Secret key rate bounds for quantum key distribution with faulty active phase randomization

Decoy-state quantum key distribution (QKD) is undoubtedly the most eﬃcient solution to handle multi-photon signals emitted by laser sources, and provides the same secret key rate scaling as ideal single-photon sources. It requires, however, that the phase of each emitted pulse is uniformly random. This might be diﬃcult to guarantee in practice, due to inevitable device imperfections and/or the use of an external phase modulator for phase randomization in an active setup, which limits the possible selected phases to a ﬁnite set. Here, we investigate the security of decoy-state QKD when the phase is actively randomized by faulty devices, and show that this technique is quite robust to deviations from the ideal uniformly random scenario. For this, we combine a novel parameter estimation technique based on semi-deﬁnite programming, with the use of basis mismatched events, to tightly estimate the parameters that determine the achievable secret key rate. In doing so, we demonstrate that our analysis can signiﬁcantly outperform previous results that address more restricted scenarios.


I. INTRODUCTION
Quantum key distribution (QKD) is a method for securely establishing symmetric cryptographic keys between two distant parties (so-called Alice and Bob) [1][2][3].Its security is based on principles of quantum mechanics, such as the no-cloning theorem [4], which guarantee that any attempt by an eavesdropper (Eve) to learn information about the distributed key inevitably introduces detectable errors.Importantly, when combined with the one-time-pad encryption scheme [5], QKD provides information-theoretically secure communications.
The field of QKD has made much progress in recent years, both theoretically and experimentally, leading to the first deployments of metropolitan and intercity QKD networks [6][7][8][9].Despite these remarkable achievements, there are still certain challenges that need to be overcome for the widespread adoption of this technology.One of these challenges is to close the existing security gap between theory and practice.This is so because QKD security proofs, typically consider assumptions that the actual experimental implementations do not satisfy.Such discrepancies could create security loopholes or so-called side channels, which might be exploited by Eve to compromise the security of the generated key without being detected.
Indeed, practical QKD transmitters usually emit phase-randomized weak coherent pulses (PR-WCPs) generated by laser sources.These pulses might contain more than one photon prepared in the same quantum state.In this scenario, Eve is no longer limited by the no-cloning theorem, because multi-photon signals provide her with perfect copies of the signal photon.As a result, it can be shown that the secret key rate of the BB84 protocol [10] with PR-WCPs scales quadratically with the system's transmittance due to the photon-number-splitting (PNS) attack [11,12].This attack provides Eve with full information about the part of the key generated with the multi-photon pulses, without introducing any error.
To overcome this limitation, the most efficient solution today is undoubtedly the decoy-state method [13][14][15], in which Alice varies at random the intensity of the PR-WCPs that she sends to Bob.This allows them to better estimate the behavior of the quantum channel.Indeed, using the observed measurement statistics associated to different intensity settings, Alice and Bob can tightly estimate the yield and phase error rate of the single-photon pulses, from which the secret key is actually distilled.As a result, the decoy-state method delivers a secret key rate that scales linearly with the channel transmittance [13][14][15][16], matching the scaling achievable with ideal singlephoton sources.This technique has been extensively demonstrated in multiple recent experiments [17][18][19][20][21][22][23], including satellite links [24,25] and the use of photonic integrated circuits [26][27][28][29].Also, decoy-state QKD setups are currently offered commercially by several companies [30][31][32][33][34], which highlights its importance.
The discrete phase-randomization scenario has been analyzed in [45] (see also [46]).This work assumes evenly distributed discrete random phases in [0, 2π), i.e., it considers that g(θ) satisfies where δ(x) represents the Dirac delta function, and θ k = 2πk/N , with N being the total number of selected phases.Under this assumption, [45] shows that it is possible to approximate the secret key rate achievable in the ideal situation where g(θ) = 1/2π, with around N = 10 random phases.While this result is remarkable, in practice, inevitable imperfections of the phase modulator and electronic noise might prevent the phases θ from being exactly evenly distributed, thus invalidating the application of the results presented in [45] to a real setup.
