Asymmetric twin-field quantum key distribution

Twin-Field (TF) quantum key distribution (QKD) is a major candidate to be the new benchmark for far-distance QKD implementations, since its secret key rate can overcome the repeaterless bound by means of a simple interferometric measurement. Many variants of the original protocol have been recently proven to be secure. Here, we focus on the TF-QKD type protocol proposed by Curty et al (2019 NPJ Quantum Inf. 5 64), which can provide a high secret key rate and whose practical feasibility has been demonstrated in various recent experiments. The security of this protocol relies on the estimation of certain detection probabilities (yields) through the decoy-state technique. Analytical bounds on the relevant yields have been recently derived assuming that both parties use the same set of decoy intensities, thus providing sub-optimal key rates in asymmetric-loss scenarios. Here we derive new analytical bounds when the parties use either two, three or four independent decoy intensity settings each. With the new bounds we optimize the protocol’s performance in asymmetric-loss scenarios and show that the protocol is robust against uncorrelated intensity fluctuations affecting the parties’ lasers.


Introduction
Quantum Key Distribution (QKD) [1][2][3][4][5] allows two separated parties (typically called Alice and Bob) to generate identical bit strings with information-theoretic security. Due to the loss in the quantum channel connecting the parties, the performance of point-to-point QKD generally decreases with the distance, being unpractical for fardistance applications. Nonetheless, there have been remarkable efforts towards improving its range of applicability, such as the recent QKD experiments performed over 421 km of optical fiber [6] and over 1000 km of free space in satellite-to-ground links [7,8]. However, even for the most outstanding far-distance experiments, the secret key rate turns out to be probably too low for commercial purposes. In fact, it has been proven that there exist fundamental limits on the secret key rate that can be extracted from such point-to-point configurations. These limits say that the secret key rate scales linearly with the transmittance of the quantum channel linking the parties, or in other words, that it decreases exponentially with the channel length [9,10].
Quantum repeaters [11][12][13] and measurement-device-independent QKD (MDI-QKD) protocols with either quantum memories [14,15] or with quantum non-demolition measurements [16] are possible theoretical solutions to overcome these limits. Unfortunately, in practice they require a technology that seems to be far from available in the near future. A more realistic solution was proposed recently by Lucamarini et al [17]. They devised an MDI-QKD type protocol-called twin-field QKD (TF-QKD)-in which the untrusted central node performs a single-photon interference measurement on the two incoming pulses, causing the key rate to scale with the square-root of the channel transmittance by using simple optical devices. Since the original proposal, several variants of the TF-QKD protocol were proven to be secure [18][19][20][21][22][23] and some of them were experimentally implemented [24][25][26][27].
Here we focus on the TF-QKD scheme proposed in [19]. In this protocol, Alice and Bob use the decoy-state technique to upper bound the detection probabilities associated to various photon-number states (called yields), which are subsequently used to obtain a bound on the phase error rate. Importantly, and in contrast to other solutions [18,20,22] which use a post-selection step based on the matching of a global phase, the scheme in [19] pre-selects the value of the global phase and thus it can provide a higher secret key rate. Moreover, the practical feasibility of this scheme has been recently demonstrated in [24,25,27]. A complete analysis of the symmetric scenario where both users use the same signal intensities and analytically estimate the yields using the same decoy intensity settings was performed recently in [28]. However, using the same set of intensities is an optimal strategy only when the quantum channels connecting the users to the central node have approximately the same transmittance. Thus, the bounds derived in [28] are not suitable for several real-world situations in optical networks where the distances between the users and the central node can be notoriously different. Furthermore, assuming that the parties employ exactly the same intensities is problematic even when the losses are symmetric. This is due to the fact that, typically, neither Alice nor Bob can ensure that their lasers emit pulses with a perfectly locked intensity. Instead, their intensities are typically fluctuating randomly and independently from the other party. For these reasons, the use of independent signal intensities and the derivation of yields bounds based on asymmetric decoy intensities is crucial for the protocol's security in the presence of intensity fluctuations and for addressing asymmetric-loss scenarios. This idea has already been used to optimize the early MDI-QKD protocols based on two-photon interference in asymmetric-loss scenarios [29] and has recently been applied to another type of TF-QKD protocol in [30]. Moreover, decoy-state based protocols affected by intensity fluctuations have already been studied in [31][32][33][34].
In this paper, we address the above-mentioned problems by analyzing the performance of the TF-QKD scheme proposed in [19] in the presence of asymmetric losses and independent laser intensity fluctuations. For this, we derive new analytical bounds on the yields when Alice and Bob use asymmetric intensity settings. In particular, we consider the practical cases where each of Alice and Bob uses two, three and four decoy intensity settings, which are the most efficient solutions for covering long distances. In doing so, we show that the protocol can tolerate highly-asymmetric loss scenarios and is quite robust against intensity fluctuations, thus demonstrating its practicality for realistic network configurations.
The paper is organized as follows. In section 2 we summarize the TF-QKD protocol introduced in [19]. Then, in section 3 we analyze the performance of the aforementioned protocol under the assumption that Alice and Bob use the same signal and decoy intensities. In section 4 we present analytical bounds on the yields when the parties are allowed to use three independent decoy intensity settings. With the derived bounds, we investigate the protocol's performance in section 5 when using independent signal and decoy intensities and in the presence of uncorrelated intensity fluctuations affecting the users' lasers. Finally, in section 6 we present our conclusions. The paper includes also a few Appendixes with additional calculations, including the analytical bounds on the yields when each of Alice and Bob uses either two or four independent decoy intensity settings.

