Unconditional security of sending or not sending twin-field quantum key distribution with finite pulses

TL;DR

This paper analyzes the finite-key effects in the Sending-or-Not-Sending twin-field quantum key distribution protocol, demonstrating it can achieve unconditional security over long distances even with practical imperfections.

Contribution

It provides a comprehensive finite-key analysis for the protocol, showing unconditional security under general attacks with realistic parameters.

Findings

Secure key generation over 500 km distance

Unconditional security under coherent attacks

Robustness to large misalignment errors

Abstract

The Sending-or-Not-Sending protocol of the twin-field quantum key distribution (TF-QKD) has its advantage of unconditional security proof under any coherent attack and fault tolerance to large misalignment error. So far this is the only coherent-state based TF-QKD protocol that has considered finite-key effect, the statistical fluctuations. Here we consider the complete finite-key effects for the protocol and we show by numerical simulation that the protocol with typical finite number of pulses in practice can produce unconditional secure final key under general attack, including all coherent attacks. It can exceed the secure distance of 500 $km$ in typical finite number of pulses in practice even with a large misalignment error.

Tables

Table 1. Table 1: List of experimental parameters used in numerical simulations. Here p d subscript 𝑝 𝑑 p_{d} : the dark count rate of Charlie’s detectors; e 0 subscript 𝑒 0 e_{0} : error rate of the vacuum count; e d subscript 𝑒 𝑑 e_{d} : the misalignment-error probability; η d subscript 𝜂 𝑑 \eta_{d} : the detection efficiency of Charlie’s detectors; f 𝑓 f : the error correction inefficiency; α f subscript 𝛼 𝑓 \alpha_{f} : the fiber loss coefficient ( d ​ B / k ​ m 𝑑 𝐵 𝑘 𝑚 dB/km ); ξ 𝜉 \xi : the failure probability of statistical fluctuation analysis.

$p_d$	$e_0$	$e_d$	${\eta }_d$	$f$	${\alpha }_f$	$\xi$
$1.0\times {10}^{-10}$	0.5	$15\%$	$80.0\%$	$1.1$	$0.2$	$1.0\times {10}^{-10}$

Equations

$$\underset{{\rho }_E}{\min }\frac{1}{2}\parallel {\rho }_{AE}-U_A\otimes {\rho }_E\parallel \le {\epsilon }_{sec},$$

$$1-|\cos ({\theta }_A-{\theta }_B-{\psi }_{AB})|\le |\lambda |,$$

$$|{\theta }_A-{\theta }_B-{\psi }_{AB}|\le \frac{\Delta }{2},|{\theta }_A-{\theta }_B-{\psi }_{AB}-\pi |\le \frac{\Delta }{2}.$$

$$R=2p(1-p){\mu }_z{e}^{-{\mu }_z}{s}_1[1-h(e_1^{ph})]-f{S}_{z}h(E_z),$$

$$\begin{array}{rl}l=& n_1[1-h(e_1^{ph})]-lea{k}_{EC}-{\log }_2\frac{2}{{\epsilon }_{cor}}\\ & -2{\log }_2\frac{1}{\sqrt{2}{\epsilon }_{PA}\hat{\epsilon }},\end{array}$$

$${\epsilon }_{sec}\le 2\epsilon +\frac{1}{2}\sqrt{2^{l-H_{min}^{\epsilon }(Z_s|E^{\prime })}},$$

$$H_{min}^{\epsilon }(Z_s|E^{\prime })\ge H_{min}^{\epsilon }(Z_s|E)-|C|,$$

$$\begin{array}{rl}{H}_{min}^{\epsilon }(Z_s|E)\ge & H_{min}^{\bar{\epsilon }}(Z_1|Z_{rest}E)+H_{min}^{{\epsilon }^{\prime }}(Z_{rest}|E)\\ & -2{\log }_2\frac{\sqrt{2}}{\hat{\epsilon }},\end{array}$$

$$\begin{array}{rl}{H}_{min}^{\bar{\epsilon }}(Z_1|Z_{rest}E)& \ge n_1-H_{max}^{\bar{\epsilon }}(X_{s1}|X_{s1}^{\prime })\\ & \ge n_1-n_{1}h(e_1^{ph}).\end{array}$$

$$\begin{array}{rl}{H}_{min}^{\epsilon }(Z_s|E^{\prime })\ge & n_1[1-h(e_1^{ph})]-lea{k}_{EC}\\ & -{\log }_2\frac{2}{{\epsilon }_{cor}}-2{\log }_2\frac{\sqrt{2}}{\hat{\epsilon }}.\end{array}$$

$${\epsilon }_{sec}\le 2\hat{\epsilon }+4\bar{\epsilon }+{\epsilon }_{PA}.$$

$${\epsilon }_{sec}\le 2\hat{\epsilon }+4\bar{\epsilon }+{\epsilon }_{PA}+{\epsilon }_{n_1}.$$

$$\begin{array}{rl}{N}_{00}=& [(1-p_z{)}^2{p}_0^2+2(1-p_z)p_z{p}_0{p}_{z0}]N,\\ N_{01}=& N_{10}=[(1-p_z{)}^2{p}_0{p}_1+(1-p_z)p_z{p}_{z0}{p}_1]N,\\ N_{02}=& N_{20}=[(1-p_z{)}^2(1-p_0-p_1)p_0\\ & +(1-p_z)p_z{p}_{z0}(1-p_0-p_1)]N.\end{array}$$

$$N_{{\Delta }^{\pm }}=\frac{\Delta }{2\pi }(1-p_z{)}^2{p}_1^{2}N.$$

$$\begin{array}{rl}⟨s_1^Z⟩& \ge ⟨{\underline{s}}_1^Z⟩=\frac{1}{2{\mu }_1{\mu }_2({\mu }_2-{\mu }_1)}[{\mu }_2^2{e}^{{\mu }_1}(⟨{\underline{S}}_{01}⟩+⟨{\underline{S}}_{10}⟩)\\ & -{\mu }_1^2{e}^{{\mu }_2}(⟨{\overline{S}}_{02}⟩+⟨{\overline{S}}_{20}⟩)-2({\mu }_2^2-{\mu }_1^2)⟨{\overline{S}}_{00}⟩],\end{array}$$

$$⟨e_1^{ph}⟩\le ⟨{\overline{e}}_1^{ph}⟩=\frac{⟨{\overline{T}}_{\Delta }⟩-\frac{1}{2}{e}^{-2{\mu }_1}⟨{\underline{S}}_{00}⟩}{2{\mu }_1{e}^{-2{\mu }_1}⟨{\underline{s}}_1^Z⟩}.$$

$${\varphi }^L(X)=$$

$${\varphi }^U(X)=$$

$${\left(\frac{e^{{\delta }_1}}{(1+{\delta }_1{)}^{1+{\delta }_1}}\right)}^{\frac{X}{1+{\delta }_1}}$$

$${\left(\frac{e^{-{\delta }_2}}{(1-{\delta }_2{)}^{1-{\delta }_2}}\right)}^{\frac{X}{1-{\delta }_2}}$$

$${\varphi }^L(N_{jk}{S}_{jk})=N_{jk}⟨{\underline{S}}_{jk}⟩,{\varphi }^U(N_{jk}{S}_{jk})=N_{jk}⟨{\overline{S}}_{jk}⟩.$$

$${\phi }^U(Y)=[1+{\delta }_1^{\prime }(Y)]Y,$$

$${\phi }^L(Y)=[1-{\delta }_2^{\prime }(Y)]Y,$$

$${\left(\frac{e^{{\delta }_1^{\prime }}}{(1+{\delta }_1^{\prime }{)}^{1+{\delta }_1^{\prime }}}\right)}^Y$$

$${\left(\frac{e^{-{\delta }_2^{\prime }}}{(1-{\delta }_2^{\prime }{)}^{1-{\delta }_2^{\prime }}}\right)}^Y$$

$$n_1={\phi }^L(N_1⟨{\underline{s}}_1^Z⟩),e_1^{ph}=\frac{{\phi }^U(N_1⟨{\underline{s}}_1^Z⟩⟨{\overline{e}}_1^{ph}⟩)}{N_1⟨{\underline{s}}_1^Z⟩}.$$

$$n_{00}$$

$$n_{01}$$

$$n_{02}$$

$$n_t$$

$$E_z$$

$$n_{{\Delta }^{+}}^R$$

$$n_{signal}=$$

$$-(1-p_d{)}^2{e}^{-2\eta {\mu }_z}],$$

$$n_{error}=$$

$$-(1-p_d{)}^2{e}^{-2\eta {\mu }_z}]+2N{p}_z^2{p}_{z0}^2{p}_d(1-p_d),$$

Full text

I Introduction

Quantum key distribution (QKD) could provide unconditionally secure communication BENNETT (1984); Gisin et al. (2002); Gisin and Thew (2007); Scarani et al. (2009); Shor and Preskill (2000); Koashi (2009); Tamaki et al. (2003); Kraus et al. (2005) of two parties, Alice and Bob. But the security in ideal case Shor and Preskill (2000); Koashi (2009); Tamaki et al. (2003); Kraus et al. (2005) dose not guarantee the security in practice Huttner et al. (1995); Yuen (1996); Brassard et al. (2000); Lütkenhaus (2000); Lütkenhaus and Jahma (2002); Lydersen et al. (2010); Gerhardt et al. (2011); Hayashi (2007); Scarani and Renner (2008). Fortunately, the decoy-state method Hwang (2003); Wang (2005a); Lo et al. (2005); Wang et al. (2007a); Rosenberg et al. (2007); Schmitt-Manderbach et al. (2007); Peng et al. (2007); Liao et al. (2017); Peev et al. (2009); Chen et al. (2010); Sasaki et al. (2011); Fröhlich et al. (2013); Boaron et al. (2018); Wang et al. (2008a); Wang (2005b); Adachi et al. (2007); Wang et al. (2007b, 2008b, 2009); Tamaki et al. (2014); Yu et al. (2016); Xu et al. (2009); Chau (2018) could help us beating the photon-number-splitting (PNS) attack Huttner et al. (1995); Yuen (1996); Brassard et al. (2000); Lütkenhaus (2000); Lütkenhaus and Jahma (2002) and guarantee the security with imperfect light sources. Besides decoy-state mehtod, there are other protocols such as RRDPS protocol Sasaki et al. (2014); Takesue et al. (2015) proposed to beat PNS attack. Measurement-device-independent (MDI)-QKD Braunstein and Pirandola (2012); Lo et al. (2012) can solve all possible loopholes of detection. And the decoy-state MDI-QKD Wang (2013); Rubenok et al. (2013); Liu et al. (2013); Tang et al. (2014a, b); Wang et al. (2015); Comandar et al. (2016); Yin et al. (2016); Wang et al. (2017); Curty et al. (2014); Xu et al. (2014); Yu et al. (2015); Zhou et al. (2016); Jiang et al. (2017) protocol could help us ensure the security of protocol performed by imperfect light sources and detectors.

The 4-intensity protocol Zhou et al. (2016) together with the joint-constraints Yu et al. (2015) has greatly improved the key rate and distance of the MDI-QKD. Using this protocol, a distance exceeding 400 km has been experimentally demonstrated Yin et al. (2016) for the MDI-QKD. However, the key rate of all the prior art decoy-state protocols and the MDI-QKD protocols protocols cannot be better than the linear scale of the channel transmittance. It cannot exceed the known bound of the repeaterless QKD, such as the PLOB bound Pirandola et al. (2017) or the TGW bound Takeoka et al. (2014). Recently, a QKD protocol named Twin-Field (TF) QKD was proposed Lucamarini et al. (2018) whose key rate $R\sim O(\sqrt{\eta})$, where $\eta$ is the channel transmittance, and thus has attracted much attention. But the later announcement of the phase information in Ref. Lucamarini et al. (2018) will casuse security loopholes Wang et al. (2018a, b), and many variants of TF-QKD have been proposed Wang et al. (2018b); Tamaki et al. (2018); Ma et al. (2018); Cui et al. (2019); Curty et al. (2018); Yu et al. (2019); Lu et al. (2019) to close the loophole. A series of experiments Minder et al. (2019); Liu et al. (2019); Wang et al. (2019); Zhong et al. (2019) have been done to demonstrate those protocols. In particular, an efficient protocol for TF-QKD through sending-or-not-sending (SNS protocol) has been given in Ref. Wang et al. (2018b). The SNS protocol has been experimentally demonstrated in proof-of-principle in Ref. Minder et al. (2019), and realized in real optical fiber with the effects of statistical fluctuation being taken Liu et al. (2019). The unconditional security of SNS protocol in the asymptotic case has been proved Wang et al. (2018b) and SNS protocol relaxes the requirement for single photon interference accuracy. The key rate of SNS is still considerable even if the misalignment error is as large as $35\%$. Among all those variants of TF QKD with coherent states, the SNS QKD protocol is the only one that takes the effect of statistical fluctuation and finite decoy states into consideration Yu et al. (2019). Here we show an analysis of the complete effect of finite-key size of SNS QKD protocol.

The main tool we use to analyse the effect of finite-key size is the universally composable framework Müller-Quade and Renner (2009). An complete QKD protocol usually includes the preparation and distribution of quantum states, measurement of received quantum states, parameter estimation, error correction and private amplification. After the error correction step, Alice gets a bit string $S$, and Bob get an estimate string $S^{\prime}$ of $S$. If the error rate is too large, the results of error correction is an empty string and the protocol aborts. A protocol is called $\varepsilon_{cor}$-correct if the probability that $S$ and $S^{\prime}$ aren’t the same, Pr$(S\neq S^{\prime})\leq\varepsilon_{cor}$.

Besides, the quantum state of Alice may be attacked by Eve in the distribution and measurement steps and some information would be leaked to Eve. To ensure the security of final secret keys, Alice and Bob apply a privacy amplification scheme based on two-universal hashing Renner (2005) to extract two shorter strings of length $l$ from $S$ and $S^{\prime}$. We denote the density operator of the system of Alice and Eve as $\rho_{AE}$. If

[TABLE]

where $U_{A}$ denotes the fully mixed state of Alice’s system of strings of length $l$ and $\rho_{E}$ is the density operator of Eve’s system, the protocol is called $\varepsilon_{sec}$-secret Curty et al. (2014); König et al. (2007); Tomamichel et al. (2012). According to the composable framework, a protocol is called $\varepsilon$-secure if it is both $\varepsilon_{cor}$-correct and $\varepsilon_{sec}$-secret, and $\varepsilon\leq\varepsilon_{cor}+\varepsilon_{sec}$.

This paper is arranged as follows. In Sec. II, we introduce the main results of the effect of finite-key size. And in Sec. III, we present our numerical simulation results. The article ends with some concluding remarks. The details of calculation are shown in the Methods part.

II The effect of finite-key size of SNS protocol

As shown in Ref. Wang et al. (2018b), there are two windows in SNS protocol, the $\widetilde{X}$ windows and the $Z$ windows. In a $Z$ window, Alice (Bob) randomly decides to send a phase-radomized coherent state $|\sqrt{\mu_{z}}e^{i\theta_{A}}\rangle$ ($|\sqrt{\mu_{z}}e^{i\theta_{B}}\rangle$) with a probability $p$, or sends nothing (a vacuum state $|0\rangle$). In an $\widetilde{X}$ window (note that the $\widetilde{X}$ window defined here is a slightly different from the definition of the $X$ window in Ref. Wang et al. (2018b), thus we use a different symbol.), Alice and Bob randomly send out a phase-randomized coherent state.

The $\widetilde{X}$ windows are decoy windows and will be used to estimate the counting rate $s_{1}$ and phase-flip error rate $e_{1}^{ph}$ of the single photon state $|01\rangle$ or $|10\rangle$ that Alice decides sending and Bob decides not sending or Alice decides not sending and Bob decides sending in the $Z$ windows. The asymptotic case is considered in Ref. Wang et al. (2018b), and there are infinite intensities in $\widetilde{X}$ windows and infinite pulses in the whole protocol, thus $s_{1}$ and $e_{1}^{ph}$ could be estimated exactly.

Alice and Bob send their prepared pulses to Charlie, and Charlie is assumed to perform interferometric measurements on the received pulses and announces the measurement result to Alice and Bob. If one and only one detector clicks in the measurement process, Charlie will also announce whether the left detector or right detector clicks. The effective events of $Z$ windows and $\widetilde{X}$ windows are defined individually: it is an effective event of $Z$ windows if one and only one detector clicks; it is an effective event of $\widetilde{X}$ windows if one and only one detector clicks and Alice and Bob send the coherent state with the same intensity, and their phases satisfy the post-selection criterion, which is

[TABLE]

where $\theta_{A}$ and $\theta_{B}$ are the phases of coherent states prepared by Alice and Bob respectively, and $\psi_{AB}$ can take an arbitrary value which can be different from time to time as Alice and Bob like, so as to obtain a satisfactory key rate for the protocol Liu et al. (2019). Note that $1-|\cos{[\theta_{A}-\theta_{B}-(\gamma_{A}-\gamma_{B})]}|\leq|\lambda|$ according to the security proof of Ref. Wang et al. (2018b) in the poset-selction criterion there Wang et al. (2018b), both $\gamma_{A}$ and $\gamma_{B}$ can take arbitrary values there Wang et al. (2018b). However, in applying the criterion, we only need the value $\gamma_{A}-\gamma_{B}$ which is actually only one value. Thus we could just use $\psi_{AB}$ in Eq. (2) here. The value of $\lambda$ is decided by the size of phase slice, $\Delta$, that Alice and Bob choose Lucamarini et al. (2018). The Eq. (2) is equivalent to

[TABLE]

Same with that in Ref. Yu et al. (2019), here $|x|$ means the degree of the minor angle enclosed by the two rays that enclose the rotational angle of degree $x$, e.g., $|-15\pi/8|=|15\pi/8|=\pi/8$, $|-\pi/10|=\pi/10$.

The phases of coherent states in $Z$ windows are never be announced in the public channel, thus the coherent states in $Z$ windows are phase-randomized coherent states which are equivalent to classical mixture of different photon numbers. Only the effective events of single-photon states in those $Z$ windows that Alice decides sending and Bob decides not sending or Alice decides not sending and Bob decides sending, are untagged events, thus we have the following formula of final key rate

[TABLE]

where $S_{z}$ is the counting rate of pulses in $Z$ windows and $E_{z}$ is the corresponding error rate, $h(x)=-x\log_{2}{x}-(1-x)\log_{2}{(1-x)}$ is the binary Shannon entropy function, $f$ is the error correction inefficiency, and $s_{1}$ and $e_{1}^{ph}$ are defined in the beginning of this section.

However, the number of pulses is finite in practice and thus there can not be infinite intensities in $\widetilde{X}$ windows. Here we consider the four-intensity decoy state SNS protocol Yu et al. (2019). In each time, Alice and Bob randomly choose the decoy window or signal window with probabilities $1-p_{z}$ and $p_{z}$. If the decoy window is chosen, Alice (Bob) randomly chooses vacuum state $|0\rangle$, $|e^{i\delta_{A}}\sqrt{\mu_{1}}\rangle$ or $|e^{i\delta_{A}^{\prime}}\sqrt{\mu_{2}}\rangle$ (vacuum state $|0\rangle$, $|e^{i\delta_{B}}\sqrt{\mu_{1}}\rangle$ or $|e^{i\delta_{B}^{\prime}}\sqrt{\mu_{2}}\rangle$) with probabilities $p_{0}$, $p_{1}$ and $1-p_{0}-p_{1}$ respectively, where $\delta$ is random in $[0,2\pi)$. If the signal window is chosen, Alice (Bob) randomly chooses vacuum state $|0\rangle$, or phase-randomized weak coherent state of intensity $\mu_{z}$, with probabilities $p_{z0}$ and $1-p_{z0}$. Then Alice and Bob prepare the chosen states and send them to Charlie. Charlie is assumed to perform interferometric measurements on the received quantum signals and announces the measurement result to Alice and Bob. If one and only one detector clicks in the measurement process, Charlie will also announces whether the left detector or right detector clicks. Then Alice and Bob will take it as an one-detector heralded event. After Alice and Bob repeat the above steps for $N$ times, they perform the following data post-processing steps.

1. Sifting. If both Alice and Bob choose the signal window, it is a $Z$ window. If both Alice and Bob choose the decoy window, it is an $\widetilde{X}$ window. Besides, we define that if both Alice and Bob decide to send the phase-randomized coherent state with intensity $\mu_{1}$, as $X_{1}$ window, which is a subset of $\widetilde{X}$ windows. According to the criterion introduced in the beginning of this section, Alice and Bob decide whether an one-detector heralded event is an effective event. We define three kinds of sets, $\mathcal{Z},\mathcal{X}_{1}$, and $\mathcal{X}_{2}$. The set $\mathcal{Z}$ includes all effective events in $Z$ windows. The set $\mathcal{X}_{1}$ includes all effective events in $X_{1}$ windows. And the set $\mathcal{X}_{2}$ includes all other one-detector heralded events.

2. Parameter estimation. For the events in the set $\mathcal{Z}$, Alice will denote it as bit [math] if she sends a vacuum state, and denote it as bit $1$ if she sends a phased-randomized weak coherent state. In the same time, Bob will denote it as bit $1$ if he sends a vacuum state, and denote it as bit [math] if he sends a phased-randomized weak coherent state. Finally Alice and Bob form the $n_{t}$-bit strings $Z_{s}$ and $Z_{s}^{\prime}$ according to the events in set $\mathcal{Z}$. Then through the decoy-state method, Alice and Bob estimate $n_{1}$ according to the events in $\mathcal{X}_{2}$ and estimate $e_{1}^{ph}$ according the events in set $\mathcal{X}_{1}$, where $n_{1}$ is the lower bound of bits caused by untagged events in $Z_{s}$ or $Z_{s}^{\prime}$, and $e_{1}^{ph}$ is the upper bound of phase-flip error rate of the untagged bits. The details of how to calculate $n_{1}$ and $e_{1}^{ph}$ are shown in the Methods part.

3. Error correction. Alice and Bob perform an information reconciliation scheme to correct $Z_{s}^{\prime}$, and Bob will obtain an estimate $\hat{Z_{s}}$ of $Z_{s}$ from $Z_{s}^{\prime}$. To achieve this goal, Alice sends Bob $leak_{EC}$ bits of error correction data. Then Alice computes a hash of $Z_{s}$ of length $\log_{2}{(1/\varepsilon_{cor})}$ using a random universal hash function, and she sends the hash and hash function to Bob Renner (2005). If the hash that Bob computes is the same with Alice, the probability that $Z_{s}$ and $\hat{Z_{s}}$ aren’t the same, Pr$({Z_{s}\neq\hat{Z_{s}}})$, is less than $\varepsilon_{cor}$. If the hash that Bob computes is not the same with Alice, the protocol aborts.

4. Private amplification. Alice and Bob apply a privacy amplification scheme based on two-universal hashing Renner (2005) to extract two shorter strings of length $l$ from $Z_{s}$ and $\hat{Z_{s}}$. Alice and Bob obtain strings $Z_{PA}$ and $\hat{Z}_{PA}$ which is the final secret key after privacy amplification.

The protocol is $\varepsilon_{cor}$-correct if the error correction step is passed. If the final length of secret keys, $l$, satisfies

[TABLE]

the protocol is $\varepsilon_{sec}$-secret. And according to the composable framework, the security coefficient of the whole protocol is $\varepsilon_{tol}=\varepsilon_{cor}+\varepsilon_{sec}$, where $\varepsilon_{sec}=2\hat{\varepsilon}+4\bar{\varepsilon}+\varepsilon_{PA}+\varepsilon_{n_{1}}$. Here, $\varepsilon_{cor}$ is the failure probability of error correction; $\bar{\varepsilon}$ is the accuracy of estimating the smooth min-entropy, which is also the failure probability that the real value of $e_{1}^{ph}$ isn’t in the bound that we estimate; $\varepsilon_{PA}$ is the failure probability of privacy amplification; $\varepsilon_{n_{1}}$ is the failure probability that the real value of $n_{1}$ isn’t in the bound that we estimate. The value of $leak_{EC}$ is related to the specific error correction schemes, and in general $leak_{EC}=fn_{t}h(E_{z})$, where $E_{z}$ is the error rate of strings $Z_{s}$ and $Z_{s}^{\prime}$.

III Numerical simulation

If an experiment of SNS protocol is done, we can first calculate the lower and upper bound of $\langle S_{jk}\rangle$ with Eqs. (13), (17)-(21) from their observed values. And we can get the upper bound of $\langle T_{\Delta}\rangle$ in a similar way. Then we can get the lower bound of $\langle s_{1}^{Z}\rangle$ and the upper bound of $\langle e_{1}^{ph}\rangle$ with Eqs. (15) and (16). Then we can get the lower bound of $n_{1}$ and the upper bound of $e_{1}^{ph}$ with Eqs (22)-(26). Finally, we can get how many bits of secret keys we could extract from this experiment with Eq. (5). The problem is that we do not have such observed values and we need to simulate what values we would observe in the experiment with the experimental parameters list in Table. 1. All symbols appearing in this paragraph is defined in Sec. IV.2.

We use the linear model to simulate the observed values of experiment with the experimental parameters list in Table. 1. Without loss of generality, we assume the distance between Alice and Charlie and the distance between Bob and Charlie are the same, and we assume the property of Charlie’s two detectors are the same. The total transmittance of the experiment set-ups is $\eta=10^{-L/100}\eta_{d}$, where $L$ is the distance between Alice and Bob. The simulation of those observed values are shown in Sec. IV.3, which are related to $\eta$ and other parameters list in Table. 1.

Here we set $\varepsilon_{cor}=\hat{\varepsilon}=\varepsilon_{PA}=\xi,\bar{\varepsilon}=4\xi$ and $\varepsilon_{n_{1}}=4\xi$, and thus security coefficient of the whole protocol is $\varepsilon_{tol}=24\xi=2.4\times 10^{-9}$. The reason we set $\bar{\varepsilon}=4\xi$ and $\varepsilon_{n_{1}}=4\xi$ is that we use the Chernoff bound for four times to estimate $e_{1}^{ph}$ and $n_{1}$ (Notice that we could handle $\langle\underline{S}_{01}\rangle,\langle\underline{S}_{10}\rangle$ and $\langle\overline{S}_{02}\rangle,\langle\overline{S}_{20}\rangle$ together in Eq. (13)). In order to fairly compare the performance of generating final keys of different total pulse numbers, $N$, we define the key rate of per sending pulse, $R=l/N$.

Fig. 1 and Fig. 2 are our simulation results of this work and Ref. Yu et al. (2019) with the experimental parameters list in Table. 1. The only difference of Fig. 1 and Fig. 2 is that $e_{d}=15\%$ in Fig. 1 and $e_{d}=20\%$ in Fig. 2. The results of this work and Ref. Yu et al. (2019) is almost overlap while we set $N=1\times 10^{14}$, but the difference of the results is obvious while we set $N=1\times 10^{10}$, especially in the end of the lines. Still, the secure distance of SNS protocol can still reach up to 500 $km$ with $20\%$ misalignment error and $1\times 10^{12}$ total pulses, even if we take all the effects of finite-key size into consideration.

Fig. 3 and Fig. 4 are our simulation results of another two groups of experimental parameters. We set $p_{d}=1\times 10^{-8}$ and $e_{d}=5\%$ in Fig. 3 and $p_{d}=1\times 10^{-9}$ and $e_{d}=5\%$ in Fig. 4. The other experimental parameters we use are listed in Table 1. Same with Fig. 1 and Fig. 2, we simulate three groups of results where $N=1\times 10^{14},1\times 10^{12},1\times 10^{10}$. Comparing Fig. 3 with Fig. 4, we can find that the secure distances are improved at most 100 $km$ if the dark count is reduced by an order of magnitude. Still, the complete effect of finite size is reflected in the end of lines especially when the total number of pulses, $N$, is relatively small.

IV Conclusion

In this paper, we show an analysis of the finite-key size effect of SNS protocol and get the relation of final key length $l$ and the security coefficient, as shown in Eq. (5). Eq. (5) is derived by the method proposed in Ref. Tomamichel et al. (2012), and thus it can produce unconditional secure final key under general attack, including all coherent attacks. The numerical results show that the secure distance of SNS protocol can still reach up to 500 $km$ with $20\%$ misalignment error and $1\times 10^{12}$ total pulses, even if we take all the effects of finite-key size into consideration. This clearly shows that the SNS protocol Wang et al. (2018b) of TF-QKD is on the one hand secure under general attack, i.e., as secure as the existing decoy-state MDI-QKD, on the other hand more efficient than the existing decoy-state MDI-QKD by many orders of magnitudes in key rate at long distance domain.

Acknowledgement: We thank Hai Xu for discussions. We acknowledge the financial support in part by Ministration of Science and Technology of China through The National Key Research and Development Program of China grant No. 2017YFA0303901; National Natural Science Foundation of China grant No. 11474182, 11774198 and U1738142.

Methods

IV.1 The relation of the length of final key and $\varepsilon_{sec}$

In this protocol, any attack to quantum channel and detectors is allowed only if it doesn’t break the rules of quantum mechanics, and we call the attacker as Eve. We denote the system of Eve after error correction as $E^{\prime}$. If Alice and Bob apply a privacy amplification scheme based on two-universal hashing to extract two shorter strings of length $l$ from $Z_{s}$, the protocol is $\varepsilon_{sec}$-secret Renner (2005); Tomamichel et al. (2010)

[TABLE]

where $H_{min}^{\varepsilon}(Z_{s}|E^{\prime})$ is the $\varepsilon$-smooth min entropy. It measures the max probability of guessing $Z_{s}$ right giving $E^{\prime}$. $E^{\prime}$ could be decomposed as $CE$, where $C$ is the system of leakage information while Alice and Bob perform error correction and $E$ is the system of Eve before error correction. According to the chain rules Renner (2005), we have

[TABLE]

where $|C|<leak_{EC}+\log_{2}(\frac{2}{\varepsilon_{cor}})$. And we could decompose the string $Z_{s}$ as $Z_{1}Z_{rest}$, where $Z_{1}$ is the bits caused by untagged-photon events and $Z_{rest}$ is the other bits of $Z_{s}$ Curty et al. (2014). Thus according to the chain rules Vitanov et al. (2013), we have

[TABLE]

where $\varepsilon=2\bar{\varepsilon}+\varepsilon^{\prime}+\hat{\varepsilon}$ and $H_{min}^{\varepsilon^{\prime}}(Z_{rest}|E)\geq 0$.

Besides, we denote $X$ basis as $\{\frac{1}{2}(|01\rangle+e^{i\theta}|10\rangle),\frac{1}{2}(|01\rangle-e^{i\theta}|10\rangle)\}$ and $Z$ basis as $\{|01\rangle,|10\rangle\}$, where $\theta$ can be an arbitary value. To get the lower bound of $H_{min}^{\bar{\varepsilon}}(Z_{1}|Z_{rest}E)$, we need to use the uncertainty relation of smooth min and max entropy Tomamichel et al. (2012); Tomamichel and Renner (2011). It says that if the untagged-photon states prepared in $X$ basis and $Z$ basis are orthogonal unbiased, and if the states originally prepared and measured under the Z-basis are now prepared and measured under the X-basis and obtained strings $X_{s1}$ and $X_{s1}^{\prime}$ by Alice and Bob respectively, then we have

[TABLE]

Finally we have

[TABLE]

Combining Eqs. (5), (6) and (10) and setting $\varepsilon^{\prime}=0$, we have

[TABLE]

Finally, containing the failure probability that the real value of $n_{1}$ isn’t in the bound that we estimate, $\varepsilon_{n_{1}}$, we have

[TABLE]

IV.2 The calculation method of $n_{1}$ and $e_{1}^{ph}$

The method we use here is similar with Ref. Yu et al. (2019). In an $\widetilde{X}$ window with different intensities from Alice and Bob, they don’t announce any phase information in the protocol, therefore the coherent states sent out from each sides can be regarded as classical mixture of different photon numbers. We denote $\rho=|0\rangle\langle 0|,\rho_{1}=\sum_{k=0}\frac{\mu_{1}^{k}e^{-\mu_{1}}}{k!}|k\rangle\langle k|,\rho_{2}=\sum_{k=0}\frac{\mu_{2}^{k}e^{-\mu_{2}}}{k!}|k\rangle\langle k|$ and $\rho_{z}=\sum_{k=0}\frac{\mu_{z}^{k}}{k!}|k\rangle\langle k|$, where $\rho_{1}$ and $\rho_{2}$ are the density operator of the coherent states used here in $\widetilde{X}$ windows. And this also applies to Bob’s quantum state. In the whole protocol, Alice and Bob obtain $N_{jk}(jk=\{00,01,02,10,20\})$ instances when Alice sends state $\rho_{j}$ and Bob sends state $\rho_{k}$. And after the sifted step, Alice and Bob obtain $n_{jk}$ one-detector heralded events. We denote the counting rate of source $jk$ as $S_{jk}=n_{jk}/N_{jk}$. With all those definitions, we have

[TABLE]

Besides, we need define two new subsets of $X_{1}$ windows, $C_{\Delta^{+}}$ and $C_{\Delta^{-}}$, to estimate the upper bound of $e_{1}^{ph}$. $C_{\Delta^{+}}$ contains all the instance that both Alice and Bob prepare $|e^{i\delta_{A}}\sqrt{\mu_{1}}\rangle$ and $|e^{i\delta_{B}}\sqrt{\mu_{1}}\rangle$ and $|\delta_{A}-\delta_{B}|\leq\frac{\Delta}{2}$. $C_{\Delta^{-}}$ contains all the instance that both Alice and Bob prepare $|e^{i\delta_{A}}\sqrt{\mu_{1}}\rangle$ and $|e^{i\delta_{B}}\sqrt{\mu_{1}}\rangle$ and $|\delta_{A}-\delta_{B}-\pi|\leq\frac{\Delta}{2}$. Same with that in Ref. Yu et al. (2019), here $|x|$ means the degree of the minor angle enclosed by the two rays that enclose the rotational angle of degree $x$, e.g., $|-15\pi/8|=|15\pi/8|=\pi/8$, $|-\pi/10|=\pi/10$. The number of instances in $C_{\Delta^{\pm}}$ is

[TABLE]

We denote the number of effective events of right detectors responding from $C_{\Delta^{+}}$ as $n_{\Delta^{+}}^{R}$, and the number of effective events of left detectors responding from $C_{\Delta^{-}}$ as $n_{\Delta^{-}}^{L}$. And we get the counting error rate of $C_{\Delta^{\pm}}$, $T_{\Delta}=\frac{n_{\Delta^{+}}^{R}+n_{\Delta^{-}}^{L}}{2N_{\Delta^{\pm}}}$.

If we denote the expected value of the counting rate of untagged photons as $\langle s_{1}^{Z}\rangle$, the lower bound of $\langle s_{1}^{Z}\rangle$ is

[TABLE]

where $\langle S_{jk}\rangle$ is the expected value of $S_{jk}$, and $\langle\overline{S}_{jk}\rangle$ and $\langle\underline{S}_{jk}\rangle$ are the upper bound and lower bound of $\langle S_{jk}\rangle$ when we estimate the expected value from its observed value.

The expected value of the phase-flip error rate of the untagged photons satisfies Yu et al. (2019)

[TABLE]

Here we use the fact that the error rate of vacuum state is always $\frac{1}{2}$.

Chernoff bound. The formulas of $\langle\underline{s}_{1}^{Z}\rangle$ and $\langle\overline{e}_{1}^{ph}\rangle$ are represented by expected values, but the values we get in experiment are observed values. To close the gap between the expected values and observed values, we need Chernoff bound Jiang et al. (2017); Chernoff et al. (1952). Let $X_{1},X_{2},\dots,X_{n}$ be $n$ random samples, detected with the value 1 or 0, and let $X$ denote their sum satisfying $X=\sum_{i=1}^{n}X_{i}$. $\phi$ is the expected value of $X$. We have

[TABLE]

where we can obtain the values of $\delta_{1}(X)$ and $\delta_{2}(X)$ by solving the following equations

[TABLE]

where $\xi$ is the failure probability. Thus we have

[TABLE]

Still Eqs. (15) and (16) are the lower bound of the expected values of the counting rate and the upper bound of the phase flip error rate of single-photons. The final question is what their real values are in this specific experiment, and we need the Chernoff bound to help us estimate their real values from their expected values. Similar to Eqs. (17)- (20), the observed value, $\varphi$, and its expected value, $Y$, satisfy

[TABLE]

where we can obtain the values of $\delta_{1}^{\prime}(Y)$ and $\delta_{2}^{\prime}(Y)$ by solving the following equations

[TABLE]

We define $N_{1}=2p_{z}^{2}p_{z0}(1-p_{z0})\mu_{z}e^{-\mu_{z}}N$, and we have Yu et al. (2019)

[TABLE]

This ends the estimate of $n_{1}$ and $e_{1}^{ph}$.

IV.3 The simulation of observed values

We use the linear model to simulate the observed values of experiment with the experimental parameters list in Table. 1. Without loss of generality, we assume the distance between Alice and Charlie and the distance between Bob and Charlie are the same, and we assume the properties of Charlie’s two detectors are the same. If the total transmittance of the experiment set-ups is $\eta$, then we have

[TABLE]

where $N_{00},N_{01},N_{10},N_{02},N_{20},N_{\Delta^{\pm}}$ are defined in Eqs. (13) and (14) and

[TABLE]

where $I_{0}(x)$ is the [math]-order hyperbolic Bessel functions of the first kind.