Abstract
Quantum key distribution — the establishment of informationtheoretically secure keys based on quantum physics — is mainly limited by its practical performance, which is characterised by the dependence of the key rate on the channel transmittance R(η). Recently, schemes based on singlephoton interference have been proposed to improve the key rate to \(R=O(\sqrt{\eta })\) by overcoming the pointtopoint secret key capacity bound with interferometers. Unfortunately, all of these schemes require challenging global phase locking to realise a stable longarm singlephoton interferometer with a precision of approximately 100 nm over fibres that are hundreds of kilometres long. Aiming to address this problem, we propose a modepairing measurementdeviceindependent quantum key distribution scheme in which the encoded key bits and bases are determined during data postprocessing. Using conventional secondorder interference, this scheme can achieve a key rate of \(R=O(\sqrt{\eta })\) without global phase locking when the local phase fluctuation is mild. We expect this highperformance scheme to be readytoimplement with offtheshelf optical devices.
Similar content being viewed by others
Introduction
Quantum key distribution (QKD)^{1,2} is currently the most successful application of quantum information science and serves as the first stepping stone towards a future quantum communication network^{3}. A core advantage of QKD compared to other quantum communication tasks is that it is ready to implement with current commercially available offtheshelf optical devices. However, two major characteristics of QKD—its practical security and keyrate performance—limit its reallife implementation. The key generation speed suffers heavily from transmission loss in the optical channel. Fundamentally, the asymptotic key rate for pointtopoint QKD schemes is upper bounded by the repeaterless ratetransmittance bounds^{4,5}, which are approximately linear functions of the transmittance, R ≤ O(η). For example, when η is small, the PLOB repeaterless ratetransmittance bound^{5} is about 1.44η. Quantum repeaters^{6,7,8} have been proposed as a radical solution to this problem. Unfortunately, none of the quantum repeater proposals is easy to implement in the near term.
In reallife use, the deviation of the realistic behaviour of physical devices from their ideal ones gives rise to critical issues in practical security. There are many quantum attacks that can take advantage of the loopholes introduced by device imperfections^{9}. A typical QKD system can be divided into three parts: source, channel, and measurement. The security of the channel has been well addressed in the security proofs for QKD^{10,11,12}. The source is relatively simple and can be well characterised^{13}. In contrast, the measurement device is complicated and difficult to calibrate. Moreover, an adversary could manipulate the measurement device by sending unexpected signals^{14,15}. To solve this implementation security problem, measurementdeviceindependent quantum key distribution (MDIQKD) schemes have been proposed to close the detection loopholes once and for all^{16}. Various experimental systems have been successfully demonstrated^{17,18,19,20}, with extension to a communication network^{21}.
A generic MDIQKD setup is shown in Fig. 1a. Each of the two communicating parties, Alice and Bob, holds a quantum light source, encodes random bits into quantum pulses, and sends these pulses to a measurement site through lossy channels. Measurement devices are possessed by an untrusted party, Charlie, who is supposed to correlate Alice’s and Bob’s signals via interference detection. Based on the detection results announced by Charlie, Alice and Bob sift the local random bits encoded in the pulses to generate secure key bits. Note that the security of MDIQKD schemes does not rely upon the physical implementation of the detection devices. Alice and Bob need to trust only their own locally encoded quantum sources. Since neither Alice nor Bob receives quantum signals from the channel during key distribution, any hacker’s attempt to manipulate the users’ devices becomes extremely difficult compared to regular QKD schemes^{14,15}.
Strictly speaking, MDIQKD is not a pointtopoint scheme, as there is an interference site between Alice and Bob. Consequently, it is not necessarily limited by the repeaterless ratetransmittance bound. Nevertheless, the original MDIQKD scheme^{16}, in which Alice and Bob both encode a ‘dualrail’ qubit into a singlephoton subspace on two polarization modes, unfortunately, cannot overcome this bound. Later, alternative schemes were proposed^{22,23} in which the qubit is encoded into two optical time bins. We refer to schemes of this type as twomode MDIQKD, in the sense that the singleside key information is encoded in the relative phase of the coherent states in the two orthogonal optical modes, i.e., secondquantized electromagnetic fields. To correlate Alice’s and Bob’s encoded information in a twomode scheme, a successful twophoton interference measurement is required. If either Alice or Bob’s emitted photon is lost in transmission, there will be no conclusive detection result. For example, in the timebin encoding scheme^{23} shown in Fig. 1b, Alice and Bob each emit a qubit encoded in two timebin modes, with Alice emitting A_{1} and A_{2} and Bob emitting B_{1} and B_{2}. Only when both the interference between modes A_{1} and B_{1} and that between A_{2} and B_{2} yield successful detection can Alice restore Bob’s raw key information. Thus, successful interference requires a coincidence detection. Due to this coincidencedetection requirement, rounds with only a single detection are discarded, resulting in a relatively low key generation rate—one that is a linear function of the transmittance, O(η). From the perspective of practical implementation, however, coincidence detection also has certain merits. This approach can ensure stable optical interference, while Alice and Bob need only to stabilise the relative phases between the two modes.
Coincidence detection is the essential factor that prevents MDIQKD from overcoming the linear keyrate bound. To eliminate this requirement, a new type of MDIQKD scheme called twinfield quantum key distribution (TFQKD) based on encoding information into a singleoptical mode have been proposed^{24}, illustrated in Fig. 1c. Later on, variants of TFQKD have been proposed, among which the key information in encoded in either the phase^{25,26} (known as phasematching QKD) or the intensity^{27} (known as sendingornotsending TFQKD) of coherent states. In this work, we refer to these twinfieldtype schemes as onemode MDIQKD schemes for a conceptual comparison to the traditional twomode MDIQKD schemes, since the singleside information in these schemes is encoded into a singleoptical mode in each round. We remark that the singleopticalmode encoding MDIQKD scheme was first proposed in ref. ^{28} as “MDIB92” scheme. Similar to the DuanLukinCiracZollertype repeater design^{29}, such onemode schemes use singlephoton interference instead of coincidence detection, hence yielding a quadratic improvement in key rate compared to twomode schemes^{24,25,26}. As a result, they can overcome the pointtopoint linear keyrate bound^{4,5}. Unfortunately, onemode schemes are more challenging to implement due to the unstable optical interference resulting from the lack of global phase references. For example, in the phasematching QKD (PMQKD) scheme^{25}, the key information is encoded into the global phase of Alice’s and Bob’s coherent states. The phases of the coherent states generated by two remote and independent lasers need to be matched at the measurement site. A small phase drift or fluctuation caused by the lasers and/or channels is hazardous for key generation.
At first glance, it seems that we cannot simultaneously enjoy the advantages of onemode schemes (i.e., quadratic improvement in successful detection) and twomode schemes (i.e., stable optical interference), due to an intrinsic tradeoff between the informationencoding efficiency and robustness. On the one hand, the relative information among different optical modes is more difficult to retrieve when the channel loss is large. On the other hand, the global phase of a coherent state is not as stable as the relative phase between two coherent states travelling through the same quantum channel. In a typical 200km fibre with a telecommunication frequency of 1550 nm, the phase of a coherent state is susceptible to small fluctuations in the optical transmission time (~10^{−15} s), optical length (~200 nm) and light frequency (~100 kHz). Recently, experimentalists have made great efforts to demonstrate highperformance in onemode schemes, utilising highend technologies to perform a precise control operation to stabilise the global phase by locking the frequency and phase of the coherent states^{30,31,32,33,34,35,36,37}. However, this increases the experimental difficulty and undermines the applicability of onemode schemes in real life.
In this work, we propose a modepairing MDIQKD scheme that aims to offer both—simple implementation and high performance. Hereafter, we refer to this scheme as the modepairing scheme for simplicity. By observing that the majority of detection events are singleclicks and are discard in the twomode MDIQKD schemes, we try to recycle the discarded singleclick in the modepairing scheme. To do that, the coherent states in the transmitted modes are initially prepared independently with randomly encoded information. Based on the fact that the two detection events used to read out the encoded information do not need to occur at two predetermined locations, the key is extracted from two paired detection events rather than coincidence detection, as shown in Fig. 1d. This offers a quadratic improvement akin to that of onemode schemes when the local phases can be stabilized using currently available phase stabilization techniques. Moreover, key information about the modepairing scheme is encoded in the relative phases or intensities, whose stability relies only upon the conditions of the local phase references and optical paths. Therefore, the technical complexity is similar to that of twomode schemes, which have been widely implemented both in the laboratory^{17,18,19,38} and in the field^{21,39}. Notably, to adapt to different hardware conditions, the modepairing scheme can be freely tuned between the onemode and twomode schemes by adjusting a pulseinterval parameter (as discussed later in Results’ subsection “Pairing strategy”) during data postprocessing to optimise the system performance.
Results
Modepairing scheme
In the modepairing scheme, Alice and Bob first prepare coherent states with independently and randomly chosen intensities and phases in each emitted optical mode. These coherent states are sent to the untrusted measurement site, Charlie. Based on Charlie’s announced measurement results, Alice and Bob pair the optical modes with successful detection and determine the key bits and bases for each mode pair locally. They then sift the bases and generate secure key bits via postprocessing. The scheme is introduced in Box 1 and illustrated in Fig. 2a. For simplicity of the introduction of the main protocol design, we omit the details of the decoystate method^{40} and discrete phase randomisation here. A complete description of the modepairing scheme is given in the Methods’ subsection “Modepairing scheme with decoy states”.
In the modepairing scheme, we mainly consider the keys generated from the Zpair data, since they have a much lower quantum bit error rate \({E}_{\mu \mu }^{Z}\) than the Xpair data. The encoding of the modepairing scheme in Box 1 originates from the timebin encoding MDIQKD scheme^{23}. If Alice’s two paired optical modes {A_{i}, A_{j}} are assigned to the Zbasis, then the state of the two optical modes is either \({\big0\big\rangle }_{{A}_{i}}{\big\sqrt{\mu }{{{{{{{{\rm{e}}}}}}}}}^{{{{{{{{\rm{i}}}}}}}}{\phi }_{j}^{a}}\big\rangle }_{{A}_{j}}\) or \({\left\sqrt{\mu }{{{{{{{{\rm{e}}}}}}}}}^{{{{{{{{\rm{i}}}}}}}}{\phi }_{i}^{a}}\right\rangle }_{{A}_{i}}{\left0\right\rangle }_{{A}_{j}}\), where \({\phi }_{i}^{a}\) and \({\phi }_{j}^{a}\) are two independent random phases. We can write the encoded states in a unified form:
where κ^{a} is the encoded key information and \(\bar{\kappa }:= \kappa \oplus 1\) is the inverse of κ. In the other case, in which the two optical modes {A_{i}, A_{j}} are assigned to the Xbasis, we can rewrite their two independent random phases \({\phi }_{i}^{a}\) and \({\phi }_{j}^{a}\) as
In this way, the phase ϕ^{a} becomes a global random phase on the pulse pair, while \({\phi }_{\delta }^{a}\) is the relative phase for quantum information ‘encoding’. Due to the independence of \({\phi }_{i}^{a}\) and \({\phi }_{j}^{a}\), the phases ϕ^{a} and \({\phi }_{\delta }^{a}\) are also independent of each other and uniformly range from [0, 2π). By definition, we have \({\phi }_{\delta }^{a}={\theta }^{a}+\pi {\kappa }^{a}\). Then, the Xpair state can be written as,
where μ^{a} ∈ {0, μ}. When θ = 0 or π/2, Alice emits Xbasis or Ybasis states, respectively, as used in the timebin encoding MDIQKD scheme^{23}.
We remark that in either the Zpair state in Eq. (1) or the Xpair state in Eq. (3), there is a global random phase ϕ^{a}, which will not be revealed publicly. With this (global coherent state) phase randomisation, the emitted Z and Xpair states can be regarded as a mixture of photon number states^{40}. Then, Alice and Bob can estimate the detections caused by the pairs where they both emit single photons and use them to generate secure keys, in a manner similar to traditional twomode schemes. Therefore, the security of the modepairing scheme is similar to that of twomode schemes. Nevertheless, the modepairing scheme in Box 1 has the following unique features.

