††thanks: These authors contributed equally to this work††thanks: These
authors contributed equally to this work

# Breaking the Rate-Loss Bound of Quantum Key Distribution with Asynchronous
Two-Photon Interference

Yuan-Mei Xie  Yu-Shuo Lu  Chen-Xun Weng  Xiao-Yu Cao  Zhao-Ying Jia  Yu Bao
Yang Wang  National Laboratory of Solid State Microstructures, School of
Physics and Collaborative Innovation Center of Advanced Microstructures,
Nanjing University, Nanjing 210093, China.  Yao Fu  MatricTime Digital
Technology Co. Ltd., Nanjing 211899, China  Hua-Lei Yin<EMAIL_ADDRESS>National Laboratory of Solid State Microstructures, School of Physics and
Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China.  Zeng-Bing Chen<EMAIL_ADDRESS>National
Laboratory of Solid State Microstructures, School of Physics and Collaborative
Innovation Center of Advanced Microstructures, Nanjing University, Nanjing
210093, China.  MatricTime Digital Technology Co. Ltd., Nanjing 211899, China

###### Abstract

Twin-field quantum key distribution can overcome the secret key capacity of
repeaterless quantum key distribution via single-photon interference. However,
to compensate for the channel fluctuations and lock the laser fluctuations,
the techniques of phase tracking and phase locking are indispensable in
experiment, which drastically increase experimental complexity and hinder
free-space realization. We herein present an asynchronous measurement-device-
independent quantum key distribution protocol that can surpass the secret key
capacity even without phase tracking and phase locking. Leveraging the concept
of time multiplexing, asynchronous two-photon Bell-state measurement is
realized by postmatching two interference detection events. For a 1 GHz
system, the new protocol reaches a transmission distance of 450 km without
phase tracking. After further removing phase locking, our protocol is still
capable of breaking the capacity at 270 km. Intriguingly, when using the same
experimental techniques, our protocol has a higher key rate than the phase-
matching-type twin-field protocol. In the presence of imperfect intensity
modulation, it also has a significant advantage in terms of the transmission
distance over the sending-or-not-sending type twin-field protocol. With high
key rates and accessible technology, our work provides a promising candidate
for practical scalable quantum communication networks.

##  I Introduction

Quantum key distribution (QKD) [1, 2] allows the distribution of information-
theoretically secure keys guaranteed by quantum mechanical limits. However,
experimental implementations of QKD always deviate from the theoretical
assumptions used in security proofs, leading to various quantum hacking
attacks [3, 4, 5, 6, 7]. Fortunately, all security loopholes on the detection
side are closed by measurement-device-independent QKD (MDIQKD) [8], which
introduces an untrusted third party, Charlie, to perform two-photon Bell-state
measurement in the intermediate node. Thus far, MDIQKD has made many
theoretical and experimental breakthroughs [9, 10, 11, 12, 13, 14, 15, 16, 17,
18, 19, 20, 21, 22, 23, 24, 25].

However, because a significant number of photons are inevitably lost in the
channel, the key rate of most QKD protocols, including MDIQKD, is rigorously
limited by the secret key capacity of repeaterless QKD [26, 27, 28, 29, 30],
more precisely, the Pirandola–Laurenza–Ottaviani–Banchi (PLOB) bound
$R=-\log_{2}(1-\eta)$ [28], where $R$ is the secret key rate and $\eta$ is the
total channel transmittance between the two users. Utilizing single-photon
interference, twin-field QKD (TFQKD) [31] and its variants [32, 33, 34, 35,
36, 37, 38, 39, 40, 41, 42, 43], such as sending-or-not-sending QKD (SNSQKD)
[33] and phase-matching QKD (PMQKD) [32, 40], have been proposed to increase
the key rate to $O(\sqrt{\eta})$, overcoming the PLOB bound. Since then, they
have aroused widespread concern. For example, remarkable progress has been
made in the theory of finite key analysis [44, 45, 46, 47]. Additionally, some
notable experimental implementations have been reported [48, 49, 50, 51, 52,
53, 54, 55, 56, 57, 58, 59, 60]. The longest transmission distance of more
than 830 km was recently achieved in the laboratory through optical fibers
[60].

Because the phase evolution of the twin fields is sensitive to both channel
length drift and frequency difference between two user lasers, phase-tracking
and phase-locking techniques are vital for twin-field-type protocols. Phase
tracking is used to compensate for the phase fluctuation on the channels
connecting the users to Charlie, where bright reference light pulses are sent
to measure the phase fluctuation. However, the performance of the system is
severely affected because the bright light causes scattering noise and
occupies the time of the quantum signal [48, 50, 51, 52, 53, 54, 56]. Phase
tracking also imposes a high counting requirement on the detectors. Phase
locking is utilized to lock the frequency and the phase of the two users’
lasers. There are several types of phase-locking techniques, including laser
injection [17], optical phase-locked loop [61, 62], and time-frequency
dissemination technology [51, 63]. However, they all require additional
channels between users to transfer the reference light. In addition, laser
injection may introduce security risks [64, 65], and the optical phase-locked
loop and the time-frequency dissemination technology both require complicated
feedback systems. An ingenious replacement for phase locking and phase
tracking in TFQKD experiments [49, 55] is the plug-and-play type construction
[34], but it is susceptible to Trojan horse attacks [66, 67, 68, 69].
Furthermore, free-space realization of QKD in various types of channels,
including the atmosphere [70, 71], seawater [72], and satellite-to-ground
channels [73, 74, 75, 76], is essential to establishing a global-scale quantum
networks [77, 78]. However, deploying phase-tracking and phase-locking
techniques in free space faces some technical challenges. For example, phase
locking requires additional channels between the two users. In summary, these
technical requirements increase experimental complexity, may incur security
risks, and hinder the implementation of TFQKD in commerce and free space.

In this work, we propose an asynchronous-MDIQKD protocol to remove these
requirements. It has a simple hardware implementation while enjoying a high
key rate. Recall that in the conventional time-bin encoding MDIQKD scheme
[79], coincidence detection of two neighboring time bins is required,
resulting in the $O({\eta})$ scaling of the key rate [30]. Intriguingly, we
observe that the two neighboring time bins can actually be decoupled.
Specifically, the requirement for coincidence detection of two neighboring
time bins is unnecessary. By utilizing time multiplexing, we match two
detected time bins that are phase-correlated to establish an asynchronous two-
photon Bell state, and the key rate is enhanced to $O(\sqrt{\eta})$. This can
be regarded as breaking the recently proposed linear boundary of dual-rail
protocols [30]. We highlight the intrinsic differences between time-bin
encoding MDIQKD and polarization encoding MDIQKD—time multiplexing is possible
solely for time-bin encoding, where there are infinite time modes. For
polarization encoding, only two orthogonal modes exist.

Because the differential phase evolution of each time bin is approximately
equal in a short time interval, we can postmatch two phase-related time bins
without the phase-tracking and phase-locking techniques at the cost of a
slight increase in the interference error rate. We show that after removing
these techniques, the misalignment angle between the two users is
approximately $0.1\pi$ within 1 $\mu$s with simple commercially available
instruments, giving rise to an interference error rate of approximately
$2.4\%$. In this case, our protocol can beat the PLOB bound at a distance of
approximately 270 km, achieving a reasonable trade-off between practicality
and performance. By circumventing the need for phase locking and phase
tracking, our protocol can directly utilize techniques derived from free-space
MDIQKD [70], thereby facilitating QKD to break the secret key capacity in free
space. Moreover, when the imperfection in light intensity modulation is
considered [80], our protocol achieves a longer transmission distance and
higher key rates compared with SNSQKD with actively odd-parity pairing (AOPP)
[81, 82] and PMQKD [40] when using the same experimental techniques.

Figure 1: Basic idea of the adaptive MDIQKD scheme [83] and this work. (a) In
the adaptive MDIQKD scheme, Alice and Bob send $m$ single-photon pulses to
Charlie using spatial multiplexing. Charlie applies quantum nondemolition
measurement (QND) to confirm the arrival of pulses, matches the arriving
pulses using optical switches (SW), and performs two-photon Bell measurements
(BM) on the pairs. (b) In our asynchronous-MDIQKD protocol, Alice and Bob send
$N$ pulses to Charlie to perform single-photon interference (SPI), and a two-
photon Bell state is obtained by postmatching two successful SPI events.

##  II asynchronous-MDIQKD protocol

In this section, we first introduce the basic idea of the asynchronous-MDIQKD
protocol and then present a detailed protocol description.

###  II.1 Protocol topology

Our proposal is motivated by the adaptive MDIQKD scheme [83], as shown in Fig.
1(a). In this scheme, the idea of spatial multiplexing is leveraged, where $m$
optical pulses in single-photon states pass through $m$ channels. When
$m\sqrt{\eta}\geq 1$, one or more single photons arrive at Charlie from Alice
and Bob each, with unitary probability, resulting in $O(\sqrt{\eta})$ scaling
with the key rate.

In the time-bin encoding MDIQKD [79], the information is encoded in the
relative phase between the optical modes in two separate time bins $i$, $j$,
with $i=2t-1$, $j=2t$, where $t$ is an integer. Let ${\lvert
1,0\rangle}^{ij}={\lvert 1\rangle}^{i}{\lvert 0\rangle}^{j}$ denote the
quantum state, where there is one photon in time bin $i$ and zero photon in
time bin $j$. Alice and Bob prepare quantum states ${\lvert+z\rangle}={\lvert
1,0\rangle}^{i,j}$, ${\lvert-z\rangle}={\lvert 0,1\rangle}^{i,j}$, and
${\lvert\pm x\rangle}=({\lvert 1,0\rangle}^{i,j}\pm{\lvert
0,1\rangle}^{i,j})/\sqrt{2}$, and send them to Charlie for Bell-state
measurement, where ${\lvert\pm z\rangle}$ are the eigenstates in the $Z$
basis, and ${\lvert\pm x\rangle}$ are the eigenstates in the $X$ basis. Note
that for the Bell states announced by Charlie,
${\lvert\psi^{\pm}\rangle}=1/\sqrt{2}({\lvert 1,0\rangle}^{i,j}_{a}{\lvert
0,1\rangle}^{i,j}_{b}\pm{\lvert 0,1\rangle}^{i,j}_{a}{\lvert
1,0\rangle}^{i,j}_{b})$, where subscript $a$ represents mode “Alice” and $b$
represents mode “Bob”, we can decouple $i$ and $j$ as two independent
variables [84], making time multiplexing possible.

The basic idea of our asynchronous-MDIQKD protocol is illustrated in Fig.
1(b). $N$ pairs of optical pulses are sent in $N$ time bins. In each time bin,
single-photon interference is performed, and $n\approx N\sqrt{\eta}$
successful detection events are obtained. By time multiplexing, Alice and Bob
can postmatch successful detection events of two time bins that are phase-
correlated to establish two-photon entangled states
${\lvert\psi^{\pm}\rangle}$, leading to the $O(\sqrt{\eta})$ decay of the key
rate.

Figure 2: Schematic of $\mathit{case~{}1}$ and $\mathit{case~{}2}$. Each time
bin is represented by a lattice, and detection events are painted in deep
purple. $\mathit{case~{}1}$: a detection event around which other detection
events can be found within $T_{c}$; $\mathit{case~{}2}$: a detection event
around which there are no other detection events within $T_{c}$. $N_{T}$ is
the total number of pulses sent within $T_{c}$, which is proportional to the
system repetition rate.

We consider the case in which Alice and Bob always match two successful
detection events within a short time interval $T_{c}$, where $T_{c}$ is on the
order of microseconds. Hereafter, we abbreviate a successful detection event
to a detection event for simplicity. As shown in Fig. 2, the detection events
can be classified into two cases: $\mathit{case~{}1}$ and $\mathit{case~{}2}$.
The $\mathit{case~{}1}$ event indicates that other detection events can be
found around it within $T_{c}$, and the differential phase evolution of
detection events in $T_{c}$ are unknown but almost the same. The
$\mathit{case~{}2}$ event indicates that there are no other detection events
around it within $T_{c}$. After removing phase tracking and phase locking, the
differential phase evolution of each $\mathit{case~{}2}$ event becomes
indeterminate. This means that $\mathit{case~{}2}$ events have no phase
correlations with each other. These events should be carefully handled to
ensure security. For example, Charlie can know the total photon number in each
optical pulse pair sent by Alice and Bob via quantum nondemolition
measurements, and Charlie always lets the joint single-photon be detected as
$\mathit{case~{}2}$ events. Charlie’s operation would not be found by Alice
and Bob. If Alice and Bob discard $\mathit{case~{}2}$ events, the single-
photon pairs cannot be reasonably estimated using the conventional decoy-state
method. Fortunately, a sufficiently small number (one on average) of
$\mathit{case~{}2}$ events will not affect the security of the protocol.

Figure 3: Schematic of the setup for the asynchronous-MDIQKD protocol. Alice
and Bob utilize a narrow-linewidth continuous-wave laser, intensity modulator
(IM), phase modulator (PM), and attenuator (ATT) to prepare phase-randomized
weak coherent pulses with different intensities and phases. Charlie performs
interference measurement with a beam splitter (BS) and single-photon
detectors. Charlie announces the detection events where only the detector
$\mathbf{L}$ or $\mathbf{R}$ clicks.

###  II.2 Protocol description

The schematic of the asynchronous-MDIQKD setup is shown in Fig. 3, and the
details of the protocol are presented as follows.