In this paper, we consider the more realistic and practical scenario in which g(θ) could be an arbitrary, continuous or discrete, PDF, due to imperfections in the phase-randomization process, and we provide asymptotic secret key rates for this general situation.In our derivations, for simplicity, we consider collective attacks, but our results are also valid against coherent attacks due to the quantum de Finetti theorem [47].The key ingredients of our study are two: the use of basis mismatched events (i.e., events in which Alice and Bob select different bases), and a novel parameter estimation technique based on semi-definite programming (SDP), very recently introduced in [48].Importantly, we show that the combination of these two ingredients permits a tight estimation of the relevant parameters needed to evaluate the secret key rate in the scenario considered here.In doing so, we find that the decoy-state method is indeed very robust to imperfect phase randomization even with an arbitrary, continuous or discrete, g(θ).Remarkably, for the ideal discrete phase-randomization case described by Eq. ( 1), our analysis delivers significantly higher secret key rates than those provided by the seminal analysis presented in [45].Or, to put it in other words, it requires fewer random bits for phase selection to achieve a similar performance.
The paper is organized as follows.In Sec.II, we describe the quantum states emitted by Alice when θ follows an arbitrary PDF, g(θ).Then, in Sec.III we introduce the decoy-state protocol considered, together with its asymptotic secret key rate formula.Next, in Sec.IV, we present the parameter estimation technique based on SDP, as well as on the use of basis mismatched events, to calculate the different parameters required to evaluate the secret key rate.Then, in Sec.V we simulate the achievable secret key rate for various functions g(θ) of practical interest, both for the cases in which this func-tion is fully (or only partially) characterized.Sec.VI concludes the paper with a summary.The paper includes as well some Appendixes with additional calculations.

II. PHASE RANDOMIZATION WITH AN ARBITRARY g(θ)
In this section, we describe the quantum states emitted by Alice when each of them has a phase θ that follows an arbitrary PDF, g(θ).
In particular, a WCP of intensity µ and phase θ can be written in terms of the Fock basis as where |n represents a Fock state with n photons.If Alice selects the phase θ of each generated signal independently and at random according to g(θ), its state is simply given by with P (|φ ) = |φ φ|.Any quantum state can always be diagonalised in a certain orthonormal basis.For the states given by Eq. ( 3), we shall denote the elements of such basis by |ψ n,µ,g(θ) , since, in general, they might depend on both the intensity µ and the function g(θ).Here, the subscript n simply identifies the different elements of the basis, which are not necessarily the Fock states.This means, in particular, that we can rewrite the states given by Eq. (3) as follows where the coefficients p n|µ,g(θ) ≥ 0 satisfy That is, these coefficients can be interpreted as the probability with which, in a certain time instance, Alice emits the state |ψ n,µ,g(θ) , given that she chose the intensity µ and θ follows the PDF g(θ).

III. PROTOCOL DESCRIPTION AND KEY GENERATION RATE
For concreteness, we shall assume that Alice and Bob implement a decoy-state BB84 scheme with three different intensity settings {s, ν, ω} in each basis, with s > ν > ω ≥ 0.Moreover, we consider that they generate secret key only from those events in which both of them select the Z basis and Alice chooses the signal intensity setting s.This is the most typical configuration of the decoy-state BB84 protocol.We remark, however, that the analysis below could be straightforwardly adapted to other protocol configurations, or to other combinations of intensity settings.
In each round of the protocol, Alice probabilistically chooses a bit value b ∈ {0, 1} with probability p b = 1/2, a basis α ∈ {Z, X} with probability p α , an intensity value µ ∈ {s, ν, ω} with probability p µ , and a random phase θ according to the PDF given by g(θ).Then, she generates a WCP of intensity µ and phase θ, | √ µe iθ , and applies an operation that encodes her bit and basis choices b and α into the pulse.From Eve's perspective, these states are described by Eq. ( 4) due to her ignorance about the selected phase θ.On the receiving side, Bob measures each arriving signal using a basis α ∈ {Z, X}, which he selects with probability p α .We shall assume the basis independent detection efficiency condition throughout the paper.That is, the probability that Bob obtains a conclusive measurement outcome does not depend on his basis choice.
