the result $\zeta^{a}$. Then the conditional state in the systems
$\tilde{A}_{1}$, $\tilde{A}_{2}$, $A_{1}^{\prime\prime}$, $A_{1}$ and $A_{2}$
can be reduced to the $X(\theta)$-basis encoding state
$\ket{\tilde{\Phi}^{X(\theta)}_{2\mu}}$ of Eq. (45) used in the coherent-state
MDI-QKD scheme in Sec. B.1 with a possible simultaneous $\pi$-phase modulation
on the optical modes $A_{1}$ and $A_{2}$ when $\zeta^{a}=1$.

###### Proof.

We first summarize the introduced reduction procedure in Fig. 15, which is
independent of Charlie’s operation.

Figure 15: (a) Alice’s composite encoding process in the MP scheme. In each
round, Alice generates a state $\ket{\tilde{\Psi}^{Com}}$ on the one optical
mode $A_{i}$, two qubit ancillaries $A_{i}^{\prime}$ and
$A_{i}^{\prime\prime}$ and a qudit $\tilde{A}_{i}$ defined in Eq. (59). (here
$i=1$ or $2$.) She transmits the system $A_{i}$ to Charlie. Based on the
detection, she pairs the ancillary systems based on a pairing setting
$\vec{\chi}$. For a pair on locations $1$ and $2$, she first performs
collective detection on systems $A_{1}^{\prime}$ and $A_{2}^{\prime}$ to
determine the basis. (b) The reduction of Alice’s state to the $Z$-basis
encoding state $\ket{\tilde{\Phi}^{Z}_{\mu}}$ defined in Eq. (43) or the
$X(\theta)$-basis encoding state $\ket{\tilde{\Phi}^{X(\theta)}_{2\mu}}$
defined in Eq. (45) of coherent-state MDI-QKD. If the measurement result on
$A_{2}^{\prime}$ is $\tau^{a}=1$, Alice measures the modes
$A_{1}^{\prime\prime}$ and $A_{2}^{\prime\prime}$ on $Z$-basis and records the
results $z_{1}^{\prime\prime}$ and $z_{2}^{\prime\prime}$. The final state on
$A_{1}^{\prime}$, $A_{1}$, $A_{2}$, $\tilde{A}_{1}$ and $\tilde{A}_{2}$ will
be the $Z$-basis encoding state $\ket{\tilde{\Phi}^{Z}_{\mu}}$ with two
possible extra $\pi$-phase modulations on $A_{1}$ and $A_{2}$, based on the
values of $z_{1}^{\prime\prime}$ and $z_{2}^{\prime\prime}$, respectively. On
the other hand, if $\tau^{a}=0$, Alice measures $A_{1}^{\prime}$ on the
$Z$-basis. If the result is $1$, Alice obtains
$\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}\otimes\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}$
defined in Eq. (60). She applies a CNOT gate from $A_{2}^{\prime\prime}$ to
$A_{1}^{\prime\prime}$, measure $A_{2}^{\prime\prime}$ on $Z$-basis and
records the result $\zeta^{a}$. In this way, she generates
$\ket{\tilde{\Phi}^{X(\theta)}_{2\mu}}$ with a possible simultaneous
$\pi$-phase modulation on $A_{1}$ and $A_{2}$, based on the value of
$\zeta^{a}$.

To perform the basis-assignment measurement, Alice first performs a CNOT gate
on qubits $A_{1}^{\prime}$ and $A_{2}^{\prime}$ and then measure
$A_{2}^{\prime}$. After the CNOT gate, the joint state on
$A_{1}^{\prime\prime}A_{1}^{\prime}A_{1}$ and
$A_{2}^{\prime\prime}A_{2}^{\prime}A_{2}$ becomes

$\displaystyle\ket{\tilde{\Psi}^{Com}_{1,2}}=$
$\displaystyle\frac{1}{2}\big{(}\ket{00}\ket{\tilde{\Psi}^{X(\theta)}_{0}}\ket{\tilde{\Psi}^{X(\theta)}_{0}}+\ket{01}\ket{\tilde{\Psi}^{X(\theta)}_{0}}\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}$
(61) $\displaystyle+$
$\displaystyle\ket{11}\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}\ket{\tilde{\Psi}^{X(\theta)}_{0}}+\ket{10}\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}\big{)}_{A_{1}^{\prime},A_{2}^{\prime};\tilde{A}_{1},A_{1}^{\prime\prime},A_{1};\tilde{A}_{2},A_{2}^{\prime\prime},A_{2}},$

where
$\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}_{\tilde{A}_{1}A_{1}^{\prime\prime}A_{1}}$
is defined in Eq. (60). Now, Alice performs $Z$-basis measurement on the
system $A_{2}^{\prime}$ to determine the encoding basis.

When the outcome is $\tau^{a}=1$, the post-selected state is

$\displaystyle\frac{1}{\sqrt{2}}\big{(}\ket{0}\ket{\tilde{\Psi}^{X(\theta)}_{0}}\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}+\ket{1}\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}\ket{\tilde{\Psi}^{X(\theta)}_{0}}\big{)}_{A_{1}^{\prime};\tilde{A}_{1},A_{1}^{\prime\prime},A_{1};\tilde{A}_{2},A_{2}^{\prime\prime},A_{2}}$
(62) $\displaystyle=$
$\displaystyle\frac{1}{2\sqrt{2}D}\sum_{j_{1},j_{2}=0}^{D-1}\ket{j_{1}}_{\tilde{A}_{1}}\ket{j_{2}}_{\tilde{A}_{2}}\Big{[}\ket{0}\left(\ket{0}\ket{0}+\ket{1}\ket{0}\right)\left(\ket{0}\ket{\sqrt{\mu}e^{i\phi^{a}_{j_{2}}}}+\ket{1}\ket{\sqrt{\mu}e^{i(\phi^{a}_{j_{2}}+\pi)}}\right)$
$\displaystyle+\ket{1}\left(\ket{0}\ket{\sqrt{\mu}e^{i\phi^{a}_{j_{1}}}}+\ket{1}\ket{\sqrt{\mu}e^{i(\phi^{a}_{j_{1}}+\pi)}}\right)\left(\ket{0}\ket{0}+\ket{1}\ket{0}\right)\Big{]}_{A_{1}^{\prime};A_{1}^{\prime\prime},A_{1};A_{2}^{\prime\prime},A_{2}}$
$\displaystyle=$
$\displaystyle\frac{1}{2}\Big{[}\ket{00}\ket{\tilde{\Phi}^{Z}_{\mu}}+\ket{01}\hat{U}(\pi)_{A_{2}}\ket{\tilde{\Phi}^{Z}_{\mu}}+\ket{10}\hat{U}(\pi)_{A_{1}}\ket{\tilde{\Phi}^{Z}_{\mu}}+\ket{11}(\hat{U}(\pi)\otimes\hat{U}(\pi))_{A_{1},A_{2}}\ket{\tilde{\Phi}^{Z}_{\mu}}\Big{]}_{A_{1}^{\prime};A_{1}^{\prime\prime},A_{1};A_{2}^{\prime\prime},A_{2}},$

where
$\ket{\tilde{\Phi}^{Z}_{\mu}}_{\tilde{A}_{1}\tilde{A}_{2},A_{1}^{\prime},A_{1}A_{2}}$
is defined in Eq. (43). Now, suppose Alice measures the systems
$A_{1}^{\prime\prime}$ and $A_{2}^{\prime\prime}$ on $Z$-basis and obtains the
results $z_{1}^{\prime\prime}$ and $z_{2}^{\prime\prime}$. The post-selected
state on the systems $A_{1}^{\prime},A_{1},A_{2}$ will become the $Z$-basis
encoding state $\ket{\tilde{\Phi}^{Z}_{\mu}}$ of the coherent-state MDI-QKD
scheme with a possible $\pi$-phase modulation on the optical modes $A_{1}$ and
$A_{2}$, depending on the values $z_{1}^{\prime\prime}$ and
$z_{2}^{\prime\prime}$. This reduction process is illustrated in Fig. 16.

Figure 16: Reduction of the encoding state of the MP scheme in Fig. 15(b) to
the $Z$-basis encoding state $\ket{\tilde{\Phi}^{Z}_{\mu}}$ in Eq. (43) and
Fig. 14(a). After we measure the ancillary qubits $A_{1}^{\prime\prime}$ and
$A_{2}^{\prime\prime}$ on $Z$-basis and obtain the results
$z_{1}^{\prime\prime}$ and $z_{2}^{\prime\prime}$, we will project the
remaining encoding state to $\ket{\tilde{\Phi}^{Z}_{\mu}}$ with extra phase
modulations $z_{1}^{\prime\prime}\pi$ and $z_{2}^{\prime\prime}\pi$ on the
optical modes $A_{1}$ and $A_{2}$, respectively. The extra $\pi$-phase
modulation will not affect the security and the performance of the $Z$-basis
coherent-state MDI-QKD scheme.

We remark that, for the single-photon component, a $\pi$-phase modulation on
the optical modes $\tilde{A}_{1}$ and $\tilde{A}_{2}$ can be regarded as a
$Z$-axis rotation on the ancillary qubit $A^{\prime}$ shown in Fig. 13. This
rotation will not affect the $Z$-basis measurement result. Therefore, the
$\pi$-phase modulation on $A_{1}$ and $A_{2}$ will not affect the security of
the $Z$-basis key generation.

On the other hand, when $\tau^{a}=0$, the post-selected state is

$\displaystyle\frac{1}{\sqrt{2}}\big{(}\ket{0}\ket{\tilde{\Psi}^{X(\theta)}_{0}}\ket{\tilde{\Psi}^{X}_{0}}+\ket{1}\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}\big{)}_{A_{1}^{\prime};A_{1}^{\prime\prime},A_{1};A_{2}^{\prime\prime},A_{2}}.$
(63)

In this case, Alice further measures $A_{1}^{\prime}$ on the $Z$ basis and
keeps her signals if the result is $1$. The post-selected state is then
$\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}\otimes\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}_{\tilde{A}_{1}A_{1}^{\prime\prime}A_{1};\tilde{A}_{2}A_{2}^{\prime\prime}A_{2}}$,
where $\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}$ is defined in Eq. (60). We remark
that, if the measurement result on $A_{1}^{\prime}$ is $0$, then the state
will not be used for key generation; instead, it can be used for the parameter
estimation.

To reduce the state
$\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}\otimes\ket{\tilde{\Psi}^{X(\theta)}_{\mu}}_{\tilde{A}_{1}A_{1}^{\prime\prime}A_{1};\tilde{A}_{2}A_{2}^{\prime\prime}A_{2}}$
to the $X(\theta)$-basis encoding state
$\ket{\tilde{\Phi}^{X(\theta)}_{2\mu}}$ of coherent-state MDI-QKD scheme
defined in Eq. (45), Alice applies a CNOT operation from the system
$A_{2}^{\prime\prime}$ to $A_{1}^{\prime\prime}$, measures
$A_{2}^{\prime\prime}$ on the $Z$-basis, and records the result $\zeta^{a}$.
As is shown in Fig. 17, we can equivalently move the $Z$-basis measurement on
$A_{2}^{\prime\prime}$ forward to the beginning. In this way, we can reduce
the encoding state to $\ket{\tilde{\Phi}^{X(\theta)}_{2\mu}}$ with a
simultaneous $\pi$-phase modulation on the optical modes $A_{1}$ and $A_{2}$.
For the $X(\theta)$-basis coherent-state MDI-QKD scheme, such $\pi$-phase
modulation will not cause any effect.

Figure 17: Reduction of encoding in Fig. 15(b) to the $X(\theta)$-basis
encoding state $\ket{\tilde{\Phi}^{X(\theta)}_{2\mu}}$ in Eq. (45) and Fig.
14(b). From (a) to (b), we advance the $Z$-basis measurement on
$A_{2}^{\prime\prime}$. This entails introducing an extra random number
$\zeta^{a}$ in the phase modulations of $A_{1}$ and $A_{2}$, as shown in (c).
We remark that, a simultaneous phase modulation will not affect the security
and performance of the $X(\theta)$-basis coherent-state MDI-QKD.

∎

Based on Lemma 3, we introduced the fixed-pairing MP scheme in Box
LABEL:box:fixedMP, which is also illustrated in Fig. 18.

Fixed-pairing MP schemefixedMP

  1. 1.

State preparation: In each round, Alice prepares the composite state
$\ket{\tilde{\Psi}^{Com}}$ defined in Eq. (59) on the optical mode $A_{i}$,
two ancillary qubits $A_{i}^{\prime}$ and $A_{i}^{\prime\prime}$ and an
ancillary qudit $\tilde{A}_{i}$. In a similar manner, Bob prepares
$\ket{\tilde{\Psi}^{Com}}$.

  2. 2.

Measurement: Alice and Bob send modes $A_{i}$ and $B_{i}$ to Charlie, who is
supposed to perform the single-photon interference measurement. Charlie
announces the clicks of the detectors $L$ and/or $R$.

Alice and Bob perform the above steps over many rounds. Afterwards, they
perform the following data post-processing.

  3. 3.

Mode Pairing: Based on a pre-set pairing setting $\vec{\chi}\in\mathcal{X}$,
Alice and Bob pair their locations (i.e., group each two locations together).

  4. 4.

Basis Sifting: For each pair on locations $i$ and $j$, Alice performs the
basis-assignment measurement on $A_{i}^{\prime}$ and $A_{j}^{\prime}$ to
determine the basis, as shown in Fig. 15. If the result $\tau^{a}=0$, Alice
further measures $A_{i}^{\prime}$ on the $Z$-basis and records the result
$\lambda^{a}$. Alice assigns the basis of the pair as $Z$ if $\tau^{a}=1$, $X$
if $\tau^{a}=0$ and $\lambda^{a}=1$ and ‘0’ if $\tau^{a}=\lambda^{a}=0$. Bob
assigns the basis in the same way. Alice and Bob announce their bases. If the
announced bases are the same, $X,X$ or $Z,Z$, they keep their signals.

  5. 5.

Key mapping: For each $Z$-pair on locations $i$ and $j$, Alice discards qubits
$A_{i}^{\prime\prime}$ and $A_{j}^{\prime\prime}$ and keeps $A_{i}^{\prime}$
for later usage. For each $X$-pair, Alice applies CNOT gate from qubit
$A_{j}^{\prime\prime}$ to $A_{i}^{\prime\prime}$, discards qubit
$A_{j}^{\prime\prime}$, keeps qubit $A_{i}^{\prime\prime}$. Alice then
performs global measurement $M(k,\theta)$ defined in Eq. (32) on qudits
$\tilde{A}_{i}$ and $\tilde{A}_{j}$ to obtain the photon number $k^{a}$ and
the relative phase $\theta^{a}$. Bob operates similarly. For all $X$ pairs,
Alice and Bob further announce $\theta^{a}$ and $\theta^{b}$. If
$\theta^{a}=\theta^{b}$, they keep the $X$-pair data; if
$\theta^{a}-\theta^{b}=\pi$, they keep the $X$-pair data with Bob applying the
$Z$ gate on his left qubit. Moreover, if Charlie’s announcement on locations
$i$ and $j$ is $(L,R)$ or $(R,L)$, Bob applies $Z$ gate on the qubit system
$B_{i}^{\prime\prime}$ for the $X$-pairs. Alice and Bob then measure the
ancillary qubits $A^{\prime\prime}$ and $B^{\prime\prime}$ of all the
$X$-pairs and the ancillary qubits $A^{\prime}$ and $B^{\prime}$ of all the
$Z$-pairs on the $X$\- and $Z$-bases, respectively, to obtain the raw key bits
$\kappa^{a}$ and $\kappa^{b}$.

  6. 6.

Parameter estimation: Alice and Bob estimate the fraction of clicked single-
photon signals $q_{(1,1)}$ and the corresponding phase-error rate
$e^{X(\theta)}_{(1,1)}$ in the $Z$-pairs, with Alice and Bob both emitting a
single photon at locations $i$ and $j$.

  7. 7.

Key distillation: Alice and Bob reconcile the key string to $\kappa^{a}$ and
perform privacy amplification using universal-2 hashing matrices. The sizes of
hashing matrices are determined by the estimated single-photon yield
$q_{(1,1)}$ and the $X(\theta)$-basis error rate $e^{X(\theta)}_{(1,1)}$
according to Eq. (57).

Figure 18: Diagram of the entanglement-based MP scheme with a fixed pairing
location. Here we take the pair on location $1$ and $2$ for example. Alice and
Bob both generate a composite state $\ket{\tilde{\Psi}^{Com}}$ on an optical
mode, two ancillary qubits and a ancillary qudit in each round and send the
optical modes to Charlie. After Charlie’s detection announcement, they perform
control operations on the ancillary qubits at the predetermined paired
locations and perform measurements on them. They then perform $Z$-basis
measurements on all the ancillary qubits $A^{\prime}_{1}(B^{\prime}_{1})$,
$A^{\prime\prime}_{1}(B^{\prime\prime}_{1})$, $A^{\prime}_{2}(B^{\prime}_{2})$
and $A^{\prime\prime}_{2}(B^{\prime\prime}_{2})$ to obtain the measurement
results $\sigma^{a}(\sigma^{b})$, $\lambda^{a}(\lambda^{b})$,
$\zeta^{a}(\zeta^{b})$, $\tau^{a}(\tau^{b})$. The usage of these results is
listed in Fig. 21(d).

We introduce encoding redundancies in the coherent-state MDI-QKD scheme, so
that the proposed MP scheme owns i.i.d. state preparation process in each
round. Due to this i.i.d. encoding property, we can see that the MP scheme can
be reduced to the coherent-state scheme based on Lemma 3 _for any given
pairing setting $\vec{\chi}$_. We now clarify this lemma.

######  Lemma 4 (Security of the MP scheme under any fixed pairing setting).

In the MP scheme, for any given pairing setting $\vec{\chi}$, suppose that
Alice and Bob perform the mode-pairing operations on the ancillary qubits
$\\{A_{i}^{\prime},A_{i}^{\prime\prime},B_{i}^{\prime},B_{i}^{\prime\prime}\\}_{i}$
in Lemma 3 and the pairwise measurement $M(k,\theta)$ defined in Eq. (32) on
the ancillary qudits $\\{\tilde{A}_{i},\tilde{B}_{i}\\}_{i}$. When the
discrete phase number $D\to\infty$, we have,

  1. 1.

(Photon-number Poisson statistics) For the $(i,j)$-location pairs with overall
intensities
$\mu^{a}:=\mu^{a}_{i}+\mu^{a}_{j},\mu^{b}:=\mu^{b}_{i}+\mu^{b}_{j}$, the
photon-number-measurement results $(k^{a},k^{b})$ of Alice and Bob’s pairwise
measurement $M(k,\theta)$ follow Poisson distributions,

$\Pr(k^{a},k^{b})=e^{-(\mu^{a}+\mu^{b})}\frac{(\mu^{a})^{(k^{a})}(\mu^{b})^{(k^{b})}}{k^{a}!k^{b}!}.$
(64)

  2. 2.

(Independence of the photon-number states to the intensity) The resultant
state after the joint measurement $M(k,\theta)$ is independent of the
intensity values $\mu^{a}$ and $\mu^{b}$.

  3. 3.

(Basis-independence of the single-photon pairs) For the location pairs with
the overall photon-number measurement result $k^{a}=k^{b}=1$, the
$X(\theta)$-basis error rate can be used as a fair estimation of the $Z$-basis
phase-error rate.

As a result, with any fixed pairing $\vec{\chi}$, the $\vec{\chi}$-fixed-
pairing scheme is able to generate secure key strings with the tagging key-
rate formula, Eq. (57).

###### Proof.

From Lemma 3 we see that, under any pairing setting $\vec{\chi}$, with the
given basis-assignment and post-selection condition, Alice and Bob can
generate the encoding states $\ket{\tilde{\Phi}^{Z}_{\mu}}$ and
$\ket{\tilde{\Phi}^{X(\theta)}_{2\mu}}$ in the coherent-state MDI-QKD scheme.
Furthermore, if Alice and Bob perform the pairwise measurement $M(k,\theta)$
defined in Eq. (32) on the remaining state, from Lemma 2 we see that, the
results $(k^{a},k^{b})$ of $M(k,\theta)$ defined in Eq. (32) obey the Poisson
distribution; after the pairwise measurement $M(k,\theta)$, the post-selected
photon-number state is independent of the intensity setting $\mu^{a}$ and
$\mu^{b}$; the post-selected encoding states with $k^{a}=k^{b}=1$ will become
to the ones in the single-photon MDI-QKD scheme. If we post-select the
corresponding encoding states, the security of this scheme will be equivalent
to the single-photon MDI-QKD scheme, where the encoding state is basis-
independent and the security proof can be easily done based on the
complementarity.

If we set the photon numbers $k^{a}$ and $k^{b}$ to be the tag on the MP
scheme, the key rate of the MP scheme also follows the traditional tagging
key-rate formula in Eq. (57). ∎

###  B.4 Free-pairing MP scheme

The freedom of choosing the pairing setting, $\vec{\chi}$, in the fixed-
pairing MP scheme inspires us to consider a more flexible variant, where
$\vec{\chi}$ is determined based on Charlie’s announcements $\vec{C}$. We call
this variant the free-pairing MP scheme, in Definition 5. Note that the
pairing setting, $\vec{\chi}\in\mathcal{X}$ in Definition 1, is chosen for all
the $N$ emitted signals, even for the locations without successful detection.
This is due to the usage of Lemma 4 in the latter discussion.

######  Definition 4 (Pairing Strategy $T$).

For $N$ location indexes $i=1,2,...,N$ where $N$ is an even number, a pairing
strategy, $T:\mathcal{C}\to\mathcal{X}$, is defined to be a map from Charlie’s
announcement $\vec{C}\in\mathcal{C}$ in Definition 2 to the pairing setting
$\vec{\chi}\in\mathcal{X}$ in Definition 1. The possible pairing strategies
form a finite set $\mathcal{T}$.

######  Definition 5 ($T$-Free-Pairing MP).

In a MP MDI-QKD scheme, if pairing setting $\vec{\chi}$ depends on Charlie’s
announcement, then we call it the free-pairing MP scheme. A free-pairing MP
scheme with pairing strategy $T\in\mathcal{T}$ is called the $T$-free-pairing
MP scheme.

We remark that, the pairing setting $\vec{\chi}$ in Definition 1 and the
pairing strategy $T$ in Definition 4 are defined for _all the locations_ ,
even for the ones with unsuccessful detections. In a pairing strategy $T$, we
need to pair all the locations based on Charlie’s announcement $\vec{C}$ and
do not perform any post-selection. The pairing definition in this way is
helpful to build up a connection between the fixed- and free-pairing schemes,
so that the loss sifting in the free-pairing schemes will be handled following
the same way as the fixed-pairing schemes. For example, suppose there are 4
rounds in the mode-pairing scheme and Charlie announces successful detections
on locations 1 and 4, then based on a simple pairing strategy, Alice and Bob
pair the locations as follows: $(1,4)$, $(2,3)$. The “lost” pair $(2,3)$ will
be used for the parameter estimation.

We also note that, the $\vec{\chi}$-fixed-pairing scheme can be regarded as a
special case of the $T$-free-pairing scheme, where the pairing strategy is a
constant function, $T(\vec{C})\equiv\vec{\chi}$,
$\forall\vec{C}\in\mathcal{C}$. Following the fixed-pairing MP scheme in Box
LABEL:box:fixedMP, we present the procedures of the free-pairing MP scheme
with a pairing strategy $T$ in Box LABEL:box:freeMP.

Free-pairing MP schemefreeMP

  1. 1.

State preparation: Same as the fixed-pairing MP scheme in Box
LABEL:box:fixedMP.

  2. 2.

Measurement: Same as the fixed-pairing MP scheme in Box LABEL:box:fixedMP.

Alice and Bob perform the above steps over many rounds. After that, they
perform the following data post-processing steps.

  3. 3.

Mode Pairing: Charlie announces $\vec{C}\in\mathcal{C}$ of Definition 2, based
on which Alice and Bob determine a pairing setting
$\vec{\chi}=T(\vec{C})\in\mathcal{X}$ of Definition 1 using a predetermined
pairing strategy $T\in\mathcal{T}$ of Definition 4.

  4. 4.

Basis Sifting: Same as the fixed-pairing MP scheme in Box LABEL:box:fixedMP.

  5. 5.

Key mapping: Same as the fixed-pairing MP scheme in Box LABEL:box:fixedMP.

  6. 6.

Parameter estimation: Same as the fixed-pairing MP scheme in Box
LABEL:box:fixedMP.

  7. 7.

Key distillation: Same as the fixed-pairing MP scheme in Box
LABEL:box:fixedMP.

In the free-pairing scheme, Charlie announces $\vec{C}$ and then Alice and Bob
determine $\vec{\chi}$ based on $\vec{C}$. In a way, Charlie can manipulate
the choice of paring settings. Here, we prove the security of the free-pairing
scheme by taking the advantage of the arbitrariness of the pairing setting
$\vec{\chi}$ in the fixed-pairing scheme.

Figure 19: Flowcharts of (a) $\vec{\chi}$-fixed-pairing scheme and (b)
$T$-free-pairing scheme. Here, the key-generation operation $M_{ab}$
correponds to Steps 4-7 in Box LABEL:box:fixedMP and LABEL:box:freeMP. The
major difference of the fixed-pairing and free-pairing scheme lies in how the
key-generation operation $M_{ab}$ depends on the pairing setting $\vec{\chi}$
and how the pairing setting is determined by Charlie’s announcement $\vec{C}$.

Before we examine the free-pairing scheme, we first briefly review the process
of fixed-pairing scheme and revisit what we proved in Lemma 4. A simple
diagram of $\vec{\chi}$-fixed-pairing scheme is shown in Fig. 19(a), as a
special case of Fig. 9. Alice and Bob first generate $N=2n$ rounds of the
encoding state $\rho_{ABA^{\prime}B^{\prime}}$ as the pure state
$\ket{\tilde{\Psi}^{Com}}_{Alice}\otimes\ket{\tilde{\Psi}^{Com}}_{Bob}$
defined in Eq. (59). They send all the optical signals of systems $A$ and $B$
to Charlie, who performs unknown measurement $M_{c}$ on them and announces the
result $\vec{C}$ defined in Definition 2. Note that $M_{c}$ refers to all
Charlie’s operations, including measurement, result processing, and
announcement strategy.

Figure 20: Security of the free-pairing MP scheme. Given Charlie’s measurement
$M_{c}$, we list all possible ancillary states
$\sigma_{\vec{C}}:=\sigma(\vec{C})$ and the private key states
$\rho^{P}_{\vec{\chi},\vec{C}}:=\rho^{P}(\vec{C},\vec{\chi})$ with different
announcements $\vec{C}$ and pairing settings $\vec{\chi}$. Adopting a free
pairing strategy $T(\vec{C})$ in the key-generation procedure is essentially
to pick out a private key state $\rho^{P}$ for each announcement $\vec{C}$
according to $\vec{\chi}=T(\vec{C})$. For the example shown in the figure,
connected by dashed red arrow lines, $T(\vec{C}_{1})=\vec{\chi}_{3}$,
$T(\vec{C}_{2})=\vec{\chi}_{M}$, $T(\vec{C}_{3})=\vec{\chi}_{1}$, and
$T(\vec{C}_{N})=\vec{\chi}_{2}$.

Based on $M_{c}$ and $\vec{C}$, Alice and Bob’s remaining ancillary state
$\sigma(M_{c},\vec{C})$ at hand is supposed to be entangled if Charlie
honestly follows the designed measurement. Afterwards, in the
$\vec{\chi}$-fixed-pairing scheme, Alice and Bob perform the key-generation
operation $M_{ab}(\vec{C},\vec{\chi})$, including basis-sifting, key mapping,
parameter estimation, and key distillation (i.e., Steps 4-7 in Box
LABEL:box:fixedMP) based on a pre-determined pairing setting $\vec{\chi}$ in
Definition 1 and Charlie’s announcement $\vec{C}$. Following Lemma 4, we have
proven that, for all possible Charlie’s measurement operation $M_{c}$ and
announcement result $\vec{C}$, the final state
$\rho^{P}(M_{c},\vec{C},\vec{\chi})$ will be private for every
$\vec{\chi}\in\mathcal{X}$.

Now we are going to show the security of a free-pairing scheme.

######  Theorem 1 (Security of the free-pairing MP scheme).

For any pairing strategy $T\in\mathcal{T}$ in Definition 4, under all
Charlie’s measurement operations $M_{c}$ and announced results $\vec{C}$, in
the $T$-free-pairing scheme, Alice and Bob is able to generate private key
state $\rho^{P}(M_{c},\vec{C},\vec{\chi})$ with the tagging key-rate formula
Eq. (57).

###### Proof.

We are going to prove the following three statements,

  1. 1.

In any fixed-pairing scheme where $T(\vec{C})\equiv\vec{\chi}\in\mathcal{X}$,
for any possible Charlie’s measurement operation $M_{c}$ and announcement
result $\vec{C}$, after the key-generation operation $M_{ab}$ (i.e., Steps 4-7
in Box LABEL:box:fixedMP) , the final state $\rho^{P}$ is private with the
tagging key-rate formula Eq. (57).

  2. 2.

All possible Charlie’s measurements $M_{c}$ in a $T$-free-pairing scheme can
be realized in every fixed-pairing scheme 111That is, the set of possible
$M_{c}$ in the free-pairing scheme is contained in that of fixed-pairing
scheme. Strictly speaking, the sets of possible $M_{c}$ in the two cases are
the same, since it only depends on the state Alice and Bob prepare, which is
independent of $T$-free-pairing or $\chi$-fixed-pairing..

  3. 3.

Given Charlie’s measurement $M_{c}$, the final state generated by a $T$-free-
pairing scheme is equal to the private state
$\rho^{P}(M_{c},\vec{C},\vec{\chi})$ generated by one of the
$\vec{\chi}$-fixed-pairing schemes.

The first statement is a direct result of Lemma 4.

To prove the second statement, we notice that the encoding state prepared in
both free-pairing and fixed-pairing schemes are the same. Then, Charlie
receives exactly the same quantum states in the two schemes. The only
difference is that Charlie receives different classical information of the
pairing strategies $T\in\mathcal{T}$. Recall that the fixed pairing
$\vec{\chi}$ is a special pairing strategy in $\mathcal{T}$. The second
statement becomes the following question: for any Charlie’s measurements
$M_{c}$ in a $T$-free-pairing scheme, whether Charlie can perform the same
$M_{c}$ in a fixed-pairing scheme. Since the pairing strategy $T$ is
independent of the quantum states sent to Charlie, the answer is yes and hence
the second statement holds.

Now, we prove the third statement. For a given Charlie’s measurement $M_{c}$,
we can list the resultant ancillary states $\sigma(\vec{C})$ at Alice and
Bob’s hand corresponding to different measurement results $\vec{C}$, shown in
Fig. 20. Furthermore, we list all the possible resultant states $\rho^{P}$
after the key-generation operation $M_{ab}$ correspond to different fixed
pairing settings $\vec{\chi}\in\mathcal{X}$ in the fixed-pairing MP schemes,
shown in Fig. 20.

In the $T$-free-pairing scheme in Definition 5, Alice and Bob choose the
pairing setting $\vec{\chi}=T(\vec{C})$ during the key generation process
$M_{ab}$. For a pairing strategy $T\in\mathcal{T}$ in Definition 4, we have
$T(\vec{C})\in\mathcal{X}$. That is, in a $T$-free-pairing scheme, the
resultant state after the key-generation operation will be the same as a
private key state from one of the fixed-pairing schemes, as shown in Fig. 20.

Combining the three statements, we conclude that: under any possible Charlie’s
measurement operation $M_{c}$ and announcement $\vec{C}$, a $T$-free-pairing
scheme results in a private key state with the key length determined by the
tagging key-rate formula Eq. (57). ∎

Having said that Alice and Bob can choose the pairing strategy $T$ freely even
based on Charlie’s announcement $\vec{C}$, the pairing setting $\vec{\chi}$
cannot depend on the measurement results of Alice’s and Bob’s ancillary
states. This is due to the fact that in our security proof, the pairing
setting $\vec{\chi}$ is determined before any operation on the ancillary
states.

###  B.5 Prepare-and-measure MP scheme

As the final step, we reduce the entanglement-based free-pairing MP scheme in
Box LABEL:box:freeMP to the prepare-and-measure one presented in the main
text. In the following discussions, we focus on the reduction on Alice’s side.
The reduction of Bob’s side follows the same manner. Also, for the simplicity
of discussion, we take a paired location $1$ and $2$ as an example.

First, we remove all the pairwise joint measurements $M(k,\theta)$ defined in
Eq. (32) used to read out the global photon number and the relative phase on
each pair of optical modes. Instead, we assume Alice and Bob measure the
(discrete) phase of each pulse directly. In this way, the relative phase can
be obtained by classical post-processing. Then, the global photon number is
lost due to the uncertain relationship between phase and photon number
measurements. In practice, Alice and Bob can use the decoy-state method to
estimate the fraction of the single-photon component. Furthermore, we assume
the random phase is measured at the beginning, which is then equivalent to a
random phase encoding on the emitted optical pulses. In this way, we remove
the two ancillary qudits $\tilde{A}_{1}$ and $\tilde{A}_{2}$ in the encoding
process.

After removing the phase encoding ancillary systems, we are now going to
remove the four ancillary qubits $A_{1}^{\prime}$, $A_{1}^{\prime\prime}$,
$A_{2}^{\prime}$ and $A_{2}^{\prime\prime}$. To do this, we move all the
measurements on the ancillary qubits mentioned in Lemma 3 forward. In Fig.
21(a), we list the complete basis and key-assignment procedure of the
entanglement-based MP scheme. The final measurement results
$\sigma^{a},\lambda^{a},\zeta^{a}$ and $\tau^{a}$ are used in different ways,
as shown in Fig. 21(d). Note that the $Z$-basis measurements commute with all
$CNOT$ gates. Therefore, moving all measurements before the control gates
between locations $1$ and $2$, one can equivalently obtain the measurement
results $\sigma^{a},\lambda^{a},\zeta^{a}$, and $\tau^{a}$ by classical post-
processing, as shown in Fig. 21(b).

Figure 21: (a) All of the operations that Alice performs on the ancillary
qubits $A_{1}^{\prime\prime}$, $A_{1}^{\prime}$, $A_{2}^{\prime\prime}$ and
$A_{2}^{\prime}$ to assign bases and generate raw key bits when the locations
$1$ and $2$ are paired. $\tau^{a}$ is used for the basis assignment,
$\lambda^{a}$ is used for key generation in the $Z$-basis and post-selection
in the $X(\theta)$-basis and $\sigma^{a}$ is used for key generation in the
$X(\theta)$-basis. (b) An equivalent process whereby Alice moves all the
measurement before the global control gates between locations $1$ and $2$. The
measurement results $z_{1}^{\prime\prime}$ and $z_{1}^{\prime}$ on
$A_{1}^{\prime\prime}$ and $A_{1}^{\prime}$ reveal the encoded phase and the
intensity on $A_{1}$, respectively. (c) Alice further measures all ancillaries
in the beginning. This is equivalent to preparing the coherent states on
$A_{1}$ and $A_{2}$ with modulated intensities and phases. (d) The values and
usage of the variables $\sigma^{a},\lambda^{a},\zeta^{a}$ and $\tau^{a}$.

In Fig. 21(b), the measurement results $z_{1}^{\prime}$ and
$z_{1}^{\prime\prime}$ on $A_{1}^{\prime}$ and $A_{1}^{\prime\prime}$ reveal
the encoded intensity and phase on $A_{1}$, respectively. Alice further moves
the measurements on the ancillary qubits to the beginning. It is then
equivalent to preparing the coherent states
$\ket{\sqrt{z_{1}^{\prime}\mu}e^{i\pi
z_{1}^{\prime\prime}}},\ket{\sqrt{z_{2}^{\prime}\mu}e^{i\pi
z_{2}^{\prime\prime}}}$ on $A_{1}$ and $A_{2}$ with modulated intensities and
phases. Thus, we reduce the entanglement-based scheme to a prepare-and-measure
version.

Prepare-and-measure MP schemePrepMeaMP

  1. 1.

State preparation: In the $i$-th round, Alice generates two random bits
$z_{i}^{\prime}$ and $z_{i}^{\prime\prime}$ and a random phase $\phi^{a}_{i}$
uniformly and discretely chosen from $\\{\frac{2\pi}{D}j\\}_{j\in[D]}$. She
generates a coherent state $\ket{\sqrt{z_{i}^{\prime}\mu}e^{i(\pi
z_{i}^{\prime\prime}+\phi^{a}_{i})}}$. Similarly, Bob generates two random
bits $y_{i}^{\prime}$ and $y_{i}^{\prime\prime}$, $\phi^{b}_{i}$, and a
coherent state $\ket{\sqrt{y_{i}^{\prime}\mu}e^{i(\pi
y_{i}^{\prime\prime}+\phi^{b}_{i})}}$.

  2. 2.

Measurement: Alice and Bob send the coherent states to Charlie, who is
supposed to perform a single-photon interference measurement. Charlie
announces the clicks of the $L$ and/or $R$ detectors.

Alice and Bob perform the above steps over many rounds. Afterwards, they
perform the following data post-processing steps.

  3. 3.

Mode pairing: Alice and Bob set a strategy to pair the clicked locations,
i.e., to group each two detected rounds together based on Charlie’s
announcement.

  4. 4.

Basis sifting: For each pair on locations $i$ and $j$, Alice sets
$\tau^{a}:=z_{i}^{\prime}\oplus z_{j}^{\prime}$,
$\lambda^{a}:=z_{i}^{\prime}$. Alice sets the basis of the pair to $Z$ if
$\tau^{a}=1$, $X$ if $\tau^{a}=0$ and $\lambda^{a}=1$, and ‘0’ if
$\tau^{a}=\lambda^{a}=0$. Bob assigns the basis in the same way. Alice and Bob
announce the bases. If the announced bases are $X,X$ or $Z,Z$, they maintain
the signals.

  5. 5.

Key mapping: For each $Z$-pair on locations $i$ and $j$, Alice records
$\lambda^{a}$ as the key bit. For each $X$-pair, Alice sets
$\sigma^{a}:=z_{i}^{\prime\prime}\oplus z_{j}^{\prime\prime}$ as the key bit
and records $\theta^{a}_{i,j}:=\phi^{a}_{i}-\phi^{a}_{j}$ for later usage. For
all $X$-pairs, Alice and Bob further announce $\theta^{a}$ and $\theta^{b}$.
If $\theta^{a}=\theta^{b}$, they keep the $X$-pair data; if
$\theta^{a}-\theta^{b}=\pi$, they keep the $X$-pair data with Bob flipping the
value of $\sigma^{b}$; otherwise, they discard the $X$-pair data. Moreover, if
Charlie’s announcement at locations $i$ and $j$ is $(L,R)$ or $(R,L)$, Bob
flips the value of $\sigma^{b}$.

  6. 6.

Parameter estimation: Alice and Bob estimate the fraction of clicked signals
$q_{(1,1)}$ and the corresponding phase-error rate $e^{X}_{(1,1)}$ in the
$Z$-pairs, where Alice and Bob both emit a single photon at locations $i$ and
$j$. They also estimate the quantum bit-error rate $E^{Z}_{(\mu,\mu)}$ of the
$Z$-pairs.

  7. 7.

Key distillation: Alice and Bob reconcile the key string to $\kappa^{a}$ and
perform privacy amplification using universal-2 hashing matrices. The sizes of
hashing matrices are determined by the estimated single-photon yield
$q_{(1,1)}$ and the $X(\theta)$-basis error rate $e^{X(\theta)}_{(1,1)}$
according to Eq. (57).

To reduce the scheme to the MP scheme in the main text, we further simplify
the announcement of the random phase in the $X$ basis. Note that the encoding
phase in the $i$-th round is $\phi^{a}_{i}+\pi z_{i}^{\prime\prime}$, with
$\phi^{a}_{i}\in[0,2\pi)$. The phase modulation of $z_{i}^{\prime\prime}$ is
redundant in the experiment. We now try to absorb it into $\phi^{a}_{i}$.

In the following discussion, without loss of generality, we first assume that
$\theta^{a}$ and $\theta^{b}$ are equal to $0$ or $\pi$. In this case, Alice
and Bob’s random phases on locations $i$ and $j$ are either $0$ or $\pi$. We
denote them as

$\displaystyle\phi^{a}_{i}=\pi\hat{\phi}^{a}_{i},\quad\phi^{a}_{j}=\pi\hat{\phi}^{a}_{j},$
(65)
$\displaystyle\phi^{b}_{i}=\pi\hat{\phi}^{b}_{i},\quad\phi^{b}_{j}=\pi\hat{\phi}^{b}_{j},$

where $\hat{\phi}^{a}_{i},\hat{\phi}^{a}_{j},\hat{\phi}^{b}_{i}$ and
$\hat{\phi}^{b}_{j}$ are four binary variables.

During the $X$-basis key mapping, Alice and Bob’s raw key and random phase at
locations $i$ and $j$ are

$\displaystyle\sigma^{a}:=z_{i}^{\prime\prime}\oplus
z_{j}^{\prime\prime},\quad\theta^{a}:=\pi(\hat{\phi}^{a}_{i}\oplus\hat{\phi}^{a}_{j}),$
(66) $\displaystyle\sigma^{b}:=y_{i}^{\prime\prime}\oplus
y_{j}^{\prime\prime}\oplus\delta_{\theta}\oplus\delta_{d},\quad\theta^{b}:=\pi(\hat{\phi}^{b}_{i}\oplus\hat{\phi}^{b}_{j}).$

Here, the binary variable
$\delta_{\theta}:=(\hat{\phi}^{a}_{i}\oplus\hat{\phi}^{a}_{j}\oplus\hat{\phi}^{b}_{i}\oplus\hat{\phi}^{b}_{j})$
indicates whether the announcements of $\theta^{a}$ and $\theta^{b}$ are the
same or different. $\delta_{\theta}$ describes the detection announcement in
$i$ and $j$: if the announcements are $(L,L)$ and $(R,R)$, then
$\delta_{d}=0$; if the announcements are $(L,R)$ and $(R,L)$, $\delta_{d}=1$.

To simplify the key-mapping strategy, Alice and Bob absorb the random phase
$z_{i}^{\prime\prime},z_{j}^{\prime\prime};y_{i}^{\prime\prime},y_{j}^{\prime\prime}$
into $\phi_{i}^{a},\phi_{j}^{a};\phi_{i}^{a},\phi_{j}^{b}$. They revise the
raw key announcement as follows:

$\displaystyle\bar{\sigma}^{a}:=(\hat{\phi}^{a}_{i}\oplus
z_{i}^{\prime\prime})\oplus(\hat{\phi}^{a}_{j}\oplus z_{j}^{\prime\prime}),$
(67) $\displaystyle\bar{\sigma}^{b}:=(\hat{\phi}^{b}_{i}\oplus
y_{i}^{\prime\prime})\oplus(\hat{\phi}^{b}_{j}\oplus y_{j}^{\prime\prime}).$

Meanwhile, they set the announced basis angle to be
$\bar{\theta}^{a}=\bar{\theta}^{b}=0$. In this case, the announced information
is less than the original scheme. Hence, the privacy of Alice’s raw key
$\bar{\sigma}^{a}$ will not worsen. The new raw key bit is related to the
original raw key bit as

$\displaystyle\bar{\sigma}^{a}=\sigma^{a}\oplus(\hat{\phi}^{a}_{i}\oplus\hat{\phi}^{a}_{j}),$
(68)
$\displaystyle\bar{\sigma}^{b}=\sigma^{b}\oplus(\hat{\phi}^{b}_{i}\oplus\hat{\phi}^{b}_{j}).$

Therefore, $\bar{\sigma}^{a}=\bar{\sigma}^{b}$ iff $\sigma^{a}=\sigma^{b}$. Up
to a random phase difference, the new raw key bits are equivalent to the
original ones.

In general, $\theta^{a}$ and $\theta^{b}$ may not be $0$ or $\pi$. In this
case, we revise the random phase announcement. Let

$\theta^{a}_{r}:=(\phi^{a}_{i}+\pi z_{i}^{\prime\prime})-(\phi^{a}_{j}+\pi
z_{j}^{\prime\prime})=(\phi^{a}_{i}-\phi^{a}_{j})+\pi(z_{i}^{\prime\prime}-z_{j}^{\prime\prime})=\theta^{a}+\pi(z_{i}^{\prime\prime}\oplus
z_{j}^{\prime\prime}).$ (69)

Now, we further split $\theta^{a}_{r}$ into two parts,

$\theta^{a}_{r}=\theta^{a}_{0}+\pi\kappa^{a},$ (70)

where $\theta^{a}_{0}:=\theta^{a}_{r}\text{ mod }\pi\in[0,\pi)$ denotes half
of $\theta^{a}_{r}$ while $\kappa^{a}:=(\theta^{a}_{r}/\pi)\text{ mod }2$.
Using a similar method, one can show that $\kappa^{a}=\kappa^{b}$ iff
$\sigma^{a}=\sigma^{b}$.

Therefore, in an equivalent but simplified $X(\theta)$-basis key mapping
procedure, Alice (Bob) regards the phase
$(\phi^{a}_{i}+z_{i}^{\prime\prime})$($(\phi^{b}_{i}+y_{i}^{\prime\prime})$)
as a whole. They calculate the basis angle as Eq. (69) and (70). The
corresponding revised scheme can now be reduced to the MP scheme in the main
text.

##  Appendix C Decoy-state estimation

Here, we apply decoy-state analysis [56] to the mode-pairing scheme, with the
typical three-intensity settings — vacuum (zero intensity), weak (intensity
$\nu$) and signal (intensity $\mu$) states. The discussion below can naturally
be extended to the decoy-state method with an arbitrary number of intensities.
In the mode-pairing scheme, Alice and Bob each independently generate coherent
states with intensities $\mu_{i}^{a}$ and $\mu_{i}^{b}$, respectively, for the
$i$-th round. Suppose the state intensities are randomly chosen from the set
$\\{0,\nu,\mu\\}$ with probabilities $s_{0},s_{\nu}$ and $s_{\mu}$,
respectively, where, $s_{0}+s_{\nu}+s_{\mu}=1$.

We consider the pairing setting $\vec{\chi}$ in Definition 1, which defined on
all the locations, including the locations with unsuccessful clicks. In the
practical mode-pairing scheme, Alice and Bob decide the pairing setting based
on Charlie’s announcement $\vec{C}$, which is a $2N$-bit string. On each
location, Charlie announces two-bit information $(L_{i},R_{i})$, indicating
the detection results of the two detectors $L$ and $R$. The pairing strategy
we mentioned in the main text is an algorithm to choose a specific pairing
setting $\vec{\chi}$ based on Charlie’s announcement $\vec{C}$. We simply pair
all the unpaired locations (including the locations with unsuccessful
detections and the ones discarded during the pairing process) in Algorithm 1
to construct a complete pairing setting $\vec{\chi}$.

In the following discussion, we consider the case that Alice and Bob choose a
specific fixed pairing setting $\vec{\chi}$. Since the following decoy-state
estimation methods holds for all pairing settings $\vec{\chi}$ from
$\mathbf{X}$, it can also be applied to the pairing setting $\vec{\chi}$
chosen by the pairing strategy based on $\vec{C}$. A detailed discussion on
the security of mode-pairing scheme with a pairing setting $\vec{\chi}$ chosen
based on Charlie’s announcement $\vec{C}$ can be found in Sec. B.4.

Let us first study the source property under a pairing setting $\vec{\chi}$.
Alice and Bob pair two locations, $i$ and $j$, based on $\vec{\chi}$ as one
round of QKD. The intensity vector of the $(i,j)$ pair is denoted as

$\vec{\mu}=(\mu^{a}_{i}+\mu^{a}_{j},\mu^{b}_{i}+\mu^{b}_{j}),$ (71)

where $\mu^{a}_{i},\mu^{a}_{j},\mu^{b}_{i},\mu^{b}_{j}\in\\{0,\nu,\mu\\}$ and
hence
$\mu^{a}_{i}+\mu^{a}_{j},\mu^{b}_{i}+\mu^{b}_{j}\in\\{0,\nu,\mu,2\nu,\mu+\nu,2\mu\\}$.
The probability of Alice and Bob sending out intensities $\vec{\mu}$ for the
$(i,j)$ pair can be derived from the single-round probabilities as

$q^{\vec{\mu}}=\sum_{(\mu^{a}_{i}+\mu^{a}_{j},\mu^{b}_{i}+\mu^{b}_{j})=\vec{\mu}}s_{\mu^{a}_{i}}\,s_{\mu^{a}_{j}}\,s_{\mu^{b}_{i}}\,s_{\mu^{b}_{j}},$
(72)

which is independent of the pairing strategy.

In the entanglement-based mode-pairing scheme presented in Sec. B, for each
pair of locations $(i,j)$, Alice is able to perform the overall-photon-number
measurement on the systems $\tilde{A}_{i}$ and $\tilde{A}_{j}$, respectively.
We denote the photon-number measurement result to be $k^{a}$. Likewise, Bob
can also perform the photon-number measurement on $\tilde{B}_{i}$ and
$\tilde{B}_{j}$ and obtain $k^{b}$. Let $\vec{k}$ denote the photon numbers
$(k^{a},k^{b})$ on the $(i,j)$ pair. Given the intensity setting $\vec{\mu}$
on the $(i,j)$ pair, the probability for Alice and Bob’s photon-number
measurement result to be $\vec{k}=(k^{a},k^{b})$ is given by

$\Pr(\vec{k}|\vec{\mu})=e^{-(\mu^{a}_{i}+\mu^{a}_{j})-(\mu^{b}_{i}+\mu^{b}_{j})}\frac{(\mu^{a}_{i}+\mu^{a}_{j})^{k^{a}}(\mu^{b}_{i}+\mu^{b}_{j})^{k^{b}}}{k^{a}!k^{b}!},$
(73)

which is a product of two Poisson distributions, since the intensity settings
of Alice and Bob are independent.

In the above description, Alice and Bob first choose the intensity setting
$\vec{\mu}$ with probability $q^{\vec{\mu}}$ and then measure the ancillary
systems to obtain the photon number $\vec{k}$ with probability
$\Pr(\vec{k}|\vec{\mu})$. From another viewpoint, the _conditional
probability_ of the intensity setting being $\vec{\mu}$ if Alice and Bob
measure the photon number on $(i,j)$-pair and obtain the result $\vec{k}$ is
given by

$\displaystyle\Pr(\vec{\mu}|\vec{k})$
$\displaystyle=\frac{q^{\vec{\mu}}\Pr(\vec{k}|\vec{\mu})}{\sum_{\vec{\mu}^{\prime}}q^{\vec{\mu}^{\prime}}\Pr(\vec{k}|\vec{\mu}^{\prime})},$
(74)

where the summation of $\vec{\mu}^{\prime}=(\mu^{a},\mu^{b})$ takes over all
possible source-intensity settings. The conditional probability
$\Pr(\vec{\mu}|\vec{k})$ reflects an intrinsic property of the source, which
is independent of the specific pairing setting $\vec{\chi}$. We remark that,
the probabilities $\Pr(\vec{k}|\vec{\mu}),q^{\vec{\mu}}$ and
$\Pr(\vec{\mu}|\vec{k})$ in Eq. (73) and (74) are _a prior_ probability
distributions without the post-selection of the emitted pulses based on
Charlie’s announcement $\vec{C}$.

Now, let us investigate the detection side. For an $(i,j)$ pair, Alice and Bob
determine the bases and raw key bits based on the encoded intensities and
phases. If the intensity vector $\vec{\mu}$ satisfies

$\mu^{a}_{i}\mu^{a}_{j}=\mu^{b}_{i}\mu^{b}_{j}=0,\mu^{a}_{i}+\mu^{a}_{j}+\mu^{b}_{i}+\mu^{b}_{j}\neq
0,$ (75)

then it is a $Z$-pair. Below, we mainly consider decoy-state estimation in the
$Z$ basis, but the analysis for $X$-basis estimation is similar.

After mode pairing and sifting, Alice and Bob obtain $M$ rounds of $Z$-pairs
with successful detections; of these, $E$ rounds are erroneous. Let
$M^{\vec{\mu}}$ denote the number of rounds detected with intensity setting
$\vec{\mu}$, among which $E^{\vec{\mu}}$ rounds are wrongly detected. Let the
total and erroneous numbers of rounds with photon numbers $\vec{k}$ be denoted
by $M_{\vec{k}}$ and $E_{\vec{k}}$, respectively, among which
$M^{\vec{\mu}}_{\vec{k}}$ and $E^{\vec{\mu}}_{\vec{k}}$ are the rounds with
intensity setting $\vec{\mu}$. We have the following relations,

$\displaystyle M$
$\displaystyle=\sum_{\vec{\mu}}M^{\vec{\mu}}=\sum_{\vec{k}}M_{\vec{k}}=\sum_{\vec{\mu}}\sum_{\vec{k}}M^{\vec{\mu}}_{\vec{k}}$
(76) $\displaystyle E$
$\displaystyle=\sum_{\vec{\mu}}E^{\vec{\mu}}=\sum_{\vec{k}}E_{\vec{k}}=\sum_{\vec{\mu}}\sum_{\vec{k}}E^{\vec{\mu}}_{\vec{k}}.$

In the entire QKD process, the values
$\\{M^{\vec{\mu}},E^{\vec{\mu}}\\}_{\vec{\mu}}$ are known to Alice and Bob.
The values $\\{M_{\vec{k}}$ and $E_{\vec{k}}\\}_{\vec{k}}$, however, are
unknown to them but are fixed after Charlie’s announcement.

We remark that, no matter what the intensity setting $\vec{\mu}$ is, if Alice
and Bob measures the photon number on the ancillary systems and obtain the
result $\vec{k}$, the post-selected state is independent of the intensity
setting. As a result, _conditional on Alice and Bob’s specific photon-number
measurement result $\vec{k}$, Charlie’s announcement strategy is independent
of the intensity setting $\vec{\mu}$_. This is an alternative description of
the basic assumption that the original decoy-state method makes in its
security proof [39].

Based on this property, in all the generated $Z$-pairs with the photon-number
measurement result to be $\vec{k}$, the expected ratio of different intensity
settings should be the same as the ratio of the emitted states,

$\frac{M^{\vec{\mu}}_{\vec{k}}}{M^{\vec{\mu}^{\prime}}_{\vec{k}}}\approx\frac{\Pr(\vec{\mu},\vec{k})}{\Pr(\vec{\mu}^{\prime},\vec{k})}=\frac{q^{\vec{\mu}}\Pr(\vec{k}|\vec{\mu})}{q^{\vec{\mu}^{\prime}}\Pr(\vec{k}|\vec{\mu}^{\prime})},$
(77)

where the approximation is due to statistical fluctuation. In the limit of
infinite data size, the approximation becomes an equality.

In our experiment, we assume that Alice and Bob randomly determine the
intensity $\vec{\mu}$ at each location by measuring an ancillary system.
Measurement results are used to classically control the intensity of the
signals to Charlie. In practice, Alice and Bob first measure the overall
photon number and obtain $\vec{k}$. In this case, the intensity choice is
determined only by $\vec{k}$, independent of Charlie’s announcement. Among the
$M_{\vec{k}}$ pairs with photon number $\vec{k}$, the number of pairs with an
intensity setting $\vec{\mu}$ is a variable
$\mathcal{M}_{\vec{k}}^{\vec{\mu}}$ that is determined by Alice and Bob’s
ancillary systems. The expected ratio of the intensity setting $\vec{\mu}$ is
given by

$\mathbb{E}\left(\frac{\mathcal{M}^{\vec{\mu}}_{\vec{k}}}{M_{\vec{k}}}\right)=\Pr(\vec{\mu}|\vec{k})=\frac{q^{\vec{\mu}}\Pr(\vec{k}|\vec{\mu})}{\sum_{\vec{\mu}^{\prime}}q^{\vec{\mu}^{\prime}}\Pr(\vec{k}|\vec{\mu}^{\prime})},$
(78)

where the expectation value is taken for the random variable
$\mathcal{M}_{\vec{k}}^{\vec{\mu}}$ characterising Alice and Bob’s intensity
settings. Similarly, for erroneous detection among the $E_{\vec{k}}$ pairs
with $\vec{k}$ photon numbers, $\mathcal{E}_{\vec{k}}^{\vec{\mu}}$ is the
variable for describing the number of pairs with intensity setting
$\vec{\mu}$,

$\mathbb{E}\left(\frac{\mathcal{E}^{\vec{\mu}}_{\vec{k}}}{E_{\vec{k}}}\right)=\Pr(\vec{\mu}|\vec{k})=\frac{q^{\vec{\mu}}\Pr(\vec{k}|\vec{\mu})}{\sum_{\vec{\mu}^{\prime}}q^{\vec{\mu}^{\prime}}\Pr(\vec{k}|\vec{\mu}^{\prime})}.$
(79)

From Eqs. (78) and (79), we have,

$\displaystyle\mathbb{E}[\mathcal{M}^{\vec{\mu}}_{\vec{k}}]$
$\displaystyle=\Pr(\vec{\mu}|\vec{k})M_{\vec{k}},$ (80)
$\displaystyle\mathbb{E}[\mathcal{E}^{\vec{\mu}}_{\vec{k}}]$
$\displaystyle=\Pr(\vec{\mu}|\vec{k})E_{\vec{k}}.$

Let the composite variables $\mathcal{M}^{\vec{\mu}}$ and
$\mathcal{E}^{\vec{\mu}}$ denote the overall numbers of pairs with intensity
settings $\vec{\mu}$,

$\displaystyle\mathcal{M}^{\vec{\mu}}$
$\displaystyle=\sum_{k}\mathcal{M}^{\vec{\mu}}_{\vec{k}},$ (81)
$\displaystyle\mathcal{E}^{\vec{\mu}}$
$\displaystyle=\sum_{k}\mathcal{E}^{\vec{\mu}}_{\vec{k}}.$

From Eqs. (80) and (81), we have

$\displaystyle\mathbb{E}[\mathcal{M}^{\vec{\mu}}]$
$\displaystyle=\sum_{\vec{k}}\Pr(\vec{\mu}|\vec{k})M_{\vec{k}}$ (82)
$\displaystyle\mathbb{E}[\mathcal{E}^{\vec{\mu}}]$
$\displaystyle=\sum_{\vec{k}}\Pr(\vec{\mu}|\vec{k})E_{\vec{k}}.$

To summarise, decoy-state analysis can be formulated as follows. _For unknown
$\\{M_{k},E_{k}\\}_{k}$ and known
$\\{\Pr(\vec{\mu}|\vec{k})\\}_{\vec{\mu},\vec{k}}$, the lower bound of
$\mathcal{M}^{(\mu,\mu)}_{(1,1)}$ and the upper bound of
$\mathcal{E}^{(\mu,\mu)}_{(1,1)}$ are evaluated given the observed constraints
of the detected pair numbers $\\{M^{\vec{\mu}},E^{\vec{\mu}}\\}_{\vec{\mu}}$_.
This problem can be solved through the following steps.

  1. 1.

Record the number of clicked rounds
$\\{M^{\vec{\mu}},E^{\vec{\mu}}\\}_{\vec{\mu}}$.

  2. 2.

Evaluate the upper and lower bounds of the expectation values
$\left\\{\mathbb{E}\left[\mathcal{M}^{\vec{\mu}}\right],\mathbb{E}\left[\mathcal{E}^{\vec{\mu}}\right]\right\\}_{\vec{\mu}}$
using the (inverse) Chernoff bound for independent variables.

  3. 3.

Solve the following linear-programming problems:

$\displaystyle\min$ $\displaystyle M_{(1,1)}$ (83) s.t.
$\displaystyle\mathbb{E}^{L}\left[\mathcal{M}^{\vec{\mu}}\right]\leq\sum_{\vec{k}}\Pr(\vec{\mu}|\vec{k})M_{\vec{k}}\leq\mathbb{E}^{U}\left[\mathcal{M}^{\vec{\mu}}\right],\quad\forall\vec{\mu},$
$\displaystyle 0\leq M_{\vec{k}}\leq M,$ $\displaystyle\max$ $\displaystyle
E_{(1,1)}$ (84) s.t.
$\displaystyle\mathbb{E}^{L}\left[\mathcal{E}^{\vec{\mu}}\right]\leq\sum_{\vec{k}}\Pr(\vec{\mu}|\vec{k})E_{\vec{k}}\leq\mathbb{E}^{U}\left[\mathcal{E}^{\vec{\mu}}\right],\quad\forall\vec{\mu},$
$\displaystyle 0\leq E_{\vec{k}}\leq E,$

where $\vec{\mu}\in\\{0,\nu,\mu\\}^{\otimes 2}$,
$\vec{k}\in\mathbb{Z}_{+}^{\otimes 2}$ and $\mathbb{Z}_{+}=\\{0,1,2,...\\}$ is
the set of natural numbers. Denote the results for these two programmes as
$M^{L}_{(1,1)}$ and $E^{U}_{(1,1)}$, respectively.

  4. 4.

To evaluate the upper bound of $M^{(\mu,\mu)}_{(1,1)}$ and the lower bound of
$E^{(\mu,\mu)}_{(1,1)}$ using the values of $M^{L}_{(1,1)}$ and
$E^{U}_{(1,1)}$ with Eq. (80), one can apply the Chernoff bound again for
independent variables.

Here, we explain why Alice and Bob can use the Chernoff bound for independent
variables in Step 2 and 4. As we mentioned before Eq. (77), when the photon
number $\vec{k}$ on the pair of location is given, the intensity $\vec{\mu}$
for each pair of locations is determined merely by the conditional probability
$\Pr(\vec{\mu}|\vec{k})$ in Eq. (80). As a result, the intensity choices in
different pair of locations are independent when the photon number $\vec{k}$
of the pairs are given. Moreover, when the emitted state in each round is
identical, the intensity choices in different pairs of locations are also
identical. To be more clear, we consider all the $M_{\vec{k}}$ clicked pairs
for the pairs with specific measured photon number $\vec{k}$. If Alice and Bob
check the intensity label $\vec{\mu}$ on these pairs, and treat these
intensity labels as random variables, then these varibles are i.i.d.,

$\hat{\vec{\mu}}_{i}=\vec{\mu},\text{ with probability
}\Pr(\vec{\mu}|\vec{k}).\quad(i=1,2,...,M_{\vec{k}})$ (85)

Here, the value of the conditional probability $\Pr(\vec{\mu}|\vec{k})$ only
depends on the property of the source. In this case, Alice and Bob can
evaluate the real number of pairs $M_{\vec{k}}^{\vec{\mu}}$ from its
expectation value $M_{\vec{k}}\Pr(\vec{\mu}|\vec{k})$ using Chernoff bound of
independent variables (Step 4 in the decoy estimation procedure above, cf. Eq.
(33) in Ref. [56]); on the other hand, if Alice and Bob were awared of the
photon number measurement results on the pairs, they can infer the expectation
value from the real number of pairs $M_{\vec{k}}^{\vec{\mu}}$ by the inverse
Chernoff bound (Step 2 in the decoy estimation procedure above, cf. Eq. (30)
in Ref. [56]).

In the practical Step 2, however, Alice and Bob do not have the photon numer
measurement results on the pairs. As an alternative way, instead of solving
the inverse Chernoff problem for each photon number setting $\vec{k}$, they
can combine the estimation problems together: to infer the expectation value
of $\mathcal{M}^{\vec{\mu}}:=\sum_{\vec{k}}\mathcal{M}^{\vec{\mu}}_{\vec{k}}$
based on the observed value of $M^{\vec{\mu}}$. When the underlying values the
photon numbers $\vec{k}$ for each pair of locations are determined, the
intensity variables $\hat{\vec{\mu}}_{i}$ are independent, following Eq. (85),
regardless of the photon number $\vec{k}$. For different $\vec{k}$, however,
the variables $\hat{\vec{\mu}}_{i}$ are not identical anymore, as the
conditional probabilities $\Pr(\vec{\mu}|\vec{k})$ differ. In this case, we
can still apply the inverse Chernoff bound for the independent variables.

We have introduced the decoy-state procedure for the $Z$-basis. Likewise,
Alice and Bob can perform decoy-state analysis for the sifted $X$-basis obtain
the single-photon-pair numbers $M_{(1,1)}^{X,L}$ and $E_{(1,1)}^{X,U}$ for
successful and erroneous detection, respectively. Let
$M^{(\mu,\mu),Z,L}_{(1,1)}$ denote the estimated lower bound on the single-
photon-pair number with intensity $(\mu^{a},\mu^{b})=(\mu,\mu)$ in the case
where Alice and Bob emit $Z$-basis data. The finite key-length formula of the
mode-pairing scheme is given by

$\displaystyle M_{R}$
$\displaystyle=M^{(\mu,\mu),Z}\left\\{q^{(\mu,\mu),Z,L}_{(1,1)}\left[1-H\left(e^{(\mu,\mu),Z,U}_{(1,1),ph}\right)\right]-fH(E^{Z}_{\mu\mu})\right\\},$
(86)
$\displaystyle=M^{(\mu,\mu),Z,L}_{(1,1)}\left[1-H\left(\frac{E^{(\mu,\mu),Z,U}_{(1,1),ph}}{M^{(\mu,\mu),Z,L}_{(1,1)}}\right)\right]-fM^{(\mu,\mu),Z}H(E^{Z}_{\mu\mu}),$

where $E^{(\mu,\mu),Z,U}_{(1,1),ph}$ is the upper bound of the phase-error
number of the single-photon pair with the intensity
$(\mu^{a},\mu^{b})=(\mu,\mu)$ when Alice and Bob emit $Z$-basis data.
$E^{(\mu,\mu),Z,U}_{(1,1),ph}$ can be directly estimated from
$M^{(\mu,\mu),Z,L}_{(1,1)}$, $M_{(1,1)}^{X,L}$ and $E_{(1,1)}^{X,U}$ based on
the statistics of random sampling without a replacement problem [57]. The
number of $(\mu,\mu)$-pairs in the $Z$-basis $M^{(\mu,\mu,Z)}$ and the quantum
bit-error number $E^{Z}_{\mu\mu}$ can be directly obtained from the
experimental results. The lower bound of the fraction
$q^{(\mu,\mu),Z,L}_{(1,1)}$ and upper bound of the phase-error rate
$e^{(\mu,\mu),Z,U}_{(1,1),ph}$ are defined as

$\displaystyle q^{(\mu,\mu),Z,L}_{(1,1)}$
$\displaystyle:=\frac{M^{(\mu,\mu),Z,L}_{(1,1)}}{M^{(\mu,\mu),Z}},$ (87)
$\displaystyle e^{(\mu,\mu),Z,U}_{(1,1),ph}$
$\displaystyle:=\frac{E^{(\mu,\mu),Z,U}_{(1,1),ph}}{M^{(\mu,\mu),Z,L}_{(1,1)}},$

In the asymptotic case, $q^{(\mu,\mu),Z,L}_{(1,1)}$ and
$e^{(\mu,\mu),Z,U}_{(1,1),ph}$ become $q_{11}$ and $e^{X}_{11}$, respectively,
defined in the main text.

In practice, the linear-programming problems in Eq. (83) and (84) can be
analytically solved by converting the detection number
$M^{\vec{\mu}},E^{\vec{\mu}},M_{\vec{k}}$ and $E_{\vec{k}}$ into traditional
ratio values (i.e. the gain and yield). To do this, we denote the expected
total pair number to be $N_{p}=\lfloor N/2\rfloor$. Furthermore, we define
$N^{\vec{\mu}}:=q^{\vec{\mu}}N_{p}$ to be the expected number of rounds with
intensity setting $\vec{\mu}$. We define
$N^{\infty}_{\vec{k}}:=\sum_{\vec{\mu}}\Pr(\vec{k}|\vec{\mu})N^{\vec{\mu}}$ to
be the expected number of rounds where the source sends out $\vec{k}$-photon
states. Then the ‘gain’ and ‘yield’ are defined as

$\displaystyle\mathcal{Q}^{\vec{\mu}}:=\frac{\mathcal{M}^{\vec{\mu}}}{N^{\vec{\mu}}},$
$\displaystyle\quad\mathcal{Q}_{E}^{\vec{\mu}}:=\frac{\mathcal{E}^{\vec{\mu}}}{N^{\vec{\mu}}},$
(88) $\displaystyle
Y_{\vec{k}}^{*}:=\frac{M_{\vec{k}}}{N^{\infty}_{\vec{k}}},$
$\displaystyle\quad(Y_{E})_{\vec{k}}^{*}:=\frac{E_{\vec{k}}}{N^{\infty}_{\vec{k}}}.$

The relationship between $\mathcal{Q}^{\vec{\mu}}$ and $Y_{\vec{k}}^{*}$ is,

$\displaystyle\mathbb{E}[\mathcal{Q}^{\vec{\mu}}]$
$\displaystyle=\mathbb{E}\left[\frac{\mathcal{M}^{\vec{\mu}}}{N^{\vec{\mu}}}\right]=\frac{\mathbb{E}[\mathcal{M}^{\vec{\mu}}]}{N^{\vec{\mu}}}$
(89)
$\displaystyle=\sum_{\vec{k}}\Pr(\vec{\mu}|\vec{k})\frac{M_{\vec{k}}}{q^{\vec{\mu}}N_{p}}$
$\displaystyle=\sum_{\vec{k}}\frac{q^{\vec{\mu}}\Pr(\vec{k}|\vec{\mu})}{\sum_{\vec{\mu}^{\prime}}q^{\vec{\mu}^{\prime}}\Pr(\vec{k}|\vec{\mu}^{\prime})}\frac{M_{\vec{k}}}{q^{\vec{\mu}}N_{p}}$
$\displaystyle=\sum_{\vec{k}}\Pr(\vec{k}|\vec{\mu})\frac{M_{\vec{k}}}{\sum_{\vec{\mu}^{\prime}}\left(N_{p}q^{\vec{\mu}^{\prime}}\right)\Pr(\vec{k}|\vec{\mu}^{\prime})}$
$\displaystyle=\sum_{\vec{k}}\Pr(\vec{k}|\vec{\mu})Y_{\vec{k}}^{*},$
$\displaystyle\mathbb{E}[\mathcal{Q}_{E}^{\vec{\mu}}]$
$\displaystyle=\sum_{\vec{k}}\Pr(\vec{k}|\vec{\mu})(Y_{E})_{\vec{k}}^{*},$

where $\Pr(\vec{k}|\vec{\mu})$ is the product of two Poisson distributions,
given by Eq. (73). In this way, one can directly apply the traditional decoy-
state formulas for MDI-QKD as a solution to the linear-programming problems
[47, 48]. Note that the value of $N_{p}$ will not affect the correctness of
Eq. (89). If we redefine $N_{p}$ as $N_{p}^{\prime}=cN_{p}$, then the defined
gain and yield will become $\frac{1}{c}\mathcal{Q}^{\vec{\mu}}$ and
$\frac{1}{c}Y_{\vec{k}}^{*}$, respectively. From Eq. (88), we can see that the
final estimated value $M_{\vec{k}}$ is invariant only if the experimental data
$\\{M^{\vec{\mu}}\\}$ are unchanged.

##  Appendix D Simulation formulas

Here, we list the formulas used for key-rate simulation of different QKD
schemes. In Sec. D.1, we derive the simulation formula for the free-round MP
scheme with maximal pairing length $l$. In a similar fashion, we derive the
simulation formula for the time-bin MDI-QKD scheme in Sec. D.2. Finally, in
Sec. D.3, we list the simulation formulas used in the main text for the decoy-
BB84 and PM-QKD schemes.

###  D.1 Mode-pairing scheme

The key rate of the MP scheme can be calculated using Eqs. (90), (91), (93),
(98), (102), (103) and (104) below.

In the MP scheme, Alice and Bob use the $Z$-basis to generate keys. In the
asymptotic case, we assume that Alice and Bob choose to randomly emit signals
with intensity $\\{0,\mu\\}$ with a probability of nearly $1/2$ and a decoy
intensity $\nu$ with negligible probability. Let us express the coherent pulse
emitted by Alice in the $i$-th round as
$\ket{\sqrt{z_{i}^{a}\mu}\exp(i\phi_{i}^{a})}$, with $z_{i}^{a}\in\\{0,1\\}$
being a random variable indicating the intensity and $\phi_{i}^{a}$ being a
random phase. Similarly, Bob emits
$\ket{\sqrt{z_{i}^{b}\mu}\exp(i\phi_{i}^{b})}$ in the $i$-th round. The $i$-th
round intensity setting is then denoted by a $2$-bit vector
$z_{i}:=[z_{i}^{a},z_{i}^{b}]$.

In the simulation, Alice and Bob are assumed to emit pulses to Charlie through
a typical symmetric-loss channel. The single-side transmittance of the channel
(with included detection efficiency $\eta_{d}$ included) is $\eta_{s}$, and
the dark count of each detector is $p_{d}$. The simulation data is provided in
Fig. 4 in the main text. In this case, the channel is i.i.d. for each round.
Alice and Bob then pair the clicked pulses and set their bases. For the
$(i,j)$-th pulses to be paired, let
$\tau_{i,j}=[\tau^{a}_{i,j},\tau^{b}_{i,j}]:=[z_{i}^{a}\oplus
z_{j}^{a},z_{i}^{a}\oplus z_{j}^{a}]$, where $\oplus$ is the bit-wise addition
modulo 2. When $\tau_{i,j}=[1,1]$, the $(i,j)$-pair is then set to be a signal
pair.

The key rate of the MP scheme is expressed as

$R=r_{p}(p,l)\,r_{s}\left\\{\bar{q}_{11}[1-H(e^{X}_{(1,1)})]-fH(E^{Z}_{(\mu,\mu)})\right\\},$
(90)

where $l$ is the maximal pairing gap, $r_{p}(p,l)$ is the expected pair number
generated during each round, and $r_{s}$ is the probability that a clicked
pulse pair is a signal pair, $\bar{q}_{11}$ and $e^{X}_{(1,1)}$ are,
respectively, the expected single-photon pair ratio in all signal pairs and
the phase error of the single-photon pairs, which are estimated via decoy-
state methods. $f$ is the error-correction efficiency, $E^{Z}_{(\mu,\mu)}$ is
the bit-error rate of the signal pairs and $p$ is the probability of the
$i$-th signal to be successfully clicked (as defined in Eq. (93)). The value
of $r_{p}(p,l)$ has already been given in the Methods as

$r_{p}(p,l)=\left[\frac{1}{p[1-(1-p)^{l}]}+\frac{1}{p}\right]^{-1}.$ (91)

Here, we first consider the calculation of $r_{s},\bar{q}_{11}$ and
$E^{Z}_{(\mu,\mu)}$. In the $i$-th round, we denote the click events of the
left and right detectors at the $i$-th turn by two variables $(L_{i},R_{i})$.
The successful click variable is $C_{i}=L_{i}\oplus R_{i}$. Only when
$C_{i}=1$ does an successful click occur. The detection probability
$\Pr(C_{i}=1|z_{i})$ is given by

$\Pr(C_{i}=1|z_{i})\approx
1-(1-2p_{d})\exp\left[-\eta_{s}\mu\left(z^{a}_{i}+z^{b}_{i}\right)\right].$
(92)

The expected click probability, i.e., the total transmittance of each round,
is

$p:=\Pr(C_{i}=1)=\sum_{z_{i}}\Pr(C_{i}=1|z_{i})\Pr(z_{i})=\frac{1}{4}\sum_{z_{i}}\Pr(C_{i}=1|z_{i}).$
(93)

The pairing rate $r_{p}(p,l)$ can then be calculated using Eq. (91).

The phase-randomised coherent states emitted in the $i$-th round can also be
regarded as the mixture of photon-number states. $\Pr(C_{i}=1|n_{i})$ denotes
the detection probability when Alice and Bob emit photon-number states
$\ket{n_{i}^{a}}$ and $\ket{n_{i}^{b}}$, respectively; it is given by

$\Pr(C_{i}=1|n_{i})\approx 1-(1-2p_{d})(1-\eta_{s})^{(n_{i}^{a}+n_{i}^{b})}.$
(94)

Now, let us calculate the signal-pair ratio $r_{s}$. Without loss of
generality, we consider the $i$-th and $j$-th turns as a paired group. For a
general turn, the probability of a click caused by the intensity setting $z$
is

$\Pr(z|C=1)=\frac{\Pr(z,C=1)}{\Pr(C=1)}=\frac{\Pr(C=1|z)}{\sum_{z^{\prime}}\Pr(C=1|z^{\prime})}.$
(95)

Note that the subscript is omitted, since the detections in all rounds are
identical and independently distributed in our simulation.

In the MP scheme, an successful click happens when $\tau_{i,j}=[1,1]$.
Therefore, four possible configurations of $z_{i}$ and $z_{j}$ (which generate
signal pairs) are

$[z_{i},z_{j}]\in\\{[00,11],[01,10],[10,01],[11,00]\\};$ (96)

of these, $Err:=\\{[00,11],[11,00]\\}$ are the two configurations that cause
bit errors. To simplify our notations, we introduce several events,

$\displaystyle\Pr(C)=\Pr(\textit{Pair Clicked}):=\Pr(C_{i}=C_{j}=1)=p^{2},$
(97) $\displaystyle\Pr(E)=\Pr(\textit{Pair Effective}):=\Pr(z_{i}\oplus
z_{j}=11),$ $\displaystyle\Pr(Err)=\Pr(\textit{Pair
Erroneous}):=\Pr([z_{i},z_{j}]\in Err),$
$\displaystyle\Pr(S)=\Pr(\textit{Single-photon Pair}):=\Pr(n_{i}\oplus
n_{j}=11).$

The signal-pair ratio $r_{s}$ is then

$\displaystyle r_{s}=$ $\displaystyle\Pr(E|C)=\Pr(z_{i}\oplus
z_{j}=11|C_{i}=1,C_{j}=1)$ (98) $\displaystyle=\sum_{z_{i}\oplus
z_{j}=11}\,\Pr(z_{i}|C_{i}=1)\Pr(z_{j}|C_{j}=1)$
$\displaystyle=\sum_{z_{i}\oplus
z_{j}=11}\frac{\Pr(C_{i}=1|z_{i})\Pr(z_{i})}{\Pr(C_{i}=1)}\frac{\Pr(C_{j}=1|z_{j})\Pr(z_{j})}{\Pr(C_{j}=1)}$
$\displaystyle=\frac{1}{16}\frac{1}{p^{2}}\sum_{z_{i}\oplus
z_{j}=11}\Pr(C_{i}=1|z_{i})\Pr(C_{j}=1|z_{j}),$

We remark that, when $\eta_{s}\mu\ll 1$, the signal-pair ratio $r_{s}$ is
approximately

$\displaystyle r_{s}$
$\displaystyle\approx\frac{1}{16}\frac{1}{p^{2}}[2(\eta_{s}\mu)^{2}]$ (99)
$\displaystyle=\frac{1}{16}\frac{1}{(\eta_{s}\mu)^{2}}[2(\eta_{s}\mu)^{2}]=\frac{1}{8},$

which is nearly a constant independent of $\eta_{s}$ and $\mu$.

The expected error rate $E^{Z}_{(\mu,\mu)}$ of the $(i,j)$-pair is

$\displaystyle E^{Z}_{(\mu,\mu)}$ $\displaystyle=\Pr\left(Err|E,C\right)$
(100)
$\displaystyle=\frac{\Pr\left(Err,E|C\right)}{\Pr\left(E|C\right)}=\frac{\Pr\left(Err|C\right)}{\Pr\left(E|C\right)}$
$\displaystyle=r_{s}^{-1}\Pr\left(Err|C\right).$

Note that the erroneous pair condition is contained in the effective pair
condition. The erroneous probability is given by

$\displaystyle\Pr\left(Err|C\right)=\Pr\left([z_{i},z_{j}]\in
Err|C_{i}=C_{j}=1\right)$ (101) $\displaystyle=\sum_{[z_{i},z_{j}]\in
Err}\,\Pr(z_{i}|C_{i}=1)\Pr(z_{j}|C_{j}=1)$
$\displaystyle=\sum_{[z_{i},z_{j}]\in
Err}\frac{\Pr(C_{i}=1|z_{i})\Pr(z_{i})}{\Pr(C_{i}=1)}\frac{\Pr(C_{j}=1|z_{j})\Pr(z_{j})}{\Pr(C_{j}=1)}$
$\displaystyle=\frac{1}{16}\frac{1}{p^{2}}\sum_{[z_{i},z_{j}]\in
Err}\Pr(C_{i}=1|z_{i})\Pr(C_{j}=1|z_{j}).$

Therefore,

$\displaystyle E^{Z}_{(\mu,\mu)}$
$\displaystyle=\frac{1}{16}\frac{1}{r_{s}p^{2}}\sum_{[z_{i},z_{j}]\in
Err}\Pr(C_{i}=1|z_{i})\Pr(C_{j}=1|z_{j}).$ (102)

Then, we calculate the expected single-photon pair ratio $\bar{q}_{11}$ in the
effective signal-pairs:

$\displaystyle\bar{q}_{11}$
$\displaystyle=\Pr(S|E,C)=\frac{\Pr(S,E,C)}{\Pr(E,C)}$ (103)
$\displaystyle=\frac{1}{r_{s}p^{2}}\Pr(S,E,C)$
$\displaystyle=\frac{1}{r_{s}p^{2}}\sum_{z_{i},z_{j}}\Pr(S,E,C|z_{i},z_{j})\Pr(z_{i},z_{j})$
$\displaystyle=\frac{1}{16}\frac{1}{r_{s}p^{2}}\sum_{z_{i}\oplus
z_{j}=11}\Pr(S,C|z_{i},z_{j})$
$\displaystyle=\frac{1}{16}\frac{1}{r_{s}p^{2}}\sum_{z_{i}\oplus
z_{j}=11}\Pr(C|S,z_{i},z_{j})\Pr(S|z_{i},z_{j})$
$\displaystyle=\frac{1}{16}\frac{P_{\mu}(1)^{2}}{r_{s}p^{2}}\sum_{z_{i}\oplus
z_{j}=11}\Pr(C_{i}=1|n_{i}=z_{i})\Pr(C_{j}=1|n_{j}=z_{j}),$

where $P_{\mu}(k)=\exp(-\mu)\frac{\mu^{k}}{k!}$ is the Poisson distribution
and $\Pr(C_{i}=1|n_{i})$ is defined in Eq. (94).

The phase-error rate formula of the MP scheme cannot be calculated for single-
pulse-based methods. In the MP scheme, if the decoy-state estimation is
perfect, then the phase-error rate should be the same as that of the original
two-mode MDI-QKD scheme. Here, we apply the formulas (A9) and (A11) in Ref.
[23]:

$\displaystyle Y_{11}$
$\displaystyle=(1-p_{d})^{2}\left[\dfrac{\eta_{a}\eta_{b}}{2}+(2\eta_{a}+2\eta_{b}-3\eta_{a}\eta_{b})p_{d}+4(1-\eta_{a})(1-\eta_{b})p_{d}^{2}\right],$
(104) $\displaystyle e_{11}^{X}Y_{11}$
$\displaystyle=e_{0}Y_{11}-(e_{0}-e_{d})(1-p_{d}^{2})\dfrac{\eta_{a}\eta_{b}}{2}.$

Here, $e_{0}=1/2$ is the error caused by vacuum signals, $e_{d}$ is the pre-
set misalignment error, and $\eta_{a}(\eta_{b})$ are the transmittances from
Alice (Bob) to Charlie. In our case, $\eta_{a}=\eta_{b}=\eta_{s}$.

###  D.2 Time-bin MDI-QKD

The key rate of time-bin MDI-QKD is calculated as Eqs. (105), (110), (111),
(112), and (113) below.

The time-bin MDI-QKD scheme can be regarded as a special case of the MP scheme
with fixed-pairing setting and a predetermined effective-intensity setting
$[z_{i},z_{j}]$ at locations $i$ and $j$. That is, if the pairs are clicked,
then the pair is effective with $z_{i}\oplus z_{j}=11$. The derivation of the
simulation formulas for time-bin MDI-QKD is similar to that of the MP scheme
in Sec. D.1.

In the time-bin MDI-QKD scheme, Alice and Bob use the $Z$-basis to generate
keys. In the asymptotic case, we assume that they choose to emit the $X$-basis
state with a negligible probability, such that the basis-sifting factor is
almost $1$. The key rate of the time-bin MDI-QKD scheme is

$R_{MDI}=\frac{1}{2}Q_{\mu\mu}\\{\bar{q}_{11}[1-H(e^{X}_{(1,1)})]-fH(E^{Z}_{(\mu,\mu)})\\},$
(105)

where the factor $\frac{1}{2}$ is for a comparison with the MP scheme, since
the key-rate formula of $R_{MDI}$ is defined on a pair of rounds while the
key-rate formula Eq. (90) for the MP scheme is defined on each round.
$Q_{\mu\mu}$ is the probability of the pair with successful detection. The
parameters $\bar{q}_{11},e^{X}_{(1,1)}$ and $E^{Z}_{(\mu,\mu)}$ are similar to
those in the MP scheme.

Similar to Sec. D.1, we also introduce $z_{i}=[\zeta^{a}_{i},z^{b}_{i}]$ and
$C_{i}$ to denote the intensity setting of the $i$-th location and detection
results, respectively. The single-location detection probability of a given
$z_{i}$ is the same as that in the MP scheme,

$\Pr(C_{i}=1|z_{i})\approx
1-(1-2p_{d})\exp\left[-\eta_{s}\mu\left(z^{a}_{i}+z^{b}_{i}\right)\right].$
(106)

Meanwhile, we introduce $n_{i}=[n^{a}_{i},n^{b}_{i}]$ to denote the emitted
photon number at the $i$-th location. The conditional detection probability
$\Pr(C_{i}=1|n_{i})$ is still given by

$\Pr(C_{i}=1|n_{i})\approx 1-(1-2p_{d})(1-\eta_{s})^{(n_{i}^{a}+n_{i}^{b})}.$
(107)

In time-bin MDI-QKD and for a fixed pair of locations $i$ and $j$, the
configurations of $z_{i}$ and $z_{j}$ are predetermined to be chosen in the
set

$[z_{i},z_{j}]\in\\{[00,11],[01,10],[10,01],[11,00]\\}.$ (108)

Among these $Err:=\\{[00,11],[11,00]\\}$ are the two configurations causing
bit errors. To simplify our notation, we also introduce several events,

$\displaystyle\Pr(C)=\Pr(\textit{Pair Clicked}):=Q_{\mu\mu},$ (109)
$\displaystyle\Pr(Err)=\Pr(\textit{Pair Erroneous}):=\Pr([z_{i},z_{j}]\in
Err),$ $\displaystyle\Pr(S)=\Pr(\textit{Single-photon Pair}):=\Pr(n_{i}\oplus
n_{j}=11).$

By definition we have

$\displaystyle Q_{\mu\mu}$ $\displaystyle=\Pr(C)=\sum_{z_{i}\oplus
z_{j}=11}\Pr(z_{i},z_{j})\Pr(C_{i}=1|z_{i})\Pr(C_{j}=1|z_{j})$ (110)
$\displaystyle=\frac{1}{4}\sum_{z_{i}\oplus
z_{j}=11}\Pr(C_{i}=1|z_{i})\Pr(C_{j}=1|z_{j}).$

The quantum bit-error rate $E^{Z}_{(\mu,\mu)}$, is

$\displaystyle E^{Z}_{(\mu,\mu)}$
$\displaystyle=\Pr(Err|C)=\frac{\Pr(Err,C)}{\Pr(C)}$ (111)
$\displaystyle=\frac{1}{Q_{\mu\mu}}\sum_{[z_{i},z_{j}]\in
Err}\Pr(z_{i},z_{j})\Pr(C_{i}=1|z_{i})\Pr(C_{j}=1|z_{j})$
$\displaystyle=\frac{1}{4}\frac{1}{Q_{\mu\mu}}\sum_{[z_{i},z_{j}]\in
Err}\Pr(C_{i}=1|z_{i})\Pr(C_{j}=1|z_{j}).$

The ratio of the single-photon pairs in the signals with successful detection
$\bar{q}_{11}$ is

$\displaystyle\bar{q}_{11}$ $\displaystyle=\Pr(S|C)=\frac{\Pr(S,C)}{\Pr(C)}$
(112) $\displaystyle=\frac{1}{Q_{\mu\mu}}\sum_{z_{i}\oplus
z_{j}=11}\Pr(z_{i},z_{j})\Pr(S,C|z_{i},z_{j})$
$\displaystyle=\frac{1}{4}\frac{1}{Q_{\mu\mu}}\sum_{z_{i}\oplus
z_{j}=11}\Pr(C|S,z_{i},z_{j})\Pr(S|z_{i},z_{j})$
$\displaystyle=\frac{1}{4}\frac{P_{\mu}(1)^{2}}{Q_{\mu\mu}}\sum_{z_{i}\oplus
z_{j}=11}\Pr(C_{i}=1|n_{i}=z_{i})\Pr(C_{j}=1|n_{j}=z_{j}),$

where $P_{\mu}(k)=\exp(-\mu)\frac{\mu^{k}}{k!}$ is the Poisson distribution
and $\Pr(C_{i}=1|n_{i})$ is defined in Eq. (107).

The phase-error-rate formula of time-bin MDI-QKD is given by the formulas (A9)
and (A11) in Ref. [23],

$\displaystyle Y_{11}$
$\displaystyle=(1-p_{d})^{2}\left[\dfrac{\eta_{a}\eta_{b}}{2}+(2\eta_{a}+2\eta_{b}-3\eta_{a}\eta_{b})p_{d}+4(1-\eta_{a})(1-\eta_{b})p_{d}^{2}\right],$
(113) $\displaystyle e_{11}^{X}$
$\displaystyle=e_{0}Y_{11}-(e_{0}-e_{d})(1-p_{d}^{2})\dfrac{\eta_{a}\eta_{b}}{2}.$

Here, $e_{0}=1/2$ is the error caused by vacuum signals, $e_{d}$ is the pre-
set misalignment error, and $\eta_{a}(\eta_{b})$ are the transmittances from
Alice (Bob) to Charlie. In our case, $\eta_{a}=\eta_{b}=\eta_{s}$.

###  D.3 Other QKD schemes

Here, we list the simulation formulas for decoy-state BB84 and PM-QKD which
are used in the key rate simulation programme. We also list the repeaterless
rate-transmittance bound drawn in the main text.

The key rate of the decoy-state BB84 scheme is [39]

$R_{BB84}=\frac{1}{2}Q_{\mu}\\{-fH(E_{\mu}^{Z})+q_{1}[1-H(e^{X}_{1})]\\}.$
(114)

Here, for a fair comparison with the time-bin MDI-QKD and the MP scheme, we
consider a time-bin encoding BB84 scheme, where Alice’s $Z$-basis encoding is
undertaken by choosing to emit a phase-randomised coherent state in one of two
time-bin optical modes. In this case, the $Z$-basis bit error is merely caused
by the dark counts, regardless of the misalignment error. We now consider an
efficient basis choice with a sifting factor of $1$. For a fair comparison, we
multiply the original key rate of decoy-state BB84 by a factor of $1/2$. The
reason is that we are considering the averaged key rate generated by each pair
of optical modes, $A_{i}$ and $B_{i}$, while the key rate for the original
decoy-state BB84 is found for each round in which Alice (and Bob) emit two
optical modes.

In the simulation, the yield and error rates of the $k$-photon component in
the $X$-basis are [58]

$\displaystyle Y_{k}$ $\displaystyle=1-(1-Y_{0})(1-\eta)^{k},$ (115)
$\displaystyle e_{k}$ $\displaystyle=e_{d}+\frac{(e_{0}-e_{d})Y_{0}}{Y_{k}},$

where $e_{d}$ is the intrinsic misalignment-error rate caused by a phase-
reference mismatch. The gain and QBER of the $Z$-basis pulse are given by

$\displaystyle Q_{\mu}$
$\displaystyle=\sum_{k=0}^{\infty}\frac{\mu^{k}e^{-\mu}}{k!}Y_{k},$ (116)
$\displaystyle=1-(1-Y_{0})e^{-\eta\mu},$ $\displaystyle E_{\mu}$
$\displaystyle=\frac{e_{d}Y_{0}}{Q_{\mu}},$

where $Y_{0}=2p_{d}$ and $e_{0}=1/2$.

For PM-QKD, the key-rate formula is [25, 45],

$R_{PM}=\dfrac{2Q_{\mu}}{D}\sum_{j}\left[1-H(E_{\mu}^{X})-fH(E_{\mu,j}^{Z})\right],$
(117)

where $D=16$ is the number of slices. The gain, yield and error rates are

$\displaystyle Q_{\mu}$ $\displaystyle=1-(1-2p_{d})e^{-\eta\mu},$ (118)
$\displaystyle Y_{k}$ $\displaystyle=1-(1-2p_{d})(1-\eta)^{k},$ $\displaystyle
q_{k}$ $\displaystyle=Y_{k}\frac{e^{-\mu}\mu^{k}/k!}{Q_{\mu}},$ $\displaystyle
E_{\mu}^{X}$ $\displaystyle=1-\sum_{k}q_{2k+1}<1-q_{1}-q_{3}-q_{5},$
$\displaystyle E_{\mu,j}^{Z}$
$\displaystyle=[p_{d}+\eta\mu(e_{\delta,j}+e_{d}^{PM})]\frac{e^{-\eta\mu}}{Q_{\mu}},$
$\displaystyle e_{\delta,j}$
$\displaystyle=\sin^{2}\left[\frac{\pi}{4}-\left|\frac{\pi}{4}-\frac{\pi
j}{D}\right|\right],$

where $e_{d}^{PM}$ is the intrinsic misalignment error of the PM-QKD. We take
these formulas from Eqs. (8)-(12) and (D1)-(D4) in Ref. [45].

For SNS-TF-QKD, the key-rate formula is [27, 46],

$R_{SNS}=2p_{z0}(1-p_{z0})\mu_{z}e^{-\mu_{z}}s_{1}\left[1-H(e_{1}^{ph})\right]-fS_{z}H(E^{Z}),$
(119)

where $p_{z0}$ is Alice’s (or Bob’s) probability of sending vaccum state,
$\mu_{z}$ is the light intensity for Alice or Bob’s signal pulses, $s_{1}$ is
the detecting probability of single-photon signals, $e_{1}^{ph}$ is the
single-photon phase error rate, $S_{z}$ is the detecting probability of signal
lights and $E^{Z}$ is the quantum bit error rate. $p_{z0}$ and $\mu_{z}$ need
to be optimized. We use the following simulation formula, matching the results
in Ref. [46],

$\displaystyle s_{1}$ $\displaystyle=(1-\eta)2p_{d}(1-p_{d})+\eta(1-p_{d}),$
(120) $\displaystyle e_{1}^{ph}$
$\displaystyle=(1-e_{d}^{SNS})\frac{(1-\eta)p_{d}(1-p_{d})}{s_{1}}+e_{d}^{SNS}\left[1-\frac{(1-\eta)p_{d}(1-p_{d})}{s_{1}}\right],$
$\displaystyle S_{z}$
$\displaystyle=p_{z0}^{2}S_{00}+(1-p_{z0})^{2}S_{22}+2p_{z0}(1-p_{z0})S_{02},$
$\displaystyle E^{Z}$
$\displaystyle=\left[p_{z0}^{2}S_{00}+(1-p_{z0})^{2}S_{22}\right]/S_{z}.$

Here, $e_{d}^{SNS}$ is the misalignment error. $S_{00}$, $S_{02}$, and
$S_{22}$ indicate the detecting probabilities of the signals when Alice and
Bob emit light with intensity $(0,0)$, $(0,\mu_{z})$, and $(\mu_{z},\mu_{z})$,
respectively, which are given by the following formulas,

$\displaystyle S_{00}$ $\displaystyle=2p_{d}(1-p_{d}),$ (121) $\displaystyle
S_{02}$
$\displaystyle=2\left[(1-p_{d})e^{-\eta\mu_{z}/2}-(1-p_{d})^{2}e^{-\eta\mu_{z}}\right],$
$\displaystyle S_{22}$
$\displaystyle=2\left[(1-p_{d})e^{-\eta\mu_{z}}I_{0}(\eta\mu_{z})-(1-p_{d})^{2}e^{-2\eta\mu_{z}}\right],$

where $I_{0}(x)$ is the modified Bessel function of the first kind.

The repeaterless rate-transmittance bound of the repeaterless point-to-point
QKD scheme is the PLOB bound [5]

$R_{PLOB}=-\log_{2}(1-\eta).$ (122)

##  Appendix E Numerical results for the optimal intensity

To further understand the key rate property of the MP scheme, we simulate this
scheme’s optimal intensity settings, as well as those of the other schemes
mentioned in the main text. We choose exactly the same simulation parameters
as used in Fig. 4 in the main text. Fig. 23 illustrates the optimal
intensities of different QKD schemes; Fig. 22 illustrates those corresponding
to different communication distances and pairing lengths $l$.

We first note that, for the time-bin-encoding version of BB84, the two-mode
MDI-QKD and the MP scheme, the $Z$-basis bit error is almost $0$ and is
irrelevant to the intensity $\mu$. In this case, the error-correction-related
term has a negligible contribution in the key rate. For BB84, the optimal
intensity satisfies (cf. Eq. (12) in Ref. [59])

$(1-\mu)e^{-\mu}=\frac{fH(E^{Z}_{\mu})}{1-H(e^{X}_{1})}.$ (123)

When $fH(E^{Z}_{\mu})\to 0$, we have $(1-\mu)e^{-\mu}\to 0$; hence, $\mu\to
1$. The optimal $\mu$ for MDI-QKD can be derived in a similar fashion. As
shown in Fig. 23, before the error rates caused by the dark-count events come
to dominate the bit-error rate $E^{Z}$, the optimal $\mu$ values for BB84 and
MDI-QKD are always $1$.

The optimal $\mu$ for the MP scheme, however, cannot be directly derived from
the key-rate formula due to an additional dependence of the key rate $R$ on
the pairing rate $r_{p}$. If we set $p_{d}\to 0$ and assume that
$\eta_{s}\mu\ll 1$, the key rate of the MP scheme in Eq. (90) is approximately

$\displaystyle R$
$\displaystyle=r_{p}(p,l)r_{s}\\{q_{(1,1)}[1-H(e^{X}_{(1,1)})]-fH(E^{Z}_{(\mu,\mu)})\\}$
(124) $\displaystyle\approx
p\left[\frac{1}{1-(1-p)^{l}}\right]^{-1}\frac{1}{8}\\{e^{-2\mu}[1-H(e^{X}_{(1,1)})]-fH(E^{Z}_{(\mu,\mu)})\\}.$

Here,

$\displaystyle r_{s}$
$\displaystyle\approx\frac{1}{16}\frac{1}{p^{2}}[2(\eta_{s}\mu)^{2}]=\frac{1}{8},$
(125) $\displaystyle q_{(1,1)}$ $\displaystyle\approx\frac{1}{16}\frac{(\mu
e^{-\mu})^{2}}{r_{s}(\eta_{s}\mu)^{2}}2\eta^{2}_{s}=e^{-2\mu}.$

Now, we consider two extreme cases: 1) $l$ is small, such that $pl\ll 1$; 2)
$l$ is large, such that $pl\gg 1$. Note that, we always assume that $1\gg p\gg
p_{d}$.

When $pl\ll 1$, we have $(1-p)^{l}\approx 1-lp$. The key rate can be
simplified to be

$\displaystyle R$
$\displaystyle\approx\frac{1}{8}lp^{2}\\{e^{-2\mu}[1-H(e^{X}_{(1,1)})]-fH(E^{Z}_{(\mu,\mu)})\\},$
(126)
$\displaystyle=\frac{1}{8}l(\eta_{s}\mu)^{2}\\{e^{-2\mu}[1-H(e^{X}_{(1,1)})]-fH(E^{Z}_{(\mu,\mu)})\\}.$

Taking the derivative of $R$ with respective to $\mu$, we obtain the following
condition for optimal $\mu$:

$(1-\mu)e^{-2\mu}=\frac{fH(E^{Z}_{(\mu,\mu)})}{1-H(e^{X}_{(1,1)})}.$ (127)

Suppose that $E^{Z}_{(\mu,\mu)}\to 0$; then $\mu\to 1$. In the long-distance
regime, $E^{Z}_{(\mu,\mu)}$ gets larger, resulting in a smaller $\mu$.

When $pl\gg 1$, we have $(1-p)^{l}\approx 0$. The key rate can be simplified
as

$\displaystyle R$
$\displaystyle\approx\frac{1}{16}p\\{e^{-2\mu}[1-H(e^{X}_{(1,1)})]-fH(E^{Z}_{(\mu,\mu)})\\},$
(128)
$\displaystyle=\frac{1}{16}\eta_{s}\mu\\{e^{-2\mu}[1-H(e^{X}_{(1,1)})]-fH(E^{Z}_{(\mu,\mu)})\\}.$

Taking the derivative of $R$ with respective to $\mu$, we obtain the following
condition for optimal $\mu$:

$(1-2\mu)e^{-2\mu}=\frac{fH(E^{Z}_{(\mu,\mu)})}{1-H(e^{X}_{(1,1)})}.$ (129)

Suppose $E^{Z}_{(\mu,\mu)}\to 0$; then $\mu\to 1/2$. In the long-distance
regime, $E^{Z}_{(\mu,\mu)}$ increases, resulting in a smaller $\mu$.

In the general case, for a fixed $l$, the value of $pl$ grows smaller as the
communication distance becomes longer. The optimal value of $\mu$ may first be
close to $0.5$ and then increased to nearly $1$.

Figure 22: Optimal intensity setting of the MP scheme with different pairing
lengths $l$. Here, all of the simulation parameters are chosen to be the same
as the ones in Fig. 4 in the main text. Figure 23: Comparison of the optimal
intensity settings of different QKD schemes. Here, all the simulation
parameters are chosen to be the same as those in Fig. 4 in the main text.
Here, the optimal $\mu$ for the BB84 scheme is defined to be the overall
intensity of two emitted modes in each round. The optimal $\mu$ value for
(two-mode) MDI-QKD is defined as the overall intensity of Alice’s (or Bob’s)
two emitted modes in each round. The optimal $\mu$ values for MP-QKD, PM-QKD,
and SNS-TFQKD are defined on each single round.

##  Appendix F Proof-of principle experimental demonstration

In the mode-pairing scheme, like other phase-encoding QKD schemes, certain
“local phase stabilization” is still required. In this section, we want to
clarify the difference between this local phase stabilization and the “global
phase locking” over two remote independent lasers required for the one-mode
MDI-QKD schemes.

Suppose Alice and Bob hold two independent lasers emitting the optical pulses
independently. One can track the phases of these coherent state pulses. For
the pulses emitted by Alice and Bob at the time $t$, denote the global phases
of the pulses as $\phi^{a}(t)$ and $\phi^{b}(t)$, respectively. Generally, the
circular frequencies of Alice’s and Bob’s lasers, $\omega_{a}(t)$ and
$\omega_{b}(t)$, are changing over time. We model the phases $\phi^{a}(t)$ and
$\phi^{b}(t)$ as follows,

$\displaystyle\phi^{a}(t)=\int_{0}^{t}\omega_{a}(t)dt+\psi_{a}(t),$ (130)
$\displaystyle\phi^{b}(t)=\int_{0}^{t}\omega_{b}(t)dt+\psi_{b}(t),$

where $\psi_{a}(t)$ and $\psi_{b}(t)$ are two randomly fluctuated noise terms
with a rate much slower than the one caused by circular frequencies and
independent of $\omega_{a}$ and $\omega_{b}$. Here, the phase fluctuation
caused by fibres is normally slow, based on the former experimental result.
When the fibre length is around $500$ km, the phase drift velocity is less
than $10$ rad/ms [31]. Then, we define global phase locking and local phase
stabilization as following.

######  Definition 6 (Global phase locking).

After Alice and Bob perform global phase locking, they can achieve either of
the following two tasks during the whole process of the experiment.

  * •

They keep the relative phase between the two emitted pulses
$\phi^{b}(t)-\phi^{a}(t)$ to be a constant, independent of the time $t$.

  * •

They are able to estimate the phase difference $\phi^{b}(t)-\phi^{a}(t)$ for
every moment $t$ accurately.

If we want to perform global phase locking, we have to stabilize the phase
difference $\phi^{b}(t)-\phi^{a}(t)$ for each moment $t$ or accurately
estimate it. Due to the large frequency difference
$\omega_{b}(t)-\omega_{a}(t)$ of two independent lasers, the value of
$\phi^{b}(t)-\phi^{a}(t)$ changes rapidly with respect to $t$, making the
stabilization or accurate estimation of $\phi^{b}(t)-\phi^{a}(t)$ challenging.

######  Definition 7 (Local phase stabilization).

After Alice and Bob perform local phase locking, they can achieve either of
the following two tasks for any two moments $t_{1}$ and $t_{2}$, satisfying
$|t_{1}-t_{2}|\leq\Delta t$,

  * •

Alice keeps the relative phase between her two emitted pulses
$\phi^{a}(t_{2})-\phi^{a}(t_{1})$ to be a constant, independent of $t_{1}$ and
$t_{2}$. Bob does the same thing for $\phi^{b}(t_{2})-\phi^{b}(t_{1})$.

  * •

They are able to estimate the phase difference
$\theta^{\delta}(t_{1},t_{2}):=\phi^{b}(t_{2})-\phi^{b}(t_{1})-\phi^{a}(t_{2})+\phi^{a}(t_{1})$
accurately.

We remark that, the core difference of the local phase stabilization from the
global phase locking is to estimate the _difference_ of the phase
$\phi^{b}(t)-\phi^{a}(t)$ between two moments $t_{1}$ and $t_{2}$ instead of
estimating the phase itself. We now discuss why this task will be easier than
the global phase locking for a reasonable time period $\Delta t=t_{2}-t_{1}$.

In the task of local phase stabilization, the users try to stabilize

$\displaystyle\theta^{\delta}(t_{1},t_{2})=[\phi^{b}(t_{2})-\phi^{b}(t_{1})]-[\phi^{a}(t_{2})-\phi^{a}(t_{1})]=\int_{t_{1}}^{t_{2}}[\omega_{b}(t)-\omega_{a}(t)]dt+[\psi_{b}(t_{2})-\psi_{b}(t_{1})]-[\psi_{a}(t_{2})-\psi_{a}(t_{1})]$
(131)

within time $\Delta t=t_{2}-t_{1}$. For a short time period $\Delta t$,
$\psi_{a}(t_{2})-\psi_{a}(t_{1})$ and $\psi_{b}(t_{2})-\psi_{b}(t_{1})$ will
be relatively small. To estimate the value of $\theta^{\delta}(t_{1},t_{2})$
in a short period $\Delta t$, Alice and Bob only need to track the frequency
difference $\omega_{b}(t)-\omega_{a}(t)$, which is easier than directly
measure the phase difference $\phi^{b}(t)-\phi^{a}(t)$. Then, they use the
integration $\int_{t_{1}}^{t_{2}}[\omega_{b}(t)-\omega_{a}(t)]dt$ to estimate
the phase difference $\theta^{\delta}(t_{1},t_{2})$. On the other hand, when
the time period $\Delta t$ gets longer, the accuracy of integration
$\int_{t_{1}}^{t_{2}}[\omega_{b}(t)-\omega_{a}(t)]dt$ will be affected, and
the slow phase fluctuation $\psi_{a}(t_{2})-\psi_{a}(t_{1})$ and
$\psi_{b}(t_{2})-\psi_{b}(t_{1})$ would come into play, which would affect the
final results of local phase stabilization. The hardness of local phase
stabilization requirement depends on the time interval $\Delta t$. We now
consider the following two extreme cases.

  1. 1.

When $\Delta t=t_{2}-t_{1}\ll 1/\Delta f$, where $\Delta f$ is the laser
linwidth. For example, in the regular phase-encoding MDI-QKD, the $\Delta t$
of local phase stabilization requirement is the time between two adjacent
pulses, which is usually in this scenario. In this case, the values of
$\omega_{b}(t)-\omega_{a}(t)$ is stable, and the value of
$\psi_{a}(t_{2})-\psi_{a}(t_{1})$ and $\psi_{b}(t_{2})-\psi_{b}(t_{1})$ will
be close to zero. As a result, the local phase stabilization is easy to
realize.

  2. 2.

When $\Delta t=t_{2}-t_{1}\gg 1/\Delta f$. Then, the frequency difference
$\omega_{b}(t)-\omega_{a}(t)$ fluctuates randomly, and the values of
$\psi_{a}(t_{2})-\psi_{a}(t_{1})$ and $\psi_{b}(t_{2})-\psi_{b}(t_{1})$ become
large. To fulfill the requirements in Definition 7, we have to estimate both
the phases $\phi^{b}(t_{1})-\phi^{a}(t_{1})$ and
$\phi^{b}(t_{2})-\phi^{a}(t_{2})$ accurately. In this case, the local phase
stabilization approaches the case of global phase locking.

In order to show the feasibility of realizing the local phase stabilization in
Definition 7 with a reasonable large time period $\Delta t$, we perform an
experimental demonstration using two independent lasers. This is the
essentially the same setup as the phase-matching experiment [31], except for
the removal of the strong master laser for global phase-locking. Alice and Bob
each use a laser with the central frequency of
$\omega_{a}\approx\omega_{b}\approx 193.533$ THz. The linewidth $\Delta f$ of
the lasers is $2$ kHz. The frequency difference of two lasers is about $30$
MHz, which is much larger than the linewidth. The system frequency is $625$
MHz.

In the experiment, Alice and Bob both send laser pulses of intensity $\mu$ to
a measurement site in the middle. Depending on the transmission distance, they
will choose a proper $\mu$ such that they will get a suitable number of
detection results. Besides, they do not perform any phase modulation on these
pulses for simplicity. The coherent state prepared by Alice and Bob can be
denoted as $\ket{\sqrt{\mu}e^{i\phi^{a}(t)}}$ and
$\ket{\sqrt{\mu}e^{i\phi^{b}(t)}}$, respectively. The two pulses are
interfered at the measurement site and then are detected by single-photon
detectors. The detection result is “$L$” if one of the detectors clicks, and
“$R$” if the other detector clicks.

Now, they do not apply any phase-locking techniques in the demonstration, it
is very challenging to track the global phases and predict the measurement
result in single round. However, in mode-pairing scheme, we only care about
whether the measurement results of the two paired locations are the same or
not. Which is determined by the phase difference betweem two paired locations
$i$ and $j$,

$\theta^{\delta}=(\phi^{b}_{j}-\phi^{b}_{i})-(\phi^{a}_{j}-\phi^{a}_{i})=\int_{t_{i}}^{t_{j}}\omega_{\delta}(t)dt,$
(132)

where $\omega_{\delta}(t):=\omega_{b}(t)-\omega_{a}(t)$ is the frequency
difference between Alice’s and Bob’s laser pulses. For a short period of time,
we can assume that $\omega_{\delta}(t)$ drifts with a linear model,

$\omega_{\delta}(t)=kt+\omega_{\delta}(0).$ (133)

After accumulating enough detection results, Alice and Bob can use them to
estimate the frequency difference of their lasers during data post-processing.
First, they pair the locations where the successful detection occurs. For a
pair, there are four possible detection results, $(L,R)$, $(R,L)$, $(L,L)$ and
$(R,R)$. One click on location $i$ and the other on $j$. With the paired
locations and corresponding detection results, Alice and Bob can estimate
$\omega_{\delta}(t)$ using a probabilistic model corresponding to this optical
setting. Then they can calculate the phase difference $\theta^{\delta}$ using
Eq. (132).

To test the accuracy of the estimation of $\omega_{\delta}(t)$ in Eq. (133),
we further use the estimated $\theta^{\delta}$ to predict the detection
results. When the estimated value of $\theta^{\delta}$ of a pair is in the
region $[-\Delta/2,+\Delta/2)$ or $[\pi-\Delta/2,\pi+\Delta/2)$, this data
pair can be further used for testing. Here, $\Delta=2\pi/32$ is the width of
the phase slice. In the former case, Alice and Bob assign the detection
$(L,R)$ or $(R,L)$ to be error and $(L,L)$ or $(R,R)$ to be correct; while in
the latter case, they assign the detection $(L,L)$ or $(R,R)$ to be error and
$(L,R)$ or $(R,L)$ to be correct.

Below we draw the error rate of the paired strong pulses with respect to
different pairing length $l=j-i$. We group the paired locations by different
pairing length, as shown in Figure 24. This error rate can reflect the
$X$-basis error rate in mode-pairing QKD. Similar to the phase-encoding MDI-
QKD, the $X$-basis error has a 25% intrinsic error rate caused by the multi-
photon components in the coherent states. From the demonstration we can see
that, apart from the intrinsic error, our method only introduces a reasonable
additional error rate. One can further reduce the error rate by post-selecting
the good signals in post-processing of reference pulses. If we use the decoy
method to estimate the phase error in a single photon pair, the error rate
will be a reasonable value that we can obtain a positive final key rate.
Therefore, the mode-pairing scheme is feasible without global phase locking.

Figure 24: Error rates of the paired laser pulses under different pairing
intervals and different transmission distances. The intensities of laser
pulses are chosen such that the arrived signals on the measurement site are
strong enough to provide enough clicks. Given a pairing length interval, say
$l\in[1000,2000)$, we pair all detection clicks such that $1000\leq j-i<2000$.

From Figure 24, we can see that the error rate is stable when the pairing
length is up to $3000\sim 4000$. If we further enhance the system frequency to
$4$ GHz [36], we are able to achieve a maximal pairing length of 20000. In
this way, the performance of the mode-pairing scheme can surpass the
repeaterless key-rate bound. We leave a full demonstration of the mode-pairing
scheme for future works.