— ”name”: ”Daniel S. Katz” — —”name” — —”keywords” —

# Implementing Transitive Credit with JSON-LD

Daniel S. Katz
National Science Foundation;
Computation Institute, University of Chicago &
Argonne National Laboratory
<EMAIL_ADDRESS>Arfon M. Smith
GitHub Inc.
<EMAIL_ADDRESS>
###### Abstract

Science and engineering research increasingly relies on activities that
facilitate research but are not currently rewarded or recognized, such as:
data sharing; developing common data resources, software and methodologies;
and annotating data and publications. To promote and advance these activities,
we must develop mechanisms for assigning credit, facilitate the appropriate
attribution of research outcomes, devise incentives for activities that
facilitate research, and allocate funds to maximize return on investment. In
this article, we focus on addressing the issue of assigning credit for both
direct and indirect contributions, specifically by using JSON-LD to implement
a prototype transitive credit system.

##  1 Introduction

Science and engineering research increasingly relies on activities that
facilitate research but are not currently rewarded or recognized. This
includes the sharing of data; development of common data resources, software
and methodologies; and annotation of data and publications. This situation has
been documented in a number of recent reports [11, 6] that focus on changing
needs and mechanisms for attribution and citation of digital products, from
the use of alternative metrics [13] that track reports of research impact
apart from research publications, to work on data [10]. About half of the
articles in many recent issues of Science describe research that depended on
software, and a larger fraction analyze data. Indeed, the US National Science
Foundation recently updated its guide to proposers to instruct them to provide
a list of their “products”—objects that are “citable and accessible including
but not limited to publications, data sets, software, patents, and
copyrights”—rather than publications [12].

To promote and advance pursuit of activities that facilitate research, we must
develop mechanisms for assigning credit, facilitate the appropriate
attribution of research outcomes, devise incentives for activities that
facilitate research, and allocate funds to maximize return on investment. In
this article, we explore how the idea of transitive credit [7, 8], which would
credit both direct and indirect contributions, can be implemented.

##  2 Transitive Credit

Transitive credit involves three main elements. The first is complete credit.
Any product should list all authors (as currently listed as authors of a
paper), all contributors (as currently listed in the acknowledgements of a
paper) and all component products that have been used, including both
publications and other products such as software and data (as currently either
cited, acknowledged, or not included in a paper). We coin the term
“contriponents” for the combination of these contributors and components
(though we eagerly welcome suggestions for a better term).

Second, all the contriponents need to have weights assigned. Determining how
to weight credit of the authors may be difficult, but it should be possible.
Methods for doing this weighting, whether using a taxonomy or a more
traditional list of authors, and analysis of these methods and their impact
would likely happen if this overall idea moves forward. Just as publications
today are submitted by one person who is responsible for making sure all
authors are listed (and perhaps assigned roles in a taxonomy) and the
publication is complete, the submitter would also be responsible for
registering this fractional credit, no matter how the values are determined.

The third element of transitive credit is its transitive nature, as is shown,
for example, by how the credit map for a product A, which is used by a product
B, feeds into the credit map for product B. Suppose product A is a software
package equally written by two authors and its credit map is that 50% of the
credit for this should go the lead developer, 20% to the second developer, and
10% to the third developer. In addition, 5% should go to each of the four
libraries that are needed to run the code. When this product is created and
registered, this credit map is registered along with it. Product B is a paper
that obtains new science results, and it depended on Product A. The person who
registers the publication also registers its credit map, in this case 75% to
her/himself, and 25% to the software code previously mentioned. Credit is now
transitive, in that the lead software developer of the code can be given
credit for 12.5% of the paper. If another paper is later written that extends
the product B paper and gives 10% credit to that paper, the lead software
package developer will also have 1.25% credit for the new paper.

The value of transitive credit is in measuring the indirect contributions to a
product, which today are not quantitatively captured. Because they aren’t
captured, they aren’t rewarded, and there is a disincentive to perform them,
due to the cost (in time or something else). If they were captured, this
disincentive would be replaced by an incentive, which for software and data
would mean to publish and share them in a reusable form.

Transitive credit could be implemented by adding either creditmaps to the
metadata stored with DOIs [5], or alternatively by building a separate system
to store creditmaps and then adding pointers to entries in this system to the
metadata stored in DOIs. Here, we focus on the creditmap itself, and how it
can be described in a structured, machine (and human) readable form.

##  3 JSON-LD

JSON-LD (JavaScript Object Notation for Linked Data, http://json-ld.org) is a
subset of the key-value based JSON document format that provides a way of
describing machine-readable information with semantic context. Popular as an
alternative to XML in the web development community, JSON is also used as a
base data format for search engines such as Elastic Search [3] and NoSQL data
stores such as MongoDB [9].

In the final stages of standardization at W3C [15], JSON-LD is designed to
lower the barrier for data publishers who wish to provide ‘Linked Data’ so
that concepts and entities can be identified with certainty. As an example of
machine readable data with semantics take this JSON snippet describing a
person: . Without additional context there is ambiguity as to what the term
describes (such as the name of a person, place or thing). A better alternative
is:

    {
      "@context": "http://schema.org",
      "@type": "Person",
      "name": "Daniel S. Katz",
      "@id": "http://orcid.org/0000-0001-5934-7525"
     }

##  4 Using JSON-LD for Transitive Credit

Smith recently proposed using JSON-LD for research tools [14]. In this paper,
we extend this idea to suggest that it could be used for transitive credit of
any scholarly product. Because of namespaced nature of the JSON-LD structure,
it is trivial to include all contriponents such as datasets, software, and
articles with their appropriate semantic context definition while maintainting
a both human and machine-readable structure. Note that we use vocabularies
from http://schema.org for the different entities; other examples include DOAP
(https://github.com/edumbill/doap) and SPDX (http://spdx.org).

A subset (due to space limits) of a possible creditmap for this article
follows, as an illustrative example of the power of this concept.

    {
      "@context": "http://schema.org",
      "@type": "ScholarlyArticle",
      "headline": "Implementing Transitive Credit with JSON-LD",
      "dateCreated": "2014-07-10",
      "keywords": "transitive credit, credit for code, json-ld, linked data",
      "author": [
        {
        "@type": "Person",
        "name": "Daniel S. Katz",
        "@id": "http://orcid.org/0000-0001-5934-7525",
        "email"<EMAIL_ADDRESS>        "creditWeight": "0.25"
        },
        {
        "@type": "Person",
        "name": "Arfon Smith",
        "@id": "http://orcid.org/0000-0002-7217-4494",
        "email"<EMAIL_ADDRESS>        "creditWeight": "0.25"
        }
      ],
      "citation": {
        "articles": [
          {
            "@type": "ScholarlyArticle",
            "headline": "Transitive credit as a means to address social and technological
                concerns stemming from citation and attribution of digital products",
            "doi": "10.5334/jors.be",
            "creditWeight": "0.3"
          }
        ],
        "software": [
          {
            "@type": "Code",
            "name": "Fidgit",
            "codeRepository": "https://github.com/arfon/fidgit",
            "license": "http://opensource.org/licenses/MIT",
            "creditWeight": "0.04"
          }
        ],
        "acknowledgment": [
          {
            "@type": "Person",
            "name": "James Howison",
            "@id": "http://orcid.org/0000-0002-5702-149X",
            "email"<EMAIL_ADDRESS>            "creditWeight": "0.01"
          }
        ],
        "other": [
          {
            "@type": "BlogPosting",
            "headline": "JSON-LD for software discovery, reuse and credit",
            "url": "http://www.arfon.org/json-ld-for-software-discovery-reuse-and-credit",
            "license": "http://creativecommons.org/licenses/by/4.0/",
            "creditWeight": "0.15"
          }
        ]
      }
    }

##  5 Conclusions

In this paper we have outlined a mechanism for ascribing complete credit for
all contriponents that have led to a scholarly product.

This is one of the needed elements to a transitive credit system. This credit
information could be stored as part of the metadata within the DOI system,
perhaps by updating the kernel metadata and adding a creditmap entry to the
DOI data dictionary [5], though note that this is a standardization activity
which requires community effort, similar to that being undertaken today by
CASRAI (http://casrai.org) and others. Then, creditmap information would need
to be added by registration authorities (RAs) that hold these scholarly
products (i.e., publishers of all sorts, including journals, data archivers).
And it needs to be supported by indexing systems (e.g., Thomson Reuters).
Similar complementary changes have also been discussed recently aimed at
characterizing contributions rather than assigning weights [2, 1, 4].

The manner in which we use unique IDs is somewhat rough; we use ORCIDs for
people and DOIs for papers, but for other elements, such as software that may
not have a DOI, the solution is not clear. Additionally, the manner in which
weights are assigned is also rough; it might be easier to assign weights
within categories, then assign weights to categories, and let the system
determine the detailed weights.

While this paper addresses the technical aspects of how to make transitive
credit possible, many social questions remain unresolved. For example,
disciplinary communities will need to decide what the contriponents are that
are relevant to their discipline, how to weigh various categories of
contriponents (e.g., are developers more, equally, or less important than
libraries?), and how the authors of products should assign weights to specific
product contriponents (e.g., reference 1 is more/less important to a
manuscript than reference 2.)

One potential extension to this creditmap we have proposed would be to replace
the entry to include a description of the subject area from a defined
taxonomy. When appropriate, such as in the case of software, this could also
include a description of the function of the tool. Using indexing tools such
as Elastic Search [3], it would then be possible to build indexes of these
fields and then make powerful faceted searches such as ‘find astrophysics
software, written in Python designed to manipulate spectroscopic data’.

Finally, we note that our proposal in this paper is very compatible with the
current altmetrics activities [13], and would add to the alternative metrics
that could be collected and analyzed.

## Acknowledgments

The authors thank James Howison, Gabrielle Allen, and David Proctor for some
discussions about this work.

Some work by Katz was supported by the National Science Foundation (NSF) while
working at the Foundation; any opinion, finding, and conclusions or
recommendations expressed in this material are those of the author and do not
necessarily reflect the views of the NSF.

## References

  * [1] Liz Allen, Jo Scott, Amy Brandt, Marjorie Hlava, and Micah Altman.  Publishing: Credit where credit is due.  Nature, 508:312–313, 2014.  DOI: 10.1038/508312a.
  * [2] Elisabeth Davenport and Blaise Cronin.  Who dunnit? metatags and hyperauthorship.  Journal of the American Society for Information Science and Technology, 52(9):770–773, 2001.  DOI: 10.1002/asi.1123.
  * [3] The Elastic Search project.  http://www.elasticsearch.org.  Accessed: 2014-07-07.
  * [4] Carolin Häussler and Henry Sauermann.  The anatomy of teams: Division of labor and allocation of credit in collaborative knowledge production, May 7 2014.  DOI: 10.2139/ssrn.2434327.
  * [5] International DOI Foundation.  The DOI Handbook, chapter DOI Data Model.  2012\.  http://www.doi.org/doi˙handbook/4˙Data˙Model.html Accessed: 2014-07-14.
  * [6] Daniel Katz, Sou-Cheng Choi, Hilmar Lapp, Ketan Maheshwari, Frank Löffler, Matthew Turk, Marcus Hanwell, Nancy Wilkins-Diehr, James Hetherington, James Howison, Shel Swenson, Gabrielle Allen, Anne Elster, Bruce Berriman, and Colin Venters.  Summary of the first workshop on sustainable software for science: Practice and experiences (WSSSPE1).  Journal of Open Research Software, 2(1), 2014.  DOI: 10.5334/jors.be.
  * [7] Daniel S. Katz.  Citation and attribution of digital products: Social and technological concerns.  Technical Report 791606, figshare, 2013.  DOI: 10.6084/m9.figshare.791606.
  * [8] Daniel S. Katz.  Transitive credit as a means to address social and technological concerns stemming from citation and attribution of digital products.  Journal of Open Research Software, 2014.  DOI: 10.5334/jors.be.
  * [9] The MongoDB database project.  http://www.mongodb.org.  Accessed: 2014-07-07.
  * [10] National Research Council.  For Attribution–Developing Data Attribution and Citation Practices and Standards.  National Academies Press, 2012.
  * [11] National Science Foundation.  A vision and strategy for software for science, engineering, and education: Cyberinfrastructure framework for the 21st century, 2012.  NSF 12-113, http://www.nsf.gov/publications/pub˙summ.jsp?ods˙key=nsf12113.
  * [12] National Science Foundation.  Grant and proposal guide, 2014.  NSF 14-1.
  * [13] J. Priem, D. Taraborelli, P. Groth, and C. Neylon.  Altmetrics manifesto, 2011.  http://altmetrics.org/manifesto.
  * [14] Arfon Smith.  JSON-LD for software discovery, reuse, and credit, 2014.  http://www.arfon.org/json-ld-for-software-discovery-reuse-and-credit Accessed: 2014-07-10.
  * [15] W3C JSON-LD definition.  http://www.w3.org/TR/json-ld/.  Accessed: 2014-07-07.


# Improving the performance of twin-field quantum key distribution with
advantage distillation technology

Hong-Wei Li<EMAIL_ADDRESS>Henan Key Laboratory of Quantum Information and
Cryptography, SSF IEU, Zhengzhou 450000, China  Rui-Qiang Wang  CAS Key
Laboratory of Quantum Information, University of Science and Technology of
China, Hefei, Anhui 230026, China  Chun-Mei Zhang  Institute of Quantum
Information and Technology, Nanjing University of Posts and
Telecommunications, Nanjing 210003, China  Qing-Yu Cai<EMAIL_ADDRESS>School of Information and Communication Engineering, Hainan University, Haikou
570228, China

###### Abstract

In this work, we apply the advantage distillation method to improve the
performance of a practical twin-field quantum key distribution system under
collective attack. Compared with the previous analysis result given by Maeda,
Sasaki and Koashi [Nature Communication 10, 3140 (2019)], the maximal
transmission distance obtained by our analysis method will be increased from
420 km to 470 km. By increasing the loss-independent misalignment error to
$12\%$, the previous analysis method can not overcome the rate-distance bound.
However, our analysis method can still overcome the rate-distance bound when
the misalignment error is $16\%$. More surprisingly, we prove that twin-field
quantum key distribution can generate positive secure key even if the
misalignment error is close to $50\%$, thus our analysis method can
significantly improve the performance of a practical twin-field quantum key
distribution system.

##  1 Introduction

Quantum key distribution (QKD) [1] is the art of sharing information-
theoretical secure key between two different remote parties Alice and Bob.
Under the perfect quantum devices preparation, the eavesdropper Eve can not
get the secure key information even if she has unlimited computation and
storage power [2, 3, 4]. Unfortunately, a practical QKD system is usually
composed of imperfect devices, and the practical QKD system may be attacked
[5, 6, 7, 8] by utilizing imperfect quantum state preparation and measurement
devices. To avoid the detector side channel attack [6, 7], measurement-device-
independent QKD (MDI-QKD) was proposed [9, 10]. In MDI-QKD, the ideal quantum
states are randomly prepared by Alice and Bob, and then will be transmitted to
untrusted Charlie to apply Bell state measurement [11]. To beat the Pirandola-
Laurenza-Ottaviani-Banchi (PLOB) bound [12], twin-field QKD (TF-QKD) [13] was
proposed which is a variant of the MDI-QKD protocol. TF-QKD can overcome the
rate scaling from $\eta$ to $\sqrt{\eta}$ with a relatively simple setup,
where $\eta$ is the single-photon transmissivity of the link from Alice to
Bob. In the TF-QKD protocol, Charlie simply conducts an interference
measurement to learn the relative phase between Alice and Bob, and the secure
key can be generated with in-phase and anti-phase measurement outcomes
respectively. More recently, many intensive studies have been devoted to
achieving information theoretic proofs of variants of TF-QKD protocols [14,
15, 16, 17, 18, 19, 20, 21], and several practical TF-QKD systems have been
widely implemented in labs and field tests [22, 23, 24, 25, 26, 27, 28]. By
applying the entanglement purification with two-way classical communication,
the transmission distance of TF-QKD protocol can be improved [29].

To analyze the security of MDI-QKD protocols [9, 10], Alice and Bob should
randomly prepare phase-randomized pulses in Z basis and X basis respectively,
where Z basis consists of $|0\rangle$ and $|1\rangle$, and X basis consists of
$|+\rangle=\frac{|0\rangle+|1\rangle}{\sqrt{2}}$ and
$|-\rangle=\frac{|0\rangle-|1\rangle}{\sqrt{2}}$. Note that the bit error rate
in Z basis and X basis can also be applied to characterize the bit error rate
and phase error rate about the quantum channel. Based on this quantum channel
characterization, the upper bound of the secure key information leaked to Eve
can be estimated. However, to estimate the bit error rate in X basis, TF-QKD
needs to generate a non-classical optical state [19, 29], which is difficult
to realize in current technology. Fortunately, Maeda, Sasaki and Koashi
proposed the operator dominance method [19] to estimate the bit error rate in
X basis by preparing phase-randomized weak coherent states. Combining the
error rate in Z basis with the error rate in X basis, the practical quantum
channel in TF-QKD can be characterized, and the secure key rate can be
analyzed with the entanglement distillation and purification method [2, 3,
19]. The purpose of TF-QKD is to extend the transmission distance with current
technology, but the final solution is to use quantum repeater in the future
research [30, 31, 32].

In this work, we apply the error rate in X basis and Z basis to characterize
the practical quantum channel. By applying the information-theoretical
security analysis method, we apply the advantage distillation (AD) method to
improve the secure key rate and transmission distance. The AD method was
initially proposed in classical cryptography theory [33], then it has been
widely used in different QKD protocols [34, 35, 36, 37] to improve the error
tolerance. More recently, we analyze the security of practical BB84-QKD [1],
six-state-QKD [38] and MDI-QKD [9, 10] systems by combining the AD method [4]
with the decoy-state method [39, 40, 41], and the analysis results demonstrate
that the AD method can significantly improve the performance of different
practical QKD systems [42]. Inspired by our previous work, we combine the AD
method and the operator dominance method [19] to analyze the security of TF-
QKD, and the analysis results demonstrate that both the transmission distance
and the secure key rate can be sharply improved. More surprisingly, the
analysis results also demonstrate that TF-QKD can generate positive secure key
even if the loss-independent misalignment error is close to $50\%$, thus our
analysis method can significantly improve the robustness of the practical TF-
QKD system.

##  2 Security of QKD with AD

To prove the security of a QKD protocol, the bit error rate of different bases
should be precisely estimated. It has been proved that the security of the
state preparation and measurement based QKD protocol can be analyzed with the
entanglement based QKD protocol [2, 4]. In the entanglement based protocol,
Alice and Bob can take inputs from four-dimensional Hilbert spaces
$H_{A}\otimes H_{B}$ to apply Z basis and X basis measurements. By considering
BB84 [1] and six-state [38] QKD protocols, it has been proved that Eve’s
general attack can be reduced to the Pauli attack [4, 43], which can be
described by the classical probability theory. Thus, the QKD protocol can be
illustrated with the following quantum state preparation,

${\sigma_{AB}}=\sum\limits_{i=0}^{3}{{\lambda_{i}}}\left|{{\Phi_{i}}}\right\rangle\left\langle{{\Phi_{i}}}\right|,with\sum\limits_{i=0}^{3}{{\lambda_{i}}}=1,$
(1)

where

$\begin{array}[]{lll}|\Phi_{0}\rangle=\frac{1}{\sqrt{2}}(|00\rangle+|11\rangle)\\\
|\Phi_{1}\rangle=\frac{1}{\sqrt{2}}(|00\rangle-|11\rangle)\\\
|\Phi_{2}\rangle=\frac{1}{\sqrt{2}}(|01\rangle+|10\rangle)\\\
|\Phi_{3}\rangle=\frac{1}{\sqrt{2}}(|01\rangle-|10\rangle).\\\ \end{array}$
(2)

By combining this state preparation with the $Z$ basis and $X$ basis
measurement in Alice and Bob’s side, the secure key rate can be given by [4]

$\displaystyle R\geq$ $\displaystyle
min_{\lambda_{0},\lambda_{1},\lambda_{2},\lambda_{3}}[S(A|E)-H(A|B)]$ (3)
$\displaystyle=$ $\displaystyle
min_{\lambda_{0},\lambda_{1},\lambda_{2},\lambda_{3}}[1-(\lambda_{0}+\lambda_{1})H(\frac{\lambda_{0}}{\lambda_{0}+\lambda_{1}})$
$\displaystyle-(\lambda_{2}+\lambda_{3})H(\frac{\lambda_{2}}{\lambda_{2}+\lambda_{3}})-H(\lambda_{0}+\lambda_{1})],$

where $E$ is Eve’s ancillary state, $S(A|E)=S(A,E)-S(E)$,
$H(A|B)=H(A,B)-H(B)$, $H(x)=-x\text{log}x-(1-x)\text{log}(1-x)$ and
$S(\rho)=-\text{tr}(\rho\text{log}\rho)$ are entropy functions. Since the
quantum channel can be controlled by Eve, she can choose the optimal
parameters $\lambda_{i},\leavevmode\nobreak\ i=\\{0,1,2,3\\}$ to reduce the
secure key rate, but $\lambda_{i}$ should also be restricted by the quantum
bit error rate in two different bases.

To improve the maximal tolerable error rate, the repetition code protocol
based AD method has been proposed [4]. In the repetition code protocol, Alice
and Bob split their raw key into blocks of $b$ bits $x_{0},x_{1},...x_{b-1}$
and $y_{0},y_{1},...y_{b-1}$ respectively. Alice privately generates a random
bit $c\in\\{0,1\\}$, and sends the message
$m=m_{0},m_{1},...,m_{b-1}=x_{0}\oplus c,x_{1}\oplus c,...x_{b-1}\oplus c$ to
Bob through an authenticated classical channel. Bob accepts the block if and
only if $m_{0}\oplus y_{0},m_{1}\oplus y_{1},...,m_{b-1}\oplus
y_{b-1}\in\\{0,0,...0\leavevmode\nobreak\ \text{or}\leavevmode\nobreak\
1,1,...,1\\}$. If Alice and Bob accept the block, they keep the first bit
$x_{0}$ and $y_{0}$ as the raw key. Finally, Alice and Bob will apply the
error correction and privacy amplification algorithms to generate the final
secure key.

Based on the repetition code protocol, the secure key rate $\tilde{R}$ can be
modified as the following inequality [4]

$\displaystyle\tilde{R}\geq$ $\displaystyle max_{b}\leavevmode\nobreak\
min_{\lambda_{0},\lambda_{1},\lambda_{2},\lambda_{3}}\frac{1}{b}p_{succ}[1-(\tilde{\lambda}_{0}+\tilde{\lambda}_{1})H(\frac{\tilde{\lambda}_{0}}{\tilde{\lambda}_{0}+\tilde{\lambda}_{1}})$
(4)
$\displaystyle-(\tilde{\lambda}_{2}+\tilde{\lambda}_{3})H(\frac{\tilde{\lambda}_{2}}{\tilde{\lambda}_{2}+\tilde{\lambda}_{3}})-H(\tilde{\lambda}_{0}+\tilde{\lambda}_{1})],$

where

$\displaystyle\tilde{\lambda}_{0}=\frac{(\lambda_{0}+\lambda_{1})^{b}+(\lambda_{0}-\lambda_{1})^{b}}{2p_{succ}},$
(5)
$\displaystyle\tilde{\lambda}_{1}=\frac{(\lambda_{0}+\lambda_{1})^{b}-(\lambda_{0}-\lambda_{1})^{b}}{2p_{succ}},$
$\displaystyle\tilde{\lambda}_{2}=\frac{(\lambda_{2}+\lambda_{3})^{b}+(\lambda_{2}-\lambda_{3})^{b}}{2p_{succ}},$
$\displaystyle\tilde{\lambda}_{3}=\frac{(\lambda_{2}+\lambda_{3})^{b}-(\lambda_{2}-\lambda_{3})^{b}}{2p_{succ}},$

$p_{succ}=(\lambda_{0}+\lambda_{1})^{b}+(\lambda_{2}+\lambda_{3})^{b}$ is the
successful probability of the AD method. Since the parameter $b$ in the AD
method can be controlled by Alice and Bob, they can choose the optimal $b$ to
improve the secure key rate. Note that this secure key rate is based on the
single photon state preparation, which can also be applied in practical QKD
systems with weak coherent pulse preparation [42].

##  3 The virtual protocol to analyze the quantum channel

Based on the TF-QKD protocol proposed by Maeda, Sasaki and Koashi [19], Alice
and Bob generate four different pulses with the signal state modulation and
the testing state modulation respectively. In the signal state modulation,
Alice and Bob randomly prepare the weak coherent pulse with amplitude
$\sqrt{\mu}$ or $-\sqrt{\mu}$. In the testing state modulation, Alice and Bob
randomly prepare the phase-randomized weak coherent pulse with intensities
$\nu_{1}$, $\nu_{2}$ and $0$ respectively. For every pair of pulses received
from Alice and Bob, Charlie announces whether the phase difference is
successfully detected. When the phase difference is detected, Charlie further
announces whether it is in-phase when detector $D_{1}$ clicks or anti-phase
when detector $D_{2}$ clicks. After receiving Charlie’s measurement outcomes,
Alice and Bob will apply phase information on the signal state to generate the
sifted key. More precisely, Charlie’s measurement outcomes can be divided into
two cases. In the in-phase measurement outcome case, Alice and Bob will
respectively generate the random bit $a$ with the signal state preparation
$|(-1)^{a}\sqrt{\mu}\rangle$. In the anti-phase measurement outcome case,
Alice and Bob will respectively generate the random bit $a$ with the signal
state preparation $|(-1)^{a}\sqrt{\mu}\rangle$ and $|(-1)^{a\oplus
1}\sqrt{\mu}\rangle$ respectively.

By applying the entanglement based protocol, the signal state preparation in
Alice’s side can be illustrated with the following quantum state

$\begin{array}[]{lll}\frac{|0\rangle_{A}|\sqrt{\mu}\rangle_{C_{A}}+|1\rangle_{A}|-\sqrt{\mu}\rangle_{C_{A}}}{\sqrt{2}}.\end{array}$
(6)

After preparing the quantum states $|\psi\rangle_{AC_{A}}$, Alice will measure
the first quantum state, and the second quantum state will be transmitted to
the quantum channel. And the signal state preparation in Bob’s side can be
illustrated with the following quantum state.

$\begin{array}[]{lll}\frac{|0\rangle_{B}|\sqrt{\mu}\rangle_{C_{B}}-|1\rangle_{B}|-\sqrt{\mu}\rangle_{C_{B}}}{\sqrt{2}}.\end{array}$
(7)

After preparing the quantum states $|\varphi\rangle_{BC_{B}}$, Bob will
measure the first quantum state, and the second quantum state will be
transmitted to the quantum channel.

It should be pointed out that this analysis method has been given in Ref.
[19]. Maeda, Sasaki and Koashi have proved that Alice and Bob’s procedure in
the signal mode can be equivalently executed by preparing the qubits $AB$ and
the optical pulses $C_{A}C_{B}$ in a joint quantum state
$\frac{|0\rangle_{A}|\sqrt{\mu}\rangle_{C_{A}}+|1\rangle_{A}|-\sqrt{\mu}\rangle_{C_{A}}}{\sqrt{2}}\otimes\frac{|0\rangle_{B}|\sqrt{\mu}\rangle_{C_{B}}-|1\rangle_{B}|-\sqrt{\mu}\rangle_{C_{B}}}{\sqrt{2}}$.
After preparing these quantum states, Alice and Bob will measure the first
quantum state, and the second quantum state will be transmitted to Charlie.
Thus the quantum state shared among Alice, Bob and Charlie can be given by

$\begin{array}[]{lll}&\frac{|0\rangle_{A}|\sqrt{\mu}\rangle_{C_{A}}+|1\rangle_{A}|-\sqrt{\mu}\rangle_{C_{A}}}{\sqrt{2}}\otimes\frac{|0\rangle_{B}|\sqrt{\mu}\rangle_{C_{B}}-|1\rangle_{B}|-\sqrt{\mu}\rangle_{C_{B}}}{\sqrt{2}}\\\
=&\frac{1}{4}[(|0\rangle|0\rangle+|1\rangle|1\rangle)_{AB}(|\sqrt{\mu}\rangle|\sqrt{\mu}\rangle-|-\sqrt{\mu}\rangle|-\sqrt{\mu}\rangle)_{C_{A},C_{B}}\\\
&+(|0\rangle|0\rangle-|1\rangle|1\rangle)_{AB}(|\sqrt{\mu}\rangle|\sqrt{\mu}\rangle+|-\sqrt{\mu}\rangle|-\sqrt{\mu}\rangle)_{C_{A},C_{B}}\\\
&+(|0\rangle|1\rangle+|1\rangle|0\rangle)_{AB}(-|\sqrt{\mu}\rangle|-\sqrt{\mu}\rangle+|-\sqrt{\mu}\rangle|\sqrt{\mu}\rangle)_{C_{A},C_{B}}\\\
&+(|0\rangle|1\rangle-|1\rangle|0\rangle)_{AB}(-|\sqrt{\mu}\rangle|-\sqrt{\mu}\rangle-|-\sqrt{\mu}\rangle|\sqrt{\mu}\rangle)_{C_{A},C_{B}}].\end{array}$
(8)

After measuring the received quantum states $C_{A}$ and $C_{B}$ with a $50:50$
beam-splitter and a pair of photon detectors $D_{1}$ and $D_{2}$, Charlie
announces whether the phase difference is successfully detected. Note that TF-
QKD protocol is based on the first-order interference, while MDI-QKD is based
on the second-order interference. Correspondingly, this quantum state will be
transformed to

$\begin{array}[]{lll}\frac{1}{4}[(|0\rangle|0\rangle+|1\rangle|1\rangle)_{AB}(|\sqrt{2\mu}\rangle|0\rangle-|-\sqrt{2\mu}\rangle|0\rangle)_{D_{1},D_{2}}+\\\
(|0\rangle|0\rangle-|1\rangle|1\rangle)_{AB}(|\sqrt{2\mu}\rangle|0\rangle+|-\sqrt{2\mu}\rangle|0\rangle)_{D_{1},D_{2}}+\\\
(|0\rangle|1\rangle+|1\rangle|0\rangle)_{AB}(-|0\rangle|\sqrt{2\mu}\rangle+|0\rangle|-\sqrt{2\mu}\rangle)_{D_{1},D_{2}}+\\\
(|0\rangle|1\rangle-|1\rangle|0\rangle)_{AB}(-|0\rangle|\sqrt{2\mu}\rangle-|0\rangle|-\sqrt{2\mu}\rangle)_{D_{1},D_{2}}],\end{array}$
(9)

where the detection results that detector $D_{1}$ clicks and detector $D_{2}$
clicks respectively demonstrate the in-phase and anti-phase measurement
outcomes in Charlie’s side. Here, for the simplicity of the discussion, we
assume that there are no channel losses. Correspondingly, the quantum states
$(|\sqrt{2\mu}\rangle|0\rangle-|-\sqrt{2\mu}\rangle|0\rangle)_{D_{1},D_{2}}$
and
$(|\sqrt{2\mu}\rangle|0\rangle+|-\sqrt{2\mu}\rangle|0\rangle)_{D_{1},D_{2}}$
demonstrate the in-phase measurement outcome, while quantum states
$(-|0\rangle|\sqrt{2\mu}\rangle+|0\rangle|-\sqrt{2\mu}\rangle)_{D_{1},D_{2}}$
and
$(-|0\rangle|\sqrt{2\mu}\rangle-|0\rangle|-\sqrt{2\mu}\rangle)_{D_{1},D_{2}}$
demonstrate the anti-phase measurement outcome. Note that TF-QKD protocol is a
variant of the MDI-QKD protocol, thus the measurement outcomes can be assumed
to be controlled by Eve. We can simply assume the click of detector $D_{1}$
demonstrates the Bell state
$\frac{1}{\sqrt{2}}(|0\rangle|0\rangle+|1\rangle|1\rangle)_{AB}$ preparation
in Alice and Bob’s side, while the click of detector $D_{2}$ demonstrates the
Bell state $\frac{1}{\sqrt{2}}(|0\rangle|1\rangle+|1\rangle|0\rangle)_{AB}$
preparation in Alice and Bob’s side. Since Charlie’s measurement outcomes have
no security requirement, this assumption is reasonable, and more detailed
explanation has been given in Ref. [19].

By applying the time reversed entanglement technique, we can assume the Bell
states $\frac{1}{\sqrt{2}}(|0\rangle|0\rangle+|1\rangle|1\rangle)_{AB}$ and
$\frac{1}{\sqrt{2}}(|0\rangle|1\rangle+|1\rangle|0\rangle)_{AB}$ is prepared
in Charlie’s side, then the two quantum states will be transmitted to Alice
and Bob to perform Z basis or X basis measurement. Based on this analysis
method, the in-phase measurement outcome demonstrates the Bell state
preparation

$\begin{array}[]{lll}\frac{1}{\sqrt{2}}(|0\rangle|0\rangle+|1\rangle|1\rangle)_{AB}=\frac{1}{\sqrt{2}}(|+\rangle|+\rangle+|-\rangle|-\rangle)_{AB}.\end{array}$
(10)

Suppose Alice and Bob apply Z basis measurement, Z basis error is defined to
be an event where the pair is found in either state $|0\rangle|1\rangle_{AB}$
or $|1\rangle|0\rangle_{AB}$. Suppose Alice and Bob apply X basis measurement,
X basis error is defined to be an event where the pair is found in either
state $|+\rangle|-\rangle_{AB}$ or $|-\rangle|+\rangle_{AB}$.

Similarly, the anti-phase measurement outcome demonstrates the Bell state
preparation

$\begin{array}[]{lll}\frac{1}{\sqrt{2}}(|0\rangle|1\rangle+|1\rangle|0\rangle)_{AB}=\frac{1}{\sqrt{2}}(|+\rangle|+\rangle-|-\rangle|-\rangle)_{AB}.\end{array}$
(11)

Suppose Alice and Bob apply Z basis measurement, Z basis error is defined to
be an event where the pair was found in either state $|0\rangle|0\rangle_{AB}$
or $|1\rangle|1\rangle_{AB}$. Suppose Alice and Bob apply X basis measurement,
X basis error is defined to be an event where the pair is found in either
state $|+\rangle|-\rangle_{AB}$ or $|-\rangle|+\rangle_{AB}$.

In a practical TF-QKD experiment, the bit error rate in Z basis can be
directly tested, but the bit error rate in X basis can’t be directly observed.
To analyze the bit error rate in X basis, the quantum state shared among
Alice, Bob and Charlie can be rewritten as

$\begin{array}[]{lll}&\frac{|0\rangle_{A}|\sqrt{\mu}\rangle_{C_{A}}+|1\rangle_{A}|-\sqrt{\mu}\rangle_{C_{A}}}{\sqrt{2}}\otimes\frac{|0\rangle_{B}|\sqrt{\mu}\rangle_{C_{B}}-|1\rangle_{B}|-\sqrt{\mu}\rangle_{C_{B}}}{\sqrt{2}}\\\
=&(\sqrt{c_{+}}|+\rangle_{A}|\sqrt{\mu_{even}}\rangle_{C_{A}}+\sqrt{c_{-}}|-\rangle_{A}|\sqrt{\mu_{odd}}\rangle_{C_{A}})\\\
&\otimes(\sqrt{c_{-}}|+\rangle_{B}|\sqrt{\mu_{odd}}\rangle_{C_{B}}+\sqrt{c_{+}}|-\rangle_{B}|\sqrt{\mu_{even}}\rangle_{C_{B}}),\end{array}$
(12)

where $c_{+}:=e^{-\mu}cosh\mu$, $c_{-}:=e^{-\mu}sinh\mu$,
$|\sqrt{\mu_{even}}\rangle=(|\sqrt{\mu}\rangle+|-\sqrt{\mu}\rangle)/(2\sqrt{c_{+}})$
and
$|\sqrt{\mu_{odd}}\rangle=(|\sqrt{\mu}\rangle-|-\sqrt{\mu}\rangle)/(2\sqrt{c_{-}})$.
Based on this state preparation, the X basis error occurs with probability
$p_{even}=c_{+}^{2}+c_{-}^{2}=e^{-2\mu}cosh2\mu$, and the optical pulses are
sent in the following quantum state

