Experimental continuous-variable quantum key distribution using a thermal source

Gaussian-modulated coherent-state (GMCS) continuous-variable quantum key distribution (CVQKD) protocol can allow authenticated users to share secret key with unconditional security. So far, all previous experimental implementations of GMCS CVQKD schemes are based on active modulations, i.e. amplitude and phase modulators and quantum random number generator (QRNG) are required. However, high-speed modulation with high extinction ratio and stability is challenging, which is extremely remarkable in chip-scale silicon photonic realization. While the passive-state-preparation (PSP) CVQKD scheme, which explores the intrinsic field fluctuations of a thermal source, avoids the uses of active modulations and QRNG. In this paper, we experimentally realize the intact PSP CVQKD through a realistic optical fiber channel using off-the-shelf amplified spontaneous emission source. In particular, specially designed frame synchronization method is used to build the correlation between the data measured from the two legitimate parties, and excess noise are synthetically controlled to generate secure secret keys at the metro-area distances when considering the practical and non-negligible finite-size effects under collective Gaussian attacks. Due to the avoidance of modulators and QRNG, the passive state encoding scheme provides a promising direction of applicable high-speed, chip-based and even sunlight-based CVQKD with less cost and complexity.

. The schematic diagram of PSP CVQKD scheme. BS, beam splitter; Att 1 (2) , optical attenuator; Hom, homodyne detector; η a(b) D the efficiencies of Alice's (Bob's) homodyne detectors; η A(s) the transmittance of Att 1 (2) . prepared actively using amplitude and phase modulations, i.e. Alice first generates Gaussian-distributed random numbers x A and p A , and then performs amplitude and phase modulations on the source state with these random numbers in order to prepare the coherent states |x A + ip A . However, high-speed modulation with high extinction ratio and stability in realistic condition is challenging, which is even serious in chip-scale silicon photonic implementation. Moreover, the high-speed on-chip modulators in the active CVQKD scheme induce significant cost, manufacturing time, implementation complexity and contribute natural loss in most integrated photonic circuits [25].
In order to overcome these shortcomings, one efficient way is adopting the passive-state-preparation (PSP) CVQKD scheme [26], where the amplitude and phase modulators and quantum random number generator (QRNG) used for encoding are removed and replaced by a thermal source, beam splitters, optical attenuators, and homodyne detectors. It is shown in reference [26] that the PSP CVQKD scheme explores the intrinsic quadrature fluctuations of a thermal state, which is equivalent to the GMCS CVQKD when the transmitter in Alice's station is trusted. So the well-established security proofs for GMCS CVQKD can be directly applied to the PSP scheme. Recently, a noise model for the PSP CVQKD scheme is developed, and it is further verified experimentally by using an off-the-shelf amplified spontaneous emission source (ASE) [25], which suggests the feasibility of secure key generation over metro-area distances. However, the full demonstration of secure key distribution over the realistic fiber channel has not been realized yet, even without considering the practical and non-negligible finite-size effects. The main obstacles lie in robust frame synchronization without special-frame-based methods, and the suppression of excess noise arising from the polarization and phase drifts when passive-preparation quantum states are transmitting over realistic fiber channel. Meanwhile, the limited interference stability for thermal states also restricts the length of the raw key data block, which will lead to intense finite-size effects [11] and thus quite increase the excess noise.
In this paper, we experimentally realize the intact PSP CVQKD for the first time over a 5.005 km standard single-mode-fibre spool with a loss of 0.2 dB km −1 with an off-the-shelf ASE source. In particular, frame phase compensation and specially designed frame synchronization method are used to suppress the excess noise and thus build the correlation between the two legitimate parties. Finally, with the consideration of finite-size effects under collective Gaussian attacks, the secure secret keys are generated with 9.3 Mbps at Alice and Bob's sides by applying a high-efficiency reconciliation method based on slice-type polar codes. Since the required amplitude and phase modulators and QRNG are replaced with simple and cheap devices, the passive state encoding scheme provides a promising direction of applicable high-speed and chip-based CVQKD with less complexity and cost. It is anticipated that even the natural and perfect thermal light, i.e. the sunlight, may be directly explored to realize the quantum cryptography communication.

