# Security of quantum key distribution with detection-efficiency mismatch in
the multiphoton case

A.S. Trushechkin  Steklov Mathematical Institute of Russian Academy of
Sciences, Moscow 119991, Russia

(August 27, 2024)

###### Abstract

The detection-efficiency mismatch is a common problem in practical quantum key
distribution (QKD) systems. The security of quantum key distribution in this
case is proved only under the assumption that either the output of the sender
side or the input to the receiver side are single-photon signals, which impose
a restriction over the class of possible eavesdropping strategies. Here we
present a security proof without such a restriction and, thus, solve this
important problem and prove the security of quantum key distribution with
detection-efficiency mismatch against general attacks. In particular, we
propose an adaptation of the decoy state method to the case of detection-
efficiency mismatch.

##  I Introduction

Quantum key distribution (QKD) is aimed to provide unconditionally secure
communication. The notion of unconditional security means that an eavesdropper
is allowed to have unlimited computational power. In theory, the eavesdropper
is restricted only by quantum mechanics. The first QKD protocol was discovered
by Bennett and Brassard in 1984 BB84  and is thus called the BB84 protocol. A
number of unconditional security proofs for the BB84 protocol were proposed
Mayers0 ; Mayers ; ShorPreskill ; Renner ; Koashi ; GisinRenner ; Toma , which
gave rise to a beautiful mathematical theory.

Security proofs for practical implementations of QKD protocols (rather than
theoretic schemes) faces with various problems caused by certain imperfections
in apparatus Gisin ; Scarani ; nature2016 , which should be taken into account
in security proofs. This paper is devoted to the problem of the efficiency
mismatch between different threshold single-photon detectors.

In the BB84 protocol (as well as in other discrete-variable QKD protocols)
information is encoded in the polarization or phase of weak coherent pulses
simulating true single-photon states. Single-photon detectors are used on the
receiver side to read the information encoded in such states. Ideally, a
single-photon detector fires whenever it is hit by at least one photon.
However, a realistic detector is triggered by one photon only with a certain
probability $0<\eta\leq 1$, which is referred to as the efficiency of a
detector. Typical value of $\eta$ for the detectors used in practical QKD
systems (based on avalanche photodiodes) is 0.1. The detectors based on
superconductors have $\eta\approx 0.9$, but they are more expensive and
require cryogenic temperatures.

In this paper we will consider the BB84 protocol with the active basis choice.
In this case, two single-photon detectors are used on the receiver side: One
for the signals encoding bit 0 and one for the signals encoding bit 1,
respectively. Imperfect efficiencies of the detectors, i.e., $\eta<1$, is not
a problem whenever the efficiencies of the detectors coincide with each other,
because the loss in the detection rate can be treated as a part of
transmission loss followed by ideal detectors with perfect efficiency. But
there is an even a small difference of the detectors’ efficiencies make the
aforementioned security proofs inapplicable. Since now the detection loss is
different for different detectors, we cannot anymore treat the detection loss
as a part of the transmission loss. This is a serious problem since, in
practice, it is hard to build two detectors with exactly the same
efficiencies.

Detection-efficiency mismatch leads to unequal frequencies of zeros and ones
in the so called raw key. Indeed, if, for example, the efficiency of the
detector for the signals encoding bit 0 is higher than that of the detector
for the signals encoding bit 1, then the frequency of zeros will be greater
then the frequency of ones. This gives a priori information on the raw key to
the eavesdropper. Analysis of possible attacks on a QKD protocol with such a
priori information is challenging.

The first security proof for the BB84 protocol with detection-efficiency
mismatch was proposed in Ref. Fung . In Ref. Lutk-num , higher secret key
rates for BB84 with detection-efficiency mismatch were obtained numerically,
which were confirmed analytically in Ref. Bochkov . Also the decoy state
method was adopted to the case of detection-efficiency mismatch in Ref.
Bochkov . In all this works an essential restriction on the class of attacks
allowed to the eavesdropper is imposed: she is not allowed to add photons to
single-photon pulses. In other words, the input to the receiver side are
single-photon signals. However, in the general case, the technologically
unlimited eavesdropper can increase the number of photons in the pulses, for
example, to increase the probability of detection of the desired positions on
the receiver side.

In the case of equal detection efficiencies, the reduction of the multiphoton
(infinite-dimensional) input on the receiver side to the single-photon
(finite-dimensional) input is provided by the so called squashing model squash
. Squashing model is a special map from an infinite-dimensional Hilbert space
to a finite-dimensional one, which gives the same statistics of measurement
results. However, there is no squashing model for the detection-efficiency
mismatch case, hence, the multiphoton input on the receiver side should be
analyzed explicitly.

Very recently (during the preparation of this paper) in Ref. Zhang , the
security of the BB84 protocol with detection-efficiency mismatch was analyzed
for the multiphoton input on the receiver side using the numerical
optimization techniques. The security is proved there under a conjecture,
which is confirmed only numerically. Namely, in Ref. Zhang , it is conjectured
that the minimal rate of double clicks for $n>3$ photons on the receiver side
is not smaller than this quantity for $n=3$. A similar conjecture for the
minimal mean error rate is also used. Here we rigorously prove a variant of
such conjecture for the double click rates using the entropic uncertainty
relations, see Proposition 3. So, our Proposition 3 may serve as a lacking
part for the analysis in Ref. Zhang .

Another improvement of our work is the analytic derivation of a formula for
the secret key rate rather than numerical methods. To be more accurate, we
reduce the estimation of secret key rate from below to a problem of
minimization of a one-dimensional convex function, which is much easier than a
multidimensional problem of semidefinite programming used in Ref. Zhang .

The obtained almost explicit formula for the secret key rate allows to
generalize the results to the practical case of weak coherent pulses on the
Alice’s side. Namely, Ref. Zhang  relaxes the assumption that the Bob’s input
is a single photon, but assumes that the Alice’s output is a single photon.
However, as is well-known, in most implementations, Alice sends not true
single-photon states but weak coherent pulses, which make QKD vulnerable to
the photon number splitting attack PNS ; PNS2 . This problem can be fixed by
the decoy-state method, which effectively allows us to bound the number of
multiphoton pulses from above LoMa2005 ; Wang2005 ; MaLo2005 ; Ma2017 ;
Trushechkin2016 . The usual decoy state method is formulated for the case of
no detection-efficiency mismatch. So, a generalization of a security proof for
the BB84 protocol with with detection-efficiency mismatch to the case of weak
coherent pulses is not straightforward. In Bochkov , an adaptation of the
decoy state method to the case of detection-efficiency mismatch was proposed
under the additional assumption that the eavesdropper cannot add the photons
to single-photon pulses. Here we relax this assumption and present an
adaptation of the decoy state method for the case of no detection-efficiency
mismatch and no assumption on the dimensionality of the Bob’s input. The
obtained analytic formula for the case of single-photon Alice’s output is
important for such an adaptation.

Thus, we solve an important problem for practical QKD and prove the security
of the BB84 protocol with detection-efficiency mismatch for the multiphoton
case on both Alice’s output and Bob’s input.

Finally, let us note that a simple random discarding of some detections from
the detector with a higher efficiency, which allows us to balance the number
of ones and zeros in the raw key, does not work. Firstly, this requires the
precise knowledge of both efficiencies, while our method requires only the
knowledge of a lower bound on the ratio $\eta$ of the lower efficiency to the
higher one. Second, in the random discarding scheme, the eavesdropper can
violate the balance the number of ones and zeros by sending many photons. So,
the the random discarding scheme works only under the assumptions of the
single-photon input of the receiver side and the precise knowledge of both
efficiencies.

The following text is organized as follows. In Sec. II we present preliminary
information: the adopted detection model and a brief description of the BB84
protocol. In Sec. III, we formulate the results for the case of single-photon
Alice’s output. In Sec. III, we relax the assumption of single-photon Alice’s
output and present an adaptation of the decoy state method. In Sec. V, we
proof the main theorem (Theorem 1) of Sec. III.

##  II Preliminaries

###  II.1 Detection model

We start with the description of the detection model. We will adopt the common
names for the communication parties: Alice for transmitting side, Bob for the
receiver side, and Eve for the eavesdropper. Alice and Bob are also referred
to as the legitimate parties.

The information is encoded in a quantum state of the two-dimensional single-
photon Hilbert space $\mathbb{C}^{2}$. The elements of the standard basis ($z$
basis) will be denoted as $\ket{0}$ and $\ket{1}$. The elements of the
Hadamard basis ($x$ basis) will be denoted as

$\begin{split}&\ket{+}=\frac{\ket{0}+\ket{1}}{\sqrt{2}}=H\ket{0},\\\
&\ket{-}=\frac{\ket{0}-\ket{1}}{\sqrt{2}}=H\ket{1},\end{split}$ (1)

where $H$ is the so called Hadamard transformation.

The $n$-photon space is $(\mathbb{C}^{2})^{\otimes_{s}n}$, where $\otimes_{s}$
is a symmetrized tensor product. If $n=0$, then
$(\mathbb{C}^{2})^{\otimes_{s}0}=\mathbb{C}\ni\ket{\rm vac}$, where $\ket{\rm
vac}$ is the vacuum vector. The arbitrary number of photons corresponds to the
bosonic Fock space $\mathcal{F}_{\rm
b}(\mathbb{C}^{2})=\bigoplus_{n=0}^{\infty}(\mathbb{C}^{2})^{\otimes_{s}n}$.
Denote $c^{\dagger}_{z0}$ ($c_{z0}$), $c^{\dagger}_{z1}$ ($c_{z1}$),
$c^{\dagger}_{x0}$ ($c_{x0}$), and $c^{\dagger}_{x1}$ ($c_{x_{1}}$) the
creation (annihilation) operators of a photon in the states $\ket{0}$,
$\ket{1}$, $\ket{+}$, and $\ket{-}$, respectively. They are related to each
other as

$c_{xa}=\frac{c_{z0}+(-1)^{a}c_{z1}}{\sqrt{2}},\quad a=0,1.$ (2)

Denote

$\ket{n_{0},n_{1}}_{b}=\frac{(c_{b0}^{\dagger})^{n_{0}}}{\sqrt{n_{0}!}}\frac{(c_{b1}^{\dagger})^{n_{1}}}{\sqrt{n_{1}!}}\ket{\rm
vac}.$ (3)

The $\mathbb{C}^{2}$ space is naturally embedded into $\mathcal{F}_{\rm
b}(\mathbb{C}^{2})$ if we identify $\ket{a}=c^{\dagger}_{za}\ket{\rm vac}$ and
$H\ket{a}=c^{\dagger}_{xa}\ket{\rm vac}$, $a\in\\{0,1\\}$.

Consider the case of the perfect detection, i.e., each detector fires whenever
it is hit by at least one photon. Then the measurement in the basis
$b\in\\{z,x\\}$ is described by the probability operator valued measure (POVM)
$\\{\tilde{P}_{\varnothing},\tilde{P}_{0},\tilde{P}_{1},\tilde{P}_{01}\\}$,
where the operators correspond to four possible outcomes: no click, only
detector 0 clicks, only detector 1 clicks, and both detector clicks (double
click), and

$\begin{split}&\tilde{P}_{\varnothing}=\ket{\rm vac}\bra{\rm vac},\\\
&\tilde{P}^{(b)}_{0}=\sum_{n_{0}=1}^{\infty}\ket{n_{0},0}_{b}\bra{n_{0},0},\\\
&\tilde{P}^{(b)}_{1}=\sum_{n_{1}=1}^{\infty}\ket{0,n_{1}}_{b}\bra{0,n_{1}},\\\
&\tilde{P}^{(b)}_{01}=\sum_{n_{0},n_{1}=1}^{\infty}\ket{n_{0},n_{1}}_{b}\bra{n_{0},n_{1}}.\\\
\end{split}$ (4)

Now let us describe the imperfect detection. Let $\eta_{0}$ and $\eta_{1}$ be
the efficiencies of the detectors and, say, $0<\eta_{1}\leq\eta_{0}\leq 1$. As
shown in Ref. EntanglVerif , the efficiencies can be renormalized as
$\eta^{\prime}_{0}=1$ and $\eta^{\prime}_{1}=\eta_{1}/\eta_{0}=\eta$. The
common loss $1-\eta_{0}$ in both detectors can be treated as additional
transmission loss. So, without loss of generality we assume that $\eta_{0}=1$
and $\eta_{1}=\eta$, $0<\eta\leq 1$. Then the imperfect detection can be
described by the POVM $\\{P_{\varnothing},P_{0},P_{1},P_{01}\\}$:

$\begin{split}&P_{\varnothing}=\sum_{n_{1}=0}^{\infty}(1-\eta)^{n_{1}}\ket{0,n_{1}}_{b}\bra{0,n_{1}},\\\
&P^{(b)}_{0}=\sum_{n_{0}=1}^{\infty}\sum_{n_{1}=0}^{\infty}(1-\eta)^{n_{1}}\ket{n_{0},n_{1}}_{b}\bra{n_{0},n_{1}},\\\
&P^{(b)}_{1}=\sum_{n_{1}=1}^{\infty}[1-(1-\eta)^{n_{1}}]\ket{0,n_{1}}_{b}\bra{0,n_{1}},\\\
&P^{(b)}_{01}=\sum_{n_{0},n_{1}=1}^{\infty}[1-(1-\eta)^{n_{1}}]\ket{n_{0},n_{1}}_{b}\bra{n_{0},n_{1}}.\\\
\end{split}$ (5)

The mismatch parameter $\eta$ is assumed to be constant and known to both
legitimate parties and the eavesdropper. Denote also

$\theta_{n}=1-(1-\eta)^{n}$ (6)

since this quantity will be widely used.

