while standard wisdom has long held that some significant component of the cosmic ray spectrum is the result of particle acceleration by shocks in snrs , only recently has compelling evidence of such a process been observed .
studies carried out with the _ advanced satellite for cosmology and astrophysics _
( asca ) have clearly established the nonthermal nature of the emission from the limb - brightened regions of the remnant of sn  1006 ( koyama et al .
1995 ) . both the spectrum and the morphology of the observed x - rays can be explained by models in which synchrotron radiation is produced from electrons with energies up to 100  tev accelerated by the remnant blast wave ( reynolds 1996 ) , a scenario which is bolstered by the apparent detection of tev @xmath1-rays from sn  1006 ( tanimori et al .
1998 ) .
x - ray spectral results similar to those for sn  1006 are observed for the remnant g347.3@xmath00.5 ( figure 1 ) , a bright snr discovered in the rosat all - sky survey ( rass ; pfeffermann & aschenbach 1996  the rosat catalog source name for the remnant is rx  j1713.7@xmath03946 ) .
koyama et al .
( 1997 ) serendipitously observed the northwest shell of the remnant in a portion of a galactic plane survey being conducted with asca and found that the emission from this region appears nonthermal ; the spectrum is featureless , extends to high energies , and is well described by a power law .
here we present our new x - ray and radio observations of g347.3@xmath00.5 that cover the entire snr . in  2 below
, we describe the several data sets we have for the remnant . in  3 we discuss the remnant s distance implied by our co data and the spectral results from the x - ray observations .
section 4 contains a discussion of the overall picture the data suggest for g347.3@xmath00.5 , and the conclusions are summarized in  5 .
nonthermal emission in supernova remnants is usually associated with the presence of a central pulsar - powered synchrotron nebula .
sn  1006 appears to present a glaring exception to this scenario , but cas a also possesses a hard power - law tail ( allen et al .
1997 ) , and ic443 harbors a concentration of hard emission ( keohane et al .
1997 ) that appears to be associated with a molecular cloud interaction site . with synchrotron spectra extending to 10  kev and beyond ,
this implies the presence of electrons with energies as high as @xmath2  tev for typical interstellar magnetic fields .
the origin of this emission is of considerable significance both in terms of the long - surmised source of cosmic rays and because it raises questions about what special conditions are responsible for such production in such a limited number of snrs . like sn  1006 ( but unlike cas a or ic443 ) , the nonthermal emission from g347.3@xmath00.5 _ dominates _ the x - ray flux .
this snr thus presents significant evidence for particle acceleration which may lead to a confirmation of the long - suspected connection with the origin of cosmic rays .
however , in contrast to sn  1006 , whose age , distance , and progenitor type are known , g347.3@xmath00.5 is an unfamiliar beast . to understand how and why ( or even if ) it is acting as a cosmic ray accelerator
, we need to establish the basic fundamentals of its character .
( 0,10.5)(18.5,21 )    ( 0.4,20.7)=8.5 cm    ( 9.75,20.7)=8.0 cm    ( 0,12.7 )    = 3.5 mm fig
.  1. rosat pspc image of g347.3@xmath00.5 .
two point - like sources are seen in the central regions .
the eastern - most source is associated with a star while the central source is unidentified .
asca observations reveal strong nonthermal emission from the two bright regions along the western limb as well as weak nonthermal emission from the rest of the interior .
contour levels start at @xmath3 and increase inward in steps of @xmath4 .
( 9.7,12.7 )    = 3.5 mm fig .
2. asca gis image of g347.3@xmath00.5 with pspc contours .
regions used for spectral studies are indicated .
boxes along the western limb were used for the nw and sw regions ( see text ) .
two circles from the eastern half of the remnant were used for the east region and a circle around the central point source was used for the ptsrc region . for deriving upper limits to the thermal emission for the entire snr
, the four black circles were used with the white circle excluded .
g347.3@xmath00.5 was first discovered in the rass data ( pfeffermann & aschenbach 1996 ) .
a follow - up 3  ks pointed observation was then carried out with the position sensitive proportional counter ( pspc ) , providing a good map of the @xmath5  arcmin diameter remnant ( figure 1 ) .
the spectral results were inconclusive , however , being unable to distinguish between a thermal or nonthermal origin for the soft x - ray emission .
the pspc also reveals two point - like sources in the field of the remnant .
the first , 1wgaj1714.4@xmath03945 , has a very soft spectrum and appears to be associated with a star ( pfeffermann & aschenbach 1996 ) .
we will not discuss it further .
the second source , 1wgaj1713.4@xmath03949 , which is located near the center of the remnant at position 17@xmath6  13@xmath7  28@xmath8 , @xmath039@xmath9  49@xmath10  46@xmath11 ( epoch j2000 here and henceforth ) , has no reported counterpart .
the brightest cataloged object near the x - ray source is @xmath12  arcsec away and has an optical magnitude @xmath13 ( @xmath14 ) .
this separation is consistent with the expected position errors for the pspc source given the point spread function of the detector as well as aspect reconstruction errors .
the large x - ray to optical flux ratio is consistent with what might be expected for a neutron star .
a stellar counterpart is virtually ruled out for such a ratio ( stocke et al .
1991 ) , but a background extragalactic source remains a possibility .
we observed g347.3@xmath00.5 with asca on 1997 march 25 for a total of 50  ks using three pointings of 10  ks duration and one ( in the fainter southeast region ) of 20  ks duration , which resulted in complete coverage by the gas - imaging spectrometer ( gis ) .
complimentary chips on the ccds were used to image the entire solid - state imaging spectrometer ( sis ) field of view ; nevertheless , complete coverage of the remnant was not possible with the sis .
risetime information for the gis was sacrificed in order to provide improved temporal resolution so that timing analysis could be carried out on the central source . after standard screening procedures for the gis and sis data , we performed spectral fits for several distinct spatial regions defined as follows : nw - a box surrounding the bright region in the northwest which was first studied by koyama et al .
( 1997 ) ; sw - a box surrounding the bright region in the southwest ; ptsrc - a 3 arcmin radius circle centered on the central source ; and east - combined data from two circles in the northeast and southeast regions of the remnant .
these regions are shown schematically in figure 2 where we present the gis image .
( also shown are additional circles used in combination with east to establish limits on the total thermal emission ; see  3.2.2 . ) the corresponding spectra are shown in figure 3 .
( 9.5,-1)(18.5,10.3 )    ( 9.0,10.3)=8.8
cm    ( 9.0,1.5 )    = 3.5 mm fig .
3. asca spectra from distinct regions of g347.3@xmath00.5 ( see figure 2 ) along with best - fit models .
top panel : gis ( upper ) and sis ( lower ) from nw shell .
spectrum is well described by a power law ( shown as histogram ) and is indistinguishable from spectrum of sw shell ( not shown ) .
middle panel : gis spectrum from eastern region of remnant along with best - fit power law model .
lower panel : gis spectrum of central point - like source along with best - fit blackbody model .
table 1    g347.3@xmath00.5 spectral parameters    [ cols="<,<,<,<",options="header " , ]     unlike the line - dominated x - ray spectra typical of snrs , the spectra for g347.3@xmath00.5 are clearly featureless and extend to at least 10  kev , where the asca effective area becomes very small . for each region , we performed joint fits to data from each gis detector as well as to the associated pspc data from the same spatial region of the remnant .
a power law spectrum provides an excellent fit to each spectral region of the remnant .
the nw and sw regions display virtually identical spectra while that for the eastern region appears to have a flatter spectral index and somewhat lower absorption .
the best - fit spectral values are listed in table 1 .
addition of a thermal component ( raymond & smith 1977 ) to the spectral model does not result in a significant improvement in the fit ; there is no significant evidence for thermal emission from any portion of the snr .
we note that a pure thermal bremsstrahlung model ( e.g. , an exponential with gaunt factor ) yields a considerably larger value of @xmath15 than does the power law model ( e.g. , for the sw region , @xmath16 for 293 degrees of freedom compared with @xmath17 for the power law model ) .
the sis data provide higher sensitivity for detection of line features in the spectra due to its better spectral resolution compared to the gis .
however , due to the extended nature of the emission , the number of counts in any particular chip is small .
further , background measurements were possible for only two of the chips and these were used as representative background for analysis of data from other chips .
variations in the spectral characteristics of each chip , plus possible spatial variations in the cosmic and galactic x - ray background emission , thus introduce larger uncertainties than would be obtained with independently measured backgrounds .
we have carried out fits to the sis data from the nw region , the sw region , and for the northeast region . in each case , the sis fits show no evidence of spectral lines and the power - law fit parameters are in reasonable agreement with those obtained from the joint gis / pspc fits .
the nonthermal nature of the emission from all regions of the remnant is quite peculiar . unlike sn 1006 , where thermal emission is found in the central regions , any such component from g347.3@xmath00.5
is apparently overwhelmed by the nonthermal emission .
we discuss this surprising result in  3 .
( 0,-0.5)(8.5,4 ) ( -0.5,3.5 )    = 3.5 mm    table 2    blackbody model for 1wgaj1713.4 - 3949    llparameter & value + @xmath18 & @xmath19 + @xmath20 & @xmath21 kev + @xmath22 & @xmath23 + @xmath24 & @xmath25 +   +   +    the spectrum from the unidentified central source 1wgaj1713.4@xmath03949 is not well constrained by the data .
joint fits to the sis / gis / pspc data yield acceptable fits for power - law , raymond - smith , bremsstrahlung , and blackbody models .
the blackbody model yields the lowest overall @xmath15 fit ( though only marginally lower than the other models ) , and we summarize these fit parameters in table 2 for use in discussing a neutron star scenario for this source in  3.2.3 .
however , we note that additional observations are required to obtain a higher fidelity characterization of the spectral properties .
( 0,11)(18.5,21 )    ( 0,12.7 )    = 3.5 mm fig .
4. iras 60  @xmath26m/100  @xmath26 m ratio image with pspc contours overlaid .
a marginal enhancement in the ratio appears over the interior of the remnant , but significant emission is seen outside the western limb possibly indicating the presence of adjacent cool material .
( 9.7,12.7 )    = 3.5 mm fig .
