Twin-field quantum key distribution with passive-decoy state

With the help of quantum key distribution (QKD), distant agents (Alice and Bob) are able to share secret keys with information-theoretic security which is guaranteed by quantum physics [1–3]. QKD has been developed rapidly both in theory and experiment over the decades [4–12]. However, a fundamental limit is that the secret key rate (SKR) is scaled by the transmittance η [13–15], which is finally revealed as the linear key rate bound: R ⩽ −log₂(1 − η) [14]. Fortunately, the TF-QKD protocol made a difference [16], in TF-QKD protocol, pairs of phase-randomized optical pulses are generated at Alice and Bob and then combined at a central measuring station Charlie, single-photon interference is produced at Charlie, this lets TF-QKD gain the square-root of the channel transmittance, which is the same as it with a quantum repeater. The reference [17] enhanced the security proof of that given in reference [16], it proposed a novel way to use decoy states by switching between decoy mode and code mode, by doing this, it confirmed the scaling properties of the original scheme and overcame the linear key bound at long distances.

Inspired by the original TF-QKD, many variants are proposed including phase-matching protocol [18], sending-or-not-sending protocol [19]. And reference [20–22] removed active phase randomization and phase postselection in code mode, this proved to reach a higher final key rate. Yet, the security proof of all these protocols are based on decoy-state method [23–25], the essential idea behind decoy-state method in TF-QKD is simple, the sender (Alice and Bob) varies the mean photon number of each pulse she transmits to the central station (Charlie), users can obtain a better estimation of the behavior of the quantum channel from the measurement results corresponding to different intensity settings, this helps to enhance the achievable SKR and communicating distance. In practical experiments, decoy-state method is usually performed by actively modulating a variable optical attenuator together with a random number generator [26]. However, these approaches may lead to side channel and can even break the security of the system [27], if the VOA, which changes the intensity of Alice's (Bob's) pulses, is not properly designed, it may happen that some physical parameters (for example frequency spectrum) of the pulses emitted by the sender depend on the particular setting selected, which could open a security loophole in the active schemes. Fortunately, passive-decoy protocol [28–30] is able to remove certain side channel caused by actively modulating intensity of the source. Specifically, in our proposed scheme, this kind of side channel can be removed provided that Alice and Bob have perfect local detectors and there is no Trojan horse attack. Even though perfect detectors are not available in practical experiments, the side channel may still be significantly reduced when high-detection-efficiency local detectors are equipped. The original passive-decoy protocol utilizes a parametric downconversion source in conjunction with a photon number resolving detector to substitute an idealized single-photon source, the passive-decoy state selection can be accomplished without the need for any active optical elements. Besides, the references [31, 32] implemented passive-decoy method by using weak coherent pulses (WCPs), in which Alice and Bob treat click and no click of the detectors separately and distill a secret key from both of them.

To enhance the source security of TF-QKD, in this paper we propose passive-decoy TF-QKD, in our scheme, different decoy states are generated passively according to the mode of photon detectors. Our passive scheme can eliminate the side channel generated by active modulation of source intensities, simultaneously, it provides a performance as good as the active decoy method when the setup with four-intensity settings is applied. In section 2, we introduce our scheme and the setups. In section 3, we give the method to calculate SKR with two-intensity decoy setups and four-intensity setups. The conclusion and a discussion are given in section 4.

The system of our passive-decoy TF-QKD scheme is given in figure 1(a). The setups on Alice have no difference from that on Bob, thus we take Alice as an example. Weak coherent pulse (WCP) is generated at Alice side, BS₁ splits the pulses into two paths (path r and path s), the transmittance of BS₁ is t₁. Path r and path s are the same in length so the pulses at these two paths will interfere in the passive-decoy setup (PDS). After interference, the outcome mode a₁ is sent to untrusted party Charlie. The PDS is the setup we designed to implement our passive-decoy scheme, it mainly consists of BSs and photon detectors, specifically, figures 1(b) and (c) are two PDSs with two-intensity settings and four-intensity settings. The specific steps of our passive-decoy TF-QKD scheme can be described as follows [20]:

Zoom In Zoom Out Reset image size

Step 1. Alice and Bob randomly choose code mode or decoy mode in each trial.

Step 2.a. When Alice (Bob) chooses code mode, the intensity modulator (IM) blocks the pulses on path s, here we choose Lithium Niobate-based Mach–Zehnder (LNMZ) intensity modulator for its advantages of low driving voltage, high bandwidth, adjustable chirp. The phase modular (PM₁) on path r modulates the signal phase according to the random classical key bit 0 or 1. By doing these, Alice (Bob) prepares a weak coherent state $\vert {\pm}\sqrt{\mu }{\rangle }_{\mathrm{A}}$ ($\vert {\pm}\sqrt{\mu }{\rangle }_{\mathrm{B}}$) mentioned in reference [20].