###  II.2 Brief description of the BB84 protocol

In this subsection we briefly describe the BB84 protocol. For more details
see, e.g., Refs. Gisin ; Scarani ; Fung2018 . We start with the
prepare&measure formulation, where Alice prepares single-photon states and
send them to Bob, who measures them.

(1) Alice randomly generates $N$ bases $\mathbf{b}=b_{1}\ldots b_{N}$,
$b_{i}\in\\{z,x\\}$. These random bases are independent and identically
distributed. Denote $p_{z}$ and $p_{x}=1-p_{z}$ probabilities of the $z$ basis
and the $x$ basis. Bob also randomly generates $N$ bases
$\mathbf{b}^{\prime}=b^{\prime}_{1}\ldots b^{\prime}_{N}$,
$b^{\prime}_{i}\in\\{z,x\\}$ with the same distribution (independent of
Alice’s choices).

(2) Alice randomly generates a large number $N$ of bits
$\mathbf{a}=a_{1}\ldots a_{N}$, $a_{i}\in\\{0,1\\}$. These random bits are
independent and uniformly distributed. Then Alice prepares $N$ quantum states
$\ket{a_{i}}\in\mathbb{C}^{2}$ for $b_{i}=z$ and $H\ket{a_{i}}$ for $b_{i}=x$,
$i=1,\ldots,N$, and sends them to Bob. Bob measures them according to POVM (4)
with $b=b_{i}$ for a given position $i$ and record the results
$\mathbf{a}^{\prime}=a^{\prime}_{1}\ldots a^{\prime}_{N}$: no click
corresponds to $a^{\prime}_{i}=\varnothing$, a click of the detector 0 or 1
corresponds to $a^{\prime}_{i}=0$ or $a^{\prime}_{i}=1$, respectively. In case
of a double click, Bob randomly (with equal probabilities) chooses
$a^{\prime}_{i}=0$ or $a^{\prime}_{i}=1$. But also he can also record the
positions where double clicks were obtained. The strings $\mathbf{a}$ and
$\mathbf{a}^{\prime}$ are referred to as the raw keys.

(3) Using a public authentic classical channel, Alice and Bob announce their
bases (the strings $\mathbf{b}$ and $\mathbf{b}^{\prime}$), also Bob announces
the positions where he has obtained a click (no matter single or double). We
adopt a version of the protocol where only the $z$ basis is used for key
generation. So, Alice and Bob keep positions where $b_{i}=b^{\prime}_{i}=z$
and Bob obtain a click. Denote the strings with only such positions as
$\tilde{\mathbf{a}}$ and $\tilde{\mathbf{a}}^{\prime}$, which are referred to
as the sifted keys. The other (dropped) positions still can be used to obtain
statistics required for the estimation of the achievable key generation rate.

(4) Communicating over the public authentic classical channel, Alice and Bob
estimate the Eve’s information about the Alice’s sifted key and either abort
the protocol (if this information is too large) or perform procedures of error
correction and privacy amplification to obtain a final key. The former allows
to fix the discrepancies between their sifted keys. Here we adopt a version
where positions where $\tilde{a}_{i}\neq\tilde{a}^{\prime}_{i}$ are treated as
Bob’s errors. During the error correction procedure, Bob corrects these errors
and obtain a key, which is identical to the Alice’s one, i.e.,
$\tilde{\mathbf{a}}$.

In the privacy amplification procedure, Alice and Bob apply to the sifted key
a randomly generated special map (a hash function) to obtain a shorter key,
which is a final key. Alice and Bob are required to have an upper bound for
the Eve’s information about the Alice’s sifted key $\tilde{\mathbf{a}}$ (or,
equivalently, a lower bound on the Eve’s ignorance about the Alice’s sifted
key) to calculate the length $l$ of the final key such that the eavesdropper
has only an infinitesimal (as $N\to\infty$) information about the final key.
The corresponding ratio $l/N$ will be referred to as the secret key rate. See
Ref. DW  for a formal definition. Here we do not need a formal definition.
Actually, we will use formula (12) below as a starting formula for the secret
key rate. Note that sometimes secret key ratio is defined as a ratio of $l$ to
the length of the sifted key (rather than the raw one).

In this paper, we consider only asymptotic case $N\to\infty$ and do not
address the finite-key effects. In this case, we can put $p_{x}\sim
1/\sqrt{N}\to 0$, $p_{z}\to 1$.

$\rho_{AB}$ is distributed among the legitimate parties. The Alice’s
measurement result encodes the information about which state Alice prepared.
The step (2) of the protocol is replaced by the following: The source of
entangled states generates a state

For mathematical analysis of the security of the protocol, it is convenient to
reformulate it in terms of the equivalent entanglement-based version. In the
entanglement-based version of the protocol, step (2) in the description above
is altered. Alice does not generate the string $\mathbf{a}$ and does not
prepare and send quantum states. Instead, a source of entangled states
generates a state

$\rho_{AB}=\ket{\Phi^{+}}\bra{\Phi^{+}}$ (7)

on the Hilbert space $\mathbb{C}^{2}\otimes\mathcal{F}(\mathbb{C}^{2})$, where

$\begin{split}\ket{\Phi^{+}}&=\frac{1}{\sqrt{2}}(\ket{0}\otimes\ket{1,0}_{z}+\ket{1}\otimes\ket{0,1}_{z})\\\
&=\frac{1}{\sqrt{2}}(\ket{+}\otimes\ket{1,0}_{x}+\ket{1}\otimes\ket{0,1}_{x})\in\mathbb{C}^{2}\otimes\mathcal{F}(\mathbb{C}^{2}).\end{split}$

and sends the first part to Alice and the second qubit to Bob. Then, like Bob,
Alice perform a measurement in the basis $b_{i}$ (POVM $\\{\ket{0},\ket{1}\\}$
for the $z$ basis and $\\{\ket{0},\ket{1}\\}$ for the $x$ basis) and records
the result $a_{i}$. Since Alice’s measurement is virtual, her measurement
corresponds to detectors with the perfect efficiencies.

In the entanglement-based QKD Eve is assumed to control the source of
entangled states, i.e., she can replace the density operator $\rho_{AB}$ given
in (7) by her own arbitrary density operator $\rho_{ABE}$ acting on the
Hilbert space
$\mathbb{C}^{2}\otimes\mathcal{F}(\mathbb{C}^{2})\otimes\mathcal{H}_{E}\equiv\mathcal{H}_{A}\otimes\mathcal{H}_{B}\otimes\mathcal{H}_{E}$,
where $\mathcal{H}_{E}$ is an arbitrary separable Hilbert space. Eve is
assumed to own the additional register $E$ corresponding to the space
$\mathcal{H}_{E}$. The transmission loss in the original prepare&measure
formulation can be included in the state $\rho_{ABE}$. But the detection loss
is basis-dependent in the case of the detection-efficiency mismatch and cannot
be included in $\rho_{ABE}$.

##  III Formulation of results for the case of single-photon Alice’s output

###  III.1 Problem statement

Let us adopt the following common agreement: For any tripartite state
$\rho_{ABE}$, the notations like $\rho_{AB}$, $\rho_{B}$, etc. mean
$\rho_{AB}=\operatorname{Tr}_{E}\rho_{ABE}$,
$\rho_{B}=\operatorname{Tr}_{AE}\rho_{ABE}$, etc. Denote
$\mathfrak{T}(\mathcal{H})$ the space of trace-class operators on a Hilbert
space $H$. If $\Phi$ is a quantum transformation acting on, for example, Bob’s
Hilbert space, i.e., $\Phi$ is a linear map from
$\mathfrak{T}(\mathcal{F}(\mathbb{C}^{2}))$ to itself, then
$\Phi(\rho_{ABE})\equiv({\rm Id}_{A}\otimes\Phi\otimes{\rm
Id}_{E})(\rho_{ABE})$ with Id being the identity quantum transformation on the
corresponding Hilbert space.

Noe let, as before, $\rho_{ABE}$ is a tripartite state corresponding to a
sending. Denote

$\rho^{\prime}_{ABE}=\mathcal{G}(\rho_{ABE})\equiv G\rho_{ABE}G,$ (8)

where

$G=\sqrt{I_{B}-P_{\varnothing}^{(z)}}.$ (9)

$I_{A,B,E}$ are the identity operators in the corresponding Hilbert spaces.
This transformation correspond to the following partial measurement: Instead
of full measurement in the $z$ basis described by Eq. (5), we just check
whether we obtain a detection or not. If we do not obtain a detection, we sift
this position out. In other words, Eq. (8) is a post-selection map. Then

$p_{\rm det}=\operatorname{Tr}\rho^{\prime}_{ABE}$

is the detection probability for Bob if he measures in the $z$ basis. Since
Bob announces the positions where he has obtained a click, this quantity is
known to the legitimate parties. Denote also
$\tilde{\rho}^{\prime}_{ABE}=p_{\rm det}^{-1}\rho^{\prime}_{ABE}$.

Alice’s measurement in the $z$ basis and the $x$ basis correspond to the
transformations

$\begin{split}\tilde{\rho}^{\prime}_{ABE}&\mapsto\mathcal{Z}(\tilde{\rho}^{\prime}_{ABE})=\tilde{\rho}^{\prime}_{ZBE},\\\
\tilde{\rho}^{\prime}_{ABE}&\mapsto\mathcal{X}(\tilde{\rho}^{\prime}_{ABE})=\tilde{\rho}^{\prime}_{XBE},\end{split}$
(10)

where

$\begin{split}\mathcal{Z}(\rho_{ABE})&=\sum_{a=0}^{1}(\ket{a}\bra{a}\otimes
I_{BE})\rho_{ABE}(\ket{a}\bra{a}\otimes I_{BE}),\\\
\mathcal{X}(\rho_{ABE})&=(H\otimes I_{BE})\mathcal{Z}(\rho_{ABE})(H\otimes
I_{BE})\end{split}$ (11)

with $I_{BE}$ being the identity operator on
$\mathcal{H}_{B}\otimes\mathcal{H}_{E}$.

According to Devetak and Winter theorem DW , the secret key rate is given by

$K=p_{\rm
det}[H(Z|E)_{\tilde{\rho}^{\prime}}-H(Z|B)_{\tilde{\rho}^{\prime}}],$ (12)

where the conditional von Neumann entropies are calculated for the state
$\tilde{\rho}^{\prime}_{ZBE}$. Here we have taken into account that only the
positions where both legitimate parties used $z$ basis, participate in the
sifted key and $p_{z}\to 1$ as $N\to\infty$.

