Optimized protocol for twin-field quantum key distribution

TL;DR

This paper presents a unified framework for twin-field quantum key distribution protocols by discretizing global phases, showing that increasing phase discretization extends communication distance but reduces short-distance key rates.

Contribution

It introduces a unified view of different TF-QKD protocols through phase discretization, optimizing the trade-off between distance and key rate.

Findings

Discretizing global phases unifies various TF-QKD protocols.

Increasing phase discretization extends maximum communication distance.

Higher phase discretization reduces secret key rate at short distances.

Abstract

Twin-field quantum key distribution (TF-QKD) and its variant protocols are highly attractive due to the advantage of overcoming the rate-loss limit for secret key rates of point-to-point QKD protocols. For variations of TF-QKD, the key point to ensure security is switching randomly between a code mode and a test mode. Among all TF-QKD protocols, their code modes are very different, e.g. modulating continuous phases, modulating only two opposite phases, and sending or not sending signal pulses. Here we show that, by discretizing the number of global phases in the code mode, we can give a unified view on the first two types of TF-QKD protocols, and demonstrate that increasing the number of discrete phases extends the achievable distance, and as a trade-off, lowers the secret key rate at short distances due to the phase post-selection.

Tables

Table 1. Table 1: Parameters

Parameters	Values
Dark count rate $d$	$8\times {10}^{-8}$
Error correction efficiency $f$	1.15
Detector efficiency ${\eta }_d$	14.5%
Misalignment error $e_{mis}$	1.5%

Table 2. Table 2: The maximal channel loss for Protocol I with different M 𝑀 M .

$M$	The maximal channel loss (dB)
1	72.3
2	80.8
4	81.3
$\infty$	81.5

Table 3. Table 3: The maximal channel loss with Protocol II different M 𝑀 M .

$M$	The maximal channel loss (dB)
1	67.0
2	75.3
4	75.8
$\infty$	75.8

Equations

$$R\ge \frac{1}{M}Q(1-fH(e)-I_{AE}),$$

$${\rho }_{AB}$$

$$=\sum _{n=0}^{\infty }{P}_n|n,+⟩⟨n,+|,$$

$$|n,+⟩=\frac{1}{\sqrt{2^{n}n!}}(a^{†}+b^{†}{)}^n{|00⟩}_{AB},$$

$$P_n=e^{-2\mu }\frac{(2\mu {)}^n}{n!},$$

$${\rho }_{AB}$$

$$=\sum _{n=0}^{\infty }{P}_n|n,-⟩⟨n,-|,$$

$$|n,-⟩=\frac{1}{\sqrt{2^{n}n!}}(a^{†}-b^{†}{)}^n{|00⟩}_{AB},$$

$$U_{Eve}{|n,\pm ⟩}_{AB}{|e⟩}_E=$$

$$\sqrt{Y_{n,\pm }^L}|{\gamma }_{n,\pm }^L⟩|L⟩+\sqrt{Y_{n,\pm }^R}|{\gamma }_{n,\pm }^R⟩|R⟩+\sqrt{Y_{n,\pm }^N}|{\gamma }_{n,\pm }^N⟩|N⟩,$$

$$|\alpha e^{i\frac{x}{M}\pi }⟩|\alpha e^{i\frac{x}{M}\pi }⟩=\sum _{n=0}^{\infty }\sqrt{P_n}{e}^{i\frac{nx\pi }{M}}|n,+⟩,k_a=k_b=0$$

$$|-\alpha e^{i\frac{x}{M}\pi }⟩|-\alpha e^{i\frac{x}{M}\pi }⟩=\sum _{n=0}^{\infty }\sqrt{P_n}{e}^{i\frac{n(M+x)\pi }{M}}|n,+⟩,k_a=k_b=1$$

$$|\alpha e^{i\frac{x}{M}\pi }⟩|-\alpha e^{i\frac{x}{M}\pi }⟩=\sum _{n=0}^{\infty }\sqrt{P_n}{e}^{i\frac{nx\pi }{M}}|n,-⟩,k_a=0,k_b=1$$