1.
The emitted states in different optical modes {A_{i}} are independent and identically distributed (i.i.d.). Therefore, the information encoded in different optical modes is completely decoupled.

2.
Based on the postselection of clicked signals, different optical modes are paired afterwards. The relative information between the two modes is then converted into raw key data.
In the modepairing scheme, the key information is determined not in the state preparation step, but by the detection location, sharing some similarities with the differentialphaseshifting QKD scheme^{41,42}. It is the untrusted measurement site that determines the location of successful detection and thereby affects the pairing setting. The ‘dualrail’ qubits encoded on the single photons are ‘postselected’ on the basis of this detection. By virtual of the independence of the optical modes, the information encoded in the ‘postselected’ qubits cannot be revealed from other optical pulses.
For another comparison, the sendingornotsending (SNS) TFQKD scheme^{27} also uses a Zbasis timebin encoding, whereby either Alice or Bob emits an optical mode to generate key bits. The state preparation of the modepairing scheme shares similarities with the SNSTFQKD scheme. However, the information of the modepairing scheme is encoded into the relative information between the two optical modes. As a result, the basissifting and key mapping of the modepairing scheme follow different logic originated from the timebin encoding MDIQKD scheme^{23}. Note that in the SNS scheme, bits 0 and 1 are highly biased in the Z basis, whereas in the modepairing scheme, they are evenly distributed.
A critical issue in the security analysis of the modepairing scheme is to maintain the flexibility to determine in which two optical modes to perform the overall photon number measurement until Charlie announces the detection results. Note that, in the original twomode QKD schemes, the encoders can always be assumed to perform an overall photon number measurement and postselect the singlephoton components as good ‘dualrail’ qubits before they emit their signals to Charlie. In the modepairing scheme, however, this is not viable because the optical pulse pair, for which the singlephoton component is defined, is postselected based on Charlie’s detection announcement. To solve this problem, we introduce source replacement for the random phases in the coherent states to purify them as ancillary qudits and define an indirect overall photon number measurement on them. The sourcereplacement procedure can be found in the Methods’ subsection “Source replacement of the encoding state”. Conditioned on the indirect overall photon number measurement result to be singlephoton states, the Xbasis error rate fairly estimates the Zbasis phase error rate for the signals for which Alice and Bob both emit single photons.
In Supplementary Note 2, we provide a detailed security proof based on entanglement distillation. The main idea is to introduce a ‘fixedpairing’ scheme, in which the pairing setting, i.e., which locations are paired together, is predetermined and hence independent of Charlie’s announcement. We first prove that, with any given pairing setting, the fixedpairing scheme is secure, as it can be reduced to a twomode MDIQKD scheme. Afterwards, we examine the private state generated by the modepairing scheme and prove that it is the same as that of a fixedpairing scheme under all possible measurements that Charlie could perform and announcement methods. In this way, we prove the equivalence of the modepairing scheme to a group of fixedpairing schemes with different pairing settings.
Pairing strategy
The pairing strategy mentioned in Step 3 lies at the core of the modepairing scheme in Box 1, which correlates two independent signals and determines their bases and key bits. Note that the relative phase between two paired quantum signals determines the key information on the X basis. When the time interval between these two pulses becomes too large, the key information suffers from phase fluctuation, which is characterised by the laser coherence time. Therefore, Alice and Bob should establish a maximal pairing interval l, such that the number of pulses between the two paired signals should not exceed l. In practice, l can be estimated by multiplying the laser coherence time by the system repetition rate.
Here, we consider a simple pairing strategy in which Alice pairs adjacent detection pulses together if the time interval between them is not too large (≤l). The details are shown in the simple pairing strategy in Box 2 and illustrated in Fig. 2b. Charlie’s announcement in the ith round is denoted by a Boolean variable C_{i} that indicates whether the detection is successful. That is, C_{i} = 1 implies that either the detector L or R clicks. Otherwise, there is no click or double clicks.
To check the efficiency of this pairing strategy, let us calculate the pairing rate r_{p} (i.e. the average number of pairs generated per pulse). We assume that Alice and Bob choose intensities 0 and μ with equal probability, maximising the number of successful pairs in the Z basis. With a typical QKD channel model, the pairing rate r_{p} is calculated as shown in the Methods’ subsection “Modepairingefficiency calculation”,
where p is the probability that the emitted pulses result in a click event, given approximately by η_{s}μ. Here, η_{s} and η denote the channel transmittance from Alice to Charlie and the total transmittance from Alice to Bob, respectively. When the channel is symmetric for Alice and Bob, we have \(\eta ={\eta }_{s}^{2}\). An explicit simulation formula for p in a pureloss channel is given in Supplementary Note 4. Note that both the pairing ratio r_{p} and the detection probability p can be directly obtained by experimentation.
The raw key rate mainly depends on the pairing rate r_{p}. Now, let us check the scaling of r_{p} with the channel transmittance in the symmetricchannel case. If the local phase reference is sufficiently stable, then the maximal interval can be set to l → +∞. In this case,
where the optimal intensity is μ = O(1), as evaluated in Supplementary Note 5. On the other hand, if the local phase reference is not at all stable, one must set l = 1; then,
In this case, the experimental requirements for the modepairing scheme are close to those of the existing timebin MDIQKD scheme^{23}. Now, if we consider a finite value of l, the dependence of r_{p}(p, l) on η will be decided by how the denominator of the first term in Eq. (4), p[1 − (1−p)^{l}], depends on p ≈ η_{s}μ. When pl ≫ 1, r_{p}(p, l) scales with p linearly, hence \({r}_{p}=O(\sqrt{\eta })\); when pl ≪ 1, it scales with p^{2}, resulting in r_{p} = O(η). Around pl = 1, there will be a performance transition from \({r}_{p}=O(\sqrt{\eta })\) to r_{p} = O(η).
In practice, l can be adjusted in accordance with the laser quality and quantumchannel fluctuations. Note that l can also be adjusted during data postprocessing, offering flexibility for various environmental changes in real time. Generally, the whole pairing strategy can be adjusted through different realisations.
Practical issues and simulation
The key rate of the modepairing scheme, as rigorously analysed in the Supplementary Note 2, has a decoystate MDIQKD form:
where r_{p} is the pairing rate contributed by each block, r_{s} is the proportion of Zpairs among all the generated location pairs (~1/8), q_{(1, 1)} is the fraction of Zpairs caused by singlephotonpair states ρ^{(1, 1)} in which both Alice and Bob send singlephoton states in the two paired modes, \({e}_{(1,1)}^{X}\) is the phase error rate of the detection caused by ρ^{(1, 1)}, f is the errorcorrection efficiency, and E^{(μ, μ),Z} is the bit error rate of the sifted raw data. The fraction q_{(1, 1)} and the phase error \({e}_{(1,1)}^{X}\) can be estimated using the decoystate method^{40,43,44}. A detailed estimation procedure for q_{(1, 1)} and \({e}_{(1,1)}^{X}\) with the vacuum + weak decoystate method is introduced in Supplementary Note 3.
