# Scalable High-Rate Twin-Field Quantum Key Distribution Networks without
Constraint of Probability and Intensity

Yuan-Mei Xie  Chen-Xun Weng  Yu-Shuo Lu  National Laboratory of Solid State
Microstructures, School of Physics and Collaborative Innovation Center of
Advanced Microstructures, Nanjing University, Nanjing 210093, China  Yao Fu
MatricTime Digital Technology Co. Ltd., Nanjing 211899, China  Yang Wang
National Laboratory of Solid State Microstructures, School of Physics and
Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China  Hua-Lei Yin<EMAIL_ADDRESS>National
Laboratory of Solid State Microstructures, School of Physics and Collaborative
Innovation Center of Advanced Microstructures, Nanjing University, Nanjing
210093, China  Zeng-Bing Chen<EMAIL_ADDRESS>National Laboratory of Solid
State Microstructures, School of Physics and Collaborative Innovation Center
of Advanced Microstructures, Nanjing University, Nanjing 210093, China
MatricTime Digital Technology Co. Ltd., Nanjing 211899, China

###### Abstract

Implementation of a twin-field quantum key distribution network faces
limitations, including the low tolerance of interference errors for phase-
matching type protocols and the strict constraint regarding intensity and
probability for sending-or-not-sending type protocols. Here, we propose a two-
photon twin-field quantum key distribution protocol and achieve twin-field-
type two-photon interference through post-matching phase-correlated single-
photon interference events. We exploit the non-interference mode as the code
mode to highly tolerate interference errors, and the two-photon interference
naturally removes the intensity and probability constraint. Therefore, our
protocol can transcend the abovementioned limitations while breaking the
secret key capacity of repeaterless quantum key distribution. Simulations show
that for a four-user networks, under which each node with fixed system
parameters can dynamically switch different attenuation links, the key rates
of our protocol for all six links can either exceed or approach the secret key
capacity. However, the key rates of all links are lower than the key capacity
when using phase-matching type protocols. Additionally, four of the links
could not extract the key when using sending-or-not-sending type protocols. We
anticipate that our protocol can facilitate the development of practical and
efficient quantum networks.

##  I Introduction

Establishing a global quantum network has become a formidable and important
issue for maintaining the privacy of worldwide communications in the era of
powerful quantum computers [1, 2]. Quantum key distribution (QKD) [3, 4], a
key platform for exploring quantum networks, enables two remote users to share
secret keys with information-theoretic security guaranteed by the laws of
quantum physics. QKD has developed rapidly in theory and has been implemented
in various experiments and networks in the past three decades [5, 6, 7, 8].
However, the non-negligible gap between ideal protocols and realistic setups
underlies various security loopholes [7]. Measurement-device-independent (MDI)
QKD [9, 10] can eliminate these loopholes on the detection side by introducing
an untrusted third party to implement entanglement swapping. Owing to
excellent real-world security, ease of deployment in a star network, and
sharing of expensive detectors, MDIQKD has received extensive attention and
in-depth research has been conducted [11, 12, 13, 14, 15, 16, 17, 18, 19, 20,
21, 22, 23, 24, 25, 26, 27]. In particular, MDIQKD is regarded as an efficient
and practical building block of quantum networks [28, 29, 30, 31, 32, 33].

Figure 1: (a) Illustration of a satellite–ground and metropolitan-area
communication network. A quantum satellite is connected to six ground stations
via ground satellite links. There are two types of nodes in the quantum
metropolitan-area network: user nodes (orange circles) and an untrusted relay
(red star). These users are connected by a relay via fiber channels. (b)
Example of a scalable QKD network setup consisting of numerous users who may
freely join or leave the network. Each user node has an asymmetric channel
connected to an untrusted relay, through which it can establish a QKD link to
others.

On the other hand, optical pulses inevitably suffer from absorption and
scattering in media, resulting in the key rates of MDIQKD depending heavily on
quantum channel transmittance. Specifically, the extracted secure key rates of
MDIQKD protocols are limited by the rate-loss scaling of repeaterless quantum
channels [34, 35, 36, 37, 38]. The exact limit is provided by the secret key
capacity, also known as the Pirandola–Laurenza–Ottaviani–Banchi (PLOB) bound
$R=-\log_{2}(1-\eta)$ [36], where $R$ and $\eta$ are the secret key rate and
the channel transmittance between the two users, respectively. In the long
term, this limitation can be overcome by using intermediate nodes together
with quantum repeaters [39, 40]. However, mature quantum repeaters are still
far from real-life implementation because of the difficulty in constructing
and reliably operating low-loss and high-clock quantum memories.

Twin-field (TF) QKD [41], which exploits single-photon-type interference in
the untrusted relay, has been proposed to break the PLOB bound. TFQKD
maintains all the advantages of MDIQKD and greatly improves the secure key
rate. Since then, many variants of TFQKD have been proposed [42, 43, 44, 45,
46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56]. These variants can be divided
into two types according to the mode of extraction of the secret key. One type
is the phase-matching-type protocol, including phase-matching (PM) QKD [42],
no phase post-selection (NPP) QKD [44, 46, 45], and four-phase TFQKD [57],
which exploits the interference mode to extract the secret key. The other type
is the single-photon-type protocol that includes sending-or-not-sending (SNS)
TFQKD [43], which uses the non-interference mode to extract the secret key and
the interference mode to estimate the phase error. These protocols have been
realized in the laboratory [58, 59, 60, 61, 62, 63, 64, 57, 65] and in the
field [66, 67, 68]. Recently, the secure transmission distance of four-phase
TFQKD was experimentally demonstrated to be over 833.8 km, setting a new
record for fiber-based quantum key distribution [57]. Furthermore, the twin-
field concept has been widely applied to other quantum tasks, such as device-
independent quantum key distribution [69], quantum conference key agreement
[70, 71, 72, 73, 74], quantum digital signatures [75, 76], and quantum secret
sharing [77, 78, 79].

TFQKD significantly improves the key rates, extends the transmission range,
and thwarts all types of detection attacks. Therefore, TFQKD is anticipated to
be a major component of future communication networks [7]. For practical
quantum networks, as shown in Fig. 1(a), there are highly asymmetrical
channels and losses at various nodes. In addition, large interference
misalignment errors may occur because some nodes may be located in complex
environments. Therefore, phase-matching-type protocols [42, 44, 46, 45, 48,
55], whose key rates are extremely sensitive to interference errors, are not
considered optimal in quantum networks. Single-photon type protocols, such as
the SNS-TFQKD protocol [43], can tolerate large misalignment errors. With the
help of actively odd-parity pairing (AOPP) [80, 81], SNS-TFQKD greatly
improves the transmission distance and the security key rate [62, 67, 68, 65].
However, a crucial limitation of SNS-TFQKD is that the sending probabilities
and intensities of quantum states must satisfy a strict mathematical
constraint (see Eq. (15)), such that the density matrix of the two-mode
single-photon state in the $X$ basis is the same as that in the $Z$ basis [49,
50]. Each user has certain given system parameters in practical network links,
including laser-pulse probabilities and intensities that depend on the
hardware [28, 32]. Therefore, it is extremely difficult to modulate system
parameters to satisfy the mathematical constraint when communication users are
switched. Additionally, the light intensity cannot be precisely modulated to
meet the constraint in a realistic setup, even for a fixed pair of users,
resulting in an insecure key rate.

In this work, we propose a two-photon (TP) TFQKD protocol that avoids the
aforementioned mathematical constraints and is robust against large
misalignment error. By leveraging the idea of time multiplexing, we post-match
two phase-correlated single-photon detection events to realize two-photon
interference. The function of post-matching resembles a quantum repeater—the
pairing for two-photon interference depends on the occurrence of detected
photons, thereby breaking the PLOB bound [37]. Traditional dual-rail
protocols, including two-photon interference MDIQKD [9], suffer from the
limitation of secret key capacity [38]. Interestingly, TP-TFQKD is a dual-rail
protocol that can overcome this limitation. We highlight that the key
components of all QKD protocols that break the PLOB bound [39, 18, 41, 24, 25]
(including our protocol) are entanglement swapping via untrusted relays and
multiplexing. Additionally, our protocol uses the non-interference mode as the
code mode, which is the same as single-photon-type protocol, so it can
tolerate high interference errors. Two-photon interferences in our protocol
make the density matrices of the single-photon pairs always identical in the
$Z$ and $X$ bases so that the security of the key rate is not affected by
modulated light intensity deviations.

In a simulation of a four-user quantum network with asymmetric channels, as
shown in Fig. 1(b), we show that TP-TFQKD enables the key rates of the five
pairs of users to exceed the secret key capacity. In contrast, secret key
rates cannot be generated for four pairs of users if SNS-TFQKD is adopted.
When a moderate interference error occurs in the network, TP-TFQKD still
enables the key rates of all six user pairs to exceed or approximate the PLOB
bound, whereas the key rates of PMQKD are an order of magnitude smaller or
even zero. Additionally, we derive a security proof for SNS-TFQKD when the
constraint is not satisfied by using the quantum coin concept [82, 83]. The
transmission distance of TP-TFQKD is 200-km longer than that of SNS-TFQKD
using the AOPP method if the intensities of the weak decoy states of both
protocols have deviations of $3\%$. The performance of our protocol is also
much better than that of PMQKD, NPPQKD, and four-phase TFQKD. Moreover, we
demonstrate that the three-intensity protocol can provide higher key rates for
long distances than the four-intensity protocol when finite-size effects are
considered, further reducing experimental complexity. Our protocol
simultaneously achieves high robustness and performance, paving the way for
deployment of practical quantum networks.

##  II TP-TFQKD protocol

We illustrate the TP-TFQKD setup in Fig. 2. Note that the TP-TFQKD setup is
identical to that of TFQKD—or rather, all variants of TFQKD have the same
experimental setup, and the workflows of these protocols differ only in state
preparation and post-processing procedures. The experimental requirements of
TP-TFQKD are also the same as those of other TFQKD protocols. A detailed
description of the protocol follows.

1\. Preparation. Alice and Bob repeat the first two steps for $N$ rounds to
obtain sufficient data. At each time bin $i\in\\{1,2,\ldots,N\\}$, Alice
chooses a random phase, $\theta_{a}^{i}$ $\in[0,2\pi)$ and a random classical
bit, $r_{a}^{i}\in\\{0,1\\}$. She then prepares a weak coherent pulse
$\ket{e^{\textbf{i}(\theta_{a}^{i}+r_{a}^{i}\pi)}\sqrt{k_{a}^{i}}}$ with
probability $p_{k_{a}}$, where $k_{a}^{i}\in\\{\mu_{a},\leavevmode\nobreak\
\nu_{a},\leavevmode\nobreak\ \mathbf{o}_{a},\leavevmode\nobreak\
\hat{\mathbf{o}}_{a}\\}$ denote the signal, decoy, vacuum, and declare-vacuum
intensities, respectively. The intensities satisfy the relation
$\mu_{a}>\nu_{a}>\mathbf{o}_{a}=\hat{\mathbf{o}}_{a}=0$. Similarly, Bob
prepares a phase-randomized weak coherent pulse
$\ket{e^{\textbf{i}(\theta_{b}^{i}+r_{b}^{i}\pi)}\sqrt{k_{b}^{i}}}$ with
probability $p_{k_{b}}$, where $k_{b}^{i}\in\\{\mu_{b},\leavevmode\nobreak\
\nu_{b},\leavevmode\nobreak\ \mathbf{o}_{b},\leavevmode\nobreak\
\hat{\mathbf{o}}_{b}\\}$ denote the signal, decoy, vacuum, and declare-vacuum
intensities, respectively. The intensities satisfy the relation
$\mu_{b}>\nu_{b}>\mathbf{o}_{b}=\hat{\mathbf{o}}_{b}=0$. Alice and Bob send
the pulses to Charlie through insecure quantum channels. In addition, they
send bright reference light to Charlie to measure the phase noise difference,
$\phi_{ab}^{i}$.

2\. Measurement. Charlie performs an interference measurement on the two
received pulses for each time bin and obtains a successful event when only one
detector clicks. Charlie publicly announces whether he obtained a successful
detection event and which detector clicked.

We represent a successful detection event as $\\{k_{a},\leavevmode\nobreak\
k_{b}\\}$, where Alice sends the intensity $k_{a}$ and Bob sends $k_{b}$. The
compressed notation $\\{k_{a}^{i}k_{a}^{j},\leavevmode\nobreak\
k_{b}^{i}k_{b}^{j}\\}$ denotes the pairing of
$\\{k_{a}^{i},\leavevmode\nobreak\ k_{b}^{i}\\}$ and
$\\{k_{a}^{j},\leavevmode\nobreak\ k_{b}^{j}\\}$, where the first label refers
to time bin $i$, and the second to time bin $j$.

Figure 2: A schematic of the TP-TFQKD protocol setup. In the station of
Alice/Bob, a narrow-linewidth continuous-wave laser is utilized as the light
source. Encoding is completed by an intensity modulator (IM) and a phase
modulator (PM). Finally, these encoded light pulses are attenuated to the
single-photon level using an attenuator (Att) and sent to Charlie. At the
station of Charlie, the interference measurement is performed using a beam
splitter (BS) and single-photon detectors (SPDs). Charlie announces detection
events when only detector $\mathbf{L}$ or $\mathbf{R}$ clicks. Note that
phase-locking and phase-tracking techniques are also required in our protocol.

3\. Sifting. For time bins where Alice sends decoy or declare-vacuum
intensity, or Bob sends decoy or declare-vacuum intensity, Alice and Bob
communicate their intensities and phase information with each other via an
authenticated classical channel. The unannounced detection events, that is,
$\\{\mu_{a},\mathbf{o}_{b}\\}$, $\\{\mu_{a},\mu_{b}\\}$,
$\\{\mathbf{o}_{a},\mu_{b}\\}$, and $\\{\mathbf{o}_{a},\mathbf{o}_{b}\\}$,
will be used to form data in the $Z$ basis. For these events, Alice randomly
matches time bin $i$ of intensity $\mu_{a}$ with another time bin $j$ of
intensity $\mathbf{o}_{a}$. She sets her bit value to 0 (1) if
$i<j\leavevmode\nobreak\ (i>j)$ and informs Bob of serial numbers $i$ and $j$.
Bob sets his bit value as 0 (1) if the intensities in the corresponding time
bins are $k_{b}^{\min\\{i,j\\}}=\mu_{b}$ $(\mathbf{o}_{b})$ and
$k_{b}^{\max\\{i,j\\}}=\mathbf{o}_{b}$ $(\mu_{b})$. Bob announces the
abandonment of the paired events where $k_{b}^{i}$ $=$
$k_{b}^{j}=\mathbf{o}_{b}$ or $\mu_{b}$, leaving paired events
$\\{\mu_{a}\mathbf{o}_{a},\leavevmode\nobreak\ \mathbf{o}_{b}\mu_{b}\\}$,
$\\{\mu_{a}\mathbf{o}_{a},\leavevmode\nobreak\ \mu_{b}\mathbf{o}_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},\leavevmode\nobreak\ \mathbf{o}_{b}\mu_{b}\\}$, and
$\\{\mathbf{o}_{a}\mu_{a},\leavevmode\nobreak\ \mu_{b}\mathbf{o}_{b}\\}$ in
the $Z$ basis. Afterwards, Bob always flips his bits in the $Z$ basis. Thus,
the events $\\{\mu_{a}\mathbf{o}_{a},\leavevmode\nobreak\
\mu_{b}\mathbf{o}_{b}\\}$ and $\\{\mathbf{o}_{a}\mu_{a},\leavevmode\nobreak\
\mathbf{o}_{b}\mu_{b}\\}$ will cause errors.

