\mathrm{n}(E_\mathrm{n})=\frac{\pi \cdot n}{L_\mathrm{eff}(n)} < k_\mathrm{n,\infty}$, indicating that the effective lengths $L_\mathrm{eff}(n)$ of the QD are larger than $L$ ($i e $ the resonant states wavefunctions are characterized by penetrating evanescent modes inside the defect scattering potential), as expected for an open system  The shortest $L_\mathrm{eff}(n)$ are obtained for the DV-DV configuration with 12 1 nm (m1), 13 1 nm (m2) and 12 9 nm (m3), which we attribute to wider scattering potential profiles for DVs compared to SVs  In the valence band, we find that $k_\mathrm{n}(E_\mathrm{n})=\frac{\pi \cdot n}{L_\mathrm{eff}(n)} > k_\mathrm{n,\infty}$, with $L_\mathrm{eff}(n)$ values between 7 9 nm (DV-DV, m-1) and 9 66 nm (DV-SV, m-2)  We attribute this pronounced QD shortening to wider scattering potential profiles of both DVs and SVs in the valence band, probably due to mixing with wide spread defect states in the valence band 
\\
\indent Ab-initio calculations for different defect pairs combinations containing at least one N ad-atom, $i e $ N-DV, N-SV and N-N, are presented in Fig ~\ref{num_data}(e)-(h) for a $(17,0)$ SWNT, along with details on the defects geometries  Remarkably, clear QD states are generated for all three configurations, underlining the potential of N ad-atoms to confine carriers in semiconducting SWNTs and thus to generate intrananotube QDs  
\\
\indent In order to demonstrate the scattering strengths of the different defects, we calculated the energy dependent conductance in addition to the LDOS for the different combinations of the QD defining scattering defects on the $(16,0)$ and $(17,0)$ SWNTs, see supplementary information  Generally we can observe strong conductance modulation of the order of 30-40\% with regard to the pristine CNT for all three tested defects (double vacancies DV, single vacancies SV and chemisorbed C-N) with the DVs having the largest scattering strength in the CB and VB   
\\
\indent Note that the choice of the zigzag SWNT chiralities in the two different ab-initio scenarios is motivated by the different effective masses of both chiralities ($m^{*}_{(17,0)}>m^{*}_{(16,0)}$) which is typical for chirality families $(3n-1,0)$ and $(3n-2,0)$~\cite{ZZ_families}  Taking advantage of recent reports on SWNT chirality control~\cite{chirality_control_EMPA,chirality_control_chinese,chirality_chemistry}, this property could be used in practice to design QDs with different level spacings for the same QD length  From an application point of view, however, QDs generated by DVs will have far superior stability at room temperature due to their high migration barrier above 5 eV ($\sim$~1 eV for single vacancy)~\cite{Kra06vm}  This value drops down by at least 2 eV for N ad-atoms depending on their chemisorption configuration~\cite{Nitrogen_prb_07,Yma05nitr} 
\\
\indent Our ab-initio simulations do not take into account any substrate effect  In the experimental case, the carriers can decay through the substrate, thus limiting their lifetime  This leads to state broadening, measured between about 60 meV up to 120 meV in QD I and II, while the quantized states widths in ab-initio simulations vary between about 5 meV and 45 meV  This suggests that a better contrast of the experimental quantized states, especially in the valence band, could be achieved by lowering the nanotubes-substrate interaction through $e g $ the insertion of atomically thin insulating NaCl films~\cite{Ruffieux_Nature_2016}  This would allow to gain more insight on the electronic structure of the QDs as well as in the associated scattering physics at the confining defects~\cite{Buchs_PRL}  

\section{Conclusions and outlook}
In summary, using low-temperature STM/STS measurements supported by an analytical model and ab-initio simulations, we have demonstrated that intrananotube quantum dots with confined electron and hole states characterized by energy level spacings well above thermal broadening at room temperature can be generated in semiconducting SWNTs by structural defects such as vacancies and di-vacancies, as well as nitrogen ad-atoms  These results, combined with recent progresses in type and spatial control in the formation of defects~\cite{Robertson_2012,Yoon_2016,Laser_writing_2017} as well as chirality control~\cite{tunable_QD_defects}, hold a high potential for applications in the design of SWNT based quantum devices  These include $e g $ electrically driven single-photon emitters operating at room temperature and telecom wavelength  In this context, the observation of quantum confinement effects in the emitted light of cut, sub-10 nm, semiconducting SWNTs~\cite{Dai_2008} shall be seen as an additional motivation for investigating the optical properties of our "QD with leads" building-blocks  These would include $e g $ studying optical transitions selection rules for different types and configurations of defect pairs~\cite{sel_rules_2006} associated with experimental studies such as photoluminescence~\cite{Lefebvre06} combined to $g^{(2)}$ correlation measurements~\cite{Hofmann_2013} in suspended SWNT devices as well as photocurrent imaging~\cite{Buchs_Nat_comm} and spectroscopy~\cite{Gabor_2009} 

\section*{Acknowledgements}
The authors thank Ethan Minot, Lee Aspitarte, Jhon Gonzalez, Andres Ayuela, Omjoti Dutta and Arkady Krasheninnikov for fruitful discussions 
The work of DB is supported by Spanish Ministerio de Econom\'ia y Competitividad (MINECO) through the project  FIS2014-55987-P and by the (LTC) QuantumChemPhys  LM acknowledges support from the BMBF-project WireControl (FKZ16ES0294) and computing time for the supercomputers JUROPA and JURECA at the J\"ulich Supercomputer Centre (JSC) 


\clearpage

\section*{References}






ground_truth: Low temperature scanning tunneling microscopy and spectroscopy (STM/STS).