Experimental results and discussion
2.1. Protocol and setup PSP CVQKD protocol [26] can be simply implemented using the intrinsic field fluctuations of a thermal source, which can be schematically depicted in figure 1. Firstly, Alice splits the output of a thermal source into two spatial modes. One is attenuated with Att 1 and then sent to Bob, while the other will be locally measured by Alice using heterodyne detection (here Att 2 denotes the local loss in Alice's signal channel). Secondly, Bob performs heterodyne detection on the incoming quantum states transmitted from Alice, and obtains the values of quadratures X and P. Thirdly, after frame synchronization and excess noise suppressing operations, Alice and Bob further perform parameter estimation through the authenticated classical channel to upper bound the secret key information that the potential eavesdropper could gain. Finally, Alice and Bob perform reconciliation and privacy amplification to extract a string of secure secret key.
Actually, we can see except the first step where the Alice's key information is obtained by heterodyne detection, the other steps are same with the conventional GMCS CVQKD protocol. In the PSP CVQKD scheme, Alice can scale down her measurement results by a factor thus to optimize the estimation of the quadrature values of the outgoing mode. Since the quadrature values in Alice's side is obtained by an imperfect heterodyne detection in PSP scheme rather than the fixed value directly generated by QRNG, Alice's minimum uncertainty on the quadrature of the outgoing mode will be larger than one [25]. This leads to extra excess noise in quantum state preparation step (see appendix A for more details), which is always classified as the untrusted noise as where V A = n 0 η A is the modulation variance with n 0 the average photon number of the prepared thermal source. Therefore, Alice can adjust the source intensity and transmittance η A of Att 1 to set a desired quadrature variance value V A of the outgoing mode. So from the viewpoint of an eavesdropper, she cannot distinguish the quantum state sent in PSP CVQKD from the one in active GMCS CVQKD (preparation-andmeasurement scheme or entanglement-based scheme), and the theoretical securities of these CVQKD schemes are equivalent, i.e. the unconditional security of the PSP CVQKD can be guaranteed. Here the coherent detections provide the mode-selective capability to distill the intrinsic randomness of a thermal source. It is shown in references [27][28][29] that the excess noise introduced by the mismatched modes of thermal light can be negligible due to the suppressing effect of strong LO.
The secret key rate can therefore be calculated as [11] where f is the repetition rate, I AB is the classical mutual information between Alice and Bob, χ BE is the Holevo bound on the information leaked to Eve in the finite-size regime, β is the reconciliation efficiency, FER is the frame error rate of the reconciliation, Δ(n) is an offset term due to privacy amplification in the finite-size regime, α is the overhead for phase drift reference and frame synchronization, n and N denotes the block length for final key distillation and the whole sampling length, respectively. The experimental setup is shown in figure 2. In order to generate a high-intensity broadband thermal source, a fiber amplifier work in continuous-wave (CW) mode with a commercial ASE source (Golight) input is employed. A nominal 0.4 nm optical band-pass filter centred at 1549.72 nm with polarization-maintaining (PM) fiber is applied to reduce the power of unused light and select out a single polarization mode after the fiber amplifier. The property of the filtered thermal source is tested, and the single-time second-order correlation function can reach 2.0179, which is very close to the value of 2 for a perfect thermal source (see appendix B for more experimental details). This indicates that the natural perfect thermal source, i.e. the sunlight, may be capable for this implementation. Here an amplitude modulator (PhotoLine) is chosen to cut the filtered thermal light into pulse train to adjust the interference. A narrow-linewidth CW laser centred at 1549.72 nm (NKT Koheras BASIK X15) with 100 Hz line width and PM output fiber, an optical isolator and a variable optical attenuator construct the adjustable LO source. The filtered thermal light is then split by a balanced beam splitter into two modes: one is sent to Bob after passing through a 5.005 km single-mode fiber (SMF) spool with a measured loss of 0.2 dB km −1 at 1549.72 nm, while the other is measured locally in Alice's side.
The modulation variance is set by the VOA at the entrance of the channel. Specifically, the linear relationship between modulation variance and VOA is calibrated in advance through the back-to-back test. Then the modulation variance is set accurately through VOA in the experiment. In theory, the optimal modulation variance can be a larger value for short-distance transmission. However, the modulation variance is directly related to the transmittance of the optical attenuator η A and the average photon number of the thermal source n 0 with equation V A = η A n 0 . When n 0 is fixed for a specific thermal source, decreasing η A will lead to smaller extra excess noise ε s in Alice's quantum state preparation step. But meanwhile it will also lead to smaller modulation variance and thus decrease the secret key rate. So here according to the intensity of the used thermal source, we set V A = 4 for optimal consideration.
After adjusted by the polarization controllers, the filtered thermal signals are measured by Alice and Bob with heterodyne detections, respectively. Here the heterodyne detection is implemented by a 90 • optical hybrid (Optoplex) and two balanced homodyne detectors (Thorlabs), and Bob's LO is directly split from Alice's LO source for simplicity. While for practical applications, it is preferable to generate Bob's LO locally [30][31][32], especially for long-distance transmissions. The outputs of the four balanced homodyne detectors are sampled by a real time oscilloscope. To simply achieve cursory frame synchronization of the simultaneously sampled data with one oscilloscope, a same 5.005 km SMF spool with ±100 m of length deviation is added here in Alice's thermal light transmission channel. It should be mentioned that this extra spool is not necessary when Alice and Bob use independent data sampling modules and calibrate the transmission delay.

Synchronization and excess noise suppression
In our experiment, to optimize the interference of the filtered thermal light and LO, an AM is used to cut the filtered thermal light into pulses so as to adjust and verify the interference (while there exist coherent peaks in pulses). Specifically, in the preparation stage, the filtered thermal light is transformed into a 5 MHz clock square pulse train by an AM in pulse modulation. Then in the key generation stage, Alice and Bob execute the PSP CVQKD protocol, where both the broadband thermal source in Alice's and Bob's side and the LO are operated in CW mode (disable the AM), and a 13 GHz bandwidth real-time oscilloscope is employed to sample the outputs of Alice's and Bob's balanced homodyne detectors at 5 GS s −1 rate. Here four homodyne detectors are selected with the same quantum efficiencies η a(b) D = 0.6 and electronic noises ν el = 0.25 in shot noise units (SNU). The quantum efficiencies and electronic noises are calibrated before the key distribution experiment. Quantum efficiencies η a(b) D = 0.6 are contributed by the PC with a 0.4 dB insert loss, the 90 • optical hybrid with 0.8 dB, and the balanced homodyne detector with 1 dB. Electronic noises are calibrated through the sampled data with the disconnected LO. Moreover, the SNU is calibrated in real time by randomly switching off the signal path to prevent the possible side-attacks on transmitting LO [33,34]. It should be mentioned here that by using the interference operation in CW mode, we can extract as much raw key data as possible during the finite stable period to perform parameter estimation and key generation, thus relieving the finite-size effects. However, limited by the finite bandwidth of the homodyne detectors, the raw key data should be down-sampled with the rate not higher than the bandwidth of homodyne detectors, which to some extent restricts the block length. Fortunately, the development of high-bandwidth homodyne detectors [35] can resolve this problem.
Precise frame synchronization is necessary for Alice and Bob to generate final key. However, the conventional frame synchronization schemes for CVQKD require active modulation devices to construct special frames, which is technically impossible for PSP CVQKD schemes. So precise frame synchronization for PSP scheme is a very challenging problem. Here a novel robust synchronization algorithm is specially designed and is applied without using specially modulated frames, but just with some of the shared measurement results of heterodyne detections, i.e. the random values of quadratures X and P, even when intense phase drifts exist or at a low signal-to-noise (SNR) ratio [36]. Especially, a new feature based on labelling is designed to tolerate phase shifts and synchronize in a strong noise environment. See appendix C for more details about the frame synchronization scheme. After the frame synchronization process, the sampled raw data in Alice and Bob's sides are then directly correlated. Figure 3 shows the relationship of raw data of Alice's and Bob's x-quadrature measurement results with and without channel losses of two 5.005 km SMF spools. It can be seen from the raw data that the correlation between Alice's and Bob's data is barely visible for the low loss channel.
By changing the output power of ASE, pump power of the fiber amplifier, and the attenuation of VOA, we can adjust the average photon number of the filtered thermal light n 0 , and then control the excess noise due to the passive state preparation to ε s = 0.0349 SNU based on the evaluation of equation (A5). In order  to further control the excess noise due to mode mismatching through the lossy and noisy channel, frame phase compensation is performed to improve the data correlation. In particular, approximate 40% random points are announced to estimate the phase drift for phase compensation. See appendix D for more details about the frame phase compensation. In theory, the residual phase excess noise can be completely eliminated by the frame phase compensation for relatively slow phase drift. However, in practical situations, phase compensation in one frame may be not so precise due to other reasons, such as the resident depolarization drift and source-intensity fluctuation and so on. So this frame phase compensation does not exclude all of the phase noise, but the actual residual phase noise can be low enough to meet the requirement of key extraction in the experiment.
The experimental excess noises measured with 40 raw data blocks of length 1 × 10 5 for a distance of 5.005 km are shown in figure 4. After confirming the average excess noise due to passive state preparation, we perform maximum-likelihood estimations just for the channel parameters when considering the finite-size effects. The corresponding confidence intervals are calculated to bound their values with 6.5 standard deviations. For each data point, a worst-case estimator of the excess noise compatible with the experimental data is also indicated. Moreover, the average experimental excess noise and the worst-case excess noise estimator at the channel input are obtained as 0.0664 and 0.1056 in SNU, respectively.

Secret-key distillation
Here highly efficient post-processing is needed to distill secure secret key, especially for high excess noise. Fortunately, for the low-loss quantum channel, we can control the SNR ratio to be larger than 1 by using relatively high modulation variance. So here we can use slice reconciliation algorithm, which is very suitable for efficient reconciliation under high SNR [37]. The polar codes with a relatively short length of 10 5 at each level are sufficient to achieve reconciliation efficiencies above 90% over a wide range of SNR. It can be  found from figure 4 that the finite-size effects quite affect the estimated excess noise and thus the performance. Moreover, the fluctuations of the excess noises for different data blocks illustrate the limited stability of the setup, such as the remained relative phase fluctuation due to the uncertainty of passive state preparation, the variations of the intensity of thermal source and the polarization drifts through fiber channel.
It should be mentioned that we just adopt frame phase compensation and passive manual polarization control to suppress the excess noise here, since we mainly focus on the demonstration of the intact implementation of PSP CVQKD. Actually, several data blocks reveal very low excess noises, which illustrates the huge potential improvements of secret key rate and secure transmission distance. Here we use the worst-case scenario to evaluate Eve's Holevo bound and the secret key rate. The overview of key experimental parameters is shown in table 1.
The simulated secret key rate based on equation (2) and the experimental secret key generation results are shown in figure 5 (see appendix E for more details about the security analysis and secret-key-rate calculation). Limited by the 350 MHz bandwidth of the homodyne detectors, we perform down-sampling of the raw data with 350 MHz rate, and the equivalent repetition rate for the CW-mode communication in our experiment is then also 350 MHz. The secret key rate is 9.3 Mbps over 5.005 km SMF, and the secure transmission distance is 10.2 km. To further increase the secret key rate, one straightforward method is to improve the data sampling rate and use homodyne detectors with a larger bandwidth. For instance, the secret key rate can be roughly evaluated more than 230 Mbps when using 9 GHz homodyne detectors [35] for 10 GHz sampling rate. Nevertheless, a detector with higher bandwidth tends to have higher electrical noise which may slightly reduce the secret key rate in practice. In addition, removing the attenuation of Alice's local 5.005 km SMF spool will decrease the excess noise due to the passive state preparation. Moreover, larger data block will reduce the finite-size effects and enable higher reconciliation efficiency, thus further improve the secret key rate.

Conclusion
We have demonstrated the first intact PSP CVQKD experiment through a realistic optical fiber channel by applying specially designed frame synchronization algorithm to build direct correlation between the two sets of Alice's and Bob's measurement results and controlling the excess noise. In particular, we use a high-intensity thermal source, employ a narrow-band optical filter, and perform frame phase compensation and passive polarization control to synthetically suppress the excess noise induced in the whole communication including the passive state preparation stage. The secret key rate is 9.3 Mbps with the worst-case estimator over 5.005 km standard optical fiber when finite-size effects are taken into account.
Since the raw key data for Alice and Bob are all obtained from the heterodyne detections of the thermal states. The instability of the setup can be all basically attributed to the interference instability in Alice's and Bob's stations. It is anticipated that improvement of stability with active polarization and phase compensations, and optimization of thermal source and modulation variance, will enhance the correlations between Alice and Bob, thus further decreasing the measured excess noise. In particular, since the equivalent repetition rate here is limited to 350 MHz, the stable duration for generating a raw data block of length 5 × 10 5 is just approximately millisecond level. So improving the interference stability of the PSP CVQKD setup or bandwidth of homodyne detection will all lead to linear increase of the length of raw data blocks for key generation, and thus decrease the excess noise due to finite-size effects. Actually, the existence of low excess noises in the data blocks reveals the realistic probability of further suppression of excess noise, which enables the PSP CVQKD with higher secret key rate and longer secure transmission distance.
It should be mentioned that one may concern the randomness from the thermal source, since it is common to apply a QRNG in the active CVQKD. The illustrations in references [25,38] show that true randomness can be trusted as long as the eavesdropper Eve cannot access (or control) the thermal source. This can be fully guaranteed because it is a common and reasonable assumption in security proof of CVQKD. Our experiment verifies the practical ability of secure key generation for PSP CVQKD over metro-area distances, which provides an appealing way to implement high-speed, chip-based and even sunlight-based CVQKD with less cost and complexity.

Data availability statement
The data generated and/or analysed during the current study are not publicly available for legal/ethical reasons but are available from the corresponding author on reasonable request.

Author contribution
PH and TW contributed equally to this work.

Appendix A. Excess noise analysis in passive-state-preparation scheme
The noise model of the experimental PSP CVQKD scheme is based on the one proposed in references [25,26], which could be constructed as follows.
For simplicity, only the quadrature X is considered below. The quadrature P can be considered in the same model. From the depicted model shown in figure 6, we can get the mode sent by Alice after passing through the attenuator will be where x s is the X-quadrature of the output mode of the thermal source, η A is the transmittance of the optical attenuator, x v1 and x v3 are the vacuum noise introduced by BS 1 and the attenuator. For the vacuum noise, x 2 v1 = x 2 v3 = 1. We assume the average photon number of the thermal source is n 0 , then the average photon number sent to Bob is η A n 0 /2. Thus the modulation variance V A which is equivalent to the one in GMCS CVQKD scheme can be calculated as similarly, the X-quadrature measured by Alice can be expressed as where η s is the transmittance of the equivalent optical attenuator Att 2 before homodyne detections in Alice's other signal path, η a D is the efficiency of Alice's homodyne detector, x v2 denotes the vacuum noise introduced by BS 2 , x v4 denotes the vacuum noise introduced by the equivalent optical attenuator Att 2 , x vd represents the vacuum noise introduced by Alice's detector, and x De represents the electrical noise of Alice's detector. Also x 2 v4 = x 2 vd = 1. According to the agreement, Alice multiplies the measurement results by the correction factor α A to estimate the quadratures sent to Bob. Here α A = x A x 1 / x 2 A , which can be deduced as where ν el = x 2 De represents the variance of electrical noise of Alice's homodyne detector. Therefore, the excess noise ε s due to passive state preparation can be calculated as It can be found that we can increase η s , decrease η A and optimize the modulation variance to reduce the excess noise due to passive state preparation. In practice, the measured modes by Alice and Bob may not be perfectly overlapped, which are determined by the modes of Alice's and Bob's LOs after the transmission of the thermal state. So the mode mismatch will induce untrusted excess noise. Moreover, the noisy and lossy quantum channel will also introduce additional excess noise.
Here we can use the known parameter estimation procedure to evaluate the total excess noise for each communication cases based on the shared raw key data. And also the excess noise due to passive state preparation can be calculated with equation (A5). Once the excess noise in the source is obtained, we can set it as a fixed value of untrusted excess noise. Then we can attribute the other excess noise as the untrusted one like the channel excess noise, whereby the worst-case estimator of the excess noise can be evaluated, which is further applied to calculate the secret key rate.