We define the global phase difference at time bin $i$ as
$\theta^{i}:=\theta_{a}^{i}-\theta_{b}^{i}+\phi_{ab}^{i}$. Alice and Bob both
keep detection events $\\{\nu_{a}^{i},\leavevmode\nobreak\ \nu_{b}^{i}\\}$
only if $\theta^{i}\leavevmode\nobreak\
\in[-\delta,\delta]\cup[\pi-\delta,\pi+\delta]$. Here, the value $\delta$ is
determined by the size of the phase slice chosen by Alice and Bob. They
randomly select two retained detection events that satisfy
$\left|\theta^{i}-\theta^{j}\right|\approx 0$ or $\pi$, and then match these
two events, denoted as $\\{\nu_{a}^{i}\nu_{a}^{j},\nu_{b}^{i}\nu_{b}^{j}\\}$.
By calculating the classical bits $r_{a}^{i}\oplus r_{a}^{j}$ and
$r_{b}^{i}\oplus r_{b}^{j}$, Alice and Bob extract a bit value on the $X$
basis, respectively. Bob flips his bits when the global phase difference
between two matching time bins is 0 ($\pi$) and the two clicking detectors
announced by Charles are different (same) in the $X$ basis. The events
$\\{\mu_{a},\hat{\mathbf{o}}_{b}\\}$, $\\{\hat{\mathbf{o}}_{a},\mu_{b}\\}$,
$\\{o_{a},\nu_{b}\\}$, $\\{\nu_{a},o_{b}\\}$,
$\\{\hat{\mathbf{o}}_{a},o_{b}\\}$, and
$\\{\mathbf{o}_{a},\hat{\mathbf{o}}_{b}\\}$ will be used for decoy analysis,
where $o_{a(b)}\in\\{\mathbf{o}_{a(b)},\hat{\mathbf{o}}_{a(b)}\\}$.

4\. Parameter estimation. Alice and Bob use random bits from the $Z$ basis to
form $n^{z}$-length raw key bits. The remaining bits in the $Z$ basis are used
to compute the bit error rate, $E^{z}$. All bit values in the $X$ basis are
disclosed to obtain the total number of errors. Alice and Bob use the decoy-
state method [84, 85] to estimate the number of events in the $Z$ basis when
Alice emits a zero-photon state in the two matched time bins,
$s_{0\mu_{b}}^{z}$, the count of single-photon pairs in the $Z$ basis,
$s_{11}^{z}$, the bit error rate in the $X$ basis, $e_{11}^{x}$, and the phase
error rate of single-photon pairs in the $Z$ basis, $\phi_{11}^{z}$ (see
Appendix C.1 for details).

5\. Postprocessing. Alice and Bob distill the final keys utilizing the error
correction algorithm with $\varepsilon_{\rm{cor}}$-correct and the privacy
amplification algorithm with $\varepsilon_{\rm{sec}}$-secret. Using the
entropic uncertainty relation [13], the length of the final secret key,
$\ell$, against coherent attacks with total security
$\varepsilon_{\rm{TP}}=\varepsilon_{\rm{sec}}+\varepsilon_{\rm{cor}}$ can be
written as

$\displaystyle\ell=$
$\displaystyle\underline{s}_{0\mu_{b}}^{z}+\underline{s}_{11}^{z}\left[1-H_{2}(\overline{\phi}_{11}^{z})\right]-n^{z}fH_{2}(E^{z})$
(1) $\displaystyle-\log_{2}\frac{2}{\varepsilon_{\rm
cor}}-2\log_{2}\frac{2}{\varepsilon^{\prime}\hat{\varepsilon}}-2\log_{2}\frac{1}{2\varepsilon_{\rm
PA}},$

and $\varepsilon_{\rm
sec}=2(\varepsilon^{\prime}+\hat{\varepsilon}+2\varepsilon_{e})+\varepsilon_{\beta}+\varepsilon_{0}+\varepsilon_{1}+\varepsilon_{\rm
PA}$. Here,

  * $\underline{x}$

is the lower bound of observed value $x$.

  * $\overline{x}$

is the upper bound of observed value $x$.

  * $H_{2}(x)$

is the binary Shannon entropy function:
$H_{2}(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)$.

  * $f$

is the error correction efficiency.

  * $\varepsilon_{\rm cor}$

is the failure probability of error verification.

  * $\varepsilon_{\rm PA}$

is the failure probability of privacy amplification.

  * $\varepsilon^{\prime}$

and $\hat{\varepsilon}$ are coefficients when using chain rules of smooth min-
entropy and max-entropy, respectively.

  * $\varepsilon_{\beta}$

is the failure probability for estimating the terms of $E_{z}$.

  * $\varepsilon_{0}$

, $\varepsilon_{1}$, and $\varepsilon_{e}$ are the failure probabilities for
estimating the terms of $s_{0\mu_{b}}^{z}$, $s_{11}^{z}$, and $\phi_{11}^{z}$,
respectively.

##  III Security proof

Here, we introduce a virtual entanglement-based TP-TFQKD protocol. Let
$\ket{10}^{ij}=\ket{1}^{i}\ket{0}^{j}$ denote the quantum state, where we have
one photon in time bin $i$ and zero photons in time bin $j$. For time bins $i$
and $j$, Alice (Bob) prepares an entangled state
$\ket{\phi^{+}}_{Aa}=1/\sqrt{2}(\ket{+z}_{A}\ket{+z}_{a}+\ket{-z}_{A}\ket{-z}_{a})$
($\ket{\phi^{+}}_{Bb}$), where $\ket{\pm z}_{A(B)}$ are two eigenvectors of
the Pauli $Z$ operator denoting the qubits in the hands of Alice (Bob), and
$\ket{+z}_{a(b)}=\ket{10}^{ij}$ and $\ket{-z}_{a(b)}=\ket{01}^{ij}$ are two
eigenvectors of the $Z$ basis for optical modes $a\leavevmode\nobreak\ (b)$,
respectively. Accordingly, the eigenvectors of the $X$ basis are $\ket{\pm
x}=(\ket{+z}\pm\ket{-z})/\sqrt{2}$. The joint quantum state of Alice and Bob
can be written as

$\displaystyle\ket{\Phi}_{AaBb}=\ket{\phi^{+}}_{Aa}$
$\displaystyle\otimes\ket{\phi^{+}}_{Bb}$ (2)
$\displaystyle=\frac{1}{2}(\ket{+z+z}_{AB}$
$\displaystyle\ket{+z+z}_{ab}+\ket{-z-z}_{AB}\ket{-z-z}_{ab}$
$\displaystyle+\ket{+z-z}_{AB}$
$\displaystyle\ket{+z-z}_{ab}+\ket{-z+z}_{AB}\ket{-z+z}_{ab}),$

where quantum state $\ket{+z+z}_{ab}$ represents $\ket{+z}_{a}\ket{+z}_{b}$.
Next, Alice and Bob perform nonlocal operations to preserve their quantum
state of unequal qubits. For example, Alice and Bob can perform controlled NOT
operations on an auxiliary qubit $\ket{+z}_{C}$ on Alice’s side controlled by
qubit $A$ and qubit $B$, respectively (Bob could perform the controlled NOT
nonlocally with the help of an additional entangled state [86]). Alice then
measures qubit $C$ in the $Z$ basis and they post select the joint quantum
state when the outcome is $-z$. Under this condition, the joint quantum state
acquired by Alice and Bob can be written as

$\displaystyle\ket{\Psi}_{ABab}=$
$\displaystyle\frac{1}{\sqrt{2}}(\ket{+z-z}_{AB}\ket{+z-z}_{ab}$ (3)
$\displaystyle+\ket{-z+z}_{AB}\ket{-z+z}_{ab})$ $\displaystyle=$
$\displaystyle\frac{1}{\sqrt{2}}\left(\frac{\ket{+x+x}_{AB}-\ket{-x-x}_{AB}}{\sqrt{2}}\ket{\psi^{+}}_{ab}\right.$
$\displaystyle-\left.\frac{\ket{-x+x}_{AB}-\ket{+x-x}_{AB}}{\sqrt{2}}\ket{\psi^{-}}_{ab}\right).$

Alice and Bob hold qubits $A$ and $B$, respectively. They send optical modes
$a$ and $b$, respectively, to Charlie, who performs Bell state measurements to
identify the two Bell states:
$\ket{\psi^{+}}_{ab}=(\ket{+z-z}_{ab}+\ket{-z+z}_{ab})/\sqrt{2}$ and
$\ket{\psi^{-}}_{ab}=(\ket{+z-z}_{ab}-\ket{-z+z}_{ab})/\sqrt{2}$. The same
detector clicks at time bins $i$ and $j$ indicate a projection into Bell state
$\ket{\psi^{+}}_{ab}$. Different detector clicks at time bins $i$ and $j$
imply a projection into Bell state $\ket{\psi^{-}}_{ab}$.

Table 1: Simulation parameters. $\eta_{d}$ and $p_{d}$ are the detector efficiency and dark count rate, respectively. $\alpha$ is the attenuation coefficient of the fiber, $e_{d}^{z}$ is the misalignment error in the $Z$ basis, and $f$ denotes the error correction efficiency. $\epsilon$ is the failure probability considered in the error verification and finite data analysis processes. $\eta_{d}$ | $p_{d}$ | $\alpha$ | $e_{d}^{z}$ | $f$ | $\epsilon$
---|---|---|---|---|---
[.5]0 $70\%$ | $10^{-8}$ |  $0.165$ dB/km | 0 | $1.1$ | $36/24\times 10^{-10}$
Table 2: Simulated secure key rates for TP-TFQKD and SNS-TFQKD with the AOPP method in the QKD network shown in Fig.1(b) using the parameters in Table 1. The angle of misalignment in the $X$ basis of TP-TFQKD and SNS-TFQKD (AOPP) are both set to $\sigma=5^{\circ}$ and the data size is $N=10^{11}$. Here, link A-C represents that user A communicates with user C. The sending intensities and corresponding probabilities are selected by the users to obtain the optimal key rate for links A to C and B to D. Here, the superscripts $\rm{tp}$ and $\rm{sns}$ correspond to the TP-TFQKD and SNS-TFQKD (AOPP) protocols, respectively. When users switch to communicate with other users, these values remain unchanged. [.5]0 | Protocol | A-C | B-D | A-D | A-B | C-D | C-B
---|---|---|---|---|---|---|---
[.5]0 | PLOB | $5.300\times 10^{-6}$ | $1.695\times 10^{-6}$ | $1.695\times 10^{-6}$ | $2.537\times 10^{-7}$ | $3.542\times 10^{-5}$ | $5.300\times 10^{-6}$
| TP-TFQKD | $8.631\times 10^{-6}$ | $6.701\times 10^{-6}$ | $6.063\times 10^{-6}$ | $1.743\times 10^{-6}$ | $1.754\times 10^{-5}$ | $8.456\times 10^{-6}$
| SNS-TFQKD (AOPP) | $1.111\times 10^{-5}$ | $8.228\times 10^{-6}$ | $0$ | $0$ | $0$ | $0$
[.5]0 | User | TP-TFQKD | SNS-TFQKD (AOPP)
[.5]0 | $\mu^{\rm{tp}}$ | $\nu^{\rm{tp}}$ | $p_{\mu}^{\rm{tp}}$ | $p_{\nu}^{\rm{tp}}$ | $p_{\mathbf{o}}^{\rm{tp}}$ | $p_{\hat{\mathbf{o}}}^{\rm{tp}}$ | $\mu^{\rm{sns}}$ | $\nu^{\rm{sns}}$ | $p_{\mu}^{\rm{sns}}$ | $p_{\nu}^{\rm{sns}}$ | $p_{\mathbf{o}}^{\rm{sns}}$ | $p_{\hat{\mathbf{o}}}^{\rm{sns}}$
[.5]0 | A | $0.725$ | $0.100$ | $0.388$ | $0.159$ | $0.449$ | $0.004$ | $0.789$ | $0.1262$ | $0.388$ | $0.111$ | $0.498$ | $0.003$
| B | $0.681$ | $0.098$ | $0.362$ | $0.163$ | $0.471$ | $0.004$ | $0.765$ | $0.0714$ | $0.336$ | $0.124$ | $0.537$ | $0.003$
| C | $0.166$ | $0.005$ | $0.069$ | $0.161$ | $0.762$ | $0.008$ | $0.164$ | $0.006$ | $0.077$ | $0.108$ | $0.807$ | $0.008$
| D | $0.250$ | $0.015$ | $0.108$ | $0.165$ | $0.716$ | $0.011$ | $0.253$ | $0.010$ | $0.119$ | $0.125$ | $0.749$ | $0.007$

After Charlie announces whether he has obtained a Bell state and which Bell
state he has identified through public channels, Alice and Bob will randomly
choose the $Z$ or $X$ basis to measure qubits $A$ and $B$, respectively. Alice
and Bob publish the basis information through an authenticated classical
channel. Bob always flips his bit value if he chooses the $Z$ basis. Bob will
flip his outcome in the $X$ basis if Charlie’s announcement is
$\ket{\psi^{-}}_{ab}$. They use the data of the $Z$ basis to generate the raw
key, while the data of the $X$ basis are used to estimate the leaked
information. Alice and Bob can acquire a secure key through error correction
and privacy amplification.

Next, the entanglement-based protocol can be equivalently converted to the
prepare-and-measurement protocol by the arguments of Shor–Preskill. For the
prepare-and-measure protocol, Alice and Bob prepare the quantum states of
modes $a$ and $b$ according to Eq. (3). Specifically, Alice and Bob send joint
quantum states of a single-photon pair, $\ket{+z-z}_{ab}$ and
$\ket{+z-z}_{ab}$, randomly if they choose the $Z$ basis. They randomly send
the joint quantum states of a single-photon pair, $\ket{\psi^{+}}_{ab}$ and
$\ket{\psi^{-}}_{ab}$, if they choose the $X$ basis. The other steps are all
the same as the entanglement-based protocol, including the Bell state
measurement, basis comparison, bit flipping, error correction, and privacy
amplification. After Alice and Bob know the bit error rate of the state with
single-photon pairs $e_{11}^{x}$ in the $X$ basis, the asymptotic key rate can
be given by [87, 88]

$\displaystyle R$
$\displaystyle=q_{11}[1-H_{2}(e_{11}^{x})-fH_{2}(e_{11}^{z})],$ (4)

where $q_{11}$ and $e_{11}^{z}$ represent the gain and bit error rates of the
single-photon pairs in the $Z$ basis, respectively. Note that the
entanglement-based protocol and prepare-and-measure protocol are virtual
protocols, which are not used experimentally but to prove security in theory.
In fact, Alice and Bob do not need to pre-share the nonlocal entanglement
state $\ket{\psi^{\pm}}_{ab}$. Instead, they can send the two-mode phase-
randomized coherent states
$\ket{e^{i(\kappa+r_{a}^{i}\pi)}\alpha_{a}}_{a}^{i}\ket{e^{i(\varphi+r_{a}^{j}\pi)}\alpha_{a}}_{a}^{j}$
and
$\ket{e^{i(\kappa+r_{b}^{i}\pi)}\alpha_{b}}_{b}^{i}\ket{e^{i(\varphi+r_{b}^{j}\pi)}\alpha_{b}}_{b}^{j}$
to Charlie in the $X$ basis. Then, they use the decoy-state method to estimate
the upper bound of the phase-flip error rate of $\ket{\psi^{\pm}}_{ab}$ (see
Appendix A).

##  IV Performance and Discussion

We first provide an intuitive understanding of the scaling of our protocol
before demonstrating its performance. In the TP-TFQKD protocol, successful
detection in each time bin depends on the arrival of a single photon at the
relay with a probability of $O(\sqrt{\eta})$, which is identical to the
original twin-field protocol. Afterwards, the post-matching process, which is
the pairwise matching of successful detection events, will only add a factor
of 1/2 to the $O(\sqrt{\eta})$ scaling for the large data size $N$. Compared
with traditional two-photon interference, wherein the pairings are
predetermined independently of the arrival of a photon at the relay, twin-
field-type asynchronous two-photon interference improves the scaling from
$O(\eta)$ to $O(\sqrt{\eta})$.

Table 3: Simulated secure key rates for TP-TFQKD and PMQKD in the QKD network shown in Fig.1(b) using parameters in Table 1. The angle of misalignment in the $X$ basis of TP-TFQKD and PMQKD were both set to $\sigma=18^{\circ}$ and the data size is $N=10^{11}$. The users fix sending intensities and corresponding probability values to values that enable the A-C and B-D links to obtain the optimal key rate. Here, superscripts $\rm{tp}$ and $\rm{pm}$ correspond to TP-TFQKD and PMQKD protocols, respectively.  [.5]0 Protocol | A-C | B-D | A-D | A-B | C-D | C-B
---|---|---|---|---|---|---
[.5]0 PLOB | $5.300\times 10^{-6}$ | $1.695\times 10^{-6}$ | $1.695\times 10^{-6}$ | $2.537\times 10^{-7}$ | $3.542\times 10^{-5}$ | $5.300\times 10^{-6}$
TP-TFQKD | $2.572\times 10^{-6}$ | $1.945\times 10^{-6}$ | $1.730\times 10^{-6}$ | $3.573\times 10^{-7}$ | $6.192\times 10^{-6}$ | $2.530\times 10^{-6}$
PMQKD | $2.840\times 10^{-7}$ | $2.400\times 10^{-7}$ | $2.244\times 10^{-7}$ | $0$ | $8.940\times 10^{-7}$ | $2.700\times 10^{-7}$
User | TP-TFQKD | PMQKD
$\mu^{\rm{tp}}$ | $\nu^{\rm{tp}}$ | $p_{\mu}^{\rm{tp}}$ | $p_{\nu}^{\rm{tp}}$ | $p_{\mathbf{o}}^{\rm{tp}}$ | $p_{\hat{\mathbf{o}}}^{\rm{tp}}$ | $\mu^{\rm{pm}}$ | $\nu^{\rm{pm}}$ | $p_{\mu}^{\rm{pm}}$ | $p_{\nu}^{\rm{pm}}$ | $p_{o}^{\rm{pm}}$
A | 0.720 | 0.084 | 0.343 | 0.243 | 0.409 | 0.005 | 0.086 | 0.024 | 0.605 | 0.176 | 0.219
B | 0.666 | 0.084 | 0.320 | 0.245 | 0.430 | 0.005 | 0.076 | 0.022 | 0.613 | 0.169 | 0.218
C | 0.168 | 0.004 | 0.058 | 0.251 | 0.677 | 0.014 | 0.005 | 0.002 | 0.626 | 0.172 | 0.202
D | 0.266 | 0.013 | 0.088 | 0.262 | 0.638 | 0.012 | 0.013 | 0.004 | 0.609 | 0.177 | 0.214

###  IV.1 Quantum network simulation results

To show the TP-TFQKD performance in a real-life network, we focus on the four
users (A, B, C, and D) in the QKD network shown in Fig. 1(b), where the
corresponding distances to the untrusted relay are $L_{A}=200$ km, $L_{B}=200$
km, $L_{C}=120$ km, and $L_{D}=150$ km. The experimental parameters were set
to be typical values and are listed in Table 1. For the finite-size regime, we
set failure parameters $\varepsilon_{\rm{cor}}$, $\varepsilon^{\prime}$,
$\hat{\varepsilon}$, $\varepsilon_{e}$, $\varepsilon_{\beta}$, and
$\varepsilon_{\rm PA}$ to be the same value: $\epsilon$. We have
$\varepsilon_{0}+\varepsilon_{1}=13\epsilon$ because we use the Chernoff bound
[89, 90] 13 times to estimate $s_{0\mu_{b}}^{z}$, $s_{11}^{z}$, and
$e_{11}^{x}$. The corresponding security bound is
$\varepsilon_{\rm{TP}}=24\epsilon$. We also simulated the key rate of the SNS-
TFQKD protocol using the actively odd-parity pairing method (simply AOPP
hereafter) for comparison. In Ref. [81], the security bound of the AOPP is
$\varepsilon_{\rm{AOPP}}=36\varepsilon$ in finite-size cases. For a fair
comparison, we set $\varepsilon=10^{-10}$ and $\epsilon=36{\varepsilon}/24$
such that $\varepsilon_{\rm{TP}}=\varepsilon_{\rm{AOPP}}=3.6\times 10^{-9}$.
Detailed equations for simulating the TP-TFQKD protocol are shown in Appendix
C.2. In a commercialized network, the sending intensities and corresponding
probabilities are usually fixed as long as the hardware is set up. Here, we
set the sending intensity and probability of four users, which will allow
links A-C and B-D to have optimal key rates. If the AOPP protocol is utilized
in other links (A-D, A-B, C-D, and C-B), the mathematical constraints required
by the AOPP (given in Eq. 15 in Appendix B) may not be satisfied, resulting in
completely insecure key rates. In this case, we provide quantitative bounds
that connect deviation from the mathematical constraints to the security of
the SNS-TFQKD protocol, thus giving a secure key rate when the constraint is
violated (see Appendix B for details).

In Table 2, we list the secret key rate, $R=\ell/N$, for different pairs of
users under the TP-TFQKD and AOPP protocols [81] when the data size is
$N=10^{11}$. To assess the performance of the network, we also provide the
PLOB bound. For links A-C and B-D, the key rates for TP-TFQKD are only
slightly lower and comparable to those of AOPP. If TP-TFQKD is to be
implemented, links A-D, A-B, C-D, and C-B also have high key rates, whereas no
secure key is generated with the AOPP protocol. In addition, five pairs of
links among the six pairs can exceed the PLOB bound with TP-TFQKD. In view of
this, our protocol is suitable not only for long-distance communication but
also for scalable networks.

Figure 3:  Comparison of the secret key rates of TP-TFQKD and AOPP [81] in the
finite-size regime under two types of channels: (a) symmetric channel
$l_{a}=l_{b}$ and (b) asymmetric channel $l_{b}-l_{a}=100$ km. The horizontal
axis represents total transmission distance $l=l_{a}+l_{b}$ and the parameters
listed in Table 1 and $N=10^{13}$ were used. The angles of misalignment in the
$X$ basis of TP-TFQKD and AOPP were both set to $\sigma=5^{\circ}$ and the
security bounds are $\varepsilon_{\rm{TP}}=\varepsilon_{\rm{AOPP}}=3.6\times
10^{-9}$. In each plot, the solid (dashed) lines represent the key rates of
TP-TFQKD (AOPP) for different preparation deviations of decoy intensity
$\nu_{b}$, and the solid gray line illustrates the PLOB bound [36]. The
simulations show that our protocol can achieve key rates comparable to those
of the AOPP scheme in the ideal case. Additionally, TP-TFQKD obtained a
significantly higher key rate than AOPP in the presence of more than $3\%$
deviation of modulated light intensity $\nu_{b}$.  Figure 4: (a) Comparison of
the secret key rates of TP-TFQKD and PMQKD [53] under two channel types: (a)
symmetric, $l_{a}=l_{b}$, and (b) asymmetric, $l_{b}-l_{a}=100$ km. The
horizontal axis represents the total transmission distance, $l=l_{a}+l_{b}$.
The parameters listed in Table 1 were used and the angles of misalignment in
the $X$ basis of TP-TFQKD and PMQKD were both set to $\sigma=5^{\circ}$. In
the finite case, we set the failure probability of PMQKD to $10^{-10}$, and
the corresponding security bound was $O(10^{-9})$. In the finite case, we
simulated two groups of results where $N=10^{11}$ and $N=10^{13}$. The
simulations show that TP-TFQKD has a higher key rate than PMQKD.  Figure 5:
Comparison of the secret key rates of TP-TFQKD, NPPQKD [51] and four-phase
TFQKD [57] using the same parameters in the ultra-low-loss fiber scenario of
Ref. [57]. The total number of transmitted quantum signals is $3.2\times
10^{14}$. The detection efficiency is $28\%$, the dark count rate is $3\times
10^{-11}$, and the channel transmittance from Alice (Bob) to Charlie is
$\eta_{a(b)}=10^{-0.16(l-10.7)/20}$. The misalignment error rate of NPPQKD and
four-phase TFQKD is $2\%$. The misalignment angle of TP-TFQKD is set as
$5^{\circ}$, which contributes an error rate of approximately $2\%$. The
security bounds are both $2^{-31}$. The simulations show that TP-TFQKD has
higher key rates than NPPQKD and four-phase TFQKD, and that the transmission
distance of TP-TFQKD can exceed 900 km. Figure 6: (a) Comparison of secret key
rates between our protocol and AOPP with four-intensity and three-intensity
decoy-state methods where $N=10^{11}$. The horizontal axis represents the
total transmission distance, $l=l_{a}+l_{b}$. The misalignment angle in the
$X$ basis $\sigma=5^{\circ}$. Here, the solid (dashed) yellow line represents
the relative difference between four- and three-intensity decoy states TP-
TFQKD (AOPP). (b) Comparison of secret key rates between our protocol and AOPP
with four-intensity and three-intensity decoy-state methods in the presence of
a deviation in the modulated intensity, $\nu_{b}$, where $N=10^{13}$. Our
results show that the key rate of the three-intensity decoy-state method is
almost the same as that of the four-intensity decoy-state method for both TP-
TFQKD and AOPP, regardless of whether there is a deviation in the light
intensity.

In Table 3, we simulated TP-TFQKD and PMQKD performance [53] when the
misalignment angle in the network was $\sigma=18^{\circ}$, resulting in an
interference error rate of approximately $5\%$. The results show that when
there is a moderate interference error, the key rate of TP-TFQKD can still
exceed the PLOB bound for a transmission distance of 400 km while PMQKD is
unable to generate a secure key. In this network, TP-TFQKD enables the key
rates of the two links (B-D and A-B) to exceed the PLOB bound. However, PMQKD
failed to exceed the PLOB bound under the same circumstances. When the
transmission distance is 300 km, the key rate of TP-TFQKD can still reach
$10^{-6}$. This means that a key rate of several kbits per second can be
achieved with a state-of-the-art high-speed QKD system working at a gigahertz
repetition rate.

###  IV.2 Comparison with TFQKD protocol variants

We denote the distance between Alice (Bob) and Charlie as $l_{a}$ ($l_{b}$).
In Fig. 3, we plot the secret key rates of TP-TFQKD and AOPP [81] in symmetric
($l_{a}=l_{b})$ and asymmetric ($l_{b}-l_{a}=100$ km) channels under data size
$N=10^{13}$, and we also consider the inaccuracy of the modulated light
intensities. For TP-TFQKD, we use
$\Delta_{\nu_{b}=10\%}=(R_{\rm{tp}}-R_{\delta\nu_{b}=10})/R_{\rm{tp}}$ to
represent the relative difference between the key rate in the ideal case,
$R_{\rm{tp}}$, and the key rate when the deviation of intensity $\nu_{b}$ is
10% $R_{\delta\nu_{b}=10}$. The key rates of TP-TFQKD when the light intensity
is inaccurately modulated are only slightly smaller than those when the light
intensity is perfectly modulated. When the light intensity is perfectly
modulated, the AOPP key rate is slightly higher than that of TP-TFQKD.
However, whether in a symmetric or asymmetric channel, this advantage of AOPP
no longer exists when there is a deviation of even 1% in the light intensity
preparation, $\nu_{b}$, and other parameters do not deviate. Figure 3(a) shows
that the transmission distance of TP-TFQKD in a symmetric channel is 200 km
farther than that of AOPP when the deviations of intensity $\nu_{b}$ for both
protocols is 3%. Moreover, the transmission distance of the AOPP cannot exceed
320 km with a deviation of more than 10%. Figure 3(b) reveals that the
transmission distance of TP-TFQKD is 200 km farther than that of AOPP in an
asymmetric channel when the deviations of intensity $\nu_{b}$ for both
protocols is 10%. The key rate of AOPP is slightly better in the asymmetric
case when the intensity deviations are the same because the fidelity between
joint density matrices of the single-photon states in the Z and X bases is the
lowest in the symmetric case for a fixed intensity deviation (see Eq. (16)).

In fact, a preparation deviation of 3% is common, especially for small values.
For example, when light intensity $\nu$ prepared by user D is changed from
0.010 to 0.0103 (see Table 2), the preparation deviation reaches 3%. This
preparation deviation further reduces the key rate, even resulting in a secure
key rate of zero. To illustrate the importance of this point, we analyze the
potential secret key in practical situations under reported experimental
performance and security parameters [67, 68]. To ensure that the AOPP key rate
for the 428 km of deployed commercial fiber in Ref [67] is not zero, the
preparation deviation of the $\nu_{a}$ light intensity is required to be less
than $0.09\%$. To ensure that the AOPP key rate for the 511-km of ultra-low-
loss fiber in Ref [68] is not zero, the preparation deviation of the $\nu_{a}$
light intensity must be less than $0.2\%$. These two small deviations are
usually difficult to achieve.

In addition, we compare the key rates of TP-TFQKD with PMQKD [53] protocols
under the finite-size case in Fig. 4. The experimental parameters are listed
in Table 1. The angle of misalignment in the $X$ basis of TP-TFQKD and PMQKD
are both set to $\sigma=5^{\circ}$, which contributes to an error of
approximately $2\%$. Figures 4(a) and 4(b) show a comparison of key rates
between TP-TFQKD and PMQKD protocols under symmetrical and asymmetrical
channels, respectively. Under the same experimental parameters, TP-TFQKD can
achieve significantly higher key rates and longer transmission distances than
PMQKD in both symmetric and asymmetric channels. At 400 km and $N={10}^{11}$,
the key rate of our protocol is 5.2 times that of PMQKD in the symmetric
channel and 14 times that of PMQKD in the asymmetric channel. Compared with
symmetric channels, TP-TFQKD has a greater advantage in key rates than PMQKD
under asymmetric channels.

We also compare the key rates of TP-TFQKD with NPPQKD and four-phase TFQKD in
the finite-key scenario in Fig. 5. The same parameters in the ultra-low-loss
fiber scenario of Ref. [57] are used along with data size $N=3.2\times
10^{14}$, detection efficiency $\eta_{d}=28\%$, dark count rate $p_{d}=3\times
10^{-11}$, and channel transmittance from Alice (Bob) to Charlie
$\eta_{a(b)}=10^{-0.16(l-10.7)/20}$. The misalignment error rate of NPPQKD and
four-phase TFQKD $e_{m}=2\%$, and the misalignment angle of TP-TFQKD is set to
$\sigma=5^{\circ}$, which contributes to an error rate of approximately $2\%$.
The security bounds are both $2^{-31}$. Our simulation results for the key
rates of NPPQKD and four-phase TFQKD are consistent with the simulation
results in Ref. [57]. Under these system parameters, the experimental
transmission distance of four-phase TFQKD achieves 833.80 km. The simulations
show that if using the same system parameters, TP-TFQKD has higher key rates
than NPPQKD and four-phase TFQKD, and the transmission distance of TP-TFQKD
can exceed 900 km. The key rate of TP-TFQKD is approximately $10$ times that
of NPPQKD when the fiber length is $800$ km. For an 830-km transmission
distance, the key rate of TP-TFQKD is $3.337\times 10^{-10}$ per quantum
pulse, which is approximately $11$ times that of four-phase TFQKD
($3.113\times 10^{-11}$).

###  IV.3 Comparison of three-intensity and four-intensity protocols

In this section, we discuss the performance of the TP-TFQKD protocol using the
decoy-state method with different intensities. The parameters used are listed
in Table 1. In the four-intensity decoy-state TP-TFQKD protocol, Alice chooses
random phase $\theta_{a}^{i}$ $\in[0,2\pi)$ and random classical bit
$r_{a}^{i}\in\\{0,1\\}$ at each time bin $i\in\\{1,2,\ldots,N\\}$. She then
prepares a weak coherent pulse
$\ket{e^{\textbf{i}(\theta_{a}^{i}+r_{a}^{i}\pi)}\sqrt{k_{a}^{i}}}$ with
probability $p_{k_{a}}$, where
$k_{a}^{i}\in\\{\mu_{a},\omega_{a},\nu_{a},\mathbf{o}_{a},\hat{\mathbf{o}}_{a}\\}$.
The intensities satisfy the relation
$\mu_{a}>\omega_{a}>\nu_{a}>\mathbf{o}_{a}=\hat{\mathbf{o}}_{a}=0$. Likewise,
Bob prepares a phase-randomized weak coherent pulse:
$\ket{e^{\textbf{i}(\theta_{b}^{i}+r_{b}^{i}\pi)}\sqrt{k_{b}^{i}}}$
($k_{b}^{i}\in\\{\mu_{b},\omega_{b},\nu_{a},\mathbf{o}_{b},\hat{\mathbf{o}}_{b}\\}$).
The events in the $Z$ basis consist of
$\\{\mu_{a}\mathbf{o}_{a},\mathbf{o}_{b}\mu_{b}\\}$,
$\\{\mu_{a}\mathbf{o}_{a},\mu_{b}\mathbf{o}_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},\mathbf{o}_{b}\mu_{b}\\}$, and
$\\{\mathbf{o}_{a}\mu_{a},\mu_{b}\mathbf{o}_{b}\\}$. The events in the $X$
basis are $\\{\nu_{a}^{i}\nu_{a}^{j},\nu_{b}^{i}\nu_{b}^{j}\\}$ that satisfy
$\theta^{i(j)}\in[-\delta,\delta]\cup[\pi-\delta,\pi+\delta]$. At the same
time, $\left|\theta^{i}-\theta^{j}\right|=0$ or $\pi$. Detection events
$\\{o_{a},\omega_{b}\\}$, $\\{\omega_{a},o_{b}\\}$,
$\\{\hat{\mathbf{o}}_{a},\mu_{b}\\}$, $\\{\mu_{a},\hat{\mathbf{o}}_{b}\\}$,
$\\{\hat{\mathbf{o}}_{a},o_{b}\\}$, and
$\\{\mathbf{o}_{a},\hat{\mathbf{o}}_{b}\\}$ will be used later for decoy
analysis. We compared the performance of the TP-TFQKD protocol using the
decoy-state method with different intensities.

Figure 6 shows comparison results of the key rates of the three- and four-
intensity decoy-state protocols. In Fig. 6(a), the key rates between our
protocol and AOPP are compared with four-intensity and three-intensity decoy-
state methods under $N=10^{11}$.
$\Delta=(R^{\rm{four}}-R^{\rm{three}})/R^{\rm{four}}$ is used to represent the
relative difference between the key rate of the four-intensity decoy-state
protocol, $R^{\rm{four}}$, and the key rate of the three-intensity decoy-state
protocol, $R^{\rm{three}}$. The results indicate that at relatively short
distances, no obvious increase in key rate is observed when using more decoy
intensities. Interestingly, the three-intensity protocol could provide higher
key rates than the four-intensity protocol at long distances. In Fig. 6(b), we
compare the key rates between our protocol and AOPP with four-intensity and
three-intensity decoy-state methods when the intensities of the weak decoy
states, $\nu_{b}$, of both protocols deviate under $N=10^{13}$. Figure 6(b)
reveals that the gap between three-intensity decoy-state protocols and four-
intensity decoy-state protocols is also small in the presence of a deviation
in the modulated intensity. Hence, practical implementations of TP-TFQKD or
AOPP using three intensities can be convenient and efficient.

##  V Conclusion

In summary, we provided a two-photon (TP) TFQKD protocol through time
multiplexing that can break the secret key capacity with the same experimental
requirements as other TFQKD protocols. In addition, we quantified the security
of the SNS-TFQKD protocol without satisfying constraints regarding intensity
and probability by transforming the imperfect modulation into an information
leakage problem. Compared with SNS-TFQKD (AOPP), which can theoretically
transmit the farthest distance at present, our protocol achieves a longer
transmission distance in the presence of deviations in modulating intensity.
In a scalable network with a large number of users, our protocol compares
favorably with SNS-TFQKD (AOPP) because it is unaffected by the addition or
deletion of users and has an order of magnitude higher key rate than PMQKD.
Furthermore, we studied the performance of TP-TFQKD and SNS-TFQKD (AOPP) using
the decoy-state method with different intensities. The results show that the
three-intensity protocol of both TP-TFQKD and SNS-TFQKD (AOPP) achieve a good
trade-off between technical complexity and performance.

In contrast to the phase-matching-type QKD protocol, TP-TFQKD can further
improve the key rate by harnessing single-photon sources or other nonclassical
light sources because the non-interference mode is used for key generation.
Our protocol has important practical advantages: high misalignment error
tolerance, long transmission distance, and independent setting of probability
and intensity for each user. Thus, our protocol is highly versatile and
suitable for most metropolitan networks. The post-matched two-photon
interference performed in our scheme can also apply to other quantum
information processing, such as quantum conference key agreement, quantum
secret sharing, and quantum digital signatures.

Note added–During the time our work was posted on the preprint server, we
notice that Ref. [91] also solve the problem for the SNS-TFQKD protocol where
source errors are unavoidable. Additionally, two different research studies
exploiting post-matching ideas to make MDIQKD break the repeaterless rate-
transmittance bound have been reported [24, 25]. In this work, we propose a
post-matching TF-type protocol tailored for scalable TFQKD networks and show
that it is secure against coherent attacks in the finite-key regime. Although
our post-matching ideas are similar to these recently published works, there
are differences in the density matrix of single-photon pairs and security in
the protocols.

## Acknowledgement

We gratefully acknowledge the support from the National Natural Science
Foundation of China (No. 12274223), the Natural Science Foundation of Jiangsu
Province (No. BK20211145), the Fundamental Research Funds for the Central
Universities (No. 020414380182), the Key Research and Development Program of
Nanjing Jiangbei New Area (No. ZDYD20210101), the Program for Innovative
Talents and Entrepreneurs in Jiangsu (JSSCRC2021484), the Program of Song Shan
Laboratory (Included in the management of Major Science and Technology Program
of Henan Province) (No. 221100210800-02), and the China Postdoctoral Science
Foundation (No. 2021M691536).

##  Appendix A Security analysis for TP-TFQKD protocol

For our practical protocol, the normalized density matrix of the joint quantum
state with a single-photon pair in the $Z$ basis is

$\displaystyle\boldsymbol{\rho}_{z}^{11}$
$\displaystyle=\frac{1}{2}\left(\ket{+z-z}_{ab}\bra{+z-z}+\ket{-z+z}_{ab}\bra{-z+z}\right)$
(5)
$\displaystyle=\frac{1}{2}\left(\ket{10}_{a}^{ij}\bra{10}\otimes\ket{01}_{b}^{ij}\bra{01}+\ket{01}_{a}^{ij}\bra{01}\otimes\ket{10}_{b}^{ij}\bra{10}\right)$
$\displaystyle=\frac{1}{2}\left(\ket{10}_{ab}^{i}\bra{10}\otimes\ket{01}_{ab}^{j}\bra{01}+\ket{01}_{ab}^{i}\bra{01}\otimes\ket{10}_{ab}^{j}\bra{10}\right).$

This requires Alice to prepare $\ket{0}$ at one time bin and $\ket{1}$ at the
other time bin, whereas Bob does the opposite. We consider this “effective,”
which will be used later. Note that the measurement outcomes of quantum states
$\ket{10}_{a}^{ij}\ket{10}_{b}^{ij}$ and $\ket{01}_{a}^{ij}\ket{01}_{b}^{ij}$
are not “effective” events.

After matching time bin $i$, where the global phases of Alice and Bob are both
$\kappa$, with time bin $j$, where the global phases of Alice and Bob are both
$\varphi$, the four-mode coherent state in the $X$ basis can be written as
$\ket{\Psi}=\ket{e^{i(\kappa+r_{a}^{i}\pi)}\alpha_{a}}_{a}^{i}\otimes\ket{e^{i(\varphi+r_{a}^{j}\pi)}\alpha_{a}}_{a}^{j}\otimes\ket{e^{i(\kappa+r_{b}^{i}\pi)}\alpha_{b}}_{b}^{i}\otimes\ket{e^{i(\varphi+r_{b}^{j}\pi)}\alpha_{b}}_{b}^{j}$.
The security will not be affected when the global phases of Alice and Bob do
not satisfy the specific correlation because the global phase noise difference
is determined by an untrusted Charlie. To reduce the interference error, it is
preferable to satisfy the phase correlation. Given that the values of $\kappa$
and $\varphi$ are both randomized, the density matrix of the four-mode joint
quantum state in the $X$ basis can be written as

$\displaystyle\hat{\rho}_{r_{a}^{i}r_{b}^{i}r_{a}^{j}r_{b}^{j}}$
$\displaystyle=\frac{1}{(2\pi)^{2}}\int_{0}^{2\pi}\int_{0}^{2\pi}\ket{\Psi}\bra{\Psi}d\kappa
d\varphi$ (6)
$\displaystyle=e^{-2(\nu_{a}+\nu_{b})}\left(\sum_{n=0}^{\infty}\sum_{m=0}^{\infty}\frac{(\nu_{a}+\nu_{b})^{n+m}}{n!m!}\ket{n}_{ab}^{i}\bra{n}\otimes\ket{m}_{ab}^{j}\bra{m}\right),$

where $\nu_{a}=|\alpha_{a}|^{2}$, $\nu_{b}=|\alpha_{b}|^{2}$ and Fock states

$\displaystyle\ket{n}_{ab}^{i}$
$\displaystyle=\frac{\left(\sqrt{\nu_{a}}a_{i}^{\dagger}+e^{i(r_{b}^{i}-r_{a}^{i})\pi}\sqrt{\nu_{b}}b_{i}^{\dagger}\right)^{n}}{\sqrt{(\nu_{a}+\nu_{b})^{n}n!}}\ket{00}_{ab}^{i},$
(7) $\displaystyle\ket{m}_{ab}^{j}$
$\displaystyle=\frac{\left(\sqrt{\nu_{a}}a_{j}^{\dagger}+e^{i(r_{b}^{j}-r_{a}^{j})\pi}\sqrt{\nu_{b}}b_{j}^{\dagger}\right)^{m}}{\sqrt{(\nu_{a}+\nu_{b})^{m}m!}}\ket{00}_{ab}^{j}.$

The corresponding single-photon pair component is

$\displaystyle\hat{\rho}_{r_{a}^{i}r_{b}^{i}r_{a}^{j}r_{b}^{j}}^{11}$
$\displaystyle=\ket{1}_{ab}^{i}\bra{1}\otimes\ket{1}_{ab}^{j}\bra{1}$ (8)
$\displaystyle=\frac{\sqrt{\nu_{a}}\ket{10}_{ab}^{i}+e^{i(r_{b}^{i}-r_{a}^{i})\pi}\sqrt{\nu_{b}}\ket{01}_{ab}^{i}}{\sqrt{\nu_{a}+\nu_{b}}}\frac{\sqrt{\nu_{a}}\bra{10}_{ab}^{i}+e^{-i(r_{b}^{i}-r_{a}^{i})\pi}\sqrt{\nu_{b}}\bra{01}_{ab}^{i}}{\sqrt{\nu_{a}+\nu_{b}}}$
$\displaystyle\otimes\frac{\sqrt{\nu_{a}}\ket{10}_{ab}^{j}+e^{i(r_{b}^{j}-r_{a}^{j})\pi}\sqrt{\nu_{b}}\ket{01}_{ab}^{j}}{\sqrt{\nu_{a}+\nu_{b}}}\frac{\sqrt{\nu_{a}}\bra{10}_{ab}^{j}+e^{-i(r_{b}^{j}-r_{a}^{j})\pi}\sqrt{\nu_{b}}\bra{01}_{ab}^{j}}{\sqrt{\nu_{a}+\nu_{b}}}.$

Hence, the density matrix of the joint quantum state with a single-photon pair
in the $X$ basis is

$\displaystyle\hat{\rho}^{11}_{x}=$
$\displaystyle\frac{1}{16}\big{(}\rho_{0000}^{11}+\rho_{0011}^{11}+\rho_{0101}^{11}+\rho_{0110}^{11}+\rho_{1001}^{11}+\rho_{1010}^{11}+\rho_{1100}^{11}+\rho_{1111}^{11}$
(9)
$\displaystyle\qquad+\rho_{0001}^{11}+\rho_{0010}^{11}+\rho_{0100}^{11}+\rho_{0111}^{11}+\rho_{1000}^{11}+\rho_{1011}^{11}+\rho_{1101}^{11}+\rho_{1110}^{11}\big{)}$
$\displaystyle=$
$\displaystyle\frac{2\nu_{a}\nu_{b}}{(\nu_{a}+\nu_{b})^{2}}\frac{(\ket{\psi^{+}}_{ab}\bra{\psi^{+}}+\ket{\psi^{-}}_{ab}\bra{\psi^{-}})}{2}+\frac{\nu_{a}^{2}+\nu_{b}^{2}}{(\nu_{a}+\nu_{b})^{2}}\frac{(\ket{\chi^{+}}_{ab}\bra{\chi^{+}}+\ket{\chi^{-}}_{ab}\bra{\chi^{-}})}{2},$

where
$\ket{\psi^{\pm}}_{ab}=(\ket{10}_{ab}^{i}\ket{01}_{ab}^{j}\pm\ket{01}_{ab}^{i}\ket{10}_{ab}^{j})/\sqrt{2}$
and
$\ket{\chi^{\pm}}_{ab}=(\nu_{a}\ket{10}_{ab}^{i}\ket{10}_{ab}^{j}\pm\nu_{b}\ket{01}_{ab}^{i}\ket{01}_{ab}^{j})/\sqrt{\nu_{a}^{2}+\nu_{b}^{2}}$.
We define
$\boldsymbol{\rho}_{x}^{11}:=(\ket{\psi^{+}}_{ab}\bra{\psi^{+}}+\ket{\psi^{-}}_{ab}\bra{\psi^{-}})/2$
and
$\tilde{\boldsymbol{\rho}}_{x}^{11}:=(\ket{\chi^{+}}_{ab}\bra{\chi^{+}}+\ket{\chi^{-}}_{ab}\bra{\chi^{-}})/2$
as density matrices of “effective” and “ineffective” single-photon pairs in
the X basis, respectively. The single-photon pair component in the $X$ basis
can be regarded as a classical mixture of “effective” single-photon pairs and
“ineffective” single-photon pairs:

$\displaystyle\hat{\rho}^{11}_{x}=$
$\displaystyle\frac{2\nu_{a}\nu_{b}}{(\nu_{a}+\nu_{b})^{2}}\boldsymbol{\rho}_{x}^{11}+\frac{\nu_{a}^{2}+\nu_{b}^{2}}{(\nu_{a}+\nu_{b})^{2}}\tilde{\boldsymbol{\rho}}_{x}^{11}.$
(10)

Note that the “effective” single-photon pairs in the $X$ and $Z$ bases have
the same density matrices:

$\displaystyle\boldsymbol{\rho}_{x}^{11}=\boldsymbol{\rho}_{z}^{11}$
$\displaystyle=\frac{1}{2}\left(\ket{\psi^{+}}_{ab}\bra{\psi^{+}}+\ket{\psi^{-}}_{ab}\bra{\psi^{-}}\right)$
(11)
$\displaystyle=\frac{1}{2}\left(\ket{10}_{ab}^{i}\bra{10}\otimes\ket{01}_{ab}^{j}\bra{01}+\ket{01}_{ab}^{i}\bra{01}\otimes\ket{10}_{ab}^{j}\bra{10}\right).$

Therefore, the bit error rate of “effective” single-photon pairs in the $X$
basis, ${e}_{11}^{x}$, is asymptotically equal to the phase error rate of
“effective” single-photon pairs in the $Z$ basis, $\phi_{11}^{z}$. Combining
Eqs. (6) and (10), we obtain that the four-mode joint quantum state sent by
Alice and Bob collapses to“effective” single-photon pairs with probability
$2\nu_{a}\nu_{b}e^{-2(\nu_{a}+\nu_{b})}$; the vacuum state at the previous
time bin (this case is denoted as $\mathcal{V}_{i}$) with probability
$e^{-(\nu_{a}+\nu_{b})}$; the vacuum state at the latter time bin (denoted as
$\mathcal{V}_{j}$) with probability $e^{-(\nu_{a}+\nu_{b})}$; and the vacuum
states at both time bins (denoted as $\mathcal{V}_{ij}$) with probability
$e^{-2(\nu_{a}+\nu_{b})}$. The error in the $X$ basis comes from four parts:
the vacuum state, the “effective” single-photon pair, the “ineffective”
single-photon pair, and the multi-photon pair. Denoting the bit error rate in
the $X$ basis as $E^{x}$ and using the fact that the error rate of the vacuum
state is always $1/2$, we can estimate the upper bound for the error rate of
“effective” single-photon pairs in the $X$ basis by

$\displaystyle e_{11}^{x}\leq$
$\displaystyle\frac{E^{x}-1/2e^{-(\nu_{a}+\nu_{b})}(q_{0\nu_{a},0\nu_{b}}+q_{\nu_{a}0,\nu_{b}0})+1/2e^{-2(\nu_{a}+\nu_{b})}q_{00,00}}{2\nu_{a}\nu_{b}e^{-2(\nu_{a}+\nu_{b})}Y_{11}^{x}},$
(12)

where $Y_{11}^{x}$ is the yield of “effective” single-photon pairs in the $X$
basis, $q_{0\nu_{a},0\nu_{b}}\leavevmode\nobreak\ (q_{\nu_{a}0,\nu_{b}0})$ is
the yield of $\mathcal{V}_{i}\leavevmode\nobreak\ (\mathcal{V}_{j})$, and
$q_{00,00}$ is the yield of $\mathcal{V}_{ij}$. Note that $\mathcal{V}_{ij}$
is the subset of $\mathcal{V}_{i}$ and $\mathcal{V}_{j}$. The error rate
caused by $\mathcal{V}_{ij}$ is subtracted twice in the term
$1/2e^{-(\nu_{a}+\nu_{b})}(q_{0\nu_{a},0\nu_{b}}+q_{\nu_{a}0,\nu_{b}0})$, for
which the term $1/2e^{-2(\nu_{a}+\nu_{b})}q_{00,00}$ is added to the numerator
as compensation. The detailed calculation of the bit error rate in the $X$
basis and the phase error rate in the $Z$ basis using the decoy-state method
is given in Appendix C.1.

As shown by Eqs. (10)–(11), similar to MDIQKD, the density matrices of the
“effective” single-photon pairs are always identical in the $X$ and $Z$ bases
regardless of the source parameters independently chosen by Alice and Bob.
Hence, virtual protocol of entanglement swapping and purification always
holds. On the other hand, different from MDIQKD, the bit error rate of
“effective” single-photon pairs in the $Z$ basis of our protocol is strictly
zero.

##  Appendix B Security analysis for SNS-TFQKD protocol

Under the SNS-TFQKD protocol [43, 49], when Alice (Bob) chooses the
$Z$-window, she (he) prepares and sends the phase-randomized coherent state
$\ket{\sqrt{\mu_{a}}}\leavevmode\nobreak\ (\ket{\sqrt{\mu_{b}}})$ with
probability $t_{a}\leavevmode\nobreak\ (t_{b})$ or sends a vacuum pulse with
probability $1-t_{a}\leavevmode\nobreak\ (1-t_{b})$. The corresponding density
matrix of the joint single-photon states in the $Z$ basis is

$\displaystyle\rho^{1}_{z}=$ $\displaystyle
C[t_{a}(1-t_{b})\mu_{a}e^{-\mu_{a}}\ket{10}_{ab}\bra{10}$ (13)
$\displaystyle+$ $\displaystyle
t_{b}(1-t_{a})\mu_{b}e^{-\mu_{b}}\ket{01}_{ab}\bra{01}],$

where
$C=1/[t_{a}(1-t_{b})\mu_{a}e^{-\mu_{a}}+t_{b}(1-t_{a})\mu_{b}e^{-\mu_{b}}]$ is
the normalization factor. When Alice (Bob) chooses the $X$ window, she (he)
prepares and sends phase-randomized coherent state
$\ket{\sqrt{\nu_{a}}}\leavevmode\nobreak\ (\ket{\sqrt{\nu_{b}}})$. After
implementing post-selected phase matching, the density matrix of the joint
one-photon states in the $X$ basis is

$\displaystyle\rho^{1}_{x}=$
$\displaystyle\frac{1}{\nu_{a}+\nu_{b}}[\nu_{a}\ket{10}_{ab}\bra{10}+\nu_{b}\ket{01}_{ab}\bra{01}].$
(14)

As a result, one requests the following mathematical constraint for source
parameters [49]

$\displaystyle\frac{\nu_{a}}{\nu_{b}}=$
$\displaystyle\frac{t_{a}(1-t_{b})\mu_{a}e^{-\mu_{a}}}{t_{b}(1-t_{a})\mu_{b}e^{-\mu_{b}}}$
(15)

to satisfy the relation $\rho^{1}=\rho^{1}_{x}=\rho^{1}_{z}$ so that one can
use the bit error rate in the $X$ basis to estimate the phase error rate in
the $Z$ basis. Note that one always needs to satisfy Eq. (15), even for
symmetric channels [43].

However, Eq. (15) is not usually satisfied in a multiuser quantum network. In
this case, to provide a secure key rate, we introduce the imbalance of the
quantum coin $\Delta$, defined as [82, 83]

$\displaystyle\Delta$
$\displaystyle=\frac{1}{2Q_{1}}[1-F(\rho_{x}^{1},\rho_{z}^{1})],$ (16)

where
$Q_{1}=C[t_{a}(1$$-$$t_{b})\mu_{a}e^{-\mu_{a}}y_{10}+t_{b}(1-t_{a})\mu_{b}e^{-\mu_{b}}y_{01}]$
is the yield of single photons in the $Z$ basis and $\rho_{x}^{1}$
($\rho_{z}^{1}$) is the joint density matrix of single-photon states in the
$X$ ($Z$) basis prepared by Alice and Bob. $F(\rho_{x},\rho_{z})={\rm
tr}\sqrt{\rho_{x}^{1/2}\rho_{z}\rho_{x}^{1/2}}$ is the fidelity between
density matrices $\rho_{x}$ and $\rho_{z}$. With the relationship
$1-2\Delta\leq\sqrt{(1-e_{1}^{x*})(1-e_{\rm ph}^{z*})}+\sqrt{e_{1}^{x*}e_{\rm
ph}^{z*}}$, the upper bound of the expected value of the phase error rate in
the $Z$ basis $e_{\rm ph}^{z*}$ [82] can be expressed as

$\displaystyle\overline{e}_{\rm ph}^{z*}\leq$
$\displaystyle\left[(1-2\Delta)\sqrt{e_{1}^{x*}}+2\sqrt{\Delta(1-\Delta)(1-e_{1}^{x*})}\right]^{2}$
(17) $\displaystyle\leq$ $\displaystyle
e_{1}^{x*}+4{\Delta}+4\sqrt{{\Delta}{e}_{1}^{x*}},$

where $e_{1}^{x*}$ is the expected value of the bit error rate in the $X$
basis. From Eq. (16) and Eq. (17), we can see that $\Delta$ increases
dramatically as distance increases, leading to extremely poor estimation of
the phase error rate $\overline{e}_{\rm ph}^{z}$.

##  Appendix C Detailed calculation of TP-TFQKD protocol

###  C.1 Calculation methods

In this section, we calculate the parameters in Eq. (1) to estimate the secret
key rate in the finite-size regime. We apply the variant of the Chernoff bound
to obtain the upper and lower bounds of expected value $x^{*}$ for a given
observed value $x$ and failure probability $\varepsilon$ [90]:

$\displaystyle\overline{x}^{*}$ $\displaystyle=x+\beta+\sqrt{2\beta
x+\beta^{2}}$ (18) $\displaystyle\underline{x}^{*}$
$\displaystyle=\max\left\\{x-\frac{\beta}{2}-\sqrt{2\beta
x+\frac{\beta^{2}}{4}},\leavevmode\nobreak\ 0\right\\},$

where $\beta=\ln{\varepsilon^{-1}}$. We use the Chernoff bound to obtain the
upper and lower bounds of observed value $x$ for a given expected value
$x^{*}$ and failure probability $\varepsilon$ [90]:

$\displaystyle\overline{x}$ $\displaystyle=x^{*}+\frac{\beta}{2}+\sqrt{2\beta
x^{*}+\frac{\beta^{2}}{4}}$ (19) $\displaystyle\underline{x}$
$\displaystyle=x^{*}-\sqrt{2\beta x^{*}}.$

We denote the number of $\\{k_{a},\leavevmode\nobreak\ k_{b}\\}$ as
$x_{k_{a}k_{b}}$. We denote the number and error number of events
$\\{k_{a}^{i}k_{a}^{j},\leavevmode\nobreak\ k_{b}^{i}k_{b}^{j}\\}$ after post-
matching as $n_{k_{a}^{i}k_{a}^{j},\leavevmode\nobreak\ k_{b}^{i}k_{b}^{j}}$
and $m_{k_{a}^{i}k_{a}^{j},\leavevmode\nobreak\ k_{b}^{i}k_{b}^{j}}$,
respectively. For simplicity, we abbreviate
$k_{a}^{i}k_{a}^{j},k_{a}^{i}k_{a}^{j}$ as $2k_{a},2k_{b}$ when
$k_{a}^{i}=k_{a}^{j}$ and $k_{b}^{i}=k_{b}^{j}$.

(1) $\underline{s}_{11}^{z}$. $s_{11}^{z}$ corresponds to the number of
successful detection events, where Alice and Bob emit a single photon in
different time bins in the $Z$ basis. Define $y_{10}$ ($y_{01}$) as the yield
of events in which Alice (Bob) emits a single photon and Bob (Alice) emits a
vacuum state in an $\\{\mu_{a},\mathbf{o}_{b}\\}$
($\\{\mathbf{o}_{a},\mu_{b}\\}$) event. The lower bounds of their expected
values can be estimated using the decoy-state method:

$\displaystyle\underline{y}_{01}^{*}\geq$
$\displaystyle\frac{\mu_{b}}{N(\mu_{b}\nu_{b}-\nu_{b}^{2})}\times$ (20)
$\displaystyle\left(\frac{e^{\nu_{b}}\underline{x}_{o_{a}\nu_{b}}^{*}}{p_{o_{a}}p_{\nu_{b}}}-\frac{\nu_{b}^{2}}{\mu_{b}^{2}}\frac{e^{\mu_{b}}\overline{x}_{\hat{\mathbf{o}}_{a}\mu_{b}}^{*}}{p_{\hat{\mathbf{o}}_{a}}p_{\mu_{b}}}-\frac{\mu_{b}^{2}-\nu_{b}^{2}}{\mu_{b}^{2}}\frac{\overline{x}_{oo}^{d*}}{p_{oo}^{d}}\right),$
$\displaystyle\underline{y}_{10}^{*}\geq$
$\displaystyle\frac{\mu_{a}}{N(\mu_{a}\nu_{a}-\nu_{a}^{2})}\times$ (21)
$\displaystyle\left(\frac{e^{\nu_{a}}\underline{x}_{\nu_{a}o_{b}}^{*}}{p_{\nu_{a}}p_{o_{b}}}-\frac{\nu_{a}^{2}}{\mu_{a}^{2}}\frac{e^{\mu_{a}}\overline{x}_{\mu_{a}\hat{\mathbf{o}}_{b}}^{*}}{p_{\mu_{a}}p_{\hat{\mathbf{o}}_{b}}}-\frac{\mu_{a}^{2}-\nu_{a}^{2}}{\mu_{a}^{2}}\frac{\overline{x}_{oo}^{d*}}{p_{oo}^{d}}\right),$

where
$x_{oo}^{d}=x_{\hat{\mathbf{o}}_{a}\hat{\mathbf{o}}_{b}}+x_{\hat{\mathbf{o}}_{a}\mathbf{o}_{b}}+x_{\mathbf{o}_{a}\hat{\mathbf{o}}_{b}}$
represents the number of events where at least one user chooses the declare-
vacuum state and
$p_{oo}^{d}=p_{\hat{\mathbf{o}}_{a}}p_{\hat{\mathbf{o}}_{b}}+p_{\hat{\mathbf{o}}_{a}}p_{\mathbf{o}_{b}}+p_{\mathbf{o}_{a}}p_{\hat{\mathbf{o}}_{b}}$
refers to the corresponding probability. Let $z_{10}$ ($z_{01}$) denotes the
number of events in which Alice (Bob) emits a single photon and Bob (Alice)
emits a vacuum state in an $\\{\mu_{a},\mathbf{o}_{b}\\}$
($\\{\mathbf{o}_{a},\mu_{b}\\}$) event. The lower bounds of their expected
values are
$\underline{z}_{10}^{*}=Np_{\mu_{a}}p_{\mathbf{o}_{b}}\mu_{a}e^{-\mu_{a}}\underline{y^{*}_{10}}$
and
$\underline{z}^{*}_{01}=Np_{\mathbf{o}_{a}}p_{\mu_{b}}\mu_{b}e^{-\mu_{b}}\underline{y^{*}_{01}}$,
respectively. Thus, the expected lower bound of the “effective” single-photon
pairs in the $Z$ basis is given by

$\displaystyle\underline{s}_{11}^{z*}$ $\displaystyle=x_{\rm
min}\frac{\underline{z}_{01}^{*}}{x_{\mathbf{o}_{a}\mathbf{o}_{b}}+x_{\mathbf{o}_{a}\mu_{b}}}\frac{\underline{z}_{10}^{*}}{x_{\mu_{a}\mathbf{o}_{b}}+x_{\mu_{a}\mu_{b}}}$
(22) $\displaystyle=\frac{\underline{z}_{01}^{*}\underline{z}_{10}^{*}}{x_{\rm
max}}$

where
$x_{\min}=\min\\{x_{\mathbf{o}_{a}\mathbf{o}_{b}}+x_{\mathbf{o}_{a}\mu_{b}},x_{\mu_{a}\mathbf{o}_{b}}+x_{\mu_{a}\mu_{b}}\\}$
and
$x_{\max}=\max\\{x_{\mathbf{o}_{a}\mathbf{o}_{b}}+x_{\mathbf{o}_{a}\mu_{b}},x_{\mu_{a}\mathbf{o}_{b}}+x_{\mu_{a}\mu_{b}}\\}$.

(2) $\underline{s}_{0\mu_{b}}^{z}$. $s_{0\mu_{b}}^{z}$ represents the number
of events in the $Z$ basis when Alice emits a zero-photon state in the two
matched time bins and the total intensity of Bob’s pulses is $\mu_{b}$. Let
$z_{00}$ ($z_{0\mu_{b}}$) represents the number of detection events where the
state sent by Alice collapses to the vacuum state in the
$\\{\mu_{a},\mathbf{o}_{b}\\}$ ($\\{\mu_{a},\mu_{b}\\}$) event. The lower
bound of the expected values is
$\underline{z}_{00}^{*}={p_{\mu_{a}}p_{\mathbf{o}_{b}}e^{-\mu_{a}}\underline{x}_{oo}^{d*}}/{p_{o_{a}o_{b}}^{d}}$
and $\leavevmode\nobreak\
\underline{z}_{0\mu_{b}}^{*}={p_{\mu_{a}}p_{\mu_{b}}e^{-\mu_{a}}\underline{x}_{\mathbf{o}_{a}\mu_{b}}^{*}}/{p_{\mathbf{o}_{a}}p_{\mu_{b}}}$,
respectively. Here, we utilize the relationship between the expected value
$\underline{x}_{\mathbf{o}_{a}\mu_{b}}^{*}={p_{\mathbf{o}_{a}}\underline{x}_{\hat{\mathbf{o}}_{a}\mu_{b}}^{*}}/{p_{\hat{\mathbf{o}}_{a}}}$,
and $\leavevmode\nobreak\
\underline{x}_{\mathbf{o}_{a}\mathbf{o}_{b}}^{*}={p_{\mathbf{o}_{a}}p_{\mathbf{o}_{b}}\underline{x}_{oo}^{d*}}/{p_{oo}^{d}}$.
The lower bound of $s_{0\mu_{b}}^{z*}$ can be written as

$\displaystyle\underline{s}_{0\mu_{b}}^{z*}=$ $\displaystyle x_{\rm
min}\frac{\underline{x}_{\mathbf{o}_{a}\mu_{b}}^{*}}{x_{\mathbf{o}_{a}\mathbf{o}_{b}}+x_{\mathbf{o}_{a}\mu_{b}}}\frac{\underline{z}_{00}^{*}}{x_{\mu_{a}\mathbf{o}_{b}}+x_{\mu_{a}\mu_{b}}}$
(23) $\displaystyle+$ $\displaystyle x_{\rm
min}\frac{x_{\mathbf{o}_{a}\mathbf{o}_{b}}^{*}}{\underline{x}_{\mathbf{o}_{a}\mathbf{o}_{b}}+x_{\mathbf{o}_{a}\mu_{b}}}\frac{\underline{z}_{0\mu_{b}}^{*}}{x_{\mu_{a}\mathbf{o}_{b}}+x_{\mu_{a}\mu_{b}}}$
$\displaystyle=$
$\displaystyle\frac{\underline{x}_{\mathbf{o}_{a}\mu_{b}}^{*}\underline{z}_{00}^{*}+x_{\mathbf{o}_{a}\mathbf{o}_{b}}^{*}\underline{z}_{0\mu_{b}}^{*}}{x_{\rm
max}}.$

(3) $\underline{s}_{11}^{x}$. We define the global phase difference between
Alice and Bob as $\theta=\theta_{a}-\theta_{b}+\phi_{ab}$. All events in the
$X$ basis can be grouped according to phase difference
$\theta\leavevmode\nobreak\
(\in\\{-\delta,\delta\\}\cup\\{\pi-\delta,\pi+\delta\\})$. In the post-
matching step, two time bins are matched if they have the same global phase
difference, $\theta$. Suppose $\theta$ is a randomly and uniformly distributed
value and consider the angle of misalignment in the $X$ basis, $\sigma$, the
expected lower bound of the “effective” single-photon pairs in the $X$ basis
can then be given by

$\displaystyle\underline{s}_{11}^{x*}$
$\displaystyle=4\int_{\sigma}^{\sigma+\delta}\frac{Np_{\nu_{a}}p_{\nu_{b}}q_{\nu_{a}\nu_{b}}^{\theta}}{4\pi}\times\frac{2\nu_{a}\nu_{b}e^{-2(\nu_{a}+\nu_{b})}\underline{Y}_{11}^{x*}}{(q_{\nu_{a}\nu_{b}}^{\theta})^{2}}d\theta$
(24)
$\displaystyle=\frac{2Np_{\nu_{a}}p_{\nu_{b}}\nu_{a}\nu_{b}e^{-2(\nu_{a}+\nu_{b})}\underline{y}_{01}^{*}\underline{y}_{10}^{*}}{\pi}\int_{\sigma}^{\sigma+\delta}\frac{1}{q_{\nu_{a}\nu_{b}}^{\theta}}d\theta,$

where $q_{\nu_{a}\nu_{b}}^{\theta}$ is the gain when Alice chooses $\nu_{a}$
and Bob chooses $\nu_{b}$ with phase difference $\theta$. In the second
equation, we use the relationship implied in Eq. (11):
$Y_{11}^{x*}=Y_{11}^{z*}=y_{01}^{*}y_{10}^{*}$, where $Y_{11}^{z*}$ is the
expected yield of the “effective” single-photon pairs in the $Z$ basis.

(4) $\overline{e}_{11}^{x}$. For “effective” single-photon pairs, the expected
value of the phase error rate in the $Z$ basis is equal to the expected value
of the bit error rate in the $X$ basis. Therefore, we first calculate the
number of errors of the “effective” single-photon pairs in the $X$ basis
${t_{11}^{x}}$. The upper bound of ${t_{11}^{x}}$ can be expressed as

$\displaystyle\overline{t}_{11}^{x}\leq$ $\displaystyle
m^{x}-\underline{(m_{\nu_{a}0,\nu_{b}0}+m_{0\nu_{a},0\nu_{b}})}+\overline{m}_{00,00},$
(25)

where $m_{\nu_{a}0,\nu_{b}0}$ ($m_{0\nu_{a},0\nu_{b}}$) is the error count
when the states sent by Alice and Bob in time bin $i$ ($j$) both collapse to
the vacuum state in events $\\{2\nu_{a},2\nu_{b}\\}$, and $m_{00,00}$
corresponds to the event where the states sent by Alice and Bob both collapse
to vacuum states in events $\\{2\nu_{a},2\nu_{b}\\}$. The expected counts
$\underline{(n_{\nu_{a}0,\nu_{b}0}+n_{0\nu_{a},0\nu_{b}})}^{*}$ and
$\overline{n}_{00,00}^{*}$ can be expressed as

$\displaystyle\underline{(n_{\nu_{a}0,\nu_{b}0}+n_{0\nu_{a},0\nu_{b}})}^{*}$
(26) $\displaystyle=$ $\displaystyle
4\int_{\sigma}^{\sigma+\delta}\frac{Np_{\nu_{a}}p_{\nu_{b}}q_{\nu_{a}\nu_{b}}^{\theta}}{4\pi}\times\frac{e^{-(\nu_{a}+\nu_{b})}(\underline{q}_{0\nu_{a},0\nu_{b}}^{\theta*}+\underline{q}_{\nu_{a}0,\nu_{b}0}^{\theta*})}{(q_{\nu_{a}\nu_{b}}^{\theta})^{2}}d\theta$
$\displaystyle=$ $\displaystyle\frac{2\delta
Np_{\nu_{a}}p_{\nu_{b}}e^{-(\nu_{a}+\nu_{b})}\underline{q}_{00}^{*}}{\pi}$

and

$\displaystyle\overline{n}_{00,00}^{*}=$ $\displaystyle
4\int_{\sigma}^{\sigma+\delta}\frac{Np_{\nu_{a}}p_{\nu_{b}}q_{\nu_{a}\nu_{b}}^{\theta}}{4\pi}\times\frac{e^{-2(\nu_{a}+\nu_{b})}\overline{q}_{00,00}^{*}}{(q_{\nu_{a}\nu_{b}}^{\theta})^{2}}d\theta$
(27) $\displaystyle=$
$\displaystyle\frac{Np_{\nu_{a}}p_{\nu_{b}}e^{-2(\nu_{a}+\nu_{b})}(\overline{q}_{00}^{*})^{2}}{\pi}\int_{\sigma}^{\sigma+\delta}\frac{1}{q_{\nu_{a}\nu_{b}}^{\theta}}d\theta$

respectively, where we use the relationships
$q_{0\nu_{a},0\nu_{b}}^{\theta*}=q_{\nu_{a}0,\nu_{b}0}^{\theta*}=q_{00}^{*}q_{\nu_{a}\nu_{b}}^{\theta}$,
$q_{00,00}^{*}=(q_{00}^{*})^{2}$, and
$q_{00}^{*}=x_{o_{a}o_{b}}^{d*}/(Np_{oo}^{d})$. Then, we have
$\underline{(m_{\nu_{a}0,\nu_{b}0}+m_{0\nu_{a},0\nu_{b}})}^{*}=\frac{1}{2}\underline{(n_{\nu_{a}0,\nu_{b}0}+n_{0\nu_{a},0\nu_{b}})}^{*}$
and $\overline{m}_{00,00}^{*}=\frac{1}{2}\overline{n}_{00,00}^{*}$ since the
error rate of the vacuum state is always $1/2$. The upper bound of the bit
error rate in the $X$ basis can be given by
$\overline{e}_{11}^{x}=\overline{t_{11}^{x}}/\underline{s}_{11}^{x}$.

(5) $\overline{\phi}_{11}^{z}$. Finally, for failure probability $\epsilon$,
the upper bound of the phase error rate, $\phi_{11}^{z}$, can be obtained
using random sampling without replacement [90]:

$\displaystyle\overline{\phi}_{11}^{z}\leq$
$\displaystyle\overline{e}_{11}^{x}+\gamma^{U}\left(\underline{s}_{11}^{z},\underline{s}_{11}^{x},\overline{e}_{11}^{x},\epsilon\right),$
(28)

where

$\gamma^{U}(n,k,\lambda,\epsilon)=\frac{\frac{(1-2\lambda)AG}{n+k}+\sqrt{\frac{A^{2}G^{2}}{(n+k)^{2}}+4\lambda(1-\lambda)G}}{2+2\frac{A^{2}G}{(n+k)^{2}}},$
(29)

with $A=\max\\{n,k\\}$ and $G=\frac{n+k}{nk}\ln{\frac{n+k}{2\pi
nk\lambda(1-\lambda)\epsilon^{2}}}$.

For calculation of the asymptotic key rate, we just need to let the expected
value be equal to the observed value and let the phase error rate in the $Z$
basis be equal to the bit error rate in the $X$ basis.

###  C.2 Simulation formulas

When Alice and Bob send intensities $k_{a}$ and $k_{b}$ with phase difference
$\theta$, the gain corresponding to only one detector ($\mathbf{L}$ or
$\mathbf{R}$) clicking is

$\displaystyle q_{k_{a}k_{b}}^{L\theta}=$ $\displaystyle
y_{k_{a}k_{b}}\left[e^{\omega_{k_{a}k_{b}}\cos\theta}-y_{k_{a}k_{b}}\right],$
(30) $\displaystyle q_{k_{a}k_{b}}^{R\theta}=$ $\displaystyle
y_{k_{a}k_{b}}\left[e^{-\omega_{k_{a}k_{b}}\cos\theta}-y_{k_{a}k_{b}}\right].$

where $\eta_{a}=\eta_{d}10^{-\alpha l_{a}/10}$, $\eta_{b}=\eta_{d}10^{-\alpha
l_{b}/10}$,
$y_{k_{a}k_{b}}=e^{\frac{-(\eta_{a}k_{a}+\eta_{b}k_{b})}{2}}(1-p_{d})$, and
$\omega_{k_{a}k_{b}}=\sqrt{\eta_{a}k_{a}\eta_{b}k_{b}}$. The overall gain can
be expressed as
$q_{k_{a}k_{b}}=1/2\pi\int_{0}^{2\pi}(q_{k_{a}k_{b}}^{L\theta}+q_{k_{a}k_{b}}^{R\theta})d\theta=2y_{k_{a}k_{b}}[I_{0}(\omega_{k_{a}k_{b}})-y_{k_{a}k_{b}}]$,
where $I_{0}(x)$ refers to zero-order modified Bessel functions of the first
kind. The total number for $\\{k_{a},k_{b}\\}$ is
$x_{k_{a}k_{b}}=Np_{k_{a}}p_{k_{b}}q_{k_{a}k_{b}}$.

The post-matching events in the basis of $Z$ can be divided into two types:
correct events $\\{\mu_{a}\mathbf{o}_{a},\mathbf{o}_{b}\mu_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},\mu_{b}\mathbf{o}_{b}\\}$, and incorrect events
$\\{\mu_{a}\mathbf{o}_{a},\mu_{b}\mathbf{o}_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},\mathbf{o}_{b}\mu_{b}\\}$. The corresponding numbers
are denoted as $n_{C}^{z}$ and $n_{E}^{z}$, respectively, which can be written
as

$\displaystyle n_{C}^{z}=$ $\displaystyle
x_{\min}\times\frac{p_{\mathbf{o}_{a}}p_{\mu_{b}}q_{\mathbf{o}_{a}\mu_{b}}}{p_{\mathbf{o}_{a}}p_{\mathbf{o}_{b}}q_{\mathbf{o}_{a}\mathbf{o}_{b}}+p_{\mathbf{o}_{a}}p_{\mu_{b}}q_{\mathbf{o}_{a}\mu_{b}}}\times$
(31)
$\displaystyle\frac{p_{\mu_{a}}p_{\mathbf{o}_{b}}q_{\mu_{a}\mathbf{o}_{b}}}{p_{\mu_{a}}p_{\mathbf{o}_{b}}q_{\mu_{a}\mathbf{o}_{b}}+p_{\mu_{a}}p_{\mu_{b}}q_{\mu_{a}\mu_{b}}}$

and

$\displaystyle n_{E}^{z}=$ $\displaystyle
x_{\min}\times\frac{p_{\mathbf{o}_{a}}p_{\mathbf{o}_{b}}q_{\mathbf{o}_{a}\mathbf{o}_{b}}}{p_{\mathbf{o}_{a}}p_{\mathbf{o}_{b}}q_{\mathbf{o}_{a}\mathbf{o}_{b}}+p_{\mathbf{o}_{a}}p_{\mu_{b}}q_{\mathbf{o}_{a}\mu_{b}}}\times$
(32)
$\displaystyle\frac{p_{\mu_{a}}p_{\mu_{b}}q_{\mu_{a}\mu_{b}}}{p_{\mu_{a}}p_{\mathbf{o}_{b}}q_{\mu_{a}\mathbf{o}_{b}}+p_{\mu_{a}}p_{\mu_{b}}q_{\mu_{a}\mu_{b}}}.$

The overall number of events in the $Z$ basis is $n^{z}=n^{z}_{C}+n^{z}_{E}$.
Considering the misalignment error $e_{d}^{z}$, the number of bit errors in
the $Z$ basis is $m^{z}=(1-e_{d}^{z})n^{z}_{E}+e_{d}^{z}n^{z}_{C}$, and the
bit error rate in the $Z$ basis is $E^{z}=m^{z}/n^{z}$.

The overall number of events in the $X$ basis is

$\displaystyle n^{x}=$ $\displaystyle
4\int_{\sigma}^{\sigma+\delta}\frac{Np_{\nu_{a}}p_{\nu_{b}}q_{\nu_{a}\nu_{b}}^{\theta}}{4\pi}d\theta$
(33) $\displaystyle=$ $\displaystyle\frac{Np_{\nu_{a}}p_{\nu_{b}}}{\pi}\times$
$\displaystyle\int_{\sigma}^{\sigma+\delta}y_{\nu_{a}\nu_{b}}(e^{\omega_{\nu_{a}\nu_{b}}\cos\theta}+e^{-\omega_{\nu_{a}\nu_{b}}\cos\theta}-2y_{\nu_{a}\nu_{b}})d\theta.$

For simplicity, we only consider the case in which all matched events satisfy
$\theta^{i}-\theta^{j}=0$. In this case, when $r_{a}^{i}\oplus r_{a}^{j}\oplus
r_{b}^{i}\oplus r_{b}^{j}=0$ (1), the
$\\{\nu_{a}^{i}\nu_{a}^{j},\leavevmode\nobreak\ \nu_{b}^{i}\nu_{b}^{j}\\}$
event is considered to be an error event when different detectors (the same
detector) click at time bins $i$ and $j$. The overall error count in the $X$
basis can be given as

$\displaystyle m^{x}=$ $\displaystyle
4\int_{\sigma}^{\sigma+\delta}\frac{Np_{\nu_{a}}p_{\nu_{b}}q_{\nu_{a}\nu_{b}}^{\theta}}{4\pi}\times
p_{E}d\theta$ (34) $\displaystyle=$
$\displaystyle\frac{2Np_{\nu_{a}}p_{\nu_{b}}}{\pi}\int_{\sigma}^{\sigma+\delta}y_{\nu_{a}\nu_{b}}\times$
$\displaystyle\left[\frac{(1-y_{\nu_{a}\nu_{b}})^{2}}{e^{\omega_{\nu_{a}\nu_{b}}\cos\theta}+e^{-\omega_{\nu_{a}\nu_{b}}\cos\theta}-2y_{\nu_{a}\nu_{b}}}-1\right]d\theta,$

where
$p_{E}=\frac{2q_{\nu_{a}\nu_{b}}^{L\theta}q_{\nu_{a}\nu_{b}}^{R\theta}}{q_{\nu_{a}\nu_{b}}^{\theta}q_{\nu_{a}\nu_{b}}^{\theta}}$.
The code of our protocol has been uploaded to the open-source code website
[92].

As a comparison, the overall error count in the $X$ basis of the AOPP is
defined as

$\displaystyle\hat{m}^{x}$
$\displaystyle=4\int_{\sigma}^{\sigma+\delta}\frac{Np_{\nu_{a}}p_{\nu_{b}}q_{\nu_{a}\nu_{b}}^{\theta}}{2\pi}\times\hat{p}_{E}d\theta$
(35)
$\displaystyle=\frac{2Np_{\nu_{a}}p_{\nu_{b}}}{\pi}\int_{\sigma}^{\sigma+\delta}y_{\nu_{a}\nu_{b}}(e^{-\omega_{\nu_{a}\nu_{b}}\cos\theta}-y_{\nu_{a}\nu_{b}})d\theta,$

where we have
$\hat{p}_{E}=\frac{q_{\nu_{a}\nu_{b}}^{R\theta}}{q_{\nu_{a}\nu_{b}}^{\theta}}$.