Once the quantum communication phase of the protocol ends, Alice and Bob broadcast (via an authenticated classical channel) both the intensity and basis settings selected for each detected signal.The results related to those detected signals in which both of them used the Z basis with intensity setting s constitute the sifted key.For the detected rounds in which Bob chose the X basis, Alice reveals her bit values b and Bob announces his corresponding measurement outcomes.This data is used for parameter estimation, i.e., to determine the relevant quantities needed to evaluate the secret key rate formula.Finally, Alice and Bob apply error correction and privacy amplification to the sifted key to obtain a final secret key, following the standard post-processing procedure in QKD [1][2][3].For a more detailed description of the protocol steps of a decoy-state BB84 scheme, we refer the reader to e.g.[16].
In the ideal scenario where g(θ) = 1/2π, Alice's state preparation process is equivalent to emitting Fock states |n with a Poisson distribution of mean equal to the intensity setting µ selected, as shown by Eq. ( 5).In this situation, both the single-photon and vacuum pulses with the intensity setting s contribute to secret bits [49].The multi-photon signals are insecure due to the PNS attack.Similarly, when θ follows an arbitrary PDF, g(θ), and Alice chooses the intensity setting µ, from Eq. ( 4) we have that her state preparation process is equivalent to generating pure states |ψ n,µ,g(θ) with probability p n|µ,g(θ) .
The closer the function g(θ) is to a uniform distribution, the closer the signals (probabilities) |ψ n,µ,g(θ) (p n|µ,g(θ) ) are to the Fock states |n (probabilities e −µ µ n /n!).In this scenario, Alice and Bob can in principle distill secret bits from any |ψ n,µ,g(θ) with µ = s, though the main contribution would mainly arise from those with indexes n = 0, 1, which are the ones closer to vacuum and singlephoton pulses.These are the contributions that we consider below.Indeed, for the examples studied in Sec.V, we have observed that the secret key rate improvement that one might obtain when considering n > 1 is essentially negligible.This means, in particular, that the asymptotic secret key rate formula for the decoy-state BB84 protocol considered can be written as [15,49,50] , where Y Z n,s,g(θ) denotes the yield associated to the state |ψ n,s,g(θ) encoded (and measured) in the Z basis, i.e., the probability that Bob observes a detection click in his measurement apparatus conditioned on Alice and Bob selecting the Z basis and Alice preparing the state |ψ n,s,g(θ) ; the parameter e n,s,g(θ) represents the phase error rate of these latter signals; is the binary Shannon entropy function; the quantity f is the efficiency of the error correction protocol; Q Z s,g(θ) is the overall gain of the signals emitted conditioned on Alice selecting the intensity s and Alice and Bob choosing the Z basis, i.e., the probability that Bob observes a detection click conditioned on Alice sending him such signals; and E Z s,g(θ) is the overall quantum bit error rate (QBER) associated to these latter signals.Moreover, in Eq. ( 6), the superscript L (U) refers to a (an) lower (upper) bound.
The quantities Q Z s,g(θ) and E Z s,g(θ) are directly observed in the experiment.In principle, the probabilities p n|s,g(θ) could also be known, and depend on the state preparation process.However, in practice it might be difficult to find their value analytically.Instead, in the next section we present a simple method to obtain a lower bound, p L n|s,g(θ) , on these quantities.There, we also explain how to estimate the parameters Y Z,L n,s,g(θ) and e U n,s,g(θ) , with n = 0, 1, which are needed to evaluate Eq. (6).

