# Sending or not sending twin-field quantum key distribution
with distinguishable decoy states

Yi-Fei Lu  Mu-Sheng Jiang<EMAIL_ADDRESS>Yang Wang  Xiao-Xu Zhang  Fan Liu
Chun Zhou  Hong-Wei Li  Wan-Su Bao<EMAIL_ADDRESS>Henan Key Laboratory of
Quantum Information and Cryptography, SSF IEU, Zhengzhou, Henan 450001, China
Synergetic Innovation Center of Quantum Information and Quantum Physics,
University of Science and Technology of China, Hefei, Anhui 230026, China

###### Abstract

Twin-field quantum key distribution (TF-QKD) and its variants can overcome the
fundamental rate-distance limit of QKD which has been demonstrated in the
laboratory and field while their physical implementations with side channels
remains to be further researched. We find the external modulation of different
intensity states through the test, required in those TF-QKD with post-phase
compensation, shows a side channel in frequency domain. Based on this, we
propose a complete and undetected eavesdropping attack, named passive
frequency shift attack, on sending or not-sending (SNS) TF-QKD protocol given
any difference between signal and decoy states in frequency domain which can
be extended to other imperfections with distinguishable decoy states. We
analyze this attack by giving the formula of upper bound of real secure key
rate and comparing it with lower bound of secret key rate under Alice and
Bob’s estimation with the consideration of actively odd-parity pairing (AOPP)
method and finite key effects. The simulation results show that Eve can get
full information about the secret key bits without being detected at long
distance. Our results emphasize the importance of practical security at source
and might provide a valuable reference for the practical implementation of TF-
QKD.

††preprint: APS/123-QED

##  I Introduction

Quantum key distribution (QKD) allows two distant parties, Alice and Bob, to
share secret keys securely in the presence of an eavesdropper, Eve, by
harnessing the laws of physics [1, 2, 3]. Combined with one-time pad, Alice
and Bob can achieve unconditionally secure private communication. Notable
progress has been made to improve performance, such as the communication
distance and secret key rate, and bridge the gap between the idealized device
models assumed in security proofs and the functioning of realistic devices in
practical systems.

The measurement-device-independent (MDI) QKD [4] can remove both known and
unknown security loopholes, or so-called side channels, in the measurement
unit perfectly which shift the focus of quantum attacks to the source. Photon-
number-splitting (PNS) attack [5, 6], the major threat at source since single-
photon source is not available at present and weak laser light are widely used
in practical QKD systems, has been overcome by the decoy-state method [7, 8].
Combining these two methods, the decoy-state MDI-QKD equipped with some
security patches performs well with imperfect single-photon sources. However,
the key rate and communication distance are two implementation bottlenecks. To
exceed the linear scale of key rate [9, 10], twin-field QKD (TF-QKD) was
proposed by Lucamarini _et al._ [11] whose key rate scales linearly with
square-root of the channel transmittance $\eta$ by harnessing single-photon
interference over long distance. Though the security is not completed and the
security loophole is caused by the later announcement of the phase information
[12], then many variants of TF-QKD [12, 13, 14, 15, 16, 17] have been proposed
to deal with this security loophole and each has its advantages. Many effects
have been considered in real-life implementation to accelerate its
application, including finite key effects, the number of states with different
intensities, the phase slice of appropriate and asymmetric transmission
distance, etc. [18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32,
33, 34]. Meanwhile, several experiments of TF-QKD have been completed in
laboratory and field to demonstrate its ability to overcome the rate-distance
limit [35, 36, 37, 38, 39, 40, 41, 42].

However, the physical implementations of TF-QKD protocols with side channels
remains to be further researched at present. Since TF-QKD retains the MDI
characteristic, we should just focus on light source. Ideally, it is assumed
that the sending devices are placed in a protected laboratory, and can prepare
and encode quantum states correctly. Unfortunately, these conditions are not
met in practical systems, and state preparation flaws (SPFs) and leakage may
be induced from imperfect devices or Eve’s disturbance. A small imperfection
at source does not necessarily mean a small impact on the secret key rate,
because Eve could enhance such imperfection by exploiting channel loss.
Therefore, Eve can steal secret information actively by performing Trojan-
horse attack [43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55] on
modulators, lasers or attenuators and so on, or passively by harnessing the
SPFs and leakage caused by imperfect devices [5, 6, 56, 57, 58, 59].

In those QKD protocols with imperfect single-photon sources, the decoy-state
method is vital and employed to monitor the channel eavesdropping whose
security is based on the fact that Eve could not distinguish between decoy and
signal states. In practice, however, it does not with the behavior of the real
apparatuses or Eve’s disturbance. For instance, the probability distributions
of signal states and decoy states do not overlap in time domain totally with
pump-current modulation [58]. Besides, signal states and decoy states can be
distinguished with external intensity modulation in frequency domain when Eve
applying wavelength-selected photon-number-splitting attack actively in ’plug-
and-play’ systems [46]. This loophole is introduced by decoy-state method and
caused by the imperfections of modulators and modulation voltage. As the
decoy-state method is employed in TF-QKD protocols, it is of significance to
analyze its practical security in this aspect.

In this paper, we concentrate on the sending or not-sending (SNS) TF-QKD
protocol [12] with actively odd-parity pairing (AOPP) method and finite-key
effects taken into consideration [20, 21], and propose a complete and
undetected eavesdropping attack, named passive frequency shift attack, which
can take advantage of the most general side channels in frequency domain and
can be extended to other cases with distinguishable decoy states. In Sec. II,
we recap the frequency shift of intensity modulators (IMs) and test
experimentally the spectral distribution of signal pulses with external
modulation method which shows a side channel in frequency domain. In Sec. III,
we propose a passive frequency shift attack on SNS protocol and analyze its
adverse impact by giving the formula of upper bound of secure key rate and
comparing it with the lower bound of secret key rate under Alice and Bob’s
estimation with consideration of AOPP method and finite-key effects. In Sec.
IV, we present our simulation results. Last, we give some discussion about the
countermeasure of side channels in Sec. V and conclude in Sec. VI.

##  II Frequency shift of intensity modulators

In this section, we will recap the frequency shift of IMs and test
experimentally to show a side channel in frequency domain.

There are several kinds of intensity modulators, such as the Mach-Zehnder type
electro-optical intensity modulators (EOIMs), electro-absorption modulators
(EAMs), and acousto-optical modulators (AOMs). EOIMs, especially LiNbO3-based
devices, possess the excellent performance of wavelength-independent
modulation characteristics, excellent extinction performance (typically 20 dB)
and low insertion losses (typically 5 dB) [60].

LiNbO3-based EOIMs work by the principle of interference, controlled by
modulating the optical phase. The incoming light is coupled into a waveguide
and then split into two paths of a Mach-Zehnder interferometer equally and
interfere at an output coupler. The two arms made of lithium niobate will
induce a phase change when applying voltages. Accordingly, the intensity and
phase of output light will be modulated after interference depending on the
applied electrical voltages. Assuming voltages $V_{1}(t)$ and $V_{2}(t)$ are
applied to two arms separately with the input field of intensity $E_{0}$ and
frequency $\omega_{0}$, the output field can be written as [46]

$\displaystyle E_{\rm out}(t)=E_{0}{\rm
cos}[\Delta\varphi(t)]e^{i[\omega_{0}t+\varphi(t)]},$ (1)

where $\Delta\varphi(t)=[\gamma V_{1}(t)+\varphi_{1}-\gamma
V_{2}(t)-\varphi_{2}]/2$ and $\varphi(t)=[\gamma V_{1}(t)+\varphi_{1}+\gamma
V_{2}(t)+\varphi_{2}]/2$, $\gamma=\pi/V_{\pi}$ is the voltage-to-phase
conversion cofficients for two arms, and $\varphi_{1}$ and $\varphi_{2}$ are
the static phases which we will omit for simplicity. Here, $V_{\pi}$ is half-
wave voltage that is required to change the phase in one modulator arm by
$\pi$ radians. The output intensity is given by

$\displaystyle P_{\rm out}(t)=|E_{\rm
out}(t)|^{2}=\frac{P_{0}}{2}\bigl{[}1+{\rm cos}[\gamma V(t)]\bigr{]},$ (2)

where $V(t)=V_{1}(t)-V_{2}(t)$ and $P_{0}$ is the input optical power. The
phase maintains and intensity is determined by Eq. 2 on condition that the two
modulator arms are driven by the same amount, but in opposite directions (i.e.
$V_{1}(t)=-V_{2}(t)$), which is known as balanced driving or push–pull
operation. When $V(t)$ is constant we will get pure intensity modulation
without frequency shift. However, once $V(t)$ is not a constant any more,
something unexpected will arise to the output field. Specifically, frequency
shift will be induced as we can see, for example, if
$V_{1}(t)=-V_{2}(t)=V_{0}+kt$, the output field can be expressed as [46]

$\displaystyle E_{\rm out}=\frac{E_{0}}{2}\Bigl{[}e^{i[(\omega_{0}+\gamma
k)t+\gamma V_{0}]}+e^{i[(\omega_{0}-\gamma k)t+\gamma V_{0}]}\Bigr{]}.$ (3)

From Eq. 3, we can see a frequency shift of the light pulses with
$\pm\omega_{m}=\pm\gamma k$ compared with the original $\omega_{0}$, where $k$
is the slope of modulation voltage. Moreover, the frequency shift of the
output field will be more confusing when the modulation voltages are more
complicated in practical systems. We can analyze the spectrum of the output
field using the fast Fourier transform method.

To evaluate the frequency shift of different intensity pulses, we test it in
principle. Optical pulses with 1 ns pulse width are produced with a constant
intensity from a laser diode (Keysight 8164B) first, modulated by an IM driven
by an arbitrary waveform generator (Keysight M9505A) and measured by an
optical spectrum analyzer (Yokogawa AQ637D) last. Note that the measurement is
taken before the fixed attenuation as implemented in actual systems since the
probability of emitting pulses at the single-photon level follows the same
distribution. Fig. 1 illustrates the wavelength spectrum of three states with
intensity ratio taken from the SNS experiment [39] as 0.1: 0.384: 0.447
($\mu_{a}=0.1$, $\mu_{b}=0.384$, $\mu_{z}=0.447$). And the normalized
intensity probability distributions are shown in Fig. 2 to distinguish the
difference.

Figure 1:  The wavelength spectrum of three different states with intensity
ratio as 0.1: 0.384: 0.447 ($\mu_{a}=0.1$, $\mu_{b}=0.384$, $\mu_{z}=0.447$).
Figure 2:  The normalized intensity distribution of three different states
with intensity ratio as 0.1: 0.384: 0.447 ($\mu_{a}=0.1$, $\mu_{b}=0.384$,
$\mu_{z}=0.447$). Two dashed lines at 1550.1125 nm and 1550.131 nm are
boundaries that can be used to distinguish states with intensity $\mu_{z}$
($\mu_{b}$) and $\mu_{a}$. There are also some subtle differences between
states $\mu_{z}$ and $\mu_{b}$ in frequency domain.

Obviously, the states modulated by IMs of different intensities do not overlap
totally in frequency domain. The distinction of signal states (also strong
decoy states) and weak decoy states is evident as expected because the
amplitude of modulation voltages of signal and strong decoy states are higher
which will induce more frequency shift, and thus the peaks of the signal and
strong decoy states are lower than weak decoy states. More precisely, the
normalized probability of weak decoy states is higher than signal and strong
decoy states between 1550.112 nm and 1550.131 nm. There are also slight
differences between signal and strong decoy states. The difference will be
bigger when narrowing pulses or the line width as TF-QKD requires, or when the
intensity difference of the different states becomes larger. On this
foundation, Eve can apply a passive frequency shift attack by harnessing this
side channel.

##  III Passive frequency shift attack on SNS protocol

In this section, we propose a passive frequency shift attack scheme on
practical SNS TF-QKD systems by exploiting the side channels in frequency
domain and analyze its adverse impact by fiving the formula of upper bound of
secure key rate with consideration of AOPP method and finite-key effects. But
we note that this attack can be applied with other side channels except in
frequency domain.

In fact, the signal pulses (including signal states and decoy states) and
reference pulses must be modulated with a stable continuous-wave laser source
with external modulation method so as to estimate and compensate phase noise
in those TF-QKD protocols which need post-phase compensation, such as SNS TF-
QKD [12] and phase-matching (PM) TF-QKD [13]. Even if the synchronization can
not be controlled by Eve unlike discussed in Ref. [46, 47], the probability
distributions of signal states and decoy states may do not overlap inevitably
in frequency domain.

In the 4 intensity SNS TF-QKD protocol (see Appendix A for details), Alice and
Bob need to modulate the continuous light to 5 different intensities, the
maximum intensity pulses are used as phase reference pulses, the minimum as
vacuum states, while others as signal states, weak and strong decoy states. In
practical SNS systems [38, 39], three IMs are used to modulate these 5
different pulses to ensure that the output signal intensities are in agreement
with the theoretical requirements and the reference detections are high enough
for phase compensation. There will be side channels in frequency domain
inevitably. In what follows, we introduce the passive frequency shift attack.

Suppose Eve intercepts all signal pulses at Alice and Bob’s output ports where
the signal pulses haven’t been attenuated by channels, and then distinguishes
signal and decoy states with a wavelength division multiplexer (WDM) and three
single-photon detectors (SPDs) as illustrated in Fig. 3. Set internals
$T_{\alpha}$ properly, where $\alpha\in\\{z,a,b\\}$, according to the
wavelength spectrum of different states to distinguish the states with
intensity $\mu_{\alpha}$ but may fail with a certain probability.
Theoretically, $T_{\alpha}$ can be set as the union of two symmetric intervals
according to Eq. 3.

Figure 3:  Schematic of the passive frequency shift attack. PM: phase
modulator, IM: intensity modulator, ATT: attenuator, WDM: wavelength division
multiplexer, SPD: single-photon detector, S: light path selector, BS: beam
splitter, SNSPD: superconducting nanowire single-photon detectors. The light
path selector S1 (S2) is controlled by SPD1 (SPD1 and SPD2) and Bob’s device
is the same as Alice’s which we have omitted in figure.

Suppose the four ports of WDM 1, 2, 3 and 4 can export photons with frequency
located in $T_{z}$, $T_{a}$, $T_{b}$ and others. The light path selector S1
(S2) is controlled by SPD1 (SPD1 and SPD2). Denote as 1 or 0 when SPD (i.e.
SPD1, SPD2 or SPD3) clicks or not, and 1 or 0 when the light path selector
(i.e. S1 or S2) selects the up or down path. Then we set

$\displaystyle{\rm S1}$ $\displaystyle=\overline{{\rm SPD1}},$
$\displaystyle{\rm S2}$ $\displaystyle={\rm SPD1}\vee{\rm SPD2}.$ (4)

Note that only one SPD at most will click under this principle. According to
the response of SPDs, set the total transmittance as $\eta_{z}$, $\eta_{a}$,
$\eta_{b}$ or $\eta_{k}$ when SPD1, SPD2, SPD3 clicks or none of them click,
respectively. In this process, Eve could get partial raw key bits after Alice
(Bob) announces their signal and decoy windows, which can be understood in
this way that Eve can conclude their key bits as 1 (0) when ${\rm
SPD1}\vee{\rm SPD2}\vee{\rm SPD3}=1$ in $Z$ windows. There is no bit-flip
error between Alice (Bob) and Eve because Eve can intercepts photons at output
ports without stray photons. Only the raw bits are secure in $Z$ windows when
${\rm SPD1}\vee{\rm SPD2}\vee{\rm SPD3}=0$ on both sides. On the one hand,
once Eve detects photons successfully on one side, the bit is either the same
or a bit-flip error with the other side which will be revealed in the error
correction step (and pre-error correction process when AOPP is performed). On
the other hand, the bits are balanced (i.e. random for Eve) in one-detector
heralded events with ${\rm SPD1}\vee{\rm SPD2}\vee{\rm SPD3}=0$ which means
the raw bits are secure in these windows. Though Eve could not distinguish the
decoy states and signal states without errors, once the transmittance of
signal and decoy states differ from others, the decoy-state method may not
estimate the count rate and phase-flip error rate of single-photon states
correctly. When the actual secure key rate is lower than the estimated one,
the final secret string is insecure partially.

We emphasize that this attack will not introduce unnecessary errors as the
beam splitting and measurement by Eve can be seen as a loss and the rest of
the pulses are coherent states with no phase noise. What is more, Eve could
control errors completely expect the inherent errors of the protocol through
channels, superconducting nanowire single-photon detectors (SNSPDs) and
classic information he announces. In the following, we will analyze the
negative effect of this passive frequency shift attack.

