Differential phase encoded measurement-device-independent quantum key distribution

Abstract

We present a measurement-device-independent quantum key distribution (MDI-QKD) using single photons in a linear superposition of three orthogonal time-bin states, for generating the key. The orthogonal states correspond to three distinct paths in the delay line interferometers used by two (trusted) sources. The key information is decoded based on the measurement outcomes obtained by an untrusted third party Charles, who uses a beamsplitter to measure the phase difference between pulses traveling through different paths of the two delay lines. The proposed scheme combines the best of both differential-phase-shift (DPS) QKD and MDI-QKD. It is more robust against phase fluctuations, and also ensures protection against detector side-channel attacks. We prove unconditional security by demonstrating an equivalent protocol involving shared entanglement between the two trusted parties. We show that the secure key rate for our protocol compares well to existing protocols in the asymptotic regime. For the decoy-state variant of our protocol, we evaluate the secure key rate by using a phase-post-selection technique. Finally, we estimate the bit error rate and the phase error rate, in the finite key regime.

Appendices

Analysis of DPS-MDI-QKD protocol

Fig. 8

a and b are input ports, and c and d are the output ports of the beamsplitter

We start with the form of the input to Charles’ beamsplitter given in Eq. (3):

$$\begin{aligned} |\psi \rangle _{\text {in}}= & {} \frac{1}{3}\left[ \; |100,100\rangle _{ab} + e^{i\phi _{{a}_{1}}}|010,100\rangle _{ab}\right. \\&+e^{i\phi _{{a}_{2}}}|001,100\rangle _{ab}+ e^{i\phi _{{b}_{1}}} |100,010\rangle _{ab} \\&+ e^{i\phi _{{b}_{2}}}|100,001\rangle _{ab}+ e^{i(\phi _{{a}_{1}}+\phi _{{b}_{1}})}|010,010\rangle _{ab} + e^{i(\phi _{{a}_{1}}+\phi _{{b}_{2}})} |010,001\rangle _{ab} \\&\left. + e^{i(\phi _{{a}_{2}}+\phi _{{b}_{1}})} |001,010\rangle _{ab}+ e^{i(\phi _{{a}_{2}}+\phi _{{b}_{2}})} |001,001\rangle _{ab} \;\right] . \end{aligned}$$

We leave out the states that correspond to photons traversing identical paths in Alice’s and Bob’s set-up, since they do not contribute to the sifted key, and consider the (normalized) state,

$$\begin{aligned} |\psi \rangle _{\text {in}}= & {} \frac{1}{\sqrt{6}}\left[ \; e^{i\phi _{{a}_{1}}}|010,100\rangle _{ab}+ e^{i\phi _{{a}_{2}}}|001,100\rangle _{ab}\right. \nonumber \\&+ e^{i\phi _{{b}_{1}}} |100,010\rangle _{ab} + e^{i\phi _{{b}_{2}}}|100,001\rangle _{ab} \nonumber \\&\left. + e^{i(\phi _{{a}_{1}}+\phi _{{b}_{2}})} |010,001\rangle _{ab}+ e^{i(\phi _{{a}_{2}}+\phi _{{b}_{1}})} |001,010\rangle _{ab} \;\right] . \end{aligned}$$

(24)

Writing $\phi _{a_{1}}-\phi _{b_{1}}=\varDelta \phi _{1}$ and $\phi _{a_{2}}-\phi _{b_{2}}=\varDelta \phi _{2}$ as the phase differences between corresponding pulses from Alice and Bob, the input to Charles’ beamsplitter is written as,

$$\begin{aligned} |\tilde{\psi }\rangle _{\text {in}}= & {} \frac{1}{\sqrt{6}} e^{i(\phi _{{b}_{1}}+\phi _{{b}_{2}} )} \left[ \, e^{i\varDelta \phi _{1}} |010,001\rangle _{ab}\right. \nonumber \\&+ e^{i\varDelta \phi _{2}}|001,010\rangle _{ab}+ e^{-i\phi _{{b}_{1}}} \Big ( |100,001\rangle \nonumber \\&\left. + e^{i\varDelta \phi _{2}} |001,100\rangle \Big ) + e^{-i\phi _{{b}_{2}}} \Big ( \, |100,010\rangle + e^{i\varDelta \phi _{1}}|010,100\rangle _{ab} \Big ) \, \right] . \end{aligned}$$

(25)

Figure 8 shows a typical 50 : 50 beamsplitter. The action of the beamsplitter with input ports a, b and output ports c, d, when there is a photon incident on only one of the two ports is given by,

$$\begin{aligned} |1,0\rangle _{ab}\longrightarrow & {} \frac{1}{\sqrt{2}}\left( |1,0\rangle _{cd} + |0,1\rangle _{cd} \right) , \nonumber \\ |0,1\rangle _{ab}\longrightarrow & {} \frac{1}{\sqrt{2}}\left( |1,0\rangle _{cd} - |0,1\rangle _{cd} \right) . \end{aligned}$$

(26)

Using Eq. 26, we find that the beamsplitter transforms the terms present in the joint input state of Alice and Bob (Eq. 25) as shown below:

$$\begin{aligned} |010,001\rangle _{ab}\longrightarrow & {} \frac{1}{2}\Big (|011,000\rangle _{cd}-|010,001\rangle _{cd}+|001,010\rangle _{cd}-|000,011\rangle _{cd}\Big ) , \nonumber \\ |001,010\rangle _{ab}\longrightarrow & {} \frac{1}{2} \Big (|011,000\rangle _{cd}+|010,001\rangle _{cd} -|001,010\rangle _{cd}-|000,011\rangle _{cd}\Big ) , \nonumber \\ |100,001\rangle _{ab}\longrightarrow & {} \frac{1}{2} \Big (|101,000\rangle _{cd}-|100,001\rangle _{cd}+|001,100\rangle _{cd}-|000,101\rangle _{cd}\Big ) , \nonumber \\ |001,100\rangle _{ab}\longrightarrow & {} \frac{1}{2} \Big (|101,000\rangle _{cd}+|100,001\rangle _{cd}-|001,100\rangle _{cd}-|000,101\rangle _{cd}\Big ) ,\nonumber \\ |100,010\rangle _{ab}\longrightarrow & {} \frac{1}{2} \Big (|110,000\rangle _{cd}-|100,010\rangle _{cd}+|010,100\rangle _{cd}\,-|000,110\rangle _{cd}\Big ) , \nonumber \\ |010,100\rangle _{ab}\longrightarrow & {} \frac{1}{2} \Big (|110,000\rangle _{cd}+|100,010\rangle _{cd} -|010,100\rangle _{cd}-|000,110\rangle _{cd}\Big ) , \nonumber \\ |100,100\rangle _{ab}\longrightarrow & {} \frac{1}{\sqrt{2}} \Big (|200,000\rangle _{cd}-|000,200\rangle _{cd}\Big ) , \nonumber \\ |010,010\rangle _{ab}\longrightarrow & {} \frac{1}{\sqrt{2}} \Big (|020,000\rangle _{cd}-|000,020\rangle _{cd}\Big ) , \nonumber \\ |001,001\rangle _{ab}\longrightarrow & {} \frac{1}{\sqrt{2}} \Big (|002,000\rangle _{cd}-|000,002\rangle _{cd}\Big ) . \end{aligned}$$

(27)

Using Eq. (25) and Eq. (27), we get

$$\begin{aligned} |\psi \rangle _{\text {out}}= & {} \frac{1}{2\sqrt{6}}e^{i(\phi _{{b}_{1}}+\phi _{{b}_{2}})}\Big [ \,e^{i\varDelta \phi _{1}}\Big (|011,000\rangle _{cd}-|010,001\rangle _{cd}\nonumber \\&+|001,010\rangle _{cd}-|000,011\rangle _{cd}\Big )\nonumber \\&+e^{i\varDelta \phi _{2}}\Big (|011,000\rangle _{cd}+|010,001\rangle _{cd} -|001,010\rangle _{cd}-|000,011\rangle _{cd}\Big )\nonumber \\&+ e^{-i\phi _{{b}_{1}}}\Big \{\Big (|101,000\rangle _{cd}-|100,001\rangle _{cd}+|001,100\rangle _{cd} \,-|000,101\rangle _{cd}\Big )\nonumber \\&+e^{i\varDelta \phi _{2}}\Big (|101,000\rangle _{cd}+|100,001\rangle _{cd}-|001,100\rangle _{cd} -|000,101\rangle _{cd}\Big )\Big \}\nonumber \\&+ e^{-i\phi _{{b}_{2}}}\Big \{\Big (|110,000\rangle _{cd} \,-|100,010\rangle _{cd}+|010,100\rangle _{cd}\,-|000,110\rangle _{cd}\Big )\nonumber \\&+e^{i\varDelta \phi _{1}}\Big (|110,000\rangle _{cd}+|100,010\rangle _{cd} -|010,100\rangle _{cd}-|000,110\rangle _{cd}\Big )\Big \}\Big ].\nonumber \\ \end{aligned}$$

(28)

The output after the beamsplitter depends upon the random phase applied by Alice and Bob to their respective time-bins. We write down the four different final states realized, corresponding to the four possible values of $(\varDelta \phi _{1}, \varDelta \phi _{2})$. To help understand the key-reconciliation step, we have rewritten the final state by grouping together the states at each output port (c or d), corresponding to the three different time-bins ($t_{1}$, $t_{2}$ or $t_{3}$).

Case 1: When $\varDelta \phi _{1}=\varDelta \phi _{2}=0$, the two-photon state after the beamsplitter is,

$$\begin{aligned} |\psi \rangle _{\text {out}}= & {} \frac{1}{\sqrt{6}}e^{i(\phi _{{b}_{1}}+\phi _{{b}_{2}})}\Big [ \Big (|011,000\rangle _{cd}-|000,011\rangle _{cd}\Big ) +e^{-i\phi _{{b}_{1}}}\Big (|101,000\rangle _{cd}\nonumber \\&-|000,101\rangle _{cd}\Big )+e^{-i\phi _{{b}_{2}}}\Big (|110,000\rangle _{cd}- |000,110\rangle _{cd}\Big )\Big ]. \end{aligned}$$

(29)

Case 2: When $\varDelta \phi _{1}=\varDelta \phi _{2}=\pi$, the output state of the beamsplitter is,

$$\begin{aligned} |\psi \rangle _{\text {out}}= & {} \frac{1}{\sqrt{6}}e^{i(\phi _{{b}_{1}}+\phi _{{b}_{2}})}\Big [ \Big (|011,000\rangle _{cd}-|000,011\rangle _{cd} +e^{-i\phi _{{b}_{1}}}\Big (|001,100\rangle _{cd}\nonumber \\&-|100,001\rangle _{cd}\Big )+e^{-i\phi _{{b}_{2}}}\Big (|010,100\rangle _{d} -|100,010\rangle _{d}\Big )\Big ]. \end{aligned}$$

(30)

Case 3: When $\varDelta \phi _{1}=0$ and $\varDelta \phi _{2}=\pi$, the output state is,

$$\begin{aligned} |\psi \rangle _{\text {out}}= & {} \frac{1}{\sqrt{6}}e^{i(\phi _{{b}_{1}}+\phi _{{b}_{2}})}\Big [ \Big (|001,010\rangle _{cd}-|010,001\rangle _{cd}\Big )+e^{-i\phi _{{b}_{1}}} \Big (|001,100\rangle _{cd}\nonumber \\&-|100,001\rangle _{cd}\Big )+e^{-i\phi _{{b}_{2}}}\Big (|110,000\rangle _{cd} -|000,110\rangle _{cd}\Big )\Big ]. \end{aligned}$$

(31)

Case 4: When $\varDelta \phi _{1}=\pi$ and $\varDelta \phi _{2}=0$, the output state is,

$$\begin{aligned} |\psi \rangle _{\text {out}}= & {} \frac{1}{\sqrt{6}}e^{i(\phi _{{b}_{1}}+\phi _{{b}_{2}})}\Big [ \Big (|010,001\rangle _{cd}-|001,010\rangle _{cd}\Big )+e^{-i\phi _{{b}_{1}}} \Big (|101,000\rangle _{cd}\nonumber \\&-|000,101\rangle _{cd}\Big )+e^{-i\phi _{{b}_{2}}}\Big (|010,100\rangle _{cd} -|100,010\rangle _{cd}\Big )\Big ]. \end{aligned}$$

(32)

We now formulate the key reconciliation scheme (see Table 1) based on Eqs. (29)- (32), while noting that detector $D_{c}$ detects the photons from port c of the beamsplitter and correspondingly detector $D_{d}$ clicks when photons exits from port d.

Consider the two examples when Alice and Bob use $\varDelta \phi _{1}$ to extract the key.

• 1. When Charles announces the clicking of $D_c$ in time-bins $t_{1}$ and $t_{2}$, this would indicate that $\varDelta \phi _{1}$ and $\varDelta \phi _{2}$ have taken values corresponding to Case 1 or Case 3 above, corresponding to $\varDelta \phi _{1} = 0$ and $\varDelta \phi _{2}= 0$ or $\pi$. Alice and Bob therefore use only $\varDelta \phi _{1}$ to extract the key.

• 2. When Charles announces the clicking of $D_c$ at $t_{1}$ and $D_d$ at $t_{2}$, Alice and Bob again use $\varDelta \phi _{1}$ to extract the key. However, they also need a bit flip operation to get the same key bits. Note that in this example also, $\varDelta \phi _{1}=0$ and $\varDelta \phi _{2}=0$ or $\pi$.

A similar reasoning can be used to complete the key reconciliation scheme as described in Table 1.

DPS-MDI as an entanglement-based protocol

We start with Eqs. (7) and (8), to write the joint state of Alice and Bob after their encoding procedure. Recall that A and B indicate Alice and Bob’s signal states, whereas $A_{i}$ and $B_{i}$ indicate the $i^{\mathrm{th}}$ pair of ancilla qubit in respective (ideal) quantum memories. The joint state thus reads as,

$$\begin{aligned} |\psi \rangle _{\text {Alice}}\otimes |\psi \rangle _{\text {Bob}}= & {} \frac{1}{4}\sum _{j_{1},j_{2}\in \{ 0,1 \}}(|j_{1}\rangle _{A_{1}}|j_{2}\rangle _{A_{2}})\otimes |\psi _{j_1j_2}\rangle _{a}\nonumber \\&\otimes \sum _{\tilde{j}_{1},\tilde{j}_{2} \in \{ 0,1 \}}(|\tilde{j}_{1}\rangle _{B_{1}}|\tilde{j}_{2}\rangle _{B_{2}})\otimes |\psi _{\tilde{j}_{1},\tilde{j}_{2}}\rangle _{b}, \nonumber \\= & {} \frac{1}{4}\sum _{j_{1},j_{2},\tilde{j}_{1},\tilde{j}_{2} \in \{ 0,1 \}} |j_{1}\rangle _{A_{1}}|\tilde{j}_{1}\rangle _{B_{1}}|j_{2}\rangle _{A_{2}}|\tilde{j}_{2}\rangle _{B_{2}}\nonumber \\&\otimes |\varPsi _{(j_{1}j_{2}\tilde{j}_{1}\tilde{j}_{2})}\rangle _{ab}. \end{aligned}$$

(33)

The state $|\varPsi _{j_{1}j_{2}\tilde{j}_{1}\tilde{j}_{2}}\rangle _{ab}$, which eventually becomes the input to Charles’ beamsplitter, has the following form:

$$\begin{aligned} \vert \varPsi _{j_{1}j_{2}\tilde{j}_{1}\tilde{j}_{2}}\big \rangle _{ab}= & {} |\psi _{j_1j_2}\rangle _{a}\otimes |\psi _{\tilde{j_1}\tilde{j_2}}\rangle _{b}\nonumber \\= & {} \Big ( a^{\dagger }_{1}b_{1}^{\dagger } + \sum _{i=1}^{2}(-1)^{(j_{i}+\tilde{j}_{i})}a_{i+1}^{\dagger }b_{i+1}^{\dagger } + (-1)^{\tilde{j}_{1}}a_{1}^{\dagger }b_{2}^{\dagger } + (-1)^{ \tilde{j}_{2}}a_{1}^{\dagger }b_{3}^{\dagger } \nonumber \\&+ (-1)^{j_{1}}a_{2}^{\dagger }b_{1}^{\dagger } + (-1)^{j_{1}+ \tilde{j}_{2}}a_{2}^{\dagger }b_{3}^{\dagger } + (-1)^{j_{2}} a_{3}^{\dagger }b_{1}^{\dagger } \nonumber \\&+ (-1)^{(j_{2} + \tilde{j}_{1})}a_{3}^{\dagger }b_{2}^{\dagger } \Big ) \vert 0,0 \big \rangle _{ab} . \end{aligned}$$

(34)

Here, $|0,0\rangle _{ab}=|0\rangle _a\otimes |0\rangle _b$, and denotes the vaccum at the input ports of the beamsplitter. $a_{i}^{\dagger }$ and $b_{i}^{\dagger }$ are the creation operators corresponding to a photon traversing through the $i^{\mathrm{th}}$ arm in Alice and Bob’s delay lines respectively. As indicated above, there is no entanglement yet between Alice and Bob’s states; rather, each encoded state is entangled with their respective quantum memories.

To obtain the output state after measurement and key reconciliation, we first do a post-selection and discard input states which have photons arriving at the same time-bin from both Alice and Bob. As described in Sect. 3, such photons do not contribute to the final key, due to Hong–Ou–Mandel interference. Hence, we drop terms of the form $a_{i}^{\dagger }b_{i}^{\dagger }$ in Eq. (34). When the photons arrive at different times, as represented by terms of the form $a_{i}^{\dagger }b_{j}^{\dagger }$ for $i\ne j$, they transform as,

$$\begin{aligned} a^{\dagger } \rightarrow \frac{1}{\sqrt{2}}(c^{\dagger } + d^{\dagger })\, ; \quad b^{\dagger } \rightarrow \frac{1}{\sqrt{2}}(c^{\dagger } -d^{\dagger }) . \end{aligned}$$

We may thus write down the final state after the action of the beamsplitter and post-selection as,

$$\begin{aligned} \vert \varPhi _{j_{1}j_{2}\tilde{j}_{1}\tilde{j}_{2}}\big \rangle _{cd}= & {} \frac{1}{2}\Big [ (-1)^{\tilde{j}_{1}}(c_{1}^{\dagger }+ d_{1}^{\dagger })(c_{2}^{\dagger } - d_{2}^{\dagger }) + (-1)^{ \tilde{j}_{2}}(c_{1}^{\dagger }+ d_{1}^{\dagger })(c_{3}^{\dagger } - d_{3}^{\dagger }) \nonumber \\&+ (-1)^{j_{1}}(c_{2}^{\dagger }+ d_{2}^{\dagger })\nonumber \\&\times (c_{1}^{\dagger } - d_{1}^{\dagger }) + (-1)^{(j_{1} + \tilde{j}_{2})}(c_{2}^{\dagger }+ d_{2}^{\dagger })(c_{3}^{\dagger } - d_{3}^{\dagger }) \nonumber \\&+ (-1)^{j_{2}} (c_{3}^{\dagger } + d_{3}^{\dagger })(c_{1}^{\dagger } - d_{1}^{\dagger }) \nonumber \\&+ (-1)^{(j_{2} + \tilde{j}_{1})}(c_{3}^{\dagger } + d_{3}^{\dagger })(c_{2}^{\dagger } - d_{2}^{\dagger }) \Big ]\vert 0,0\rangle _{cd} . \end{aligned}$$

(35)

The complete state, including the registers $A_{1}, A_{2}$ and $B_{1}, B_{2}$, is of the form,

$$\begin{aligned} |\chi \rangle _{A_{1}B_{1}A_{2}B_{2}cd} = \frac{1}{4}\sum _{j_{1},j_{2},\tilde{j}_{1},\tilde{j}_{2} \in \{ 0,1 \}} |j_{1}\rangle _{A_{1}}|\tilde{j}_{1}\rangle _{B_{1}}|j_{2}\rangle _{A_{2}}|\tilde{j}_{2}\rangle _{B_{2}} \otimes |\varPhi _{(j_{1}j_{2}\tilde{j}_{1}\tilde{j}_{2})}\rangle _{cd}. \end{aligned}$$

(36)