1\. Preparation. Alice and Bob repeat the first two steps for $N$ rounds to
obtain sufficient data. At each time bin $i\in\\{1,2,\ldots,N\\}$, both phase
$\theta_{a}^{i}$ $\in[0,2\pi)$ and classical bit $r_{a}^{i}\in\\{0,1\\}$ are
randomly chosen by Alice. Alice then prepares a weak coherent pulse ${\lvert
e^{\textbf{i}(\theta_{a}^{i}+r_{a}^{i}\pi)}\sqrt{k_{a}^{i}}\rangle}$ with
probability $p_{k_{a}}$, where
$k_{a}^{i}\in\\{\mu_{a},~{}\nu_{a},~{}\mathbf{o}_{a},~{}\hat{\mathbf{o}}_{a}\\}$
corresponds to the signal, decoy, preserve-vacuum, and declare-vacuum
intensities, respectively
($\mu_{a}>\nu_{a}>\mathbf{o}_{a}=\hat{\mathbf{o}}_{a}=0$). Similarly, Bob
prepares a phase-randomized weak coherent pulse. Alice and Bob send the
corresponding pulses ${\lvert
e^{\textbf{i}(\theta_{a}^{i}+r_{a}^{i}\pi)}\sqrt{k_{a}^{i}}\rangle}$ and
${\lvert e^{\textbf{i}(\theta_{b}^{i}+r_{b}^{i}\pi)}\sqrt{k_{b}^{i}}\rangle}$
($k_{b}^{i}\in\\{\mu_{b},~{}\nu_{b},~{}\mathbf{o}_{b},~{}\hat{\mathbf{o}}_{b}\\}$)
to Charlie via insecure quantum channels.

2\. Measurement. For each time bin $i$, Charlie performs interference
measurement on the two received pulses. Charlie obtains a detection event when
only one detector clicks. He publicly announces whether a detection event is
obtained and which detector clicked. In the following description, we define
$\\{k_{a},~{}k_{b}\\}$ as a detection event when Alice sends intensity
$k_{a}$, and Bob sends $k_{b}$. The compressed notation
$\\{k_{a}^{i}k_{a}^{j},~{}k_{b}^{i}k_{b}^{j}\\}$ indicates
that$\\{k_{a}^{i},~{}k_{b}^{i}\\}$ and $\\{k_{a}^{j},~{}k_{b}^{j}\\}$ are
matched, the first label referring to time bin $i$, and the second to time bin
$j$.

3\. Sifting. Alice and Bob first check the number of $\mathit{case~{}2}$
events. If the number of occurrences of $\mathit{case~{}2}$ is smaller than or
equal to $\Lambda$, the data of $\mathit{case~{}2}$ can be discarded, where
$\Lambda$ is a preset threshold; otherwise, they abort the protocol. For
$\mathit{case~{}1}$ events, when at least either Alice or Bob chooses a decoy
or declare-vacuum intensity, they announce their intensities and phase
information through authenticated channels. They then use the following rules
to randomly match two $\mathit{case~{}1}$ events with a time interval of less
than $T_{c}$.

The unannounced detection events $\\{\mu_{a},~{}\mathbf{o}_{b}\\}$,
$\\{\mu_{a},~{}\mu_{b}\\}$, $\\{\mathbf{o}_{a},~{}\mu_{b}\\}$, and
$\\{\mathbf{o}_{a},~{}\mathbf{o}_{b}\\}$ are used to form data in the $Z$
basis. For these events, Alice randomly matches a time bin $i$ of intensity
$\mu_{a}$ with another time bin $j$ of intensity $\mathbf{o}_{a}$. Alice and
Bob discard detection events that cannot find a matchable peer. Then, Alice
sets her bit value to 0 (1) if $i<j~{}(i>j)$ and informs Bob of the serial
numbers $i$ and $j$. In the corresponding time bins, if Bob chooses
intensities $k_{b}^{\min\\{i,j\\}}=\mu_{b}$ $(\mathbf{o}_{b})$ and
$k_{b}^{\max\\{i,j\\}}=\mathbf{o}_{b}$ $(\mu_{b})$, the bit value is set to 0
(1). Bob announces an event where $k_{b}^{i}$ $=$ $k_{b}^{j}=\mathbf{o}_{b}$
or $\mu_{b}$. Thus, the valid events in the $Z$ basis are
$\\{\mu_{a}\mathbf{o}_{a},~{}\mathbf{o}_{b}\mu_{b}\\}$,
$\\{\mu_{a}\mathbf{o}_{a},~{}\mu_{b}\mathbf{o}_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},~{}\mathbf{o}_{b}\mu_{b}\\}$, and
$\\{\mathbf{o}_{a}\mu_{a},~{}\mu_{b}\mathbf{o}_{b}\\}$.

The detection events $\\{\nu_{a},~{}\nu_{b}\\}$, $\\{o_{a},~{}\nu_{b}\\}$,
$\\{\nu_{a},~{}o_{b}\\}$, $\\{\hat{\mathbf{o}}_{a},o_{b}\\}$, and
$\\{\mathbf{o}_{a},~{}\hat{\mathbf{o}}_{b}\\}$ are used to form data in the
$X$ basis, where
$o_{a(b)}\in\\{\mathbf{o}_{a(b)},~{}\hat{\mathbf{o}}_{a(b)}\\}$. The global
phase of Alice (Bob) at time bin $i$ is defined as
$\varphi^{i}_{a(b)}:=\theta^{i}_{a(b)}+\phi^{i}_{a(b)}$, where
$\phi^{i}_{a(b)}$ is the phase evolution from the channel. The global phase
difference between Alice and Bob at time bin $i$ is
$\varphi^{i}=\varphi_{a}^{i}-\varphi_{b}^{i}$. Alice and Bob randomly choose
two detection events that satisfy $k_{a}^{i}=k_{a}^{j}$, $k_{b}^{i}=k_{b}^{j}$
and $\left|\varphi^{i}-\varphi^{j}\right|=0$ or $\pi$ (experimental techniques
for quantifying $\left|\varphi^{i}-\varphi^{j}\right|$ are discussed later in
Sec. III). They then match the two events as
$\\{k_{a}^{i}k_{a}^{j},~{}k_{b}^{i}k_{b}^{j}\\}$. By calculating the classical
bits $r_{a}^{i}\oplus r_{a}^{j}$ and $r_{b}^{i}\oplus r_{b}^{j}$, Alice and
Bob obtain a bit value in the $X$ basis, respectively. Afterwards, in the $Z$
basis, Bob always flips his bit. In the $X$ basis, Bob flips part of his bits
to correctly correlate them with Alice’s (see Table. 1).

4\. Parameter estimation. Alice and Bob exploit the random bits from the $Z$
basis to form the $n^{z}$-length raw key bit. The remaining bits in the $Z$
basis are used to calculate the bit error rate $E^{z}$. They reveal all bit
values in the $X$ basis to obtain the total number of errors. The decoy-state
method [85, 86] is utilized to estimate the number of vacuum events in the $Z$
basis $s_{0\mu_{b}}^{z}$, number of single-photon pairs $s_{11}^{z}$, bit
error rate in the $X$ basis $e_{11}^{x}$, and phase error rate of single-
photon pairs $\phi_{11}^{z}$ in the $Z$ basis (see Appendix A for details).

_Note_ : To estimate the single-photon component gain of each postmatching
interval, we assume that the single-photon distributions in all detection
events are independent and identical.

5\. Postprocessing. Alice and Bob distill the final keys by using the error
correction algorithm with $\varepsilon_{\rm{cor}}$-correct, and the privacy
amplification algorithm with $\varepsilon_{\rm{sec}}$ -secret. Similar to Ref.
[15], the length of the final secret key $\ell$ with total security
$\varepsilon_{\rm{AMDI}}=\varepsilon_{\rm{sec}}+\varepsilon_{\rm{cor}}$ can be
given by

$\displaystyle\ell=$
$\displaystyle\underline{s}_{0\mu_{b}}^{z}+\underline{s}_{11}^{z}\left[1-H_{2}(\overline{\phi}_{11}^{z})\right]-\lambda_{\rm{EC}}$
(1) $\displaystyle-\log_{2}\frac{2}{\varepsilon_{\rm
cor}}-2\log_{2}\frac{2}{\varepsilon^{\prime}\hat{\varepsilon}}-2\log_{2}\frac{1}{2\varepsilon_{\rm
PA}},$

where $\underline{x}$ and $\overline{x}$ denote the lower and upper bounds of
the observed value $x$, respectively. $\lambda_{\rm{EC}}=n^{z}fH_{2}(E^{z})$
is the amount of information leaked during error correction, where $f$ is the
error correction efficiency, and $H_{2}(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)$ is
the binary Shannon entropy function. $\varepsilon_{\rm cor}$ is the failure
probability of error verification, and $\varepsilon_{\rm PA}$ refers to the
failure probability of privacy amplification. $\varepsilon^{\prime}$ and
$\hat{\varepsilon}$ represent the coefficients when using the chain rules of
smooth min-entropy and max-entropy, respectively. $\varepsilon_{\rm
sec}=2(\varepsilon^{\prime}+\hat{\varepsilon}+2\varepsilon_{e})+\varepsilon_{\beta}+\varepsilon_{0}+\varepsilon_{1}+\varepsilon_{\rm
PA}$, where $\varepsilon_{0}$, $\varepsilon_{1}$ and $\varepsilon_{e}$ are the
failure probabilities of estimating the terms $s_{0\mu_{b}}^{z}$,
$s_{11}^{z}$, and $\phi_{11}^{z}$, respectively.

Table 1: Postprocessing of bit in the sifting step. In the $X$ basis, Bob decides whether to implement a bit flip to guarantee correct correlations, depending on the clicking detectors announced by Charles and the global phase difference between two matching time bins. Here, $\mathbf{RL}$ ($\mathbf{LR}$) denotes the detectors $\mathbf{R}$ ($\mathbf{L}$) and $\mathbf{L}$ ($\mathbf{R}$) clicks at time bins $i$ and $j$, respectively. $\mathbf{RR}$ ($\mathbf{LL}$) denotes that the detector $\mathbf{R}$ ($\mathbf{L}$) clicks at time bins $i$ and $j$. | Measurement results of Charlie
---|---
Global phase difference |  $\mathbf{RL}$ ($\mathbf{LR}$) |  $\mathbf{RR}$ ($\mathbf{LL}$)
$|\varphi^{i}-\varphi^{j}|=0$ |  Bit flip | No bit flip
$|\varphi^{i}-\varphi^{j}|=\pi$ |  No bit flip | Bit flip

##  III Experimental Discussion

In the asynchronous-MDIQKD protocol, the information in the interference mode
is encoded in the phase difference of two matched time bins. One may regard
the latter as the reference mode and the former as the signal mode, which is
the same as the time-bin encoding MDIQKD [79]. In the $X$ basis, Alice and Bob
postmatch pulses of two time bins $i$ and $j$ with phase relation
$\left|\varphi^{i}-\varphi^{j}\right|=0$ or $\pi$, where
$\varphi^{i(j)}=\theta_{a}^{i(j)}-\theta_{b}^{i(j)}+\phi^{i(j)}$ is the global
phase difference at time bin $i~{}(j)$. $\theta_{a}^{i(j)}$ and
$\theta_{b}^{i(j)}$ are random phases known to Alice and Bob.
$\phi^{i(j)}=\phi^{i(j)}_{a}-\phi^{i(j)}_{b}$ is the differential phase
evolution at time bin $i~{}(j)$, which is determined by the frequency
difference between the two users’ lasers and the fluctuation of the fiber
channels. When the two pulses sent by Alice and Bob reach Charlie, the phase
evolutions of the two pulses are $\phi_{a}^{i}=2\pi
v_{a}^{i}(t^{i}-l^{i}_{a}/s)$ and $\phi_{b}^{i}=2\pi
v_{b}^{i}(t^{i}-l^{i}_{b}/s)$, respectively, where $t^{i}$ is the time of the
time bin $i$, $v_{a(b)}^{i}$ is the laser frequency, $s$ is the speed of light
in the fiber, and $l_{a(b)}^{i}$ is the fiber length between Alice (Bob) and
Charlie at time bin $i$. In symmetric channels, the differential phase
evolution between Alice and Bob can be expressed as

$\displaystyle\phi^{i}=\phi_{a}^{i}-\phi_{b}^{i}=2\pi\delta
v^{i}t^{i}-\frac{2\pi}{s}(\delta v^{i}l^{i}+v^{i}\delta l^{i}),$ (2)

where $\delta v^{i}=v_{a}^{i}-v_{b}^{i}$, $\delta l^{i}=l_{a}^{i}-l_{b}^{i}$,
$l^{i}=(l^{i}_{a}+l^{i}_{b})/2$ and $v^{i}=(v^{i}_{a}+v^{i}_{b})/2$. Ensuring
the phase correlation between time bins $i$ and $j$ is essential for
postmatching. In the experiment, when the time interval for postmatching
$T_{c}$ is large, the phase correlation can be maintained by using phase-
tracking and phase-locking techniques to measure differential phase evolution
in each time bin. Fortunately, when $T_{c}$ is small, the phase correlation
naturally exists, that is, the differential phase evolution is approximately
constant within $T_{c}$ because the fiber length drift rate and relative phase
drift rate between lasers are relatively small. Therefore, our protocol can
discard phase-tracking and phase-locking techniques at the cost of a slight
increase in the interference error rate.

###  III.1 Removing phase tracking

Assuming that the frequencies of the two user lasers are synchronized with
phase-locking techniques, $v_{a}^{i(j)}=v_{b}^{i(j)}=v^{i(j)}$, we have

$\displaystyle\phi^{j}-\phi^{i}=\frac{2\pi}{s}\left(v^{j}\delta
l^{j}-v^{i}\delta l^{i}\right).$ (3)

When $T_{c}$ is on the order of tens of microseconds, say 50 $\mu$s, the
frequency drift is small for typical commercially available narrow-linewidth
lasers. Hence, $\phi^{j}-\phi^{i}$ is mainly determined by the relative phase
drift caused by the fiber length drift, which was measured to be approximately
$8$ rad/ms $@$ $402$ km [52], corresponding to a phase drift of 0.4 rad per
$50~{}\rm{\mu s}$. Note that two time bins $i$ and $j$ are randomly and
uniformly distributed within the time interval $T_{c}$; therefore, the mean
phase drift between the two time bins is half of the maximum value.
Consequently, there will be an intrinsic interference error rate of
approximately $(1-\cos{0.2})/2\approx 1\%$.

Figure 4: HOM visibility and error rate as a function of frequency difference
between two lasers $\delta v$. We set the time interval of two consecutive
time bins $\tau=1~{}\mu$s. The blue line is the HOM visibility, and the orange
dotted line is the interference error rate.

This indicates that our protocol with short-term matching can be
experimentally implemented without phase tracking when the matching interval
$T_{c}$ is on the order of tens of microseconds. Note that sufficient
detection counts should be accumulated per $T_{c}$ for postmatching. The
detection count per $T_{c}$ can be approximated as
$T_{c}F(1-e^{-\overline{\mu}\eta_{d}\sqrt{\eta_{\rm{ch}}}})$, where $F$ is the
system frequency, $\eta_{\rm{ch}}$ is the channel transmittance between Alice
and Bob, $\eta_{d}$ is the detection efficiency, and $\overline{\mu}$ is the
total mean photon number of Alice and Bob. At 400 km, by using a 1 GHz system
with $\eta_{d}=70\%$ and ultra-low loss fiber, there will be approximately 9.3
detection events per $T_{c}$ if we set $\bar{\mu}=0.5$, which is sufficient
for postmatching.

###  III.2 Removing phase tracking and phase locking

We consider the case in which neither phase-tracking nor phase-locking
techniques are applied. When $T_{c}$ is on the order of a few tens of
microseconds, the fiber length drift is also negligible. The relative phase
drift between time bins $i$ and $j$ is mainly determined by the frequency
difference between the two independent lasers, which can be expressed as

$\displaystyle\phi^{j}-\phi^{i}=2\pi\delta v(t^{j}-t^{i}).$ (4)

In practice, $\delta v$ is the sum of stable laser frequency difference
between the two users and laser frequency random drift. The former can be a
relatively large value (up to tens of megahertz) known to Alice and Bob. The
latter is an unknown small value (tens of kilohertz). For simplicity, below we
discuss the case where the two users try to adjust their lasers to nearly the
same frequency, leaving only an unknown small $\delta v$. In this case, there
is an intrinsic phase misalignment $\pi\delta vT_{c}$ on average during
$T_{c}$. If $\delta v$ is controlled to 100 kHz, for $T_{c}=$ 1 $\rm{\mu s}$,
$\phi^{i}-\phi^{j}\approx 0.1\pi$, resulting in an interference error rate of
2.4$\%$. By using an experimental setup with $F=10$ GHz (which is feasible
under current technology [87, 88]) and $\eta_{d}=70\%$, at $300$ km, there
will be approximately $11.7$ detection events per microsecond if we set
$\overline{\mu}=0.5$.

Figure 5: Test results of the frequency difference between two independent
lasers , which are obtained by manually adjusting the temperature. (a)
Frequency difference between two NKT lasers for 60 s. (b) Histogram of the
frequency difference distribution between the two NKT lasers. The mean
frequency difference is 145 kHz. (c) Frequency difference between two RIO
Orion lasers of 60 s. (d) Histogram of the frequency difference distribution
between two RIO Orion lasers, where the mean value is 92.5 kHz. Note that if
using automatic feedback systems, the frequency difference can be further
reduced.

The experimental requirement of the asynchronous-MDIQKD protocol without phase
tracking and phase locking is similar to that of the previous phase encoding
MDIQKD, in which the information is encoded in the relative phase of the two
time bins with time interval $\tau$. The frequency difference between the two
users will inevitably misalign the phase basis, leading to intrinsic phase
misalignment $\delta\phi=2\pi\delta v\tau$ [22]. In experimental
demonstrations in Refs. [18] and [22], the time delays are 6.37 ns and 0.5 ns,
respectively. The maximum frequency difference is 37.5 MHz and 30 MHz,
respectively, which introduce phase misalignments of 0.47 $\pi$ and 0.03
$\pi$, respectively. For our protocol with short time matching, $\tau$ is on
the order of microseconds, and the frequency difference is approximately tens
of kilohertz.

In a real setup, to suppress the frequency difference between two independent
lasers within $100$ kHz, Alice and Bob can periodically enter the calibration
process to calibrate the frequency of their lasers. There are several
approaches available for frequency calibration. The most straightforward way
is to measure the beat note of two lasers. Alice and Bob can also locally
calibrate the frequency with a frequency standard [70]. In addition, they can
measure the Hong–Ou–Mandel (HOM) interference and utilize the interference
visibility as the feedback signal [25] to minimize the frequency difference.
These are mature techniques in time-bin MDIQKD.

We briefly describe the method of frequency calibration using HOM interference
[25] as follows. Consider the HOM interference of two weak coherent pulses
with the same time, polarization and spatial mode, but different frequencies.
The HOM interference visibility is related to the time interval of two
consecutive time bins $\tau$ and the frequency difference $\delta v$. As shown
in Fig. 4, we simulate the interference visibility $V$ and interference error
rate $E=(1-V)/2$ as a function of $\delta v$, where $\tau=1~{}\mu$s. The
visibility reaches the maximum value of approximately 0.5 when the frequency
difference is 0, and decreases rapidly as the frequency difference increases.
The minimum error rate of approximately $25\%$ is obtained when $\delta v=0$.
When $\delta v$ increases to 100 kHz, the error rate increases to 29.7$\%$. In
experiment, one can adjust the laser frequency to minimize the error rate.
When the observed error rate is close to 25$\%$, the frequencies of the two
users’ lasers are calibrated. By increasing $\tau$, the error rate becomes
more sensitive to $\delta v$.

Figure 6:  The bit error rate in the $X$ basis as a function of the matching
time interval $T_{c}$, where both phase tracking and phase locking are not
adopted. The distance between Alice and Bob is $300$ km and the system
repetition rate is $F=4$ GHz. The frequency difference $\delta v$ is set to
10, 50 and 100 kHz.

To demonstrate the feasibility of the experimental setup without phase-
tracking and phase-locking techniques, we measured the frequency difference
between two independent lasers. Two narrow-linewidth lasers working at 1550.12
nm emit continuous light. The continuous light passes through fiber,
interferes at a beam splitter, and is detected by a photoelectric detector.
The beat note was recorded using an oscilloscope. Fig. 5 (a) shows the beat
frequencies of the two NKT lasers (Koheras BASIK E15). These lasers support
fine piezoelectric tuning with a minimum tuning frequency on the order of kHz.
During the test time of 60 s, we manually adjusted the frequency of one of the
lasers every few seconds to minimize the observed beat frequency. A histogram
of the recorded data is presented in Fig. 5(b), and the mean value is 145 kHz.
We also measured the frequency difference between the two independent Rio
lasers (Rio ORION). They were first tuned to the same frequency and kept free
running during the 60 s test time. The collected data are shown in Fig. 5(c),
and the histogram is shown in Fig. 5(d), with an average of 92.5 kHz. In a
real setup, if using the RIO laser or the NKT laser, the frequency needs to be
adjusted every few seconds. We stress that the frequency difference can be
further reduced by utilizing automatic feedback systems and improving the
stability of the experimental environment.

Additionally, we simulate the bit error rate in the X basis as a function of
the time interval $T_{c}$ in Fig. 6, which is calculated under the optimal key
rate. The distance between Alice and Bob is 300 km and the system repetition
rate is $F=4$ GHz. The experimental parameters were set to the typical values
given in Table. 2. With a fixed frequency difference, the error rate in the X
basis increases as the time bin interval increases. When the frequency
difference $\delta v=10$ kHz, the error rate increases slowly, indicating that
a relatively low system repetition rate is sufficient for the experiment.

Figure 7: Secret key rates of the asynchronous-MDIQKD with short time matching as a function of the distance when implemented without phase tracking. Here, we set the matching time interval $T_{c}=50~{}\mu$s, the system repetition rate is $F=1$ GHz and the angle of misalignment in the $X$ basis $\sigma=\pi/10$. Our protocol can break the PLOB bound at a distance of approximately 280 km with $N=10^{12}$, and the transmission distance reaches 450 km. Table 2: Simulation parameters. $\eta_{d}$ and $p_{d}$ are the detector efficiency and dark count rate, respectively. $\alpha$ is the attenuation coefficient of the fiber and $f$ denotes the error correction efficiency. $\epsilon$ is the failure probability considered in the error verification and finite data analysis. $\eta_{d}$ | $p_{d}$ | $\alpha$ | $f$ | $\epsilon$
---|---|---|---|---
[.5]0 $70\%$ | $10^{-8}$ |  $0.165$ dB/km | $1.1$ | $36/23\times 10^{-10}$

##  IV Performance and discussion

We numerically simulate the key rate $R=\ell/N$ of our asynchronous-MDIQKD
protocol in finite-size cases. We set the threshold $\Lambda=10$. The genetic
algorithm is exploited to globally search for the optimal value of light
intensities and their corresponding probabilities. When optimizing the key
rate, we set an additional condition in which the mean number of
$\mathit{case~{}2}$ events $\bar{N}^{c_{2}}\leq 1$. Assuming that the
distribution of the number of events in $\mathit{case~{}2}$ follows a Poisson
distribution, the probability that the observed number of $\mathit{case~{}2}$
events in the experiment exceeds $\Lambda$ is
$1-\sum_{k=0}^{10}\frac{\varsigma^{j}}{j!}e^{-\varsigma}\approx 1\times
10^{-8}$, where $\varsigma=\bar{N}^{c_{2}}$. This reveals the robustness of
our protocol, which will only fail once in 100 million rounds of experiments.

The experimental parameters were set to the typical values given in Table. 2.
We set the failure parameters $\varepsilon^{\prime}$, $\hat{\varepsilon}$,
$\varepsilon_{e}$, $\varepsilon_{\beta}$, and $\varepsilon_{\rm PA}$ to be the
same $\epsilon$. We denote the distance between Alice (Bob) and Charlie as
$l_{a}$ ($l_{b}$). In the symmetric case, that is, $l_{a}=l_{b}=l/2$, we have
$\varepsilon_{0}+\varepsilon_{1}=14\epsilon$ because the Chernoff bound [89,
90] is used 14 times to estimate $s_{0\mu_{b}}^{z}$, $s_{11}^{z}$, and
$e_{11}^{x}$. The corresponding security bound is
$\varepsilon_{\rm{asyn}}=2.4\times 10^{-9}$. Similarly, in the asymmetric
case, we have $\varepsilon_{0}+\varepsilon_{1}=13\epsilon$ and
$\varepsilon_{\rm{asyn}}=2.3\times 10^{-9}$.

Figure 8:  Secret key rates of our protocol with short-term matching as a
function of the distance where both phase tracking and phase locking are not
adopted. Different system repetition rates $F$, matching time intervals
$T_{c}$ and frequency differences $\delta v$ are taken into consideration. Red
line: $F=10$ GHz, $T_{c}=1~{}\mu$s, $\delta v=100$ kHz; blue line: $F=4$ GHz,
$T_{c}=10~{}\mu$s, $\delta v=10$ kHz; yellow line: $F=1$ GHz,
$T_{c}=20~{}\mu$s, $\delta v=3$ kHz. Our protocol can overcome the PLOB bound
at 270 km with a key rate of $2\times 10^{-5}$.

First, we calculate the key rates of the asynchronous-MDIQKD protocol with a
short time interval $T_{c}$. The detailed formulas for simulating our protocol
are presented in Appendix B. The statistical fluctuation analysis formulas are
presented in Appendix C. Fig. 7 shows a scenario in which phase tracking is
removed. The time interval $T_{c}=50$ $\rm{\mu s}$, and the system repetition
rate is $F=1$ GHz. We assume that the angle of misalignment in the $X$ basis
$\sigma=\pi/10$. The key rate beats the PLOB bound at 280 km under the
condition where the data size is $N=10^{12}$ and the transmission distance
reaches 450 km. One can also transmit over more than 420 km and overcome the
PLOB even with a data size of $N=10^{11}$.

The key rate in the case where neither phase-tracking nor phase-locking
techniques are employed is shown in Fig. 8. Here, we consider the frequency
differences of 3, 10 and 100 kHz. Correspondingly, the system repetition rates
are 1 GHz, 4 GHz (which has been employed in the experiments in Ref. [60]) and
10 GHz. Note that when $T_{c}=20~{}\mu$s, the phase misalignment caused by
fiber phase drift is considered. The simulation results show that the proposed
protocol can overcome the PLOB bound at 270 km. For the frequency difference
$\delta v=100$ kHz, by applying a 10 GHz system and setting the matching time
interval $T_{c}=1~{}\mu$s, the secure transmission distance can still exceed
380 km. The corresponding loss is 62 dB. In free space, if the Micius
satellite [73] is used as the intermediate station Charlie, the key
distribution between two ground nodes with a distance of approximately 1000 km
can be realized. At an intercity distance of 300 km, the key rate is 0.15
Mbps, which is sufficient to perform a variety of tasks, including audio and
video encryption.

Figure 9: Comparison of the secret key rates of the asynchronous-MDIQKD with
arbitrary-time matching, PMQKD [40] and AOPP [81] in symmetric channels. The
numerical results here show that our protocol has a notable advantage and is
able to achieve a long transmission distance of 620 km.

We remark that by circumventing the need for phase tracking, the asynchronous-
MDIQKD protocol has a noteworthy advantage over TFQKD at intercity distance.
Typically, the maximum counting rate of a commercially available SNSPD is
approximately 2 MHz per channel. For TFQKD, using strong reference light to
execute phase-tracking usually consumes a count rate of about 4 MHz per
channel [50] (sometimes 40 MHz peak count rate [51]), and dedicated high-
performance detectors are needed. In Ref. [51], the two-parallel-nanowire
serial-connected configuration is developed to address the high count rate
issue. In contrast, asynchronous-MDIQKD does not impose a strict count rate
requirement on the detector, and all detector count rates are usable for
quantum signals. Assuming the maximum counting rate is 5 MHz per channel, at
230 km, with a 4 GHz repetition rate, the count rate of the quantum signal
will be approximately 4.4 MHz per channel, which can be used for key
generation in our protocol. The key rate is 350 kbps when $\delta v=10$ kHz
and $T_{c}=10~{}\mu$s. However, for TFQKD, the available count rate is only 1
MHz per channel, resulting in a key rate of approximately 20 kbps [51]. In
this case, the key rate of our protocol is one order of magnitude higher than
that of TFQKD.

For a large time interval $T_{c}$, say $1$ s, the phase correlation between
two time bins fades. With the same experimental complexity as TFQKD, that is,
using phase locking and phase tracking, one can postmatch time bins with
arbitrary time interval and achieve better performance. Here, we simulate the
key rates of asynchronous-MDIQKD with arbitrary time matching and compare it
with those of PMQKD (PMQKD) [40] and SNSQKD with the help of actively AOPP. We
set the total number of pulses as $N=10^{11}$ and $10^{13}$, the misalignment
in the $X$ basis as $\sigma=\pi/36$, and the security bounds as
$\varepsilon_{\rm{AMDI}}=\varepsilon_{\rm{AOPP}}=3.6\times 10^{-9}$ and
$\varepsilon_{\rm{PM}}=O(10^{-9})$. The detailed formulas for simulating our
protocol are presented in Appendix B.

Figure 10: Comparison of secret key rates of our protocol with arbitrary time
matching, PMQKD, and AOPP versus transmission distance in asymmetric channels.
Our protocol exhibits a decent performance in asymmetric channels.

Because our protocol is an MDI-type protocol, the density matrix of the
single-photon pair component is always identical in the X and Z bases for each
user, regardless of the asymmetric source parameters chosen. This makes it
possible for a dynamic quantum network to add or delete new user nodes without
considering the source parameters of existing users. In contrast, to guarantee
that the density matrix of the two users’ joint single-photon state in the X
basis is the same as that in the Z basis for SNSQKD protocols, the
transmission probability and intensity of the coherent state must follow
strict mathematical constraint [33, 39]. However, this constraint is difficult
to realize in practice, especially in networks where users are added and
deleted over time, which greatly degrades their performance. By exploiting the
quantum coin concept [91, 92], a recent study provided a security proof for
the SNSQKD protocol when the constraint is not satisfied [80]. When comparing
the key rates, we considered that the intensity of the coherent state in AOPP
does not satisfy the mathematical constraint (which is often the case in
practice) with a modulation deviation of decoy state $\nu_{b}$ to $5\%$, and
the other parameters have no deviation. The key rates in symmetric channels
are shown in Fig. 9. The simulation results show that the key rate of
asynchronous-MDIQKD is always higher than that of PMQKD and AOPP. At 500 km,
for $N=10^{13}$, the secret key rate of our protocol is $150\%$ higher than
that of PMQKD, and the transmission distance is 240 km longer than that of
AOPP. For $N=10^{11}$, our protocol transmits over a distance of more than 500
km. Fig. 10 shows the key rate in the asymmetric channels, where
$l_{b}=l_{a}+100$ km. Notably, our protocol also performs well in asymmetric
channels. At 500 km, for $N=10^{13}$, the key rate of our protocol is $400\%$
higher than that of PMQKD, and the transmission distance is 150 km longer than
that of AOPP. Similarly, when $N=10^{11}$, the transmission distance of the
asynchronous-MDIQKD protocol is 50 km higher.

In summary, the asynchronous-MDIQKD protocol does not require complicated
phase-locking and phase-tracking techniques, and it is resistant to imperfect
intensity modulation. Therefore, an intercity quantum network is possible,
where users can dynamically access and freely choose to perform asynchronous-
MDIQKD with short time matching or arbitrary time matching.

##  V conclusion

In this work, we presented an asynchronous-MDIQKD protocol through time
multiplexing. We realized $O(\sqrt{\eta})$ scaling of the key rate with
asynchronous two-photon interference, thus surpassing the PLOB bound. By
removing phase locking and phase tracking, our protocol greatly simplifies the
hardware requirement with a small sacrifice in performance. When using the
same experimental techniques as TFQKD, our protocol is secure against coherent
attacks, and shows longer transmission and higher key rate than PMQKD and
SNSQKD (AOPP), considering imperfect intensity modulation. Our work also
suggests a practical method of overcoming the linear bound of dual-rail
protocols [30] without challenging technologies. In addition, our protocol can
also exploit the six-state encoding [93] due to random phase modulation.
Therefore, if applying single photon sources in the $Z$ basis, our protocol
can be made secure up to higher error rate by establishing the non-trivial
mutual information between the bit-flip and phase error patterns [93, 94],
thereby achieving a higher key rate. This work exhibits remarkable superiority
in intercity quantum network deployment for balancing performance and
technical complexity. We believe the key contributions of this work will
produce exciting opportunities for the widespread deployment of global quantum
networks beyond quantum key distribution, ranging from quantum repeaters to
quantum entanglement distribution.

ACKNOWLEDGMENTS

We gratefully acknowledge the support from the National Natural Science
Foundation of China (No. 61801420), the Natural Science Foundation of Jiangsu
Province (No. BK20211145), the Fundamental Research Funds for the Central
Universities (No. 020414380182), the Key Research and Development Program of
Nanjing Jiangbei New Aera (No. ZDYD20210101), the Key-Area Research and
Development Program of Guangdong Province (No. 2020B0303040001), and the China
Postdoctoral Science Foundation (No. 2021M691536).

Note added— During the peer review of our work, we became aware of a similar
work by Zeng et al. [95], who consider a mode-pairing MDI-QKD scheme that
matches the adjacent detection pulses to extract the key information. By
assuming infinite decoy states, they calculated the key rate in the asymptotic
regime, which can break the rate-loss bound. In this work, we use the three-
intensity decoy-state method to calculate the key rate in the finite-size
regime and show its ability to break the rate-loss bound.

##  Appendix A Simulation formulas

In this section, we calculate the parameters in Eq. (1) to estimate the secret
key rate. In the following description, let $x^{*}$ be the expected value of
$x$. We denote the number of $\\{k_{a},~{}k_{b}\\}$ as $x_{k_{a}k_{b}}$. We
denote the number and error number of events
$\\{k_{a}^{i}k_{a}^{j},~{}k_{b}^{i}k_{b}^{j}\\}$ after postmatching as
$n_{k_{a}^{i}k_{a}^{j},~{}k_{b}^{i}k_{b}^{j}}$ and
$m_{k_{a}^{i}k_{a}^{j},~{}k_{b}^{i}k_{b}^{j}}$, respectively. For simplicity,
we abbreviate $k_{a}^{i}k_{a}^{j},k_{a}^{i}k_{a}^{j}$ as $2k_{a},2k_{b}$ when
$k_{a}^{i}=k_{a}^{j}$ and $k_{b}^{i}=k_{b}^{j}$.

1\. $\underline{s}_{11}^{z}$. $s_{11}^{z}$ corresponds to the number of
successful detection events where Alice and Bob each emit a single photon in
different time bins in the $Z$ basis. We define $z_{10}$ ($z_{01}$) as the
number of events in which Alice (Bob) emits a single photon and Bob (Alice)
emits a vacuum state in $\\{\mu_{a},\mathbf{o}_{b}\\}$
($\\{\mathbf{o}_{a},\mu_{b}\\}$) event. The lower bounds of their expected
values are
$\underline{z}_{10}^{*}=Np_{\mu_{a}}p_{\mathbf{o}_{b}}\mu_{a}e^{-\mu_{a}}\underline{y^{*}_{10}}$
and
$\underline{z}^{*}_{01}=Np_{\mathbf{o}_{a}}p_{\mu_{b}}\mu_{b}e^{-\mu_{b}}\underline{y^{*}_{01}}$,
where the yields $\underline{y}_{10}^{*}$ and $\underline{y}_{01}^{*}$ are the
corresponding yields. These can be estimated using the decoy-state method:

$\displaystyle\underline{y}_{01}^{*}\geq$
$\displaystyle\frac{\mu_{b}}{N(\mu_{b}\nu_{b}-\nu_{b}^{2})}\left(\frac{e^{\nu_{b}}\underline{x}_{o_{a}\nu_{b}}^{*}}{p_{o_{a}}p_{\nu_{b}}}\right.$
$\displaystyle\left.-\frac{\nu_{b}^{2}}{\mu_{b}^{2}}\frac{e^{\mu_{b}}\overline{x}_{\hat{\mathbf{o}}_{a}\mu_{b}}^{*}}{p_{\hat{\mathbf{o}}_{a}}p_{\mu_{b}}}-\frac{\mu_{b}^{2}-\nu_{b}^{2}}{\mu_{b}^{2}}\frac{\overline{x}_{oo}^{d*}}{p_{o_{a}o_{b}}^{d}}\right),$
(5) $\displaystyle\underline{y}_{10}^{*}\geq$
$\displaystyle\frac{\mu_{a}}{N(\mu_{a}\nu_{a}-\nu_{a}^{2})}\left(\frac{e^{\nu_{a}}\underline{x}_{\nu_{a}o_{b}}^{*}}{p_{\nu_{a}}p_{o_{b}}}\right.$
$\displaystyle\left.-\frac{\nu_{a}^{2}}{\mu_{a}^{2}}\frac{e^{\mu_{a}}\overline{x}_{\mu_{a}\hat{\mathbf{o}}_{b}}^{*}}{p_{\mu_{a}}p_{\hat{\mathbf{o}}_{b}}}-\frac{\mu_{a}^{2}-\nu_{a}^{2}}{\mu_{a}^{2}}\frac{\overline{x}_{oo}^{d*}}{p_{o_{a}o_{b}}^{d}}\right),$
(6)

where
$x_{oo}^{d}=x_{\hat{\mathbf{o}}_{a}\hat{\mathbf{o}}_{b}}+x_{\hat{\mathbf{o}}_{a}\mathbf{o}_{b}}+x_{\mathbf{o}_{a}\hat{\mathbf{o}}_{b}}$
represents the number of events where at least one user chooses the declare-
vacuum state and
$p_{oo}^{d}=p_{\hat{\mathbf{o}}_{a}\hat{\mathbf{o}}_{b}}+p_{\hat{\mathbf{o}}_{a}\mathbf{o}_{b}}+p_{\mathbf{o}_{a}\hat{\mathbf{o}}_{b}}$
refers to the corresponding probability. Thus, the lower bound of
$s_{11}^{z*}$ can be given by

$\displaystyle\underline{s}_{11}^{z*}=n_{C}^{z}\frac{\underline{z}_{10}^{*}}{x_{\mu_{a}\mathbf{o}_{b}}}\frac{\underline{z}_{01}^{*}}{x_{\mathbf{o}_{a}\mu_{b}}}=\frac{\underline{z}_{10}^{*}\underline{z}_{01}^{*}}{x_{\max}}.$
(7)

where $x_{0}=x_{\mathbf{o}_{a}\mu_{b}}+x_{\mathbf{o}_{a}\mathbf{o}_{b}}$,
$x_{1}=x_{\mu_{a}\mathbf{o}_{b}}+x_{\mu_{a}\mu_{b}}$ and
$x_{\max}=\max\\{x_{0},x_{1}\\}$.

2\. $\underline{s}_{0\mu_{b}}^{z}$. $s_{0\mu_{b}}^{z}$ represents the number
of events in the $Z$ basis, Alice emits a zero-photon state in the two matched
time bins, and the total intensity of Bob’s pulses is $\mu_{b}$. We define
$z_{00}$ ($z_{0\mu_{b}}$) as the number of detection events where the state
sent by Alice collapses to the vacuum state in the
$\\{\mu_{a},\mathbf{o}_{b}\\}$ ($\\{\mu_{a},\mu_{b}\\}$) event. The lower
bounds of the expected values are
$\underline{z}_{00}^{*}={p_{\mu_{a}}p_{\mathbf{o}_{b}}e^{-\mu_{a}}\underline{x}_{oo}^{d*}}/{p_{oo}^{d}}$
and
$~{}\underline{z}_{0\mu_{b}}^{*}={p_{\mu_{a}}p_{\mu_{b}}e^{-\mu_{a}}\underline{x}_{\mathbf{o}_{a}\mu_{b}}^{*}}/{p_{\mathbf{o}_{a}}p_{\mu_{b}}}$,
respectively. In this study, we employed the relation between the expected
value
$\underline{x}_{\mathbf{o}_{a}\mu_{b}}^{*}={p_{\mathbf{o}_{a}}\underline{x}_{\hat{\mathbf{o}}_{a}\mu_{b}}^{*}}/{p_{\hat{\mathbf{o}}_{a}}}$,
and
$~{}\underline{x}_{\mathbf{o}_{a}\mathbf{o}_{b}}^{*}={p_{\mathbf{o}_{a}}p_{\mathbf{o}_{b}}\underline{x}_{oo}^{d*}}/{p_{oo}^{d}}$.
The lower bound of $s_{0\mu_{b}}^{z*}$ can be written as

$\displaystyle\underline{s}_{0\mu_{b}}^{z*}=$ $\displaystyle
n_{C}^{z*}\frac{\underline{z}_{00}^{*}}{x_{\mu_{a}\mathbf{o}_{b}}^{*}}+n_{E}^{z*}\frac{\underline{z}_{0\mu_{b}}^{*}}{x_{\mu_{a}\mu_{b}}^{*}},$
(8)

3\. $\underline{s}_{11}^{x}$. The phase difference between Alice and Bob is
defined as $\varphi=\theta_{a}-\theta_{b}+\phi$ and the corresponding number
in the $\\{k_{a},~{}k_{b}\\}$ event as $x_{k_{a}k_{b}}^{\varphi}$. In the
post-matching step, two time bins are matched if they have the same phase
difference $\varphi$, and all $\\{2\nu_{a},~{}2\nu_{b}\\}$ events can be
grouped according to the phase difference $\varphi$. We denote the number of
$\\{2\nu_{a},~{}2\nu_{b}\\}$ events with phase difference $\varphi$ as
$n_{2\nu_{a},2\nu_{b}}^{\varphi}=x_{\nu_{a}\nu_{b}}^{\varphi}/2$. Similar to
the time-bin MDIQKD, the expected yields of single-photon pairs in the $X$ and
$Z$ bases satisfy the following relation:

$\displaystyle Y_{11}^{x*}$
$\displaystyle=Y_{11}^{z*}=\frac{1}{4}(y_{01}^{*}y_{10}^{*}+y_{10}^{*}y_{01}^{*}+y_{00}^{*}y_{11}^{*}+y_{11}^{*}y_{00}^{*})$
(9) $\displaystyle\geq\frac{1}{2}y_{10}^{*}y_{01}^{*}.$

Suppose the global phase difference $\varphi$ is a randomly and uniformly
distributed value. The expected number of single-photon pairs can be given by

$\displaystyle s_{11}^{x*}$
$\displaystyle=\frac{1}{2\pi}\int_{0}^{2\pi}n_{2\nu_{a},2\nu_{b}}^{\varphi}\times\frac{4\nu_{a}\nu_{b}e^{-2\nu_{a}-2\nu_{b}}}{q_{\nu_{a}\nu_{b}}^{\varphi}q_{\nu_{a}\nu_{b}}^{\varphi}}y_{11}^{x*}d\varphi$
(10)
$\displaystyle\geq\frac{1}{2\pi}\int_{0}^{2\pi}n_{2\nu_{a},2\nu_{b}}^{\varphi}\times\frac{\nu_{a}\nu_{b}e^{-2\nu_{a}-2\nu_{b}}}{q_{\nu_{a}\nu_{b}}^{\varphi}q_{\nu_{a}\nu_{b}}^{\varphi}}2\underline{y}_{10}^{*}\underline{y}_{01}^{*}d\varphi$
$\displaystyle=Np_{\nu_{a}}p_{\nu_{b}}\nu_{a}\nu_{b}e^{-2(\nu_{a}+\nu_{b})}\underline{y}_{10}^{*}\underline{y}_{01}^{*}\int_{0}^{2\pi}\frac{1}{2\pi
q_{\nu_{a}\nu_{b}}^{\varphi}}d\varphi,$

where the coefficient 4 on the first line of the formula corresponds to the
four modes of single-photon pairs in the $X$ basis,
$q_{\nu_{a}\nu_{b}}^{\varphi}$ is the gain when Alice chooses intensity
$\nu_{a}$, and Bob chooses intensity $\nu_{b}$ with phase difference $\varphi$
and
$n_{2\nu_{a},2\nu_{b}}^{\varphi}$$=$$Np_{\nu_{a}}p_{\nu_{b}}q_{\nu_{a}\nu_{b}}^{\varphi}/2$.
We define
$q_{k_{a}k_{b}}$$=$$1/(2\pi)\int_{0}^{2\pi}q_{k_{a}k_{b}}^{\varphi}d\varphi$
as the average gain, given that Alice chooses intensity $k_{a}$, and Bob
chooses intensity $k_{b}$. When $\nu_{a}$ and $\nu_{b}\approx 0$, there is an
approximation relation $\int_{0}^{2\pi}1/(2\pi
q_{\nu_{a}\nu_{b}}^{\varphi})d\varphi\approx 1/q_{\nu_{a}\nu_{b}}$.

In the discrete case, the phase difference $\varphi$ is divided into $M$
slices $\\{\delta_{m}\\}$ for $1\leq m\leq M$, where $m$ is an integer, where
$\delta_{m}=[2\pi(m-1)/M,2\pi m/M)$. The expected number of single-photon
pairs is given by

$\displaystyle\underline{s}_{11}^{x*}$
$\displaystyle\geq\sum_{m=1}^{M}n_{2\nu_{a},2\nu_{b}}^{m}\times
2\frac{\nu_{a}e^{-\nu_{a}-\nu_{b}}\underline{y}_{10}^{*}}{q_{\nu_{a}\nu_{b}}^{m}}\frac{\nu_{b}e^{-\nu_{a}-\nu_{b}}\underline{y}_{01}^{*}}{q_{\nu_{a}\nu_{b}}^{m}},$
(11)

where $n_{2\nu_{a},2\nu_{b}}^{m}$ is the number of $\\{2\nu_{a},2\nu_{b}\\}$
events with phase difference $\varphi$ falling into slice $\delta_{m}$.
$q_{\nu_{a}\nu_{b}}^{m}$ is the corresponding gain.

4\. $\overline{e}_{11}^{x}$. For single-photon pairs, the expected value of
the phase error rate in the $Z$ basis equals the expected value of the bit
error rate in the $X$ basis, and the error rate
$\overline{e}_{11}^{x}={\overline{t}_{11}^{x}}/{\underline{s}_{11}^{x}}$.
Therefore, we first calculate the number of errors of the single-photon pairs
in the $X$ basis ${t_{11}^{x}}$. The upper bound of ${t_{11}^{x}}$ can be
expressed as

$\displaystyle\overline{t_{11}^{x}}\leq$ $\displaystyle
m_{2\nu_{a},2\nu_{b}}-(\underline{m_{0,2\nu_{b}}+m_{2\nu_{a},0}})+\overline{m}_{0,0},$
(12)

where $m_{0,2\nu_{b}}$ ($m_{2\nu_{a},0}$) is the error count when the state
sent by Alice (Bob) collapses to the vacuum state in events
$\\{2\nu_{a},2\nu_{b}\\}$, and $m_{0,0}$ corresponds to the event where the
states sent by Alice and Bob both collapse to vacuum states in events
$\\{2\nu_{a},2\nu_{b}\\}$. The expected error counts $m_{0,2\nu_{b}}^{*}$ and
$m_{2\nu_{a},0}^{*}$ can be expressed as follows:

$\displaystyle m_{0,2\nu_{b}}^{*}$
$\displaystyle=e_{o}\frac{1}{2\pi}\int_{0}^{2\pi}n_{2\nu_{a},2\nu_{b}}^{\varphi}\frac{e^{-\nu_{a}}q_{0\nu_{b}}^{*}}{q_{\nu_{a}\nu_{b}}^{\varphi}}\frac{e^{-\nu_{a}}q_{0\nu_{b}}^{*}}{q_{\nu_{a}\nu_{b}}^{\varphi}}d\varphi$
(13)
$\displaystyle=e_{o}Np_{\nu_{a}}p_{\nu_{b}}e^{-2\nu_{a}}q_{0\nu_{b}}^{*2}\frac{1}{4\pi}\int_{0}^{2\pi}\frac{1}{q_{\nu_{a}\nu_{b}}^{\varphi}}d\varphi,$
$\displaystyle m_{2\nu_{a},0}^{*}$
$\displaystyle=e_{o}\frac{1}{2\pi}\int_{0}^{2\pi}n_{2\nu_{a},2\nu_{b}}^{\varphi}\frac{e^{-\nu_{b}}q_{\nu_{a}0}^{*}}{q_{\nu_{a}\nu_{b}}^{\varphi}}\frac{e^{-\nu_{b}}q_{\nu_{a}0}^{*}}{q_{\nu_{a}\nu_{b}}^{\varphi}}d\varphi$
$\displaystyle=e_{o}Np_{\nu_{a}}p_{\nu_{b}}e^{-2\nu_{b}}q_{\nu_{a}0}^{*2}\frac{1}{4\pi}\int_{0}^{2\pi}\frac{1}{q_{\nu_{a}\nu_{b}}^{\varphi}}d\varphi,$

respectively, where $e_{o}=1/2$ is the error rate of the background noise.

In the symmetric case, $\nu_{a}=\nu_{b}$, $p_{o_{a}}=p_{o_{b}}$, and
$~{}p_{\nu_{a}}=p_{\nu_{b}}$. In this case, we have
$q_{\nu_{a}o}^{*}=q_{o\nu_{b}}^{*}=(x_{o_{a}\nu_{b}}+x_{\nu_{a}o_{b}})^{*}/(2Np_{o_{a}}p_{\nu_{b}})$.
In the asymmetric case,
$q_{\nu_{a}o}^{*}=x_{\nu_{a}o_{b}}^{*}/(Np_{\nu_{a}}p_{o_{b}})$ and
$q_{o\nu_{b}}^{*}=x_{o_{a}\nu_{b}}^{*}/(Np_{o_{a}}p_{\nu_{b}})$. Then, the
lower bound of the observed value of $m_{0,2\nu_{b}}+m_{2\nu_{a},0}$ can be
written as

$\displaystyle\underline{m_{0,2\nu_{b}}+m_{2\nu_{a}0}}=$
$\displaystyle\varphi^{L}(\underline{m}_{0,2\nu_{b}}^{*}+\underline{m}_{2\nu_{a},0}^{*},\epsilon).$
(14)

where $\varphi^{L}(x)$ is the lower bounds when using Chernoff bound to
estimate the real values according to the expected values and is defined in
Eq. 22. The expected value of ${m}_{0,0}$ can be given by

$\displaystyle{m}_{0,0}^{*}=$ $\displaystyle
e_{o}\frac{1}{2\pi}\int_{0}^{2\pi}n_{2\nu_{a},2\nu_{b}}^{\varphi}\frac{e^{-\nu_{a}-\nu_{b}}q_{00}^{*}}{q_{\nu_{a}\nu_{b}}^{\varphi}}\frac{e^{-\nu_{a}-\nu_{b}}q_{00}^{*}}{q_{\nu_{a}\nu_{b}}^{\varphi}}d\varphi$
(15)
$\displaystyle=e_{o}Np_{\nu_{a}}p_{\nu_{b}}e^{-2(\nu_{a}+\nu_{b})}q_{00}^{*2}\frac{1}{4\pi}\int_{0}^{2\pi}\frac{1}{q_{\nu_{a}\nu_{b}}^{\varphi}}d\varphi.$

The upper bound of $q_{00}^{*}$ can be obtained from
$\overline{q}_{00}^{*}=\overline{m}_{oo}^{d*}/(Np_{oo}^{d})$. The upper bound
of $m_{0,0}$ can be obtained by
$\overline{m}_{0,0}=\varphi^{U}(\overline{m}_{0,0}^{*},\epsilon)$, where
$\varphi^{U}(x)$ is the upper bound while using the Chernoff bound to estimate
the observed values according to the expected values and is defined in Eq. 23.

5\. $\overline{\phi}_{11}^{z}$. Finally, for a failure probability
$\varepsilon$, the upper bound of the phase error rate
$\overline{\phi}_{11}^{z}$ can be obtained by using random sampling without
replacement in Eq. (26)

$\displaystyle\overline{\phi}_{11}^{z}\leq$
$\displaystyle\overline{e}_{11}^{x}+\gamma\left(\underline{s}_{11}^{z},\underline{s}_{11}^{x},\overline{e}_{11}^{x},\varepsilon\right).$
(16)

##  Appendix B Simulation details

###  B.1 Asynchronous-MDIQKD protocol for arbitrary-time matching

Similar to the time-bin encoding MDIQKD, the valid events after postmatching
in the $Z$ basis can be divided into correct events
$\\{\mu_{a}\mathbf{o}_{a},~{}\mathbf{o}_{b}\mu_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},~{}\mu_{b}\mathbf{o}_{b}\\}$, and incorrect events
$\\{\mu_{a}\mathbf{o}_{a},~{}\mu_{b}\mathbf{o}_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},~{}\mathbf{o}_{b}\mu_{b}\\}$. The corresponding
numbers are denoted as $n_{C}^{z}$ and $n_{E}^{z}$, respectively, which can be
written as

$\displaystyle
n_{C}^{z}=x_{\min}\frac{x_{\mathbf{o}_{a}\mu_{b}}}{x_{0}}\frac{x_{\mu_{a}\mathbf{o}_{b}}}{x_{1}}=\frac{x_{\mathbf{o}_{a}\mu_{b}}x_{\mu_{a}\mathbf{o}_{b}}}{x_{\max}},$

and

$\displaystyle
n_{E}^{z}=x_{\min}\frac{x_{\mathbf{o}_{a}\mathbf{o}_{b}}}{x_{0}}\frac{x_{\mu_{a}\mu_{b}}}{x_{1}}=\frac{x_{\mathbf{o}_{a}\mathbf{o}_{b}}x_{\mu_{a}\mu_{b}}}{x_{\max}},$

where $x_{\min}=\min\\{x_{0},x_{1}\\}$. The overall number of events in the
$Z$ basis is $n^{z}=n^{z}_{C}+n^{z}_{E}$ and the bit error rate in the $Z$
basis is $E^{z}={n^{z}_{E}}/{n^{z}}$.

In the $X$ basis, the data are composed of events
$\\{2\nu_{a},~{}2\nu_{b}\\}$, $\\{2o_{a},~{}2\nu_{b}\\}$,
$\\{2\nu_{a},~{}2o_{b}\\}$, $\\{2\hat{\mathbf{o}}_{a},2o_{b}\\}$, and
$\\{2\mathbf{o}_{a},~{}2\hat{\mathbf{o}}_{b}\\}$. Without loss of generality,
we consider the case in which all matched events satisfy
$\theta_{a}^{i}-\theta_{a}^{j}-(\theta_{b}^{i}-\theta_{b}^{j})+(\phi^{i}-\phi^{j})=0$.
In this case, when $r_{a}^{i}\oplus r_{a}^{j}\oplus r_{b}^{i}\oplus
r_{b}^{j}=0$ (1), the $\\{\nu_{a}^{i}\nu_{a}^{j},~{}\nu_{b}^{i}\nu_{b}^{j}\\}$
event is considered to be an error event when different detectors (the same
detector) click at time bins $i$ and $j$.

When Alice and Bob send intensities $k_{a}$ and $k_{b}$ with phase difference
$\varphi$, the gain corresponding to only one detector click is

$\displaystyle q_{k_{a}k_{b}}^{L\varphi}=$ $\displaystyle
y_{k_{a}k_{b}}\left[e^{\omega_{k_{a}k_{b}}\cos\varphi}-y_{k_{a}k_{b}}\right],$
(17) $\displaystyle q_{k_{a}k_{b}}^{R\varphi}=$ $\displaystyle
y_{k_{a}k_{b}}\left[e^{-\omega_{k_{a}k_{b}}\cos\varphi}-y_{k_{a}k_{b}}\right].$

where $y_{k_{a}k_{b}}:=e^{\frac{-(\eta_{a}k_{a}+\eta_{b}k_{b})}{2}}(1-p_{d})$,
$\omega_{k_{a}k_{b}}$$:=$$\sqrt{\eta_{a}k_{a}\eta_{b}k_{b}}$,
$\eta_{a}=\eta_{d}10^{-\alpha l_{a}/10}$ and $\eta_{b}=\eta_{d}10^{-\alpha
l_{b}/10}$. The overall gain can be given by
$q_{k_{a}k_{b}}=1/2\pi\int_{0}^{2\pi}q_{k_{a}k_{b}}^{\varphi}d\varphi=1/2\pi\int_{0}^{2\pi}(q_{k_{a}k_{b}}^{L\varphi}+q_{k_{a}k_{b}}^{R\varphi})d\varphi=2y_{k_{a}k_{b}}[I_{0}(\omega_{k_{a}k_{b}})-y_{k_{a}k_{b}}]$,
where $I_{0}(x)$ represents the zero-order modified Bessel function of the
first kind. The total number of $\\{k_{a},k_{b}\\}$ is
$x_{k_{a}k_{b}}=Np_{k_{a}}p_{k_{b}}q_{k_{a}k_{b}}$.

The overall error count in the $X$ basis can be given as

$\displaystyle m_{2\nu_{a},2\nu_{b}}$
$\displaystyle=\frac{1}{2\pi}\int_{0}^{2\pi}n_{2\nu_{a}2\nu_{b}}^{\varphi}\left[\frac{q_{\nu_{a}\nu_{b}}^{L\varphi}q_{\nu_{a}\nu_{b}}^{R({\varphi+\sigma})}+q_{\nu_{a}\nu_{b}}^{R\varphi}q_{\nu_{a}\nu_{b}}^{L({\varphi+\sigma})}}{q_{\nu_{a}\nu_{b}}^{\varphi}q_{\nu_{a}\nu_{b}}^{\varphi+\sigma}}\right]d\varphi$
(18)
$\displaystyle=Np_{\nu_{a}}p_{\nu_{b}}\frac{1}{4\pi}\int_{0}^{2\pi}\frac{q_{\nu_{a}\nu_{b}}^{L\varphi}q_{\nu_{a}\nu_{b}}^{R({\varphi+\sigma})}+q_{\nu_{a}\nu_{b}}^{R\varphi}q_{\nu_{a}\nu_{b}}^{L({\varphi+\sigma})}}{q_{\nu_{a}\nu_{b}}^{\varphi+\sigma}}d\varphi.$

where $\sigma$ refers to the angle of misalignment in the $X$ basis.

###  B.2 Asynchronous-MDIQKD protocol for short-term matching

The total number of time bins per $T_{c}$ is $N_{T_{c}}=T_{c}F$. For each
detection event, the probability that it belongs to $\mathit{case~{}1}$ is
$p_{c_{1}}=1-(1-\bar{p})^{2N_{T_{c}}-2}$ and the probability of belonging to
$\mathit{case~{}2}$ is $p_{c_{2}}=(1-\bar{p})^{2N_{T_{c}}-2}$, where
$\bar{p}=\sum_{k_{a},k_{b}}p_{k_{a}}p_{k_{b}}q_{k_{a}k_{b}}$ is the average
detection probability, and $2N_{T_{c}}-2$ is the total number of time bins
neighboring the given detection event. The mean number of $\mathit{case~{}2}$
events is $\bar{N}^{c_{2}}=Np_{c_{2}}\bar{p}$.

For simplicity, we divide the post-matching window into $d$ windows with a
time length of $T_{c}$, where $d=N/N_{T_{c}}$. In the $Z$ basis, given that
Alice sends $k_{a}$ and Bob sends $k_{b}$, the detection count in the $i$-th
window and the total detection count are
$x_{k_{a}k_{b}}^{i}=N_{T_{c}}p_{c_{1}}p_{k_{a}}p_{k_{b}}q_{k_{a}k_{b}}$ and
$x_{k_{a}k_{b}}=Np_{c_{1}}p_{k_{a}}p_{k_{b}}q_{k_{a}k_{b}}$, respectively.
After postmatching, the number of correct and incorrect events in the $Z$
basis is

$\displaystyle
n^{z}_{C}=\sum^{d}_{i=1}x^{i}_{\min}\frac{x^{i}_{\mathbf{o}_{a}\mu_{b}}}{x^{i}_{0}}\frac{x^{i}_{\mu_{a}\mathbf{o}_{b}}}{x^{i}_{1}}=\sum^{d}_{i=1}\frac{x^{i}_{\mu_{a}\mathbf{o}_{b}}x^{i}_{\mathbf{o}_{a}\mu_{b}}}{x^{i}_{\max}},$
(19) $\displaystyle
n^{z}_{E}=\sum^{d}_{i=1}x^{i}_{\min}\frac{x^{i}_{\mathbf{o}_{a}\mathbf{o}_{b}}}{x_{0}^{c_{1}}}\frac{x_{\mu_{a}\mu_{b}}^{i}}{x_{1}^{i}}=\sum^{d}_{i=1}\frac{x_{\mathbf{o}_{a}\mathbf{o}_{b}}^{i}x_{\mu_{a}\mu_{b}}^{i}}{x^{i}_{\max}},$

respectively, where
$x^{i}_{0}=x^{i}_{\mathbf{o}_{a}\mu_{b}}+x^{i}_{\mathbf{o}_{a}\mathbf{o}_{b}}$,
$x^{i}_{1}=x^{i}_{\mu_{a}\mathbf{o}_{b}}+x^{i}_{\mu_{a}\mu_{b}}$,
$x^{i}_{\min}=\min\\{x^{i}_{0},x^{i}_{1}\\}$,
$x^{i}_{\max}=\max\\{x^{i}_{0},x^{i}_{1}\\}$. The overall number of events in
the $Z$ basis is $n^{z}=n^{z}_{C}+n^{z}_{E}$, and the bit error rate in the
$Z$ basis is $E^{z}={n^{z}_{E}}/{n^{z}}$.

In our simulation, we set $M=16$. Assuming that $x_{\nu_{a}\nu_{b}}^{m}$, the
detection count of $\\{\nu_{a},~{}\nu_{b}\\}$ events in slice $\delta_{m}$
follows the Poisson distribution
$P_{r}(x_{\nu_{a}\nu_{b}}^{m}=j)=\frac{\lambda^{j}}{j!}e^{-\lambda}$, where
$\lambda=\bar{x}_{\nu_{a}\nu_{b}}^{i}$ is the mean value of
$x_{\nu_{a}\nu_{b}}^{m}$. In the postmatching step, if
$x_{\nu_{a}\nu_{b}}^{m}$ is even, all $\\{\nu_{a},~{}\nu_{b}\\}$ events within
the $m$-th $T_{c}$ will be utilized. If $x_{\nu_{a}\nu_{b}}^{m}$ is odd, there
will be a redundant $\\{\nu_{a},~{}\nu_{b}\\}$ event to be aborted. Therefore,
the mean number of $\\{2\nu_{a},~{}2\nu_{b}\\}$ events per $T_{c}$ is

$\displaystyle n_{2\nu_{a},2\nu_{b}}^{i}$
$\displaystyle=\frac{2}{M}\left[\sum_{k}^{\left\lfloor\frac{N_{T_{c}}-1}{2}\right\rfloor}kP_{r}(2k)+kP_{r}(2k+1)\right]$
(20)
$\displaystyle=\frac{1}{M}\left[\lambda-\frac{1-e^{-2\lambda}}{2}\right].$

The overall error count in the $X$ basis can be given as

$\displaystyle m_{2\nu_{a},2\nu_{b}}^{i}$
$\displaystyle=n_{2\nu_{a},2\nu_{b}}^{i}\sum_{m=0}^{\frac{M}{2}-1}\left[\frac{2}{M}\frac{q_{\nu_{a}\nu_{b}}^{L\varphi_{m}}q_{\nu_{a}\nu_{b}}^{R(\varphi_{m}+\sigma)}+q_{\nu_{a}\nu_{b}}^{R\varphi_{m}}q_{\nu_{a}\nu_{b}}^{L({\varphi_{m}+\sigma})}}{q_{\nu_{a}\nu_{b}}^{\varphi_{m}}q_{\nu_{a}\nu_{b}}^{\varphi_{m}+\sigma}}\right],$
(21)

where $\varphi_{m}=2\pi m/M$.

##  Appendix C Statistical fluctuation analysis

In this Appendix, we introduce the statistical fluctuation analysis method
[90] used in the simulation.

Chernoff bound. Let $x^{*}$ be the expected value of $x$. For a given expected
value $x^{*}$, the Chernoff bound can be used to obtain the upper and lower
bounds of the observed value.

$\displaystyle\overline{x}$
$\displaystyle=\varphi^{U}(x^{*})=x^{*}+\frac{\beta}{2}+\sqrt{2\beta
x^{*}+\frac{\beta^{2}}{4}},$ (22)

and

$\displaystyle\underline{x}$
$\displaystyle=\varphi^{L}(x^{*})=x^{*}-\sqrt{2\beta x^{*}},$ (23)

where $\beta=\ln{\epsilon^{-1}}$.

Variant of Chernoff bound. For a given observed value $x$ and failure
probability $\varepsilon$, the upper and lower bounds of $x^{*}$ can be
acquired by the variant of the Chernoff bound

$\displaystyle\overline{x}^{*}$ $\displaystyle=x+\beta+\sqrt{2\beta
x+\beta^{2}},$ (24)

and

$\displaystyle\underline{x}^{*}$
$\displaystyle=\max\left\\{x-\frac{\beta}{2}-\sqrt{2\beta
x+\frac{\beta^{2}}{4}},~{}0\right\\}.$ (25)

Random sampling without replacement. Let
$X_{n+k}:=\\{x_{1},x_{2},\dots,x_{n+k}\\}$ be a string of binary bits of size
$n+k$, where the number of bits is unknown. Let $X_{k}$ be a random sample
(without replacement) bit string with $k$ is picked from $X_{n+k}$ . Let
$\lambda$ be the probability of a bit value 1 observed in $X_{k}$. Let $X_{n}$
be the remaining bit string, where the probability of bit value 1 observed in
$X_{n}$ is $\chi$. The upper bound of $\chi$ can be expressed as

$\displaystyle\overline{\chi}\leq$
$\displaystyle\lambda+\gamma^{U}(n,k,\lambda,\epsilon),$ (26)

where

$\gamma^{U}(n,k,\lambda,\epsilon)=\frac{\frac{(1-2\lambda)AG}{n+k}+\sqrt{\frac{A^{2}G^{2}}{(n+k)^{2}}+4\lambda(1-\lambda)G}}{2+2\frac{A^{2}G}{(n+k)^{2}}},$
(27)

with $A=\max\\{n,k\\}$ and $G=\frac{n+k}{nk}\ln{\frac{n+k}{2\pi
nk\lambda(1-\lambda)\epsilon^{2}}}$.

## References

  * Bennett and Brassard [2014] C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, Theor. Comput. Sci. 560, 7 (2014).
  * Ekert [1991] A. K. Ekert, Quantum cryptography based on bell’s theorem, Phys. Rev. Lett. 67, 661 (1991).
  * Zhao  _et al._ [2008] Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, Quantum hacking: Experimental demonstration of time-shift attack against practical quantum-key-distribution systems, Phys. Rev. A 78, 042333 (2008).
  * Lydersen  _et al._ [2010] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, Hacking commercial quantum cryptography systems by tailored bright illumination, Nat. Photonics 4, 686 (2010).
  * Tang  _et al._ [2013] Y.-L. Tang, H.-L. Yin, X. Ma, C.-H. F. Fung, Y. Liu, H.-L. Yong, T.-Y. Chen, C.-Z. Peng, Z.-B. Chen, and J.-W. Pan, Source attack of decoy-state quantum key distribution using phase information, Phys. Rev. A 88, 022308 (2013).
  * Xu  _et al._ [2020a] F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, Secure quantum key distribution with realistic devices, Rev. Mod. Phys. 92, 025002 (2020a).
  * Pirandola  _et al._ [2020] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, _et al._ , Advances in quantum cryptography, Adv. Opt. Photon. 12, 1012 (2020).
  * Lo  _et al._ [2012] H.-K. Lo, M. Curty, and B. Qi, Measurement-device-independent quantum key distribution, Phys. Rev. Lett. 108, 130503 (2012).
  * Braunstein and Pirandola [2012] S. L. Braunstein and S. Pirandola, Side-channel-free quantum key distribution, Phys. Rev. Lett. 108, 130502 (2012).
  * Liu  _et al._ [2013] Y. Liu, T.-Y. Chen, L.-J. Wang, H. Liang, G.-L. Shentu, J. Wang, K. Cui, H.-L. Yin, N.-L. Liu, L. Li, X. Ma, J. S. Pelc, M. M. Fejer, C.-Z. Peng, Q. Zhang, and J.-W. Pan, Experimental measurement-device-independent quantum key distribution, Phys. Rev. Lett. 111, 130502 (2013).
  * Rubenok  _et al._ [2013] A. Rubenok, J. A. Slater, P. Chan, I. Lucio-Martinez, and W. Tittel, Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks, Phys. Rev. Lett. 111, 130501 (2013).
  * Zhou  _et al._ [2016] Y.-H. Zhou, Z.-W. Yu, and X.-B. Wang, Making the decoy-state measurement-device-independent quantum key distribution practically useful, Phys. Rev. A 93, 042324 (2016).
  * Tang  _et al._ [2014] Z. Tang, Z. Liao, F. Xu, B. Qi, L. Qian, and H.-K. Lo, Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution, Phys. Rev. Lett. 112, 190503 (2014).
  * Fu  _et al._ [2015] Y. Fu, H.-L. Yin, T.-Y. Chen, and Z.-B. Chen, Long-distance measurement-device-independent multiparty quantum communication, Phys. Rev. Lett. 114, 090501 (2015).
  * Curty  _et al._ [2014] M. Curty, F. Xu, W. Cui, C. C. W. Lim, K. Tamaki, and H.-K. Lo, Finite-key analysis for measurement-device-independent quantum key distribution, Nat. Commun. 5, 3732 (2014).
  * Yin  _et al._ [2014] H.-L. Yin, W.-F. Cao, Y. Fu, Y.-L. Tang, Y. Liu, T.-Y. Chen, and Z.-B. Chen, Long-distance measurement-device-independent quantum key distribution with coherent-state superpositions, Opt. Lett. 39, 5451 (2014).
  * Comandar  _et al._ [2016] L. Comandar, M. Lucamarini, B. Fröhlich, J. Dynes, A. Sharpe, S.-B. Tam, Z. Yuan, R. Penty, and A. Shields, Quantum key distribution without detector vulnerabilities using optically seeded lasers, Nat. Photonics 10, 312 (2016).
  * Yin  _et al._ [2016a] H.-L. Yin, T.-Y. Chen, Z.-W. Yu, H. Liu, L.-X. You, Y.-H. Zhou, S.-J. Chen, Y. Mao, M.-Q. Huang, W.-J. Zhang, H. Chen, M. J. Li, D. Nolan, F. Zhou, X. Jiang, Z. Wang, Q. Zhang, X.-B. Wang, and J.-W. Pan, Measurement-device-independent quantum key distribution over a 404 km optical fiber, Phys. Rev. Lett. 117, 190501 (2016a).
  * Semenenko  _et al._ [2020] H. Semenenko, P. Sibson, A. Hart, M. G. Thompson, J. G. Rarity, and C. Erven, Chip-based measurement-device-independent quantum key distribution, Optica 7, 238 (2020).
  * Yin  _et al._ [2017] H.-L. Yin, W.-L. Wang, Y.-L. Tang, Q. Zhao, H. Liu, X.-X. Sun, W.-J. Zhang, H. Li, I. V. Puthoor, L.-X. You, _et al._ , Experimental measurement-device-independent quantum digital signatures over a metropolitan network, Phys. Rev. A 95, 042338 (2017).
  * Wei  _et al._ [2020] K. Wei, W. Li, H. Tan, Y. Li, H. Min, W.-J. Zhang, H. Li, L. You, Z. Wang, X. Jiang, T.-Y. Chen, S.-K. Liao, C.-Z. Peng, F. Xu, and J.-W. Pan, High-speed measurement-device-independent quantum key distribution with integrated silicon photonics, Phys. Rev. X 10, 031030 (2020).
  * Woodward  _et al._ [2021] R. I. Woodward, Y. Lo, M. Pittaluga, M. Minder, T. Paraïso, M. Lucamarini, Z. Yuan, and A. Shields, Gigahertz measurement-device-independent quantum key distribution using directly modulated lasers, npj Quantum Inf. 7, 58 (2021).
  * Wang  _et al._ [2017] C. Wang, Z.-Q. Yin, S. Wang, W. Chen, G.-C. Guo, and Z.-F. Han, Measurement-device-independent quantum key distribution robust against environmental disturbances, Optica 4, 1016 (2017).
  * Zheng  _et al._ [2021] X. Zheng, P. Zhang, R. Ge, L. Lu, G. He, Q. Chen, F. Qu, L. Zhang, X. Cai, Y. Lu, S. Zhu, P. Wu, and X.-S. Ma, Heterogeneously integrated, superconducting silicon-photonic platform for measurement-device-independent quantum key distribution, Adv. Photonics 3, 055002 (2021).
  * Tang  _et al._ [2016] Y.-L. Tang, H.-L. Yin, Q. Zhao, H. Liu, X.-X. Sun, M.-Q. Huang, W.-J. Zhang, S.-J. Chen, L. Zhang, L.-X. You, Z. Wang, Y. Liu, C.-Y. Lu, X. Jiang, X. Ma, Q. Zhang, T.-Y. Chen, and J.-W. Pan, Measurement-device-independent quantum key distribution over untrustful metropolitan network, Phys. Rev. X 6, 011024 (2016).
  * Pirandola  _et al._ [2009] S. Pirandola, R. García-Patrón, S. L. Braunstein, and S. Lloyd, Direct and reverse secret-key capacities of a quantum channel, Phys. Rev. Lett. 102, 050503 (2009).
  * Takeoka  _et al._ [2014] M. Takeoka, S. Guha, and M. M. Wilde, Fundamental rate-loss tradeoff for optical quantum key distribution, Nat. Commun. 5, 5235 (2014).
  * Pirandola  _et al._ [2017] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, Fundamental limits of repeaterless quantum communications, Nat. Commun. 8, 15043 (2017).
  * Pirandola [2019] S. Pirandola, End-to-end capacities of a quantum communication network, Commun. Phys. 2, 51 (2019).
  * Das  _et al._ [2021] S. Das, S. Bäuml, M. Winczewski, and K. Horodecki, Universal limitations on quantum key distribution over a network, Phys. Rev. X 11, 041016 (2021).
  * Lucamarini  _et al._ [2018] M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate–distance limit of quantum key distribution without quantum repeaters, Nature 557, 400 (2018).
  * Ma  _et al._ [2018] X. Ma, P. Zeng, and H. Zhou, Phase-matching quantum key distribution, Phys. Rev. X 8, 031043 (2018).
  * Wang  _et al._ [2018] X.-B. Wang, Z.-W. Yu, and X.-L. Hu, Twin-field quantum key distribution with large misalignment error, Phys. Rev. A 98, 062323 (2018).
  * Yin and Fu [2019] H.-L. Yin and Y. Fu, Measurement-device-independent twin-field quantum key distribution, Sci. Rep. 9, 3045 (2019).
  * Lin and Lütkenhaus [2018] J. Lin and N. Lütkenhaus, Simple security analysis of phase-matching measurement-device-independent quantum key distribution, Phys. Rev. A 98, 042332 (2018).
  * Curty  _et al._ [2019] M. Curty, K. Azuma, and H.-K. Lo, Simple security proof of twin-field type quantum key distribution protocol, npj Quantum Inf. 5, 64 (2019).
  * Cui  _et al._ [2019] C. Cui, Z.-Q. Yin, R. Wang, W. Chen, S. Wang, G.-C. Guo, and Z.-F. Han, Twin-field quantum key distribution without phase postselection, Phys. Rev. Applied 11, 034053 (2019).
  * Yin and Chen [2019a] H.-L. Yin and Z.-B. Chen, Coherent-state-based twin-field quantum key distribution, Sci. Rep. 9, 14918 (2019a).
  * Hu  _et al._ [2019] X.-L. Hu, C. Jiang, Z.-W. Yu, and X.-B. Wang, Sending-or-not-sending twin-field protocol for quantum key distribution with asymmetric source parameters, Phys. Rev. A 100, 062337 (2019).
  * Zeng  _et al._ [2020] P. Zeng, W. Wu, and X. Ma, Symmetry-protected privacy: beating the rate-distance linear bound over a noisy channel, Phys. Rev. Applied 13, 064013 (2020).
  * Xie  _et al._ [2021a] Y.-M. Xie, B.-H. Li, Y.-S. Lu, X.-Y. Cao, W.-B. Liu, H.-L. Yin, and Z.-B. Chen, Overcoming the rate–distance limit of device-independent quantum key distribution, Opt. Lett. 46, 1632 (2021a).
  * Wang  _et al._ [2020] R. Wang, Z.-Q. Yin, F.-Y. Lu, S. Wang, W. Chen, C.-M. Zhang, W. Huang, B.-J. Xu, G.-C. Guo, and Z.-F. Han, Optimized protocol for twin-field quantum key distribution, Commun. Phys. 3, 149 (2020).
  * Li  _et al._ [2021] B.-H. Li, Y.-M. Xie, Z. Li, C.-X. Weng, C.-L. Li, H.-L. Yin, and Z.-B. Chen, Long-distance twin-field quantum key distribution with entangled sources, Opt. Lett. 46, 5529 (2021).
  * Maeda  _et al._ [2019] K. Maeda, T. Sasaki, and M. Koashi, Repeaterless quantum key distribution with efficient finite-key analysis overcoming the rate-distance limit, Nat. Commun. 10, 3140 (2019).
  * Yin and Chen [2019b] H.-L. Yin and Z.-B. Chen, Finite-key analysis for twin-field quantum key distribution with composable security, Sci. Rep. 9, 17113 (2019b).
  * Jiang  _et al._ [2019] C. Jiang, Z.-W. Yu, X.-L. Hu, and X.-B. Wang, Unconditional security of sending or not sending twin-field quantum key distribution with finite pulses, Phys. Rev. Applied 12, 024061 (2019).
  * Currás-Lorenzo  _et al._ [2021] G. Currás-Lorenzo, Á. Navarrete, K. Azuma, G. Kato, M. Curty, and M. Razavi, Tight finite-key security for twin-field quantum key distribution, npj Quantum Inf. 7, 22 (2021).
  * Minder  _et al._ [2019] M. Minder, M. Pittaluga, G. Roberts, M. Lucamarini, J. Dynes, Z. Yuan, and A. Shields, Experimental quantum key distribution beyond the repeaterless secret key capacity, Nat. Photonics 13, 334 (2019).
  * Zhong  _et al._ [2019] X. Zhong, J. Hu, M. Curty, L. Qian, and H.-K. Lo, Proof-of-principle experimental demonstration of twin-field type quantum key distribution, Phys. Rev. Lett. 123, 100506 (2019).
  * Wang  _et al._ [2019] S. Wang, D.-Y. He, Z.-Q. Yin, F.-Y. Lu, C.-H. Cui, W. Chen, Z. Zhou, G.-C. Guo, and Z.-F. Han, Beating the fundamental rate-distance limit in a proof-of-principle quantum key distribution system, Phys. Rev. X 9, 021046 (2019).
  * Liu  _et al._ [2019] Y. Liu, Z.-W. Yu, W. Zhang, J.-Y. Guan, J.-P. Chen, C. Zhang, X.-L. Hu, H. Li, C. Jiang, J. Lin, T.-Y. Chen, L. You, Z. Wang, X.-B. Wang, Q. Zhang, and J.-W. Pan, Experimental twin-field quantum key distribution through sending or not sending, Phys. Rev. Lett. 123, 100505 (2019).
  * Fang  _et al._ [2020] X.-T. Fang, P. Zeng, H. Liu, M. Zou, W. Wu, Y.-L. Tang, Y.-J. Sheng, Y. Xiang, W. Zhang, H. Li, Z. Wang, L. You, M.-J. Li, H. Chen, Y.-A. Chen, Q. Zhang, C.-Z. Peng, X. Ma, T.-Y. Chen, and J.-W. Pan, Implementation of quantum key distribution surpassing the linear rate-transmittance bound, Nat. Photonics 14, 422 (2020).
  * Chen  _et al._ [2020] J.-P. Chen, C. Zhang, Y. Liu, C. Jiang, W. Zhang, X.-L. Hu, J.-Y. Guan, Z.-W. Yu, H. Xu, J. Lin, M.-J. Li, H. Chen, H. Li, L. You, Z. Wang, X.-B. Wang, Q. Zhang, and J.-W. Pan, Sending-or-not-sending with independent lasers: Secure twin-field quantum key distribution over 509 km, Phys. Rev. Lett. 124, 070501 (2020).
  * Liu  _et al._ [2021a] H. Liu, C. Jiang, H.-T. Zhu, M. Zou, Z.-W. Yu, X.-L. Hu, H. Xu, S. Ma, Z. Han, J.-P. Chen, Y. Dai, S.-B. Tang, W. Zhang, H. Li, L. You, Z. Wang, Y. Hua, H. Hu, H. Zhang, F. Zhou, Q. Zhang, X.-B. Wang, T.-Y. Chen, and J.-W. Pan, Field test of twin-field quantum key distribution through sending-or-not-sending over 428 km, Phys. Rev. Lett. 126, 250502 (2021a).
  * Zhong  _et al._ [2021] X. Zhong, W. Wang, L. Qian, and H.-K. Lo, Proof-of-principle experimental demonstration of twin-field quantum key distribution over optical channels with asymmetric losses, npj Quantum Inf. 7, 8 (2021).
  * Chen  _et al._ [2021a] J.-P. Chen, C. Zhang, C. Liu, Yang Jiang, W.-J. Zhang, Z.-Y. Han, S.-Z. Ma, X.-L. Hu, Y.-H. Li, F. Liu, Hui Zhou, H.-F. Jiang, H. Chen, Teng-Yun Li, L.-X. You, Z. Wang, X.-B. Wang, Q. Zhang, and J.-W. Pan, Twin-field quantum key distribution over a 511 km optical fibre linking two distant metropolitan areas, Nat. Photonics 15, 570 (2021a).
  * Clivati  _et al._ [2022] C. Clivati, A. Meda, S. Donadello, S. Virzì, M. Genovese, F. Levi, A. Mura, M. Pittaluga, Z. Yuan, A. J. Shields, M. Lucamarini, I. P. Degiovanni, and D. Calonico, Coherent phase transfer for real-world twin-field quantum key distribution, Nat. Commun. 13, 157 (2022).
  * Pittaluga  _et al._ [2021] M. Pittaluga, M. Minder, M. Lucamarini, M. Sanzaro, R. I. Woodward, M.-J. Li, Z. Yuan, and A. J. Shields, 600-km repeater-like quantum communications with dual-band stabilization, Nat. Photonics 15, 530 (2021).
  * Chen  _et al._ [2021b] J.-P. Chen, C. Zhang, Y. Liu, C. Jiang, D.-F. Zhao, W.-J. Zhang, F.-X. Chen, H. Li, L.-X. You, Z. Wang, Y. Chen, X.-B. Wang, Q. Zhang, and J.-W. Pan, Quantum key distribution over 658 km fiber with distributed vibration sensing, arXiv preprint arXiv:2110.11671 (2021b).
  * Wang  _et al._ [2022] S. Wang, Z.-Q. Yin, D.-Y. He, W. Chen, R.-Q. Wang, P. Ye, Y. Zhou, G.-J. Fan-Yuan, F.-X. Wang, W. Chen, Y.-G. Zhu, P. V. Morozov, A. V. Divochiy, Z. Zhou, G.-C. Guo, and Z.-F. Han, Twin-field quantum key distribution over 830-km fibre, Nat. Photonics 16, 154 (2022).
  * Kazovsky [1986] L. Kazovsky, Balanced phase-locked loops for optical homodyne receivers: performance analysis, design considerations, and laser linewidth requirements, J. Light. Technol. 4, 182 (1986).
  * Kazovsky and Atlas [1990] L. G. Kazovsky and D. A. Atlas, A 1320-nm experimental optical phase-locked loop: performance investigation and psk homodyne experiments at 140 mb/s and 2 gb/s, J. Light. Technol. 8, 1414 (1990).
  * Predehl  _et al._ [2012] K. Predehl, G. Grosche, S. M. F. Raupach, S. Droste, O. Terra, J. Alnis, T. Legero, T. W. Hänsch, T. Udem, R. Holzwarth, and H. Schnatz, A 920-kilometer optical fiber link for frequency metrology at the 19th decimal place, Science 336, 441 (2012).
  * Huang  _et al._ [2019] A. Huang, A. Navarrete, S.-H. Sun, P. Chaiwongkhot, M. Curty, and V. Makarov, Laser-seeding attack in quantum key distribution, Phys. Rev. Applied 12, 064043 (2019).
  * Pang  _et al._ [2020] X.-L. Pang, A.-L. Yang, C.-N. Zhang, J.-P. Dou, H. Li, J. Gao, and X.-M. Jin, Hacking quantum key distribution via injection locking, Phys. Rev. Applied 13, 034008 (2020).
  * Lucamarini  _et al._ [2015] M. Lucamarini, I. Choi, M. B. Ward, J. F. Dynes, Z. L. Yuan, and A. J. Shields, Practical security bounds against the trojan-horse attack in quantum key distribution, Phys. Rev. X 5, 031030 (2015).
  * Sajeed  _et al._ [2016] S. Sajeed, A. Huang, S. Sun, F. Xu, V. Makarov, and M. Curty, Insecurity of detector-device-independent quantum key distribution, Phys. Rev. Lett. 117, 250505 (2016).
  * Zhang  _et al._ [2021] G. Zhang, I. W. Primaatmaja, J. Y. Haw, X. Gong, C. Wang, and C. C. W. Lim, Securing practical quantum communication systems with optical power limiters, PRX Quantum 2, 030304 (2021).
  * Bozzio  _et al._ [2021] M. Bozzio, A. Cavaillès, E. Diamanti, A. Kent, and D. Pitalúa-García, Multiphoton and side-channel attacks in mistrustful quantum cryptography, PRX Quantum 2, 030338 (2021).
  * Cao  _et al._ [2020] Y. Cao, Y.-H. Li, K.-X. Yang, Y.-F. Jiang, S.-L. Li, X.-L. Hu, M. Abulizi, C.-L. Li, W. Zhang, Q.-C. Sun, W.-Y. Liu, X. Jiang, S.-K. Liao, J.-G. Ren, H. Li, L. You, Z. Wang, J. Yin, C.-Y. Lu, X.-B. Wang, Q. Zhang, C.-Z. Peng, and J.-W. Pan, Long-distance free-space measurement-device-independent quantum key distribution, Phys. Rev. Lett. 125, 260503 (2020).
  * Liu  _et al._ [2021b] H.-Y. Liu, X.-H. Tian, C. Gu, P. Fan, X. Ni, R. Yang, J.-N. Zhang, M. Hu, J. Guo, X. Cao, X. Hu, G. Zhao, Y.-Q. Lu, Y.-X. Gong, Z. Xie, and S.-N. Zhu, Optical-relayed entanglement distribution using drones as mobile nodes, Phys. Rev. Lett. 126, 020503 (2021b).
  * Hu  _et al._ [2021] C.-Q. Hu, Z.-Q. Yan, J. Gao, Z.-M. Li, H. Zhou, J.-P. Dou, and X.-M. Jin, Decoy-state quantum key distribution over a long-distance high-loss air-water channel, Phys. Rev. Applied 15, 024060 (2021).
  * Chen  _et al._ [2021c] Y.-A. Chen, Q. Zhang, T.-Y. Chen, W.-Q. Cai, S.-K. Liao, J. K. Chen, J. Yin, J.-G. Ren, Z. Chen, S.-L. Han, Q. Yu, K. Liang, F. Zhou, X. Yuan, M.-S. Zhao, T.-Y. Wang, X. Jiang, L. Zhang, W.-Y. Liu, Y. Li, Q. Shen, Y. Cao, C.-Y. Lu, R. Shu, J.-Y. Wang, L. Li, N.-L. Liu, F. Xu, X.-B. Wang, C.-Z. Peng, and J.-W. Pan, An integrated space-to-ground quantum communication network over 4,600 kilometres, Nature 589, 214 (2021c).
  * Dequal  _et al._ [2021] D. Dequal, L. T. Vidarte, V. R. Rodriguez, G. Vallone, P. Villoresi, A. Leverrier, and E. Diamanti, Feasibility of satellite-to-ground continuous-variable quantum key distribution, npj Quantum Inf. 7, 3 (2021).
  * Yin  _et al._ [2020a] J. Yin, Y.-H. Li, S.-K. Liao, M. Yang, Y. Cao, L. Zhang, J.-G. Ren, W.-Q. Cai, W.-Y. Liu, S.-L. Li, _et al._ , Entanglement-based secure quantum cryptography over 1,120 kilometres, Nature 582, 501 (2020a).
  * Takenaka  _et al._ [2017] H. Takenaka, A. Carrasco-Casado, M. Fujiwara, M. Kitamura, M. Sasaki, and M. Toyoshima, Satellite-to-ground quantum-limited communication using a 50-kg-class microsatellite, Nat. Photonics 11, 502 (2017).
  * Wehner  _et al._ [2018] S. Wehner, D. Elkouss, and R. Hanson, Quantum internet: A vision for the road ahead, Science 362, eaam9288 (2018).
  * Sidhu  _et al._ [2021] J. S. Sidhu, S. K. Joshi, M. Gündoğan, T. Brougham, D. Lowndes, L. Mazzarella, M. Krutzik, S. Mohapatra, D. Dequal, G. Vallone, P. Villoresi, A. Ling, T. Jennewein, M. Mohageg, J. G. Rarity, I. Fuentes, S. Pirandola, and D. K. L. Oi, Advances in space quantum communications, IET Quantum Commun. 2, 182 (2021).
  * Ma and Razavi [2012] X. Ma and M. Razavi, Alternative schemes for measurement-device-independent quantum key distribution, Phys. Rev. A 86, 062319 (2012).
  * Xie  _et al._ [2021b] Y.-M. Xie, C.-X. Weng, Y.-S. Lu, Y. Fu, Y. Wang, H.-L. Yin, and Z.-B. Chen, Scalable high-rate twin-field quantum key distribution networks without constraint of probability and intensity, arXiv preprint arXiv:2112.11165 (2021b).
  * Xu  _et al._ [2020b] H. Xu, Z.-W. Yu, C. Jiang, X.-L. Hu, and X.-B. Wang, Sending-or-not-sending twin-field quantum key distribution: Breaking the direct transmission key rate, Phys. Rev. A 101, 042330 (2020b).
  * Jiang  _et al._ [2020] C. Jiang, X.-L. Hu, H. Xu, Z.-W. Yu, and X.-B. Wang, Zigzag approach to higher key rate of sending-or-not-sending twin field quantum key distribution with finite-key effects, New J. Phys. 22, 053048 (2020).
  * Azuma  _et al._ [2015] K. Azuma, K. Tamaki, and W. J. Munro, All-photonic intercity quantum key distribution, Nat. Commun. 6, 10171 (2015).
  * Bose and Home [2013] S. Bose and D. Home, Duality in entanglement enabling a test of quantum indistinguishability unaffected by interactions, Phys. Rev. Lett. 110, 140404 (2013).
  * Lo  _et al._ [2005] H.-K. Lo, X. Ma, and K. Chen, Decoy state quantum key distribution, Phys. Rev. Lett. 94, 230504 (2005).
  * Wang [2005] X.-B. Wang, Beating the photon-number-splitting attack in practical quantum cryptography, Phys. Rev. Lett. 94, 230503 (2005).
  * Takesue  _et al._ [2007] H. Takesue, S. W. Nam, Q. Zhang, R. H. Hadfield, T. Honjo, K. Tamaki, and Y. Yamamoto, Quantum key distribution over a 40-db channel loss using superconducting single-photon detectors, Nat. Photonics 1, 343 (2007).
  * Islam  _et al._ [2017] N. T. Islam, C. C. W. Lim, C. Cahall, J. Kim, and D. J. Gauthier, Provably secure and high-rate quantum key distribution with time-bin qudits, Sci. Adv. 3, e1701491 (2017).
  * Chernoff [1952] H. Chernoff, A measure of asymptotic efficiency for tests of a hypothesis based on the sum of observations, Ann. Math. Stat. 23, 493 (1952).
  * Yin  _et al._ [2020b] H.-L. Yin, M.-G. Zhou, J. Gu, Y.-M. Xie, Y.-S. Lu, and Z.-B. Chen, Tight security bounds for decoy-state quantum key distribution, Sci. Rep. 10, 14312 (2020b).
  * Lo and Preskill [2007] H.-K. Lo and J. Preskill, Security of quantum key distribution using weak coherent states with nonrandom phases, Quantum Inf. Comput. 7, 431 (2007).
  * Koashi [2009] M. Koashi, Simple security proof of quantum key distribution based on complementarity, New J. Phys. 11, 045018 (2009).
  * Lo [2001] H.-K. Lo, Proof of unconditional security of six-state quatum key distribution scheme, Quantum Inf. Comput. 1, 81 (2001).
  * Yin  _et al._ [2016b] H.-L. Yin, Y. Fu, Y. Mao, and Z.-B. Chen, Security of quantum key distribution with multiphoton components, Sci. Rep. 6, 29482 (2016b).
  * Zeng  _et al._ [2022] P. Zeng, H. Zhou, W. Wu, and X. Ma, Quantum key distribution surpassing the repeaterless rate-transmittance bound without global phase locking, arXiv preprint arXiv:2201.04300 (2022).