Appendix B. Thermal source characterization
In our experiment, the centre wavelength of LO laser is carefully turned close to the centre wavelength of optical band-pass filter by adjusting the bias current. It should be noted that the wavelength of LO laser can never drift out 0.4 nm range under normal operation, which is centred at 1549.72 nm, and the line width of the used LO laser is 100 Hz.  Before distributing quantum secret key, we firstly test the characteristics of the filtered thermal source. In particular, we here use the sampled data of Alice's measurement outcomes to perform the analysis. Figure 7 shows the distributions of the measurement results with thermal input and vacuum input, where the efficiencies and electronic noise of Alice's two homodyne detectors are both 0.6 and 0.25, respectively. By normalizing the quadrature variances of the thermal state to the Alice's vacuum noise, the average photon number (per mode) of the filtered thermal state can be evaluated as 597, where the attenuation efficiency is η A = 0.0067. Since we apply CW-mode signal and high-bandwidth sampling in our experiment, the average photon number per mode here can be seen as averaging based on the response time of used homodyne detectors with limited bandwidth.
The two-dimensional histogram of Alice's measured data is shown in figure 8 when inputting the thermal source. The small deviation from a perfect two-dimensional Gaussian distribution is most likely due to the nonuniform bin size of the analog-to-digital converter of the oscilloscope. The single-time second-order correlation function g (2) for Z = X 2 + P 2 is calculated to be 2.0179, which indicates that the thermal source is very close to the value of 2 for a perfect thermal source.
The synchronization algorithm should work well at low SNR situations and tolerate phase shifts. After the heterodyne detection (the conjugate homodyne detection), the sender Alice and receiver Bob share some values of the quadratures X and P. Here we use a specially designed frame synchronization algorithm [36], where parts of the output of detection are directly regarded as synchronization frames. Then a transformation is performed on these quadratures and every value of the output strings is assigned a label.
This labelling process will output a random number sequence X which can be expressed as (x 1 , x 2 , . . .) into a binary sequence Y(y 1 , y 2 , . . .) by the rules: step 1, sum the next L numbers of the current position, such as x i+3 , x i+4 for current position x i+2 and L = 2. Then subtract the sum of the former L numbers, the output is used as a descriptor. And we call the 2L + 1 interval an transformation unit.
Step 2, we first set a threshold V th , which is usually the modulation variance. If i+L j=i+1 x j − i−1 j=i−L x j > V th , we mark this position with symbol '1' (y i = 1). If i+L j=i+1 x j − i−1 j=i−L x j V th , we mark this position with symbol '0' (y i = 0). After marking all the received signals, the synchronization process begins. Every successive N bits of conversion sequence Y are seen as a feature, and we can calculate the hamming distance of the two signal sequences to measure their similarity. It should be mentioned that noise with zero expectation will be suppressed and their impact on synchronization is weaken. We can see this transformation method is simple and efficient.
In order to compete with phase drifts, the sender Alice can prepare four transformation sequences of her synchronization frames, which contain binary sequences TX A and TP A and their complements. Firstly, Alice generates the binary sequences TX A and TP A by using the rules listed in steps 1 and 2 with the sequences of quadratures x A and p A , respectively. Then their complements TX A and TP A , can be directly obtained by using a not operator. For example, if TX A is '0101', then TX A is '1010', the rules are same for TP A and TP A . Bob also transforms the sequences with the received quadratures x B (or p B ) with the same rules. After the sequence transformations, the similarity can be measured by calculating the hamming distance between the transformed sequences of Alice's synchronization symbols and every segments of Bob's received signal. We should make the cost function reach its peak value when synchronization succeed, the cost can be rewritten D(TX A , TX B ) = n − H(TX A , TX B ), where D(X 1 , X 2 ) means similarity of sequences X 1 and X 2 , and H(X 1 , X 2 ) means hamming distance of X 1 and X 2 . Here we define a new function, The location of synchronization is just where the function F(A, B) reaches its peak value.
The following synchronization scheme can then be performed based on this feature; step 1, Alice (the sender) selects parts of the random strings as the synchronization frame; step 2, Alice transforms the selected sequences into 0-1 sequences by the incremental label algorithm proposed above. Both x and p components must be transformed. Then we get two 0-1 sequences TX A and TP A ; step 3, Alice publishes the two 0-1 sequences TX A and TP A through classical channel; step 4, Bob transforms x B (or p B ) into 0-1 sequences by the incremental label algorithm, and matches them to the received two 0-1 sequences TX A and TP A bits by bits. Then he calculates the function F(A, B); step 5, Alice and Bob synchronize at the position where the function F(A, B) reaches its peak value.

Appendix D. Frame phase compensation
The purpose of phase compensation is to align the phase reference coordinate of Alice and Bob. In the practical fiber link, due to the fluctuation of the transmission path length, the optical wavefront that reaches the detector of Alice and Bob changes with time, which in turn causes the phase reference coordinate at both ends inconsistent, hindering the extraction of secret key. Considering that the optical path changes relatively slowly during transmission, the relative phase drift in a frame with a relatively high-repetition rate can be assumed constant. Therefore, a random part of the data is disclosed in one frame and estimate the relative phase drift value through cross-correlation calculation with Alice, and then use this value to compensate Alice's data. The specific operation includes the following steps: step 1, disclose a part of Alice's data (x Ai , p Ai ) and the corresponding Bob's data (x Bi , p Bi ). Set the phase drift estimator θ 0 and calculate the cross-correlation value of the Alice and Bob components based on the above data, namely, K = n i=1 x ARi × x Bi , where x ARi = re[(x Ai + jp Bi ) × exp(jθ 0 )] is the preset phase rotation of Alice's data; step 2, traverse θ 0 from 0 to 2π to get the relationship between K and θ 0 ; step 3, find the maximum value of K and the corresponding θ 0 , which is the optimal phase drift estimator. Use this value to compensate for Alice's undisclosed data, namely x AC + jp AC = (x A + jp A ) × exp(jθ 0 ). The compensated data (x AC , p AC ) are then used for final key distillation.