Tight finite-key analysis for mode-pairing quantum key distribution

However, in practical implementations, the imperfections of practical equipments will create some security loopholes. An eavesdropper, Eve, can steal key information without introducing any signal disturbance by taking advantage of these loopholes. A close examination of hacking strategies indicates that most loopholes exist in the detection part of QKD systems Makarov et al. (2006); Zhao et al. (2008); Fung et al. (2007); Xu et al. (2010); Lydersen et al. (2010); Gerhardt et al. (2011); Qian et al. (2018); Wei et al. (2019). Considering this situation, measurement-device-independent QKD (MDI-QKD) Lo et al. (2012) (see also Braunstein and Pirandola (2012)) protocol is proposed, which can remove all loopholes on the vulnerable detection side. Various theory improvements Ma and Razavi (2012); Yu et al. (2013); Xu et al. (2014); Curty et al. (2014); Yin et al. (2014a, b); Yu et al. (2015); Wang and Wang (2014); Zhou et al. (2016); Lu et al. (2020); Hu et al. (2021); Jiang et al. (2021); Lu et al. (2022) and experiments Liu et al. (2013); Wang et al. (2015); Yin et al. (2016); Comandar et al. (2016); Wang et al. (2017); Fan-Yuan et al. (2022) are achieved in recent years.

Besides the security, high performance and long transmission distance are the eternal pursuits in the research of QKD. However, because of the inevitable transmission loss in the channel, the MDI-QKD and the other QKD protocols which are point-to-point schemes are upper bounded by the secret key capacity of repeaterless QKD Pirandola et al. (2009); Takeoka et al. (2014); Pirandola et al. (2017). The PLOB (Pirandola, Laurenza, Ottaviani, and Banchi) bound Pirandola et al. (2017), for example, restricts the secret key rate $R\leq-\log_{2}(1-\eta)$, where $\eta$ is the total channel transmittance between Alice and Bob. This bound is approximately a linear function of $\eta$, $R\sim O(\eta)$. For breaking this restriction, an interesting work named twin-field QKD (TF-QKD) was proposed Lucamarini et al. (2018), whose secret key rate $R\sim O(\sqrt{\eta})$. Moreover, it is an MDI-like protocol that is immune to all detection attacks. Subsequently, many variants of TF-QKD are proposed Ma et al. (2018); Wang et al. (2018); Curty et al. (2019); Cui et al. (2019); Wang et al. (2020), such as sending-or-not-sending QKD (SNS-QKD) Wang et al. (2018), phase-matching QKD (PM-QKD) Ma et al. (2018) and no phase post-selection QKD (NPP-QKD) Cui et al. (2019). Because of their high performance, they have attracted much attention and remarkable progress has been made not just in the theory Maeda et al. (2019); Jiang et al. (2019); Lu et al. (2019); Xu et al. (2020); Zeng et al. (2020); Currás-Lorenzo et al. (2021), but also in the experimental implementations Minder et al. (2019); Zhong et al. (2019); Wang et al. (2019); Liu et al. (2019); Fang et al. (2020); Chen et al. (2020); Liu et al. (2021); Chen et al. (2021); Clivati et al. (2022); Pittaluga et al. (2021); Chen et al. (2022); Wang et al. (2022). However, because TF-type QKD depends on stable interference between coherent states, phase-tracking is needed for compensating the phase fluctuation on the channels while phase-locking is needed for locking the frequency and phase of Alice and Bob’s lasers. These challenging techniques significantly increase the complexity of experimental systems and may bring extra noise.

Recently, two works named asynchronous-MDI-QKD Xie et al. (2022) and mode-pairing QKD (MP-QKD) Zeng et al. (2022) are proposed almost simultaneously. Surprisingly, while their quantum state preparation and measurement are almost the same as the time-bin-phase coding MDI-QKD Ma and Razavi (2012), the key rate can be increased dramatically just by defining the key bit differently in post processing step. As a result, beating the PLOB bound becomes possible even without the help of phase-locking and phase-tracking.

For ease of understanding, let’s review the MP-QKD in a simple way. Similar with the time-bin-phase coding MDI-QKD Ma and Razavi (2012), in each round, Alice and Bob send weak coherent pulses with different intensities and phases to Charlie. Then, after Charlie announces each round leads to a single click or not by his interference measurement, Alice and Bob may pair two clicked pulses to a key generation event provided the timing interval of the two paired pulses is smaller than the coherent time of the lasers. Note that this pairing step is missing in the time-bin-phase coding MDI-QKD Ma and Razavi (2012), where only two adjacent and clicked optical pulses, i.e. coincidence detection, can be used to generate key bit, thus its key rate must be proportional to the channel transmittance $\eta$. Indeed, this subtle pairing strategy leads to a dramatic increment of the key rate.

Although an elegant security proof for MP-QKD has been given in Ref. Zeng et al. (2022), its security and performance in non-asymptotic situations are still unknown. Here, we show a finite-key analysis of the MP-QKD protocol. Our analysis applies to coherent attack and satisfies the definition of composable security, namely the secret keys are perfect keys except a failure probability no larger than $\varepsilon_{\rm{\rm{tol}}}$. It’s confirmed that PLOB bound can be surpassed in MP-QKD with a moderate number of optical pulses, typically $10^{13}$. Moreover, we propose a six-state MP-QKD protocol that can improve the secret key rate, and show its performance in the finite-key regions. Our results can be directly applied in future practical experiments of MP-QKD.

1.State preparation. The first two steps are repeated by Alice and Bob for $N$ rounds to obtain sufficient data. In the $i$-th round ($i\in$ $\{1,2,...,N\}$), Alice prepares a coherent state $|\sqrt{k^{i}_{a}}\exp({\rm{i}}\theta^{i}_{a})\rangle$ with probability $p_{k_{a}}$, where the intensity $k^{i}_{a}$ is chosen randomly from the set $\{\mu_{a},\nu_{a},o\}$ ($\mu_{a}>\nu_{a}>o=0$) and the phase $\theta^{i}_{a}$ is chosen uniformly from $[0,2\pi)$. Similarly, Bob chooses $k^{i}_{b}$ and $\theta^{i}_{b}$ then prepares a weak coherent state $|\sqrt{k^{i}_{b}}\exp({\rm{i}}\theta^{i}_{b})\rangle$.

2.Measurement. Alice and Bob send two pulses $|\sqrt{k^{i}_{a}}\exp({\rm{i}}\theta^{i}_{a})\rangle$ and $|\sqrt{k^{i}_{b}}\exp({\rm{i}}\theta^{i}_{b})\rangle$ to Charlie for interference measurement. After the measurement, Charlie announces the detection results of detectors L and R. If only detector L or R clicks, $C^{i}=1$. And $C^{i}=0$ for the other cases.

3.Mode pairing. For all rounds with effective detection ($C^{i}=1$), Alice and Bob employ a strategy to group two effective detection events as a pair. The specific pairing strategy is shown as follows:

Considering that when the time interval between adjacent pulses becomes too large, the key information suffers from phase fluctuation. Alice and Bob define a maximal pairing interval $l$ before the pairing, which denotes the maximal interval pulse number in an effective event pair. $l$ can be estimated by multiplying the laser coherence time by the system repetition rate in practically. Alice (Bob) calculates the interval between the first and second effective detection event. If the interval is less than or equal to $l$, she (he) records an effective event pair $P_{a(b)}^{i_{1},j_{1}}=\{k^{i_{1}}_{a(b)},k^{j_{1}}_{a(b)},\theta^{i_{1}}_{a(b)},\theta^{j_{1}}_{a(b)}\}$, where $i_{1}$ and $j_{1}$ are the round numbers of the first and the second effective detection event, then considers the interval between the third and the fourth effective detection event. Otherwise, the first effective detection event is dropped, then she (he) considers the interval between the second and the third. Until the last effective detection event, she (he) completes the mode pairing. A flow chart of Alice’s pairing strategy is presented in Fig. 2.

4.Basis sifting. Based on the intensities of two grouped rounds, Alice (Bob) labels the ’basis’ of each $P_{a(b)}^{i,j}$ as:

(a) $Z$-basis: if one of the intensities $k^{i}_{a(b)}$ and $k^{j}_{a(b)}$ is 0 and the other is nonzero;

(b) $X$-basis: if $k^{i}_{a(b)}=k^{j}_{a(b)}\neq 0$;

(c) ’0’-basis: if $k^{i}_{a(b)}=k^{j}_{a(b)}=0$;

(d) ’discard’: if $0\neq k^{i}_{a(b)}\neq k^{j}_{a(b)}\neq 0$.

See also the Tab. 1.

Then they announce the bases ($Z$-basis, $X$-basis, ’0’-basis, or ’discard’), the sum of the intensities $k^{i}_{a}+k^{j}_{a}$ and $k^{i}_{b}+k^{j}_{b}$ for each pair of $P_{a}^{i,j}$ and $P_{b}^{i,j}$ respectively. Let’s denote the pair of $P_{a}^{i,j}$ and $P_{b}^{i,j}$ by $P^{i,j}$ for simplicity. Then for each $P^{i,j}$, if the announced bases for $P_{a}^{i,j}$ and $P_{b}^{i,j}$ are both $Z$-basis, $X$-basis or ’0’-basis, they record $P^{i,j}$ as $Z$-pair, $X$-pair, or ’0’-pair respectively; if one of them is ’0’-basis and the other one is $X$-basis ($Z$-basis), they record $P^{i,j}$ as $X$-pair ($Z$-pair); if both of the announced bases are ’0’, they record it as ’0’-pair; and otherwise, they discard $P^{i,j}$. See also the Tab. 2.

5.Key mapping. For each $Z$-pair $P^{i,j}$, if $k^{j}_{a}\neq k^{i}_{a}=0$, Alice sets her key to $\kappa_{a}=0$; if $k^{i}_{a}\neq k^{j}_{a}=0$, Alice sets her key to $\kappa_{a}=1$; and for the condition $k^{i}_{a}=k^{j}_{a}=0$, she sets her key $\kappa_{a}$ to either 0 or 1 at random with a $1/2$ probability. The setting of Bob’s key is contrary to Alice’s. If $k^{i}_{b}\neq k^{j}_{b}=0$, Bob sets his key to $\kappa_{b}=0$; if $k^{j}_{b}\neq k^{i}_{b}=0$, Bob sets his key to $\kappa_{b}=1$; and for the condition $k^{i}_{b}=k^{j}_{b}=0$, he sets his key $\kappa_{b}$ to either 0 or 1 at random with a $1/2$ probability.

For each $X$-pair $P^{i,j}$, Alice’s key is extracted from the relative phase $\theta_{a}:=(\theta^{j}_{a}-\theta^{i}_{a})\mod 2\pi$, where the raw key bit is $\kappa_{a}=\lfloor\theta_{a}/\pi\rfloor$ and the alignment angle is $\delta_{a}=\theta_{a}\mod\pi$ $\left(\delta_{a}\in[0,\pi)\right)$. Bob also calculates his raw key bit $\kappa_{b}$ and alignment angle $\delta_{b}$ in the same way. Then they announce the alignment angles $\delta_{a}$ and $\delta_{b}$. If $|\delta_{a}-\delta_{b}|\leq\Delta$, they keep $P^{i,j}$; if $|\delta_{a}-\delta_{b}|\geq\pi-\Delta$, Bob flips the raw key bit $\kappa_{b}$ and they keep $P^{i,j}$; otherwise, they discard them. Moreover, if Charlie’s clicks are (L,R) or (R,L), Bob flips $\kappa^{b}$. It should be noted that if $P^{i,j}$ consists of both ’0’-basis and $X$-basis, they retain all the data pairs whatever the value of $\delta_{a}$ and $\delta_{b}$ are. We define three sets $\mathcal{Z}$, $\mathcal{X}$ and $\mathcal{V}$ here, which include all $Z$-pair, $X$-pair, and ’0’-pair $P^{i,j}$ respectively.

6.Parameter estimation. Alice and Bob choose $P^{i,j}$ satisfying $(k^{i}_{a}+k^{j}_{a},k^{i}_{b}+k^{j}_{b})\in\{(\mu_{a},\mu_{b}),(\mu_{a},\nu_{b}),(\nu_{a},\mu_{b}),(\nu_{a},\nu_{b})\}$ in the set $\mathcal{Z}$ to form the $n_{Z}$-length raw key bit strings $\mathbf{Z}$ and $\mathbf{Z^{\prime}}$, respectively. And through the decoy-state method, Alice and Bob estimate the lower bound of the single-photon effective detection number in the raw key, $n_{Z_{1}}^{\rm{L}}$, according to the events in $\mathcal{Z}$ and $\mathcal{V}$. The upper bound of the single-photon phase error rate of $n_{Z_{1}}^{\rm{L}}$, $e_{Z_{1}}^{\rm{ph,U}}$, is estimated by the events in $\mathcal{X}$ and $\mathcal{V}$.

7.Error correction. Alice and Bob exploit an information reconciliation scheme to correct $\mathbf{Z^{\prime}}$, in which Bob acquires an estimation $\hat{\mathbf{Z}}$ of $\mathbf{Z}$ from Alice. This process reveals at most $\lambda_{\rm{EC}}$ bits Alice’s raw key. Then, for verifying the success of error correction, Alice employs a random universal hash function to compute a hash of $\mathbf{Z}$ of length $\log_{2}(2/\varepsilon_{\rm{cor}})$, and sends the hash and hash function to Bob. If the hash computed by Bob is the same as Alice’s, $\Pr\left(\mathbf{Z}\neq\hat{\mathbf{Z}}\right)\leq\varepsilon_{\rm{cor}}$, they proceed this protocol. Otherwise, the protocol aborts.

8.Private amplification. Alice and Bob exploit a privacy amplification scheme based on two-universal hashing Renner (2008) to extract two $l_{o}$-length bit strings $\mathbf{S}$ and $\hat{\mathbf{S}}$ from $\mathbf{Z}$ and $\hat{\mathbf{Z}}$ respectively. $\mathbf{S}$ and $\hat{\mathbf{S}}$ are the secret keys.

Then, we show one of the main results of our paper. If the error correction step is passed, the protocol is $\varepsilon_{\rm{cor}}$-correct. And the protocol is $\varepsilon_{\rm{sec}}$-secret if the secret key length

where $h(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)$ is the binary Shannon entropy function, and $\varepsilon_{\rm{cor}}$, $\hat{\varepsilon}$, and $\varepsilon_{\rm{PA}}$ are the security coefficients which the users may optimize over. $n_{Z_{1}}^{\rm{L}}$ is the lower bound of the single-photon effective detection number in the raw key with a failure probability $\varepsilon_{1}$. $e_{Z_{1}}^{\rm{ph,U}}$ is the upper bound of the single-photon phase error rate of $n_{Z_{1}}^{\rm{L}}$ with a failure probability $\varepsilon_{e}$. $n_{Z_{1}}^{\rm{L}}$ and $e_{Z_{1}}^{\rm{ph,U}}$ are estimated by the decoy-state method, which is shown in the Supplementary Note C. And ${\lambda_{\rm{EC}}}=fn_{Z}h(E_{Z})$ is the information revealed in the error correction step, where $f$ is the error correction efficiency which is related to the specific error correction scheme, $n_{Z}$ is the length of the raw key and $E_{Z}$ is the bit-flip error rate between strings $\mathbf{Z}$ and $\mathbf{Z}^{\prime}$.

Surprisingly, it’s possible to obtain both the error rates under hypothetical $\sigma_{X}$ and $\sigma_{Y}$ measurements in the MP-QKD. Let’s explain this point intuitively. When the pair $P^{i,j}_{a}$ happens to be a $Z$-basis and also a single-photon event, its hypothetical $\sigma_{X}$ and $\sigma_{Y}$ measurements just lead to quantum superpositions $(|i\rangle\pm|j\rangle)/\sqrt{2}$ or $(|i\rangle\pm{\rm{i}}|j\rangle)/\sqrt{2}$ respectively. The quantum state $|i\rangle$($|j\rangle$) denote that in the i-th and j-th rounds, only single-photon is in the $i-th$ ($j-th$) round. Note that if $P^{i,j}_{a}$ happens to be an $X$-basis and also a single-photon event, $(|i\rangle\pm e^{{\rm{i}}\theta_{a}}|j\rangle)/\sqrt{2}$ will be prepared, in which $\theta_{a}$ ranges from $[0,\pi)$. Equivalently, $(|i\rangle\pm e^{{\rm{i}}\theta_{a}}|j\rangle)/\sqrt{2}$ can be rewritten as $(|i\rangle\pm e^{{\rm{i}}\theta_{a}}|j\rangle)/\sqrt{2}$ if $\theta_{a}\in[0,\pi/2)$, and $(|i\rangle\pm{\rm{i}}e^{{\rm{i}}\theta^{\prime}_{a}}|j\rangle)/\sqrt{2}$ if $\theta^{\prime}_{a}\in[\pi/2,\pi)$, where $\theta^{\prime}_{a}:=\theta_{a}\mod(\pi/2)$. Just as mentioned in Supplemental Note, $\theta^{\prime}_{a}$ can be resulted by Alice’s unitary operation on her local qubits, thus has no effect on the security. This implies that for any $\theta^{\prime}_{a}$, the former one and latter may be used to estimate the error rates under $\sigma_{X}$ and $\sigma_{Y}$ measurements respectively, so $X$-basis is indeed $XY$-basis in this sense. Finally, a six-state like MP-QKD is possible. Following this idea, we present a detailed description of this scheme and the results of security proof as follows:

1.State preparation. Same as the step 1 in the original protocol.

2.Measurement. Same as the step 2 in the original protocol.

3.Mode pairing. Same as the step 3 in the original protocol.

4.Basis sifting. Based on the intensities of two grouped rounds, Alice (Bob) labels the ’basis’ of $P_{a(b)}^{i,j}$ as:

(a) $Z$-basis: if one of the intensities $k^{i}_{a(b)}$ and $k^{j}_{a(b)}$ is 0 and the other is nonzero;

(b) $XY$-basis: if $k^{i}_{a(b)}=k^{j}_{a(b)}\neq 0$;

(c) ’0’-basis: if $k^{i}_{a(b)}=k^{j}_{a(b)}=0$;

(d) ’discard’: if $0\neq k^{i}_{a(b)}\neq k^{j}_{a(b)}\neq 0$.

Then they announce the basis ($Z$-basis, $XY$-basis, ’0’-basis or ’discard’) and the sum of the intensities $k^{i}_{a}+k^{j}_{a}$ and $k^{i}_{b}+k^{j}_{b}$ for each pair of $P_{a}^{i,j}$ and $P_{b}^{i,j}$ respectively. Let’s denote the pair of $P_{a}^{i,j}$ and $P_{b}^{i,j}$ by $P^{i,j}$ for simplicity. Then for each $P^{i,j}$: if the announced bases for $P_{a}^{i,j}$ and $P_{b}^{i,j}$ are both $Z$-basis, $XY$-basis or ’0’-basis, they record $P^{i,j}$ as $Z$-pair, $XY$-pair, or ’0’-pair respectively; if one of them is ’0’-basis and the other one is $XY$-basis ($Z$-basis), they record $P^{i,j}$ as $XY$-pair ($Z$-pair); if both of the announced bases are ’0’, they record it as ’0’-pair; and otherwise, they discard $P^{i,j}$.

5.Key mapping. The key mapping step of $Z$-pair $P^{i,j}$ is the same as the step in the original protocol. For each $Z$-pair $P^{i,j}$, if $k^{j}_{a}\neq k^{i}_{a}=0$, Alice sets her key to $\kappa_{a}=0$; if $k^{i}_{a}\neq k^{j}_{a}=0$, Alice sets her key to $\kappa_{a}=1$; and for the condition $k^{i}_{a}=k^{j}_{a}=0$, she sets her key $\kappa_{a}$ to either 0 or 1 at random with a $1/2$ probability. The setting of Bob’s key is contrary to Alice’s. If $k^{i}_{b}\neq k^{j}_{b}=0$, Bob sets his key to $\kappa_{b}=0$; if $k^{j}_{b}\neq k^{i}_{b}=0$, Bob sets his key to $\kappa_{b}=1$; and for the condition $k^{i}_{b}=k^{j}_{b}=0$, he sets his key $\kappa_{b}$ to either 0 or 1 at random with a $1/2$ probability.

For each $XY$-pair $P^{i,j}$, Alice’s key and basis are extracted from the relative phase $\theta_{a}=(\theta^{j}_{a}-\theta^{i}_{a})\mod 2\pi$, where the raw key bit is $\kappa_{a}=\lfloor\theta_{a}/\pi\rfloor$, the alignment angle is $\delta_{a}=\theta_{a}\mod(\pi/2)$ $\left(\delta_{a}\in[0,\pi/2)\right)$, and $r_{a}=\lfloor\theta_{a}/(\pi/2)\rfloor-2\kappa_{a}$, where $r_{a}=0$ and $1$ denotes $X$- and $Y$-bases, respectively. Bob also calculates his raw key bit $\kappa_{b}$, alignment angle $\delta_{b}$, and obtains the information of the basis $r_{b}$ in the same way. Then they announce the alignment angles $\delta_{a}$, $\delta_{b}$ and the values $r_{a}$ and $r_{b}$. If $|\delta_{a}-\delta_{b}|\leq\Delta$ and $r_{a}=r_{b}$, they keep $P^{i,j}$ and label them as $X$-pair if $r_{a}=0$ or $Y$-pair if $r_{a}=1$; if $|\delta_{a}-\delta_{b}|\geq\pi/2-\Delta$ and $r_{a}\neq r_{b}$, Bob may flip the basis $r_{b}$ and the raw key bit $\kappa_{b}$ according to the rules in the Tab. 3, then keep $P^{i,j}$ and label them as $X$-pair if $r_{a}(r_{b})=0$ or $Y$-pair if $r_{a}(r_{b})=1$; otherwise, they discard them. Moreover, if Charlie’s clicks are (L,R) or (R,L), Bob flips $\kappa^{b}$. We define three sets $\mathcal{Z}$, $\mathcal{XY}$ and $\mathcal{V}$ here, which include all reserved $Z$-pair, $XY$-pair, and ’0’-pair $P^{i,j}$ respectively.

6.Parameter estimation. Alice and Bob choose $P^{i,j}$ satisfying $(k^{i}_{a}+k^{j}_{a},k^{i}_{b}+k^{j}_{b})\in\{(\mu_{a},\mu_{b}),(\mu_{a},\nu_{b}),(\nu_{a},\mu_{b}),(\nu_{a},\nu_{b})\}$ in the set $\mathcal{Z}$ to form the $n_{Z}$-length raw key bit strings $\mathbf{Z}$ and $\mathbf{Z^{\prime}}$, respectively. And through the decoy-state method, Alice and Bob estimate the number of effective single-photon events $n_{Z_{1}}^{\rm{L}}$ according the events in $\mathcal{Z}$ and $\mathcal{V}$.

7.Error correction. Same as the step 7 in the original protocol.

8.Private amplification. Same as the step 8 in the original protocol.

Similar with the analysis of the original protocol, we can bound the secret key length with

where $e_{Z_{1}}^{\rm{bit,U}}$ is the upper bound of the single-photon bit error rate of $n_{Z_{1}}^{\rm{L}}$ with a failure probability $\varepsilon_{e}^{\prime}$. $\left(e_{X_{1}}^{\rm{bit}}+e_{Y_{1}}^{\rm{bit}}\right)^{\rm{U}}$ is the upper bound of the sum of the single-photon bit error rate of $n_{Z_{1}}^{\rm{L}}$ if Alice and Bob take $\sigma_{X}$ or $\sigma_{Y}$ measurement, with a failure probability $\varepsilon_{e}^{\prime\prime}$.The detailed security proof is shown in Supplementary Note A. And the specific calculation is shown in Supplementary Note C.

Meanwhile, we optimize the intensities and their corresponding sending probabilities for each distance in the simulation. Without loss of generality, we assume that the distance between Alice and Charlie, $L_{a}$, and the distance between Bob and Charlie, $L_{b}$, are the same. Under this situation, $\mu=\mu_{a}=\mu_{b}$, $\nu=\nu_{a}=\nu_{b}$, $p_{\mu}=p_{\mu_{a}}=p_{\mu_{b}}$, and $p_{\nu}=p_{\nu_{a}}=p_{\nu_{b}}$. Then, there are only five parameters, $\mu$, $\nu$, $p_{\mu}$, $p_{\nu}$, and $\Delta$, needed to be optimized.

With the experimental parameters and optimized parameters, we simulate observed values first, including effective detection number and bit error number. The specific formulas are shown in Supplementary Note B. Then, with those observed values, we can obtain $n_{Z_{1}}^{\rm{L}}$, $e_{Z_{1}}^{\rm{ph,U}}$, $e_{Z_{1}}^{\rm{bit,U}}$, and $(e_{X_{1}}^{\rm{bit}}+e_{Y_{1}}^{\rm{bit}})^{\rm{U}}$ by employing the decoy-state method. The specific formulas are shown in Supplementary Note C. Here, we set the same failure probability parameters for simplicity, $\varepsilon_{\rm{cor}}=\hat{\varepsilon}=\varepsilon_{\rm{PA}}=\xi$, $\varepsilon_{1}=8\xi$, and $\varepsilon_{e}=\varepsilon_{e}^{\prime}=\varepsilon_{e}^{\prime\prime}=5\xi$. For a fair comparison, we compare the secret key rate per sending pulse, $R_{o(s)}=l_{o(s)}/N$.

Figure 3 is the simulation of the original MP-QKD protocol with finite-key size analysis. We compare the secret key rate (per pulse) under different total pulse numbers $N$ and different maximal pairing intervals $l$. It indicates that the original protocol can reach up to 446 km under the condition that $N=10^{13}$ and $l=10^{6}$. Moreover, when $N=10^{13}$ and $l=10^{4}$, this protocol is close to the PLOB bound at a distance about 320 km. That means that it can break the PLOB bound if $l>10^{4}$ when $N=10^{13}$, or $N>10^{13}$ when $l=10^{4}$. The secret key rate under a short distance is almost invariable with the increase of the maximal pairing interval.

For a better understanding of the MP-QKD protocol, we show the evolution of optimized variables over increasing distance when the number of total pulses is ${10^{13}}$ in Fig. 4. It can be shown that for $l=10^{6}$, the intensity $\mu$ and its probability $p_{\mu}$ decrease with the increase of the distance. This is because that with the increase of the distance, the quantum bit error rate (QBER) caused by the multiple-photon term will increase, causing the smaller $\mu$, which is similar to Supplementary Note 5 of Ref. Zeng et al. (2022). And because the statistical fluctuation effect intensifies, the probability $p_{\nu}$ should be improved to blunt the effect, causing the bigger $p_{\nu}$ and smaller $p_{\mu}$. Different from the other protocols, MP-QKD needs enough intensity $o$ to form a $Z$-pair, so $p_{o}$ is high in our optimization. For $l=10^{4}$, the parameters are the same as $l=10^{6}$ when the distance is below 210 km. This is because the gain is high enough under this situation, the quantity of successful pairing can’t increase with $l$. Then, with the improvement of the distance, $\mu$ and $p_{\mu}$ increase and then decrease. These are two tradeoffs between the coincidence count and the QBER, the coincidence count and the statistical fluctuation, respectively. Moreover, $\Delta$ varies between $\pi/16$ and $\pi/8$.

Figure 5 is the simulation of the six-state MP-QKD protocol with finite-key size analysis. We present the secret key rate under three different maximal pairing intervals. Moreover, we compare the secret key rates of the original protocol and the six-state one, the blue lines show the ratio of $R_{s}$ to $R_{o}$. The improvement of our six-state protocol becomes significant in long distance cases.

In conclusion, we prove the composable security of the original MP-QKD protocol in the finite-key regime against general attacks. Methodologically, by employing the uncertainty relation of smooth min- and max-entropy and proving the relation between the single-photon phase error of the $Z$-basis and the single-photon bit error of the $X$-basis, the secret key rate was obtained. Moreover, we propose a six-state MP-QKD protocol and analyze its finite-key effect. The six-state one can obtain a higher secret key rate than the original protocol. This improvement is achieved by a subtle analysis of experimental data, thus any modification of experimental system is not necessary. As shown in the numerically simulation, the MP-QKD protocol can break the PLOB bound when the total pulse numbers is $10^{13}$ and the maximal pairing interval is greater than $10^{4}$. It can reach up to $446$ km with $10^{6}$ pairing interval and $10^{13}$ total pulses. Moreover, the simulation shows that the six-state protocol can obtain higher secret key rate than the original protocol, especially on a long distance. Our work provides theoretical tools for key rate calculation in future MP-QKD implementations.

In this work, our analysis is based on continuous phase randomization , which might be difficult to realize in the real world. For future work, an analysis based on a discrete set is meaningful Cao et al. (2015). And the data of unmatched basis are wasted in our work, the utilization of them may improve the performance or increase the security, similar to some other protocols Laing et al. (2010); Tamaki et al. (2014); Braunstein and Pirandola (2012); Watanabe et al. (2008). This is also a possible direction for future work.

According to the quantum leftover hash lemma Renner (2008); Tomamichel et al. (2011), an $\varepsilon_{\rm{sec}}$-secret key of length $l_{o}$ can be extracted from the bit string $\mathbf{Z}$ by applying privacy amplification with two-universal hashing, and

where $E^{\prime}$ is the auxiliary of Eve after error correction, $H_{\rm{min}}^{\varepsilon}(\mathbf{Z}|E^{\prime})$ is the conditional smooth min-entropy, which is employed to quantify the average probability that Eve guesses $\mathbf{Z}$ correctly with $E^{\prime}$ Konig et al. (2009). Because $\lambda_{\rm{EC}}+\log_{2}(2/\varepsilon_{\rm{cor}})$ bits are published in the error correction step, the conditional smooth min-entropy $H_{\rm{min}}^{\varepsilon}(\mathbf{Z}|E^{\prime})$ can be bounded by

where $E$ is the auxiliary of Eve before error correction. Moreover, since the phases of coding states in $Z$-pair $P^{i,j}$ are never revealed, the coding states can be treated as a mixture of Fock states. This implies $\mathbf{Z}$ can be decomposed into $\mathbf{Z}_{1}\mathbf{Z}_{\rm{zm}}$, which are the corresponding bit strings due to the single-photon and the other events. By employing a chain-rule inequality for smooth entropies Vitanov et al. (2013), we have

where $\varepsilon=2\overline{\varepsilon}+\hat{\varepsilon}$.

The essential of the security proof is how to bound $H_{\rm{min}}^{\overline{\varepsilon}}(\mathbf{Z}_{1}|\mathbf{Z}_{\rm{zm}}E)$. We give the sketch of the proof and leave the details in Supplementary Note A. By describing the protocol as an entanglement-based one, Alice (Bob) decides the basis of $P^{i,j}_{a}$ ($P^{i,j}_{b}$) and key bit by measuring her (his) local quantum memories. Specifically, $\mathbf{Z}_{1}$ can be seen as the results of $\sigma_{Z}$ measurements on Alice’s local qubits of single-photon events. Then according to the uncertainty relation for smooth entropies, $H_{\rm{min}}^{\overline{\varepsilon}}(\mathbf{Z}_{1}|\mathbf{Z}_{\rm{zm}}E)$ can be upper-bounded by the phase error rate, i.e. the error rate of key bits generated by the hypothetical $\sigma_{X}$ measurements on these local qubits. As an example, when the pair $P^{i,j}_{a}$ happens to be a $Z$-basis and also a single-photon event, $\sigma_{Z}$ measurement on Alice’s local qubits makes this single-photon collapse into the position $i$ or $j$, i.e. $|i\rangle$ or $|j\rangle$ respectively. Meanwhile, its hypothetical $\sigma_{X}$ measurement just leads to quantum super positions $(|i\rangle\pm|j\rangle)/\sqrt{2}$. Actually, one can easily imagine that $(|i\rangle\pm e^{{\rm{i}}\theta_{a}}|j\rangle)/\sqrt{2}$ will be prepared if $P^{i,j}_{a}$ is an $X$-basis event. Intuitively, the phase $\theta_{a}$ may be removed without compromising the security, since this phase may be resulted by a unitary operation on Alice’s local qubits. Then the sketch of the security proof is clear.

In Supplementary Note A, we prove that the phase error rate for any individual single-photon $Z$-pair $P^{i,j}$ must be equal to the error rate if single-photon $P^{i,j}$ happens to be $X$-pair. Then in non-asymptotic cases, the phase error rate for the raw key string $\mathbf{Z}_{1}$ has been sampled by the error rate between $\mathbf{X}_{1}$ and $\mathbf{X}_{1}^{\prime}$, where $\mathbf{X}_{1}$ and $\mathbf{X}_{1}^{\prime}$ represent the key strings obtained from single-photon events in $\mathcal{X}$. Finally, we have

where $n_{Z_{1}}^{\rm{L}}$ is the lower bound of the length of $\mathbf{Z_{1}}$ with a failure probability $\varepsilon_{1}$, $e_{Z_{1}}^{\rm{ph,U}}$ is the upper bound of the single-photon phase error rate of $n_{Z_{1}}^{\rm{L}}$ with a failure probability $\varepsilon_{e}$. And $h(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)$ is the binary Shannon entropy function. Actually, $e_{Z_{1}}^{\rm{ph,U}}$ can be estimated by the observed values. And the decoy-state method which is employed to estimated $n_{Z_{1}}^{\rm{L}}$ and $e_{Z_{1}}^{\rm{ph,U}}$ is shown in Supplementary Note C.

If we choose

where $\overline{\varepsilon}=\sqrt{\varepsilon_{e}+\varepsilon_{1}}$, $\varepsilon_{\rm{PA}}$ is the failure probability of privacy amplification, we can get one of the main results of our paper by combining the equation behind,

where ${\rm{\lambda_{EC}}}=fn_{Z}h(E_{Z})$ is the information revealed in the error correction step, $f$ is the error correction efficiency which is related to the specific error correction scheme, $n_{Z}$ is the length of the raw key and $E_{Z}$ is the bit error rate between strings $\mathbf{Z}$ and $\mathbf{Z}^{\prime}$. Moreover, the security coefficient of the whole protocol is $\varepsilon_{\rm{tol}}=\varepsilon_{\rm{cor}}+\varepsilon_{\rm{sec}}$, where $\varepsilon_{\rm{sec}}=2(\hat{\varepsilon}+2\sqrt{\varepsilon_{e}+\varepsilon_{1}})+\varepsilon_{\rm{PA}}$. $\hat{\varepsilon}$ is the coefficient while using the chain rules, and $\varepsilon_{\rm{PA}}$ is the failure probability of privacy amplification.