The first and the second terms in the brackets in Eq. 12 characterize Eve’s
and Bob’s ignorances about Alice’s sifted key bit, respectively. Here we
assume that the length of the error-correcting syndrome is given by the
Shannon theoretical limit. Otherwise, a factor $f>1$ should be added to the
second term. The present-day error-correcting codes allow for $f=1.22$. A
method of using of the low-density parity-check codes in QKD, which allows us
to decrease the factor $f$, is given in Refs. SymBl1 ; SymBl2 . A syndrome-
based QBER estimation algorithm, which also can decrease $f$, is proposed in
Ref. fly .

Using the Fano’s inequality, the second term in the right-hand side of Eq.
(12) is bounded from above by $h(Q_{z})$, where $h(x)=-x\log x-(1-x)\log(1-x)$
($\log\equiv\log_{2}$) is the binary entropy and $Q_{z}$ is the quantum bit
error rate (QBER), i.e., error ratio in the $z$ basis. This value is observed
by Alice and Bob, hence, thus term is known by the legitimate parties.
Formally, $Q_{z}$ is defined as

$Q_{z}=p_{\det}^{-1}\operatorname{Tr}(\rho_{AB}\ket{0}\bra{0}\otimes
P_{1}^{(z)}+\ket{1}\bra{1}\otimes P_{0}^{(z)})$ (13)

But the first term (Eve’s ignorance) since the state $\rho_{ABE}$ is chosen by
Eve and is unknown to Alice and Bob. They should estimate Eve’s ignorance from
below using the registration statistics. To simplify the problem and eliminate
the dependence of the right-hand side of Eq. (12) from the Eve’s subsystem, we
apply the entropic uncertainty relations BertaEUR ; ColesEUR :

$H(Z|E)_{\tilde{\rho}^{\prime}}+H(X|B)_{\tilde{\rho}^{\prime}}\geq 1,$ (14)

where the second conditional entropy is calculated for the state
$\tilde{\rho}^{\prime}_{XBE}$, or, equivalently, $\tilde{\rho}^{\prime}_{XB}$.

So, the secret key rate is given by

$K=p_{\rm
det}[1-\max_{\rho_{AB}\in\mathbf{S}}H(X|B)_{\tilde{\rho}^{\prime}}-h(Q_{z})],$
(15)

where

$\mathbf{S}=\\{\rho_{AB}\in\mathfrak{T}(\mathcal{H}_{A}\otimes\mathcal{H}_{B})\|\,\rho\geq
0,\>\operatorname{Tr}\Gamma_{i}\rho_{AB}=\gamma_{i},\\\ i=1,\ldots,m\\}.$ (16)

Here $\Gamma_{i}$ are linear operators acting on
$\mathcal{H}_{A}\otimes\mathcal{H}_{B}$ corresponding to observables of Alice
and Bob. They impose constraints on $\rho_{AB}$ since the latter should be
consistent with the observed data.

Note that, in Eq. (15), we should estimate Bob’s ignorance about Alice’s
outcome in the $x$ basis for the state $\tilde{\rho}^{\prime}_{AB}$ after the
attenuation corresponding to the measurement in the $z$ basis, see Eq. (8). In
the case of equal detector efficiencies, Alice and Bob can estimate this
entropy in the same way as the last term $H(Z|B)$ in Eq. (12). Namely, Bob
just measures his state in the $x$ basis, calculates the ratio of
discrepancies between his and the Alice’s results, and use the Fano’s
inequality for the estimation of $H(X|B)$. But in the case of the detection-
efficiency mismatch he cannot proceed in such a way! Indeed, now the detection
loss is basis-dependent, and the imperfect measurement in the $x$ basis leads
to the state $G^{(x)}\rho_{AB}G^{(x)}$, where
$G^{(x)}=\sqrt{I_{B}-P_{\varnothing}^{(x)}}$ instead of
$\rho^{\prime}_{AB}=G\rho_{AB}G$, where $G$ is given by (9). This is the main
difficulty of the analysis of security for the case of detection-efficiency
mismatch. The inconsistency of the phase error rate with the bit error rate in
the $x$ basis is a common problem for QKD with device imperfections GLLP .

Also note that the conditional entropy can be expressed as

$H(X|B)_{\tilde{\rho}^{\prime}}=-D(\tilde{\rho}^{\prime}_{XB}\|I_{A}\otimes\tilde{\rho}^{\prime}_{B}),$
(17)

where
$D(\sigma\|\tau)=\operatorname{Tr}\sigma\log\sigma-\operatorname{Tr}\sigma\log\tau$
is the quantum relative entropy, which is a jointly convex function. So,
problem (15) is in a convex minimization problem subject to linear
constraints. In the case of finite-dimensional
$\mathcal{H}_{A}\otimes\mathcal{H}_{B}$, it can be solved numerically, as was
proposed in Refs. Lutk-num ; Lutk-num-pre . But we have an infinite-
dimensional $\mathcal{H}_{B}$, so, analytic bounds for $H(X|B)$ are required.

###  III.2 Main theorem and simulation

Consider the following linear constraints:

(1) Probability of detection (for the $z$ basis)

$\Gamma_{1}=I_{A}\otimes(I_{B}-P_{\varnothing}^{(z)}),\quad\operatorname{Tr}\Gamma_{1}\rho_{AB}=p_{\rm
det}.$ (18)

(2) Weighted mean erroneous detection rate in the $x$ basis

$\displaystyle\Gamma_{2}$
$\displaystyle=\eta^{-1}\ket{+}\bra{+}\otimes\left(P^{(x)}_{1}+\frac{1}{2}P^{(x)}_{01}\right)$
(19)
$\displaystyle+\ket{-}\bra{-}\otimes\left(P^{(x)}_{0}+\frac{1}{2}P^{(x)}_{01}\right),\>\operatorname{Tr}\Gamma_{2}\rho_{AB}=q.$

This means that in case of double click, a bit value 0 or 1 is assigned with
equal probabilities, but we consider a weighted sum: erroneous ones are taken
with the weight $\eta^{-1}$ and erroneous zeros are taken with the weight 1.
Also note $q$ this is not the usual QBER. This is a weighted probabilities for
erroneous detection rather than the ration of erroneous detections to all
detections (see Eq. (13).

(3) Probability of a single click of the detector 1 for the measurement in the
$z$ basis

$\Gamma_{3}=I_{A}\otimes
P^{(z)}_{1},\quad\operatorname{Tr}\Gamma_{3}\rho_{AB}=p_{1}.$ (20)

(4) Mean probability of a double click

$\Gamma_{4}=I_{A}\otimes\frac{1}{2}(P^{(z)}_{01}+P^{(x)}_{01}),\quad\operatorname{Tr}\Gamma_{3}\rho_{AB}=p_{\rm
dc}.$ (21)

Let us define also the following quantities:

(1) $p_{01}^{\rm min}$ as the unique root of the equation

$2p_{01}^{\rm min}\log 3+2h(p_{01}^{\rm min})=1.$ (22)

Numerically, $p_{\rm dc}^{\rm min}\approx 0.06$ ($p_{\rm dc}^{\rm min}>0.06$).

(2) The two-photon contribution to the probability of detection $p_{\rm
det}^{(2)}$ – a free variable over which the secret key rate is minimized.

(3) Upper bound on the three- and more photon contribution to the probability
of detection:

$p_{\rm det}^{(3+),\rm U}=\frac{p_{01}}{\eta p_{01}^{\rm min}}.$ (23)

(4) Lower bound on the single-photon contribution to the probability of
detection:

$p_{\rm det}^{(1),\rm L}=p_{\rm det}-p_{\rm det}^{(2)}-p_{\rm det}^{(3+),\rm
U}.$ (24)

(5) Upper bound on the two-photon contribution to the probability of a single
click of detector 1:

$p_{1}^{(2),\rm U}=\frac{p_{\rm det}^{(2)}}{2}+\sqrt{\frac{2p_{01}p_{\rm
det}^{(2)}}{\eta\theta_{2}}}.$ (25)

(6) Lower bound on the single-photon contribution to the probability of a
single click of detector 1:

$p_{1}^{(1),\rm L}=p_{1}-p_{1}^{(2),\rm U}-p_{\rm det}^{(3+),\rm U}.$ (26)

(7) Lower bound on the single-photon contribution to the detection probability
in the case of perfect (no mismatch) detection:

$t_{1}^{\rm L}=p_{\rm det}^{(1),\rm L}-p_{1}^{(1),\rm
L}\left(\frac{1}{\eta}-1\right).$ (27)

(8) Lower bound on the two-photon contribution to the weighted mean erroneous
detection rate in the $x$ basis:

$q_{2}^{\rm L}=\frac{(1+\theta_{2})p_{\rm
det}^{(2)}}{4}-\sqrt{\frac{2p_{01}p_{\rm det}^{(2)}}{\eta\theta_{2}}}.$ (28)

(9) Upper bound on single-photon contribution to the weighted mean erroneous
detection rate in the $x$ basis:

$q_{1}^{\rm U}=q-q_{2}^{\rm L}.$ (29)

(10) Upper bound on the two-photon contribution to the probability of
detection $p_{\rm det}^{(2),\rm U}$. It is defined as a maximal value such
that $p_{\rm det}^{(2),\rm U}<p_{\rm det}^{(2),\rm U}\leq p_{\rm det}-p_{\rm
det}^{(3),\rm U}$ and $\sqrt{\eta}(t_{1}^{\rm L}-2q_{1}^{\rm U})\leq p_{\rm
det}^{(1),\rm L}$. In view of Eqs. (23)–(29), $p_{\rm det}^{(2),\rm U}$ can be
explicitly found by solving a quadratic equation.

######  Theorem 1.

Suppose that $q_{1}^{\rm U}<t_{1}^{\rm L}/2$ for all $p_{\rm
det}^{(2)}\in\left[0,p_{\rm det}^{(2),\rm U}\right]$. Then the secret key rate
(15) subject to constraints (18)–(21) is lower bounded by

$K\geq\min_{p_{\rm det}^{(2)}}p^{(1),\rm L}_{\rm
det}\left[1-h\left(\frac{1-\delta_{x}^{\rm L}}{2}\right)\right]-p_{\rm
det}h(Q_{z}),$ (30)

where

$\delta_{x}^{\rm L}=\frac{\sqrt{\eta}(t_{1}^{\rm L}-2q_{1}^{\rm
U})}{p^{(1),\rm L}_{\rm det}}.$ (31)

The minimization is performed over the segment $p_{\rm
det}^{(2)}\in\left[0,p_{\rm det}^{(2),\rm U}\right]$. The expression under
minimization in Ineq. (30) is a convex function of $p_{\rm det}^{(2)}$.

The calculations of the secret key rate with formula (30) are presented on
Fig. 1. For the simulation, we assumed that

$\rho_{AB}=(1-2Q)\ket{\Phi^{+}}\bra{\Phi^{+}}+2Q\frac{I_{2}}{2},$ (32)

where $0\leq Q\leq 1$ and $I_{2}$ is an identity operator in the qubit space.
In the case of perfect detection, $Q$ is a probability of error for both
bases. The right-hand side of Eq. (32) is an action of the depolarizing
channel on the state given by Eq. (7). The depolarizing channel is a commonly
used model for an actual transmission line. We assume that the line introduces
no loss. Otherwise, the right-hand side of Eq. (32) should be multiplied by a
factor $0\leq t\leq 1$. This will lead to a multiplication of the secret key
rate on the same factor $t$. The state given by Eq. (32) gives $p_{\rm
det}=(1+\eta)/2$, $p_{1}=\eta/2$, and $q=Q$. Also we artificially set
$p_{01}=10^{-5}$ due to dark counts. Strictly speaking, dark counts should be
taken into account explicitly in the detection model, i.e., in Eqs. (4) and
(5). This will be a subject for a future work.

As an upper bound for the secret key rate we can use a tight bound for a
single-photon Bob’s input, which was obtained obtained in Bochkov , see also
Proposition 2 below with a simplified proof:

$\displaystyle K$ $\displaystyle=$ $\displaystyle p_{\rm
det}\left[h\left(\frac{1-\delta_{z}}{2}\right)-h\left(\frac{1-\sqrt{\delta_{x}^{2}+\delta_{z}^{2}}}{2}\right)\right],$
(33) $\displaystyle K$ $\displaystyle\geq$ $\displaystyle p_{\rm
det}\left[1-h\left(\frac{1-\delta_{x}}{2}\right)\right].$ (34)

where $\delta_{x}$ and $\delta_{z}$ are given by Eq. (63) below. Formula (33)
is the exact value of the secret key rate for the additional restriction
$\rho_{AB}\in\mathfrak{T}(\mathbb{C}^{2}\otimes\mathbb{C}^{2})$, i.e., the
Bob’s input is a single photon. We use it as an upper bound. Formula (34)
gives a simplified and more rough bound. It is important for us because we
used it (rather than Eq. (33)) for the derivation of Eq. (30). From Fig. 1, we
see that, in the practical case of small detection-efficiency mismatch ($\eta$
close to 1), formula (30) gives a secret key rate close to the both Eqs. (33)
and (34).

Figure 1:  Secret key of the BB84 protocol vs the efficiency of one of the
detectors $\eta$ for the case. Another detector and the transmission line are
assumed to be perfect; otherwise, the secret key rate is reduced by a constant
factor. The state $\rho_{AB}$ is given by Eq. (32) with $Q=0.05$. This
correspond to $p_{\rm det}=(1+\eta)/2$, $p_{1}=\eta/2$, and $q=Q$. Also we
artificially set $p_{01}=10^{-5}$ due to dark counts. Solid line: formula
(30). Dashed line: tight bound for the single-photon case (used as an upper
bound for the secret key rate). Dotted line: simplified (more rough) bound for
the single-photon case, which was used in the derivation of formula (30). We
see that for the practical case of small detection-efficiency mismatch ($\eta$
close to 1) formula (30) gives a secret key rate close to the upper bound.

The decrease of secret key rate with the decrease of $\eta$ shown on Figs. 1
is caused by two effects: the decrease of the average detector efficiency
$(1+\eta)/2$ and detection-efficiency mismatch as such. To distinguish the
influence of the mismatch as such, we compare the secret key rates for the
mismatch case with the detector efficiencies 1 and $\eta$ and the no-mismatch
case with both efficiencies equal to $(1+\eta)/2$. The secret key rate for the
latter case is given by

$K=p_{\rm det}[1-2h(Q)].$ (35)

The ratio of the secret key rate in the mismatch case to that in the no-
mismatch case is shown on Fig. LABEL:Fig2. The solid line corresponds to no
errors $Q=0$ and the dashed line corresponds to a high error rate $Q=0.09$.
Recall that $Q\approx 0.11$ is a maximal QBER for which the key distribution
is possible ($1-2h(Q)>0$). The key rate $Q=0.09$ is high in the sense that it
is close to the critical one $Q\approx 0.11$.

We see that first the secret key rate is larger influenced by mismatch for
high QBERs and second, if the mismatch is not very large, then the decrease of
secret key rate is also relatively small even for high QBERs. For example, the
secret key rate for $\eta=0.8$ and $Q=0.09$ is above 90% of the secret key
rate for the no-mismatch case with the same $Q$ and average efficiency.

Figure 2:  Decrease of secret key rate in the detection efficiency-mismatch
case with respect to the no-mismatch case: the ratio of the secret key rate in
the mismatch case with the detector efficiencies 1 and $\eta$ to the secret
key rate in the no-mismatch case with both efficiencies equal to $(1+\eta)/2$.
Solid line: no errors $Q=0$, dashed line: relatively high error rate $Q=0.09$
(close to the critical value for the case of perfect detection $Q=0.11$). If
the mismatch is small, then the decrease of secret key rate is relatively
small even for high QBERs.

##  IV Decoy state method in the case of detection-efficiency mismatch

Now we take into account that Alice sends not true single-photon pulses, but
weak coherent pulses (with the randomized phase). We consider the scheme of
one signal state and two weak decoy states. This means that each Alice’s pulse
can be either a signal pulse with the intensity $\mu_{\rm s}=\mu$ (used for
key generation) or one of two decoy pulses with the intensities $\mu_{\rm
d_{1}}=\nu_{1}$ and $\mu_{\rm d_{2}}=\nu_{2}$, with the conditions
$0\leq\nu_{2}<\nu_{1}$ and $\nu_{1}+\nu_{2}<\mu$.

We follow the method of Ref. MaLo2005 , where a lower bound for the number of
detections originated from the single-photon pulses and an upper bound for the
error rate for the single-photon pulses were derived.

The decoy state method for the case of detection-efficiency mismatch was
developed in Ref. Bochkov . It is observed there that a nice feature of the
decoy state method proposed in Ref. MaLo2005  is that it actually do not
impose any assumptions on the efficiency of detectors. It is based solely on
simple counting of detections and erroneous detections. In principle, the
decoy state estimations are still valid even if Eve to have full control on
the detector efficiencies.

But since the formula for single-photon Alice’s pulses (30) in the case of
detection-efficiency mismatch requires some observables (namely, $p_{1}$ and
$q$) which does not enter in the corresponding formula (35) for the case of no
mismatch, we need to derive the bounds for these observables using the decoy
state method.

Redenote the quntities $p_{\rm det}$, $p_{1}$, $q$, and $p_{01}$ by
${}_{1}p_{\rm det}$, ${}_{1}p_{1}$, ${}_{1}q$, and ${}_{1}p_{01}$ where the
left subindex 1 denotes that these quantities are conditioned on the single-
photon Alice’s pulse (exactly as in Eqs. (18)–(21)). Denote ${}^{v}p_{\rm
det}$, ${}^{v}p_{1}$, ${}^{v}q$, and ${}^{v}p_{01}$ the analogous quantities
conditioned on the event that Alice sends a weak coherent pulse of the type
$v\in\\{\rm s,d_{1},d_{2}\\}$ (i.e., with either the signal intensity $\mu$ or
one of two decoy intensities $\nu_{1}$ and $\nu_{2}$). Finally, denote

$\displaystyle{}_{1}^{\rm s}p_{\rm det}=\mu e^{-\mu}\times{}^{\rm s}p_{\rm
det},\quad{}_{1}^{\rm s}p_{1}=\mu e^{-\mu}\times{}^{\rm s}p_{1},$ (36)
$\displaystyle{}_{1}^{\rm s}q=\mu e^{-\mu}\times{}^{\rm s}q,\quad{}_{1}^{\rm
s}p_{01}=\mu e^{-\mu}\times{}^{\rm s}p_{01}.$ (37)

These quantities has the following meaning: ${}_{1}^{\rm s}p_{\rm det}$ is the
joint probability that a signal pulse contains a single photon and at least
one of the Bob’s detectors clicks (conditioned on the measurement in the basis
$z$), ${}_{1}^{\rm s}p_{1}$ is the joint probability that a signal pulse
contains a single photon and Bob obtains a single click of detector one
(conditioned on the measurement in the basis $z$), etc.

As usual in the decoy state method, we treat multiphoton Alice’s pulses as
insecure. Only signal pulses are used for key generation. Thus, the secret key
rate is then lower bounded by

$K\geq\min_{p_{\rm det}^{(2)}}p^{(1),\rm L}_{\rm
det}\left[1-h\left(\frac{1-\delta_{x}^{\rm L}}{2}\right)\right]-{}^{s}p_{\rm
det}h(Q_{z}),$ (38)

where $p_{\rm det}$, $p_{1}$, $q$, and $p_{01}$ should be substituted by
${}_{1}^{\rm s}p_{\rm det}$, ${}_{1}^{\rm s}p_{1}$, ${}_{1}^{\rm s}q$, and
${}^{\rm s}_{1}p_{01}$ in all quantities (23)–(29). But the quantities
${}_{1}^{\rm s}p_{\rm det}$, ${}_{1}^{\rm s}p_{1}$, ${}_{1}^{\rm s}q$, and
${}_{1}^{\rm s}p_{01}$ are not directly observable. The directly observable
quantities are ${}^{v}p_{\rm det}$, ${}^{v}p_{1}$, ${}^{v}q$, and
${}^{v}p_{01}$, $v\in\\{\rm s,d_{1},d_{2}\\}$.

The right-hand side of Ineq. (38), is an increasing function of $p_{\rm
det}^{(1),\rm L}$, see the end of Sec. V.2. Hence, it is an increasing
function of ${}_{1}p_{\rm det}$. Since it is obviously an increasing function
of $\delta_{x}^{\rm L}$, it is also an increasing function of ${}_{1}^{\rm
s}p_{1}$ and a decreasing function of ${}_{1}^{\rm s}p_{01}$ and ${}_{1}^{\rm
s}q$. Hence, we should estimate ${}_{1}^{\rm s}p_{\rm det}$ and ${}_{1}^{\rm
s}p_{1}$ from below and ${}_{1}^{\rm s}q$ and ${}_{1}^{\rm s}p_{01}$ from
above.

Let us discuss each quantity.

(1) ${}_{1}p_{\rm det}$ is the usual yield of single-photon states (denoted by
$Y_{1}$ in Refs. MaLo2005  and Ma2017 ), ${}^{v}p_{\rm det}$ is the overall
gain of the signal states (denoted by $Q_{\mu}$, $Q_{\nu_{1}}$ and
$Q_{\nu_{2}}$ in Ref. MaLo2005  and by $Q^{v}$ in Ref. Ma2017 ), and
${}_{1}^{\rm s}p_{\rm det}$ is the single-photon contribution to ${}^{\rm
s}p_{\rm det}$ (denoted by $Q_{1}^{\mu}$, $Q_{1}^{\nu_{1}}$ and
$Q_{1}^{\nu_{2}}$ in Ref. MaLo2005  and by $Q_{1}^{v}$ in Ref. Ma2017 ). The
only difference is that all our quantities are defined conditioned on the
Bob’s choice of the $z$ basis for measurement. As we noted above, derivations
of bounds in the decoy state method are still valid in the case of detection-
efficiency mismatch, because does not use the assumption of equal efficiencies
at all. Thus, we can use the bound derived in Ref. MaLo2005 . Conditioning on
the choice of the $z$ basis for measurement also does not affect the
derivation since all relations used in the derivations in Ref. MaLo2005  are
still true if we fix a basis. So,

${}_{1}^{\rm s}p_{\rm det}\geq{}_{1}^{\rm s}p_{\rm det}^{\rm
L}=\frac{\mu^{2}e^{-\mu}}{\mu\nu_{1}-\mu\nu_{2}-\nu_{1}^{2}+\nu_{2}^{2}}\\\
\times\left[{}^{\rm d_{1}}p_{\rm det}e^{\nu_{1}}-{}^{\rm d_{2}}p_{\rm
det}e^{\nu_{2}}-\frac{\nu_{1}^{2}-\nu_{2}^{2}}{\mu^{2}}({}_{1}^{\rm s}p_{\rm
det}e^{\mu}-Y_{0}^{\rm L})\right],$ (39)

where

$Y_{0}^{\rm L}=\max\left[\frac{\nu_{1}{}^{\rm d_{2}}p_{\rm
det}e^{\nu_{2}}-\nu_{2}{}^{\rm d_{1}}p_{\rm
det}e^{\nu_{1}}}{\nu_{1}-\nu_{2}},0\right].$ (40)

(2) Derivation of the lower bound for ${}_{1}^{\rm s}p_{1}$ is completely the
same: the quantity ${}_{1}^{\rm s}p_{\rm det}$ is the single-photon
contribution to the gain of the signal states conditioned on the Bob’s choice
of the $z$ basis. The quantity ${}_{1}^{\rm s}p_{\rm det}$ is the single-
photon contribution to the gain of the signal states detected solely by
detector 1 conditioned on the Bob’s choice of the $z$ basis. Conditioning on
the single clicks of detector 1 also does not affect the derivation in Ref.
MaLo2005 . Hence, the lower bound for ${}_{1}^{\rm s}p_{1}$ (denoted as
${}_{1}^{\rm s}p_{1}^{\rm L}$) is also given by formulas (39) and (40) where
all ${}^{v}p_{\rm det}$ are substituted by ${}^{v}p_{1}$.

