Sending-or-not-sending twin-field quantum key distribution in practice

Recently, the twin field quantum key distribution (TF-QKD) protocols have been investigated extensively. In particular, an efficient protocol for TF-QKD with sending or not sending the coherent state has been given in. Here in this paper, we present results of practical sending-or-not-sending (SNS) twin field quantum key distribution. In real-life implementations, we need consider the following three requirements, a few different intensities rather than infinite number of different intensities, a phase slice of appropriate size rather than infinitely small size and the statistical fluctuations. We first show the decoy-state method with only a few different intensities and a phase slice of appropriate size. We then give a statistical fluctuation analysis for the decoy-state method. Numerical simulation shows that, the performance of our method is comparable to the asymptotic case for which the key size is large enough. Our method can beat the PLOB bound on secret key capacity. Our results show that practical implementations of the SNS quantum key distribution can be both secure and efficient.


Results
The decoy-state method with a few different intensities and a phase slice of appropriate size. In the four-intensity decoy-state SNS protocol, Alice and Bob randomly choose the X-window (decoy pulses) and Z-window (signal pulses) to send or not to send a phase-randomized coherent pulse to an untrusted party, Charlie, who is expected to perform interference measurement. The protocol is detailed below.
1. Alice and Bob repeat Steps 2-3, N times. All the public announcements by the legitimate users Alice and Bob are done over an authenticated channel. 2. Alice and Bob randomly choose X-window and Z-window with probabilities p X and 1−p X respectively.
Alice (Bob) prepares and sends the decoy pulses in her (his) X-window. Explicitly she (he) randomly choose one of three sources ρ α i with probability p i for i = 0, 1, 2, where ρ = | 〉〈 | α 0 0 0 is the vacuum source, ρ α 1 and ρ α 2 are two phase-randomized coherent sources with intensity μ 1 and μ 2 (μ 1 < μ 2 ) respectively. In Z-window, Alice (Bob) puts down a bit value 1 and prepares and sends the phase-randomized coherent state ρ α z with probability p z , or puts down a bit value 0 and sends nothing else, i.e., sends the vacuum pulse with probability 1−p z . 3. Charlie measures the incoming signals and records which detector clicks. When the quantum communication is over, he publicly announces all the information about the detection event. The situation when one and only one detector (detector 0 or detector 1) makes a count is denoted as an effective event. Alice and Bob collect all the data with effective events and discard all the others. 4. Alice and Bob announce the basis information (X-window or Z-window) firstly. Then they announce the bit values and phase information corresponding to the effective events when Alice or Bob choose X-window. With these information, Alice and Bob obtain the observable N jk (j, k = 0, 1, 2, z) being the number of instances when Alice and Bob send state ρ α j and ρ α k respectively. Correspondingly, the lowercases n jk are used to denote the number of effective events. The yields can be defined as S jk = n jk /N jk . Explicitly, we have N 11 , N 22 and N zz are the number of instances when Alice and Bob send state ρ α 1 , ρ α 2 and ρ α z respectively. Furthermore, In order to improve the results, the instances for basis unmatched are also considered and where p 0 = 1−p 1 −p 2 is the probability to send a vacuum pulse in X-window, is the number of instances when both Alice and Bob choose X-window and N XZ = p X (1−p X )N is the number of instances when Alice chooses X-window and Bob chooses Z-window. 5. Define two sets Δ + C and Δ − C that contain the instances when both Alice and Bob send ρ α 1 in X-window with the phase information θ A and θ B falling into the slice |θ A −θ B | ≤ Δ/2 and |θ A −θ B −π| ≤ Δ/2 respectively. The number of instances in Δ ± C are = π Δ Δ ± N N 11 2 11 . The number of effective events corresponding to Δ ± C are denoted by Δ ± n 11 0 and Δ ± n 11 1 for detector 0 and detector 1 respectively. 6. With these observables, Alice and Bob can estimate the lower bound of n 1 and the upper bound of e ph 1 by using the decoy-state methods shown below. Then the post-processing can be performed and the final key length is where N f is the number of final bits, n 1 is the number of effective events caused by single-photon states in Z-basis when Alice decides sending while Bob decides not sending or Alice decides not sending while Bob decides sending, e ph 1 is the phase-flip error rate for instances of n 1 , is the binary entropy function, f is the correction efficiency, n t is the number of effective events when both Alice and Bob choose Z-window and E Z is the corresponding bit-flip error rate.
Alternatively, we also have the equivalent formula for key rate per time window as shown in the section Methods.
In the above, for conciseness, we have omitted those mismatching time windows in a real protocol. For example, when Alice commits to a decoy window and Bob commits to a signal window. Although the events of these windows cannot be used for the final key distillation, the data for heralded events from these time windows can be used in the decoy-state analysis. The bit value encoding is defined by Alice or Bob's decision on sending or not-sending in a signal window. As shown in ref. 1 , we can relate the bit values with local ancillary states in the virtual protocol. Clearly, there isn't any definition confusion 47 in the SNS protocol 1 .
A tricky point in the SNS protocol is that the traditional decoy-state method can still work. In this protocol, the random phase information of Z-windows are never announced therefore we can regard pulses of Z-basis as classical mixture of different photon number states properly. Note that, very importantly, the random phase information in Z windows can never been announced because otherwise, the elementary concepts such as the www.nature.com/scientificreports www.nature.com/scientificreports/ number of single-photon counts are illy defined. But, as shown in details in ref. 1 , the random phase information in X-windows can be post announced. Because we only want to verify the phase-flip error rate of Z windows. The phase-flip rate of Z windows is an objective fact, once it is verified, it is there. The post announced phase information does not change this objective facts because no matter how Eve takes action with the post announced information, the action is just Eve's local action which can not make a difference to anything detectable to Alice and Bob.
Numerical simulation. In this section, we present some results of the numerical simulation. In order to show the efficiency of our method, without any loss of generality, we focus on the symmetric case where the two channel transmissions from Alice to Charlie and from Bob to Charlie are equal. We also assume that Charlie's detectors are identical, i.e., they have the same dark count rates and detection efficiencies, and their detection efficiencies do not depend on the incoming signals. The results for the asymmetric case will be considered in the coming work. We shall estimate what values would be probably observed in the normal cases by the linear models as previously. The values of the experimental parameters used in the simulations are listed in Table 1.
We optimize all parameters, p X , p 1 , p 2 p z , μ 1 , μ 2 , μ z and Δ by the method of full optimization. The results of optimized key rate with different N by four-inensity decoy-state method and the result with theoretical PLOB bound 49 are shown in Fig. 1. In it, we use the red solid line to denote the asymptotic results with infinite number of pulses. The optimal key rate with N = 10 14 , N = 10 13 and N = 10 12 are shown by the blue dotted line, the green dash-dot line and the black dashed line respectively. The result with theoretical PLOB bound is plotted by the thick magenta solid line. The numerical simulations show that the finite-size SNS protocol can overcome the PLOB bound. In Fig. 2, we plot the final key rates by the four-intensity and the three-intensity decoy-state methods with N = 10 12 . We can see that the optimal key rates for the three-intensity decoy-state method is nearly equal to the results for the four-intensity decoy-state method when we are aim for practically useable key-rates (such as 10 −6 per-pulse). In Fig. 3, we plot the optimal value of Δ for different distances with N = 10 12 by four-inensity decoy-state method. With this, we know that the optimal value of Δ are changed with different communication distance between Alice and Bob. The optimal value of Δ monotonically increases, to reduce the impact of statistical fluctuations, until it reaches a peak where the optimal key rate becomes decreasing dramatically and the error rate has a greater impact on the key rate than the statistical fluctuation.
Also, according to the observed data there 36 , we use a linear loss model to estimate the actual loss in the experiment for 404 km of ultralow-loss optical fiber (0.16 dB/km). Assuming the same device parameters (p d = 7.2 × 10 −8 , η d = 0.5525, f = 1.16, ε = 10 −10 , e a = 2% and N = 6.0 × 10 14 ), we make the optimization by using our SNS protocol with the four-intensity decoy-state method shown above. We obtain a final key rate of 141 bit per second (bps), which is more than 4.4 × 10 5 times higher than the reported experimental result, 3.2 × 10 −4 bps. Similarly, assuming the same device parameters (   www.nature.com/scientificreports www.nature.com/scientificreports/ and N = 2.178 × 10 14 ) for 421 km of ultralow-loss optical fiber (0.17 dB/km) in ref. 50 , we obtain a final key rate of 2.62 × 10 3 bit per second (bps), which is more than 1.05 × 10 4 times higher than the reported experimental result, 0.25 bps.

Discussion
In real setups of QKD, the practical situations with a few different intensities rather than infinite number of different intensities, a phase slice of appropriate size rather than infinitely small size and the statistical fluctuations must be considered. We first present the decoy-state method with a few different intensities and a phase slice of appropriate size. Then we show that the SNS protocol is a highly practical scheme even when the statistical fluctuations are considered. Numerical simulation shows that, the finite-size SNS protocol can exceed the PLOB bound. Our results show that practical implementations of the SNS TF-QKD can be both secure and efficient.

Methods
Decoy-state method analysis. In the protocol, Alice and Bob prepare and send the coherent pulses with randomized phase. The traditional formulas of decoy-state method can be applied directly. The coherent state whose phase is selected uniformly at random can be regard as a mixture of photon number states  www.nature.com/scientificreports www.nature.com/scientificreports/ where μ j = |α j | 2 is the intensity of the coherent state |α j 〉. Then the state when Alice decides not sending and Bob decides to send ρ α k is ρ μ = ∑ | 〉〈 | , has the following form Note: Replacing the source ρ 2 used in Eqs (4-6) with the source ρ z , we obtain the other lower bound of s Z 1 . With this replacement, source ρ 2 is not used actually, then the four-intensity decoy-state method can be simplified to a three-intensity decoy-state method by taking p 2 = 0. On the one hand, the three-intensity decoy-state method can be carried out easily in experiment. On the other hand, interested more in terms of practical key-rates instead of achieving the longest distance QKD possible (such as 10 −6 per-pulse), the key rate of the three-intensity decoy-state method is only a little lower than (less than one percent for the cases discussed in the numerical simulation) the results for the four-intensity decoy-state method.
In the rest of this section, we show the formula to estimate the upper bound of e ph 1 in Eq. (2) with the observable. The state of pulse pair when Alice sends the coherent state α μ = θ e A i 1 1 A and Bob sends the coherent state Considering the single-photon twin-field states in So we know that the single-photon states in set C Δ and in Z-basis have the same density matrices. The probability to emit a single-photon pulse from C Δ is μ = μ − q e 2 1 1 2 1 . With this relations, we know that the bit-flip error rate of single-photon state in set C Δ is equal to the phase-flip error rate e ph 1 asymptotically. The bit-flip error yield for all instances in set C Δ is where T k , k = Δ, Δ + , Δ − is the proportion of wrong effective events in C k , e.g. in N k 11 . Attribute all the error to the single-photon state and the vacuum state, the upper bound of phase-flip error rate e ph 1 can be estimated by where R is the final key rate, μ = μ − a e z 1 z is the probability to emit a single-photon state from source ρ z , s 1 is the yield of the single-photon state in Z-window when one party from Alice and Bob decides to send a signal states, e ph 1 is the phase-flip error rate for those instance of s 1 , S Z and E Z are the yield and bit-flip error rate for instances when both Alice and Bob choose Z-window.

Statistical fluctuation analysis.
In the real protocol with finite data size, in order to extract the secure final key, we have to consider the effect of statistical fluctuations. To obtain the lower bound value for s 1 and the upper bound value for e ph 1 in the real protocol with finite N, one can implement the idea of ref. 25 , i.e., treating the averaged yield. Accordingly, define 〈S〉 as the mean value of yield S. Note that even though S jk (j, k = 0, 1, 2, z) are known values directly observed in the experiment, the mean values 〈S jk 〉 are not. However, given the observed values S jk and the corresponding number of pulse pairs, the confidence lower and upper limits of 〈S jk 〉 can be calculated.
In order to obtain a tighter lower bound of 〈 〉 s Z 1 , we need introduce the following two yields  Replacing the observed yields with their mean values in Eqs (6) and (15)