As discussed in Sect. 3.2 , Alice and Bob extract information about their relative phases $\varDelta \phi _{1} = \phi _{a_{1}}-\phi _{b_{1}}$ and $\varDelta \phi _{2} = \phi _{a_{2}}-\phi _{b_{2}}$ based on Charles’ measurement outcomes, and hence obtain the shared key. Expressing all the phases in terms of the binary variables $(j_{1}, j_{2})$ and $(\tilde{j}_{1}, \tilde{j}_{2})$, which characterize Alice and Bob’s qubit registers respectively, we have,

$$\begin{aligned} \phi _{a_{1}} = j_{1}\pi , \; \phi _{a_{2}} = j_{2} \pi , \; \phi _{b_{1}} = \tilde{j}_{1}\pi , \; \phi _{b_{2}} = \tilde{j}_{2} \pi . \end{aligned}$$

Thus the relative phases are given by,

$$\begin{aligned} \varDelta \phi _{1} = (j_{1} - \tilde{j}_{1})\pi , \; \; \varDelta \phi _{2} = ( j_{2} - \tilde{j}_{2} )\pi . \end{aligned}$$

It is now easy to show that the joint state of Alice and Bob’s registers collapses to an entangled state after Charles’ measurement and the reconciliation process described in Table 1. In particular, when Alice and Bob use the phases $\phi _{a_{i}}, \phi _{b_{i}}$ to generate their secret key bits without a bit flip operation, they end up with the perfectly correlated Bell state $\frac{1}{\sqrt{2}}[|00\rangle _{A_{i}B_{i}} -|11\rangle _{A_{i}B_{i}}]$. In those cases where they need to perform a bit flip operation, they end up sharing the anti-correlated entangled state $\frac{1}{\sqrt{2}}[|10\rangle _{A_{i}B_{i}} -|01\rangle _{A_{i}B_{i}}]$.

For example, when Charles announces that the detector c has clicked in both $t_{1}$ and $t_{2}$ bins, Eq. (36) collapses to the post-measurement state,

$$\begin{aligned} |\chi ^{(1)}\rangle _{\mathrm{out}}= & {} \frac{1}{2\sqrt{2}} \Big [ |0000\rangle _{A_{1}B_{1}A_{2}B_{2}} - |0001\rangle _{A_{1}B_{1}A_{2}B_{2}} \nonumber \\&+|0010\rangle _{A_{1}B_{1}A_{2}B_{2}} - |0011\rangle _{A_{1}B_{1}A_{2}B_{2}} \nonumber \\&- |1100\rangle _{A_{1}B_{1}A_{2}B_{2}} + |1101\rangle _{A_{1}B_{1}A_{2}B_{2}} \nonumber \\&-|1110\rangle _{A_{1}B_{1}A_{2}B_{2}} +|1111\rangle _{A_{1}B_{1}A_{2}B_{2}} \Big ]\nonumber \\&\otimes |110,000\rangle _{cd}, \end{aligned}$$

(37)

where we have represented $|j_1\rangle _{A_1}|\tilde{j_1}\rangle _{B_1}|j_2\rangle _{A_2}|\tilde{j_2}\rangle _{B_2}$ as $|j_1\tilde{j}_1j_2\tilde{j}_2\rangle _{A_{1}B_{1}A_{2}B_{2}}$. We see that in Eq. (37), the first ancilla registers ($A_{1}$ and $B_{1}$) of both Alice and Bob always have same bit value. Hence, Alice and Bob share the perfectly correlated Bell state, as shown explicitly below,

$$\begin{aligned} |\chi ^{(1)}\rangle _{\mathrm{out}}= & {} \frac{1}{2\sqrt{2}} \Big [|00\rangle _{A_{1}B_{1}} - |11\rangle _{A_{1}B_{1}} \Big ] \nonumber \\&\otimes \Big [ |00\rangle _{A_{2}B_{2}} - |01\rangle _{A_{2}B_{2}} + |10\rangle _{A_{2}B_{2}} - |11\rangle _{A_{2}B_{2}} \Big ]\nonumber \\&\otimes |110,000\rangle _{cd}. \end{aligned}$$

(38)

When Charles announces that the detector c clicked at $t_{1}$ and d at $t_{2}$, the state presented in Eq. (36) collapses to,

$$\begin{aligned} |\chi ^{(2)}\rangle _{\mathrm{out}}= & {} \frac{1}{2\sqrt{2}}\Big [-|0100\rangle _{A_{1}B_{1}A_{2}B_{2}}\nonumber \\&+|0101\rangle _{A_{1}B_{1}A_{2}B_{2}} - |0110\rangle _{A_{1}B_{1}A_{2}B_{2}} + |0111\rangle _{A_{1}B_{1}A_{2}B_{2}} \nonumber \\&-|1000\rangle _{A_{1}B_{1}A_{2}B_{2}} -|1001\rangle _{A_{1}B_{1}A_{2}B_{2}} \nonumber \\&+|1010\rangle _{A_{1}B_{1}A_{2}B_{2}} - |1011\rangle _{A_{1}B_{1}A_{2}B_{2}} \Big ]\nonumber \\&\otimes |100,010\rangle _{cd} . \end{aligned}$$

(39)

As seen from Eq. (39), the first ancilla registers ($A_{1}$ and $B_{1}$) of Alice and Bob are now always opposite in the bit value. This implies they share an anti-correlated entangled state. Hence, they require a bit flip operation after Charles announcement so as to ensure that both of them end up with similar key bits. We can extend similar lines of reasoning to the other entries of Table 1 to show that Alice and Bob indeed share maximally entangled states.

Bounding of phase error rate in terms of bit error rate

In “Appendix B”, we show that Charles measurement entangles Alice’s and Bob’s ancilla qubits. However, the EPR pairs shared by Alice and Bob become corrupt due to channel noise and eavesdropping. Alice and Bob extract a small number of perfect EPR pairs from the corrupted EPR pairs using a suitable entanglement distillation protocol based on Calderbank–Shor–Steane (CSS) codes, provided the channel is not too noisy [3]. Alice and Bob determine the bit and the phase error rates. They continue with the entanglement distillation protocol if the error rates are nominal, else they abort the protocol. The bit error rates can be easily estimated by sharing a certain fraction of the raw key generated during the experiment. However, phase errors cannot be determined experimentally, and hence, need to be estimated indirectly using experimentally observed quantities. We upper bound the phase error rate for our scheme in terms of the bit error rate in this section.

We begin with $|\psi \rangle ^{(l)}_{\text {out}}$, which is the state after Charles announces his measurement result for the lth time slot, and is related to the joint input state of Alice and Bob $|\psi \rangle ^{(l)}_{\text {in}}$ as,

$$\begin{aligned} |\psi \rangle _{\text {out}}^{(l)}=F^{(l)}M^{(l)}E^{(l)}|\psi \rangle ^{(l)}_{\text {in}}. \end{aligned}$$

(40)

Here, $M^{(l)}$ is the beamsplitter operator acting on the lth time slot, $F^{(l)}$ is the filtering operator and $E^{(l)}$ is a $3 \times 3$“noise” matrix representing the effects of noise and Eve’s most general attack in lth time slot. We assume that the noise and Eve affect the link connecting Alice to Charles and Bob to Charles independently. Hence, we decompose the overall noise matrix $E^{(l)}$ as $E_{a}^{(l)}\otimes E_b^{(l)}$. Both $E_a^{(l)}$ and $E_b^{(l)}$ are $3\times 3$ matrices with matrix elements $(a)_{ij}$ and $(b)_{ij}$, respectively. $\vert a_{ij}\vert ^2$ gives the probability of time-bin i getting affected given that the noise/Eve acts on time-bin j. We would like to clarify the terms “time-bin” and “time-slot” used here. We use the time-slot label to mark every single-photon state (in the ideal scenario) or weak coherent pulse (in a typical experiment) generated by the source, whether Alice or Bob. Each pulse labeled by a time-slot is eventually measured at one of three time-bins ($i/j =1, 2, 3$) by Charlie, depending on which path the photon traversed in the DLI at the source. The form of these matrices depends upon the type of noise in the channel. The matrix structure is dependent upon the eavesdropper’s attack too. Hereafter, in the interest of brevity, we drop the superscript (l).

For example, we can study a channel noise (or an attack) which flips the key bits. The key is encoded in the phase difference of the corresponding time-bins of Alice and Bob in our protocol. Hence, Eve would need to flip the phase of Alice’s time-bins or Bob’s time-bins. So different noise matrices that can lead to such an attack are

$$\begin{aligned} \begin{pmatrix} 1 &{}\quad 0 &{}\quad 0\\ 0 &{}\quad -1 &{}\quad 0\\ 0 &{}\quad 0 &{}\quad -1 \end{pmatrix}_{a}\otimes \begin{pmatrix} 1 &{}\quad 0 &{}\quad 0\\ 0 &{}\quad 1 &{}\quad 0\\ 0 &{}\quad 0 &{}\quad 1 \end{pmatrix}_{b}\quad \text {or} \quad \begin{pmatrix} 1 &{}\quad 0 &{}\quad 0\\ 0 &{}\quad 1 &{}\quad 0\\ 0 &{}\quad 0 &{}\quad 1 \end{pmatrix}_{a}\otimes \begin{pmatrix} 1 &{}\quad 0 &{}\quad 0\\ 0 &{}\quad -1 &{}\quad 0\\ 0 &{}\quad 0 &{}\quad -1 \end{pmatrix}_{b} \end{aligned}$$

(41)

Another example is of an attack where Eve just monitors the presence of a photon in the second time-bin of Alice’s signal. We can write Alice’s state as

$$\begin{aligned} |\psi \rangle _{\text {in}}=\frac{1}{\sqrt{3}} \left( \, |100\rangle _{a} + e^{i\phi _{{a}_{1}}} |011\rangle _{a} + e^{i\phi _{{a}_{2}}} |001\rangle _{a} \, \right) \end{aligned}$$

(42)

When Eve discovers no photon in the second time-bin, the state shown in Eq. (42) collapses to

$$\begin{aligned} |\psi \rangle _{\text {final}}=\frac{1}{\sqrt{2}} \left( \, |100\rangle _{a}+ e^{i\phi _{{a}_{2}}} |001\rangle _{a} \, \right) \end{aligned}$$

(43)

One such noise matrix that achieves this attack is

$$\begin{aligned} E_a=\begin{pmatrix} \frac{1}{\sqrt{6}} &{}\quad \frac{1}{\sqrt{6}} &{}\quad \frac{1}{\sqrt{6}}\\ 0 &{}\quad 0 &{}\quad 0\\ \frac{1}{\sqrt{6}} &{}\quad \frac{1}{\sqrt{6}} &{}\quad \frac{1}{\sqrt{6}} \end{pmatrix} \end{aligned}$$

(44)

From the above examples, we conclude that the elements of these noise matrices can be predicted only when we know the nature of Eve’s attack and the noise in the channel. Hence, by assuming a general form for these matrices, we can find the bit and phase error rates in our protocol for any general eavesdropping strategy.

Alice and Bob measure their EPR pairs in the Z (X) basis, which acts as a stabilizer for the bit (phase) error. Thus, the probability of obtaining a bit error in the lth time-slot is,

$$\begin{aligned} e{_{\text {b}}}=1-\frac{1}{2}\big (\langle \psi \vert I_{cd}\otimes Z_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}\vert \psi _{\text {out}}\rangle + \langle \psi _{\text {out}}\vert I_{cd}\otimes I_{A_{1}B_{1}}\otimes Z_{A_{2}B_{2}}\vert \psi _{\text {out}}\rangle \big ). \end{aligned}$$

(45)

Similarly, the probability of obtaining a phase error in the lth time-slot can be expressed as,

$$\begin{aligned} e_{\text {p}}=1-\frac{1}{2}\big (\langle \psi _{\text {out}}\vert I_{cd}\otimes X_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}\vert \psi _{\text {out}}\rangle + \langle \psi _{\text {out}}\vert I_{cd}\otimes I_{A_{1}B_{1}}\otimes X_{A_{2}B_{2}}\vert \psi _{\text {out}}\rangle \big ). \end{aligned}$$

(46)

Using Eq. (40), we rewrite the bit error rate as,

$$\begin{aligned} e{_{\text {b}}}= & {} 1-\frac{1}{2}\big (\langle \psi _{\text {in}}\vert E^{\dagger }M^{\dagger }F^{\dagger }_1 F_1M E\otimes Z_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}\vert \psi _{\text {in}}\rangle \nonumber \\&+ \langle \psi _{\text {in}}\vert E^{\dagger }M^{\dagger }F^{\dagger }_2 F_2ME\otimes I_{A_{1}B_{1}}\otimes Z_{A_{2}B_{2}}\vert \psi _{\text {in}}\rangle \big ). \end{aligned}$$

(47)

Here, $F_{1}$ and $F_{2}$ are the filtering operators corresponding to the instances where Charles measurement and its public announcement effectively results in entangling the first and second ancilla qubits of Alice and Bob, respectively.

1.1 Decomposing $M^{(l)\dagger }F^{(l)\dagger }_1 F^{(l)}_1M^{(l)}$

$|100\rangle$, $|010\rangle$ and $|001\rangle$ form an orthonormal basis for Alice’s and Bob’s system, where e.g. $|100\rangle$ represents a photon in the first time-bin. Using Eq. (27), for each time slot (l), we write,

$$\begin{aligned} M= & {} \frac{1}{2}\Big [\big (|100\rangle _c\langle 100|_a+|100\rangle _d\langle 100|_a\big )\otimes \big (|100\rangle _c\langle 100|_b-|100\rangle _d\langle 100|_b\big )\nonumber \\&+\big (|100\rangle _c\langle 100|_a+|100\rangle _d\langle 100|_a\big )\otimes \big (|010\rangle _c\langle 010|_b-|010\rangle _d\langle 010|_b\big )\nonumber \\&+\big (|100\rangle _c\langle 100|_a+|100\rangle _d\langle 100|_a\big )\otimes \big (|001\rangle _c\langle 001|_b-|001\rangle _d\langle 001|_b\big )\nonumber \\&+\big (|010\rangle _c\langle 010|_a+|010\rangle _d\langle 010|_a\big )\otimes \big (|100\rangle _c\langle 100|_b-|100\rangle _d\langle 100|_b\big )\nonumber \\&+\big (|010\rangle _c\langle 010|_a+|010\rangle _d\langle 010|_a\big )\otimes \big (|010\rangle _c\langle 010|_b-|010\rangle _d\langle 010|_b\big )\nonumber \\&+\big (|010\rangle _c\langle 010|_a+|010\rangle _d\langle 010|_a\big )\otimes \big (|001\rangle _c\langle 001|_b-|001\rangle _d\langle 001|_b\big )\nonumber \\&+\big (|001\rangle _c\langle 001|_a+|001\rangle _d\langle 001|_a\big )\otimes \big (|100\rangle _c\langle 100|_b-|100\rangle _d\langle 100|_b\big )\nonumber \\&+\big (|001\rangle _c\langle 001|_a+|001\rangle _d\langle 001|_a\big )\otimes \big (|010\rangle _c\langle 010|_b-|010\rangle _d\langle 010|_b\big )\nonumber \\&+\big (|001\rangle _c\langle 001|_a+|001\rangle _d\langle 001|_a\big )\otimes \big (|001\rangle _c\langle 001|_b-|001\rangle _d\langle 001|_b\big )\Big ].\nonumber \\ \end{aligned}$$

(48)

$F_1$ acts as identity for the measurement results which contribute towards the key. Hence, it can be expressed as,

$$\begin{aligned} F_1= & {} |110\rangle _c\langle 110|_c\otimes |000\rangle _d\langle 000|_d+ |000\rangle _c\langle 000|_c\otimes |110\rangle _d\langle 110|_d\nonumber \\&|100\rangle _c\langle 100|_c\otimes |010\rangle _d\langle 010|_d+|010\rangle _c\langle 010|_c \otimes |100\rangle _d\langle 100|_d. \end{aligned}$$

(49)

Using Eq. (48) and Eq. (49), we get

$$\begin{aligned} M^{\dagger }F^{\dagger }_1F_1M=|100\rangle _a\langle 100|_a\otimes |010\rangle _b\langle 010|_b +|010\rangle _a\langle 010|_a\otimes |100\rangle _b\langle 100|_b . \end{aligned}$$

(50)

We express Eq. (50) in the basis of $A\otimes B$. In a concise notation, we use $|a_{i}b_{i}\rangle$ to denote the basis of the system $A\otimes B$, where e.g. $|a_{1}b_{1}\rangle$ equals $|100\rangle _a\otimes |100\rangle _b$. Using a completeness relation, we can write Eq. (50) as,

$$\begin{aligned} M^{\dagger }F^{\dagger }_1 F_1M=|a_1b_2\rangle \langle a_1b_2|+|a_2b_1\rangle \langle a_2b_1|. \end{aligned}$$

(51)

By defining a suitable $F_{2}$, we can write

$$\begin{aligned} M^{\dagger }F^{\dagger }_2 F_2M=|a_1b_3\rangle \langle a_1b_3|+|a_3b_1\rangle \langle a_3b_1|. \end{aligned}$$

(52)

1.2 Bit error rate (BER)

First, we evaluate one component of the bit error rate - $\langle \psi _{\text {in}}\vert E^{\dagger }|a_1b_2\rangle \langle a_1b_2|E\otimes Z_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}\vert \psi _{\text {in}}\rangle$. We assume that Eve acts independently on the channels connecting Alice to Charles and Bob to Charles. Hence, we can write $E=E_a\otimes E_b$. Using Eq. (33) and Eq. (34), we express $\langle \psi _{\text {in}}\vert E^{\dagger }|a_1b_2\rangle \langle a_1b_2|E\otimes Z_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}\vert \psi _{\text {in}}\rangle$ as,

$$\begin{aligned}&\sum \limits _{|j\rangle =|0000\rangle }^{|1111\rangle }\Big (\langle a_1b_1| +(-1)^{j_1+\tilde{j_1}}\langle a_2b_2|+(-1)^{j_2+\tilde{j_2}}\langle a_3b_3|\nonumber \\&\quad +(-1)^{\tilde{j_1}}\langle a_1b_2|+(-1)^{\tilde{j_2}}\langle a_1b_3|\nonumber \\&\quad +(-1)^{j_1}\langle a_2b_1|+(-1)^{j_1+\tilde{j_2}}\langle a_2b_3|+(-1)^{j_2}\langle a_3b_1| +(-1)^{j_2+\tilde{j_1}}\langle a_3b_2|\Big )\nonumber \\&\quad \otimes \langle j_1\tilde{j_1}j_2\tilde{j_2}| E^{\dagger }_a\otimes E^{\dagger }_b |a_1b_2\rangle \langle a_1b_2|E_a\otimes E_b \otimes Z_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}\Big (|a_1b_1\rangle \nonumber \\&\quad +(-1)^{j_1+\tilde{j_1}}|a_2b_2\rangle +(-1)^{j_2+\tilde{j_2}}|a_3b_3\rangle +(-1)^{\tilde{j_1}} |a_1b_2\rangle +(-1)^{\tilde{j_2}}|a_1b_3\rangle \nonumber \\&\quad +(-1)^{j_1}|a_2b_1\rangle +(-1)^{j_1+\tilde{j_2}}|a_2b_3\rangle +(-1)^{j_2}|a_3b_1\rangle +(-1)^{j_2+\tilde{j_1}}|a_3b_2\rangle \Big )\nonumber \\&\quad \otimes |j_1\tilde{j_1}j_2\tilde{j_2}\rangle , \end{aligned}$$

(53)

where, $|j\rangle =|j_{1}\tilde{j_1}j_2\tilde{j_2}\rangle$ is the state of the joint quantum memory of Alice and Bob. We define the $(a_{ij})^\text {th}$ matrix elements of $E_a$ as $\langle a_i|E_a|a_j\rangle$ and the $(b_{ij})^\text {th}$ element of $E_b$ as $\langle b_i|E_a|b_j\rangle$. Hence, we write Eq. (53) as,

$$\begin{aligned}&\sum \limits _{|j\rangle =|0000\rangle }^{|1111\rangle }(-1)^{(j_1+\tilde{j_1})} \Big [\Big (a_{11}^*b_{21}^*+(-1)^{j_1+\tilde{j_1}}a_{12}^*b_{22}^*+(-1)^{j_2 +\tilde{j_2}}a_{13}^*b_{23}^*\nonumber \\&\quad +(-1)^{\tilde{j_1}}a_{11}^*b_{22}^*\nonumber \\&\quad +(-1)^{\tilde{j_2}}a_{11}^*b_{23}^*+(-1)^{j_1}a_{12}^*b_{21}^*+(-1)^{j_1 +\tilde{j_2}}a_{12}^*b_{23}^*+(-1)^{j_2}a_{13}^*b_{21}^*\nonumber \\&\quad +(-1)^{j_2+\tilde{j_1}}a_{13}^*b_{22}^*\Big )\times \Big (a_{11}b_{21}+(-1)^{j_1 +\tilde{j_1}}a_{12}b_{22}+(-1)^{j_2+\tilde{j_2}}a_{13}b_{23}\nonumber \\&\quad +(-1)^{\tilde{j_1}}a_{11}b_{22}+(-1)^{\tilde{j_2}}a_{11}b_{23} +(-1)^{j_1}a_{12}b_{21} +(-1)^{j_1+\tilde{j_2}}a_{12}b_{23}\nonumber \\&\quad +(-1)^{j_2}a_{13}b_{21}+(-1)^{j_2+\tilde{j_1}}a_{13}b_{22}\Big )\Big ] . \end{aligned}$$