(3) An upper bound for ${}_{1}^{\rm s}q$ was derived in Ref. Bochkov  also as
a simple generalization of derivations in Ref. MaLo2005 :

${}_{1}^{\rm s}q\leq{}_{1}^{\rm s}q^{\rm U}=\left[\left({}^{\rm
d_{1}}q^{(0)}+{}^{\rm d_{1}}q^{(1)}/\eta\right)e^{\nu_{1}}\right.\\\
\left.-\left({}^{\rm d_{2}}q^{(0)}+{}^{\rm
d_{2}}q^{(1)}/\eta\right)e^{\nu_{2}}\right]\frac{\mu
e^{-\mu}}{\nu_{1}-\nu_{2}},$ (41)

where ${}^{v}q^{(0)}$ and ${}^{v}q^{(1)}$ are the fractions of erroneous
outcomes 0 and 1, respectively, for the pulses of type $v$ and the choice of
the $x$ basis by both legitimate parties. For example, ${}^{v}q^{(0)}$ is the
ratio of the number of erroneous outcomes 0 (i.e., when actually the bit 1 was
sent) for the pulses of type $v$ and the choice of the $x$ basis by both
parties to the total number of outcome 0 with the same conditions.

(4) As for ${}_{1}^{\rm s}p_{01}$, we can simply estimate it from above as
${}_{1}^{\rm s}p_{01}\leq{}^{\rm s}p_{01}$. This estimation has the following
intuitive interpretation. We treat multiphoton Alice’s pulses as insecure. In
the analysis of the case of single-photon Alice’s pulses, we treated positions
with multiphoton Bob’s inputs as insecure. So, the most pessimistic assumption
is that all multiphoton Bob’s inputs originate from single-photon Alice’s
pulses: This assumption maximizes the number of insecure positions. This means
that we do not have to estimate a contribution to the double click rate
$p_{01}$ from the single-photon Alice’s pulses.

Thus, we have obtained all required estimations and finished the adaptation of
the decoy state method to the case of detection-efficiency mismatch.

##  V Proof of Theorem 1

###  V.1 General facts

######  Proposition 1.

Let $\Phi$ be a completely positive and trace-preserving map acting on
$\mathfrak{T}(\mathcal{H}_{A}\otimes\mathcal{H}_{B})$ which commutes with
$\mathcal{X}$ and $\mathcal{G}$ and such that
$\Phi^{\dagger}(\Gamma_{i})=\Gamma_{i}$ for all $i$. We assume that $p_{\rm
det}$ given by (18) is included in the set of restriction. Then

$\max_{\rho_{AB}\in\mathbf{S}}H(X|B)_{\tilde{\rho}^{\prime}}=\max_{\rho_{AB}\in\mathbf{S}^{\prime}}H(X|B)_{\tilde{\rho}^{\prime}},$
(42)

where
$\mathbf{S}^{\prime}=\mathbf{S}\cap\\{\rho_{AB}\,\|\,\Phi(\rho_{AB})=\rho_{AB}\\}$.

The lemma tells that if we have a certain symmetry transformation, then we can
restrict the set of states to the states that are invariant with respect to
this transformation. Note the transformation $\mathcal{X}$ is defined by Eq.
(11) with $I_{BE}$ replaced by $I_{B}$ since we do not consider the Eve’s
subsystem now. Denote $\rho^{\prime}_{XB}=\mathcal{X}(\rho^{\prime}_{AB})$
and, as before, $\tilde{\rho}^{\prime}_{XB}=p_{\rm
det}^{-1}\mathcal{X}(\rho^{\prime}_{AB})$.

###### Proof.

$\begin{split}-p_{\rm det}H(X|B)_{\tilde{\rho}^{\prime}}&=p_{\rm
det}D(\tilde{\rho}^{\prime}_{XB}\|I_{A}\otimes\tilde{\rho}^{\prime}_{B})\\\
&=D(\rho^{\prime}_{XB}\|I_{A}\otimes\rho^{\prime}_{B})\\\
&=D(\mathcal{X}(\mathcal{G}(\rho_{AB}))\|I_{A}\otimes\mathcal{G}(\rho_{B}))\\\
&\leq
D(\Phi(\mathcal{X}(\mathcal{G}(\rho_{AB})))\|\Phi(I_{A}\otimes\mathcal{G}(\rho_{B})))\\\
&=D(\mathcal{X}(\mathcal{G}(\Phi(\rho_{AB})))\|I_{A}\otimes\Phi(\mathcal{G}(\rho_{B}))).\end{split}$
(43)

Here we have used that the quantum relative entropy monotonically non-
increases if a CPTP map is applied to both arguments. Ineq. (43) means that
the substitution of $\rho_{AB}$ by $\Phi(\rho_{AB})$ does not decrease
$H(X|B)$. Since $\Phi^{\dagger}(\Gamma_{i})=\Gamma_{i}$ for all $i$,
$\Phi(\rho_{AB})$ satisfies all restrictions whenever $\rho_{AB}$ does. Hence,
the maximum of $H(X|B)$ is achieved on $\mathbf{S}^{\prime}$. ∎

######  Corollary 1.

In particular, consider a family of unitary operators $\\{U_{g}\\}_{g\in G}$
on $\mathcal{H}_{A}\otimes H_{B}$, where $G$ is a finite set with the
cardinality $|G|$. If $\Phi_{g}(\rho_{AB})=U_{g}\rho_{AB}U_{g}^{\dagger}$ for
all $g$ satisfies the conditions of the lemma, then

$\Phi(\rho_{AB})=\frac{1}{|G|}U_{g}\rho_{AB}U_{g}^{\dagger}$ (44)

also satisfies the conditions of the lemma.

Note that we always can include the identity operator into the family
$\\{U_{g}\\}$.

Let us define the transformation of decoherence with respect to the total
number of photons:

$\Phi_{1}(\rho)=\sum_{n=0}^{\infty}\Pi_{n}\rho\Pi_{n},$ (45)

where

$\begin{split}\Pi_{n}&=\sum_{k=0}^{n}\ket{k,n-k}_{z}\bra{k,n-k}\\\
&=\sum_{k=0}^{n}\ket{k,n-k}_{x}\bra{k,n-k}.\end{split}$

It satisfies the conditions of Proposition 1 for the constraints (18)–(21).
Hence, we can take $\rho_{AB}$ invariant under this transformation:
$\rho_{AB}=\Phi_{1}(\rho_{AB})$. Hence, $\rho_{XB}$ is a mixture of the
contributions with a certain number of photons. Also it was observed in Ref.
EntanglVerif  that the measurement (4) can be regarded as following by a
quantum non-demolition measurement of the number of photons. So, we have

$\displaystyle\rho_{XB}$ $\displaystyle=$
$\displaystyle\sum_{n=0}^{\infty}\rho^{(n)}_{XB},\quad\rho_{XB}^{(n)}\in\mathfrak{T}(\mathbb{C}^{2}\otimes(\mathbb{C}^{2})^{\otimes_{s}n}),$
(46) $\displaystyle\rho_{XB}$ $\displaystyle=$
$\displaystyle\frac{1}{2}\left(\ket{+}\bra{+}\otimes\rho^{(+)}_{B}+\ket{-}\bra{-}\otimes\rho^{(-)}_{B}\right),$
(47) $\displaystyle\rho^{(\pm)}_{B}$ $\displaystyle=$
$\displaystyle\sum_{n=0}^{\infty}\rho^{(n,\pm)}_{XB},\quad\rho_{XB}^{(n,\pm)}\in\mathfrak{T}((\mathbb{C}^{2})^{\otimes_{s}n}).$
(48) $\rho^{\prime}_{XB}=\sum_{n=1}^{\infty}G_{n}\rho_{XB}^{(n)}G_{n},$ (49)
$G_{n}=\begin{pmatrix}1&&\\\ &\ddots&\\\
&&\sqrt{\theta_{n}}\end{pmatrix}=I_{B}-(1-\sqrt{\theta_{n}})\ket{0,n}_{z}\bra{0,n},$
(50)

where the matrix representation is given in the basis
$\\{\ket{k,n-k}_{z}\\}_{k=0}^{n}$ of the space
$(\mathbb{C}^{2})^{\otimes_{s}n}$. Denote also

$\displaystyle t_{n}$ $\displaystyle=$
$\displaystyle\operatorname{Tr}\rho^{(n)}_{XB},\quad
t=\sum_{n=1}^{\infty}t_{n},$ (51) $\displaystyle p_{\rm det}^{(n)}$
$\displaystyle=$
$\displaystyle\operatorname{Tr}\Gamma_{2}\rho^{(n)}_{XB},\quad p_{\rm
det}=\sum_{n=1}^{\infty}p_{\rm det}^{(n)},$ (52) $\displaystyle q_{n}$
$\displaystyle=$
$\displaystyle\operatorname{Tr}\Gamma_{2}\rho^{(n)}_{XB},\quad
q=\sum_{n=1}^{\infty}q_{n}.$ (53)

Define the probability of either single click of the detector 0 or double
click and the probability of single click of the detector 1:

$p_{0+01}=\operatorname{Tr}\rho_{B}\big{(}P^{(z)}_{0}+P^{(z)}_{01}\big{)}=p_{\rm
det}-p_{1}$ (54)

and the contributions of the $n$-photon part to $p_{0+01}$ and $p_{1}$:

$p^{(n)}_{0+01}=\operatorname{Tr}\rho^{(n)}_{B}\big{(}P^{(z)}_{0}+P^{(z)}_{01}\big{)},\quad
p^{(n)}_{1}=\operatorname{Tr}\rho^{(n)}_{B}P^{(z)}_{1},$ (55)
$p_{0+01}=\sum_{n=1}^{\infty}p_{0+01}^{(n)},\quad
p_{1}=\sum_{n=1}^{\infty}p_{1}^{(n)},$ (56)

We have

$\displaystyle p^{(n)}_{\rm det}=p^{(n)}_{0+01}+p^{(n)}_{1},\quad p_{\rm
det}=p_{0+01}+p_{1},$ (57) $\displaystyle
t_{n}=p^{(n)}_{0+01}+\frac{p_{1}^{(n)}}{\theta_{n}},\quad
t=p_{0+01}+\sum_{n=1}^{\infty}\frac{p_{1}^{(n)}}{\theta_{n}}.$ (58)

######  Remark 1.

Imperfect detection of the detector 1 turns some potential double clicks into
single clicks of the detector 0 and some potential single clicks of the
detector 1 into no clicks. So, only the signals which lead to a single click
of the detector 1 in the case of perfect detection, can be lost in the case of
imperfect one. The terms $p_{1}^{(n)}/\theta_{n}$ mean that the fraction
$\theta_{n}$ is lost on the detector 1 from the $n$-photon part.

Due to (15), the minimization of $K$ is equivalent to the maximization of
$H(X|B)_{\tilde{\rho}^{\prime}}$. Using the joint convexity of the quantum
relative entropy,

$p_{\rm det}H(X|B)_{\tilde{\rho}^{\prime}}\leq\sum_{n=1}^{\infty}p_{\rm
det}^{(n)}H(X|B)_{(n)},$ (59)

where the conditional entropy $H(X|B)_{(n)}$ is calculated for the state
$\big{(}p_{\rm det}^{(n)}\big{)}^{-1}G_{n}\rho_{XB}^{(n)}G_{n}$. Using the
trivial upper bound $H(X|B)_{(n)}\leq 1$ for $n\geq 2$, we obtain

$p_{\rm det}H(X|B)_{\tilde{\rho}^{\prime}}\leq p_{\rm
det}^{(1)}H(X|B)_{(1)}+\big{(}p_{\rm det}-p_{\rm det}^{(1)}\big{)}.$ (60)

Thus, our plan is to estimate $H(X|B)_{(1)}$ from above for a fixed single-
photon part $\rho^{(1)}_{XB}$ and to estimate the required parameters of
$\rho^{(1)}_{XB}$ (for example, $p_{\rm det}^{(1)}$) by the known observables
for the whole state $\rho_{AB}$.

###  V.2 Single-photon part

The tight bounds for the single-photon case was analytically obtained in
Bochkov . Here we present a simplified proof of them.

######  Proposition 2.

For any $\rho^{(1)}_{XB}\in\mathfrak{T}(\mathbb{C}^{2}\otimes\mathbb{C}^{2})$,
$\rho_{XB}^{(1)}\geq 0$, the following inequality is satisfied

$\frac{q_{1}}{t_{1}}\geq\frac{1}{2}-\sqrt{\frac{p^{(1)}_{0}p^{(1)}_{1}}{\eta}},$
(61)

where $p_{0}^{(1)}=\operatorname{Tr}\rho^{(1)}_{B}P_{0}^{(z)}=p_{\rm
det}^{(1)}-p_{1}^{(1)}$ (the probability of click of detector 0).

$H(X|B)_{(1)}\leq
h\left(\frac{1-\sqrt{\delta_{x}^{2}+\delta_{z}^{2}}}{2}\right)+1-h\left(\frac{1-\delta_{z}}{2}\right),$
(62)

where

$\delta_{z}=\frac{p^{(1)}_{0}-p^{(1)}_{1}}{p^{(1)}_{\rm
det}},\quad\delta_{x}=\frac{\sqrt{\eta}(t_{1}-2q_{1})}{p_{\rm det}^{(1)}}.$
(63)

The right-hand side of Ineq. (62) is a non-decreasing function of $\delta_{x}$
and $\delta_{z}$. In particular, a simplified formula (obtained by setting
$\delta_{z}=0$) is true:

$H(X|B)_{(1)}\leq h\left(\frac{1-\delta_{x}}{2}\right).$ (64)

###### Proof.

The unitary transformation $Z\otimes Z$, where
$Z=\ket{-}\bra{+}+\ket{+}\bra{-}$ (phase flip), satisfies the conditions of
Corollary 1 for the problem of maximization of $H(X|B)_{(1)}$ over
$\rho^{(1)}_{XB}\in\mathfrak{T}(\mathbb{C}^{2}\otimes\mathbb{C}^{2})$ with the
constrains (18)–(20), with $\Gamma_{i}$ substituted by
$\Gamma_{i}^{(1)}=\Pi_{1}\Gamma_{i}\Pi_{1}$, $i=1,2,3$. Hence, the CPTP map
defined by

$\Phi_{2}(\rho^{(1)}_{XB})=\frac{1}{2}\left[\rho^{(1)}_{XB}+(Z\otimes
Z)\rho^{(1)}_{XB}(Z\otimes Z)\right]$ (65)

satisfies the conditions of Proposition 1. Hence, we can restrict the set of
states $\rho^{(1)}_{XB}$ to those that satisfy
$\Phi_{2}(\rho^{(1)}_{XB})=\rho^{(1)}_{XB}$, or,

$\rho^{(1)}_{XB}=Z\otimes Z\rho^{(1)}_{XB}Z\otimes Z.$ (66)

Eqs. (47) and (66) imply that

$\begin{split}G_{1}\rho_{XB}^{(1)}G_{1}=\frac{1}{2}\Big{(}&\ket{+}\bra{+}\otimes
G_{1}\rho^{(1,+)}_{B}G_{1}+\\\ &\ket{-}\bra{-}\otimes
G_{1}\rho^{(1,-)}_{B}G_{1}\Big{)},\end{split}$ (67)

where $G_{1}\rho^{(1,-)}_{B}G_{1}=ZG_{1}\rho^{(1,+)}G_{1}Z$. The the matrix
representation of the operator $G_{1}\rho^{(1,+)}G-1$ in the $z$ basis is

$G_{1}\rho^{(1,+)}G_{1}=\frac{p_{\rm
det}^{(1)}}{2}\begin{pmatrix}1+\delta_{z}&&\delta_{x}\\\
\delta_{x}&&1-\delta_{z}\end{pmatrix},$ (68)

where $\delta_{z}$ and $\delta_{x}$ are some numbers. The matrix
representation of the same operator in the $x$ basis is

$G_{1}\rho^{(1,+)}G_{1}=\frac{p_{\rm
det}^{(1)}}{2}\begin{pmatrix}1+\delta_{x}&&\delta_{z}\\\
\delta_{z}&&1-\delta_{x}\end{pmatrix}.$ (69)

We see that

$\frac{1}{p_{\rm
det}^{(1)}}\operatorname{Tr}\left[G_{1}\rho^{(1,+)}_{B}G_{1}\big{(}\tilde{P}_{0}^{(b)}-\tilde{P}_{0}^{(b)}\big{)}\right]=\delta_{b},$
(70)

$b\in\\{x,z\\}$, which explains the denotations $\delta_{z}$ and $\delta_{x}$.
Namely, $\delta_{b}$ is the difference between the probabilities of two
outcomes in the case of perfect detection on the state
$G_{1}\rho_{B}^{(1,+)}G_{1}$, i.e., on the state attenuated by the imperfect
detection in the $z$ basis. Formula for $\delta_{z}$ in Eqs. (63) is now
obvious. Also it can be straightforwardly shown that

$q_{1}=\operatorname{Tr}\big{(}\Gamma^{(1)}_{2}\rho_{XB}^{(1)}\big{)}=t_{1}-\frac{p_{\rm
det}^{(1)}\delta_{x}}{\sqrt{\eta}},$ (71)

which gives formula for $\delta_{x}$ in Eqs. (63). Direct calculation of
$H(X|B)_{(1)}$ for the operator (67)–(68) gives Ineq. (62).

The monotonic non-decreasing of the right-hand side of Ineq. (62) follows from
the relation (17) and the non-increasing of the quantum relative entropy under
CPTP actions on both arguments: as we see from Eqs. (68) and (69), decrease of
$\delta_{z}$ ($\delta_{x}$) corresponds to (partial) decoherence in the basis
$x$ (basis $z$). Setting $\delta_{b}=0$ corresponds to full decoherence. ∎

Thus, Eq. (62) is a tight bound, while Eq. (64) is a simplified and more rough
one. In the latter case, $(1-\delta_{x})/p^{(1)}_{\rm det}$ can be identified
with the phase error rate, which plays a crucial role in the security proofs
of QKD ShorPreskill ; Koashi . As in other cases of practical imperfections,
it is not equal to the bit error rate for the $x$ basis GLLP .

We will use a simplified formula (64) in our work since its deviation from a
tight bound (62) is small for $\eta$ close to 1, which is a practical case.
The substitution of Ineq. (64) into Ineq. (60) gives

$p_{\rm det}H(X|B)_{\tilde{\rho}^{\prime}}\leq p_{\rm
det}^{(1)}h\left(\frac{1-\delta_{x}}{2}\right)+\big{(}p_{\rm det}-p_{\rm
det}^{(1)}\big{)}.$ (72)

We need to estimate $\delta_{x}$ from below. Hence, in view of Eq. (63), we
should estimate $t_{1}$ from below and $q_{1}$ from above. Let us discuss the
dependence of the right-hand side of Ineq. (72) on $p_{\rm det}^{(1)}$.
Consider the function

$f\big{(}p_{\rm det}^{(1)}\big{)}=p_{\rm
det}^{(1)}\left[h\left(\frac{1-\delta_{x}\big{(}p_{\rm
det}^{(1)}\big{)}}{2}\right)\right],$ (73)

where the notation $\delta_{x}\big{(}p_{\rm det}^{(1)}\big{)}$ mean that here
we treat $\delta_{x}$ as a function of $p_{\rm det}^{(1)}$ according to Eq.
(63) with fixed $t_{1}$ and $q_{1}$. It can be straightforwardly shown that
$f$ is a non-increasing function of $p_{\rm det}^{(1)}$. Hence, $p_{\rm
det}^{(1)}$ should be estimated from below. In Subsections V.3 and V.4 we
obtain estimations for the three- and more photon part and the two-photon
parts, respectively. In Subsections V.5 we finish the proof of Theorem 1.

###  V.3 Three- and more photon part

Denote the double click probabilities in the case of perfect and imperfect
detections:

$\begin{split}\tilde{p}_{01}^{(b)}&=\operatorname{Tr}\rho_{AB}\big{(}I_{A}\otimes\tilde{P}^{(b)}_{01}\big{)},\\\
p_{01}^{(b)}&=\operatorname{Tr}\rho_{AB}\big{(}I_{A}\otimes
P^{(b)}_{01}\big{)},\\\
\tilde{p}_{01}&=\frac{\tilde{p}_{01}^{(z)}+\tilde{p}_{01}^{(x)}}{2},\end{split}$
(74)

Define also the corresponding double click probabilities averaged over two
bases (mean double click probabilities):

$p_{01}=\frac{p_{01}^{(z)}+p_{01}^{(x)}}{2},$ (75)

$b\in\\{z,x\\}$. In force of

$\tilde{P}_{01}^{(b)}\geq P_{01}^{(b)}\geq\eta\tilde{P}_{01}^{(b)},$ (76)

we have $\tilde{p}_{01}\geq p_{01}\geq\eta\tilde{p}_{01}$.

######  Proposition 3.

Consider the state $\rho_{XB}$ of form (46). Then

$t_{3+}\leq\frac{p_{01}}{\eta p_{01}^{\rm min}}\equiv t_{3+}^{\rm U},$ (77)

where $p_{01}^{\rm min}$ is defined by Eq. (22).

We begin with two lemmas.

######  Lemma 1.

Suppose $\rho_{B}\in\mathfrak{T}((\mathbb{C}^{2})^{\otimes_{s}n})$ for $n\geq
3$ and $\rho$ is the density operator, i.e., $\rho_{B}\geq 0$ and
$\operatorname{Tr}\rho_{B}=1$. Then

$2\tilde{p}_{01}\log(2^{n-1}-1)+2h(\tilde{p}_{01})\geq n-2.$ (78)

###### Proof.

The Hilbert space $(\mathbb{C}^{2})^{\otimes_{s}n}$ is naturally embedded into
the space $(\mathbb{C}^{2})^{\otimes n}$. Let us then consider the operators
$\rho_{B}$ and $\tilde{P}^{(b)}_{01}$ as the operators acting on
$(\mathbb{C}^{2})^{\otimes n}$. For a binary string $a=a_{1}\ldots a_{n}$
denote $\ket{a_{1}\ldots
a_{n}}=\ket{a_{1}}\otimes\ldots\otimes\ket{a_{n}}\in(\mathbb{C}^{2})^{\otimes
n}$. Let $|a|$ denote the Hamming weight of $a$, i.e., the number of ones in
$a$. The embedding is as follows:

$(\mathbb{C}^{2})^{\otimes_{s}n}\ni\ket{n-k,k}_{z}=\frac{1}{\sqrt{k!}}\sum_{\begin{subarray}{c}a\in\\{0,1\\}^{n}\\\
|a|=k\end{subarray}}\ket{a}\in(\mathbb{C}^{2})^{\otimes n}$ (79)

Define also the operators corresponding to a double click in
$(\mathbb{C}^{2})^{\otimes n}$:

$\begin{split}\bar{P}^{(z)}_{01}&=\sum_{\begin{subarray}{c}a\in\\{0,1\\}^{n}\\\
1\leq|a|\leq n-1\end{subarray}}\ket{a}\bra{a},\\\
\bar{P}^{(x)}_{01}&=\sum_{\begin{subarray}{c}a\in\\{0,1\\}^{n}\\\ 1\leq|a|\leq
n-1\end{subarray}}H^{\otimes n}\ket{a}\bra{a}H^{\otimes n},\end{split}$ (80)

where $H$ is a Hadamard transformation. The operators $\bar{P}^{(b)}_{01}$
differ from the embeddings of $\tilde{P}^{(b)}_{01}$. However, if
$\rho_{B}\in\mathfrak{T}((\mathbb{C}^{2})^{\otimes_{s}n})$, i.e., $\rho_{B}$
is symmetric with respect to the permutations of qubits, then

$\operatorname{Tr}\tilde{P}^{(b)}_{01}\rho_{B}=\operatorname{Tr}\bar{P}^{(b)}_{01}\rho_{B}.$
(81)

Hence, $\tilde{p}_{01}^{(b)}$ can be equivalently defined in terms of
$\bar{P}^{(b)}_{01}$. Let $Z$ and $X$ be the usual Pauli operators, and let
$H(Z^{\otimes n})$ and $H(X^{\otimes n})$ be the Shannon entropies of the
results of the measurements of the $n$-qubit observables $Z^{\otimes n}$ and
$X^{\otimes n}$, respectively. Then

$\begin{split}H(Z^{\otimes
n})&=h\left(\tilde{p}^{(z)}_{01}\right)+\tilde{p}^{(z)}_{01}H(Z^{\otimes
n}|\text{ double click})\\\ &+\left(1-\tilde{p}^{(z)}_{01}\right)H(Z^{\otimes
n}|\text{ single click})\\\ &\leq
h\left(\tilde{p}^{(z)}_{01}\right)+\tilde{p}^{(z)}_{01}\log(2^{n}-2)+1-\tilde{p}^{(z)}_{01}\\\
&=h\left(\tilde{p}^{(z)}_{01}\right)+\tilde{p}^{(z)}_{01}\log(2^{n-1}-1)+1.\end{split}$
(82)

The inequality takes place since the single click event correspond to two
outcomes ($a=0\ldots 0$ and $a=1\ldots 1$) and the double click corresponds to
the rest $2^{n}-2$ outcomes. Analogously,

$H(X^{\otimes n})\leq
h\left(\tilde{p}^{(x)}_{01}\right)+\tilde{p}^{(x)}_{01}\log(2^{n-1}-1)+1.$
(83)

From the other side, due to entropy uncertainty relations MaassenUffink , we
have

$H(Z^{\otimes n})+H(X^{\otimes n})\geq n.$ (84)

Using Ineqs. (82)–(84) and the concavity of $h$, we obtain

$2\tilde{p}_{01}\log(2^{n-1}-1)+2h(\tilde{p}_{01})\\\
\geq\left(\tilde{p}^{(z)}_{01}+\tilde{p}^{(x)}_{01}\right)\log(2^{n-1}-1)+h\left(\tilde{p}^{(z)}_{01}\right)+h\left(\tilde{p}^{(z)}_{01}\right)\\\
\geq n-2,$ (85)

q.e.d. ∎

######  Lemma 2.

Suppose $n\geq 3$. There is a unique value $p^{{\rm min},(n)}_{01}$ for
$p^{(n)}_{01}$ that turns inequality (78) into the equality. This is a minimal
mean double click probability for a given $n$. Moreover, $p^{{\rm
min},(n)}_{01}$ is a non-decreasing function of $n$ for $n\geq 3$.

The proof is technical and does not contain essential ideas, so, it is given
in Appendix A.

###### Proof of Proposition 3.

In force of Lemmas 1 and 2,

$\frac{1}{2t_{n}}\operatorname{Tr}\rho_{XB}^{(n)}[\tilde{P}_{01}^{(z)}+\tilde{P}_{01}^{(x)}]\geq
p^{{\rm min},(n)}_{01}\geq p^{\rm min}_{01}$ (86)

for $n\geq 3$, where, as before, $t_{n}=\operatorname{Tr}\rho_{XB}^{(n)}$.
Note that $p^{\rm min}_{01}$, which is defined by Eq. (22), is equal to
$p^{{\rm min},(3)}$. Due to Ineq. (76),

$\frac{1}{2t_{n}}\operatorname{Tr}\rho_{XB}^{(n)}[P_{01}^{(z)}+P_{01}^{(x)}]\geq\eta
p^{{\rm min}}_{01}.$ (87)

Then,

$p_{01}=\sum_{n=3}^{\infty}\operatorname{Tr}\rho_{XB}^{(n)}[P_{01}^{(z)}+P_{01}^{(x)}]\geq\eta
t_{3+}p^{\rm min}_{01}.$ (88)

The proposition has been proved. ∎

###  V.4 Two-photon part

Unfortunately, bound (78) is trivial for the case $n=2$. The two-photon Bell
state

$\ket{\Phi^{+}}=\frac{1}{\sqrt{2}}(\ket{2,0}_{z}+\ket{0,2}_{z})=\frac{1}{\sqrt{2}}(\ket{2,0}_{x}+\ket{0,2}_{x})$
(89)

produces no double clicks in both bases. So, estimation of the fraction of
two-photon pulses requires a separate analysis.

The intuition behind the analysis is as follows. If the number of double
clicks is small, then the two-photon part of the Bob’s state is closed to the
pure state $\ket{\Phi^{+}}$. So, the Bob’s subsystem is almost uncorrelated
with the Alice’s one the QBER will be close to 1/2. By this reason, as we will
see in the next subsection, it is not advantageous for Eve to increase the
fraction of two-photon part of the Bob’s state: she introduces a large number
of errors obtaining only a small information about the key.

######  Proposition 4.

The following inequalities for the state $\rho_{XB}$ of form (46)–(48) hold:

$\displaystyle\frac{q_{2}}{t_{2}}$ $\displaystyle\geq$
$\displaystyle\frac{1+\theta_{2}}{4}-\sqrt{\frac{p_{01}}{\eta t_{2}}},$ (90)
$\displaystyle\frac{p_{1}^{(2)}}{t_{2}}$ $\displaystyle\leq$
$\displaystyle\frac{\theta_{2}}{2}+\sqrt{\frac{p_{01}}{\eta t_{2}}},$ (91)

###### Proof.

First consider the case $t_{2}=1$. The vectors $\ket{\Phi^{+}}$,
$\ket{\Phi^{-}}$, and $\ket{\Psi^{+}}$, where

$\begin{split}\ket{\Phi^{-}}&=\frac{1}{\sqrt{2}}(\ket{2,0}_{z}-\ket{0,2}_{z})=\ket{1,1}_{x},\\\
\ket{\Psi^{+}}&=\ket{1,1}_{z}=\frac{1}{\sqrt{2}}(\ket{2,0}_{x}-\ket{0,2}_{x}),\end{split}$
(92)

compose a basis in $(C^{2})^{\otimes_{s}2}$. As we see, the state
$\ket{\Phi^{-}}\bra{\Phi^{-}}$ produces $\tilde{p}_{01}^{(z)}=0$ and
$\tilde{p}_{01}^{(x)}=1$, while the state $\ket{\Psi^{-}}\bra{\Psi^{-}}$
produces $\tilde{p}_{01}^{(z)}=1$ and $\tilde{p}_{01}^{(x)}=0$. In both cases,
$\tilde{p}_{01}=1/2$. First consider the case $t_{2}=1$. It follows that

$\tilde{p}_{01}\geq\frac{1-\braket{\Phi^{+}}{\rho^{(2)}_{B}}{\Phi^{+}}}{2}.$
(93)

Here we pessimistically assume that all double clicks are caused by the two-
photon part. As well as, in the previous subsection, we pessimistically
assumed that all double clicks are caused by the three- and more photon parts.
Then,

$T(\rho^{(2)}_{B},\ket{\Phi^{+}}\bra{\Phi^{+}})\leq\sqrt{1-\braket{\Phi^{+}}{\rho^{(2)}_{B}}{\Phi^{+}}}\leq\sqrt{2\tilde{p}_{01}},$
(94)

where $T$ is the trace distance, and we have used the well-known estimation of
the trace distance by the fidelity $\ket{\Phi^{+}}\bra{\Phi^{+}}$.

If $\rho^{(2)}_{XB}=\frac{1}{2}I_{A}\otimes\ket{\Phi^{+}}\bra{\Phi^{+}}$, then
$q_{2}=(1+\theta_{2})/4$ and $\tilde{p}_{1}^{(2)}=\theta_{2}/2$. Due to
general form (47) of $\rho_{XB}$,

$\displaystyle
T\left(\rho_{XB},\frac{1}{2}I_{A}\otimes\ket{\Phi^{+}}\bra{\Phi^{+}}\right)$
$\displaystyle=\frac{1}{2}T\left(\rho^{(2,+)}_{B},\ket{\Phi^{+}}\bra{\Phi^{+}}\right)+\frac{1}{2}T\left(\rho^{(2,-)}_{B},\ket{\Phi^{-}}\bra{\Phi^{-}}\right)$
$\displaystyle\leq\frac{1}{2}\sqrt{1-\braket{\Phi^{+}}{\rho^{(2,+)}_{B}}{\Phi^{+}}}+\frac{1}{2}\sqrt{1-\braket{\Phi^{+}}{\rho^{(2,-)}_{B}}{\Phi^{+}}}$
$\displaystyle\leq\sqrt{1-\braket{\Phi^{+}}{\rho^{(2)}_{B}}{\Phi^{+}}}\leq\sqrt{2\tilde{p}_{01}}\leq\sqrt{2p_{01}/\eta}.$
(95)

Due to the properties of the trace distance

$\left|q_{2}-\frac{1+\theta_{2}}{4}\right|\leq\sqrt{\frac{2p_{01}}{\eta}},\quad\left|p_{1}^{(2)}-\frac{\theta_{2}}{2}\right|\leq\sqrt{\frac{2p_{01}}{\eta}},$
(96)

hence,

$\displaystyle q_{2}\geq\frac{1+\theta_{2}}{4}-\sqrt{\frac{2p_{01}}{\eta}},$
(97) $\displaystyle
p_{1}^{(2)}\leq\frac{\theta_{2}}{2}+\sqrt{\frac{2p_{01}}{\eta\theta_{2}}}.$
(98)

We have obtain the required bound (90) for the case $t_{2}=1$. If $t_{2}<1$,
then all derivations above should be performed for $\rho^{(2)}_{XB}/t_{2}$. In
particular, the observables $q_{2}$, $p^{(2)}_{1}$, and $p_{01}$. should be
substituted by $q_{2}/t_{2}$, $p_{1}^{(2)}/t_{2}$, and $p_{01}/t_{2}$. Thus,
we obtain Eqs. (90) and (91). ∎

###  V.5 Final formula and remarks

We proceed to final steps to the proof of Theorem 1. Using the inequality

$p^{(n)}_{\rm det}\leq t_{n}\leq\frac{p^{(n)}_{\rm det}}{\theta_{n}}$ (99)

(see Eqs. (57) and (58)) and Ineq. (90), we have

$\displaystyle q_{2}$ $\displaystyle\geq$
$\displaystyle\frac{(1+\theta_{2})p_{\rm
det}^{(2)}}{4}-\sqrt{\frac{2p_{01}p_{\rm
det}^{(2)}}{\eta\theta_{2}}}=q_{2}^{\rm L}$ (100) $\displaystyle p_{1}^{(2)}$
$\displaystyle\leq$ $\displaystyle\frac{p_{\rm
det}^{(2)}}{2}+\sqrt{\frac{2p_{01}p_{\rm
det}^{(2)}}{\eta\theta_{2}}}=p_{1}^{(2),\rm U},$ (101) $\displaystyle p_{\rm
det}^{(3+)}$ $\displaystyle\leq$ $\displaystyle t_{3+}^{\rm U}=p_{\rm
det}^{(3+),\rm U}$ (102)

(so, $t_{3+}^{\rm U}$ and $p_{\rm det}^{(3+),\rm U}$ denote the same Eq.
(77)). Estimation (24) is obvious. Then,

$\displaystyle p_{1}^{(1)}$ $\displaystyle\geq$ $\displaystyle
p_{1}^{(1)}-p_{1}^{(2),\rm U}-\sum_{n=3}^{\infty}p_{1}^{(n)}$ (103)
$\displaystyle\geq$ $\displaystyle p_{1}^{(1)}-p_{1}^{(2),\rm U}-p_{\rm
det}^{(3+),\rm U}=p_{1}^{(1),\rm L},$ (104) $\displaystyle t_{1}$
$\displaystyle\leq$ $\displaystyle p_{\rm
det}^{(1)}+\left(\frac{1}{\eta}-1\right)p^{(1),\rm L}_{1}=t_{1}^{\rm L}.$
(105)

So, we have used the simple estimation $p_{1}^{(n)}\leq t_{n}$ for $n\geq 3$,
but estimated $p_{1}^{(2)}$ more precisely.

In view of Eqs. (15) and (72) and the comments after Eq. (72) formula (30) has
been proved. To finish the proof of Theorem 1, we need to prove that the
expression under minimization in Ineq. (30) is a convex function of $p_{\rm
det}^{(2)}$. If we redenote $p_{\rm det}^{(1),\rm L}$ as an independent
variable $x$ (not to be confused with the denotation of a basis), then $p_{\rm
det}^{(2)}$ can be expressed as $p_{\rm det}^{(2)}=p_{\rm det}-p_{\rm
det}^{(3),\rm U}-x$, then we can equivalently minimize over $x$. Since
$t_{1}^{\rm L}-2q_{1}^{\rm U}$ is a convex function of $x$, it suffices to
prove the following lemma.

######  Lemma 3.

Consider the function of the form

$f(x)=xh\left(\frac{1}{2}-\frac{g(x)}{x}\right)$ (106)

defined on some segment $x\in[x_{0},x_{1}]$, $x_{0},x_{1}\geq 0$ where
$0\leq\frac{g(x)}{x}\leq\frac{1}{2}$. If $g(x)$ is convex, then $f(x)$ is
concave.

The proof is technical and is given in Appendix B. This finishes the proof of
Theorem 1.

######  Remark 2.

Let us explain the range of variation of $p_{\rm det}^{(2)}$. There is no
positive operator $\rho_{AB}$ with $p_{\rm det}^{(2)}$ such that
$\delta_{x}^{\rm L}>1$. Indeed, the inequality $|\delta_{x}|\leq 1$ comes from
positivity of $\rho^{(1)}_{XB}$, see the proof of Proposition 2. Since
$\delta_{x}\geq\delta_{x}^{\rm L}$, $\delta_{x}^{\rm L}>1$ implies non-
positivity of $\rho_{AB}$. From the other side, if $q_{1}^{\rm U}\geq
t_{1}^{\rm L}/2$, or, in other words, $\delta_{x}^{\rm L}\leq 0$ for some
$p^{(2)}_{\rm det}$, then we cannot guarantee a positive secret key rate (the
error rate is too large). Thus, Alice and Bob must abort the protocol in this
case (see step 4 in the description of the BB84 protocol in Sec. II.2).

######  Remark 3.

As we see on Fig. 1, formula (30) gives a significant deviation from the upper
bound (33) for large detection-efficiency mismatch (small $\eta$). For
$\eta<0.3$, the formula (30) gives a worse result even in comparison with a
simplified bound (34) for the single-photon Bob’s input. Though, usually the
mismatch is not large, here we discuss some ways to improve bound (30).

The first way is to use more precise estimate of $p_{1}^{(2)}$ instead of
Ineq. (101). Indeed, in Ineq. (101) (compare with Ineq. (91)) we simply use
the bound $t_{2}\leq p_{\rm det}^{(2)}/theta_{2}$. However, we can estimate
$t_{2}$ and $p_{2}$ using the system of Ineq. (91) and equation

$t_{2}=p_{\rm det}+p_{1}^{(2)}\left(\frac{1}{\theta_{2}}-1\right).$ (107)

Then the estimation of $t_{2}$ and $p_{2}$ is reduced to a solution of a
quadratic equation.

The second way to improve formula (30) is to use a tight bound (62) for the
single-photon part instead of a simplified formula (62).

######  Remark 4.

In the case of no dark counts, we could take the $\Gamma_{2}$ observable
(weighted mean erroneous detection rate in the $x$ basis) as

$\Gamma_{2}=\eta^{-1}\ket{+}\bra{+}\otimes P^{(x)}_{1}+\ket{-}\bra{-}\otimes
P^{(x)}_{0}$ (108)

instead of Eq. (19), i.e., do not include the double clicks. Indeed, we used a
non-trivial estimation of $H(X|B)$ only for the single-photon part. Though we
did not include the dark counts in our detection model (Eqs. (4) and (5)), we
use more general formula (19). Since dark count may lead to double clicks, in
the practical case of non-zero dark count rate, formula (19) should be used.

##  VI Conclusions

We have solved an important problem for practical QKD and prove the security
of the BB84 protocol with detection-efficiency mismatch for the multiphoton
case on both Alice’s output and Bob’s input. The main formula of the present
paper is (30). It is formulated for the case of single-photon Alice’s pulses,
but it can be adopted to the case of weak coherent pulses with the randomized
phase by the decoy state method. We have proposed an adaptation of the decoy
state method to the case of detection-efficiency mismatch (as a development of
our earlier results Bochkov ).

Also Proposition 1 (with Corollary 1)) and Propositions 3 and 4 can be of
interest in the context of numerical approach to QKD Lutk-num-pre ; Lutk-num ;
EntanglVerif ; Zhang . Proposition 1 allows us to reduce the search space and
Propositions 3 and 4 allows us to rigorously estimate the number of
multiphoton events, which was the lacking part of the analysis of Ref. Zhang .

An open problem is to include the dark count rates and, in particular dark
count mismatch in the detection model. The difference between dark count rates
of two detectors also may affect the security and the secret key rate.

Another open problem is generalization to the case when the detection-
efficiency mismatch is not constant, but is under partial Eve’s control. Such
attacks are described and employed experimentally LoHack ; Makarov . In
principle, the combination of Proposition 3 with the numerical techniques
developed in Refs. Zhang , allows us to calculate the secret key rate, but
analytical estimates and the adaptation of the decoy state method are also
desirable.

Finally, let us note that the Devetak and Winter formula for the secret key
rate (12) is valid only for collective Eve’s attacks. This is not an actual
restriction since the results can be generalized to the case of the most
general, coherent attacks using the entropy accumulation technique EntrAccum .
This technique also allows us to take the finite-size effects into account.

##  Appendix A Proof of Lemma 2

Let us define a function

$F(x,y)=2y\log(2^{x}-1)+2h(y)-x+2$ (109)

$F(x,0)<0$ and $F(x,1/2)>0$ for $x\geq 3$. Hence, $F(x,y)$ has a unique root
$y=f(x)$ for $x\geq 3$. Since $F(x,1)>0$ for $n\geq 3$ and $F$ is concave with
respect to $y$, there are no more roots of $F(x,y)$. For $x=n$ we have
$f(x)=p^{{\rm min},(n)}_{01}$.

For the second part, it is sufficient to prove that $f^{\prime}(x)\geq 0$ for
$x\geq 3$. We have

$f^{\prime}(x)=-\frac{F^{\prime}_{x}(x,f(x))}{F^{\prime}_{y}(x,f(x))}.$ (110)

$F^{\prime}_{y}(x,y)>0$ for $y\leq 1/2$,

$F^{\prime}_{x}(x,y)=\frac{2y}{1-2^{-x}}-1<0\quad\text{for
}\>y<\frac{1-2^{-x}}{2}.$ (111)

Hence, we should prove that

$f(x)<\frac{1-2^{-x}}{2}.$ (112)

Indeed, since $h(y)>0$ for $0<y<1$ and, as can be easily proved,

$(1-2^{-x})\log(2^{x}-1)-x\geq-2,$ (113)

we obtain $F(x,(1-2^{-x})/2)>0$, which implies Ineq. (112). The lemma has been
proved.

##  Appendix B Proof of Lemma 3

For arbitrary $x,y$ and an arbitrary $0\leq t\leq 1$, we have

$\displaystyle
txh\left(\frac{1}{2}-\frac{g(x)}{x}\right)+(1-t)yh\left(\frac{1}{2}-\frac{g(y)}{y}\right)$
$\displaystyle=[tx+(1-t)y]\bigg{\\{}\frac{tx}{tx+(1-t)y}h\left(\frac{1}{2}-\frac{g(x)}{x}\right)$
$\displaystyle\hskip
71.13188pt+\frac{ty}{tx+(1-t)y}h\left(\frac{1}{2}-\frac{g(y)}{y}\right)\bigg{\\}}$
$\displaystyle\leq[tx+(1-t)y]h\left(\frac{1}{2}-\frac{tg(x)+(1-t)g(y)}{tx+(1-t)y}\right)$
$\displaystyle\leq[tx+(1-t)y]h\left(\frac{1}{2}-\frac{g(tx+(1-t)y)}{tx+(1-t)y}\right),$
(114)

q.e.d. The first inequality comes from concavity of $h$ and the second
inequality comes from convexity of $g$ and monotonicity of $h$.

## References

  * (1) C. H. Bennett, G. Brassard, in Proceedings of IEEE International Conference on Computers, Systems and Signal Processing, Bangalore, India (IEEE, New York, 1984), p. 175.
  * (2) D. Mayers, arXiv:quant-ph/9606003 (1996).
  * (3) D. Mayers, JACM. 48, 351 (2001).
  * (4) P. W. Shor and J. Preskill, Phys. Rev. Lett. 85, 441 (2000).
  * (5) R. Renner, arXiv:quant-ph/0512258 (2005).
  * (6) M. Koashi, New J. Phys. 11, 045018 (2009).
  * (7) M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner, Nat. Commun. 3, 634 (2012).
  * (8) M. Tomamichel and A. Leverrier, Quantum 1, 14 (2017).
  * (9) N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev. Mod. Phys. 74, 145 (2002).
  * (10) V. Scarani, H. Bechmann-Pasquinucci, N.J. Cerf, M. Dusek, N. Lütkenhaus, and M. Peev, Rev. Mod. Phys. 81, 1301 (2009).
  * (11) E. Diamanti, H.-K, Lo, B. Qi, and Z. Yuan, npj Quant. Inf. 2, 16025 (2016)
  * (12) C.-H. F. Fung, K. Tamaki, B. Qi, H.-K. Lo, X. Ma, Quant. Inf. Comput. 9, 131 (2009).
  * (13) A. Winick, N. Lütkenhaus, and P. J. Coles, Quantum 2, 77 (2018).
  * (14) M.K. Bochkov, A.S. Trushechkin, Phys. Rev. A 99, 032308 (2019).
  * (15) O. Gittsovich, N. J. Beaudry, V. Narasimhachar, R. Romero Alvarez, T. Moroder, and N. Lütkenhaus, Phys. Rev. A 89, 012325 (2014).
  * (16) Y. Zhang, P. J. Coles, A. Winick, J. Lin, N. Lütkenhaus, arXiv:2004.04383 (1996).
  * (17) M. Dušek, M. Jahma, and N. Lütkenhaus Phys. Rev. A 62, 022306 (2000).
  * (18) N. Lütkenhaus and M. Jahma, New J. Phys. 4, 44 (2002).
  * (19) H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94, 230504 (2005).
  * (20) X.-B. Wang, Phys. Rev. Lett. 94, 230503 (2005).
  * (21) X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, Phys. Rev. A 72, 012326 (2005).
  * (22) Z. Zhang, Q. Zhao, M. Razavi, and X. Ma, Phys. Rev. A 95, 012333 (2017).
  * (23) A. S. Trushechkin, E. O. Kiktenko, and A. K. Fedorov, Phys. Rev. A 96, 022316 (2017).
  * (24) Y. Zhang and N. Lütkenhaus, Phys. Rev. A 95, 042319 (2017).
  * (25) C.-H. F. Fung, X. Ma, H. F. Chau, Phys. Rev. A 81, 012318 (2010).
  * (26) I. Devetak and A. Winter, Proc. R. Soc. London, Ser. A, 461, 207 (2005)
  * (27) E. O. Kiktenko, A. S. Trushechkin, C. C. W. Lim, Y. V. Kurochkin, A. K. Fedorov, Phys. Rev. Applied 8, 044017 (2017).
  * (28) E. O. Kiktenko, A. S. Trushechkin, A. K. Fedorov, Lobachevskii J. Math. 39, 992 (2018).
  * (29) E. O. Kiktenko, A. O. Malyshev, A. A. Bozhedarov, N. O. Pozhar, M. N. Anufriev, A. K. Fedorov, J. Russ. Laser Res. 39, 558 (2018).
  * (30) D. Gottesman, H.-K. Lo, N. Lütkenhaus, J. Preskill, Quant. Inf. Comput. 5, 325 (2004).
  * (31) M. Berta, M. Christandl, R. Colbeck, J. M. Renes, R. Renner, Nature Phys. 6, 659 (2010).
  * (32) P. J. Coles, L. Yu, V Gheorghiu, R. B. Griffiths, Phys. Rev. A 83, 062338 (2011).
  * (33) P. J. Coles, E. M. Metodiev, and N. Lütkenhaus, Nat. Commun. 7, 11712 (2016).
  * (34) H. Maassen, J. B. M. Uffink, Phys. Rev. Lett. 60, 1103 (1988).
  * (35) Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, Phys. Rev. A 78, 042333 (2008).
  * (36) S. Sajeed, P. Chaiwongkhot, J.-P. Bourgoin, T. Jennewein, N. Lütkenhaus, and V. Makarov, Phys. Rev. A 91, 062301 (2015)
  * (37) F. Dupuis, O. Fawzi, and R. Renner, arXiv:1607.01796 (2005).