# One-Time Universal Hashing Quantum Digital Signatures without Perfect Keys

Bing-Hong Li  Yuan-Mei Xie  Xiao-Yu Cao  Chen-Long Li  National Laboratory of
Solid State Microstructures and School of Physics, Collaborative Innovation
Center of Advanced Microstructures, Nanjing University, Nanjing 210093, China
Yao Fu<EMAIL_ADDRESS>Beijing National Laboratory for Condensed Matter
Physics and Institute of Physics, Chinese Academy of Sciences, Beijing 100190,
China  Hua-Lei Yin<EMAIL_ADDRESS>Zeng-Bing Chen<EMAIL_ADDRESS>National Laboratory of Solid State Microstructures and School of Physics,
Collaborative Innovation Center of Advanced Microstructures, Nanjing
University, Nanjing 210093, China

###### Abstract

Quantum digital signatures (QDS), generating correlated bit strings among
three remote parties for signatures through quantum law, can guarantee non-
repudiation, authenticity, and integrity of messages. Recently, one-time
universal hashing QDS framework, exploiting the quantum asymmetric encryption
and universal hash functions, has been proposed to significantly improve the
signature rate and ensure unconditional security by directly signing the hash
value of long messages. However, similar to quantum key distribution, this
framework utilizes keys with perfect secrecy by performing privacy
amplification that introduces cumbersome matrix operations, thereby consuming
large computational resources, causing delays, and increasing failure
probability. Here, we prove that, different from private communication,
imperfect quantum keys with partial information leakage can be used for
digital signatures and authentication without compromising the security while
having eight orders of magnitude improvement on signature rate for signing a
megabit message compared with conventional single-bit schemes. This study
significantly reduces the delay for data postprocessing and is compatible with
any quantum key generation protocols. In our simulation, taking two-photon
twin-field key generation protocol as an example, QDS can be practically
implemented over a fiber distance of 650 km between the signer and receiver.
For the first time, this study offers a cryptographic application of quantum
keys with imperfect secrecy and paves a way for the practical and agile
implementation of digital signatures in a future quantum network.

##  I Introduction

Digital signatures are cryptographic primitives that offer data authenticity
and integrity [1], especially for the non-repudiation of sensitive
information. It has become an indispensable and essential technique in the
global internet owing to its wide application especially in digital financial
transactions, email, and digital currency. However, the security of classical
digital signatures, guaranteed by public-key infrastructure [2, 3, 4], is
threatened by rapidly developing algorithms [5, 6] and quantum computing [7].
Different from classical digital signatures, quantum digital signatures (QDSs)
can provide a higher level of security, information-theoretic security, by
employing the fundamental principles of quantum mechanics. That is, QDS can
protect data integrity, authenticity, and non-repudiation even if the attacker
utilizes unlimited computational power. The rudiment of the single-bit QDS
scheme was introduced in 2001 [8], but it could not be implemented due to some
impractical requirements such as high-dimensional single-photon states and
quantum memories. Subsequently, there have been many developments to remove
these impractical requirements [9, 10, 11], making QDS closer to real
implementation. Furthermore, based on non-orthogonal encoding [12] and
orthogonal encoding [13], respectively, two independent single-bit QDS
protocols without secure quantum channels were proposed and proved to be
secure for the first time. These two protocols have triggered numerous
achievements of single-bit QDS theoretically [14, 15, 16, 17, 18, 19, 20, 21,
22, 23, 24, 25] and experimentally [26, 27, 28, 29, 30, 31, 32, 33, 34, 35,
36].

Nonetheless, all these schemes still have several limitations. Protocols
utilizing orthogonal encoding require additional symmetrization steps which
results in extra secure channels [13]. Therefore, to guarantee information-
theoretic security, quantum key distribution (QKD) and one-time pad encryption
are required between two receivers in orthogonal-type protocols [28, 29].
Single-bit QDS schemes based on non-orthogonal encoding [12, 20, 23] are
independent of additional QKD channels, but the signature rate is sensitive to
the misalignment error of the quantum channel. In addition, all these schemes
can sign only a one-bit message in each round. If one wants to sign a multi-
bit message using single-bit QDS schemes, he needs to encode it into a new
message string and sign the new string bit by bit [37, 38, 39, 40, 41, 22].
However, these solutions have not been completely proved as information-
theoretically secure with the quantified failure probability, and the
signature rate is very low and far from implementation for long messages with
a lot of bits.

Recently, an efficient QDS scheme has been proposed based on secret sharing,
one-time pad, and one-time universal hashing (OTUH) [42]. Different from
single-bit QDS protocols that require a long key string to sign a one-bit
message, this OUTH-QDS protocol offers a method to directly sign the hash
value of multi-bit messages through one key string with information-theoretic
security, and thus drastically improves the QDS efficiency. However, this
framework requires perfect keys with complete secrecy, which is an expensive
resource guaranteed by the complete procedure of QKD or quantum secret sharing
(QSS). Accordingly, privacy amplification steps are required, thereby adding
to the complexity of the algorithm and causing unendurable delays.

Here, we point out that quantum keys with imperfect secrecy are adequate for
protecting the authenticity and integrity of messages in such a digital
signature scheme. Accordingly, we propose a new OTUH-QDS protocol with
imperfectly secret keys, utilizing only asymmetric quantum keys without
perfect secrecy to sign multi-bit messages. We demonstrate that our proposed
scheme provides information-theoretic security for digital signature tasks and
simulate the performance of our protocol. The result reveals that our protocol
outperforms other QDS schemes in terms of signature rate and transmission
distance. In a practical case of signing a megabit message, the proposed
scheme has a higher signature rate of nearly eight orders of magnitude,
compared with single-bit QDS schemes due to its robustness against message
size. Moreover, we show that our scheme can significantly reduce the
computational costs and delays of postprocessing owing to the removal of
privacy amplification. Furthermore, the proposed scheme is a general framework
that can be applied to all existing QKD protocols. When utilizing the idea of
two-photon twin-field QKD [43], one of the most efficient QKD protocols, to
execute our work, a transmission distance of 650 km can be achieved with a
signature rate of 0.01 times per second.

To date, almost all quantum communication protocols such as QKD [44, 45, 46,
47, 48, 49, 50, 51, 52, 53, 54], QSS [55, 56, 57], and quantum conference key
agreement [55, 58] aim at generating quantum states among the parties and
extract keys with perfect secrecy through complex postprocessing steps.
Thereafter, these keys are then used to finish the corresponding cryptographic
tasks such as private communication, secret sharing, and group encryption. In
contrast, the proposed protocol offers a new approach to digital signature
tasks that only require keys with imperfect secrecy through quantum optical
communication. The troublesome postprocessing steps are thus moved out without
relaxing the security assumption. This is the first instance of applying this
kind of keys to cryptographic tasks with information-theoretic security. We
believe that our proposed solution can provide a feasible approach to the
practical application of QDS and enlighten other applications of quantum keys
with imperfect secrecy in a future quantum communication network.

The remainder of this paper is organized as follows. In Sec. II we review
OTUH-QDS scheme and introduce the motivation of this work. In Sec. III we
propose our protocol with two approaches of universal hashing. In Sec. IV we
give the security proof of authentication based on quantum keys with imperfect
secrecy and then, the security analysis of the proposed QDS protocol. In Sec.
V we discuss the performance of the proposed scheme and compare it with both
single-bit QDS and OTUH-QDS schemes. Finally, we conclude the paper in Sec.
VI.

##  II PRELIMINARIES

Figure 1:  (a) OTUH-QDS [42]. In the distribution stage, Alice, Bob and
Charlie share key bit strings with perfect secret sharing relationship through
key generation protocol (KGP), error correction and privacy amplification. In
the messaging stage Alice generates the signature through AXU hashing, and
sends the message and signature to Bob. Bob then sends his keys and received
information to Charlie, who will later send his keys to Bob. Ultimately, Bob
and Charlie use their own and received keys to infer Alice keys and then
perform AXU hashing to verify the signature. (b) Schematic of the proposed
protocol. In the distribution stage, the users only perform KGP and error
correction to share keys with full correctness but some secrecy leakage. Their
keys still hold secret sharing relationship. In the messaging stage the
manipulation of classic information is analogous to that in OUTH-QDS.

###  II.1 OTUH-QDS protocol

The schematic of OTUH-QDS [42] isreviewed herein. The protocol can be
segmented into the distribution stage and messaging stage, consistent with
single-bit QDS introduced in Appendix A.1. The length of message is denoted as
$m$. The schematic of OTUH-QDS is shown in Fig. 1(a).

####  II.1.1 distribution stage

Alice, Bob, and Charlie each have two key bit strings
$\\{X_{a},~{}X_{b},~{}X_{c}\\}$ with $n$ bits and
$\\{Y_{a},~{}Y_{b},~{}Y_{c}\\}$ with $2n$ bits, satisfying the perfect
correlation $X_{a}=X_{b}\oplus X_{c}$ and $Y_{a}=Y_{b}\oplus Y_{c}$,
respectively. The distribution stage can be realized using quantum
communication protocols, such as QKD and QSS. It need to be mentioned that
single-bit QDS requires only the quantum part of QKD protocols, also refered
as key generation protocol (KGP). In OTUH-QDS, the users need to perform
additional error correction and privacy amplification steps after KGP.

####  II.1.2 messaging stage

(i) _Signing of Alice_ —First, Alice uses a local quantum random number,
characterized by an $n$-bit string $p_{a}$, to randomly generate an
irreducible polynomial $p(x)$ of degree $n$ [59]. Second, she uses the initial
vector (key bit string $X_{a}$) and irreducible polynomial (quantum random
number $p_{a}$) to generate a random linear feedback shift register-based
(LFSR-based) Toeplitz matrix [60] $H_{nm}$, with $n$ rows and $m$ columns.
Third, she uses a hash operation with $Hash$= $H_{nm}\cdot Doc$ to acquire an
$n$-bit hash value of the $m$-bit document. Fourth, she exploits the hash
value and the irreducible polynomial to constitute the $2n$-bit digest
$Dig=(Hash||p_{a})$. Fifth, she encrypts the digest with her key bit string
$Y_{a}$ to obtain the $2n$-bit signature $Sig=Dig\oplus Y_{a}$ using OTP.
Finally, she uses the public channel to send the signature and document
$\\{Sig,~{}Doc\\}$ to Bob. Note that $Sig$ includes the information of the
irreducible polynomial chosen for the hashing.

(ii) _Verification of Bob_ —Bob uses the authentication classical channel to
transmit the received $\\{Sig,~{}Doc\\}$, as well as his key bit strings
$\\{X_{b},~{}Y_{b}\\}$, to Charlie. Thereafter, Charlie uses the same
authentication channel to forward his key bit strings $\\{X_{c},~{}Y_{c}\\}$
to Bob. Bob obtains two new key bit strings $\\{K_{X_{b}}=X_{b}\oplus
X_{c},~{}K_{Y_{b}}=Y_{b}\oplus Y_{c}\\}$ by the XOR operation. Bob exploits
$K_{Y_{b}}$ to obtain an expected digest and bit string $p_{b}$ via XOR
decryption. Bob utilizes the initial vector $K_{X_{b}}$ and irreducible
polynomial $p_{b}$ to establish an LFSR-based Toeplitz matrix. He uses a hash
operation to acquire an $n$-bit hash value and then constitutes a $2n$-bit
actual digest. Bob will accept the signature if the actual digest is equal to
the expected digest. Then, he informs Charlie of the result. Otherwise, Bob
rejects the signature and announces to abort the protocol.

(iii) _Verification of Charlie_ —If Bob announces that he accepts the
signature, Charlie then uses his original key along with the key sent to Bob
to create two new key bit strings $\\{K_{X_{c}}=X_{b}\oplus
X_{c},~{}K_{Y_{c}}=Y_{b}\oplus Y_{c}\\}$. Charlie employs $K_{Y_{c}}$ to
acquire an expected digest and bit string $p_{c}$ via XOR decryption. Charlie
uses a hash operation to obtain an $n$-bit hash value and then constitutes a
$2n$-bit actual digest, where the hash function is an LFSR-based Toeplitz
matrix generated by initial vector $K_{X_{c}}$ and irreducible polynomial
$p_{c}$. Charlie accepts the signature only if the two digests are identical;
otherwise, Charlie rejects the signature.

The core point of this protocol is to realize the perfect bits correlation of
the three parties, construct a completely asymmetric key relationship for
them, and perform one-time almost XOR universal2 (AXU) hashing, specifically,
LFSR-based Toeplitz hashing, to generate the signature. AXU hash functions is
a special class of hash functions that can map an input value of arbitrary
length into an almost random hash value with a preset length [61]. The
signature generated in OTUH-QDS is simply the AXU hash value of the long
message to be signed, where the AXU hash function is determined by using only
one string of Alice keys. After the distribution stage, Alice’s, Bob’s and
Charlie’s keys are completely secret and correct with the relationship of
secret sharing. Bob (Charlie) can only obtain Alice’s keys after he receives
keys of Charlie (Bob). Thus Bob can obtain no information of Alice’s keys
which decides the AXU hash function before transfering the message and
signature to Charlie. Accordingly, Bob’s forging attack under this protocol is
equivalent to that against an authentication scenario where Alice sends an
authenticated message to Charlie. It has been proved that such a message
authentication scheme based on AXU hashing is information-theoretically secure
[60]. Consequently, forging attack is protected by one-time AXU hash functions
and key relationship among three parties. From the perspective of Alice, Bob
and Charlie’s keys are totally symmetric when they verify the signature. Thus,
Alice’s repudiation attack is prevented as well.

###  II.2 Motivation of this work

Different from all single-bit QDS protocols that require a long key string to
sign a one-bit message, OUTH-QDS offers a method to sign multi-bit messages
through one key string with information-theoretic security, and thereby
drastically improves the QDS efficiency. Essentially, this advantage is
introduced by AXU hash functions, which has been proved to be information-
theoretically secure only under perfectly secret keys in previous studies.
Thus, compared with single-bit QDS, OTUH-QDS requires extra error correction
and privacy amplification steps to realize the perfect bits correlation in the
distribution stage. These postprocessing steps especially privacy
amplification involves multiplication calculations on matrices with comparable
length of data size, which introduces heavy computational costs and unpleasant
delays in practical scenarios. For large-size data, the delays will become
unendurable and constrain the practicality.

The process of AXU hashing is equivalent to the scenario where the input value
decides the function, mapping the initial input keys into almost random output
hash values. We notice that partial secrecy leakage of input value (keys) will
be concealed in AXU hash value because of its randomness. Thus, these
imperfect keys with partial secrecy leakage will not undermine the
authenticity of messages in a QDS scheme like OTUH-QDS. Moreover, the
integrity of messages is also not compromised. Based on this concept, in this
paper we propose a solution for OTUH-QDS protocols with imperfectly secret
keys. In other words, we implement QDS with quantum keys without privacy
amplification. As the additional computational cost and delays of OTUH-QDS are
primarily introduced by privacy amplification, this concept can effectively
reduce the weaknesses of OTUH-QDS and lay a ground for the future
implementation of QDS in a quantum network.

The schematic of the proposed protocol is illustrated in Fig. 1(b). In the
distribution stage users only perform the error correction step after KGP,
ensuring that their keys have no mismatches, and build a secret sharing
relationship through Alice’s XOR operation. The final keys will be randomly
divided into several $n$-bit groups for AXU hashing. Each of these groups of
keys contains full correctness and some secrecy leakage with an upper bound
which can be estimated through finite-size analysis using experimental data in
KGP. In the messaging stage, the rules of information exchange are consistent
with that in OTUH-QDS. We will prove that the bit stings generated in our
distribution stage are sufficient for AXU hashing and quantify the security
bound in Sec. IV. In addition, we give two solutions based on different types
of AXU hash functions.