5. most image of radio emission at 843 mhz , with pspc contours .
emission from the bulk of the snr rim can be seen with particular enhancements along the west / northwest regions where bright nonthermal x - ray emission is seen .
bright emission outside of the western limb corresponds well with the observed infrared emission from this region .
we have also investigated the infrared emission from the region with the infrared astronomical satellite ( iras ) 60@xmath26m/100@xmath26 m ratio ( figure 4 ) .
an enhancement of this ratio , indicative of hot dust , has been shown to be a powerful discriminator of remnant emission against the background emission of the galactic plane ( saken , fesen , & shull 1992 ; slane , vancura , & hughes 1996 ) . the infrared emission in the inner galactic disk is intense and complicated , but as figure 4 shows , there is a clear enhancement of the 60 mm/100 mm ratio coincident with the remnant .
the strongly enhanced ratio to the northwest of the remnant is due to the  region g347.61 + 0.20 ( lockman 1979 ) , which may be associated with the same molecular cloud as the remnant ( see  3.1 ) .
radio maps from the parkes - mit - nrao ( pmn ) 6  cm survey ( condon , griffith , & wright 1993 ) reveal complex emission from the region surrounding the remnant , but we find very good morphological correspondence with the infrared emission , particularly for the regions directly west and northwest of the remnant . to better delineate any radio emission corresponding to the x - ray remnant , we have carried out 843 mhz observations using the molonglo observatory synthesis telescope ( most ; robertson 1994 ) .
the synthesis was carried out on 1997 may 27 , with the telescope in its wide field mode of operation ( large et al .
the resulting map ( figure 5 ) reveals regions of faint emission which extend along most of the snr perimeter , with the most distinct emission corresponding to the bright x - ray regions in the northwest and southwest .
considerable contributions from sidelobes , baseline errors , and grating rings from surrounding sources result in a rather high noise level of @xmath27  mjy  beam@xmath28 ; the contrast has been adjusted considerably to show the faint shell emission .
the brightest regions of emission within the confines of the x - ray contours are found along two arcs in the northwest .
these are concentrated along the edges of the brightest x - ray emission .
arc 1 is centered at approximately 17@xmath6  12@xmath7  46@xmath8 , @xmath039@xmath9  25@xmath10  49@xmath11 .
we estimate a surface brightness range of @xmath29 ( @xmath30 ) with @xmath31 uncertainty in these values .
arc 2 , centered at 17@xmath6  11@xmath7  27@xmath8 , @xmath039@xmath9  32@xmath10  36@xmath11 has a surface brightness range @xmath32 ( @xmath33 ) with similar uncertainty .
this arc appears to be most closely correlated with the bright x - ray emission and , although its east - west elongation is curiously askew with respect to the perceived snr shell at this location , the radio filament does overlay a filament of x - ray emission at this position . an upper limit to any radio counterpart to the unidentified x - ray point source 1wga  j1713.4@xmath03949 is 15 mjy ( @xmath34 ) .
the intense emission beyond the nw limb of the remnant corresponds to the same  region , g347.61 + 0.20 , that was evident in the iras map ( figure 4 ) .
additional radio observations of g347.3@xmath005 with higher resolution and sensitivity have been carried out with the australia telescope compact array .
analysis of these data is in progress and will be reported in a future publication .      to further constrain our picture of the environment surrounding the remnant ,
we have used observations of the _ j _ = @xmath35  rotational transition of co ( at 115 ghz ) , the best large - scale tracer of interstellar molecular gas , from the cfa - chile 1.2 m telescope ( bronfman et al .
figure 6 is a map of total molecular column density over a wide section of the inner galaxy centered on the snr .
it is noteworthy that the snr coincides very closely with the largest and deepest hole in the molecular column density near the galactic plane in the inner fourth quadrant . since the co emission in the direction of the remnant is complex and extends over @xmath36 in radial velocity , it is difficult to determine which individual molecular cloud or clouds , if any , along the line of sight might be associated .
the most likely candidates based on the morphology of the co and x - ray emission are a pair of clouds at @xmath37 and a third at @xmath38 ( figure 7 ) . given that giant molecular complexes with active star formation sometimes have total velocity extents of  30 km s@xmath28 ( e.g. , w44 ; dame et al .
1986 ) , it is possible that all three of these clouds are part of the same molecular complex that gave birth to the  region g347.61 + 0.20 and the snr , with one or more of the clouds significantly perturbed in velocity .
the cloud at @xmath38 abuts the region of strongest x - ray and radio enhancement , suggesting that the remnant may be expanding into this cloud .
it is worth noting that a compact region of anomalous - velocity emission extending to @xmath39 is seen in both 21  cm ( burton 1985 ) and co ( bronfman et al .  1989 ) emission along the line of sight to the remnant .
( -0.5,11.7)(8.5,24 )    ( -0.75,24)=8.8 cm    ( -0.75,14.5 )    = 3.5 mm fig .
7. contours of co intensity integrated over the velocity range @xmath40 to @xmath41 , from the survey of bronfman et al .
the contours are spaced every @xmath42 , starting at @xmath43 .
the rosat pspc image is shown in grayscale .
the molecular clouds that seem most likely to be associated with g347.3@xmath00.5 are labeled with their lsr velocities .
the region g347.61 + 0.20 is marked by a `` + '' sign .
given their proximity both in projected position on the sky and in velocity , the pair of clouds at @xmath37 are almost certainly associated with each other , and with the  region g347.61 + 0.20 , which has a recombination - line velocity of @xmath44 ( lockman 1979 ) .
an association between the snr and the pair of clouds at @xmath37 is suggested by the presence of massive star formation in one of them , as evidenced by the  region , and by an enhancement of the co(21)/co(10 ) line ratio in the other .
studies of molecular clouds in the galaxy find values generally below 1 for the ratio @xmath45 .
sakamoto et al.(1995 ) find a mean value of @xmath46 with a variation from 0.5 to 0.8 that has some dependence on galactocentric distance .
chiar et al .
( 1994 ) find a value of @xmath47 from their study of molecular clouds in the scutum arm of the galaxy . on the other hand molecular clouds that appear to be undergoing interactions with snrs ( e.g. , w44 and ic443 ; seta et al .
1998 ) , show an enhanced @xmath48 ratio ( @xmath491.2 ) that is indicative of shocked material in the molecular gas .
we obtained co(21 ) spectra over the range @xmath50 to 348.5 , @xmath51 to 0.5 , on a 0.25 degree grid ( handa & hasegawa 1999 , private communication ) from the university of tokyo 0.6 m telescope on la silla , chile , which has the same angular resolution at the co(21 ) line as the cfa - chile 1.2 m at the co(10 ) line . over the range for which co(21 )
spectra were available , the mean @xmath48 value was determined to be @xmath52 .
however , the largest values of @xmath48 were associated with the cloud at @xmath37 : in particular , toward @xmath53 , @xmath54 , a value of @xmath55 is found near @xmath56 , in the wing of a strong ( 4 k ) and well - defined co(10 ) line near @xmath57 .
such an enhancement in the wing of the co line is suggestive of an interaction with the snr shock wave ( seta et al .
we note that no enhanced @xmath48 value is observed for the cloud at @xmath58 which appears along the line of sight to the brightest x - ray limb
. however , the co(21 ) data are coarsely spaced ( every 1/4 degree ) ; more sensitive and closely spaced spectra in this region may reveal such an enhancement and are of considerable interest .
koyama et al .  (
1997 ) compare their measurement of the column density toward g347.3@xmath00.5 ( which is in good agreement with the values we report here ) with the total @xmath18 in the direction of the galactic center to estimate a distance of 1  kpc to the remnant .
we argue that a distance as small as this is unlikely , based on several lines of evidence . like
koyama et al .
( 1997 ) we first consider the distance estimate based on the x - ray derived column density .
the total line - of - sight column density in the direction of g347.3@xmath00.5 is @xmath59 based upon  observations ( dickey & lockman 1990 ) and confirmed by co measurements ( bronfman et al.1989 ) .
this relatively low value is consistent with the presence of a hole in the molecular column density in this direction mentioned earlier ( see also fig 6 ) .
the @xmath18 value we measure for g347.3@xmath00.5 ( @xmath60@xmath61 , see table 1 ) is a significant fraction of the total column through the galaxy and so the distance to the remnant must be considerably more than 1 kpc .    we have just argued in the preceeding section that the remnant , the  region , and the complex of three molecular clouds in this direction are all likely to be physically associated .
this provides an opportunity to obtain a quantitative estimate for the distance to the remnant . from the rotation curve of the galaxy ( burton 1988 ) ,
the pair of clouds at @xmath37 lie at a distance of @xmath62  kpc or @xmath63  kpc . whether the near or far kinematic distance is appropriate
can be resolved in favor of the former by noting that molecular absorption measurements place the associated  region at a distance of 6.3  kpc ( lockman 1979 , adjusted to the burton 1988 rotation curve and @xmath64  kpc ) .
the cloud at @xmath65 has a near kinematic distance of 5.4 kpc , assuming that its radial velocity is purely due to galactic rotation .
therefore we adopt a distance of 6 kpc for the distance to g347.3@xmath00.5 , with the warning that this is uncertain by at least @xmath661 kpc . in the following we present results in terms of @xmath67 .
the nonthermal x - ray emission from g347.3@xmath00.5 strongly indicates that the snr shock is accelerating particles to very high energies .
the electron energy associated with synchrotron photons radiated at energy @xmath68 is @xmath69 with observed photon energies up to of 10  kev , the spectrum for g347.3@xmath00.5 thus indicates the presence of electrons with energies as high as 300  tev for typical magnetic fields of @xmath70 g .
if protons are accelerated to similar energies , it would appear that g347.3@xmath00.5 may be accelerating cosmic rays up to energies near the `` knee '' in the cosmic ray spectrum at @xmath71  ev .
the total energy associated with the x - ray producing electrons is of order @xmath72  erg which is a small fraction of the mechanical energy released in the supernova explosion .
as noted in table 1 , the spectral index for the emission from the bright regions along the western limb of g347.3@xmath00.5 appears to be steeper than that for the rest of the diffuse emission from the snr .
the column density from the spectral fits also differs between the two regions .
when @xmath18 is fixed to the value determined for the nw region , the photon index derived for the eastern region is @xmath73 , the same as that for the regions along the western limb .