During the key mapping step in Box 1, the Xpair sifting condition θ^{a} = θ^{b} is impossible to fulfil exactly. This results in insufficient data for Xbasis error rate estimation. To solve this problem, one can apply discrete phase randomisation^{45} such that θ^{a} and θ^{b} are chosen from a discrete set. We expect the discretisation effect to be negligible when the number of discrete phases is reasonably large, such as D = 16, similar to the situation in previous works on onemode MDIQKD^{46}.
Based on the above analysis, we simulate the asymptotic performance of the modepairing scheme under a typical symmetric quantumchannel model, using practical experimental parameter settings. We assign the maximal pairing interval l of the modepairing scheme as a value between 1 and 1 × 10^{6}, aiming to illustrate the dependence of the key rate on l. We also compare the key rate of the modepairing scheme with those of a typical twomode scheme, timebin encoding MDIQKD^{23}, and two onemode schemes — PMQKD^{46} and SNSTFQKD^{47}. The simulation results are shown in Fig. 3. We set the misalignment error rate of the modepairing scheme to be the same as the onemode schemes for a fair comparison. In Supplementary Note 5, we show that the keyrate performance of the modepairing scheme is robust against misalignment errors. Even with a misalignment error rate of 15%, the modepairing scheme is able to surpass the repeaterless ratetransmittance bound with l = 2000. Here, we compare the asymptotic keyrate performance of all the schemes under the scenario of oneway localoperation and classical communication. The simulation formulas for these schemes are listed in Supplementary Note 4. Recently, researches^{48,49} show that the keyrate performance of SNSTFQKD can be further improved by introducing the twoway classical communication^{50,51}. We will leave the advanced key distillation for future studies.
As shown in Fig. 3a, the modepairing scheme with only neighbour pairing, l = 1, show a performance comparable to that of the original twomode scheme. These two schemes have the same scaling property, i.e., R = O(η). The deviation is caused by an extra sifting factor in the modepairing scheme as a result of independent encoding. When the maximal pairing interval l is increased to 1 × 10^{3}, the key rate is significantly enhanced by 3 orders of magnitude compared to the l = 1 case, making it able to surpass the linear keyrate bound. If we further increase l above 1 × 10^{5}, then the modepairing scheme has a similar key rate to PMQKD and SNSTFQKD and a scaling property given by \(R=O(\sqrt{\eta })\). In Fig. 3b, we further compare the keyrate performance of the modepairing scheme under different settings for l. When l falls within the range of 1 to 1 × 10^{6}, the key rate of the modepairing scheme lies between the two extreme cases of O(η) and \(O(\sqrt{\eta })\). The keyrate behaviour is dominated by the pairing rate given in Eq. (4).
In typical optical experiments, the typical line width of a common commercial laser is 3 kHz (see for example, ref. ^{32}). Hence, the coherence time of the laser is around 333 μs. In practice, the frequency fluctuation of the lasers will affect the stabilization of the phase. To test the feasibility of the modepairing scheme, we perform an interference experiment using a commercial optical communication system with a repetition rate of 625 MHz. The experiment detail is shown in Supplementary Note 6. Based on the experimental data, we find that the phase coherence can be maintained well in a time interval of 5 μs, corresponding to l = 3000 ~ 4000. If we apply the stateoftheart optical communication system with the repetition rate of 4 GHz^{37}, we can realize a pairing interval over l = 20000. As an extra remark, our current discussion on the implementation of the modepairing scheme is based on the multiplexing of optical timebin modes. Nonetheless, the proposed modepairing design is generic for the multiplexing of other optical degrees of freedom. For example, we can introduce frequency multiplexing. The optical modes with different frequencies are first prepared and interfered independently, i.e., only the pulses with the same frequency will be interfered. After the announcement of detection results, Alice and Bob then pair the locations with different frequencies during the postprocessing. This can be used to increase the effective maximal pairing interval to an even larger value without the global phase locking. From Fig. 3b we can see that the key rate of the modepairing scheme with l = 1 × 10^{4} remains \(R \sim O(\sqrt{\eta })\) when η is smaller than 30 dB, corresponding to a communication distance of 300 km. The asymptotic key rate of the modepairing scheme is 3 to 5 orders of magnitude higher than that of the twomode scheme. We remark that the decoherence effect caused by the opticalfibre channel is negligible compared to the laser coherence time. When the fibre length is around 500 km, the velocity of phase drift in the fibre is <10 rad/ms^{32}, which can be calibrated using strong laser pulses without the need for realtime feedback control. As a result, the value of l depends only upon the local phase reference and not the communication distance.
One advantage of the modepairing scheme is that it can be adapted to specific hardware conditions. In practice, optical systems may be unstable, causing the local phase reference to fluctuate rapidly. In this case, we can reduce the maximal pairing interval l and search for the optimal pairing strategy during the postprocessing procedure. As shown in the inset plot of Fig. 3b, the key rate of the modepairing scheme first increases linearly with increasing l before saturating when l is larger than \({p}^{1}={(\mu \sqrt{\eta })}^{1}\). In this case, Alice and Bob find successful detection within l locations with a high probability. Even when the optical system is unstable, the key rate can be nearly l times higher than that of the original timebin MDIQKD scheme when the value of l does not exceed \({p}^{1}={(\mu \sqrt{\eta })}^{1}\). We remark that, with the original experimental apparatus used in timebin MDIQKD, one can directly enhance the key rate by a factor of ~100 using the modepairing scheme. On the other hand, we note that for a given communication distance, l does not need to be very large to reach the maximal keyrate performance. For example, when the distance reaches 200 km, a maximal pairing interval of l = 1000 is sufficient to achieve the optimal keyrate performance. We leave a detailed evaluation for future research.
Discussion
Based on a reexamination of the conventional twomode MDIQKD schemes and the recently proposed onemode MDIQKD schemes, we have developed a modepairing MDIQKD scheme that retains the advantages of both, namely, achieving a high key rate with easy implementation. Since MDIQKD schemes have the highest practical security level among the currently feasible QKD schemes, we expect the modepairing scheme paves the way for an optimal design for QKD, simultaneously enjoying high practicality, implementation security, and performance.
There remain several interesting directions for future work. Natural followup questions lie in the statistical analysis of the modepairing scheme in the finitedatasize regime and efficient parameter estimation. Due to the photonnumberbased property of the modepairing scheme, previous studies of the statistical analysis of twomode MDIQKD schemes^{52,53,54} can be readily extended to analyse the modepairing scheme. To improve the efficiency of data usage, Alice and Bob may perform parameter estimation before basis sifting in order to use all signals that were originally discarded. On the other hand, one could design a modepairing scheme using the Xbasis for key generation and the Zbasis for parameter estimation.
