††thanks: These authors contributed equally to this work††thanks: These
authors contributed equally to this work

# Experimental measurement-device-independent type quantum key distribution
with flawed and correlated sources

Jie Gu  Xiao-Yu Cao  National Laboratory of Solid State Microstructures and
School of Physics, Collaborative Innovation Center of Advanced
Microstructures, Nanjing University, Nanjing 210093, China  Yao Fu  Beijing
National Laboratory for Condensed Matter Physics and Institute of Physics,
Chinese Academy of Sciences, Beijing 100190, China  MatricTime Digital
Technology Co. Ltd., Nanjing 211899, China  Zong-Wu He  National Laboratory of
Solid State Microstructures and School of Physics, Collaborative Innovation
Center of Advanced Microstructures, Nanjing University, Nanjing 210093, China
State Key Laboratory of Particle Detection and Electronics, University of
Science and Technology of China, Hefei 230026, China  Ze-Jie Yin  State Key
Laboratory of Particle Detection and Electronics, University of Science and
Technology of China, Hefei 230026, China  Hua-Lei Yin<EMAIL_ADDRESS>National Laboratory of Solid State Microstructures and School of Physics,
Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China  Zeng-Bing Chen<EMAIL_ADDRESS>National
Laboratory of Solid State Microstructures and School of Physics, Collaborative
Innovation Center of Advanced Microstructures, Nanjing University, Nanjing
210093, China  MatricTime Digital Technology Co. Ltd., Nanjing 211899, China

###### Abstract

The security of quantum key distribution (QKD) is severely threatened by
discrepancies between realistic devices and theoretical assumptions. Recently,
a significant framework called the reference technique was proposed to provide
security against arbitrary source flaws under current technology such as state
preparation flaws, side channels caused by mode dependencies, the Trojan horse
atttacks and pulse correlations. Here, we adopt the reference technique to
prove security of an efficient four-phase measurement-device-independent QKD
using laser pulses against potential source imperfections. We present a
characterization of source flaws and connect them to experiments, together
with a finite-key analysis against coherent attacks. In addition, we
demonstrate the feasibility of our protocol through a proof-of-principle
experimental implementation and achieve a secure key rate of 253 bps with a 20
dB channel loss. Compared with previous QKD protocols with imperfect devices,
our study considerably improves both the secure key rate and the transmission
distance, and shows application potential in the practical deployment of
secure QKD with device imperfections.

Keywords: measurement-device-independent, quantum key distribution, reference
technique, source flaw characterization, practical security

##  I INTRODUCTION

Quantum key distribution (QKD) enables two distant participants, Alice and
Bob, to share secure key bits [1, 2] for the encryption and decryption of
secret communication. Together with the one-time pad algorithm, QKD offers
theoretical security for information exchanges based on the laws of quantum
mechanics [3, 4]. However, for the practical operation of QKD systems, a
serious security loophole still exists, which occurs due to the discrepancy
between theoretical security assumptions and practical devices. To be precise,
a security proof of QKD is established with assumptions on the system devices,
which cannot be satisfied for realistic devices because of inherent
imperfections and the disturbance of eavesdroppers [5, 6, 7, 8]. This
deviation results in more information leakage to eavesdroppers, which cannot
be noticed by users [3].

To narrow the discrepancy and further strengthen the security against device
flaws, some crucial protocols have been presented, one of which is device-
independent QKD, which guarantees the unconditional security of QKD by
measuring the violation of Bell’s inequality [9]. Although a number of
experimental demonstrations of the loophole-free Bell test have been conducted
[10, 11, 12], experimental implementations of device-independent QKD still
suffer from short transmission distances, because they require nearly perfect
single-photon detection. To date, several device-independent QKD experiments
have been performed, which show that device-independent QKD is still far from
being implemented in long-distance transmission [13, 14, 15], as listed in
Table 1.

Table 1: Comparison of the experimental performance for different methods for
QKD against source and detection flaws.

[.5]() |  Performance2 | Key rate (bps)
---|---|---
[.5]() This study | 10 dB attenuation | $9.10\times 10^{4}$
| 20 dB attenuation | 253
[.5]() Side-channel-secure1 [16] |  50 km fiber spool | 173
[.5]() Device-independent [13] |  2 m spatial distance |  $\sim$ 7.43
[.5]() Device-independent [14] |  400 m spatial distance | $8.5\times 10^{-4}$
[.5]() Device-independent [15] | 220 m fiber spool | 2.60

  * 1

Ref. [16] is a side-channel-secure QKD experiment (assuming perfect vacuum and
without considering pulse correlations).

  * 2

The performance of QKD experiments can be demonstrated by realistic
transmission or attenuation simulation. The attenuation of 50 km fiber spool
is about 10 dB.

Furthermore, a recent study revealed that Bell nonlocality is insufficient to
prove the security of standard device-independent QKD protocols [17] in the
large-noise regime.

Another significant approach towards the security of practical QKD is
measurement-device-independent (MDI) QKD [18, 19, 20, 21, 22, 23], as well as
its single-photon interference version, twin-field QKD [24], which closes all
attacks on measurement devices. Both of them are practical [25, 26, 27, 28,
29, 30, 31, 32], and break the transmission record using current technologies
[33, 34, 35, 36, 37]. Espeically, twin-field QKD protocols can break the
Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound, which is the repeaterless
secret key capacity bound [38, 39]. However, source flaws present a loophole
towards securing QKD with imperfect devices. In recent years, several studies
have been conducted to improve the security with source flaws, such as the
loss-tolerant protocol [40, 41, 42, 43] and other attempts [19, 44, 45, 46,
47, 48, 49]. Recently, an important theoretical study was published to propose
a security analysis method for practical QKD against source flaws, which is
called the reference technique (RT) [50, 51, 52]. To be precise, the RT is a
parameter estimation technique which can help simplify the estimation of
parameters needed for security proof through several reference states. Using
the RT method, parameters characterizing typical source flaws, such as state
preparation flaws (SPFs) [53], side channels caused by mode dependencies,
Trojan horse attacks (THAs), and classical pulse correlations [52], can be
estimated to guarantee the security of the actual QKD protocol.

Here, we adopt the RT method to prove the practical security of a four-phase
(FP) MDIQKD protocol [54] using coherent light sources against all possible
source flaws, including pulse correlations. We apply the setup of phase
encoding schemes [54] and the single photon interference introduced in twin-
field QKD [24] contributes to improving the key rate of our scheme. In
addition, we perform a proof-of-principle experimental implementation of our
protocol to demonstrate its feasibility. Specifically, we fully characterize
imperfect sources using the state representation in Ref. [51] (the reference
state representation) and introduce bounded fidelity to offer a secure key
rate by using the RT method. Although bounded fidelity was first introduced in
the Gottesman-Lo-Lütkenhaus-Preskill (GLLP) analysis [55, 56], the GLLP
analysis can be included under the RT method as a special case [51]. We
simulated the secure key rate of our protocol and compared it with protocols
in Refs. [50] and [46] which are both against source flaws. The simulation
results show that both in the ideal scenario and in the scenario with source
flaws, the secure key rate of our protocol shows a higher performance than the
other two protocols.

We specify the parameters characterizing source flaws in the reference state
representation and further relate them to data that can be measured
experimentally to help generate a secure key rate in the experiment. Our
experimental implementation only requires four-phase (quadrature phase-shift
keying [57]) modulation of coherent states, which avoids intensity modulation
correlations [58] and does not require vacuum state preparation. In addition,
we conducted a finite-key analysis of our protocol, which is secure against
coherent attacks. Considering source flaws, our experiments can achieve a key
rate of 253 bps with a 20 dB channel loss, which is a considerable progress
compared with previous experimental implementations of QKD protocols with
imperfect source and measurement devices [16, 13, 14, 15]. Our study is the
first experimental implementation of a QKD protocol using the RT method [43,
51], with practical security against currently all possible imperfections in
devices. The method we used to build relations between parameters estimated
through the RT method and experimental data is also compatible with other
potential source imperfections. Our study proves the feasibility of a
practical secure QKD using the RT method. The features of our protocol also
jointly show possible practicality for the future deployment of secure QKD
systems with imperfect devices .

##  II Materials and methods

###  II.1 Protocol description

A brief schematic of the FP-MDIQKD protocol is shown in Fig. 1. In our QKD
system, Alice and Bob send weak coherent state pulses to an untrusted node,
Charlie, who performs the interference measurement. For simplicity, we first
describe our protocol under the assumption that Alice and Bob are able to
prepare perfect optical pulses. Source flaws are thoroughly discussed
afterwards. The protocol comprises the following steps:

(i) Preparation. In each turn, Alice randomly chooses the $\rm X$ and $\rm Y$
bases with probabilities $p_{x}$ and $p_{y}=1-p_{x}$, respectively. If
selecting the $\rm X$ basis, she picks a ”key” bit $k_{x}^{a}\in\\{0,1\\}$ and
generates a weak coherent state pulse
$\mathinner{|{e^{ik_{x}^{a}\pi}\alpha}\rangle}$, where $|\alpha|^{2}$ is the
intensity of the optical pulse. When choosing the $\rm Y$ basis, she prepares
a weak coherent state pulse
$\mathinner{|{e^{i(k_{y}^{a}+\frac{1}{2})\pi}\alpha}\rangle}$ according to
random bit $k_{y}^{a}\in\\{0,1\\}$. Bob does the same.

(ii) Measurement. Alice and Bob send their optical pulses to an untrusted
middle node Charlie through insecure quantum channels. Charlie is expected to
perform interference measurements and record the detector that clicks.

Note that Charlie is assumed to apply a 50:50 beam splitter to the incoming
two optical pulses, followed by two threshold single-photon detectors, D1 and
D2. We assume that D1 (D2) will click when the phase difference between the
two incoming optical pulses is zero ($\pi$). We assume that Charlie records
the situation when one and only one detector clicks as an effective
measurement, regardless of the actual clicking results, because Charlie is an
untrusted node and his betrayal can be included in the security analysis.

(iii) Sifting. Alice and Bob repeat Steps (i)–(ii) many times. Then, Charlie
announces the effective measurements and detection results (whether D1 or D2
clicks). Alice and Bob maintain their corresponding keys and basis choices
based on Charlie’s announcement. If Charlie claims that D2 clicks, Bob will
flip his key bit. Alice and Bob then disclose their basis choices for
effective measurements through authenticated classical channels, and further
classify their key bits with basis information.

(iv) Parameter estimation. For the retained key bits in the $\rm X$ and $\rm
Y$ bases, Alice and Bob obtain the gain. Then, they disclose all key bits
under the $\rm Y$ basis to calculate the bit error rate, which is used to set
a bound on the phase error rate.

(v) Key distillation. Alice and Bob perform error correction and privacy
amplification on the remaining sifted keys under the $\rm X$ basis to distill
the final secure key bits.

Evidently, the use of weak coherent state pulses naturally makes it easier for
us to characterize the SPFs because theoretically any deviation in intensity
and phase modulation between ideal pulses and realistic pulses can be directly
shown in the expression of laser pulses. No assumption on dimensions of
Hilbert spaces is required. Our protocol further inherits the advantages that
the QKD system can be implemented with fixed intensity because a recent study
reveals that intensity modulation introduces extra pulse correlations of
intensity [58].

Figure 1: Schematic of our FP-MDIQKD protocol. At Alice’s (Bob’s) site, the
simplified transmitter contains a laser source and an encoder. The encoder
modulates the phase of the optical pulses. The modulation information of the
encoder should be monitored to characterize the deviation between ideal and
realistic pulses. If the untrusted Charlie is honest, he measures the signals
received using an interference measurement.