$$|-\alpha e^{i\frac{x}{M}\pi }⟩|\alpha e^{i\frac{x}{M}\pi }⟩=\sum _{n=0}^{\infty }\sqrt{P_n}{e}^{i\frac{n(M+x)\pi }{M}}|n,-⟩,k_a=1,k_b=0.$$

$$|{\psi }_{j,\pm }^{L/R}⟩=\sum _{n=0}^{\infty }\sqrt{P_{2Mn+j}{Y}_{2Mn+j,\pm }^{L/R}}|{\gamma }_{2Mn+j,\pm }^{L/R}⟩,$$

$$|{\psi }_{ex,\pm }^{L/R}⟩=\sum _{j=0}^{M-1}{e}^{i\frac{2jx\pi }{M}}|{\psi }_{2j,\pm }^{L/R}⟩$$

$$|{\psi }_{ox,\pm }^{L/R}⟩=\sum _{j=0}^{M-1}{e}^{i\frac{(2j+1)x\pi }{M}}|{\psi }_{2j+1,\pm }^{L/R}⟩,$$

$${\rho }_{AEx}^L=\frac{1}{4}{|0⟩}_A⟨0|\otimes (P\{|{\psi }_{ex,+}^L⟩+|{\psi }_{ox,+}^L⟩\}$$

$$+P\{|{\psi }_{ex,-}^L⟩+|{\psi }_{ox,-}^L⟩\})+\frac{1}{4}{|1⟩}_A⟨1|$$

$$\otimes (P\{|{\psi }_{ex,+}^L⟩-|{\psi }_{ox,+}^L⟩\}+P\{|{\psi }_{ex,-}^L⟩-|{\psi }_{ox,-}^L⟩\}),$$

$$Q_x^L=\frac{1}{2}(||{\psi }_{ex,+}^L⟩{|}^2+||{\psi }_{ox,+}^L⟩{|}^2+||{\psi }_{ex,-}^L⟩{|}^2+||{\psi }_{ox,-}^L⟩{|}^2),$$

$$e_x^L$$

$$=\frac{||{\psi }_{ex,-}^L⟩{|}^2+||{\psi }_{ox,-}^L⟩{|}^2}{2Q_x^L},$$

$$I_{AEx}^L$$

$$\le (1-e_x^L)H(\frac{||{\psi }_{ex,+}^L⟩{|}^2}{2(1-e_x^L)Q_x^L})+e_x^{L}H(\frac{||{\psi }_{ex,-}^L⟩{|}^2}{2e_x^L{Q}_x^L})$$

$$\le H(\frac{||{\psi }_{ex,+}^L⟩{|}^2+||{\psi }_{ex,-}^L⟩{|}^2}{2Q_x^L}),$$

$$R_x^L=Q_x^L(1-fH(e_x^L)-I_{AEx}^L),$$

$$R^L=\frac{1}{M}\sum _{x=0}^{M-1}{R}_x^L=\frac{1}{M}\sum _{x=0}^{M-1}{Q}_x^L(1-fH(e_x^L)-I_{AEx}^L),$$

$$Q^L=\frac{1}{M}\sum _{x=0}^{M-1}{Q}_x^L$$

$$e^L=\frac{{\sum }_{x=0}^{M-1}{Q}_x^L{e}_x^L}{{\sum }_{x=0}^{M-1}{Q}_x^L},$$

$$\frac{1}{M}\sum _{x=0}^{M-1}{Q}_x^{L}H(e_x^L)\le Q^{L}H(\frac{\frac{1}{M}{\sum }_{x=0}^{M-1}{Q}_x^L{e}_x^L}{Q^L})=Q^{L}H(e^L),$$

$$\frac{1}{M}\sum _{x=0}^{M-1}{Q}_x^L{I}_{AEx}^L$$

$$\le$$

$$+|\sum _{j=0}^{M-1}{e}^{i\frac{2jx\pi }{M}}|{\psi }_{2M+2j,-}^L⟩{|}^2)$$

$$=$$

$$R^L\ge Q^L(1-fH(e^L)-I_{AE}^L).$$

$$R^R\ge Q^R(1-fH(e^R)-I_{AE}^R),$$

$$I_{AE}^R=H(\frac{{\sum }_{j=0}^{M-1}||{\psi }_{2M+2j,-}^R⟩{|}^2+||{\psi }_{2M+2j,+}^R⟩{|}^2}{2Q^R}).$$