In this work, we employ a simple modepairing strategy based on pairing adjacent detection pulses. A more sophisticated pairing method might make bit and basis sifting more efficient. To improve the pairing strategy, Alice and Bob could reveal parts of the encoded intensity and phase information. For example, in the simple pairing strategy introduced in Box 2, Alice and Bob reveal the bases of the generated data pairs immediately after locations i and j are paired. If their basis choices differ, Alice and Bob ‘unpair’ locations i and j, and seek the next good pairing location for location i until the basis choices match.
To further enhance the performance, we could extend the modepairing design to other optical degrees of freedom, such as angular momentum and spectrum mode. Meanwhile, we could multiplex the usage of different degrees of freedom to enhance the repetition rate and extend the pairing interval l. Such multiplexing techniques would have additional benefits for the modepairing scheme. Suppose that we multiplex m quantum channels for a QKD task. In a normal setting, the key generation speed would be improved by a factor of m. For the modepairing scheme, in addition to this mfold improvement, multiplexing would also introduce a larger pairing interval ml, since Alice and Bob would be able to pair quantum signals from different channels. A larger pairing interval ml would result in more paired signals and, hence, more key bits. Especially in the highchannelloss regime where the distance between two clicked signals is large, the number of successful pairs becomes proportional to the maximum pairing interval ml. Thus, the key generation rate is proportional to m^{2} in the highchannelloss regime.
Meanwhile, entanglementbased MDIQKD schemes are essentially based on entanglementswapping, which is the core design feature of quantum repeaters. The modepairing technique may help design a robust quantum repeater against a lossy channel. Note that our work shares similarities with the memoryassisted MDIQKD protocol^{55} with quantum memories in the middle and with the allphotonic intercity MDIQKD protocol^{56} with adaptive Bellstate measurement on the postselected photons. It is interesting to discuss the possibility of combining the modepairing design with an adaptive Bellstate measurement to tolerate more losses.
Moreover, the modepairing scheme has a unique feature in that the key bits are determined not in the encoding or measurement steps but upon postprocessing, which is an approach that can be further explored in other quantum communication tasks, including continuousvariable schemes.
Methods
Source replacement of the encoding state
The main idea of the security proof for the modepairing scheme is to introduce an entanglementbased scheme and reduce the security of the scheme to that of a traditional twomode MDIQKD scheme. To realise this, we perform a systematic sourcereplacement procedure^{57,58}. Without loss of generality, in this subsection, we always assume the paired locations (i, j) to be (1, 2) to simplify the notations.
For convenience in the security proof, we slightly modify the scheme described in Box 1. First, we assume that the random phase of each mode is discretely chosen from a set of D phases, evenly distributed in [0, 2π). We expect the corresponding correction term in the security analysis due to the discretisation effect to be negligible^{45,46}. Second, in the security proof, we modify the phase encoding and postprocessing procedures, as shown in Table 1. In the original scheme, Alice modulates A_{1} and A_{2} based on two random phases \({\phi }_{1}^{a}\) and \({\phi }_{2}^{a}\), respectively. During the Xbasis processing, she calculates the relative phase difference \({\phi }_{\delta }^{a}:= {\phi }_{2}^{a}{\phi }_{1}^{a}\) and splits it into an alignment angle θ^{a} in the range of [0, π) and a raw key bit κ^{a}. We modify these procedures as follows: in addition to the two random phases \({\phi }_{1}^{a}\) and \({\phi }_{2}^{a}\), Alice also generates two bits \({z}_{1}^{^{\prime\prime} }\) and \({z}_{2}^{^{\prime\prime} }\) and applies extra phase modulations of \({z}_{1}^{^{\prime\prime} }\pi\) and \({z}_{2}^{^{\prime\prime} }\pi\) to A_{1} and A_{2}, respectively. During the Xbasis processing, she calculates the relative phase difference \({\phi }_{\delta }^{a}:= {\phi }_{2}^{a}{\phi }_{1}^{a}\) and directly announces it for alignmentangle sifting. In the Supplementary Information, we prove the equivalence of these two encoding methods.
With the modification above, Alice further generates a random bit \({z}_{1}^{\prime}\) and a random dit (d = D) j_{1} in the first round. Based on the values of \({z}_{1}^{\prime}\), \({z}_{1}^{^{\prime\prime} }\) and \({j}_{1}^{a}\), she prepares the state
with \({\phi }_{1}={j}_{1}\frac{2\pi }{D}\). As shown in Fig. 4, we substitute the encoding of random encoded information into the introduction of extra ancillary qubit and qudit systems labelled as \({\tilde{A}}_{1}\), \({A}_{1}^{^{\prime\prime} }\) and \({A}_{1}^{\prime}\). The purified encoding state is
In Fig. 4, we provide a specific state preparation procedure. The initial state is
Here Alice applies a controlledphase gate \({C}_{D}\hat{U}({\phi }_{{{\Delta }}})\) with \({\phi }_{{{\Delta }}}:= \frac{2\pi }{D}\) from the qudit \({\tilde{A}}_{1}\) to optical mode A_{1}. The controlledphase gate is defined as
where a^{†} and a are the creation and annihilation operators, respectively, of mode A_{1}. Alice also applies a controlledphase gate \(C\hat{U}(\pi )\) from \({A}_{1}^{^{\prime\prime} }\) to A_{1}.
In the entanglementbased modepairing scheme, Alice and Bob generate the composite encoding state \(\big{\tilde{{{\Psi }}}}^{Com}\big\rangle\) defined in Eq. (9) in each round. They emit the optical modes to Charlie for interference. Based on Charlie’s announcement, they pair the locations and perform global operations on the corresponding ancillaries to generate raw key bits and useful parameters. In Fig. 5, we list the global operations performed on Alice’s paired locations. Among them, the relative encoded intensity \({\tau }^{a}:= {z}_{1}^{\prime}\oplus {z}_{2}^{\prime}\) is used to determine the basis choice. The encoded intensity \({\lambda }^{a}:= {z}_{1}^{\prime}\) and the relative encoded phase \({\sigma }^{a}={z}_{1}^{^{\prime\prime} }\oplus {z}_{2}^{^{\prime\prime} }\) are the raw key bits in the Zbasis and Xbasis postprocessing, respectively.
A key point in our security proof is that we replace the random phases and register them into purified systems \({\tilde{A}}_{1}\) and \({\tilde{A}}_{2}\). This enables us to define a global measurement M(k, θ) on \({\tilde{A}}_{1}\) and \({\tilde{A}}_{2}\) to simultaneously obtain the overall photon number and the relative phase information encoded in optical modes A_{1} and A_{2}. The construction of M(k, θ) is described in Supplementary Note 1. With the introduction of the purified systems \({\tilde{A}}_{1}\) and \({\tilde{A}}_{2}\) and the existence of the global measurement M(k, θ), Alice (same for Bob) is able to determine at which two locations to perform the global photon number measurement after Charlie’s announcement. With this measurement, Alice and Bob can further reduce the encoding state to a twomode scheme. The detailed security proof is provided in Supplementary Note 2.
Modepairing scheme with decoy states
Here, we present the modepairing scheme with an extra decoy intensity ν to estimate the parameters q_{11} and \({e}_{11}^{X}\). Of course, more decoy intensities can be applied in a similar manner.