Step 2.b. When Alice (Bob) chooses decoy mode, PM₁ and PM₂ randomize the phase of the pulses on each path and leave the IM on path s unmodulated, the randomized phase will never be publicly announced. By doing these, mixed state in Fock space is generated on path r and path s, and the photon distribution of the mixed state is depending on the mode of photon detectors in PDS.

Step 3. For each trial, Charlie publicly announces which detector (L or R) clicks or is a no click event.

Step 4. After repeating steps 1 to 3 for sufficient times, Alice and Bob publicly announce which trials are code modes and which trials are decoy modes. For the trials in which Alice and Bob both select the code mode and Charlie announces a click event, the raw key bits are generated. For the trials in which Alice and Bob both select decoy mode, Alice and Bob can estimate the yield Y_nm, Y_nm is the probability of Charlie announcing click event provided Alice emits an n-photon state and Bob emits an m-photon state in a decoy mode.

In step 2, the IM we choose is LNMZ intensity modulator. Since the only purpose of the IM is blocking the pulses on path s in code mode with no information encoded, thus it will not lead to side channel attacks. On the other hand, LNMZ intensity modulator has high bandwidth (usually GHz), making it suitable for systems with high repetition rate like ours. Besides, the extinction ratio of LNMZ intensity modulator is usually more than 25 dB, which means the error rate caused by the IM could be neglected compared with the code rate of our system (see detailed derivation in appendix A).

In the scheme, the secret key rate per trial in a code mode is given as follow

$$\begin{equation}R={Q}_{\mu }\left[1-f h\left({\mathrm{e}\mathrm{r}}_{\mu },1-{\mathrm{e}\mathrm{r}}_{\mu }\right)-{I}_{\mathrm{A}\mathrm{E}}^{u}\right].\end{equation} \tag{ 1 }$$

Here h(x, y) = −x  log₂  x − y  log₂  y + (x + y)log₂(x + y), Q_μ is the counting rate in code mode, er_μ is the error rate of raw key bits, Q_μ and er_μ can be directly observed experimentally. ${I}_{\mathrm{A}\mathrm{E}}^{u}$ is the upper bound of the information leakage, and ${I}_{\mathrm{A}\mathrm{E}}^{u}$ can be solved by the following optimization problem

$$\begin{equation*}{I}_{\mathrm{A}\mathrm{E}}^{u}=\mathrm{max}\enspace h\left(\frac{{x}_{00}}{{Q}_{\mu }},\frac{{x}_{10}}{{Q}_{\mu }}\right)+h\left(\frac{{x}_{11}}{{Q}_{\mu }},\frac{{x}_{01}}{{Q}_{\mu }}\right),\end{equation*}$$

$$\begin{equation}\begin{cases}0{\leqslant}{x}_{00}{\leqslant}{\left\vert \sum _{n,m=0}\sqrt{{P}_{2n}{P}_{2m}{Y}_{2n,2m}}\right\vert }^{2},\quad \hfill \\ 0{\leqslant}{x}_{10}{\leqslant}{\left\vert \sum _{n,m=0}\sqrt{{P}_{2n+1}{P}_{2m}{Y}_{2n+1,2m}}\right\vert }^{2},\quad \hfill \\ 0{\leqslant}{x}_{11}{\leqslant}{\left\vert \sum _{n,m=0}\sqrt{{P}_{2n+1}{P}_{2m+1}{Y}_{2n+1,2m+1}}\right\vert }^{2},\quad \hfill \\ 0{\leqslant}{x}_{01}{\leqslant}{\left\vert \sum _{n,m=0}\sqrt{{P}_{2n}{P}_{2m+1}{Y}_{2n,2m+1}}\right\vert }^{2},\quad \hfill \\ {x}_{00}+{x}_{10}+{x}_{11}+{x}_{01}={Q}_{\mu },\quad \hfill \end{cases}\end{equation} \tag{ 2 }$$

in which P_k = e^−μμ^k/k! is Poissonian distribution. P_n (P_m) is determined by the input parameter μ, which is chosen by the parties prior to initiating the experiment.

To get the secret key rate R in code mode, we need to know the information leakage ${I}_{\mathrm{A}\mathrm{E}}^{u}$ in equation (2). For that P_n, P_m and Q_μ in equation (2) can be observed in practical experiments, thus it is necessary to estimate Y_n,m. In our scheme, Y_n,m can be bounded with the passive-decoy state method. The gain of the decoy states satisfies

$$\begin{equation}{Q}_{\mathrm{d}}=\sum _{n,m}{\mathrm{P}\mathrm{r}}_{\mathrm{a}}\left(n\right){\mathrm{P}\mathrm{r}}_{\mathrm{b}}\left(m\right){Y}_{n,m}.\end{equation} \tag{ 3 }$$

Here Q_d is the counting rate in decoy mode, Pr_a(n) (Pr_b(m)) is the n-photon (m-photon) distribution of the state on Alice (Bob) in decoy mode, which depends on the mode of photon detectors on PSD in our passive-decoy scheme. In ideal case with infinite decoy states, we can list infinite linear equations like equation (3) to calculate Y_n,m accurately. On the other hand, finite decoy states can also help to estimate the lower bound for yields and it is more feasible in practical system.

In our scheme, when the two-intensity setup is implemented in PDS as shown in figure 1(b), pulses on path r and path s will interfere at BS₂ with two outcomes a₁ and a₂, a₁ is sent to Charlie and a₂ is detected by D₁. Denote the detect efficiency of D₁ is η, the darkcount rate is η_d, we can get

$$\begin{equation}\begin{cases}_{\mathrm{u}}\left(n\right)={\left(1-\eta \right)}^{n}\left(1-{\eta }_{\mathrm{d}}\right),\quad \hfill \\ {P}_{\mathrm{c}}\left(n\right)=1-{P}_{\mathrm{u}}\left(n\right),\quad \hfill \end{cases}\end{equation} \tag{ 4 }$$

in which P_c(n) and P_u(n) are probabilities that detector click or not when n photons come. With these two probabilities, we have two different conditional photon number distributions according to the mode of D₁ (see the details in the appendix B)

$$\begin{equation}P{r}^{1}\left(k\right)=\frac{\sum _{q=0}^{\infty }P\left(q,k\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(q\right)}{\sum _{q,k=0}^{\infty }P\left(q,k\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(q\right)},\end{equation} \tag{ 5 }$$

and

$$\begin{equation}P{r}^{0}\left(k\right)=\frac{\sum _{q=0}^{\infty }P\left(q,k\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(q\right)}{\sum _{q,k=0}^{\infty }P\left(q,k\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(q\right)}.\end{equation} \tag{ 6 }$$

Here Pr¹(k) is the probability of finding k photons in a₁ when D₁ produces a click, Pr⁰(k) is the probability of that when D₁ does not click, P(q, k|μ₁, μ₂) is the conditional probability of finding k photons in a₁ and q photons in a₂ when the mean photon numbers of pulses in path s and path r are μ₁ and μ₂, P(q, k|μ₁, μ₂) is derived in appendix. Then substituting Pr¹(k) and Pr⁰(k) into equation (3), we can have:

$$\begin{equation}\begin{cases}_{\mathrm{d}}^{0,0}=\sum _{n,m}{\mathrm{P}\mathrm{r}}_{\mathrm{a}}^{0}\left(n\right){\mathrm{P}\mathrm{r}}_{\mathrm{b}}^{0}\left(m\right){Y}_{n,m},\quad \hfill \\ {Q}_{\mathrm{d}}^{0,1}=\sum _{n,m}{\mathrm{P}\mathrm{r}}_{\mathrm{a}}^{0}\left(n\right){\mathrm{P}\mathrm{r}}_{\mathrm{b}}^{1}\left(m\right){Y}_{n,m},\quad \hfill \\ {Q}_{\mathrm{d}}^{1,0}=\sum _{n,m}{\mathrm{P}\mathrm{r}}_{\mathrm{a}}^{1}\left(n\right){\mathrm{P}\mathrm{r}}_{\mathrm{b}}^{0}\left(m\right){Y}_{n,m},\quad \hfill \\ {Q}_{\mathrm{d}}^{1,1}=\sum _{n,m}{\mathrm{P}\mathrm{r}}_{a}^{1}\left(n\right){\mathrm{P}\mathrm{r}}_{b}^{1}\left(m\right){Y}_{n,m},\quad \hfill \end{cases}\end{equation} \tag{ 7 }$$

in which ${Q}_{\mathrm{d}}^{0,0}$, ${Q}_{\mathrm{d}}^{0,1}$, ${Q}_{\mathrm{d}}^{1,0}$ and ${Q}_{\mathrm{d}}^{1,1}$ are counting rates on different detector modes in decoy mode. For example, in equation (7) ${Q}_{\mathrm{d}}^{0,1}$ is the counting rate when the detector on Alice does not click and the detector on Bob produces a click, ${\mathrm{Pr}}_{\mathrm{a}}^{0}\left(n\right)$ and ${\mathrm{Pr}}_{\mathrm{b}}^{0}\left(n\right)$ are defined as same as Pr⁰(n) while the subscripts a and b denote the distributions on Alice's and Bob's sides respectively.

In practice, after observing ${Q}_{\mathrm{d}}^{0,0}$, ${Q}_{\mathrm{d}}^{0,1}$, ${Q}_{\mathrm{d}}^{1,0}$ and ${Q}_{\mathrm{d}}^{1,1}$, we can give approximations to Y_0,0, Y_0,1, Y_1,0, Y_2,0, Y_0,2 and Y₂ by linear programming using equation (7), where Y₂ denotes the yields that are from decoy trials in which Alice and Bob share two photons in total, which means n + m = 2. Then following the same technique in section 5 of reference [20], we substitute these yields into equation (2) to bound the information leakage ${I}_{\mathrm{A}\mathrm{E}}^{u}$ and calculate the final key rate R in equation (1).

After presenting the scheme of generating two-intensity decoy state passively, we decide to go further, thus we add BS₃ and two photon detectors at the end, as shown in figure 1(c). There are four different modes with two photon detectors in the setup, thus we can get four different conditional photon distributions according to the modes of detector D₁ and D₂, which means four-intensity decoy states (see the details in the appendix B)

$$\begin{equation}P{r}^{00}\left(k\right)=\frac{\sum _{j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(j\right){P}_{\mathrm{u}}\left(l\right)}{\sum _{k,j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(j\right){P}_{\mathrm{u}}\left(l\right)},\end{equation} \tag{ 8 }$$

$$\begin{equation}P{r}^{10}\left(k\right)=\frac{\sum _{j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(j\right){P}_{\mathrm{u}}\left(l\right)}{\sum _{k,j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(j\right){P}_{\mathrm{u}}\left(l\right)},\end{equation} \tag{ 9 }$$

$$\begin{equation}P{r}^{01}\left(k\right)=\frac{\sum _{j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(j\right){P}_{\mathrm{c}}\left(l\right)}{\sum _{k,j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(j\right){P}_{\mathrm{c}}\left(l\right)},\end{equation} \tag{ 10 }$$

$$\begin{equation}P{r}^{11}\left(k\right)=\frac{\sum _{j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(j\right){P}_{\mathrm{c}}\left(l\right)}{\sum _{k,j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(j\right){P}_{\mathrm{c}}\left(l\right)},\end{equation} \tag{ 11 }$$

in which Pr⁰⁰(k), Pr¹⁰(k), Pr⁰¹(k) and Pr¹¹(k) are the photon distributions in a₁ given that D₁ and D₂ are in different modes. For example, Pr¹⁰(k) is the probability of finding k photons in a₁ when D₁ produces a click and D₂ does not. Note that when the transmittance of BS₃ is t₃ = 0.5, we will get Pr¹⁰(k) = Pr⁰¹(k), which means Pr¹⁰(k) and Pr⁰¹(k) are not independent. To get more useful constraints in linear program, we let 0.5 < t₃ < 1. For readability we write Pr⁰⁰, Pr¹⁰, Pr⁰¹, Pr¹¹ as Pr¹, Pr², Pr³, Pr⁴, and define the following gains: ${Q}_{\mathrm{d}}^{4,4}$, ${Q}_{\mathrm{d}}^{1,4}$, ${Q}_{\mathrm{d}}^{2,4}$, ${Q}_{\mathrm{d}}^{3,4}$, ${Q}_{\mathrm{d}}^{4,1}$, ${Q}_{\mathrm{d}}^{4,2}$, ${Q}_{\mathrm{d}}^{4,3}$, ${Q}_{\mathrm{d}}^{1,1}$, ${Q}_{\mathrm{d}}^{2,2}$ and ${Q}_{\mathrm{d}}^{3,3}$. For example, ${Q}_{\mathrm{d}}^{1,4}$ is the counting rate when both D₁ and D₂ on Alice do not click and the both D₁ and D₂ on Bob produce click, then like what we do in two-intensity cases, after observing these gains, we can give approximations to Y_0,0, Y_0,1, Y_1,0, Y_2,0, Y_0,2 and Y₂ by linear programming, and we can get the final key rate R using equations (1) and (2). This's the passive scheme of generating four-intensity decoy state with two BS and two photon detectors.

Comparing figure 1(b) with figure 1(c), we can know that Alice could increase the mode of the detectors by adding a BS at the end to get more constrains in linear programing and improve key rates. Following this idea, we can actually generalize our setup to infinite passive-decoy case. we denote the joint photon number distribution of the passive setup with n (n = 1, 2, 3, ...) intensity settings is pⁿ, we can get a recursive formula

$$\begin{equation}{p}^{n}={p}^{n-1}p\left(n,m\vert {\mu }_{1},{\mu }_{2}\right).\end{equation} \tag{ 12 }$$

From equation (12), we can get the conditional probabilities of photon number distribution in a₁ on each mode of the detectors, one may refer to the appendix for detailed derivations.

Now we carry out a numerical simulation to evaluate the performance of our two-intensity and four-intensity protocols. We focus on the symmetric case, which means that Charlie is at the middle of Alice and Bob and all other device parameters on Alice's side and Bob's side are identical. The simulation model can be found in the appendix of reference [20], the parameters in our simulation are listed in table 1.

Our results are shown in figure 2. It shows that, in two-decoy settings, there is a gap between active decoy scheme and passive-decoy scheme, while in four-decoy settings, our passive-decoy scheme performs as good as the active one and even slightly better at a long distance. This shows that our passive-decoy state method can perform as good as the active one. Furthermore, our method can eliminate side channels on sources which may be caused by active modulation. Thus our scheme is very promising for applications of practical systems.

Zoom In Zoom Out Reset image size

Besides, we also add a simulation of the passive setup with eight decoys, and compare it with the infinite decoy states.The result shows that the secret key rate of passive setup with the eight decoys surpasses that of the four decoys at a long range of distance. More importantly, the gap between the passive setup with the eight decoys and the infinite decoy states is narrow, which shows our protocol can present satisfactory performance with just a few detectors.

We have proposed the scheme of passive-decoy state TF-QKD, in which different decoy states are generated passively according to the modes of photon detectors. In this way, our scheme can eliminate side channel on source caused by actively modulating of the source intensity. Moreover we presented a simulation comparing the key generation rate with that in active-decoy, it shows our result can performs as good as that in active decoy TF-QKD, and our scheme could reach satisfactory secret key rates with just a few photon detectors. Thus our work provides a useful approach to improve the performance of TF-QKD in practical implementation.

Nevertheless, although our scheme can remove certain side channel caused by actively modulating intensity of the source, we can not remove all side channels, there are still further work to do. For example, the scheme is still threatened by Trojan horse attack although it is not easy in practice, and an imperfect real-life source may emit imperfect states with varied frequency spectra, which will also lead to side channel. Fortunately, imperfect states preparation may be remedied by reference [33], which proposed that an imperfect source S and a perfect source P are identical in side-channel space if there exists a quantum process that can map the S to P. Besides, the intensities of the photon pulses could be unstable. To solve this issue, references [34, 35] have discussed these issues. Reference [34] bounded the fraction of single-photon counts in the decoy-state QKD, while reference [35] proposed a theory that decoy-state QKD with an unstable source can work as if the source were stable provided the condition: $\underset{j}{\mathrm{max}}\left(\frac{{p}_{j}{a}_{kj}}{{p}_{j}^{\prime }{a}_{kj}^{\prime }}\right){\leqslant}\underset{j}{\mathrm{max}}\left(\frac{{p}_{j}{a}_{2j}}{{p}_{j}^{\prime }{a}_{2j}^{\prime }}\right){< }\underset{j}{\mathrm{max}}\left(\frac{{p}_{j}{a}_{1j}}{{p}_{j}^{\prime }{a}_{1j}^{\prime }}\right)$, for all k ⩾ 2 hold. In our scheme, this condition still holds by optimizing the transmittance of BS(s), therefore, our scheme can work under unstable source in principle. Moreover, there are still side channels in our scheme due to bases switching, i.e., different values in phase modulation in the code mode. It would be interesting to study this issue in the future.

This work has been supported by the National Key Research and Development Program of China (Grant No. 2016YFA0302600), the National Natural Science Foundation of China (Grant Nos. 61822115, 61961136004, 61775207, 61702469, 61771439, 61627820, 61675189), National Cryptography Development Fund (Grant No. MMJJ20170120) and Anhui Initiative in Quantum Information Technologies.

We take Alice as an example, for simplicity, we let the extinction ratio of the IM be 20 dB, the intensity of the weak coherent pulses from laser be μ, the transmittance of BS₁ is t₁, thus we have

$$\begin{equation}\begin{cases}_{\mathrm{s}}=\left(1-{t}_{1}\right)\mu ,\quad \hfill \\ {\mu }_{\mathrm{r}}={t}_{1}\mu ,\quad \hfill \end{cases}\end{equation} \tag{ A1 }$$

in which μ_s, μ_r are the intensity of the pulses at the two outputs of BS₁, then pulses on path s will be blocked by the IM, the intensity of the output pulses is μ_s' = μ_s/100, thus we can get the probability

$$\begin{equation}\begin{cases}P\left({\mu }_{\mathrm{s}}^{\prime },n=0\right)={\text{e}}^{-{\mu }_{\mathrm{s}}^{\prime }},\quad \hfill \\ P\left({\mu }_{\mathrm{s}}^{\prime },n\ne 0\right)=1-{\text{e}}^{-{\mu }_{\mathrm{s}}^{\prime }}.\quad \hfill \end{cases}\end{equation} \tag{ A2 }$$

Where P(n = 0, μ_s') is the probability of finding no photons from the output of path s after blocking of the IM, $P\left(n\ne 0,{\mu }_{\mathrm{s}}^{\prime }\right)=1-{\text{e}}^{-{\mu }_{\mathrm{s}}^{\prime }}$ is the probability of finding at least one photon from the output of path s.