(54)

Eq. (54) can be factorised as,

$$\begin{aligned}&\sum \limits _{|j\rangle =|0000\rangle }^{|1111\rangle }(-1)^{j_1+\tilde{j_1}}\Big (a_{11}^*+(-1)^{j_1} a_{12}^*+(-1)^{j_2}a_{13}^*\Big )\Big (b_{21}^*+(-1)^{\tilde{j_1}}b_{22}^* +(-1)^{\tilde{j_2}}b_{23}^*\Big )\nonumber \\&\quad \times \Big (a_{11}+(-1)^{j_1}a_{12}+(-1)^{j_2}a_{13}\Big ) \Big (b_{21}+(-1)^{\tilde{j_1}}b_{22}+(-1)^{\tilde{j_2}}b_{23}\Big ), \end{aligned}$$

(55)

which further simplifies to,

$$\begin{aligned} 16\Big (\vert a_{12}\vert ^2+\vert a_{11}\vert ^2-\vert a_{12}-a_{11}\vert ^2\Big )\Big (\vert b_{22}\vert ^2+\vert b_{21}\vert ^2-\vert b_{22}-b_{21}\vert ^2\Big ). \end{aligned}$$

(56)

Now, we evaluate the remaining terms of Eq. (47) and obtain the total BER in each time slot as,

$$\begin{aligned} e_{\text {b}}= & {} 1-\frac{16}{2\times 144}\Bigg [\Big (\vert a_{12}\vert ^2+\vert a_{11}\vert ^2-\vert a_{12}-a_{11}\vert ^2\Big )\Big (\vert b_{22}\vert ^2+\vert b_{21}\vert ^2-\vert b_{22}-b_{21}\vert ^2\Big )\nonumber \\&+\Big (\vert a_{21}\vert ^2+\vert a_{22}\vert ^2-\vert a_{21}-a_{22}\vert ^2\Big )\Big (\vert b_{12}\vert ^2+\vert b_{11}\vert ^2-\vert b_{12}-b_{11}\vert ^2\Big )\nonumber \\&+\Big (\vert a_{13}\vert ^2+\vert a_{11}\vert ^2-\vert a_{13}-a_{11}\vert ^2\Big )\Big (\vert b_{33}\vert ^2+\vert b_{31}\vert ^2-\vert b_{33}-b_{31}\vert ^2\Big )\nonumber \\&+\Big (\vert a_{33}\vert ^2+\vert a_{31}\vert ^2-\vert a_{33}-a_{31}\vert ^2\Big )\Big (\vert b_{13}\vert ^2+\vert b_{11}\vert ^2-\vert b_{13}-b_{11}\vert ^2\Big )\Bigg ]. \end{aligned}$$

(57)

1.3 Phase error rate

We begin by calculating one component of the phase error rate in the lth time slot, $\langle \psi _{\text {in}}\vert E^{\dagger }|a_1b_2\rangle \langle a_1b_2|E\otimes X_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}\vert \psi _{\text {in}}\rangle$ in this section. Similar to Eq.(55), we can factorize the phase error rate as,

$$\begin{aligned}&(a_{11}^*-(-1)^{j_1}a_{12}^*+(-1)^{j_2}a_{13}^*)(b_{21}^* -(-1)^{\tilde{j_1}}b_{22}^*+(-1)^{\tilde{j_2}}b_{23}^*)\nonumber \\&\quad \times \big (a_{11}+(-1)^{j_1}a_{12}+(-1)^{j_2}a_{13}\big )\big (b_{21}+ (-1)^{\tilde{j_1}}b_{22}+(-1)^{\tilde{j_2}}b_{23}\big ). \end{aligned}$$

(58)

We use the fact that X flips the qubit $|j\rangle$, write $(-1)^{j+1}$ as $-(-1)^j$, and get the expanded value of Eq. (58) as,

$$\begin{aligned} 16\Big (\vert a_{11}\vert ^2-\vert a_{12}\vert ^2+\vert a_{13}\vert ^2\Big )\Big (\vert b_{21}\vert ^2-\vert b_{22}\vert ^2+\vert b_{23}\vert ^2\Big ). \end{aligned}$$

(59)

We can also write Eq. (58) as,

$$\begin{aligned}&\big [(a_{11}^*+(-1)^{j_1}a_{12}^*+(-1)^{j_2}a_{13}^*)(b_{21}^*+(-1)^{\tilde{j_1}}b_{22}^* +(-1)^{\tilde{j_2}}b_{23}^*)-2((-1)^{j_1}a_{12}^*b_{21}^*\nonumber \\&\quad +(-1)^{j_1+\tilde{j_2}}a_{12}^*b_{23}^*+(-1)^{\tilde{j_1}}a_{11}^*b_{22}^* +(-1)^{\tilde{j_1}+j_2}a_{13}^*b_{22}^*)\big ]\big (a_{11}+(-1)^{j_1}a_{12}\nonumber \\&\quad +(-1)^{j_2}a_{13}\big )\big (b_{21}+(-1)^{\tilde{j_1}}b_{22}+(-1)^{\tilde{j_2}}b_{23}\big ). \end{aligned}$$

(60)

The above equation, when summed over all the possible values of $|j\rangle =|j_1\tilde{j}_1j_2\tilde{j}_2\rangle$ gives

$$\begin{aligned}&\langle \psi _{\text {in}}\vert E^{\dagger }|a_1b_2\rangle \langle a_1b_2|E\otimes Z_{A_{1}B_{1}}\otimes I_{A_{2}B_{2}}\vert \psi _{\text {in}}\rangle -\frac{2\times 16}{2\times 144}\big [\vert a_{12}\vert ^2\big (\vert b_{21}\vert ^2+\vert b_{23}\vert ^2\big )\nonumber \\&\quad +\vert b_{22}\vert ^2\big (\vert a_{11}\vert ^2+\vert a_{13}\vert ^2\big )\big ]. \end{aligned}$$

(61)

Calculating the remaining three terms (cf. Eqs. (46), (51) and (52)) along the lines of Eq. (58) and Eq. (59), we get the total phase error rate as,

$$\begin{aligned}&1-\frac{16}{2\times 144}\Bigg [\Big (\vert a_{11}\vert ^2-\vert a_{12}\vert ^2+\vert a_{13}\vert ^2\Big )\Big (\vert b_{21}\vert ^2-\vert b_{22}\vert ^2+\vert b_{23}\vert ^2\Big )\nonumber \\&\quad +\Big (\vert a_{21}\vert ^2-\vert a_{22}\vert ^2+\vert a_{23}\vert ^2\Big ) \nonumber \\&\quad \times \Big (\vert b_{11}\vert ^2-\vert b_{12}\vert ^2+\vert b_{13}\vert ^2\Big )\Big (\vert a_{11}\vert ^2+\vert a_{12}\vert ^2-\vert a_{13}\vert ^2\Big )\Big (\vert b_{31}\vert ^2+\vert b_{32}\vert ^2-\vert b_{33}\vert ^2\Big )\nonumber \\&\quad +\Big (\vert a_{31}\vert ^2+\vert a_{32}\vert ^2-\vert a_{33}\vert ^2\Big )\Big (\vert b_{11}\vert ^2+\vert b_{12}\vert ^2-\vert b_{13}\vert ^2\Big )\Bigg ]. \end{aligned}$$

(62)

Along the lines of Eq. (61), we can express the phase error rate in terms of bit error rate as,

$$\begin{aligned} e_{\text {p}}= & {} e_{\text {b}}-\frac{2\times 16}{2\times 144}\Big [\big \{\vert a_{12}\vert ^2\big (\vert b_{21}\vert ^2+\vert b_{23}\vert ^2\big )+\vert b_{22}\vert ^2\big (\vert a_{11}\vert ^2+\vert a_{13}\vert ^2\big )\big \}\nonumber \\&+\big \{\vert a_{22}\vert ^2\Big (\vert b_{11}\vert ^2\nonumber \\&+\vert b_{13}\vert ^2\big )+\vert b_{12}\vert ^2\big (\vert a_{21}\vert ^2+\vert a_{23}\vert ^2\big )\big \}+\big \{\vert a_{13}\vert ^2\big (\vert b_{31}\vert ^2+\vert b_{32}\vert ^2\big )\nonumber \\&+\vert b_{33}\vert ^2\big (\vert a_{11}\vert ^2+\vert a_{12}\vert ^2\big )\big \}+\big \{\vert a_{33}\vert ^2\big (\vert b_{11}\vert ^2+\vert b_{12}\vert ^2\big )\nonumber \\&+\vert b_{13}\vert ^2\big (\vert a_{31}\vert ^2+\vert a_{32}\vert ^2\big )\big \}\Big ]. \end{aligned}$$

(63)

From Eq. (63) , we can bound the phase error in each time slot as,

$$\begin{aligned} e_{\text {p}}^{(l)}\le e_{\text {b}}^{(l)}, \forall \; l. \end{aligned}$$

(64)

Asymptotic key analysis of DPS-MDI

1.1 DPS-MDI key rate with single-photon states

We calculate the asymptotic key rate of the single-photon source based DPS-MDI, while taking into account the effects of channel loss, background counts, and misalignment errors. We model Alice’s and Bob’s lossy channels as beamsplitters with transmissivity $\eta _{a}$ and $\eta _{b}$, respectively. After passing through the lossy channels, the joint input state of Alice and Bob (Eq. (2)) appears as a mixed state to Charles, before he carries out the beamsplitter measurement :

$$\begin{aligned} \rho _{\text {in}}= & {} \frac{\eta _{a}\eta _{b}}{9}|\psi _{11}\rangle \langle \psi _{11}| +\frac{\eta _{a}(1-\eta _{b})}{3}|\psi _{10}\rangle \langle \psi _{10}|+\frac{(1-\eta _{a}) \eta _{b}}{3}|\psi _{01}\rangle \langle \psi _{01}|\nonumber \\&+(1-\eta _{a})(1-\eta _{b})|\psi _{00}\rangle \langle \psi _{00}|, \end{aligned}$$