Full text

INTRODUCTION

Quantum key distribution (QKD) BB84 ; Ekert1991quantum provides two distant parties (Alice and Bob) with a secure random bit string against any eavesdropper (Eve) guaranteed by the law of quantum mechanics. During last three decades, QKD has rapidly developed both in theory and experiment Inoue2002DPS ; Lo2012MDI ; gobby2004quantum ; Jouguet2013Experimental ; Wang2015RFIMDI , and it is on the way to a wide range of implementation. Among all QKD experiments before, without quantum repeaters, the maximum key rates are bounded with respect to the channel transmittance $\eta$, defined as the probability for an effective detector click caused by a transmitted photon. So, one of the crucial tasks for the theorists is to find the maximum key rate achievable under ideal implementation (based on perfect single-photon sources, pure-loss channels, perfect detectors, perfect post-processing and so on). With the aim of finding an upper bound of secret key rate, the theorists have provided several answers pirandola2009direct ; takeoka2014fundamental ; pirandola2017fundamental . The recent work has provided the fundamental limit called Pirandola-Laurenza-Ottaviani-Banchi (PLOB) boundpirandola2017fundamental , which establishes that the secret key rate without quantum repeaters must satisfy $R\leq-log(1-\eta)$.

Remarkably, the twin-field (TF) QKD protocol, proposed by Lucamarini et al. lucamarini2018overcoming , is capable of overcoming this PLOB bound with some restrictions on Eve’s strategies, which is mainly attributed to the single-photon interferometric measurement at the third untrusted party Eve. In other words, a single photon came from either Alice or Bob interferes at Eve’s beam splitter and clicks the detector, which means that generating a secret key bears a unilateral transmission loss. Because of this dramatic breakthrough, a variant of TF-QKD protocols have been proposed consequentially ma2018phase ; wang2018twin ; cui2019twin ; curty2019simple ; lin2018simple ; tamaki2018information and some protocols have been demonstrated experimentally minder2019experimental ; wang2019beating ; liu2019experimental ; zhong2019proof ; chen2020sending . For variant TF-QKD protocols, the key idea to ensure the security is switching probabilistically between a code mode and a test mode, where the former is for key generation, and the latter is for parameter estimationtamaki2018information . Among all TF-QKD protocols, their code modes are very different, e.g. modulating continuous phases lucamarini2018overcoming ; ma2018phase , modulating only two opposite phases cui2019twin ; curty2019simple ; lin2018simple , and sending or not sending signal pulseswang2018twin . The code modes of the first two kinds are similar in some sense. Intuitively, they may be explained by a unified view.

Interestingly, by discretizing the global phases of Alice and Bob’s emitted pulses in the code mode, we can give a unified view on two kinds of TF-QKD protocols lucamarini2018overcoming ; ma2018phase ; cui2019twin ; curty2019simple ; lin2018simple . Specifically, Alice and Bob encode classical bit [math], $1$ into phases [math], $\pi$ of a coherent state, respectively, then randomize them by adding a phase chosen randomly $0,\pi/M,2\pi/M,\ldots,(M-1)\pi/M$. According to whether or not perform phase post-selection in the test mode, we introduce two protocols. To prove their security, we establish a universal framework against collective attacks, which can be extended to robust against coherent attacks lu2019practical with the technique in christandl2009postselection . The security analysis indicates that increasing the number of discrete phases can extend the achievable distance, but lower the secret key rate at short distances due to the phase post-selection. Furthermore, simulation results show that a small number of random phases (say M=2) may be the best choice for practical implementations.

