# Asynchronous measurement-device-independent quantum key distribution with
hybrid source

Jun-Lin Bai  Yuan-Mei Xie  National Laboratory of Solid State Microstructures
and School of Physics, Collaborative Innovation Center of Advanced
Microstructures, Nanjing University, Nanjing 210093, China.  Yao Fu
<EMAIL_ADDRESS>Beijing National Laboratory for Condensed Matter Physics and
Institute of Physics, Chinese Academy of Sciences, Beijing 100190, China.
Hua-Lei Yin  Corresponding author<EMAIL_ADDRESS>Zeng-Bing Chen
<EMAIL_ADDRESS>National Laboratory of Solid State Microstructures and
School of Physics, Collaborative Innovation Center of Advanced
Microstructures, Nanjing University, Nanjing 210093, China.

###### Abstract

The linear constraint of secret key rate capacity is overcome by the tiwn-
field quantum key distribution (QKD). However, the complex phase-locking and
phase-tracking technique requirements throttle the real-life applications of
twin-field protocol. The asynchronous measurement-device-independent (AMDI)
QKD or called mode-pairing QKD protocol can relax the technical requirements
and keep the similar performance of twin-field protocol. Here, we propose an
AMDI-QKD protocol with a nonclassical light source by changing the phase-
randomized weak coherent state to a phase-randomized coherent-state
superposition in the signal state time window. Simulation results show that
our proposed hybrid source protocol significantly enhances the key rate of the
AMDI-QKD protocol, while exhibiting robustness to imperfect modulation of
nonclassical light sources.

##  I Introduction

Quantum key distribution (QKD) can distribute keys between two parties with
information-theoretical security, and there has been some progress in security
theory and experimental implementation [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11].
Despite no information being revealed from ideal QKD systems, attackers are
still able to use the imperfection of real devices to perform attacks on the
actual QKD system [12, 13, 14, 15]. Various QKD protocols have been proposed
[16, 1, 17, 18, 19, 20, 21, 22] and security proof theories [23, 24, 25, 26,
27, 28] have been developed to bridge the gap between theoretical and
practical conditions.

The measurement-device-independent (MDI) QKD protocol [1] is able to close all
security loopholes of the measurement party, while the transmission distance
of MDI-QKD protocols is still relatively close because of two-photon
interference in the protocols. For the key transmission distance and key rate
of the QKD protocol, there is a theoretical upper limit, the Pirandola-
Laurenza-Ottaviani-Banchi (PLOB) bound [29], which restricts the repeater-less
QKD system. It indicates the transmission distance of a single photon in the
channel. Luckily, the twin-field (TF) QKD protocol [17] utilizes the idea of
single-photon interference to achieve a breakthrough in repeater-less QKD
protocols over long distances while preserving the MDI characteristic of the
protocol.

The TF-QKD protocol [17] has very significant advantages over the MDI-QKD
protocol in terms of key rate and transmission distance. However, TF-QKD
requires phase tracking and phase locking technology in practical
implementation because of the single-photon interference. For realistic
scenarios, these techniques significantly increase the difficulty of QKD
system implementation. To reduce this difficulty, improved protocols [19, 20]
have been proposed by using asynchronous coincidence pairing, which is named
as asynchronous measurement-device-independent (AMDI) QKD [19] or called mode-
pairing QKD [20]. Importantly, both AMDI-QKD experiments [30, 31] have been
successfully demonstrated in laboratory. Ref. [31] extends the maximal
distance from 404 km to 508 km fiber and breaks the repeaterless bound without
using phase-tracking and phase-locking. Ref. [30] improves the secret key rate
by 3 orders of magnitude over 407 km fiber using two independent off-the-shelf
lasers and no phase-locking situation.

The data used to form the raw key in the AMDI protocol are derived from the
two post-matching time bins of the weak coherent state (WCS) and vacuum state.
Furthermore, the security key rate is estimated according to the single photon
component of the WCS. The WCS with a random phase can be considered as a
photon number mixing state, where multiphoton components are not used to form
the raw key in the AMDI-QKD protocol. With the maturity of experimental
techniques, the preparation of nonclassical sources in QKD protocol
implementation is gradually being considered [32, 33, 34]. Coherent-state
superposition (CSS) , also known as cat-state often serves as a basis for
quantum cryptography [32]. There have been some CSS preparation experiments
reported [35, 36]. Quantum cryptography tasks require specific CSS amplitudes,
and the experiments above are used to prepare CSS with relatively small
amplitudes. For the difficulty of controlling amplitudes, a transformation
protocol which can iterate to obtain arbitrarily high amplitudes has been
proposed [37]. Therefore, QKD protocols with CSS applied have promising
application potential in the future. Our work utilizes phase-randomized
coherent-state superposition (CSS) in the signal state time window while decoy
states time window are still send phase-randomized WCS and significantly
improves the performance of the AMDI protocol.

##  II Protocol description

In our hybrid source AMDI protocol, the first two rounds of the process are
repeated $N$ times to obtain enough data, and the signal state and the decoy
state are post-selected accordingly. To send the states that will be selected
as the decoy state, we assume that the time bin subscript is
$n\in\left\\{1,2,...,N\right\\}$, and the phase, bit value and intensity are
$\theta_{a(b)}^{n}\in\left[0,2\pi\right)$,
$r_{a(b)}^{n}\in\left\\{0,1\right\\}$ and
$k_{a}^{n}\in\left\\{\nu_{a},\omega_{a},o_{a}\right\\},~{}\nu_{a}>\omega_{a}>o_{a}=0$,
or
$k_{b}^{n}\in\left\\{\nu_{b},\omega_{b},o_{b}\right\\},~{}\nu_{b}>\omega_{b}>o_{b}=0$.
Then, Alice and Bob send the prepared states
$\left|e^{i(\theta_{a}^{n}+r_{a}^{n}\pi)}\sqrt{k_{a}^{n}}\right\rangle$ and
$\left|e^{i(\theta_{b}^{n}+r_{b}^{n}\pi)}\sqrt{k_{b}^{n}}\right\rangle$ to
Charlie at the measurement part, respectively. For the time bin of the signal
state, the coherent states of the light intensity $\mu_{a}(\mu_{b})$ with the
same amplitude and opposite phase form the CSS,
$\frac{1}{\sqrt{N_{-,a(b)}}}\left(\left|\alpha_{A}(\alpha_{B})\right\rangle-\left|-\alpha_{A}(\alpha_{B})\right\rangle\right)$,
where $N_{-,a(b)}=2(1-e^{-2\mu_{a}(\mu_{b})})$, and
$|\alpha_{A}(\alpha_{B})|^{2}=\mu_{a}(\mu_{b})$. When the phases of CSS from
Alice and Bob are randomized, the CSS sent in our proposed hybrid protocol is
a mixture of Fock states, and the density matrix of the sent CSS is expanded
in the photon number space as
$\rho=\sum_{n=0}^{\infty}P_{\xi(\mu)}(2n+1)\left|2n+1\right\rangle\left\langle
2n+1\right|$, where $P_{\xi(\mu)}(2n+1)=\frac{\mu^{2n+1}}{\sinh(\mu)(2n+1)!}$.
For simplicity, we use $\xi(\mu_{a}(\mu_{b}))$ to denote
$\frac{1}{\sqrt{N_{-,a(b)}}}\left(\left|\alpha_{A}(\alpha_{B})\right\rangle-\left|-\alpha_{A}(\alpha_{B})\right\rangle\right)$.
Alice (Bob) sends CSS $\xi(\mu_{a}(\mu_{b}))$ with probability of
$p_{\xi(\mu_{a}(\mu_{b}))}$, and sends WCS $\nu_{a(b)}$, $\omega_{a(b)}$,
$o_{a(b)}$ with probability of $p_{\nu_{a(b)}}$, $p_{\omega_{a(b)}}$,
$p_{o_{a(b)}}$. In the subsequent measurement step, Charlie at the measurement
part performs an interference measurement for each time bin (his observations
of detector clicks are recorded as events). The detectors respond with gain of
$q(k_{a},k_{b})$, where
$k_{a(b)}\in\left\\{\xi(\mu_{a}(\mu_{b})),~{}\nu_{a(b)},~{}\omega_{a(b)},~{}o_{a(b)}\right\\}$.
Charlie announces whether the event is detected and which detector clicks.