Figure 2: Schematic of the setup of the proposed QDS protocol. The red line
represents quantum optical channel in the distribution stage, and the black
arrow line represents the information exchange through classic authenticated
channel in the messaging stage. (i) In the distribution stage, Alice, Bob and
Charlie utilize a narrow-linewidth continuous-wave laser, intensity modulator
(IM), phase modulator (PM), arbitrary wave generator (AWG) and variable
optical attenuator (VOA) to prepare a phase-randomized weak coherent source
with different intensities and phases. The signals from Bob and Charlie will
both go through an optical switch. An untrusted relay Eve performs
interference measurement on the signals from Alice and an optical switch with
a beam splitter (BS) and a single-photon detector (SPD). After sifting,
parameter estimation and error correction, Alice can share bit strings with
Bob and Charlie, respectively. (ii) In the messaging stage, Alice transmits
the desired message to Bob. Bob sends the message along with his keys to
Charlie. Charlie will then send his keys to Bob. Then Bob verifies the
signature by his own and received keys. If he accepts the signature, he will
inform Charlie who will also verify the signature by his own and received
keys. The signature is successfully validated if both Bob and Charlie accept
it.

##  III QDS PROTOCOL

A schematic of setups of the proposed QDS protocol is illustrated herein and
illustrated in Fig. 2.

###  III.1 Distribution stage

Our proposal is a general framework in which KGP can be derived from any type
of QKD protocol. As an example, the proposed scheme is demonstrated based on
two-photon twin-field (TP-TF) QKD [43]. In the distribution stage, Alice–-Bob
and Alice–-Charlie independently implement TP-TF KGP (TP-TFKGP for simplicity)
to share key bit strings. We remark that in this three-party protocol the
process of Alice–-Bob and Alice–-Charlie are independent, and can be performed
separately. The difficulty of the experiment is the same as two-party QKD
protocols. Specifically, TP-TFKGP utilizes the idea of two-photon interference
to distribute quantum states. Consequently, the performance is independent of
probability and intensity for each user, meanwhile having high misalignment
error tolerance. The protocol is thus unaffected by the addition or deletion
of users (as long as the number of users is on less than three), highly
versatile and suitable for future quantum metropolitan networks.

1\. Preparation. At each time bin $i\in\\{1,2,\ldots,N\\}$, Alice and Bob
(Alice and Charlie) each independently prepare a weak coherent pulse ${\lvert
e^{\textbf{i}(\theta_{x}^{i}+r_{x}^{i}\pi)}\sqrt{k_{x}^{i}}\rangle}$ with
probability $p_{k_{x}}$, where the subscript $x\in\\{a,b,c\\}$ represents the
user Alice, Bob or Charlie, the phase $\theta_{x}^{i}$ $\in[0,2\pi)$,
classical bit $r_{x}^{i}\in\\{0,1\\}$, intensity
$k_{x}^{i}\in\\{\mu_{x},~{}\nu_{x},~{}\mathbf{o}_{x},~{}\hat{\mathbf{o}}_{x}\\}$
(represent signal, decoy, preserve-vacuum and declare-vacuum intensity,
$\mu_{x}>\nu_{x}>\mathbf{o}_{x}=\hat{\mathbf{o}}_{x}=0$) are chosen randomly.
Then Alice and Bob (Alice and Charlie) transmit the corresponding pulses to
the untrusted relay Eve through insecure quantum channels, respectively. In
addition, they send a bright reference light to Eve to measure the phase noise
difference $\phi_{ab}^{i}$ ($\phi_{ac}^{i}$).

2\. Measurement. Eve performs interference measurements on every received
pulse pair with a beam splitter and two detectors. If one and only one
detector clicks, Eve announces that she obtained a successful detection event
and which detector clicked. In the following we use the brace with the
information of users’ intensity selection in it to distinguish these events.
For example, $\\{\mu_{a},\mathbf{o}_{b}\\}$ represents the events that Alice
selects signal intensity and Bob selects vacuum intensity.

3\. Sifting. Here we only list the sifting process between Alice and Bob for
simplicity since Alice–Bob and Alice–Charlie are symmetric. Alice and Charlie
will sift their successful detection events following the same approach.

All successful events are segmented into two parts. The first part is those
when neither Alice nor Bob selects the decoy or declare-vacuum intensity,
i.e., $\\{\mu_{a},\mathbf{o}_{b}\\}$, $\\{\mu_{a},\mu_{b}\\}$,
$\\{\mathbf{o}_{a},\mu_{b}\\}$, and $\\{\mathbf{o}_{a},\mathbf{o}_{b}\\}$,
which will be used for generating data in the $Z$ basis to form the key. The
other successful events, i.e., the second part, are used for estimating
parameters. For the first part of events, Alice randomly matches a time bin
$i$ of intensity $\mu_{a}$ with another time bin $j$ of intensity
$\mathbf{o}_{a}$. Thereafter she sets her bit value as 0 (1) if $i<j~{}(i>j)$,
and informs the serial numbers $i$ and $j$ to Bob. In the corresponding time
bins, if Bob chooses intensities $k_{b}^{\min\\{i,j\\}}=\mu_{b}$
$(\mathbf{o}_{b})$, and $k_{b}^{\max\\{i,j\\}}=\mathbf{o}_{b}$ $(\mu_{b})$, he
sets his bit value as 0 (1). Bob announces to abort the event where
$k_{b}^{i}$ $=$ $k_{b}^{j}=\mathbf{o}_{b}$ or $\mu_{b}$. To conclude, the
preserved events in the $Z$ basis are sifted as
$\\{\mu_{a}\mathbf{o}_{a},~{}\mathbf{o}_{b}\mu_{b}\\}$,
$\\{\mu_{a}\mathbf{o}_{a},~{}\mu_{b}\mathbf{o}_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},~{}\mathbf{o}_{b}\mu_{b}\\}$, and
$\\{\mathbf{o}_{a}\mu_{a},~{}\mu_{b}\mathbf{o}_{b}\\}$.

For the second part of events, Alice and Bob communicate their intensities and
phase information with each other via an authenticated channel. Define the
global phase difference at time bin $i$ as
$\theta^{i}:=\theta_{a}^{i}-\theta_{b}^{i}+\phi_{ab}^{i}$. Alice and Bob keep
detection events $\\{\nu_{a}^{i},~{}\nu_{b}^{i}\\}$ only if
$\theta^{i}~{}\in[-\delta,\delta]\cup[\pi-\delta,\pi+\delta]$. They randomly
select two retained detection events that satisfy
$\left|\theta^{i}-\theta^{j}\right|=0$ or $\pi$, and then match these two
events , denoted as $\\{\nu_{a}^{i}\nu_{a}^{j},\nu_{b}^{i}\nu_{b}^{j}\\}$. By
calculating classical bits $r_{a}^{i}\oplus r_{a}^{j}$ and $r_{b}^{i}\oplus
r_{b}^{j}$, Alice and Bob extract a bit value in the $X$ basis, respectively.
Subsequently, Bob always flips his bit in the $Z$ basis. In the $X$ basis, Bob
flips part of his bits to correctly correlate them with those of Alice. To be
specific, when the global phase difference between two matching time bins is 0
($\pi$) and the two clicking detectors announced by Eve are different (same),
Bob will flip his bits. Otherwise, Bob will directly save his bits for later
use. The other events in the second part is used for decoy analysis.

4\. Parameter estimation. Alice and Bob (Alice and Charlie) form the
$n_{Z}$-length raw key bit from the random bits under the $Z$ basis. The
remaining bits in the $Z$ basis are used to estimate the bit error rate
$E^{z}$. Further, they communicate all bit values in the $X$ basis to obtain
the total number of errors. The decoy-state method [62, 63] is used to
estimate the number of vacuum events in the $Z$ basis $s_{0\mu_{b}}^{z}$, the
count of single-photon pairs $s_{11}^{z}$, and the phase error rate of single-
photon pairs $\phi_{11}^{z}$ on the $Z$ basis.

5\. Error correction and examination. Alice and Bob (Alice and Charlie)
distill final keys by utilizing an error correction algorithm with
$\varepsilon_{\rm{cor}}$-correctness. [64, 65] The size of the distilled key
remains $n_{Z}$, and the unknown information of a possible attacker can be
expressed as $\mathcal{H}$. Alice then randomly disturbs the orders of the
distilled key and publicizes the new order to Bob (Charlie) through the
authenticated channel. Subsequently, Alice and Bob (Alice and Charlie) divide
the final keys into several $n$-bit strings, each of which is used to perform
a task in the messaging stage. The grouping process can be considered as a
random sampling. More details are shown in Sec. IV.1 and Appendix C.1.

###  III.2 Messaging stage

Various AXU hash functions can be employed in the messaging stage of the
proposed protocol by following the framework presented in Fig. 1(b). To
demonstrate the detailed procedure, we here present two specific approaches to
the messaging stage utilizing LFSR based Toeplitz hashing and generalized
division hashing, respectively. LFSR-based Toeplitz hashing is highly
compatible with the hardware systems whereas generalized division hashing is
more suitable for realizing software systems. In a practical case we select
either of methods of hashing depending on the different application
environments of users. The message to be signed is denoted as $M$. For each
$M$ if using LFSR-based Toeplitz hashing Alice generates six bit strings
$\mathbb{X}_{B},~{}\mathbb{X}_{C},~{}\mathbb{Y}_{B},~{}\mathbb{Y}_{C},~{}\mathbb{Z}_{B},~{}\mathbb{Z}_{C}$,
each of length n. If choosing generalized division hashing in the messaging
stage, Alice will only generate four bit strings
$\mathbb{X}_{B},~{}\mathbb{X}_{C},~{}\mathbb{Y}_{B},~{}\mathbb{Y}_{C}$. The
subscripts represent the participants performing KGP with Alice, where B
represents Bob and C represents Charlie. Thereafter, Alice will generate
$\mathbb{X}_{a}=\mathbb{X}_{b}\oplus\mathbb{X}_{c}$,
$\mathbb{Y}_{a}=\mathbb{Y}_{b}\oplus\mathbb{Y}_{c}$, and
$\mathbb{Z}_{a}=\mathbb{Z}_{b}\oplus\mathbb{Z}_{c}$ as her own key strings.
For the scheme with LFSR-based Toeplitz hashing the signature rate is

$R_{\rm{LFSR}}=n_{Z}/3n,$ (1)

whereas for generalized division hashing there is

$R_{\rm{GDH}}=n_{Z}/2n.$ (2)

####  III.2.1 Utilizing LFSR-based Toeplitz hashing

######  Definition 1.

LFSR-based Toeplitz hash functions: LFSR-based Toeplitz hash functions can be
expressed as $h_{p,s}(M)=H_{nm}M$, where $p,s$ determines the function and
$M=(M_{0},M_{1},...,M_{m-1})^{T}$ is the message in the form of an $m$-bit
vector. The process of generating LFSR-based Toeplitz hash function is
detailed as follows.

A randomly selected irreducible polynomial of order $n$ in the field GF(2),
$p(x)$, determines the construction of LFSR.
$p(x)=x^{n}+p_{n-1}x^{n-1}+...+p_{1}x+p_{0}$ can be characterized by its
coefficients of order from $0$ to $n-1$, i.e.,
$p=(p_{n-1},p_{n-2},...,p_{1},p_{0})$. For the initial state $s$ which is also
represented as an n-bit vector $s=(a_{n},a_{n-1},...,a_{2},a_{1})^{T}$, the
LFSR will be performed n times to generate n vectors. Specifically, it will
shift down every element in the previous column, and add a new element to the
top of the column. For instance, the LFSR transforms $s$ into
$s_{1}=(a_{n+1},a_{n},...,a_{3},a_{2})^{T}$, where $a_{n+1}=p\cdot s$, and
likewise, transforms $s_{1}$ to $s_{2}$. Then the m vectors
$s,s_{1},...,s_{m-1}$ will together construct the Toeplitz matrix
$H_{nm}=(s,s_{1},...,s_{m-1})$, and the hash value of the message is
$H_{nm}M$.

(i) Alice obtains a string of random numbers through a quantum random number
generator and uses it to randomly generate a monic irreducible polynomial in
GF(2) of order $n$, denoted as $p(x)$. $p(x)$ can be characterized by its
coefficients of order from $0$ to $n-1$, i.e., an n-bit string, denoted by
$p_{a}$. Details of generating $p(x)$ can be found in Appendix B.1.

(ii) Alice uses her key bit string $\mathbb{Y}_{a}$ and $p(x)$ to perform
LFSR-based Toeplitz hashing and generates an n-bit hash value
$Dig=H_{\mathbb{Y},p_{a}}(M)$, and encrypts it by $\mathbb{Z}_{a}$ to obtain
the final signature $Sig=Dig\oplus\mathbb{Z}_{a}$. In addition, Alice encrypts
$p_{a}$ by the key set $\mathbb{X}_{a}$ to obtain the encrypted string
$p=p_{a}\oplus\mathbb{X}_{a}$. Here we adopt a different expression from that
in OUTH-QDS that we independently list the hash value as $Dig$ and the
coefficients of the irreducible polynomial as $p_{a}$, i.e., $Sig$ does not
include the information of the irreducible polynomial to avoid
misunderstanding. She then transmits $\\{Sig,~{}p,~{}M\\}$ to Bob through an
authenticated classical channel.

(iii) Bob transmits $\\{Sig,~{}p,~{}M\\}$ as well as his key bit strings
$\\{\mathbb{X}_{b},~{}\mathbb{Y}_{b},~{}\mathbb{Z}_{b}\\}$ to Charlie so as to
inform Charlie that he has received the signature. Thereafter, Charlie
forwards his key bit strings
$\\{\mathbb{X}_{c},~{}\mathbb{Y}_{c},~{}\mathbb{Z}_{c}\\}$ to Bob. These data
are all transmitted through an authenticated channel. Bob obtains three new
key bit strings
$K_{\mathbb{X}_{b}}=\mathbb{X}_{b}\oplus\mathbb{X}_{c},~{}K_{\mathbb{Y}_{b}}=\mathbb{Y}_{b}\oplus\mathbb{Y}_{c}$,
and $K_{\mathbb{Z}_{b}}=\mathbb{Z}_{b}\oplus\mathbb{Z}_{c}$ using the XOR
operation. He exploits $K_{\mathbb{X}_{b}}$ and $K_{\mathbb{Z}_{b}}$ to obtain
the expected digest and string $p_{b}$ via XOR decryption. He utilizes
$K_{\mathbb{Y}_{b}}$ and $p_{b}$ to establish an LFSR-based Toeplitz matrix
and derive an actual digest via a hash operation. Bob will accept the
signature if the actual digest is equal to the expected digest. Then he
informs Charlie of the result.

(iv) If Bob announces that he accepts the signature, Charlie creates three new
key bit strings
$K_{\mathbb{X}_{c}}=\mathbb{X}_{b}\oplus\mathbb{X}_{c},,~{}K_{\mathbb{Y}_{c}}=\mathbb{Y}_{b}\oplus\mathbb{Y}_{c}$
and $K_{\mathbb{Z}_{c}}=\mathbb{Z}_{b}\oplus\mathbb{Z}_{c}$ using his original
key and that received from Bob. He employs $K_{\mathbb{X}_{c}}$ and
$K_{\mathbb{Z}_{c}}$ to acquire the expected digest and variable $p_{c}$ via
XOR decryption. Charlie obtains an actual digest via hash operation, where the
hash function is an LFSR-based Toeplitz matrix generated by
$K_{\mathbb{Y}_{c}}$ and $p_{c}$. Charlie accepts the signature if the two
digests are identical.

####  III.2.2 Utilizing generalized division hashing

######  Definition 2.

Generalized division hash functions: The generalized division hash functions
can be expressed as $h_{P}(M)=M(x)\cdot x^{n/k}$ mod $P(x)$, where $P(x)$ is a
monic irreducible polynomial of order $n/k$ in the field GF($2^{k}$), $M$ is
the message and $M(x)$ is the polynomial of order $m/k$ in GF($2^{k}$) with
every coefficient corresponding to $k$ bits of $M$. The calculation is also
performed in GF($2^{k}$). The final result is a polynomial of order $n/k$ in
field GF($2^{k}$), and can be transformed into an $n$-bit strings. [66]

Commonly, $k$ is set as $k=2^{x}$ for simplicity, where $x$ is a positive
integer. In the current scheme, we select $k=2^{3}=8$.

(i) In this case, Alice selects
$\mathbb{X}_{a}=\mathbb{X}_{b}\oplus\mathbb{X}_{c}$ and
$\mathbb{Y}_{a}=\mathbb{Y}_{b}\oplus\mathbb{Y}_{c}$ as her own key sets. Alice
first obtains a string of random numbers through a quantum random number
generator and uses it to randomly generate a monic irreducible polynomial in
GF($2^{8}$) of order $n/8$, denoted by $P(x)$. The generation process of
$p(x)$ are detailed in Appendix B.1. $P(x)$ can be characterized by its
coefficients of order from 0 to $n/8-1$. By encoding each coefficient into an
8-bit string, we can use an n-bit string to express $P(x)$, denoted as
$P_{a}$. Subsequently, Alice encrypts $P_{a}$ by the key set $\mathbb{X}_{a}$
to obtain the encrypted string $P=P_{a}\oplus\mathbb{X}_{a}$

(ii) Alice uses $P(x)$ to perform the generalized division hashing [66] to
obtain an $n$-bit hash value $Dig=h_{P_{a}}(M)$. She encrypts $Dig$ by
$\mathbb{Y}_{a}$ to derive the signature $Sig=Dig\oplus\mathbb{Y}_{a}$ and
transmits the message along with the obtained signature $\\{Sig,~{}p,~{}M\\}$
to Bob.

step (iii) and (iv) are similar to those utilizing LFSR-based Toeplitz
hashing. Bob and Charlie will exchange their key strings in turn through an
authenticated channel and examine their expected and received digests.

This summarizes the entire procedure of the proposed protocol. Note that the
TP-TFKGP can be replaced by any other KGP such as BB84-KGP or sending-or-not-
sending (SNS)-KGP. Actually, in the distribution stage Alice shares bit
strings with Bob and Charlie in the relationship of secret sharing. Thus, the
distribution stage can also be performed based on QSS without employing the
privacy amplification step.

##  IV Security analysis

Similar to OTUH-QDS, the core point of the proposed protocol is the security
of the authentication based on AXU hashing, which directly protects the
security of QDS against fogery [42]. However, the security of our protocol
differs because of the information leakage during the distribution stage. In
this section we first analyze the success probability of an attacker guessing
a key string generated in the distribution stage, and thereafter provide a
more detailed security analysis of AXU hashing under imperfect keys with
partial secrecy leakage, and finally demonstrate the security of our protocol.

###  IV.1 Guessing probability of the attacker

Unlike QKD that generates keys with perfect secrecy, in our protocol the keys
are imperfectly secret. Any possible attackers may obtain partial information
on the keys. After the distribution stage, users share keys in the form of
several $n$-bit strings. We need to quantify the information leakage and bound
the maximum probability of the attacker guessing such a string of keys.
Suppose an n-bit key string as $\mathbb{X}$ and the attacker’s system is
$\mathbb{B}$. We consider a general attack scenario where attackers can
execute any entangling operations on the system of any or all states, obtain a
system $\rho_{B}^{x}$ and perform any positive operator-valued measure
$\\{E_{B}^{x}\\}_{x}$ on it. The probability that the attacker correctly
guesses $\mathbb{X}$ using an optimal strategy is denoted as
$P_{\rm{guess}}(\mathbb{X}|\mathbb{B})$. According to the definition of min-
entropy in Ref. [67],

$P_{\rm{guess}}(\mathbb{X}|\mathbb{B})=\max_{\\{E_{B}^{x}\\}_{x}}\sum_{x}P_{x}\operatorname{tr}(E_{B}^{x}\rho_{B}^{x})=2^{-H_{\rm{min}}(\mathbb{X}|\mathbb{B})_{\rho}},$
(3)

where $H_{\rm{min}}(\mathbb{X}|\mathbb{B})_{\rho}$ is the min-entropy of
$\mathbb{X}$ and $\mathbb{B}$. If $\mathbb{X}$ is generated in the
distribution stage of our protocol,
$H_{\rm{min}}(\mathbb{X}|\mathbb{B})_{\rho}$ can be estimated by

$H_{\rm{min}}(\mathbb{X}|\mathbb{B})_{\rho}=\mathcal{H}_{n}.$ (4)

Thus, we have the relationship

$P_{\rm{guess}}(\mathbb{X}|\mathbb{B})=2^{-\mathcal{H}_{n}},$ (5)

which means that the attacker can correctly guess $\mathbb{X}$ with a
probability no more than $2^{-\mathcal{H}_{n}}$. $\mathcal{H}_{n}$ is the
total unknown information of the $n$-bit string and can be upper bounded by
parameters estimated in the distribution stage

$\mathcal{H}_{n}\leq\underline{s}_{0\mu_{b}}^{zn}+\underline{s}_{11}^{zn}\left[1-H(\underline{\phi}_{11}^{zn})\right]-nfH(E^{z}),$
(6)

where $f$ is the error correction efficiency, $\underline{s}_{0\mu_{b}}^{zn}$
and $\underline{s}_{11}^{zn}$ are the lower bounds of vacuum events and
single-photon pairs events in the $n$-bit string, respectively, and
$\underline{\phi}_{11}^{zn}$ is the upper bound of the phase error rate of
single-photon pairs in the $n$-bit string. More details of calculation are
shown in Appendix C.1.

###  IV.2 Security of authentication based on hashing

In our QDS schemes, hashing is used to perform the authentication task. Thus
we first consider the authentication scenario where the sender generates a
signature $Sig=h(M)\oplus r$ as message authentication code, and sends
$\\{M,~{}Sig\\}$ to the recipient. The attacker can intercept and capture
$\\{M,~{}Sig\\}$, tamper a new message and signature
$\\{M^{\prime},~{}Sig^{\prime}\\}$, and send it to the recipient, who will
examine whether $Sig^{\prime}=h(M^{\prime})\oplus r$ before accepting it. The
attacker succeed if and only if (iff) a combination $\\{m,~{}t\\}$ is select
with the relationship $h(m)=t$, and $\\{M^{\prime}=M\oplus
m,~{}Sig^{\prime}=Sig\oplus t\\}$ is sent to the recipient. In this case, the
recipient will accept the message because of the relationship $h(M\oplus
m)=h(M)\oplus h(m)=Sig\oplus t$. It should be mentioned that $m\neq 0$ due to
the requirement for a valid forge.

Suppose keys generated in the distribution stage of our protocol, i.e., keys
with partial information leakage, are used to perform this authentication
task, and define $\epsilon$ as the success probability of the attacker under
this scenario. We should consider three types of possible attacks. The first
one is to randomly generate ${m,t}$. It is a trivial strategy whose success
probability is only

$\epsilon_{1}=2^{-n}.$ (7)

The other two types of attacks are guessing keys that decide the hash function
and recovering the function from signatures.

####  IV.2.1 Attack of guessing keys

The LFSR-based Toeplitz hash function is represented as $h_{p,s}(M)$=
$H_{nm}\cdot M$, where $H_{nm}$ is determined by the two bit strings $p$ and
$s$ [60]. Herein we follow the terminology in the messaging stage of the
proposed protocol where $p$ is actually $p_{a}$ encrypted by $\mathbb{X}_{a}$,
$s$ is $\mathbb{Y}_{a}$, and the hash value $Dig$ is encrypted by
$\mathbb{Z}_{a}$. We show that guessing only $\mathbb{X}_{a}$ or in other
words, guessing only $p_{a}$ is enough to execute an optimal attack by a
proposition.

######  Proposition 1.

For the LFSR-based Toeplitz hash function $h_{p,s}(M)$= $H_{nm}\cdot M$, if
$p(x)|M(x)=M_{m-1}x^{m-1}+...+M_{1}x+M_{0}$, then $h_{p,s}(M)=0$.

The proof of this proposition is shown in Appendix B.2. It means that the
attacker can easily generate a message $m$ satisfying the relationship
$h(m)=0$ if he knows $p$. In the scenario described above, suppose the
attacker obtains a string $\mathbb{X}_{g}$ as his estimation of
$\mathbb{X}_{a}$. He can decrypt it to obtain $p_{g}$ as his guessing of
$p_{a}$ and transform $p_{g}$ into a polynomial $p_{g}(x)$. Thereafter the
attacker can easily generate a bit string $m$ satisfying $p_{g}(x)|m(x)$, and
there is the relationship $h(m)=0$ if $p_{g}=p_{a}$ (or equivalently
$\mathbb{X}_{g}=\mathbb{X}_{a}$) according to Proposition 1. Then he can
tamper the message into $M\oplus m$ without changing the signature.
$\\{M+m,Sig\\}$ will pass the authentication test if
$\mathbb{X}_{g}=\mathbb{X}_{a}$. As $m(x)$ is m-order and the polynomial is
n-order, the attacker can select no more than $m/n$ polynomials and multiply
them to consist his choice of $m(x)$. In other words, he can guess the string
$\mathbb{X}_{a}$ for no more than $m/n$ times. It must be considered that the
attacker knows $p_{a}$ is irreducible, so he will only choose those guesses
that satisfy $p_{a}$ is irreducible. The success probability of this optimized
strategy can be expressed as

$P_{1}=\frac{m}{n}\cdot P(\mathbb{X}_{a}=\mathbb{X}_{g}|p_{g}\in\mathcal{I}),$
(8)

where $P(A|B)$ represents the probability of event $A$ under the condition
that event $B$ occurs, and $\mathcal{I}$ denotes the set of all irreducible
polynomials of order n in GF(2). The cardinal number of $\mathcal{I}$, i.e.,
the number of all n-order irreducible polynomials in GF(2), is more than
$2^{n-1}/n$. Thus $P(p_{g}\in\mathcal{I})\leq(2^{n-1}/n)/2^{n}=1/2n$. It is
obvious that
$P(\mathbb{X}_{a}=\mathbb{X}_{g},p_{g}\in\mathcal{I})=P(\mathbb{X}_{a}=\mathbb{X}_{g})$
because if $\mathbb{X}_{a}=\mathbb{X}_{g}$ then $p_{g}=p_{a}\in\mathcal{I}$.
Then we can obtain the upper bound of the success probability of this type of
attack, denoted as $\epsilon_{\rm{LFSR}}$,

$\displaystyle P_{1}=$
$\displaystyle\frac{m}{n}\cdot\frac{P(\mathbb{X}_{a}=\mathbb{X}_{g})}{P(p_{g}\in\mathcal{I})}$
$\displaystyle\leq$
$\displaystyle\frac{m}{n}\cdot\frac{2^{-\mathcal{H}_{n}}}{\frac{1}{2n}}$
$\displaystyle=$ $\displaystyle m\cdot
2^{1-\mathcal{H}_{n}}=\epsilon_{\rm{LFSR}}.$

The attacker can also guess the strings $\mathbb{X}_{a}$ and $\mathbb{Y}_{a}$
to obtain $p$ and $s$ so that he can guess the hash function and make a
successful attack for certainty. Under this circumstance his success
probability is no more than $\epsilon_{\rm{LFSR}}$,

$\displaystyle P_{2}=$ $\displaystyle
P(\mathbb{X}_{a}=\mathbb{X}_{g},\mathbb{Y}_{a}=\mathbb{Y}_{g}|p_{g}\in\mathcal{I})$
$\displaystyle\leq$ $\displaystyle
P(\mathbb{X}_{a}=\mathbb{X}_{g}|p_{g}\in\mathcal{I})$ $\displaystyle\leq$
$\displaystyle\epsilon_{\rm{LFSR}}.$

The generalized division hash function $h_{P}(M)$= $m(x)\cdot x^{n/8}$ mod
$P(x)$ is determined only by $P$. As earlier, we also follow the terminology
in the proposed protocol that $P$ is $P_{a}$ encrypted by $\mathbb{X}_{a}$ and
the hash value $Dig$ is encrypted by $\mathbb{Y}_{a}$. The attacker’s strategy
is to guess a string $\mathbb{X}_{g}$ such that he can obtain $P_{g}$ and then
forge a message. Analogous to the analysis discussed above, the upper bound of
the success probability is defined as

$\displaystyle\epsilon_{\rm{GDH}}=\frac{m}{n}\cdot\frac{2^{-\mathcal{H}_{n}}}{\frac{4}{n}}=m\cdot
2^{-2-\mathcal{H}_{n}}.$ (9)

The only difference in the calculation is that there are at least
$2^{n-1}/(n/8)$ irreducible polynomials of order $n/8$ in GF($2^{8}$), so
$P(P_{g}\in\mathcal{I})\geq(2^{n-1}/(n/8))/2^{n}=4/n$.

####  IV.2.2 Attack of recovering keys from signature

The attacker can attempt to recover the desired keys from the captured
signature. In both kinds of hashing the hash value is encrypted to generate
the signature. Thus the attacker must first guess the corresponding key
strings ($\mathbb{Z}_{a}$ in LFSR-based Toeplitz hashing or $\mathbb{Y}_{a}$
in generalized division hashing) and then perform the recovering algorithm.
The success probability of this strategy is no more than that only guessing
the bit string ($P(\mathbb{Z}_{a}=\mathbb{Z}_{g})$ or
$P(\mathbb{Y}_{a}=\mathbb{Y}_{g})$) and is obviously no more than
$\epsilon_{\rm{LFSR}}$ or $\epsilon_{\rm{GDH}}$.

In conclusion, the optimal strategy on LFSR-based Toeplitz hashing and
generalized division hashing (GDH) is to guess the key string that encrypts
the polynomial. We can quantify the upper bound of failure probability of
authentication based on both types of hashing with imperfect keys of secrecy
leakage:

$\displaystyle\epsilon_{\rm{LFSR}}=$ $\displaystyle m\cdot
2^{1-\mathcal{H}_{n}},$ (10) $\displaystyle\epsilon_{\rm{GDH}}=$
$\displaystyle m\cdot 2^{-2-\mathcal{H}_{n}}.$ (11)

###  IV.3 Security of the QDS scheme

Finally, we analyze the security in the QDS scheme which contains three parts,
robustness, repudiation, and forgery.

####  IV.3.1 Robustness.

The honest run abortion means the protocol is aborted when all parties are
honest. It occurs only when Alice and Bob (or Charlie) share different key
bits after the distribution stage. In the proposed protocol Alice and Bob
(Charlie) perform error correction in the distribution stage. Thus, they share
the identical final key, and the honest run occurs only at the case where
errors occur. The robustness bound is
$\epsilon_{\rm{rob}}=2\epsilon_{\rm{cor}}+2\epsilon^{\prime}$, where
$\epsilon_{\rm{cor}}$ is the failure probability of the error correction
protocol in the distribution stage, and $\epsilon^{\prime}$ is the probability
that error occurs in classical message transmission. Remark that we assume
$\epsilon^{\prime}=10^{-11}$ for simplicity since it is a parameter of
classical communication.

####  IV.3.2 Repudiation.

Alice successfully repudiates when Bob accepts the message while Charlie
rejects it. For Alice’s repudiation attacks, Bob and Charlie are both honest
and symmetric and possess the same new key strings. They will converge on the
same decision for the same message and signature. In other words, when Bob
rejects (accepts) the message, Charlie also rejects (accepts) it. Repudiation
attacks succeed only when errors occur in one of the key exchange steps. Thus,
the repudiation bound is $\epsilon_{\rm{rep}}=2\epsilon^{\prime}$.

####  IV.3.3 Forgery.

Bob forges successfully when Charlie accepts the tampered message forwarded by
Bob. According to the proposed protocol, Charlie accepts the message iff
Charlie obtains the same result through one-time pad decryption and one-time
AXU hash functions. In principle, this is the same as an authentication
scenario in Sec. IV.2 where Bob is the attacker attempting to forge the
information sent from Alice to Charlie. Therefore, the probability of a
successful forgery $\epsilon_{\rm{for}}$ can be determined by the failure
probability of hashing, i.e., one chooses two distinct messages with identical
hash values. For the scheme utilizing LFSR-based Toeplitz hash
$\epsilon_{\rm{for}}=m\cdot 2^{1-\mathcal{H}_{n}}$, and for generalized
division hashing $\epsilon_{\rm{for}}=m\cdot 2^{-2-\mathcal{H}_{n}}$.

The total security bound of QDS, i.e., the maximum failure probability of the
protocol, is
$\epsilon=\max\\{\epsilon_{\rm{rob}},\epsilon_{\rm{rep}},\epsilon_{\rm{for}}\\}$.

Table 1: Simulation parameters. $\eta_{d}$ and $p_{d}$ denote the detector efficiency and dark count rate, respectively. $e_{d}$ represents the misalignment error rate. $N$ is the data size. $\alpha$ is the attenuation coefficient of the fiber. $f$ is the error correction efficiency. $\epsilon$ is the failure probability of QDS schemes. $\eta_{d}$ | $p_{d}$ | $e_{d}$ | $N$ | $\alpha$ | $f$ | $\epsilon$
---|---|---|---|---|---|---
$70\%$ | $10^{-8}$ | $0.02$ | $10^{13}$ | $0.165$ | $1.1$ | $10^{-10}$

##  V Discussion

Figure 3: Signature rates of the proposed protocol with TP-TFKGP, BB84-KGP,
SNS-KGP, and decoy state BB84-QDS [13], SNS-QDS [21], SNS-QDS with random
pairing [24] with the message size of 1 Kb. In the proposed protocol we use
generalized division hashing in messaging stage. The repetition rate of the
laser is 1 GHz. The distances between Alice–Bob and Alice–Charlie are assumed
to be the same. The data size N is $10^{13}$ and the security bound is
$10^{-10}$.

From Eqs. (1), (2), (10), and (11), there are just differences in a constant
$2/3$ between two signature rates and a constant 8 between two security
parameters. The difference between the two approaches is trivial. For
simplicity, we only discuss the protocol with generalized division hashing in
this section.

To demonstrate the advantage of the current proposal, we first build our
protocol based on BB84-KGP, SNS-KGP and TP-TFKGP, and compare them with decoy-
state BB84-QDS [13] and SNS-QDS [21] which are single-bit QDS protocols based
on BB84-KGP and SNS-KGP. We also compare SNS-QDS with random pairing [24],
which improves the signature rate of SNS-QDS and can be applied to other QDS.
More details of the calculation are shown in Appendix C. In the simulations,
we consider two common cases where each message to be signed is $10^{3}$ bits
(1 Kb) and $10^{6}$ bits (1 Mb), respectively. The repetition rate of the
laser is 1 GHz, and the distances between Alice-Bob and Alice-Charlie are
assumed to be the same. The unit of signature rate is set as time per second
(tps). Detailed analysis is shown in Appendix A.2. Other simulation parameters
are listed in Table 1.

It should be mentioned that all conventional single-bit QDS protocols sign
only a one-bit message every round. In the case of signing the multi-bit
message, an $m$-bit message must be encoded into a new sequence with length
$h$ by inserting ‘0’ and adding ‘1’ to the original sequence. The signing
efficiency, i.e., $\hat{\eta}=m/h$, is obviously less than 1. For simplicity,
we use the upper bound $\hat{\eta}=1$, i.e., $h=m$, in our simulation. It is
obvious that key consumption of single-bit QDS increases linearly with message
size $m$. In other words, the signature rate is proportional to $1/m$. In our
proposed scheme, the signature is generated by hash functions operating on the
message, so that the signature rate is robust against the length of the
message. From Eqs. (10) and (11), $\epsilon$ increases linearly as $m$
increase, but decrease exponentially as $\mathcal{H}_{n}$ increases. Thus, to
guarantee the same epsilon, $\mathcal{H}_{n}$, which is proportional to group
size $n$, increases logarithmically with $m$. Consequently, the signature rate
of the proposed scheme is proportional to $-\log_{2}{m}$.

Figure 4: Signature rates of the proposed protocol with TP-TFKGP, BB84-KGP,
SNS-KGP, and decoy state BB84-QDS [13], SNS-QDS [21], SNS-QDS with random
pairing [24] with the message size of 1 Mb. In the protocol, we use
generalized division hashing in messaging stage. The repetition rate of the
laser is 1 GHz. The distances between Alice–Bob and Alice–Charlie are assumed
to be the same. The data size N is $10^{13}$ and the security bound is
$10^{-10}$.

The simulation results of all the protocols mentioned are presented in Figs. 3
and 4. For the message size of 1 Kb, our protocols show an advantage on
signature rate of over five orders of magnitude compared with conventional QDS
schemes, which is a quite larger improvement than SNS-QDS with random pairing.
If the message size becomes 1 Mb, the signature rate of conventional BB84-QDS,
SNS-QDS, and SNS-QDS with random pairing will decrease by three orders of
magnitude, whereas that of our protocols decreases only slightly. Thus the
proposed QDS scheme delivers a signature rate with eight orders of magnitude
higher than previous schemes. As demonstrated, the proposed protocol shows
great robustness to message size. Furthermore, based on TP-TFKGP the proposed
scheme can reach a transmission distance of 650 km as well as a signature rate
of approximately 0.01 times per second (tps). It is an immense breakthrough in
terms of both distance and signature rate, indicating the considerable
potential of the proposed protocol in the practical implementation of QDS. The
performance of the proposed protocol under different data sizes $10^{9}$,
$10^{11}$ and $10^{13}$ is depicted in Fig. 5. The curve of $N=10^{9}$ stops
at 1 tps, i.e., one time for all data, because signing less than 1 time (1
message) for all data is nonsense. The result shows that even with a data size
as small as $10^{9}$, the proposed protocol can reach a transmission distance
of 350 km, and performance of data size $N=10^{11}$ is close to that of
$N=10^{13}$. The influence of finite-size effects caused by small data size on
our protocol is in an acceptable level.

Table 2: Time consumption of error correction $T_{\rm EC}$ and privacy amplification $T_{PA}$ under different data sizes $N=10^{13}$ and $N=10^{11}$ when the distance is 400 km. $T_{1}=T_{\rm EC}$ and $T_{2}=T_{\rm EC}+T_{\rm PA}$ represent the postprocessing time of the proposed scheme and OTUH-QDS, respectively. $n_{Z}$ is the number of raw bits generated in TP-TFKGP; $l$ is the length of keys after privacy amplification. In case $N=10^{13}$, postprocessing time of OTUH-QDS is 5.85 h, and that of the proposed protocol is only 8.07 min. $N$ | $n_{Z}$ | errors | l | $T_{\rm EC}$ | $T_{\rm PA}$ | $T_{1}$ | $T_{2}$
---|---|---|---|---|---|---|---
$10^{13}$ | $1.695\times 10^{8}$ | 300 | $4.87\times 10^{7}$ | 8.07 min | 5.71 h | 8.07 min | 5.85 h
$10^{11}$ | $1.267\times 10^{6}$ | 39830 | $2.51\times 10^{5}$ | 3.62 s | 2.98 s | 3.62 s | 6.6 s
Figure 5: Signature rates of the proposed protocols with TP-TFKGP under
different data sizes $N=10^{9},~{}10^{11}$ and $10^{13}$. The message size is
assumed to be 1 Mb, and the repetition rate of the laser is 1 GHz. The
security bound is $10^{-10}$.

Compared with OTUH-QDS, the proposed protocol does not require perfectly
secret keys, and thus involves no privacy amplification step. Therefore, the
proposed protocol only consumes keys with partial information leakage, which
is an affordable and practical resource compared with perfect quantum keys
generated by quantum secure communication. Error correction of quantum keys
can be easily performed by classical Cascade protocol [64, 65] where the bit
string is first blocked and then manipulated by blocks. Thus the complexity of
error correction increases linearly with the data size $N$ and can be
performed via stream computing. Privacy amplification, however, requires a
hash matrix multiplication step where the numbers of columns and rows are
proportional to $N$. Thus the computational complexity of privacy
amplification is $O(N^{2})$. The fast Fourier transform algorithm can reduce
the complexity to $O(N\log N)$ [68], and one can also block the keys before
performing privacy amplification. However, as the minimum blocks should be
adequately large to minimize the finite-size effect, the actual computational
cost and delay of privacy amplification are still very large.

The time consumed in conducting consumption of error correction, privacy
amplification, and data transmission are listed in Table 2, including the
total postprocessing time of both protocols, at a distance of 400 km with data
sizes $10^{13}$ and $10^{11}$. Details of simulation are introduced in
Appendix D. If $N=10^{11}$, time consumption of postprocessing in OTUH-QDS is
6.6 s, while that of the proposed protocol is 3.62 s. Moreover, when
$N=10^{13}$, time for privacy amplification is 5.71 h, which will introduce a
quite long delay in experiment. Accordingly, time for error correction is only
8.07 min. The proposed scheme, free of privacy amplification, can
significantly save computational resources and minimize postprocessing delays.

Figure 6: Ratio of the signature rate of the proposed protocol with TP-TFKGP
and that of OTUH-QDS [42] combined with TP-TFQKD, if not considering the
postprocessing time, with data sizes $10^{13}$ and $10^{11}$. The message size
is 1 Kb and the repetition rate of the laser is 1 GHz. The ratio is more than
0.8 with a transmission distance lower than 500 km.

We further compare the signature rates of the proposed protocol and that of
OTUH-QDS [42]. Theoretically, the two signature rates should be equal under
ideal conditions. In practical cases, there are two effects that influence the
performance of the proposed protocol compared with OTUH-QDS. The first effect
is that in our protocol the parameter $n$ is optimized, which will improve the
signature rate compared with OUTH-QDS. This effect will decrease as distance
increases. The second effect is that in our protocol we consider the
statistical fluctuation of the error rate in the grouping process. This effect
will damage the signature rate compared with OUTH-QDS. At both long and short
distances, this effect is slight because the size of groups is small and the
error rate is small, respectively.

In Fig. 6, we draw the ratio of the signature rate of the proposed protocol
based on TP-TFKGP and that of OTUH-QDS [42] combined with TP-TFQKD, if not
considering the postprocessing time, with data sizes of $10^{13}$ and
$10^{11}$, and message size of 1Kb. The result shows that the ratio is more
than 80$\%$ for transmission distances less than 500 km. Overall, the
signature rates of the two protocols are comparable. In addition, in case of
assuming the repetition rate of the laser as 1 GHz, time consumption for
postprocessing ($2.057\times 10^{4}$s) is even longer than time for data
transmission ($10^{4}$s) for $N=10^{13}$. The signature rate of OTUH-QDS will
be constrained by the efficiency of privacy amplification. That is, in
practice the signature rate of OTUH-QDS is lower than the simulation result,
while the proposed scheme can overcome this shortcoming. Considering the fact
that the proposed protocol can save postprocessing time by even one hundred
times, our proposal shows significant improvement in the practical scenario
especially when the digital signature tasks are performed at high frequency
and the data size is large.

##  VI Conclusion

In summary, in this paper we prove that keys with partial secrecy leakage can
protect the authenticity and integrity of messages if combined with AXU hash
functions. Furthermore, we theoretically propose an efficient QDS protocol
utilizing imperfect quantum keys without privacy amplification based on the
framework of OTUH-QDS, reducing computational resources and delays of
postprocessing without compromising the security. The simulation results
demonstrate that the proposed protocol outperforms previous single-bit QDS
protocols in terms of both signing efficiency and distance. For instance, for
a 1-MB-size message to be signed, the signature rate of the proposed protocol
is higher than that of single-bit QDS protocols by over eight orders of
magnitude. Specifically, for the protocol based on TP-TFKGP, the transmission
distance can reach up to 650 km and still holds a signature rate of 0.01 tps.
Moreover, compared with OUTH-QDS, the proposed protocol notably saves the
postprocessing time into an endurable range and therefore, significantly
improves the practicality. Our scheme is a general framework that can be
applied to any existing QKD or QSS protocol, and is highly compatible with
future quantum networks and feasible in numerous applications. Additionally,
this work, only requiring keys with imperfect secrecy, is a new approach of
quantum communication that is different from other quantum secret
communication protocols. We suggest that raw quantum keys can be directly used
to finish cryptographic tasks including message authentication and digital
signatures, indicating the enormous potential of this resource and the
possibility of removing the classical postprocessing step in a future quantum
world. We believe that the proposed scheme and the idea of utilizing imperfect
quantum keys provide a solution for the real implementation of practical and
commercial QDS as well as other quantum cryptography tasks in future quantum
networks.

## Acknowledgments

This study was supported by the National Natural Science Foundation of China
(No. 12274223), the Natural Science Foundation of Jiangsu Province (No.
BK20211145), the Fundamental Research Funds for the Central Universities (No.
020414380182), the Key Research and Development Program of Nanjing Jiangbei
New Area (No. ZDYD20210101), the Program for Innovative Talents and
Entrepreneurs in Jiangsu (No. JSSCRC2021484), and the Program of Song Shan
Laboratory (Included in the management of Major Science and Technology Program
of Henan Province) (No. 221100210800-02).

##  Appendix A single-bit QDS

###  A.1 schematic of single-bit QDS

Here, we first introduce orthogonal encoding QDS [13] as an example of single-
bit QDS schemes. Commonly, all single-bit QDS protocols can be segmented into
two stages: the distribution stage and messaging stage. The schematic of
orthogonal encoding QDS is shown in Fig. 7.

distribution stage:

(i)For each possible future message $m$ = 0 or 1, Alice uses the KGP to
generate four different length $L$ keys,
$A_{B}^{0},~{}A_{B}^{1},~{}A_{C}^{0},~{}A_{C}^{1}$, where the subscript
denotes the participant with whom she performed the KGP and the superscript
denotes the future message, to be decided later by Alice. Bob holds the length
$L$ strings $K_{B}^{0},~{}K_{B}^{1}$ and Charlie holds the length L strings
$K_{C}^{0},~{}K_{C}^{1}$.

(ii)For each future message, Bob and Charlie symmetrize their keys by choosing
half of the bit values in their $K_{B}^{m},~{}K_{C}^{m}$ and sending them (as
well as the corresponding positions) to the other participant using the Bob-
Charlie secret classical channel. They will only use the bits they did not
forward and those received from the other participant. Their final symmetrized
keys are denoted as $S_{B}^{m}$ and $S_{C}^{m}$. Bob (and Charlie) will keep a
record of whether an element in $S_{B}^{m}$ ($S_{C}^{m}$) came directly from
Alice or whether it was forwarded to him by Charlie (or Bob).

Figure 7: Orthogonal encoding QDS. In the distribution stage, Alice–Bob and
Alice–Charlie independently perform KGP to generate correlated bit strings
with limited mismatches. Then Bob and Charlie symmetrize their keys by
exchanging half of their keys. In the messaging stage Alice generates the
signature depending on the message bit, and sends the message and signature to
Bob, who will transfer it to Charlie. Bob and Charlie examine their mismatch
and compare it with the threshold to verify the signed message..

messaging stage:

(i) To send a signed one-bit message $m$, Alice sends $(m,Sig_{m})$ to the
desired recipient (say Bob), where $sig_{m}=(A_{B}^{m},A_{C}^{m})$.

(ii) Bob checks whether $(m,Sig_{m})$ matches his $S_{B}^{m}$ and records the
number of mismatches he finds. He separately checks the part of his key
received directly from Alice and the part of the key received from Charlie. If
there are fewer than $s_{a}(L/2)$ mismatches in both halves of the key, where
$s_{a}<1/2$ is a small threshold determined by the parameters and the desired
security level of the protocol, then Bob accepts the message.

(iii) To forward the message to Charlie, Bob forwards the pair $(m,Sig_{m})$
that he received from Alice.

(iv) Charlie tests for mismatches in the same way, but in order to protect
against repudiation by Alice he uses a different threshold. Charlie accepts
the forwarded message if the number of mismatches in both halves of his key is
below $s_{v}(L/2)$ where $s_{v}$ is another threshold, with
$0<s_{a}<s_{v}<1/2$.

KGP is actually part of QKD protocol except for the error correction and
privacy amplification steps. In distribution stage, $A_{X}^{m}$ and
$K_{X}^{m}$ generated through KGP are correlated with limited mismatch, and
$A_{X}^{m}$ contains fewer mismatches with $K_{X}^{m}$ than does any string
produced by an eavesdropper, where $X\in\\{B,C\\}$ represents Bob and Charlie,
$m$ is the message. After Bob and Charlie’s symmetrization step, Bob holds
$S_{B}^{m}$ and Charlie holds $S_{C}^{m}$, each containing half of $K_{B}^{m}$
and $K_{C}^{m}$. From the perspective of Alice, $S_{B}^{m}$ and $S_{C}^{m}$
are symmetric. Alice has no information on whether it is Bob’s $S_{B}^{m}$ or
Charlie’s $S_{C}^{m}$ that contains a particular element of the string
($K_{B}^{m},K_{C}^{m}$). This protects against repudiation. From the
perspective of Bob, $S_{B}^{m}$ and $S_{C}^{m}$ are asymmetric. Bob has access
to all of $K_{B}^{m}$ and only half of $K_{C}^{m}$, but, even if he is
dishonest, he does not know the half of $K_{C}^{m}$ that Charlie chose to
keep. This protects against forging.

The framework of non-orthogonal encoding QDS is analogous to that of
orthogonal encoding. The difference is that it does not require the
symmetrization step. However the signer needs to send the same quantum states
to two receivers and only detection events where the two receivers both have
clicks are valid.

###  A.2 Signing a multi-bit message using single-bit QDS

The framework above only offer a way for signing a one-bit message. To sign
multi-bit messages with these protocols, it is not sufficient to directly
iterate the protocol on each bits of the message, which will give a chance for
an outside or inside attacker to perform forgery attacks [37]. In order to
offer information-theoretic security, one must reconstruct the multi-bit
message and then sign it bit by bit. This step will make the new message
become longer and thus damage the efficiency. To date, the most efficient
coding rule is given in Ref. [39], which can be summarized as follows.

Suppose the signer Alice needs to sign an $n$-bit message
$M=m_{1}||m_{2}||...||m_{n}$, $m_{i}\in\\{0,1\\}$, $i=1,2,...,n$. She will
encode $M$ into

$\displaystyle\hat{M}=1_{1}||1_{2}||...||1_{x+1}||0||m_{1}||m_{2}||...||m_{x}||0||$
(12) $\displaystyle||m_{x+1}||m_{x+2}||...||m_{2x}||0||$ $\displaystyle...$
$\displaystyle||m_{[\frac{n}{x}]x+1}||m_{[\frac{n}{x}]x+2}||...||m_{n}||0||1_{1}||1_{2}||...||1_{x+1},$

where $x$ refers to the coding interval, $[x]$ is the round down function. To
conclude, the coding rule is that the encoder replenishes a ‘0’ in the head of
$M$, and another in the tail. Then, the encoder inserts a ‘0’ every $x$ bits
and adds ‘1’ with a number of $x+1$ to both the start and the end.

Denote the length of $\hat{M}$ as $h$. An iteration of conventional QDS
protocols with $h$ rounds on $\hat{M}$ is an information-theoretically secure
protocol to sign the multi-bit message $M$. According to the encoding rule,
$h=n+[\frac{n}{x}]+2x+4$. For a given $n$ we can optimize $x$ to obtain the
minimal $h$ and the maximum efficiency $\eta=\frac{n}{h}$. It is clear that if
$n$ is large, the maximum efficiency will be close to 1, but will definitely
be less than 1. Thus in our simulation in Sec. V we use the upper bound of
deficiency, i.e., assume $h=n$.

##  Appendix B Mathematical details

###  B.1 Generating an irreducible polynomial

In this section we introduce ways to generate an irreducible polynomial over
Gloise fields GF(2) in random, which is the first step in the messaging stage
of our protocol.

Suppose $p(x)$ is a polynomial of order $n$ in ${\rm GF}(2)$. $p(x)$ is
irreducible means that no polynomials can divide it except the identity
element ’1’ and $p(x)$ itself. The necessary and sufficient condition for
$p(x)$ being irreducible can be expressed as:

$\left\\{\begin{gathered}x^{2^{n}}\equiv x~{}~{}\rm{mod}~{}p(x)\\\\[3.0pt]
\rm{gcf}(x^{2^{\frac{n}{d}}}-x,p(x))=1\end{gathered}\right.$ (13)

where $d$ is any prime factor of $n$, $\rm{gcf}(f(x),g(x))$ represents the
greatest common factor (GCF) of $f(x)$ and $g(x)$.

In order to randomly generate an irreducible polynomial, one way is to
generate polynomials at random and test for irreducibility through the
condition above. However, this is quite time consuming and requires a lot of
random bits.

A better solution is proposed in Ref. [66]. We can first have an irreducible
polynomial of order $n$, defining the extension field GF($2^{n}$). Given this,
we generate a random element in GF($2^{n}$) and then compute the minimal
polynomial of this element, which will be irreducible. This procedure only
needs $n$ random bits and consumes less time. The concrete procedure is as
follows.

Denote the initial irreducible polynomial as $f(x)$ and the polynomial
generated by random element as $g(x)$. We will calculate the sequence
$a_{0}=g_{0}(0)$, $a_{1}=g_{1}(0)$, …, $a_{2n-1}=g_{2n-1}(0)$, where
$g_{i}(x)=g^{i}(x)$ mod $f(x)$. This sequence of $2n$ elements can fully
determine the minimal polynomial of $g(x)$, which can be efficiently computed
by Berlekamp-Massey algorithm [69]. The result, i.e., the minimal polynomial
of $g(x)$, will be the irreducible polynomial we generate.

If choosing generalized division hashing, we need to generate an irreducible
polynomial over GF($2^{k}$). The procedure is the same as that described
above. The only difference is that all the calculations need to be done under
GF($2^{k}$).

###  B.2 Proof of proposition 1

An LFSR-based Toeplitz hash function can be expressed as $h_{p,s}(M)=H_{nm}M$.
The construction of $H_{nm}$ is introduced in Def. 1. Here we follow the
expression in Def. 1 and define an $n\times n$ matrix $W$ which is only
decided by $p$.

$W=\begin{pmatrix}p_{n-1}&p_{n-2}&...&p_{1}&p_{0}\\\ 1&0&...&0&0\\\
0&1&...&0&0\\\ ...&...&...&...&...\\\ 0&0&...&1&0\end{pmatrix},$ (14)

then we can express $s_{i}$ through $s$ and $W$

$s_{i}=W^{i}s.$ (15)

Thereafter we rewrite $h_{p,s}(M)$

$\displaystyle h_{p,s}(M)=$ $\displaystyle H_{nm}M$ (16) $\displaystyle=$
$\displaystyle\begin{pmatrix}s&s_{1}&...&s_{m-1}\end{pmatrix}\begin{pmatrix}M_{0}\\\
M_{1}\\\ ...\\\ M_{m-1}\end{pmatrix}$ $\displaystyle=$
$\displaystyle\sum_{i=0}^{m-1}M_{i}W^{i}s$ $\displaystyle=$ $\displaystyle
M(W)s,$

where $M(W)=M_{m-1}W^{m-1}+...+m_{1}W+m_{0}I$ is an $n\times n$ matrix.

Define $f(x)$ as the characteristic polynomial of the matrix $W$, and we can
calculate it as follows.

$\displaystyle f(x)=$ $\displaystyle|xI-W|$ (17) $\displaystyle=$
$\displaystyle\begin{vmatrix}x+p_{n-1}&p_{n-2}&...&p_{1}&p_{0}\\\
1&x&...&0&0\\\ 0&1&...&0&0\\\ ...&...&...&...&...\\\ 0&0&...&1&x\end{vmatrix}$
$\displaystyle=$ $\displaystyle x^{n}+p_{n-1}x^{n-1}+...+p_{1}x+p_{0}.$

It is obvious that $f(x)=p(x)$, in other words, $p(x)$ is the characteristic
polynomial of the matrix $W$. Then according to Hamilton-Cayley theorem,
$p(W)=0$. Thereafter, it is trivial that if $p(x)|M(x)$, $M(W)=0$, and thus
$h_{p,s}(M)=M(W)s=0$.

##  Appendix C Calculation details

###  C.1 TP-TFQKD and TP-TFKGP in this work

The calculation of TP-TFKGP in this work is analogous to that in TP-TFQKD
[43].

When Alice and Bob send intensities $k_{a}$ and $k_{b}$ with phase difference
$\theta$, the gain corresponding to only one detector ($\mathbf{L}$ or
$\mathbf{R}$) clicking is

$\displaystyle Q_{k_{a}k_{b}}^{L\theta}=$ $\displaystyle
y_{k_{a}k_{b}}\left(e^{\omega_{k_{a}k_{b}}\cos\theta}-y_{k_{a}k_{b}}\right),$
(18) $\displaystyle Q_{k_{a}k_{b}}^{R\theta}=$ $\displaystyle
y_{k_{a}k_{b}}\left(e^{-\omega_{k_{a}k_{b}}\cos\theta}-y_{k_{a}k_{b}}\right).$

where $y_{k_{a}k_{b}}=e^{\frac{-(\eta_{a}k_{a}+\eta_{b}k_{b})}{2}}(1-p_{d})$,
$\omega_{k_{a}k_{b}}=\sqrt{\eta_{a}k_{a}\eta_{b}k_{b}}$. The overall gain can
be expressed as
$Q_{k_{a}k_{b}}=1/2\pi\int_{0}^{2\pi}(Q_{k_{a}k_{b}}^{L\theta}+Q_{k_{a}k_{b}}^{R\theta})d\theta=2y_{k_{a}k_{b}}[I_{0}(\omega_{k_{a}k_{b}})-y_{k_{a}k_{b}}]$,
where $I_{0}(x)$ refers to the zero-order modified Bessel functions of the
first kind.

The total number for $\\{k_{a},k_{b}\\}$ is

$x_{k_{a}k_{b}}=Np_{k_{a}}p_{k_{b}}Q_{k_{a}k_{b}}.$ (19)

The valid post-matching events on the basis of $Z$ can be divided into two
types: correct events $\\{\mu_{a}\mathbf{o}_{a},\mathbf{o}_{b}\mu_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},\mu_{b}\mathbf{o}_{b}\\}$, and incorrect events
$\\{\mu_{a}\mathbf{o}_{a},\mu_{b}\mathbf{o}_{b}\\}$,
$\\{\mathbf{o}_{a}\mu_{a},\mathbf{o}_{b}\mu_{b}\\}$. The corresponding numbers
are denoted as $n_{C}^{z}$ and $n_{E}^{z}$, respectively, which can be written
as

$\displaystyle
n_{C}^{z}=x_{\min}\frac{x_{\mathbf{o}_{a}\mu_{b}}}{x_{0}}\frac{x_{\mu_{a}\mathbf{o}_{b}}}{x_{1}}=\frac{x_{\mathbf{o}_{a}\mu_{b}}x_{\mu_{a}\mathbf{o}_{b}}}{x_{\max}},$

and

$\displaystyle
n_{E}^{z}=x_{\min}\frac{x_{\mathbf{o}_{a}\mathbf{o}_{b}}}{x_{0}}\frac{x_{\mu_{a}\mu_{b}}}{x_{1}}=\frac{x_{\mathbf{o}_{a}\mathbf{o}_{b}}x_{\mu_{a}\mu_{b}}}{x_{\max}},$

where $x_{0}=x_{\mathbf{o}_{a}\mu_{b}}+x_{\mathbf{o}_{a}\mathbf{o}_{b}}$,
$x_{1}=x_{\mu_{a}\mathbf{o}_{b}}+x_{\mu_{a}\mu_{b}}$,
$x_{\min}=\min\\{x_{0},x_{1}\\}$, and $x_{\max}=\max\\{x_{0},x_{1}\\}$.
$s_{11}^{z}$ corresponds to the number of successful detection events, where
Alice and Bob emit a single photon in different time bins in the $Z$ basis.
The overall number of events in the $Z$ basis is

$\displaystyle n^{z}=$ $\displaystyle n^{z}_{C}+n^{z}_{E}.$ (20)

Considering the misalignment error $e_{d}^{z}$, the number of bit errors in
the $Z$ basis is $m^{z}=(1-e_{d}^{z})n^{z}_{E}+e_{d}^{z}n^{z}_{C}$. Thus, the
bit error rate in the $Z$ basis is

$\displaystyle E^{z}=$ $\displaystyle\frac{m^{z}}{n^{z}}.$ (21)

The overall number of “effective” events in the $X$ basis is

$\displaystyle n^{x}$
$\displaystyle=\frac{1}{\pi}\int_{0}^{\delta}x_{\nu_{a}\nu_{b}}^{\theta}d\theta$
(22)
$\displaystyle=\frac{Np_{\nu_{a}}p_{\nu_{b}}}{\pi}\int_{\sigma}^{\sigma+\delta}y_{\nu_{a}\nu_{b}}(e^{\omega_{\nu_{a}\nu_{b}}\cos\theta}$
$\displaystyle+e^{-\omega_{\nu_{a}\nu_{b}}\cos\theta}-2y_{\nu_{a}\nu_{b}})d\theta.$

For simplicity, we only consider the case in which all matched events satisfy
$\theta^{i}-\theta^{j}=0$. In this case, when $r_{a}^{i}\oplus r_{a}^{j}\oplus
r_{b}^{i}\oplus r_{b}^{j}=0$ (1), the
$\\{\nu_{a}^{i}\nu_{a}^{j},~{}\nu_{b}^{i}\nu_{b}^{j}\\}$ event is considered
to be an error event when different detectors (the same detector) click at
time bins $i$ and $j$.

The overall error count in the $X$ basis can be given as

$\displaystyle m^{x}$
$\displaystyle=\frac{1}{\pi}\int_{\sigma}^{\sigma+\delta}x_{\nu_{a}\nu_{b}}^{\theta}p_{E}d\theta$
(23)
$\displaystyle=\frac{2Np_{\nu_{a}}p_{\nu_{b}}}{\pi}\int_{\sigma}^{\sigma+\delta}y_{\nu_{a}\nu_{b}}\times$
$\displaystyle\left[\frac{(1-y_{\nu_{a}\nu_{b}})^{2}}{e^{\omega_{\nu_{a}\nu_{b}}\cos\theta}+e^{-\omega_{\nu_{a}\nu_{b}}\cos\theta}-2y_{\nu_{a}\nu_{b}}}-1\right]d\theta,$

where
$p_{E}=\frac{2q_{\nu_{a}\nu_{b}}^{L\theta}q_{\nu_{a}\nu_{b}}^{R\theta}}{q_{\nu_{a}\nu_{b}}^{\theta}q_{\nu_{a}\nu_{b}}^{\theta}}$.

We can then calculate the parameters in Eq. (6) to estimate the key rate and
the information leaked after the distribution stage. In the following
description, let $x^{*}$ denote the expected value of $x$. We denote the
number of $\\{k_{a},~{}k_{b}\\}$ as $x_{k_{a}k_{b}}$. We denote the number and
error number of events $\\{k_{a}^{i}k_{a}^{j},~{}k_{b}^{i}k_{b}^{j}\\}$ after
post-matching as $n_{k_{a}^{i}k_{a}^{j},~{}k_{b}^{i}k_{b}^{j}}$ and
$m_{k_{a}^{i}k_{a}^{j},~{}k_{b}^{i}k_{b}^{j}}$, respectively. For simplicity,
we abbreviate $k_{a}^{i}k_{a}^{j},k_{a}^{i}k_{a}^{j}$ as $2k_{a},2k_{b}$ when
$k_{a}^{i}=k_{a}^{j}$ and $k_{b}^{i}=k_{b}^{j}$.

(1) $\underline{s}_{11}^{z}$.