1.
State preparation: In the ith round (i = 1, 2, . . . , N), Alice prepares a coherent state \(\left\sqrt{{\mu }_{i}^{a}}\exp ({{{{{{{\rm{i}}}}}}}}{\phi }_{i}^{a})\right\rangle\) in optical mode A_{i} with an intensity \({\mu }_{i}^{a}\) randomly chosen from {0, ν, μ} (0 < ν < μ < 1) and a phase \({\phi }_{i}^{a}\) uniformly chosen from the set \({\{\frac{2\pi }{D}k\}}_{k = 0}^{D1}\). She records \({\mu }_{i}^{a}\) and \({\phi }_{i}^{a}\) for later use. Likewise, Bob chooses \({\mu }_{i}^{b}\) and \({\phi }_{i}^{b}\) randomly and prepares \(\big\sqrt{{\mu }_{i}^{b}}\exp ({{{{{{{\rm{i}}}}}}}}{\phi }_{i}^{b})\big\rangle\) in mode B_{i}.

2.
Measurement: (Same as Step 2 in Box 1.) Alice and Bob send modes A_{i} and B_{i} to Charlie, who performs the singlephoton interference measurement. Charlie announces the clicks of the detectors L and/or R. Alice and Bob repeat the above two steps N times; then, they perform the following data postprocessing procedures:

3.
Mode pairing: (Same as Step 3 in Box 1.) For all rounds with successful detection (L or R clicks), Alice and Bob establish a strategy for grouping two clicked rounds as a pair. A specific pairing strategy is introduced in Box 2.

4.
Basis sifting: Based on the intensities of two grouped rounds, Alice labels the ‘basis’ of the data pair as:

(a)
Z if one of the intensities is 0 and the other is nonzero;

(b)
X if both of the intensities are the same and nonzero; or

(c)
‘0’ if the intensities are (0, 0), which will be reserved for decoy estimation of both the Z and X bases; or

(d)
‘discard’ when both intensities are nonzero and not equal.
See also Table 2 for the basis assignment. Alice and Bob announce the basis (X, Z, ‘0’, or ‘discard’) and the sum of the intensities \(({\mu }_{i,j}^{a},{\mu }_{i,j}^{b})\) for each location pair i, j. If the announced bases are the same and no ‘discard’ state occurs, they record the pair basis and maintain the data pairs; if one of the announced bases is ‘0’ and the other one is X(Z), they record the pair basis as X(Z) and keep the data pairs; if both of the announced bases are ‘0’, they record the pair basis as ‘0’ and maintain the data pairs; and otherwise, they discard the data. See also Table 3 for the basissifting strategy.

(a)

5.
Key mapping: (Same as Step 5 in Box 1) For each Zpair at locations i and j, Alice sets her key to κ^{a} = 0 if the intensity of the ith pulse is \({\mu }_{i}^{a}=0\) and to κ^{a} = 1 if \({\mu }_{j}^{a}=0\). For each Xpair at locations i and j, the key is extracted from the relative phase \(({\phi }_{j}^{a}{\phi }_{i}^{a})={\theta }^{a}+\pi {\kappa }^{a}\), where the raw key bit is \({\kappa }^{a}=\big\lfloor (({\phi }_{j}^{a}{\phi }_{i}^{a})/\pi {{{{{{{\rm{mod}}}}}}}}2)\big\rfloor\) and the alignment angle is \({\theta }^{a}:= ({\phi }_{j}^{a}{\phi }_{i}^{a}){{{{{{{\rm{mod}}}}}}}}\pi\). Similarly, Bob also assigns his raw key bit κ^{b} and determines θ^{b}. For the Xpairs, Alice and Bob announce the alignment angles θ^{a} and θ^{b}. If θ^{a} = θ^{b}, they keep the data pairs; otherwise, they discard them.

6.
Parameter estimation: Alice and Bob estimate the quantum bit error rate \({E}_{\mu \mu }^{Z}\) of the raw key data in Zpairs with overall intensities of \(({\mu }_{i,j}^{a},{\mu }_{i,j}^{b})=(\mu ,\mu )\). They use Zpairs with different intensity settings to estimate the clicked singlephoton fraction q_{11} using the decoystate method, and the Xpairs are used to estimate the singlephoton phase error rate \({e}_{11}^{X}\). Specially, q_{11} and \({e}_{11}^{X}\) are estimated via the decoystate method introduced in Supplementary Note 3.