## References

  * Gidney and Ekerå [2021] C. Gidney and M. Ekerå, How to factor 2048 bit rsa integers in 8 hours using 20 million noisy qubits, Quantum 5, 433 (2021).
  * Yan et al. [2022] B. Yan, Z. Tan, S. Wei, H. Jiang, W. Wang, H. Wang, L. Luo, Q. Duan, Y. Liu, W. Shi, et al., Factoring integers with sublinear resources on a superconducting quantum processor, arXiv preprint arXiv:2212.12372 (2022).
  * Bennett and Brassard [2014] C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, Theor. Comput. Sci. 560, 7 (2014).
  * Ekert [1991] A. K. Ekert, Quantum cryptography based on bell’s theorem, Phys. Rev. Lett. 67, 661 (1991).
  * Scarani et al. [2009] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev, The security of practical quantum key distribution, Rev. Mod. Phys. 81, 1301 (2009).
  * Weedbrook et al. [2012] C. Weedbrook, S. Pirandola, R. García-Patrón, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Gaussian quantum information, Rev. Mod. Phys. 84, 621 (2012).
  * Xu et al. [2020a] F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, Secure quantum key distribution with realistic devices, Rev. Mod. Phys. 92, 025002 (2020a).
  * Pirandola et al. [2020] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, et al., Advances in quantum cryptography, Adv. Opt. Photonics 12, 1012 (2020).
  * Lo et al. [2012] H.-K. Lo, M. Curty, and B. Qi, Measurement-device-independent quantum key distribution, Phys. Rev. Lett. 108, 130503 (2012).
  * Braunstein and Pirandola [2012] S. L. Braunstein and S. Pirandola, Side-channel-free quantum key distribution, Phys. Rev. Lett. 108, 130502 (2012).
  * Liu et al. [2013] Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu, J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S. Pelc, M. M. Fejer, C.-Z. Peng, Q. Zhang, and J.-W. Pan, Experimental measurement-device-independent quantum key distribution, Phys. Rev. Lett. 111, 130502 (2013).
  * Rubenok et al. [2013] A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks, Phys. Rev. Lett. 111, 130501 (2013).
  * Curty et al. [2014] M. Curty, F. Xu, W. Cui, C. C. W. Lim, K. Tamaki, and H.-K. Lo, Finite-key analysis for measurement-device-independent quantum key distribution, Nat. Commun. 5, 3732 (2014).
  * Yin et al. [2014] H.-L. Yin, W.-F. Cao, Y. Fu, Y.-L. Tang, Y. Liu, T.-Y. Chen, and Z.-B. Chen, Long-distance measurement-device-independent quantum key distribution with coherent-state superpositions, Opt. Lett. 39, 5451 (2014).
  * Ferreira da Silva et al. [2013] T. Ferreira da Silva, D. Vitoreti, G. B. Xavier, G. C. do Amaral, G. P. Temporão, and J. P. von der Weid, Proof-of-principle demonstration of measurement-device-independent quantum key distribution using polarization qubits, Phys. Rev. A 88, 052303 (2013).
  * Tang et al. [2014] Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, and H.-K. Lo, Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution, Phys. Rev. Lett. 112, 190503 (2014).
  * Fu et al. [2015] Y. Fu, H.-L. Yin, T.-Y. Chen, and Z.-B. Chen, Long-distance measurement-device-independent multiparty quantum communication, Phys. Rev. Lett. 114, 090501 (2015).
  * Azuma et al. [2015] K. Azuma, K. Tamaki, and H.-K. Lo, All-photonic quantum repeaters, Nat. Commun. 6, 6787 (2015).
  * Zhou et al. [2016] Y.-H. Zhou, Z.-W. Yu, and X.-B. Wang, Making the decoy-state measurement-device-independent quantum key distribution practically useful, Phys. Rev. A 93, 042324 (2016).
  * Comandar et al. [2016] L. Comandar, M. Lucamarini, B. Fröhlich, J. Dynes, A. Sharpe, S.-B. Tam, Z. Yuan, R. Penty, and A. Shields, Quantum key distribution without detector vulnerabilities using optically seeded lasers, Nat. Photonics 10, 312 (2016).
  * Yin et al. [2016] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou, S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang, H. Chen, M. J. Li, D. Nolan, F. Zhou, X. Jiang, Z. Wang, Q. Zhang, X.-B. Wang, and J.-W. Pan, Measurement-device-independent quantum key distribution over a 404 km optical fiber, Phys. Rev. Lett. 117, 190501 (2016).
  * Woodward et al. [2021] R. I. Woodward, Y. Lo, M. Pittaluga, M. Minder, T. Paraïso, M. Lucamarini, Z. Yuan, and A. Shields, Gigahertz measurement-device-independent quantum key distribution using directly modulated lasers, npj Quantum Inf. 7, 58 (2021).
  * Kwek et al. [2021] L.-C. Kwek, L. Cao, W. Luo, Y. Wang, S. Sun, X. Wang, and A. Q. Liu, Chip-based quantum key distribution, AAPPS Bulletin 31, 1 (2021).
  * Xie et al. [2022] Y.-M. Xie, Y.-S. Lu, C.-X. Weng, X.-Y. Cao, Z.-Y. Jia, Y. Bao, Y. Wang, Y. Fu, H.-L. Yin, and Z.-B. Chen, Breaking the rate-loss bound of quantum key distribution with asynchronous two-photon interference, PRX Quantum 3, 020315 (2022).
  * Zeng et al. [2022] P. Zeng, H. Zhou, W. Wu, and X. Ma, Mode-pairing quantum key distribution, Nat. Commun. 13, 3903 (2022).
  * Li and Wei [2022] Z. Li and K. Wei, Improving parameter optimization in decoy-state quantum key distribution, Quantum Engineering 2022 (2022).
  * Gu et al. [2022] J. Gu, X.-Y. Cao, Y. Fu, Z.-W. He, Z.-J. Yin, H.-L. Yin, and Z.-B. Chen, Experimental measurement-device-independent type quantum key distribution with flawed and correlated sources, Science Bulletin 67, 2167 (2022).
  * Tang et al. [2016] Y.-L. Tang, H.-L. Yin, Q. Zhao, H. Liu, X.-X. Sun, M.-Q. Huang, W.-J. Zhang, S.-J. Chen, L. Zhang, L.-X. You, Z. Wang, Y. Liu, C.-Y. Lu, X. Jiang, X. Ma, Q. Zhang, T.-Y. Chen, and J.-W. Pan, Measurement-device-independent quantum key distribution over untrustful metropolitan network, Phys. Rev. X 6, 011024 (2016).
  * Pirandola et al. [2015] S. Pirandola, C. Ottaviani, G. Spedalieri, C. Weedbrook, S. L. Braunstein, S. Lloyd, T. Gehring, C. S. Jacobsen, and U. L. Andersen, High-rate measurement-device-independent quantum cryptography, Nat. Photonics 9, 397 (2015).
  * Yin et al. [2017] H.-L. Yin, W.-L. Wang, Y.-L. Tang, Q. Zhao, H. Liu, X.-X. Sun, W.-J. Zhang, H. Li, I. V. Puthoor, L.-X. You, E. Andersson, Z. Wang, Y. Liu, X. Jiang, X. Ma, Q. Zhang, M. Curty, T.-Y. Chen, and J.-W. Pan, Experimental measurement-device-independent quantum digital signatures over a metropolitan network, Phys. Rev. A 95, 042338 (2017).
  * Wang et al. [2019a] W. Wang, F. Xu, and H.-K. Lo, Asymmetric protocols for scalable high-rate measurement-device-independent quantum key distribution networks, Phys. Rev. X 9, 041012 (2019a).
  * Fan-Yuan et al. [2021] G.-J. Fan-Yuan, F.-Y. Lu, S. Wang, Z.-Q. Yin, D.-Y. He, Z. Zhou, J. Teng, W. Chen, G.-C. Guo, and Z.-F. Han, Measurement-device-independent quantum key distribution for nonstandalone networks, Photonics Res. 9, 1881 (2021).
  * Zheng et al. [2021] X. Zheng, P. Zhang, R. Ge, L. Lu, G. He, Q. Chen, F. Qu, L. Zhang, X. Cai, Y. Lu, et al., Heterogeneously integrated, superconducting silicon-photonic platform for measurement-device-independent quantum key distribution, Adv. Photonics 3, 055002 (2021).
  * Pirandola et al. [2009] S. Pirandola, R. García-Patrón, S. L. Braunstein, and S. Lloyd, Direct and reverse secret-key capacities of a quantum channel, Phys. Rev. Lett. 102, 050503 (2009).
  * Takeoka et al. [2014] M. Takeoka, S. Guha, and M. M. Wilde, Fundamental rate-loss tradeoff for optical quantum key distribution, Nat. Commun. 5, 5235 (2014).
  * Pirandola et al. [2017] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, Fundamental limits of repeaterless quantum communications, Nat. Commun. 8, 15043 (2017).
  * Pirandola [2019] S. Pirandola, End-to-end capacities of a quantum communication network, Commun. Phys. 2, 51 (2019).
  * Das et al. [2021] S. Das, S. Bäuml, M. Winczewski, and K. Horodecki, Universal limitations on quantum key distribution over a network, Phys. Rev. X 11, 041016 (2021).
  * Duan et al. [2001] L. M. Duan, M. D. Lukin, J. I. Cirac, and P. Zoller, Long-distance quantum communication with atomic ensembles and linear optics, Nature 414, 413 (2001).
  * Sangouard et al. [2011] N. Sangouard, C. Simon, H. de Riedmatten, and N. Gisin, Quantum repeaters based on atomic ensembles and linear optics, Rev. Mod. Phys. 83, 33 (2011).
  * Lucamarini et al. [2018] M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate–distance limit of quantum key distribution without quantum repeaters, Nature 557, 400 (2018).
  * Ma et al. [2018] X. Ma, P. Zeng, and H. Zhou, Phase-matching quantum key distribution, Phys. Rev.X 8, 031043 (2018).
  * Wang et al. [2018] X.-B. Wang, Z.-W. Yu, and X.-L. Hu, Twin-field quantum key distribution with large misalignment error, Phys. Rev. A 98, 062323 (2018).
  * Lin and Lütkenhaus [2018] J. Lin and N. Lütkenhaus, Simple security analysis of phase-matching measurement-device-independent quantum key distribution, Phys. Rev. A 98, 042332 (2018).
  * Curty et al. [2019] M. Curty, K. Azuma, and H.-K. Lo, Simple security proof of twin-field type quantum key distribution protocol, npj Quantum Inf. 5, 64 (2019).
  * Cui et al. [2019] C. Cui, Z.-Q. Yin, R. Wang, W. Chen, S. Wang, G.-C. Guo, and Z.-F. Han, Twin-field quantum key distribution without phase postselection, Phys. Rev. Applied 11, 034053 (2019).
  * Yin and Fu [2019] H.-L. Yin and Y. Fu, Measurement-device-independent twin-field quantum key distribution, Sci. Rep. 9, 3045 (2019).
  * Yin and Chen [2019a] H.-L. Yin and Z.-B. Chen, Coherent-state-based twin-field quantum key distribution, Sci. Rep. 9, 14918 (2019a).
  * Hu et al. [2019] X.-L. Hu, C. Jiang, Z.-W. Yu, and X.-B. Wang, Sending-or-not-sending twin-field protocol for quantum key distribution with asymmetric source parameters, Phys. Rev. A 100, 062337 (2019).
  * Jiang et al. [2019] C. Jiang, Z.-W. Yu, X.-L. Hu, and X.-B. Wang, Unconditional security of sending or not sending twin-field quantum key distribution with finite pulses, Phys. Rev. Applied 12, 024061 (2019).
  * Maeda et al. [2019] K. Maeda, T. Sasaki, and M. Koashi, Repeaterless quantum key distribution with efficient finite-key analysis overcoming the rate-distance limit, Nat. Commun. 10, 3140 (2019).
  * Yin and Chen [2019b] H.-L. Yin and Z.-B. Chen, Finite-key analysis for twin-field quantum key distribution with composable security, Sci. Rep. 9, 17113 (2019b).
  * Zeng et al. [2020] P. Zeng, W. Wu, and X. Ma, Symmetry-protected privacy: beating the rate-distance linear bound over a noisy channel, Phys. Rev. Applied 13, 064013 (2020).
  * Currás-Lorenzo et al. [2021] G. Currás-Lorenzo, Á. Navarrete, K. Azuma, G. Kato, M. Curty, and M. Razavi, Tight finite-key security for twin-field quantum key distribution, npj Quantum Inf. 7, 22 (2021).
  * Li et al. [2021a] B.-H. Li, Y.-M. Xie, Z. Li, C.-X. Weng, C.-L. Li, H.-L. Yin, and Z.-B. Chen, Long-distance twin-field quantum key distribution with entangled sources, Opt. Lett. 46, 5529 (2021a).
  * Yin et al. [2021] Z.-Q. Yin, F.-Y. Lu, J. Teng, S. Wang, W. Chen, G.-C. Guo, and Z.-F. Han, Twin-field protocols: Towards intercity quantum key distribution without quantum repeaters, Fundamental Research 1, 93 (2021).
  * Wang et al. [2022] S. Wang, Z.-Q. Yin, D.-Y. He, W. Chen, R.-Q. Wang, P. Ye, Y. Zhou, G.-J. Fan-Yuan, F.-X. Wang, W. Chen, Y.-G. Zhu, P. V. Morozov, A. V. Divochiy, Z. Zhou, G.-C. Guo, and Z.-F. Han, Twin-field quantum key distribution over 830-km fibre, Nat. Photonics 16, 154 (2022).
  * Minder et al. [2019] M. Minder, M. Pittaluga, G. Roberts, M. Lucamarini, J. Dynes, Z. Yuan, and A. Shields, Experimental quantum key distribution beyond the repeaterless secret key capacity, Nat. Photonics 13, 334 (2019).
  * Wang et al. [2019b] S. Wang, D.-Y. He, Z.-Q. Yin, F.-Y. Lu, C.-H. Cui, W. Chen, Z. Zhou, G.-C. Guo, and Z.-F. Han, Beating the fundamental rate-distance limit in a proof-of-principle quantum key distribution system, Phys. Rev.X 9, 021046 (2019b).
  * Zhong et al. [2019] X. Zhong, J. Hu, M. Curty, L. Qian, and H.-K. Lo, Proof-of-principle experimental demonstration of twin-field type quantum key distribution, Phys. Rev. Lett. 123, 100506 (2019).
  * Fang et al. [2020] X.-T. Fang, P. Zeng, H. Liu, M. Zou, W. Wu, Y.-L. Tang, Y.-J. Sheng, Y. Xiang, W. Zhang, H. Li, Z. Wang, L. You, M.-J. Li, H. Chen, Y.-A. Chen, Q. Zhang, C.-Z. Peng, X. Ma, T.-Y. Chen, and J.-W. Pan, Implementation of quantum key distribution surpassing the linear rate-transmittance bound, Nat. Photonics 14, 422 (2020).
  * Chen et al. [2020] J.-P. Chen, C. Zhang, Y. Liu, C. Jiang, W. Zhang, X.-L. Hu, J.-Y. Guan, Z.-W. Yu, H. Xu, J. Lin, M.-J. Li, H. Chen, H. Li, L. You, Z. Wang, X.-B. Wang, Q. Zhang, and J.-W. Pan, Sending-or-not-sending with independent lasers: Secure twin-field quantum key distribution over 509 km, Phys. Rev. Lett. 124, 070501 (2020).
  * Zhong et al. [2021] X. Zhong, W. Wang, L. Qian, and H.-K. Lo, Proof-of-principle experimental demonstration of twin-field quantum key distribution over optical channels with asymmetric losses, npj Quantum Inf. 7, 8 (2021).
  * Pittaluga et al. [2021] M. Pittaluga, M. Minder, M. Lucamarini, M. Sanzaro, R. I. Woodward, M.-J. Li, Z. Yuan, and A. J. Shields, 600-km repeater-like quantum communications with dual-band stabilization, Nat. Photonics 15, 530 (2021).
  * Chen et al. [2022] J.-P. Chen, C. Zhang, Y. Liu, C. Jiang, D.-F. Zhao, W.-J. Zhang, F.-X. Chen, H. Li, L.-X. You, Z. Wang, et al., Quantum key distribution over 658 km fiber with distributed vibration sensing, Phys. Rev. Lett. 128, 180502 (2022).
  * Clivati et al. [2022] C. Clivati, A. Meda, S. Donadello, S. Virzì, M. Genovese, F. Levi, A. Mura, M. Pittaluga, Z. Yuan, A. J. Shields, M. Lucamarini, I. P. Degiovanni, and D. Calonico, Coherent phase transfer for real-world twin-field quantum key distribution, Nat. Commun. 13, 157 (2022).
  * Liu et al. [2021] H. Liu, C. Jiang, H.-T. Zhu, M. Zou, Z.-W. Yu, X.-L. Hu, H. Xu, S. Ma, Z. Han, J.-P. Chen, Y. Dai, S.-B. Tang, W. Zhang, H. Li, L. You, Z. Wang, Y. Hua, H. Hu, H. Zhang, F. Zhou, Q. Zhang, X.-B. Wang, T.-Y. Chen, and J.-W. Pan, Field test of twin-field quantum key distribution through sending-or-not-sending over 428 km, Phys. Rev. Lett. 126, 250502 (2021).
  * Chen et al. [2021] J.-P. Chen, C. Zhang, C. Liu, Yang Jiang, W.-J. Zhang, Z.-Y. Han, S.-Z. Ma, X.-L. Hu, Y.-H. Li, F. Liu, Hui Zhou, H.-F. Jiang, H. Chen, Teng-Yun Li, L.-X. You, Z. Wang, X.-B. Wang, Q. Zhang, and J.-W. Pan, Twin-field quantum key distribution over a 511 km optical fibre linking two distant metropolitan areas, Nat. Photonics 15, 570 (2021).
  * Xie et al. [2021] Y.-M. Xie, B.-H. Li, Y.-S. Lu, X.-Y. Cao, W.-B. Liu, H.-L. Yin, and Z.-B. Chen, Overcoming the rate–distance limit of device-independent quantum key distribution, Opt. Lett. 46, 1632 (2021).
  * Grasselli et al. [2019] F. Grasselli, H. Kampermann, and D. Bruß, Conference key agreement with single-photon interference, New J. Phys. 21, 123002 (2019).
  * Cao et al. [2021a] X.-Y. Cao, J. Gu, Y.-S. Lu, H.-L. Yin, and Z.-B. Chen, Coherent one-way quantum conference key agreement based on twin field, New J. Phys. 23, 043002 (2021a).
  * Cao et al. [2021b] X.-Y. Cao, Y.-S. Lu, Z. Li, J. Gu, H.-L. Yin, and Z.-B. Chen, High key rate quantum conference key agreement with unconditional security, IEEE Access 9, 128870 (2021b).
  * Zhao et al. [2020] S. Zhao, P. Zeng, W.-F. Cao, X.-Y. Xu, Y.-Z. Zhen, X. Ma, L. Li, N.-L. Liu, and K. Chen, Phase-matching quantum cryptographic conferencing, Phys. Rev. Applied 14, 024010 (2020).
  * Li et al. [2021b] Z. Li, X.-Y. Cao, C.-L. Li, C.-X. Weng, J. Gu, H.-L. Yin, and Z.-B. Chen, Finite-key analysis for quantum conference key agreement with asymmetric channels, Quantum Sci. Technol. 6, 045019 (2021b).
  * Zhang et al. [2021] C.-H. Zhang, X. Zhou, C.-M. Zhang, J. Li, and Q. Wang, Twin-field quantum digital signatures, Opt. Lett. 46, 3757 (2021).
  * Yin et al. [2022] H.-L. Yin, Y. Fu, C.-L. Li, C.-X. Weng, B.-H. Li, J. Gu, Y.-S. Lu, S. Huang, and Z.-B. Chen, Experimental quantum secure network with digital signatures and encryption, National Science Review 10, nwac228 (2023) {https://doi.org/10.1093/nsr/nwac228} .
  * Gu et al. [2021a] J. Gu, X.-Y. Cao, H.-L. Yin, and Z.-B. Chen, Differential phase shift quantum secret sharing using a twin field, Opt. Express 29, 9165 (2021a).
  * Jia et al. [2021] Z.-Y. Jia, J. Gu, B.-H. Li, H.-L. Yin, and Z.-B. Chen, Differential phase shift quantum secret sharing using a twin field with asymmetric source intensities, Entropy 23, 6 (2021).
  * Gu et al. [2021b] J. Gu, Y.-M. Xie, W.-B. Liu, Y. Fu, H.-L. Yin, and Z.-B. Chen, Secure quantum secret sharing without signal disturbance monitoring, Opt. Express 29, 32244 (2021b).
  * Xu et al. [2020b] H. Xu, Z.-W. Yu, C. Jiang, X.-L. Hu, and X.-B. Wang, Sending-or-not-sending twin-field quantum key distribution: Breaking the direct transmission key rate, Phys. Rev. A 101, 042330 (2020b).
  * Jiang et al. [2020] C. Jiang, X.-L. Hu, H. Xu, Z.-W. Yu, and X.-B. Wang, Zigzag approach to higher key rate of sending-or-not-sending twin field quantum key distribution with finite-key effects, New J. Phys. 22, 053048 (2020).
  * Lo and Preskill [2007] H.-K. Lo and J. Preskill, Security of quantum key distribution using weak coherent states with nonrandom phases, Quantum Inf. Comput. 7, 431 (2007).
  * Koashi [2009] M. Koashi, Simple security proof of quantum key distribution based on complementarity, New J. Phys. 11, 045018 (2009).
  * Wang [2005] X.-B. Wang, Beating the photon-number-splitting attack in practical quantum cryptography, Phys. Rev. Lett. 94, 230503 (2005).
  * Lo et al. [2005] H.-K. Lo, X. Ma, and K. Chen, Decoy state quantum key distribution, Phys. Rev. Lett. 94, 230504 (2005).
  * Eisert et al. [2000] J. Eisert, K. Jacobs, P. Papadopoulos, and M. B. Plenio, Optimal local implementation of nonlocal quantum gates, Phys. Rev. A 62, 052317 (2000).
  * Lo and Chau [1999] H.-K. Lo and H. F. Chau, Unconditional security of quantum key distribution over arbitrarily long distances, Science 283, 2050 (1999).
  * Shor and Preskill [2000] P. W. Shor and J. Preskill, Simple proof of security of the BB84 quantum key distribution protocol, Phys. Rev. Lett. 85, 441 (2000).
  * Chernoff [1952] H. Chernoff, A measure of asymptotic efficiency for tests of a hypothesis based on the sum of observations, Ann. Math. Stat. 23, 493 (1952).
  * Yin et al. [2020] H.-L. Yin, M.-G. Zhou, J. Gu, Y.-M. Xie, Y.-S. Lu, and Z.-B. Chen, Tight security bounds for decoy-state quantum key distribution, Sci. Rep. 10, 14312 (2020).
  * Jiang et al. [2022] C. Jiang, Z.-W. Yu, X.-L. Hu, and X.-B. Wang, Robust twin-field quantum key distribution through sending-or-not-sending, National Science Review 10, nwac186 (2023) {https://doi.org/10.1093/nsr/nwac186} .
  * [92] Y.-M. Xie, Codes of key rate calculation, https://github.com/yuan-meixie/TP-TFQKD.