$s_{11}^{z}$ corresponds to the number of successful detection events, where
Alice and Bob emit a single photon in different time bins in the $Z$ basis.
Define $z_{10}$ ($z_{01}$) as the number of events in which Alice (Bob) emits
a single photon and Bob (Alice) emits a vacuum state in an
$\\{\mu_{a},\mathbf{o}_{b}\\}$ ($\\{\mathbf{o}_{a},\mu_{b}\\}$) event. The
lower bounds of their expected values are
$\underline{z}_{10}^{*}=Np_{\mu_{a}}p_{\mathbf{o}_{b}}\mu_{a}e^{-\mu_{a}}\underline{y^{*}_{10}}$
and
$\underline{z}^{*}_{01}=Np_{\mathbf{o}_{a}}p_{\mu_{b}}\mu_{b}e^{-\mu_{b}}\underline{y^{*}_{01}}$,
respectively, where $\underline{y}_{10}^{*}$ and $\underline{y}_{01}^{*}$ are
the corresponding yields. These can be estimated using the decoy-state method

$\displaystyle\underline{y}_{01}^{*}\geq$
$\displaystyle\frac{\mu_{b}}{N(\mu_{b}\nu_{b}-\nu_{b}^{2})}\left(\frac{e^{\nu_{b}}\underline{x}_{o_{a}\nu_{b}}^{*}}{p_{o_{a}}p_{\nu_{b}}}\right.$
$\displaystyle\left.-\frac{\nu_{b}^{2}}{\mu_{b}^{2}}\frac{e^{\mu_{b}}\overline{x}_{\hat{\mathbf{o}}_{a}\mu_{b}}^{*}}{p_{\hat{\mathbf{o}}_{a}}p_{\mu_{b}}}-\frac{\mu_{b}^{2}-\nu_{b}^{2}}{\mu_{b}^{2}}\frac{\overline{x}_{oo}^{d*}}{p_{o_{a}o_{b}}^{d}}\right),$
(24) $\displaystyle\underline{y}_{10}^{*}\geq$
$\displaystyle\frac{\mu_{a}}{N(\mu_{a}\nu_{a}-\nu_{a}^{2})}\left(\frac{e^{\nu_{a}}\underline{x}_{\nu_{a}o_{b}}^{*}}{p_{\nu_{a}}p_{o_{b}}}\right.$
$\displaystyle\left.-\frac{\nu_{a}^{2}}{\mu_{a}^{2}}\frac{e^{\mu_{a}}\overline{x}_{\mu_{a}\hat{\mathbf{o}}_{b}}^{*}}{p_{\mu_{a}}p_{\hat{\mathbf{o}}_{b}}}-\frac{\mu_{a}^{2}-\nu_{a}^{2}}{\mu_{a}^{2}}\frac{\overline{x}_{oo}^{d*}}{p_{o_{a}o_{b}}^{d}}\right),$
(25)

where
$x_{oo}^{d}=x_{\hat{\mathbf{o}}_{a}\hat{\mathbf{o}}_{b}}+x_{\hat{\mathbf{o}}_{a}\mathbf{o}_{b}}+x_{\mathbf{o}_{a}\hat{\mathbf{o}}_{b}}$
represents the number of events where at least one user chooses the declare-
vacuum state and
$p_{oo}^{d}=p_{\hat{\mathbf{o}}_{a}}p_{\hat{\mathbf{o}}_{b}}+p_{\hat{\mathbf{o}}_{a}}p_{\mathbf{o}_{b}}+p_{\mathbf{o}_{a}}p_{\hat{\mathbf{o}}_{b}}$
refers to the corresponding probability. Thus, the lower bound of
$s_{11}^{z*}$ is given by

$\displaystyle\underline{s}_{11}^{z*}=\frac{\underline{z}_{10}^{*}\underline{z}_{01}^{*}}{x_{\max}}.$
(26)

(2) $\underline{s}_{0\mu_{b}}^{z}$. $s_{0\mu_{b}}^{z}$ represents the number
of events in the $Z$ basis, Alice emits a zero-photon state in the two matched
time bins, and the total intensity of Bob’s pulses is $\mu_{b}$. We define
$z_{00}$ ($z_{0\mu_{b}}$) as the number of detection events where the state
sent by Alice collapses to the vacuum state in the
$\\{\mu_{a},\mathbf{o}_{b}\\}$ ($\\{\mu_{a},\mu_{b}\\}$) event. The lower
bound of the expected values is
$\underline{z}_{00}^{*}={p_{\mu_{a}}p_{\mathbf{o}_{b}}e^{-\mu_{a}}\underline{x}_{oo}^{d*}}/{p_{o_{a}o_{b}}^{d}}$
and
$~{}\underline{z}_{0\mu_{b}}^{*}={p_{\mu_{a}}p_{\mu_{b}}e^{-\mu_{a}}\underline{x}_{\mathbf{o}_{a}\mu_{b}}^{*}}/{p_{\mathbf{o}_{a}}p_{\mu_{b}}}$,
respectively. Here, we employ the relationship between the expected value
$\underline{x}_{\mathbf{o}_{a}\mu_{b}}^{*}={p_{\mathbf{o}_{a}}\underline{x}_{\hat{\mathbf{o}}_{a}\mu_{b}}^{*}}/{p_{\hat{\mathbf{o}}_{a}}}$,
and
$~{}\underline{x}_{\mathbf{o}_{a}\mathbf{o}_{b}}^{*}={p_{\mathbf{o}_{a}}p_{\mathbf{o}_{b}}\underline{x}_{oo}^{d*}}/{p_{oo}^{d}}$.
The lower bound of $s_{0\mu_{b}}^{z*}$ can be written as

$\displaystyle\underline{s}_{0\mu_{b}}^{z*}=\frac{\underline{x}_{\mathbf{o}_{a}\mu_{b}}^{*}\underline{z}_{00}^{*}}{x_{\max}}+\frac{\underline{x}_{\mathbf{o}_{a}\mathbf{o}_{b}}^{*}\underline{z}_{0\mu_{b}}^{*}}{x_{\max}}$
(27)

(3) $\underline{s}_{11}^{x}$. We define the phase difference between Alice and
Bob as $\theta=\theta_{a}-\theta_{b}+\phi_{ab}$. All valid events in the $X$
basis can be grouped according to the phase difference
$\theta~{}(\in\\{-\delta,\delta\\}\cup\\{\pi-\delta,\pi+\delta\\})$, and the
corresponding number in the $\\{k_{a},~{}k_{b}\\}$ event is denoted as
$x_{k_{a}k_{b}}^{\theta}$. In the post-matching step, two time bins are
matched if they have the same phase difference $\theta$. Suppose the global
phase difference $\theta$ is a randomly and uniformly distributed value, and
considering the angle of misalignment in the $X$ basis $\sigma$, the expected
number of single-photon pairs can be given by

$\displaystyle\underline{s}_{11}^{x*}$
$\displaystyle=\frac{1}{\pi}\int_{\sigma}^{\sigma+\delta}x_{\nu_{a}\nu_{b}}^{\theta}\times
2\frac{\nu_{b}e^{-(\nu_{a}+\nu_{b})}\underline{y}_{01}^{*}}{q_{\nu_{a}\nu_{b}}^{\theta}}\frac{\nu_{a}e^{-(\nu_{a}+\nu_{b})}\underline{y}_{10}^{*}}{q_{\nu_{a}\nu_{b}}^{\theta}}d\theta$
(28)
$\displaystyle=\frac{Np_{\nu_{a}}p_{\nu_{b}}}{\pi}\int_{\sigma}^{\sigma+\delta}\frac{2\nu_{a}\nu_{b}e^{-2(\nu_{a}+\nu_{b})}\underline{y}_{01}^{*}\underline{y}_{10}^{*}}{q_{\nu_{a}\nu_{b}}^{\theta}},$

where $q_{\nu_{a}\nu_{b}}^{\theta}$ is the gain when Alice chooses intensity
$\nu_{a}$, and Bob chooses the intensity $\nu_{b}$ with phase difference
$\theta$ and
$x_{\nu_{a}\nu_{b}}^{\theta}=Np_{\nu_{a}}p_{\nu_{b}}q_{\nu_{a}\nu_{b}}^{\theta}$.

(4) $\overline{e}_{11}^{x}$. For single-photon pairs, the expected value of
the phase error rate in the $Z$ basis is equal to the expected value of the
bit error rate in the $X$ basis. Therefore, we first calculate the number of
errors of the single-photon pairs in the $X$ basis ${t_{11}^{x}}$. The upper
bound of ${t_{11}^{x}}$ can be expressed as

$\displaystyle\overline{t}_{11}^{x}\leq$ $\displaystyle
m^{x}-\underline{(m_{\nu_{a}0,\nu_{b}0}+m_{0\nu_{a},0\nu_{b}})}+\overline{m}_{00,00},$
(29)

where $(m_{\nu_{a}0,\nu_{b}0}$ ($m_{0\nu_{a},0\nu_{b}}$) is the error count
when the states sent by Alice and Bob in time bin $i$ ($j$) both collapse to
the vacuum state in events $\\{2\nu_{a},2\nu_{b}\\}$, and $m_{00,00}$
corresponds to the event where the states sent by Alice and Bob both collapse
to vacuum states in events $\\{2\nu_{a},2\nu_{b}\\}$. The expected counts
$\underline{(n_{\nu_{a}0,\nu_{b}0}+n_{0\nu_{a},0\nu_{b}})}^{*}$ and
$\overline{n}_{00,00}^{*}$ can be expressed as

$\displaystyle\underline{(n_{\nu_{a}0,\nu_{b}0}+n_{0\nu_{a},0\nu_{b}})}^{*}=$
$\displaystyle\frac{2}{\pi}\int_{\sigma}^{\sigma+\delta}x_{\nu_{a}\nu_{b}}^{\theta}\frac{e^{-(\nu_{a}+\nu_{b})}\underline{q}_{00}^{*}}{q_{\nu_{a}\nu_{b}}^{\theta}}d\theta$
(30) $\displaystyle=$ $\displaystyle\frac{\delta
Np_{\nu_{a}}p_{\nu_{b}}e^{-(\nu_{a}+\nu_{b})}\underline{q}_{00}^{*}}{\pi}$

and

$\displaystyle\overline{n}_{00,00}^{*}=$
$\displaystyle\frac{1}{\pi}\int_{\sigma}^{\sigma+\delta}x_{\nu_{a}\nu_{b}}^{\theta}\left(\frac{e^{-(\nu_{a}+\nu_{b})}\overline{q}_{00}^{*}}{q_{\nu_{a}\nu_{b}}^{\theta}}\right)^{2}d\theta$
(31) $\displaystyle=$
$\displaystyle\frac{Np_{\nu_{a}}p_{\nu_{b}}}{\pi}\int_{\sigma}^{\sigma+\delta}\frac{e^{-2(\nu_{a}+\nu_{b})}(\overline{q}_{00}^{*})^{2}}{q_{\nu_{a}\nu_{b}}^{\theta}}d\theta$

respectively. Here $q_{00}^{*}=x_{o_{a}o_{b}}^{d*}/(Np_{oo}^{d})$. Using the
fact that the error rate of the vacuum state is always $1/2$, we have
$\underline{(m_{\nu_{a}0,\nu_{b}0}+m_{0\nu_{a},0\nu_{b}})}^{*}=\frac{1}{2}\underline{(n_{\nu_{a}0,\nu_{b}0}+n_{0\nu_{a},0\nu_{b}})}^{*}$
and $\overline{m}_{00,00}^{*}=\frac{1}{2}\overline{n}_{00,00}^{*}$. Hence the
upper bound of the bit error rate in the $X$ basis can be given by

$\overline{e}_{11}^{x}=\overline{t_{11}^{x}}/\underline{s}_{11}^{x}.$ (32)

(5) $\overline{\phi}_{11}^{z}$. For a failure probability $\varepsilon$, the
upper bound of the phase error rate $\phi_{11}^{z}$ can be obtained by using
the random sampling without replacement [70]

$\displaystyle\overline{\phi}_{11}^{z}\leq$
$\displaystyle\overline{e}_{11}^{x}+\gamma^{U}\left(\underline{s}_{11}^{z},\underline{s}_{11}^{x},\overline{e}_{11}^{x},\epsilon\right),$
(33)

where

$\gamma^{U}(n,k,\lambda,\epsilon)=\frac{\frac{(1-2\lambda)AG}{n+k}+\sqrt{\frac{A^{2}G^{2}}{(n+k)^{2}}+4\lambda(1-\lambda)G}}{2+2\frac{A^{2}G}{(n+k)^{2}}},$
(34)

with $A=\max\\{n,k\\}$ and $G=\frac{n+k}{nk}\ln{\frac{n+k}{2\pi
nk\lambda(1-\lambda)\epsilon^{2}}}$.

(6) $\underline{s}_{11}^{zn}$, $\underline{s}_{0\mu_{b}}^{zn}$ and
$\overline{\phi}_{11}^{zn}$. Finally we can estimate the parameters in Eq.
(6), i.e., the lower bound of vacuum events and single-photon pairs in a
selected key group $\underline{s}_{11L}^{z}$ and
$\underline{s}_{0\mu_{b}L}^{z}$, and the upper bound of the phase error rate
of the $n$-bit group $\overline{\phi}_{11U}^{z}$. They can be obtained from
the parameters above by using the random sampling without replacement.

$\displaystyle\underline{s}_{11}^{zn}\geq$ $\displaystyle
n\left[\underline{s}_{11}^{z}/n^{z}-\gamma^{U}\left(n,n^{z}-n,\underline{s}_{11}^{z}/n^{z},\epsilon\right)\right],$
(35) $\displaystyle\underline{s}_{0\mu_{b}}^{zn}\geq$ $\displaystyle
n\left[\underline{s}_{0\mu_{b}}^{z}/n^{z}-\gamma^{U}\left(n,n^{z}-n,\underline{s}_{0\mu_{b}}^{z}/n^{z},\epsilon\right)\right],$
$\displaystyle\overline{\phi}_{11}^{zn}\leq$
$\displaystyle\overline{\phi}_{11}^{z}+\gamma^{U}\left(\underline{s}_{11}^{zn},\underline{s}_{11}^{z}-\underline{s}_{11}^{zn},\overline{\phi}_{11}^{z},\epsilon\right).$

(7)$l_{key}$. We can also obtain the length of final keys of TP-TFQKD, which
can be used to simulate the performance of OTUH-QDS in Fig. 4.

$\displaystyle l_{key}=$
$\displaystyle\underline{s}_{0\mu_{b}}^{z}+\underline{s}_{11}^{z}\left[1-H(\overline{\phi}_{11}^{z})\right]-n^{z}fH(E^{z})$
(36)
$\displaystyle-\log_{2}{\frac{2}{\epsilon_{cor}}}-2\log_{2}{\frac{1}{2\epsilon_{PA}}},$

where $\epsilon_{PA}$ is the failure probability of privacy amplification.

###  C.2 BB84-KGP in BB84-QDS and this work

Both BB84-QDS and this work utilize decoy-state BB84-KGP to generate
correlated bit strings. According to Ref. [71] we can estimate the number of
vacuum events and single-photon events under $X$ basis,

$s_{X,0}\geq\tau_{0}\frac{\mu_{\rm{2}}n_{X,\mu_{\rm{3}}}^{-}-\mu_{\rm{3}}n_{X,\mu_{\rm{2}}}^{+}}{\mu_{\rm{2}}-\mu_{\rm{3}}},$
(37)
$s_{X,1}\geq\frac{\tau_{1}\mu_{\rm{1}}\left[n_{X,\mu_{\rm{2}}}^{-}-n_{X,\mu_{\rm{3}}}^{+}-\frac{\mu_{\rm{2}}^{2}-\mu_{\rm{3}}^{2}}{\mu_{\rm{1}}^{2}}(n_{X,\mu_{\rm{1}}}^{+}-\frac{s_{X,0}}{\tau_{0}})\right]}{\mu_{\rm{1}}(\mu_{\rm{2}}-\mu_{\rm{3}})-\mu_{\rm{2}}^{2}+\mu_{\rm{3}}^{2}}.$
(38)

where $\tau_{n}:=\sum_{k\in\mathcal{K}}e^{-k}k^{n}p_{k}/n!$ is the probability
that Alice sends a $n$-photon state, and

$n_{X,k}^{\pm}:=\frac{e^{k}}{p_{k}}\left(n_{X,k}\pm\sqrt{\frac{n_{X}}{2}\log\frac{21}{\varepsilon_{\textnormal{sec}}}}\right),~{}\forall~{}k\in\mathcal{K}.$

We can also calculate the number of vacuum events, $s_{Z,0}$, and the number
of single-photon events, $s_{Z,1}$, for
$\mathcal{Z}=\cup_{k\in\mathcal{K}}\mathcal{Z}_{k}$, i.e., by using Eqs. (37)
and (38) with statistics from the basis $Z$. Then we can obtain the phase
error rate of the single-photon events in the $X$ basis by

$\phi_{X,1}:=\frac{c_{X,1}}{s_{X,1}}\leq\frac{v_{Z,1}}{s_{Z,1}}+\gamma^{U}\left(s_{Z,1},{s}_{X,1},\frac{v_{Z,1}}{s_{Z,1}},\varepsilon_{\textnormal{sec}}\right),$
(39)

where

$v_{Z,1}\leq\tau_{1}\frac{m_{Z,\mu_{\rm{2}}}^{+}-m_{Z,\mu_{\rm{3}}}^{-}}{\mu_{\rm{2}}-\mu_{\rm{3}}},$
$m_{Z,k}^{\pm}:=\frac{e^{k}}{p_{k}}\left(m_{Z,k}\pm\sqrt{\frac{m_{Z}}{2}\log\frac{21}{\varepsilon_{\textnormal{sec}}}}\right),~{}\forall~{}k\in\mathcal{K},$
$\gamma^{U}(n,k,\lambda,\epsilon)=\frac{\frac{(1-2\lambda)AG}{n+k}+\sqrt{\frac{A^{2}G^{2}}{(n+k)^{2}}+4\lambda(1-\lambda)G}}{2+2\frac{A^{2}G}{(n+k)^{2}}}$

The total number of events under $X$ basis is
$n_{X}=\sum_{k\in\mathcal{K}}n_{X,k}$ and the number of error events is
$m_{X}=\sum_{k\in\mathcal{K}}m_{X,k}$.

