Beating the repeaterless bound with adaptive measurement-device-independent quantum key distribution

Surpassing the repeaterless bound is a crucial task on the way towards realizing long-distance quantum key distribution. In this paper, we focus on the protocol proposed by Azuma et al (2015 Nat. Commun. 6 10171), which can beat this bound with idealized devices. We investigate the robustness of this protocol against imperfections in realistic setups, particularly the multiple-photon pair components emitted by practical entanglement sources. In doing so, we derive necessary conditions on the photon-number statistics of the sources in order to beat the repeaterless bound. We show, for instance, that parametric down-conversion sources do not satisfy the required conditions and thus cannot be used to outperform this bound.


Introduction
Quantum key distribution (QKD) protocols can provide two distant parties (Alice and Bob) with informationtheoretically secure secret keys [1][2][3]. However, in point-to-point QKD via pure-loss bosonic channels, the achievable secret key rate is fundamentally limited by the so-called repeaterless bound [4][5][6][7][8][9]. In the limit of high channel loss (i.e. long distances) the repeaterless bound is proportional to the transmittance of the channel connecting Alice and Bob, denoted by η. This means that the secret key rate of any point-to-point QKD protocol scales at most with η. As in the case of optical fibers e L L att h = -, where L is the distance between the parties and L att is the attenuation length of the fiber, this poses a stringent limitation on the achievable secret key rate. Therefore, surpassing the repeaterless bound is an essential step towards efficient long-distance quantum communication.
A simple idea to outperform the repeaterless bound is to introduce intermediate nodes, dividing the channel into many smaller segments so that the probability of losing a signal stays relatively small on each segment. This naturally leads to the concept of quantum repeaters [10][11][12][13][14][15][16][17][18], which are typically based on entanglement swapping and distillation. However, to truly benefit from a quantum repeater, one needs many nodes and demanding technological resources, which makes the experimental realization very challenging with current technology [19].
Another, recently proposed idea is twin-field QKD (TF-QKD) [20], which is based on single-photon interference and includes one intermediate node performing such conceptually simple interferometric measurement. Indeed, this offers a square root improvement in the scaling of the secret key rate. This proposal has triggered a lot of attention in the field and various simple security proofs and improved versions of the original protocol have been very recently introduced [21][22][23][24][25][26][27]. Proof-of-principle experiments to show the feasibility of some of the suggested TF-type QKD protocols have already been demonstrated experimentally [28][29][30][31], which may suggest the viability of this approach to achieve intercity QKD with current technology.
The same square root improved scaling can be achieved if one extends the original measurement-deviceindependent QKD (MDI-QKD) [32] protocol, based on two-photon interference, with some feedback mechanism to make sure that the Bell state measurement (BSM) is performed between signals that actually survived the channel loss. One way is to make use of quantum memories [33][34][35], but the required memory parameters are still challenging for current technology [36]. To avoid the need for quantum memories while having the same square root improved scaling, Azuma et al proposed the idea of a fully optical, adaptive MDI-QKD [37] (AMDI-QKD) protocol, using standard optical teleportation for performing a quantum nondemolition measurement (QND) [38] to confirm the arrival of the single-photon signals at the middle node. While the required technology to implement the AMDI-QKD protocol is far off our current experimental capabilities, this protocol could offer higher secret key rates than the TF-QKD protocol, because the former is based on two-photon interference at the middle node while the latter is based on single-photon interference [39].
The original AMDI-QKD scheme [37] assumes highly idealized devices, like, for instance, perfect entanglement sources, which are capable of generating a perfect EPR pair on demand for the teleportation in the QND measurement, and perfect single-photon sources. In this paper, we investigate the robustness of this protocol against source imperfections, like for example a non-vanishing probability of emitting multiplephoton signals and thus introducing extra noise into the system. By performing a full-mode analysis of a realistic setup we derive a necessary condition on the photon-number statistics of the sources for overcoming the repeaterless bound in [6].
In doing so, we also show, for example, that with parametric down-conversion (PDC) sources, the AMDI-QKD protocol has a scaling of at most η, therefore unable to beat the repeaterless bound. This is due to the fact that PDC sources have a too large probability of emitting multiple-photon pairs compared to the probability of emitting single-photon pairs.
We note that a similar behavior has also been observed in the context of the ensemble-based quantum memory assisted MDI-QKD [40] protocol. Ensemble-based quantum memories have many favorable properties, but they inherently suffer from a non-negligible probability of emitting multiple-photons (similar to that of the PDC sources) causing the advantageous scaling offered by a traditional memory assisted system [33][34][35] to vanish. In this regard, we remark that our result is stronger than that introduced in [40] in the sense that it applies even with photon-number resolving (PNR) detectors, while [40] assumes threshold detectors.
The paper is organized as follows. In section 2, the investigated protocol is introduced and its secret key rate formula is presented. Section 3 describes mathematically the physical devices used for the implementation of the protocol. Next, in section 4 we present the main results of the paper. Here, we obtain necessary conditions on the applied entanglement sources for overcoming the repeaterless bound [6] with the AMDI-QKD protocol. As a corollary, we prove that the protocol is not capable of beating the repeaterless bound [6] using PDC sources. Lastly, section 5 contains the conclusions of the paper. The paper also includes two appendices for providing the details of the calculations.
2. The AMDI-QKD protocol 2.1. Protocol steps The schematic layout of the AMDI-QKD protocol [37] can be seen in figure 1. The protocol runs as follows: 1. Each of Alice and Bob generates m signals with their on-demand entanglement sources S AC and S BC , respectively. One mode of each signal is sent to Charlie's QND measurement simultaneously via the quantum channel, using a multiplexing technique (e.g. wavelength based). The other mode is kept by Alice and Bob and they measure it in the Z or X basis, which they choose with probabilities p Z and p p 1 HH ) from the others, as we consider (see figure 3 in section 3) a standard linear-optics implementation of the BSMs. Here H (V ) represents a horizontally (vertically) polarized single-photon state.

