# Review of the NIST Light-weight Cryptography Finalists

William J Buchanan1, Leandros Maglaras1
1Blockpass ID Lab, Edinburgh Napier University

###### Abstract

Since 2016, NIST has been assessing light-weight encryption methods, and, in
2022, NIST published the final 10: ASCON, Elephant, GIFT-COFB, Grain128-AEAD,
ISAP, Photon-Beetle, Romulus, Sparkle, TinyJambu, and Xoodyak. The time that
the article was written, NIST announced ASCON as the chosen method that will
be published as NIST’s lightweight cryptography standard later in 2023. In
this article we provide a comparison between these methods in terms of energy
efficiency, time for encryption and time for hashing.

###### Index Terms:

Light-weight cryptography, NIST

##  I Introduction

While AES and SHA work well together within computer systems, they struggle in
an IoT/embedded world as they take up: too much processing power; too much
physical space; and consume too much battery power. So NIST outlines a number
of methods which can be used for light-weight cryptography, and which could be
useful in IoT and RFID devices [1]. They define the device spectrum as:

  * •

Conventional cryptography. Servers and Desktops. Tablets and smart phones.

  * •

Light-weight cryptography. Embedded Systems. RFID and Sensor Networks.

With embedded systems, we commonly see 8-bit, 16-bit and 32-bit
microcontrollers, and which would struggle to cope with real-time demands for
conventional cryptography methods. And in the 40+ years since the first 4-bit
processor, there is even a strong market for 4-bit processors. RFID and sensor
network devices, especially, have limited numbers of gates available for
security, and are often highly constrained with the power drain on the device.

So AES is typically a non-starter for many embedded devices. In light-weight
cryptography, we often see smaller block size (typically 64 bits or 80 bits),
smaller keys (often less than 90 bits) and less complex rounds (and where the
S-boxes often just have 4-bits).

For light-weight cryptography the main constraints that we have are typically
related to ener requirements, gate equivalents (GEs), and timing. With passive
RFID devices, we do not have an associated battery for the power supply, and
where the chip must power itself from energy coupled from the radio wave. An
RFID device is thus likely to be severely constrained in the power drain
associated with any cryptography functions, along with being constrained for
the timing requirements and for the number of gates used. Even if an RFID
device has an associated battery (active RFID), it may be difficult to
recharge the battery, so the drain on power must often be minimised.

There is thus often a compromise between the cryptography method used and the
overall security of the method. Thus often light-weight cryptography methods
balance performance (throughput) against power drain and GE, and do not
perform as well as main-stream cryptography standards (such as AES and
SHA-256). Along with this, the method must also have a low requirement for RAM
(where the method requires the usage of running memory to perform its
operation) and ROM (where the method is stored on the device). In order to
assess the strengths of various methods we often define the area that the
cryptography function will use on the device – and which is defined in $\mu
m^{2}$.

And, so, since 2016, researchers have been probing the submitted methods, and
in 2022 NIST published the final 10: ASCON, Elephant, GIFT-COFB,
Grain128-AEAD, ISAP, Photon-Beetle, Romulus, Sparkle, TinyJambu, and Xoodyak.
A particular focus is on the security of the methods, along with their
performance on low-cost FPGAs/embedded processes and their robustness against
side-channel attacks. The time that the artile was written, NIST announced
ASCON as the chosen method that will be published as NIST’s lightweight
cryptography standard later in 2023. Nevertheless in this article we provide a
comparison between these methods in terms of energy efficiency, time for
encryption and time for hashing using an Arduino Due with an ARM Cortex M3
running at 84MHz, Arduino Nano Every (AVR ARmega 4809), Arduino MKR Zero (ARM
Cortex M10+) and Arduino Nano 33 BLE.

##  II Related work

Bellini et al [2] outlined a set of tests for the NIST finalists related to
their randomness. These tests were similar to the tests performed for the AES
and the SHA-3 standards. The tests include: Avalanche Plaintext; Avalanche
Key; Plaintext-Ciphertext correlation; Cipher Block Chaining Mode; Random;
Low-Density with Plaintext ;Low-Density with Key; High-Density with Plaintext;
and High-Density with Key. The main conclusion is that the underlying
primitives for most of the methods produce datasets that seem random. in the
first third of the total number of rounds.

Elsadek et al [3] performed an evaluation on the NIST finalists. In terms of
the size of each implementation (Table I, we see that TinyJambu and Grain128
have the smallest footprint, while Sparkle has by far the largest footprint.
In terms of gate equivalent (GE), TinyJambu requires 3,600 GEs, while Sparkle
needs 39,500.

TABLE I:  Average energy efficiency [3] | Area ($\mu m^{2}$ \- synthesis over 22nm) | Area (kGE)
---|---|---
TinyJambu | 716 | 3.6
Grain128-AEAD | 861 | 4.3
GIFT-COFB | 1,618 | 8.1
Romulus | 1,961 | 9.8
ASCON | 21,93 | 11
Xoodyak | 2,387 | 11.9
Photon-Beetle | 2,523 | 12.6
ISAP | 3,080 | 15.4
Elephant | 3,458 | 17.3
Sparkle | 7,897 | 739.5

##  III Methods

Table II outlines some of the core specifications of the NIST finalists [4].

TABLE II:  Outline specifications for NIST LWC finalist algorithms [4] Name | Type | Variant | Underlying Primitive | State | Key | Mode | Rate/Block | Tag | Security
---|---|---|---|---|---|---|---|---|---
|  |  |  | (Bits) | (Bits) |  | (Bits) | (Bits) | (Bits)
Ascon | Sponge | Ascon-128 | Ascon-p | 320 | 128 | Duplex | 64 | 128 | 128
|  | Ascon-128a | Ascon-p | 320 | 128 | Duplex | 128 | 128 | 128
Elephant | Sponge | Jumbo | Spongent | 176 | 128 | Elephant | 176 | 64 | 127
|  | Dumbo | Spongent | 160 | 128 | Elephant | 160 | 64 | 112
|  | Delirium | Keccak | 200 | 128 | Elephant | 176 | 128 | 127
GIFT-COFB | Block | GIFT-COFB | GIFT-128 | 192 | 128 | COFB | 128 | 128 | 128
Grain-128AEAD | Stream | Grain-128AEAD | N/A | 256 | 128 | N/A | 1 | 64 | 128
ISAP | Sponge | ISAP-A-128 | Ascon-p | 320 | 128 | ISAP | 64 | 128 | 128
|  | ISAP-K-128 | Keccak | 400 | 128 | ISAP | 144 | 128 | 128
|  | ISAP-K-128A | Keccak | 400 | 128 | ISAP | 144 | 128 | 128
|  | ISAP-A-128A | Ascon-p | 320 | 128 | ISAP | 64 | 128 | 128
PHOTON-Beetle | Sponge | PHOTON-Beetle-AEAD[128] | PHOTON256 | 256 | 128 | Beetle | 128 | 256 | 121
|  | PHOTON-Beetle-AEAD | PHOTON256 | 256 | 128 | Beetle | 32 | 256 | 128
Romulus | Block | Romulus-M | Skinny-128-384 | 384 | 128 | COFB | 128 | 128 | 128
|  | Romulus-N | Skinny-128-384 | 384 | 128 | COFB | 128 | 128 | 128
|  | Romulus-T | Skinny-128-384 | 384 | 128 | COFB | 128 | 128 | 128
SPARKLE | Sponge | SCHWAEMM256-128 | SPARKLE | 384 | 128 | SPARKLE | 256 | 128 | 120
|  | SCHWAEMM128-128 | SPARKLE | 256 | 128 | SPARKLE | 128 | 128 | 120
|  | SCHWAEMM192-192 | SPARKLE | 384 | 192 | SPARKLE | 192 | 192 | 184
|  | SCHWAEMM256-256 | SPARKLE | 512 | 256 | SPARKLE | 256 | 256 | 248
TinyJambu | Sponge | TinyJambu | TinyJambu | 128 | 128 | TinyJambu | 32 | 64 | 120
Xoodyak | Sponge | Xoodyak | Xoodoo | 384 | 128 | Cyclist | 352 | 128 | 128

###  III-A ASCON

ASCON [5, 6] was designed by Christoph Dobraunig, Maria Eichlseder, Florian
Mendel and Martin Schläffer from Graz University of Technology, Infineon
Technologies, and Radboud University. It is both a lightweight hashing and
encryption method. ASCON uses a single lightweight permutation with Sponge-
based modes of operation and an SPN (substitution–permutation network)
permutation. Overall it has an easy method of implementing within hardware
(2.6 gate equivalents) and software. A 5-bit S-box (as used in Keccak’s S-box
core) is used to enable a lightweight approach, and it has no known side-
channel attacks. It can also achieve high throughputs such as throughputs of
between 4.9 and 7.3 Gbps. It stores its current state with 320 bits.

###  III-B Elephant

Elephant is a light-weight crypto cipher created by Tim Beyne, Yu Long Chen,
Christoph Dobraunig, and Bart Mennink [7]. It is an authenticated encryption
scheme, based on a nonce-based encrypt-then-MAC construction. We can provide a
nonce (or IV) and which is the salt value for the cipher. Along with this it
supports Authenticated Encryption with Associated Data (AEAD) and where we can
provide additional data for the cipher. This additional data is not sent with
the cipher or used within the cipher, but can be used to authenticate it. An
example might be to link a packet sequence number to the additional data, so
that the cipher could not be played-back for another sequence number. One of
the strengths of Elephant is that it has a low footprint such as with a
160-bit permutation and can be parallelized.

Within Elephant we have three different variations: Dumbo, Jumbo and Delirium
(and which is a Belgian beer with a pink elephant logo). It was created by Tim
Beyne, Yu Long Chen, Christoph Dobraunig, and Bart Mennink [8]. Tim and Yu are
from KU Leuven and imec-COSIC, Belgium, and Christoph and Bart from Radboud
University, The Netherlands.

One of the strengths of Elephant is that it has a low footprint and can use a
160-bit permutation. This small value reduces the footprint of the method
within memory. In order to speed up the encryption process, the method can
also be parallelized. There are three main methods:

  * •

Dumbo: Elephant-Spongent-$\pi$[160]. This method is well-matched to hardware
and gives the baseline level of security. The 160 value relates to the bit
size of the permutation that is operated on. Overall it gives 112-bit security
levels.

  * •

Jumbo: Elephant-Spongent-$\pi$[176]. This is an improved method and achieves
127-bit security.

  * •

Delirium: Elephant-Keccak-f[200]. This is a more software-focused approach
with reasonably good hardware performance, and with 127-bit security.

###  III-C GIFT-COFB

GIFT-COFB is a light-weight crypto cipher created by Subhadeep Banik, Avik
Chakraborti, Tetsu Iwata, Kazuhiko Minematsu Mridul Nandi, Thomas Peyrin, Yu
Sasaki, Siang Meng Sim and Yosuke Todo [9, 10, 11]. It uses a COFB (COmbined
FeedBack) block cipher based AEAD mode using the GIFT-128 block cipher [12].
Overall GIFT is similar to a smaller version of PRESENT. It is thought that
GIFT has better performance than SIMON and SKINNY. GIFT-COFB fixes some of the
security weaknesses of PRESENT. As many systems are now looking to
authenticate encryption with AEAD (Authenticated Encryption with Additional
Data). With AEAD we add in extra data and which can be used to authenticate
the connected cipertext. For example, with network packets, we could add the
source port and sequence number into the additional data, and where these were
used to perform the authentication. The AEAD addition was then added through a
submission to the NIST competition for lightweight cryptography with GIFT-
COFB.

###  III-D Grain128-AEAD

Grain is a Light Weight Stream Cipher and was written by Martin Hell, Thomas
Johansson and Willi Meier [13, 14]. It has a relatively low gate count, power
consumption and memory. In its AEAD form, it has a 128-bit key, and has two
shift registers (LFSR - Linear Feedback Shift Register and NFSR - Non-linear
Feedback Shift Register) and a nonlinear output function. The gate equivalent
(GE) relates to the level of parallelization defined. For the lowest level of
parallization (s=1), we can achieve a GE of 3,638, and with the maximum
parallelization level (s=32), we have a GE of 12,110. When running a maximum
speed for the lowest level of parallelization we get a throughput of 560 Mbps,
a power drain of 3.6 mW and an area of 5,258 $\mu m^{2}$. With the highest
level of parallelization we can achieve a throughput of 10.59 Gbps.

###  III-E ISAP

Isap is a lightweight block cipher and was written by Christoph Dobraunig,
Maria Eichlseder, Stefan Mangard, Florian Mendel, Bart Mennink, Robert Primas
and Thomas Unterluggauer [15, 16, 17]. It is focused on robustness against
power analysis and fault attacks and where there is a node for small code
size. Overall it uses a sponge-based mode with SPN permutations. Isap has
mechanisms to protect against fault attacks. Isap uses an Encrypt-then-MAC
design with two keys for IsapMac and IsapEnc.

###  III-F Photon-Beetle

One of the great advantages of using a sponge method in cryptography is that
you get the addition of hashing on top of encryption for very little overhead
in the code size and the memory requirements. If we are using something like
an 8-bit microcontroller, we might only have a few hundred bytes of ROM, and a
similar space for RAM. The device on the left-hand side is an MC6811, and only
has 8 KB of ROM and 256 bytes of on-chip RAM. We thus need efficient code for
our encryption, as there needs to be space for the main application software,
too.

One method which focuses on creating an extremely small footprint is the
PHOTON-Beetle method [18, 19, 20]. Overall it is a lightweight block cipher
and was written by Zhenzhen Bao, Avik Chakraborti, Nilanjan Datta, Jian Guo,
Mridul Nandi, Thomas Peyrin, and Kan Yasuda. It uses the sponge-based mode
Beetle with the P256 for the permutation and supports both authenticated
encryption (AE) and hashing. PHOTON-Beetle AEAD and PHOTON-Beetle hashing are
finalists for NIST’s competition on lightweight cryptography.

The Beetle family of cryptography methods integrates a lightweight, sponge-
based authenticated encryption. When this is linked with the PHOTON
permutation (PHOTON-256), it achieves an extremely small footprint. In tests,
a 64-bit security version of PHOTON-Beetle consumes less than 600 LUTs (LookUp
Tables) on an FPGA, compared with 1,000 LUTs for COFB-AES (COmbined FeedBack-
AES).

PHOTON-Beetle can be optimized for either a low ROM environment (where the
code needs to be compact) or for speed. For PHOTON-Beetle AEAD, on 8-bit
microcontrollers with low ROM sizes, the ROM code size is less than 2,200
bytes, and adding a hashing method on top of this, only adds another 300 bytes
of ROM. The requirement for memory, too, is small and where it only requires
100 bytes of RAM. The average speed is around 8,200 cycles per byte for
encryption. For the PHOTO-Beetle AEAD mode which focuses on speed, the ROM
code size is less than 4,100 bytes, with hashing adding 300 bytes. The average
speed is around 4,900 cycles per byte for encryption.

###  III-G Romulus

Romulus is a lightweight block cipher and was written by Tetsu Iwata, Mustafa
Khairallah, Kazuhiko Minematsu and Thomas Peyrin [21, 22, 23]. The NIST
competition for lightweight cryptography has reached the final stage, and with
a shortlist of 10 candidates. Each differs in their approach, but they aim to
create a cryptography method that is secure, has a low footprint, and is
robust against attacks. So while many of the contenders, such as ASCON, GIFT
and Isap, use the sponge method derived from the SHA-3 standard (Keccak),
Romulus takes a more traditional approach and looks towards a more traditional
lightweight crypto approach. Overall it is defined as a tweakable block cipher
(TBC) and which supports authenticated encryption with associated data (AEAD).
For its more traditional approach, it uses the SKINNY lightweight tweakable
block cipher.

SKINNY is a light-weight block cipher. It has a 64-bit or 128-bit block size,
and a key size of 64 bits, 128 bits and 256 bits. The methods are SKINNY-64-64
(64-bit block, 64-bit key and 32 rounds); SKINNY-64-128 (64-bit block, 128-bit
key, and 36 rounds); SKINNY-64-192 (64-bit block, 192-bit key, and 40 rounds);
SKINNY-128-128 (128-bit block, 128-bit key, and 40 rounds); SKINNY-128-256
(128-bit block, 256-bit key, and 48 rounds); SKINNY-128-384 (128-bit block,
384 key, and 56 rounds). For a 64-bit block it uses a 4x4 matrix for nibbles,
and a 4x4 matrix of bytes for a 128-bit block size. :

For a 64-bit block it uses a 4x4 matrix for nibbles (4 bits), and a 4x4 matrix
of bytes for a 128-bit block size. For the 4x4 matrix, each round we have
operations of SC (SubCells); AC (AddConstants); ShiftRows (SR); and MixColums
(MC):

For the SubCells (SC) we either have a 4-bit S-box (for 64-bit block) or a
8-bit S-box (for 128-bit block):

The AddRoundTweakey (ART) process takes part of the key, and applies it within
each round.

###  III-H Sparkle

Sparkle is a family of permutations. Schwaemm [24] is a light-weight
cryptography method and provides confidentiality, integrity and
authentication, while Esch provides a hashing method that is preimage and
collision resistant. Both methods use a sponge construction using a
cryptographic permutation (as used in SHA-3). Esch256 (Efficient, Sponge-
based, and Cheap Hashing) implements the hashing method for a 256-bit hash,
and has a block size of 16 bytes, a security level of 128 bits and a data
limit of up to 2132. It was designed by Christof Beierle, Alex Biryukov, Luan
Cardoso dos Santos, Johann Großschädl, Léo Perrin, Aleksei Udovenko, Vesselin
Velichkov, and Qingju Wang. Schwaemm stands for Sponge-based Cipher for
Hardened but Weightless Authenticated Encryption on Many Microcontrollers, and
is also the Luxembourgish word of ”sponge”.

The submitted version for the NIST competition includes Schwaemm [24, 25]
which is a lightweight cryptography method and provides confidentiality,
integrity and authentication and Esch which provides a hashing method that is
preimage and collision-resistant. Both methods use a sponge construction using
a cryptographic permutation (as used in SHA-3). Esch256 (Efficient, Sponge-
based, and Cheap Hashing) implements the hashing method for a 256-bit hash and
has a block size of 16 bytes, a security level of 128 bits and a data limit of
up to $2^{132}$.

For Schwaemm, the name is derived from ”Sponge-based Cipher for Hardened but
Weightless Authenticated Encryption on Many Microcontrollers”, and which is
also the Luxembourgish word of ”sponge”. Esch256 is also a part of a name of a
place in Luxembourg. SPARKLE is similar to SPARKX and its name derives from
SPARx, but Key LEss.

For AEAD, we have Schwaemm128–128, Schwaemm256–128, Schwaemm192–192, and
Schwaemm256–256, and which support block sizes of 16 (128 bits), 32 (256
bits), 24 (192 bits) and 64 bytes, respectively. These give a security level
that ranges from 120 bits to 248 bits.

###  III-I TinyJambu

TinyJAMBU defines a family of lightweight cryptography methods and was
designed by Hongjun Wu and Tao Huang [26].

###  III-J Xoodyak

Xoodyak comes from the Keccak research team [27, 28], and which was successful
in the SHA-3 competition. Overall, Keccak was evaluated as the most efficient
and secure hashing method.

Joan Daemon also co-authored the Rijndael cipher that eventually became AES.
With Xoodoo permutation we can apply it with the Xoodyak function. With this,
we store a 384-bit state for the encryption and which relates to the sequence
of the input data. With this, we can create a fixed-length hash, a pseudo-
random bit value, or an output of a variable length. This can thus produce
either a hash function, a random bit stream, or an encryption method.

##  IV Results

And, so, since 2016, researchers have been probing the submitted methods, and
in 2022 NIST published the final 10: ASCON, Elephant, GIFT-COFB,
Grain128-AEAD, ISAP, Photon-Beetle, Romulus, Sparkle, TinyJambu, and Xoodyak.
A particular focus is on the security of the methods, along with their
performance on low-cost FPGAs/embedded processes and their robustness against
side-channel attacks.

The current set of benchmarks includes running on an Arduino Uno R3 (AVR
ARmega 328P), Arduino Nano Every (AVR ARmega 4809), Arduino MKR Zero (ARM
Cortex M10+) and Arduino Nano 33 BLE (ARM Cortex M4F). These are just 8-bit
processors and fit into an Arduino board. Along with their processing
limitations, they are also limited in their memory footprint (to run code and
also to store it). The lightweight cryptography method must thus overcome
these limitations, and still, be secure and provide a good performance level.
Running AES in block modes on these devices is often not possible, as there is
not enough resources. Overall we use a benchmark for encryption — with AEAD
(Authenticated Encryption with Additional Data) and for hashing. With AEAD we
add extra information — such as the session ID — into the encryption process.
This type of method can bind the encryption to a specific stream.

###  IV-A ARM Cortex M3

In Table III [1], we see a sample run using an Arduino Due with an ARM Cortex
M3 running at 84MHz. The tests are taken in comparison with the ChaCha20
stream cipher and defined for AEAD, and where the higher the value the better
the performance. We can see that Sparkle, Xoodyak and ASCON are the fastest of
all. Sparkle has a 100% improvement, and Xoodyak gives a 60% increase in speed
over ChaCha20. Elephant, ISAP and PHOTON-Beetle have the worst performance for
encryption (with around 1/20th of the speed of ChaCha20).

TABLE III:  Arduino Due with an ARM Cortex M3 running at 84MHz for encryption against ChaCha20 [29] Algorithm | Key Bits | Nonce Bits | Tag Bits | Encrypt 128 B | Decrypt 128 B | Encrypt 16 B | Decrypt 16 B | Aver
---|---|---|---|---|---|---|---|---
Schwaemm128-128 (SPARKLE) | 128 | 128 | 128 | 1.6 | 1.58 | 2.84 | 2.39 | 2.01
Xoodyak | 128 | 128 | 128 | 1.66 | 1.51 | 1.73 | 1.6 | 1.62
ASCON-128 | 128 | 128 | 128 | 1.54 | 1.44 | 1.78 | 1.68 | 1.61
TinyJAMBU-128 | 128 | 96 | 64 | 0.93 | 0.95 | 1.63 | 1.61 | 1.21
GIFT-COFB | 128 | 128 | 128 | 1.01 | 1.01 | 1.16 | 1.15 | 1.08
Grain-128AEAD | 128 | 96 | 64 | 0.26 | 0.26 | 0.56 | 0.56 | 0.37
Romulus-M1 | 128 | 128 | 128 | 0.1 | 0.11 | 0.15 | 0.16 | 0.13
PHOTON-Beetle-AEAD-ENC-128 | 128 | 128 | 128 | 0.06 | 0.07 | 0.11 | 0.12 | 0.08
ISAP-A-128 | 128 | 128 | 128 | 0.08 | 0.08 | 0.03 | 0.04 | 0.05
Delirium (Elephant) | 128 | 96 | 128 | 0.04 | 0.05 | 0.06 | 0.07 | 0.05

Not all of the finalists can do hash functions. Table IV outlines these.

TABLE IV:  Arduino Due with an ARM Cortex M3 running at 84MHz for hashing against BLAKE2s [30] Algorithm | Hash Bits | 1024 bytes | 128 bytes | 16 bytes | Average
---|---|---|---|---|---
Esch256 (SPARKLE) | 256 | 0.89 | 0.78 | 1.5 | 1.06
Xoodyak | 256 | 0.71 | 0.65 | 1.43 | 0.93
GIMLI-24-HASH | 256 | 0.54 | 0.47 | 0.86 | 0.62
ASCON-HASH | 256 | 0.51 | 0.41 | 0.63 | 0.52
PHOTON-Beetle-HASH | 256 | 0.01 | 0.01 | 0.05 | 0.02

Again, we see Sparkle and Xoodyak in the lead, with Sparkle actually faster in
the test than BLAKE2s, and Xoodyak just a little bit slower. ASCON has a
weaker performance, and PHOTON-Beetle is relatively slow. For all the tests,
the ranking for authenticated encryption is (and where the higher the rank,
the better):

14 SPARKLE 12 Xoodyak 12 ASCON 10 TinyJAMBU 9 GIFT-COFB, Gimli 4
Grain-128AEAD,KNOT 0 Elephant, ISAP, PHOTON-Beetle

and for hashing SPARKLE and Xoodyak are ranked the same:

7 SPARKLE, Xoodyak 5 Gimli 3 ASCON 0 PHOTON-Beetle

###  IV-B Uno Nano performance

For AEAD on Uno Nano Every [2], the benchmark is against AES GCM. We can see
in V , that SPARKLE is 4.7 times faster than AES GCM for 128-bit data sizes,
and Xoodyak comes in second with a 3.3 times improvement over AES GCM. When it
comes to 8-bit data sizes TinyJambu actually is the fastest, but where Sparkle
and Xoodyak still perform well. PHOTON-Beetle, Grain128 and ISAP do not do
well, and only slightly improve on AES GCM. In fact, Grain128 and ISAP are
actually slower than AES GCM.

TABLE V:  Uno Nano for AEAD against AES GCM and showing cycles (showing fastest of the method) Algorithm | Impl. | Primary | Flag | Size | Enc(0:8) | Dec(0:8) | Enc(128:129) | Dec(128:128) | Bench.(128) | Bench.(8)
---|---|---|---|---|---|---|---|---|---|---
sparkle | rhys | yes | O3 | 12290 | 1276 | 1316 | 4648 | 5072 | 4.7 | 3.3
Xoodyak | XKCP-AVR8 | yes | O3 | 4560 | 2596 | 2608 | 7184 | 7128 | 3.3 | 1.6
knot | $avr8_{s}peed$ | no | Os | 1664 | 2124 | 2140 | 8144 | 8160 | 2.9 | 2
ascon | rhys | no | O3 | 5180 | 1240 | 1284 | 8056 | 8488 | 2.8 | 3.3
GIFT-COFB | rhys | yes | O1 | 23312 | 1852 | 1892 | 8220 | 8776 | 2.7 | 2.2
saeaes | ref | no | O3 | 17062 | 1208 | 1212 | 8992 | 9004 | 2.6 | 3.4
hyena | rhys | yes | O3 | 293860 | 1912 | 1964 | 8960 | 9396 | 2.5 | 2.2
elephant | rhys | no | O3 | 13106 | 1924 | 1948 | 9260 | 9796 | 2.4 | 2.2
estate | ref | yes | O3 | 9434 | 1424 | 1448 | 10276 | 10292 | 2.3 | 2.9
romulus | rhys | no | O3 | 19346 | 1632 | 1676 | 10152 | 10568 | 2.2 | 2.5
spook | rhys | no | O3 | 12942 | 2984 | 2968 | 10272 | 10708 | 2.2 | 1.4
tinyjambu | rhys | yes | O3 | 9174 | 1232 | 1288 | 10364 | 10888 | 2.2 | 3.4
subterranean | rhys | yes | Os | 6042 | 3372 | 3460 | 10288 | 10944 | 2.2 | 1.2
orange | rhys | yes | O3 | 12140 | 2500 | 2536 | 11200 | 11620 | 2 | 1.7
gimli | rhys | yes | O3 | 21272 | 1920 | 1956 | 11944 | 12360 | 1.9 | 2.2
skinny | rhys | no | O1 | 12452 | 1604 | 1644 | 12960 | 14372 | 1.7 | 2.6
photon-beetle | $avr8_{s}peed$ | yes | Os | 3536 | 2444 | 2472 | 20076 | 20092 | 1.2 | 1.7
reference | rhys | yes | O2 | 7874 | 4152 | 4156 | 23812 | 23764 | 1 | 1
grain128aead | rhys | yes | O2 | 9532 | 3992 | 3980 | 30396 | 30124 | 0.8 | 1
isap | rhys | no | O2 | 3824 | 20212 | 20256 | 42936 | 43372 | 0.5 | 0.2

And so for AEAD (performance) the ordering is

1\. Sparkle 2\. Xoodyak 3\. Ascon 4\. GIFT-COFB. 5\. Elephant. 6\. Romulus.
7\. Tiny Jambu. 8\. PHOTON-Beetle. 9\. Grain128 10\. ISAP.

For hashing on an Uno Nano Every, Table VI shows a similar performance level
as to the ARM Cortex M3 assessment. In this case, the benchmark hash is
SHA-256, and we can see that it takes Sparkle twice as many cycles for a
128-bit hash, and 2.9 times for Xoodyak. PHOTON-Beetle is way behind with a
128-bit hash and which is 17.4 times slower than SHA-256. That said, though,
PHOTON-Beetle could be more focused on reducing power consumption rather than
speed. GIMLI and SKINNY are included to show a comparison with well-designed
methods in lightweight hashing. It can be seen that every method beats SKINNY,
but only SPARKLE and Xoodyak beat GIMLI.

TABLE VI:  Uno Nano for hashing against SHA-256 and showing cycles (showing fastest of the method for hashing) Algorithm | Impl. | Primary | Flag | Size | h(8) | h(16) | h(32) | h(64) | h(128) | Benchmark
---|---|---|---|---|---|---|---|---|---|---
reference | $nacl_{r}ef$ | yes | O3 | 18774 | 768 | 768 | 772 | 1364 | 1968 | 1
sparkle | rhys | yes | O1 | 7912 | 1036 | 1036 | 1468 | 2272 | 3884 | 2
Xoodyak | XKCP-AVR8 | yes | O3 | 2604 | 1284 | 1288 | 1924 | 3192 | 5732 | 2.9
gimli | rhys | yes | O3 | 19554 | 1284 | 1920 | 2544 | 3804 | 6312 | 3.2
ascon | rhys | yes | O3 | 2178 | 2972 | 3552 | 4736 | 7088 | 11784 | 6
drygascon | rhys | no | O3 | 15500 | 4604 | 4600 | 6540 | 10360 | 17912 | 9.1
photon-beetle | $avr8_{s}peed$ | yes | O3 | 2948 | 2372 | 2364 | 6940 | 16084 | 34172 | 17.4
skinny | rhys | yes | O2 | 9784 | 7048 | 10556 | 13976 | 20952 | 34896 | 17.7

And so for hashing (performance) the ordering is:

  1. 1.

Sparkle.

  2. 2.

Xoodyak.

  3. 3.

Ascon

  4. 4.

PHOTON-Beetle.

##  V Conclusion

NIST announced ASCON as the chosen method that will be published as NIST’s
lightweight cryptography standard later in 2023. The performance benchmarks as
stated in this article put Xoodyak and Sparkle look better in terms of
performance. But, there are other assessments, such as security, energy
footprint, and memory footprint that were taken into consideration from NIST
when choosing the strongest and most efficient lightweight algorithm.

## References

  * [1] W. J. Buchanan, S. Li, and R. Asif, “Lightweight cryptography methods,” _Journal of Cyber Security Technology_ , vol. 1, no. 3-4, pp. 187–201, 2017\.
  * [2] E. Bellini and Y. J. Huang, “Randomness testing of the nist light weight cipher finalist candidates,” in _NIST Lightweight Cryptography Workshop, May_ , 2022.
  * [3] I. Elsadek, S. Aftabjahani, D. Gardner, E. MacLean, J. R. Wallrabenstein, and E. Y. Tawfik, “Hardware and energy efficiency evaluation of nist lightweight cryptography standardization finalists,” in _2022 IEEE International Symposium on Circuits and Systems (ISCAS)_. IEEE, 2022, pp. 133–137.
  * [4] H. Madushan, I. Salam, and J. Alawatugoda, “A review of the nist lightweight cryptography finalists and their fault analyses,” _Electronics_ , vol. 11, no. 24, p. 4199, 2022.
  * [5] C. Dobraunig, M. Eichlseder, F. Mendel, and M. Schläffer, “Ascon v1. 2,” _Submission to the CAESAR Competition_ , vol. 5, no. 6, p. 7, 2016.
  * [6] ASCON, “Ascon github,” https://github.com/ascon/ascon-c, ASCON, 2022, accessed: Dec 27 2022. [Online]. Available: https://github.com/ascon/ascon-c
  * [7] T. Beyne, Y. L. Chen, C. Dobraunig, and B. Mennink, “Dumbo, jumbo, and delirium: Parallel authenticated encryption for the lightweight circus,” _IACR Transactions on Symmetric Cryptology_ , vol. 2020, pp. 5–30, 2020.
  * [8] Elephant, “Elephant github,” https://github.com/TimBeyne/Elephant/tree/master/crypto_aead/elephant200v1/ref, Elephant, 2022, accessed: Dec 27 2022. [Online]. Available: https://github.com/TimBeyne/Elephant/tree/master/crypto_aead/elephant200v1/ref
  * [9] S. Banik, A. Chakraborti, T. Iwata, K. Minematsu, M. Nandi, T. Peyrin, Y. Sasaki, S. M. Sim, and Y. Todo, “Gift-cofb: Nist lwc second-round candidate status update,” _Energy (nJ/128-bit)_ , vol. 5, p. 0.
  * [10] GIFT, “Gift github,” https://github.com/aadomn/gift, GIFT, 2022, accessed: Dec 27 2022. [Online]. Available: https://github.com/aadomn/gift
  * [11] W. J. Buchanan, “Gift-cofb - light-weight cipher,” https://asecuritysite.com/light/lw_gift, Asecuritysite.com, 2022, accessed: December 27, 2022. [Online]. Available: https://asecuritysite.com/light/lw_gift
  * [12] S. Banik, S. K. Pandey, T. Peyrin, Y. Sasaki, S. M. Sim, and Y. Todo, “Gift: a small present,” in _International conference on cryptographic hardware and embedded systems_. Springer, 2017, pp. 321–345.
  * [13] M. Hell, T. Johansson, A. Maximov, and W. Meier, “A stream cipher proposal: Grain-128,” in _2006 IEEE International Symposium on Information Theory_. IEEE, 2006, pp. 1614–1618.
  * [14] W. J. Buchanan, “Grain128aead - light-weight cipher,” https://asecuritysite.com/light/lw_grain, Asecuritysite.com, 2022, accessed: December 27, 2022. [Online]. Available: https://asecuritysite.com/light/lw_grain
  * [15] C. Dobraunig, M. Eichlseder, S. Mangard, F. Mendel, B. Mennink, R. Primas, and T. Unterluggauer, “Isap v2. 0,” 2020.
  * [16] Isap, “Isap,” https://isap.iaik.tugraz.at/, Isap, 2022, accessed: Dec 27 2022. [Online]. Available: https://isap.iaik.tugraz.at/
  * [17] W. J. Buchanan, “Isap - light-weight cipher,” https://asecuritysite.com/light/lw_isap, Asecuritysite.com, 2022, accessed: December 27, 2022. [Online]. Available: https://asecuritysite.com/light/lw_isap
  * [18] A. Chakraborti, N. Datta, M. Nandi, and K. Yasuda, “Beetle family of lightweight and secure authenticated encryption ciphers,” _Cryptology ePrint Archive_ , 2018.
  * [19] PHOTON-Beetle, “Photon-beetle,” https://github.com/GMUCERG/PHOTON-Beetle, PHOTON-Beetle, 2022, accessed: Dec 27 2022. [Online]. Available: https://github.com/GMUCERG/PHOTON-Beetle
  * [20] W. J. Buchanan, “Photon-beetle - light-weight cipher,” https://asecuritysite.com/light/lw_beetle, Asecuritysite.com, 2022, accessed: December 27, 2022. [Online]. Available: https://asecuritysite.com/light/lw_beetle
  * [21] T. Iwata, M. Khairallah, K. Minematsu, and T. Peyrin, “Duel of the titans: the romulus and remus families of lightweight aead algorithms,” _IACR Transactions on Symmetric Cryptology_ , pp. 43–120, 2020.
  * [22] Romulus, “Romulus,” https://github.com/romulusae/romulus, Romulus, 2022, accessed: Dec 27 2022. [Online]. Available: https://github.com/romulusae/romulus
  * [23] W. J. Buchanan, “Romulus - light-weight cipher,” https://asecuritysite.com/light/lw_romulus, Asecuritysite.com, 2022, accessed: December 27, 2022. [Online]. Available: https://asecuritysite.com/light/lw_romulus
  * [24] C. Beierle, A. Biryukov, L. C. dos Santos, J. Großschädl, L. Perrin, A. Udovenko, V. Velichkov, Q. Wang, and A. Biryukov, “Schwaemm and esch: lightweight authenticated encryption and hashing using the sparkle permutation family,” _NIST round_ , vol. 2, 2019.
  * [25] W. J. Buchanan, “Sparkle (schwaemm and esch) - light-weight cipher,” https://asecuritysite.com/light/lw_Sparkle, Asecuritysite.com, 2022, accessed: December 27, 2022. [Online]. Available: https://asecuritysite.com/light/lw_Sparkle
  * [26] H. Wu and T. Huang, “Tinyjambu: A family of lightweight authenticated encryption algorithms: Submission to nist lwc (2019).”
  * [27] J. Daemen, S. Hoffert, M. Peeters, G. V. Assche, and R. V. Keer, “Xoodyak, a lightweight cryptographic scheme,” 2020.
  * [28] W. J. Buchanan, “Golang xoodyak,” https://asecuritysite.com/golang/go_xoo, Asecuritysite.com, 2022, accessed: December 27, 2022. [Online]. Available: https://asecuritysite.com/golang/go_xoo
  * [29] Rweather, “Lightweight cryptography primitives,” https://rweather.github.io/lightweight-crypto/performance.html, Lightweight cryptography, 2022, accessed: December 27, 2022. [Online]. Available: https://rweather.github.io/lightweight-crypto/performance.html
  * [30] NIST, “Results nano every hash all,” https://github.com/usnistgov/Lightweight-Cryptography-Benchmarking/blob/main/benchmarks/results_nano_every_hash_all.csv, NIST, 2022, accessed: December 27, 2022. [Online]. Available: https://github.com/usnistgov/Lightweight-Cryptography-Benchmarking/blob/main/benchmarks/results_nano_every_hash_all.csv


# On the property (C) of Corson and other sequential properties of Banach
Spaces

Gonzalo Martínez-Cervantes  Universidad de Alicante, Departamento de
Matemáticas, Facultad de Ciencias, 03080 Alicante, Spain
ORCID: 0000-0002-5927-5215<EMAIL_ADDRESS>and  Alejandro Poveda
Harvard University, Center of Mathematical Sciences and Applications,
Cambridge, MA 02138, USA
Website: https://scholar.harvard.edu/apoveda/home
<EMAIL_ADDRESS>
###### Abstract.

A well-known result of R. Pol states that a Banach space $X$ has property
($\mathcal{C}$) of Corson if and only if every point in the weak*-closure of
any convex set $C\subseteq B_{X^{*}}$ is actually in the weak*-closure of a
countable subset of $C$. Nevertheless, it is an open problem whether this is
in turn equivalent to the countable tightness of $B_{X^{*}}$ with respect to
the weak*-topology. Frankiewicz, Plebanek and Ryll-Nardzewski provided an
affirmative answer under $\mathrm{MA}+\neg\mathrm{CH}$ for the class of
$\mathcal{C}(K)$-spaces. In this article we provide a partial extension of
this latter result by showing that under the Proper Forcing Axiom
($\mathrm{PFA}$) the following conditions are equivalent for an arbitrary
Banach space $X$:

  1. (1)

$X$ has property $\mathcal{E}^{\prime}$;

  2. (2)

$X$ has weak*-sequential dual ball;

  3. (3)

$X$ has property ($\mathcal{C}$) of Corson;

  4. (4)

$(B_{X^{*}},w^{\ast})$ has countable tightness.

This provides a partial extension of a former result of Arhangel’skii. In
addition, we show that every Banach space with property $\mathcal{E}^{\prime}$
has weak*-convex block compact dual ball.

###### Key words and phrases:

Sequential, sequentially compact, countable tightness, property (C) of Corson,
Fréchet-Urysohn, angelic, Efremov property, Banach space

###### 2010 Mathematics Subject Classification:

Primary 57N17, 54D55, 46A50; Secondary 46B20, 46B50.

The first author was partially supported by Fundación Séneca - ACyT Región de
Murcia (grant 21955/PI/22) and by Agencia Estatal de Investigación and
EDRF/FEDER “A way of making Europe" (MCIN/AEI/10.13039/501100011033) (grant
PID2021-122126NB-C32). The second author is funded by the Center of
Mathematical Sciences and Applications at Harvard University.

##  1\. Introduction

A Banach space $X$ is said to have _property ( $\mathcal{C}$) of Corson_ if
every family of closed convex subsets of $X$ with empty intersection contains
a countable subfamily with empty intersection. R. Pol discovered that property
($\mathcal{C}$) is a convex analogue of countable tightness:

######  Theorem (Pol [17]).

A Banach space $X$ has property $(\mathcal{C})$ if and only if every point in
the weak*-closure of a convex set $C\subseteq B_{X^{\ast}}$ is in the
weak*-closure of a countable subset of $C$.

Recall that a topological space $T$ is said to have countable tightness if for
every subspace $F$ of $T$, every point in the closure of $F$ is in the closure
of a countable subspace of $F$. Thus, if the dual ball of a Banach space $X$
has countable tightness (with respect to the weak*-topology) then $X$ has
property $(\mathcal{C})$ of Corson. A natural question is whether the reverse
implication holds. To the best of our knowledge, this question is open (see
[11, 14, 12]).

Both countable tightness and property $(\mathcal{C})$ of Corson are closely
related to several classical sequential properties. Before diving into deeper
waters let us fix the notation and state some of the topological notions under
consideration. All topological spaces considered in the manuscript are assumed
to be Hausdorff. The symbol $w^{\ast}$ will be reserved to denote the weak*
topology of a Banach space. Recall that a topological space $T$ is said to be
sequentially compact if every sequence in $T$ contains a convergent
subsequence; whereas it is said to be Fréchet-Urysohn (FU for short) if for
every subspace $F$ of $T$, every point in the closure of $F$ is the limit of a
sequence in $F$. Thus, every FU compact space is sequentially compact and has
countable tightness. For our purpose and to follow the standard terminology in
the field, let us just say that a Banach space is said to have weak*-angelic
dual if it has weak*-FU dual ball.

In this article we shall pay particular attention to a property which is
between being FU and having countable tightness. A topological space $T$ is
said to be sequential if any sequentially closed subspace is closed. Recall
that a set is said to be sequentially closed if it coincides with its
sequential closure, i.e. with the set of all limits of sequences in the set.
It is immediate that every FU space is sequential and that every sequential
compact space is sequentially compact. It is a well-known fact that every
sequential space has countable tightness. However, whether the converse
implication holds for the class of compact spaces is known as the _Moore-
Mrowka Problem_ , which is undecidable on the grounds of ZFC. On the one hand,
Balogh proved in [3] that under the _Proper Forcing Axiom_ (PFA) a compact
space has countable tightness if and only if it is sequential. On the other
hand, Fedorchuk [10] provided a consistent example of a compact space with
countable tightness with no convergent subsequences, hence non-sequentially
compact. Later variations of Balogh’s theorem not bearing on PFA (hence,
bypassing the use of large cardinal) have been obtained by Dow [8] and, more
recently, by Dow and Eisworth [9].

Thereby for a compact space $K$ we have the following implications:

$K$ is FU $\Rightarrow$ $K$ is sequential $\Rightarrow$ $K$ is sequentially
compact $\Downarrow$ $K$ has countable tightness

In what follows we focus on convex analogues of the above-mentioned properties
when the topological space is the dual ball of a Banach space endowed with the
weak*-topology. A Banach space $X$ is said to have property $\mathcal{E}$ if
every point in the weak*-closure of any _convex_ subset $C\subseteq
B_{X^{\ast}}$ is the weak*-limit of a sequence in $C$ [16, p. 352] . In the
same spirit we say that $X$ has _property $\mathcal{E}^{\prime}$_ if every
weak*-sequentially closed _convex_ set in the dual ball is weak*-closed [13].
Thus, if $X$ has weak*-angelic dual then it has property $\mathcal{E}$, which
in turn implies property $\mathcal{E}^{\prime}$. Likewise, if $X$ has
weak*-sequential dual ball then $X$ has property $\mathcal{E}^{\prime}$.

The last property considered in this article is a convex version of sequential
compactness:

######  Definition.

If $(x_{n})_{n}$ is a sequence in a Banach space, we say that
$(y_{k})_{k\in\mathbb{N}}$ is a convex block subsequence of
$(x_{n})_{n\in\mathbb{N}}$ if there is a sequence $(I_{k})_{k\in\mathbb{N}}$
of finite subsets of $\mathbb{N}$ with $\max(I_{k})<\min(I_{k+1})$ and a
sequence $a_{n}\in[0,1]$ with $\sum_{n\in I_{k}}a_{n}=1$ for every
$k\in\mathbb{N}$ such that

$y_{k}=\sum_{n\in I_{k}}a_{n}x_{n}.$

A Banach space $X$ is said to have weak*-convex block compact dual ball if
every bounded sequence in $X^{\ast}$ has a weak*-convergent convex block
subsequence.

Since every subsequence is a convex block subsequence, it follows that every
Banach space with weak*-sequentially compact dual ball has weak*-convex block
compact dual ball. A simple argument shows that every Banach space with
property $\mathcal{E}^{\prime}$ has property $(\mathcal{C})$ (see Lemma 2).
Furthermore, in Theorem 3 we prove that every Banach space with property
$\mathcal{E}^{\prime}$ has weak*-convex block compact dual ball. Thus, the
implications between these Banach-space properties can be summarized in a
diagram as follows:

$X$ has weak*-angelic dual $\Rightarrow$ $X$ has weak*-sequential dual ball
$\Rightarrow$ $X$ has weak*-sequentially compact dual ball $\Uparrow$
$(B_{X^{*}},w^{*})$ has countable tightness $X$ has property $\mathcal{E}$
$\Rightarrow$ $X$ has property $\mathcal{E}^{\prime}$ $\Rightarrow$ $X$ has
weak*-convex block compact dual ball
$\Downarrow$$\Downarrow$$\Downarrow$$\Downarrow$ $X$ has property
$(\mathcal{C})$

A. Plichko and D. Yost asked in [16, p. 352] whether property ($\mathcal{C}$)
implies property $\mathcal{E}$. J. Moore provided a negative answer in an
unpublished notes using a modification of Ostaszewski space (a scattered
compact space of height $\omega_{1}$ with countable tightness, but not
sequential) using $\Diamond$. In [4] C. Brech constructed yet another
consistent example of a $\mathcal{C}(K)$-space with property ($\mathcal{C}$)
but not property $\mathcal{E}$. More specifically, Brech defines a scattered
compact space of the form $K=L\cup\\{\infty\\}$, where $K$ is the Alexandroff
compactification of a space $L$ with the property that $\ell_{1}(L)$ is
weak*-sequentially closed in $\mathcal{C}(K)^{*}=\ell_{1}(K)$. Thereby,
Brech’s construction yields an example of a Banach space with property
($\mathcal{C}$) that does not satisfy property $\mathcal{E}^{\prime}$.

In this article we prove the consistency of the converse implication. More
specifically, our main result reads as follows.

######  Theorem 1 (PFA).

The following conditions are equivalent for a Banach space $X$:

  1. (1)

$X$ has property $\mathcal{E}^{\prime}$;

  2. (2)

$X$ has weak*-sequential dual ball;

  3. (3)

$X$ has property $(\mathcal{C})$ of Corson;

  4. (4)

$(B_{X^{*}},w^{*})$ has countable tightness.

Combining the above theorem with Brech’s result from [4] we have that the
implication $(3)\implies(1)$ is independent of ZFC. On the contrary, it seems
to be unknown whether $(3)\implies(4)$ is provable in ZFC alone. Frankiewicz,
Plebanek and Ryll-Nardzewski showed that under $\mathrm{MA}+\neg\mathrm{CH}$
this implication holds provided $X$ is a $\mathcal{C}(K)$-space [11]. We refer
the reader to [14] for more results and a comprehensive treatment of this
problem. As far as we are concerned, it is unknow whether $(3)\implies(4)$
holds for arbitrary Banach spaces even under the extra assumption of
$\mathrm{MA}+\neg\mathrm{CH}$. In general, we do not know whether Theorem 1
above holds true under the weaker assumption of $\mathrm{MA}+\neg\mathrm{CH}$.

Theorem 1 provides a partial extension of a result of Arhangel’skii [1] saying
that, under the PFA, if $T$ is a Lindelöff space then any compact subspace of
$\mathcal{C}_{p}(T)$111Namely, the space of continuous functions endowed with
the topology of point-wise covergence. has countable tightness. In particular,
under the PFA, if a Banach space $X$ is Lindelöff with respect to its weak
topology then $(B_{X^{*}},w^{*})$ has countable tightness. Nevertheless the
demand of $X$ being weak-Lindelöff is way stronger than $X$ having property
$(\mathcal{C})$ of Corson. Indeed, on the one hand weak-Lindelöffness implies
property $(\mathcal{C})$ of Corson222As every convex norm-closed set
$F\subseteq X$ is weak-closed.. On the other hand, there are Banach spaces $X$
with property $(\mathcal{C})$ of Corson which fail to be weak-Lindelöff (see
[5, Example 2] and recall that property $(\mathcal{C})$ is a three-space
property).

##  2\. Property $\mathcal{E}^{\prime}$ and convex block subsequences

Let us start this section showing that property $\mathcal{E}^{\prime}$ implies
property $(\mathcal{C})$.

######  Lemma 2.

If a Banach space $X$ has property $\mathcal{E}^{\prime}$ then $X$ has
property $(\mathcal{C})$ of Corson.

###### Proof.

Let $S\subseteq B_{X^{*}}$ be a convex set and define

$S_{0}:=\\{x^{*}\in B_{X^{*}}\mid\mbox{there is a countable set }D\subseteq
S\mbox{ such that }x^{*}\in\overline{D}^{w^{*}}\\}.$

We have to prove that $\overline{S}^{w^{*}}=S_{0}$. Notice that $S_{0}$ is
sequentially closed hence, as $X$ has property $(\mathcal{E}^{\prime})$ and
$S\subseteq S_{0}\subseteq\overline{S}^{w^{*}}$, it suffices to show that
$S_{0}$ is convex. Let $x^{*},y^{*}\in S_{0}$ and $0\leq\lambda\leq 1$. Then,
there exist countable sets $\\{x_{n}^{*}\mid n\in\mathbb{N}\\}$ and
$\\{y_{n}^{*}\mid n\in\mathbb{N}\\}$ in $S$ such that
$x^{*}\in\overline{\\{x_{n}^{*}\mid n\in\mathbb{N}\\}}^{w^{*}}$ and
$y^{*}\in\overline{\\{y_{n}^{*}\mid n\in\mathbb{N}\\}}^{w^{*}}$. We claim that

$\lambda x^{*}+(1-\lambda)y^{*}\in\overline{\\{\lambda
x_{n}^{*}+(1-\lambda)y_{m}^{*}\mid n,m\in\mathbb{N}\\}}^{w^{*}}.$

Let $U$ be any neighborhood of $\lambda x^{*}+(1-\lambda)y^{*}$. Then, there
exist neighborhoods $U_{1}$ of $x^{*}$ and $U_{2}$ of $y^{*}$ such that

$\lambda U_{1}+(1-\lambda)U_{2}:=\\{\lambda z_{1}^{*}+(1-\lambda)z_{2}^{*}\mid
z_{1}^{*}\in U_{1},~{}z_{2}^{*}\in U_{2}\\}\subseteq U.$

Since $x^{*}\in\overline{\\{x_{n}^{*}\mid n\in\mathbb{N}\\}}^{w^{*}}$ and
$y^{*}\in\overline{\\{y_{n}^{*}\mid n\in\mathbb{N}\\}}^{w^{*}}$, there are
$n,m\in\mathbb{N}$ such that $x_{n}^{*}\in U_{1}$ and $y_{m}^{*}\in U_{2}$, so
$\lambda x_{n}^{*}+(1-\lambda)y_{m}^{*}\in\lambda
U_{1}+(1-\lambda)U_{2}\subseteq U$, as desired. ∎

The goal of this section is to prove the following result, which was part of
the first’s author Ph.D. thesis:

######  Theorem 3.

Every Banach space with property $\mathcal{E}^{\prime}$ has weak*-convex block
compact dual ball.

Given a Banach space $X$ and a set $C\subseteq B_{X^{*}}$ we denote by $S(C)$
its weak*-sequential closure; i.e. $S(C)$ is the set of limits of
weak*-convergent sequences in $C$. It is immediate that
$\overline{C}^{\|\cdot\|}\subseteq S(C)$ for every set $C\subseteq B_{X}$.
Notice that $S(C)$ might not be sequentially closed. Nevertheless, the
situation can be even worse, since the weak*-sequential closure of a bounded
convex set $C$ might not be norm-closed (see [2, Example 5.2]). This fact
motivates the following auxiliary lemma which will be used in the proof of
Theorem 3.

######  Lemma 4.

Let $X$ be a Banach space with property $\mathcal{E}^{\prime}$ and $C\subseteq
B_{X^{\ast}}$ a convex subset. If the weak*-sequential closure of $C$ is equal
to $\overline{C}^{\|\cdot\|}$ then
$\overline{C}^{w^{\ast}}=\overline{C}^{\|\cdot\|}$.

###### Proof.

Obviously $\overline{C}^{\|\cdot\|}$ is contained in $S(C)$. Suppose
$S(C)=\overline{C}^{\|\cdot\|}$ but
$\overline{C}^{w^{\ast}}\neq\overline{C}^{\|\cdot\|}$. Then $S(C)$ is not
weak*-closed. Since $X$ has property $\mathcal{E}^{\prime}$, there exists a
sequence $x_{n}^{\ast}\in S(C)$ which converges to a point $x^{\ast}\notin
S(C)$. It follows from the equality $S(C)=\overline{C}^{\|\cdot\|}$ that there
exists $y_{n}^{\ast}\in C$ such that
$\|y_{n}^{\ast}-x_{n}^{\ast}\|<\frac{1}{2^{n}}$ for every $n\in\mathbb{N}$.
Then, $y_{n}^{\ast}=x_{n}^{\ast}+(y_{n}^{\ast}-x_{n}^{\ast})$ is
weak*-convergent to $x^{\ast}$. Thus $x^{\ast}\in S(C)$ in contradiction with
our assumption. ∎

For the sake of completeness we include a proof of the following fact which is
folklore (see, for instance, the proof of [7, Corollary 6 in pg. 82]).

######  Lemma 5.

Let $X$ be a Banach space and $A\subseteq B_{X^{\ast}}$ a norm-separable
weak*-closed set. Then $A$ is weak*-metrizable.

###### Proof.

Set $D=\\{x_{n}^{*}\mid n\in\mathbb{N}\\}\subseteq A$ a countable norm-dense
set and fix $x_{i,j}\in B_{X}$ for every $i,j\in\mathbb{N}$ such that
$\frac{\|x_{i}^{*}-x_{j}^{*}\|}{2}\leq x_{i}^{*}(x_{i,j})-x_{j}^{*}(x_{i,j})$.
If $x^{\ast},y^{\ast}\in A$ are different then we can take
$x^{*}_{i},x^{*}_{j}\in D$ with
$\|x^{\ast}-x_{i}^{*}\|<\frac{\|x^{\ast}-y^{\ast}\|}{8}$ and
$\|y^{\ast}-x_{j}^{*}\|<\frac{\|x^{\ast}-y^{\ast}\|}{8}$. Then
$\|x_{i}^{*}-x_{j}^{*}\|>\frac{3\|x^{*}-y^{*}\|}{4}$ and

$x^{*}(x_{i,j})-y^{*}(x_{i,j})>x_{i}^{*}(x_{i,j})-\frac{\|x^{\ast}-y^{\ast}\|}{8}-x_{j}^{*}(x_{i,j})-\frac{\|x^{\ast}-y^{\ast}\|}{8}\geq$
$\geq\frac{\|x_{i}^{*}-x_{j}^{*}\|}{2}-\frac{\|x^{\ast}-y^{\ast}\|}{4}>0.$

Thus, the set $\\{x_{i,j}\mid i,j\in\mathbb{N}\\}$ gives a countable family of
weak*-continuous functions on the weak*-compact $A$ which separates points of
$A$. Thus, $A$ is weak*-metrizable. ∎

###### Proof of Theorem 3.

Let $(x_{n}^{\ast})_{n\in\mathbb{N}}$ be a sequence in $B_{X^{\ast}}$. We have
to show that $(x_{n}^{\ast})_{n\in\mathbb{N}}$ has a weak*-convergent convex
block subsequence. Set $C$ the convex hull of
$(x_{n}^{\ast})_{n\in\mathbb{N}}$.

Notice that if $S(C)=\overline{C}^{\|\cdot\|}$ then
$S(C)=\overline{C}^{w^{\ast}}=\overline{C}^{\|\cdot\|}$ by Lemma 4 and
therefore $\overline{C}^{w^{\ast}}$ is norm-separable, so weak*-metrizable by
Lemma 5 and, in particular, $\left({x_{n}^{\ast}}\right)_{{n}=1}^{\infty}$
contains a weak*-convergent subsequence.

Thus, we can assume that $S(C)\neq\overline{C}^{\|\cdot\|}$, i.e. that there
exists $x^{\ast}\in S(C)\setminus\overline{C}^{\|\cdot\|}$. Let
$(y_{n}^{\ast})_{n\in\mathbb{N}}$ be a sequence in $C$ weak*-convergent to
$x^{\ast}$. Write

$y_{n}^{\ast}=\sum_{k=1}^{\infty}\lambda_{k}^{n}x_{k}^{\ast},$

with

$\sum_{k=1}^{\infty}\lambda_{k}^{n}=1,~{}0\leq\lambda_{k}^{n}\leq 1\mbox{ and
}\lambda_{k}^{n}=0\mbox{ for all except finitely many }k\in\mathbb{N}$

for every $n\in\mathbb{N}$. Without loss of generality, we may suppose that
$(\lambda_{k}^{n})_{n\in\mathbb{N}}$ converges to some point $\lambda_{k}$ for
every $k\in\mathbb{N}$. Moreover, a standard diagonal argument proves that we
can assume that each sequence $(\lambda_{k}^{n})_{n\in\mathbb{N}}$ is
eventually monotone. Notice that $0\leq\sum_{k=1}^{\infty}\lambda_{k}\leq 1$.
We claim that $\sum_{k=1}^{\infty}\lambda_{k}<1$. If
$\sum_{k=1}^{\infty}\lambda_{k}=1$ then
$\sum_{k=1}^{\infty}\lambda_{k}x_{k}^{\ast}\in\overline{C}^{\|\cdot\|}$ and it
can be easily seen that $x^{\ast}=\sum_{k=1}^{\infty}\lambda_{k}x_{k}^{\ast}$,
in contradiction with $x^{\ast}\notin\overline{C}^{\|\cdot\|}$.

Thus, $0\leq\lambda:=\sum_{k=1}^{\infty}\lambda_{k}<1$. Set
$N_{n}=\\{k\in\mathbb{N}\mid\lambda_{k}^{n}>\lambda_{k}\\}$ for every
$n\in\mathbb{N}$. Notice that

(1) $\sum_{k\in N_{n}}(\lambda_{k}^{n}-\lambda_{k})=1-\sum_{k\in
N_{n}}\lambda_{k}-\sum_{k\notin N_{n}}\lambda_{k}^{n}\geq
1-\sum_{k=1}^{\infty}\lambda_{k}=1-\lambda>0.$

Passing to a subsequence if necessary, we suppose that there exists

(2) $\lambda^{\prime}=\lim_{n}\sum_{k\in
N_{n}}(\lambda_{k}^{n}-\lambda_{k})\geq 1-\lambda>0.$

Set $y_{n}^{+}=\sum_{k\in N_{n}}\lambda_{k}^{n}x_{k}^{\ast}$ and
$y_{n}^{-}=\sum_{k\notin N_{n}}\lambda_{k}^{n}x_{k}^{\ast}$. We claim that
$(y_{n}^{-})_{n\in\mathbb{N}}$ is norm-Cauchy and therefore norm-convergent.
Fix $\varepsilon>0$ and take $k_{0},k_{1}\in\mathbb{N}$ such that
$\sum_{k>k_{0}}\lambda_{k}<\frac{\varepsilon}{4}$, $(\lambda_{k}^{n})_{n\geq
k_{1}}$ is monotone for every $k\leq k_{0}$ and

$\sum_{k=1}^{k_{0}}|\lambda_{k}^{n}-\lambda_{k}^{m}|<\frac{\varepsilon}{2}$

for every $n,m\geq k_{1}$. Then,

$\|y_{n}^{-}-y_{m}^{-}\|\leq\sum_{k=1}^{k_{0}}|\lambda_{k}^{n}-\lambda_{k}^{m}|+\sum_{k>k_{0},~{}k\notin
N_{n}}\lambda_{k}^{n}+\sum_{k>k_{0},~{}k\notin
N_{m}}\lambda_{k}^{m}\leq\frac{\varepsilon}{2}+2\sum_{k>k_{0}}\lambda_{k}<\varepsilon$

for every $n,m\geq k_{1}$. Thus, $(y_{n}^{-})_{n\in\mathbb{N}}$ is norm
convergent and, since $y_{n}^{+}=y_{n}^{\ast}-y_{n}^{-}$, the sequence
$(y_{n}^{+})_{n\in\mathbb{N}}$ is weak*-convergent to a point $y^{\ast}$.

Set

$z_{n}^{\ast}=\frac{1}{\sum_{k\in
N_{n}}(\lambda_{k}^{n}-\lambda_{k})}\sum_{k\in
N_{n}}(\lambda_{k}^{n}-\lambda_{k})x_{k}^{\ast}=\frac{1}{\sum_{k\in
N_{n}}(\lambda_{k}^{n}-\lambda_{k})}(y_{n}^{+}-\sum_{k\in
N_{n}}\lambda_{k}x_{k}^{\ast})$

for every $n\in\mathbb{N}$. It follows from (1) and (2) that $z_{n}^{\ast}$ is
well-defined, $z_{n}^{\ast}\in C$ and it converges to
$\frac{1}{\lambda^{\prime}}(y^{\ast}-\sum_{k\in M}\lambda_{k}x_{k}^{\ast})$,
where

$M=\\{k\in\mathbb{N}\mid(\lambda_{k}^{n})_{n\in\mathbb{N}}\mbox{ is eventually
decreasing}\\}.$

For each $n,k\in\mathbb{N}$, write
$\beta_{k}^{n}=\frac{\lambda_{k}^{n}-\lambda_{k}}{\sum_{k^{\prime}\in
N_{n}}(\lambda_{k^{\prime}}^{n}-\lambda_{k^{\prime}})}$ if $k\in N_{n}$ and
$\beta_{k}^{n}=0$ if $k\notin N_{n}$. Then, $(\beta_{k}^{n})_{n\in\mathbb{N}}$
converges to zero and
$z_{n}^{\ast}=\sum_{k=1}^{\infty}\beta_{k}^{n}x_{k}^{\ast}$. By taking small
perturbations of $z_{n}^{\ast}$, we are going to construct a convex block
subsequence $(u_{n}^{\ast})_{n\in\mathbb{N}}$ of
$(x_{n}^{\ast})_{n\in\mathbb{N}}$ with the same limit than
$(z_{n}^{\ast})_{n\in\mathbb{N}}$.

Fix $u_{1}^{\ast}=z_{1}^{\ast}$ and take a finite subset $I_{1}$ of
$\mathbb{N}$ such that $u_{1}^{\ast}=\sum_{k\in
I_{1}}\beta_{k}^{1}x_{k}^{\ast}$. Fix $n_{1}\in\mathbb{N}$ such that
$\sum_{k\in I_{1}}\beta_{k}^{n}<\frac{1}{2}$ for every $n\geq n_{1}$ and take
a finite set $I_{2}$ with $\max(I_{1})<\min(I_{2})$ such that
$z_{n_{1}}^{\ast}=\sum_{k\in I_{1}\cup I_{2}}\beta_{k}^{n_{1}}x_{k}^{\ast}$.
Take $u_{2}^{\ast}=\frac{1}{\sum_{k\in I_{2}}\beta_{k}^{n_{1}}}\sum_{k\in
I_{2}}\beta_{k}^{n_{1}}x_{k}^{\ast}$. Notice that $u_{2}^{\ast}\in C$ and

$\|z_{n_{1}}^{\ast}-u_{2}^{\ast}\|<\frac{1}{2}+\sum_{k\in
I_{2}}\beta_{k}^{n_{1}}\biggl{(}\frac{1}{\sum_{k^{\prime}\in
I_{2}}\beta_{k^{\prime}}^{n_{1}}}-1\biggr{)}\leq\frac{1}{2}+\biggl{(}\frac{1}{\sum_{k\in
I_{2}}\beta_{k}^{n_{1}}}-1\biggr{)}.$

Repeating this argument we construct a sequence
$(u_{n}^{\ast})_{n\in\mathbb{N}}$ in $C$, an increasing sequence
$(n_{k})_{k\in\mathbb{N}}$ in $\mathbb{N}$ and a sequence of finite sets
$(I_{k})_{k\in\mathbb{N}}$ of $\mathbb{N}$ with $\max(I_{k})<\min(I_{k+1})$
such that

$\sum_{k\in I_{1}\cup I_{2}\cup\dots\cup I_{r}}\beta_{k}^{m}<\frac{1}{2^{r}}$

for every $m\geq n_{r}$,

$z_{n_{r}}^{\ast}=\sum_{k\in I_{1}\cup I_{2}\cup\dots\cup
I_{r+1}}\beta_{k}^{n_{r}}x_{k}^{\ast},$ $u_{r+1}^{\ast}=\frac{1}{\sum_{k\in
I_{r+1}}\beta_{k}^{n_{r}}}\sum_{k\in I_{r+1}}\beta_{k}^{n_{r}}x_{k}^{\ast}$

and

$\|z_{n_{r}}^{\ast}-u_{r+1}^{\ast}\|<\frac{1}{2^{r}}+\sum_{k\in
I_{r+1}}\beta_{k}^{n_{r}}\biggl{(}\frac{1}{\sum_{k^{\prime}\in
I_{r+1}}\beta_{k^{\prime}}^{n_{r}}}-1\biggr{)}\leq\frac{1}{2^{r}}+\biggl{(}\frac{1}{\sum_{k\in
I_{r+1}}\beta_{k}^{n_{r}}}-1\biggr{)}$
$\leq\frac{1}{2^{r}}+\biggl{(}\frac{2^{r}}{2^{r}-1}-1\biggr{)}=\frac{1}{2^{r}}+\frac{1}{2^{r}-1},$

where the last inequality follows from

$\sum_{k\in I_{r+1}}\beta_{k}^{n_{r}}=1-\sum_{k\in I_{1}\cup
I_{2}\cup\dots\cup I_{r}}\beta_{k}^{n_{r}}\geq
1-\frac{1}{2^{r}}=\frac{2^{r}-1}{2^{r}}.$

Since $\|z_{n_{r}}^{\ast}-u_{r+1}^{\ast}\|$ converges to zero, we conclude
that $(u_{r}^{\ast})_{r\in\mathbb{N}}$ is a convex block subsequence of
$(x_{n}^{\ast})_{n\in\mathbb{N}}$ which is weak*-convergent with the same
limit than $(z_{n}^{\ast})_{n\in\mathbb{N}}$. ∎

##  3\. From property $(\mathcal{C})$ to countable tightness

In this section we characterize (under PFA) property $(\mathcal{C})$ of Corson
(Theorem 1):

######  Lemma 6 (PFA).

If $X$ has property $(\mathcal{C})$ of Corson then $(B_{X^{*}},w^{*})$ has
countable tightness.

In our proof of Lemma 6 we use the following notion due to Balogh [3]:

######  Definition 7.

Let $T$ be a non-empty set and $L,R\subseteq T^{2}$ two reflexive relations. A
sequence $\langle x_{\alpha}\mid\alpha\in\omega_{1}\rangle\subseteq T$ of
distinct points is an _increasing $\omega_{1}$-sequence for the pair $\langle
L,R\rangle$_ if

$\forall\beta\in\omega_{1}\;(L(x_{\beta})\cap\langle
x_{\alpha}\mid\alpha<\omega_{1}\rangle\subseteq\langle
x_{\alpha}\mid\alpha\leq\beta\rangle\subseteq R(x_{\beta})\cap\langle
x_{\alpha}\mid\alpha<\omega_{1}\rangle).$

######  Definition 8.

Let $T$ be a topological space and $\mathcal{F}$ a closed filter on
$T$444I.e., a filter consisting of closed sets in $T$..

A subspace $S\subseteq T$ is said to be _$\mathcal{F}$ -small_ if there is
$F\in\mathcal{F}$ with $S\cap F=\emptyset$. A relation $R\subseteq T^{2}$ is
called $\mathcal{F}$-small-valued if $R(x)$ is $\mathcal{F}$-small for every
$x\in T$.

The following theorem due to Balogh will be instrumental in our proof of Lemma
6:

######  Theorem 9.

[3, Theorem 1.1] Let $T$ be a countably compact, noncompact $T_{1}$-space, and
let $\mathcal{F}$ be a free closed filter on $T$. Suppose that $L,R\subseteq
T^{2}$ is a pair of reflexive relations such that $L$ is $\mathcal{F}$-small-
valued and for every $x\in T$, $L(x)$ is closed and $R(x)$ is open.

Then, under $\mathrm{PFA}$, there is an increasing $\omega_{1}$-sequence for
the pair $\langle L,R\rangle$.

###### Proof of Lemma 6.

Suppose that $(B_{X^{*}},w^{*})$ does not have countable tightness. Then,
there exists $S\subseteq B_{X^{*}}$ which is not weak*-closed but such that
$\overline{A}^{w^{*}}\subseteq S$ for any countable set $A\subseteq S$. In
particular, $(S,w^{*})$ is countably compact. Set
$x^{*}\in\overline{S}^{w^{*}}\setminus S$ and consider

$\mathcal{F}=\\{\overline{U}^{w^{*}}\cap S\mid U\mbox{ is a weak*-open convex
set in }B_{X^{*}}\mbox{ with }x^{*}\in U\\}.$

Notice that $\mathcal{F}$ is a closed filter in $(S,w^{*})$ and
$\bigcap_{B\in\mathcal{F}}B=\emptyset$; i.e., $\mathcal{F}$ is a free filter.
Thus, by Hahn-Banach Separation Theorem, for every $y\in S$ there are
weak*-open convex neighborhoods (in $B_{X^{*}}$) $G(y)$ and $U(y)$ of $y$ such
that $\overline{G(y)}^{w^{*}}\cap S$ is $\mathcal{F}$-small and

$\overline{U(y)}^{w^{*}}\subseteq G(y).$

Set $L(y):=\overline{G(y)}^{w^{*}}\cap S$ and $R(y):=U(y)\cap S$ for every
$y\in S$. We can apply Theorem 9 with respect to $T:=S$ and the pair $\langle
L,R\rangle$ and obtain, in return, an increasing $\omega_{1}$-sequence
$\langle x_{\alpha}\mid\alpha<\omega_{1}\rangle$ in $S$ for $\langle
L,R\rangle$. Thus, by definition,

(3)
$\overline{\\{x_{\alpha}:\alpha\leq\beta\\}}^{w^{*}}\subseteq\overline{R(x_{\beta})}^{w^{*}}\subseteq
G(x_{\beta})\subseteq B_{X^{*}}\setminus\\{x_{\alpha}:\alpha>\beta\\}$

for every $\beta<\omega_{1}$. Now, set
$L=\bigcup_{\beta<\omega_{1}}\overline{\operatorname{co}\\{x_{\alpha}:\alpha<\beta\\}}^{w^{*}}$.
It is clear that $L$ is a convex set such that $\overline{C}^{w^{*}}\subseteq
L$ for every countable set $C\subseteq L$. To finish the proof it is enough to
show that $L$ is not weak*-closed, since in such case $X$ does not have
property ($\mathcal{C}$) of Corson. Since each $G(x_{\beta})$ is convex, by
(3), we have

$\overline{\operatorname{co}\\{x_{\alpha}:\alpha<\beta\\}}^{w^{*}}\subseteq
G(x_{\beta})$

for every $\beta<\omega_{1}$ and, therefore,
$\\{G(x_{\beta}):\beta<\omega_{1}\\}$ is a weak*-open cover of $L$.
Nevertheless, again by (3), there is no finite subcover for $L$. Thus, $L$ is
not weak*-compact and, in particular, it is not weak*-closed, as desired. ∎

The time is now ripe to prove the main result of the section:

###### Proof of Theorem 1.

(1) $\Rightarrow$ (3): This is Lemma 2.

(3) $\Rightarrow$ (4): This is Lemma 6.

(4) $\Rightarrow$ (2): This is Balogh’s main theorem in [3].

(2) $\Rightarrow$ (1): This is obvious. ∎

##  4\. Further remarks and questions

The question of whether property $(\mathcal{C})$ of Corson entails property
$\mathcal{E}$ was raised in [16, p. 352]. In the introduction we have
mentioned several (consistent) examples which answer this question in the
negative. Besides, we have also shown that it is consistent for property
$(\mathcal{C})$ of Corson to imply property $\mathcal{E}^{\prime}$. In [2] an
example of a Banach space with property $\mathcal{E}^{\prime}$ but failing to
have property $\mathcal{E}$ was constructed under the CH. Nevertheless, the
following question seems to be open.

######  Question 10.

Is it consistent with $\mathrm{ZFC}$ that properties $\mathcal{E}$ and
$\mathcal{E}^{\prime}$ coincide?

Furthermore, yet another example of a Banach space with property $\mathcal{E}$
but without weak*-angelic dual was constructed in [2], also under CH. Once
again, it seems to be unknown whether it is consistent with ZFC that these two
properties coincide.

Finally, concerning properties $\mathcal{E}^{\prime}$ and $(\mathcal{C})$, the
following seems to be open.

######  Question 11.

  1. (1)

Does every Banach space with property $\mathcal{E}^{\prime}$ have
weak*-sequential dual ball?

  2. (2)

Does every Banach space with property $(\mathcal{C})$ of Corson have dual ball
with countable tightness (with respect to the weak*-topology)?

## Acknowledgments

We are grateful to J. Rodriguez for his feedback and careful reading of the
manuscript which helped us to improve the paper.

## References

  * [1] A.V. Arhangel’skii, Topological Function Spaces (in Russian) Izd. Moskovskovo Univ. (1989); also Topological Function Spaces, Kluwer Academic Publishers (1992).
  * [2] A. Avilés, G. Martínez-Cervantes and J. Rodríguez, Weak*-sequential properties of Johnson-Lindenstrauss spaces, J. Funct. Anal. 276 (2019), 3051–3066.
  * [3] Z. Balogh, On compact Hausdorff spaces of countable tightness, Proc. Amer. Math. Soc. 105 (1988), 755–764.
  * [4] C. Brech, Construções genéricas de espaços de Asplund C(K), Ph.D. thesis, Universidade de São Paulo and Université Paris 7 (2008).
  * [5] H.H. Corson, The weak topology of a Banach space, Trans. Amer. Math. Soc. 101 (1961), 1–15.
  * [6] J. Diestel, Sequences and series in Banach spaces, Springer New York (1984).
  * [7] J. Diestel and J.J. Uhl, Jr., Vector measures, American Mathematical Society, Providence, R.I., 1977, With a foreword by B.J. Pettis, Mathematical Surveys, No. 15.
  * [8] A. Dow, On the consistency of the Moore-Mrówka solution, Top. Appl. 44 (1992), 125–141.
  * [9] A. Dow, T. Eisworth, CH and the Moore-Mrówka problem, Top. Appl., 195 (2015), 226–238.
  * [10] V.V. Fedorchuk, A compact space having the cardinality of the continuum with no convergent sequences, Math. Proc. Camb. Phil. Soc. 81 (1977), 177–181.
  * [11] R. Frankiewicz, G. Plebanek, C. Ryll-Nardzewski, Between the Lindelöf property and countable tightness, Proc. Amer. Math. Soc. 129 (2000), 97–103.
  * [12] J. Kąkol, W. Kubiś and M. López-Pellicer, Corson’s Property (C) and Tightness. In: Descriptive Topology in Selected Topics of Functional Analysis. Developments in Mathematics, vol 24. Springer, Boston, MA. (2011).
  * [13] G. Martínez-Cervantes, Banach spaces with weak*-sequential dual ball, Proc. Amer. Math. Soc. 146(4) (2018) 1825–1832.
  * [14] G. Plebanek and D. Sobota, Countable tightness in the spaces of regular probability measures, Fund. Math. 229 (2015), 159–169.
  * [15] A. Plichko, Three sequential properties of dual Banach spaces in the weak* topology, Top. Appl. 190 (2015), 93–98.
  * [16] A. Plichko, D. Yost, Complemented and uncomplemented subspaces of Banach spaces, Extracta Math. 15 (2000), no. 2, 335–371, III Congress on Banach Spaces (Jarandilla de la Vera, 1998).
  * [17] R. Pol, On a question of H.H. Corson and some related problems, Fund. Math. 109 (1980), 143–154.


[a,b]Ryan Bignell

# Disconnected contributions to the magnetic polarisability of the neutral
pion

Waseem Kamleh  Derek Leinweber

###### Abstract

The magnetic polarisability of the neutral pion has been calculated using the
background field method in lattice QCD. These early results do not consider
the effect of the disconnected loop contractions arising from the breaking of
charge symmetry in a background magnetic field. Recent work in chiral
perturbation theory has shown that these quark-self-annihilation contractions
provide the leading loop-order contributions to the magnetic polarisability. A
first investigation of these contractions in a background magnetic field is
presented.

##  1 Introduction

The response of the structure of the pion to an external electric or magnetic
field is characterised by the electric $\left(\alpha_{\pi}\right)$ and
magnetic $\left(\beta_{\pi}\right)$ polarisabilities. These are experimentally
measured using Compton scattering experiments [1, 2, 3, 4] where the
polarisabilities describe the scattering angular distribution [4, 5, 6, 7, 8].

Pion polarisabilities have been studied in a variety of theoretical
frameworks; including chiral perturbation theory [9, 8, 10], the linear
$\sigma$ model [11] and dispersion sum rules [12, 13, 14]. Close agreement
with experiment is possible using chiral perturbation theory [9]. The _ab
initio_ method for low energy QCD known as lattice QCD has also been to used
to calculate electric and magnetic polarisabilities of the pion [15, 16, 17,
18, 19, 20, 21]. The lattice QCD simulations are typically performed with a
number of non-physical constraints; chief among them is the neglect of
disconnected quark contributions.

It is this feature which is considered herein for the first time. We compute
the full neutral pion correlator, including disconnected contributions by
using stochastic methods [22, 23] in order to calculate estimates of the $x-x$
or _all-to-all_ quark propagator. The consideration of the full neutral pion
and the connected pion allows disconnected terms to be isolated. This is in
contrast to previous studies which have considered only the connected pion
[15, 16, 17, 18, 19]

$\displaystyle\chi_{{\pi_{0}}^{u|d}}=\left(\overline{q}_{u|d}\,\gamma_{5}\,q_{u|d}\right).$
(1)

The magnetic polarisability can be calculated using lattice QCD by inducing a
uniform external magnetic field using the background field method. This
external field changes the energy of the zero-momentum neutral pion according
to the relativistic energy-field relation [24, 25, 15, 16, 17, 18]

$\displaystyle
E^{2}_{{\pi_{0}}}\left(B\right)=m_{\pi}^{2}-4\,\pi\,m_{\pi}\,\beta_{{\pi_{0}}}\,B^{2}+\mathcal{O}\left(B^{3}\right).$
(2)

The extraction of the magnetic polarisability term from this energy is
nontrivial as the energy contribution of the magnetic polarisability term is
small compared to the overall energy of the particle [17, 26, 27, 28, 29, 18].
In fact, this is a requirement if the energy-field relation of Eq.
$\left(\ref{eqn:E2piz}\right)$ is to have small
$\mathcal{O}\left(B^{3}\right)$ contributions. As such specialised quark
operators are used to provide enhanced coupling to the energy eigenstates of
the neutral pion in an external magnetic field.

In this study a projection operator defined by the eigenmodes of the two-
dimensional $SU(3)\times U(1)$ lattice Laplacian operator [30] is used to
project the quark sink. This enables the pion ground state in an external
magnetic field to be isolated, hence allowing for an accurate determination of
the magnetic polarisability of the pion. The background-field-corrected (BFC)
form [17] of the clover-fermion action [31, 32] is used in order to remove the
spurious background-field dependent quark mass renormalisation associated with
the Wilson term [16, 17].

This research is presented in the following manner. Section 2 describes the
chief motivation behind considering disconnected Wick contractions. A brief
summary of disconnected propagator techniques is presented in Section 3. The
details of the lattice simulations performed in this work are presented in
Section 4 and results in Section 5.

##  2 Pion Polarisability

Figure 1: Full ${\pi_{0}}$ meson operator Wick contractions of Eq.
$\left(\ref{eqn:Gpiz}\right)$.

The full neutral pion interpolating operator is

$\displaystyle\chi_{{\pi_{0}}}=\frac{1}{\sqrt{2}}\,\left(\overline{q}_{u}\,\gamma_{5}\,q_{u}-\overline{q}_{d}\,\gamma_{5}\,q_{d}\right),$
(3)

which produces the corresponding two-point correlation function

$\displaystyle\mathcal{G}(t,\vec{p})$
$\displaystyle=\frac{1}{2}\,\sum_{\vec{x}}e^{-i\vec{p}\cdot\vec{x}}\bigg{[}$
$\displaystyle-\mathrm{Tr}\big{[}\gamma_{5}U^{ee}(x,x)\big{]}\mathrm{Tr}\big{[}\gamma_{5}U^{e^{\prime}e^{\prime}}(0,0)\big{]}-\mathrm{Tr}\big{[}\gamma_{5}D^{ee}(x,x)\big{]}\mathrm{Tr}\big{[}\gamma_{5}D^{e^{\prime}e^{\prime}}(0,0)\big{]}$
$\displaystyle+\mathrm{Tr}\big{[}\gamma_{5}U^{ee}(x,x)\big{]}\mathrm{Tr}\big{[}\gamma_{5}D^{e^{\prime}e^{\prime}}(0,0)\big{]}+\mathrm{Tr}\big{[}\gamma_{5}D^{ee}(x,x)\big{]}\mathrm{Tr}\big{[}\gamma_{5}U^{e^{\prime}e^{\prime}}(0,0)\big{]}$
$\displaystyle+\mathrm{Tr}\big{[}\gamma_{5}D^{ee^{\prime}}(x,0)\gamma_{5}D^{e^{\prime}e}(0,x)\big{]}+\mathrm{Tr}\big{[}\gamma_{5}U^{ee^{\prime}}(x,0)\gamma_{5}U^{e^{\prime}e}(0,x)\big{]}\bigg{]},$

where colour indices are made explicit by $e$,$e^{\prime}$ and $U$
$\left(D\right)$ represents an up (down) quark propagator. The disconnected
quark propagators $S\left(x,x\right)$ of Eq. $\left(\ref{eqn:Gpiz}\right)$
require a source at each lattice point. The point-point $S\left(0,0\right)$,
point-all $S\left(x,0\right)$ and all-to-all $S\left(x,x\right)$ propagators
are represented in Figure 1. Due to their expense, the disconnected terms are
typically neglected in lattice QCD calculations.

Figure 2: Leading order contributions to the magnetic polarisability of the
pion as described by Eq. 20 of He et al. [33] for the range $0\leq
m_{\pi}^{2}\leq 2\,m_{\pi\,{\rm Phys}}^{2}$ where reasonable convergence is
expected. The uncertainty in the result of He et al.  reflects the statistical
uncertainty of the lattice results, the uncertainty in the low energy
coefficients and a systematic uncertainty associated with two-loop diagrams in
the electroquenched theory.

In order to connect the lattice results of Ref. [18] to the physical regime,
He et al. [33] performed a chiral extrapolation using the exact leading-order
nonanalytic terms of chiral perturbation theory. Electro-quenching effects
were considered through the framework of partially quenched chiral
perturbation theory where it was found that the electro-quenching has no
effect on the magnetic polarisability at leading loop-order. It is shown in
Ref. [33] that the loops that contribute to the leading term are the mixed-
flavour disconnected loops of Figure 1. The results of Ref. [33] are separated
into leading loop-order and components in Figure 2. Here the leading loop-
order contribution provides a $\sim 15\%$ correction at the physical point.
This is a substantial proportion which must be considered in future precision-
era lattice QCD studies.

Figure 3: One-loop quark flow diagram for the neutral pion. Here we consider
the Wick contraction
$\mathrm{Tr}\big{[}\gamma_{5}D^{ee}(x,x)\big{]}\mathrm{Tr}\big{[}\gamma_{5}U^{e^{\prime}e^{\prime}}(0,0)\big{]}$
where the neutral pion is dressed by a ${\pi^{+}}$.

The disconnected terms of Eq. $\left(\ref{eqn:Gpiz}\right)$ hence pose a
particularly interesting question. Figure 3 illustrates how the mixed-flavour
contractions can produce a ${\pi^{+}}$ dressing to the neutral pion. This
effect is absent in the connected pion correlation functions investigated in
previous studies [16, 18, 19]. This highlights the importance of including
disconnected contributions to the neutral pion. In this study we will focus on
contractions which produce a charged pion dressing as these are expected to be
the dominant contribution at one-loop order [33].

##  3 Propagator Methods

The disconnected propagators $S\left(x,x\right)$ of Eq.
$\left(\ref{eqn:Gpiz}\right)$ require a different method to conventional
point-to-all propagators; here we use stochastic estimation of the matrix
inverse [22, 23].

For each correlator, we construct sets of random noise vectors
$\left\\{\eta\right\\}$ with elements drawn from $\mathbb{Z}_{4}$ such that
averaging over noise vectors gives

$\displaystyle\Braket{\eta_{a\alpha}\left(x\right)\,\eta^{\dagger}_{b\beta}\left(y\right)}=\delta_{xy}\,\delta_{ab}\,\delta_{\alpha\beta},$
(4)

where $a$, $b$ are colour indices, $\alpha$, $\beta$ are spin indices and the
space-time indices are $x$, $y$. Each noise vector has a corresponding
solution vector

$\displaystyle\chi=M^{-1}\,\eta,$ (5)

where $M$ is the fermion matrix. Hence the fermion propagator matrix element
is stochastically estimated as

$\displaystyle
S_{ab;\alpha\beta}\left(x,y\right)\simeq\Braket{\chi_{a\alpha}\left(x\right)\,\eta^{\dagger}_{b\beta}\left(y\right)}.$
(6)

The source smearing methods of Ref. [34] are adopted when smearing
disconnected quark propagators. The $SU(3)\times U(1)$ eigenmode projection
technique of Ref. [30] is incorporated in the $S\left(x,x\right)$ propagator
by applying it to the solution vector $\chi$ before the disconnected
propagator calculation.

##  4 Simulation details

We make use of the $2+1$ flavour dynamical QCD gauge configurations provided
through the ILDG [35] by the PACS-CS [36] collaboration. The ensemble under
consideration here has a pion mass $m_{\pi}$ of $0.296$ GeV and a lattice
spacing of $0.0907(13)$ fm. The lattice volume is
$L^{3}\times\,T=32^{3}\times\,64$ and 150 configurations were used in this
preliminary study. The Background-Field-Corrected (BFC) clover fermion action
of Ref. [17] is used to remove spurious lattice artefacts that are introduced
by the Wilson term . The BFC action uses a non-perturbatively improved clover
coefficient for the QCD portion of the clover term and a tree-level
coefficient for the portion deriving from the background field in order to
remove the additive-mass renormalisation induced by the Wilson term [16, 17].

All-to-all propagators are fully diluted in time, spin and colour indices in
order to reduce the statistical variance [37]. In order to improve the signal-
to-noise properties of the disconnected quark propagators, we use $2^{3}$
spatial dilution in a manner similar to Refs. [38] and [39]. $\mathbb{Z}_{4}$
(complex $\mathbb{Z}_{2}$) noise is chosen due to it’s superior noise
reduction properties [40, 41, 42]. The disconnected quark propagators is
computed only for $t\in\left[22,36\right]$ where we expect ground state
dominance for the connected pion correlator [30].

We implement a background magnetic field as described in Ref. [17] using the
background field method [43, 27, 44]. The field strength is governed by
$k_{d}$ as
$\left|qe\,B\right|=\left(2\,\pi\,k\right)/\left(N_{x}\,N_{y}\,a^{2}\right)$
where the down quark has the smallest charge magnitude $q_{d}$. As the
background magnetic field was not included at configuration generation, these
configurations are _electro-quenched_ ; the background field exists only for
the valence quarks of the hadron. However, at leading loop order in the chiral
expansion, there are no electroquenching errors [33, 45].

##  5 Results

Due to the inherent challenges in calculating the magnetic polarisability,
particularly with stochastic propagators, we consider the change in the
disconnected portion of the correlator as a function of field strength rather
than the full magnetic polarisability. We compute correlation functions of
both the connected pion and the full neutral pion as in Eqs.
$\left(\ref{eqn:isoSingOp}\right)$ and $\left(\ref{eqn:fullOp}\right)$
respectively. Additionally we consider the single flavour operator with
disconnected contributions. This enables the separation of the connected and
disconnected portions of the correlation function.

Figure 4: Left: Disconnected
$\mathrm{Tr}\big{[}\gamma_{5}D^{ee}(x,x)\big{]}\mathrm{Tr}\big{[}\gamma_{5}U^{e^{\prime}e^{\prime}}(0,0)\big{]}$
term with no external background field and with an external background field
with $k_{d}=-1$. Right: Coherent sum of disconnected terms as appropriate for
the $\eta^{\prime}$ for zero-background field.

The disconnected mixed-flavour $u-d$ contribution to the ${\pi_{0}}$
correlator shown in Figure 4 (left) enters with a positive sign in Eq.
$\left(\ref{eqn:Gpiz}\right)$, reflecting the negative sign between the uu and
dd terms in the full ${\pi_{0}}$ interpolating operator. This is in contrast
to the iso-scalar $\eta^{\prime}$

$\displaystyle\chi_{\eta^{\prime}_{is}}=\frac{1}{\sqrt{2}}\,\left(\overline{q}_{u}\,\gamma_{5}\,q_{u}+\overline{q}_{d}\,\gamma_{5}\,q_{d}\right),$
(7)

where all the flavours of disconnected loops sum coherently and contribute
with a sign opposite to the mixed flavour contributions to the pion. This acts
to increase the negative slope of the correlator, hence increasing the mass of
the $\eta^{\prime}$ [46]. This is evident in Figure 4 (right). The iso-scalar
$\eta^{\prime}$ is considered here in order to determine the quality of our
data in a _best-case_ scenario where the disconnected terms sum.

There is also clearly some sensitivity to the external magnetic field in
Figure 4 (left), hence encouraging the future investigation of correlated
ratios of correlators at different field strengths.

##  6 Conclusion

In this proceedings, we have presented the first preliminary calculation
exploring the effect of a background magnetic field to the disconnected loop
contractions of the neutral pion. These disconnected loops are the next-
leading terms in the magnetic polarisability of the neutral pion and represent
an important step towards a complete _ab-initio_ calculation of the magnetic
polarisability of the neutral pion using lattice QCD and the background field
method.

The results presented in this study highlight that these disconnected
contributions are in reach of today’s computing efforts and represent an
important opportunity to enhance our understanding of the magnetic
polarisability of the neutral pion.

## Acknowledgments

R.B thanks Fangcheng He for helpful conversations. We thank the PACS-CS
Collaboration for making their $2+1$ flavour configurations available via the
International Lattice Data Grid (ILDG). This work was supported with
supercomputing resources provided by the Phoenix HPC service at the University
of Adelaide. This research was undertaken with the assistance of resources
from the National Computational Infrastructure (NCI). NCI resources were
provided through the National Computational Merit Allocation Scheme and
supported by the Australian Government through Grant No. LE190100021 via the
University of Adelaide Partner Share. This work was supported by resources
provided by the Pawsey Supercomputing Centre with funding from the Australian
Government and the Government of Western Australia. This research is supported
by the Australian Research Council through Grants No. DP190102215,
DP210103706, LE190100021 (D.B.L) and DP190100297 (W.K). W.K is supported by
the Pawsey Supercomputing Centre through the Pawsey Centre for Extreme Scale
Readiness (PaCER) program. This work is supported by STFC grants ST/T000813/1
and ST/P00055X/1 (R.B).

## References

  * [1] Y. Antipov et al., _Measurement of pi- meson polarizability in pion compton effect_ , _Phys.Lett.B_ 121 (1983) 445–448.
  * [2] COMPASS collaboration, C. Adolph et al., _Measurement of the charged-pion polarizability_ , _Phys. Rev. Lett._ 114 (2015) 062002, [arXiv:1405.6377].
  * [3] L. V. Fil’kov and V. L. Kashevarov, _Dipole Polarizabilities of $\pi^{\pm}$-Mesons_, _Int. J. Mod. Phys. Conf. Ser._ 47 (2018) 1860092, [arXiv:1806.06852].
  * [4] M. Moinester and S. Scherer, _Compton Scattering off Pions and Electromagnetic Polarizabilities_ , _Int. J. Mod. Phys._ A34 (2019) 1930008, [arXiv:1905.05640].
  * [5] B. R. Holstein, _Pion polarizability and chiral symmetry_ , _Comments Nucl.Part.Phys._ 19 (1990) 221–238.
  * [6] M. A. Moinester and V. Steiner, _Pion and kaon polarizabilities and radiative transitions_ , hep-ex/9801008.
  * [7] S. Scherer, _Real and virtual Compton scattering at low-energies_ , _Czech. J. Phys._ 49 (1999) 1307–1345, [nucl-th/9901056].
  * [8] J. Ahrens et al., _Measurement of the pi+ meson polarizabilities via the gamma p $\to$ gamma pi+ n reaction_, _Eur. Phys. J._ A23 (2005) 113–127, [nucl-ex/0407011].
  * [9] J. Gasser, M. A. Ivanov and M. E. Sainio, _Revisiting gamma gamma — > pi+ pi- at low energies_, _Nucl. Phys._ B745 (2006) 84–108, [hep-ph/0602234].
  * [10] U. Burgi, _Charged pion pair production and pion polarizabilities to two loops_ , _Nucl. Phys._ B479 (1996) 392–426, [hep-ph/9602429].
  * [11] V. Bernard, B. Hiller and W. Weise, _Pion Electromagnetic Polarizability and Chiral Models_ , _Phys. Lett._ B205 (1988) 16–21.
  * [12] L. V. Fil’kov and V. L. Kashevarov, _Compton scattering on the charged pion and the process gamma gamma — > pi0 pi0_, _Eur. Phys. J._ A5 (1999) 285–292, [nucl-th/9810074].
  * [13] L. V. Fil’kov and V. L. Kashevarov, _Dipole and quadrupole polarizabilities of the pion_ , in _Proceedings, 6th International Workshop on the Physics of Excited Nucleons (NSTAR 2007): Bonn, Germany, September 5-8, 2007_ , 2008.  arXiv:0802.0965.
  * [14] R. Garcia-Martin and B. Moussallam, _MO analysis of the high statistics Belle results on $\gamma\gamma\to\pi^{+}\pi^{-},\pi^{0}\pi^{0}$ with chiral constraints_, _Eur. Phys. J._ C70 (2010) 155–175, [arXiv:1006.5373].
  * [15] E. V. Luschevskaya, O. E. Solovjeva and O. V. Teryaev, _Magnetic polarizability of pion_ , _Phys. Lett._ B761 (2016) 393–398, [arXiv:1511.09316].
  * [16] G. S. Bali, B. B. Brandt, G. Endrodi and B. Glaessle, _Meson masses in electromagnetic fields with Wilson fermions_ , _Phys. Rev._ D97 (2018) 034505, [arXiv:1707.05600].
  * [17] R. Bignell, W. Kamleh and D. Leinweber, _Pion in a uniform background magnetic field with clover fermions_ , _Phys. Rev. D_ 100 (Dec, 2019) 114518, [arXiv:1910.14244].
  * [18] R. Bignell, W. Kamleh and D. Leinweber, _Pion magnetic polarisability using the background field method_ , _Phys. Lett. B_ 811 (2020) 135853, [arXiv:2005.10453].
  * [19] H. T. Ding, S. T. Li, A. Tomiya, X. D. Wang and Y. Zhang, _Chiral properties of (2+1)-flavor QCD in strong magnetic fields at zero temperature_ , _Phys. Rev. D_ 104 (2021) 014505, [arXiv:2008.00493].
  * [20] H. Niyazi, A. Alexandru, F. X. Lee and M. Lujan, _Charged pion electric polarizability from lattice QCD_ , _Phys. Rev. D_ 104 (2021) 014510, [arXiv:2105.06906].
  * [21] W. Wilcox and F. X. Lee, _Towards charged hadron polarizabilities from four-point functions in lattice QCD_ , _Phys. Rev. D_ 104 (2021) 034506, [arXiv:2106.02557].
  * [22] S.-J. Dong and K.-F. Liu, _Stochastic estimation with Z(2) noise_ , _Phys. Lett. B_ 328 (1994) 130–136, [hep-lat/9308015].
  * [23] J. Foley, K. Jimmy Juge, A. O’Cais, M. Peardon, S. M. Ryan and J.-I. Skullerud, _Practical all-to-all propagators for lattice QCD_ , _Comput. Phys. Commun._ 172 (2005) 145–162, [hep-lat/0505023].
  * [24] J.-W. Lee and B. C. Tiburzi, _Reconciling the lattice background field method with nonrelativistic QED: Spinor case_ , _Phys. Rev._ D90 (2014) 074036, [arXiv:1407.8159].
  * [25] C. Itzykson and J. B. Zuber, _Quantum Field Theory_.  International Series in Pure and Applied Physics. McGraw-Hill , New York, 1980.
  * [26] E. Chang, W. Detmold, K. Orginos, A. Parreno, M. J. Savage, B. C. Tiburzi et al., _Magnetic structure of light nuclei from lattice QCD_ , _Phys. Rev._ D92 (2015) 114502, [arXiv:1506.05518].
  * [27] M. Burkardt, D. B. Leinweber and X.-m. Jin, _Background field formalism in quantum systems_ , _Phys. Lett._ B385 (1996) 52–56, [hep-ph/9604450].
  * [28] B. C. Tiburzi and S. O. Vayl, _Method to extract charged hadron properties from lattice QCD in magnetic fields_ , _Phys. Rev._ D87 (2013) 054507, [arXiv:1210.4464].
  * [29] T. Primer, W. Kamleh, D. Leinweber and M. Burkardt, _Magnetic properties of the nucleon in a uniform background field_ , _Phys. Rev._ D89 (2014) 034508, [arXiv:1307.1509].
  * [30] R. Bignell, W. Kamleh and D. Leinweber, _Magnetic polarisability of the nucleon using a Laplacian mode projection_ , _Phys. Rev. D_ 101 (2020) 094502, [arXiv:2002.07915].
  * [31] K. G. Wilson, _Confinement of Quarks_ , _Phys. Rev._ D10 (1974) 2445–2459.
  * [32] B. Sheikholeslami and R. Wohlert, _Improved Continuum Limit Lattice Action for QCD with Wilson Fermions_ , _Nucl. Phys._ B259 (1985) 572.
  * [33] F. He, D. B. Leinweber, A. W. Thomas and P. Wang, _Chiral extrapolation of the magnetic polarizability of the neutral pion_ , _Phys. Rev. D_ 102 (2020) 114509, [arXiv:2010.01580].
  * [34] A. L. Kiratidis, W. Kamleh, D. B. Leinweber and B. J. Owen, _Lattice baryon spectroscopy with multi-particle interpolators_ , _Phys. Rev. D_ 91 (2015) 094509, [arXiv:1501.07667].
  * [35] M. G. Beckett, B. Joo, C. M. Maynard, D. Pleiter, O. Tatebe and T. Yoshie, _Building the International Lattice Data Grid_ , _Comput. Phys. Commun._ 182 (2011) 1208–1214, [arXiv:0910.1692].
  * [36] PACS-CS collaboration, S. Aoki et al., _2+1 Flavor Lattice QCD toward the Physical Point_ , _Phys. Rev._ D79 (2009) 034503, [arXiv:0807.1661].
  * [37] TrinLat collaboration, A. Ó Cais, K. J. Juge, M. J. Peardon, S. M. Ryan and J.-I. Skullerud, _Improving algorithms to compute all elements of the lattice quark propagator_ , _Nucl. Phys. B Proc. Suppl._ 140 (2005) 844–849, [hep-lat/0409069].
  * [38] Y. Akahoshi, S. Aoki, T. Aoyama, T. Doi, T. Miyamoto and K. Sasaki, _${\bf I=2}\boldsymbol{\pi\pi}$ potential in the HAL QCD method with all-to-all propagators_, _PTEP_ 2019 (2019) 083B02, [arXiv:1904.09549].
  * [39] Y. Akahoshi, S. Aoki, T. Aoyama, T. Doi, T. Miyamoto and K. Sasaki, _The HAL QCD potential in $I=1$ $\pi\pi$ system with the $\rho$ meson bound state_, _PTEP_ 2020 (2020) 073B07, [arXiv:2004.01356].
  * [40] HADRON SPECTRUM collaboration, J. Bulava, R. Edwards and C. Morningstar, _Stochastic All-to-All Propagators for Baryon Correlators_ , _PoS_ LATTICE2008 (2008) 124, [arXiv:0810.1469].
  * [41] J. Foley, C. H. Wong, J. Bulava, K. J. Juge, D. Lenkner, C. Morningstar et al., _A novel method for evaluating correlation functions in lattice hadron spectroscopy_ , _PoS_ Lattice2010 (2014) 098, [arXiv:1011.0481].
  * [42] C. Morningstar, J. Bulava, J. Foley, K. J. Juge, D. Lenkner, M. Peardon et al., _Improved stochastic estimation of quark propagation with Laplacian Heaviside smearing in lattice QCD_ , _Phys. Rev. D_ 83 (2011) 114505, [arXiv:1104.3870].
  * [43] J. Smit and J. C. Vink, _Remnants of the Index Theorem on the Lattice_ , _Nucl. Phys._ B286 (1987) 485–508.
  * [44] Z. Davoudi and W. Detmold, _Implementation of general background electromagnetic fields on a periodic hypercubic lattice_ , _Phys. Rev. D_ 92 (2015) 074506, [arXiv:1507.01908].
  * [45] J. Hu, F.-J. Jiang and B. C. Tiburzi, _Pion Polarizabilities and Volume Effects in Lattice QCD_ , _Phys. Rev. D_ 77 (2008) 014502, [arXiv:0709.1955].
  * [46] J. J. Dudek, R. G. Edwards, B. Joo, M. J. Peardon, D. G. Richards and C. E. Thomas, _Isoscalar meson spectroscopy from lattice QCD_ , _Phys. Rev. D_ 83 (2011) 111502, [arXiv:1102.4299].