RESULTS

We firstly describe details of our proposed TF-QKD protocols that have discrete phase randomization in the code mode, and the schematic setup is shown in Fig 1.

Protocol I

Step 1. Alice and Bob randomly choose code mode or test mode in each trial.

Step 2. If a code mode is selected, Alice (Bob) randomly generates a key bit $k_{a}$ ($k_{b}$) and a random number $x$ ($y$) and then prepares the coherent state $\ket{\alpha e^{i(k_{a}+\frac{x}{M})\pi}}$ ($\ket{\alpha e^{i(k_{b}+\frac{y}{M})\pi}}$), where $x,y\in{\{0,1,2,\ldots,M-1\}}$. If a test mode is selected, Alice (Bob) generates a random phase $\phi_{a}\in{[0,2\pi)}$ ($\phi_{b}\in{[0,2\pi)}$) and emits coherent state $\ket{\beta_{a}e^{i\phi_{a}}}$ ($\ket{\beta_{b}e^{i\phi_{b}}}$), where $\beta_{a}$ ($\beta_{b}$) is randomly chosen from a pre-decided set.

Step 3. Alice and Bob send their quantum states to the untrusted receiver Eve. For each trial, only three outcomes are acceptable, which are ”Only detector $L$ clicks”, ”Only detector $R$ clicks” and ”No detectors click”, and Eve announces one of these outcomes. Note that the outcome ”Both detectors $L$ and $R$ click” is considered as ”No detectors click”.

Step 4. Alice and Bob repeat the above steps many times. For the successful detection outcomes (only detector L or R clicks), Alice and Bob publicly announce which trials are the code modes and which trials are the test modes. For each successful trial in the code mode, Alice and Bob announce their $x$ and $y$, and keep $k_{a}$, $k_{b}$ as their raw key if $x=y$. Moreover, Bob should flip his key $k_{b}$ if Eve announces ”Only detector $R$ clicks”.

Step 5. For each trial that both Alice and Bob select test mode, Alice and Bob announce ${\beta_{a}}$ with random phase $\phi_{a}$ and ${\beta_{b}}$ with random phase $\phi_{b}$, and only keep the trial that $\beta_{a}=\beta_{b}$ and $|\phi_{a}-\phi_{b}|=0$ or $\pi$.

Step 6. Alice and Bob perform information reconciliation and privacy amplification to extract the final secure keys.

For the simplicity in experiments, we can remove post-selection in the test mode, and the simplified protocol runs as follows.

Protocol II

Step 1. Same as Protocol I

Step 2. Same as Protocol I

Step 3. Alice and Bob send their quantum states to the untrusted receiver Eve. For each trial, only three outcomes are acceptable, which are ”Only detector $L$ clicks”, ”Only detector $R$ clicks” and ”No detectors click”. Note that, the outcome ”Both detectors $L$ and $R$ click” is considered as ”No detectors click” in the code mode, and is considered as only detector $L$ or $R$ clicks with equal probability in the test mode. Consequentially, Eve announces one of these outcomes.

Step 4. Alice and Bob repeat the above steps many times. For the successful detection outcomes (only detector $L$ or $R$ clicks), Alice and Bob publicly announce which trials are the code modes and which trials are the test modes. For each successful trial in the code mode, Alice and Bob announce their $x$ and $y$, and keep $k_{a}$, $k_{b}$ as their raw key if $x=y$. Moreover, Bob should flip his key $k_{b}$ if Eve announces ”Only detector $R$ clicks”.

Step 5. For each trial that both Alice and Bob select the test mode, the yield $Y_{l,k}$, probability of Eve announcing the successful outcome provided Alice emits $l$-photon state and Bob emits $k$-photon state, can be estimated.