IV. PARAMETER ESTIMATION
The analysis follows the techniques very recently introduced in [48] in the context of phase correlations in gain-switched lasers.For simplicity, below we introduce the main results and refer the reader to Appendixes A and B for the detailed derivations.
A. Lower bound on the yields Y Z n,s,g(θ) In Appendix A it is shown that a lower bound on the yields Y Z n,s,g(θ) can be obtained by solving the following SDP: The states |ψ n,s,g(θ) and ρ µ [g(θ)] are known in principle but inaccessible and depend on the intensity setting selected by Alice and on the function g(θ).Also, as already mentioned, the gains Q Z µ,g(θ) are directly observed experimentally in a realization of the protocol.That is, the only unknown in Eq. ( 7) is the positive semi-definite operator J Z over which the minimization takes place.Let J * Z denote the solution to the SDP given by Eq. (7).Then, we find that B. Upper bound on the phase-error rates e n,s,g(θ) The phase-error rates, e n,s,g(θ) , are defined by means of a virtual protocol [51].For this, we shall consider the standard assumption in which the efficiency of Bob's measurement is independent of his basis choice.Then, for those rounds in which both Alice and Bob select the Z basis and Alice generates the n-th eigenstate |ψ n,s,g(θ) , we can equivalently describe her state preparation process as follows.First, she prepares the following bipartite entangled state where Vbα , with b = 0, 1 and α ∈ {Z, X}, denotes the encoding operation corresponding to the α basis and the bit value b.Although our analysis is valid for any { Vbα }, for simplicity, in our simulations, we assume that these operators, are ideal BB84 encoding operators, given by Next, she measures her ancilla system A in Eq. ( 9) in the orthonormal basis {|0 Z , |1 Z } to learn the bit value encoded, and sends the other system to Bob, who measures it in the Z basis.In this situation, the phase-error rate e n,s,g(θ) corresponds to the bit error rate that Alice and Bob would observe if Alice (Bob) instead performed an X basis measurement on the ancilla system A (arriving signal).If Alice performs a X basis measurement on her system A, this is equivalent to emitting the states with probability 2 , where denote the probability that Bob obtains the measurement outcome (∆ ⊕ 1) X when he performs an X basis measurement on the arriving signal conditioned on Alice emitting the state |λ virtual ∆,n,s,g(θ) .That is, this event corresponds to a phase error.Then, the phase error rate e n,s,g(θ) can be written as .
In Appendix A, it is shown that an upper bound on the quantity can be obtained by solving the following SDP: max where ρ µ [g(θ)] is given by Eq. ( 4), and ,bα denotes the probability that Bob observes the result (∆ ⊕ 1) X with his X basis measurement given that Alice chose the intensity setting µ, the basis α, the bit value b, and the phases θ follow the PDF g(θ).We note that Eq. ( 13) includes constraints provided by basis mismatched events [52] in which Alice prepares the signals in the Z basis and Bob measures them in the X basis, which may result in a tighter estimation.This is because, in general, |λ virtual ∆,n,s,g(θ) = V∆ X |ψ n,s,g(θ) , and P (|λ virtual ∆,n,s,g(θ) ) may be better approximated by an operator-form linear combination of both Z-encoded and X-encoded states, rather than just the latter.Importantly, the states | λvirtual ∆,n,s,g(θ) and ρ µ [g(θ)] , as well as the operators Vbα , are known and depend on Alice's state preparation process.The gains Q (∆⊕1) X µ,g(θ),bα are directly observed in a realization of the protocol.That is, the only unknown in Eq. ( 13) is the positive semi-definite operator L over which the maximization takes place.
Let L * (∆⊕1) X denote the solution to the SDP given by Eq. (13).Then, we have that C. Solving Eqs. ( 7)-( 13) numerically Solving numerically the SDPs presented above is difficult for two main reasons.