###  II.2 Key rate of FP-MDIQKD

As depicted in Fig. 1, the setting of two bases can introduce bounded fidelity
with imbalance $\Delta$ of a quantum coin [54, 59, 55]. For simplicity, we
only present the main result for key rate estimation because the idea of a
quantum coin has been discussed in previous studies [55, 56] (see
Supplementary Material). Because only key bits under the $\rm X$ basis are
used to form secure key bits, the final key rate of our FP-MDIQKD protocol is
given by

$R=Q^{x}[1-fH(E_{\rm b}^{x})-H(E_{\rm p})]$ (1)

where $Q^{x}$ denotes the gain under the X-basis. $E_{\rm p}$ is the phase
error rate under the X-basis. $E_{\rm b}^{x}$ represents the quantum bit error
rate under the X basis. $H(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)$ is the binary
Shannon entropy function. According to the GLLP analysis and the RT method
[55, 56, 54, 59, 51], the phase error rate $E_{\rm p}$ can be bounded by

$1-2\Delta\leq\sqrt{E_{\rm b}^{y}E_{\rm p}}+\sqrt{(1-E_{\rm b}^{y})(1-E_{\rm
p})},$ (2)

where $E_{\rm b}^{y}$ is the quantum bit error rate in the $\rm Y$ basis and
$\Delta$ quantifies the imbalance of Alice’s and Bob’s quantum coins based on
their basis choices. $\Delta$ can be bounded by the fidelity of the two basis-
dependent states under the X and Y bases, which is denoted as
$|\left\langle{\Psi_{\rm Y}}|{\Psi_{\rm X}}\right\rangle|$. In the symmetric
scenario in which Alice and Bob share basis-dependent states, the simplified
relation between $\Delta$ and fidelity is [59] $1-2Q\Delta={\rm
Max}_{\theta^{\prime},\delta_{\rm X},\delta_{\rm Y}}{\rm
Re}\left(e^{i\theta^{\prime}}\left\langle{\Psi_{{\rm Y},\delta_{\rm
Y}}}|{\Psi_{{\rm X},\delta_{\rm
X}}}\right\rangle\right)|\left\langle{\Psi_{\rm Y}}|{\Psi_{\rm
X}}\right\rangle|$, where $Q$ is the total gain. Here,
$\theta^{\prime},\delta_{\rm X}$, and $\delta_{\rm Y}$ are free variables
ranging from 0 to $2\pi$ and $\left|{\Psi_{{\rm V},\delta_{\rm
V}}}\right\rangle=(\left|{0_{\rm V}}\right\rangle\left|{\Psi_{0\rm
V}}\right\rangle+\left|{1_{\rm V}}\right\rangle\left|{\Psi_{1\rm
V}}\right\rangle)/\sqrt{2}$. $\left|{\Psi_{j\rm V}}\right\rangle$ is the state
that Alice or Bob actually prepares in the implementation under the V basis (V
= X or Y) with the bit value $j$. For the experimental implementation, the
calculation of fidelity with imperfect sources can be expressed as

$\displaystyle\left\langle{\Psi_{\rm X}}|{\Psi_{\rm Y}}\right\rangle=$
$\displaystyle\frac{1}{4}(1-\epsilon)e^{-\mu}{\rm
cos}^{2}\theta[(1-i)\left\langle{\alpha^{\prime}}|{ie^{i\delta}\alpha^{\prime}}\right\rangle$
(3)
$\displaystyle+(1-i)\left\langle{-e^{i\delta}\alpha^{\prime}}|{-ie^{i\delta}\alpha^{\prime}}\right\rangle$
$\displaystyle+(1+i)\left\langle{\alpha^{\prime}}|{-ie^{i\delta}\alpha^{\prime}}\right\rangle$
$\displaystyle+(1+i)\left\langle{-e^{i\delta}\alpha^{\prime}}|{ie^{i\delta}\alpha^{\prime}}\right\rangle)],$

where we use $\epsilon$, $\mu$, and $\theta$ to characterize pulse
correlations, THAs, and side channels caused by mode dependencies,
respectively. Here, we consider special cases of THAs and side channels as
discussed in the reference state representation [43]. For the THAs, $\mu$ is
the intensity of the back-reflected light sent by the eavesdroppers. For the
side channels, $\theta$ is the parameter used to bound the side channels in
the polarization space of our protocol in Eq. (8). Note that other potential
side channels can also be characterized by additional parameters. For SPFs, we
consider only the worst scenario with the maximum deviation in intensity and
phase modulation without pulse correlations. $|\alpha^{\prime}|^{2}$
represents the realistic intensity modulation of coherent pulses. The maximum
deviation ratio can be denoted by the optical power fluctuation $\xi$ and
$\xi=\left||\alpha^{\prime}|^{2}-|\alpha|^{2}\right|/|\alpha|^{2}$. $\delta$
represents the deviation from the ideal phase modulation. Aside from the THAs,
the parameters of the side channels and SPFs discussed here can be directly
measured in the experiment, which can be seen in our experimental
implementation. By contrast, pulse correlations are usually witnessed during
experiments in the form of pattern effects [60], which means $\epsilon$ cannot
be directly derived through experimental measurements. Since our protocol was
one FP-MDIQKD with fixed intensity, the pattern effect occurs in the phase
modulation, which is denoted as $\psi$ and $\psi$ represents the maximum
deviation of the phase modulation caused only by pulse correlations. Here, we
derive a formula that relates $\epsilon$ to $\psi$, which can be obtained as

$\epsilon=1-e^{|\alpha|^{2}(2{\rm cos}\psi-2)}.$ (4)

We remark that $\epsilon$ is the parameter generalizing arbitrarily long-range
pulse correlations. In our experiments, we only measure pattern effects
happening between nearest-neighbor pulses. However, our method can also be
easily applied to measure long-range pattern effects when the length of pulse
correlations is more than one, as shown in Supplementary Material.

For experimental implementation, we provide a finite-key analysis of our
protocol based on the method introduced in Ref. [61] and the analysis is
secure against coherent attacks. The formula for the number of secure key bits
$l$ can be expressed as

$\displaystyle l=n_{x}\Bigg{[}1$ $\displaystyle-H(\overline{E}_{\rm p})-{\rm
leak}_{\rm EC}$ (5) $\displaystyle-\frac{1}{n_{x}}{\rm
log}_{2}\frac{2}{\epsilon_{\rm EC}}-\frac{1}{n_{x}}{\rm
log}_{2}\frac{1}{4\epsilon^{2}_{\rm PA}}\Bigg{]},$

where $n_{x}$ denotes the number of raw bits under the X basis, which is used
to generate the secret key, and ${\rm leak}_{\rm EC}=fH(E_{\rm b}^{x})$
represents the percentage of bits consumed during the error correction.
$\epsilon_{\rm EC}$ and $\epsilon_{\rm PA}$ represent the failure
probabilities for the error correction and privacy amplification,
respectively. $\bar{\epsilon}$ is the other error probability that measures
the accuracy of estimating smooth min-entropy. In addition, statistical
fluctuations should be applied to determine the upper bound of the observed
phase-error rate $\overline{E}_{\rm p}$. Detailed formulas can be found in the
Supplementary Material.

###  II.3 Characterization of source flaws

We characterized the expression for basis-dependent states in our protocol.
First, an ideal scenario is presented. Then, we discuss how to jointly
consider different realistic source flaws (SPFs, side channels arising from
mode dependencies, THAs and pulse correlations) to describe the basis-
dependent states using the reference state representation.

####  II.3.1 The ideal scenario

In the ideal scenario, Alice and Bob prepare perfect weakly coherent states.
The symmetric scenario is another assumption under which the states Alice and
Bob prepare are the same. The basis-dependent states are

$\displaystyle\left|{\Psi_{\rm
X}}\right\rangle=\frac{1}{\sqrt{2}}\left(\left|{0_{\rm
X}}\right\rangle\left|{\alpha}\right\rangle+\left|{1_{\rm
X}}\right\rangle\left|{-\alpha}\right\rangle\right),$ (6)
$\displaystyle\left|{\Psi_{\rm
Y}}\right\rangle=\frac{1}{\sqrt{2}}\left(\left|{1_{\rm
Y}}\right\rangle\left|{i\alpha}\right\rangle+\left|{0_{\rm
Y}}\right\rangle\left|{-i\alpha}\right\rangle\right),$

where $\\{\left|{0_{\rm X}}\right\rangle,\left|{1_{\rm X}}\right\rangle\\}$
and $\\{\left|{0_{\rm Y}}\right\rangle,\left|{1_{\rm Y}}\right\rangle\\}$ are
the eigenstates of the Pauli operators $\sigma_{x}$ and $\sigma_{y}$,
respectively.

####  II.3.2 State preparation flaws

When considering SPFs in practical implementations, there is an inherent
advantage of using weak coherent pulses as SPFs can be characterized by
imperfect intensity and phase modulations on weak coherent pulses [53]. The
actual basis-dependent states with SPFs can be expressed as

$\displaystyle\left|{\Psi_{\rm
X}}\right\rangle^{*}=\frac{1}{\sqrt{2}}\left(\mathinner{|{0_{\rm
X}}\rangle}\mathinner{|{\alpha_{0}}\rangle}+\mathinner{|{1_{\rm
X}}\rangle}\mathinner{|{-e^{i\delta_{1}}\alpha_{1}}\rangle}\right),$ (7)
$\displaystyle\left|{\Psi_{\rm
Y}}\right\rangle^{*}=\frac{1}{\sqrt{2}}\left(\mathinner{|{1_{\rm
Y}}\rangle}\mathinner{|{ie^{i\delta_{2}}\alpha_{2}}\rangle}+\mathinner{|{0_{\rm
Y}}\rangle}\mathinner{|{-ie^{i\delta_{3}}\alpha_{3}}\rangle}\right).$

Note that the phase in $\mathinner{|{\alpha_{0}}\rangle}$ can be regarded as
the global phase and does not affect the bounded fidelity of the two bases.
Here, we consider a situation with varied basis and bit choices, which have
different deviations of intensity and phase modulations, to derive the general
expression of the basis-dependent states. For the simulation and experimental
implementations, as mentioned before, we only considered the worst scenario
with maximum deviations in intensity and phase modulations without pulse
correlations.

####  II.3.3 Side channels caused by mode dependencies

Side channels caused by mode dependencies are common imperfections in a
practical QKD system, where the eavesdropper Eve can exploit dimensions other
than the encoding dimension to distinguish states that carry the secret. For
example, in our protocol, the bits are encoded in phase space, which is the
operational space, and Eve can distinguish signals from senders using the
polarization information of each state, which is one of the side channels .
Here, we consider only the polarization space as the side-channel space,
together with a polarization multimode scenario. We express the weak coherent
states according to the basis and bit information as follows:

$\displaystyle\mathinner{|{\alpha_{0}^{\prime}}\rangle}=\rm
cos\theta_{0}\mathinner{|{\alpha_{0}}\rangle}_{\rm H}+\rm
sin\theta_{0}\mathinner{|{\alpha_{0}}\rangle}_{\rm V},$ (8)
$\displaystyle\mathinner{|{\alpha_{1}^{\prime}}\rangle}=\rm
cos\theta_{1}\mathinner{|{-e^{i\delta_{1}}\alpha_{1}}\rangle}_{\rm H}+\rm
sin\theta_{1}\mathinner{|{-e^{i\delta_{1}}\alpha_{1}}\rangle}_{\rm V},$
$\displaystyle\mathinner{|{\alpha_{2}^{\prime}}\rangle}=\rm
cos\theta_{2}\mathinner{|{ie^{i\delta_{2}}\alpha_{2}}\rangle}_{\rm H}+\rm
sin\theta_{2}\mathinner{|{ie^{i\delta_{2}}\alpha_{2}}\rangle}_{\rm V},$
$\displaystyle\mathinner{|{\alpha_{3}^{\prime}}\rangle}=\rm
cos\theta_{3}\mathinner{|{-ie^{i\delta_{3}}\alpha_{3}}\rangle}_{\rm H}+\rm
sin\theta_{3}\mathinner{|{-ie^{i\delta_{3}}\alpha_{3}}\rangle}_{\rm V},$

where H and V refer to the horizontal and vertical polarization modes,
respectively. In addition, we assume that
$\theta_{0}=\theta_{1}=\theta_{2}=\theta_{3}=\theta$, as we consider the worst
situation when the maximum deviation of polarization $\theta$ occurs for every
state. We adopt only states in the horizontal polarization mode to form the
secure key rate, and $\theta$ can be directly measured through the extinction
ratio of polarization. We obtain the basis-dependent states with side channels
and SPFs as

$\displaystyle\left|{\Psi_{\rm
X}}\right\rangle^{\prime}=\frac{1}{\sqrt{2}}\left(\mathinner{|{0_{\rm
X}}\rangle}\mathinner{|{\alpha_{0}^{\prime}}\rangle}+\mathinner{|{1_{\rm
X}}\rangle}\mathinner{|{\alpha_{1}^{\prime}}\rangle}\right),$ (9)
$\displaystyle\left|{\Psi_{\rm
Y}}\right\rangle^{\prime}=\frac{1}{\sqrt{2}}\left(\mathinner{|{1_{\rm
Y}}\rangle}\mathinner{|{\alpha_{2}^{\prime}}\rangle}+\mathinner{|{0_{\rm
Y}}\rangle}\mathinner{|{\alpha_{3}^{\prime}}\rangle}\right).$

####  II.3.4 Trojan horse attacks

THAs have been recognized as powerful eavesdropping strategies [62, 63]. Here,
we consider a special THA in which Eve can inject strong light into Alice’s
and Bob’s sites through the quantum channel and obtain the phase modulation
information by measuring the light reflected from Alice’s and Bob’s optical
devices. Here, we can assume that the back-reflected strong light Eve sends to
Alice’s (Bob’s) site is a strong coherent pulse:

$\left|{\zeta_{\rm T}}\right\rangle_{\rm E}=e^{-\mu/2}\left|{v_{\rm
T}}\right\rangle_{\rm E}+\sqrt{1-e^{-\mu}}\left|{\xi_{\rm
T}}\right\rangle_{\rm E},$ (10)

where $\rm T\in\\{{\rm 0_{X},0_{Y},1_{X},1_{Y}}\\}$ denotes the bit and basis
choices of Alice and Bob and $\mu$ is the intensity of Eve’s back-reflected
light. Here, we apply the model of THAs, in which $\left|{\zeta_{\rm
T}}\right\rangle_{\rm E}$ is a coherent state and $\left|{v_{\rm
T}}\right\rangle_{\rm E}$ is the vacuum state [43]. For simplicity, we
consider the worst scenario in which the overlap is $\left\langle{\xi_{\rm
T}}|{\xi_{{\rm T}^{\prime}}}\right\rangle_{\rm E}=0$. When jointly considering
the SPFs and side-channel effects, the basis-dependent states can be written
as

$\displaystyle\left|{\Psi_{\rm
X}}\right\rangle^{\prime\prime}=\frac{1}{\sqrt{2}}\left(\mathinner{|{0_{\rm
X}}\rangle}\mathinner{|{\alpha_{0}^{\prime}}\rangle}\left|{\zeta_{\rm
0X}}\right\rangle_{\rm E}+\mathinner{|{1_{\rm
X}}\rangle}\mathinner{|{\alpha_{1}^{\prime}}\rangle}\left|{\zeta_{\rm
1X}}\right\rangle_{\rm E}\right),$ (11) $\displaystyle\left|{\Psi_{\rm
Y}}\right\rangle^{\prime\prime}=\frac{1}{\sqrt{2}}\left(\mathinner{|{1_{\rm
Y}}\rangle}\mathinner{|{\alpha_{2}^{\prime}}\rangle}\left|{\zeta_{\rm
1Y}}\right\rangle_{\rm E}+\mathinner{|{0_{\rm
Y}}\rangle}\mathinner{|{\alpha_{3}^{\prime}}\rangle}\left|{\zeta_{\rm
0Y}}\right\rangle_{\rm E}\right).$

####  II.3.5 Pulse correlations

Pulse correlation is another security loophole in a practical QKD system [60,
64, 51, 58, 52], which is caused by different modulations between coherent
pulses and can reveal the modulation information to Eve. Because vacuum state
modulation is avoided in this study, it is not necessary to consider the
intensity correlation between pulses [58]. However, since our protocol adopts
a phase encoding scheme, phase modulation also introduces pulse correlations,
which can be observed in our experiments. Fortunately, it has been
theoretically demonstrated that classical pulse correlations can be
interpreted as side channels [51]. Here we also discuss classical pulse
correlations and leave characterization of quantum pulse correlations to be
the future study. Furthermore, based on the recent study in Ref. [52], we
firstly theoretically present characterization of long-range pulse
correlations where the length of correlations is set as $l_{c}$. Ignoring
other source flaws, we express the entangled state of $N$ pulses sent by Alice
as

$\left|{\Psi}\right\rangle_{\rm
A}=\frac{1}{M}\sum_{j_{n}}\sum_{j_{n-1}}...\sum_{j_{1}}\bigotimes_{k=1}^{N}\sqrt{p_{t}}\left|{j_{k}}\right\rangle_{A_{k}}\left|{\psi_{j_{k}|j_{k-1}}}\right\rangle_{C_{k}},$
(12)

where $1/M$ is a coefficient of normalization and $j_{k}\in\\{0_{\rm X},1_{\rm
X},0_{\rm Y},1_{\rm Y}\\}_{k=1,2,...,N}$ denotes the qubit state representing
bit and basis choices of Alice. $p_{t}\in\\{p_{x},p_{y}\\}$ is related to
basis choices since Alice biasedly chooses states in the X and Y bases.
$\left|{\psi_{j_{k}|j_{k-1}}}\right\rangle_{C_{k}}$ is the $k$th state Alice
send to Charlie which is affected by long-range pulse correlations. The
conclusion in Refs. [51, 52] shows that the actual $k$th state can also be
expressed as

$\left|{\psi^{\rm act}_{j_{k}|j_{k-1}}}\right\rangle_{{\rm
A}_{k}}=a_{k}\left|{\Phi}\right\rangle_{{\rm
A}_{k}}+\sqrt{1-a^{2}_{k}}\left|{\Phi^{\perp}}\right\rangle_{{\rm A}_{k}}.$
(13)

$\left|{\Phi}\right\rangle_{{\rm A}_{k}}$ represents the ideal state which is
side channel free and $\left|{\Phi^{\perp}}\right\rangle_{{\rm A}_{k}}$ is the
state with side channels, which is orthogonal to
$\left|{\Phi}\right\rangle_{{\rm A}_{k}}$. There is no need to derive the
specific expression of $\left|{\Phi^{\perp}}\right\rangle_{{\rm A}_{k}}$. To
minimize $a_{k}$ means we maximize the pulse correlations which is considered
as side channels. We directly derive the relation between the lower bound of
$a_{k}$ and parameters characterizing pulse correlations of different lengths
through outcomes in Ref. [52] as
$a_{k}=\prod_{d=1}^{l_{c}}\sqrt{1-\epsilon_{d}}$. $\epsilon_{d}$ is the
parameter characterizing influence of pulse correlations when the length of
correlation is $d$. For simplicity, we introduce one parameter $\epsilon$ to
generalize the formula of $a_{k}$, which makes the relation
$a_{k}=\sqrt{1-\epsilon}$. For different basis choices of the X and Y bases,
the relation remains. Therefore, we can obtain the state-dependent states as

$\displaystyle\left|{\Psi_{\rm
X}}\right\rangle=\sqrt{1-\epsilon}\left|{\Psi_{\rm
X}}\right\rangle^{\prime\prime}+\sqrt{\epsilon}\left|{\Psi_{\rm
X}^{\perp}}\right\rangle,$ (14) $\displaystyle\left|{\Psi_{\rm
Y}}\right\rangle=\sqrt{1-\epsilon}\left|{\Psi_{\rm
Y}}\right\rangle^{\prime\prime}+\sqrt{\epsilon}\left|{\Psi_{\rm
Y}^{\perp}}\right\rangle,$

removing subscripts $j_{k}$ and introducing subscripts of basis choices to
accomodate the GLLP analysis. Here we also consider the worst situation for
the senders, where $\left\langle{\Psi_{\rm X}^{\perp}}|{\Psi_{\rm
Y}^{\perp}}\right\rangle=0$. In the experiment, we could measure the deviation
of phase modulations caused by pulse correlations, which is called the pattern
effect [60]. Here, we only recorded the maximum phase deviation of nearest-
neighbor pulse correlations, which is denoted as $\psi$. We remark that in our
protocol, pulse correlations of different lengths can also be recorded through
our method measuring pattern effects. The relation between $\epsilon$ and
$\psi$ can be built through the following analysis. For simplicity, our
discussion is also based on the condition that imperfections other than the
pulse correlations are neglected. For example, when the ideal state without
any imperfection is $\left|{-\alpha}\right\rangle$, corresponding to bit $1$
on the X basis, the phase modulations of this state will be influenced by
long-range classical pulse correlations owing to the phase modulation of other
pulses. The practical state corresponds to
$\left|{-e^{i\psi}\alpha}\right\rangle$. Similar to the basic idea for finding
the reference state, we can write the practical state as

$\left|{-e^{i\psi}\alpha}\right\rangle=e^{(e^{i\psi}-1)|\alpha|^{2}}\left|{-\alpha}\right\rangle+\sqrt{1-e^{2(e^{i\psi}-1)|\alpha|^{2}}}\left|{-\alpha^{\perp}}\right\rangle,$
(15)

where
$\left\langle{-\alpha}|{-e^{i\psi}\alpha}\right\rangle=e^{(e^{i\psi}-1)|\alpha|^{2}}$
and there is no need to write down the specific expression of
$\left|{-\alpha^{\perp}}\right\rangle$. The definition of $\epsilon$ leads to
the formula $\sqrt{1-\epsilon}=e^{(e^{i\psi}-1)|\alpha|^{2}}$, and we obtain
the relation $\epsilon=1-e^{|\alpha|^{2}(2{\rm cos}\psi-2)}$. For other bit
and basis choices, it is readily observed that the formula remains the same.
In the experimental implementation, we will measure the pattern effect whose
values can be seen in Supplementary Material. The pattern effect can be
expressed by $\psi$ in the form of ${\rm sin}\psi$, which means $\psi$ can be
derived through measurements of pattern effects. To be precise, for state
$\left|{\alpha}\right\rangle$, after phase modulation, the state can be
expressed as
$\left|{\alpha^{\prime}}\right\rangle=e^{i(\psi+\theta)}\left|{\alpha}\right\rangle$.
Consequently, the interference result of
$\left|{\alpha^{\prime}}\right\rangle$ and $\left|{\alpha}\right\rangle$ is
$(e^{i\psi}\pm 1)\left|{\alpha}\right\rangle/{\sqrt{2}}$. Thus, the deviation
of the pulse intensity after interference is ${\rm sin}\psi$.

Figure 2: Experimental setup of our plug-and-play system. Optical pulses are
directly generated by a pulsed laser source and then pass through a circulator
(CIR). These pulses are separated into two pulse sequences with different
propagation directions using a $50:50$ beam splitter (BS). The clockwise pulse
sequence is modulated by a phase modulator (PM) controlled by an arbitrary
waveform generator after passing dense wavelength division multiplexing (DWDM)
and a BS. A counterclockwise pulse sequence undergoes a similar process.
Finally, these two pulses interfere in the BS and are detected by two
superconducting nanowire single-photon detectors D1 and D2. Polarization
controllers (PC) are used to modify the polarization of the incident pulses to
achieve maximum detection efficiencies.

####  II.3.6 The calculation of the basis-dependent states

Here, we need to calculate the analytic formula for the bounded fidelity to
estimate the imbalance $\Delta$. The fidelity $\left\langle{\Psi_{\rm
X}}|{\Psi_{\rm Y}}\right\rangle$ becomes $\left\langle{\Psi_{\rm
X}}|{\Psi_{\rm Y}}\right\rangle=(1-\epsilon)\left\langle{\Psi_{\rm
X}}|{\Psi_{\rm Y}}\right\rangle^{\prime\prime}$ and

$\displaystyle\left\langle{\Psi_{\rm X}}|{\Psi_{\rm
Y}}\right\rangle^{\prime\prime}=$ $\displaystyle\frac{1}{4}e^{-\mu}{\rm
cos}^{2}\theta[(1-i)\left\langle{\alpha_{0}}|{ie^{i\delta_{2}}\alpha_{2}}\right\rangle$
(16)
$\displaystyle+(1-i)\left\langle{-e^{i\delta_{1}}\alpha_{1}}|{-ie^{i\delta_{3}}\alpha_{3}}\right\rangle$
$\displaystyle+(1+i)\left\langle{\alpha_{0}}|{-ie^{i\delta_{3}}\alpha_{3}}\right\rangle$
$\displaystyle+(1+i)\left\langle{-e^{i\delta_{1}}\alpha_{1}}|{ie^{i\delta_{2}}\alpha_{2}}\right\rangle)],$

which can be applied to the calculation of joint fidelity
$|\left\langle{\Psi_{\rm Y}}|{\Psi_{\rm X}}\right\rangle|^{2}$. For
simplicity, we further assumed that $\delta_{1}=\delta_{2}=\delta_{3}=\delta$
and $\alpha_{0}=\alpha_{1}=\alpha_{2}=\alpha_{3}=\alpha^{\prime}$, which
represent the maximum deviations of the intensity and phase modulations,
respectively, as shown in Eq. (3).

###  II.4 Experimental implementation

Here, we present a proof-of-principle experimental demonstration of the FP-
MDIQKD protocol. The setup is illustrated in Fig. 2. This is a plug-and-play
construction consisting of a Sagnac interferometer, similar to the system in
Refs. [65, 66]. We use the Sagnac loop to stabilize the phase fluctuation of
the channel automatically, and all optical fibers maintain polarization.

Optical pulses are generated using a homemade pulsed laser. Pulses with a
frequency of 100 MHz have an extinction ratio greater than 30 dB and a pulse
width of less than 300 ps. Charlie sends the optical pulses to Alice and Bob.
These optical pulses pass through a circulator and are then separated by a
50:50 BS into two identical pulses. The two pulses are phase-modulated by
Alice and Bob. Specifically, clockwise (counterclockwise) pulses are modulated
by Alice (Bob). In addition, four DWDMs are used as bandpass filters, and four
BSs are utilized to monitor the intensity of pulses entering Alice’s or Bob’s
site, with the aim of protecting against attacks from injected pulses. In
fact, we did not monitor the intensity and filter pulses during implementation
because of resource limitations, which should be addressed for security.
However, these processes can be directly added to our system with little
influence on the results. Alice (Bob) chooses the X basis with a probability
of $p_{x}=90\%$ and the Y basis with a probability of $p_{y}=10\%$. Note that
random numbers are generated by Python’s module random and the cycle length is
10000. The radio frequency signals for modulation and clock signals of the
experimental system are produced by an arbitrary waveform generator with a
sampling rate of 2.5 Gs/s (Tabor Electronics, P2588B).

After the phase modulations, Alice (Bob) send pulses through a variable
optical attenuator before the Charlie’s beam splitter. The loss between Alice
(Bob) and Charlie is adjusted to simulate the loss of the communication
channel. Pulses from Alice and Bob interfere at the BS. One output of this BS
is detected by a single-photon detector D1 via the circulator, whereas the
other output is followed directly by D2. The experimental parameters include
the laser wavelength $\lambda=1550.14$ nm, total efficiencies of the optical
elements at the detection site, $\eta_{\rm det1}=75.3\%$ and $\eta_{\rm
det2}=86.1\%$, and detection efficiencies of the two detectors, $\eta_{\rm
D1}=88.0\%$ and $\eta_{\rm D2}=85.5\%$. $\eta_{\rm det1}$ consists of the
efficiencies of three main components: the beam splitter, circulator, and
polarization controller, whereas $\eta_{\rm det2}$ includes the beam splitter
and polarization controller. Generally, for $D_{1}$, the total detection
efficiency $\eta_{1}$ (considering the loss in Charlie) is $66.3\%$ and the
dark count rate $p_{d,1}$ is $1.6\times 10^{-8}$ (1.5 ns per time window). For
$D_{2}$, the detection efficiency $\eta_{2}$ is $73.6\%$ and the dark count
rate $p_{d,2}$ is $2.5\times 10^{-8}$ (1.5 ns per time window).

We measured and quantified four types of source flaws in this system:
imperfect intensity modulation, imperfect phase modulation, the extinction
ratio of polarization (side channels), and pattern effects (pulse
correlation). It should be noted that THAs cannot be quantified in this
implementation, which is a flaw in the plug-and-play system, and we set them
to $10^{-7}$ [62]. Imperfect intensity modulation is quantified by the optical
power fluctuation $\xi$ of the pulses sent, because there is no intensity
modulation in this protocol. Imperfect phase modulation can be quantitively
characterized by the deviation $\delta$ between the actual and expected
phases. For side channels $\theta$, we measured the the extinction ratio of
polarization ${\rm tan}\theta$ of the pulses when the system was running. The
pattern effects were quantified by the interference results of the same phases
under different patterns and 0 phase, which is denoted as $\psi$. All
parameters corresponding to those are introduced in Eq. (3). The results are
presented as follows. The five parameters related to the imperfection of
realistic sources included the optical power fluctuation $\xi=1.11\%$, the
extinction ratio of polarization tan$\theta=10^{-2.65}$, phase shift
$\delta=0.062$, pattern effect $\psi=8.54\times 10^{-3}$, and THAs
$\mu=10^{-7}$. Detailed descriptions of the derivation of these parameters are
provided in the Supplementary Material.

##  III Results

Figure 3: Key rate vs. the overall transmission loss. (a) When there are no
source flaws, we compare the performance of our protocol (violet line) with
that of two other protocols in Ref. [50] (red line) and Ref. [46] (blue line)
and the PLOB bound [38, 39] (black dotted line). An evident improvement in the
key rate indicates that our protocol outperformed the other two protocols. (b)
We applied the same parameter $\epsilon$ as in Ref. [50] to characterize
general side channels and depict the performance of secret key rates in both
our protocol and the protocol in Ref. [50] for different values of $\epsilon$
($0,~{}10^{-8},~{}10^{-7},~{}10^{-6},~{}10^{-5}$) using different colors.
Evidently, our protocol (solid lines) outperforms the protocol described in
Ref. [50] (dashed lines) with respect to key rate. With $\epsilon=10^{-5}$,
the orange solid line can still generate a secure key rate when the total loss
is 30 dB, whereas the orange dashed line can barely generate a secure key
rate. (c) Considering the experimental results, we depicted the secret key
rate when the total number of pulses sent by Alice or Bob $N=10^{10}$. The
filled symbols indicate the experimental results obtained for whether source
flaws were considered . The solid lines correspond to the theoretical
simulation results for our protocol, under different assumptions.

###  III.1 Simulation results

To evaluate the performance of our protocol theoretically and experimentally,
we simulate the secure key rates of our protocol in two different scenarios,
sharing one precondition that we only conduct simulations in the asymptotic
scenario. Specifically, we set the detector efficiency $\eta_{\rm d}=1$ and
the dark count rate $p_{\rm d}=10^{-8}$. The error correction efficiency $f$
was set to 1.16. The simulation results are shown in Fig. 3, respectively.

In the first scenario, shown in Fig. 3a, we only considered the ideal scenario
with no source flaws, which means that the parameters characterizing the
source flaws can easily be set to zero. For comparison, we also depict the key
rates of the two other side-channel-free protocols in Refs. [50] and [46]. The
simulation results clearly illustrate that, when the total attenuation
approaches 50 dB, only our protocol can generate secret keys. The final key
rate of our protocol cannot break the PLOB bound, which results from the
pessimistic assumption made in the GLLP analysis, where Eve is assumed to be
able to enhance the fidelity decay with the channel losses. For improving the
performance of our final key rate, the decoy state method [67, 68, 69] can be
applied, which is the key to overcome the PLOB bound in twin-field-type QKD
protocols [70]. However, with the same transmission loss, the key rate of our
protocol was approximately one order of magnitude higher than that of the
protocol in Ref. [50], and approximately two orders of magnitude higher than
that of the protocol in Ref. [46].

In the second scenario, as illustrated in Fig. 3b, we analyzed the security of
our protocol compared to that in Ref. [50], which generalizes all the side
channels to a single parameter, $\epsilon$. From the formula for the practical
secure key rate in Eq. (14), if we only consider the pulse correlation flaws
and set the other parameters to zero, $\epsilon$ can be converted into the
parameter introduced in Ref. [50] , which characterizes general side channels.
Based on this, we evaluated the key rate of our protocol for different degrees
of general side channels
($\epsilon=0,~{}10^{-8},~{}10^{-7},~{}10^{-6},~{}10^{-5}$). In Fig. 3b, when
$\epsilon$ increases, a decrease in the key rate can be observed both in our
study and in the protocol in Ref. [50], and a better performance can be
observed in our secret key rate with the same $\epsilon$. The performance of
our key rate means the decay of the fidelity causes the lower key rate and the
decay of the fidelity means the more deviation between the practical states
and the ideal states, which is why we consider the worst case of the fidelity
in our theoretical analysis and experimental implementation. Additionally, our
protocol can still generate a considerable secret key rate when
$\epsilon=10^{-5}$.

###  III.2 Experimental results

To demonstrate the advantages of our protocol when considering source flaws,
we implemented experiments under three values of channel losses between Alice
and Bob: 10, 16, and 20 dB, with the number of pulses sent by Alice (Bob)
$N=10^{10}$, as shown in Fig. 3c. We further performed experiments under
channel losses of 30 and 35 dB, with the assumption that the sources are
perfect. The shaded area between the blue and red lines shown in Fig. 3c is
unsafe and need to be considered seriously. The blue line can be reached by
rigorously narrowing the parameters in Eq. (3) to approximately 0. Considering
imperfect sources, our protocol can obtain secure key bits when the channel
loss is over 20 dB, which means that it can be implemented over 100 km using
existing technologies. The key rate of 253 bps we achieved under a channel
loss of 20 dB is the best result for the transmission distance and key rate
considering both source and detection imperfections. Under 10 dB ($\sim$50
km), the key rate of our protocol is over 90 kbps, whereas under 16 dB
($\sim$80 km), the key rate is over 9 kbps. Regardless of the source flaws, we
achieved a key rate of 29.2 bps with a channel loss of 35 dB. Detailed
experimental results are presented in Table 2. Although we cannot actually
demonstrate THAs in our experiment, a recent study focused on resisting THAs,
and its creative design of optical power limiters can also be applied in our
study against THAs [63]. In addition, despite the fact that optical fibers
were not used in the actual implementation and the two users were not
separated, as a proof-of-principle demonstration, we focused on the
feasibility of our protocol rather than aiming to establish a complete system
with all necessary hardware. Combined with the developed phase-locking and
phase-tracking technology in the implementation of twin-field QKD [33, 34, 35,
36, 37], our protocol containing two independent users can be directly
implemented in real optical fibers, which is illustrated in detail in the
Supplementary Material.

Table 2: Summary of experimental data. We tested the key rates for different channel losses. The table shows the number of pulses sent, the expected intensity of pulses $\mu^{\prime}=|\alpha|^{2}$, the number of detection events under corresponding bases, the experimental quantum bit error rates under the X basis and Y basis, the number of clicks under the X basis $S_{\rm X}^{\rm L}$, the key rate $R^{*}$ regardless of source flaws, and the key rate $R$ considering source flaws. [.5]() Loss (dB) | $N$ | $\mu^{\prime}$ |  $E_{\rm b}^{\rm X}$ $(\%)$ |  $E_{\rm b}^{\rm Y}$ $(\%)$ | $S_{\rm X}^{\rm L}$ | $R^{*}$ | $R$
---|---|---|---|---|---|---|---
[.5]() 10 | $10^{10}$ | 1.38$\times 10^{-2}$ | 0.23 | 0.36 | 49398692 | 1.41$\times 10^{-3}$ | 9.10$\times 10^{-4}$
[.5]() 16 | $10^{10}$ | 6.40$\times 10^{-3}$ | 0.23 | 0.38 | 11421107 | 3.00$\times 10^{-4}$ | 9.39$\times 10^{-5}$
[.5]() 20 | $10^{10}$ | 3.30$\times 10^{-3}$ | 0.22 | 0.36 | 3718173 | 1.02$\times 10^{-4}$ | 2.53$\times 10^{-6}$
[.5]() 30 | $10^{10}$ | 1.31$\times 10^{-3}$ | 0.27 | 0.42 | 464991 | 4.40$\times 10^{-6}$ | 0
[.5]() 35 | $10^{10}$ | 6.27$\times 10^{-4}$ | 0.33 | 0.57 | 124117 | 2.92$\times 10^{-7}$ | 0

##  IV Discussion and conclusion

Based on the fact that tremendous progress has been witnessed in the
deployment of QKD, practical secure QKD protocols are becoming an important
research direction in quantum communication since they are relevant for the
practical deployment of QKD. In this study, we adopt the RT method to
guarantee security of an FP-MDIQKD protocol using coherent states against
realistic flawed sources. We further demonstrate the feasibility of the
protocol through a proof-of-principle experimental implementation [24]. For
source flaws, we consider SPFs, side channels caused by mode dependencies,
THAs, and classical pulse correlations, which typically cover all possible
source imperfections that are currently observed in experimental
implementations. Although we only consider the special polarization side
channel and one special THA, we note that other similar side channels and THAs
can also be included in the calculation of fidelity with extra parameters.
However, actually, imperfections in side channel space, which are not
considered in our state representation and our calculation of fidelity, also
have influences on the fidelity and the experimental results, which is a
remaining problem for future study. In addition, we offer relations between
parameters characterizing source flaws and experimental data, and provide
specific implementations in our experiment on how to define and measure these
parameters, which can also be compatible to other types of potential source
flaws, which means higher practicality of our study in experimental and real-
life implementations. In addition, the simulation results show that our
protocol generates a higher secure key rate against source flaws than the
other QKD protocols in Refs. [50] and [46]). For experimental implementation,
we also present a finite-key analysis against coherent attacks.

Furthermore, we experimentally demonstrate our protocol using a plug-and-play
system. With perfect sources, our protocol can be demonstrated over 35 dB ,
which is a considerable improvement in the transmission distance in the realm
of practical secure QKD. By removing assumptions of the perfect source and
detection site, our protocol can still achieve a key rate of 253 bps with a 20
dB channel loss, which outperforms other experimental implementations of
practical secure QKD protocols. Besides, we also achieve key rates of 91.0 and
9.39 kbps at 10 and 16 dB, respectively. The transmission distance of our
protocol was constrained using five parameters relevant to imperfect sources.
However, these five parameters can be optimized. Thus, the key rate and
transmission distance of this protocol can be further improved. First, the
measurements of these parameters are limited by the accuracy and precision of
the devices. For example, the accuracy of the power meter measuring optical
power fluctuations is limited, and the power meter itself has jitters, which
may result in larger fluctuations. Additionally, the values of these
parameters can be further reduced using available technologies. More accurate
phase modulation can be achieved by using more phase modulators, which can
avoid nonlinear amplification of radio frequency signals. The extinction ratio
of polarization can be further improved by fusing optical fibers or by adding
a polarizer at the user’s site. With developed technologies, these parameters
will be closer to 0. Note that our scheme does not need to resort to immature
technologies such as entanglement or single-photon sources, which makes our
scheme more practical. Overall, our study further proves the feasibility of
secure QKD with arbitrary flawed devices, and holds the potential to be
applied to the future deployment of practical secure QKD.

## Conflict of interest

The authors declare that they have no conflict of interest.

## Acknowledgments

This study was supported by the Natural Science Foundation of Jiangsu Province
(BK20211145), the Fundamental Research Funds for the Central Universities
(020414380182), the Key Research and Development Program of Nanjing Jiangbei
New Aera (ZDYD20210101), the Program for Innovative Talents, and Entrepreneurs
in Jiangsu (JSSCRC2021484). We thank P. Liu and Y.-S. Lu for valuable
discussion and Y. Bao and S.-C. Huang for experimental assistance.

## Author contributions

Hua-Lei Yin and Zeng-Bing Chen supervised the study. Jie Gu and Hua-Lei Yin
built the theoretical model. Xiao-Yu Cao, Yao Fu, Zong-Wu He, Ze-Jie Yin, and
Hua-Lei Yin designed and performed the experiment. Jie Gu, Xiao-Yu Cao, Yao
Fu, and Hua-Lei Yin analyzed the experimental data. Jie Gu, Xiao-Yu Cao, and
Hua-Lei Yin co-wrote the manuscript with input from the other authors. All
authors have discussed the results and proofread the manuscript.

##  Appendix A Formula of the final key rate

In our four-phase measurement-device-independent QKD protocol, the classical
bits can be encoded through phase differences of coherent pulses from Alice
and Bob and the setting of the X and Y bases introduces the idea of ”quantum
coin” where we can introduce $\Delta$ as the imbalance of a quantum coin to
bound the information leakage. The imbalance $\Delta$ can be calculated
through the bounded fidelity discussed in the GLLP security proof [55, 56],
which can be naturally extended to the security analysis of the reference
technique [51]. In the ideal scenario with no source flaws, Alice’s entangled
basis-dependent states are expressed as

$\displaystyle\left|{\Psi_{\rm X}}\right\rangle_{\rm
Aa}=\frac{1}{\sqrt{2}}(\mathinner{|{0_{\rm X}}\rangle}_{\rm
A}\mathinner{|{\alpha}\rangle}_{\rm a}+\mathinner{|{1_{\rm X}}\rangle}_{\rm
A}\mathinner{|{-\alpha}\rangle}_{\rm a}),$ (17) $\displaystyle\left|{\Psi_{\rm
Y}}\right\rangle_{\rm Aa}=\frac{1}{\sqrt{2}}(\mathinner{|{1_{\rm
Y}}\rangle}_{\rm A}\mathinner{|{i\alpha}\rangle}_{\rm a}+\mathinner{|{0_{\rm
Y}}\rangle}_{\rm A}\mathinner{|{-i\alpha}\rangle}_{\rm a}),$

where $\\{\mathinner{|{0_{\rm X}}\rangle},\mathinner{|{1_{\rm X}}\rangle}\\}$
are eigenstates of the Pauli operator $\sigma_{x}$ and $\\{\mathinner{|{0_{\rm
Y}}\rangle},\mathinner{|{1_{\rm Y}}\rangle}\\}$ are eigenstates of the Pauli
operator $\sigma_{y}$. The same equations of Bob’s entangled basis-dependent
states can be obtained in the similar expressions with the system B denoting
the virtual qubit space and the system b representing the actual space of
coherent pulses. Here, the basis-dependence of Alice’s (Bob’s) entangled
states can be related to an equivalent virtual protocol considering the
balance of a quantum coin [55], where Alice (Bob) measures the coin in the Z
basis to determine the basis choice. Here the basis-dependent states can be
expressed as $\left|{\Psi_{\rm X}}\right\rangle$ and $\left|{\Psi_{\rm
Y}}\right\rangle$ without distinguishing the sender. The joint state can be
taken to be

$\displaystyle\left|{\Phi}\right\rangle=\sqrt{p_{x}}\mathinner{|{0_{\rm
Z}}\rangle}\left|{\Psi_{\rm X}}\right\rangle+\sqrt{p_{y}}\mathinner{|{1_{\rm
Z}}\rangle}\left|{\Psi_{\rm Y}}\right\rangle,$ (18)

where $p_{x}$ and $p_{y}$ separately represent the probabilities of sending
states in the X basis and the Y basis. Note that we assume the measurement of
the quantum coin will be delayed after Charlie has finished her measurement
and eavesdropping. The final key rate of this protocol is

$R=Q^{x}[1-fH(E_{\rm b}^{x})-H(E_{\rm p})],$ (19)

where $Q^{x}=(1-p_{\rm d})[1-(1-2p_{\rm d})e^{-2\eta|\alpha|^{2}}]$ and
$E_{\rm b}^{x}Q^{x}=e_{\rm d_{x}}(1-p_{\rm d})[1-(1-p_{\rm
d})e^{-2\eta|\alpha|^{2}}]+(1-e_{\rm d_{x}})p_{\rm d}(1-p_{\rm
d})e^{-2\eta|\alpha|^{2}}$. $Q^{x}$ is the gain in the X basis and $E_{\rm
b}^{x}$ means the bit error rate under the X basis. $e_{\rm d_{x}}$ means the
misalignment error rate in the X basis of the four-phase measurement-device-
independent QKD system. The total efficiency is $\eta$ and we use
$|\alpha|^{2}$ to express the intensity of weak coherent states. $E_{\rm p}$
represents the phase error rate under the X basis, which is bounded by
$\Delta$ and the bit error rate in the Y basis $E_{\rm b}^{y}$. The equation
of $E_{\rm b}^{y}$ is similar to that of $E_{\rm b}^{x}$ with its separate
misalignment error rate $e_{\rm d_{y}}$ that $E_{\rm b}^{y}Q=e_{\rm
d_{y}}(1-p_{\rm d})[1-(1-p_{\rm d})e^{-2\eta|\alpha|^{2}}]+(1-e_{\rm
d_{y}})p_{\rm d}(1-p_{\rm d})e^{-2\eta|\alpha|^{2}}$. Here for simulation, we
just consider the situation that $E_{\rm b}^{y}$ is equal to $E_{\rm b}^{x}$
since we set the misalignment error rates to be 0 without the finite-key
analysis. Note that $E_{\rm b}^{y}$ is not rigorously equal to $E_{\rm b}^{x}$
in the practical scenario since $e_{\rm d_{y}}$ evidently differs from $e_{\rm
d_{x}}$ in experiment. $\eta=\eta_{\rm d}\times 10^{-L/20}$, where $L$ $({\rm
dB})$ is the total attenuation of the channel.
Based on the fact that our protocol considers an biased basis choice, we
provide the relation between the phase error rate in the X basis $E_{\rm p}$
and the bit error rate in the Y basis $E_{\rm b}^{y}$. According to the
procedure of our protocol, the simplified entangled state shared by Alice and
Bob in two bases can be expressed as

$\displaystyle\left|{X}\right\rangle=\left|{\Psi_{\rm X}}\right\rangle_{\rm
Aa}\left|{\Psi_{\rm X}}\right\rangle_{\rm Bb},$ (20)
$\displaystyle\left|{Y}\right\rangle=\left|{\Psi_{\rm Y}}\right\rangle_{\rm
Aa}\left|{\Psi_{\rm Y}}\right\rangle_{\rm Bb},$

where we denote regardless of the measurement result of Charlie. We introduce
the error operator by Alice and Bob, $E_{\rm AB}^{y}=\left|{0_{\rm Y}1_{\rm
Y}}\right\rangle_{\rm AB}\left\langle{0_{\rm Y}1_{\rm Y}}\right|+\left|{1_{\rm
Y}0_{\rm Y}}\right\rangle_{\rm AB}\left\langle{1_{\rm Y}0_{\rm Y}}\right|$.
The phase error rate of the $X$ basis and the bit error rate of the Y basis
are defined as

$\displaystyle E_{\rm p}$
$\displaystyle=\left\langle{X}\right|M_{ab}^{{\dagger}}E_{\rm
AB}^{y}M_{ab}\left|{X}\right\rangle,$ (21) $\displaystyle E_{\rm b}^{y}$
$\displaystyle=\left\langle{Y}\right|M_{ab}^{{\dagger}}E_{\rm
AB}^{y}M_{ab}\left|{Y}\right\rangle,$

where $M_{ab}$ is the Kraus operator corresponding to the announcement of
Charlie. Note that the normalization has been assumed. Similar with the method
in Ref. [45], we have

$\displaystyle E_{\rm p}=$
$\displaystyle|\left\langle{X}|{Y}\right\rangle|^{2}\left\langle{Y}\right|\mathbf{E}\left|{Y}\right\rangle+|\left\langle{X}|{Y^{\bot}}\right\rangle|^{2}\left\langle{Y^{\bot}}\right|\mathbf{E}\left|{Y^{\bot}}\right\rangle$
(22)
$\displaystyle+\left\langle{X}|{Y}\right\rangle\left\langle{X}|{Y^{\bot}}\right\rangle(\left\langle{Y}\right|\mathbf{E}\left|{Y^{\bot}}\right\rangle+\left\langle{Y^{\bot}}\right|\mathbf{E}\left|{Y}\right\rangle),$

where we let $\mathbf{E}=M_{ab}^{{\dagger}}E_{\rm AB}^{y}M_{ab}$ and use the
fact that
$I=\mathinner{|{Y}\rangle}\mathinner{\langle{Y}|}+\mathinner{|{Y^{\bot}}\rangle}\mathinner{\langle{Y^{\bot}}|}$.
The fidelity of quantum states can be expressed as
$1-2\Delta^{\prime}=\left\langle{X}|{Y}\right\rangle=|\left\langle{\Psi_{\rm
X}}|{\Psi_{\rm Y}}\right\rangle|^{2}$. Eve can enhance the source flaws by
exploiting the loss of channel, which means that we should have the the worst
situation $\Delta=\Delta^{\prime}/Q$ [55]. Therefore, we can obtian the
relation between $E_{\rm b}^{y}$ and $\Delta$,

$1-2\Delta\leq\sqrt{E_{\rm b}^{y}E_{\rm p}}+\sqrt{(1-E_{\rm b}^{y})(1-E_{\rm
p})}.$ (23)

##  Appendix B Finite-key analysis for the experimental implementation

Here we provide the specific expression of the finite-key analysis for the
experiment of our protocol. The number of final key bits $l$ has been
expressed as

$\displaystyle l=n_{x}\Bigg{[}1$ $\displaystyle-H(\overline{E}_{\rm p})-{\rm
leak}_{\rm EC}$ (24) $\displaystyle-\frac{1}{n_{x}}{\rm
log}_{2}\frac{2}{\epsilon_{\rm c}}-\frac{1}{n_{x}}{\rm
log}_{2}\frac{1}{4\epsilon^{2}_{\rm PA}}\Bigg{]},$

which is $\epsilon_{\rm c}-{\rm correct}$ and $\epsilon_{\rm s}-{\rm secure}$,
with $\epsilon_{\rm s}=\sqrt{\epsilon_{\rm F}}+\epsilon_{\rm PA}$ [61]. We
directly offer $n_{x}$ through the experiment, together with $E_{\rm b}^{\rm
X}$ in the formula of ${\rm leak}_{\rm EC}$. Based on Eq. (S7), we have to
consider the statistical fluctuation when calculating the bit error rate in
the Y basis $E_{\rm b}^{\rm Y}$ and estimating the phase error rate
considering eavesdroppers’ coherent attacks. Here, we adopt the concentration
inequality introduced in Ref. [71, 61] to guarantee security against coherent
attacks when we bound the deviation between a sum of correlated random
variables and its expected value.

Let $\xi_{1},...,\xi_{n}$ be a sequence of Bernoulli random variables which
are dependent and let $\Lambda_{j}=\sum_{u=1}^{j}\xi_{u}$. We denote
$\mathcal{F}_{j}$ to be its natural filtration, which is the $\sigma$-algebra
generated by $\\{\xi_{1},...,\xi_{n}\\}$. Based on the conclusions in Ref.
[71, 61], we obtain that for any $b\geq 0$

$\displaystyle{\rm Pr}\left[\Lambda_{n}-\sum_{u=1}^{n}{\rm
Pr}(\xi_{u}=1|\mathcal{F}_{u-1})\geq b\sqrt{n}\right]\leq{\rm exp}[-2b^{2}],$
(25) $\displaystyle{\rm Pr}\left[\sum_{u=1}^{n}{\rm
Pr}(\xi_{u}=1|\mathcal{F}_{u-1})\geq b\sqrt{n}-\Lambda_{n}\right]\leq{\rm
exp}[-2b^{2}].$

By equating the right hand of Eq. (S9) to be $\epsilon_{\rm F}$ and solving
for $b$, we have that

$\displaystyle\sum_{u=1}^{n}{\rm
Pr}(\xi_{u}=1|\xi_{1},...,\xi_{u-1})\leq\Lambda_{n}+\Delta_{c},$ (26)
$\displaystyle\Lambda_{n}\leq\sum_{u=1}^{n}{\rm
Pr}(\xi_{u}=1|\xi_{1},...,\xi_{u-1})+\Delta_{c},$

where $\Delta_{c}=\sqrt{\frac{1}{2}n{\rm ln}\epsilon_{\rm F}^{-1}}$ and each
of the bounds in Eq. (S10) fail with probability at most $\epsilon_{\rm F}$.
Eq. (S10) is the simple bound of the concentration inequality but it is
sufficiently tight for all opponents in our protocol. The concentration
inequality [71] here is tighter than the widely applied Azuma’s inequality
[72] to guarantee security against coherent attacks when random variables are
correlated and the encoding bases are not mutually unbiased [61]. Then we will
present how to derive the upper bound $\overline{E}_{\rm p}$. First, we set
$n_{y}$ and $m_{y}$ to be the number of efficient outcomes and the number of
bit errors in the Y basis, which is obtained through the experiment. We derive
an upper bound of the expectation value of the number of bit errors in the Y
basis $m_{y}^{*}$. The upper bound of the expected bit error rate in the Y
basis is ${E_{\rm b}^{y}}^{*}=m_{y}^{*}/n_{y}$, which can be used to calculate
the upper bound of the expected value of the phase error rate in the X basis
$E_{\rm p}^{*}$. Then the number of phase errors is obtained in the form of
$m_{\rm p}^{*}=n_{x}E_{\rm p}^{*}$. We then estimate the upper bound of the
observed number of phase errors in the X basis $\overline{m}_{\rm p}$ through
the concentration inequality. Then $\overline{E}_{\rm p}$ can be naturally
calculated with $\overline{E}_{\rm p}=\overline{m}_{\rm p}/n_{x}$. According
to the experimental results, formulas in Eq. (S10) is sufficiently tight for
generating considerable final key rate in the finite-key regime so we just
introduce the simple bound in Ref. [61]. Without loss of generality, we set
$\epsilon_{\rm c}=\epsilon_{\rm PA}=\epsilon_{\rm F}=10^{-10}$.

##  Appendix C Experimental details on derivation of parameters characterizing
source flaws

###  C.1 Optical power fluctuation

Imperfect intensity modulation can be quantitively characterized by the
fluctuation of optical power over a period of time. We test it by the optical
power meter. Due to the limited range of power meter, we divide the
fluctuation into two parts, the source fluctuation and the path fluctuation.
For the source part, we directly measured the optical power of the laser
source with a 40 dB attenuation. The laser source is a homemade pulsed laser
and Field Programmable Gate Array (FPGA) is used as the logic control of our
laser source and to send laser drive signals. Since the circulator and beam
splitters used in the system are fast-axis blocked, changes in polarization
bring about fluctuations in intensity. Consequently, we measured the intensity
of pulses sent by Alice with an appropriate attenuation to make the intensity
around -70 dBm while the phase modulations are carried on. Besides, VOA also
causes optical power fluctuation, so we add an additional attenuation each to
the measurement of the fluctuation of path and source, which means the
intensity of these pulses is lower than the minimum optical power (-103.7 dBm)
we sent when considering source flaws. Since the time of conducting one round
of QKD is 100 seconds, we denote the difference between the maximum and
minimum value of optical power in 100 seconds as the value of fluctuation. As
shown in Fig. S1, the upper bound of optical power fluctuation in 1000 seconds
is 1.11%, which is the sum of source and path fluctuation.

Figure 4: Optical power fluctuation. We divide the fluctuation into two parts,
the source fluctuation and the path fluctuation. The optical power of pulses
is measured once every 100 ms and we measure the fluctuation for 1000 seconds.
Red line reflects the fluctuation of the source and the maximum difference
within 100 s is 0.008 dB. While the blue line reflects the fluctuation of the
path and the maximum value is 0.04 dB. Consequently, the total fluctuation is
0.048 dB ($1\pm 0.0111$). Consider the worst case, the optical power
fluctuation is 1.11%.

###  C.2 Phase shift

We quantify the modulation error $\delta$ in the source through calibrating
Alice’s PM, in the plug-and-play QKD system. $\delta_{\phi}$ is defined as the
difference between the actual phase and the expected phase $\phi$. In our
protocol, we need to modulate 4 phases $\phi\in\\{0,\pi/2,\pi,3\pi/2\\}$.
Similar to Ref. [73], only Alice performs phase modulation and Bob sets his
own PM at a fixed unmodulated phase 0. Note that the experimental setup here
is the same as that used to demonstrate the QKD protocol. Alice and Bob are
connected with a one-metre-long polarization maintained fiber. Alice scans the
voltages applied to her PM according to the random phase selection in the
experiment and the intensity of these pulses is 0.001. Charlie records the
clicks for 100 seconds. Based on the phase selection, we can obtain the number
of clicks for different phases and these counts are denoted by $D_{1}^{\phi}$
and $D_{2}^{\phi}$. For $D_{1}$, the total detection efficiency $\eta_{1}$
(considering the loss in Charlie) is $66.3\%$ and the dark count rate
$p_{d,1}$ is $1.6\times 10^{-8}$. For $D_{2}$, the detection efficiency
$\eta_{2}$ is $73.6\%$ and the dark count rate $p_{d,2}$ is $2.5\times
10^{-8}$. Since the dark count rates of two detectors are at the level of
$10^{-8}$, dark counts have little influence on the computation and are
ignored in the computation. The detailed experimental data can be seen in
Table S1. The function generator used is P25588B (Tabor Electronics) with
16-bit depth. The electrical drivers used are DR-VE-10-MO (iXblue) and PMs are
PM-5S5-10-PFA-UV (Eospace). In our data analysis, we use Hoeffding’s
inequality [74]. The upper bound of $\delta_{\phi}$ is given by Eq. (27). For
$\phi\in\\{\pi/2,\pi\\}$, $\phi_{0}=\phi$ and for $\phi=3\pi/2$,
$\phi_{0}=\phi-\pi$. Consequently, The error $\delta$ is upper bounded by the
case of $\overline{\delta}_{\pi}=0.062$. Note that for statistical analysis,
we only choose an appropriate time window without any other data processing,
whose length is 2 ns.

Table 3: Upper bounds of different phases. The number of clicks detected by $D_{1}$ and $D_{2}$ under different phases and their upper bound $\overline{\delta}_{\phi}$. [.5]() $\phi$ |  $D_{1,\phi}$ |  $D_{2,\phi}$ |  $\overline{\delta}_{\phi}$
---|---|---|---
0 |  5956406 |  1269 |  -
$\pi/2$ |  343663 |  376778 |  $0.012$
$\pi$ |  6627 |  6597672 |  $0.062$
$3\pi/2$ |  333491 |  367139 |  $0.010$
$\overline{\delta}_{\phi}={\rm max}\left\\{\left|\phi_{0}-2{\rm
arctan}\sqrt{\frac{(\overline{D}_{2,\phi}^{*}-\underline{D}_{2,0}^{*})/\eta_{2}}{(\underline{D}_{1,\phi}^{*}-\overline{D}_{2,0}^{*})/\eta_{1}}}\right|,\left|\phi_{0}-2{\rm
arctan}\sqrt{\frac{(\underline{D}_{2,\phi}^{*}-\overline{D}_{2,0}^{*})/\eta_{2}}{(\overline{D}_{1,\phi}^{*}-\underline{D}_{2,0}^{*})/\eta_{1}}}\right|\right\\}.$
(27)

###  C.3 Extinction ratio of polarization

Figure 5: The experimental setup for measuring the extinction ratio of
polarization. The setup is similar to our plug-and-play system. A PBS
(polarization beam splitter) is placed at the exit of a sending site. Two
ports of the PBS are connected to the power meter and the optical power of
fast-axis and slow axis can be obtained. Consequently, the relationship
between the extinction ratio of pulse polarization and time can be acquired.

Since Eve could distinguish signals from the polarization information of each
state, we quantify this situation by measuring the extinction ratio of
polarization in the plug-and-play system. We put a polarization beam splitter
(PBS) at Alice’s site to obtain the the extinction ratio of polarization of
the pulses Alice sent, which is the ratio of fast-axis optical power to slow-
axis optical power. The specific quantum states are shown as

$\displaystyle\mathinner{|{\alpha_{0}^{\prime}}\rangle}=\rm
cos\theta_{0}\mathinner{|{\alpha_{0}}\rangle}_{\rm H}+\rm
sin\theta_{0}\mathinner{|{\alpha_{0}}\rangle}_{\rm V},$ (28)
$\displaystyle\mathinner{|{\alpha_{1}^{\prime}}\rangle}=\rm
cos\theta_{1}\mathinner{|{-e^{i\delta_{1}}\alpha_{1}}\rangle}_{\rm H}+\rm
sin\theta_{1}\mathinner{|{-e^{i\delta_{1}}\alpha_{1}}\rangle}_{\rm V},$
$\displaystyle\mathinner{|{\alpha_{2}^{\prime}}\rangle}=\rm
cos\theta_{2}\mathinner{|{ie^{i\delta_{2}}\alpha_{2}}\rangle}_{\rm H}+\rm
sin\theta_{2}\mathinner{|{ie^{i\delta_{2}}\alpha_{2}}\rangle}_{\rm V},$
$\displaystyle\mathinner{|{\alpha_{3}^{\prime}}\rangle}=\rm
cos\theta_{3}\mathinner{|{-ie^{i\delta_{3}}\alpha_{3}}\rangle}_{\rm H}+\rm
sin\theta_{3}\mathinner{|{-ie^{i\delta_{3}}\alpha_{3}}\rangle}_{\rm V}.$

Consequently, we denote the extinction ratio of polarization of pulses as
${\rm tan}\theta$. We decrease the attenuation and the optical power of pulses
in the Sagnac loop is about -20 dBm. We use a power meter to measure the
optical power at both ports of the PBS. We measured the optical power once
every 100 ms and tested it for 1000 seconds. As shown in Fig. S3, the blue
points mean the ratio of slow-axis to fast-axis and the minimum value is still
over 26.5 dB. As we only need 100 seconds to perform a round of measurement,
the ratio can be easily maintained above 26.5 dB.

Figure 6: The extinction ratio of pulse polarization versus time. We measured
the extinction ratio of polarization of Alice’s and Bob’s pulses by a
polarization beam splitter (PBS) for 1000 seconds while our system considering
realistic sources, only runs for 100 seconds. Its value is always above 26.5
dB.

###  C.4 Pattern effect

Practical electro-optic modulators and electrical drivers are band limited,
which results in state correlation between the optical pulses as well as
intensity fluctuation of individual pulses. Pulse correlation is particularly
critical for the security since current security analysis usually assumes
independent and identically distributed pulses. In this experiment, we do not
need to modulate different intensities and we only need to quantify the phase
correlation. The experimental structure is same as that used for measuring
phase shift. Here we only consider the influences of pattern effects limited
to the adjacent pulses [60]. Consequently, for four phases, sixteen patterns
exist. We quantified the phase correlation by measuring the intensities under
different patterns. Bob’s PM is set at an unmodulated phase 0 and Alice
modulates each pattern with equal probability. The modulated pulses and
unmodulated pulses interfere at BS and the results are measured by D1 and D2
with detection efficiencies of 66.3% and 73.6%. Denote phase 0 as $S_{1}$,
phase $\pi/2$ as $S_{2}$, phase $\pi$ as $S_{3}$ and phase $3\pi/2$ as
$S_{4}$. The pattern effects of phase 0 and $\pi/2$ are given by D1’s
detection results while the pattern effects of phase $\pi$ and $3\pi/2$ are
given by D2’s detection results. As shown in Table S2, the maximum value, or
say sin$\psi$, is $8.54\times 10^{-3}$. Note that here we only measured the
deviation from average values while theoretically we should measure the
largest intensity deviation of individual pulses in each pattern. It is a
remaining problem for future study.

Table 4: Detection clicks of pulses with different phases for sixteen types of predecessors.  Pattern |  Counts of |  deviation from
---|---|---
|  second pulse |  average value
$S_{1}\rightarrow S_{1}$ |  411665 |  $1.54\times 10^{-3}$
$S_{2}\rightarrow S_{1}$ |  412610 |  $7.52\times 10^{-4}$
$S_{3}\rightarrow S_{1}$ |  411939 |  $8.76\times 10^{-4}$
$S_{4}\rightarrow S_{1}$ |  412986 |  $1.66\times 10^{-3}$
$S_{1}\rightarrow S_{2}$ |  206867 |  $5.61\times 10^{-4}$
$S_{2}\rightarrow S_{2}$ |  208191 |  $6.96\times 10^{-3}$
$S_{3}\rightarrow S_{2}$ |  206554 |  $8.08\times 10^{-4}$
$S_{4}\rightarrow S_{2}$ |  205362 |  $6.72\times 10^{-3}$
$S_{1}\rightarrow S_{3}$ |  455404 |  $2.93\times 10^{-3}$
$S_{2}\rightarrow S_{3}$ |  454520 |  $9.83\times 10^{-4}$
$S_{3}\rightarrow S_{3}$ |  452736 |  $2.95\times 10^{-3}$
$S_{4}\rightarrow S_{3}$ |  453635 |  $9.66\times 10^{-4}$
$S_{1}\rightarrow S_{4}$ |  227822 |  $6.37\times 10^{-3}$
$S_{2}\rightarrow S_{4}$ |  227191 |  $3.58\times 10^{-3}$
$S_{3}\rightarrow S_{4}$ |  226059 |  $1.42\times 10^{-3}$
$S_{4}\rightarrow S_{4}$ |  224446 |  $8.54\times 10^{-3}$

##  Appendix D Scheme with independent lasers

We extend the plug-and-play system to a scheme with independent lasers in this
part. As shown in Fig. S4, this system includes two independent users and an
untrusted intermediate node.

Figure 7: Experimental setup of two independent users. The phase-modulated
pulses are generated by light sources without phase modulators. The light
source consists of a phase-preparation laser (PP-Laser) and a pulse-generation
laser (PG-Laser). PG-Laser is connected to PP-Laser via an optical circulator
(CIR). Bob owns an optical phase-locked loop (OPLL) to lock his PP-Laser to
Alice’s PP-Laser. After traveling through quantum channels, Alice’s and Bob’s
encoded pulses interfere with each other on Charlie’s beam splitters (BS), and
are finally detected by two superconducting nanowire single-photon detectors,
D1 and D2. EPC, electrical polarization controller; VOA, variable optical
attenuator; PC, polarization controller; PM, phase modulator.

The phase-modulated pulses are directly generated employing the idea of
optical injection [75, 76], which has been proven to effectively remove the
need for a phase modulator. Additionally, without multi-intensity modulation,
our scheme does not need an intensity modulator. Consequently, Eve cannot get
any information about phase modulation and intensity modulation from the
backscattered light and thus this scheme can resist Trojan horse attacks. As
shown in Fig. S4, Alice’s (Bob) laser source is made up with a phase-
preparation laser (PP-Laser) and a pulse-generation laser (PG-Laser). Two
laser diodes are connected with an optical circulator. PP-Laser acts as a
master laser and PG-Laser acts as a slave laser. PP-Laser is always biased
over its threshold to generate continuous-wave light. PG-Laser is gain-
switched corresponding with modulation signals applied to PP-Laser for
avoiding side effects and sends pulses inheriting the phase prepared by PP-
Laser. By introducing perturbations in the driving signal of PP-Laser, the
relative phase between two secondary pulses can be set to an arbitrary value.
To illustrate this point more specifically, consider a continuous wave laser
above threshold with the central frequency $\nu_{0}$. When applying a
perturbation on the driving signal, the optical frequency shifts by
$\Delta\nu$. The signal duration is $t_{0}$. After $t_{0}$, the frequency is
restored to the initial value. The phase difference caused by this signal is
$2\pi\Delta\nu t_{0}$. Bob locks his PP-Laser to Alice’s PP-Laser by utilizing
an optical phase-locked loop (OPLL). The modulated optical pulses are then
attenuated to the single-photon level by a variable optical attenuator and
their intensities are monitored by detectors. A polarizer is used to improve
the polarization extinction ratio of pulses sent.
After traveling through optical fibers, Alice’s and Bob’s pulses interfere
with each other on Charlie’s BS. Two polarization controllers (PCs) are used
to modify the polarization of the incident pulses to achieve the maximum
detection efficiencies. One feedback phase modulator (PM) is added in the path
from Alice to Charlie’s BS to compensate for the relative phase drift
introduced by fiber channels.The interference results are finally detected by
two superconducting single-photon detectors, D1 and D2.
Since our protocol does not need intensity modulation, this scheme removes the
need for electro-optic modulators and electrical drivers, simplifying the
experiment. Here, we propose a scheme that two independent parties share
secure keys considering source flaws with developed technology, which can be
widely implemented in the approaching quantum networks.

##  Appendix E Experimental results

Table 5: Efficiencies of measurement station. Optical devices |  Attenuation
---|---
CIR 2$\rightarrow$3 |  0.62 dB
BS-1 |  0.45 dB
BS-2 |  0.47 dB
PC-1 |  0.16 dB
PC-2 |  0.18 dB
Table 6: Experimental results obtained under different losses. [.5]() Channel loss | 10 dB | 16 dB | 20 dB | 30 dB | 35 dB
---|---|---|---|---|---
[.5]() N | $10^{10}$ | $10^{10}$ | $10^{10}$ | $10^{10}$ | $10^{10}$
[.5]() $E_{p}^{*}$ | 18.4% | 19.4% | 19.0% | 29.4% | 35.5%
[.5]() $E_{p}$ | 23.7% | 30.8% | 39.3% | 50.0% | 50.0%
[.5]() Detected 00 (D1) | 11697938 | 2700313 | 882175 | 108166 | 29340
[.5]() Detected 0$\pi$ (D1) | 36848 | 9031 | 2703 | 261 | 113
[.5]() Detected $\pi$0 (D1) | 23186 | 6897 | 1994 | 319 | 73
[.5]() Detected $\pi\pi$ (D1) | 11633036 | 2699790 | 882851 | 108459 | 29303
[.5]() Detected $\frac{\pi}{2}\frac{\pi}{2}$ (D1) | 143957 | 33188 | 10872 | 1773 | 472
[.5]() Detected $\frac{\pi}{2}\frac{3\pi}{2}$ (D1) | 491 | 108 | 35 | 5 | 3
[.5]() Detected $\frac{3\pi}{2}\frac{\pi}{2}$ (D1) | 603 | 162 | 45 | 8 | 3
[.5]() Detected $\frac{3\pi}{2}\frac{3\pi}{2}$ (D1) | 143048 | 33308 | 10766 | 1284 | 331
[.5]() Detected 00 (D2) | 7516 | 1693 | 570 | 106 | 65
[.5]() Detected 0$\pi$ (D2) | 12982085 | 2998179 | 973757 | 121242 | 31961
[.5]() Detected $\pi$0 (D2) | 12973080 | 2996549 | 971129 | 125848 | 33099
[.5]() Detected $\pi\pi$ (D2) | 45002 | 8655 | 2994 | 590 | 163
[.5]() Detected $\frac{\pi}{2}\frac{\pi}{2}$ (D2) | 347 | 60 | 20 | 4 | 1
[.5]() Detected $\frac{\pi}{2}\frac{3\pi}{2}$ (D2) | 167242 | 38832 | 12464 | 1543 | 408
[.5]() Detected $\frac{3\pi}{2}\frac{\pi}{2}$ (D2) | 167263 | 38658 | 12650 | 1348 | 346
[.5]() Detected $\frac{3\pi}{2}\frac{3\pi}{2}$ (D2) | 823 | 216 | 71 | 8 | 2

We summarized the optical element transmittance in Table S3. The optical
elements include the polarization controllers (PCs), circulator (CIR), and the
beam splitter (BS). The results are given for each output (D1/D2) as
appropriate.
The experimental results are summarized in Table S4, the total pulses sent in
the experiment N, the phase error rate regardless the source flaws $E_{\rm
P}^{*}$, the phase error rate considering the source flaws $E_{\rm P}$, the
number of detected pulses is labeled as “Detected-AB (Di)”, where “A” (“B”)
means an A (B) phase was added on the pulses by Alice (Bob) and detected by
Di, i $\in\\{1,2\\}$. For 30 dB and 35 dB, the key rates are 0 and $E_{\rm
P}=50\%$.

## References

  * [1] Bennett CH, Brassard G.  Quantum cryptography: public key distribution and coin tossing.  Theor Comput Sci 2014;560:7–11.
  * [2] Ekert AK.  Quantum cryptography based on Bell’s theorem.  Phys Rev Lett 1991;67:661–663.
  * [3] Xu F, Ma X, Zhang Q, et al.  Secure quantum key distribution with realistic devices.  Rev Mod Phys 2020;92:025002.
  * [4] Pirandola S, Andersen UL, Banchi L, et al.  Advances in quantum cryptography.  Adv Opt Photon 2020;12:1012–1236.
  * [5] Lydersen L, Wiechers C, Wittmann C, et al.  Hacking commercial quantum cryptography systems by tailored bright illumination.  Nat Photon 2010;4:686–689.
  * [6] Tang YL, Yin HL, Ma X, et al.  Source attack of decoy-state quantum key distribution using phase information.  Phys Rev A 2013;88:022308.
  * [7] Xu F, Qi B, Lo HK.  Experimental demonstration of phase-remapping attack in a practical quantum key distribution system.  New J Phys 2010;12:113026.
  * [8] Huang A, Navarrete A, Sun SH, et al.  Laser-seeding attack in quantum key distribution.  Phys Rev Applied 2019;12:064043.
  * [9] Acín A, Brunner N, Gisin N, et al.  Device-independent security of quantum cryptography against collective attacks.  Phys Rev Lett 2007;98:230501.
  * [10] Hensen B, Bernien H, Dréau AE, et al.  Loophole-free Bell inequality violation using electron spins separated by 1.3 kilometres.  Nature 2015;526:682–686.
  * [11] Shalm LK, Meyer-Scott E, Christensen BG, et al.  Strong loophole-free test of local realism.  Phys Rev Lett 2015;115:250402.
  * [12] Giustina M, Versteegh MAM, Wengerowsky S, et al.  Significant-loophole-free test of Bell’s theorem with entangled photons.  Phys Rev Lett 2015;115:250401.
  * [13] Nadlinger DP, Drmota P, Nichol BC, et al.  Experimental quantum key distribution certified by Bell’s theorem.  Nature 2022;607:682–686.
  * [14] Zhang W, van Leent T, Redeker K, et al.  A device-independent quantum key distribution system for distant users.  Nature 2022;607:687–691.
  * [15] Liu WZ, Zhang YZ, Zhen YZ, et al.  Toward a photonic demonstration of device-independent quantum key distribution.  Phys Rev Lett 2022;129:050502.
  * [16] Zhang C, Hu XL, Jiang C, et al.  Experimental side-channel-secure quantum key distribution.  Phys Rev Lett 2022;128:190503.
  * [17] Farkas M, Balanzó-Juandó M, Łukanowski K, et al.  Bell nonlocality is not sufficient for the security of standard device-independent quantum key distribution protocols.  Phys Rev Lett 2021;127:050503.
  * [18] Lo HK, Curty M, Qi B.  Measurement-device-independent quantum key distribution.  Phys Rev Lett 2012;108:130503.
  * [19] Braunstein SL, Pirandola S.  Side-channel-free quantum key distribution.  Phys Rev Lett 2012;108:130502.
  * [20] Wang XB.  Three-intensity decoy-state method for device-independent quantum key distribution with basis-dependent errors.  Phys Rev A 2013;87:012320.
  * [21] Curty M, Xu F, Cui W, et al.  Finite-key analysis for measurement-device-independent quantum key distribution.  Nat Commun 2014;5:3732.
  * [22] Xu F, Xu H, Lo HK.  Protocol choice and parameter optimization in decoy-state measurement-device-independent quantum key distribution.  Phys Rev A 2014;89:052333.
  * [23] Yu ZW, Zhou YH, Wang XB.  Statistical fluctuation analysis for measurement-device-independent quantum key distribution with three-intensity decoy-state method.  Phys Rev A 2015;91:032318.
  * [24] Lucamarini M, Yuan ZL, Dynes JF, et al.  Overcoming the rate–distance limit of quantum key distribution without quantum repeaters.  Nature 2018;557:400–403.
  * [25] Rubenok A, Slater JA, Chan P, et al.  Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks.  Phys Rev Lett 2013;111:130501.
  * [26] Tang YL, Yin HL, Chen SJ, et al.  Measurement-device-independent quantum key distribution over 200 km.  Phys Rev Lett 2014;113:190501.
  * [27] Wang C, Song XT, Yin ZQ, et al.  Phase-reference-free experiment of measurement-device-independent quantum key distribution.  Phys Rev Lett 2015;115:160502.
  * [28] Zhou YH, Yu ZW, Wang XB.  Making the decoy-state measurement-device-independent quantum key distribution practically useful.  Phys Rev A 2016;93:042324.
  * [29] Tang Z, Liao Z, Xu F, et al.  Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution.  Phys Rev Lett 2014;112:190503.
  * [30] Comandar LC, Lucamarini M, Fröhlich B, et al.  Quantum key distribution without detector vulnerabilities using optically seeded lasers.  Nat Photon 2016;10:312–315.
  * [31] Zheng X, Zhang P, Ge R, et al.  Heterogeneously integrated, superconducting silicon-photonic platform for measurement-device-independent quantum key distribution.  Adv Photon 2021;3:055002.
  * [32] Xie YM, Lu YS, Weng CX, et al.  Breaking the rate-loss bound of quantum key distribution with asynchronous two-photon interference.  PRX Quantum 2022;3:0203.
  * [33] Yin HL, Chen TY, Yu ZW, et al.  Measurement-device-independent quantum key distribution over a 404 km optical fiber.  Phys Rev Lett 2016;117:190501.
  * [34] Fang XT, Zeng P, Liu H, et al.  Implementation of quantum key distribution surpassing the linear rate-transmittance bound.  Nat Photon 2020;14:422–425.
  * [35] Pittaluga M, Minder M, Lucamarini M, et al.  600-km repeater-like quantum communications with dual-band stabilization.  Nat Photon 2021;15:530–535.
  * [36] Chen JP, Zhang C, Liu Y, et al.  Twin-field quantum key distribution over a 511 km optical fibre linking two distant metropolitan areas.  Nat Photon 2021;15:570–575.
  * [37] Wang S, Yin ZQ, He DY, et al.  Twin-field quantum key distribution over 830-km fibre.  Nat Photon 2022;16:154–161.
  * [38] Pirandola S, García-Patrón R, Braunstein SL, et al.  Direct and reverse secret-key capacities of a quantum channel.  Phys Rev Lett 2009;102:050503.
  * [39] Pirandola S, Laurenza R, Ottaviani C, et al.  Fundamental limits of repeaterless quantum communications.  Nat Commun 2017;8:15043.
  * [40] Tamaki K, Curty M, Kato G, et al.  Loss-tolerant quantum cryptography with imperfect sources.  Phys Rev A 2014;90:052314.
  * [41] Xu F, Wei K, Sajeed S, et al.  Experimental quantum key distribution with source flaws.  Phys Rev A 2015;92:032305.
  * [42] Tang Z, Wei K, Bedroya O, et al.  Experimental measurement-device-independent quantum key distribution with imperfect sources.  Phys Rev A 2016;93:042308.
  * [43] Pereira M, Curty M, Tamaki K.  Quantum key distribution with flawed and leaky sources.  npj Quantum Inf 2019;5:62.
  * [44] Yin ZQ, Fung CHF, Ma X, et al.  Measurement-device-independent quantum key distribution with uncharacterized qubit sources.  Phys Rev A 2013;88:062322.
  * [45] Sun S.  Security of reference-frame-independent quantum key distribution with source flaws.  Phys Rev A 2021;104:022423.
  * [46] Wang XB, Hu XL, Yu ZW.  Practical long-distance side-channel-free quantum key distribution.  Phys Rev Applied 2019;12:054034.
  * [47] Li HW, Yin ZQ, Chen W, et al.  Quantum key distribution based on quantum dimension and independent devices.  Phys Rev A 2014;89:032302.
  * [48] Ding HJ, Zhou XY, Zhang CH, et al.  Measurement-device-independent quantum key distribution with insecure sources.  Opt Lett 2022;47:665–668.
  * [49] Huang A, Mizutani A, Lo HK, et al.  Characterisation of state preparation uncertainty in quantum key distribution.  arXiv preprint 2022;arXiv:2205.11870.
  * [50] Navarrete A, Pereira M, Curty M, et al.  Practical quantum key distribution that is secure against side channels.  Phys Rev Applied 2021;15:034072.
  * [51] Pereira M, Kato G, Mizutani A, et al.  Quantum key distribution with correlated sources.  Sci Adv 2020;6:eaaz4487.
  * [52] Mizutani A, Kato G.  Security of round-robin differential-phase-shift quantum-key-distribution protocol with correlated light sources.  Phys Rev A 2021;104:062611.
  * [53] Jiang C, Yu ZW, Hu XL, et al.  Robust twin-field quantum key distribution through sending-or-not-sending.  arXiv preprint 2021;arXiv:2112.13723.
  * [54] Tamaki K, Lo HK, Fung CHF, et al.  Phase encoding schemes for measurement-device-independent quantum key distribution with basis-dependent flaw.  Phys Rev A 2012;85:042307.
  * [55] Lo HK, Preskill J.  Security of quantum key distribution using weak coherent states with nonrandom phases.  Quantum Inf Comput 2007;7:431–458.
  * [56] Koashi M.  Simple security proof of quantum key distribution based on complementarity.  New J Phys 2009;11:045018.
  * [57] Liu WB, Li CL, Xie YM, et al.  Homodyne detection quadrature phase shift keying continuous-variable quantum key distribution with high excess noise tolerance.  PRX Quantum 2021;2:040334.
  * [58] Zapatero V, Navarrete Á, Tamaki K, et al.  Security of quantum key distribution with intensity correlations.  Quantum 2021;5:602.
  * [59] Tamaki K, Lo HK, Fung CHF, et al.  Erratum: phase encoding schemes for measurement-device-independent quantum key distribution with basis-dependent flaw [Phys Rev A 85, 042307 (2012)].  Phys Rev A 2012;86:059903.
  * [60] Yoshino Ki, Fujiwara M, Nakata K, et al.  Quantum key distribution with an efficient countermeasure against correlated intensity fluctuations in optical pulses.  npj Quantum Inf 2018;4:8.
  * [61] Currás-Lorenzo G, Navarrete Á, Azuma K, et al.  Tight finite-key security for twin-field quantum key distribution.  npj Quantum Inf 2021;7:22.
  * [62] Lucamarini M, Choi I, Ward MB, et al.  Practical security bounds against the trojan-horse attack in quantum key distribution.  Phys Rev X 2015;5:031030.
  * [63] Zhang G, Primaatmaja IW, Haw JY, et al.  Securing practical quantum communication systems with optical power limiters.  PRX Quantum 2021;2:030304.
  * [64] Mizutani A, Kato G, Azuma K, et al.  Quantum key distribution with setting-choice-independently correlated light sources.  npj Quantum Inf 2019;5:8.
  * [65] Zhong X, Hu J, Curty M, et al.  Proof-of-principle experimental demonstration of twin-field type quantum key distribution.  Phys Rev Lett 2019;123:100506.
  * [66] Yin HL, Fu Y.  Measurement-device-independent twin-field quantum key distribution.  Sci Rep 2019;9:3045.
  * [67] Hwang WY.  Quantum key distribution with high loss: toward global secure communication.  Phys Rev Lett 2003;91:057901.
  * [68] Wang XB.  Beating the photon-number-splitting attack in practical quantum cryptography.  Phys Rev Lett 2005;94:230503.
  * [69] Lo HK, Ma X, Chen K.  Decoy state quantum key distribution.  Phys Rev Lett 2005;94:230504.
  * [70] Tamaki K, Lo HK, Wang W, et al.  Information theoretic security of quantum key distribution overcoming the repeaterless secret key capacity bound.  arXiv preprint 2018;arXiv:1805.05511.
  * [71] Kato G.  Concentration inequality using unconfirmed knowledge.  arXiv preprint 2020;arXiv:2002.04357.
  * [72] Mizutani A, Curty M, Lim CCW, et al.  Finite-key security analysis of quantum key distribution with imperfect light sources.  New J Phys 2015;17:093011.
  * [73] Xu F, Wei K, Sajeed S, et al.  Experimental quantum key distribution with source flaws.  Phys Rev A 2015;92:032305.
  * [74] Hoeffding W.  Probability inequalities for sums of bounded random variables.  J Am Stat Assoc 1963;58:13–30.
  * [75] Yuan Z, Fröhlich B, Lucamarini M, et al.  Directly phase-modulated light source.  Phys Rev X 2016;6:031044.
  * [76] De Marco I, Woodward RI, Roberts GL, et al.  Real-time operation of a multi-rate, multi-protocol quantum key distribution transmitter.  Optica 2021;8:911–915.