however , the @xmath15 for the fit is considerably higher and the residuals clearly indicate difficulty with such a high absorption value for the eastern region .
a variation in column density is not hard to reconcile ; many snrs exhibit such spatial variations in the foreground absorbing column ( e.g. , roberts et al .  1993 ) . for g347.3@xmath00.5
this interpretation is particularly reasonable , since the regions indicating higher column density ( i.e. , the nw and sw enhancement regions ) lie closest to the galactic plane ( see figure 7 ) .
variations in spectral index are also well - understood for synchrotron nebulae where the finite radiating lifetimes of electrons accelerated by a central pulsar result in a steepening of the spectral index with distance from the electron injection point ( e.g. , kennel & coroniti 1984 ; slane , bandiera , & torii 1998 ) . for synchrotron nebulae
the steepening of the spectrum goes along with a decrease in brightness . for g347.3@xmath00.5 ,
however , no obvious injection point is evident , and the steeper index appears to be concentrated along the bright western limb .
a synchrotron lifetime argument thus appears problematic in that the brightest synchrotron region ( i.e. , the western limb ) would also have to be `` older . '' for completeness we note that the nonthermal x - ray emission from sn  1006 , with a photon index @xmath74 , is steeper than spectra measured here for g347.3@xmath00.5 .
although the bright rim regions of sn  1006 are dominated by synchrotron emission , asca studies of the interior reveal the line - dominated x - ray thermal component expected from the hot shocked gas characteristic of snrs ( koyama et al .
our asca observations of g347.3@xmath00.5 reveal no such component .
the lack of measurable thermal emission sets limits on the amount of hot material , and thus on the density of the region in which the snr evolved .
this is illustrated in figure 8 where we have plotted upper limits to the thermal emission measure as a function of temperature based upon our spectral analysis .
for the curve plotted as the solid histogram in figure 8 , we have combined data from the gis detectors using regions that cover most of the remnant ( but not the bright regions along the western limb  see figure 2 ) and determined 3-sigma upper limits to the amount of thermal emission , assuming normal solar composition , that could be added to the model .
the resulting normalization for this thermal component was then scaled by a factor of two to account for the incomplete coverage of the remnant that our spectral extraction regions gave . as indicated in figure 2
, the spectral regions actually cover more than 50% of the area of the snr , so the upper limits shown are quite conservative .    under some assumptions about the three - dimensional geometry of the remnant , the upper limit on the emission measure can be converted into a limit on the mean density of the ambient medium . for g347.3@xmath00.5 we assume a spherical shell geometry with a measured angular radius of @xmath75 and an estimated shell thickness equal to @xmath76 . (
note that the factor 23 was chosen for numerical agreement with the integrated emission measure for a sedov solution . ) for the range of allowed emission measures , we then calculate that the hydrogen number density of the ambient preshock medium in the strong shock limit ( i.e. , assuming the density jump across the shock front is a factor of 4 ) is in the range @xmath77 = 0.0140.28 @xmath78 @xmath79 .
the lower bound on the ambient density corresponds to temperatures of @xmath600.75 kev , while the upper bound corresponds to the lowest temperature bin in figure 8 .
( 9.5,8)(18.5,20 )    ( 9.0,20)=8.8 cm    ( 9.0,11.5 )    = 3.5 mm fig .
8. upper limit to derived emission measure associated with a thermal emission component plotted as a function of temperature .
the two histograms correspond to limits derived for the entire snr ( solid ) based upon scaling results which exclude the bright regions ( see text ) , and for the bright northwest region ( dashed ) . also shown
are curves for models derived assuming a sedov solution .
solid ( dotted ) curves correspond to a distance of 6  kpc ( 2  kpc ) with @xmath80 varying from 0.2 ( lower ) to 1.0 ( upper ) .
also plotted in figure 8 are model curves for explosion energies @xmath81 , 0.5 , and 1.0 ( in units of @xmath82 erg ) assuming a distance of 6  kpc ( solid curves ) and 2  kpc ( dotted curves ) under the assumptions that the remnant is in the sedov ( 1959 ) phase of evolution and the electrons and ions share the same temperature behind the shock front .
we see that the derived upper limits are not inconsistent with the model curves for our prefered distance of 6  kpc .
that is , for the range of parameter space shown , the lack of detectable thermal emission is expected for a sedov - phase snr ; as with sn  1006 , the thermal emission simply pales in comparison to the bright nonthermal emission .
for such an interpretation , however , the density of the ambient medium must be very low , as we found above .
the derived upper limits on emission measure appear to rule out a sedov solution for g347.3@xmath00.5 if the remnant is at a distance of 2  kpc .
the only acceptable solution requires an unusually low explosion energy and a rather hot remnant , @xmath83  kev .
however this conclusion is sensitive to the assumption of temperature equilibration between electrons and ions in the post - shock gas .
the alternative scenario , wherein the electrons and ions acquire the same mean thermal velocity behind the shock front and then share energy slowly through coulomb collisions ( see spitzer 1978 ) , will result in the mean electron temperature in the remnant ( @xmath84 ) lagging considerably behind the post - shock temperature of the ions .
in this situation the measured electron temperature does not reflect the actual shock velocity and , in fact , it has been shown ( cox & anderson 1982 ) that the electron temperature has an extremely weak dependence on the shock temperature .
furthermore , because the equilibration timescale is inversely proportional to the electron density , the effects of non - equilibration are greatest for low density remnants , which is precisely the situation we have here for g347.3@xmath00.5 .
although a detailed analysis of the effects of non - equilibration will be addressed in a future article , we make the following brief comments here .
the curves for the sedov solution shown in figure 8 are substantially modified if equilibration on coulomb collisional timescales is assumed .
first of all , there are no high temperature solutions for reasonable values of the explosion energy ( @xmath85 ) anywhere in the range of emission measures plotted .
second , it is not possible to rule out a sedov solution as a model for the remnant if it is at a distance of 2 kpc .
for example , for this distance and a mean temperature of @xmath86 kev , emission measures in the allowed range 0.01@xmath87 predict ranges for the explosion energy of @xmath882.2 and the remnant s age of 21003400 yrs .
lower values of the mean temperature are also acceptable and result in a broad range of possible dynamical states that , in general , encompass smaller values of the explosion energy and larger values of the age . for a distance of 6 kpc , a reasonable dynamical state for g347.3@xmath00.5 is possible for a mean temperature of @xmath89 kev and emission measures in the allowed range 0.003@xmath90 . within this range
the explosion energy varies in the range @xmath911.7 and the remnant s age lies between 18,700 yrs and 40,600 yrs .
so in conclusion to this discussion , the lack of detected thermal emission from g347.3@xmath00.5 can be reconciled with a broad range of reasonable dynamical evolutionary states , possible remnant ages , and distances as long as the mean ambient density around the remnant is low .
this would appear incompatible with the environment in the vicinity of a molecular cloud unless the remnant has involved in a cavity produced by the stellar wind of the progenitor star .
we discuss this further in  4 .
the limits on thermal emission used for the preceeding analyses represent an average of the faint parts of the remnant .
clearly the limits will be higher in the bright regions of the snr . in the upper panel of figure 8
, the dashed histogram represents the upper limit for thermal emission from the bright northwestern region of the remnant using the spectral extraction region illustrated in figure 2 . treating the emission region as a simple slab through the remnant , the upper limit at the low end of the temperature scale limits the preshock density of material at this position to @xmath92 where @xmath93 represents the fraction of the slab volume that is actually responsible for the emission .
this limit suggests that the ambient density toward the northwest could be considerably greater      the best spectral fit for the unidentified central x - ray source 1wgaj1713.4@xmath03949 based upon a joint fit to the gis , sis , and pspc is obtained for a blackbody spectrum with @xmath94  kev ( see table 2 ) .
the normalization yields a relatively small emitting area with radius @xmath95  km , suggesting a compact object .
the lack of an optical counterpart supports the interpretation that the source is a neutron star associated with g347.3@xmath00.5 .
however , the blackbody temperature is rather high for a cooling neutron star .
temperatures similar to that observed are often associated with emission from heated polar caps , but in the case of 1wgaj1713.4@xmath03949 the emitting area @xmath96 is considerably larger than that observed from other sources ( _ e.g. _ psr 1919 + 10 ; yancopoulos , hamilton , & helfand 1994 ) , implying that 1wgaj1713.4@xmath03949 may be a rapidly spinning object ( @xmath97 , where @xmath98 is the rotation period ) .
there is no evidence of long - term flux variability between the rosat and asca observations ( although uncertainties in the spectral model do not allow us to rule out small variations ) .
we extracted a total of 1100 counts in the gis data from the region around the source for use in timing analysis . a search for pulsations for periods longer than @xmath99  ms ( the highest time resolution for the entire data set ) yielded negative results implying a pulsed fraction upper limit of @xmath100 for the extracted events assuming a sinusoidal light curve ( vaughan et al .
1994 ) . based upon fits to the background - subtracted spectrum for the source ,
@xmath101 of the events in the extraction region were attributable to the source .
the derived upper limit to the source pulsed fraction is thus of order 100% and offers no meaningful constraint .
we note that adequate spectral fits for the central source emission can also be obtained for power law and raymond - smith models . for the power law model ,
the spectral index is extremely steep ( photon index @xmath102 ) and the column density is large ( @xmath103 ) . for the thermal plasma model ,
the best - fit column density is @xmath104 which is comparable with the total absorption through the galaxy in this direction .
thus it is possible that the source is extragalactic , although the steep x - ray spectral slope and the lack of radio emission makes this interpretation somewhat implausible .
based upon all observations to date , a complete picture of g347.3@xmath00.5 is only just beginning to unfold .
initial x - ray observations ( pfeffermann & aschenbach 1996 ) indicated a nearby ( @xmath105  kpc ) remnant which was subsequently suggested as a counterpart to a guest star from ad393 ( wang , qu , & chen 1997 ) .
the latter authors argue that the limited information available for such a scenario would seem to suggest a type ib / ic progenitor explosion .
they further suggest that the morphology of the remnant may show some evidence of a central ring - like structure which could be associated with evolution in a wind - blown bubble .
we see no evidence of such structure in either the original pspc maps of g347.3@xmath00.5 nor in our maps obtained with asca .
further , as argued above , a distance as small as 1  kpc appears to be very unlikely .
the asca spectra for g347.3@xmath00.5 clearly indicate the presence of very high energy electrons , providing evidence for direct acceleration of particles by the snr shock .
reynolds ( 1998 ) provides a thorough discussion of the maximum energy constraints for diffusive shock acceleration in snrs and produces model results for the nonthermal radiation assuming a constant magnetic field and explosion characteristics typical of type ia progenitors .
the maximum energy for the accelerated particles is determined by : ( 1 ) radiative losses by the particles in the ambient magnetic / photon field ; ( 2 ) the finite acceleration time associated with the snr age ; and ( 3 ) particle escape due to the weakening or absence of magnetohydrodynamic waves ( beyond some maximum wavelength ) from which the electrons scatter . reynolds ( 1998 ) shows that all young snrs should show some evidence of nonthermal x - rays due to shock acceleration , but that the maximum ratio of x - ray / radio nonthermal emission will occur when the snr age is roughly equal to the loss time for electrons in the postshock magnetic field  a condition that apparently holds for sn  1006 but not for other historical snrs .
the nonthermal emission persists to ages beyond @xmath106  yr .
a similar scenario for the nonthermal emission in g347.3@xmath00.5 presents some difficulties .
we have argued that the distance to this snr is of order 6  kpc and that it appears to be in the vicinity of a molecular cloud complex .
the conditions are thus considerably different than the high - latitude , type ia environment for sn  1006 . however ,
if g347.3@xmath00.5 were the result of an explosion in a stellar wind bubble , there are at least qualitative similarities .
the surrounding medium would have low density and a toroidal magnetic field which may yield conditions for efficient particle acceleration .
tenario - tagle et al .  (
1991 ) have performed 2d numerical hydrodynamical simulations of young type ii snrs interacting with wind - blown bubbles and find that the freely moving ejecta undergo only partial thermalization while the remnant as a whole ages rapidly since early evolutionary phases are essentially accelerated due to the low density medium in the interior of the bubble .
if , upon encountering the bubble wall , diffusive shock acceleration is enhanced , the under - thermalization of the ejecta along with the small swept - up mass may result in a large ratio of nonthermal / thermal x - ray emission .
thus , if the remnant is indeed interacting with the observed molecular clouds , this could enhance the nonthermal component .
simulations indicate that such interactions result in additional shocks in the cloud which can enhance the nonthermal electron population ( jun & jones 1999 ) although jones & kang ( 1993 ) argue that such enhancements occur primarily when the incident shock is already dominated by cosmic - ray pressure .
an alternative interpretation for the featureless x - ray spectrum from g347.3@xmath00.5 could be thermal emission from material dominated by low-@xmath107 elements ( h , he , c , o ) which are fully ionized ( hamilton , sarazin , szymkowiak , & vartanian 1985 ) .
hamilton , sarazin , & szymkowiak ( 1986 ) proposed a scenario for sn  1006 in which the ejecta from the type ia explosion were stratified in such a way as to yield an outer region dominated by such featureless emission .
in addition they were able to obtain an approximately power - law spectral form by integrating over the power - law distribution of thermal components that came out of their dynamical model . however , koyama et al .
( 1995 ) argue convincingly that their asca observations of sn  1006 rule this model out .
a similar scenario has been revisited by laming ( 1998 ) who concludes that the flux associated with the featureless components of sn  1006 and g347.3@xmath00.5 , if interpreted as thermal in nature , would imply an x - ray emitting mass of low-@xmath107 elements far in excess of that expected to be ejected by a type ia supernova explosion .
thus , while this mechanism could potentially explain some small featureless components ( _ e.g. _ for ic443 or cas a ) it does not appear to be a viable explanation for the spectrum of g347.3@xmath00.5 .
recent model calculations by baring et al .
( 1999 ) suggest that the soft x - ray flux of young remnants with parameters typical of type ia explosions should be dominated by bremsstrahlung emission .
however , these authors do find models that produce spectra dominated by synchrotron emission up to and beyond 10  kev .
one of these ( their model `` d '' ) uses @xmath108 , ambient density @xmath109 , ejecta mass @xmath110 , and an age of 40,000 yrs . with the exception of the explosion energy ( which is probably unrealistically large anyway ) , these parameters are moderately consistent with a picture in which g347.3@xmath00.5 is a moderate age snr which is in a low density environment
.    the characteristics of the unidentified x - ray source 1wgaj1713.4@xmath03949 are marginally consistent with those for a neutron star .
the high x - ray to optical flux ratio virtually rules out a stellar counterpart but is consistent with the source being a neutron star .
the lack of detected pulsations at current sensitivities does not provide a strong discriminator in the interpretation .
the spectral characteristics of the blackbody model provide a curious scenario if accurate , however .
the luminosity implied by the spectral fit is considerably higher than expected for hot polar cap models unless the neutron star is spinning with a period of @xmath111  ms . with the rather sparse spectrum ,
it is conceivable that an additional spectral component ( e.g. , softer blackbody emission from the entire surface ) is contributing to the somewhat high flux . alternatively , as mentioned earlier , the source could be an extragalactic background object unrelated to the snr .
more sensitive x - ray measurements are needed to address this .
if 1wgaj1713.4@xmath03949 is indeed a neutron star associated with g347.3@xmath00.5 , then g347.3@xmath00.5 differs from sn  1006 in a very fundamental way in that the latter is the remnant of a type ia explosion .
association with the molecular cloud seen in co would lead to a similar conclusion ; the remnant presumably then originated from a high mass progenitor which , in its short lifetime , did not migrate far from its birthplace .
models for cosmic ray production from shell - type remnants would thus need to accommodate the very different environments expected from the two types of progenitors . in this case
, we expect the evolution of g347.3@xmath00.5 to have initially been dominated by the effects of a precursor wind cavity .
if our preferred distance of 6 kpc , as suggested by the apparent association with the molecular cloud complex , is correct , then the remnant now has a radius of over 50  pc which is still well within the expected size of the stellar wind bubble for massive o - type stars ( chevalier & liang 1989 ) .
this could provide a logical explanation for both the low density inferred from the lack of thermal x - ray emission as well as the presence of a molecular cloud interaction site .
the strong nonthermal x - ray emission observed from g347.3@xmath00.5 provides tantalizing evidence for the second case of a direct signature of cosmic ray acceleration in snrs .
like sn  1006 , this remnant is very faint in the radio .
the peak radio surface brightness of sn  1006 is @xmath112 at the same frequency and resolution , which is comparable to arc 2 of g347.3@xmath00.5 .
however , in distinct contrast , g347.3@xmath00.5 shows no evidence of the thermal x - ray emission typically associated with ism and ejecta material heated by the snr shock , nor is the morphology as distinctly shell - like as sn  1006 .
we have shown that nonthermal x - ray emission pervades the entire image of g347.3@xmath00.5 .
faint radio emission appears to delineate a nearly complete shell with brighter arc - like features along regions of bright x - ray emission .
co observations suggest that these features coincide with a region in which the snr may be interacting with a molecular cloud found along the line of sight .
several lines of evidence , including an association with this molecular cloud complex as well as an  region , suggest that the most appropriate distance to the remnant is 6 kpc . the lack of thermal emission sets a strong limit on the mean density around the remnant : @xmath113 .
although this is rather low for the near vicinity of a molecular cloud , we argue that it means the majority of the remnant is evolving in the low density interior of the large circumstellar cavity driven by the wind of its massive progenitor star .
simple sedov - phase models for the remnant s evolutionary state can be found that are consistent with this low density environment for reasonable values of the age and explosion energy .
however in the absence of an actual measurement of the thermal properties of the remnant , any conclusions about the evolutionary state of the remnant remain premature . in the x - ray bright region toward the northwest edge of g347.3@xmath00.5 , where an interaction with denser gas may be occurring , the limits on the ambient density are higher @xmath114 and broadly consistent with the densities estimated around other snrs that are associated with molecular clouds ( e.g. , n132d in the large magellanic cloud , see discussion in hughes , hayashi , and koyama 1998 ) . regardless of its precise evolutionary state , our observations reveal g347.3@xmath00.5 to be the most extreme example known of a nonthermal shell - type x - ray remnant and may indicate that shock acceleration of cosmic rays by supernova remnants can occur in a diversity of interstellar environments .
additional measurements will help shed light on the nature of g347.3@xmath00.5 .
in particular , a search for oh maser emission ( frail et al .  1996 ) along the nw limb could confirm a molecular cloud interaction there .
optical observations of this region could also provide evidence of such an interaction , but the extinction is rather high making such observations difficult .
deeper x - ray observations which might reveal and characterize the thermal component are needed , as are additional observations of the centrally - located source in order to assess the potential for association as the compact relic of the explosion which produced g347.3@xmath00.5 . while the x - ray spectrum of the snr clearly indicates the presence of very high energy electrons , and by inference the acceleration of cosmic rays , further study is required to provide a sufficiently constrained picture of g347.3@xmath00.5 to
which acceleration models can be compared .
higher - energy x - ray observations to search for any change in the spectral index which might be associated with a bremsstrahlung component will be important in this regard , as will higher - resolution spatial and spectral observations to provide additional information on the shock structure , and more sensitive observations to search for thermal emission .
we gratefully acknowledge t.  handa and t.  hasegawa of the university of tokyo who kindly shared their co(21 ) observations in the vicinity of g347.3@xmath00.5 prior to publication .
the most is operated by the university of sydney with support from the australian research council and the science foundation for physics within the university of sydney .
bmg acknowledges the support of an australian postgraduate award . this work was supported in part by the national aeronautics and space administration through contract nas8 - 39073 and
grant nag5 - 4803 .
jph acknowledges support through nasa grants nag 5 - 4794 and nag 5 - 4871 .


random privacy amplification based on the universal@xmath3 condition@xcite has been studied by many authors@xcite .
this technique is originally aimed for random number extraction@xcite .
it can be applied to secret key distillation ( agreement ) with public communication@xcite and wire - tap channel@xcite , which treats the secure communication in the presence of an eavesdropper .