Firstly, they are infinitely dimensional, because the states ρ µ [g(θ)] are infinitedimensional.Secondly, this also renders the calculation of the eigendecomposition of ρ µ [g(θ)] given by Eq. ( 4) a difficult task.To overcome these two limitations, we follow a technique recently introduced in [48,53] (see also [54]), which consists in projecting the states ρ µ [g(θ)] onto a finite-dimensional subspace that contains up to M photons.We shall denote the projected states as where Π M = M n=0 |n n| denotes the projector onto the M -photon subspace, being |n a Fock state.In doing so, now the eigendecomposition of ρ µ [g(θ)],M can be easily obtained numerically.For later convenience, we will denote the eigendecomposition of the numerator of the RHS of Eq. ( 16) as Importantly, this technique also allows to transform the infinite-dimensional SDPs given by Eqs. ( 7)-( 13) onto finite-dimensional SDPs that can be solved numerically.The resulting SDPs and their derivation are provided in Appendix B.
D. Lower bound on the probabilities p n|s,g(θ) As explained in the previous subsection, because the states ρ µ [g(θ)] are infinite-dimensional, it might be difficult to calculate their eigendecomposition, and thus the probabilities p n|s,g(θ) .Instead, here we provide a lower bound on these probabilities based on the eigendecomposition given by Eq. (17).In particular, in Appendix B it is shown that p n|s,g(θ) ≥ q n|s,g(θ) − s := p L n|s,g(θ) (18) with In this section, we now evaluate the secret key rate obtainable for various examples of functions g(θ).For illustration purposes, we consider three main scenarios, depending on whether or not the function g(θ) is fully characterized.Also, for the simulations, we consider a simple channel model whose transmission efficiency is given by 10 − γ 10 , where γ (measured in dB) represents the overall system loss, i.e., it also includes the effect of the finite detection efficiency of Bob's detectors.Moreover, for simplicity, we disregard any misalignment effect, and assume that the only source of errors are the dark counts of Bob's detectors, whose rate is set to p d = 10 −8 .In addition, as already mentioned, we consider that the BB84 encoding operators are ideal even though the analysis presented here is applicable if this condition is not met, and we take an error correction efficiency f = 1.16.
To obtain the bounds Y Z,L n,s,g(θ) and e U n,s,g(θ) we use the finite-dimensional versions of the SDPs above, which are presented in Appendix B. Note that, the resulting secret key rate is an increasing function of M .However, the time required to numerically solve such SDPs grows rapidly with this parameter.For this reason, we have set a sufficiently large M so that an increase in this parameter would result in a negligible improvement of the secret key rate as tested numerically.
A. Fully-characterized g(θ) Here, we consider the scenario in which the function g(θ) is completely characterized, and we evaluate two specific examples of practical interest.The first example corresponds to the scenario given by Eq. ( 1), which has been considered in [45], while the second example can be interpreted as a noisy version of the first one.

Ideal discrete phase randomization
The results are shown in Fig. 1 for different values of the total number of random phases N selected by Alice.In particular, the solid lines in the figure have been obtained using the parameter estimation procedure presented in Sec.IV based on SDP and the use of basis mismatched events.If we discard these latter events, the obtainable key rate decreases, as illustrated by the dashed-dot lines.Finally, the dotted lines correspond to the analysis in [45].For completeness, this latter approach is summarized in Appendix D. In the first two cases, for simplicity, we set the intensity settings to the possibly sub-optimal values ω = 0, ν = s/5 and we optimize s as a function of the overall system loss γ, while in the later case we set ω = 0 and optimize both ν and s as a function of γ (which provides the optimal solution for this approach).Importantly, despite this fact, Fig. 1 shows that the use of SDP and basis mismatched events significantly improve the secret key rate when compared to the results in [45].Furthermore, we find that the improvement of using basis mismatched events is more advantageous when N is small.Indeed, when N ≥ 5, this enhancement in performance is almost negligible.This is expected as basis mismatched events do not improve the estimation in the case of ideal continuous phase randomization, i.e., in the limit N → ∞.On the other hand, when N is small, the eigenstates |ψ n,s,g(θ) for n = 0, 1 deviate more from a perfect Fock state, meaning that the virtual states |λ virtual ∆,n,s,g(θ) deviate more from the Xencoded states V∆ X |ψ n,s,g(θ) and thus basis mismatched events provide a tighter estimation.

FIG. 1.
Secret key rate in logarithmic scale versus the overall system loss for the ideal discrete phase-randomization scenario given by Eq. ( 1), as a function of the total number of random phases N selected by Alice.The solid lines correspond to the parameter estimation procedure based on SDP and basis mismatched events considered in this work, while the dashed-dotted lines represent the same procedure overlooking basis mismatched events.Finally, the dotted lines correspond to the analysis in [45] using linear programming.
Remarkably, as shown in Fig. 2, when N = 8 the secret key rate provided by our approach is already quite close to the ideal scenario where θ is uniformly random in [0, 2π).Note that this configuration requires only three random bits per pulse to select the random phase, which does not significantly increase the consumption of the random numbers.

FIG. 2.
Secret key rate in logarithmic scale versus the overall system loss for the ideal discrete phase-randomization scenario given by Eq. ( 1), as a function of the total number of random phases N selected by Alice, when Alice and Bob employ the parameter estimation procedure based on SDP and basis mismatched events considered in this work.Remarkably, as shown in the figure, only eight random phases are enough to deliver a secret key rate already quite close to the ideal scenario of perfect PR-WCPs, where the phase of each pulse is uniformly random in [0, 2π).

Noisy discrete phase randomization
Here we consider the situation in which the actual phase encoded by Alice in each emitted pulse follows a certain PDF around the selected discrete value θ k = 2πk/N .This might happen due to device imperfections of the phase modulator or the electronics that control it.For concreteness and illustration purposes, we shall assume that this PDF is a truncated Gaussian distribution, though we remark that our analysis can be applied to any given distribution.A truncated Gaussian distribution has the form ) when the phase θ is in the interval λ k < θ < Λ k , and zero otherwise.The functions φ x; γ, σ 2 and Φ x; γ, σ 2 in Eq. ( 19) are, respectively, given by That is, in this scenario the function g(θ) has the following form for certain parameters θ k , σ k , λ k and Λ k .
In the limit when the standard deviations σ k → 0 ∀k, Eq. ( 21) converges to the PDF given by Eq. ( 1), because in that regime each truncated Gaussian distribution approaches the Dirac delta function.On the other hand, when σ k → ∞, and given that the concatenation of the truncation intervals defined by λ k and Λ k allow the phase to take any value within the range of [0, 2π) but do not overlap each other, Eq. ( 21) converges to the PDF of a uniform distribution in [0, 2π).Importantly, this means that the achievable secret key rate will increase with higher values of σ k , or, to put it in other words, when the uncertainty about the phase actually imprinted by Alice on each of her prepared signals increases, given that g(θ) is completely characterized.
The simulation results are shown in Fig. 3, which presents a comparison between the achievable secret key rate for two different values of the standard deviations σ k , which, for simplicity, are assumed to be equal for all k.As expected, the larger the value of σ k is, the higher the resulting secret key rate, regardless of the number N of random phases selected by Alice, though the improvement is more relevant when N is small.For simplicity and due to the lack of experimental data, Fig. 3 assumes that λ k = θ k − 3σ k and Λ k = θ k + 3σ k .Moreover, like in the previous example, we set ω = 0, ν = s/5 and we optimize s as a function of the overall system loss.

FIG. 3.
Secret key rate in logarithmic scale versus the overall system loss when g(θ) follows the PDF given by Eq. ( 21), as a function of the total number of random phases N selected by Alice, and for two different values of the standard deviations σ k , which are assumed to be equal for all k.
