Twin-field quantum key distribution without optical frequency dissemination

Twin-field (TF) quantum key distribution (QKD) has rapidly risen as the most viable solution to long-distance secure fibre communication thanks to its fundamentally repeater-like rate-loss scaling. However, its implementation complexity, if not successfully addressed, could impede or even prevent its advance into real-world. To satisfy its requirement for twin-field coherence, all present setups adopted essentially a gigantic, resource-inefficient interferometer structure that lacks scalability that mature QKD systems provide with simplex quantum links. Here we introduce a technique that can stabilise an open channel without using a closed interferometer and has general applicability to phase-sensitive quantum communications. Using locally generated frequency combs to establish mutual coherence, we develop a simple and versatile TF-QKD setup that does not need service fibre and can operate over links of 100 km asymmetry. We confirm the setup’s repeater-like behaviour and obtain a finite-size rate of 0.32 bit/s at a distance of 615.6 km.

Introduction.Communication at the single photon level enables quantum key distribution (QKD) to achieve a revolutionary milestone in information security, allowing two distant users to establish a cryptographic key with verifiable secrecy 1,2 .Decades' development has advanced fibre-based QKD systems to a maturity level that is suitable for showcasing long-term, uninterrupted services in real-world networks [3][4][5][6] .In such systems, quantum signals experience the loss of the entire link and thus their maximally achievable rates scale linearly with the channel transmittance (η) 7,8 .This rate-loss scaling leads to a prohibitively low rate for long haul links, while such links often bear strategic importance for connecting metropolitan cities. Theoretically, quantum repeaters 9,10 can improve this scaling to η 1 N +1 with N intermediate nodes and thus enable secure communications over arbitrarily long distances, but require technologies that are yet to become practical.
Twin-field (TF) QKD protocol 11 was recently proposed for practical long-haul quantum communications.Similarly to the form of QKD that achieves measurementdevice-independence 12,13 (MDI), it uses an intermediate measurement node that halves the signal transmission loss, but extracts information from single photon interference rather than two-photon coincidence so as to gain the advantageous repeater-like rate-loss scaling of √ η.Security against general attacks was proven for protocol variants [14][15][16][17][18][19][20] , among which sending-not-sending (SNS) 16 and no-phase-post selection (NPP) [17][18][19] remove partially the need for phase slice reconciliation and thus improve key generation efficiency.An exciting collection of experiments [21][22][23][24][25][26][27][28][29][30][31][32] has successfully validated TF-QKD's superior rate-loss scaling and repeatedly broken the communication distance record, which now stands at 833 km 31 .With above achievements, the primary experimental focus should now turn to addressing TF-QKD's implementation complexity, which would otherwise impair its * yuanzl@baqis.ac.cn practical deployment.Due to the stringent requirement for twin-field phase tracking, all existing long-haul TF-QKD setups have to adopt essentially a gigantic Mach-Zehnder inteferometer (MZI) configuration with half of its fibre used for optical frequency dissemination (Fig. 1a).Use of service fibre brings two severe drawbacks.First, the setups are fibre-resource inefficient and require additional frequency locking hardware and often optical amplifiers along the service fibre.Second, the closed fibre configuration is inherently incompatible with optical switching, which could restrict TF-QKD's scalability into a larger network like other QKD systems 33,34 .Using Sagnac interferometer permits a simple TF-QKD ring network 35 , but its long-haul capability could be obstructed by noise contamination due to counter-propagating signals of strong intensity disparity.Ideally, the twin-field phase could be stabilised without using a closed interferometer so as to reach a simple setup (Fig. 1b) sharing an identical fibre configuration as MDI-QKD.We note that new MDI-QKD variants were recently proposed to allow repeater-like rate-loss scaling via post-detection time-bin pairing 36,37 .Open quantum link stabilisation.To perform TF-QKD, it is necessary to ensure stable interference at the intermediate node (Charlie) between signals transmitted by two remote users (Alice and Bob).The differential phase (φ) between their signals evolves as where ∆ν is the difference between the users' laser frequencies (ν), s light speed in the fibre, and ∆L the length difference between the users' fibres to Charlie.The fibre term ( ν s d∆L dt ) contributes typically a few kHz to the phase instability for a fibre link of several hundred kilometers 11,27 .This kHz drift alone can be corrected for with a feedback loop of a sub-MHz bandwidth using a low-level reference signal, without scattering overwhelming noise photons and thus crucially maintaining the quantum channel intact.However, the laser term is more problematic.Free-running lasers have unsatisfying long-term stability, with daily frequency drift often in the region of 10 -100 MHz, although some can offer instantaneous linewidth of 1 kHz.Referencing to a high-fineness cavity helps, but the cavity itself drifts.Consequently, TF-QKD setups to date resort to sending strong laser signals to synchronise the users' lasers to enforce ∆ν = 0 and hence require a separate service fibre channel to avoid contamination to the quantum link (see Fig. 1a).The resulting setup has a closed fibre configuration.
In this work, we develop a scheme to stabilise an open quantum link between two distant users that share no prior mutual coherence and are separated by hundreds kilometers of single mode fibre.Using this scheme we have achieved a drastically simplified and versatile TF-QKD setup, capable of supporting asymmetric links, that needs neither dissemination of optical frequencies nor its associated service fibre and hardware, as schematically shown in Fig. 1b.Here, each user generates their local frequency comb and transmits one comb line to Charlie for interference, the outcome of which feeds into a photon-counting proportional-integral-derivative (PID) controller that allows rapid reading out and zeroing the laser frequency difference as well as cancelling the fi-bre fluctuation.Importantly, our solution brings neither performance degradation nor loss of practicality thanks partly to its choice of proven ingredients including ultrastable lasers 29,32 , optical frequency combs 30 and dualwavelength stabilisation 27,30 .Setup.Our setup (Fig. 2) does not need service fibre and has an identical fibre configuration as MDI-QKD 12 .Alice and Bob are connected to Charlie from opposite directions via their segments of the quantum link.The quantum link is made of spools of ultra-low loss fibres with an average loss coefficient of 0.168 dB km −1 .For detailed information on the fibre properties, refer to Supplementary Table S1.
Each user owns an independent continuous-wave laser that features a sub-Hz short-term linewidth and allows adjustment of its optical frequency at 1 mHz step size.See Methods for the detailed information on the lasers.Passing through a phase modulator (PM), the laser light is modulated to generate a frequency comb (Fig. 2a) with a precise spacing of 25 GHz thanks to the microwave frequency driver referenced to a Rubidium frequency standard.For 50 GHz dense-wavelength-divisionmultiplexing (DWDM) compatibility, two comb lines of λ q = 1549.72nm and λ c = 1550.52nm (ITU Channels 34.5 and 33.5) are selected and filtered into two separate paths.The continuous-wave λ c signal is used to establish coherence with the other user, and we refer to it as the 'channel reference'.The λ q signal passes through the encoder box (Fig. 2b), which carves the continuouswave input into a train of pulses of 300 ps width at an interval of 1 ns.The encoder's description is provided in Supplementary.We apply blockwise modulation for every 200 pulses.The first 95 pulses of each block do not receive further modulation and are used to sense the phase of the quantum channel.They are referred to as the 'quantum reference'.The last 100 pulses are modulated according to TF-QKD protocol's requirement.As these quantum pulses can be considerably weaker than the quantum reference, the encoder extinguishes the 5 pulses in between to create an empty buffer to prevent inter-group contamination.Overall, our setup has an effective QKD clock rate of 500 MHz.After the encoder box, the λ q light is recombined with the channel reference (λ c ) into the quantum channel segment using a DWDM filter.In addition to setting the approximate photon fluxes, both wavelengths paths have separate polarisation controls for pre-compensation of polarisation rotation by the quantum link.
After travelling through their respective quantum link segments, Alice and Bob's light enters Charlie's 50/50 interfering beam splitter with an identical polarisation and matched intensities.The interference outcome is spectrally de-multiplexed before detection by three superconducting nanowire single photon detectors (SNSPD's), with D 0 and D 1 assigned to the λ q signals and D c for the λ c channel reference.Charlie contains a PM in one of his input arms for fast phase feedback control.Charlie's components losses and detector performance is sum- marised in Supplementary Tables S2 and S3.
We describe briefly below, and provide more information in Section II of Supplementary, on how our setup is stabilised.For all different fibre lengths, we adjust the channel references' intensities to have a maximal interference visibility and maintain an average count rate of approximately 13 MHz at D c .This count rate allows 200 kHz sampling with acceptable noise by a fieldprogrammable-gated-array (FPGA) PID controller (not shown) to process and generate compensation voltages to Charlie's PM, locking the differential phase to π/2 between the channel references.This locking process cancels simultaneously both instability terms in Eq. (1), i.e., the laser frequency difference and fibre fluctuation.As described later, the FPGA controller allows real-time readout of the laser frequency difference and can thus apply feedback to one user's laser to prevent the laser drifting out of the PID's correction bandwidth.Due to coherence among comb lines, the frequency difference for the λ q signals is reduced by a factor of |λq−λc| λq . The phase drift by this residual difference can then be corrected for through a second stage compensation 27 which uses the interference result of the quantum reference to act on a fibre stretcher in Alice's encoder at a rate of 50-100 Hz.
Note that use of coherent combs enables the setup to support asymmetric channels, which can substantially ease fibre provision during installation.Experimental results.To evaluate the effectiveness of our open fibre scheme, we analyse the compensation signal that is applied to the Charlie's PM in response to the lasers' frequency difference (∆ν) and fibre fluctuation of the quantum channel.Figs.3a and 3b show the histograms of compensation signals integrated over 10 ms intervals for three different frequency offsets.For clarity, the PM compensation signal is converted to angular frequency with unit of 2π s −1 or Hz.For a 10 m quantum channel (Fig. 3a), the PID compensates mostly the laser frequency difference and we therefore observe a histogram of sharp distributions with its compensating signal tracking exactly the laser frequency difference.After installing 615.6 km fibre (Fig. 3b), each histogram becomes considerably broadened because the PID has now to work on also rapid and random fibre fluctuation.However, the peak of each histogram remains at the same angular frequency, as the random fibre fluctuation does not produce a net drift.We can then determine the laser frequency drift with high accuracy by increasing the readout time to just 100 ms, as shown in Fig. 3c, where the compensation rate follows strictly the frequency offset.This fast read- out enables real-time compensation for laser frequency drift, which is indispensable for long-term operation of TF-QKD.
Fig. 3d shows the interference results of the channel references at Charlie's interfering 50/50 beam-splitter after travelling the 615.6 km quantum channel.With the PID switched off, the measured optical power oscillates violently between constructive and destructive extremes due to fast fibre fluctuation.We extract an average fringe visibility of 97.8 %, which is noticeably worse than the value of 99.0 % obtained with a single laser serving both the users, illustrating a small penalty of using truly independent lasers.We extract a standard deviation of 1.07 kHz for the fibre drift, which is in good agreement with data extracted from the PID control (not shown) and comparable to those reported in the literature 11,27,29,31 .After enabling the PID control, the interference output is narrowed down to a tight band (green).We extract the phase angles and plot their distributions as shown in Figs.3e -3g.We obtain almost identical standard deviations of 0.099, 0.096 and 0.097 rad for different frequency offsets of -2, 0 and +2 kHz, suggesting the PID control is tolerant to at least 2 kHz detuning.A phase deviation of 0.1 rad will cause about 0.5 % drop in the interference visibility, which is acceptable for TF-QKD.After the PID control on the channel reference, the phase drift of the λ q signals is drastically slowed down, as shown by orange circles in Fig. 3d.The standard deviation of this drift rate is 0.72 Hz, which is 1500 times slower than the value for the unstabilised channel.We measure an interference fringe visibility of be 96.8 %, which will cause 1.6 % floor to the QBER in the phase basis.For detailed information on how the visibility values were extracted, refer to Section IV in Supplementary.
With the simplex channel stabilisation, we performed two sets of TF-QKD experiments using the SNS protocol 16,38,39 .In the first set, the users' channel losses to Charlie are strictly matched while their fibre lengths may differ by 10 km, which was introduced for compensating the loss by Charlie's PM.We ran the SNS protocol for three distances of 403.73, 518.16 and 615.59 km, with 2.025 × 10 12 , 2.475 × 10 12 and 1.418 × 10 13 total pulses sent respectively.We take the actively odd-parity pairing (AOPP) method for data post-processing, which can efficiently reduce the bit-flip error rate of the raw key and have a higher probability for pairing success than the random 'two-way classical communication' method 38 , and use the zigzag approach proposed in Ref. 39 in the secure key rate (SKR) calculation.The detailed experimental parameters and results can be found in Supplementary Tables S4-S6.In Fig. 4a, we present our experimental results (red square) in terms of SKR versus distance together with the simulation curve (red line).We include also the absolute repeaterless Pirandola-Laurenza-Ottaviani-Banchi bound 8 (black line), i.e., SKC 0 , which represents the fundamentally maximum rate that an ideal point-point QKD could achieve and can only be overcome by a repeater-like setup.With finite-size effects being taken into consideration, we obtain SKR's of 146.To further demonstrate the robustness of our open channel scheme, we explore the capability of our setup supporting asymmetric fibre links.With Bob's fibre fixed at 253.78 km, we ran experiments over two different distances of 201.87 and 153.45 km between Al-ice and Charlie, representing a link asymmetry of 51.91 and 100.33 km, respectively.For fair assessment, we use an identical parameter set and compensate the extra loss asymmetry by adding 8.13 dB attenuation to the 153.45 km link.During optimisation of the parameter set, we apply mathematical constraint that need to be satisfied for the security of asymmetric SNS protocol 40 and introduce a new constraint for the intensities of both decoy states to guarantee a high interference visibility at Charlie.The experimental results are shown in Fig. 4 (green triangles).We extract respective finitesize SKR's of 50.75 and 46.30 bit/s for the asymmetries of 51.91 km and 100.33 km, with a minor deterioration by extra 48 km asymmetry.This result improves considerably over the current asymmetry record of 22 km 30 , while most setups had to keep channels strictly matched down to meters 21,22,27,31 .Additionally, our result illustrates also the importance of parameter optimization for asymmetric links, as the obtained SKR's are thrice higher than the rate (green dashed line) expected if we just add attenuation to balance the fibre disparity.
We compare our open scheme with recent experiments that adopted the closed MZI configuration.As SKR's and distances are directly affected by the detector performance and/or the clock frequency, the relevant parameter to compare here is the quantum bit error rate (QBER) arising from the interfering twin-field signals that went through TF-QKD's phase randomisation process.Based on this criteria, we list in Table I the X-basis QBER for experiments that adopted also the SNS protocol.Within the margin of error, our system gives even a slightly better QBER of 4.75 % than the other setups 27,32 , showing no performance degradation from using truly independent lasers between an open quantum channel.Discussion.We have shown for the first time the capability of stabilising the phase of a simplex quantum link without resorting to a closed interferometer-type configuration.With the open-channel stabilisation technique we are able to achieve a simple and robust TF-QKD setup that can drastically ease fibre provision and route planning for future deployment.The technique could be adapted to enable free-space quantum experiments involving single-photon interference between remote light sources, including free-space TF-QKD.Moreover, its demonstrated frequency tolerance makes it possible to use less-demanding lasers, e.g., these lasers 41,42 that reference to absolute atomic or molecular transitions and feature typically 1 kHz linewidth, stimulating further simplification in TF-QKD setups.We believe our technique is applicable to phase-based quantum applications in general, including quantum repeaters 10 , single photon entanglement distribution 43 and quantum internet 44 .

Methods
Ultra-stable lasers.The ultra-stable lasers were manufactured by MenloSystems (Model: ORS-Cubic).Each  21,22,27,30,31 , time-frequency metrology 23,26,32 and optical injection locking 25,28 , to synchronise the users' lasers with the reference optical frequency delivered via a service fibre that is as long as the quantum fibre (see Fig. 1a).The subsequent twin-field phase can be either actively stabilised 22,27,30,31 or reconciled through post-selection at the data processing stage 25,29,32 , though the latter approach does not support NPP-TF-QKD protocols.Among active schemes, using a second wavelength 27,30 can suppress double Rayleigh scattering noise and increase the stabilisation bandwidth, while further introduction of inter-wavelength coherence 30 enables support for asymmetric fibre channels.The X-basis quantum bit error rate (QBER) is listed just for experiments that adopted the SNS protocol for fair comparison.laser emits at a wavelength of 1550.12 nm and features a sub-Hz short-term linewidth thanks to its use of Pound-Drever-Hall (PDH) technique for locking to a cavity with a fineness of 250000 and a free spectral range (FSR) of 3 GHz.In the PDH locking path there is an extra phase modulator which is driven at a base frequency of 300 MHz and allows fine adjustment of the laser frequency with a step size of 1 mHz.We measured the two lasers to have respective frequency drift rates of 110.4 mHz s −1 and 92.5 mHz s −1 in the same direction, and their differential frequency drifts about 1500 Hz per day.During initial characterisation of the TF-QKD setup, the frequency difference (∆ν) between the lasers was monitored through their beating note recorded by a photodiode and can be precisely set via adjusting the modulation frequency to the PM in one laser.This laser frequency drift can easily be corrected for by our photon-counting-based FPGA PID controller, so the offset monitoring by the photodiode is unnecessary during TF-QKD experiments.Our laser frequency feedback will work even when they are installed in separated locations.

Experiment
Coherent frequency comb.We generate the electrooptic frequency comb by passing the continuous-wave laser through a phase modulator that is driven by a stable microwave source with its power carefully set.Driving at 25 GHz, we obtain a total of 13 comb lines between 1548.9 nm to 1551.3 nm as shown in Fig. 2a.The comb lines of 1549.72 nm (λ q ) and 1550.52 nm (λ c ) are selected as the quantum signal and the channel reference respectively.Their spacing of 0.8 nm (100 GHz) compatible with the ITU G694.1 standard DWDM grid and allows convenient spectral filtering and wavelength routing.After spectral filtering, each comb line has an output power of ≥300 µW and channel isolation of >55 dB, both sufficient for TF-QKD encoding.
Protocol.In this experiment, we adopt a 4-intensity SNS-TF-QKD protocol with actively odd-parity pairing (AOPP) 38 for the data post-processing, with finite-size effects being taken into account.We describe the theory of asymmetric protocol 40 and mention that it also applies to the symmetric case when Alice and Bob have an identical loss to Charlie and use the same values for their source parameters.In this protocol, Alice and Bob repeat the following process N tot times to obtain a string of binary bits.In each time window, Alice (Bob) randomly decides whether it is a decoy window with probability p Ax (p Bx ) or a signal window with probability 1 − p Ax (1 − p Bx ).If it is a signal window, Alice (Bob) randomly prepares a phaserandomized weak coherent state (WCS) with intensity µ Az (µ Bz ) and decides whether to send it or not, with probabilities A ( B ) and 1− A (1− B ), respectively.For the decisions of not-sending in the signal windows, Alice (Bob) denotes them as bit 0 (1), and for the decisions of sending, Alice (Bob) denotes them as bit 1 (0).If a decoy window is chosen, Alice (Bob) randomly prepares phaserandomized WCS with intensities µ A0 (µ B0 ), µ A1 (µ B1 ) or µ A2 (µ B2 ) with respective probabilities 1 − p A1 − p A2 (1 − p B1 − p B2 ), p A1 (p B1 ) and p A2 (p B2 ).As was proven in Ref. 40 , in order to main the security of the protocol, the asymmetric source parameters should satisfy the following mathematical constraint Note that this requirement is automatically met for the symmetric protocol, and its purpose is to guarantee the users' raw key free from systematic bias.After the preparation stage, Alice and Bob send their pulses to the middle untrusted node, Charlie, who performs interference measurements and announces publicly which detector clicks.The detection events which one and only one detector clicks are taken as effective events.For time windows determined by both Alice and Bob to be a signal window, which are labelled as Z windows, Alice and Bob get two n t bits of raw key strings comprised by the corresponding bits from effective events.The bit-flip error rate of these two strings is denoted as E z .
Events in time windows determined by both Alice and Bob to be a decoy window, which are labelled as X windows, are used to perform the security analysis.In X windows where Alice and Bob choose intensities µ A1 and µ B1 , respectively, the phase information of their WCSs would be publicly announced and post-selected based on the following criteria where θ A1 and θ B1 are the private phases of Alice's and Bob's pulses respectively and M is the number of phase slices.
The AOPP method is used to reduce the errors of raw key strings before the error correction and privacy amplification processes.In AOPP, Bob first actively pairs his bits 0 with bits 1 of the raw key string and announces the pairing information to Alice.Alice performs the same pairing accordingly and they then compare the parity of pairs.They discard both bits in the pair if the announced parities are different and keep the first bit of the pairs if the parities are the same.The users now use the remaining bits to form a new shorter string n t with dramatically reduced bit-flip error rate E z , from which they will ex-tract the final key.
Next we briefly show how to extract the information of single-photon states, which constitutes the final key rate formula, from X-window events, through decoy-state analysis.We denote the counting rate of sources κζ in X windows by S κζ , which is the ratio of the number of corresponding effective events to the number of respective pulses sent out by Alice and Bob.These values can be measured in the experiment.Note that a statistical fluctuation analysis should be considered here as part of the finite-size effects, with more details being presented in Ref. 45 .Then we use the decoy-state method to deduce the counting rate of single-photon states which either Alice or Bob actually sends out a single photon from WCSs, which are 40 , respectively, where the notations • and • denote the lower and the upper bound of the corresponding expected values, respectively, with a composable definition of security and the Chernoff bound being applied.Their detailed explanations and expressions can be found in the Ref. 46 .Then the lower bound of the expected value of the counting rate of untagged bits, which is the number of bits generated through effective events when the users actually send out single-photon states in Z windows, is given by 40 and the lower bound of the expected value of the number of untagged bits is where is the number of pulses Alice and Bob both choose signal windows.Ac-cording to Ref. 40 , so long as Eq. 2 is satisfied, the phaseflip error rate of untagged bits in Z windows can be calculated from the bit-flip error rate of untagged bits in X windows, which is written as where T XX is the ratio of the number of corresponding error events over the number of total pulses with intensities µ A1 and µ B1 sent out in X windows.
The secret key rate (SKR) of AOPP with finite-size effects is given by where h are the number of untagged bits and their phase-flip error rate, respectively, after AOPP process.Here we adopt a zigzag approach proposed in Ref. 39 in order to obtain higher key rates and take all the finite-key effects efficiently, the same as the calculation method applied in experimental reference 28,29,32 .For simplicity, we do not list the calculation processes here, with all details can be found in the cited papers.
1 Beijing Academy of Quantum Information Sciences, Beijing 100193, China

I. ENCODER
The purpose of the encoder is to turn the continuouswave input into a 1 GHz, 300 ps pulse train with each pulse's intensity and phase set according to the requirements by a TF-QKD protocol.The encoder is capable of supporting all TF-QKD protocols, although just the SNS protocol was demonstrated in this work.Below, we describe the encoder with reference to Fig. 2b, Main Text.
The input light has its polarisation aligned to the slow axis of a series of intensity and phase modulators (3 IM's and 2 PM's), which are driven by a 25 GSa/s arbitrary waveform generator containing 2 waveform and 4 pattern output channels.IM 1 is modulated for pulse carving, IM 2 by a waveform signal for preparing pulses of different intensities, and IM 3 by a second binary signal for adjusting the intensity contrast between the 'quantum reference' and the quantum signal.Together, three IM's prepare pulses of five different intensity levels: µ qr (quantum reference), µ Z (signal state), µ 2 (strong decoy), µ 1 (weak decoy) and µ 0 (vacuum).The encoder is able to achieve >40 dB extinction ratio between the signal (µ Z ) and vacuum (µ 0 ) states.After intensity modulation, PM 1 and PM 2 encode the phase of each quantum signal pulse with one of 16 phase values, θ ∈ {0, π/8, 2π/8...15π/8} meeting TF-QKD's phase randomisation and qubit encoding requirement, while the quantum reference pulses are left unmodulated.The quantum signals are interleaved with the quantum reference in every 100 ns.Overall, the quantum signals occupy 50 % of the total time slots and have an effective clock rate of 500 MHz.In our experiments, we used a pattern length of 40000 bits, corresponding to a duration of 40 µs.Modulation patterns were carefully designed to produce correct sending and matching probabilities of different class of pulses as expected from the TF-QKD protocol.
All optical elements in each encoder are installed in an enclosure for stability.

II. ACTIVE FEEDBACKS
To ensure stable operation, we implemented four feedback routines to correct the photon polarisation, the fast phase drift, the slow residual phase drift, and the laser frequency difference.These routines require each user to have two mutually coherent wavelengths of λ c and λ q for channel reference and quantum reference/signal.
As shown in Fig. S1, each user's λ q and λ c signals of 100 GHz spacing are derived from the same laser via electro-optic frequency comb generation.They are separated by an optical filter with 55 dB isolation into two separate paths.The encoding path contains a fibre stretcher (FS), an electronically driven polarisation controller (EPC1) and a variable optical attenuator (VOA1) in addition to the modulation elements (not shown).The channel reference path is just a straight fibre.The two paths are multiplexed together by a 50 GHz Dense Wavelength Division Multiplexer (DWDM) into a second EPC (EPC2) and then sent to Charlie via the quantum link segment after being attenuated to the desired intensity by a second optical attenuator (VOA2).VOA1 sets the intensity contrast to a desired level between the two wavelengths, while VOA2 is to set the quantum signals to the correct fluxes as defined in Table S4.
At each input, Charlie uses a polarisation beam splitter (PBS) to ensure all photons entering his 50/50 interfering beam splitter (BS) to have an identical polarisation and thus achieve maximum interference visibility.Polarisation rotation by the quantum link segment will affect the transmission through the PBS.The reflected signals by the PBS is routed to two single photon detectors (D 2 and D 3 ) via a polarisation beam combiner and a DWDM.D 2 (D 3 ) detects the λ c (λ q ) photons and its count rate is minimised via controlling EPC2 (EPC1), thus maximising the transmissions.This feedback routine operates continuously at a rate of 5 -10 Hz.
The interference outcome between Alice and Bob's channel references (λ c ) is detected by D c and its count rate feeds to the FPGA PID controller which then computes a compensation voltage to drive Charlie's PM at a feedback rate of 200 kHz.This feedback locks Alice and Bob's channel reference signals to a differential phase of π/2, and corrects Alice and Bob's optical frequency difference and the fibre fluctuation of the entire quantum channel.The mutual coherence ensures the differential phase of the λ q wavelength is mostly compensated as well, with its residual amounting to about |λ q − λ c |/λ q of its original rate.This residual drift is then corrected for by Alice's FS with the feedback signal from D 1 's count rate.This slow feedback operates at a rate of 50 -100 Hz.
As described in Main Text (see Fig. 3c), the FPGA PID controller allows instantaneous readout of the laser frequency difference even when the lasers are separated by hundreds of kilometers fibres.Once the frequency offset exceeds a certain value, e.g., 300 Hz, Charlie transmits an instruction to Alice to offset her laser frequency accordingly.This feedback is applied less than daily thanks to the stability of the lasers.

III. SYSTEM LOSS CHARACTERISATION
In our setup, the quantum channel is made of ultralow-loss fibre spools (Corning G654.C ULL) of mainly 25.2 km and 50.4 km each in length.They were spliced into sets of different lengths to allow varying fibre lengths in experiments.Including loss from fibre connectors, the quantum channel was characterised to have an average loss coefficient of 0.168 dB km −1 .Table S1 summarises the lengths and their corresponding losses for the fibre configurations used in our experiments.
Inside Charlie's module, there is a chain of fibre components from either user's input port to the single photon detectors.These components and their losses are summarised in Table S2.Charlie's transmission loss at Alice's side is 4.5 dB, which is 2 dB higher than Bob's side because of the extra phase modulator.This 2 dB asymmetry was compensated either by a 2 dB attenuator in the symmetric 403.73 km experiment or by a 10 km fibre spool for all other experiments.
We present the performance of superconducting nanowire single photon detectors (SNSPD's: D 0 and D 1 ) in Table S3.These SNSPDs are polarisation-sensitive, so a manual polarisation controller is placed in front of each SNSPD for maximising the efficiency.Their noise counts include both detector dark counts (2 Hz) and scattered noise (2 Hz) from the fibre channel.

IV. VISIBILITY CHARACTERISATION
In this section, we describe how we measured the various interference visibilities reported in the Main Text.
To measure the interference visibility over a free-drifting long quantum channel, we use an optical power meter with a sampling rate of 500 kHz.Each measurement has a duration of 10 s and produces a corresponding data array of 5 × 10 6 samples.We compute a visibility (V ) for each segment of 2 × 10 4 samples (40 ms) from the average ( Īmax ) of the 5 highest values and the average ( Īmin ) of the 5 lowest values, We then calculate the average visibility from the entire 10 s data and its standard deviation.Fig. S2 shows the measured interference fringes for the channel reference over the free-drifting quantum channel of 615.6 km.When Alice and Bob shared a common laser (a), the measured visibility is just 99 % and this imperfect visibility is caused mainly by the 10 km asymmetry in the quantum link.The visibility drops to 97.8 % when Alice and Bob use truly independent lasers with nominally 0 Hz offset (b), illustrating the performance penalty by the loss of mutual frequency locking.Increasing the offset to 2 kHz (c, d), the measured visibility further decreases to ∼97.0 %.However, this further decrease is attributed mainly to the limitation of the power meter sampling rate, because the absolute drift rate is higher in the presence of a frequency offset, as shown in Fig. 3b of the Main Text.Note that Figs.S2c and d can also have destructive interference occasionally as low as those lowest in b when the net drift rate happens to be slow.
Once the quantum channel is stabilised by the FPGA PID controller, the residual phase drift of the quantum signal becomes much slower.In this case, we use a power meter at a slower sampling rate of 200 Hz.We record a 50 s data containing 10 4 samples.From every 10 s of data (2000 samples), we compute a visibility value from averaging 10 highest and 10 lowest values, and then compute the average visibility and its standard deviation.Fig. S3 reports the measurement result for the 615.6 km quantum channel with two independent lasers.The average visibility is 96.8 %.

V. DETAILED EXPERIMENTAL PARAMETERS AND RESULTS
In Table S4, we give the detailed experimental encoding parameters used for symmetrical and asymmetrical setups.Table S5 and S6 summarize the experimental results and quantities relative to the key rate calculation using AOPP for symmetric and asymmetric cases, respectively.The total number of signal pulses sent is given by N tot .The number of valid detections reported by Charlie is denoted as "Detected AB ab ", where "A" ("B") is X or Z indicating the basis Alice (Bob) chooses; "a" ("b") is 0, 1, 2 or 3 indicating the intensity Alice (Bob) chooses is µ A0 (µ B0 ), µ A1 (µ B1 ), µ A2 (µ B2 ), or µ Az (µ Bz ), respectively."QBER (X 11 )" and "QBER (X 22 )" represent the error rates in X bases for the decoy states with respective intensity "11" and "22".The rest of the notations is explained in the main text.TABLE S4.Encoding parameters used in the two sets of experiments.In symmetric experiments, Alice and Bob share an identical set of parameters.µZ , µ2, µ1 and µ0 are the values of mean photon number per pulse for signal, strong decoy, weak decoy and vacuum pulses.PZ is the probability of a pulse to be encoded in the coding (Z) basis.The parameter is the probability of a signal pulse to be actually sent when Z basis is chosen.PX = 1 − PZ is the selection probability of the checking (X) basis, while pµ 2 , pµ 1 and pµ 0 are the selection probabilities for preparing µ2, µ1 and µ0 decoy states in the X-encoding basis.

FIG. 1 .
FIG.1.Schematics of TF-QKD setups.In TF-QKD, the users (Alice and Bob) communicate with each other by sending encoded quantum signals at the single-photon level to the intermediate node (Charlie), who measures the interference using two single photon detectors.The protocol's stringent requirement for phase stability has rendered all existing setups to adopt a closed interferometer configuration, which is resource-inefficient and inflexible.a, Existing Mach-Zehnder interferometer setup27,30,31 .Alice and Bob inherit a common optical frequency νR that is disseminated by Charlie via the long service fibres.b, Open channel setup.Alice and Bob locally generate their own optical frequencies and their coherent side-bands of νA ± f0 and νB ± f0, with a nominally identical microwave frequency offset f0.One side-band is used to reconcile the laser frequency difference (∆ν = νA − νB), while the other is allocated quantum signal encoding.The open scheme eliminates the need for the service fibre and the optical frequency locking hardware, and supports asymmetric links.

FIG. 2 .
FIG. 2. Experimental setup.Alice (Bob) owns an independent ultrastable laser, the signal of which is modulated by a phase modulator (PM) to produce a frequency comb of 25 GHz spacing.Two comb lines separated by 100 GHz are chosen for quantum signal encoding (λq) and channel stabilisation (λc), respectively.Charlie contains a receiving 50/50 beam splitter to interfere the incoming signals.The λq photons are registered by D0 and D1 and the λc photons by Dc.Dc's count rate is used as error signal to the fast PID controller that cancels the twin-field phase fluctuation of the λc signals.a, Optical frequency comb measured after the PM; b, Encoder box.DWDM: dense wavelength-division multiplexing; EPC: electrically driven polarisation controller; FS: fibre stretcher; IM: Intensity Modulator; VOA: variable optical attenuator.

FIG. 3 .
FIG.3.Open quantum channel stabilisation.Alice and Bob's lasers are fully independent, and their frequency difference is adjustable by offsetting Alice's laser to a high-fineness cavity.Except a, all data in this figure were measured with the 615.6 km quantum fibre.a, Histograms of phase compensation signals integrated over 10 ms time intervals for a 10 m quantum link; b, same as a but with 615.6 km quantum link; c, Compensation signal angular frequency as a function of the laser frequency offset (∆ν).d, Optical output power as a function of time measured at one output of Charlie's 50/50 interfering beam-splitter; Purple (green): channel reference or the λc signal when the FPGA PID controller is turned off (on); Orange: slowed drift of the λq signal.e, f, g, The phase angle distributions of the channel reference before (purple) and after (green) the simplex channel stabilisation, measured for laser frequency offsets of -2, 0 and 2 kHz, respectively.Data in d -g were measured with a power meter.
is the binary Shannon entropy.f = 1.1 is the error correction efficiency factor.∆ = 2log 2 (2/ cor )+4log 2 (1/ √ 2 PA ˆ ) is the finite-size correction term, with cor = 10 −10 , PA = 10 −10 and ˆ = 10 −10 being the failure probabilities for error correction, privacy amplification and the coefficient of the smoothing parameter, respectively.n 1 and e ph 1 FIG. S1.Active feedbacks.Four feedback routines are implemented.1 Polarisation precompensation using detectors D2 and D3 as error signals to adjust EPC2 and EPC1; Rate: 5 -10 Hz. 2 Fast phase compensation for the channel reference λc using detector Dc as error signal to drive Charlie's phase modulator (PM); Rate: 200 kHz; 3 Active phase compensation for the quantum wavelength λq using detector D1's count rate as error signal to adjust Alice's fibre stretcher (FS); Rate: 50 -100 Hz; 4 Active correction of the laser frequency difference.Rate: daily.Routine 1 applies on both Alice and Bob, 2 locally at Charlie, 3 and 4 apply just on Alice.BS: beam splitter; DWDM: dense wavelength division multiplexer; EPC: electronically driven polarisation controller; PBS: polarisation beam splitter/combiner; PM: phase modulator; SMF: single mode fibre; VOA: variable optical attenuator.
FIG. S2.Free-drifting interference fringes.All data were measured with the 615.6 km (302.8 km + 312.8 km) that drifts freely and a power meter at a sampling rate of 500 kHz.a, Alice and Bob shared a common laser; b, Independent lasers with nominally 0-Hz frequency offet; c, As b but with +2 kHz frequency offset; d, As b but with -2 kHz offset.
FIG. S3.Interference fringes of the quantum wavelength.The 615.6 km (302.8 km + 312.8 km) was stabilised by the FPGA PID controller and the data were recorded by a power meter at 200 Hz.Alice and Bob used independent lasers with nominally 0 Hz detuning.
7, 14.38 and 0.32 bit/s for 403.73, 518.16 and 615.59 km, respectively.They all overcome the SKC 0 bound, confirming the repeater-like behavior of our setup.At 615.6 km, the SKR is 9.70 times above SKC 0 .

TABLE I .
A selection of recent state-of-the-art TF-QKD experiments and comparison with this work.All previous longhaul setups use optical frequency dissemination technologies, including homodyne/heterodyne optical phase locked loop (OPLL)

TABLE S1 .
Lengths and corresponding losses for the fibre links we used in the two sets of experiments.

TABLE S5 .
Finite-size symmetric SNS with AOPP: experimental results at various quantum link fibre lengths.

TABLE S6 .
Finite-size asymmetric SNS with AOPP: experimental results at various quantum link fibre lengths.