( for details of its application , see e.g. hayashi @xcite . ) when random privacy amplification is implemented by a universal@xmath3 hash function , it can yield protocols for the above tasks with a relatively small amount of calculation . similar to the study @xcite for random privacy amplification based on the universal@xmath3 condition , hayashi@xcite focused only on the mutual information with the eavesdropper .
however , as the secrecy criterion , many papers in cryptography community @xcite dopt the half of the @xmath0 norm distance , which is also called the variation distance or eve s distinguishability .
because this criterion is closely related to universally composable security @xcite , it is required to evaluate the leaked information based on the @xmath0 norm distance from cryptography community viewpoint .    in this paper , we adopt the @xmath0 norm distance as the secrecy criterion , and evaluate the secrecy for random privacy amplification while hayashi@xcite adopts the mutual information criterion . in the independent and identical distributed case , when the rate of generating random numbers is smaller than the entropy of the original information source , it is possible to generate the random variable whose @xmath0 norm distance to the uniform random number approaches zero asymptotically
. however , in the real setting , we can manipulate only a finite size of random variables .
so , the speed of this convergence is very important . in the community of information theory , in order to discuss the speed , we often focus on the the exponential rate of decrease .
this rate is called the exponent , and is widely discussed among several topics in information theory , e.g. , channel coding@xcite , source coding@xcite , and mutual information criterion in wire - tap channel@xcite .
however , the exponent has not been discussed in the community of cryptography as an important criterion .
the purpose of this paper is establishing a systematic evaluating method for exponent for the @xmath0 norm distance in secure protocols .    in subsection [ s2a ] , for a given generating rate and a given source distribution , in the i.i.d .
setting , we derive a lower bound of the exponent of the average of the @xmath0 norm distance between the generated random number and the uniform random number when universal@xmath3 hash function is applied
. then , we introduce a stronger condition for hash functions , which is called strongly universal@xmath3 function , and show that our lower bound is tight under this condition . since our bound realizes the optimal exponent , it is thought to be powerful even for the finite length setting .
we consider the @xmath4-independent and identical extension , and show that the exponential rate of decrease for this bound is tight under a stronger condition by using the type method@xcite . however , if our protocol generating the random number depends on the original distribution , there is a possibility to improve the exponent while it is known that asymptotic generation can not be improved@xcite . in subsection
[ s3 ] , we derive the optimal exponent in this setting by using the cramer s theorem @xcite and the type method @xcite . comparing these two exponents , we can compare the performances between the protocol based on universal@xmath3 hash function and the protocol depending on the information source .    in information theory ,
the part constructing the protocol achieving the rate is called the direct part . and
the proof for non - existence surpassing the rate is called the converse part . concerning the exponent of the @xmath0 norm distance with universal@xmath3 hash function , the direct part is relatively simple while the converse part is more complicated .
the converse part is regarded as an important topic in information theory , while it has been regarded as a minor topic in other research areas .
in the direct part , we focus on bennett et al@xcite s evaluation for random privacy amplification , which employs the rnyi entropy of order 2 .
this evaluation was also obtained by hastad et al @xcite and is often called leftover hash lemma . using the same discussion as renner @xcite
, we derive an upper bound for the @xmath0 norm distance .
renner @xcite applied @xmath5 approximation idea ( smoothing ) to min - entropy , which bounds the rnyi entropy of order 2 . in this paper , we apply the same idea to the rnyi entropy of order 2 .
however , for the evaluation of the smoothing error , we use a method different from the method invented by holenstein - renner@xcite , but our method is standard in large deviation theory@xcite .
in fact , as is shown in subsection [ s2b ] , our evaluation is much better than that by holenstein - renner@xcite .
then , we obtain a bound based on the rnyi entropy of order @xmath1 as the main theorem ( theorem [ thm1 ] ) .
note that , hayashi@xcite obtained a similar result using the rnyi entropy of order @xmath1 , but it evaluates the shannon entropy not the @xmath0 norm distance .
contrastly , in the converse part , we employ type method , which was invented by csiszr and krner @xcite .
the discussion of this part is quite technical , but conventional in information theory . concerning the exponent of the protocol depending on the original distribution ,
the direct part can be shown by the combination of a new invented lemma ( lemma [ lemdi ] ) and cramer s theorem in large deviation theory@xcite .
the converse part can be shown by very technical application of the type method@xcite .    in section [ s42 ] , we consider the case when an eavesdropper has a random variable correlated to the random variable of the authorized user . in this case , when the authorized user applies universal@xmath3 hash function to his random variable , he obtain a secure random variable .
when we apply theorem [ thm1 ] to the security by @xmath0 norm distance in this setting , we obtain a tighter evaluation than existing evaluation than that directly obtained from hayashi@xcite .    in section [ s2 ] , we focus on wire - tap channel model , whose capacity has been calculated by wyner @xcite and csiszr and krner @xcite .
csiszr @xcite showed the strong security , and hayashi @xcite derived bounds for both exponential rates of decrease for the mutual information between alice and eve and the security criterion based on the @xmath0 norm distance , which is simply called the @xmath0 security criterion .
he obtained a bound for the exponential rate of decrease concerning the @xmath0 security criterion .
however , their approaches are based on completely random coding . using the method of information spectrum@xcite ,
hayashi @xcite showed strong security when universal@xmath3 hash function is applied in the privacy amplification process of wire - tap channel .
but , the analysis on @xcite was based on the mutual information not the @xmath0 security criterion . in the paper@xcite , he invented a systematic method to construct a wire - tap channel code based on universal@xmath3 hash function , and evaluated the performance based on a privacy amplification theorem concerning the shannon entropy given in @xcite .
so , we can expect that theorem [ thm1 ] plays the same role in evaluation of the @xmath0 security criterion in wire - tap channel model as a privacy amplification theorem concerning the shannon entropy given in @xcite . in this paper
, we apply theorem [ thm1 ] to wire - tap channel model , and obtain the evaluation of the exponent of the @xmath0 security criterion . in fact
, we can evaluate the exponent of the @xmath0 security criterion from the evaluation for exponent concerning the mutual information in @xcite by applying the pinsker inequality to the mutual information .
it is also shown in section [ s6 - 1 ] , that the evaluation obtained in this paper is better than that by @xcite and that obtained by application of pinsker inequality .    in section [ s6 ] , the same discussion as sections v and vi in @xcite
can be applied to the @xmath0 security criterion with a suitable modification . in the additive noise case ,
the obtained bound can be attained by linear operation .
further , we obtain the bound for the @xmath0 security criterion in one - way secret key distillation by the same discussion as sections vi in @xcite . in appendix [ as2 ] , we prove theorem [ thm2 ] mentioned in subsection [ s2a ] . in appendix
[ al9 - 9 - 1 ] , we prove lemma [ l9 - 9 - 1 ] given in subsection [ s3 ] .
firstly , we consider the uniform random number generation problem from a biased random number @xmath6 , which obeys a probability distribution @xmath7 when its cardinality @xmath8 is finite .
there are two types protocols for this problem .
one is a protocol specialized for the given distribution @xmath7 .
the other is a universal protocol that does not depends on the given distribution @xmath7 .
the aim of this section is evaluate the performance of the latter setting . in the latter setting , our protocol is given by a function @xmath9 from @xmath10 to @xmath11 . in order to evaluate the protocol @xmath9 , we use the @xmath0 distance ( the variational distance ) @xmath12 and the @xmath13 distance @xmath14 these definitions can be extended when the total measure is less than @xmath15 i.e. , @xmath16 . in the following , we call such @xmath7 a sub - distribution .
this extension for sub distributions is crucial for the later discussion .
then , the quality of the random number obeying the distribution @xmath7 is evaluated by @xmath17 where @xmath18 is the uniform distribution on @xmath10 .
we also use the quantitty @xmath19 and the rnyi entropy order @xmath1 : @xmath20 the @xmath13 distance is written by using the rnyi entropy order @xmath21 as follows .
@xmath22    now , we focus on an ensemble of the functions @xmath23 from @xmath10 to @xmath24 , where @xmath25 denotes a random variable describing the stochastic behavior of the function @xmath23 .
an ensemble of the functions @xmath23 is called universal@xmath3 hash when it satisfies the following condition@xcite :    @xmath26 , the collision probability that @xmath27 is at most @xmath28 .
we sometimes require the following additional condition :    for any @xmath25 , the cardinality of @xmath29 does not depend on @xmath30 .
this condition will be used in section iii .
indeed , when the cardinality @xmath8 is a power of a prime power @xmath31 and @xmath32 is another power of the same prime power @xmath31 , as is shown in appendix ii of hayashi @xcite , the ensemble @xmath33 can be given by the concatenation of toeplitz matrix and the identity @xmath34@xcite only with @xmath35 random variables taking values in the finite field @xmath36 .
that is , the function can be obtained by the multiplication of the random matrix @xmath34 taking values in @xmath36 . in this case ,
condition [ c12 ] can be confirmed because the rank of @xmath34 is constant . for condition [ c1 ] ,
see appendix ii of hayashi @xcite .
bennett et al@xcite essentially showed the following lemma .
a universal@xmath3 function @xmath23 satisfies @xmath37    this was also shown by hastad et al @xcite and is often called leftover hash lemma .
now , we follow the derivation of theorem 5.5.1 of renner @xcite when one classical random variable is given .
the schwarz - inequality implies that @xmath38 the jensen inequality yields that @xmath39 substituting ( [ 5 - 14 - 3 ] ) and ( [ 5 - 14 - 4 ] ) into the above inequality , we obtain @xmath40    using ( [ 5 - 14 - 6 ] ) , we can show the following theorem as a generalization of ( [ 5 - 14 - 6 ] ) .
a universal@xmath3 function @xmath23 satisfies @xmath41    substituting @xmath42 , we obtain @xmath43 since the difference between ( [ 5 - 14 - 6 ] ) and ( [ 5 - 14 - 7 ] ) is only the coefficient , theorem [ thm1 ] can be regarded as a kind of generalization of bennett et al@xcite s result ( [ 5 - 14 - 4 ] ) .
for any @xmath44 , we choose subset @xmath45 , and define the subdistribution @xmath46 by @xmath47 since @xmath48 , @xmath49 the inequality ( [ 5 - 14 - 6 ] ) yields @xmath50 for @xmath51 , we can evaluate @xmath52 and @xmath53 as @xmath54 combining ( [ 5 - 14 - 10 ] ) , ( [ 5 - 14 - 8 ] ) , and ( [ 5 - 14 - 9 ] ) , for @xmath55 , we obtain @xmath56 where we substitute @xmath57 into @xmath58 .
next , we consider the case when our distribution @xmath59 is given by the @xmath4-fold independent and identical distribution of @xmath60 , i.e , @xmath61 . when the random number generation rate @xmath62 is @xmath63 , we focus on the _ exponential rate of decrease _ of @xmath64 , and consider the supremum .
when an ensemble @xmath65 is a universal@xmath3 hash functions from @xmath66 to @xmath67 , theorem [ thm1 ] yields that @xmath68 on the other hand , when we apply the pinsker inequality@xcite to the upper bound for the mutual information obtained in hayashi@xcite , we obtain another bound @xmath69 , which is smaller than ( [ 4 - 19 - 2 ] ) .
the right hand side of ( [ 4 - 19 - 2 ] ) is equal to the optimal exponential rate in the fixed - length source coding .
the following lemma is known @xcite :    assume that @xmath60 is a probability distribution and the random number generation rate @xmath63 is greater than the critical rate @xmath70 , where @xmath71 .
using kullback - leibler divergence @xmath72 , we have the following expression .
@xmath73    here
the last equation of ( [ 9 - 7 - 1 ] ) can be checked in the following way .
@xmath74 is equal to the minimum exponent for correct decoding probability when the compression rate is @xmath63@xcite .
this minimum exponent is equal to @xmath75@xcite .
hence , we obtain the last equation .    in oder to show the tightness of the exponential rate decrease ( [ 9 - 7 - 1 ] ) under the universal@xmath3 condition , we consider the following ensemble .    for any @xmath76 , @xmath77 .
the random variable @xmath78 is independent of @xmath79 for different arbitrary two elements @xmath80 .    under the strongly universal@xmath3 ensemble , and any subset @xmath81 with @xmath82 satisfies @xmath83    its proof is given in appendix [ as2 ] .
using theorem [ thm2 ] and lemma [ lem9 ] with @xmath84 and applying the type method for fixed length source coding @xcite , we can show the following proposition :    let @xmath85 be the set of empirical distributions on @xmath10 with @xmath4 trials .
assume the following conditions : @xmath86 .
when @xmath87 , any sequence of strongly universal@xmath3 ensemble @xmath88 from @xmath66 to @xmath67 satisfies the equation @xmath89    when @xmath90 , applying the type method for fixed length source coding @xcite to the random variable @xmath91 , we obtain @xmath92 using theorem [ thm2 ] with @xmath93 , we obtain @xmath94 thus , @xmath95 in particular , when @xmath87 , the equations @xmath96 hold .
since @xmath87 , lemma [ lem9 ] yields that @xmath89    therefore , we can conclude that our exponential rate of decrease is tight for the strongly universal@xmath3 condition when @xmath87 .
in the above derivation , the key point is evaluating @xmath97 in the @xmath4-i.i.d .
setting , i.e. , @xmath98 . in the community of cryptography , they often use holenstein - renner @xcite evaluation for @xmath53 in the @xmath4-i.i.d . setting .
they proved the following theorem .    when @xmath99 , @xmath100 further , when @xmath101 and @xmath102 , @xmath103 when @xmath104 , the inequality yields the following evaluation .
when @xmath105 , @xmath106 for even @xmath4 .
our evaluation ( [ 5 - 14 - 9 ] ) of @xmath98 contains the parameter @xmath107 .
since this parameter is arbitrary , it is natural to compare the upper bound @xmath108 given by ( [ 5 - 14 - 9 ] ) with that by theorem [ holenstein ] . that is , using ( [ 5 - 14 - 9 ] ) , we obtain the exponential evaluation @xmath109 while theorem [ holenstein ] yields that @xmath110 in this case , the upper bound is @xmath111 for @xmath101 and @xmath112 for @xmath113 .
in fact , the probability @xmath97 is the key quantity in the method of information spectrum , which is a unified method in information theory@xcite . when the method of information spectrum is applied to the i.i.d .
source , the probability @xmath97 is evaluated by applying cramr theorem ( see @xcite ) to the random variable @xmath114 .
then , we obtain @xmath115 for @xmath116 . since @xmath117 is concave , when @xmath118 , the maximization can be attained in @xmath119 $ ] , i.e. ,
@xmath120 which implies that our evaluation ( [ 5 - 14 - 9 ] ) gives the tight bound for exponential rate of decrease for the probability @xmath98 .
in fact , the difference among these bounds is numerically given in fig . [ f2 ] . therefore , we can conclude that our evaluation ( [ 5 - 14 - 9 ] ) is much better than that by holenstein - renner @xcite .
that is , combination of lemma 1 and ( [ 5 - 14 - 9 ] ) is essential for deriving the tight exponential bound .
next , we consider a function @xmath9 from @xmath10 to @xmath121 specialized to a given probability distribution @xmath7 . this problem is called intrinsic randomness , which was studied with general source by vembu and verd @xcite .
hayashi@xcite discussed the relation between the second order asymptotic rate and central limit theorem . in the following , for the comparison with the exponential rate of decrease for ( [ 9 - 7 - 1 ] )
, we derive the optimal exponential rate of decrease for a given rate generating uniform random number .
the following lemma is useful for this purpose .
any probability distribution @xmath7 and any function @xmath9 from @xmath10 to @xmath121 satisfy that @xmath122    when @xmath123 is not empty , @xmath124 thus , we obtain @xmath125 which implies ( [ 9 - 8 - 1 ] ) .
concerning the opposite inequality , we consider the case when our distribution @xmath59 is given by the @xmath4-fold independent and identical distribution of @xmath60 , i.e , @xmath61 . in this setting
, we have the following lemma .    for any probability distribution @xmath7 ,
there exists a function @xmath126 from @xmath66 to @xmath127 such that @xmath128 where @xmath85 is the set of empirical distribution with @xmath4 trials , and @xmath129 is the set of data with the empirical distribution @xmath130 .    in the first step ,
we define the function @xmath126 . in the second step ,
we show that the function satisfies ( [ 9 - 9 - 1 ] ) .    using the integer @xmath131
, we divide @xmath85 into three parts : @xmath132 the condition that @xmath133 is equivalent with the condition that @xmath134 for @xmath135 .
hence , @xmath136 so , @xmath137 since @xmath138 we have @xmath139 therefore , we can choose @xmath140 on @xmath141 satisfying the following conditions .
( 1 ) for @xmath142 , @xmath143 . ( 2 )
@xmath144 injective for @xmath145 .
( 3 ) @xmath146 for @xmath147 .
further , we choose @xmath140 satisfying the additional condition .
( 4 ) any type @xmath147 satisfies that @xmath148 for @xmath149 .
then , for @xmath147 , we obtain @xmath150 next , we define @xmath126 on the whole set by modifying @xmath140 as follows .
( 5 ) @xmath126 is the same as @xmath140 on @xmath151 .
( 6 ) @xmath152 .    therefore , our remaining task is to evaluate the value @xmath153 , where @xmath154_+,\\ [ x]_+&:=\left\ { \begin{array}{ll }   x & \hbox { if } x \ge 0 \\ 0 & \hbox { if } x < 0 .
\end{array }   \right.\end{aligned}\ ] ] then , ( [ 2 - 2 - 6 ] ) implies that @xmath155 for @xmath156 , ( [ 2 - 2 - 1 ] ) implies @xmath157 for @xmath158 , @xmath159    combining ( [ 2 - 2 - 2 ] ) , ( [ 2 - 2 - 3 ] ) , and ( [ 2 - 2 - 4 ] ) , we obtain @xmath160 which implies ( [ 9 - 9 - 1 ] ) .    using the above two lemmas , we obtain the following theorem .
assume that @xmath161 .
@xmath162 where the above minimum is taken among functions @xmath126 from @xmath163 to @xmath164
.    combining lemma [ lem9 ] and theorems [ thm2 ] and [ t9 - 9 - 1 ] , we can compare the performances between random universal protocol and specialized protocol .
so , our exponential rate of decrease for the protocol based on universal@xmath3 hash functions is slightly smaller than the optimal exponential rate of decrease for specialized protocols .    using cramer s theorem@xcite
, we obtain @xmath165 further , @xmath166 so , the remaining task is show that @xmath167 which can be shown from lemma [ l9 - 9 - 1 ] .
( both cases in lemma [ l9 - 9 - 1 ] are required for this derivation . )
when @xmath161 , @xmath168 when @xmath169 , @xmath170    its proof is given in appendix [ al9 - 9 - 1 ] .
next , we consider the secure key generation problem from a common random number @xmath6 which has been partially eavesdropped on by eve . for this problem , it is assumed that alice and bob share a common random number @xmath6 , and eve has another random number @xmath171 , which is correlated to the random number @xmath172 .
the task is to extract a common random number @xmath173 from the random number @xmath6 , which is almost independent of eve s random number @xmath171 . here
, alice and bob are only allowed to apply the same function @xmath9 to the common random number @xmath6 .
then , when the initial random variables @xmath174 and @xmath175 obey the distribution @xmath176 , eve s distinguishability can be represented by the following value : @xmath177 where @xmath178 is the product distribution of both marginal distributions @xmath179 and @xmath180 , and @xmath181 is the uniform distribution on @xmath121 . while the half of this value directly gives the probaility that eve can distingushes the alice s information , we call @xmath182 eve s distinguishability in the following .
this criterion was proposed by @xcite and was used by @xcite . since the half of this quantity @xmath182 is closely related to universally composable security , we adopt it as the secrecy criterion in this paper . as another criterion , we sometimes treat @xmath183 since @xmath184 , we have @xmath185 further , @xmath179 is the uniform distribution , the above both criteria coincide with each other .    in order to evaluate the average performance
, we define the quantity @xmath186 thus , using theorem [ thm1 ] and putting @xmath187 , we obtain the inequality : @xmath188 for @xmath189 and any universal@xmath3 hash function @xmath33 . note
that when eve s random variable @xmath175 takes a continuous value in the set @xmath190 , the relation ( [ 4 - 25 - 1 ] ) holds by defining @xmath191 in the following way .
@xmath192    next , we consider the case when our distribution @xmath193 is given by the @xmath4-fold independent and identical distribution of @xmath194 , i.e , @xmath195 .
ahlswede and csiszr @xcite showed that the optimal generation rate @xmath196 equals the conditional entropy @xmath197 .
that is , the generation rate @xmath198 is smaller than @xmath197 .
the quantity @xmath199 goes to zero . in order to treat the speed of this convergence , we focus on the supremum of the _ exponential rate of decrease ( exponent ) _ for @xmath199 for a given @xmath63 @xmath200
since the relation @xmath201 holds , the inequality ( [ 4 - 25 - 1 ] ) implies that @xmath202 when we apply pinsker inequality to the lower bound given in ( 5 ) of @xcite , we obtain @xmath203 where we define the function @xmath204 for @xmath2 $ ] . since @xmath205 , the right hand sides of ( [ 4 - 16 - 4 ] ) and ( [ 2 - 3 - 1 ] ) are strictly greater than @xmath15 for @xmath206 . concerning the comparison of both bounds , the following lemma holds .
@xmath207    for @xmath206 .
for example , we consider the following case : @xmath208 equals @xmath190 , the set @xmath208 has the module structure , and the conditional distribution @xmath209 has the form @xmath210 . then , both bounds can be simplified to @xmath211 in particular , the both exponents are numerically plotted in fig .
[ f3 ] when @xmath212 , and @xmath213 , @xmath214 .
we choose @xmath215 .
then , applying jensen inequality to the concave function @xmath216 , we have @xmath217 where @xmath218 .
thus , obtain ( [ 2 - 4 - 2 ] ) .
next , we consider the wire - tap channel model , in which the eavesdropper ( wire - tapper ) , eve and the authorized receiver bob receive information from the authorized sender alice . in this case , in order for eve to have less information , alice chooses a suitable encoding .
this problem is formulated as follows .
let @xmath219 and @xmath220 be the probability spaces of bob and eve , and @xmath221 be the set of alphabets sent by alice .
then , the main channel from alice to bob is described by @xmath222 , and the wire - tapper channel from alice to eve is described by @xmath223 . in this setting , in order to send the secret message in @xmath121 subject to the uniform distribution , alice chooses @xmath32 distributions @xmath224 on @xmath221 , and she generates @xmath225 subject to @xmath226 when she wants to send the message @xmath227 .
bob prepares @xmath32 disjoint subsets @xmath228 of @xmath219 and judges that a message is @xmath30 if @xmath229 belongs to @xmath230 .
therefore , the triplet @xmath231 is called a code , and is described by @xmath232 .
its performance is given by the following three quantities .
the first is the size @xmath32 , which is denoted by @xmath233 .
the second is the average error probability @xmath234 : @xmath235 and the third is eve s distinguishability @xmath236 : @xmath237 ) \\
w^e_{\phi}(e )   : = & \sum_i \frac{1}{m } w_{q_i}^e(e ) , \quad w^e[\phi](i , e )   : = \frac{1}{m } w_{q_i}^e(e).\end{aligned}\ ] ] the quantity @xmath236 gives an upper bound for the probability that eve can succeed in distinguishing whether alice s information belongs to a given subset .
so , the value can be regarded as eve s distinguishability . in order to calculate these values
, we introduce the following quantities .
@xmath238 where @xmath239 .
the following lemma gives the property of @xmath240 .
when the random variable @xmath241 takes a continuous value in the set @xmath242 while @xmath243 takes discrete value , the above definition can be changed to @xmath244 these definitions do not depend on the choice of the measure on @xmath242 . that is , when @xmath245 for a positive function @xmath9 , @xmath246    the function @xmath247 is convex for @xmath248 $ ] , and is concave for @xmath249 $ ] .
see lemma 1 of hayashi @xcite .    then , we obtain the following theorem .
there exists a code @xmath232 for any integers @xmath250 , and any probability distribution @xmath251 on @xmath221 such that @xmath252 and @xmath253    we can construct the code satisfying the above conditions by the same way as section iii of @xcite .
this theorem can be shown by replacing the concavity of @xmath254 and ( 3 ) in @xcite by the concavity of @xmath255 and the inequality ( [ 4 - 25 - 1 ] ) , respectively if we take care of the following point .
when @xmath251 is the uniform distribution on the set @xmath256 and the joint distribution @xmath257 is given by @xmath258 , the equations @xmath259 hold . in the discussion in section iii of @xcite ,
the main point is ( 12 ) of @xcite , which is essentially equivalent with ( [ 12 - 26 - 1-a ] ) . in the proof of theorem
[ 3 - 6 ] , we need to modify ( 12 ) of @xcite by using ( [ 12 - 26 - 1 ] ) .    in the @xmath4-fold discrete memoryless channels @xmath260 and @xmath261 of the channels @xmath262 and @xmath263 , the additive equation @xmath264 holds .
thus , there exists a code @xmath265 for any integers @xmath266 , and any probability distribution @xmath251 on @xmath221 such that @xmath267 and @xmath268 since @xmath269 , the rate @xmath270 can be asymptotically attained .
therefore , when the sacrifice information rate is @xmath63 , i.e. , @xmath271 , the exponential rate for decrease of eve s distinguishability is greater than @xmath272 .    in the @xmath4-fold discrete memoryless channels @xmath260 and @xmath261 of the channels @xmath262 and @xmath263 , the additive equation @xmath264 holds .
thus , there exists a code @xmath265 for any integers @xmath266 , and any probability distribution @xmath251 on @xmath221 such that @xmath267 and @xmath268 since @xmath269 , the rate @xmath270 can be asymptotically attained .
therefore , when the sacrifice information rate is @xmath63 , i.e. , @xmath271 , the exponential rate of decrease for eve s distinguishability is greater than @xmath272 .
now , we compare the lower obtained bound @xmath273 for the exponential rate of decrease for eve s distinguishability with existing lower bounds @xcite .
as existing lower bounds , hayashi @xcite derived a lower bound of this exponential rate of decrease @xmath274 .
hayashi @xcite also derived a lower bound @xmath275 of this exponential rate of decrease for the mutual information .
application of pinsker inequality to this bound yields the bound @xmath276 , which is smaller than our lower bound @xmath277 because @xmath278 for @xmath51 .    in the following ,
we compare the two bounds @xmath273 and @xmath277 for this purpose , we treat @xmath279 and @xmath280 for @xmath189 .
reverse hlder inequality @xcite with the measurable space @xmath281 is given as @xmath282 for @xmath283 . using this inequality ,
we obtain @xmath284 w_p(y)^{-s } \\ \ge &   \left (   \sum_y   \left [ \sum_x p(x ) ( w_x(y))^{1+s } \right]^{\frac{1}{1+s } } \right)^{1+s } \cdot   \left ( \sum_y   w_p(y)^{-s\cdot -\frac{1}{s } } \right)^{-s } \\ = & \left (   \sum_y   \left [ \sum_x p(x ) ( w_x(y))^{1+s } \right]^{\frac{1}{1+s } } \right)^{1+s}.\end{aligned}\ ] ] substituting @xmath285 , we obtain @xmath286 w_p(y)^{\frac{-t}{1-t } } \\ \ge & \left (   \sum_y   \left [ \sum_x p(x ) ( w_x(y))^{\frac{1}{1-t } } \right]^{1-t } \right)^{\frac{1}{1-t}},\end{aligned}\ ] ] which implies @xmath287 w_p(y)^{\frac{-t}{1-t } } \right)^{1-t } \\ \ge & \sum_y   \left [ \sum_x p(x ) ( w_x(y))^{\frac{1}{1-t } } \right]^{1-t } = e^{\phi(t|w^e , p)}.\end{aligned}\ ] ] thus , our bound @xmath273 for the exponential rate of decrease is better than the existing bound @xmath277 @xcite .
assume that @xmath288 .
we consider the following channel .
@xmath289 when @xmath290 , @xmath291 then , the three bounds @xmath292 , @xmath293 , and @xmath294 with @xmath295 are numerically compared as in fig .
[ f4 ] .
next , we consider a more specific case .
when @xmath296 and @xmath297 is a module and @xmath298 , the channel @xmath299 is called _
any additive channel @xmath263 satisfies @xmath300 for the uniform distribution @xmath301 on @xmath297 because @xmath302 we consider a more general case .
eve is assumed to have two random variables @xmath303 and @xmath304 .
the first random variable @xmath305 is the output of an additive channel depending on the second variable @xmath304 .
that is , the channel @xmath306 can be written as @xmath307 , where @xmath308 is a joint distribution .
hereinafter , this channel model is called a general additive channel .
this channel is also called a regular channel@xcite . for this channel model , the equalities @xmath309
hold because @xmath310
furthermore , in a practical sense , we need to take into account the decoding time . for this purpose , we often restrict our codes to linear codes . in the following ,
we consider the case where the sender s space @xmath221 has the structure of a module . here
, we should remark that hayashi @xcite considered the completely random ensemble of codes .
he did not consider universal@xmath3 condition .
so , we can not derive the following discussion from his result @xcite while his bound for exponential rate is the same as our bound when eve s channel is additive or general additive .
such a required code can be constructed by the same discussion as section v of @xcite . when we generate codes @xmath232 by the same method as in @xcite ,
the average of @xmath236 is bounded by @xmath311 .
this result can be applied to one - way secret key distillation by the same way as section vi of @xcite . in this problem , alice , bob , and eve
are assumed to have initial random variables @xmath312 , @xmath313 , and @xmath314 , respectively . the task for alice and bob is to share a common random variable almost independent of eve s random variable @xmath315 by using a public communication . for this purpose
, we assume that alice and bob can perform local data processing in the both sides and alice can send messages to bob via public channel .
that is , only one - way communication is allowed .
we call such a combination of these operations a code and denote it by @xmath232 .
the quality is evaluated by three quantities : the size of the final common random variable , the probability that their final variables coincide , and eve s distinguishability @xmath236 of the final joint distribution between alice and eve .
then , we can construct the same code @xmath232 as given in section vi of@xcite for any numbers @xmath32 and @xmath316 .