B. Partially-characterized g(θ) Here, we now consider the scenario in which only partial information about the function g(θ) is known.In particular, and for illustration purposes, we shall assume that the actual phase encoded by Alice in each emitted pulse could be any phase within a certain interval around the selected discrete value θ k = 2πk/N , but its precise PDF g(θ) is unknown.Precisely, let δ max denote the maximum possible deviation between the actual selected phase θ k and the actual imprinted phase, which we shall denote by θk .That is, we assume that the actual imprinted phase lies in the interval θk ∈ [θ k − δ max , θ k + δ max ], and we conservatively take the combination of values θk for all k that minimizes the secret key rate following the analysis presented in Appendix C.
The results are illustrated in Fig. 4, as a function of the total number of phases N selected by Alice and the value of the maximum deviation δ max .Like in the previous examples, for simplicity, we fix ω = 0, ν = s/5 and we optimize s as a function of the overall system loss.As expected, the larger the value of δ max is, the lower the resulting secret key rate.

FIG. 4.
Secret key rate in logarithmic scale versus the overall system loss when the phases lie in the intervals θ k ± δmax and the function g(θ) is unknown, as a function of the total number of random phases N selected by Alice and the value of δmax.Also, from Fig. 4 we see that for higher values of δ max , the secret key rate becomes less sensitive to the parameter N .Indeed, when δ max = 10 −1 , the achievable secret key rate for the cases N = 3, 4, 5 essentially overlap each other, which is the left-most curve.This seems to be due to the fact that a significant increase in δ max allows in principle for some phases to lie close to each other, or even become identical if this parameter is large enough.Under this situation, the increase of N does not help to improve the performance, as the effective randomness remains almost the same.

VI. CONCLUSION
In this paper we have considered the security of decoystate quantum key distribution (QKD) when the phase of each generated signal is not uniformly random, as requested by the theory, but follows an arbitrary, continuous or discrete, probability density function (PDF).This might happen due to the presence of device imperfections in the phase-randomization process, and/or due to the use of an external phase modulator to imprint the random phases on the generated pulses, which limits the possible selected phases to a finite set.
Our analysis combines a novel parameter estimation technique, based on semi-definite programming, with the use of basis mismatched events, to tightly estimate the relevant parameters that are needed to evaluate the achievable secret key rate.In doing so, we have shown that decoy-state QKD is rather robust to faulty phaserandomization, particularly when the PDF that governs the random phases is well-characterized.Moreover, our results significantly outperform those of previous works while being also more general, in the sense that they can handle more realistic and practical scenarios.
This work might be relevant as well to other quantum communication protocols beyond QKD that use laser sources and decoy states.
we obtain the SDP presented in Eq. (7).
Appendix B: Finite-dimensional SDPs when g(θ) is fully characterized 1. Lower bound on the yields Y Z n,s,g(θ) In this Appendix, we show how to obtain a finitedimensional relaxation of the SDP given by Eq. ( 7) to find a lower bound on the yields Y Z n,s,g(θ) .For this, we follow again the approach presented in [48,53].The key idea is rather simple: instead of considering the infinitedimensional state ρ µ [g(θ)] given by Eq. ( 4), we employ a projection ρ µ [g(θ)],M of this state onto a finite-dimensional subspace with up to M photons (see Eq. ( 16)), and then we relax the original constraints of the SDP accordingly.
From Eq. (B2), we have that with the operator J Z defined in Eq. (7).Here, since the states ρ µ [g(θ)],M are finite dimensional, the calculation of Tr ρ µ [g(θ)],M J Z can be restricted to operators J Z that act on their finite subspace.Putting it all together, we find that a lower bound on Y Z n,s,g(θ) can be obtained by solving the following finite-dimensional SDP program (B11) That is, we have that with J * * Z being the solution to the SDP in Eq. (B11), and J * Z the solution to Eq. ( 7).This holds because the constrains in Eq. (B11) are looser than those in Eq. (7).