We perform click filtering in our protocol, and only
$\left\\{k_{a}^{\rm{tot}}=\xi(\mu_{a}),k_{b}^{\rm{tot}}=\xi(\mu_{b})\right\\}$
is used to form the raw key. The overall pairing after matching the two time
bins is denoted as $\left\\{k_{a}^{\rm{tot}},k_{b}^{\rm{tot}}\right\\}$, where
$k_{a(b)}^{\rm{tot}}=k_{a(b)}^{e}+k_{a(b)}^{l}$ and the $e,l$ superscripts
represent the previous moment and the next moment after the pairing,
respectively. If either Alice or Bob pairs two response events corresponding
to two signal states,
$k_{a(b)}^{\rm{tot}}=\xi(\mu_{a}(\mu_{b}))^{e}+\xi(\mu_{a}(\mu_{b}))^{l}$, the
data of this pairing are discarded. Additionally, if either Alice or Bob pairs
two events corresponding to a signal state and a decoy state on one side
(Alice or Bob), the data of this pairing will be discarded. Alice (Bob)
announces the corresponding event of decoy state $\nu_{a}$ and $\omega_{a}$
($\nu_{b}$ and $\omega_{b}$), then Bob (Alice) announces the response events
that will be filtered. The detailed process description can be found in
Supplement 1.

In the event interval $T_{c}$, the laser signal is sent at a frequency of $F$,
and then $N_{T_{c}}=FT_{c}$ signals are sent in the $T_{c}$ time interval. If
a detector response is generated in one time bin, the probability of having at
least one detector response event in the subsequent $T_{c}$ time is
$q_{T_{c}}=1-(1-q_{tot})^{N_{T_{c}}}$, where
$q_{\rm{tot}}=\sum_{k_{a},k_{b}}p_{k_{a}}p_{k_{b}}q(k_{a},k_{b})-p_{\xi(\mu_{a})}p_{\nu_{b}}q(\xi(\mu_{a}),\nu_{b})-p_{\nu_{a}}p_{\xi(\mu_{b})}q(\nu_{a},\xi(\mu_{b}))-p_{\xi(\mu_{a})}p_{\omega_{b}}q(\xi(\mu_{a}),\omega_{b})-p_{\omega_{a}}p_{\xi(\mu_{b})}q(\omega_{a},\xi(\mu_{b}))-p_{\nu_{a}}p_{\omega_{b}}q(\nu_{a},\omega_{b})-p_{\omega_{a}}p_{\nu_{b}}q(\omega_{a},\nu_{b})$
is the probability of having a click event. Therefore, it takes on average
$1+1/q_{T_{c}}$ of valid corresponding events to form a valid pairing. Thus,
we define the total number of valid successful pairing events
$n_{\rm{tot}}=\frac{Nq_{\rm{tot}}}{1+1/q_{T_{c}}}$. After the pairing is
completed, Alice and Bob first check the number of successful pairings. If it
is greater than a threshold, they will discard the part of the data that
cannot be paired according to the protocol, or if the number is less than this
threshold, they will abandon the protocol. For the partial pairing data used
as the raw key, which corresponds to $\\{\xi(\mu_{a}),\xi(\mu_{b})\\}$,
$\\{\xi(\mu_{a}),o_{b}\\}$, $\left\\{o_{a},\xi(\mu_{b})\right\\}$,
$\left\\{o_{a},o_{b}\right\\}$ (also defined as the Z basis), Alice has
previously randomly matched two time bins as required, assuming that the state
of time bin $i$ is $\xi(\mu_{a})$ and the intensity of time bin $j$ is
$o_{a}$. If $i<j$, then Alice sets her bit value to 0, and vice versa Alice
sets her bit to 1. Alice informs Bob of the number of sequences $i,j$ in the
pairing, and in the time bin corresponding to Bob, if Bob obtains
$k_{b}^{\rm{min}\\{i,j\\}}=\xi(\mu_{b}),~{}k_{b}^{\rm{max}\\{i,j\\}}=o_{b}$
then he sets his bit value to 0, and vice versa.

The data in the X basis are given by $\left\\{\nu_{a},\nu_{b}\right\\}$,
$\left\\{o_{a},\nu_{b}\right\\}$, $\left\\{\nu_{a},o_{b}\right\\}$,
$\left\\{\omega_{a},\omega_{b}\right\\}$, $\left\\{o_{a},\omega_{b}\right\\}$,
$\left\\{\omega_{a},o_{b}\right\\}$. Alice (Bob) in time bin $i$ is with the
global phase of $\varphi_{a(b)}^{i}:=\theta_{a(b)}^{i}+\phi_{a(b)}^{i}$, where
$\phi_{a(b)}^{i}$ is the phase evolution caused by the channel. We obtain the
global phase difference, which is
$\varphi^{i}=\varphi_{a}^{i}-\varphi_{b}^{i}$. Alice and Bob randomly choose
two events that satisfy $k_{a}^{i}=k_{a}^{j},~{}k_{b}^{i}=k_{b}^{j}$ and
$|\varphi^{i}-\varphi^{j}|\in\left(-\delta,~{}\delta\right]$ or
$\in\left(\pi-\delta,~{}\pi+\delta\right]$, where $\delta$ is the phase
matching interval. Further, we utilize discrete phase randomization to replace
continuous phase randomisation as the same as in [17]. The phase interval is
split into $M$ phase slices, and any interval is denoted as $\delta
k=2\pi\frac{k}{M}$, with $k=\\{0,...,M-1\\}$. In our simulation, $M$ takes the
value of 16, and thus the effect of discrete phase randomization can be
neglected [38]. We then match these events as
$\left\\{k_{a}^{i}k_{a}^{j},k_{b}^{i}k_{b}^{j}\right\\}$. By calculating the
classical bits $r_{a}^{i}\oplus r_{a}^{j}$ and $r_{b}^{i}\oplus r_{b}^{j}$,
Alice and Bob obtain the bit values in the X basis. In addition, Bob always
needs to flip his bit values in the Z basis, and in the X basis, Bob partially
flips his bit values [19, 20].

After the above process, Alice and Bob could perform post-processing
operations to obtain the key:

$\displaystyle R_{\rm{key}}$
$\displaystyle=\frac{F}{N}\bigg{\\{}\underline{s}_{0}^{z}+\underline{s}_{11}^{z}\left[1-H_{2}\left(\overline{\phi}_{11}^{z}\right)\right]-\lambda_{\rm{EC}}$
(1)
$\displaystyle-\log_{2}\frac{2}{\epsilon_{\rm{cor}}}-2\log_{2}\frac{2}{\epsilon^{\prime}\hat{\epsilon}}-2\log_{2}\frac{1}{2\epsilon_{\rm{PA}}}\bigg{\\}},$

where $N$ is the data size. The parameter $\underline{s}_{0}^{z}$ is the lower
bound of the vacuum state event number. The single-photon pair successful
event number ${s}_{11}^{z}$ and the phase error rate $\phi_{11}^{z}$ are
estimated statistically because of imperfect single-photon sources. The
underline and overline represent the lower and upper bounds on the parameters,
respectively [39, 40]. The parameter $\lambda_{\rm{EC}}=n^{z}fH_{2}(E^{z})$
accounts for the amount of information leaked during the error correction,
where $f$ is the error correction efficiency and
$H_{2}(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)$ is the binary Shannon entropy
function. $n^{z}$ and $E^{z}$ are the total number of bits and total error
rate in the Z basis. $\varepsilon_{\rm cor}$ is the failure probability of the
error verification, and $\varepsilon_{\rm PA}$ refers to the failure
probability of privacy amplification. $\varepsilon^{\prime}$ and
$\hat{\varepsilon}$ represent the coefficients when using the chain rules of
smooth min-entropy and max-entropy, respectively. $\varepsilon_{\rm
sec}=2(\varepsilon^{\prime}+\hat{\varepsilon}+2\varepsilon_{e})+\varepsilon_{\beta}+{\varepsilon_{0}}+\varepsilon_{1}+\varepsilon_{\rm
PA}$, where $\varepsilon_{0}$, $\varepsilon_{1}$, and $\varepsilon_{e}$ are
the failure probabilities for estimating the terms $s_{0}^{z}$, $s_{11}^{z}$,
and $\phi_{11}^{z}$, respectively.