5.
For key generation, Alice and Bob post-select the events by communicating over an authenticated classical channel where they used the Z-basis to measure their modes in step 1 (and in which they both had a successful photon detection) and also the corresponding BSM was successful. To make sure that their key bits are identical, they apply a bit flip procedure [32]. To be precise, Alice or Bob flips her or his bits, except for the cases when they chose the Z basis and Charlie's BSM outcome was the state

Secret key rate formula
The secret key rate formula for the protocol above has been derived in [37] when the number of multiplexing m tends to infinity. It reads: where p s is the probability that Charlie's QND and the Z measurements are both successful either at Alice's or Bob's site. The quantity p BSM represents the success probability of one BSM. The quantities e Z and e X , on the other hand denote the bit and phase error rates, respectively. The parameter f is an inefficiency function for the error correction process and h x x ) is the binary entropy function. We remark that the fact that in equation (1) only p s rather than the square of it appears is due to the advantage that the original AMDI-QKD protocol offers, that is, BSMs are only performed between signals that survived the channel loss. Therefore, a particular signal only needs to survive traveling through one path [37].
We also note that since we evaluate the secret key rate in the asymptotic regime where m  ¥, the parties perform steps 1-5 of the protocol only once. Also, for simplicity, we assume that p p Z X  , so that we take (1) for the simulations below. Moreover, we assume for simplicity that f=1. The full-mode analysis of the AMDI-QKD protocol described above can be found in appendix B, based on equation (1) and the device models described in the next section.

Device models
Here, we describe the mathematical models that we use to characterize the behavior of the different devices employed to evaluate the performance of the AMDI-QKD protocol.

Photonic sources
We shall assume that all entanglement sources emit states of the following form: and p 0 n  . The n-photon pair states n f ñ | are given by n n x y x y . Schematic layout of the AMDI-QKD protocol using the entanglement sources S AC and S BC . The distance between Alice and Bob is denoted by L and we assume that the untrusted middle node Charlie is located halfway between them. The parameter m is the number of pulses that each party sends to Charlie. A QND measurement is performed by Charlie to confirm the arrival of the signals emitted by the S AC and S BC sources. Also, Alice and Bob measure their modes of the sources in the Z or X-basis, which they select probabilistically, indicated in the figure by the symbol (Z/X). Conditioned on the success of the QND measurements, the surviving signals are paired via optical switches (SW) and BSMs are performed between all the pairs by Charlie.
We note that if we choose p 1 =1 (i.e. p n =0 for any n 1 ¹ ) then equation (2) represents a perfect entanglement source that is capable of emitting maximally entangled states 1 f ñ | with certainty. Another interesting special case is when holds, in which case equation (2) describes a type-II PDC source [41] with λ being a positive parameter, related to the amplitude of the pumping laser.

Detectors
We shall assume that all the detectors are PNR detectors, characterized by the following positive operator-valued measure (POVM) elements n k n n 1 , 5 with k 0, 1, , = ¥  denoting the number of detected photons. In equation (5), the parameter det h is the detection efficiency of the detectors and nñ | is the n-photon Fock state. We note that for simplicity in equation (5) we have disregarded the dark count probability of the PNR detectors.