Finally, by combining Eq. (B9) with Eq. (B12) we have that The lower bound Ỹ Z,L n,s,g(θ) is the one we use in our simulations in Sec.V A.

Upper bound on the phase-error rates e n,s,g(θ)
In this Appendix, we show how to estimate an upper bound on e n,s,g(θ) by using a finite-dimensional SDP.To do so, let us also define the operator where L * (∆⊕1) X denotes the solution to the SDP given by Eq. ( 13), so that Now, let us define the finite-dimensional state and the unnormalized states | λvirtual,M ∆,n,s,g(θ) as Then, we have that B18) where we have used Eq.(B7) and the fact that V † 0Z V0Z = V † 1Z V1Z = I.Now, by applying the Cauchy-Schwarz constraint given by Eq. (B2), and taking into account the fact that G + (y, z) is a decreasing function with respect to its second argument, we find that Importantly, since G + (y, z) is an increasing function with respect to its first argument, one can upper bound the previous equation by finding an upper bound on its first argument.Moreover, since the states |Ψ Z,M n,s,g(θ) are finite dimensional, one can restrict the optimization search to operators L that act on the corresponding finite subspace.In particular, we have that (B20) where L * * (∆⊕1) X is the solution to the finite-dimensional SDP presented below.
Likewise, the constraints in Eq. ( 13) can be relaxed by using essentially the same techniques discussed in Appendix B 1. In doing so, we find that an upper bound on Tr P (| λvirtual,M ∆,n,s,g(θ) )L (∆⊕1) X can be found by solving the following SDP max where F proj µ,g(θ) is given by Eq. (B5).Let L * * (∆⊕1) X , denote the operator that maximizes the SDP given by Eq. (B21), then := ẽU n,s,g(θ) .This is the upper bound that we use in our simulations in Sec.V A.
Appendix C: Finite-dimensional SDPs when g(θ) is partially characterized Here, we consider the scenario studied in Sec.V B, i.e., when the actual imprinted phases lies in certain intervals θk ∈ [θ k − δ max , θ k + δ max ], with θ k = 2πk/N , and the exact form of g(θ) is unknown.
A direct solution to this case could be found as follows.First, one defines a dense grid with p discrete values within each interval, and then one follows essentially the approach in Sec.V A 1 for each possible combination of these discrete phases from the different intervals.The secret key rate would then correspond to the worst case scenario, i.e., the one that minimizes it among all possible combinations.The main drawback of this approach is, however, that the number of SDPs that needs to be solved grows very rapidly, as ∝ p N .
Instead, here we introduce a much simpler approach based on a modified version of the SDPs presented in Eqs.(B11)-(B21).In particular, let f (θ) denote the PDF associated to the ideal discrete phase randomization scenario given by Eq. ( 1), and let ρ µ [f (θ)],M be the finitedimensional state obtained by projecting ρ µ [f (θ)] onto the subspace that contains up to M photons.Also, let ρ µ [g(θ)] denote the state actually emitted by Alice in the scenario described above, i.e., when g(θ) is partially characterized.Then, we can bound the fidelity between ρ µ [g(θ)] and ρ µ [f (θ)],M by means of the Bures distance, which is defined as [58] for any state ρ and σ.This distance satisfies the triangle inequality [58], which means that We now compute the fidelities that correspond to the Bures distances d B (ρ µ [f (θ)] , ρ µ [f (θ)],M ) and ) so that, via Eq.(C1), we can obtain the necessary fidelity bound with Eq. (C2).
In particular, from Eq. (B5), we have that (C3) We find, therefore, that where in the first inequality we have used the fact that the states on the RHS are a purification of those on the LHS; in the first equality we have taken into account that the phases φ k in Eq. (C3) can be chosen so that they cancel the phase of the inner product, and in the second inequality we have used the fact that |δ k | ≤ δ max ∀k.
Since the function g(θ) is unknown, we do not have access to the exact form of the eigenvectors |ϕ n,s,[g(θ)] of ρ s