(65)

where,

$$\begin{aligned} |\psi _{11}\rangle&= \left( \, |100\rangle _{a} + e^{i\phi _{{a}_{1}}} |010\rangle _{a} + e^{i\phi _{{a}_{2}}} |001\rangle _{a} \, \right) \nonumber \\&\quad \otimes \left( \, |100\rangle _{b} + e^{i\phi _{{b}_{1}}} |010\rangle _{b} + e^{i\phi _{{b}_{2}}} |001\rangle _{b} \, \right) , \nonumber \\ |\psi _{10}\rangle&= \left( \, |100\rangle _{a} + e^{i\phi _{{a}_{1}}} |010\rangle _{a} + e^{i\phi _{{a}_{2}}} |001\rangle _{a} \, \right) \otimes |000\rangle _{b},\nonumber \\ |\psi _{01}\rangle&= \, |000\rangle _{a} \otimes \left( \, |100\rangle _{b} + e^{i\phi _{{b}_{1}}} |010\rangle _{b} + e^{i\phi _{{b}_{2}}} |001\rangle _{b} \, \right) ,\nonumber \\ \text {and}\qquad |\psi _{00}\rangle&= \, |000\rangle _{a} \otimes |000\rangle _{b}. \end{aligned}$$

(66)

Here, $|\psi _{11}\rangle$ corresponds to the scenario when photons from both Alice and Bob reach the measurement unit. $|\psi _{10}\rangle$ ($|\psi _{01}\rangle$) is the joint input state of Alice and Bob when Bob’s (Alice’s) photon gets lost in the channel, and only Alice’s (Bob’s) photon reaches Charles. $|\psi _{00}\rangle$ represents the case when both Alice as well as Bob’s photons get lost in the channel.

As per Eq. (27), the beamsplitter transforms $|\psi _{11}\rangle$ into

$$\begin{aligned}&|\psi _{11}\rangle _{\text {out}}=\frac{1}{2}e^{i(\phi _{{b}_{1}}+\phi _{{b}_{2}})}\Big [ \,e^{i\varDelta \phi _{1}}\Big (|011,000\rangle _{cd}-|010,001\rangle _{cd}\nonumber \\&\quad +|001,010\rangle _{cd}-|000,011\rangle _{cd}\Big )\nonumber \\&\quad +e^{i\varDelta \phi _{2}}\Big (|011,000\rangle _{cd}+|010,001\rangle _{cd} -|001,010\rangle _{cd}-|000,011\rangle _{cd}\Big )\nonumber \\&\quad +e^{-i\phi _{{b}_{1}}}\Big \{\Big (|101,000\rangle _{cd}-|100,001\rangle _{cd}+ |001,100\rangle _{cd}-|000,101\rangle _{cd}\Big )\nonumber \\&\quad +e^{i\varDelta \phi _{2}}\Big (|101,000\rangle _{cd}+|100,001\rangle _{cd}- |001,100\rangle _{cd}-|000,101\rangle _{cd}\Big )\Big \}\nonumber \\&\quad +e^{-i\phi _{{b}_{2}}}\Big \{\Big (|110,000\rangle _{cd}-|100,010\rangle _{cd}+ |010,100\rangle _{cd}\,-|000,110\rangle _{cd}\Big )\nonumber \\&\quad +e^{i\varDelta \phi _{1}}\Big (|110,000\rangle _{cd}+|100,010\rangle _{cd} - |010,100\rangle _{cd}-|000,110\rangle _{cd}\Big )\Big \}\Big ]\nonumber \\&\quad +\frac{1}{\sqrt{2}}e^{i(\phi _{{b}_{1}}+\phi _{{b}_{2}})}\Big [\Big ( \, e^{-{i(\phi _{{b}_{1}}+\phi _{{b}_{2}})}}|200,000\rangle _{cd}-|000,200\rangle \Big ) +e^{i(\phi _{{a}_{1}}-\phi _{{b}_{2}})} \nonumber \\&\quad \times \Big (|020,000\rangle _{cd}-|000,020\rangle _{cd}\Big ) +e^{i(\phi _{{a}_{2}}-\phi _{{b}_{1}})}\Big (|002,000\rangle -|000,002\rangle \Big )\Big ]\nonumber \\ \end{aligned}$$

(67)

Similarly, the action of beamspitter on $|\psi _{10}\rangle$, $|\psi _{01}\rangle$ and $|\psi _{00}\rangle$ are

$$\begin{aligned} |\psi _{10}\rangle _{\text {out}}= & {} \frac{1}{\sqrt{2}}\Big [ \, |100,000\rangle _{cd}+|000,100\rangle _{cd}\nonumber \\&+e^{\phi _{a_{1}}}\big (|010,000\rangle _{cd} +|000,010\rangle _{cd}\big )\nonumber \\&+e^{\phi _{a_{2}}}\big (|001,000\rangle _{cd} +|000,001\rangle _{cd}\big )\Big ], \end{aligned}$$

(68)

$$\begin{aligned} |\psi _{10}\rangle _{\text {out}}= & {} \frac{1}{\sqrt{2}}\Big [ |100,000\rangle _{cd}- |000,100\rangle _{cd}\nonumber \\&+e^{\phi _{a_{1}}}\big (|010,000\rangle _{cd}-|000,010\rangle _{cd}\big )\nonumber \\&+e^{\phi _{a_{2}}}\big (|001,000\rangle _{cd}-|000,001\rangle _{cd}\big )\Big ], \end{aligned}$$

(69)

$$\begin{aligned} \text {and} \quad |\psi _{00}\rangle _{\text {out}}= & {} |000,000\rangle _{cd}. \end{aligned}$$

(70)

Table 1 shows the instances corresponding to the successful measurement events. These outcomes correspond to successful BSMs as we have mapped the DPS-MDI to an equivalent entanglement-based protocol. The yield ($Y_{11}$) for our protocol is defined as the probability of a successful measurement provided both Alice and Bob send single-photon states. Using Eqs. (65)–(70), we determine the probability of a successful measurement for all the cases shown in Table 1 as,

$$\begin{aligned} {Y}_{11}^{c(t_1,t_2)}=(1-p_{\text {dark}})^4\Big [\frac{\eta _{a}\eta _{b}}{18}+ p_{\text {dark}}\Big (\frac{\eta _{a}+\eta _{b}}{3}-\frac{5\eta _{a}\eta _{b}}{9}\Big )+ p_{\text {dark}}^{2}(1-\eta _{a})(1-\eta _{b})\Big ], \end{aligned}$$

(71)

where, $p_\text {dark}$ is the dark count probability, and ${Y}_{11}^{c(t_1,t_2)}$ represents the probability that detector c clicks in time-bins 1 and 2, given that both Alice and Bob send single-photon states. We use this notation to express the probability of a successful BSM for the other cases tabulated in Table 1.

$$\begin{aligned}&{Y}_{11}^{c(t_1,t_2)}={Y}_{11}^{c(t_1,t_3)}={Y}_{11}^{d(t_1,t_2)}={Y}_{11}^{d(t_1,t_3)} ={Y}_{11}^{c(t_1),d(t_2)}={Y}_{11}^{c(t_2),d(t_1)}={Y}_{11}^{c(t_1),d(t_3)}\nonumber \\&\quad ={Y}_{11}^{c(t_3),d(t_1)}. \end{aligned}$$

(72)

Hence, the yield ($Y_{11}$) is expressed as follows:

$$\begin{aligned} Y_{11}= & {} {Y}_{11}^{c(t_1,t_2)}+{Y}_{11}^{c(t_1,t_3)}+{Y}_{11}^{d(t_1,t_2)} +{Y}_{11}^{d(t_1,t_3)}+{Y}_{11}^{c(t_1),d(t_2)}+{Y}_{11}^{c(t_2),d(t_1)}\nonumber \\&+{Y}_{11}^{c(t_1),d(t_3)}+{Y}_{11}^{c(t_3),d(t_1)}\nonumber \\= & {} 8(1-p_{\text {dark}})^4\Big [\frac{\eta _{a}\eta _{b}}{18}+p_{\text {dark}} \Big (\frac{\eta _{a}+\eta _{b}}{3}-\frac{5\eta _{a}\eta _{b}}{9}\Big )+p_{\text {dark}}^{2} (1-\eta _{a})(1-\eta _{b})\Big ].\nonumber \\ \end{aligned}$$

(73)

There are different scenarios that lead to errors in the DPS-MDI protocol. For example, an error occurs when the detector c clicks in time-bins 1 and 2, but $\varDelta \phi _{1}=\pi$. In general, an error arises when clicks corresponding to a successful partial BSM occur due to background noise, but $\varDelta \phi _{i}$ (i=1, 2) is flipped (see Table 1). Dark counts of the single-photon detectors primarily contribute to this background noise. Thus, the error rate due to background noise is given by

$$\begin{aligned} e_{\text {b}}^{'}Y_{11}=8(1-p_{\text {dark}})^4\Big [p_{\text {dark}}\Big (\frac{\eta _{a} +\eta _{b}}{3}-\frac{5\eta _{a}\eta _{b}}{9}\Big )+p_{\text {dark}}^{2}(1-\eta _{a})(1- \eta _{b})\Big ]. \end{aligned}$$

(74)

We assume that the phase misalignment error is same for both $\varDelta \phi _{1}$ and $\varDelta \phi _{2}$, and denote this deviation of $\varDelta \phi _{1}$ and $\varDelta \phi _{2}$ by $\varDelta _{\phi }$. Phase misalignment error arises due to the non-ideal nature of optical phase-locked loop and phase modulators used in the setup. Hence, considering phase misalignment errors, the total error rate is given by,

$$\begin{aligned} e_{\text {b}}Y_{11}=8(1-p_{\text {dark}})^4\Big [\frac{e_{d}\eta _{a}\eta _{b}}{18} +p_{\text {dark}}\Big (\frac{\eta _{a}+\eta _{b}}{3}-\frac{5\eta _{a}\eta _{b}}{9}\Big ) +p_{\text {dark}}^{2}(1-\eta _{a})(1-\eta _{b})\Big ], \end{aligned}$$

(75)

where $e_{d}$ is the variance of $\varDelta _{\phi }$.