7.
Key distillation: (Same as Step 7 in Box 1.) Alice and Bob use the Zpairs to generate a key. They perform error correction and privacy amplification in accordance with q_{11}, \({E}_{\mu \mu }^{Z}\) and \({e}_{11}^{X}\).
Modepairingefficiency calculation
We calculate the expected pairing number r_{p}(p, l) that corresponds to the simple modepairing strategy in Box 2, which is related to the average click probability p during each round, and the maximal pairing interval l.
For calculation convenience, we assume that in addition to the front and rear locations (F_{k}, R_{k}) of the kth pair, Alice and Bob also record the starting location S_{k}, which indicates the location at which the first successful detection signal occurs during the pairing procedure for the kth pair. If the second successful detection signal R_{k} is found within the next l locations, then F_{k} = S_{k}; otherwise, F_{k} will be larger than S_{k}. Let G_{k} ≔ S_{k+1} − S_{k} denote a random variable that reflects the location gap between the kth and (k + 1)th starting pulses. Then the expected pairing number per pulse is given by
Hence, we need to calculate only the expectation value of G_{k}. First, we split it into two parts,
where H_{k}: = R_{k} − S_{k} and \({G}_{k}^{(b)}:= {S}_{k+1}{R}_{k}\). Hence,
It is easy to show that \({G}_{k}^{(b)}\) obeys a geometric distribution,
Then, the expectation value is \({\mathbb{E}}({G}_{k}^{(b)})=1/p\).
The calculation of the pulse interval H_{k} is more complex. Suppose that we already know the expectation value \({\mathbb{E}}({H}_{k})\); now we calculate the expectation value \({\mathbb{E}}({H}_{k} d)\) conditioned on the distance between the starting point and the following click. We have
Therefore,
We have
therefore,
Note added to proof
After we submitted our work for reviewing, we became aware of a relevant work by Xie et al.^{59}, who consider a similar MDIQKD protocol that match the clicked data to generate key information. Under the assumption that the singlephoton distributions in all the Charlie’s successful detection events are independent and identically distributed, the authors simulate the performance of the protocol and show its ability to break the repeaterless ratetransmittance bound.
Data availability
The methods to generate the data in the plots are provided in Supplementary Information. The data that support the plots within this paper and other findings of this study are available from the corresponding authors upon reasonable request.
Code availability
The detailed simulation methods for the plots are provided in Supplementary Information. The specific code that support the plots within this paper and other findings of this study are available from the corresponding authors upon reasonable request.
References
Bennett, C. H. & Brassard, G. Quantum Cryptography: Public Key Distribution and Coin Tossing. in Proc. IEEE International Conference on Computers, Systems and Signal Processing. pp. 175–179 (IEEE Press, New York, 1984).
Ekert, A. K. Quantum cryptography based on bell’s theorem. Phys. Rev. Lett. 67, 661 (1991).
Chen, Y.A. et al. An integrated spacetoground quantum communication network over 4,600 kilometres. Nature 589, 214 (2021).
Takeoka, M., Guha, S. & Wilde, M. M. Fundamental rateloss tradeoff for optical quantum key distribution. Nat. Commun. 5, 5235 (2014).
Pirandola, S., Laurenza, R., Ottaviani, C. & Banchi, L. Fundamental limits of repeaterless quantum communications. Nat. Commun. 8, 15043 (2017).
Zukowski, M., Zeilinger, A., Horne, M. A. & Ekert, A. K. “Eventreadydetectors” bell experiment via entanglement swapping. Phys. Rev. Lett. 71, 4287 (1993).
Briegel, H.J., Dür, W., Cirac, J. I. & Zoller, P. Quantum repeaters: the role of imperfect local operations in quantum communication. Phys. Rev. Lett. 81, 5932 (1998).
Azuma, K., Tamaki, K. & Lo, H.K. Allphotonic quantum repeaters. Nat. Commun. 6, 6787 (2015).
Xu, F., Ma, X., Zhang, Q., Lo, H.K. & Pan, J.W. Secure quantum key distribution with realistic devices. Rev. Mod. Phys. 92, 025002 (2020).
Lo, H. K. & Chau, H. F. Unconditional security of quantum key distribution over arbitrarily long distances. Science 283, 2050 (1999).
Shor, P. W. & Preskill, J. Simple proof of security of the bb84 quantum key distribution protocol. Phys. Rev. Lett. 85, 441 (2000).
Koashi, M. Simple security proof of quantum key distribution based on complementarity. N. J. Phys. 11, 045018 (2009).
Gottesman, D., Lo, H.K., Lütkenhaus, N. & Preskill, J. Security of quantum key distribution with imperfect devices. Quantum Info. Comput. 4, 325 (2004).
Makarov, V., Anisimov, A. & Skaar, J. Effects of detector efficiency mismatch on security of quantum cryptosystems. Phys. Rev. A 74, 022313 (2006).
Qi, B., Fung, C.H. F., Lo, H.K. & Ma, X. Timeshift attack in practical quantum cryptosystems. Quantum Inf. Comput. 7, 73 (2007).
Lo, H.K., Curty, M. & Qi, B. Measurementdeviceindependent quantum key distribution. Phys. Rev. Lett. 108, 130503 (2012).
Rubenok, A., Slater, J. A., Chan, P., LucioMartinez, I. & Tittel, W. Realworld twophoton interference and proofofprinciple quantum key distribution immune to detector attacks. Phys. Rev. Lett. 111, 130501 (2013).
Liu, Y. et al. Experimental measurementdeviceindependent quantum key distribution. Phys. Rev. Lett. 111, 130502 (2013).
Ferreira da Silva, T. et al. Proofofprinciple demonstration of measurementdeviceindependent quantum key distribution using polarization qubits. Phys. Rev. A 88, 052303 (2013).
Woodward, R. I. et al. Gigahertz measurementdeviceindependent quantum key distribution using directly modulated lasers. npj Quantum Inf. 7, 1 (2021).
Tang, Y.L. et al. Measurementdeviceindependent quantum key distribution over untrustful metropolitan network. Phys. Rev. X 6, 011024 (2016).
Tamaki, K., Lo, H.K., Fung, C.H. F. & Qi, B. Phase encoding schemes for measurementdeviceindependent quantum key distribution with basisdependent flaw. Phys. Rev. A 85, 042307 (2012).
Ma, X. & Razavi, M. Alternative schemes for measurementdeviceindependent quantum key distribution. Phys. Rev. A 86, 062319 (2012).
Lucamarini, M., Yuan, Z., Dynes, J. & Shields, A. Overcoming the rate–distance limit of quantum key distribution without quantum repeaters. Nature 557, 400 (2018).
Ma, X., Zeng, P. & Zhou, H. Phasematching quantum key distribution. Phys. Rev. X 8, 031043 (2018).
Lin, J. & Lütkenhaus, N. Simple security analysis of phasematching measurementdeviceindependent quantum key distribution. Phys. Rev. A 98, 042332 (2018).
Wang, X.B., Yu, Z.W. & Hu, X.L. Twinfield quantum key distribution with large misalignment error. Phys. Rev. A 98, 062323 (2018).
Ferenczi, A. Security proof methods for quantum key distribution protocols, Ph.D. thesis http://hdl.handle.net/10012/7468 (2013).
Duan, L.M., Lukin, M., Cirac, J. I. & Zoller, P. Longdistance quantum communication with atomic ensembles and linear optics. Nature 414, 413 (2001).
Minder, M. et al. Experimental quantum key distribution beyond the repeaterless secret key capacity. Nat. Photonics 13, 334 (2019).
Wang, S. et al. Beating the fundamental ratedistance limit in a proofofprinciple quantum key distribution system. Phys. Rev. X 9, 021046 (2019).
Fang, X.T. et al. Implementation of quantum key distribution surpassing the linear ratetransmittance bound. Nat. Photonics 14, 422–425 (2020).
Zhong, X., Hu, J., Curty, M., Qian, L. & Lo, H.K. Proofofprinciple experimental demonstration of twinfield type quantum key distribution. Phys. Rev. Lett. 123, 100506 (2019).
Chen, J.P. et al. Sendingornotsending with independent lasers: Secure twinfield quantum key distribution over 509 km. Phys. Rev. Lett. 124, 070501 (2020).
Pittaluga, M. et al. 600km repeaterlike quantum communications with dualband stabilization. Nat. Photonics 15, 530–535 (2021).
Clivati, C. et al. Coherent phase transfer for realworld twinfield quantum key distribution. Nat. Commun. 13, 1 (2022).
Wang, S. et al. Twinfield quantum key distribution over 830km fibre. Nat. Photonics 16, 154–161 (2022).
Tang, Z. et al. Experimental demonstration of polarization encoding measurementdeviceindependent quantum key distribution. Phys. Rev. Lett. 112, 190503 (2014).
Tang, Y.L. et al. Field test of measurementdeviceindependent quantum key distribution. IEEE J. Sel. Top. Quantum Electron. 21, 116 (2014).
Lo, H.K., Ma, X. & Chen, K. Decoy state quantum key distribution. Phys. Rev. Lett. 94, 230504 (2005).
Inoue, K., Waks, E. & Yamamoto, Y. Differentialphaseshift quantum key distribution using coherent light. Phys. Rev. A 68, 022317 (2003).
Sasaki, T., Yamamoto, Y. & Koashi, M. Practical quantum key distribution protocol without monitoring signal disturbance. Nature 509, 475 (2014).
Hwang, W.Y. Quantum key distribution with high loss: Toward global secure communication. Phys. Rev. Lett. 91, 057901 (2003).
Wang, X.B. Beating the photonnumbersplitting attack in practical quantum cryptography. Phys. Rev. Lett. 94, 230503 (2005).
Cao, Z., Zhang, Z., Lo, H.K. & Ma, X. Discretephaserandomized coherent state source and its application in quantum key distribution. N. J. Phys. 17, 053014 (2015).
Zeng, P., Wu, W. & Ma, X. Symmetryprotected privacy: Beating the ratedistance linear bound over a noisy channel. Phys. Rev. Appl. 13, 064013 (2020).
Jiang, C., Yu, Z.W., Hu, X.L. & Wang, X.B. Unconditional security of sending or not sending twinfield quantum key distribution with finite pulses. Phys. Rev. Appl. 12, 024061 (2019).
Xu, H., Yu, Z.W., Jiang, C., Hu, X.L. & Wang, X.B. Sendingornotsending twinfield quantum key distribution: Breaking the direct transmission key rate. Phys. Rev. A 101, 042330 (2020).
Jiang, C., Hu, X.L., Yu, Z.W. & Wang, X.B. Composable security for practical quantum key distribution with two way classical communication. N. J. Phys. 23, 063038 (2021).
Gottesman, D. & Lo, H.K. Proof of security of quantum key distribution with twoway classical communications. IEEE Trans. Inf. Theory 49, 457 (2003).
Chau, H. F. Practical scheme to share a secret key through a quantum channel with a 27.6 bit error rate. Phys. Rev. A 66, 060302 (2002).
Ma, X., Fung, C.H. F. & Razavi, M. Statistical fluctuation analysis for measurementdeviceindependent quantum key distribution. Phys. Rev. A 86, 052305 (2012).
Curty, M. et al. Finitekey analysis for measurementdeviceindependent quantum key distribution. Nat. Commun. 5, 3732 (2014).
Xu, F., Xu, H. & Lo, H.K. Protocol choice and parameter optimization in decoystate measurementdeviceindependent quantum key distribution. Phys. Rev. A 89, 052333 (2014).
Panayi, C., Razavi, M., Ma, X. & Lütkenhaus, N. Memoryassisted measurementdeviceindependent quantum key distribution. N. J. Phys. 16, 043005 (2014).
Azuma, K., Tamaki, K. & Munro, W. J. Allphotonic intercity quantum key distribution. Nat. Commun. 6, 1 (2015).
Scarani, V. et al. The security of practical quantum key distribution. Rev. Mod. Phys. 81, 1301 (2009).
Ferenczi, A. & Lütkenhaus, N. Symmetries in quantum key distribution and the connection between optimal attacks and optimal cloning. Phys. Rev. A 85, 052310 (2012).
Xie, Y.M. et al. Breaking the rateloss bound of quantum key distribution with asynchronous twophoton interference. PRX Quantum 3, 020315 (2022).
Acknowledgements
We especially thank Norbert Lütkenhaus for the helpful discussions on the security analysis, thorough proofreading, and beneficial suggestions on the manuscript presentation. We thank Yizhi Huang, Guoding Liu, Zhenhuan Liu, Tian Ye, Junjie Chen, Minbo Gao, and Xingjian Zhang for the helpful discussion on the pairing rate calculation and general comments on the presentation. We especially thank HaoTao Zhu and TengYun Chen for providing us with some preliminary results showing the phase stabilization after removing phaselocking in the modepairing scheme. This work was supported by the National Natural Science Foundation of China Grants No. 11875173 and No. 12174216 and the National Key Research and Development Program of China Grants No. 2019QY0702 and No. 2017YFA0303903.
Author information
Authors and Affiliations
Contributions
X.M. conceived the research. P.Z., H.Z. and X.M. designed the protocol. X.M., P.Z., W.W. and H.Z. finished the security analysis. P.Z. and W.W. performed the protocol analysis and numerical simulation. All authors contributed extensively to the preparation of this manuscript.
Corresponding author
Ethics declarations
Competing interests
The authors declare no competing interests.
Peer review
Peer review information
Nature Communications thanks the anonymous reviewer(s) for their contribution to the peer review of this work.
Additional information
Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Supplementary information
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made. The images or other third party material in this article are included in the article’s Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this license, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Zeng, P., Zhou, H., Wu, W. et al. Modepairing quantum key distribution. Nat Commun 13, 3903 (2022). https://doi.org/10.1038/s41467022315347
Received:
Accepted:
Published:
DOI: https://doi.org/10.1038/s41467022315347
This article is cited by

Experimental quantum digital signature based on heralded singlephoton sources
Quantum Information Processing (2024)

Efficient information reconciliation in quantum key distribution systems using informed design of nonbinary LDPC codes
Quantum Information Processing (2024)

Quantum sealedbid auction protocol with postconfirmation based on blind signature
Quantum Information Processing (2024)

Enhanced Performance of Measurementdeviceindependent Quantum Key Distribution over Turbulent Channels through Adaptive Optics
Quantum Information Processing (2024)

Improving the performance of practical phasematching quantum key distribution with advantage distillation
Quantum Information Processing (2024)
Comments
By submitting a comment you agree to abide by our Terms and Community Guidelines. If you find something abusive or that does not comply with our terms or guidelines please flag it as inappropriate.