Consider the most general case, we assume that the envelope of wavelength
spectrum can be written as $f_{\beta}(\lambda)$, where $\beta\in\\{z,a,b\\}$.
The wavelength spectrum of signal states and decoy states could not totally
overlap. By setting the internals $T_{\alpha}$ properly, Eve can distinguish
the decoy states and siganl states with errors. The proportion of state
$\mu_{\beta}$ in internals $T_{\alpha}$ can be shown as

$\displaystyle r_{\beta|\alpha}=\int_{T_{\alpha}}f_{\beta}(\lambda)d\lambda,$
(5)

where $\alpha$, $\beta\in\\{z,a,b\\}$. Which one detector will click obeys a
certain probability distribution. Therefore, the states of intensity
$\mu_{\beta}$ would be transformed with one of four different transmittance
$\varOmega_{\beta}=\\{\eta_{\beta z},\eta_{\beta a},\eta_{\beta b},\eta_{\beta
k}\\}$ with a finite probability, where

$\displaystyle\eta_{\beta z}=$ $\displaystyle\eta_{z}(1-r_{\beta|z}),$
$\displaystyle\eta_{\beta a}=$
$\displaystyle\eta_{a}(1-r_{\beta|z}-r_{\beta|a}),$ $\displaystyle\eta_{\beta
b}=$ $\displaystyle\eta_{b}(1-r_{\beta|z}-r_{\beta|a}-r_{\beta|b}),$
$\displaystyle\eta_{\beta k}=$
$\displaystyle\eta_{k}(1-r_{\beta|z}-r_{\beta|a}-r_{\beta|b}).$ (6)

Table 1:  List of experimental parameters. Here, $\gamma$ is the fiber loss coefficient (dB/km), $\eta_{d}$ is the detection efficiency of detectors, $e_{d}$ is the misalignment-error probability, $f_{\rm EC}$ is the error correction inefficiency, $\xi$ is the failure probability of statiscal fluctuations analysis, $p_{d}$ is the dark count rate and $M$ is the number of phase slices. $\gamma$ | $\eta_{d}$ | $e_{d}$ | $f_{\rm EC}$ | $\xi$ | $p_{d}$ | $M$
---|---|---|---|---|---|---
0.2 | 56% | 0.1 | 1.1 | $2.2\times 10^{-9}$ | $10^{-10}$ | 16
Table 2:  List of experimental parameters about intensity and probability Alice and Bob select. $\mu_{a}$ | $\mu_{b}$ | $\mu_{z}$ | $p_{z}$ | $p_{a}$ | $p_{b}$ | $p_{z0}$
---|---|---|---|---|---|---
0.1 | 0.384 | 0.447 | 0.776 | 0.85 | 0.073 | 0.732
Table 3:  Five groups of the proportion $r_{\beta|\alpha}$ of state $\mu_{\beta}$ in internals $T_{\alpha}$. | $r_{z|z}$ | $r_{a|z}$ | $r_{b|z}$ | $r_{z|a}$ | $r_{a|a}$ | $r_{b|a}$ | $r_{z|b}$ | $r_{a|b}$ | $r_{b|b}$
---|---|---|---|---|---|---|---|---|---
G1 | 0.01 | 0.008 | 0.01 | 0.01 | 0.1 | 0.01 | 0.01 | 0.008 | 0.01
G2 | 0.01 | 0.008 | 0.01 | 0.005 | 0.1 | 0.005 | 0.01 | 0.008 | 0.01
G3 | 0.01 | 0.008 | 0.01 | 0.01 | 0.2 | 0.01 | 0.01 | 0.008 | 0.01
G4 | 0.01 | 0.005 | 0.01 | 0.005 | 0.2 | 0.005 | 0.01 | 0.005 | 0.01
G5 | 0.01 | 0.008 | 0.01 | 0 | 0.1 | 0 | 0.01 | 0.008 | 0.01

Here, the attenuation coefficient comes from Eve’s interfection and detection,
and the total transmittance can be controlled by Eve completely which means
that Eve is allowed to use a lower-loss or even lossless channel and perfect
detectors with 100% detection efficiency and no dark count, and could select
internals freely to obtain a satisfactory results. For states with intensity
$\mu_{\beta}$, the probability of being transmitted with
$\eta_{\beta\gamma}\in\varOmega_{\beta}$, $\gamma\in M=\\{z,a,b,k\\}$ can be
shown as

$\displaystyle p_{\beta z}$ $\displaystyle=(1-e^{-\mu_{\beta|z}}),$
$\displaystyle p_{\beta a}$
$\displaystyle=e^{-\mu_{\beta|z}}(1-e^{-\mu_{\beta|a}}),$ $\displaystyle
p_{\beta b}$
$\displaystyle=e^{-\mu_{\beta|z}}e^{-\mu_{\beta|a}}(1-e^{-\mu_{\beta|b}}),$
$\displaystyle p_{\beta k}$
$\displaystyle=e^{-\mu_{\beta|z}}e^{-\mu_{\beta|a}}e^{-\mu_{\beta|b}},$ (7)

where $\mu_{\beta|\alpha}=\mu_{\beta}r_{\beta|\alpha}$. Here,
$e^{-\mu_{\beta|\alpha}}$ is the probatility of zero photon in internals
$T_{\alpha}$ with intensity $\mu_{\beta}$.

Since TF-QKD protocols are proposed for the implementation of long optical
fiber communications, Eve’s best target is to acquire more percentage of keys
by minimizing $\eta_{k}$ as far as possible while maintaining the key rate and
communication distance under Alice and Bob’s estimation. When the
communication distance is long enough, Eve may steal all secret key bits.

There are two key rates matter: the lower bound of secret key rate under Alice
and Bob’s estimation $R_{e}$ and the upper bound of real secure key rate
$R_{u}$. Note that Alice and Bob could not estimate $R_{e}$ correctly under
this attack since it is impossible to pick out the decoy states that have
undergone the same operation as the signal states, i.e. the decoy-state method
does not work properly.

When AOPP method is performed with partial bits leaked to Eve, Bob only
chooses odd-parity bit pairs and they will keep the second bit if Alice’s bits
pairs are odd, too. In this process, Eve’s information on raw bits does not
reduce as the parity information is public. Therefore, the upper bound of
secure key rate $R_{u}$ can be shown as

$\displaystyle R_{u}=n_{1,{\rm sec}}[1-H(e_{\rm
in})]-n_{t}^{\prime}fH(E_{Z}^{\prime}),$ (8)

where $n_{1,{\rm sec}}$ is the upper bound of single photons which can be used
to distill secure key bits and $e_{\rm in}$ is the inherent phase-flip error
rate (i.e. the lower bound of untagged bits) determined by the number of phase
slices $M$. These two parameters will be discussed in Appendix B.

This attack can be applied as long as the wavelength spectrum distributions of
signal and decoy states are different. The effect of this attack varies based
on the discernibility of different states. However, this attack can be
extended to other imperfections with distinguishable decoy states, like the
polarization, temporal shape, etc. by replacing the WDM with appropriate
devices.

##  IV Numerical simulations

Figure 4:  The estimated lower bound of secret key rate $R_{e}$ and upper
bound of real secure key rates $R_{ui}$ in logarithmic scale versus
tranmission distance (between Alice and Bob) under passive frequency shift
attack, where $i\in\\{1,2,3,4,5\\}$, with experimental parameters listed in
Table 1, 2 and 3. The solid line corresponds to the etimated key rate $R_{e}$
which is the same as that without attack, while the dashed lines represent the
upper bound of real secure key rate $R_{ui}$. And the real secure key rate
$R_{u5}$ not shown in the figure is identically 0.

We numerically simulate the behaviour of SNS protocol under passive frequency
shift attack in this section. There are nine parameters obtained by statistic
in practical systems before AOPP, including $n_{\alpha\beta}$,
$n_{\Delta^{+}}^{R}$, $n_{\Delta^{-}}^{L}$, $n_{t}$ and $E_{z}$, where
$n_{t}=n_{\rm sig}+n_{\rm err}$ is the length of raw keys, $\alpha\beta\in
S=\\{vv,va,av,vb,bv\\}$. Here, $E_{z}=n_{\rm err}/n_{t}$, $n_{\rm sig}$ and
$n_{\rm err}$ is the number of right and wrong raw bits, respectively. Under
passive frequency shift attack, the parameters can be simulated as discussed
in Appendix C. The promotion to AOPP is trival as the attack is not applied.

For simulation purposes, the experimental parameters listed in Tables 1 and 2
are taken according to the SNS experiment [39] with a little modification.
Then we simulate the normal secret key rate without frequency shift attack,
the key rate under Alice and Bob’s estimation and the upper bound of secure
key rate under frequency shift attack with AOPP and finite-key effects by
selecting five groups of reasonable parameters about $r_{\beta|\alpha}$ listed
in Tables 3 following the principle that the difference between signal states
(strong decoy states) and weak decoy states is significant while small between
signal and strong decoy states.

In Fig. 4, the estimated key rate $R_{e}$ under passive frequency shift attack
represented by the solid line is the same as that without attack which means
this attack will not be detected by Alice and Bob with the list of
experimental parameters in Table 1, 2 and 3. In comparison, the dashed lines
represent the upper bound of secure key rates $R_{u}$ under frequency shift
attack. Denote the the upper bound of secure key rate under parameters in
Group $i$ (G$i$) in Table 3 as $R_{ui}$, where $i\in\\{1,2,3,4,5\\}$. Compared
$R_{u1}$ with $R_{u2}$, we can find that the difference between weak decoy
states and signal states (strong decoy states) affects the effects of attack
significantly i.e. the communication distance is limited from 472 km to 368 km
when the difference changes from 10 times to 20 times. The negative effects
will be more greater when $r_{z|a}:r_{a|a}:r_{b|a}$ is constant but the
absolute values increase by comparing $R_{u2}$ with $R_{u3}$. The secure
distance will be limited to shorter when the difference becomes larger by
contrasting $R_{u2}$ and $R_{u4}$. Besides, Alice and Bob could not distribute
keys when Eve can distinguish weak decoy states correctly with parameters of
Group 5. On the one hand, if Alice and Bob attach importance to these side
channels and know Eve’s action, this attack will limit the communication
distance. Note that the distance and key rate will be more pessimistic since
the key rates $R_{ui}$ is only the upper bound. Otherwise, the secret key bits
will be insecure over long distance especially. For example, the key bits are
all insecure when the estimated key rate is $10^{-8}$ per pulse at 479 km (an
acceptable value at long distance).

In this attack, we have assumed that Eve intercepts photons in the order of
$T_{z}$, $T_{a}$ and $T_{b}$, but we find there is no obvious difference when
changing this order through numerical simulations which can be understood in
this way that only the photons are secure with ${\rm SPD1}\vee{\rm
SPD2}\vee{\rm SPD3}=0$, i.e. only the pulses that are not detected by Eve in
all internals $T_{\alpha}$ are secured, or there will be no difference in any
order when $r_{\alpha|\beta}=0$ with $\alpha\neq\beta$.

##  V Discussion

This eavesdropping attack proposed above is a passive attack harnessing the
side channels and hard to be detected. To guarantee security in practical
systems with side channels, the first potential way is to improve experimental
techniques or modulation methods to restrain side channels but may be
unavoidable when one is closed, but another appears. The second alternative is
to develop mathematical models in theory to maximize the secure key rates
under attacks, like the loss-tolerant method [61, 62, 63, 64, 65] but needs an
accurate characterization of real apparatuses. It may be an ongoing search for
side channels to guarantee the practical security of QKD systems.

##  VI Conclusion

The goal of QKD at present is to provide long-distance and high-speed key
distribution, which will induce side channels inevitably. Increasing
repetition rate and narrowing pulses to improve speed will make the pulses
complex and distinguishable, like the frequency, polarization, temporal shape,
and so on. Any small imperfections may be exploited and enhanced utilizing
channel loss by Eve, especially at long distance. Therefore, it is necessary
to pay more attenuation to the practical security of TF-QKD systems.

In this paper, we have investigated and tested the side channels with external
modulation which is required in those TF-QKD protocols with post-phase
compensation, like SNS TF-QKD [12] and PM TF-QKD [13]. Based on this, we
propose a complete and undetected eavesdropping attack named passive frequency
shift attack on SNS protocol which can be applied once there are differences
between different states in frequency domain and can be extended to other
imperfections with distinguishable decoy states. Normally, Alice and Bob could
estimate the lower bound of secret key rate correctly no matter what Eve does.
But this estimation is not accurate once Eve’s operation on signal and decoy
states is different which may cause insecure bits when the upper bound of
secure key rate is lower than the estimated lower one. According to the
numerical results, Eve can get full information about the secret key bits at
long distance if Alice and Bob neglect this distinguishability. For example,
the key bits are all insecure when the estimated key rate is $10^{-8}$ per
pulse at 479 km under the five selected groups of parameters. As there is a
variety of potentially exploitable loopholes at source, our results emphasize
the practical security of the light source. It is a constant search to build
hardened implementations of practical QKD systems.

###### Acknowledgements.

This work is supported by National Key Research and Development Program of
China (Grant No. 2020YFA0309702) and National Natural Science Foundation of
China (Grants N0. 61605248, No. 61675235 and No. 61505261).

##  Appendix A SNS TF-QKD protocol

We make a review of the SNS protocol and the key rate formula with AOPP method
and finite-key effects [12, 20, 21] in this section.

(1) Preparation and measurement. At any time window $i$, Alice (Bob) randomly
determines whether it is a signal window or a decoy window with probabilities
$p_{z}$ and $p_{x}=1-p_{z}$. If it is a signal window, Alice (Bob) sends a
phase-randomized coherent state with intensity $\mu_{z}$ and denotes it as 1
(0), or a vacuum state $|0\rangle$ and denotes it as 0 (1) with probabilities
$p_{z1}=1-p_{z0}$ and $p_{z0}$, seperately. If it is a decoy window, Alice
(Bob) sends a phase-randomized coherent state
$|\sqrt{\mu_{a}}e^{i\theta_{A}}\rangle$,
$|\sqrt{\mu_{b}}e^{i\theta_{A}^{\prime}}\rangle$ or $|0\rangle$
($|\sqrt{\mu_{a}}e^{i\theta_{B}}\rangle$,
$|\sqrt{\mu_{b}}e^{i\theta_{B}^{\prime}}\rangle$ or $|0\rangle$) with
probabilities $p_{a}$, $p_{b}$ and $p_{v}=1-p_{a}-p_{b}$, where
$\mu_{a}<\mu_{b}$. The third party, Chrelie, renamed as Eve is supposed to
perform interferometic measurements on the incoming pulses and announce the
results.

(2) Different types of time windows. Suppose Alice and Bob repeat the above
process $N$ times, then they announce their signal windows and decoy windows
through public channels. If both Alice and Bob determine a signal window, it
is a $Z$ window. And the effective events in $Z$ windows are defined as one-
detector heralded events no matter which detector clicks. Alice and Bob will
get two raw $n_{t}$-bit strings $Z_{A}$ and $Z_{B}$ according to effective
events in $Z$ windows. Note that the phase-randomized coherent state of
intensity $\mu$ is equivalent to a probabilistic mixture of different photon-
number states $\sum_{k=0}^{\infty}\frac{e^{-\mu}\mu^{k}}{k!}|k\rangle\langle
k|$. Therefore, we can define $Z_{1}$ windows as a subset of $Z$ windows when
only one party determines to send and she (he) actually sends a single-photon
state $|1\rangle$. The bits from effective $Z_{1}$ windows are regarded as
untagged bits by the tagged model [66]. Then the intensity of pulses would be
announced to each other expect the intensity in $Z$ windows. If both commit to
a decoy window, it is an $X$ window. Alice and Bob also announce their phase
information $\theta_{A}$, $\theta_{B}$ when they choose the same intensity
$\mu_{a}$ in an $X$ window denoted as an $X_{a}$ window. And if only one
detector clicks in $X_{a}$ windows with phases satisfying

$\displaystyle|\theta_{A}-\theta_{B}-\varphi_{AB}|\leq\Delta/2$ (9)

or

$\displaystyle|\theta_{A}-\theta_{B}-\pi-\varphi_{AB}|\leq\Delta/2,$ (10)

it is an effective event in $X_{a}$ windows. All effective events in $X_{a}$
windows can be divided into two subsets as $C_{\Delta^{+}}$ and
$C_{\Delta^{-}}$ according Eq. 9 and Eq. 10, respectively. And the number of
events in $C_{\Delta^{+}}$ and $C_{\Delta^{-}}$ can be defined as
$N_{\Delta^{+}}$ and $N_{\Delta^{-}}$. Here, $\varphi_{AB}$ is set properly to
obtain a satisfactory key rate which will be different over time due to phase
drift and can be obtained with reference pulses. In the following, we will
omit the phase drift without loss of generality and set $\varphi_{AB}=0$.

(3) Parameter estimation. They can estimate parameters, including the bit-flip
error rate of the raw bits $E_{Z}$, the lower bound of untagged bits
$\underline{n}_{1}$ (or the lower bound of the counting rate
$\underline{s}_{1}$ equivalently) and the upper bound of the phase-flip error
rate of untagged bits $\overline{e}_{1}^{ph}$. The bit-flip error rate $E_{Z}$
can be obtained by error test, $\underline{s}_{1}$ and $\overline{e}_{1}^{ph}$
can be estimated with decoy state method as follows.

Denote $\rho_{v}=|0\rangle\langle 0|$,
$\rho_{a}=\sum_{k=0}^{\infty}e^{-\mu_{a}}\mu_{a}^{k}/k!|k\rangle\langle k|$
and $\rho_{b}=\sum_{k=0}^{\infty}e^{-\mu_{b}}\mu_{b}^{k}/k!|k\rangle\langle
k|$, where $\rho_{a}$ and $\rho_{b}$ are density operators of the phase-
randomized coherent states used in $X$ windows in which the phase is not
announced. Let $N_{\alpha\beta}$ be the number of intsnces Alice sends state
$\rho_{\alpha}$ and Bob sends state $\rho_{\beta}$ and $n_{\alpha\beta}$ be
the number of corresponding one-detector heralded events, where
$\alpha\beta\in S=\\{vv,va,av,vb,bv\\}$. Thus, the counting rate can be
defined as $S_{\alpha\beta}=n_{\alpha\beta}/N_{\alpha\beta}$. And
$\underline{s}_{1}$ can be estimated with decoy-state method as [67, 18]

$\displaystyle\underline{s}_{1}\geq$
$\displaystyle\frac{1}{2\mu_{a}\mu_{b}(\mu_{b}-\mu_{a})}[\mu_{b}^{2}e^{\mu_{a}}(S_{va}+S_{av})$
(11)
$\displaystyle-\mu_{a}^{2}e^{\mu_{b}}(S_{vb}+S_{bv})-2(\mu_{b}^{2}-\mu_{a}^{2})S_{vv}].$

Denote the bit-flip errors in $C_{\Delta^{+}}$ ($C_{\Delta^{-}}$) as the
effective events when the right (left) detector clicks and its total number as
$n_{\Delta^{+}}^{R}$ ($n_{\Delta^{-}}^{L}$). The bit-flip error rate in
$C_{\Delta}=C_{\Delta^{+}}\bigcup C_{\Delta^{-}}$ can be shown as

$\displaystyle
T_{\Delta}=\frac{n_{\Delta^{+}}^{R}+n_{\Delta^{-}}^{L}}{N_{\Delta^{+}}+N_{\Delta^{-}}}.$
(12)

Therefore $\overline{e}_{1}^{ph}$ can be estimated with decoy-state method as
[12, 18]

$\displaystyle\overline{e}_{1}^{ph}\leq\frac{T_{\Delta}-1/2e^{-2\mu_{a}}S_{vv}}{2\mu_{a}e^{-2\mu_{a}}\underline{s}_{1}}.$
(13)

(4) Key rate formula. With these quantities, the final key length can be
expressed as [68, 12]

$\displaystyle R=$ $\displaystyle
2p_{z0}(1-p_{z0})\mu_{z}e^{-\mu_{z}}\underline{s}_{1}[1-H(\overline{e}_{1}^{ph})]$
(14) $\displaystyle-n_{t}fH(E_{Z})/N.$

where $N_{f}$ is the number of final bits, $H(x)=-x{\rm log}_{2}x-(1-x){\rm
log}_{2}(1-x)$ is the binary entropy function, and $f$ is the error correction
efficiency factor.

(5) AOPP method. AOPP method [20, 21] is a pre-error correction process on raw
strings $Z_{A}$ and $Z_{B}$ proposed to improve the direct tranmission key
rate. In AOPP method, Bob randomly select two unequal bits as pairs and will
obtain $n_{p}={\rm min}(n_{t0},n_{t1})$ pairs, where $n_{t0}$ ($n_{t1}$) is
the number of bits 0 (1) in raw string $Z_{B}$. There will be only two types
of pairs can be survived when Alice make exactly the same or opposite decision
as Bob for two bits, and denote the number as $n_{vd}$ or $n_{cc}$,
respectively. Therefore, the bit error after AOPP is shown as

$\displaystyle E_{Z}^{\prime}=\frac{n_{vd}}{n_{cc}+n_{vd}}.$ (15)

The lower bound of the number of untagged bits is

$\displaystyle\underline{n}_{1}^{\prime}=n_{p}\frac{\underline{n}_{1}^{0}}{n_{t0}}\frac{\underline{n}_{1}^{1}}{n_{t1}},$
(16)

where $\underline{n}_{1}^{0}$ and $\underline{n}_{1}^{1}$ is the lower bound
of untagged bits when they make the opposite decision and obtain bits 0 and 1,
correspondingly. And the phase-flip error rate changed into
${\overline{e}^{\prime}}_{1}^{ph}=2\overline{e}_{1}^{ph}(1-\overline{e}_{1}^{ph})$.
Besides, finite-key effects should be considered in practical systems using
Chernoff bound [69, 70] and the parameters can be estimated as
$n_{1}^{\prime}=\varphi^{L}(\underline{n}_{1}^{\prime})$ and $e_{1}^{\prime
ph}=\varphi^{U}(\underline{n}_{1}^{\prime}\overline{e}_{1}^{\prime
ph})/\underline{n}_{1}^{\prime}$. Finally, the improved key length can be
shown as [21, 20, 68]

$\displaystyle N_{f}^{\prime}=$ $\displaystyle
n_{1}^{\prime}[1-H({e^{\prime}}_{1}^{ph})]-n_{t}^{\prime}fH(E_{Z}^{\prime})-{\rm
log}_{2}\frac{2}{\varepsilon_{cor}}$ (17) $\displaystyle-2{\rm
log}_{2}\frac{1}{\sqrt{2}\varepsilon_{PA}\hat{\varepsilon}}.$

##  Appendix B Details of the upper bound of secure key rate

To obtain the upper bound of secure key rate, we should consider the ideal
situation, i.e. the upper bound of the number of secure single photons and the
lower bound of phase-flip error rate without finite-key effects.

Ideally, the single photons which could be used to distill secure key bits
(i.e. the upper bound of secure untagged bits) after AOPP can be shown as

$\displaystyle n_{1,{\rm
sec}}=n_{p}\frac{n_{1s}^{0}}{n_{t0}}\frac{n_{1s}^{1}}{n_{t1}},$ (18)

where

$\displaystyle
n_{1s}^{0}=n_{1s}^{1}=Np_{z}^{2}p_{z0}(1-p_{z0})p_{zk}u_{z}\eta_{zk}e^{-u_{z}\eta_{zk}}.$
(19)

In the rest, we will analyze this inherent phase-flip error rate from the
perspective of virtual protocol. In the virtual protocol [12], Alice and Bob
will prepare an extended state

$\displaystyle|\varPsi\rangle=\frac{1}{\sqrt{2}}(e^{i\delta_{B}}|01\rangle\otimes|01\rangle+e^{i\delta_{A}}|10\rangle\otimes|10\rangle),$
(20)

with restriction of Eq. (9) or (10) which is equivalent to the state
$[|01\rangle\langle 01|\otimes|01\rangle\langle 01|+|10\rangle\langle
10|\otimes|10\rangle\langle 10|]/2$ when Alice and Bob measure ancillary
photons in photon-number basis in advance. Those states left of $\otimes$ are
real states which will be sent to Charlie, while the right are local ancillary
states with bit value encoded. Local state $|0\rangle$ corresponds to a bit 0
(1), and state $|1\rangle$ corresponds to a bit 1 (0) for Alice (Bob). In
order to obtain lower bound of phase-flip error rate, consider the ideal
situation in which the phase shift can be compensated perfectly which is
equivalent to no phase shift. After interference and detection, the local
states change into

$\displaystyle\rho_{l}=\frac{1}{2}[|\varphi_{1}\rangle\langle\varphi_{1}|+|\varphi_{2}\rangle\langle\varphi_{2}|],$
(21)

where

$\displaystyle|\varphi_{1}\rangle$
$\displaystyle=[|01\rangle+e^{i\delta}|10\rangle]/\sqrt{2},$
$\displaystyle|\varphi_{2}\rangle$
$\displaystyle=[|01\rangle-e^{i\delta}|10\rangle]/\sqrt{2},$ (22)

with $\delta=\delta_{A}-\delta_{B}$. When the local ancillary states measured
virtually with basis $|\Phi^{0}\rangle=[|01\rangle+|10\rangle]/\sqrt{2}$ and
$|\Phi^{1}\rangle=[|01\rangle-|10\rangle]/\sqrt{2}$, the phase-flip error rate
before AOPP can be shown as

$\displaystyle e_{\rm in}^{\prime}=\frac{e_{\rm in}^{0}+e_{\rm in}^{1}}{2},$
(23)

where $e_{\rm in}^{0}$ and $e_{\rm in}^{1}$ are phase-flip error rate when
$\delta_{A}$ and $\delta_{B}$ satisfy Eq. (9) and (10), respectively,

$\displaystyle e_{\rm in}^{0}$ $\displaystyle={\rm
Tr}[|\Phi^{1}\rangle\langle\Phi^{1}|\rho_{l}],$ $\displaystyle e_{\rm in}^{1}$
$\displaystyle={\rm Tr}[|\Phi^{0}\rangle\langle\Phi^{0}|\rho_{l}].$ (24)

On average, the inherent phase-flip error will be $\overline{e}_{\rm
in}^{\prime}=\int_{-\pi/M}^{\pi/M}e_{\rm in}^{\prime}dM\delta/2\pi$ and is
approximately equal to 0.0032 when $M=16$. Thus, we can obtain the inherent
phase-flip error rate with AOPP method as $e_{\rm in}=2\overline{e}_{\rm
in}^{\prime}(1-\overline{e}_{\rm in}^{\prime})$.

##  Appendix C Details of numerical simulations

Under passive frequency shift attack, the parameters obtained by statistic can
be shown as follows

$\displaystyle n_{\rm sig}=$ $\displaystyle
4Np_{z}^{2}p_{z0}p_{z1}\sum_{\gamma\in
M}p_{z\gamma}\bigl{[}\overline{p}_{d}e^{-\frac{\mu_{z\gamma}}{2}}-\overline{p}_{d}^{2}e^{-\mu_{z\gamma}}\bigr{]},$
(25) $\displaystyle n_{\rm err}=$ $\displaystyle
2Np_{z}^{2}\Big{[}p_{z1}^{2}\sum_{\gamma_{1},\gamma_{2}\in
M}p_{z\gamma_{1}}p_{z\gamma_{2}}\bigl{[}-\overline{p}_{d}^{2}e^{-(\mu_{z\gamma_{1}}+\mu_{z\gamma_{2}})}$
(26)
$\displaystyle+\overline{p}_{d}e^{-\frac{\mu_{z\gamma_{1}}+\mu_{z\gamma_{2}}}{2}}I_{0}(\sqrt{\mu_{z\gamma_{1}}\mu_{z\gamma_{2}}})\bigr{]}+p_{z0}^{2}p_{d}\overline{p}_{d}\Bigr{]},$
$\displaystyle n_{\alpha v}=$ $\displaystyle 2N_{\alpha v}\sum_{\gamma\in
M}p_{\alpha\gamma}[\overline{p}_{d}e^{-\mu_{\alpha\gamma}/2}-\overline{p}_{d}^{2}e^{-\mu_{\alpha\gamma}}],$
(27) $\displaystyle n_{v\beta}=$ $\displaystyle 2N_{v\beta}\sum_{\gamma\in
M}p_{\beta\gamma}[\overline{p}_{d}e^{-\mu_{\beta\gamma}/2}-\overline{p}_{d}^{2}e^{-\mu_{\beta\gamma}}],$
(28) $\displaystyle n_{vv}=$ $\displaystyle 2N_{vv}p_{d}\overline{p}_{d},$
(29)

where $p_{d}$ is the dark count rate and $\overline{p}_{d}=1-p_{d}$, and
$\mu_{\beta\gamma}=\mu_{\beta}\eta_{\beta\gamma}$. Here, $\beta\in\\{a,b,z\\}$
and $\gamma\in M$. Note that the intensities of state
$|e^{i\theta_{A}}\sqrt{\mu_{a}\eta_{a\gamma_{1}}}\rangle$ and
$|e^{i\theta_{B}}\sqrt{\mu_{a}\eta_{a\gamma_{2}}}\rangle$ from Alice and Bob
in $X_{a}$ windows may be different after passive frequency shift attack where
$\gamma_{1}$, $\gamma_{2}\in M$, but this does not mean it could not cause
right detection. After interference, the intensity of left and right detectors
will be

$\displaystyle\mu_{l}(\gamma_{1},\gamma_{2})=$
$\displaystyle\frac{1}{2}\Bigl{[}\mu_{a\gamma_{1}}+\mu_{a\gamma_{2}}+2\sqrt{\mu_{a\gamma_{1}}\mu_{a\gamma_{2}}}{\rm
cos}\delta\Bigr{]},$ (30) $\displaystyle\mu_{r}(\gamma_{1},\gamma_{2})=$
$\displaystyle\frac{1}{2}\Bigl{[}\mu_{a\gamma_{1}}+\mu_{a\gamma_{2}}-2\sqrt{\mu_{a\gamma_{1}}\mu_{a\gamma_{2}}}{\rm
cos}\delta\Bigr{]},$ (31)

where $\delta=\theta_{B}-\theta_{A}$. We can see that the difference of two
output intensities does not determined by the distinction of two input
intensities but phase difference. Then the number of error events in
$C_{\Delta^{\pm}}$ can be shown as

$\displaystyle n_{\Delta^{+}}^{R}$
$\displaystyle=N_{\Delta^{+}}\sum_{\gamma_{1},\gamma_{2}\in
W}p_{a\gamma_{1}}p_{a\gamma_{2}}\Big{[}-\overline{p}_{d}^{2}e^{-\mu_{a\gamma_{1}}-\mu_{a\gamma_{2}}}$
(32)
$\displaystyle+\overline{p}_{d}\int_{-\Delta/2}^{\Delta/2}e_{d}e^{-\mu_{r}(\gamma_{1},\gamma_{2})}+\overline{e}_{d}e^{-\mu_{l}(\gamma_{1},\gamma_{2})}d\frac{\delta}{\Delta}\Bigr{]},$

where $e_{d}$ is the misalignment-error probability and
$\overline{e}_{d}=1-e_{d}$. Similarly, we can obtain $n_{\Delta^{-}}^{L}$.

## References

  * Bennett and Brassard [2014] C. H. Bennett and G. Brassard, Quantum cryptography: Public key distribution and coin tossing, Theor. Comput. Sci. 560, 7 (2014).
  * Shor and Preskill [2000] P. W. Shor and J. Preskill, Simple proof of security of the bb84 quantum key distribution protocol, Phys. Rev. Lett. 85, 441 (2000).
  * Xu  _et al._ [2020a] F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan, Secure quantum key distribution with realistic devices, Rev. Mod. Phys. 92, 025002 (2020a).
  * Lo  _et al._ [2012] H. K. Lo, M. Curty, and B. Qi, Measurement-device-independent quantum key distribution, Phys. Rev. Lett. 108, 130503 (2012).
  * Brassard  _et al._ [2000] G. Brassard, N. Lütkenhaus, T. Mor, and B. C. Sanders, Limitations on practical quantum cryptography, Phys. Rev. Lett. 85, 1330 (2000).
  * Lütkenhaus and Jahma [2002] N. Lütkenhaus and M. Jahma, Quantum key distribution with realistic states: photon-number statistics in the photon-number splitting attack, New J. Phys. 4, 44 (2002).
  * Hwang [2003] W. Y. Hwang, Quantum key distribution with high loss: toward global secure communication, Phys. Rev. Lett. 91, 057901 (2003).
  * Lo  _et al._ [2005] H. K. Lo, X. Ma, and K. Chen, Decoy state quantum key distribution, Phys. Rev. Lett. 94, 230504 (2005).
  * Takeoka  _et al._ [2014] M. Takeoka, S. Guha, and M. M. Wilde, Fundamental rate-loss tradeoff for optical quantum key distribution, Nat. Commun. 5, 5235 (2014).
  * Pirandola  _et al._ [2017] S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, Fundamental limits of repeaterless quantum communications, Nat. Commun. 8, 15043 (2017).
  * Lucamarini  _et al._ [2018] M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J. Shields, Overcoming the rate-distance limit of quantum key distribution without quantum repeaters, Nature 557, 400 (2018).
  * Wang  _et al._ [2018] X.-B. Wang, Z.-W. Yu, and X.-L. Hu, Twin-field quantum key distribution with large misalignment error, Phys. Rev. A 98, 062323 (2018).
  * Ma  _et al._ [2018] X. Ma, P. Zeng, and H. Zhou, Phase-matching quantum key distribution, Phys. Rev. X 8, 031043 (2018).
  * Curty  _et al._ [2019] M. Curty, K. Azuma, and H.-K. Lo, Simple security proof of twin-field type quantum key distribution protocol, npj Quant. Inf. 5, 64 (2019).
  * Cui  _et al._ [2019] C. Cui, Z.-Q. Yin, R. Wang, W. Chen, S. Wang, G.-C. Guo, and Z.-F. Han, Twin-field quantum key distribution without phase postselection, Phys. Rev. Appl. 11, 034053 (2019).
  * Lin and Lütkenhaus [2018] J. Lin and N. Lütkenhaus, Simple security analysis of phase-matching measurement-device-independent quantum key distribution, Phys. Rev. A 98, 042332 (2018).
  * Tamaki  _et al._ [2018] K. Tamaki, H. Lo, W. Wang, and M. Lucamarini, Information theoretic security of quantum key distribution overcoming the repeaterless secret key capacity bound, arXiv: 1805.05511v1 (2018).
  * Yu  _et al._ [2019] Z. W. Yu, X. L. Hu, C. Jiang, H. Xu, and X. B. Wang, Sending-or-not-sending twin-field quantum key distribution in practice, Sci. Rep. 9, 3080 (2019).
  * Jiang  _et al._ [2019] C. Jiang, Z.-W. Yu, X.-L. Hu, and X.-B. Wang, Unconditional security of sending or not sending twin-field quantum key distribution with finite pulses, Phys. Rev. Appl. 12, 024061 (2019).
  * Xu  _et al._ [2020b] H. Xu, Z.-W. Yu, C. Jiang, X.-L. Hu, and X.-B. Wang, Sending-or-not-sending twin-field quantum key distribution: Breaking the direct transmission key rate, Phys. Rev. A 101, 042330 (2020b).
  * Jiang  _et al._ [2020] C. Jiang, X.-L. Hu, H. Xu, Z.-W. Yu, and X.-B. Wang, Zigzag approach to higher key rate of sending-or-not-sending twin field quantum key distribution with finite-key effects, New J. Phys. 22, 053048 (2020).
  * Hu  _et al._ [2019] X.-L. Hu, C. Jiang, Z.-W. Yu, and X.-B. Wang, Sending-or-not-sending twin-field protocol for quantum key distribution with asymmetric source parameters, Phys. Rev. A 100, 062337 (2019).
  * Zhou  _et al._ [2019] X.-Y. Zhou, C.-H. Zhang, C.-M. Zhang, and Q. Wang, Asymmetric sending or not sending twin-field quantum key distribution in practice, Phys. Rev. A 99, 062316 (2019).
  * Yin and Fu [2019] H.-L. Yin and Y. Fu, Measurement-device-independent twin-field quantum key distribution, Sci. Rep. 9, 3045 (2019).
  * Zeng  _et al._ [2020] P. Zeng, W. Wu, and X. Ma, Symmetry-protected privacy: Beating the rate-distance linear bound over a noisy channel, Phys. Rev. Appl. 13, 064013 (2020).
  * Currás-Lorenzo  _et al._ [2021] G. Currás-Lorenzo, L. Wooltorton, and M. Razavi, Twin-field quantum key distribution with fully discrete phase randomization, Phys. Rev. Appl. 15, 014016 (2021).
  * Zhang  _et al._ [2020] C.-M. Zhang, Y.-W. Xu, R. Wang, and Q. Wang, Twin-field quantum key distribution with discrete-phase-randomized sources, Phys. Rev. Appl. 14, 064070 (2020).
  * Grasselli and Curty [2019] F. Grasselli and M. Curty, Practical decoy-state method for twin-field quantum key distribution, New J. Phys. 21, 073001 (2019).
  * Teng  _et al._ [2020] J. Teng, F.-Y. Lu, Z.-Q. Yin, G.-J. Fan-Yuan, R. Wang, S. Wang, W. Chen, W. Huang, B.-J. Xu, G.-C. Guo, and Z.-F. Han, Twin-field quantum key distribution with passive-decoy state, New J. Phys. 22, 103017 (2020).
  * Lu  _et al._ [2019] F.-Y. Lu, Z.-Q. Yin, R. Wang, G.-J. Fan-Yuan, S. Wang, D.-Y. He, W. Chen, W. Huang, B.-J. Xu, G.-C. Guo, and Z.-F. Han, Practical issues of twin-field quantum key distribution, New J. Phys. 21, 123030 (2019).
  * Wang  _et al._ [2020] R. Wang, Z.-Q. Yin, F.-Y. Lu, S. Wang, W. Chen, C.-M. Zhang, W. Huang, B.-J. Xu, G.-C. Guo, and Z.-F. Han, Optimized protocol for twin-field quantum key distribution, Commun. Phys. 3, 149 (2020).
  * Wang and Lo [2020] W. Wang and H.-K. Lo, Simple method for asymmetric twin-field quantum key distribution, New J. Phys. 22, 013020 (2020).
  * Lorenzo  _et al._ [2019] G. C. Lorenzo, Á. Navarrete, K. Azuma, G. Kato, M. Curty, and M. Razavi, Tight finite-key security for twin-field quantum key distribution, arXiv: 1910.11407v4 (2019).
  * Mao  _et al._ [2021] Y. Mao, P. Zeng, and T.-Y. Chen, Recent advances on quantum key distribution overcoming the linear secret key capacity bound, Adv. Quantum Technol. 4, 2000084 (2021).
  * Minder  _et al._ [2019] M. Minder, M. Pittaluga, G. L. Roberts, M. Lucamarini, J. F. Dynes, Z. L. Yuan, and A. J. Shields, Experimental quantum key distribution beyond the repeaterless secret key capacity, Nat. Photon. 13, 334 (2019).
  * Wang  _et al._ [2019] S. Wang, D.-Y. He, Z.-Q. Yin, F.-Y. Lu, C.-H. Cui, W. Chen, Z. Zhou, G.-C. Guo, and Z.-F. Han, Beating the fundamental rate-distance limit in a proof-of-principle quantum key distribution system, Phys. Rev. X 9, 021046 (2019).
  * Zhong  _et al._ [2019] X. Zhong, J. Hu, M. Curty, L. Qian, and H. K. Lo, Proof-of-principle experimental demonstration of twin-field type quantum key distribution, Phys. Rev. Lett. 123, 100506 (2019).
  * Liu  _et al._ [2019] Y. Liu, Z. W. Yu, W. Zhang, J. Y. Guan, J. P. Chen, C. Zhang, X. L. Hu, H. Li, C. Jiang, J. Lin, T. Y. Chen, L. You, Z. Wang, X. B. Wang, Q. Zhang, and J. W. Pan, Experimental twin-field quantum key distribution through sending or not sending, Phys. Rev. Lett. 123, 100505 (2019).
  * Chen  _et al._ [2020] J. P. Chen, C. Zhang, Y. Liu, C. Jiang, W. Zhang, X. L. Hu, J. Y. Guan, Z. W. Yu, H. Xu, J. Lin, M. J. Li, H. Chen, H. Li, L. You, Z. Wang, X. B. Wang, Q. Zhang, and J. W. Pan, Sending-or-not-sending with independent lasers: Secure twin-field quantum key distribution over 509 km, Phys. Rev. Lett. 124, 070501 (2020).
  * Fang  _et al._ [2020] X.-T. Fang, P. Zeng, H. Liu, M. Zou, W. Wu, Y.-L. Tang, Y.-J. Sheng, Y. Xiang, W. Zhang, H. Li, Z. Wang, L. You, M.-J. Li, H. Chen, Y.-A. Chen, Q. Zhang, C.-Z. Peng, X. Ma, T.-Y. Chen, and J.-W. Pan, Implementation of quantum key distribution surpassing the linear rate-transmittance bound, Nat. Photon. 14, 422 (2020).
  * Liu  _et al._ [2021] H. Liu, C. Jiang, H.-T. Zhu, M. Zou, Z. Yu, X.-L. Hu, H. Xu, S. Ma, Z. Han, J. Chen, Y. Dai, S.-B. Tang, W. Zhang, H. Li, L. You, Z. Wang, F. Zhou, Q. Zhang, X.-b. Wang, T.-Y. Chen, and J. Pan, Field test of twin-field quantum key distribution through sending-or-not-sending over 428 km, arXiv: 2101.00276v1 (2021).
  * Chen  _et al._ [2021] J.-P. Chen, C. Zhang, Y. Liu, C. Jiang, W.-J. Zhang, Z.-Y. Han, S.-Z. Ma, X.-L. Hu, Y.-H. Li, H. Liu, F. Zhou, H.-F. Jiang, T.-Y. Chen, H. Li, L.-X. You, Z. Wang, X.-B. Wang, Q. Zhang, and J.-W. Pan, Twin-field quantum key distribution over 511 km optical fiber linking two distant metropolitans, arXiv:2102.00433v1 (2021).
  * Vakhitov  _et al._ [2001] A. Vakhitov, V. Makarov, and D. R. Hjelme, Large pulse attack as a method of conventional optical eavesdropping in quantum cryptography, J. Mod. Opt. 48, 2023 (2001).
  * Gisin  _et al._ [2006] N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, Trojan-horse attacks on quantum-key-distribution systems, Phys. Rev. A 73, 022320 (2006).
  * Fung  _et al._ [2007] C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, Phase-remapping attack in practical quantum-key-distribution systems, Phys. Rev. A 75, 032314 (2007).
  * Jiang  _et al._ [2012] M.-S. Jiang, S.-H. Sun, C.-Y. Li, and L.-M. Liang, Wavelength-selected photon-number-splitting attack against plug-and-play quantum key distribution systems with decoy states, Phys. Rev. A 86, 032310 (2012).
  * Jiang  _et al._ [2014] M.-S. Jiang, S.-H. Sun, C.-Y. Li, and L.-M. Liang, Frequency shift attack on ‘plug-and-play’ quantum key distribution systems, J. Mod. Opt. 61, 147 (2014).
  * Jain  _et al._ [2014] N. Jain, E. Anisimova, I. Khan, V. Makarov, C. Marquardt, and G. Leuchs, Trojan-horse attacks threaten the security of practical quantum cryptography, New J. Phys. 16, 123030 (2014).
  * Lucamarini  _et al._ [2015] M. Lucamarini, I. Choi, M. B. Ward, J. F. Dynes, Z. L. Yuan, and A. J. Shields, Practical security bounds against the trojan-horse attack in quantum key distribution, Phys. Rev. X 5, 031030 (2015).
  * Bugge  _et al._ [2014] A. N. Bugge, S. Sauge, A. M. M. Ghazali, J. Skaar, L. Lydersen, and V. Makarov, Laser damage helps the eavesdropper in quantum cryptography, Phys. Rev. Lett. 112, 070503 (2014).
  * Sun  _et al._ [2015] S.-H. Sun, F. Xu, M.-S. Jiang, X.-C. Ma, H.-K. Lo, and L.-M. Liang, Effect of source tampering in the security of quantum cryptography, Phys. Rev. A 92, 022304 (2015).
  * Makarov  _et al._ [2016] V. Makarov, J.-P. Bourgoin, P. Chaiwongkhot, M. Gagné, T. Jennewein, S. Kaiser, R. Kashyap, M. Legré, C. Minshull, and S. Sajeed, Creation of backdoors in quantum communications via laser damage, Phys. Rev. A 94, 030302 (2016).
  * Huang  _et al._ [2019] A. Huang, l. Navarrete, S.-H. Sun, P. Chaiwongkhot, M. Curty, and V. Makarov, Laser-seeding attack in quantum key distribution, Phys. Rev. Appl. 12, 064043 (2019).
  * Huang  _et al._ [2020] A. Huang, R. Li, V. Egorov, S. Tchouragoulov, K. Kumar, and V. Makarov, Laser-damage attack against optical attenuators in quantum key distribution, Phys. Rev. Appl. 13, 034017 (2020).
  * Pang  _et al._ [2020] X.-L. Pang, A.-L. Yang, C.-N. Zhang, J.-P. Dou, H. Li, J. Gao, and X.-M. Jin, Hacking quantum key distribution via injection locking, Phys. Rev. Appl. 13, 034008 (2020).
  * Tang  _et al._ [2013] Y.-L. Tang, H.-L. Yin, X. Ma, C.-H. F. Fung, Y. Liu, H.-L. Yong, T.-Y. Chen, C.-Z. Peng, Z.-B. Chen, and J.-W. Pan, Source attack of decoy-state quantum key distribution using phase information, Phys. Rev. A 88, 022308 (2013).
  * Tamaki  _et al._ [2016] K. Tamaki, M. Curty, and M. Lucamarini, Decoy-state quantum key distribution with a leaky source, New J. Phys. 18, 065008 (2016).
  * Huang  _et al._ [2018] A. Huang, S.-H. Sun, Z. Liu, and V. Makarov, Quantum key distribution with distinguishable decoy states, Phys. Rev. A 98, 012330 (2018).
  * Sajeed  _et al._ [2015] S. Sajeed, I. Radchenko, S. Kaiser, J.-P. Bourgoin, A. Pappa, L. Monat, M. Legré, and V. Makarov, Attacks exploiting deviation of mean photon number in quantum key distribution and coin tossing, Phys. Rev. A 91, 032326 (2015).
  * Winzer and Essiambre [2006] P. J. Winzer and R. Essiambre, Advanced optical modulation formats, Proc. IEEE 94, 952 (2006).
  * Tamaki  _et al._ [2014] K. Tamaki, M. Curty, G. Kato, H.-K. Lo, and K. Azuma, Loss-tolerant quantum cryptography with imperfect sources, Phys. Rev. A 90, 052314 (2014).
  * Pereira  _et al._ [2019] M. Pereira, M. Curty, and K. Tamaki, Quantum key distribution with flawed and leaky sources, npj Quant. Inf. 5, 62 (2019).
  * Mizutani  _et al._ [2019] A. Mizutani, T. Sasaki, Y. Takeuchi, K. Tamaki, and M. Koashi, Quantum key distribution with simply characterized light sources, npj Quant. Inf. 5, 87 (2019).
  * Navarrete  _et al._ [2020] A. Navarrete, M. Pereira, M. Curty, and K. Tamaki, Practical quantum key distribution secure against side-channels, arXiv: 2007.03364v1 (2020).
  * Pereira  _et al._ [2020] M. Pereira, G. Kato, A. Mizutani, M. Curty, and K. Tamaki, Quantum key distribution with correlated sources, Sci. Adv. 6, 4487 (2020).
  * Inamori  _et al._ [2007] H. Inamori, N. Lütkenhaus, and D. Mayers, Unconditional security of practical quantum key distribution, Eur. Phys. J. D 41, 599 (2007).
  * Yu  _et al._ [2013] Z.-W. Yu, Y.-H. Zhou, and X.-B. Wang, Three-intensity decoy-state method for measurement-device-independent quantum key distribution, Phys. Rev. A 88, 062339 (2013).
  * Tomamichel  _et al._ [2012] M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner, Tight finite-key analysis for quantum cryptography, Nat. Commun. 3, 634 (2012).
  * Chernoff [1952] H. Chernoff, A measure of asymptotic efficiency for tests of a hypothesis based on the sum of observations, Ann. Math. Stat. 23, 493 (1952).
  * Curty  _et al._ [2014] M. Curty, F. Xu, W. Cui, C. C. Lim, K. Tamaki, and H. K. Lo, Finite-key analysis for measurement-device-independent quantum key distribution, Nat. Commun. 5, 3732 (2014).