Step 6. Same as Protocol I

Our security proof is based on Devetak-Winter’s bound devetak2005distillation , concretely, bounding the information leakage $I_{AE}$. Thus, the secret key rate is given by

[TABLE]

where $Q$ is the counting rate, $1/M$ is the shifting factor, $e$ is the error rate, and $f$ is the error correction efficiency. By applying infinite decoy states Hwang2003Decoy ; Lo2005Decoy ; Wang2005Decoy ; Ma2005Decoy in the test mode, we can simulate the performance of our two protocols with different $M$. The simulation parameters are given in Table I. For Protocol I, we present the numerical simulations of secret key rate in Fig 2 and the maximal channel loss in Table II. If we remove the sifting efficiency, the limitary channel loss with $M\to\infty$ is $81.5$ dB as shown in Table II. According to Fig 2 and Table II, it’s sufficient to apply TF-QKD with $M=2$ which almost reaches the theoretical limit channel loss. Analogously, for Protocol II, we get simulation results comparable to those of Protocol I, and we show the secret key rate in Fig 3 and the theoretical limit channel loss in Table III. When removing the sifting factor, the maximal channel loss of Protocol II with$M\to\infty$ is $75.8$ dB.

When we compare Protocol I with Protocol II, the latter one does not require post-selection in the test mode, as a trade-off, the maximal channel loss will be lower. Here, we consider the relationship with several varietal TF-QKD protocols ma2018phase ; cui2019twin ; curty2019simple ; lin2018simple . When $M\to\infty$, Protocol I is exactly the PM-QKD ma2018phase if we relax the post-selection condition $|\phi_{a}-\phi_{b}|=0$ or $\pi$ and add a corresponding sifting factor. When $M=1$, Protocol II is the same as cui2019twin ; curty2019simple ; lin2018simple in the code mode, the difference is the way to estimate the information leakage or the ”phase error”. To some extent, our proposed TF-QKD protocols with discrete phase randomization in code mode cover the four varietal TF-QKD protocols above.

DISCUSSION

In summary, we have introduced a variant TF-QKD with discrete phase randomization in the code mode and proven its security in asymptotic scenarios. Our protocol can be viewed as a generalization of the four varietal TF-QKD protocols ma2018phase ; cui2019twin ; curty2019simple ; lin2018simple to some extent. The security proof discloses that the transmission distance becomes longer with $M$ exponentially increasing, as a trade-off, the secret key rate is lower at short distances. As a result, the transmission distance reaches a limitation when $M$ tends to infinity. Numerical simulations show that it’s sufficient to apply TF-QKD with $M=2$, for it almost reaches the limitary transmission distance at the cost of about half of secret key rate, compared with the case of $M=1$, at short distance. Furthermore, post-selection in the test mode is not convenient in experiment, thus, we remove it to make experiments simpler in a modified protocol. We find that the removal of post-selection in the test mode has very limited influence on the secret key rate and achievable distance. Our findings expect TF-QKD can be run with optimal phase randomization actively, i.e. at short distance one can simply bypass phase randomization, while a phase randomization of [math] or $\pi/2$ is sufficient at the long distance case.

During the preparation of this paper, we find that Primaatmaja et al. primaatmaja2019versatile proposed an open question that if coding phase in TF-QKD under different bases can improve secret key rate significantly. Their open question is answered by our finding that $M=2$ is almost optimal in some sense.

METHODS

Security proof

Here, we present security proof Protocol I. Firstly, we analyze the composite states shared by Alice and Bob when they both select the test mode. In the case of $\beta_{a}=\beta_{b}=\beta$ and $\phi_{a}=\phi_{b}=\phi$, the composite state of Alice and Bob can be written as

[TABLE]

where the fock state is defined as

[TABLE]

and the probability is given by

[TABLE]

where $\mu=|\beta|^{2}$ is the light intensity. In the case of $\beta_{a}=\beta_{b}=\beta$ and $\phi_{a}=\phi_{b}+\pi$(mod $2\pi$)$=\phi$, the composite state of Alice and Bob can be written as

[TABLE]

where the fock state is defined as

[TABLE]

with probability $P_{n}$.

In what follows, we concentrate on bounding Eve’s Holevo information. Eve’s general collective attack can be given by

[TABLE]

where state $\ket{e}_{E}$ is Eve’s ancilla. Then, Eve is supposed to announce one of legal outcomes ”Only detector $L$ clicks” ”Only detector $R$ clicks” and ”No detectors click” determined by her measurement results ”$\ket{L}$,$\ket{R}$,$\ket{N}$”, respectively. In the case of $\beta_{a}=\beta_{b}$ and $\phi_{a}=\phi_{b}$, $\ket{\gamma^{L}_{n,+}}$, $\ket{\gamma^{R}_{n,+}}$ and $\ket{\gamma^{N}_{n,+}}$ are some arbitrary quantum states referring to Eve’s measurement results ”$\ket{L}$,$\ket{R}$,$\ket{N}$” respectively. $Y^{L}_{n,+}$, $Y^{R}_{n,+}$ and $Y^{N}_{n,+}$ satisfying $Y^{L}_{n,+}+Y^{R}_{n,+}$+$Y^{N}_{n,+}=1$ are the yields referring to Eve’s measurement results ”$\ket{L}$,$\ket{R}$,$\ket{N}$” respectively. Similarly, in the case of $\beta_{a}=\beta_{b}$ and $|\phi_{a}-\phi_{b}|=\pi$, $\ket{\gamma^{L}_{n,-}}$, $\ket{\gamma^{R}_{n,-}}$ and $\ket{\gamma^{N}_{n,-}}$ are some arbitrary quantum states referring to Eve’s measurement results ”$\ket{L}$,$\ket{R}$,$\ket{N}$” respectively. $Y^{L}_{n,-}$, $Y^{R}_{n,-}$ and $Y^{N}_{n,-}$ satisfying $Y^{L}_{n,-}+Y^{R}_{n,-}$+$Y^{N}_{n,-}=1$ are the yields referring to Eve’s measurement results ”$\ket{L}$,$\ket{R}$,$\ket{N}$” respectively.

Without loss of generality, we firstly consider the secret key rate when her measurement result is ”$\ket{L}$”. When Alice and Bob both select the code mode, the initial prepared state $\ket{\alpha e^{i(k_{a}+\frac{x}{M})\pi}}$ and $\ket{\alpha e^{i(k_{b}+\frac{y}{M})\pi}}$, with matched-basis trials $x=y$, can be given by

[TABLE]

For the sake of simplicity, we define unnormalized states

[TABLE]

where $j\in{\{0,1,2,\ldots,2M-1\}}$. We also define other unnormalized states

[TABLE]

After Eve’s attack according to Eq.(7) and her announcing ”$\ket{L}$”, Alice and Bob keep trials only if $x=y$. Thus, the unnormalized state of Eve conditioned on Alice’s classical bit can be given by

[TABLE]

where $P\{\ket{x}\}=\ket{x}\bra{x}$. The probability of Alice obtaining a shifted key $(x=y)$ in a code mode when Eve announces ”$\ket{L}$” is

[TABLE]

and correspondingly an error click occurs if $k_{a}\oplus k_{b}=1$, thus, the error rate of shifted key $(x=y)$ is given by

[TABLE]

Thanks to the strong subadditivity of von Neumann entropy (the detailed derivation how we apply the strong subadditivity is in the Appendix A of wang2018security ), Eve’s Holevo information with her announcing ”$\ket{L}$” is given by

[TABLE]

where $H(x)=-x\log_{2}{x}-(1-x)\log_{2}({1-x})$ is binary Shannon entropy and the second inequality holds due to Jensen’s inequality. For each trial that $x=y$ and Eve announces ”$\ket{L}$”, the secret key rate is given by

[TABLE]

where $f$ is error correction efficiency. What we need to do next is to calculate the average secret key rate for different $x$ when Eve announces ”$\ket{L}$”. Without considering the sifting factor, the average secret key rate when Eve announces ”$\ket{L}$” is given by

[TABLE]

We use $Q^{L}$ to denote the average gain and $e^{L}$ to denote the average error rate of shifted key, which are written as

[TABLE]

Thanks to the concavity of binary Shannon entropy, we utilize Jensen’s inequality to minimize $R^{L}$. For the second term of Eq.(16) on the right, we have

[TABLE]

The condition for equality of Eq.(18) is that $e^{L}_{0}=e^{L}_{1}=\ldots=e^{L}_{M-1}$. Similarly, for the third term of Eq.(16) on the right, we have

[TABLE]

Here we define $I_{AE}^{L}=H(\frac{\sum_{j=0}^{M-1}|\ket{\psi^{L}_{2M+2j,+}}|^{2}+|\ket{\psi^{L}_{2M+2j,-}}|^{2}}{2Q^{L}})$. Consequently, we have

[TABLE]

Similarly, when Eve’s measurement result is ”$\ket{R}$”, the analysis of secret key rate is almost the same with the ones when she announces ”$\ket{L}$”. Thus, the secret key rate when Eve announces ”$\ket{R}$” is given by

[TABLE]

where $I_{AE}^{R}$ is given by

[TABLE]

The trials when Eve’s measurement result is ”$\ket{N}$” will not contribute to the secret key. Thus, the total secret key rate is $R=R^{L}+R^{R}$. The total gain and the total error rate of shifted key are given by

[TABLE]

In order to find the lower bound of the total secret key rate $R$, we apply the Jensen’s inequality to the estimation items in Eq.(15) and Eq. (21), and we can get

[TABLE]

where the equality holds when $e^{L}=e^{R}=e$, and

[TABLE]

where we define

[TABLE]

Consequently, the total secret key rate formula can be expressed by

[TABLE]

where $1/M$ is the shifting factor. And the problem of finding the lower bound of the total secret key rate can be converted into finding the upper bound of $I_{AE}$,

[TABLE]

Simulation

In this section, we simulate the performance of our TF-QKD protocols, and the simulation method is very similar to Ma et al. ma2018phase . Ideally, for Protocol I, Alice and Bob can estimate $Y^{L/R}_{n,\pm}$ precisely by infinite decoy-state method.

We assume that the total efficiency of channels and detectors is $\eta$, dark counting rate of single photon detectors (SPD) is $d$ per trial, the optical misalignment is $e_{mis}$, and the mean photon number of each pulse emitted by Alice and Bob is $\mu$. The counting rate is given by

[TABLE]

and the error rate is

[TABLE]

Applying infinite decoy states, $Y^{L/R}_{n,\pm}$ can be given by

[TABLE]

We define

[TABLE]

Thanks to Cauchy inequality, we have

[TABLE]

Thus, we can get an equivalent upper bound of $I_{AE}$ given by

[TABLE]

Security proof for Protocol II

The security proof of Protocol II is almost the same as Protocol I. In Protocol II, Eve’s general collective attack is given by

[TABLE]

where $\ket{l,k}_{AB}$ represents the photon-number base prepared by Alice and Bob, $\ket{\gamma^{L}_{l,k}}$, $\ket{\gamma^{R}_{l,k}}$ and $\ket{\gamma^{N}_{l,k}}$ are some arbitrary quantum states referring to Eve’s measurement results ”$\ket{L}$,$\ket{R}$,$\ket{N}$” respectively.Besides, $Y^{L}_{l,k}$, $Y^{R}_{l,k}$ and $Y^{N}_{l,k}$ satisfying $Y^{L}_{l,k}+Y^{R}_{l,k}$+$Y^{N}_{l,k}=1$ are the yields referring to Eve’s measurement results ”$\ket{L}$,$\ket{R}$,$\ket{N}$” respectively. Compared to the expression of Eve’s general collective attack in Protocol I, it can be argued that the general collective attack is actually the same as Protocol I if we set

[TABLE]

Consequently, applying the security proof method to Protocol II, we find that the expression of the upper bound of $I_{AE}$ is same as the one of Protocol I. In Protocol II, for removing phase post-selection, we estimate the yield $Y_{l,k}$ rather than $Y_{n}$ to bound $X_{2M+2j}$. Combining Eq.(9) and Eq.(36), we obtain

[TABLE]

where $even$ and $odd$ are the assembles referring to even number set and odd number set respectively. Similar to Eq.(33), by utilizing Cauchy inequality, we have

[TABLE]

where $Y_{l,k}=Y^{L}_{l,k}+Y^{R}_{l,k}$. Due to the decoy-state method implemented, $Y_{l,k}$ satisfies the constraints

[TABLE]

Thus, we have obtained the upper bound of $X_{2M+2j}$ given as follows

[TABLE]

Briefly, the upper bound of $I_{AE}$ in Protocol II is given by,

[TABLE]

$I_{AE}$** as a function of $M$**

For the sake of analyzing the upper bound of $I_{AE}$ with the increase of $M$, we define the upper bound of $\sum_{j=0}^{M-1}X_{2M+2j}$ as a function of positive integer $M$, which is given by

[TABLE]

As binary Shannon entropy $H(x)$ increases when $0\leq x\leq 1/2$ and decreases when $1/2\leq x\leq 1$, it’s sufficient to consider the case of $F(M)\leq Q/2$. It can be proven that

[TABLE]

where $N$ is a positive integer. In order to prove Eq.(43), we rewrite Eq.(42) as follows

[TABLE]

where we denote $F(M)$ and $\sqrt{P_{2Mn+2j}Y_{2Mn+2j}}$ as $G(M)$ and $A_{2Mn+2j}$ respectively. For $A_{2Mn+2j}$ is absolutely a nonnegative term, we have

[TABLE]

where the inequality holds because of the nonnegative cross term $\sum_{j\neq j^{{}^{\prime}}}^{M-1}(\sum_{n=0}^{\infty}A_{2Mn+2j})(\sum_{n=0}^{\infty}A_{2Mn+2j^{{}^{\prime}}})$. Similarly,

[TABLE]

where we use subscript $k$ instead of $Nj+j^{{}^{\prime}}$. The nonnegative cross term vanishes when $M\to\infty$, then, we have

[TABLE]

Thus, we have proven Eq.(43). Then we obtain that the upper bound of $I_{AE}$ decreases with $M$ exponentially increasing. In other words, the achievable distance becomes longer as $M$ exponentially increasing. As a result, the achievable distance comes to a limitation when $M$ tends to infinity.

Finite-decoy method for Protocol II with $M=2$

For Protocol II does not require phase post-selection in the test mode, it is more practical than Protocol I. For Protocol II, it almost reaches the limitary transmission distance with $M=2$ shown in TABLE III, thus, it is interesting and necessary to consider applying finite decoy states in the test mode.

When finite decoy states are implemented, finding the upper bound of $I_{AE}$ is equivalent to the following optimized problem

[TABLE]

where $\mu_{a},\mu_{b}\in\{\mu_{1},\mu_{2},\mu_{3}\}$. As Fig 4 shows, the performance is maintained using only three intensity settings. That is, we only need three decoy intensities $\{\mu_{1},\mu_{2},\mu_{3}\}$, and the signal intensity is chosen from one of them.

Data availability

The data that support the findings of this study are available from the corresponding author upon reasonable request

ACKNOWLEDGEMENTS

This work has been supported by the National Key Research and Development Program of China (Grant No. 2018YFA0306400); National Natural Science Foundation of China (Grant Nos. 61822115, 61961136004, 61775207, 61702469, 61771439, 61627820, 61675189); National Cryptography Development Fund (Grant No. MMJJ20170120); Anhui Initiative in Quantum Information Technologies.

Competing interests

The authors declare that they have no competing interests.

AUTHOR CONTRIBUTIONS

Z.-Q.Y., S.W., W.C., G.-C.G., Z.-F.H., and R.W. conceived the basic idea of the security proof. R.W. finished the details of the security proof. Z.-Q.Y., R.W., F.-Y.L., C.-M.Z., W.H., and B.-J.X. designed the simulations. Z.-Q.Y. and R.W. wrote the paper.

REFERENCES