1.2 DPS-MDI with decoy states

Here, we calculate the parameters defined in Eq. (11). We assume an infinite number of decoy states to get an accurate estimate of these parameters. Phase randomization is integral to decoy-state analysis. A coherent state is seen as a mixture of Fock states upon phase randomization. This prevents Eve from getting information from multi-photon pulses coming from WCS. Hence, Alice and Bob prepare phase randomized weak coherent states with intensities $\mu _{a}$ and $\mu _{b}$, respectively, of the form,

$$\begin{aligned} |e^{i\theta _{a}}\sqrt{\mu _{a}}\rangle ^{(a)}\otimes |e^{i\theta _{b}}\sqrt{\mu _{b}}\rangle ^{(b)}. \end{aligned}$$

(76)

Here, $\theta _{a}$ and $\theta _{b}$ ($\in [0,2\pi ]$) are the overall randomized phases. Alice and Bob pass their coherent states through their respective delay lines. The construction of the delay line is such that a photon has an equal probability of traversing through each path of the delay line. This implies that when a coherent state $|\sqrt{\mu }\rangle$ with mean photon number $\mu$ passes through a 3-path delay line, each path has a coherent state $|\sqrt{\frac{\mu _{a}}{3}}\rangle$ with mean photon number $\frac{\mu }{3}$ traversing through it. Hence, the joint state after the coherent state passing through the delay line and the phase modulator is given as,

$$\begin{aligned}&\left( \left| e^{i\theta _{a}}\sqrt{\frac{\mu _{a}}{3}}\right\rangle _{a_1}\left| e^{i(\phi _{a_{1}}+\theta _{a})}\sqrt{\frac{\mu _{a}}{3}}\right\rangle _{a_2}\left| e^{i(\phi _{a_{2}}+\theta _{a})}\sqrt{\frac{\mu _{a}}{3}}\right\rangle _{a_3}\right) \nonumber \\&\quad \otimes \left( \left| e^{i\theta _{b}}\sqrt{\frac{\mu _{b}}{3}}\right\rangle _{b_1}\left| e^{i(\phi _{b_{1}}+\theta _{b})}\sqrt{\frac{\mu _{b}}{3}}\right\rangle _{b_2}\left| e^{i(\phi _{b_{2}}+\theta _{b})}\sqrt{\frac{\mu _{b}}{3}}\right\rangle _{b_3}\right) . \end{aligned}$$

(77)

Here, $|\mu \rangle _{a_1}$ represents a coherent state traversing through path 1 of Alice’s delay line (see Fig. 2). We model the lossy channels as beamsplitters and express the joint state arriving at Chales’s beamsplitter as,

$$\begin{aligned}&\left( \left| e^{i\theta _{a}}\sqrt{\frac{\eta _{a}\mu _{a}}{3}}\right\rangle _{a_{1}} \left| e^{i(\phi _{a_{1}}+\theta _{a})}\sqrt{\frac{\eta _{a}\mu _{a}}{3}}\right\rangle _{a_{2}} \left| e^{i(\phi _{a_{2}}+\theta _{a})}\sqrt{\frac{\eta _{a}\mu _{a}}{3}} \right\rangle _{a_{3}}\right) \nonumber \\&\quad \otimes \left( \left| e^{i\theta _{b}}\sqrt{\frac{\eta _{b}\mu _{b}}{3}}\right\rangle _{b_{1}}\left| e^{i(\phi _{b_{1}}+\theta _{b})}\sqrt{\frac{\eta _{b}\mu _{b}}{3}}\right\rangle _{b_{2}}\left| e^{i(\phi _{b_{2}}+\theta _{b})}\sqrt{\frac{\eta _{b}\mu _{b}}{3}}\right\rangle _{b_{3}}\right) . \end{aligned}$$

(78)

Coherent states can also be expressed as,

$$\begin{aligned} |\sqrt{\mu }\rangle = D(\sqrt{\mu })|0\rangle , \end{aligned}$$

(79)

where $D(\sqrt{\mu })$ is the displacement operator, and is given as,

$$\begin{aligned} D(\sqrt{\mu })=e^{(\sqrt{\mu }{a^\dagger }-\sqrt{\mu }^{*}a)}. \end{aligned}$$

(80)

Here, a and $a^\dagger$ are annihilation and creation operators, respectively. The beamsplitter transforms $a^\dagger$ at the input mode as per Eq. (27). The output state of beamsplitter, when the input is Eq. (78) is,

$$\begin{aligned}&\left| e^{i\theta _{a}}\sqrt{\frac{\eta _{a}\mu _{a}}{6}}+e^{i\theta _{b}} \sqrt{\frac{\eta _{b}\mu _{b}}{6}}\right\rangle _{c_{1}}\left| e^{i\theta _{a}}\sqrt{\frac{\eta _{a}\mu _{a}}{6}}-e^{i\theta _{b}} \sqrt{\frac{\eta _{b}\mu _{b}}{6}}\right\rangle _{d_{1}}\nonumber \\&\quad \otimes \left| e^{i(\phi _{a_{1}}+\theta _{a})}\sqrt{\frac{\eta _{a}\mu _{a}}{6}} +e^{i(\phi _{b_{1}}+\theta _{b})}\sqrt{\frac{\eta _{b}\mu _{b}}{6}}\right\rangle _{c_{2}} \left| e^{i(\phi _{a_{1}}+\theta _{a})}\sqrt{\frac{\eta _{a}\mu _{a}}{6}}\right. \nonumber \\&\quad \left. -e^{i(\phi _{b_{1}} +\theta _{b})}\sqrt{\frac{\eta _{b}\mu _{b}}{6}}\right\rangle _{d_{2}}\nonumber \\&\quad \otimes \left| e^{i(\phi _{a_{2}}+\theta _{a})}\sqrt{\frac{\eta _{a}\mu _{a}}{6}} +e^{i(\phi _{b_{2}}+\theta _{b})}\sqrt{\frac{\eta _{b}\mu _{b}}{6}}\right\rangle _{c_{3}} \left| e^{i(\phi _{a_{2}}+\theta _{a})}\sqrt{\frac{\eta _{a}\mu _{a}}{6}}\right. \nonumber \\&\quad \left. -e^{i(\phi _{b_{2}} +\theta _{b})}\sqrt{\frac{\eta _{b}\mu _{b}}{6}}\right\rangle _{d_{3}}. \end{aligned}$$

(81)

Here, $|\sqrt{\mu }\rangle _{c_{1}}$ denotes a coherent state of mean photon number $\mu$ hitting the detector c in time-bin $t_{1}$.

Hence, the probability of a detector clicking in a time-bin is given by,

$$\begin{aligned}&p_{c_1}=1-(1-p_{\text {dark}})\text {exp}\left( -\Big |e^{i\theta _{a}} \sqrt{\frac{\eta _{a}\mu _{a}}{6}}+e^{i\theta _{b}}\sqrt{\frac{\eta _{b}\mu _{b}}{6}} \Big |^{2}\right) , \nonumber \\&p_{d_1}=1-(1-p_{\text {dark}}) \text {exp}\left( -\Big |e^{i\theta _{a}} \sqrt{\frac{\eta _{a}\mu _{a}}{6}}-e^{i\theta _{b}}\sqrt{\frac{\eta _{b}\mu _{b}}{6}} \Big |^{2}\right) , \nonumber \\&p_{c_2}=1-(1-p_{\text {dark}})\text {exp}\left( -\Big |e^{i(\phi _{a_{1}}+\theta _{a})} \sqrt{\frac{\eta _{a}\mu _{a}}{6}}+e^{i(\phi _{b_{1}}+\theta _{b})}\sqrt{\frac{\eta _{b} \mu _{b}}{6}}\Big |^{2}\right) , \nonumber \\&p_{d_2}=1-(1-p_{\text {dark}})\text {exp}\left( -\Big |e^{i(\phi _{a_{1}}+\theta _{a})} \sqrt{\frac{\eta _{a}\mu _{a}}{6}}-e^{i(\phi _{b_{1}}+\theta _{b})}\sqrt{\frac{\eta _{b} \mu _{b}}{6}}\Big |^{2}\right) , \nonumber \\&p_{c_3}=1-(1-p_{\text {dark}})\text {exp}\left( -\Big |e^{i(\phi _{a_{2}}+\theta _{a})} \sqrt{\frac{\eta _{a}\mu _{a}}{6}}+e^{i(\phi _{b_{2}}+\theta _{b})}\sqrt{\frac{\eta _{b} \mu _{b}}{6}}\Big |^{2}\right) , \nonumber \\&p_{d_3}=1-(1-p_{\text {dark}})\text {exp}\left( -\Big |e^{i(\phi _{a_{2}}+\theta _{a})} \sqrt{\frac{\eta _{a}\mu _{a}}{6}}-e^{i(\phi _{b_{2}}+\theta _{b})}\sqrt{\frac{\eta _{b} \mu _{b}}{6}}\Big |^{2}\right) . \end{aligned}$$

(82)

We simplify Eq. (82) by defining following relations:

$$\begin{aligned}&\mu '=\eta _{a}\mu _{a}+\eta _{b}\mu _{b},\nonumber \\&\varDelta _{\theta }=\theta _{a}-\theta _{b},\nonumber \\&x=\sqrt{\eta _{a}\mu _{a}\eta _{b}\mu _{b}}/3, \nonumber \\&y=(1-p_{\text {dark}})e^{-\mu ^{`}/6}. \end{aligned}$$

(83)

Here, $\mu '$ is the average number of photons reaching the measurement unit. $\varDelta _{\theta }$ denotes the phase difference between the overall random phase applied by Alice and Bob. Using Eq. (83), we simplify Eq. (82) as

$$\begin{aligned} \begin{aligned}&p_{c_1}=1-ye^{-x \; cos\varDelta _{\theta }},\\&p_{c_2}= 1-ye^{-x \; cos(\varDelta _{\theta }+\varDelta \phi _{1})},\\&p_{c_3}=1-ye^{-x \; cos(\varDelta _{\theta }+\varDelta \phi _{2})}, \end{aligned} \quad \begin{aligned}&p_{d_1}=1-ye^{x \; cos\varDelta _{\theta }},\\&p_{d_2}=1-ye^{x \; cos(\varDelta _{\theta }+\varDelta \phi _{1})},\\&p_{d_3}=1-ye^{x \; cos(\varDelta _{\theta }+\varDelta \phi _{2})}. \end{aligned} \end{aligned}$$

(84)

$Q_{\mu _{a}\mu _{b}}$ is the overall gain when Alice and Bob, respectively, use an average photon number of $\mu _{a}$ and $\mu _{b}$, and a successful measurement occurs. We can express $Q_{\mu _{a}\mu _{b}}$ for our protocol as,

$$\begin{aligned}&p_{c_1}p_{c_2}\Big (1-p_{c_3}\Big )\Big (1-p_{d_1}\Big )\Big (1-p_{d_2}\Big ) \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{1}=0,\;\varDelta \phi _{2}=0\; \text {or}\;\pi }\nonumber \\&\quad +\,p_{c_1}\Big (1-p_{c_2}\Big )p_{c_3}\Big (1-p_{d_1}\Big )\Big (1-p_{d_2}\Big ) \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{2}=0,\;\varDelta \phi _{1}=0\; \text {or}\;\pi }\nonumber \\&\quad +\Big (1-p_{c_1}\Big )\Big (1-p_{c_2}\Big )\Big (1-p_{c_3}\Big )p_{d_1}p_{d_2} \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{1}=0,\;\varDelta \phi _{2}=0\; \text {or}\;\pi }\nonumber \\&\quad +\Big (1-p_{c_1}\Big )\Big (1-p_{c_2}\Big )\Big (1-p_{c_3}\Big )p_{d_1} \Big (1-p_{d_2}\Big )p_{d_3}\Biggl \vert _{\varDelta \phi _{2}=0,\;\varDelta \phi _{1}=0\; \text {or}\;\pi } \nonumber \\&\quad +\,p_{c_1}\Big (1-p_{c_2}\Big )\Big (1-p_{c_3}\Big )\Big (1-p_{d_1}\Big )p_{d_2} \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{1}=\pi ,\;\varDelta \phi _{2}=0\; \text {or}\;\pi } \nonumber \\&\quad +\Big (1-p_{c_1}\Big )p_{c_2}\Big (1-p_{c_3}\Big )p_{d_1}\Big (1-p_{d_2}\Big ) \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{1}=\pi ,\;\varDelta \phi _{2}=0\; \text {or}\;\pi } \nonumber \\&\quad +\,p_{c_1}\Big (1-p_{c_2}\Big )\Big (1-p_{c_3}\Big )\Big (1-p_{d_1}\Big ) \Big (1-p_{d_2}\Big )p_{d_3}\Biggl \vert _{\varDelta \phi _{2}=\pi ,\;\varDelta \phi _{1}=0\; \text {or}\;\pi } \nonumber \\&\quad +\Big (1-p_{c_1}\Big )\Big (1-p_{c_2}\Big )p_{c_3}p_{d_1}\Big (1-p_{d_2}\Big ) \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{2}=\pi ,\;\varDelta \phi _{1}=0\; \text {or}\;\pi }. \end{aligned}$$

(85)

We substitute Eq. (83) in Eq. (85), and obtain the overall gain for a given realization of $\theta _{a}$, $\theta _{b}$ as,

$$\begin{aligned} Q_{\mu _{a}\mu _{b}}=4y^{4}[e^{2x\;cos\varDelta _{\theta }}+e^{-2x\;cos\varDelta _{\theta }} -2ye^{x\;cos\varDelta _{\theta }}-2ye^{-x\;cos\varDelta _{\theta }}+2y^2]. \end{aligned}$$

(86)

We should average the overall gain obtained in Eq. (86) over the random phases $\theta _{a}$ and $\theta _{b}$. Integrating over $\varDelta _{\theta }$ for Eq. (86) gives the overall gain as,

$$\begin{aligned} Q_{\mu _{a}\mu _{b}}=8y^4[I_{0}(2x)-2yI_{0}(x)+y^{2}]. \end{aligned}$$

(87)

Here, $I_{0}(x)$ is the modified Bessel function of the first kind. Next, we evaluate the gain of the single-photon states ($Q_{11}$) for our protocol. $Q_{11}$ is the probability of a successful BSM, given that both Alice and Bob use weak coherent states with intensities $\mu _{a}$ and $\mu _{b}$, respectively, and send single-photon pulses. We use the Poisson distribution of photon numbers in a coherent state to obtain $Q_{11}$ as,

$$\begin{aligned} Q_{11}=\mu _{a}\mu _{b}e^{-\mu _a-\mu _b}Y_{11}, \end{aligned}$$

(88)

where $Y_{11}$ is obtained through Eq. (73).

The error rate in the sifted key is quantified by the overall QBER ($E_{\mu _{a}\mu _{b}}$). Error occurs in our protocol when correct set of detectors click in the right time-bins (see Table 1) due to dark counts even when Alice and Bob have applied wrong $\varDelta _{\phi _{i}}$ (i=1, 2). For example, clicking of detectors c and d when $\varDelta _{\phi _{1}}=\pi$ leads to error. Hence, the overall QBER can be expressed as,

$$\begin{aligned}&p_{c_1}p_{c_2}\Big (1-p_{c_3}\Big )\Big (1-p_{d_1}\Big )\Big (1-p_{d_2}\Big ) \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{1}=\pi ,\;\varDelta \phi _{2}=0\; \text {or}\;\pi }\nonumber \\&\quad +\,p_{c_1}\Big (1-p_{c_2}\Big )p_{c_3}\Big (1-p_{d_1}\Big )\Big (1-p_{d_2}\Big ) \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{2}=\pi ,\;\varDelta \phi _{1}=0\; \text {or}\;\pi }\nonumber \\&\quad +\Big (1-p_{c_1}\Big )\Big (1-p_{c_2}\Big )\Big (1-p_{c_3}\Big )p_{d_1}p_{d_2} \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{1}=\pi ,\;\varDelta \phi _{2}=0\; \text {or}\;\pi }\nonumber \\&\quad +\Big (1-p_{c_1}\Big )\Big (1-p_{c_2}\Big )\Big (1-p_{c_3}\Big )p_{d_1} \Big (1-p_{d_2}\Big )p_{d_3}\Biggl \vert _{\varDelta \phi _{2}=\pi ,\;\varDelta \phi _{1}=0\; \text {or}\;\pi } \nonumber \\&\quad +\,p_{c_1}\Big (1-p_{c_2}\Big )\Big (1-p_{c_3}\Big )\Big (1-p_{d_1}\Big )p_{d_2} \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{1}=0,\;\varDelta \phi _{2}=0\; \text {or}\;\pi } \nonumber \\&\quad +\Big (1-p_{c_1}\Big )p_{c_2}\Big (1-p_{c_3}\Big )p_{d_1}\Big (1-p_{d_2}\Big ) \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{1}=0,\;\varDelta \phi _{2}=0\; \text {or}\;\pi } \nonumber \\&\quad +\,p_{c_1}\Big (1-p_{c_2}\Big )\Big (1-p_{c_3}\Big )\Big (1-p_{d_1}\Big ) \Big (1-p_{d_2}\Big )p_{d_3}\Biggl \vert _{\varDelta \phi _{2}=0,\;\varDelta \phi _{1}=0\; \text {or}\;\pi } \nonumber \\&\quad +\Big (1-p_{c_1}\Big )\Big (1-p_{c_2}\Big )p_{c_3}p_{d_1}\Big (1-p_{d_2}\Big ) \Big (1-p_{d_3}\Big )\Biggl \vert _{\varDelta \phi _{2}=0,\;\varDelta \phi _{1}=0\; \text {or}\;\pi }. \end{aligned}$$

(89)

Substituting Eq. (83) in Eq. (89),

$$\begin{aligned} E^{'}_{\mu _{a}\mu _{b}}Q_{\mu _{a}\mu _{b}}=8y^4[1-ye^{x\;cos\varDelta _{\theta }}-ye^{-x\;cos \varDelta _{\theta }}+y^2]. \end{aligned}$$

(90)

Averaging over $\varDelta _{\theta }$ in Eq. 90, we get

$$\begin{aligned} E^{'}_{\mu _{a}\mu _{b}}Q_{\mu _{a}\mu _{b}}=8y^4[1-2yI_{0}(x)+y^2]. \end{aligned}$$

(91)

1.3 Phase randomization with post selection

As evident from Fig. 4, phase randomization leads to a high intrinsic QBER. To reduce the QBER, Alice and Bob divide the overall phase into different splices as per Eq. (13). They announce the segment that they used for phase randomization while sifting. This improved data processing [66] reduces the cost of error correction (cf. Eq. (12)).

$$\begin{aligned} I_{\text {ec}}=\sum \limits _{m=0}^{N-1}Q^mfH(E^{m}) \end{aligned}$$

(92)

We assume that Alice picks up one slice out of N slices randomly and Bob always select the first phase slice. Hence, for estimation the overall gain Eq. (86) needs to be averaged over $\varDelta _{\theta }$ from $\frac{m\pi }{N}$ to $\frac{(m+1)\pi }{N}$, i.e.,

$$\begin{aligned} Q^m= & {} \frac{N}{\pi }\int \limits _{0}^{\pi /N}d\theta _{b}\frac{1}{\pi } \int \limits _{m\pi /N}^{(m+1)\pi /N}d\theta _{a}\times 4y^{4}\left[ e^{2x\;cos\varDelta _{\theta }} +e^{-2x\;cos\varDelta _{\theta }}\right. \nonumber \\&\left. -2ye^{x\;cos\varDelta _{\theta }}-2ye^{-x\;cos\varDelta _{\theta }}+2y^2\right] . \end{aligned}$$

(93)

Similarly, we can write the QBER as

$$\begin{aligned} E^{'m}_{\mu _{a}\mu _{b}}Q^{m}_{\mu _{a}\mu _{b}}=\frac{N}{\pi }\int \limits _{0}^{\pi /N}d \theta _{b}\frac{1}{\pi }\int \limits _{m\pi /N}^{(m+1)\pi /N}d\theta _{a}\times 8y^4[1-ye^{x\;cos\varDelta _{\theta }}-ye^{-x\;cos\varDelta _{\theta }}+y^2]. \end{aligned}$$

(94)

Finally, we perform a numerical integration to evaluate the QBER.