QND measurement
A linear-optics teleportation-based implementation of the QND measurement can be seen in figure 2. It consists of a standard linear-optics BSM module together with an entanglement source S QND that emits the state described in equation (2). The purpose of the QND measurement module is to herald if a photon successfully arrived at Charlie's node, so that, in this case, he can continue the protocol with performing his BSMs. The successful heralding events are constituted by the same detection patterns as in the original MDI-QKD protocol [32], that is, a successful heralding event occurs if the detectors detect exactly one photon in horizontal polarization and one photon in vertical polarization. The setup is based on quantum teleportation. Indeed, in the case of a single-photon input and S QND being a perfect EPR source with p 1 =1, the QND module teleports its input mode to its output mode [42]. We note that there exist more efficient implementations of a BSM [43,44] in terms of the success probability (which can approach 1 instead of 1/2 as in the scheme shown in figure 2), but they come with the overhead of the need for complicated ancilla states.

Optical switches
Charlie directs the successfully arriving signals into his BSMs with the help of optical switches. For this, an active feedforward mechanism is required since it takes time to align the ports of the switches properly, so that successful signals from Alice and Bob end up in the same BSM at Charlie's site. It is assumed that one active feedforward takes time τ, during which signals propagate in optical fibers. Therefore, the feedforward procedure can be modeled as a lossy channel with transmittance c L exp )due to the propagation of the signals through the fibers, where c denotes the speed of light in the optical fiber. Otherwise, we assume perfect switching devices with unlimited number of entries.

BSM modules after the switches
In this case, the linear-optics implementation of the middle BSM modules is depicted in figure 3. Similarly to the QND module, the success events are constituted by the same detection patterns as in the original MDI-QKD protocol [32]. Note, however, that this middle BSM module differs from the one used in the QND measurement. Here, Hadamard gates (denoted in figure 3 by H) are applied [39], whose operation can be described as are the creation operators of the input and output modes of the Hadamard gate in horizontal (vertical) polarization.
Including the Hadamard gates is advantageous, since they can prevent errors that can occur otherwise. For example, when the source S QND emits a two-photon pair state and the input of the QND module is the vacuum state, a successful heralding event can still occur, despite of the fact that the signal coming from the corresponding party was lost. In this scenario, it can be shown (see appendix A) that the output state of the QND measurement, heading towards the middle BSM, is a two photon signal consisting of one vertically and one horizontally polarized photon. Now, without the Hadamard gates, this state could give a successful detection event at the middle BSM, which is undesired since there was no signal received from the party connected to the seemingly successful QND measurement. Intuitively, one expects that adding the Hadamard gates, i.e. rotating the signal, will just decrease the chance of the two photons ending up in detectors corresponding to different polarizations. This is so because, after the rotation, it is not predetermined any more which detector they hit after the polarizing beam splitter, and it rather becomes a probabilistic process. However, carrying out the calculation shows (see appendix A) that, in fact, the Hadamard gates force the spurious two photon signal to give nonconclusive detection events at the final BSM, which is the best possible scenario. In short, in this example the actual signal from at least one party is lost, and therefore obtaining a conclusive key generation event will essentially introduce an error with probability 1/2 due to the fact that the parties do not share the desired quantum correlation since their emitted signals have not actually interacted. Consequently, it is advantageous for Alice and Bob to reflect such an event as a non-conclusive event of the protocol with the help of the Hadamard gates, instead of getting a conclusive one which will introduce an error with high probability.

Quantum channel
For concreteness, we assume that the quantum channel connecting Alice (Bob) to Charlie is an optical fiber with attenuation length L att and transmittance where L is the distance between Alice and Bob, and L 10 dB log 10 att a = ( ) , where log denotes the natural logarithm and α is the loss coefficient of the channel measured in dB km −1 . For simplicity, we do not consider any misalignment effect in our system.
Using the above devices, we can summarize the differences between the AMDI-QKD scheme considered in this paper and the original proposal. In particular, here we have replaced both the perfect entanglement source for the QND measurement and the perfect single-photon sources of Alice and Bob in the original AMDI-QKD [37] by more realistic entanglement sources, described by equation (2), which have non-zero probability of emitting multiple-photon signals in general. Note that the single-photon sources possessed by Alice and Bob are achieved in our scheme by measuring one mode of their entanglement sources. Another modification is to change all the threshold detectors, which were in the BSM and the QND measurement, to PNR detectors. Apart from these, the protocol, of course, runs in a similar manner as in the original proposal [37], described in section 2.1.
We note that the AMDI-QKD scheme can be implemented using only practical single-photon sources instead of the entanglement sources given by equation (2) as well. In this case, Alice and Bob would possess practical single-photon sources and the QND measurement could be replaced by a qubit amplifier setup using practical single-photon sources like, for example, that introduced in [45].

