Zigzag approach to higher key rate of sending-or-not-sending twin field quantum key distribution with finite-key effects

Odd-parity error rejection (OPER), in particular the method of actively odd parity pairing (AOPP), can drastically improve the asymptotic key rate of sending-or-not-sending twin-field (SNS-TF) quantum key distribution (QKD). However, in practice, the finite-key effects have to be considered for the security. Here, we propose a zigzag approach to verify the phase-flip error of the survived bits after OPER or AOPP. Based on this, we can take all the finite-key effects efficiently in calculating the non-asymptotic key rate. Numerical simulation shows that our approach here produces the highest key rate over all distances among all existing methods, improving the key rate by more than 100% to 3000% in comparison with different prior art methods with typical experimental setting. These verify the advantages of the AOPP method with finite data size. Also, with our zigzag approach here, the non-asymptotic key rate of SNS-TF QKD can by far break the absolute bound of repeater-less key rate with whatever detection efficiency. We can even reach a non-asymptotic key rate more than 40 times of the practical bound and 13 times of the absolute bound with 1012 pulses.

The very recently proposed TF QKD [11], together with its variants [12][13][14][15][16][17][18][19][20][21][22][23][24][25][26][27], changes the key rate into square root scale of the channel transmittance. The protocol can overcome the linear scaling of QKD where e 1 is the phase-flip error rate of those raw untagged bits before error rejection and e 1 is the phase-flip error rate for those survived untagged bits after error rejection. Note that this iteration formula is the averaged value of the phase-flip error rate for the survived untagged bits from both odd-parity groups and even-parity groups. However, we cannot blindly use this iteration formula for the phase-flip error rate for survived untagged bits from odd-parity groups alone, because the phase-flip error rates of survived untagged bits from odd-parity groups is in general different from that of even-parity groups. For example, consider the virtual protocol that Alice and Bob share many entangled pairs with each pair in the state |Ψ = 1 √ 2 (|00 + e iφ |11 ), where |0 and |1 are basis states of a qubit, and the first qubit belongs to Alice and the second qubit belongs to Bob. The random grouping of two untested bits in the real protocol is now related to the random grouping of two pair states in the virtual protocol. According to reference [87], the operators of OPER arê The subscript A means it acts on Alice's qubit and subscript B means it acts on Bob's qubit. And the operators of even-parity error rejection arê The kets |0 , |1 , |0 , |1 in equations (2) and (3) are mutually orthogonal states. After error rejection, the state of odd-parity is and the state of even-parity is This shows that the phase-flip error rate after parity check is dependent on the parity value of the group: 0 for odd-parity and 2sin 2 φ for even-parity [22]. In general, the iteration formula does not have to hold for our OPER method, which shall only use survived bits from odd-parity groups. Luckily, we have shown by de Finetti theorem that after error rejection, the phase-flip error rate of survived untagged bits from odd-parity groups can never be larger than those from even-parity groups, in the limit of infinite number of raw pairs initially [22]. However, in a real protocol, we never have infinite number of raw pairs. Since we have used de Finetti theorem, there is no straightforward calculation to take the finite-key effects efficiently.
If we choose to directly apply the existing theory [88] to calculate the key rate with finite key size, a failure probability of 10 −100 or even smaller for statistical fluctuation is needed for security under coherent attack. Given this request, the final key rate is actually smaller than that of the existing SNS protocol, and the final key rate can even be 0 unless the data size is unreasonably large. Here we shall give a more efficient way for the issue and present advantageous results with the method with normal, reasonable data size. To do so, we shall first use the zigzag approach to faithfully bound the phase-flip error rate for those survived untagged bits after OPER. Then we can efficiently take all finite-key effects in calculating the finial key. This paper is arranged as follows. In section 2 we present our zigzag approach to estimate the phase-flip iterative with explicit formulas. In section 3, we review the SNS protocol and show how to apply the formulas got in section 2 to the SNS protocol. In section 4, we show how to apply the OPER method to the asymmetric SNS protocol. In section 5, we present our numerical simulation results and compare key rates of different methods. The article ends with some concluding remarks. The details of some calculations are shown in the appendix.

Mathematical toolbox and main idea
For clarity, we first consider the virtual protocol where Alice and Bob share raw entangled pairs. There is no bit-flip error of all these pairs. After the phase-flip error test, they share 2n + k raw entangled pairs. They randomly choose 2n pairs for final key distillation and the left k pairs would be neglected. Denote the state of these 2n pairs by ρ 2n . According to the exponential de Finetti's representation theorem [89,90], mathematically, there exists an associate stateρ 2n of the state ρ 2n which satisfies the following conditions: (i) The trace distance between ρ 2n andρ 2n is bounded by (ii), the stateρ 2n is in the following form:  [91]. Actually, p m is just a pure mathematical quantity defined by {p m = tr(ρ 2nÊ m )} (6) where Ê m is the projection operator projecting any state of the 2n pairs to the subspace M where the number of phase-flip errors for any state takes value m deterministically. Mathematically, we also have the probability distribution {q m } for the number of phase errors m, of the stateρ 2n , which is {q m = tr(ρ 2nÊ m )}. According to the property of trace distance, we have which means the probability distributions of the number of phase errors of those two states are almost the same except with a small probability 2ε(r, k).
To do OPER, they randomly group those 2n pairs two by two. For each group of pairs, Alice (Bob) performs the measurement of {Ô A , Ô A } ({Ô B , Ô B }) to her (his) qubits. Since there is no bit-flip error in the raw pairs, only the operators Ô A Ô B and Ô A Ô B would be succeed. And only the results of the operator Ô A Ô B would be kept for further key distillation. This completes the OPER. The entangled pairs corresponding to Ô A Ô B after OPER are named as survived pairs. One can measure the number of phase-flip errors m s of those survived pairs. Physically, there also exists a POVM {Ê m s } which can be taken directly on the initial 2n pairs to present the value m s . Since m s is a possible value of a clearly defined observable (the number of phase errors of survived pairs), mathematically, there must exist a POVM to observe it. In the appendix E, we explicitly construct such a POVM. Therefore, we can also use the probability distributions of m s for states ρ 2n andρ 2n , respectively. We denote the probability distributions of m s by {p m s = tr(ρ 2nÊ m s )} and {q m s = tr(ρ 2nÊ m s )}. Similar to equation (7), we have Remark. {Pr D (x)} is actually just a probability distribution of the discrete variable x, but too many probability distributions are used in the following proof, thus we define such a symbol to clearly show everything more intuitively and vividly by choosing the labelling symbol D properly. In choosing labelling symbol D, we shall try to always use a symbol characterize the main properties for the probability distribution it labels. Of course every time when we use a different labelling D, we shall always note it clearly that the explicit probability distribution it labels.
Here is our main idea in bounding the value of e (b) Since the trace distance between ρ 2n and its associate stateρ 2n is small, with equations (7) and (9) where M s is an estimated value andε s is the corresponding failure probability. (d) Again, since the trace distance between ρ 2n and its associate stateρ 2n is small, with the bounded result in step (c), we can now restrict values of {p m s } by equations (8) and (11), which is where n 1 is the number of survived pairs after OPER.
Among all values and failure probabilities appeared in eqs (7)-(11), M and ε e could be got from the phase-flip error test in the very beginning [21,65,92], and ε(r, k) is set as we wanted. The only unknown values are M s andε s . Our task is now reduced to find the explicit values of M s and its corresponding failure probabilityε s .

The values ofM s and its corresponding failure probabilityε s
To clearly show our proof process, we first need to prove some Lemmas. The details of those Lemmas are shown in appendix A.
The state σ of a subsystem in ρ 2n σ is a two-dimensional state, which can be expressed as where |0 and |1 are basis states of a qubit, and the first qubit belongs to Alice and the second qubit belongs to Bob. θ, α, β are three arbitrary real numbers and satisfy We define e σ as the probability that an error occurs if Alice and Bob measure their qubits in the state σ in X basis, where X basis is 1 2 (|0 + |1 ), 1 2 (|0 − |1 ) . We define E σ as the probability that an error occurs if Alice and Bob measure their qubits in X basis after OPER performed on σ ⊗2 , that is to say, the probability that both Alice's and Bob's outcomes are odd-parities and there is an error while they measure their qubits in X basis.
The state ρ 2n σ is composed by two independent parts: one part is the i.i.d. state σ ⊗2n−r and the other part is an arbitrary stateρ r σ . If Alice and Bob measure the phase errors in ρ 2n σ , and the outcome of the number of phase errors is m, then m is also composed by two parts m = m 1 + m 2 , where m 1 is the number of phase errors in the state σ ⊗2n−r and m 2 is the number of phase errors in the stateρ r σ . We denote the probability distribution of the number of phase errors in the state ρ 2n σ as { Pr Proof. Pr where we apply lemma 1 for the second inequality and apply lemma 2 for the third inequality. Combine with equation (10), we have P 1 ξ τ ε e + 2ε(r, k). This ends the proof of theorem 1.
For the state ρ 2n σ , the OPER process can be regarded as independently happening in two individual states: one is the state σ ⊗2n−2r and the other is the state σ ⊗r ⊗ρ r σ . If Alice and Bob measure the phase errors in ρ 2n σ after OPER, and the outcome of the number of phase errors is m s , then m s is composed by two parts m s = m s1 + m s2 , where m s1 is the number of phase errors in the state σ ⊗2n−2r after OPER and m s2 is the number of phase errors in the state σ ⊗r ⊗ρ r σ after OPER. We denote the probability distribution of the number of phase errors in the state ρ 2n σ after OPER as { Pr Proof. Pr where we apply lemma 1 for the first inequality, apply the fact that all probabilities are less than or equal to 1 for the second inequality, and apply lemmas 2 and 3 for the third inequality. Combine with theorem 1, we have Pr This ends the proof of theorem 2.

The SNS protocol and its parameter estimation
We consider the 4-intensity SNS protocol [18,21]. In this protocol, Alice and Bob send N pulse pairs to Charlie and get a series of data. In each time window, Alice (Bob) randomly chooses the decoy window or signal window with probabilities 1 − p z and p z respectively. If the decoy window is chosen, Alice (Bob) randomly prepares the pulse of vacuum state or WCS state and θ B are different in different windows, and are random in [0, 2π). If the signal window is chosen, Alice (Bob) randomly chooses bit 1 or 0 (0 or 1) with probabilities and 1 − , respectively. If bit 1 (0) is chosen, Alice (Bob) prepares a phase-randomized WCS pulse with intensity μ z . If bit 0 (1) is chosen, Alice (Bob) prepares a vacuum pulse. This is said to be the sending or not-sending. For Alice (Bob), bit value 1 (0) is due to her (his) decision on sending out a phase randomized coherent state with intensity μ z for Charlie, while bit value 0 (1) is corresponding to her (his) decision of not-sending, i.e. sending out a vacuum.
Then Alice and Bob send their prepared pulses to Charlie. Charlie is assumed to perform interferometric measurements on the received pulses and announces the measurement results to Alice and Bob. If one and only one detector clicks in the measurement process, Charlie also tells Alice and Bob which detector clicks, and Alice and Bob take it as an one-detector heralded event. Alice and Bob repeat the above process for N times and collect all the data with one-detector heralded events and discard all the others.
The next process is the parameter estimation. To clearly show how this process is carried out, we have the following definitions.

Definition 2.
If both Alice and Bob choose the signal window, it is a Z window. If both Alice and Bob choose the decoy window, and the states Alice and Bob prepared are in the same intensity and their phases satisfy the post-selection criterion [25], it is an X window. The one-detector heralded events of X windows and Z windows are called effective events. And Alice and Bob respectively get n t −bit strings, Z A and Z B , formed by the corresponding bits of effective events of Z windows.

Definition 3.
For an effective event in the Z windows, if it is caused by the event that only one party of Alice and Bob decides sending out a phase-randomized WCS pulse and he (she) actually sends out a single-photon state from the view point of the decoy state method, it is an untagged event. Its corresponding bit is an untagged bit.
Parameter estimation [18,21,25]. The data of all the one-detector heralded events except the effective events of Z windows in this protocol are used to estimate the expected value of the lower bounds of the number of untagged 0-bits, n 01 , and untagged 1-bits, n 10 . The details of how to estimate the lower bound of n 01 and n 10 are shown in appendix B. We denote the expected value of the lower bounds of the number of untagged bits as n 1 = n 01 + n 10 .
Also the one-detector heralded events could be used to estimate the expected value of the upper bound of the phase-flip error rate, e ph 1 , of the untagged events. There are two methods to estimate e ph 1 . The first method is shown in equation (B8) of appendix B, where we apply the Chernoff bound for two times to estimate the upper bound of the first term and the lower bound of the second term of the numerator, and this is also the method we use in our prior articles [18,21]. The second method is shown in appendix C, where we apply the improved version of McDiarmid inequality [82]  and improves the key rate especially when the key size is small.

The data post-processing of SNS protocol
The data post-processing of SNS protocol contains two independent processes: the error correction and the privacy amplification. The goal of error correction is to correct all the different bits in Z A and Z B . And the privacy amplification is to distill a shorter but more secure final keys from the raw keys according to the formula of key rate.
If we directly correct the different bits in Z A and Z B , a large number of raw keys would be cost and the key rate is decreased. The OPER could be used to improve the key rate. And further, we can use the active OPER, which is also called active odd-parity paring (AOPP) in reference [22] to further improve the key rate. And the security of AOPP is equivalent to the security of OPER [22]. In AOPP, Bob first actively pairs the bits 0 with bits 1 of the raw key string Z B , and get 2n g pairs, and then randomly splits those pairs into two equal parts. For each part, Alice computes the parities of those n g pairs and announces them to Bob, then Alice and Bob keep the pairs with parity 1 and discard the pairs with parity 0. Finally, Alice and Bob randomly keep one bit from each survived pair and form two new n t -bits strings, which would be used to extract the secure final keys. As shown in reference [22], there is no mutual information between the split two parts and each of those two parts alone could be regarded as the result of a virtual OPER process performed on un t bits of Z A and Z B , where u = n g n odd , where n odd is the number of pairs with odd-parity if Bob randomly groups all the bits in Z B two by two, and both n g and n odd are observed values in practice. Thus we could first get the formula of the phase-flip error rate of the survived untagged bits after OPER, and then apply this formula to each part of AOPP.
In section 2, we have shown how to get the phase-flip error rate of the survived untagged bits after OPER, and here we would show how to get the values of n, k, r and so on in the instance of SNS protocol. The value of n is the number of untagged bit pairs after random pairing, where the untagged bit pairs are the pairs formed by two untagged bits. And we have where ϕ L (x) is defined in equation (B15). The value of k is the number of neglected untagged bits, thus we can take the untagged bits that are paired with tagged bits as the neglected bits, thus we have With equation (B8), we can get the value of e where ϕ U (x) is defined in equation (B14) and we also set the failure probability as 10 −13 , thus ε e = 3 × 10 −13 . All the failure probabilities of Chernoff bound used in other equations are set as 10 −10 . We set ε(r, k) = 10 −13 and we have We set ξ τ = 10 −2 ,ξ τ = 10 −10 , and then we can calculate the value of M s with equation (19). And we have ε s = 1.5 × 10 −10 . Finally, we get the upper bound of the phase-flip error rate of the survived untagged bits after OPER with a failure probability ε s = 1.5 × 10 −10 , which is where n 1 is the number of the survived untagged bits after OPER, and n 1 = ϕ L n 01 n t n 10 n t un t .
With all those values, we now can calculate the key rate R of AOPP with the formula in reference [21], which is where is the Shannon entropy, E is the bit-flip error rate of the remaining bits after AOPP, ε cor is the failure probability of error correction, ε PA is the failure probability of privacy amplification, andε is the coefficient while using the chain rules of smooth min-and max-entropy [93]. And we set ε cor = ε PA =ε = 10 −10 .  With the formula of equation (27), the protocol is 2ε tol -secure, and ε tol = ε cor + ε sec , where ε sec = 2ε + 4ε s + ε PA + ε n 1 + ε nk . Here, ε n 1 is the probability that the real value of the number of survived untagged bits is smaller than n 1 , ε nk is the failure probability when we estimate the value of n and k in equations (21) and (22). And we have ε n 1 = 6 × 10 −10 for we use the Chernoff bound for 6 times to estimate n 1 , and with the similar reason, we have ε nk = 2 × 10 −10 . Finally, we have ε tol = 1.8 × 10 −9 .

The asymmetric SNS protocol with OPER and finite-key effects
In the practical application of SNS protocol, the distance between Alice and Charlie can be different from that of Bob and Charlie. To solve this problem, the theory of asymmetric SNS protocol is proposed in reference [25]. The preparation and measurement steps of asymmetric SNS protocol are the same with those of the original SNS protocol, except the source parameters of Alice and Bob in the asymmetric SNS protocol are not the same. In this part, we use the subscript to indicate Bob's source parameters. For example, p z is the probability that Alice chooses the signal window and p z is the probability that Bob chooses the signal window; μ z is the intensity of phase-randomized WCS if Alice decides sending in her signal windows and μ z is the intensity of phase-randomized WCS if Bob decides sending in his signal windows.
Note that the original SNS protocol [12] and its improved one [22] are based on symmetric source parameters for Alice and Bob, i.e. they use the same values for the sending probabilities and light intensities. As was shown in reference [25], the SNS protocol is also secure with asymmetric source parameters given the following mathematical constraint: With this condition, light intensity chosen by Alice and that chosen by Bob can be different. After Alice and Bob repeat the preparation and measurement steps of asymmetric SNS protocol for N times, they can perform the same error correction and privacy amplification steps as shown in section 3.2. And the formula of key rate is the same as equation (27). The major differences between the original SNS protocol and asymmetric SNS protocol are the forms of the formulas of the lower bound of the number of untagged bits and the upper bound of the phase-flip error rate, which are shown in appendix B.