In BB84-QDS, the unknown information to the attacker is given by

$\mathcal{H}=\underline{s}_{X,0}+\underline{s}_{X,1}(1-h(\overline{\phi}_{X,1})).$
(40)

In our protocol based on BB84-KGP, we need to estimate parameters in a
selected $n$-bit group, i.e., the lower bound of number of vacuum events and
single-photon events under $X$ basis $\underline{s}_{X,0}^{n}$ and
$\underline{s}_{X,1}^{n}$, and the upper bound of the phase error rate of the
single-photon events in the $X$ basis $\overline{\phi}_{X,1}^{n}$.

$\displaystyle s_{X,0}^{n}\geq$ $\displaystyle
n\left[\underline{s}_{X,0}/n_{Z}-\gamma^{U}(n,n_{Z}-n,\underline{s}_{X,0}/n_{Z},\epsilon)\right],$
(41) $\displaystyle s_{X,1}^{n}\geq$ $\displaystyle
n\left[\underline{s}_{X,1}/n_{Z}-\gamma^{U}(n,n_{Z}-n,\underline{s}_{X,1}/n_{Z},\epsilon)\right],$
(42) $\displaystyle\phi_{X,1}^{n}\leq$
$\displaystyle\phi_{X,1}+\gamma^{U}\left(\underline{s}_{X,1}^{n},\underline{s}_{X,1}-\underline{s}_{X,1}^{n},\overline{\phi}_{X,1},\epsilon\right).$
(43)

Finally we can obtain

$\mathcal{H}=\underline{s}_{X,0}^{n}+\underline{s}_{X,1}^{n}\left[1-h(\overline{\phi}_{X,1}^{n})\right]-\lambda_{EC},$
(44)

where $\lambda_{EC}=nh(m_{X}/n_{X})$.

###  C.3 SNS-KGP and SNS-QDS with random pairing

We first follow the calculation in Ref. [72]. Alice and Bob obtain
$N_{jk}(jk=\\{00,01,02,10,20\\})$ instances when Alice sends intensity $j$ and
Bob sends state $k$. Here ’1’ and ’2’ represent the two intensities used in
the KGP. After the sifted step, Alice and Bob obtain $n_{jk}$ one-detector
heralded events. We denote the counting rate of source $jk$ as
$S_{jk}=n_{jk}/N_{jk}$. With all these definitions, we have

$\begin{split}N_{00}=&\left[(1-p_{z})^{2}p_{0}^{2}+2(1-p_{z})p_{z}p_{0}p_{z0}\right]N,\\\
N_{01}=&N_{10}=\left[(1-p_{z})^{2}p_{0}p_{1}+(1-p_{z})p_{z}p_{z0}p_{1}\right]N,\\\
N_{02}=&N_{20}=\big{[}(1-p_{z})^{2}(1-p_{0}-p_{1})p_{0}\\\
&+(1-p_{z})p_{z}p_{z0}(1-p_{0}-p_{1})\big{]}N.\end{split}$ (45)

In addition, we need to define two new subsets of $X_{1}$ windows,
$C_{\Delta^{+}}$ and $C_{\Delta^{-}}$, to estimate the upper bound of
$e_{1}^{ph}$. The number of instances in $C_{\Delta^{\pm}}$ is

$N_{\Delta^{\pm}}=\frac{\Delta}{2\pi}(1-p_{z})^{2}p_{1}^{2}N.$ (46)

We denote the number of effective events of right detectors responding from
$C_{\Delta^{+}}$ as $n_{\Delta^{+}}^{R}$, and the number of effective events
of left detectors responding from $C_{\Delta^{-}}$ as $n_{\Delta^{-}}^{L}$.
And we obtain the counting error rate of $C_{\Delta^{\pm}}$,
$T_{\Delta}=\frac{n_{\Delta^{+}}^{R}+n_{\Delta^{-}}^{L}}{2N_{\Delta^{\pm}}}$.

If we denote the expected value of the counting rate of untagged photons as
$s_{1}^{Z*}$, the lower bound of $s_{1}^{Z*}$ is

$\begin{split}s_{1}^{Z*}\geq&\underline{s}_{1}^{Z*}=\frac{1}{2\mu_{1}\mu_{2}(\mu_{2}-\mu_{1})}\big{[}\mu_{2}^{2}e^{\mu_{1}}(\underline{S}_{01}^{*}+\underline{S}_{10}^{*})\\\
&-\mu_{1}^{2}e^{\mu_{2}}(\overline{S}_{02}^{*}+\overline{S}_{20}^{*})-2(\mu_{2}^{2}-\mu_{1}^{2})\overline{S}_{00}^{*}\big{]},\end{split}$
(47)

where $S^{*}_{jk}$ is the expected value of $S_{jk}$, and
$\overline{S}^{*}_{jk}$ and $\underline{S}^{*}_{jk}$ are the upper bound and
lower bound of $S^{*}_{jk}$ when we estimate the expected value from its
observed value.

The expected value of the phase-flip error rate of the untagged photons
satisfies

$e_{1}^{ph*}\leq\overline{e}_{1}^{ph*}=\frac{\overline{T}^{*}_{\Delta}-\frac{1}{2}e^{-2\mu_{1}}\underline{S}^{*}_{00}}{2\mu_{1}e^{-2\mu_{1}}\underline{s}_{1}^{Z*}}.$
(48)

Here we use the fact that the error rate of vacuum state is always
$\frac{1}{2}$.

If the total transmittance of the experimental setups is $\eta$, then we have

$\displaystyle n_{00}$ $\displaystyle=2p_{d}(1-p_{d})N_{00},$ $\displaystyle
n_{01}$
$\displaystyle=n_{10}=2\left[(1-p_{d})e^{\eta\mu_{1}/2}-(1-p_{d})^{2}e^{-\eta\mu_{1}}\right]N_{01},$
$\displaystyle n_{02}$
$\displaystyle=n_{20}=2\left[(1-p_{d})e^{\eta\mu_{2}/2}-(1-p_{d})^{2}e^{-\eta\mu_{2}}\right]N_{02},$
$\displaystyle n_{t}$ $\displaystyle=n_{signal}+n_{error},$ $\displaystyle
E_{z}$ $\displaystyle=\frac{n_{error}}{n_{t}},$ $\displaystyle
n_{\Delta^{+}}^{R}$
$\displaystyle=n_{\Delta^{-}}^{L}=\left[T_{X}(1-2e_{d})+e_{d}S_{X}\right]N_{\Delta^{\pm}},$

where $N_{00},N_{01},N_{10},N_{02},N_{20},N_{\Delta^{\pm}}$ are defined in
Eqs. (45) and (46), and

$\displaystyle n_{signal}=$ $\displaystyle
4Np_{z}^{2}p_{z0}(1-p_{z0})\big{[}(1-p_{d})e^{-\eta\mu_{z}/2}$
$\displaystyle-(1-p_{d})^{2}e^{-2\eta\mu_{z}}\big{]},$ $\displaystyle
n_{error}=$ $\displaystyle
2Np_{z}^{2}(1-p_{z0})^{2}\big{[}(1-p_{d})e^{-\eta\mu_{z}}I_{0}(\eta\mu_{z})$
$\displaystyle-(1-p_{d})^{2}e^{-2\eta\mu_{z}}\big{]}+2Np_{z}^{2}p_{z0}^{2}p_{d}(1-p_{d}),$
$\displaystyle T_{X}=$
$\displaystyle\frac{1}{\Delta}\int_{-\frac{\Delta}{2}}^{\frac{\Delta}{2}}(1-p_{d})e^{-2\eta\mu_{1}\cos^{2}{\frac{\delta}{2}}}d\delta$
$\displaystyle-(1-p_{d})^{2}e^{-2\eta\mu_{1}},$ $\displaystyle S_{X}=$
$\displaystyle\frac{1}{\Delta}\int_{-\frac{\Delta}{2}}^{\frac{\Delta}{2}}(1-p_{d})e^{-2\eta\mu_{1}\sin^{2}{\frac{\delta}{2}}}d\delta$
$\displaystyle-(1-p_{d})^{2}e^{-2\eta\mu_{1}}+T_{X},$

where $I_{0}(x)$ is the $0$-order hyperbolic Bessel functions of the first
kind.

In SNS-QDS, the unknown information to the attacker is given by

$\mathcal{H}=\underline{s}_{1}^{Z*}(1-h(\overline{e}_{1}^{ph*})).$ (49)

In our protocol based on SNS-KGP, there is

$\displaystyle\underline{s}_{1n}^{Z*}=$ $\displaystyle
n\left[\underline{s}_{1}^{Z*}-\gamma^{U}\left(n,n_{Z}-n,\underline{s}_{1}^{Z*}/n_{Z},\epsilon\right)\right],$
(50) $\displaystyle\overline{e}_{1n}^{ph*}=$ $\displaystyle
n\left[\overline{e}_{1}^{ph*}+\gamma^{U}\left(\underline{s}_{1n}^{Z*},\underline{s}_{1}^{Z*}-\underline{s}_{1n}^{Z*}\,\overline{e}_{1}^{ph*},\epsilon\right)\right].$

and

$\mathcal{H}=\underline{s}_{1n}^{Z*}\left[1-h(\overline{e}_{1n}^{ph*})\right]-\lambda_{EC},$
(51)

where $\lambda_{EC}=nh(E_{z})$.

In SNS-QDS with random pairing, we follow the calculation in Ref. [24]. After
random pairing there are two different phase error rates

$\tilde{e}_{1}^{\prime
ph}=\frac{(e_{1}^{ph})^{2}}{(e_{1}^{ph})^{2}+(1-e_{1}^{ph})^{2}},$ (52)
$\tilde{e}_{2}^{\prime ph}=\frac{1}{2},$ (53)

and a new bit flip error rate

$E^{\prime}=2E_{z}(1-E_{z}).$ (54)

The proportion of untagged bits after random pairing is

$\Delta^{\prime}_{un}=\Delta_{un}^{2}+2\Delta_{un}(1-\Delta_{un}),$ (55)

where $\Delta_{un}=Np_{z}^{2}p_{z0}(1-p_{z0})s^{Z}_{1}/n_{t}$ is the
proportion of untagged bits before random pairing. The unknown information to
the attacker is given by

$\displaystyle\mathcal{H}=$
$\displaystyle\Delta^{\prime}_{un}-\Delta_{un}^{2}\left[p_{1}H(\tilde{e}_{1}^{\prime
ph})+(1-p_{1})H(\tilde{e}_{2}^{\prime ph})\right]$ (56)
$\displaystyle-2\Delta_{un}(1-\Delta_{un})H(e_{1}^{ph}),$

where $p_{1}=(e_{1}^{ph})^{2}+(1-e_{1}^{ph})^{2}$.

##  Appendix D Error correction and privacy amplification

In this section we introduce our simulation of error correction and privacy
amplification in Table 2. We use the simulated data of TP-TFKGP at the
distance of 400 km, which can be calculated by Eqs. 20, 21, 36 in Appendix C.
We implement our simulation on a desktop computer with an Intel i5-10400 CPU
(with RAM of 8 GB).

We use improved Cascade protocol to perform error correction to correct 300
(or 39830) errors among $1.267\times 10^{6}$ (or $1.695\times 10^{8}$) bits.
The detailed procedure of improved Cascade protocol can be seen in Ref. [65],
where users first block their keys, and then perform binary process on each
block to correct the errors and start trace-back section to check the error,
until there are no errors in each block. The results show that time
consumption is 3.62 and 930.98 seconds with data sizes $10^{11}$ and
$10^{13}$, respectively.

In privacy amplification step, Alice chooses a random universal2 hash function
and performs it on the $n_{Z}$-bit keys after error correction to obtain
$l$-bit final keys. The choice of function is communicated to Bob, who also
uses it to obtain his $l$-bit final keys. In the simulation we utilize a
random Toeplitz matrix as the universal2 hash function. When the data size is
$10^{13}$, the matrix is too large that it exceeds the storage of our
computer. Thus in the algorithm we block the matrix into $10\times 10$ (100)
submatrices with the same size to accomplish the calculation. For hash
manipulations of every submatrix we follow the procedure in Ref. [73], where
fast Fourier transform is used to speed up calculation time. In the simulation
it takes 2.98 and $2.057\times 10^{4}$ seconds with data sizes $10^{11}$ and
$10^{13}$, respectively.

## References

  * Diffie and Hellman [1976] W. Diffie and M. Hellman, New directions in cryptography, IEEE trans. Inf. Theory 22, 644 (1976).
  * DeMillo [1978] R. A. DeMillo,  _Foundations of secure computation_ , Tech. Rep. (Georgia Institute of Technology, 1978).
  * Rivest  _et al._ [1978] R. L. Rivest, A. Shamir, and L. Adleman, A method for obtaining digital signatures and public-key cryptosystems, Commun. ACM 21 (1978).
  * Elgamal [1985] T. Elgamal, A public key cryptosystem and a signature scheme based on discrete logarithms, IEEE trans. Inf. Theory 31, 469 (1985).
  * Stevens  _et al._ [2017] M. Stevens, E. Bursztein, P. Karpman, A. Albertini, and Y. Markov, The first collision for full sha-1, in  _Advances in Cryptology – CRYPTO 2017_ , LNCS, Vol. 10401 (Springer, 2017) pp. 570–596.
  * Boudot  _et al._ [2020] F. Boudot, P. Gaudry, A. Guillevic, N. Heninger, E. Thomé, and P. Zimmermann, Comparing the difficulty of factorization and discrete logarithm: a 240-digit experiment, in  _Annual International Cryptology Conference_ (Springer, 2020) pp. 62–91.
  * Shor [1994] P. W. Shor, Algorithms for quantum computation: discrete logarithms and factoring, in  _Proceedings 35th annual symposium on foundations of computer science_ (IEEE, 1994) pp. 124–134.
  * Gottesman and Chuang [2001] D. Gottesman and I. Chuang, Quantum digital signatures, arXiv preprint quant-ph/0105032 (2001).
  * Clarke  _et al._ [2012] P. J. Clarke, R. J. Collins, V. Dunjko, E. Andersson, J. Jeffers, and G. S. Buller, Experimental demonstration of quantum digital signatures using phase-encoded coherent states of light, Nat. Commun. 3, 1174 (2012).
  * Collins  _et al._ [2014] R. J. Collins, R. J. Donaldson, V. Dunjko, P. Wallden, P. J. Clarke, E. Andersson, J. Jeffers, and G. S. Buller, Realization of quantum digital signatures without the requirement of quantum memory, Phys. Rev. Lett. 113, 040502 (2014).
  * Dunjko  _et al._ [2014] V. Dunjko, P. Wallden, and E. Andersson, Quantum digital signatures without quantum memory, Phys. Rev. Lett. 112, 040502 (2014).
  * Yin  _et al._ [2016] H.-L. Yin, Y. Fu, and Z.-B. Chen, Practical quantum digital signature, Phys. Rev. A 93, 032316 (2016).
  * Amiri  _et al._ [2016] R. Amiri, P. Wallden, A. Kent, and E. Andersson, Secure quantum signatures using insecure quantum channels, Phys. Rev. A 93, 032325 (2016).
  * Puthoor  _et al._ [2016] I. V. Puthoor, R. Amiri, P. Wallden, M. Curty, and E. Andersson, Measurement-device-independent quantum digital signatures, Phys. Rev. A 94, 022328 (2016).
  * Shang  _et al._ [2016] T. Shang, Q. Lei, and J. Liu, Quantum random oracle model for quantum digital signature, Phys. Rev. A 94, 042314 (2016).
  * Yang  _et al._ [2017] Y.-G. Yang, Z.-C. Liu, J. Li, X.-B. Chen, H.-J. Zuo, Y.-H. Zhou, and W.-M. Shi, Theoretically extensible quantum digital signature with starlike cluster states, Quantum Inf. Process. 16, 12 (2017).
  * Thornton  _et al._ [2019] M. Thornton, H. Scott, C. Croal, and N. Korolkova, Continuous-variable quantum digital signatures over insecure channels, Phys. Rev. A 99, 032341 (2019).
  * Qu  _et al._ [2019] W. Qu, Y. Zhang, H. Liu, T. Dou, J. Wang, Z. Li, S. Yang, and H. Ma, Multi-party ring quantum digital signatures, J. Opt. Soc. Am. B 36, 1335 (2019).
  * Zhang  _et al._ [2020] C.-M. Zhang, Y. Zhu, J.-J. Chen, and Q. Wang, Practical quantum digital signature with configurable decoy states, Quantum Inf. Process. 19, 151 (2020).
  * Lu  _et al._ [2021] Y.-S. Lu, X.-Y. Cao, C.-X. Weng, J. Gu, Y.-M. Xie, M.-G. Zhou, H.-L. Yin, and Z.-B. Chen, Efficient quantum digital signatures without symmetrization step, Opt. Express 29, 10162 (2021).
  * Zhang  _et al._ [2021] C.-H. Zhang, X. Zhou, C.-M. Zhang, J. Li, and Q. Wang, Twin-field quantum digital signatures, Opt. Lett. 46, 3757 (2021).
  * Zhao  _et al._ [2021] W. Zhao, R. Shi, J. Shi, P. Huang, Y. Guo, and D. Huang, Multibit quantum digital signature with continuous variables using basis encoding over insecure channels, Phys. Rev. A 103, 012410 (2021).
  * Weng  _et al._ [2021] C.-X. Weng, Y.-S. Lu, R.-Q. Gao, Y.-M. Xie, J. Gu, C.-L. Li, B.-H. Li, H.-L. Yin, and Z.-B. Chen, Secure and practical multiparty quantum digital signatures, Opt. Express 29, 27661 (2021).
  * Qin  _et al._ [2022] J.-Q. Qin, C. Jiang, Y.-L. Yu, and X.-B. Wang, Quantum digital signatures with random pairing, Phys. Rev. Applied 17, 044047 (2022).
  * Zhang  _et al._ [2022] M.-H. Zhang, J.-H. Xie, J.-Y. Wu, L.-Y. Yue, C. He, Z.-W. Cao, and J.-Y. Peng, Practical long-distance twin-field quantum digital signatures, Quantum Inf. Process. 21, 150 (2022).
  * Yin  _et al._ [2017a] H.-L. Yin, Y. Fu, H. Liu, Q.-J. Tang, J. Wang, L.-X. You, W.-J. Zhang, S.-J. Chen, Z. Wang, Q. Zhang, T.-Y. Chen, Z.-B. Chen, and J.-W. Pan, Experimental quantum digital signature over 102 km, Phys. Rev. A 95, 032334 (2017a).
  * Collins  _et al._ [2017] R. J. Collins, R. Amiri, M. Fujiwara, T. Honjo, K. Shimizu, K. Tamaki, M. Takeoka, M. Sasaki, E. Andersson, and G. S. Buller, Experimental demonstration of quantum digital signatures over 43 db channel loss using differential phase shift quantum key distribution, Sci. Rep. 7, 3235 (2017).
  * Yin  _et al._ [2017b] H.-L. Yin, W.-L. Wang, Y.-L. Tang, Q. Zhao, H. Liu, X.-X. Sun, W.-J. Zhang, H. Li, I. V. Puthoor, L.-X. You, E. Andersson, Z. Wang, Y. Liu, X. Jiang, X. Ma, Q. Zhang, M. Curty, T.-Y. Chen, and J.-W. Pan, Experimental measurement-device-independent quantum digital signatures over a metropolitan network, Phys. Rev. A 95, 042338 (2017b).
  * Roberts  _et al._ [2017] G. Roberts, M. Lucamarini, Z. Yuan, J. Dynes, L. Comandar, A. Sharpe, A. Shields, M. Curty, I. Puthoor, and E. Andersson, Experimental measurement-device-independent quantum digital signatures, Nat. Commun. 8, 1098 (2017).
  * Zhang  _et al._ [2018] C.-H. Zhang, X.-Y. Zhou, H.-J. Ding, C.-M. Zhang, G.-C. Guo, and Q. Wang, Proof-of-principle demonstration of passive decoy-state quantum digital signatures over 200 km, Phys. Rev. Applied 10, 034033 (2018).
  * An  _et al._ [2019] X.-B. An, H. Zhang, C.-M. Zhang, W. Chen, S. Wang, Z.-Q. Yin, Q. Wang, D.-Y. He, P.-L. Hao, S.-F. Liu, X.-Y. Zhou, G.-C. Guo, and Z.-F. Han, Practical quantum digital signature with a gigahertz bb84 quantum key distribution system, Opt. Lett. 44, 139 (2019).
  * Ding  _et al._ [2020] H.-J. Ding, J.-J. Chen, L. Ji, X.-Y. Zhou, C.-H. Zhang, C.-M. Zhang, and Q. Wang, 280-km experimental demonstration of a quantum digital signature with one decoy state, Opt. Lett. 45, 1711 (2020).
  * Richter  _et al._ [2021] S. Richter, M. Thornton, I. Khan, H. Scott, K. Jaksch, U. Vogl, B. Stiller, G. Leuchs, C. Marquardt, and N. Korolkova, Agile and versatile quantum communication: Signatures and secrets, Phys. Rev. X 11, 011038 (2021).
  * Roehsner  _et al._ [2021] M.-C. Roehsner, J. A. Kettlewell, J. Fitzsimons, and P. Walther, Probabilistic one-time programs using quantum entanglement, npj Quantum Inf. 7, 98 (2021).
  * Roehsner  _et al._ [2018] M.-C. Roehsner, J. A. Kettlewell, T. B. Batalhão, J. F. Fitzsimons, and P. Walther, Quantum advantage for probabilistic one-time programs, Nat. Commun. 9, 5225 (2018).
  * Pelet  _et al._ [2022] Y. Pelet, I. V. Puthoor, N. Venkatachalam, S. Wengerovsky, M. Loncaric, S. P. Neumann, B. Liu, Z. Samec, M. Stipčević, R. Ursin, _et al._ , Unconditionally secure digital signatures implemented in an 8-user quantum network, New J. Phys. (2022).
  * Wang  _et al._ [2015] T.-Y. Wang, X.-Q. Cai, Y.-L. Ren, and R.-L. Zhang, Security of quantum digital signatures for classical messages, Sci. Rep. 5, 9321 (2015).
  * Wang  _et al._ [2017] T.-Y. Wang, J.-F. Ma, and X.-Q. Cai, The postprocessing of quantum digital signatures, Quantum Inf. Process. 16, 19 (2017).
  * Zhang  _et al._ [2019] H. Zhang, X.-B. An, C.-H. Zhang, C.-M. Zhang, and Q. Wang, High-efficiency quantum digital signature scheme for signing long messages, Quantum Inf. Process. 18, 3 (2019).
  * Cai  _et al._ [2019] X.-Q. Cai, T.-Y. Wang, C.-Y. Wei, and F. Gao, Cryptanalysis of multiparty quantum digital signatures, Quantum Inf. Process. 18, 252 (2019).
  * Yao  _et al._ [2019] X. Yao, X. Liu, R. Xue, H. Wang, H. Li, Z. Wang, L. You, Y. Huang, and W. Zhang, Multi-bit quantum digital signature based on quantum temporal ghost imaging, arXiv preprint arXiv:1901.03004 (2019).
  * Yin  _et al._ [2023] H.-L. Yin, Y. Fu, C.-L. Li, C.-X. Weng, B.-H. Li, J. Gu, Y.-S. Lu, S. Huang, and Z.-B. Chen, Experimental quantum secure network with digital signatures and encryption, Natl. Sci. Rev. 10, nwac228 (2023).
  * Xie  _et al._ [2023] Y.-M. Xie, C.-X. Weng, Y.-S. Lu, Y. Fu, Y. Wang, H.-L. Yin, and Z.-B. Chen, Scalable high-rate twin-field quantum key distribution networks without constraint of probability and intensity, Phys. Rev. A 107, 042603 (2023).
  * Bennett and Brassard [2014] C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, Theor. Comput. Sci. 560, 7 (2014).
  * Lo  _et al._ [2012] H.-K. Lo, M. Curty, and B. Qi, Measurement-device-independent quantum key distribution, Phy. Rev. Lett. 108, 130503 (2012).
  * Braunstein and Pirandola [2012] S. L. Braunstein and S. Pirandola, Side-channel-free quantum key distribution, Phy. Rev. Lett. 108, 130502 (2012).
  * Zhou  _et al._ [2016] Y.-H. Zhou, Z.-W. Yu, and X.-B. Wang, Making the decoy-state measurement-device-independent quantum key distribution practically useful, Phys. Rev. A 93, 042324 (2016).
  * Lucamarini  _et al._ [2018] M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate–distance limit of quantum key distribution without quantum repeaters, Nature 557, 400 (2018).
  * Ma  _et al._ [2018] X. Ma, P. Zeng, and H. Zhou, Phase-matching quantum key distribution, Phys. Rev. X 8, 031043 (2018).
  * Wang  _et al._ [2018] X.-B. Wang, Z.-W. Yu, and X.-L. Hu, Twin-field quantum key distribution with large misalignment error, Phy. Rev. A 98, 062323 (2018).
  * Liu  _et al._ [2021] W.-B. Liu, C.-L. Li, Y.-M. Xie, C.-X. Weng, J. Gu, X.-Y. Cao, Y.-S. Lu, B.-H. Li, H.-L. Yin, and Z.-B. Chen, Homodyne detection quadrature phase shift keying continuous-variable quantum key distribution with high excess noise tolerance, PRX Quantum 2, 040334 (2021).
  * Xie  _et al._ [2022] Y.-M. Xie, Y.-S. Lu, C.-X. Weng, X.-Y. Cao, Z.-Y. Jia, Y. Bao, Y. Wang, Y. Fu, H.-L. Yin, and Z.-B. Chen, Breaking the rate-loss bound of quantum key distribution with asynchronous two-photon interference, PRX Quantum 3, 020315 (2022).
  * Zeng  _et al._ [2022] P. Zeng, H. Zhou, W. Wu, and X. Ma, Mode-pairing quantum key distribution, Nat. Commun. 13, 3903 (2022).
  * Gu  _et al._ [2022] J. Gu, X.-Y. Cao, Y. Fu, Z.-W. He, Z.-J. Yin, H.-L. Yin, and Z.-B. Chen, Experimental measurement-device-independent type quantum key distribution with flawed and correlated sources, Sci. Bull. 67, 2167 (2022).
  * Fu  _et al._ [2015] Y. Fu, H.-L. Yin, T.-Y. Chen, and Z.-B. Chen, Long-distance measurement-device-independent multiparty quantum communication, Phys. Rev. Lett. 114, 090501 (2015).
  * Gu  _et al._ [2021] J. Gu, X.-Y. Cao, H.-L. Yin, and Z.-B. Chen, Differential phase shift quantum secret sharing using a twin field, Opt. Express 29, 9165 (2021).
  * Shen  _et al._ [2023] A. Shen, X.-Y. Cao, Y. Wang, Y. Fu, J. Gu, W.-B. Liu, C.-X. Weng, H.-L. Yin, and Z.-B. Chen, Experimental quantum secret sharing based on phase encoding of coherent states, Sci. China-Phys. Mech. Astron. 66, 260311 (2023).
  * Li  _et al._ [2021] Z. Li, X.-Y. Cao, C.-L. Li, C.-X. Weng, J. Gu, H.-L. Yin, and Z.-B. Chen, Finite-key analysis for quantum conference key agreement with asymmetric channels, Quantum Sci. Technol. 6, 045019 (2021).
  * Menezes  _et al._ [2018] A. J. Menezes, P. C. Van Oorschot, and S. A. Vanstone,  _Handbook of applied cryptography_ (CRC press, 2018).
  * Krawczyk [1994] H. Krawczyk, Lfsr-based hashing and authentication, in  _Annual International Cryptology Conference_ (1994) pp. 129–139.
  * Carter and Wegman [1977] J. L. Carter and M. N. Wegman, Universal classes of hash functions, in  _Proceedings of the ninth annual ACM symposium on Theory of computing_ (1977) pp. 106–112.
  * Wang [2005] X.-B. Wang, Beating the photon-number-splitting attack in practical quantum cryptography, Phys. Rev. Lett. 94, 230503 (2005).
  * Lo  _et al._ [2005] H.-K. Lo, X. Ma, and K. Chen, Decoy state quantum key distribution, Phys. Rev. Lett. 94, 230504 (2005).
  * Brassard and Salvail [1993] G. Brassard and L. Salvail, Secret-key reconciliation by public discussion, in  _Workshop on the Theory and Application of of Cryptographic Techniques_ (Springer, 1993) pp. 410–423.
  * Yan  _et al._ [2008] H. Yan, T. Ren, X. Peng, X. Lin, W. Jiang, T. Liu, and H. Guo, Information reconciliation protocol in quantum key distribution system, in  _2008 Fourth International Conference on Natural Computation_ , Vol. 3 (IEEE, 2008) pp. 637–641.
  * Shoup [1996] V. Shoup, On fast and provably secure message authentication based on universal hashing, in  _Annual International Cryptology Conference_ (Springer, 1996) pp. 313–328.
  * Konig  _et al._ [2009] R. Konig, R. Renner, and C. Schaffner, The operational meaning of min-and max-entropy, IEEE trans. Inform. Theory 55, 4337 (2009).
  * Hayashi [2011] M. Hayashi, Exponential decreasing rate of leaked information in universal random privacy amplification, IEEE trans. Inform. Theory 57, 3989 (2011).
  * Massey [1969] J. Massey, Shift-register synthesis and bch decoding, IEEE trans. Inform. Theory 15, 122 (1969).
  * Yin  _et al._ [2020] H.-L. Yin, M.-G. Zhou, J. Gu, Y.-M. Xie, Y.-S. Lu, and Z.-B. Chen, Tight security bounds for decoy-state quantum key distribution, Sci. Rep. 10, 14312 (2020).
  * Lim  _et al._ [2014] C. C. W. Lim, M. Curty, N. Walenta, F. Xu, and H. Zbinden, Concise security bounds for practical decoy-state quantum key distribution, Phys. Rev. A 89, 022307 (2014).
  * Jiang  _et al._ [2019] C. Jiang, Z.-W. Yu, X.-L. Hu, and X.-B. Wang, Unconditional security of sending or not sending twin-field quantum key distribution with finite pulses, Phys. Rev. Applied 12, 024061 (2019).
  * Tang  _et al._ [2019] B.-Y. Tang, B. Liu, Y.-P. Zhai, C.-Q. Wu, and W.-R. Yu, High-speed and large-scale privacy amplification scheme for quantum key distribution, Sci. Rep. 9, 15733 (2019).