Representation of the nonclassical state in the photon number space is
accompanied by probability coefficients of a non-Poisson distribution. For the
detailed calculation of the CSS state detector gain, taking
$\\{\xi(\mu_{a})^{\rm{tot}}=\xi(\mu_{a})^{e}+o_{a}^{l},~{}\xi(\mu_{b})^{\rm{tot}}=\xi(\mu_{b})^{e}+o_{b}^{l}\\}$
as an example, it is estimated as follows. In the Z basis, Alice and Bob send
a CSS to Charlie at the measurement part. We assume that the density matrix of
the nonideal CSS with phase randomization can be expressed as follows:

$\displaystyle\rho$
$\displaystyle=\frac{a}{\sinh(\mu)}\sum_{n=0}^{\infty}\frac{\mu^{2n+1}}{(2n+1)!}\left|2n+1\right\rangle\left\langle
2n+1\right|$ (2)
$\displaystyle+\frac{1-a}{\cosh(\mu)}\sum_{m=0}^{\infty}\frac{\mu^{2m}}{(2m)!}\left|2m\right\rangle\left\langle
2m\right|$
$\displaystyle=\sum_{i=0}^{\infty}P_{\xi(\mu)}(i)\left|i\right\rangle\left\langle
i\right|,$

where $a$ represents the imperfectness of the CSS. For Alice sending
$\left|i\right\rangle$ photon number state and Bob sending
$\left|j\right\rangle$ photon number state, after BS evolution, the quantum
state at the front of Charlie’s detector can be shown as follows:

$\displaystyle\left|\psi\right\rangle_{\rm{in}}$
$\displaystyle=\left|i\right\rangle_{A}\left|j\right\rangle_{B}=\frac{\left(a^{\dagger}_{A}\right)^{i}}{\sqrt{i!}}\frac{\left(a^{\dagger}_{B}\right)^{j}}{\sqrt{j!}}\left|0\right\rangle,$
(3) $\displaystyle\left|\psi\right\rangle_{\rm{out}}$
$\displaystyle=\sum_{p=0}^{i+j}\sum_{k=0}^{j}\frac{\left(-1\right)^{j-k}C_{i}^{p-k}C_{j}^{k}}{\sqrt{2^{i+j}i!j!}}\left(a^{\dagger}_{L}\right)^{p}\left(a^{\dagger}_{R}\right)^{i+j-p}\left|0\right\rangle.$

In terms of $D_{L}^{p}$ and $D_{R}^{p}$, the corresponding probabilities of
the detector clicks are
$D_{L}^{p}=1-(1-p_{d})(1-\eta)^{p},~{}D_{R}^{p}=1-(1-p_{d})(1-\eta)^{i+j-p}$.
The parameter $\eta$ is estimated by $\eta=\eta_{d}10^{-\frac{\alpha l}{20}}$,
where $\eta_{d}$, $\alpha$, and $l$ are the detector efficiency, attenuation
coefficient of the fiber, and total transmission distance, respectively. In
photon number space, the yield for only the left detector response or only the
right detector response are
$Y^{L}_{i,j}=\sum_{p=0}^{i+j}D_{L}^{p}\left(1-D_{R}^{p}\right)~{}P_{i,j},~{}Y^{R}_{i,j}=\sum_{p=0}^{i+j}\left(1-D_{L}^{p}\right)D_{R}^{p}~{}P_{i,j}$,
where
$P_{i,j}=\left|\sum_{k=0}^{j}\frac{(-1)^{j-k}C_{i}^{p-k}C_{j}^{k}}{\sqrt{2^{i+j}i!j!}}\sqrt{(p)!}\sqrt{(i+j-p)!}\right|^{2}$.
Thus, we can obtain the gain as follows:

$\displaystyle
q{\left(\xi(\mu_{a}),\xi(\mu_{b})\right)}=\sum_{i,j=0}^{\infty}P_{\xi(\mu_{a})}(i)P_{\xi(\mu_{b})}(j)\left(Y^{L}_{i,j}+Y^{R}_{i,j}\right),$
(4)

where we have
$P_{\xi(\mu)}(2n+1)=\frac{a}{\sinh(\mu)}\frac{\mu^{2n+1}}{(2n+1)!}$, and we
have $P_{\xi(\mu)}(2m)=\frac{1-a}{\cosh(\mu)}\frac{\mu^{2m}}{(2m)!}$ .

##  III Performance and Discussion

Table 1: Simulation parameters. $\eta_{d}$ and $p_{d}$ are the detector efficiency and the dark count rate, respectively. $\alpha$ ($dB/km$) and $f$ are the attenuation coefficient of the fiber and error-correction efficiency, respectively. $\epsilon$ is the failure probability parameter. We set the failure parameters $\varepsilon^{\prime}$, $\hat{\varepsilon}$, $\varepsilon_{e}$, $\varepsilon_{\beta}$ , and $\varepsilon_{PA}$ to be the same $\epsilon$. $\eta_{d}$ | $p_{d}$ | $\alpha$ | $f$ | $\epsilon$
---|---|---|---|---
$80\%$ | $10^{-8}$ | $0.16$ | $1.1$ | $10^{-10}$

We list the parameters used for simulation of the hybrid source AMDI protocol
in Table 1. The detailed calculation procedure and the optimized parameter
values at typical distance points can be found in Supplement 1, and the
absolute PLOB bound formula that we utilized in the simulation result figures
is $R=-\log_{2}(1-10^{-0.16\frac{L}{10}})$.

Figure 1: Key rate comparison between the perfect CSS AMDI protocol and the
original AMDI protocol. The time windows are set as $N=10^{12}$ and
$N=10^{14}$.

For the perfect CSS state, the parameter $a$ in Eq. 2 takes the value of $1$.
Fig. 1 shows the key rate simulation results of the perfect hybrid source AMDI
protocol for time windows of $10^{12}$ (corresponding to the red line) and
$10^{14}$ (corresponding to the blue line) compared to those of the original
AMDI protocol [19, 20] for time windows of $10^{12}$ (corresponding to the
yellow dotted line) and $10^{14}$ (corresponding to the purple dotted line).
The percentage of single photon component of CSS is higher, leading to a
higher key rate.

Fig. 2 shows the performance of the proposed CSS state protocol for time
windows of $N=10^{12}$ and $N=10^{14}$ when the signal state is imperfectly
modulated. We use the parameter $a$ in Eq. 2 to denote the CSS imperfect
modulation of the protocol, and $a$ takes the value of 0.7 in the imperfect
CSS AMDI simulation. The results in Fig. 2 show that the CSS AMDI protocol is
robust to CSS imperfect modulation. The robustness reduces the difficulty of
the experimental implementation of the proposed protocol.

Figure 2: Key rate comparison between the perfect CSS AMDI protocol and the
imperfect CSS AMDI protocol. The time windows are set as $N=10^{12}$ and
$N=10^{14}$.

We propose an improved AMDI protocol based on nonclassical quantum states. The
protocol improves secret key rate by using a quantum state with a higher
proportion of single photon components instead of the commonly used WCS
source, thus significantly improving the key rate and transmission distance of
the AMDI protocol. Our simulations use the CSS as a nonclassical light source.
In the event windows of $N=10^{12}$ and $N=10^{14}$, the simulation results of
Fig. 1 show that the key rates of the proposed protocol are $1343\%$ and
$2624\%$ higher at the distance of 400 km, and the transmission distance is
$15.57\%$ and $19.45\%$ farther than the original AMDI protocol, respectively.
Besides, the AMDI protocol using the CSS as a nonclassical light source shows
that it is robust to imperfect modulation of the nonclassical source, a
property that reduces the difficulty of the experimental implementation of the
proposed protocol. We remarked that the hybrid source protocol can also be
used for other quantum cryptography tasks, for example quantum digital
signatures [41].