Numerical simulation
In this part, we show the results of numerical simulation of SNS protocol with AOPP, including the symmetric and asymmetric cases, and compare them with the results of the prior art results. In the following, we list the key rates calculated by 'This work (A)' and 'This work (B)'. In all our calculations, we use equation (27) to calculate the key rate. We use appendix D to simulate the bit-flip error rate after OPER. The most important step is to find the bound of the phase-flip error rate after OPER, i.e. e ph 1 in equation (27). We use equation (25) and its earlier equations in Sec. IIIB to calculate e ph 1 . To complete the calculation, we also need the input value of the phase-flip error rate of untagged bits before OPER, i.e. e ph 1 . This input value with its statistical fluctuation can be calculated by straightly applying the existing matured theories of Chenoff bound [21,65], as shown in appendix B. The calculation for the input value e ph 1 can be done more efficiently if we use the method proposed by Chau and Ng, the improved version of McDiarmid inequality [82], as shown in appendix C. In all our calculations, 'this work A' and 'this work B', we use the theoretical results of zigzag approach to calculate parameters after OPER in equation (27).
But in estimating the input value e ph 1 , we use different methods: 'this work A' uses Chenoff bound while 'this work B' uses the more efficient method proposed by Chau and Ng [82], the improved version of McDiarmid inequality. The two bounds of repeater-less key rate used here, 'PLOB-1' and 'PLOB-2' [75], are for the absolute PLOB bound with whatever devices and the practical bound assuming the limitted detection efficiency, respectively.
In all our calculations, we use the composable security for the finite-key effects. In estimating the statistical fluctuation of parameters, the Chenoff bound is used in 'this work A' and all prior art works [19,21,22,81], while the improved version of McDiarmid inequality [82] is used in 'this work B' to calculate the statistical fluctuation of the value of phase-flip error rate before OPER.
We use the linear model to simulate the observed values of experiment, such as S κζ which are defined in appendix B [21], with the experimental parameters listed in table 1. And the simulation methods of n g , n t , n odd and E are shown in appendix D. Without loss of generality, we assume the property of Charlie's two detectors are the same. The distance between Alice and Charlie is L A , and that between Bob and Charlie is L B . The total distance between Alice and Bob is L = L A + L B . In our numerical simulation, we set L A = L B for the symmetric case and L A − L B = constant for the asymmetric case. Figures 1 and 2 are our simulation results of this work and reference [21] with the experimental parameters listed in table 1. In figures 1 and 2, we set L A = L B and the source parameters of Alice and Bob are all the same. The dashed brown lines in figures 1 and 2 are the results of absolute PLOB bound [75], which bounds the key rate of repeater-less QKD with whatever devices, such as perfect detection device. The cyan dashed lines are the results of practical PLOB bound, which assumes a limited detection efficiency as listed in table 1. The results show that our method can obviously exceed the absolute PLOB bound. We set N = 1.0 × 10 11 in figure 2, which is a more practical total number of pulses in experiment, and results show that our method still obviously exceeds the absolute PLOB bound, while the original SNS   [25] with the experimental parameters listed in table 1. In figures 3 and 4, we set L A − L B = 100 km. From figures 3 and 4, we can clearly see that the our method in the case of finite key size can greatly improved the key rate of SNS protocol with asymmetric channels, especially when the channel loss is large. Table 2 is the comparison of the key rates of this work, references [19,21,22], and the PLOB bounds. The method of reference [22] used here is the standard error rejection using both odd-parity and even-parity events. The parameters used here are the same with those of figure 1. The key rates show that the method of this work improves the key rate by more than 1 times compared with our prior work [21], and exceeds the results of references [19,21] in all distances. Besides, with the method here, the SNS protocol can by far break the absolute key rate limit of the repeater-less QKD and even reach more than 40 times of the practical PLOB bound and 13 times of the absolute PLOB bound with 10 12 pulses. Table 3 is the key rates of this work and reference [81]. We use the parameters of reference [81] in calculations, which are p d = 3.36 × 10 −8 , e d = 7%, η d = 20%, α f = 0.185, ξ = 1.69 × 10 −10 , and The key rates of this work, references [19,21,22], and the PLOB bounds. Here the results of 'reference [22]' come from the one that applies the standard error rejection (using both odd-parity and even-parity events) to SNS protocol.  Table 3. Comparison of key rates between this work and reference [81]. We use the parameters of reference [81] in calculations, e.g. the dark count rate is p d = 3.36 × 10 −8 , the misalignment-error probability is e d = 7%, the detection efficiency is η d = 20%, the fiber loss is α f = 0.185, the failure probability is ξ = 1.69 × 10 −10 , and the total number pulses is N = 2.0 × 10 13 3 show that the key rates of this work are more than 30 times those of reference [81].
Using the zigzag approach of this work (A), we recalculate the experimental key rates of reference [80] at distances of 350 km, 408 km and 509 km, we obtain the updated key rates of 6.12 × 10 −7 , 3.07 × 10 −7 and 1.54 × 10 −8 , respectively. At these distances, the values of absolute PLOB bounds are 3.23 × 10 −7 , 2.02 × 10 −7 and 4.05 × 10 −9 , respectively. These show that, in fact, experimental results of reference [80] at all three distances have significantly exceeded the absolute limit of repeater-less key rate.

Conclusion
In this paper, we propose a zigzag approach to verify the phase-flip error of the survived bits after OPER. Based on this, we can take all the finite-key effects efficiently in calculating the non-asymptotic key rate. The numerical results show that active OPER can greatly improve the key rate of SNS protocol for both the asymmetric and symmetric channels, and unconditionally break the absolute key rate limit of repeater-less quantum key distribution. Also, the numerical results show that with our method, the SNS protocol can improve the key rate by more than 100% to 3000% in comparison with different prior art methods with typical experimental setting. Besides, with McDiarmid inequality [82], the key rate can be further improved by more than 20%. Although our method can beat the absolute limit of the repeater-less key rate, it cannot exceed the single-repeater key-rate limit [2,94,95]. It should be interesting to undertake further studies in the future for this new goal. Our results can directly be used to the SNS experiments.
with outcomes '0' or '1' and a 2 a 1 . Let x be a new discrete variable which satisfies x = x 1 + x 2 , and we denote the probability distribution of x by {Pr D (x)}. Then we have wherex is a specific value in [a 2 , a 1 ].
Proof. According to the definition of Pr And obviously, we have Combine equations (A2) and (A3) and the fact that a 2 x 2 =0 Pr Lemma 1 shows that if a 1 a 2 , the statistical property of x is almost determined by its i.i.d. part x 1 . This also is the original intention of exponential de Finetti's representation theorem [89,90]. Proof. Lemma 2 is a direct conclusion of binomial distribution. Proof. We have proof lemma 3 in reference [22]. For completeness, we write the proof again.
According to the definition of e σ , we have and With the operator defined in equation (2), we have Directly, with equations (A6) and (A9), we have This ends the proof of lemma 3.

Appendix B. The calculation method
The calculation methods of n 01 , n 10 , and e ph 1 are similar with those in references [18,21,22,25]. And the formulas of the asymmetric SNS protocol are more general. We can easily get the formulas of original SNS protocol from those of asymmetric SNS protocol by setting the same source parameters of Alice and Bob, that is, drop the subscript in the formulas.
Then we can get the lower bound of the expected value of the counting rate of untagged photons s 1 = μ 1 μ 1 + μ 1 s 10 + μ 1 μ 1 + μ 1 s 01 , ( B 4 ) and n 10 = Np z p z (1 − )μ z e −μ z s 10 , ( B 5 ) The error counting rate of the X windows where Alice and Bob decide to prepare the pulses with intensities μ 1 and μ 1 , T X1 , can be used to estimate e ph 1 . The criterion of error events in X windows are shown in reference [25]. We denote the number of total pulses with intensities μ 1 and μ 1 sent out in the X windows by N X1 , and the number of corresponding error events by m X1 , then we have The upper bound of the expected value of e where T X1 is the expected value of T X1 .
The equations (B2)-(B8) are represented by expected values, but the values we get in the experiment are observed values. To close the gap between the expected values and observed values, we need Chernoff bound [72,96]. Let X denote the sum of n independent random variables with outcomes 0 or 1. φ is the expected value of X . We have φ L (X ) = X 1 + δ 1 (X ) , where we can obtain the values of δ 1 (X ) and δ 2 (X ) by solving the following equations: where ξ is the failure probability. Thus we have Besides, we can use the Chernoff bound to help us estimate their real values from their expected values. Similar to equations (B9)-(B12), the observed value, ϕ, and its expected value, Y, satisfy where we can obtain the values of δ 1 (Y) and δ 2 (Y) by solving the following equations:

Appendix C. The improved version of McDiarmid inequality
In this part, we show how to apply the improved version of McDiarmid inequality [82] to the numerator of equation (B8). We can rewrite the formula of T X1 as T X1 = N X1 j=1 W j /N X1 where the value of W j is 1 (0) if the jth pulse of source xx causes (dose not cause) a wrong effective event. And similarly we can rewrite the formula of S oo as S oo = N oo j=1 W j /N oo where the value of W j is 1 (0) if the jth pulse of source oo causes (dose not cause) an effective event. Besides, we denote n T = m X1 + n oo and S T = n T /(N X1 + N oo ), then we have where the value of W j is randomly A 1 or A 2 , and A 1 = According to the corollary 1 in reference [82], the true value of n T j=1 W j is larger than its observed value by [n T ln(1/ξ)/2]