Necessary conditions
In this section, we first derive a simple but non-trivial analytical necessary condition on the photon-number statistics of the sources for the AMDI-QKD protocol to be able to beat the repeaterless bound reported in [6], which is given by the formula log 1 ) . For this, we use the fact that, if one cannot beat the bound with η det =1 and τ=0 s, then it is also impossible to beat it with η det <1 and τ>0 s, since the secret key rate cannot increase with lower efficiency detectors. Thus, we can construct the necessary condition by requiring that the bound in [6] is overcome when we set η det =1 and τ=0 s, which significantly simplifies the secret key rate formula, making the derivation of an analytical result possible. With this simple necessary condition, it is already possible to show that PDC sources cannot beat the repeaterless bound with the AMDI-QKD protocol.
Afterwards, we consider the general case where η det <1 and τ>0 s. In this scenario we can only obtain the condition on the sources to beat the repeaterless bound by numerically evaluating the secret key rate formula, given by equation (1). The required formulas to evaluate equation (1) can be found in appendix B.
By comparing the two results, we see that the finite detection efficiency of the detectors has a significant impact on the required photon-number statistics of the sources. To be precise, when the detection efficiency of the detectors decreases, then the requirements on the maximum values of the multi-photon probabilities of the sources become more severe.

Simple analytical necessary condition
When we set η det =1 and τ=0 s, we find that the secret key rate formula can be written as (for the details of the calculation see appendix B): where the p n (q m ) values represent the photon-number statistics of the sources S AC and S BC (S QND ). We remark that we can choose the values of p n to be equal for the sources S AC and S BC because Charlie is located halfway between them, and such selection is optimal in this scenario. Importantly, we note that in equation (8) only the probabilities p 1 , q 1 and q 2 appear. This is so because of the following. The appearance of p 1 and q 1 is the consequence of the fact that only single-photon pairs can give rise to true success events. Using unit efficiency detectors, the only possible way for multiple-photon pairs to cause a seemingly successful QND measurement is when the S QND source emits the state 2 f ñ | and the signal from Alice (Bob) is lost during the transmission through the optical fiber, which explains the appearance of q 2 .
From equation (8) we learn, that in the case of the use of detectors with unit efficiency, in the asymptotic , which means that choosing the parameters p 1 , q 1 and q 2 properly, we can actually beat the repeaterless bound [6] in this limit. The reason why the secret key rate never breaks down in the unit efficiency detector case is due to the fact that we have neglected dark counts and misalignment in the quantum channel.
Claim. To beat the repeaterless bound [6] with the AMDI-QKD protocol, using PNR detectors and entanglement sources S AC and S BC (S QND ) of the form given by equation (2), with photon-number statistics p n (q m ), it is necessary that q pq q min 25 96 , 1 Proof. Making use of the Taylor expansion, the following inequality trivially holds for the repeaterless bound, reported in [6]: Then, for the necessary condition, we require that R Therefore, to be able to overcome the repeaterless bound [6], q q ) must hold, which means that we can upper bound the secret key rate by plugging η ch =0 in the denominator of equation (8): For the necessary condition it is then required that This inequality is tighter than q q Considering this validity condition, we obtain the simple necessary condition given by equation (9). , The necessary condition, given by equation (9), is depicted in figure 4, where we plot the value of q 2 , above which it is not possible to beat the bound [6], given the values of p 1 and q 1 . We can see that the necessary condition is more sensitive to the value of q 1 , than to the value of p 1 in the sense that if q 1 is too small then no matter how large we set p 1 , we need to have q 2 =0 (purple area in figure 4). However, in the converse situation, having p 1 small does not imply that q 2 =0. One can also see this formally by noting that in equation (9) only q 1 appears squared. This is so, because, as explained before, even in the ideal efficiency detector case the source S QND can cause errors by introducing two-photon pair signals. While the sources S AC and S BC cannot, since the detectors in the Z/X measurement filter out all the two-photon pair signals.
Corollary. Using PDC sources, it is impossible to beat the repeaterless bound [6] with the AMDI-QKD protocol.
Proof. The photon-number statistics of the PDC sources can be written as where, as already mentioned previously, λ (μ) is a positive parameter, related to the amplitude of the laser used to pump the sources S AC and S BC (S QND ). We note that due to the symmetries of the setup, that is, Charlie is located halfway between Alice and Bob, we can set the λ values for the sources S AC and S BC equal.
Plugging equations (16) into (9), we have that is necessary to overcome the repeaterless bound [6]. However, since 1 1 (the latter can be seen easily by taking the derivative with respect to λ), we have that which obviously contradicts equation (17), meaning that for PDC sources the necessary condition cannot be fulfilled. Therefore, it is impossible to overcome the repeaterless bound [6]. ,

Tighter necessary condition
In this section, we now analyze the necessary condition without the assumption of η det = 1 and τ = 0 s. For this, we numerically evaluate the general secret key rate formula derived in appendix B. For simplicity, however, in the simulations, we restrict ourselves to the case where every source emits at most two photon pairs, that is, we set q n =p n =0 for any n3. We remark, however, that, with the general secret key rate formula given in appendix B, it is possible to allow for an arbitrary number of emitted photon pairs if one has sufficient computational power. The results can be seen in figure 5. We introduced the quantities P p p 2 1 º and Q q q 2 1 º to characterize the quality of the sources, lower values meaning higher quality sources since emitting two photon pairs is less likely than emitting the desired EPR pair, for given values of p 0 and q 0 .
] denote the maximally allowable value of Q to be able to overcome the bound [6], as a function of p 0 and P, given the parameters η det and τ. In figure 5, we plot the quantity Q Q 1, 67ns ] as a function of p 0 and P for different values of η det <1, given the value of q 0 . So that we can observe how does the Q max value decreases for a given p 0 and P if we have η det <1 and τ=67 ns, compared to the η det =1 and τ=0 ns case. We set τ=67 ns as illustration, since this is the value used in the original implementation [37], based on the experiments reported in [46,47]. Our simulations show that the value of q 0 does not influence significantly the order of magnitude tendencies observed while decreasing the detection efficiency of the detectors. Loosely speaking, varying the value of q 0 only translates the secret key rate curve vertically (i.e. the secret key rate basically decreases by a constant factor for all values of the channel loss) for given P and p 0 values. This means that in the comparison, every curve for the different detection efficiencies will be translated by the same factor, therefore, for a different q 0 value, the Q max values will also be altered by a common factor for each detection efficiency, and since we are plotting their quotients, it means that the plots on figure 5 will stay very similar.
First, let us examine the region of the plots where P≈0 (reddish areas in figure 5), which means that the sources of Alice and Bob are close to perfect entanglement sources. We see that decreasing the value of η det from 1 to 0.9, 0.7 and 0.5 results in the need for about an order of magnitude higher quality sources at Charlie's hand . The maximal allowable value of q 2 as a function of p 1 and q 1 , which is necessary for the sources to be able to beat the repeaterless bound [6] with the AMDI-QKD protocol. for each efficiency compared to the previous one. This is partly due to fact that eight detections are needed for obtaining a raw key bit (one in the Z/X measurement of each Alice and Bob, two in the QND measurement at each side and two more in the BSM), therefore, now we have a factor of 1 det 8 h < in the probability of each key generation event, but this only translates the secret key rate curve vertically. On top of this, and what is more important, we now have an increased probability of obtaining erroneous key generation events from the twophoton pair component of the sources S QND . To see this, suppose that one of the sources S QND on Alice's side emits a two-photon pair signal and all the other sources emit one-photon pair signals, and suppose that the signal from Alice towards the QND measurement is lost in the transmission. In this case, as already mentioned previously, we can get a seemingly successful detection event if one photon out of the two going from the QND module towards the BSM is lost in the detection process of the BSM, which happens with a probability 1 det h -. Thus, the error rate will increase as we decrease the detection efficiency. The only way to compensate this error is to have better quality sources at Charlie's hand (meaning lower Q values). Now, let us observe the part of the plots, where P≈0.25 (purplish areas in figure 5), meaning that Alice and Bob no longer have perfect entanglement sources. In this case, we find that the more we decrease the value of η det the more the values of Q Q h , which is more or less true in the P 0 » region. What has been said before for the region P 0 » is true for this region as well, but, on top of those effects, since P 0 > , the sources of Alice and Bob now have a non-zero probability of producing erroneous successful detections in the Z/X measurements due to their two-photon pair component, which was not possible before in the P 0 » region. Consider the previously explained situation with the difference, that Alice's source now emits a two-photon pair signal and both photons from Alice heading towards the QND module are lost in the transmission. In this case we can only get a seemingly successful raw key generation event if one photon out of the two in the Z/X measurement at Alice's site is lost in the detection, which occurs with a probability 1 det h -. Thus, the probability of this type of error scales with 1 factor comes from the fact that in the scenario considered, we need to lose one more photon in the detection process of the BSM to have a seemingly successful raw key generation event), meaning that it does not depend linearly on the detection efficiency as in the P 0 » region, which explains the observed behavior for the P 0.25 » region. From this, we can see that, as expected, P has a more significant impact on the Q max values than p 0 , which, since increasing p 0 will not increase the probabilities of an error, just translates the secret key rate curve vertically. These are the main reasons behind this dramatic increase in the quality of Charlie's sources as we decrease det h .
Summing up the observations from figure 5 we can say that the necessary quality of the sources can be much higher than what is expected from the unit detection efficiency condition if we have non-perfect detectors. We also note that using the formulas for the secret key rate from appendix B, figure 5 can be easily made for arbitrary q 0 1 0  < and 0 1 det  h < .

Conclusion
We have investigated the performance of a more realistic implementation of the original AMDI-QKD protocol [37], assuming that the parties have access to a broad class of entanglement sources of the form given by equation (2) and PNR detectors. We have shown that the improved ch h scaling (with ch h being the transmittance of the channel connecting Alice and Bob to Charlie), offered by the protocol, is very sensitive to multiple-photon pair components emitted by the sources. More precisely, we have derived a simple non-trivial analytical necessary condition on the photon-number statistics of the entanglement sources to be able to overcome the repeaterless bound [6] with the AMDI-QKD protocol. With this condition, we have demonstrated analytically that employing the widely available PDC sources does not enable the protocol to beat the repeaterless bound. Furthermore, we have quantitatively investigated the effect that the finite detection efficiency of the detectors have on the required photon-number statistics of the sources. In this regard, we have shown that, when the detection efficiency of the detectors decreases, then the maximum tolerable values of the multi-photon probabilities of the sources in order to beat the repeaterless bound become significantly more severe. This latter study, however, was only feasible by numerically evaluating the secret key rate formula of the protocol.
Our results suggest, that, while the AMDI-QKD protocol could in principle overcome the repeaterless bound with idealized devices, in practice it demands very high quality entanglement sources, which are thus still challenging to realize with current technology, besides, of course, the involved multiplexing techniques depending on the channel length. As we have shown in our paper, an advantage of a protocol based on an advanced technique (e.g. a QND measurement for the case of the AMDI-QKD protocol) may be indeed sensitive to imperfections of devices and noise. Therefore, in general, it is important to study such protocols in detail [48][49][50], as well as to establish criteria to guarantee that their advantages are preserved [51], which can trigger further experimental studies.

Appendix A. BSM with Hadamard gates
In this appendix we give an intuitive argument on the reason why the use of Hadamard gates is advantageous in the BSM after the optical switches. Suppose that the state used for key generation is 1 f ñ | , given by equation (3). If every source emits this state and a successful detection pattern occurs, the parties share the desired quantum correlation to obtain their secret key (given that dark counts are neglected). However, if some of the sources emit multiple-photon pair states, for example the state 2 f ñ | , also given by equation (3), this could result in a seemingly successful detection event, which does not provide the parties with the desired correlations and will end up producing errors. As we will show below, including the Hadamard gates in the BSM removes the possibility of getting errors from the state 2 f ñ | . Let us illustrate this with an example depicted in figure A1. In particular, let us consider the situation when S AC emits the state 1 f ñ | and there is a correct detection in Alice's Z/X measurement but the photon in the other mode (mode a in figure A1), going towards the QND measurement, is lost in the transmission. Moreover, suppose that the S QND source on Alice's side emits the 2 f ñ | state, which can cause a seemingly successful QND measurement on Alice's side and also a seemingly successful BSM at Charlie's site.
Furthermore, suppose that the sources S BC and S QND on Bob's side both emit the 1 f ñ | state. Let us assume that these signals cause successful Z/X and QND measurements on Bob's side, but the photon in the other mode (mode f in figure A1), going from the S QND source towards Charlie's BSM module, is lost, say during the feedforward mechanism. Therefore, in this example, there is no actual signal coming from Bob to the BSM. This way, if the Hadamard gates are not used, it is possible that the 2 f ñ | state coming from the S QND source on Alice's side will result in a seemingly successful BSM. Consequently, the parties would conclude that the protocol had run correctly and they can obtain a secret key bit, but in reality, they will get random outcomes instead of correlated ones. Next, we show that this cannot occur in the presence of the Hadamard gates.
For simplicity, instead of 2 f ñ | , we assume that the source S QND on Alice's side emits the following unnormalised state The QND measurement is successful if there are exactly two, orthogonally polarized photons in the modes c and d (see figure A1): where we expressed the modes g and h after the Hadamard gates as a function of the input modes e and f. In doing so, we used the matrices describing the quantum optical operation of the BS and the Hadamard gate. It is clear that in this example, the state e e H V † † , which we have after the seemingly successful QND measurement, cannot cause a successful BSM, since in equations (A3)-(A6) there is no component that contains e e H V † † . Therefore, the error that was possible before is now filtered out by the Hadamard gates.
Appendix B. Full-mode analysis B.1. Rephrasing the secret key rate formula The secret key rate formula, given by equation (1), can be written as [37] R p p h e h e 1 , B 1 where we have set f=1. Also, as explained in the main text, we assume that p 1 Z » since we consider the asymptotic scenario. We remind the reader that p s is the probability that Charlie's QND and the Z/X measurements are both successful either at Alice's or Bob's site. The quantity p BSM represents the success probability of one BSM. We note that since the Z-basis is used for the key generation the above quantities are defined in the case when Alice and Bob choose the Z-basis. We also note that the probabilities p s and p BSM by definition include all the possible detection patterns that constitute that particular success event.
However, due to the symmetries of the channel model, for our simulations, it is not necessary to calculate the probabilities of all the detection patterns that constitute a certain event, which would be rather tedious and redundant. Thus, in the remainder of this section, we are going to relate the quantities p s , p BSM , e Z and e X to the probabilities of some particular detection patterns, relying on the symmetries of the channel model.  figure B1). Altogether, this means eight different possibilities. Note that these eight detection patterns all have the same probability due to the symmetries of the channel model considered. Moreover, p QND is also independent of the basis choice of Alice. Therefore, we can write that Now, let us also express p BSM with probabilities corresponding to particular detection patterns. For this, first, let p Z c (correct) denote the probability of the following particular detection pattern given that the parties choose to measure their local modes in the Z-basis. Suppose that Charlie's QND and the Z measurement were successful on both Alice's and Bob's side with the particular detection pattern described before for p QND (i.e. both parties detected H polarization) and then in the BSM after the optical switches there is exactly one photon detected in each of the detectors D H 2 and D V 2 and zero photons detected in the other detectors D H 1 and D V 1 in figure B2. Note, that this detection pattern corresponds to a projection into the Bell state f ñ -| , which means that the parties will not apply bit flip, this way obtaining correlated (correct) raw key bits. The success probability of the BSM alone, corresponding to the above described particular detection pattern can be written as p p Z c QND 2 . We also note that in the BSM after the switches there is another detection pattern that corresponds to obtaining correlated (correct) raw key bits (projection into the Bell state f ñ -| ), which happens when there is one photon detected in both D H 1 and D V 1 and zero photons detected in D H 2 and D V 2 in figure B2. Due to the symmetries,  h is the channel loss that corresponds to the active feedforward mechanism and in our calculations it has been incorporated into the detection efficiency. Optical modes are denoted by italic letters. this particular click pattern will also have probability p Z c . Therefore, the contribution to p BSM in this case will be p p 2 Z c QND 2 . Now, let us define p Z nc (non-correct) in the same way as we defined p Z c , with the only difference being that in the BSM after the optical switches there is exactly one photon detected in each of the detectors D H 2 and D V 1 and zero photons detected in the other detectors D H 1 and D V 2 in figure B2. Note that this particular detection pattern corresponds to a projection into the Bell state y ñ -| , meaning that one of the parties will apply a bit flip, therefore obtaining anti-correlated (non-correct) raw key bits. Similarly to p Z c , there is another detection pattern that corresponds to obtaining the same anti-correlated raw key bits (one photon detected in both D H 1 and D V 2 and zero photons detected in D V 1 and D H 2 in figure B2). Again, due to the symmetries, this particular click pattern will also have p Z nc probability, therefore the contribution to p BSM is p p 2 Z nc QND 2 in this case. The quantity e X can be defined and calculated, similarly to the case for e Z , by considering probabilities with which agreed and disagreed bits are adopted by Alice and Bob. However, for clarity, here we use another method to calculate e X . Choosing the X-basis means that the parties apply a Hadamard gate on the mode a in figure The remainder of appendix B is structured as follows. In appendix B.2 we derive p QND , then in appendices B.3 and B.4 we derive p Z c , p Z nc and p X c , p X nc . And finally, in B.5 we obtain the secret key rate formula for the 1 det h = and 0 s t = case.

B.2. Derivation of p QND
The layout for this derivation can be seen in figure B1. For convenience, we use the density matrix formalism for the sources. It is easy to see that converting the emitted state yñ | , given by equation (2), into a density matrix in the n f ñ | -basis, only the diagonal terms will give contributions when calculating the probabilities of the different detection patterns (described by the POVMs of equation (5), which are diagonal in the Fock basis) since different values of n represent different photon numbers. This means that for our calculations, instead of using the pure states given by equation (2), we can use mixed states of the following form: are the creation operators of horizontally (vertically) polarized photons of the corresponding modes.
Next, we calculate the quantum state from Alice that enters the 50:50 beam splitter (BS) within the QND measurement after traveling through the quantum channel. For this, we model the quantum channel by a BS with transmittance L L exp 2 ch att h = -( ( )). In doing so, it turns out that such a state is given by The quantity p QND is defined (see appendix B.1) by the probability of the event that there is exactly one photon detected in each of the modes g h , g v and a h (detectors D H 2 , D V 2 and D H 3 in figure B1) and zero photons detected in the modes h h , h v and a v (detectors D H 1 , D V 1 and D V 3 in figure B1). This event is described by the following POVM where we extended the notation used in equation (5) We repeatedly make use of the following transformation of the summation indices, whenever we calculate the trace of an expression.
The probability p QND can be obtained as the normalization factor of b G : The layout for this derivation can be seen in figure B2. Using the previous result for the state coming from the QND and the Z measurement, which is given by equation (B15), the state that enters Charlie's BSM module from Alice's (Bob's) side is c G ( d G ). Therefore, their collective state can be written as where note that upper case indices are used to describe quantities corresponding to mode d (coming from Bob's side), while using lower case indices to describe quantities corresponding to mode c (coming from Alice's side). For simplicity, in equation (B19) we introduced the following notation: Then, the state after the Hadamard gates can be written as The quantity p c Z is defined (see appendix B.1) by the probability of the event that, one photon is observed in each of the modes g h and g v (one detection in each of the detectors D H 2 and D V 2 in figure B2) and zero photons are observed in each of the modes h h and h v (no detection in neither of the detectors D H 1 and D V 1 in figure B2) Similarly, p Z nc is by definition equal to the probability of the event that one photon is observed in each of the modes g h and h v (one detection in each of the detectors D H 2 and D V 1 in figure B2) and zero photons are observed in each of the modes g v and h h (no detection in neither of the detectors D H 1 and D V 2 in figure B2). These events are described by the following POVMs The derivation of the probabilities p X c and p X nc is very similar to the derivation of p Z c and p Z nc in appendix B.3. However, for the X-basis we perform the derivation with a slightly different structure, that is, we perform the X measurements at the very end, after Charlie's QND measurement and BSM have gone through successfully. However, we remark that the calculations could also be done using the same structure like in appendix B.3.
So firstly, we obtain the state that Alice (Bob) has after Charlie's QND measurement was performed successfully on her (his) side, which is described by the following POVM: where note that we use the same notation for the modes as in figure B1 and we excluded the X measurement so far. Let us denote this state by AC s ( BC s ) on Alice's (Bob's) side. Then, we take the tensor product AC BC s s Ä and perform the middle BSM with the POVM of equation (B34), but here the modes correspond to figure B2 since this is the measurement being executed. Next, on the obtained state from the BSM, the parties perform the X measurement, which essentially means that they apply Hadamard gates on their modes and after that they perform the Z measurement in figure B1. Let ab s ¢ denote the state held by Alice and Bob after they apply the Hadamard gates, where a (b) represents the optical mode entering the PNR detectors in the Z measurement at Alice's (Bob's) site.
Considering the detection patterns that define the correlated (correct) and anti-correlated (non-correct) raw key generation events, as explained previously in appendix B.  We note that BC s has the exact same form with mode b¢ (d) entering Bob's X measurement (Charlie's BSM from Bob's side) and in the expression of BC s we use capital letter indices similarly to appendix B.3: