# Twin-field quantum key distribution without optical frequency dissemination

Lai Zhou  Jinping Lin  Yumang Jing  Zhiliang Yuan<EMAIL_ADDRESS>Beijing
Academy of Quantum Information Sciences, Beijing 100193, China

###### Abstract

Twin-field (TF) quantum key distribution (QKD) has rapidly risen as the most
viable solution to long-distance secure fibre communication thanks to its
fundamentally repeater-like rate-loss scaling. However, its implementation
complexity, if not successfully addressed, could impede or even prevent its
advance into real-world. To satisfy its requirement for twin-field coherence,
all present setups adopted essentially a gigantic, resource-inefficient
interferometer structure that lacks scalability that mature QKD systems
provide with simplex quantum links. Here we introduce a novel technique that
can stabilise an open channel without using a closed interferometer and has
general applicability to phase-sensitive quantum communications. Using locally
generated frequency combs to establish mutual coherence, we develop a simple
and versatile TF-QKD setup that does not need service fibre and can operate
over links of 100 km asymmetry. We confirm the setup’s repeater-like behaviour
and obtain a finite-size rate of 0.32 bit/s at a distance of 615.6 km.

Introduction. Communication at the single photon level enables quantum key
distribution (QKD) to achieve a revolutionary milestone in information
security, allowing two distant users to establish a cryptographic key with
verifiable secrecy1, 2. Decades’ development has advanced fibre-based QKD
systems to a maturity level that is suitable for showcasing long-term,
uninterrupted services in real-world networks3, 4, 5, 6. In such systems,
quantum signals experience the loss of the entire link and thus their
maximally achievable rates scale linearly with the channel transmittance
($\eta$) 7, 8. This rate-loss scaling leads to a prohibitively low rate for
long haul links, while such links often bear strategic importance for
connecting metropolitan cities. Theoretically, quantum repeaters9, 10 can
improve this scaling to $\eta^{\frac{1}{N+1}}$ with $N$ intermediate nodes and
thus enable secure communications over arbitrarily long distances, but require
technologies that are yet to become practical.

Twin-field (TF) QKD protocol 11 was recently proposed for practical long-haul
quantum communications. Similarly to the form of QKD that achieves
measurement-device-independence12, 13 (MDI), it uses an intermediate
measurement node that halves the signal transmission loss, but extracts
information from single photon interference rather than two-photon coincidence
so as to gain the advantageous repeater-like rate-loss scaling of
$\sqrt{\eta}$. Security against general attacks was proven for protocol
variants 14, 15, 16, 17, 18, 19, 20, among which sending-not-sending (SNS)16
and no-phase-post selection (NPP)17, 18, 19 remove partially the need for
phase slice reconciliation and thus improve key generation efficiency. An
exciting collection of experiments21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31,
32 has successfully validated TF-QKD’s superior rate-loss scaling and
repeatedly broken the communication distance record, which now stands at 833
km31.

Figure 1: Schematics of TF-QKD setups. In TF-QKD, the users (Alice and Bob)
communicate with each other by sending encoded quantum signals at the single-
photon level to the intermediate node (Charlie), who measures the interference
using two single photon detectors. The protocol’s stringent requirement for
phase stability has rendered all existing setups to adopt a closed
interferometer configuration, which is resource-inefficient and inflexible. a,
Existing Mach-Zehnder interferometer setup 27, 30, 31. Alice and Bob inherit a
common optical frequency $\nu_{R}$ that is disseminated by Charlie via the
long service fibres. b, Open channel setup. Alice and Bob locally generate
their own optical frequencies and their coherent side-bands of $\nu_{A}\pm
f_{0}$ and $\nu_{B}\pm f_{0}$, with a nominally identical microwave frequency
offset $f_{0}$. One side-band is used to reconcile the laser frequency
difference ($\Delta\nu=\nu_{A}-\nu_{B}$), while the other is allocated quantum
signal encoding. The open scheme eliminates the need for the service fibre and
the optical frequency locking hardware, and supports asymmetric links.

With above achievements, the primary experimental focus should now turn to
addressing TF-QKD’s implementation complexity, which would otherwise impair
its practical deployment. Due to the stringent requirement for twin-field
phase tracking, all existing long-haul TF-QKD setups have to adopt essentially
a gigantic Mach-Zehnder inteferometer (MZI) configuration with half of its
fibre used for optical frequency dissemination (Fig. 1a). Use of service fibre
brings two severe drawbacks. First, the setups are fibre-resource inefficient
and require additional frequency locking hardware and often optical amplifiers
along the service fibre. Second, the closed fibre configuration is inherently
incompatible with optical switching, which could restrict TF-QKD’s scalability
into a larger network like other QKD systems 33, 34. Using Sagnac
interferometer permits a simple TF-QKD ring network 35, but its long-haul
capability could be obstructed by noise contamination due to counter-
propagating signals of strong intensity disparity. Ideally, the twin-field
phase could be stabilised without using a closed interferometer so as to reach
a simple setup (Fig. 1b) sharing an identical fibre configuration as MDI-QKD.
We note that new MDI-QKD variants were recently proposed to allow repeater-
like rate-loss scaling via post-detection time-bin pairing36, 37.

Open quantum link stabilisation. To perform TF-QKD, it is necessary to ensure
stable interference at the intermediate node (Charlie) between signals
transmitted by two remote users (Alice and Bob). The differential phase
($\phi$) between their signals evolves as

$\derivative{\phi}{t}=2\pi(\Delta\nu+\frac{\nu}{s}\derivative{\Delta L}{t}),$
(1)

where $\Delta\nu$ is the difference between the users’ laser frequencies
($\nu$), $s$ light speed in the fibre, and $\Delta L$ the length difference
between the users’ fibres to Charlie. The fibre term
($\frac{\nu}{s}\derivative{\Delta L}{t}$) contributes typically a few kHz to
the phase instability for a fibre link of several hundred kilometers11, 27.
This kHz drift alone can be corrected for with a feedback loop of a sub-MHz
bandwidth using a low-level reference signal, without scattering overwhelming
noise photons and thus crucially maintaining the quantum channel intact.
However, the laser term is more problematic. Free-running lasers have
unsatisfying long-term stability, with daily frequency drift often in the
region of 10 - 100 MHz, although some can offer instantaneous linewidth of 1
kHz. Referencing to a high-fineness cavity helps, but the cavity itself
drifts. Consequently, TF-QKD setups to date resort to sending strong laser
signals to synchronise the users’ lasers to enforce $\Delta\nu=0$ and hence
require a separate service fibre channel to avoid contamination to the quantum
link (see Fig. 1a). The resulting setup has a closed fibre configuration.

In this work, we develop a scheme to stabilise an open quantum link between
two distant users that share no prior mutual coherence and are separated by
hundreds kilometers of single mode fibre. Using this scheme we have achieved a
drastically simplified and versatile TF-QKD setup, capable of supporting
asymmetric links, that needs neither dissemination of optical frequencies nor
its associated service fibre and hardware, as schematically shown in Fig. 1b.
Here, each user generates their local frequency comb and transmits one comb
line to Charlie for interference, the outcome of which feeds into a photon-
counting proportional–integral–derivative (PID) controller that allows rapid
reading out and zeroing the laser frequency difference as well as cancelling
the fibre fluctuation. Importantly, our solution brings neither performance
degradation nor loss of practicality thanks partly to its choice of proven
ingredients including ultra-stable lasers29, 32, optical frequency combs30 and
dual-wavelength stabilisation 27, 30.

Setup. Our setup (Fig. 2) does not need service fibre and has an identical
fibre configuration as MDI-QKD 12. Alice and Bob are connected to Charlie from
opposite directions via their segments of the quantum link. The quantum link
is made of spools of ultra-low loss fibres with an average loss coefficient of
0.168 dB km-1. For detailed information on the fibre properties, refer to
Supplementary Table S1.

Figure 2: Experimental setup. Alice (Bob) owns an independent ultrastable
laser, the signal of which is modulated by a phase modulator (PM) to produce a
frequency comb of 25 GHz spacing. Two comb lines separated by 100 GHz are
chosen for quantum signal encoding ($\lambda_{q}$) and channel stabilisation
($\lambda_{c}$), respectively. Charlie contains a receiving 50/50 beam
splitter to interfere the incoming signals. The $\lambda_{q}$ photons are
registered by D0 and D1 and the $\lambda_{c}$ photons by Dc. Dc’s count rate
is used as error signal to the fast PID controller that cancels the twin-field
phase fluctuation of the $\lambda_{c}$ signals. a, Optical frequency comb
measured after the PM; b, Encoder box. DWDM: dense wavelength-division
multiplexing; EPC: electrically driven polarisation controller; FS: fibre
stretcher; IM: Intensity Modulator; VOA: variable optical attenuator.

Each user owns an independent continuous-wave laser that features a sub-Hz
short-term linewidth and allows adjustment of its optical frequency at 1 mHz
step size. See Methods for the detailed information on the lasers. Passing
through a phase modulator (PM), the laser light is modulated to generate a
frequency comb (Fig. 2a) with a precise spacing of 25 GHz thanks to the
microwave frequency driver referenced to a Rubidium frequency standard. For 50
GHz dense-wavelength-division-multiplexing (DWDM) compatibility, two comb
lines of $\lambda_{q}=1549.72$ nm and $\lambda_{c}=1550.52$ nm (ITU Channels
34.5 and 33.5) are selected and filtered into two separate paths. The
continuous-wave $\lambda_{c}$ signal is used to establish coherence with the
other user, and we refer to it as the ‘channel reference’. The $\lambda_{q}$
signal passes through the encoder box (Fig. 2b), which carves the continuous-
wave input into a train of pulses of 300 ps width at an interval of 1 ns. The
encoder’s description is provided in Supplementary. We apply blockwise
modulation for every 200 pulses. The first 95 pulses of each block do not
receive further modulation and are used to sense the phase of the quantum
channel. They are referred to as the ‘quantum reference’. The last 100 pulses
are modulated according to TF-QKD protocol’s requirement. As these quantum
pulses can be considerably weaker than the quantum reference, the encoder
extinguishes the 5 pulses in between to create an empty buffer to prevent
inter-group contamination. Overall, our setup has an effective QKD clock rate
of 500 MHz. After the encoder box, the $\lambda_{q}$ light is recombined with
the channel reference ($\lambda_{c}$) into the quantum channel segment using a
DWDM filter. In addition to setting the approximate photon fluxes, both
wavelengths paths have separate polarisation controls for pre-compensation of
polarisation rotation by the quantum link.

Figure 3: Open quantum channel stabilisation. Alice and Bob’s lasers are fully
independent, and their frequency difference is adjustable by offsetting
Alice’s laser to a high-fineness cavity. Except a, all data in this figure
were measured with the 615.6 km quantum fibre. a, Histograms of phase
compensation signals integrated over 10 ms time intervals for a 10 m quantum
link; b, same as a but with 615.6 km quantum link; c, Compensation signal
angular frequency as a function of the laser frequency offset ($\Delta\nu$).
d, Optical output power as a function of time measured at one output of
Charlie’s 50/50 interfering beam-splitter; Purple (green): channel reference
or the $\lambda_{c}$ signal when the FPGA PID controller is turned off (on);
Orange: slowed drift of the $\lambda_{q}$ signal. e, f, g, The phase angle
distributions of the channel reference before (purple) and after (green) the
simplex channel stabilisation, measured for laser frequency offsets of -2, 0
and 2 kHz, respectively. Data in d – g were measured with a power meter.

After travelling through their respective quantum link segments, Alice and
Bob’s light enters Charlie’s 50/50 interfering beam splitter with an identical
polarisation and matched intensities. The interference outcome is spectrally
de-multiplexed before detection by three superconducting nanowire single
photon detectors (SNSPD’s), with D0 and D1 assigned to the $\lambda_{q}$
signals and Dc for the $\lambda_{c}$ channel reference. Charlie contains a PM
in one of his input arms for fast phase feedback control. Charlie’s components
losses and detector performance is summarised in Supplementary Tables S2 and
S3.

We describe briefly below, and provide more information in Section II of
Supplementary, on how our setup is stabilised. For all different fibre
lengths, we adjust the channel references’ intensities to have a maximal
interference visibility and maintain an average count rate of approximately 13
MHz at Dc. This count rate allows 200 kHz sampling with acceptable noise by a
field-programmable-gated-array (FPGA) PID controller (not shown) to process
and generate compensation voltages to Charlie’s PM, locking the differential
phase to $\pi/2$ between the channel references. This locking process cancels
simultaneously both instability terms in Eq. (1), i.e., the laser frequency
difference and fibre fluctuation. As described later, the FPGA controller
allows real-time readout of the laser frequency difference and can thus apply
feedback to one user’s laser to prevent the laser drifting out of the PID’s
correction bandwidth. Due to coherence among comb lines, the frequency
difference for the $\lambda_{q}$ signals is reduced by a factor of
$\frac{\absolutevalue{\lambda_{q}-\lambda_{c}}}{\lambda_{q}}$. The phase drift
by this residual difference can then be corrected for through a second stage
compensation 27 which uses the interference result of the quantum reference to
act on a fibre stretcher in Alice’s encoder at a rate of 50–100 Hz. Note that
use of coherent combs enables the setup to support asymmetric channels, which
can substantially ease fibre provision during installation.

Experimental results. To evaluate the effectiveness of our open fibre scheme,
we analyse the compensation signal that is applied to the Charlie’s PM in
response to the lasers’ frequency difference ($\Delta\nu$) and fibre
fluctuation of the quantum channel. Figs. 3a and 3b show the histograms of
compensation signals integrated over 10 ms intervals for three different
frequency offsets. For clarity, the PM compensation signal is converted to
angular frequency with unit of $2\pi$ s-1 or Hz. For a 10 m quantum channel
(Fig. 3a), the PID compensates mostly the laser frequency difference and we
therefore observe a histogram of sharp distributions with its compensating
signal tracking exactly the laser frequency difference. After installing 615.6
km fibre (Fig. 3b), each histogram becomes considerably broadened because the
PID has now to work on also rapid and random fibre fluctuation. However, the
peak of each histogram remains at the same angular frequency, as the random
fibre fluctuation does not produce a net drift. We can then determine the
laser frequency drift with high accuracy by increasing the readout time to
just 100 ms, as shown in Fig. 3c, where the compensation rate follows strictly
the frequency offset. This fast readout enables real-time compensation for
laser frequency drift, which is indispensable for long-term operation of TF-
QKD.

Fig. 3d shows the interference results of the channel references at Charlie’s
interfering 50/50 beam-splitter after travelling the 615.6 km quantum channel.
With the PID switched off, the measured optical power oscillates violently
between constructive and destructive extremes due to fast fibre fluctuation.
We extract an average fringe visibility of 97.8 %, which is noticeably worse
than the value of 99.0 % obtained with a single laser serving both the users,
illustrating a small penalty of using truly independent lasers. We extract a
standard deviation of 1.07 kHz for the fibre drift, which is in good agreement
with data extracted from the PID control (not shown) and comparable to those
reported in the literature11, 29, 27, 31. After enabling the PID control, the
interference output is narrowed down to a tight band (green). We extract the
phase angles and plot their distributions as shown in Figs. 3e – 3g. We obtain
almost identical standard deviations of 0.099, 0.096 and 0.097 rad for
different frequency offsets of -2, 0 and +2 kHz, suggesting the PID control is
tolerant to at least 2 kHz detuning. A phase deviation of $0.1$ rad will cause
about 0.5 % drop in the interference visibility, which is acceptable for TF-
QKD. After the PID control on the channel reference, the phase drift of the
$\lambda_{q}$ signals is drastically slowed down, as shown by orange circles
in Fig. 3d. The standard deviation of this drift rate is 0.72 Hz, which is
1500 times slower than the value for the unstabilised channel. We measure an
interference fringe visibility of be 96.8 %, which will cause 1.6 % floor to
the QBER in the phase basis. For detailed information on how the visibility
values were extracted, refer to Section IV in Supplementary.

With the simplex channel stabilisation, we performed two sets of TF-QKD
experiments using the SNS protocol16, 38, 39. In the first set, the users’
channel losses to Charlie are strictly matched while their fibre lengths may
differ by 10 km, which was introduced for compensating the loss by Charlie’s
PM. We ran the SNS protocol for three distances of $403.73$, $518.16$ and
$615.59$ km, with $2.025\times 10^{12}$, $2.475\times 10^{12}$ and
$1.418\times 10^{13}$ total pulses sent respectively. We take the actively
odd-parity pairing (AOPP) method for data post-processing, which can
efficiently reduce the bit-flip error rate of the raw key and have a higher
probability for pairing success than the random ‘two-way classical
communication’ method 38, and use the zigzag approach proposed in Ref. 39 in
the secure key rate (SKR) calculation. The detailed experimental parameters
and results can be found in Supplementary Tables S4-S6. In Fig. 4a, we present
our experimental results (red square) in terms of SKR versus distance together
with the simulation curve (red line). We include also the absolute
repeaterless Pirandola-Laurenza-Ottaviani-Banchi bound 8 (black line), i.e.,
SKC0, which represents the fundamentally maximum rate that an ideal point-
point QKD could achieve and can only be overcome by a repeater-like setup.
With finite-size effects being taken into consideration, we obtain SKR’s of
146.7, 14.38 and 0.32 bit/s for 403.73, 518.16 and 615.59 km, respectively.
They all overcome the SKC0 bound, confirming the repeater-like behavior of our
setup. At 615.6 km, the SKR is 9.70 times above SKC0.

Figure 4: Secure key rate (SKR) simulations and results. The AOPP-SNS TF-QKD
with finite size effects was implemented in the experiments. Two sets of
experimental data are included. Symmetric case (squares): The users’ losses to
Charlie are strictly matched while their fibre lengths may differ by 10 km;
Asymmetric case (triangles): Bob’s fibre length is fixed at 253.78 km. The
green dashed line indicates the expected SKR when the asymmetry to Bob’s
253.78 km fibre is treated by just adding attenuation. A fibre attenuation
coefficient of 0.168 dB km-1 is adopted for calculating the SKR simulation
(red line) and the absolute repeaterless SKC0 bound (black line) for an ideal
point-point QKD setup operating at 500 MHz.

To further demonstrate the robustness of our open channel scheme, we explore
the capability of our setup supporting asymmetric fibre links. With Bob’s
fibre fixed at $253.78$ km, we ran experiments over two different distances of
$201.87$ and $153.45$ km between Alice and Charlie, representing a link
asymmetry of $51.91$ and $100.33$ km, respectively. For fair assessment, we
use an identical parameter set and compensate the extra loss asymmetry by
adding $8.13$ dB attenuation to the $153.45$ km link. During optimisation of
the parameter set, we apply mathematical constraint that need to be satisfied
for the security of asymmetric SNS protocol40 and introduce a new constraint
for the intensities of both decoy states to guarantee a high interference
visibility at Charlie. The experimental results are shown in Fig. 4 (green
triangles). We extract respective finite-size SKR’s of $50.75$ and $46.30$
bit/s for the asymmetries of $51.91$ km and $100.33$ km, with a minor
deterioration by extra 48 km asymmetry. This result improves considerably over
the current asymmetry record of 22 km 30, while most setups had to keep
channels strictly matched down to meters 21, 22, 27, 31. Additionally, our
result illustrates also the importance of parameter optimization for
asymmetric links, as the obtained SKR’s are thrice higher than the rate (green
dashed line) expected if we just add attenuation to balance the fibre
disparity.

Table 1: A selection of recent state-of-the-art TF-QKD experiments and comparison with this work. All previous long-haul setups use optical frequency dissemination technologies, including homodyne/heterodyne optical phase locked loop (OPLL)21, 22, 27, 30, 31, time-frequency metrology23, 26, 32 and optical injection locking 25, 28, to synchronise the users’ lasers with the reference optical frequency delivered via a service fibre that is as long as the quantum fibre (see Fig. 1a). The subsequent twin-field phase can be either actively stabilised 27, 30, 22, 31 or reconciled through post-selection at the data processing stage 25, 29, 32, though the latter approach does not support NPP-TF-QKD protocols. Among active schemes, using a second wavelength 27, 30 can suppress double Rayleigh scattering noise and increase the stabilisation bandwidth, while further introduction of inter-wavelength coherence30 enables support for asymmetric fibre channels. The X-basis quantum bit error rate (QBER) is listed just for experiments that adopted the SNS protocol for fair comparison.  Experiment |  | Quantum
---
Fibre
| Service
---
Fibre
| Frequency
---
Dissemination
| Phase
---
Compen-
sation
| Number of
---
wavelengths
| Inter-
---
wavelength
Coherence
| X-Basis
---
QBER
| Chen et al.32,
---
2022
658.7 km | 500 km |  | Time-freq.
---
metrology
Passive | 1 | n/a |  $\sim$5.0 %
| Wang et al.31,
---
2022
833.8 km | 833.8 km |  | Homodyne
---
OPLL
Active | 1 | n/a | n/a
| Pittaluga et al.27,
---
2021
605.2 km | 611.4 km |  | Heterodyne
---
OPLL
Active | 2 | No | 5.41 %
| Clivati et al.30,
---
2022
206 km | 206 km |  | Heterodyne
---
OPLL
Active | 2 | Yes | n/a
| This work
---
615.6 km | Not needed | Not needed | Active | 2 | Yes | 4.75 %

We compare our open scheme with recent experiments that adopted the closed MZI
configuration. As SKR’s and distances are directly affected by the detector
performance and/or the clock frequency, the relevant parameter to compare here
is the quantum bit error rate (QBER) arising from the interfering twin-field
signals that went through TF-QKD’s phase randomisation process. Based on this
criteria, we list in Table 1 the X-basis QBER for experiments that adopted
also the SNS protocol. Within the margin of error, our system gives even a
slightly better QBER of 4.75 % than the other setups 27, 32, showing no
performance degradation from using truly independent lasers between an open
quantum channel.

Discussion. We have shown for the first time the capability of stabilising the
phase of a simplex quantum link without resorting to a closed interferometer-
type configuration. With the open-channel stabilisation technique we are able
to achieve a simple and robust TF-QKD setup that can drastically ease fibre
provision and route planning for future deployment. The technique could be
adapted to enable free-space quantum experiments involving single-photon
interference between remote light sources, including free-space TF-QKD.
Moreover, its demonstrated frequency tolerance makes it possible to use less-
demanding lasers, e.g., these lasers41, 42 that reference to absolute atomic
or molecular transitions and feature typically 1 kHz linewidth, stimulating
further simplification in TF-QKD setups. We believe our technique is
applicable to phase-based quantum applications in general, including quantum
repeaters 10, single photon entanglement distribution43 and quantum internet
44.

## Methods

Ultra-stable lasers. The ultra-stable lasers were manufactured by MenloSystems
(Model: ORS-Cubic). Each laser emits at a wavelength of 1550.12 nm and
features a sub-Hz short-term linewidth thanks to its use of Pound-Drever-Hall
(PDH) technique for locking to a cavity with a fineness of 250000 and a free
spectral range (FSR) of 3 GHz. In the PDH locking path there is an extra phase
modulator which is driven at a base frequency of 300 MHz and allows fine
adjustment of the laser frequency with a step size of 1 mHz. We measured the
two lasers to have respective frequency drift rates of 110.4 mHz s-1 and 92.5
mHz s-1 in the same direction, and their differential frequency drifts about
1500 Hz per day. During initial characterisation of the TF-QKD setup, the
frequency difference ($\Delta\nu$) between the lasers was monitored through
their beating note recorded by a photodiode and can be precisely set via
adjusting the modulation frequency to the PM in one laser. This laser
frequency drift can easily be corrected for by our photon-counting-based FPGA
PID controller, so the offset monitoring by the photodiode is unnecessary
during TF-QKD experiments. Our laser frequency feedback will work even when
they are installed in separated locations.

Coherent frequency comb. We generate the electro-optic frequency comb by
passing the continuous-wave laser through a phase modulator that is driven by
a stable microwave source with its power carefully set. Driving at 25 GHz, we
obtain a total of 13 comb lines between 1548.9 nm to 1551.3 nm as shown in
Fig. 2a. The comb lines of 1549.72 nm ($\lambda_{q}$) and 1550.52 nm
($\lambda_{c}$) are selected as the quantum signal and the channel reference
respectively. Their spacing of 0.8 nm (100 GHz) compatible with the ITU G694.1
standard DWDM grid and allows convenient spectral filtering and wavelength
routing. After spectral filtering, each comb line has an output power of
$\geq$300 $\mu$W and channel isolation of $>$55 dB, both sufficient for TF-QKD
encoding.

Protocol. In this experiment, we adopt a 4-intensity SNS-TF-QKD protocol with
actively odd-parity pairing (AOPP) 38 for the data post-processing, with
finite-size effects being taken into account. We describe the theory of
asymmetric protocol 40 and mention that it also applies to the symmetric case
when Alice and Bob have an identical loss to Charlie and use the same values
for their source parameters.

In this protocol, Alice and Bob repeat the following process $N_{\text{tot}}$
times to obtain a string of binary bits. In each time window, Alice (Bob)
randomly decides whether it is a decoy window with probability $p_{Ax}$
($p_{Bx}$) or a signal window with probability $1-p_{Ax}$ ($1-p_{Bx}$). If it
is a signal window, Alice (Bob) randomly prepares a phase-randomized weak
coherent state (WCS) with intensity $\mu_{Az}$ ($\mu_{Bz}$) and decides
whether to send it or not, with probabilities $\epsilon_{A}$ ($\epsilon_{B}$)
and $1-\epsilon_{A}$ ($1-\epsilon_{B}$), respectively. For the decisions of
not-sending in the signal windows, Alice (Bob) denotes them as bit 0 (1), and
for the decisions of sending, Alice (Bob) denotes them as bit 1 (0). If a
decoy window is chosen, Alice (Bob) randomly prepares phase-randomized WCS
with intensities $\mu_{A0}$ ($\mu_{B0}$), $\mu_{A1}$ ($\mu_{B1}$) or
$\mu_{A2}$ ($\mu_{B2}$) with respective probabilities $1-p_{A1}-p_{A2}$
($1-p_{B1}-p_{B2}$), $p_{A1}$ ($p_{B1}$) and $p_{A2}$ ($p_{B2}$). As was
proven in Ref. 40, in order to main the security of the protocol, the
asymmetric source parameters should satisfy the following mathematical
constraint

$\displaystyle\frac{\mu_{A1}}{\mu_{B1}}=\frac{\epsilon_{A}(1-\epsilon_{B})\mu_{Az}e^{-\mu_{Az}}}{\epsilon_{B}(1-\epsilon_{A})\mu_{Bz}e^{-\mu_{Bz}}}.$
(2)

Note that this requirement is automatically met for the symmetric protocol,
and its purpose is to guarantee the users’ raw key free from systematic bias.
After the preparation stage, Alice and Bob send their pulses to the middle
untrusted node, Charlie, who performs interference measurements and announces
publicly which detector clicks. The detection events which one and only one
detector clicks are taken as effective events. For time windows determined by
both Alice and Bob to be a signal window, which are labelled as Z windows,
Alice and Bob get two $n_{t}$ bits of raw key strings comprised by the
corresponding bits from effective events. The bit-flip error rate of these two
strings is denoted as $E_{z}$.

Events in time windows determined by both Alice and Bob to be a decoy window,
which are labelled as X windows, are used to perform the security analysis. In
X windows where Alice and Bob choose intensities $\mu_{A1}$ and $\mu_{B1}$,
respectively, the phase information of their WCSs would be publicly announced
and post-selected based on the following criteria

$\displaystyle|\theta_{A1}-\theta_{B1}|\leq\frac{2\pi}{M}\quad\quad\quad\text{or}\quad\quad\quad|\theta_{A1}-\theta_{B1}-\pi|\leq\frac{2\pi}{M},$
(3)

where $\theta_{A1}$ and $\theta_{B1}$ are the private phases of Alice’s and
Bob’s pulses respectively and $M$ is the number of phase slices.

The AOPP method is used to reduce the errors of raw key strings before the
error correction and privacy amplification processes. In AOPP, Bob first
actively pairs his bits 0 with bits 1 of the raw key string and announces the
pairing information to Alice. Alice performs the same pairing accordingly and
they then compare the parity of pairs. They discard both bits in the pair if
the announced parities are different and keep the first bit of the pairs if
the parities are the same. The users now use the remaining bits to form a new
shorter string $n_{t}^{\prime}$ with dramatically reduced bit-flip error rate
$E_{z}^{\prime}$, from which they will extract the final key.

Next we briefly show how to extract the information of single-photon states,
which constitutes the final key rate formula, from X-window events, through
decoy-state analysis. We denote the counting rate of sources $\kappa\zeta$ in
X windows by $S_{\kappa\zeta}$, which is the ratio of the number of
corresponding effective events to the number of respective pulses sent out by
Alice and Bob. These values can be measured in the experiment. Note that a
statistical fluctuation analysis should be considered here as part of the
finite-size effects, with more details being presented in Ref. 45. Then we use
the decoy-state method to deduce the counting rate of single-photon states
which either Alice or Bob actually sends out a single photon from WCSs, which
are 40,

$\displaystyle\langle\underline{y_{10}}\rangle$
$\displaystyle=\frac{\mu_{A2}^{2}e^{\mu_{A1}}\langle\underline{S}_{\mu_{A1}\mu_{B0}}\rangle-\mu_{A1}^{2}e^{\mu_{A2}}\langle\overline{S}_{\mu_{A2}\mu_{B0}}\rangle-(\mu_{A2}^{2}-\mu_{A1}^{2})\langle\overline{S}_{\mu_{A0}\mu_{B0}}\rangle}{\mu_{A2}\mu_{A1}(\mu_{A2}-\mu_{A1})},$
(4) $\displaystyle\langle\underline{y_{01}}\rangle$
$\displaystyle=\frac{\mu_{B2}^{2}e^{\mu_{B1}}\langle\underline{S}_{\mu_{A0}\mu_{B1}}\rangle-\mu_{B1}^{2}e^{\mu_{B2}}\langle\overline{S}_{\mu_{A0}\mu_{B2}}\rangle-(\mu_{B2}^{2}-\mu_{B1}^{2})\langle\overline{S}_{\mu_{A0}\mu_{B0}}\rangle}{\mu_{B2}\mu_{B1}(\mu_{B2}-\mu_{B1})},$
(5)

respectively, where the notations $\langle\underline{\cdot}\rangle$ and
$\langle\overline{\cdot}\rangle$ denote the lower and the upper bound of the
corresponding expected values, respectively, with a composable definition of
security and the Chernoff bound being applied. Their detailed explanations and
expressions can be found in the Ref. 46. Then the lower bound of the expected
value of the counting rate of untagged bits, which is the number of bits
generated through effective events when the users actually send out single-
photon states in Z windows, is given by 40

$\displaystyle\langle\underline{y_{1}}\rangle=\frac{\mu_{A1}}{\mu_{A1}+\mu_{B1}}\langle\underline{y_{10}}\rangle+\frac{\mu_{B1}}{\mu_{A1}+\mu_{B1}}\langle\underline{y_{01}}\rangle$
(6)

and the lower bound of the expected value of the number of untagged bits is

$\displaystyle\langle\underline{n_{1}}\rangle=N_{\text{ZZ}}\left[\epsilon_{A}(1-\epsilon_{B})\mu_{Az}e^{-\mu_{Az}}\langle\underline{y_{10}}\rangle+\epsilon_{B}(1-\epsilon_{A})\mu_{Bz}e^{-\mu_{Bz}}\langle\underline{y_{01}}\rangle\right],$
(7)

where $N_{\text{ZZ}}=N_{\text{tot}}(1-p_{Ax})(1-p_{Bx})$ is the number of
pulses Alice and Bob both choose signal windows. According to Ref. 40, so long
as Eq. 2 is satisfied, the phase-flip error rate of untagged bits in Z windows
can be calculated from the bit-flip error rate of untagged bits in X windows,
which is written as

$\displaystyle\langle\overline{e_{1}^{ph}}\rangle=\frac{\langle\overline{T}_{XX}\rangle-1/2e^{-\mu_{A1}-\mu_{B1}}\langle\underline{S}_{\mu_{A0}\mu_{B0}}\rangle}{e^{-\mu_{A1}-\mu_{B1}}(\mu_{A1}+\mu_{B1})\langle\underline{y_{1}}\rangle}$
(8)

where $T_{XX}$ is the ratio of the number of corresponding error events over
the number of total pulses with intensities $\mu_{A1}$ and $\mu_{B1}$ sent out
in X windows.

The secret key rate (SKR) of AOPP with finite-size effects is given by

$\displaystyle
R=\frac{1}{N_{\text{tot}}}\\{n_{1}^{\prime}[1-h(e_{1}^{\prime\text{ph}})]-fn_{t}^{\prime}h(E_{z}^{\prime})-\Delta\\},$
(9)

where $h(x)=-x\text{log}_{2}x-(1-x)\text{log}_{2}(1-x)$ is the binary Shannon
entropy. $f=1.1$ is the error correction efficiency factor.
$\Delta=2\text{log}_{2}(2/\epsilon_{\text{cor}})+4\text{log}_{2}(1/\sqrt{2}\epsilon_{\text{PA}}\hat{\epsilon})$
is the finite-size correction term, with
$\epsilon_{\text{cor}}{\color[rgb]{0,0,0}=10^{-10}}$,
$\epsilon_{\text{PA}}{\color[rgb]{0,0,0}=10^{-10}}$ and
$\hat{\epsilon}{\color[rgb]{0,0,0}=10^{-10}}$ being the failure probabilities
for error correction, privacy amplification and the coefficient of the
smoothing parameter, respectively. $n_{1}^{\prime}$ and
$e_{1}^{\prime\text{ph}}$ are the number of untagged bits and their phase-flip
error rate, respectively, after AOPP process. Here we adopt a zigzag approach
proposed in Ref. 39 in order to obtain higher key rates and take all the
finite-key effects efficiently, the same as the calculation method applied in
experimental reference 28, 29, 32. For simplicity, we do not list the
calculation processes here, with all details can be found in the cited papers.

## Acknowledgement

We thank X. B. Wang for helpful discussions on the SNS-AOPP TF-QKD protocol.
Z. L. acknowledges support by the National Natural Science Foundation of China
(Grant number 62105034).

## References

  * 1 Bennett, C. H. & Brassard, G.  Quantum cryptography: Public key distribution and coin tossing.  _Theor. Comput. Sci._ 560, 7–11 (2014).
  * 2 Gisin, N., Ribordy, G., Tittel, W. & Zbinden, H.  Quantum cryptography.  _Rev. Mod. Phys._ 74, 145–195 (2002).
  * 3 Stucki, D. _et al._ Long-term performance of the SwissQuantum quantum key distribution network in a field environment.  _New J. Phys._ 13, 123001 (2011).
  * 4 Sasaki, M. _et al._ Field test of quantum key distribution in the tokyo qkd network.  _Opt. Express_ 19, 10387–10409 (2011).
  * 5 Dynes, J. F. _et al._ Cambridge quantum network.  _npj Quant. Inf._ 5, 101 (2019).
  * 6 Chen, Y.-A. _et al._ An integrated space-to-ground quantum communication network over 4,600 kilometres.  _Nature_ 589, 214 – 219 (2021).
  * 7 Takeoka, M., Guha, S. & Wilde, M. M.  Fundamental rate-loss tradeoff for optical quantum key distribution.  _Nat. Commun._ 5, 5235 (2014).
  * 8 Pirandola, S., Laurenza, R., Ottaviani, C. & Banchi, L.  Fundamental limits of repeaterless quantum communications.  _Nat. Commun._ 8, 15043 (2017).
  * 9 Briegel, H.-J., Dür, W., Cirac, J. I. & Zoller, P.  Quantum repeaters: The role of imperfect local operations in quantum communication.  _Phys. Rev. Lett._ 81, 5932–5935 (1998).
  * 10 Duan, L.-M., Lukin, M. D., Cirac, J. I. & Zoller, P.  Long-distance quantum communication with atomic ensembles and linear optics.  _Nature_ 414, 413 – 418 (2001).
  * 11 Lucamarini, M., Yuan, Z. L., Dynes, J. F. & Shields, A. J.  Overcoming the rate-distance limit of quantum key distribution without quantum repeaters.  _Nature_ 557, 400–403 (2018).
  * 12 Lo, H.-K., Curty, M. & Qi, B.  Measurement-device-independent quantum key distribution.  _Phys. Rev. Lett._ 108, 130503 (2012).
  * 13 Braunstein, S. L. & Pirandola, S.  Side-channel-free quantum key distribution.  _Phys. Rev. Lett._ 108, 130502 (2012).
  * 14 Tamaki, K., Lo, H.-K., Wang, W. & Lucamarini, M.  Information theoretic security of quantum key distribution overcoming the repeaterless secret key capacity bound (2018).  ArXiv: 1805.05511.
  * 15 Ma, X., Zeng, P. & Zhou, H.  Phase-matching quantum key distribution.  _Phys. Rev. X_ 8, 031043 (2018).
  * 16 Wang, X.-B., Yu, Z.-W. & Hu, X.-L.  Twin-field quantum key distribution with large misalignment error.  _Phys. Rev. A_ 98, 062323 (2018).
  * 17 Lin, J. & Lütkenhaus, N.  Simple security analysis of phase-matching measurement-device-independent quantum key distribution.  _Phys. Rev. A_ 98, 042332 (2018).
  * 18 Curty, M., Azuma, K. & Lo, H.-K.  Simple security proof of twin-field type quantum key distribution protocol.  _npj Quant. Inf._ 5, 64 (2019).
  * 19 Cui, C. _et al._ Twin-field quantum key distribution without phase postselection.  _Phys. Rev. Appl._ 11, 034053 (2019).
  * 20 Currás-Lorenzo, G. _et al._ Tight finite-key security for twin-field quantum key distribution.  _npj Quant. Inf._ 7, 22 (2021).
  * 21 Minder, M. _et al._ Experimental quantum key distribution beyond the repeaterless rate-loss limit.  _Nat. Photonics_ 13, 334–338 (2019).
  * 22 Wang, S. _et al._ Beating the fundamental rate-distance limit in a proof-of-principle quantum key distribution system.  _Phys. Rev. X_ 9, 021046 (2019).
  * 23 Liu, Y. _et al._ Experimental twin-field quantum key distribution through sending or not sending.  _Phys. Rev. Lett._ 123, 100505 (2019).
  * 24 Zhong, X., Hu, J., Curty, M., Qian, L. & Lo, H.-K.  Proof-of-principle experimental demonstration of twin-field type quantum key distribution.  _Phys. Rev. Lett._ 123, 100506 (2019).
  * 25 Fang, X.-T. _et al._ Implementation of quantum key distribution surpassing the linear rate-transmittance bound.  _Nat. Photonics_ 14, 422–425 (2020).
  * 26 Chen, J.-P. _et al._ Sending-or-not-sending with independent lasers: Secure twin-field quantum key distribution over 509 km.  _Phys. Rev. Lett._ 124, 070501 (2020).
  * 27 Pittaluga, M. _et al._ 600-km repeater-like quantum communications with dual-band stabilization.  _Nat. Photonics_ 15, 530–535 (2021).
  * 28 Liu, H. _et al._ Field test of twin-field quantum key distribution through sending-or-not-sending over 428 km.  _Phys. Rev. Lett._ 126, 250502 (2021).
  * 29 Chen, J.-P. _et al._ Twin-field quantum key distribution over a 511 km optical fibre linking two distant metropolitan areas.  _Nat. Photonics_ 15, 570–575 (2021).
  * 30 Clivati, C. _et al._ Coherent phase transfer for real-world twin-field quantum key distribution.  _Nat. Commun._ 13, 157 (2022).
  * 31 Wang, S. _et al._ Twin-field quantum key distribution over 830-km fibre.  _Nat. Photonics_ 16, 154 – 161 (2022).
  * 32 Chen, J.-P. _et al._ Quantum key distribution over 658 km fiber with distributed vibration sensing.  _Phys. Rev. Lett._ 128, 180502 (2022).
  * 33 Toliver, P. _et al._ Experimental investigation of quantum key distribution through transparent optical switch elements.  _IEEE Photon. Technol. Lett._ 15, 1669–1671 (2003).
  * 34 Tang, Y.-L. _et al._ Measurement-device-independent quantum key distribution over untrustful metropolitan network.  _Phys. Rev. X_ 6, 011024 (2016).
  * 35 Zhong, X., Wang, W., Mandil, R., Lo, H.-K. & Qian, L.  Simple multiuser twin-field quantum key distribution network.  _Phys. Rev. Appl._ 17, 014025 (2022).
  * 36 Xie, Y.-M. _et al._ Breaking the rate-loss bound of quantum key distribution with asynchronous two-photon interference.  _PRX Quantum_ 3, 020315 (2022).
  * 37 Zeng, P., Zhou, H., Wu, W. & Ma, X.  Quantum key distribution surpassing the repeaterless rate-transmittance bound without global phase locking (2022).  ArXiv: 2201.04300.
  * 38 Xu, H., Yu, Z.-W., Jiang, C., Hu, X.-L. & Wang, X.-B.  Sending-or-not-sending twin-field quantum key distribution: Breaking the direct transmission key rate.  _Phys. Rev. A_ 101, 042330 (2020).
  * 39 Jiang, C., Hu, X.-L., Xu, H., Yu, Z.-W. & Wang, X.-B.  Zigzag approach to higher key rate of sending-or-not-sending twin field quantum key distribution with finite-key effects.  _New J. Phys._ 22, 053048 (2020).
  * 40 Hu, X.-L., Jiang, C., Yu, Z.-W. & Wang, X.-B.  Sending-or-not-sending twin-field protocol for quantum key distribution with asymmetric source parameters.  _Phys. Rev. A_ 100, 062337 (2019).
  * 41 Maurice, V. _et al._ Miniaturized optical frequency reference for next-generation portable optical clocks.  _Opt. Express_ 28, 24708–24720 (2020).
  * 42 Talvard, T. _et al._ Enhancement of the performance of a fiber-based frequency comb by referencing to an acetylene-stabilized fiber laser.  _Opt. Express_ 25, 2259–2269 (2017).
  * 43 Caspar, P. _et al._ Heralded distribution of single-photon path entanglement.  _Phys. Rev. Lett._ 125, 110506 (2020).
  * 44 Pompili, M. _et al._ Realization of a multinode quantum network of remote solid-state qubits.  _Science_ 372, 259–264 (2021).
  * 45 Yu, Z.-W., Hu, X.-L., Jiang, C., Xu, H. & Wang, X.-B.  Sending-or-not-sending twin-field quantum key distribution in practice.  _Sci.Rep._ 9, 1–8 (2019).
  * 46 Jiang, C., Yu, Z.-W., Hu, X.-L. & Wang, X.-B.  Unconditional security of sending or not sending twin-field quantum key distribution with finite pulses.  _Phys. Rev. Appl._ 12, 024061 (2019).