Protocol description
In this section we briefly summarize the considered TF-QKD protocol [19]. As shown in figure 1, it consists in both Alice and Bob sending optical pulses through a quantum channel to an untrusted third party, Charles, who is in charge of performing joint measurements on the incoming pulses and announcing the results. The protocol is composed of the following seven steps.  Figure 1. Scheme of the TF-QKD protocol proposed in [19]. After selecting the X or Z basis randomly, Alice and Bob send optical pulses through a quantum channel to an intermediate node controlled by the untrusted party Charles. In an honest implementation, Charles makes the incoming pulses interfere in a 50:50 beam splitter (BS) and publicly announces which of the two threshold detectors placed at the beam splitter output ports clicks. For the X basis, Alice and Bob send coherent states a  ñ | A and a  ñ | B , respectively. For the Z basis, they send PRCS whose intensities are chosen at random from predefined sets.
(i) Alice (Bob) chooses the X basis with probability p x A (p x B ) and the Z basis with probability = - For the X basis, Alice (Bob) prepares an optical pulse in a coherent state a -ñ |( ) , for simplicity. For the Z basis, Alice (Bob) prepares an optical pulse in a phase-randomized coherent state (PRCS) r m k (r n l ) whose intensity μ k (ν l ) is chosen from a set  m = { } A k k ( n = { } B ll ) with probability p k (p l ). (ii) Both Alice and Bob send their pulses to an intermediate untrusted node, Charles, through optical channels with transmittances η A and η B , respectively, in a synchronized manner.
(iii) Charles interferes the incoming pulses in a 50:50 beam splitter, followed by two threshold detectors associated with the constructive (detector D c ) and destructive (detector D d ) interference, respectively.
(iv) Charles announces the measurement outcomes k c and k d of the detectors D c and D d , respectively, with k c =1 (k d =1) corresponding to a click event and k c =0 (k d =0) corresponding to a no-click event.
(v) Alice and Bob reveal a small fraction of the bits b A (b B ) collected from those events when both parties chose the X basis and Charles reported a click only in one detector (k c +k d =1) to estimate the bit error rate. Their raw keys consist on the remaining undisclosed bits. Also, Bob flips all the bits b B collected when the click occurred in D d .
(vi) Alice and Bob publicly announce the intensities used in all the events when both chose the Z basis, and they use that information to estimate the phase error rate.
(vii) Alice and Bob apply error correction and privacy amplification techniques to their raw keys to distill two identical secret keys.

Secret key rate
The asymptotic secret key rate of the protocol described above is lower bounded by [19]  + is the conditional probability that the event Ω occurs given that Alice and Bob select the X basis, W e Z, upp is an upper bound on the phase error rate, W e X, is the bit error rate, f is the reconciliation efficiency of the error correction process and = ---- is the binary entropy function. Note that in the asymptotic scenario, which is the scenario we consider in this work, we assume for simplicity that . The upper bound on the phase error rate, W e Z, upp , is given by [19]: and  0 denotes the set of non-negative integers. The yields W Y nm are not experimentally observed but can be estimated through the decoy-state method [35][36][37] (see section 4). The bit error rate is given by The values of the bit error rate W e X, and of the probability W ( ) p X for a typical channel model are given in appendix A. These are the values we use in our simulations.

Symmetric intensities
When analyzing QKD protocols based on a central-node architecture, it is common to consider the symmetric scenario where the transmittances of the channels Alice-Charles and Bob-Charles are equal. This is, however, an unrealistic assumption. In a practical scenario, the loss introduced by the quantum channel Alice-Charles could significantly differ from the loss in the channel Bob-Charles. In this case, the yields bounds obtained by using the decoy-state technique with the same intensity settings for Alice and Bob are not optimal anymore, i.e. they are looser than those obtained when the channel losses are instead symmetric.
Indeed, as already shown in MDI-QKD [29,[38][39][40], if Alice and Bob use the same intensity settings, they might be in a situation where it is convenient for them to symmetrize the channels losses by increasing the loss in one of the channels, in order to enhance the key rate. In doing so, the intensities of the pulses arriving at the central node are now of similar magnitude, which results in an improvement of the key rate. However, if they use different intensity settings, that is no longer the case [29,[38][39][40]. The same happens in the TF-QKD scheme introduced in [19]. This is clear from figure 2, where we plot the secret key rate assuming that Alice and Bob use the same set of two, three and four decoy intensities. The plots are obtained by using the analytical yields bounds for the symmetric-intensities scenario derived in [28]. The experimental parameters used for the simulations are given in table 1 and the corresponding channel model is given in appendix A.
In figure 2, the key rate is optimized over the signal intensity a a = A B 2 2 and over the strongest decoy intensity (assumed to be equal for the two parties), while the other decoy intensities are fixed to the same values for both parties. As a matter of fact, after having observed that in the asymptotic scenario the optimal values of the weaker decoy intensities tend to be as small as possible regardless of the losses in the two channels, we fixed them to reasonably low values in the key rate optimization. More precisely: the weakest decoy intensities of Alice and Bob in the two-, three-and four-decoy case are fixed to -10 ; 5 the second-to-the-weakest decoy intensities in the three-and four-decoy case are both fixed to -10 ; 4 and the third-to-the-weakest decoy intensities in the fourdecoy case are fixed to -10 3 . The resulting key rate in both the three-and four-decoy case basically reproduces the rate one would obtain when optimizing even on the weaker decoy intensities [28]. In the two-decoy case, however, the key rate can be enhanced further by decreasing the value of the weakest decoy intensity, as explained in appendix E. The disadvantage of using symmetric signal and decoy intensity settings is clear in all the two-, three-and four-decoy cases, since increasing the loss in one of the channels can lead to an increase of the key rate in asymmetric-loss scenarios.
Furthermore, as already mentioned in the introduction, assuming that Alice and Bob are using exactly the same intensities is not realistic in most experimental implementations [25][26][27] due to the intensity fluctuations on the transmitters' lasers. The effect of intensity fluctuations was already considered in [28] under the as a function of the channel loss in Alice's and Bob's sides, assuming that both Alice and Bob use the same signal and decoy intensities. Specifically, in (a)-(c) they use two, three and four decoy intensities each, respectively. The black dashed line encloses the loss region where the key rate overcomes the repeaterless bound [10]. We note that for several combinations of losses, it might be beneficial for the parties to increase the loss in one of the channels in order to make them more symmetric, thus maximizing the key rate. The experimental parameters used in the simulations are given in table 1. assumption that the fluctuations are correlated among the two parties, which is satisfied in the experiment reported in [24], but does not hold in general.

Asymmetric intensities
In order to enhance the protocol's performance in the presence of asymmetric losses and to investigate uncorrelated intensity fluctuations, in this work we derive analytical upper bounds on the yields for the two-, three-and four-decoy scenarios with independent intensity settings for Alice and Bob. We note that the use of three or four decoy intensity settings is already enough to obtain a secret key rate close to the one that could be achieved with infinite decoy intensity settings [19,28]. The derivation of the yields bounds for different decoy intensity settings is presented in appendix F (two-decoy scenario), appendix G (three-decoy scenario) and appendix H (four-decoy scenario). However, for illustration purposes, we present in this section the resulting upper bounds for the three-decoy case.
According to the TF-QKD protocol [19] summarized in section 2-when both parties choose the Z basis-Alice prepares a PRCS whose intensity belongs to the set m m m { } , , Analogously, Bob prepares a state whose intensity is instead drawn from the set n n n { } , , The key assumption of the decoy-state method is that the yields are independent of the chosen intensities and are thus subjected to the following four equality constraints: where Q k l , is the gain in the Z basis given that Alice and Bob choose intensities m k and n l , respectively. Note that we omit here and in what follows, for readability, the dependency of the variables with Ω. Being probabilities, the yields are additionally subjected to the inequality constraints:  upp  0,0  00  0,2  02  2,0  20  2,2  22  0,4  04  4,0  40  even  2   1,1  11  1,3  13  3,1  31  odd  2 where D = å Î ¥ ( ) c n m S n m even , , , being S 0 (S 1 ) the subset of  2 0 (  + 2 1 0 ) which only includes the (n, m) pairs of those yields that are being trivially upper bounded by one. In doing so, we can obtain a fully analytical expression of the asymptotic secret key rate (1). In what follows, we present the resulting upper bounds on the aforementioned yields (we refer the reader to appendix G for their derivation). For this, let's consider the most general combination of the nine constraints (6): For simplicity, in (9) and also below, we omit the explicit dependence of the coefficients c i j , with the value of u and v. Then, we can obtain an upper bound on the yield Y uv by appropriately choosing the coefficients c i,j that appear in(9).

Upper bound on Y 00
An upper bound on the yield Y 00 is given by where G 00 is given by(9) by fixing the c i,j coefficients to those given in(G.54).

Upper bound on Y 11
An upper bound on the yield Y 11 is given by where G 22 is given by(9) by fixing the c i j , coefficients to those given in(G.6).

Upper bounds on Y 02 and Y 04
The upper bounds on the yields Y 02 and Y 04 are given by, respectively, where G 02 is given by(9) by fixing the c i j , coefficients to those given in(G.28).  where G 20 is given by(9) by fixing the c i j , coefficients to those given in(G.36).

Upper bound on Y 13
An upper bound on the yield Y 13 is given by  where G 13 is given by(9) by fixing the c i j , coefficients to those given in(G.43).  where G 31 is given by (9) by fixing the c i j , coefficients to those given in(G.47).

Simulations
In order to obtain the optimal secret key rate in the asymptotic-key regime, one needs to optimize it over the X basis intensities a A 2 and a B 2 , and over four, six or eight decoy intensities, depending on the number of decoys used by Alice and Bob. The key rate depends on the decoy intensities through the yields bounds derived in appendices F-H. For instance, for the three-decoy case analyzed in the previous section, we have that the vector of parameters to be optimized is a a m m m n n n =  ( ) p , , , , , , , In order to fairly compare the simulation results with those of the symmetric scenario (figure 2), we use the same experimental parameters given by table 1 and we again fix the weaker decoy intensities to the same symmetric values for Alice and Bob, namely: μ 1 =ν 1 =10 −5 for the two-decoy case, μ 1 =ν 1 =10 −4 and μ 2 =ν 2 =10 −5 for the three-decoy case, μ 0 =ν 0 =10 −3 , μ 1 =ν 1 =10 −4 and μ 2 =ν 2 =10 −5 for the four-decoy case. Thus the key rate is actually optimized over a a m n =  ( ) p , , , 3 in the four-decoy case. As explained in appendix H, note that in the four-decoy case, for convenience of our notation, μ 3 and ν 3 denote the strongest decoy intensities, i.e. we use the ordering μ 3 >μ 0 >μ 1 >μ 2 and ν 3 >ν 0 >ν 1 >ν 2 . Although having fixed the weaker decoy intensities to the same values for both parties might seem restrictive in the asymmetric-loss scenario considered here, indeed it is not. As a matter of fact, we observed that the optimal values of the weaker decoy intensities (i.e. μ 1 and ν 1 in the two-decoy case, μ 1 , μ 2 and ν 1 , ν 2 in the three-decoy case, μ 0 , μ 1 , μ 2 and ν 0 , ν 1 , ν 2 in the four-decoy case) tend to be as low as possible, independently of the losses in Alice and Bob's channels. We thus fixed them to symmetric low values that are reasonable from an experimental point of view [24,25]. We additionally required every non-fixed decoy intensity to be at least one order of magnitude greater than any other fixed decoy intensity of the same scenario, due to practicality reasons in an experiment.
Fixing the decoy intensities reduces the computation complexity of the simulations, which is important since, in contrast to the MDI-QKD scenario [41], the key rate is not, in general, a convex function of  p (see appendix C). This means that it is not possible to safely use time-efficient optimization methods, such as, for instance, the coordinate descent algorithm [42]. Our optimization is thus carried out by using the built-in global optimization algorithms of Wolfram Mathematica 11.0 [43].
In figure 3 we plot the asymptotic secret key rate as a function of the loss when the parties employ independent signal and decoy intensities, and each party uses either two (figure 3(a)), three (figure 3(b)) or four (figure 3(c)) decoy intensities. In all plots we observe that the improvement given by the use of independent intensities in the asymmetric-loss regions is significant. That is, introducing extra losses in one of the channels does not enhance the key rate any longer, in contrast to figures 2(a)-(c), where the intensities are instead symmetric for the two parties. Interestingly, this substantial improvement is mainly due to the independence of Alice's and Bob's signal intensities, while the independence of the decoy intensities plays a secondary role. In fact, the weaker dependence of the secret key rate on the asymmetry of Alice's and Bob's decoy intensities was recently investigated for specific scenarios and under some approximations in [44]. Nevertheless, allowing Alice and Bob to independently optimize both their signal and decoy intensities can almost double the secret key rate in extremely asymmetric-loss scenarios with respect to the case where only the signal intensities are independently optimized. This is particularly important when the estimation of the phase error rate is poor, like in the twodecoy case. It is also important to mention that, similarly to what happened in section 3, in the two-decoy scenario shown in figure 3(a) the secret key rate can be significantly enhanced by allowing the weakest decoy intensities of Alice and Bob to take lower values (see appendix E for further information). Additionally, by doing so, the trilobal pattern that can be observed in figure 3(a) almost disappears (see figure E1(a)), and the resulting figure looks similar to the three-and four-decoy cases.
The simulations suggest that in order to get a high key rate, it is important that the intensities of the pulses arriving at the central node are of similar magnitude (but not exactly the same), so that a cleaner interference occurs. This is clear from figure 4, where we plot the optimal signal and decoy intensities in the three-decoy scenario, as a function of the loss in the channel Alice-Charles and for fixed losses in the channel Bob-Charles.
We note that the optimal signal intensities a A 2 of Alice (solid lines) become greater than the correspondent ones a B 2 of Bob (dashed lines) as soon as the loss in Alice's side is greater than in Bob's side. The same happens for the decoy intensities (μ 0 of Alice and ν 0 of Bob) over which the key rate is optimized. Besides, when the losses at Alice's and Bob's sides are equal (symmetric scenario), the optimal values of both the signal and decoy intensities coincide for Alice and Bob, as expected. Moreover, the bottom plots in figure 4 show that the signal intensities arriving at the untrusted node, i.e. η A α A 2 and h a B B 2 , are very similar to each other, while this is less pronounced in the case of the arriving decoy intensities. This is expected since the signal intensities are used to generate the raw keys. Thus it is optimal to minimize the bit error rate with a clean interference by tuning the signals so that the as a function of the channel loss in Alice's and Bob's sides assuming that both Alice and Bob use independent signal and decoy intensities. In (a)-(c), the parties use two, three and four decoy intensities each, respectively. The key rate is never enhanced by increasing the loss in one of the two quantum channels, in contrast to the previous scenario with symmetric intensities (figures 2(a)-(c)). The black dashed line encloses the loss region where the key rate overcomes the repeaterless bound [10]. The experimental parameters used in the simulations are given in table 1.  ) both for Alice (solid lines) and Bob (dashed lines). (b) Optimal values of the strongest decoy intensities (μ 0 and ν 0 ) and the arriving strongest decoy intensities (μ 0 η A and ν 0 η B ) both for Alice (solid lines) and Bob (dashed lines). All the figures are plotted as a function of the loss in the channel Alice-Charles for three different values of the loss in the channel Bob-Charles. The corresponding optimized key rate is given in figure 3(b), where each party has independently three decoy intensities. We observe that it is optimal for the parties to prepare the intensities of their pulses such that the signals arriving to Charles have similar intensities, especially for the X-basis rounds. The experimental parameters used for the simulations are given in table 1.
arriving pulses have similar intensities. Conversely, the decoy pulses are used to indirectly estimate the phase error rate by upper bounding several yields. Because of the complex mathematical structure of such estimation problem, it is not true in general that the optimal phase error rate estimation is achieved by interfering arriving pulses of similar intensity. For completeness, the analogous figures with the optimal arrival intensities in the two-and four-decoy cases are shown in appendix D.
Apart from the general improvement in the secret key rate that the yields bounds derived in this work entail in asymmetric-loss scenarios, the bounds also allow to incorporate uncorrelated intensity fluctuations into the model, guaranteeing security in more realistic conditions. Figure 5 illustrates how taking into account the possible intensity fluctuations at the transmitters' lasers affects the key rate. In particular, the dashed lines are obtained by optimizing the key rate over the signal and decoy intensities (we consider two, three and four decoy intensity settings) in the case of symmetric losses in the two quantum channels (figure 5(a)) and when Bob's loss is fixed to 30 dB (figure 5(b)). We then apply uncorrelated fluctuations of fixed magnitudes (20%, 30% and 40%) on all the signal and decoy intensities of both parties and take the worst-case key rate (solid lines), i.e. the one minimized by letting each intensity independently fluctuate in its fluctuation range. For instance, by fixing the fluctuation magnitude to 30%, every signal (a A B , 2 ) and decoy (m n , k k ) intensities fluctuate independently in the following intervals centered on their optimal values (overlined terms): Figure 5. Comparison between the secret key rate with optimal signal and decoys intensities (dashed lines) with the secret key rates affected by increasing intensity fluctuations (solid lines): 20%, 30% and 40% (brighter colors; right to left). The number of decoy intensity settings are two (green lines), three (red lines) and four (blue lines). In (a) the losses at Alice's and Bob's sides are equal (symmetric-loss scenario) while in (b) the loss in the channel Bob-Charles is fixed to 30 dB. We assume that the fluctuations affect each decoy intensity and each signal intensity of both parties in a independent way, i.e. the fluctuations are uncorrelated. The plots show that the TF-QKD protocol is quite robust against intensity fluctuations and that it can beat the repeaterless bound [10] even with 40% intensity fluctuations, when Alice and Bob use either three of four decoy intensities. The weaker decoy intensities have been fixed to the following values: μ 1 =ν 1 =10 −5 for two decoy intensity settings, μ 2 =ν 2 =10 −3 and μ 1 =ν 1 =10 −2 for three decoy intensity settings, and μ 2 =ν 2 =10 −3 , μ 1 =ν 1 =10 −2 and μ 0 =ν 0 =10 −1 for four decoy intensity settings. The other experimental parameters are given in table 1.
The secret key rate is then minimized over the fluctuations of all intensities constrained in their respective intervals. This effect has already been analyzed in [28] in the case of symmetric losses in the two quantum channels, where the fluctuations are, however, assumed to be perfectly correlated among the two users. This is a quite restrictive assumption, which only occurs in practice in certain experimental implementations based on the use of only one laser [24], but does not hold in general when two lasers are employed [25][26][27], even in a scenario with symmetric losses. In order to directly compare the effect of uncorrelated fluctuations with the results in [28], we fixed the weaker decoy intensities to exactly the same values used in the intensity fluctuations plots of [28], that is: μ 1 =ν 1 =10 −5 for two decoy intensity settings, μ 2 =ν 2 =10 −3 and μ 1 =ν 1 =10 −2 for three decoy intensity settings, and μ 2 =ν 2 =10 −3 , μ 1 =ν 1 =10 −2 and μ 0 =ν 0 =10 −1 for four decoy intensity settings. The figures suggest that the protocol is quite robust against intensity fluctuations even when the fluctuations are uncorrelated among the two parties. In fact, the maximal tolerable loss in the overall Alice-Bob channel for both the three and four-decoy scenarios decreases less than 2 dB for a 20% fluctuation of the signal and decoy intensities. Remarkably, even with a fluctuation magnitude of 40% the decrease is still below 10 dB. Regarding the two-decoy case, it is important to mention that the abrupt change that the key rate suffers when considering intensity fluctuations is due to a sudden change in the optimal decoy intensities (see appendix E). In particular, a sudden increase of the optimal decoy intensity directly implies a sudden increase of its fluctuation magnitude in absolute terms What concluded for figure 5(a) also applies to the asymmetric scenario shown in figure 5(b), where the loss in the channel Bob-Charles is fixed to 30 dB.
Finally, it is also interesting to observe how the optimal values for the signal intensities in the X basis depend on the estimation of the yields in the Z basis. Figure 6 shows the variation of the optimal a A 2 and a B 2 (X basis) as a function of the loss in the channel Alice-Charles (the loss in the channel Bob-Charles is fixed to 30 dB) for four different levels of accuracy in the estimation of the yields (Z basis). One can see that, when the yields' estimation is not so tight, the X basis intensities a A 2 and a B 2 tend to be small in order to reduce the weights c n m , of the yields appearing in(3) and compensate the yields' loose upper bounds. By increasing the number of decoys in the Z basis and thus the tightness of the yields' bounds as well as the number of relevant yields which are non-trivially upper bounded, the optimal values of the signal intensities in the X basis also increase, showing that the optimal signal intensities in the X basis depend on the number of decoy states used in the Z basis.

Conclusion
In this paper we have investigated the performance of the TF-QKD protocol proposed in [19] under the realistic condition of asymmetric losses in the quantum channels linking Alice and Bob to the intermediate node. For this, we have derived analytical bounds on the relevant yields that appear in the phase error rate expression when the parties use either two, three or four decoy intensity settings. In contrast to previous results [28], the bounds derived here are valid in the general scenario of independent intensity settings for the two parties, thus Figure 6. Optimal values of the signal intensities a A 2 and a B 2 (solid and dashed lines, respectively) as a function of the loss in the channel Alice-Charles for different levels of accuracy in the estimation of the yields, i.e. assuming that the parties have at their disposal two, three, four and infinite decoy intensity settings (bottom to top). The loss in the channel Bob-Charles is fixed to 30 dB. We observe that the optimal values of the signal intensities used to prepare states in the X basis increase with the number of decoys used in the Z basis. For the infinite decoy case, we assume that Alice and Bob can estimate the yields precisely and we used the theoretical values of the yields, which are given in appendix B. The experimental parameters used for the simulations are given in table 1. optimizing the protocol's performance in the presence of asymmetric losses in the two quantum channels. The simulations show a significant improvement on the secret key rate when using independent signal and decoy intensity settings in several asymmetric-loss scenarios. In particular, the secret key rate is never enhanced by adding fiber in one of the channels in order to symmetrize their losses. Furthermore, we have demonstrated the robustness of the protocol against uncorrelated intensity fluctuations on the transmitters' lasers. These results clearly indicate the suitability of employing the considered TF-QKD protocol in practical QKD networks.

Acknowledgments
This work was supported by the Spanish Ministry of Economy and Competitiveness (MINECO), the Fondo Europeo de Desarrollo Regional (FEDER) through grant TEC2017-88243-R, and the European Union's Horizon 2020 research and innovation programme under the Marie Sklodowska-Curie grant agreement No 675662. AN gratefully acknowledges support from a FPU scholarship from the Spanish Ministry of Education.

Appendix A. Asymmetric channel model
Here, we present the expected values of the quantities required to calculate the lower bound on the secure key rate given by (1), in the case of the channel model described in [28]. The only difference is that here the losses in the channels Alice-Charles and Bob-Charles can differ and are modeled with a beamsplitter of transmittance η A for Alice and η B for Bob. Note that in this model the phase and polarization misalignments are independent from the channel's transmittance. In order to model them, let f=δπbe a phase shift at Bob's side for some parameter δ and let θ A (θ B ) be the polarization shift angle at Alice's (Bob's) side. Finally, let p d be the dark-count probability of Charles' detectors, which we assume to be the same for both detectors. Let us define for convenience where θ=θ A −θ B . Then it can be shown that the bit error rate e X,Ω and the probability p X (Ω) are given by Finally, the observed gains Q k l , used by Alice and Bob to calculate the upper bounds on the yields Y nm are just the probabilities that the event Ω occurred when Alice and Bob chose intensities μ k and ν l for their PRCS. For this channel model it turns out that the gains read: where I 0 (x) is the modified Bessel function of the first kind. Note that due to the balanced redistribution of the incoming photons in the central beam splitter, all the quantities presented here are actually independent of which detector clicked, i.e. they read the same for Ω=Ω c , Ω d .
In the simulations in the main text we assume that both the total polarization misalignment and phase mismatched are 2%, that is, we select q = ( ) 2arcsin 0.02 and d = 0.02.

Appendix B. Theoretical values for the yields
In order to check the quality of the analytical bounds on the yields, it is useful to compare them with their theoretical values, i.e. the values directly inferred from the channel model and that Alice and Bob would estimate when using an infinite number of decoy intensities. This is used, for instance, in figure 6. The theoretical values of the yields Y nm , according to the channel model presented in appendix A, are given by where the coefficients C n k A , and C m t B , are given by Note that the values of the yields are independent of the event Ω.
Appendix C. Non-convexity of the secret key rate with respect to  p As one can notice from equations (1)-(5), the dependence of the key rate R with its parameters is far from trivial.
Here we numerically analyze the convexity of the key rate function  ( ) R p , being  p the vector of parameters to optimize by the users. It is well-known that this property is noticeably useful since convex functions permit to use efficient optimization methods, which are very important when the length of  p increases. Unfortunately, it turns out that the key rate function is not convex in general, as shown in figure C1, therefore making many efficient optimization algorithms work poorly.
For instance, if we consider the coordinate descent algorithm [42], it is clear from the plots that it would not reach the optimal value if the starting point is any corner of the α A -α B plane and the first variable to optimize is α B . Note that starting from a corner basically means that, in the first step, the algorithm have to maximize the darkest or the lightest line in figure C1(c), being both maximized when α B is minimal. This means that, in the next step, the algorithm has always to optimize the darkest line in figure C1(b), which again has its maximum when α A is minimal. In figure C1, for simplicity, we assume that Alice and Bob can estimate the yields precisely. That is, we assume they use an infinite number of decoy intensities.

Appendix D. Optimal signal and decoy intensities in the two-and four-decoy case
In figure D1 we show the arriving signal and decoy intensities for the two-and four-decoy case, corresponding to the optimal intensities employed in figures 3(a) and (c), respectively. Similarly to the three-decoy case (figure 4), it is optimal for the parties to prepare the intensities of their signal pulses such that the resulting intensities that arrive at Charles are of similar magnitude. This is true for both the two-and the four-decoy case.
Regarding the arriving strongest decoy intensity, the four-decoy scenario resembles again the three-decoy one, while the two-decoy case presents some differences. First of all, in contrast to the three-and four-decoy case, Bob's optimal decoy intensity when the channel loss between Bob and Charles is fixed to 1 dB is constant and equal to the lowest allowed intensity value, i.e. ν 0 = 10 −4 (see section 5 for the intensity range in which the Figure C1. (a) Lower bound on the secret key rate as a function of α A and α B . Also, we show in (b) and (c) some specific slices of (a).
Here we considered the ¥-decoy scenario, and the losses in Alice's and Bob's channels are 20 dB and 0 dB, respectively. It is easy to note that the secret key rate function is clearly not convex. key rate optimization is performed). Moreover, even Alice's optimal decoy intensity is constant and equal to 10 −4 at low losses, until it abruptly increases several orders of magnitude and behaves similarly to the three-and four-decoy case at higher losses. The reason for this peculiar behavior does not seem to lie in numerical optimization faults since it has been confirmed by different optimization routines. We also exclude that it is caused by suboptimal analytical bounds on the yields, since it remains present even when using linear programming in bounding the relevant yields. Instead, we believe that the effect of having an extremely low optimal decoy intensity at low losses followed by an abrupt increase at higher losses is inherent in the problem at hand. In particular, the fact that the parties have only two decoy intensity settings prevents them from obtaining sufficiently tight upper bounds on the yields. In other words, there exist relevant decoy intensities combinations for which the parties are unable to bound some yields in a non-trivial way, i.e. with a value strictly smaller than one. This is the reason why we explicitly present every yield upper bound, in the two-decoy case, as given by the minimum between the obtained analytical formula and 1 (see appendix F). The resulting yields bounds are nonsmooth functions of the decoy intensities and so is the key rate. In turn, this can lead to discontinuities in the parameters over which the key rate is optimized, as observed.
Finally, we note that the loss thresholds where the discontinuities of the optimal decoy intensities take place, correspond to 'crossing the border' from one lobe to the other in the two-decoy contour plot (figure 3(a)), thus linking the peculiar shape of figure 3(a) to the above effect.
In order to have a better understanding of the special features arising in the two-decoy case discussed above, in appendix E we perform a further key rate optimization in this scenario, but allowing much smaller values for the intensity pulses.

Appendix E. Allowing lower intensities in the two-decoy case
In section 5 we observe a trilobal pattern affecting the two-decoy contour plot ( figure 3(a)) and we then link it to the discontinuities affecting the optimal decoy intensities in appendix D. In particular, we observe that for both parties ) and arriving strongest decoy intensities (μ 3 η A and ν 3 η B ) both for Alice (solid lines) and Bob (dashed lines), in the case of four decoy intensities. All the figures are plotted as a function of the loss in the channel Alice-Charles for three different values of the loss in the channel Bob-Charles. Like in the three-decoy case, we observe that it is optimal for the parties to prepare the intensities of their pulses such that the signals arriving to Charles have similar intensities, especially for the X-basis rounds. The arriving decoy intensities in the two-decoy case present instead discontinuities, that are probably caused by the inherent inefficiency of the yields bounds obtained in this scenario. The experimental parameters used for the simulations are given in table 1. the optimal strongest decoy intensity acquires the lowest possible value at low losses (10 −4 ), but then it experiences a sudden increase after a certain loss threshold. In appendix D we argue that such discontinuities are inherent in the problem of optimizing the key rate when the parties have only two decoy intensity settings at their disposal.
In order to check whether these effects are enhanced or caused by the experimentally-reasonable lower bound (10 −5 ) that we imposed on the decoy intensities, we rederive the same plots obtained for the two-decoy case in the main text, but this time we allow both the signal and the decoy intensities to acquire much smaller (but probably unpractical) values. In particular, we fix the lowest decoy intensities to μ 1 =10 −10 for Alice and ν 1 =10 −10 for Bob (opposed to μ 1 =10 −5 and ν 1 =10 −5 of the main text) and we optimize the key rate over the signal intensities  a for Alice and ν 0 >10 −10 for Bob. In order to make a fair comparison, we use the same experimental parameters used in the main text, given in table 1. Because of the unpractical values allowed for both the signal and decoy intensities, this study is driven by theoretical interest and is not intended to replace the practical one presented in the main text and in appendix D.
In the new contour plots obtained in this scenario ( figure E1) the trilobal pattern is barely visible. Indeed, figure E1 now resembles much more the correspondent figures of the three-and four-decoy case (figures 3(b) and (c)). This is readily explained by considering that now we perform the key rate optimization on a wider range of intensities, thus allowing the key rate contour lines to reach areas (i.e. loss combinations) where previously no positive key could be extracted.
Despite the trilobal shape being almost vanished, the optimal decoy intensities (figure E2) still show the same discontinuous behavior already observed in appendix D and acquire the lowest allowed value at low losses. This further confirms that this effect is not due to limits in the numerical optimization or in the analytical bounds, but it is rather inherent in the nature of the problem.
Finally, we also report the effect of intensity fluctuations on the optimized key rate ( figure E3). Similarly to the contour plots, having a wider range of intensities in the key rate optimization not only allows one to obtain more non-zero key points, but also has the general effect of making the single plot points more robust to intensity fluctuations. For instance, the optimal values of the decoy intensities at low losses are-in this case-lower than those of the main text (10 −10 instead of 10 −4 and 10 −5 ), thus reducing the fluctuations in absolute terms. Here we derive analytical upper bounds on the yields for the two-decoy scenario with independent intensity settings for Alice and Bob. The three-and four-decoy cases follow a similar procedure and are presented in appendices G and H, respectively.
In this scenario each party prepares PRCS with two possible intensities, namely {μ 0 , μ 1 } (with μ 0 >μ 1 ) for Alice and {ν 0 , ν 1 } (with ν 0 >ν 1 ) for Bob. The yields are subjected to the following four equality constraints:   Figure E2. Arriving signal (a) and strongest decoy (b) intensity both for Alice (solid lines) and Bob (dashed lines). The lowest allowed signal and decoy intensities are set to 10 −10 . The corresponding optimized key rate is given in figure E1(a), where each party has independently two decoy intensities. Like in the case with the higher allowed intensities ( figure D1(a)), we still observe discontinuities for the arriving strongest decoy intensities, confirming that the effect is intrinsic to the optimization problem. Figure E3. Comparison between the secret key rate with optimal signal and decoys intensities (dashed lines) with the secret key rates affected by increasing intensity fluctuations (solid lines): 20%, 30% and 40% (brighter colors; right to left), when the parties have two decoy intensity settings each. In (a) the losses at Alice's and Bob's sides are equal (symmetric-loss scenario) while in (b) the loss in the channel Bob-Charles is fixed to 30 dB. We assume that the fluctuations affect each decoy intensity and each signal intensity of both parties in a independent way, i.e. the fluctuations are uncorrelated. The lowest allowed signal and decoy intensities are set to 10 −10 . The plots show that the robustness of the TF-QKD protocol is increased with respect to the case analyzed in the main text (figure 5, where instead the weakest decoy intensities are set to μ 1 =ν 1 =10 −5 ). The subscript in G 11 indicates the yield that is going to be bounded with this combination of gains, that is, Y 11 in this case. In (F.3) the coefficients of the yields Y m 0 and Y n0 , for any n and m, are identically zero. Thus (F.3) can be rewritten as: Note that Y 11 is now the yield with the 'highest weight' in (F.4) since it has the largest coefficient. All the yields' bounds presented in this work follow the same philosophy. A valid upper bound for Y 11 is obtained considering the worst-case scenario for the other yields, taking into account that (7) holds. Since all the yields' coefficients carry the same sign in (F.4), the yield Y 11 is maximal when all the other yields are minimal. Thus the upper bound on Y 11 is extracted by setting all the other yields to zero in (F.4): By taking the minimum between the analytical upper bound and 1 we enforce the validity of the inequality constraints (7). This is of particular importance in the two-decoys scenario since there exist relevant combinations of decoy intensities for which the analytical upper bounds would produce a value greater than one. As a consequence, we achieve a tighter estimation of the phase error rate (3) and thus a better performance of the key rate. However, the use of expressions like (F.5) can also affect the smoothness-i.e. the continuity of the first derivative-of the key rate as a function of the decoy intensities. This in turn can lead to discontinuities in the optimal decoy intensities as a function of the losses, as pointed out in appendices D and E. Like in the derivation of the upper bound on Y 11 in the previous subsection, a valid upper bound for the generic Y 0m (where  m 1 is fixed) is obtained by considering the worst-case scenario for the remaining yields in (F.7). More specifically, Y 0m is maximal when the yields whose coefficient has the same sign as the Y 0m ʼs coefficient are minimal, and the yields whose coefficient has opposite sign to the Y 0m ʼs coefficient are maximal. Recalling the constraint (7), this means setting all the yields of the form Y 0m′ (for ¢ ¹ m m) to zero and Y nm with  n 2 and  m 1 to 1 in (F.7). In so doing, after summing the terms we obtain: By fixing m=2, one gets the desired upper bound on Y 02 .

F.3. Upper bound on Y 20
In a similar fashion, we consider the following combination of gains: A valid upper bound on Y n0 (with  n 1 fixed) is obtained by setting to zero the yields whose coefficient has the same sign as the Y n0 ʼs coefficient, and by setting to 1 the yields whose coefficient has opposite sign to the Y n0 ʼs coefficient. In the case of (F.11), this means setting ¢ Y n 0 (with ¢ ¹ n n) to zero and Y nm with  n 1 and  m 2, to one. In this way we obtain: In (F.14) the coefficients of the yields Y 1m and Y n1 , for any n and m, are identically zero. Thus (F.14) can be rewritten as:  As usual we extract an upper bound on Y 00 by setting to their lowest value the yields whose coefficient has the same sign as the Y 00 ʼs coefficient (which correspond to the Y nm with  n m , 2), and by setting to their maximum value the yields whose coefficient has opposite sign to the Y 00 ʼs coefficient (which correspond to Y 0m and Y n0 ). We know that every yield is trivially bounded by (7). However, in order to derive a tighter bound on Y 00 , we employ nontrivial bounds for all the yields Y nm with  +  We also note that the upper bounds derived on Y 04 and Y 40 in equations (F.9) and (F.13) could be used to improve the estimation of the phase error rate given in by (3). However, it can be shown that the resulting improvement in the secret key rate is very small in this case and we neglect it for simplicity.

Appendix G. Upper bounds on the yields with three decoy intensities
Here we derive the upper bounds on the yields Y 00 , Y 11 , Y 02 , Y 20 , Y 22 , Y 13 , Y 31 , Y 04 and Y 40 presented insection 4.

G.1. Upper bound on Y 22
We consider the most general combination of the nine constraints (6)   From (G.10) we deduce that the sign of Y nm ʼs coefficient is independent of n and m and it is the same for all terms in the sum. Thus a valid upper bound for Y 22 is obtained by setting all the other yields to zero in (G.10), except for Y 22 . By doing this, we obtain (12).

G.2. Upper bound on Y 11
We consider the most general combination of the nine equality constraints:  The function A 11 (μ 0 , μ 1 , μ 2 , n) is defined in [28] when deriving the analogous bound in the symmetricintensities scenario. It reads:  By looking at (G.21), we deduce that a valid upper bound on Y 11 is obtained by setting the yields Y 1m and Y n1 to their maximum allowed value and by setting to zero the yields Y nm , for  n m , 3. In particular, we use the upper bounds derived in (G.5) and (G.6) to bound Y 13 and Y 31 , respectively, while we set to 1 all the other yields Y 1m and Y n1 , for  n m  By isolating the bound on Y 11 and summing the series, we obtain (11).

G.3. Upper bound on Y 02 and Y 04
We consider the most general combination of the nine equality constraints:    We thus conclude that the sign of Y 0m and Y nm ʼs coefficients are always equal in (G.29), regardless of the values of the intensities. Therefore a valid upper bound on Y 0m -for m=2, 4-is obtained by setting to zero all the other yields in (G.29). By doing so, we obtain the upper bounds on Y 02 and Y 04 given in equations (13) and (14).

G.4. Upper bound on Y 20 and Y 40
We consider the most general combination of the nine equality constraints: and require that the terms proportional to Y 0m , Y 1m , Y n1 and Y n2 are removed in the combination. We achieve this by imposing proper conditions on the real coefficients c i j , : å å

G.5. Upper bound on Y 13
We consider the most general combination of the nine equality constraints: and require that the terms proportional to Y 0m , Y 2m , Y n0 and Y n1 are removed in the combination. We achieve this by imposing proper conditions on the real coefficients c i j , :   where A 22 is given in (G.9) and A 11 is given in (G. 19). We thus conclude that Y 1m and Y nm ʼs coefficients have always opposite sign in (G.44), regardless of the values of the intensities. Therefore a valid upper bound on Y 13 is obtained by setting to zero all the yields of the form Y 1m for ¹ m 3 and by setting to 1 all the other yields of the form Y nm with  n 3 and  m 2. In so doing, we obtain the following expression:  where we used in the series the original expressions of A 22 and A 11 that are given in (G.8) and (G.18), respectively. By summing and rearranging the terms, we obtain the upper bound on Y 13 given in (17).

G.6. Upper bound on Y 31
In a similar fashion to Y 13 ʼs bound, one first removes the terms proportional to Y 0m , Y 1m , Y n0 and Y n2 from the general combination of the nine gains:

Appendix H. Upper bounds on the yields with four decoy intensities
In this case each party prepares PRCS with four possible intensities, namely {μ 0 , μ 1 , μ 2 , μ 3 } for Alice and {ν 0 , ν 1 , ν 2 , ν 3 } for Bob. The yields are then subjected to the following sixteen equality constraints: and to the inequality constraints given in (7). Below we derive tighter upper bounds on the yields Y Y Y , , 04 40 13 and Y 31 , since the bounds derived on the yields Y 00 , Y 11 , Y 02 , Y 20 and Y 22 in appendix G are already good enough, i.e. bounding them with one additional decoy intensity would not result in a significant improvement of the performance of the protocol. Note that the bounds presented here are not valid when two decoy intensities of the same party have the same value. This case would then reduce to the three decoy intensity case. Thus, without loss of generality, we assume the following ordering within each set of intensities: μ 3 >μ 0 >μ 1 >μ 2 and ν 3 >ν 0 >ν 1 >ν 2 .

H.1. Upper bound on Y 04
We consider the combination of gains (G.29) that leads to the bound on Y 04 in the case of three decoy intensity settings: is defined by the rhs of (G.29), while G 02 0,1,2 is the combination of gains given by (G.23), with the coefficients c i j , of the combination given in (G.28). The subscript indicates the combination of gains to which it refers, while the superscript indicates the decoy intensities that are involved, namely {μ 0 , μ 1 , μ 2 } for Alice and {ν 0 , ν 1 , ν 2 } for Bob. From (G.3) we know that the terms Y n0 , Y n1 , Y 1m and Y 2m are removed in (H.2), i.e. , for any n, m. Now that the parties have at their disposal the fourth decoy intensity (μ 3 for Alice and ν 3 for Bob), one can derive three additional combinations like (H.2) by simply replacing one of the first three intensities with the fourth one:  and impose that even the terms Y n2 and Y 3m are removed:    , , , , , , ,   H.11   04  0  1  2  3  0  1  2  3  0 1 0  1  2  3  2 0  2  1  3  3 0  3   1  2  1 2 0  3  1  2  3 0  2  1  3  2 3 0  1 04  0  1  2  3  0  1  2  3  0 1 2 3 04  0  1  2  3  0  1  2  3 ... We assume that the indexes in the sums run over the set {0, 1, 2, 3} and we define    n n    We remark that in deriving the bound (H.13) we implicitly assumed that at least one of the following equalities does not hold: ν 0 =μ 0 , ν 1 =μ 1 and ν 2 =μ 2 . Indeed, when all three equalities hold (i.e. when Alice and Bob are using the same intensities settings for three out of four decoy pulses) one gets a ' 0 0 form' in the bound expression (H.13). In order to overcome this issue (which is not likely to happen in practice due to intensity fluctuations), we derive an additional upper bound on Y 04 which is valid in the particular case of: ν 0 =μ 0 , ν 1 =μ 1 and ν 2 =μ 2 .
The procedure resembles that used in deriving (H.13). We start by considering the four combinations of gains (H.2), (H.3), (H.4) and (H.5) and we impose the conditions: ν 0 =μ 0 , ν 1 =μ 1 and ν 2 =μ 2 . Let us indicate the resulting gains combinations as follows:  We assume that the indexes in the sums run over the set {0, 1, 2, 3}, we define  is defined by the rhs of (G.37), while G 20 0,1,2 is the combination of gains given by (G.31), with the coefficients c i j , of the combination given in (G.36). From G.4 we know that the terms Y n1 , Y n2 , Y 0m and Y 1m are removed in (H.28). Following the same procedure described in (H.1), we derive three additional combinations of gains in which the terms Y n1 , Y n2 , Y 0m and Y 1m are removed: Now we further combine these expressions with arbitrary real coefficients d i j k and impose that even the terms Y n3 and Y 2m are removed from the rhs of (H.32). This yields a linear system of equations in the variables d i j k , , , whose unique solution (up to a global rescaling) reads as follows: whereH 40 is given by:

H.3. Upper bound on Y 13
We follow the same procedure used in bounding the other yields in the case of four decoy intensity settings. We start by considering the four combination of gains in which the terms Y n0 , Y n1 , Y 0m and Y 2m are removed: where the last three combinations are derived from the first one as described in (H.1), while the first combination is given by (G.44). Now we further combine these expressions with arbitrary real coefficients d i j k and impose that even the terms Y n2 and Y 3m are removed from the rhs of (H.43). This yields a linear system of equations in the variables d i j k , , , whose unique solution (up to a global rescaling) reads as follows:   where the last three combinations are derived from the first one as described in (H.1), while the first combination is given by (G.48). Now we further combine these expressions with arbitrary real coefficients d i j k and impose that even the terms Y n3 and Y 2m are removed from the rhs of (H.56). This yields a linear system of equations in the variables d i j k , , , whose unique solution (up to a global rescaling) is given in (H.44), under the replacement: m n « i i for i=0, 1, 2, 3. By substituting the solution back into (H.56) and by rearranging the rhs, one gets a combination of gains where all the terms Y n0 , Y n2 , Y n3 , Y 0m , Y 1m and Y 2m are removed: