Introduction

Quantum key distribution (QKD)1,2 provides two distant parties (Alice and Bob) with a secure random bit string against any eavesdropper (Eve) guaranteed by the law of quantum mechanics. During the past three decades, QKD has rapidly developed both in theory and experiment3,4,5,6,7, and it is on the way to a wide range of implementation. Among all QKD experiments before, without quantum repeaters, the maximum key rates are bounded with respect to the channel transmittance η, defined as the probability for an effective detector click caused by a transmitted photon. So, one of the crucial tasks for the theorists is to find the maximum key rate achievable under ideal implementation (based on perfect single-photon sources, pure-loss channels, perfect detectors, perfect post-processing, and so on). With the aim of finding an upper bound of secret key rate, the theorists have provided several answers8,9,10. The recent work has provided the fundamental limit called Pirandola–Laurenza–Ottaviani–Banchi (PLOB) bound10, which establishes that the secret key rate without quantum repeaters must satisfy R ≤ −log(1 − η).

Remarkably, the twin-field (TF)-QKD protocol, proposed by Lucamarini et al.11, is capable of overcoming this PLOB bound with some restrictions on Eve’s strategies, which is mainly attributed to the single-photon interferometric measurement at the third untrusted party Eve. In other words, a single photon that came from either Alice or Bob interferes at Eve’s beam splitter and clicks the detector, which means that generating a secret key bears a unilateral transmission loss. Because of this dramatic breakthrough, a variant of TF-QKD protocols have been proposed consequentially12,13,14,15,16,17 and some protocols have been demonstrated experimentally18,19,20,21,22. For variant TF-QKD protocols, the key idea to ensure the security is switching probabilistically between a code mode and a test mode, where the former is for key generation, and the latter is for parameter estimation17. Among all TF-QKD protocols, their code modes are very different, e.g., modulating continuous phases11,12, modulating only two opposite phases14,15,16, and sending or not sending signal pulses13. The code modes of the first two kinds are similar in some sense. Intuitively, they may be explained by a unified view.

Interestingly, by discretizing the global phases of Alice and Bob’s emitted pulses in the code mode, we can give a unified view on two kinds of TF-QKD protocols11,12,14,15,16. Specifically, Alice and Bob encode classical bit 0, 1 into phases 0, π of a coherent state, respectively, then randomize them by adding a phase chosen randomly 0, π/M, 2π/M, …, (M − 1)π/M. According to whether or not to perform phase post-selection in the test mode, we introduce two protocols. To prove their security, we establish a universal framework against collective attacks, which can be extended to robust against coherent attacks23 with the technique in ref. 24. The security analysis indicates that increasing the number of discrete phases can extend the achievable distance but lower the secret key rate at short distances due to the phase post-selection. Furthermore, simulation results show that a small number of random phases (say M = 2) may be the best choice for practical implementations.

Results

We first describe details of our proposed TF-QKD protocols that have discrete phase randomization in the code mode, and the schematic set-up is shown in Fig. 1.

Fig. 1: Schematic set-up of our twin-field quantum key distribution protocols.
figure 1

In each trial, Alice and Bob randomly choose code mode and test mode and send their quantum states to the untrusted receiver Eve. If a code mode is selected, Alice (Bob) prepares coherent state chosen from \(\{|\alpha {e}^{i{k}_{a(b)}\pi }\rangle ,|\alpha {e}^{i({k}_{a(b)}+\frac{1}{M})\pi }\rangle ,\ldots ,|\alpha {e}^{i({k}_{a(b)}+\frac{M-1}{M})\pi }\rangle \}\). If a test mode is selected, Alice (Bob) prepares coherent state chosen from \(\{\left|{\beta }_{0}{e}^{i{\phi }_{0}}\right\rangle ,\left|{\beta }_{1}{e}^{i{\phi }_{1}}\right\rangle ,\ldots ,\left|{\beta }_{k}{e}^{i{\phi }_{k}}\right\rangle \}\). After interference at beam splitter (BS) and detector click on Eve’s side, she announces the outcome. More detailed explanation can be found in protocol descriptions.

Protocol I

Step 1. Alice and Bob randomly choose code mode or test mode in each trial.

Step 2. If a code mode is selected, Alice (Bob) randomly generates a key bit ka (kb) and a random number x (y) and then prepares the coherent state \(\left|\alpha {e}^{i({k}_{a}+\frac{x}{M})\pi }\right\rangle\) (\(|\alpha {e}^{i({k}_{b}+\frac{y}{M})\pi }\rangle\)), where xy {0, 1, 2, …, M − 1}. If a test mode is selected, Alice (Bob) generates a random phase ϕa [0, 2π) (ϕb [0, 2π)) and emits coherent state \(\left|{\beta }_{a}{e}^{i{\phi }_{a}}\right\rangle\) (\(\left|{\beta }_{b}{e}^{i{\phi }_{b}}\right\rangle\)), where βa (βb) is randomly chosen from a pre-decided set.

Step 3. Alice and Bob send their quantum states to the untrusted receiver Eve. For each trial, only three outcomes are acceptable, which are “Only detector L clicks”, “Only detector R clicks”, and “No detectors click”, and Eve announces one of these outcomes. Note that the outcome “Both detectors L and R click” is considered as “No detectors click”.

Step 4. Alice and Bob repeat the above steps many times. For the successful detection outcomes (only detector L or R clicks), Alice and Bob publicly announce which trials are the code modes and which trials are the test modes. For each successful trial in the code mode, Alice and Bob announce their x and y, and keep ka, kb as their raw key if x = y. Moreover, Bob should flip his key kb if Eve announces “Only detector R clicks”.

Step 5. For each trial that both Alice and Bob select test mode, Alice and Bob announce βa with random phase ϕa and βb with random phase ϕb, and only keep the trial that βa = βb and ϕa − ϕb = 0 or π.

Step 6. Alice and Bob perform information reconciliation and privacy amplification to extract the final secure keys.

For the simplicity in experiments, we can remove post-selection in the test mode, and the simplified protocol runs as follows.

Protocol II

Step 1. Same as Protocol I.

Step 2. Same as Protocol I.

Step 3. Alice and Bob send their quantum states to the untrusted receiver Eve. For each trial, only three outcomes are acceptable, which are “Only detector L clicks”, “Only detector R clicks”, and “No detectors click”. Note that, the outcome “Both detectors L and R click” is considered as “No detectors click” in the code mode and is considered as only detector L or R clicks with equal probability in the test mode. Consequentially, Eve announces one of these outcomes.

Step 4. Alice and Bob repeat the above steps many times. For the successful detection outcomes (only detector L or R clicks), Alice and Bob publicly announce which trials are the code modes and which trials are the test modes. For each successful trial in the code mode, Alice and Bob announce their x and y, and keep ka, kb as their raw key if x = y. Moreover, Bob should flip his key kb if Eve announces “Only detector R clicks”.

Step 5. For each trial that both Alice and Bob select the test mode, the yield Yl,k, probability of Eve announcing the successful outcome provided Alice emits l-photon state and Bob emits k-photon state, can be estimated.

Step 6. Same as Protocol I.

Our security proof is based on Devetak–Winter’s bound25, concretely, bounding the information leakage IAE. Thus the secret key rate is given by

$$R\ge \frac{1}{M}Q(1-fH(e)-{I}_{{\rm{AE}}}),$$
(1)

where Q is the counting rate, 1/M is the shifting factor, e is the error rate, and f is the error correction efficiency. By applying infinite decoy states26,27,28,29 in the test mode, we can simulate the performance of our two protocols with different M. The simulation parameters are given in Table 1. For Protocol I, we present the numerical simulations of secret key rate in Fig. 2 and the maximal channel loss in Table 2. If we remove the sifting efficiency, the limitary channel loss with M →  is 81.5 dB as shown in Table 2. According to Fig. 2 and Table 2, it is sufficient to apply TF-QKD with M = 2, which almost reaches the theoretical limit channel loss. Analogously, for Protocol II, we get simulation results comparable to those of Protocol I, and we show the secret key rate in Fig. 3 and the theoretical limit channel loss in Table 3. When removing the sifting factor, the maximal channel loss of Protocol II with M →  is 75.8 dB. In addition, one may refer to “Methods” section and Fig. 4 for the cases with finite decoy states.

Table 1 Parameters.
Fig. 2: Secret key rate R versus channel loss for Protocol I.
figure 2

The curves represent the secure key rate of twin-field quantum key distribution protocol for M = 1, M = 2, and M = 4 (M is the number of random phases) and the Pirandola–Laurenza–Ottaviani–Banchi (PLOB) bound, respectively. We do not show the case of M →  because the key rate tends to 0.

Table 2 The maximal channel loss for Protocol I with different M.
Fig. 3: Secret key rate R versus channel loss for Protocol II.
figure 3

The curves represent the secure key rate of twin-field quantum key distribution protocol for M = 1, M = 2, and M = 4 (M is the number of random phases) and the Pirandola–Laurenza–Ottaviani–Banchi (PLOB) bound, respectively. We do not show the case of M →  because the key rate tends to 0.

Table 3 The maximal channel loss with Protocol II different M.
Fig. 4: Secret key rate R versus channel loss for Protocol II with M = 2 (M is the number of random phases).
figure 4

The curves represent the secure key rate in the case of infinite intensities, three intensities, and the Pirandola–Laurenza–Ottaviani–Banchi (PLOB) bound, respectively.

When we compare Protocol I with Protocol II, the latter one does not require post-selection in the test mode; as a trade-off, the maximal channel loss will be lower. Here we consider the relationship with several varietal TF-QKD protocols12,14,15,16. When M → , Protocol I is exactly the phase matching QKD12 if we relax the post-selection condition ϕa − ϕb = 0 or π and add a corresponding sifting factor. When M = 1, Protocol II is the same as14,15,16 in the code mode, the difference is the way to estimate the information leakage or the “phase error”. To some extent, our proposed TF-QKD protocols with discrete phase randomization in code mode cover the four varietal TF-QKD protocols above.

Discussion

In summary, we have introduced a variant TF-QKD with discrete phase randomization in the code mode and proven its security in asymptotic scenarios. Our protocol can be viewed as a generalization of the four varietal TF-QKD protocols12,14,15,16 to some extent. The security proof discloses that the transmission distance becomes longer with M exponentially increasing; as a trade-off, the secret key rate is lower at short distances. As a result, the transmission distance reaches a limitation when M tends to infinity. Numerical simulations show that it is sufficient to apply TF-QKD with M = 2, for it almost reaches the limitary transmission distance at the cost of about half of secret key rate, compared with the case of M = 1, at short distance. Furthermore, post-selection in the test mode is not convenient in experiment, thus we remove it to make experiments simpler in a modified protocol. We find that the removal of post-selection in the test mode has very limited influence on the secret key rate and achievable distance. Our findings expect that TF-QKD can be run with optimal phase randomization actively, i.e., at short distance one can simply bypass phase randomization, while a phase randomization of 0 or π/2 is sufficient at the long distance case.

During the preparation of this paper, we found that Primaatmaja et al.30 proposed an open question that if coding phases in TF-QKD under different bases, which is quite similar to our idea of phase discrete randomization, can improve secret key rate significantly. Their open question is answered by our finding that M = 2 is almost optimal in some sense.