it follows from the similar discussion that this code satisfies that @xmath317 and @xmath318
we have derived the tight evaluation for exponent for the average of the @xmath0 norm distance between the generated random number and the uniform random number when universal@xmath3 hash function is applied and the key generation rate is less than the critical rate @xmath319 . using this evaluation ,
we have obtained an upper bound for eve s distinguishability in secret key generation from a common random number without communication when a universal@xmath3 hash function is applied . since our bound is based on the rnyi entropy of order @xmath1 for @xmath2 $ ] , it can be regarded as an extension of bennett et al @xcite s result with the rnyi entropy of order 2 .    applying this bound to the wire - tap channel , we obtain an upper bound for eve s distinguishability , which yields an exponential upper bound .
this exponent improves on the existing exponent @xcite .
further , when the error correction code is given by a linear code and when the channel is additive or general additive , the privacy amplification is given by a concatenation of toeplitz matrix and the identity matrix .
this method can be applied to secret key distillation with public communication .
the author is grateful to professors ryutaroh matsumoto and takeshi koshiba for a helpful comments .
this research was partially supported by a mext grant - in - aid for young scientists ( a ) no .
the centre for quantum technologies is funded by the singapore ministry of education and the national research foundation as part of the research centres of excellence programme .
first , for a fixed element @xmath320 , we consider the condition @xmath321 we denote the probability that this condition holds and the expectation under this condition by @xmath322 and @xmath323 .
then , @xmath324 and @xmath325      now , using the function @xmath342 , we make a code for the wire - tap channel based on the random coding method . for this purpose
, we make a protocol to share a random number .
first , we generate the random code @xmath343 with size @xmath344 , which is described by the @xmath344 independent and identical random variables @xmath345 subject to the distribution @xmath251 on @xmath221 . for integers @xmath346 and @xmath347 , let @xmath348 be the maximum likelihood decoder of the code @xmath343 .
gallager @xcite showed that the ensemble expectation of the average error probability concerning decoding the input message @xmath174 is less than @xmath349 for @xmath350 . after sending the random variable @xmath174 taking values in the set with the cardinality @xmath351 ,
alice and bob apply the above universal@xmath3 function @xmath23 to the random variable @xmath174 and generate another piece of data of size @xmath32 . here
, we assume that the ensemble @xmath352 satisfies condition [ c12 ]
. then , alice and bob share random variable @xmath353 with size @xmath32 .
this protocol is denoted by @xmath354    let @xmath175 be the random variable of the output of eve s channel @xmath263 . for simplicity , we simplify the uniform distribution @xmath355 on the message space @xmath356 and the distribution @xmath357 on @xmath221 by @xmath358 and @xmath359 .
therefore , since the random variable @xmath174 obeys the uniform distribution @xmath358 , the joint distribution @xmath360 concerning @xmath174 and @xmath175 satisfies @xmath361 for a given code @xmath343 , we apply the inequality ( [ 4 - 25 - 1 ] ) to eve s distinguishability . then , @xmath362 for @xmath363 .
the concavity of @xmath279 ( lemma [ l1 ] ) guarantees that @xmath364 for @xmath363 .
now , we make a code for wire - tap channel by modifying the above protocol @xmath354 .
first , we choose the distribution @xmath226 to be the uniform distribution on @xmath29 .
when alice wants to send the secret message @xmath30 , before sending the random variable @xmath174 , alice generates the random number @xmath174 subject to the distribution @xmath226 .
alice sends the random variable @xmath174 .
bob recovers the random variable @xmath174 , and applies the function @xmath23 .
then , bob decodes alice s message @xmath30 , and this code for wire - tap channel @xmath365 is denoted by @xmath366 . since the ensemble @xmath352 satisfies condition [ c12 ] and the secret message @xmath30 obeys the uniform distribution on @xmath367 , this protocol @xmath366 has the same performance as the above protocol @xmath354 .    finally , we consider what code is derived from the above random coding discussion .
using the markov inequality , we obtain @xmath368 therefore , the existence of a good code is guaranteed in the following way .
that is , we give the concrete performance of a code whose existence is shown in the above random coding method .
we choose @xmath326 such that @xmath327 , where @xmath328 .
when @xmath130 satisfies @xmath329 , @xmath330 hence , @xmath331 the last equation follows from the concavity of @xmath332 concerning @xmath333 .
assume that @xmath161 .
then , @xmath334 . when @xmath335 , @xmath336 which implies ( [ 9 - 9 - 4 ] ) .
assume that @xmath169 .
when @xmath335 , @xmath337 further , when @xmath338 , @xmath339 which implies ( [ 9 - 9 - 5 ] ) .
further , the concavity of @xmath340 and the condition @xmath169 imply that @xmath341 .
thus , we obtain ( [ 2 - 2 - 8 ] ) .
first , we regard a submodule @xmath369 as an encoding for the usual sent message , and focus on its decoding @xmath370 by the authorized receiver .
we construct a code for a wire - tap channel @xmath371}\}_{[x]\in c_1/c_2 } , \{\cd_{[x]}\}_{[x]\in c_1/c_2})$ ] based on a submodule @xmath372 of @xmath373 as follows .
the encoding @xmath374}$ ] is given as the uniform distribution on the coset @xmath375:=x+c_2 $ ] , and the decoding @xmath376}$ ] is given as the subset @xmath377 .
next , we assume that a submodule @xmath378 of @xmath373 with cardinality @xmath379 is generated by a random variable @xmath25 satisfying the following condition .
any element @xmath380 is included in @xmath378 with probability at most @xmath381 .
then , the performance of the constructed code is evaluated by the following theorem .
choose the subcode @xmath378 according to condition [ c3 ] .
we construct the code @xmath382 by choosing the distribution @xmath374}$ ] to be the uniform distribution on @xmath375 $ ] for @xmath375\in c_1/c_2({{\bf x}})$ ] .
then , we obtain @xmath383 where @xmath384 is the uniform distribution on the subset @xmath385 .    this inequality can be shown by ( [ 4 - 25 - 1 ] ) as follows .
now , we define the joint distribution @xmath386 .
the choice of @xmath374}$ ] corresponds to a hashing operation satisfying condition 1 .
then , ( [ 4 - 25 - 1 ] ) yields that @xmath387 is bounded by @xmath388 , which implies ( [ 4 - 27 - 1 ] ) .    next , we consider a special class of channels .
when the channel @xmath263 is additive , i.e. , @xmath389 , the equation @xmath390 holds for any @xmath391 .
thus , the concavity of @xmath279 ( lemma [ l1 ] ) implies that @xmath392 thus , combining ( [ 4 - 27 - 1 ] ) , ( [ 2 - 13 - 1 ] ) , and ( [ 12 - 26 - 2 ] ) , we obtain @xmath393 for @xmath394 .
similarly , when the channel @xmath263 is general additive , i.e. , @xmath395 , combining ( [ 4 - 27 - 1 ] ) , ( [ 2 - 13 - 1 ] ) , and ( [ 5 - 14 - 1 ] ) , we obtain @xmath396 for @xmath394 .    in the following discussion , we assume that @xmath221 is an @xmath4-dimensional vector space @xmath397 over the finite field @xmath36 . in this assumption , as is mentioned in @xcite , the bound can be attained by combination of linear code and the concatenation of toeplitz matrix and the identity @xmath34 of the size @xmath398 .
next , we explain the detail of construction of one - way secret key distillation protocol . first , alice generates another uniform random variable @xmath391 and sends the random variable @xmath399 .
then , the distribution of the random variables @xmath400 ( @xmath401 ) accessible to bob ( eve ) can be regarded as the output distribution of the channel @xmath402 ( @xmath403 ) .
the channels @xmath404 and @xmath405 are given as follows .
@xmath406 where @xmath407 ( @xmath408 ) is the joint probability between alice s initial random variable @xmath172 and bob s ( eve s ) initial random variable @xmath409 ( @xmath315 ) .
hence , the channel @xmath263 is general additive .      in particular , when @xmath221 is an @xmath4-dimensional vector space @xmath397 over the finite field @xmath36 and the joint distribution between @xmath174 and @xmath413(@xmath175 ) is the @xmath4-fold independent and identical distribution ( i.i.d . ) of @xmath414 ( @xmath176 ) , respectively , the relations @xmath415 and @xmath416 hold .
thus , there exists a code @xmath265 for any integers @xmath266 , and any probability distribution @xmath251 on @xmath221 such that @xmath267 and @xmath417 hence , the achievable rate of this protocol is equal to @xmath418 which was obtained by maurer@xcite and ahlswede - csiszr@xcite . here
, since the channels @xmath262 and @xmath263 can be regarded as general additive , we can apply the discussion in section [ s3 ] .
that is , the bound ( [ 2 - 13 - 2 ] ) can be attained with the combination of a linear code and random privacy amplification , which is given in section [ s3 ] .
u. maurer and s. wolf , `` infromation - theoretic key agreement : from weak to strong secrecy for free , '' _ advances in cryptology  eurocrypt 2000 _ , lecture notes in computer science , vol.1807 , pp.351 - 368 , springer - verlag ( 2000 ) .
r. renner and s. wolf , `` simple and tight bounds for information reconciliation and privacy amplification , '' _ asiacrypt 2005 _ , lecture notes in computer science , springer - verlag , vol .
3788 , pp .
199 - 216 , 2005 .
s. watanabe , t. saitou , r. matsumoto , t. uyematsu `` strongly secure privacy amplification can not be obtained by encoder of slepian - wolf code , '' _ proceedings of the 2009 ieee international symposium on information theory _ , volume 2 , seoul , korea , pp . 1298 - 1302 ( 2009 ) ( arxiv:0906.2582 )            a. winter , a. c. a. nascimento , and h. imai , `` commitment capacity of discrete memoryless channels , '' _ proc .
9th cirencester crypto and coding conf .
_ , lncs 2989 , pp 35 - 51 , springer , berlin 2003 ; cs.cr/0304014 ( 2003 )    m. hayashi , `` general non - asymptotic and asymptotic formulas in channel resolvability and identification capacity and its application to wire - tap channel , '' _ ieee trans .
inform . theory _
, vol . * 52*(4 ) , 15621575 , 2006 .
kuptsov , `` holder inequality '' , in hazewinkel , michiel , encyclopaedia of mathematics , springer , ( 2001 ) .
t. holenstein and r. renner , `` on the randomness of independent experiments , '' arxiv : cs/0608007 ( 2006 )