For simplicity, we take the error rate er = 0.5 on a₁ as long as there are photons come from path s, thus we have the total error rate

$$\begin{equation}{\mathrm{e}\mathrm{r}}_{\text{total}}=0.5P\left({\mu }_{\mathrm{s}}^{\prime },n\ne 0\right)=0.5\left(1-{\text{e}}^{-{\mu }_{\mathrm{s}}^{\prime }}\right).\end{equation} \tag{ A3 }$$

Since μ_s' = μ_s/100, thus er_total is a small value, we take μ_s = 0.1 for example, we get er_total = 0.00005, it is a small value that it will not affect the performance of our system.

Here we focus on the PDS in the whole passive-decoy TF-QKD system, as shown in figure 3. Let us first consider the interference with two pure coherent states $\vert n\rangle ={{a}^{{\dagger}}}^{n}\vert 0\rangle$ and $\vert m\rangle ={{b}^{{\dagger}}}^{m}\vert 0\rangle$, where a^† and b^† are creation operators, n and m are photon numbers. For a^† and b^† at a BS:

$$\begin{equation}\begin{cases}^{{\dagger}}=\sqrt{t}{c}^{{\dagger}}+\sqrt{1-t}{d}^{{\dagger}},\quad \hfill \\ {b}^{{\dagger}}=\sqrt{1-t}{c}^{{\dagger}}-\sqrt{t}{d}^{{\dagger}},\quad \hfill \end{cases}\end{equation} \tag{ B1 }$$

Zoom In Zoom Out Reset image size

Here t is the transmittance of the BS₂, c^† and d^† are creation operators of the quantum state of output a₁ and a₂. Denote ${U}_{{\mathrm{B}\mathrm{S}}_{2}}$ is the unitary operator of BS₂, thus we have

$$\begin{equation}\begin{aligned}\hfill & {U}_{{\mathrm{B}\mathrm{S}}_{2}}\vert \mathrm{n}\mathrm{m}\rangle ={\left(\sqrt{t}{c}^{{\dagger}}+\sqrt{1-t}{d}^{{\dagger}}\right)}^{n}{\left(\sqrt{1-t}{c}^{{\dagger}}-\sqrt{t}{d}^{{\dagger}}\right)}^{m}\vert 00\rangle .\hfill \end{aligned}\end{equation} \tag{ B2 }$$

from equation (2) we can get the probability of finding k photons at mode a₁, it is a problem of statistics.

$$\begin{equation*}\begin{aligned}\hfill & P\left(k\vert n,m\right)=\sum _{\mathrm{max}\left(0,k-m\right)}^{\mathrm{min}\left(k,n\right)}{C}_{n}^{i}{C}_{m}^{\left(k-i\right)}\frac{\sqrt{{t}^{n}{\left(1-t\right)}^{m}}}{\sqrt{m!n!}}\sqrt{k!\left(n+m-x\right)!}.\hfill \end{aligned}\end{equation*}$$

Here P(k|n, m) is the probability of finding k photons on a₁ given the coherent states on path s and path r containing n and m photons respectively. With P(k|n, m) we can then get the joint probability P(k, n, m|μ₁, μ₂)

$$\begin{equation}P\left(k,n,m\vert {\mu }_{1},{\mu }_{2}\right)=P\left({\mu }_{1},n\right)P\left({\mu }_{2},m\right)P\left(k\vert n,m\right),\end{equation} \tag{ B3 }$$

where P(k, n, m|μ₁, μ₂) means the pulses in path r, s are phase-randomized weak coherent states with mean photon number μ₁ and μ₂, P(μ, n) = e^−μμⁿ/n! is Poissonian distribution. Summing up n and m and we can get

$$\begin{equation}P\left(k\vert {\mu }_{1},{\mu }_{2}\right)=\sum _{n,m=0}P\left({\mu }_{1},n\right)P\left({\mu }_{2},m\right)P\left(k\vert n,m\right),\end{equation} \tag{ B4 }$$

where P(k|μ₁, μ₂) is the photon distribution on mode a₁ given two phase-randomized weak coherent states interfere at BS₂. In figure 3, the photon distribution on mode a₂ is the same as mode a₁.

$$\begin{equation}P\left(q\vert {\mu }_{1},{\mu }_{2}\right)=\sum _{n,m=0}P\left({\mu }_{1},n\right)P\left({\mu }_{2},m\right)P\left(q\vert n,m\right),\end{equation} \tag{ B5 }$$

thus we can get P(k, q|μ₁, μ₂)

$$\begin{equation}P\left(k,q\vert {\mu }_{1},{\mu }_{2}\right)=P\left(k\vert {\mu }_{1},{\mu }_{2}\right)P\left(q\vert {\mu }_{1},{\mu }_{2}\right).\end{equation} \tag{ B6 }$$

Here P(k, q|μ₁, μ₂) is the joint probability of finding k photons on mode a₁ and q photons on mode a₂. Denote η is detect efficiency, η_d is darkcount rate of photon detector D₁, we have

$$\begin{equation*}\begin{cases}_{\mathrm{u}}\left(n\right)={\left(1-\eta \right)}^{n}\left(1-{\eta }_{\mathrm{d}}\right),\quad \hfill \\ {P}_{\mathrm{c}}\left(n\right)=1-{P}_{\mathrm{u}}\left(n\right),\quad \hfill \end{cases}\end{equation*}$$

in which P_c(n) and P_u(n) are probabilities that the detector D₁ produces a click and no click when n photons come, thus there are two modes of the detector D₁ according to its click event and no click event. consequently, there are two different conditional photon distribution on a₁ according to the mode of D₁

$$\begin{equation}P{r}^{1}\left(k\right)=\frac{\sum _{q=0}^{\infty }P\left(q,k\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(q\right)}{\sum _{q,k=0}^{\infty }P\left(q,k\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(q\right)},\end{equation} \tag{ B7 }$$

$$\begin{equation}P{r}^{0}\left(k\right)=\frac{\sum _{q=0}^{\infty }P\left(q,k\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(q\right)}{\sum _{q,k=0}^{\infty }P\left(q,k\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(q\right)},\end{equation} \tag{ B8 }$$

where the subscripts '1' and '0' of Pr¹(k) and Pr⁰(k) means the detector clicks or not when pulses come.

The derivation above clarifies our passive setup with two-intensity settings, and we also investigate the four-intensity settings, the approach is to add a BS₃ at the end and two detectors for the outcome signals as shown in figure 4. Thus there are four different conditional photon distributions on a₁, Pr⁰⁰(y), Pr⁰¹(y), Pr¹⁰(y), Pr¹¹(y), according to the mode of the two detectors, We have get the probability of finding q photons on a₂ in equation (5), denote the transmittance of BS₃ is t₃, we can get the probability of finding j, l photons at the two output of BS₃ with q photons be splitted at BS₃

$$\begin{equation}P\left(j,l\vert q\right)={C}_{q}^{j}{t}_{3}^{l}{\left(1-{t}_{3}\right)}^{l},\end{equation} \tag{ B9 }$$

thus we can get

$$\begin{equation}P\left(j,l\vert {\mu }_{1},{\mu }_{2}\right)=\sum _{q=0}P\left(j,l\vert q\right)P\left(q\vert {\mu }_{1},{\mu }_{2}\right).\end{equation} \tag{ B10 }$$

Here P(j, l|μ₁, μ₂) is the probability of finding j photons on D₁ and l photons on D₂, when there are two weak coherent states with the mean photon number of μ₁ and μ₂ on path s and path r. Then we have the joint probability

$$\begin{equation}P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right)=P\left(j,l\vert {\mu }_{1},{\mu }_{2}\right)P\left(k\vert {\mu }_{1},{\mu }_{2}\right).\end{equation} \tag{ B11 }$$

Here P(k, j, l|μ₁, μ₂) is the joint probability of finding k on a₁, j photons on D₁ and l photons on D₂, then we can get the conditional probabilities of photon number distribution on a₁ according to the mode of the detectors D₁ and D₂

$$\begin{equation}P{r}^{00}\left(k\right)=\frac{\sum _{j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(j\right){P}_{\mathrm{u}}\left(l\right)}{\sum _{k,j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(j\right){P}_{\mathrm{u}}\left(l\right)},\end{equation} \tag{ B12 }$$

$$\begin{equation}P{r}^{10}\left(k\right)=\frac{\sum _{j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(j\right){P}_{\mathrm{u}}\left(l\right)}{\sum _{k,j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left({d}_{1}\right){P}_{\mathrm{u}}\left(l\right)},\end{equation} \tag{ B13 }$$

$$\begin{equation}P{r}^{01}\left(k\right)=\frac{\sum _{j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(j\right){P}_{\mathrm{c}}\left(l\right)}{\sum _{k,j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{u}}\left(j\right){P}_{\mathrm{c}}\left(l\right)},\end{equation} \tag{ B14 }$$

$$\begin{equation}P{r}^{11}\left(k\right)=\frac{\sum _{j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left(j\right){P}_{\mathrm{c}}\left(l\right)}{\sum _{k,j,l=0}^{\infty }P\left(k,j,l\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left({d}_{1}\right){P}_{\mathrm{c}}\left(l\right)}.\end{equation} \tag{ B15 }$$

Zoom In Zoom Out Reset image size

The derivation above clarifies our passive-decoy setup with four-intensity settings, the main idea is adding a BS at the end of the setup with two-intensity settings and two detectors detecting the output pulses. Thus the modes of detectors have increased from two to four, which means we increased the number of passive decoy intensities from two to four.

Following this idea, we can generalize the setup to infinite passive-decoy case. First, we denote the joint probability of the passive-decoy setup with n − 1 (n = 1,2,3, ...) intensity settings is $P\left(k,{d}_{1},{d}_{2}\dots {d}_{n-1}\vert {\mu }_{1},{\mu }_{2}\right) \left.\right)$, which means we add n − 1 photon detectors at the end and the joint probability of finding k photons on mode a₁ and finding d_n photons on the corresponding photon detector D_n is P(k, d₁, d₂, ..., d_n−1|μ₁, μ₂). Then if we add another BS at the end and two photon detectors at the output mode, the setup becomes a setup with n intensity settings, this means in the setup with n − 1 settings, the pulse on the D_n−1 is splitted by the added BS and detected by the add photons detectors, denote the transmittance of this BS is t, we can get

$$\begin{equation}P\left(n,m\vert {d}_{n-1}\right)={C}_{q}^{n}{t}^{m}{\left(1-t\right)}^{m},\end{equation} \tag{ B16 }$$

this is the same as given in equation (9), and in P(k, d₁, d₂, ..., d_n−1|μ₁, μ₂), we have

$$\begin{equation}P\left({d}_{n-1}\vert {\mu }_{1},{\mu }_{2}\right)=\sum _{k,{d}_{1},{d}_{2}\dots {d}_{n-2}=0}P\left(k,{d}_{1},{d}_{2}\dots {d}_{n-1}\vert {\mu }_{1},{\mu }_{2}\right).\end{equation} \tag{ B17 }$$

Here P(d_n−1|μ₁, μ₂) is the probability of finding d_n−1 photons on detector D_n−1 in the setup with n − 1 intensity settings. Thus we can get

$$\begin{equation}P\left(n,m\vert {\mu }_{1},{\mu }_{2}\right)=\sum _{{d}_{n-1}=0}P\left(n,m\vert {d}_{n-1}\right)P\left({d}_{n-1}\vert {\mu }_{1},{\mu }_{2}\right).\end{equation} \tag{ B18 }$$

Here P(n, m|μ₁, μ₂) is the probability of finding n and m photons on the two output mode given two phase randomized weak coherent states on path s and path r, and the mean photon number of these two phase randomized WCP is μ₁ and μ₂

With the probability on equation (18), we can get the joint probability of the passive setup with n (n = 1,2,3, ...) intensity settings

$$\begin{equation}P\left(k,{d}_{1}\dots {d}_{n-2},n,m\vert {\mu }_{1},{\mu }_{2}\right)=P\left(k,{d}_{1}\dots {d}_{n-1}\vert {\mu }_{1},{\mu }_{2}\right)P\left(n,m\vert {\mu }_{1},{\mu }_{2}\right).\end{equation} \tag{ B19 }$$

For readability, we substitute n, m with d_n−1 and d_n, thus $P\left(k,{d}_{1}\dots {d}_{n-2},{d}_{n-1},{d}_{n}\vert {\mu }_{1},{\mu }_{2}\right) \left.\right)=P\left(k,{d}_{1}\dots {d}_{n-2},n,m\vert {\mu }_{1},{\mu }_{2}\right)$. And we denote Pⁿ = P(k, d₁, ..., d_n−2, d_n−1, d_n|μ₁, μ₂) is the joint probability on passive setup with n intensity settings, Pⁿ⁻¹ = P(k, d₁, ..., d_n−1, n, m|μ₁, μ₂) is the joint probability on passive setup with n − 1 intensity settings, thus we have

$$\begin{equation}{P}^{n}={P}^{n-1}P\left(n,m\vert {\mu }_{1},{\mu }_{2}\right).\end{equation} \tag{ B20 }$$

Equation (20) is a recursive formula. In the setup with n intensity settings, there are n photon detectors, thus there are $\mathrm{M}=\sum _{m=0}^{n}{C}_{n}^{m}$ modes according to whether the detectors click or not, which means there are $\mathrm{M}=\sum _{m=0}^{n}{C}_{n}^{m}$ conditional probabilities of photon number distribution on a₁ on each mode of detectors. We take Pr_100...000(k) in equation (21) for example

$$\begin{equation}{\mathrm{P}\mathrm{r}}_{100\dots 000}\left(k\right)=\frac{\sum _{{d}_{1},{d}_{2}\dots {d}_{n}=0}^{\infty }P\left(k,{d}_{1},\dots ,{d}_{n}\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left({d}_{1}\right){P}_{u}\left({d}_{2},\dots ,{d}_{n}\right)}{\sum _{k,{d}_{1},{d}_{2},\dots ,{d}_{n}=0}^{\infty }P\left(k,{d}_{1},\dots ,{d}_{n}\vert {\mu }_{1},{\mu }_{2}\right){P}_{\mathrm{c}}\left({d}_{1}\right){P}_{\mathrm{u}}\left({d}_{2},..,{d}_{n}\right)}.\end{equation} \tag{ B21 }$$

Pr_100...000(k) is the conditional probability of photon number distribution on a₁ in the mode that only the detector D₁ clicks and the rest do not among the n detectors added. For other modes of the detectors, the conditional probability of photon number distribution is similar to equation (21).