Methods

Security proof

Here we present security proof Protocol I. First, we analyze the composite states shared by Alice and Bob when they both select the test mode. In the case of βa = βb = β and ϕa = ϕb = ϕ, the composite state of Alice and Bob can be written as

$${\rho }_{{\rm{AB}}} =\frac{1}{2\pi }\int_{0}^{2\pi }d\phi \left|\beta {e}^{i\phi }\right\rangle \left|\beta {e}^{i\phi }\right\rangle \left\langle \beta {e}^{i\phi }\right|\left\langle \beta {e}^{i\phi }\right|\\ =\sum_{n = 0}^{\infty }{P}_{n}\left|n,+\right\rangle \left\langle n,+\right|,$$
(2)

where the fock state is defined as

$$\left|n,+\right\rangle =\frac{1}{\sqrt{{2}^{n}n!}}{({a}^{\dagger }+{b}^{\dagger })}^{n}{\left|00\right\rangle }_{{\rm{AB}}},$$
(3)

and the probability is given by

$${P}_{n}={e}^{-2\mu }\frac{{(2\mu )}^{n}}{n!},$$
(4)

where μ = β2 is the light intensity. In the case of βa = βb = β and ϕa = ϕb + π(mod 2π) = ϕ, the composite state of Alice and Bob can be written as

$${\rho }_{{\rm{AB}}} =\frac{1}{2\pi }\int_{0}^{2\pi }{\rm{d}}\phi \left|\beta {e}^{i\phi }\right\rangle \left|-\beta {e}^{i\phi }\right\rangle \left\langle \beta {e}^{i\phi }\right|\left\langle -\beta {e}^{i\phi }\right|\\ =\sum_{n = 0}^{\infty }{P}_{n}\left|n,-\right\rangle \left\langle n,-\right|,$$
(5)

where the fock state is defined as

$$\left|n,-\right\rangle =\frac{1}{\sqrt{{2}^{n}n!}}{({a}^{\dagger }-{b}^{\dagger })}^{n}{\left|00\right\rangle }_{{\rm{AB}}},$$
(6)

with probability Pn.

In what follows, we concentrate on bounding Eve’s Holevo information. Eve’s general collective attack can be given by

$${U}_{{\rm{Eve}}}{\left|n,\pm \right\rangle }_{{\rm{AB}}}{\left|e\right\rangle }_{E}=\sqrt{{Y}_{n,\pm }^{L}}\left|{\gamma }_{n,\pm }^{L}\right\rangle \left|L\right\rangle +\sqrt{{Y}_{n,\pm }^{R}}\left|{\gamma }_{n,\pm }^{R}\right\rangle \left|R\right\rangle +\sqrt{{Y}_{n,\pm }^{N}}\left|{\gamma }_{n,\pm }^{N}\right\rangle \left|N\right\rangle,$$
(7)

where state \({\left|e\right\rangle }_{{\rm{E}}}\) is Eve’s ancilla. Then Eve is supposed to announce one of legal outcomes “Only detector L clicks”, “Only detector R clicks”, and “No detectors click” determined by her measurement results “\(\left|L\right\rangle\)”, “\(\left|R\right\rangle\)”, and “\(\left|N\right\rangle\)”, respectively. In the case of βa = βb and ϕa = ϕb, \(|{\gamma }_{n,+}^{L}\rangle\), \(|{\gamma }_{n,+}^{R}\rangle\), and \(|{\gamma }_{n,+}^{N}\rangle\) are some arbitrary quantum states referring to Eve’s measurement results “\(\left|L\right\rangle\)”, “\(\left|R\right\rangle\)”, and “\(\left|N\right\rangle\)”, respectively. \({Y}_{n,+}^{L}\), \({Y}_{n,+}^{R}\), and \({Y}_{n,+}^{N}\) satisfying \({Y}_{n,+}^{L}+{Y}_{n,+}^{R}+{Y}_{n,+}^{N}=1\) are the yields referring to Eve’s measurement results “\(\left|L\right\rangle\)”, “\(\left|R\right\rangle\)”, and “\(\left|N\right\rangle\)”, respectively. Similarly, in the case of βa = βb and ϕa − ϕb = π, \(|{\gamma }_{n,-}^{L}\rangle\), \(|{\gamma }_{n,-}^{R}\rangle\), and \(\|{\gamma }_{n,-}^{N}\rangle\) are some arbitrary quantum states referring to Eve’s measurement results “\(\left|L\right\rangle\)”, “\(\left|R\right\rangle\)”, and “\(\left|N\right\rangle\)”, respectively. \({Y}_{n,-}^{L}\), \({Y}_{n,-}^{R}\), and \({Y}_{n,-}^{N}\) satisfying \({Y}_{n,-}^{L}+{Y}_{n,-}^{R}+{Y}_{n,-}^{N}=1\) are the yields referring to Eve’s measurement results “\(\left|L\right\rangle\)”, “\(\left|R\right\rangle\)”, and “\(\left|N\right\rangle\)”, respectively.

Without loss of generality, we first consider the secret key rate when her measurement result is “\(\left|L\right\rangle\)”. When Alice and Bob both select the code mode, the initial prepared state \(\left|\alpha {e}^{i({k}_{a}+\frac{x}{M})\pi }\right\rangle\) and \(|\alpha {e}^{i({k}_{b}+\frac{y}{M})\pi }\rangle\), with matched-basis trials x = y, can be given by

$$\left|\alpha {e}^{i\frac{x}{M}\pi }\right\rangle \left|\alpha {e}^{i\frac{x}{M}\pi }\right\rangle =\sum_{n = 0}^{\infty }\sqrt{{P}_{n}}{e}^{i\frac{nx\pi }{M}}\left|n,+\right\rangle ,{k}_{a}={k}_{b}=0\\ \left|-\alpha {e}^{i\frac{x}{M}\pi }\right\rangle \left|-\alpha {e}^{i\frac{x}{M}\pi }\right\rangle =\sum_{n = 0}^{\infty }\sqrt{{P}_{n}}{e}^{i\frac{n(M+x)\pi }{M}}\left|n,+\right\rangle ,{k}_{a}={k}_{b}=1\\ \left|\alpha {e}^{i\frac{x}{M}\pi }\right\rangle \left|-\alpha {e}^{i\frac{x}{M}\pi }\right\rangle =\sum_{n = 0}^{\infty }\sqrt{{P}_{n}}{e}^{i\frac{nx\pi }{M}}\left|n,-\right\rangle ,{k}_{a}=0,{k}_{b}=1\\ \left|-\alpha {e}^{i\frac{x}{M}\pi }\right\rangle \left|\alpha {e}^{i\frac{x}{M}\pi }\right\rangle =\sum_{n = 0}^{\infty }\sqrt{{P}_{n}}{e}^{i\frac{n(M+x)\pi }{M}}\left|n,-\right\rangle ,{k}_{a}=1,{k}_{b}=0.$$
(8)

For the sake of simplicity, we define unnormalized states

$$\left|{\psi }_{j,\pm }^{L/R}\right\rangle =\sum_{n = 0}^{\infty }\sqrt{{P}_{2Mn+j}{Y}_{2Mn+j,\pm }^{L/R}}\left|{\gamma }_{2Mn+j,\pm }^{L/R}\right\rangle ,$$
(9)

where j {0, 1, 2, …, 2M − 1}. We also define other unnormalized states

$$ \left|{\psi }_{{\rm{ex}},\pm }^{L/R}\right\rangle =\sum_{j = 0}^{M-1}{e}^{i\frac{2jx\pi }{M}}\left|{\psi }_{2j,\pm }^{L/R}\right\rangle \\ \left|{\psi }_{{\rm{ox}},\pm }^{L/R}\right\rangle =\sum_{j = 0}^{M-1}{e}^{i\frac{(2j+1)x\pi }{M}}\left|{\psi }_{2j+1,\pm }^{L/R}\right\rangle,$$
(10)

After Eve’s attack according to Eq. (7) and her announcing “\(\left|L\right\rangle\),” Alice and Bob keep trials only if x = y. Thus the unnormalized state of Eve conditioned on Alice’s classical bit can be given by

$${\rho }_{{\rm{AE}}x}^{L}= \frac{1}{4}{\left|0\right\rangle }_{{\rm{A}}}\left\langle 0\right|\otimes \left(P\left\{\left|{\psi }_{{\rm{ex}},+}^{L}\right\rangle +\left|{\psi }_{{\rm{ox}},+}^{L}\right\rangle \right\}\right.\\ \left.+\, P\left\{\left|{\psi }_{{\rm{ex}},-}^{L}\right\rangle +\left|{\psi }_{{\rm{ox}},-}^{L}\right\rangle \right\}\right)+\frac{1}{4}{\left|1\right\rangle }_{{\rm{A}}}\left\langle 1\right|\ \otimes \left(P\left\{\left|{\psi }_{{\rm{ex}},+}^{L}\right\rangle -\, \left|{\psi }_{{\rm{ox}},+}^{L}\right\rangle \right\}+P\left\{\left|{\psi }_{{\rm{ex}},-}^{L}\right\rangle -\left|{\psi }_{{\rm{ox}},-}^{L}\right\rangle \right\}\right),$$
(11)

where \(P\{\left|x\right\rangle \}=\left|x\right\rangle \left\langle x\right|\). The probability of Alice obtaining a shifted key (x = y) in a code mode when Eve announces “\(\left|L\right\rangle\)” is

$${Q}_{x}^{L}=\frac{1}{2}\left(\left| \left|{\psi }_{{\rm{ex}},+}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{{\rm{ox}},+}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{{\rm{ex}},-}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{{\rm{ox}},-}^{L}\right\rangle \right| ^{2}\right),$$
(12)

and correspondingly an error click occurs if kakb = 1, thus the error rate of shifted key (x = y) is given by

$$\begin{array}{ll}{e}_{x}^{L}&=\frac{| \left|{\psi }_{{\rm{ex}},-}^{L}\right\rangle {| }^{2}+| \left|{\psi }_{{\rm{ox}},-}^{L}\right\rangle {| }^{2}}{| \left|{\psi }_{{\rm{ex}},+}^{L}\right\rangle {| }^{2}+| \left|{\psi }_{{\rm{ox}},+}^{L}\right\rangle {| }^{2}+| \left|{\psi }_{{\rm{ex}},-}^{L}\right\rangle {| }^{2}+| \left|{\psi }_{{\rm{ox}},-}^{L}\right\rangle {| }^{2}} =\frac{| \left|{\psi }_{{\rm{ex}},-}^{L}\right\rangle {| }^{2}+| \left|{\psi }_{{\rm{ox}},-}^{L}\right\rangle {| }^{2}}{2{Q}_{x}^{L}},\end{array}$$
(13)

Thanks to the strong subadditivity of von Neumann entropy (the detailed derivation of how we apply the strong subadditivity is in the Appendix A of ref. 31), Eve’s Holevo information with her announcing “\(\left|L\right\rangle\)” is given by

$${I}_{{\rm{AE}}x}^{L} \le (1-{e}_{x}^{L})H\left(\frac{\left| \left|{\psi }_{{\rm{ex}},+}^{L}\right\rangle \right| ^{2}}{2(1-{e}_{x}^{L}){Q}_{x}^{L}}\right)+{e}_{x}^{L}H\left(\frac{\left| \left|{\psi }_{{\rm{ex}},-}^{L}\right\rangle \right| ^{2}}{2{e}_{x}^{L}{Q}_{x}^{L}}\right)\\ \le H\left(\frac{\left| \left|{\psi }_{{\rm{ex}},+}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{{\rm{ex}},-}^{L}\right\rangle \right| ^{2}}{2{Q}_{x}^{L}}\right),$$
(14)

where \(H(x)=-x\ {\mathrm{log}\,}_{2}x-(1-x){\mathrm{log}\,}_{2}(1-x)\) is binary Shannon entropy and the second inequality holds due to Jensen’s inequality. For each trial that x = y and Eve announces “\(\left|L\right\rangle\)”, the secret key rate is given by

$${R}_{x}^{L}={Q}_{x}^{L}(1-fH({e}_{x}^{L})-{I}_{{\rm{AE}}x}^{L}),$$
(15)

where f is error correction efficiency. What we need to do next is to calculate the average secret key rate for different x when Eve announces “\(\left|L\right\rangle\).” Without considering the sifting factor, the average secret key rate when Eve announces “\(\left|L\right\rangle\)” is given by

$${R}^{L}=\frac{1}{M}\sum_{x = 0}^{M-1}{R}_{x}^{L}=\frac{1}{M}\sum_{x = 0}^{M-1}{Q}_{x}^{L}(1-fH({e}_{x}^{L})-{I}_{{\rm{AE}}x}^{L}).$$
(16)

We use QL to denote the average gain and eL to denote the average error rate of shifted key, which are written as

$${Q}^{L}=\frac{1}{M}\sum_{x = 0}^{M-1}{Q}_{x}^{L}\\ {e}^{L}=\frac{\mathop{\sum }\nolimits_{x = 0}^{M-1}{Q}_{x}^{L}{e}_{x}^{L}}{\mathop{\sum }\nolimits_{x = 0}^{M-1}{Q}_{x}^{L}}.$$
(17)

Thanks to the concavity of binary Shannon entropy, we utilize Jensen’s inequality to minimize RL. For the second term of Eq. (16) on the right, we have

$$\frac{1}{M}\sum_{x = 0}^{M-1}{Q}_{x}^{L}H({e}_{x}^{L})\le {Q}^{L}H\left(\frac{\frac{1}{M}\mathop{\sum }\nolimits_{x = 0}^{M-1}{Q}_{x}^{L}{e}_{x}^{L}}{{Q}^{L}}\right)={Q}^{L}H({e}^{L}).$$
(18)

The condition for equality of Eq. (18) is that \({e}_{0}^{L}={e}_{1}^{L}=\ldots ={e}_{M-1}^{L}\). Similarly, for the third term of Eq. (16) on the right, we have

$$\frac{1}{M}\sum_{x = 0}^{M-1}{Q}_{x}^{L}{I}_{{\rm{AE}}x}^{L} \le \frac{1}{M}\sum_{x = 0}^{M-1}{Q}_{x}^{L}H\left(\frac{\left| \left|{\psi }_{{\rm{ex}},+}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{{\rm{ex}},-}^{L}\right\rangle \right| ^{2}}{2{Q}_{x}^{L}}\right)\\ \le {Q}^{L}H\left(\frac{1}{2M{Q}^{L}}\mathop{\sum }\limits_{x = 0}^{M-1}\left| \sum_{j = 0}^{M-1}{e}^{i\frac{2jx\pi }{M}}\left|{\psi }_{2M+2j,+}^{L}\right\rangle \right| ^{2}\right.\\ \left.\hskip0.8pc+\left| \sum_{j = 0}^{M-1}{e}^{i\frac{2jx\pi }{M}}\left|{\psi }_{2M+2j,-}^{L}\right\rangle \right| ^{2}\right)\\ ={Q}^{L}H\left(\frac{\mathop{\sum }\nolimits_{j = 0}^{M-1}\left| \left|{\psi }_{2M+2j,+}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,-}^{L}\right\rangle \right| ^{2}}{2{Q}^{L}}\right).$$
(19)

Here we define \({I}_{{\rm{AE}}}^{L}=H\left(\frac{\mathop{\sum }\nolimits_{j = 0}^{M-1}| \left|{\psi }_{2M+2j,+}^{L}\right\rangle {| }^{2}\,+\,| \left|{\psi }_{2M+2j,-}^{L}\right\rangle {| }^{2}}{2{Q}^{L}}\right)\). Consequently, we have

$${R}^{L}\ge {Q}^{L}(1-fH({e}^{L})-{I}_{{\rm{AE}}}^{L}).$$
(20)

Similarly, when Eve’s measurement result is “\(\left|R\right\rangle\)”, the analysis of secret key rate is almost the same with the ones when she announces “\(\left|L\right\rangle\)”. Thus the secret key rate when Eve announces “\(\left|R\right\rangle\)” is given by

$${R}^{R}\ge {Q}^{R}(1-fH({e}^{R})-{I}_{{\rm{AE}}}^{R}),$$
(21)

where \({I}_{{\rm{AE}}}^{R}\) is given by

$${I}_{{\rm{AE}}}^{R}=H\left(\frac{\mathop{\sum }\nolimits_{j = 0}^{M-1}\left| \left|{\psi }_{2M+2j,-}^{R}\right\rangle \right | ^{2}+\left | \left|{\psi }_{2M+2j,+}^{R}\right\rangle \right | ^{2}}{2{Q}^{R}}\right).$$
(22)

The trials when Eve’s measurement result is “\(\left|N\right\rangle\)” will not contribute to the secret key. Thus the total secret key rate is R = RL + RR. The total gain and the total error rate of shifted key are given by

$$ Q={Q}^{L}+{Q}^{R}\\ e=\frac{{Q}^{L}{e}^{L\,}+\,{Q}^{R}{e}^{R}}{Q}.$$
(23)

In order to find the lower bound of the total secret key rate R, we apply the Jensen’s inequality to the estimation items in Eqs. (15) and (21), and we can get

$${Q}^{L}H({e}^{L})+{Q}^{R}H({e}^{R})\le QH\left(\frac{{Q}^{L}{e}^{L}+{Q}^{R}{e}^{R}}{Q}\right)=QH(e),$$
(24)

where the equality holds when eL = eR = e and

$${Q}^{L}{I}_{{\rm{AE}}}^{L}+{Q}^{R}{I}_{{\rm{AE}}}^{R} \le Q\left[H\left(\frac{1}{2Q}\sum_{j = 0}^{M-1}\left| \left|{\psi }_{2M+2j,+}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,-}^{R}\right\rangle \right| ^{2}\right.\right.\\ \left.\left.+\left| \left|{\psi }_{2M+2j,-}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,+}^{R}\right\rangle \right| ^{2}\right)\right],$$
(25)

where we define

$${I}_{{\rm{AE}}}= \, H\left(\frac{1}{2Q}\sum_{j = 0}^{M-1}\left| \left|{\psi }_{2M+2j,+}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,-}^{R}\right\rangle \right| ^{2}\right.\\ \left.+\,\left| \left|{\psi }_{2M+2j,-}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,+}^{R}\right\rangle \right| ^{2}\right).$$
(26)

Consequently, the total secret key rate formula can be expressed by

$$R\ge \frac{1}{M}Q(1-fH(e)-{I}_{{\rm{AE}}}),$$
(27)

where 1/M is the shifting factor. And the problem of finding the lower bound of the total secret key rate can be converted into finding the upper bound of IAE,

$${I}_{{\rm{AE}}}\le H\left(\frac{1}{2Q}\sum_{j = 0}^{M-1}\left| \left|{\psi }_{2M+2j,+}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,-}^{R}\right\rangle \right| ^{2}\right.\\ \left. +\left| \left|{\psi }_{2M+2j,-}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,+}^{R}\right\rangle \right| ^{2}\right)\\ {\hskip -4pc}\,{\mathrm{with}}\,{\mathrm{constraints}}\\ 0\le \left| \left|{\psi }_{2M+j,\!\pm\!}^{L/R}\right\rangle \right| ^{2}\le \left| \sum_{n = 0}^{\infty }\sqrt{{P}_{2Mn+j}{Y}_{2Mn+j,\!\pm\! }^{L/R}}\right| ^{2}\\ {\hskip 5pt}\sum_{j = 0}^{M-1}\left| \left|{\psi }_{2M+2j,+}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,-}^{R}\right\rangle \right| ^{2}\\ {\hskip 5pt} +\left| \left|{\psi }_{2M+2j,-}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,+}^{R}\right\rangle \right|^{2}\le Q.$$
(28)

Simulation

In this section, we simulate the performance of our TF-QKD protocols, and the simulation method is very similar to Ma et al.12. Ideally, for Protocol I, Alice and Bob can estimate \({Y}_{n,\pm }^{L/R}\) precisely by infinite decoy-state method.

We assume that the total efficiency of channels and detectors is η, dark counting rate of single photon detectors is d per trial, the optical misalignment is emis, and the mean photon number of each pulse emitted by Alice and Bob is μ. The counting rate is given by

$$Q =(1-d)(1-{e}^{-2\eta \mu })+2d(1-d){e}^{-2\eta \mu }\\ =(1-d)(1-{e}^{-2\eta \mu }+2d{e}^{-2\eta \mu }),$$
(29)

and the error rate is

$$e=\frac{(1-d)[{e}_{{\rm{mis}}}-({e}_{{\rm{mis}}}-d){e}^{-2\eta \mu }]}{Q}.$$
(30)

Applying infinite decoy states, \({Y}_{n,\pm }^{L/R}\) can be given by

$$ {Y}_{n,+}^{L}={Y}_{n,-}^{R}=(1-d)[1-{e}_{{\rm{mis}}}-(1-{e}_{{\rm{mis}}}-d){(1-\eta )}^{n}]\\ {Y}_{n,-}^{L}={Y}_{n,+}^{R}=(1-d)[{e}_{{\rm{mis}}}-({e}_{{\rm{mis}}}-d){(1-\eta )}^{n}].$$
(31)

We define

$$ {Y}_{n,+}^{L}={Y}_{n,-}^{R}={Y}_{n}^{c}\\ {Y}_{n,-}^{L}={Y}_{n,+}^{R}={Y}_{n}^{e}\\ {Y}_{n}={Y}_{n}^{c}+{Y}_{n}^{e}=(1-d)[1-(1-2d){(1-\eta )}^{n}]\\ {X}_{2M+j}^{c}=\frac{\left| \left|{\psi }_{2M+j,+}^{L}\right\rangle \right|^{2}+\left| \left|{\psi }_{2M+j,-}^{R}\right\rangle \right| ^{2}}{2}\\ {X}_{2M+j}^{e}=\frac{\left| \left|{\psi }_{2M+j,-}^{L}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+j,+}^{R}\right\rangle \right| ^{2}}{2}\\ {X}_{2M+j}={X}_{2M+j}^{c}+{X}_{2M+j}^{e}.$$
(32)

Thanks to Cauchy inequality, we have

$${\hskip -4pt}{\left(\sum_{n = 0}^{\infty }\sqrt{{P}_{n}{Y}_{n}^{c}}\right)}^{2}{\!}+{\left(\sum_{n = 0}^{\infty }\sqrt{{P}_{n}{Y}_{n}^{e}}\right)}^{2}{\!} =\sum_{n = 0}^{\infty }{P}_{n}({Y}_{n}^{c}+{Y}_{n}^{e})+\sum_{n\ne {n}^{\prime}}^{\infty }\sqrt{{P}_{n}{P}_{{n}^{\prime}}}({\!}\sqrt{{Y}_{n}^{c}{Y}_{{n}^{\prime}}^{c}}+\sqrt{{Y}_{n}^{e}{Y}_{{n}^{\prime}}^{e}})\\ \le \sum_{n = 0}^{\infty }{P}_{n}{Y}_{n}+\sum_{n\ne {n}^{\prime}}^{\infty }\sqrt{{P}_{n}{P}_{{n}^{\prime}}{Y}_{n}{Y}_{{n}^{\prime}}}\\ ={\left(\sum_{n = 0}^{\infty }\sqrt{{P}_{n}{Y}_{n}}\right)}^{2}.$$
(33)

Thus we can get an equivalent upper bound of IAE given by

$$ {I}_{{\rm{AE}}}\le H\left(\frac{\mathop{\sum }\nolimits_{j = 0}^{M-1}{X}_{2M+2j}}{Q}\right)\\ \,{\mathrm{with}}\,{\mathrm{constraints}}\,\\ 0\le {X}_{2M+2j}\le {\left(\mathop{\sum }\limits_{n = 0}^{\infty }\sqrt{{P}_{2Mn+2j}{Y}_{2Mn+2j}}\right)}^{2}\\ \sum_{j = 0}^{M-1}{X}_{2M+2j}\le \frac{Q}{2}.$$
(34)

The security proof of Protocol II is almost the same as Protocol I. In Protocol II, Eve’s general collective attack is given by

$${U}_{{\rm{Eve}}}{\left|l,k\right\rangle }_{{\rm{AB}}}{\left|e\right\rangle }_{E}= \sqrt{{Y}_{l,k}^{L}}\left|{\gamma }_{l,k}^{L}\right\rangle \left|L\right\rangle +\sqrt{{Y}_{l,k}^{R}}\left|{\gamma }_{l,k}^{R}\right\rangle \left|R\right\rangle +\sqrt{{Y}_{l,k}^{N}}\left|{\gamma }_{l,k}^{N}\right\rangle \left|N\right\rangle,$$
(35)

where \({\left|l,k\right\rangle }_{{\rm{AB}}}\) represents the photon-number base prepared by Alice and Bob, \(|{\gamma }_{l,k}^{L}\rangle\), \(|{\gamma }_{l,k}^{R}\rangle\), and \(|{\gamma }_{l,k}^{N}\rangle\) are some arbitrary quantum states referring to Eve’s measurement results “\(\left|L\right\rangle\)”, “\(\left|R\right\rangle\)”, and “\(\left|N\right\rangle\)”, respectively. Besides, \({Y}_{l,k}^{L}\), \({Y}_{l,k}^{R}\), and \({Y}_{l,k}^{N}\) satisfying \({Y}_{l,k}^{L}+{Y}_{l,k}^{R}+{Y}_{l,k}^{N}=1\) are the yields referring to Eve’s measurement results “\(\left|L\right\rangle\)”, “\(\left|R\right\rangle\)”, and “\(\left|N\right\rangle\)”, respectively. Compared to the expression of Eve’s general collective attack in Protocol I, it can be argued that the general collective attack is actually the same as Protocol I if we set

$$\sqrt{{P}_{n}{Y}_{n,\pm }^{L/R}}\left|{\gamma }_{n,\pm }^{L/R}\right\rangle =\sum_{l = 0,l+k = n}^{n}{(\pm 1)}^{l}\sqrt{{P}_{l,k}{Y}_{l,k}^{L/R}}\left|{\gamma }_{l,k}^{L/R}\right\rangle .$$
(36)

Consequently, applying the security proof method to Protocol II, we find that the expression of the upper bound of IAE is same as the one of Protocol I. In Protocol II, for removing phase post-selection, we estimate the yield Yl,k rather than Yn to bound X2M + 2j. Combining Eqs. (9) and (36), we obtain

$$\frac{1}{2}\left(\left| \left|{\psi }_{2M+2j,+}^{L/R}\right\rangle \right| ^{2}+\left| \left|{\psi }_{2M+2j,-}^{L/R}\right\rangle \right| ^{2}\right) =\frac{1}{2}\left(\left| \sum_{n = 0}^{\infty }\sqrt{{P}_{2Mn+2j}{Y}_{2Mn+2j,+}^{L/R}}\left|{\gamma }_{2Mn+2j,+}^{L/R}\right\rangle \right| ^{2}\right.\\ \hskip 0.89pc+\left.\left| \sum_{n = 0}^{\infty }\sqrt{{P}_{2Mn+2j}{Y}_{2Mn+2j,-}^{L/R}}\left|{\gamma }_{2Mn+2j,-}^{L/R}\right\rangle \right| ^{2}\right)\\ =\frac{1}{2}\left(\left| \sum_{n = 0}^{\infty } \, \sum_{l = 0}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}^{L/R}}\left|{\gamma }_{l,k}^{L/R}\right\rangle \right| ^{2}\right.\\ \hskip0.89pc +\left.\left| \sum_{n = 0}^{\infty } \, \sum_{l = 0}^{l+k = 2Mn+2j}{(-1)}^{l}\sqrt{{P}_{l,k}{Y}_{l,k}^{L/R}}\left|{\gamma }_{l,k}^{L/R}\right\rangle \right| ^{2}\right)\\ =\left| \sum_{n = 0}^{\infty } \, \sum_{l,k\in {\rm{even}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}^{L/R}}\left|{\gamma }_{l,k}^{L/R}\right\rangle \right| ^{2}\\ \hskip 0.89pc+\left| \sum_{n = 0}^{\infty } \, \sum_{l,k\in {\rm{odd}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}^{L/R}}\left|{\gamma }_{l,k}^{L/R}\right\rangle \right| ^{2}\\ \le {\left(\sum_{n = 0}^{\infty } \, \sum_{l,k\in {\rm{even}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}^{L/R}}\right)}^{2}\\ \hskip 0.89pc+{\left(\sum_{n = 0}^{\infty } \, \sum_{l,k\in {\rm{odd}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}^{L/R}}\right)}^{2},$$
(37)

where even and odd are the assembles referring to even number set and odd number set, respectively. Similar to Eq. (33), by utilizing Cauchy inequality, we have

$$ {\sum_{n = 0}^{\infty } \, \sum_{l,k}^{l+k = 2Mn+2j}{\left(\sqrt{{P}_{l,k}{Y}_{l,k}^{L}}\right)}^{2}} + {\left(\sqrt{{P}_{l,k}{Y}_{l,k}^{R}}\right)}^{2}\\ \le {\sum_{n = 0}^{\infty } \, \sum_{l,k}^{l+k = 2Mn+2j}{\left(\sqrt{{P}_{l,k}{Y}_{l,k}}\right)}^{2}},$$
(38)

where \({Y}_{l,k}={Y}_{l,k}^{L}+{Y}_{l,k}^{R}\). Due to the decoy-state method implemented, Yl,k satisfies the constraints

$${Q}^{{\mu }_{a}{\mu }_{b}}=\sum_{l,k}{P}_{l,k}^{{\mu }_{a}{\mu }_{b}}{Y}_{l,k}.$$
(39)

Thus we have obtained the upper bound of X2M+2j given as follows

$${X}_{2M+2j}\le {\left(\sum_{n = 0}^{\infty } \, \sum_{l,k\in {\rm{even}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}}\right)}^{2}+{\left(\sum_{n = 0}^{\infty } \, \sum_{l,k\in {\rm{odd}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}}\right)}^{2}.$$
(40)

Briefly, the upper bound of IAE in Protocol II is given by,

$$ {I}_{{\rm{AE}}}\le H\left(\frac{\mathop{\sum }\nolimits_{j = 0}^{M-1}{X}_{2M+2j}}{Q}\right)\\ \,{\mathrm{with}}\,{\mathrm{constraints}}\, \\ 0\le {X}_{2M+2j} \le {\left(\sum_{n = 0}^{\infty } \, \sum_{l,k\in {\rm{even}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}}\right)}^{2}\\ \quad+{\left(\sum_{n = 0}^{\infty } \, \sum_{l,k\in {\rm{odd}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}}\right)}^{2}\sum_{j = 0}^{M-1}{X}_{2M+2j}\\ \le \frac{Q}{2}.$$
(41)

For the sake of analyzing the upper bound of IAE with the increase of M, we define the upper bound of \(\mathop{\sum }\nolimits_{j = 0}^{M-1}{X}_{2M+2j}\) as a function of positive integer M, which is given by

$$F(M)=\sum_{j = 0}^{M-1}{\left(\sum_{n = 0}^{\infty }\sqrt{{P}_{2Mn+2j}{Y}_{2Mn+2j}}\right)}^{2}.$$
(42)

As binary Shannon entropy H(x) increases when 0 ≤ x ≤ 1/2 and decreases when 1/2 ≤ x ≤ 1, it is sufficient to consider the case of F(M) ≤ Q/2. It can be proven that

$$F(1)\ge F(M)\ge F(NM)\ge F(\infty ),$$
(43)

where N is a positive integer. In order to prove Eq. (43), we rewrite Eq. (42) as follows

$$G(M)=\sum_{j = 0}^{M-1}{\left(\sum_{n = 0}^{\infty }{A}_{2Mn+2j}\right)}^{2},$$
(44)

where we denote F(M) and \(\sqrt{{P}_{2Mn+2j}{Y}_{2Mn+2j}}\) as G(M) and A2Mn+2j, respectively. For A2Mn+2j is absolutely a nonnegative term, we have

$$G(1) ={\left(\sum_{j = 0}^{\infty }{A}_{2j}\right)}^{2}={\left(\sum_{n = 0}^{\infty }{A}_{2n}\right)}^{2}\\ ={\left(\sum_{j = 0}^{M-1}\left(\sum_{n = 0}^{\infty }{A}_{2Mn+2j}\right)\right)}^{2}\\ =\sum_{j = 0}^{M-1}{\left(\sum_{n = 0}^{\infty }{A}_{2Mn+2j}\right)}^{2}\\ \quad+\sum_{j\ne {j}^{\prime}}^{M-1}\left(\sum_{n = 0}^{\infty }{A}_{2Mn+2j}\right)\left(\sum_{n = 0}^{\infty }{A}_{2Mn+2{j}^{\prime}}\right)\\ \ge \sum_{j = 0}^{M-1}{\left(\sum_{n = 0}^{\infty }{A}_{2Mn+2j}\right)}^{2}\\ =G(M),$$
(45)

where the inequality holds because of the nonnegative cross term \(\mathop{\sum }\nolimits_{j\ne {j}^{\prime}}^{M-1}(\mathop{\sum }\nolimits_{n = 0}^{\infty }{A}_{2Mn+2j})(\mathop{\sum }\nolimits_{n = 0}^{\infty }{A}_{2Mn+2{j}^{\prime}})\). Similarly,

$$G(M) =\sum_{j = 0}^{M-1}{\left(\sum_{n = 0}^{\infty }{A}_{2Mn+2j}\right)}^{2}\\ =\sum_{j = 0}^{M-1}{\left(\sum_{{j}^{\prime} = 0}^{N-1}\sum_{n = 0}^{\infty }{A}_{2N(Mn+j)+2{j}^{\prime}}\right)}^{2}\\ \ge \sum_{j = 0}^{M-1}\sum_{{j}^{\prime} = 0}^{N-1}{\left(\sum_{n = 0}^{\infty }{A}_{2N(Mn+j)+2{j}^{\prime}}\right)}^{2}\\ =\sum_{j = 0}^{M-1}\sum_{{j}^{\prime} = 0}^{N-1}{\left(\sum_{n = 0}^{\infty }{A}_{2NMn+2(Nj+{j}^{\prime})}\right)}^{2}\\ =\sum_{k = 0}^{NM-1}{\left(\sum_{n = 0}^{\infty }{A}_{2NMn+2k}\right)}^{2}\\ =G(NM),$$
(46)

where we use subscript k instead of \(Nj+{j}^{\prime}\). The nonnegative cross term vanishes when M → , then we have

$$G(\infty )=\sum_{n = 0}^{\infty }{A}_{2n}^{2}.$$
(47)

Thus we have proven Eq. (43). Then we obtain that the upper bound of IAE decreases with M exponentially increasing. In other words, the achievable distance becomes longer as M exponentially increases. As a result, the achievable distance comes to a limitation when M tends to infinity.

Finite-decoy method for Protocol II with M = 2

As Protocol II does not require phase post-selection in the test mode, it is more practical than Protocol I. For Protocol II, it almost reaches the limitary transmission distance with M = 2 shown in Table 3, thus it is interesting and necessary to consider applying finite-decoy states in the test mode.

When finite-decoy states are implemented, finding the upper bound of IAE is equivalent to the following optimized problem

$$ {\rm{Max}}:\\ \mathop{\sum }\limits_{j = 0}^{M-1}{\left(\mathop{\sum }\limits_{n = 0}^{\infty }\mathop{\sum }\limits_{l,k\in {\rm{even}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}}\right)}^{2}\\ +{\left(\mathop{\sum }\limits_{n = 0}^{\infty }\mathop{\sum }\limits_{l,k\in {\rm{odd}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}}\right)}^{2}\\ \,\text{s.t.}\,\\ \mathop{\sum }\limits_{l,k = 0}^{6}{P}_{l,k}^{{\mu }_{a}{\mu }_{b}}{Y}_{l,k}\le {Q}^{{\mu }_{a}{\mu }_{b}}\le \mathop{\sum }\limits_{l,k = 0}^{6}{P}_{l,k}^{{\mu }_{a}{\mu }_{b}}{Y}_{l,k}+1-\mathop{\sum }\limits_{l,k = 0}^{6}{P}_{l,k}^{{\mu }_{a}{\mu }_{b}}\\ \,\text{and}\,\\ \mathop{\sum }\limits_{j = 0}^{M-1}{\left(\mathop{\sum }\limits_{n = 0}^{\infty }\mathop{\sum }\limits_{l,k\in {\rm{even}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}}\right)}^{2}\\ +{\left(\mathop{\sum }\limits_{n = 0}^{\infty }\mathop{\sum }\limits_{l,k\in {\rm{odd}}}^{l+k = 2Mn+2j}\sqrt{{P}_{l,k}{Y}_{l,k}}\right)}^{2}\le \frac{Q}{2}.$$
(48)

where μaμb {μ1μ2μ3}. As Fig. 4 shows, the performance is maintained using only three intensity settings. That is, we only need three decoy intensities {μ1μ2μ3}, and the signal intensity is chosen from one of them.