ACKNOWLEDGMENTS

This study was supported by National Natural Science Foundation of China
(12274223), Natural Science Foundation of Jiangsu Province (BK20211145),
Fundamental Research Funds for the Central Universities (020414380182), Key
Research and Development Program of Nanjing Jiangbei New Area (ZDYD20210101),
Program for Innovative Talents and Entrepreneurs in Jiangsu (JSSCRC2021484),
and Program of Song Shan Laboratory (included in the management of the Major
Science and Technology Program of Henan Province) (221100210800-02).

##  Appendix A Pairing method and raw key sifting

  1. 1.

The detailed pairing method is as shown in Fig. 3. The yellow zones represent
the paired data used for decoy estimation. The orange zones stand for $X$
basis quantum bit error rate ($X$-QBER) and decoy estimation. The blue zone is
the data prepared for raw key sifting, and the dark grey zones are the discard
pairing results.

Figure 3: Detailed pairing method of our protocol. The yellow zones represent
the paired data used for decoy estimation. The orange zones stand for $X$
basis quantum bit error rate ($X$-QBER) and decoy estimation. The blue zone is
the data prepared for raw key sifting, and the dark grey zones are the discard
pairing results.

  2. 2.

In the X basis, the phase, bit value and intensity are
$\theta_{a(b)}^{n}\in\left(0,2\pi\right]$,
$r_{a(b)}^{n}\in\left\\{0,1\right\\}$ and
$k_{a}^{n}\in\left\\{\nu_{a},\omega_{a},o_{a}\right\\},~{}\nu_{a}>\omega_{a}>o_{a}=0$,
or
$k_{b}^{n}\in\left\\{\nu_{b},\omega_{b},o_{b}\right\\},~{}\nu_{b}>\omega_{b}>o_{b}=0$.
Then, Alice and Bob send the prepared states
$\left|e^{i(\theta_{a}^{n}+r_{a}^{n}\pi)}\sqrt{k_{a}^{n}}\right\rangle$ and
$\left|e^{i(\theta_{b}^{n}+r_{b}^{n}\pi)}\sqrt{k_{b}^{n}}\right\rangle$ to
Charlie at the measurement part, respectively. The data in the X basis are
given by $\left\\{\nu_{a},\nu_{b}\right\\}$, $\left\\{o_{a},\nu_{b}\right\\}$,
$\left\\{\nu_{a},o_{b}\right\\}$, $\left\\{\omega_{a},\omega_{b}\right\\}$,
$\left\\{o_{a},\omega_{b}\right\\}$, $\left\\{\omega_{a},o_{b}\right\\}$.
Alice (Bob) in time bin $e$ is with the global phase of
$\varphi_{a(b)}^{e}:=\theta_{a(b)}^{e}+\phi_{a(b)}^{e}$, where
$\phi_{a(b)}^{e}$ is the phase evolution caused by the channel. We obtain the
global phase difference, which is
$\varphi^{e}=\varphi_{a}^{e}-\varphi_{b}^{e}$. Alice and Bob randomly choose
two events that satisfy $k_{a}^{e}=k_{a}^{l}$, $k_{b}^{e}=k_{b}^{l}$ and
$|\varphi^{e}-\varphi^{l}|\in\left(-\delta,~{}\delta\right]$ or
$\in\left(\pi-\delta,~{}\pi+\delta\right]$, where $\delta$ is the phase
matching interval. Key mapping method in the X basis is as shown in Fig. 4.

Figure 4: Key mapping in the X basis. Alice (Bob) in earlier time bin $e$ is
with the global phase of
$\varphi_{a(b)}^{e}:=\theta_{a(b)}^{e}+\phi_{a(b)}^{e}$, where
$\phi_{a(b)}^{e}$ is the phase evolution caused by the channel. We obtain the
global phase difference, which is
$\varphi^{e}=\varphi_{a}^{e}-\varphi_{b}^{e}$. Alice and Bob randomly choose
two events that satisfy $k_{a}^{e}=k_{a}^{l},~{}k_{b}^{e}=k_{b}^{l}$ and
$\varphi_{ab}=|\varphi^{e}-\varphi^{l}|=0$ or $=\pi$, where $l$ represents
later time bin. In experiment, $=0$ or $=\pi$ are replaced by
$\in\left(-\delta,~{}\delta\right]$ or
$\in\left(\pi-\delta,~{}\pi+\delta\right]$, where $\delta$ is the phase
matching interval.

##  Appendix B Parameter estimation

###  B.1 Number of Z-basis single photon pairs

Because of the click filtering process that we describe in the main text, all
the intensities of the decoy states are published and only
$\left[\xi\left(\mu_{a}\right),\xi\left(\mu_{b}\right)\right]$ is used for
final key (the middle bracket represents the summation representation of the
states of the two time bins $i$, $j$). For simplicity, we let
$\nu_{a}=\nu_{b}=\nu,~{}\omega_{a}=\omega_{b}=\omega,~{}o_{a}=o_{b}=o$ in the
symmetric channel case we consider. The final key of the QKD participants can
be extracted from the single-photon pair component finally. With the decoy
state method, click filtering, and joint constraints, the lower bound of the Z
basis single photon pair component can be estimated as follows.

$\displaystyle\underline{s}_{11}^{z*}$
$\displaystyle\geq\frac{p_{\left(1,~{}\xi\left(\mu_{a}\right)\right)}p_{\left(1,~{}\xi\left(\mu_{b}\right)\right)}p_{\left[\xi\left(\mu_{a}\right),\xi\left(\mu_{b}\right)\right]}}{\nu^{2}\omega^{2}\left(\nu-\omega\right)}\left[\nu^{3}\left(e^{2\omega}\frac{\underline{n}_{\left[\omega,\omega\right]}^{*}}{p_{\left[\omega,\omega\right]}}-e^{\omega}\frac{\overline{n}_{\left[o,\omega\right]}^{*}}{p_{\left[o,\omega\right]}}-e^{\omega}\frac{\overline{n}_{\left[\omega,o\right]}^{*}}{p_{\left[\omega,o\right]}}+\frac{\underline{n}_{\left[o,o\right]}^{*}}{p_{\left[o,o\right]}}\right)\right.$
(5)
$\displaystyle\left.-\omega^{3}\left(e^{2\nu}\frac{\overline{n}_{\left[\nu,\nu\right]}^{*}}{p_{\left[\nu,\nu\right]}}-e^{\nu}\frac{\underline{n}_{\left[o,\nu\right]}^{*}}{p_{\left[o,\nu\right]}}-e^{\nu}\frac{\underline{n}_{\left[\nu,o\right]}^{*}}{p_{\left[\nu,o\right]}}+\frac{\underline{n}_{\left[o,o\right]}^{*}}{p_{\left[o,o\right]}}\right)\right]$
$\displaystyle=\frac{p_{\left(1,~{}\xi\left(\mu_{a}\right)\right)}p_{\left(1,~{}\xi\left(\mu_{b}\right)\right)}p_{\left[\xi\left(\mu_{a}\right),\xi\left(\mu_{b}\right)\right]}}{\nu^{2}\omega^{2}\left(\nu-\omega\right)}\left(\underline{S}^{*}_{1}-\overline{S}^{*}_{2}\right),$

where

$\displaystyle S_{1}$
$\displaystyle=\nu^{3}e^{2\omega}\frac{\underline{n}_{\left[\omega,\omega\right]}^{*}}{p_{\left[\omega,\omega\right]}}+\omega^{3}e^{\nu}\frac{\underline{n}_{\left[o,\nu\right]}^{*}}{p_{\left[o,\nu\right]}}+\omega^{3}e^{\nu}\frac{\underline{n}_{\left[\nu,o\right]}^{*}}{p_{\left[\nu,o\right]}}+(\nu^{3}-\omega^{3})\frac{\underline{n}_{\left[o,o\right]}^{*}}{p_{\left[o,o\right]}},$
(6) $\displaystyle S_{2}$
$\displaystyle=\omega^{3}e^{2\nu}\frac{\overline{n}_{\left[\nu,\nu\right]}^{*}}{p_{\left[\nu,\nu\right]}}+\nu^{3}e^{\omega}\frac{\overline{n}_{\left[o,\omega\right]}^{*}}{p_{\left[o,\omega\right]}}+\nu^{3}e^{\omega}\frac{\overline{n}_{\left[\omega,o\right]}^{*}}{p_{\left[\omega,o\right]}},$

and

$p_{\left(1,~{}\xi\left(\mu_{a}\right)\right)}=\frac{4}{N_{-,a}}\mu_{a}e^{-\mu_{a}},~{}p_{\left(1,~{}\xi\left(\mu_{b}\right)\right)}=\frac{4}{N_{-,b}}\mu_{b}e^{-\mu_{b}},~{}p_{\left[k_{a}^{\rm{tot}},k_{b}^{\rm{tot}}\right]}=\sum_{k_{a}^{e}+k_{a}^{l}}\sum_{k_{b}^{e}+k_{b}^{l}}\left(\frac{p^{e}_{k_{a}}p^{e}_{k_{b}}}{p_{s}}\frac{p^{l}_{k_{a}}p^{l}_{k_{b}}}{p_{s}}\right).$
(7)

An asterisk indicates that the variable takes the expected value [39, 40]. We
use underline and overline to refer to the lower and upper bounds of a
variable. When using the click filtering scheme,
$p_{s}=1-p_{\xi\left(\mu_{a}\right)}p_{\nu_{b}}-p_{\nu_{a}}p_{\xi\left(\mu_{b}\right)}-p_{\xi\left(\mu_{a}\right)}p_{\omega_{b}}-p_{\omega_{a}}p_{\xi\left(\mu_{b}\right)}-p_{\nu_{a}}p_{\omega_{b}}-p_{\omega_{a}}p_{\nu_{b}}$.
With the joint constraints [42], $\underline{S}^{*}_{1}$,
$\overline{S}^{*}_{2}$ are the results obtained by applying the statistical
fluctuation formula to the mathematical transformation of $S_{1}$, $S_{2}$.

###  B.2 Number of Z-basis vacuum state

With click filtering, the Z-basis vacuum state components are counted as

$\underline{s_{0}^{z*}}=\frac{p_{\left(0,~{}\xi\left(\mu_{a}\right)\right)}p_{\left[\xi\left(\mu_{a}\right),\xi\left(\mu_{b}\right)\right]}}{p_{\left[o_{a},\xi\left(\mu_{b}\right)\right]}}\underline{n^{*}_{\left[o_{a},\xi\left(\mu_{b}\right)\right]}}.$
(8)

For a perfectly modulated coherent superposition state,
$p_{\left(0,~{}\xi\left(\mu_{a}\right)\right)}$ is equal to zero.

###  B.3 Number of X-basis single photon pairs

For simplicity, we let
$\nu_{a}=\nu_{b}=\nu,~{}\omega_{a}=\omega_{b}=\omega,~{}o_{a}=o_{b}=o$ in the
symmetric channel case we consider. With click filtering and joint
constraints, the number of successful event pairs for X-basis single photon
pairs is as follows, the spatial probability distribution of photon numbers at
different light intensities is the same, so we get:

$\displaystyle\underline{s}_{11}^{x*}\geq$
$\displaystyle\frac{\omega^{2}e^{-4\omega}4p_{\left[2\omega,2\omega\right]}}{\omega^{2}\nu^{2}\left(\nu-\omega\right)}$
(9)
$\displaystyle\times\left[\nu^{3}\left(e^{2\omega}\frac{\underline{n}_{\left[\omega,\omega\right]}^{*}}{p_{\left[\omega,\omega\right]}}-e^{\omega}\frac{\overline{n}_{\left[o,\omega\right]}^{*}}{p_{\left[o,\omega\right]}}-e^{\omega}\frac{\overline{n}_{\left[\omega,o\right]}^{*}}{p_{\left[\omega,o\right]}}+\frac{\underline{n}_{\left[o,o\right]}^{*}}{p_{\left[o,o\right]}}\right)\right.$
$\displaystyle\left.-\omega^{3}\left(e^{2\nu}\frac{\overline{n}_{\left[\nu,\nu\right]}^{*}}{p_{\left[\nu,\nu\right]}}-e^{\nu}\frac{\underline{n}_{\left[o,\nu\right]}^{*}}{p_{\left[o,\nu\right]}}-e^{\nu}\frac{\underline{n}_{\left[\nu,o\right]}^{*}}{p_{\left[\nu,o\right]}}+\frac{\underline{n}_{\left[o,o\right]}^{*}}{p_{\left[o,o\right]}}\right)\right]$
$\displaystyle=\frac{\omega^{2}e^{-4\omega}4p_{\left[2\omega,2\omega\right]}}{\omega^{2}\nu^{2}\left(\nu-\omega\right)}\left(\underline{S}^{*}_{1}-\overline{S}^{*}_{2}\right).$

where

$\displaystyle S_{1}=$
$\displaystyle\nu^{3}e^{2\omega}\frac{\underline{n}_{\left[\omega,\omega\right]}^{*}}{p_{\left[\omega,\omega\right]}}+\omega^{3}e^{\nu}\frac{\underline{n}_{\left[o,\nu\right]}^{*}}{p_{\left[o,\nu\right]}}+\omega^{3}e^{\nu}\frac{\underline{n}_{\left[\nu,o\right]}^{*}}{p_{\left[\nu,o\right]}}$
(10)
$\displaystyle+(\nu^{3}-\omega^{3})\frac{\underline{n}_{\left[o,o\right]}^{*}}{p_{\left[o,o\right]}},$
$\displaystyle S_{2}=$
$\displaystyle\omega^{3}e^{2\nu}\frac{\overline{n}_{\left[\nu,\nu\right]}^{*}}{p_{\left[\nu,\nu\right]}}+\nu^{3}e^{\omega}\frac{\overline{n}_{\left[o,\omega\right]}^{*}}{p_{\left[o,\omega\right]}}+\nu^{3}e^{\omega}\frac{\overline{n}_{\left[\omega,o\right]}^{*}}{p_{\left[\omega,o\right]}}.$

Similarly, the probabilities are calculated as

$p_{\left[k_{a}^{\rm{tot}},k_{b}^{\rm{tot}}\right]}=\sum_{k_{a}^{e}+k_{a}^{l}}\sum_{k_{b}^{e}+k_{b}^{l}}\left(\frac{p^{e}_{k_{a}}p^{e}_{k_{b}}}{p_{s}}\frac{p^{l}_{k_{a}}p^{l}_{k_{b}}}{p_{s}}\right),$
(11)

apart from $p_{[2\omega_{a},2\omega_{b}]}$ because of the phase matching
condition in the $\bm{X}$ basis, which is

$\displaystyle
p_{[2\omega_{a},2\omega_{b}]}=\frac{2}{M}\frac{p_{\omega_{a}}p_{\omega_{b}}}{p_{s}}\frac{p_{\omega_{a}}p_{\omega_{b}}}{p_{s}}.$
(12)

When using the click filtering scheme, we have
$p_{s}=1-p_{\xi\left(\mu_{a}\right)}p_{\nu_{b}}-p_{\nu_{a}}p_{\xi\left(\mu_{b}\right)}-p_{\xi\left(\mu_{a}\right)}p_{\omega_{b}}-p_{\omega_{a}}p_{\xi\left(\mu_{b}\right)}-p_{\nu_{a}}p_{\omega_{b}}-p_{\omega_{a}}p_{\nu_{b}}$.
The parameters $\underline{S}_{1}^{*}$, $\overline{S}_{2}^{*}$ are estimated
as in Z basis.

###  B.4 Wrong single photon pair pairing event count

  1. 1.

For simplicity, we let $\omega_{a}=\omega_{b}=\omega,~{}o_{a}=o_{b}=o$ in the
symmetric channel case we consider. Wrong single photon pair pairing event
number is calculated as following.

$\overline{t}^{x}_{11}\leq
m_{\left[2\omega,2\omega\right]}-\underline{m}^{0}_{\left[2\omega,2\omega\right]},$
(13)

where $m_{\left[2\omega,2\omega\right]}$ is the observed value of the X basis
error pairings number, given in the previous section;
$\underline{m}^{0}_{\left[2\omega,2\omega\right]}$ is the number of error
pairing events sent by at least one of Alice or Bob that are vacuum states.

  2. 2.

The expected lower bound of parameter
$\underline{m}^{0}_{\left[2\omega,2\omega\right]}$ is presented as

$\displaystyle\underline{m}^{0*}_{\left[2\omega,2\omega\right]}=$
$\displaystyle
e^{-2\omega}\frac{p_{\left[2\omega,2\omega\right]}}{2p_{\left[o,2\omega\right]}}\underline{n}^{*}_{\left[o,2\omega\right]}+e^{-2\omega}\frac{p_{\left[2\omega,2\omega\right]}}{2p_{\left[2\omega,o\right]}}\underline{n}^{*}_{\left[2\omega,o\right]}$
(14)
$\displaystyle+e^{-2\omega-2\omega}\frac{p_{\left[2\omega,2\omega\right]}}{2p_{\left[o,o\right]}}\underline{n}^{*}_{\left[o,o\right]}.$

###  B.5 Phase error rate

Using $\underline{s}_{11}^{x}$, the value of the phase error rate
$\overline{\phi}_{11}^{z}$ is obtained using the fact that phase error rate in
the Z basis is equal to bit error rate in the X basis [39, 40]:

$\displaystyle\overline{\phi}_{11}^{z}=$
$\displaystyle\overline{e}_{11}^{x}=\frac{\overline{t}_{11}^{x}}{\underline{s}^{x}_{11}}.$
(15)

##  Appendix C DETAILED THEORETICAL MODEL AND SIMULATION

When Alice and Bob send coherent state pulses of intensity $k_{a}$ and $k_{b}$
(with a phase difference of $\theta$) in X basis, the probability
corresponding to that only the left detector (L) or only the right detector
(R) responds is

$\displaystyle q_{\left(k_{a},k_{b}\right)}^{\theta,L}$
$\displaystyle=\left(1-p_{d}\right)e^{-\frac{\left(\eta k_{a}+\eta
k_{b}\right)}{2}}e^{\eta\sqrt{k_{a}k_{b}}\cos\theta}$ (16)
$\displaystyle\times\left[1-\left(1-p_{d}\right)e^{-\frac{\left(\eta
k_{a}+\eta k_{b}\right)}{2}}e^{-\eta\sqrt{k_{a}k_{b}}\cos\theta}\right]$

or

$\displaystyle q_{\left(k_{a},k_{b}\right)}^{\theta,R}$
$\displaystyle=\left(1-p_{d}\right)e^{-\frac{\left(\eta k_{a}+\eta
k_{b}\right)}{2}}e^{-\eta\sqrt{k_{a}k_{b}}\cos\theta}$ (17)
$\displaystyle\times\left[1-\left(1-p_{d}\right)e^{-\frac{\left(\eta
k_{a}+\eta k_{b}\right)}{2}}e^{\eta\sqrt{k_{a}k_{b}}\cos\theta}\right],$

where $p_{d}$ is the dark count rate of the detector $D_{L}$(and $D_{R}$) for
the symmetric channel distance. The parameter $\eta$ stands for
$\eta=\eta_{d}10^{-\frac{\alpha l}{20}}$, where $l$ is the total transmission
distance and $\eta_{d}$ is the detector efficiency. By integrating the angle
$\theta$ from 0 to $2\pi$, the probability that at least one detector will
respond when Alice and Bob send pulses with light intensities $k_{a}$ and
$k_{b}$ is obtained as follows.

$\displaystyle q{\left(k_{a},k_{b}\right)}$
$\displaystyle=\frac{1}{2\pi}\int\limits_{0}^{2\pi}\left(q_{\left(k_{a},k_{b}\right)}^{\theta,L}+q_{\left(k_{a},k_{b}\right)}^{\theta,R}\right)d\theta$
(18) $\displaystyle=2\left(1-p_{d}\right)e^{-\frac{\left(\eta k_{a}+\eta
k_{b}\right)}{2}}I_{0}\left(\eta\sqrt{k_{a}k_{b}}\right)$
$\displaystyle-2\left(1-p_{d}\right)^{2}e^{-{\left(\eta k_{a}+\eta
k_{b}\right)}},$

where $I_{0}\left(x\right)$ is a zero-order first kind modified Bessel
function.

Table 2: The optimized parameter values at typical distance points. Distance (km) |  $\mu_{a}$ |  $\nu_{a}$ |  $\omega_{a}$ |  $p_{\xi(\mu_{a})}$ |  $p_{\nu_{a}}$ |  $p_{\omega_{a}}$ |  $T_{c}$ ($\mu$s)
---|---|---|---|---|---|---|---
0 |  $0.088$ |  $0.087$ |  $0.036$ |  $0.333$ |  $0.007$ |  $0.038$ |  $0.315$
200 |  $0.104$ |  $0.103$ |  $0.039$ |  $0.276$ |  $0.015$ |  $0.093$ |  $0.397$
400 |  $0.180$ |  $0.179$ |  $0.051$ |  $0.225$ |  $0.026$ |  $0.209$ |  $0.425$

As we define in the main text, the total number of valid successful pairing
events can be calculated as
$n_{\rm{tot}}=\frac{Nq_{\rm{tot}}}{1+1/q_{T_{c}}}$, where
$q_{\rm{tot}}=\sum_{k_{a},k_{b}}p_{k_{a}}p_{k_{b}}q(k_{a},k_{b})-p_{\xi(\mu_{a})}p_{\nu_{b}}q(\xi(\mu_{a}),\nu_{b})-p_{\nu_{a}}p_{\xi(\mu_{b})}q(\nu_{a},\xi(\mu_{b}))-p_{\xi(\mu_{a})}p_{\omega_{b}}q(\xi(\mu_{a}),\omega_{b})-p_{\omega_{a}}p_{\xi(\mu_{b})}q(\omega_{a},\xi(\mu_{b}))-p_{\nu_{a}}p_{\omega_{b}}q(\nu_{a},\omega_{b})-p_{\omega_{a}}p_{\nu_{b}}q(\omega_{a},\nu_{b})$
is the probability of having a click event. The average pairing time, which
denotes the time consumed to form a successful effective pairing is estimated
as
$T_{\rm{mean}}=\frac{\sum_{i=0}^{N_{T_{c}}-1}(i+1)\left(1-q_{\rm{tot}}\right)^{i}q_{\rm{tot}}}{F\sum_{i=0}^{N_{T_{c}}-1}\left(1-q_{\rm{tot}}\right)^{i}q_{\rm{tot}}}=\frac{1-N_{T_{c}}q_{\rm{tot}}\left(1/qT_{c}-1\right)}{Fq_{\rm{tot}}}$.
The number of successful pairing event pairs
$S_{\left[k_{a}^{tot},k_{b}^{tot}\right]}$ needed in parameter estimates
(except the set $S_{\left[2\omega_{a},2\omega_{b}\right]}$) can be calculated
as follows:

$n_{\left[k_{a}^{\rm{tot}},k_{b}^{\rm{tot}}\right]}=n_{\rm{tot}}\sum_{k_{a}^{e}+k_{a}^{l}}\sum_{k_{b}^{e}+k_{b}^{l}}\left(\frac{p_{k_{a}}^{e}p_{k_{b}}^{e}q\left(k_{a}^{e},k_{b}^{e}\right)}{q_{\rm{tot}}}\frac{p_{k_{a}}^{l}p_{k_{b}}^{l}q\left(k_{a}^{l},k_{b}^{l}\right)}{q_{\rm{tot}}}\right).$
(19)

And the set $S_{\left[2\omega_{a},2\omega_{b}\right]}$ contains the successful
pairing events that need to consider the phase technologies, which is
calculated as follows:

$n_{\left[2\omega_{a},2\omega_{b}\right]}=\frac{n_{\rm{tot}}}{M\pi}\int\limits_{0}^{2\pi}\left(\frac{p_{\omega_{a}}p_{\omega_{b}}q^{\theta}\left(\omega_{a},\omega_{b}\right)}{q_{\rm{tot}}}\frac{p_{\omega_{a}}p_{\omega_{b}}q^{\theta}\left(\omega_{a},\omega_{b}\right)}{q_{\rm{tot}}}\right)d\theta.$
(20)

M represents the number of intervals in which the phase is divided,
$q^{\theta}\left(\omega_{a},\omega_{b}\right)=q^{\theta,L}_{\left(\omega_{a},\omega_{b}\right)}+q^{\theta,R}_{\left(\omega_{a},\omega_{b}\right)}$.

Although the phase is discrete modulated in the experiment, it is continuous
and randomly distributed while reaching the measurement part because of the
phase drift in the fiber. Therefor, the X-basis error number is calculating as

$\displaystyle m_{\left[2\omega_{a},2\omega_{b}\right]}$
$\displaystyle=\frac{n_{\rm{tot}}}{M\pi}\int\limits_{0}^{2\pi}\bigg{\\{}\left(1-E_{\rm{HOM}}\right)\frac{p_{\omega_{a}}^{2}p_{\omega_{b}}^{2}\left[q_{\left(\omega_{a},\omega_{b}\right)}^{\theta,L}q_{\left(\omega_{a},\omega_{b}\right)}^{\theta+\delta,R}+q_{\left(\omega_{a},\omega_{b}\right)}^{\theta,R}q_{\left(\omega_{a},\omega_{b}\right)}^{\theta+\delta,L}\right]}{q_{\rm{tot}}^{2}}$
(21)
$\displaystyle+E_{\rm{HOM}}\frac{p_{\omega_{a}}^{2}p_{\omega_{b}}^{2}\left[q_{\left(\omega_{a},\omega_{b}\right)}^{\theta,L}q_{\left(\omega_{a},\omega_{b}\right)}^{\theta+\delta,L}+q_{\left(\omega_{a},\omega_{b}\right)}^{\theta,R}q_{\left(\omega_{a},\omega_{b}\right)}^{\theta+\delta,R}\right]}{q_{\rm{tot}}^{2}}\bigg{\\}}d\theta,$

where $E_{\rm{HOM}}$ is the interference mislignment error rate and
$\delta=T_{\rm{mean}}\left(2\pi\delta\nu+\omega_{\rm{fib}}\right)$ is the
phase mislignment error rate caused by the fiber phase drift
$\omega_{\rm{fib}}$ and the difference $\delta\nu$ between the two laser
frequencies. However, the frequency difference $\delta\nu$ between the two
lasers in the simulation is usually small enough to be ignored.

##  Appendix D Key Rate

  1. 1.

The AMDI key rate obtained in the key distribution phase is

$\displaystyle R_{\rm{key}}$
$\displaystyle=\frac{F}{N}\bigg{\\{}\underline{s}_{0}^{z}+\underline{s}_{11}^{z}\left[1-H_{2}\left(\overline{\phi}_{11}^{z}\right)\right]$
(22)
$\displaystyle-\lambda_{\rm{EC}}-\log_{2}\frac{2}{\epsilon_{\rm{cor}}}-2\log_{2}\frac{2}{\epsilon^{\prime}\hat{\epsilon}}-2\log_{2}\frac{1}{2\epsilon_{\rm{PA}}}\bigg{\\}}.$

  2. 2.

The data consumed in the error correction process is

$\displaystyle\lambda_{\rm{EC}}=n_{\left[\xi\left(\mu_{a}\right),\xi\left(\mu_{b}\right)\right]}fH_{2}\left(\frac{m_{\left[\xi\left(\mu_{a}\right),\xi\left(\mu_{b}\right)\right]}}{n_{\left[\xi\left(\mu_{a}\right),\xi\left(\mu_{b}\right)\right]}}\right).$
(23)

##  Appendix E Some optimized parameter values

We also list the optimized parameter values at typical distance points for the
perfectly modulated signal state CSS-AMDI in Table 2. The time windows are set
as $N=10^{12}$. The parameters $\mu_{a}$, $\nu_{a}$, $\omega_{a}$,
$p_{\xi(\mu_{a})}$, $p_{\nu_{a}}$, $p_{\omega_{a}}$, and $T_{c}$ are intensity
in Z basis used for generate $\xi(\mu_{a})$, decoy state intensities
$\nu_{a}$, decoy state intensities $\omega_{a}$, probability of choosing
signal state $\xi(\mu_{a})$, probability of choosing decoy state $\nu_{a}$,
probability of choosing decoy state $\omega_{a}$, and time interval $T_{c}$.
The corresponding parameters for Bob are $\mu_{b}=\mu_{a}$, $\nu_{b}=\nu_{a}$,
$\omega_{b}=\omega_{a}$, $p_{\xi(\mu_{b})}=p_{\xi(\mu_{a})}$,
$p_{\nu_{b}}=p_{\nu_{a}}$, and $p_{\omega_{b}}=p_{\omega_{a}}$.

## References

  * Lo  _et al._ [2012] H.-K. Lo, M. Curty, and B. Qi, Measurement-device-independent quantum key distribution, Phys. Rev. Lett. 108, 130503 (2012).
  * Wang [2013] X.-B. Wang, Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors, Phys. Rev. A 87, 012320 (2013).
  * Yin  _et al._ [2016] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou, S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang, H. Chen, M. J. Li, D. Nolan, F. Zhou, X. Jiang, Z. Wang, Q. Zhang, X.-B. Wang, and J.-W. Pan, Measurement-device-independent quantum key distribution over a 404 km optical fiber, Phys. Rev. Lett. 117, 190501 (2016).
  * Zhou  _et al._ [2016] Y.-H. Zhou, Z.-W. Yu, and X.-B. Wang, Making the decoy-state measurement-device-independent quantum key distribution practically useful, Phys. Rev. A 93, 042324 (2016).
  * Boaron  _et al._ [2018] A. Boaron, G. Boso, D. Rusca, C. Vulliez, C. Autebert, M. Caloz, M. Perrenoud, G. Gras, F. Bussières, M.-J. Li, _et al._ , Secure quantum key distribution over 421 km of optical fiber, Phys. Rev. Lett. 121, 190502 (2018).
  * Liu  _et al._ [2019] Y. Liu, Z.-W. Yu, W. Zhang, J.-Y. Guan, J.-P. Chen, C. Zhang, X.-L. Hu, H. Li, C. Jiang, J. Lin, T.-Y. Chen, L. You, Z. Wang, X.-B. Wang, Q. Zhang, and J.-W. Pan, Experimental twin-field quantum key distribution through sending or not sending, Phys. Rev. Lett. 123, 100505 (2019).
  * Wei  _et al._ [2020] K. Wei, W. Li, H. Tan, Y. Li, H. Min, W.-J. Zhang, H. Li, L. You, Z. Wang, X. Jiang, _et al._ , High-speed measurement-device-independent quantum key distribution with integrated silicon photonics, Phys. Rev. X 10, 031030 (2020).
  * Liu  _et al._ [2021] W.-B. Liu, C.-L. Li, Y.-M. Xie, C.-X. Weng, J. Gu, X.-Y. Cao, Y.-S. Lu, B.-H. Li, H.-L. Yin, and Z.-B. Chen, Homodyne detection quadrature phase shift keying continuous-variable quantum key distribution with high excess noise tolerance, PRX Quantum 2, 040334 (2021).
  * Wang  _et al._ [2022] S. Wang, Z.-Q. Yin, D.-Y. He, W. Chen, R.-Q. Wang, P. Ye, Y. Zhou, G.-J. Fan-Yuan, F.-X. Wang, W. Chen, Y.-G. Zhu, P. V. Morozov, A. V. Divochiy, Z. Zhou, G.-C. Guo, and Z.-F. Han, Twin-field quantum key distribution over 830-km fibre, Nat. Photon. 16, 154 (2022).
  * Gu  _et al._ [2022] J. Gu, X.-Y. Cao, Y. Fu, Z.-W. He, Z.-J. Yin, H.-L. Yin, and Z.-B. Chen, Experimental measurement-device-independent type quantum key distribution with flawed and correlated sources, Science Bulletin 67, 2167 (2022).
  * Zhou  _et al._ [2023a] L. Zhou, J. Lin, Y. Jing, and Z. Yuan, Twin-field quantum key distribution without optical frequency dissemination, Nature Communications 14, 928 (2023a).
  * Lydersen  _et al._ [2010] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, Hacking commercial quantum cryptography systems by tailored bright illumination, Nat. Photonics 4, 686 (2010).
  * Tang  _et al._ [2013] Y.-L. Tang, H.-L. Yin, X. Ma, C.-H. F. Fung, Y. Liu, H.-L. Yong, T.-Y. Chen, C.-Z. Peng, Z.-B. Chen, and J.-W. Pan, Source attack of decoy-state quantum key distribution using phase information, Physical Review A 88, 022308 (2013).
  * Xu  _et al._ [2020a] F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, Secure quantum key distribution with realistic devices, Rev. Mod. Phys. 92, 025002 (2020a).
  * Pirandola  _et al._ [2020] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, _et al._ , Advances in quantum cryptography, Adv. Opt. Photonics 12, 1012 (2020).
  * Braunstein and Pirandola [2012] S. L. Braunstein and S. Pirandola, Side-channel-free quantum key distribution, Phys. Rev. Lett. 108, 130502 (2012).
  * Lucamarini  _et al._ [2018] M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate–distance limit of quantum key distribution without quantum repeaters, Nature 557, 400 (2018).
  * Xu  _et al._ [2020b] H. Xu, Z.-W. Yu, C. Jiang, X.-L. Hu, and X.-B. Wang, Sending-or-not-sending twin-field quantum key distribution: Breaking the direct transmission key rate, Phys. Rev. A 101, 042330 (2020b).
  * Xie  _et al._ [2022] Y.-M. Xie, Y.-S. Lu, C.-X. Weng, X.-Y. Cao, Z.-Y. Jia, Y. Bao, Y. Wang, Y. Fu, H.-L. Yin, and Z.-B. Chen, Breaking the rate-loss bound of quantum key distribution with asynchronous two-photon interference, PRX Quantum 3, 020315 (2022).
  * Zeng  _et al._ [2022] P. Zeng, H. Zhou, W. Wu, and X. Ma, Mode-pairing quantum key distribution, Nature Communications 13, 3903 (2022).
  * Jiang  _et al._ [2023] C. Jiang, Z.-W. Yu, X.-L. Hu, and X.-B. Wang, Robust twin-field quantum key distribution through sending or not sending, Natl. Sci. Rev. 10, nwac186 (2023), https://academic.oup.com/nsr/article-pdf/10/4/nwac186/50033122/nwac186.pdf .
  * Xie  _et al._ [2023] Y.-M. Xie, J.-L. Bai, Y.-S. Lu, C.-X. Weng, H.-L. Yin, and Z.-B. Chen, Advantages of asynchronous measurement-device-independent quantum key distribution in intercity networks, arXiv preprint arXiv:2302.14349 (2023).
  * Ma  _et al._ [2018] X. Ma, P. Zeng, and H. Zhou, Phase-matching quantum key distribution, Phys. Rev.X 8, 031043 (2018).
  * Wang  _et al._ [2018] X.-B. Wang, Z.-W. Yu, and X.-L. Hu, Twin-field quantum key distribution with large misalignment error, Phys. Rev. A 98, 062323 (2018).
  * Cui  _et al._ [2019] C. Cui, Z.-Q. Yin, R. Wang, W. Chen, S. Wang, G.-C. Guo, and Z.-F. Han, Twin-field quantum key distribution without phase postselection, Phys. Rev. Applied 11, 034053 (2019).
  * Curty  _et al._ [2019] M. Curty, K. Azuma, and H.-K. Lo, Simple security proof of twin-field type quantum key distribution protocol, npj Quantum Inf. 5, 64 (2019).
  * Maeda  _et al._ [2019] K. Maeda, T. Sasaki, and M. Koashi, Repeaterless quantum key distribution with efficient finite-key analysis overcoming the rate-distance limit, Nat. Commun. 10, 3140 (2019).
  * Yin and Chen [2019] H.-L. Yin and Z.-B. Chen, Finite-key analysis for twin-field quantum key distribution with composable security, Sci. Rep. 9, 17113 (2019).
  * Pirandola  _et al._ [2017] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, Fundamental limits of repeaterless quantum communications, Nat. Commun. 8, 15043 (2017).
  * Zhu  _et al._ [2023] H.-T. Zhu, Y. Huang, H. Liu, P. Zeng, M. Zou, Y. Dai, S. Tang, H. Li, L. You, Z. Wang, Y.-A. Chen, X. Ma, T.-Y. Chen, and J.-W. Pan, Experimental mode-pairing measurement-device-independent quantum key distribution without global phase locking, Phys. Rev. Lett. 130, 030801 (2023).
  * Zhou  _et al._ [2023b] L. Zhou, J. Lin, Y.-M. Xie, Y.-S. Lu, Y. Jing, H.-L. Yin, and Z. Yuan, Experimental quantum communication overcomes the rate-loss limit without global phase tracking, arXiv preprint arXiv:2212.14190, accepted by Phys. Rev. Lett. (2023b).
  * Yin  _et al._ [2014] H.-L. Yin, W.-F. Cao, Y. Fu, Y.-L. Tang, Y. Liu, T.-Y. Chen, and Z.-B. Chen, Long-distance measurement-device-independent quantum key distribution with coherent-state superpositions, Opt. Lett. 39, 5451 (2014).
  * Zhang  _et al._ [2019] C.-H. Zhang, C.-M. Zhang, and Q. Wang, Twin-field quantum key distribution with modified coherent states, Opt. Lett. 44, 1468 (2019).
  * Xu  _et al._ [2020c] H. Xu, X.-L. Hu, X.-L. Feng, and X.-B. Wang, Hybrid protocol for sending-or-not-sending twin-field quantum key distribution, Optics Letters 45, 4120 (2020c).
  * Neergaard-Nielsen  _et al._ [2006] J. S. Neergaard-Nielsen, B. M. Nielsen, C. Hettich, K. Mølmer, and E. S. Polzik, Generation of a superposition of odd photon number states for quantum information networks, Phys. Rev. Lett. 97, 083604 (2006).
  * Huang  _et al._ [2015] K. Huang, H. Le Jeannic, J. Ruaudel, V. B. Verma, M. D. Shaw, F. Marsili, S. W. Nam, E. Wu, H. Zeng, Y.-C. Jeong, R. Filip, O. Morin, and J. Laurat, Optical synthesis of large-amplitude squeezed coherent-state superpositions with minimal resources, Phys. Rev. Lett. 115, 023602 (2015).
  * Sychev  _et al._ [2017] D. V. Sychev, A. E. Ulanov, A. A. Pushkina, M. W. Richards, I. A. Fedorov, and A. I. Lvovsky, Enlargement of optical schrdinger’s cat states, Nature Photonics 11, 379 (2017).
  * Cao  _et al._ [2015] Z. Cao, Z. Zhang, H.-K. Lo, and X. Ma, Discrete-phase-randomized coherent state source and its application in quantum key distribution, New Journal of Physics 17, 053014 (2015).
  * Chernoff [1952] H. Chernoff, A measure of asymptotic efficiency for tests of a hypothesis based on the sum of observations, Ann. Math. Stat. 23, 493 (1952).
  * Yin  _et al._ [2020] H.-L. Yin, M.-G. Zhou, J. Gu, Y.-M. Xie, Y.-S. Lu, and Z.-B. Chen, Tight security bounds for decoy-state quantum key distribution, Sci. Rep. 10, 14312 (2020).
  * Yin  _et al._ [2023] H.-L. Yin, Y. Fu, C.-L. Li, C.-X. Weng, B.-H. Li, J. Gu, Y.-S. Lu, S. Huang, and Z.-B. Chen, Experimental quantum secure network with digital signatures and encryption, Natl. Sci. Rev. 10, nwac228 (2023).
  * Yu  _et al._ [2015] Z.-W. Yu, Y.-H. Zhou, and X.-B. Wang, Statistical fluctuation analysis for measurement-device-independent quantum key distribution with three-intensity decoy-state method, Phys. Rev. A 91, 032318 (2015).