$\begin{array}[]{lll}p_{even}\rho^{even}=&c_{+}^{2}|\sqrt{\mu_{even}}\sqrt{\mu_{even}}\rangle\langle\sqrt{\mu_{even}}\sqrt{\mu_{even}}|_{C_{A}C_{B}}\\\
&+c_{-}^{2}|\sqrt{\mu_{odd}}\sqrt{\mu_{odd}}\rangle\langle\sqrt{\mu_{odd}}\sqrt{\mu_{odd}}|_{C_{A}C_{B}}.\end{array}$
(13)

To analyze the error rate in X basis, the counting rate with this non-
classical optical state preparation can be analyzed with the operator
dominance method [19], where the detection frequency of $\rho^{even}$ can be
estimated from a combination of phase-randomized weak coherent states with
intensities $\nu_{1}$, $\nu_{2}$ and $0$. Combining this analysis result with
the operator dominance method given by [19], we can estimate the quantum
channel parameters $\lambda_{i},\leavevmode\nobreak\ i=\\{0,1,2,3\\}$ in the
following section.

##  4 Security of TF-QKD with AD

By applying the previous analysis result with the signal state modulation in
Alice and Bob’s side, we need to analyze the error rate $E_{uu}^{ZZ}$ in Z
basis and the error rate $E_{uu}^{XX}$ in X basis respectively. In a practical
TF-QKD experiment, $E_{uu}^{ZZ}$ can be directly calculated by testing part of
the in-phase and anti-phase measurement outcomes. However, the non-classical
optical state $\rho^{even}$ is hard to realize in current technology, the bit
error rate $E_{uu}^{XX}$ can not be directly estimated in a practical TF-QKD
system. Fortunately, Maeda, Sasaki and Koashi proposed the operator dominance
method to estimate $E_{uu}^{XX}$ [19], where the linear combination of the
testing states can be applied to approximate the non-classical optical state
$\rho^{even}$. To analyze the security of the entanglement based TF-QKD
protocol with the information-theoretical analysis method, the relationship
among $E_{uu}^{ZZ}$, $E_{uu}^{XX}$ and $\lambda_{i}$ can be given with the
following equations,

$\displaystyle\lambda_{1}+\lambda_{3}=E_{uu}^{XX},$ (14)
$\displaystyle\lambda_{2}+\lambda_{3}=E_{uu}^{ZZ},$

where $\lambda_{0}+\lambda_{1}+\lambda_{2}+\lambda_{3}=1$. In the TF-QKD
protocol, only the signal state can be used to generate the final secure key.
Since the quantum channel parameters $\lambda_{i},\leavevmode\nobreak\
i=\\{0,1,2,3\\}$ can be estimated with Eq. (14), Eq. (4) can be modified with
the following inequality by applying the AD method

$\displaystyle R_{TF}\geq$ $\displaystyle max_{b}\leavevmode\nobreak\
\frac{1}{b}q_{succ}^{ZZ}Q_{uu}^{ZZ}[S(A|E)-H(A|B)]$ (15) $\displaystyle=$
$\displaystyle max_{b}\leavevmode\nobreak\
\frac{1}{b}q_{succ}^{ZZ}Q_{uu}^{ZZ}[(1-(\tilde{\lambda}_{0}+\tilde{\lambda}_{1})H(\frac{\tilde{\lambda}_{0}}{\tilde{\lambda}_{0}+\tilde{\lambda}_{1}})$
$\displaystyle-(\tilde{\lambda}_{2}+\tilde{\lambda}_{3})H(\frac{\tilde{\lambda}_{2}}{\tilde{\lambda}_{2}+\tilde{\lambda}_{3}}))-fh(\tilde{E}_{uu}^{ZZ})],$

where $Q_{uu}^{ZZ}$ is the counting rate by considering Alice and Bob prepare
the signal states,
$\tilde{E}_{uu}^{ZZ}=\frac{{E_{uu}^{ZZ}}^{b}}{{E_{uu}^{ZZ}}^{b}+(1-E_{uu}^{ZZ})^{b}}$
is the error rate after the AD protocol, $f>1$ is the error correction
efficiency, $q_{succ}^{ZZ}={E_{uu}^{ZZ}}^{b}+(1-E_{uu}^{ZZ})^{b}$ is the
successful probability of the AD method in the practical TF-QKD system.

By applying the operator dominance method with asymptotic key length, the
error rate in X basis $E_{\mu\mu}^{XX}$ can be given by [19]

$\begin{array}[]{lll}E_{\mu\mu}^{XX}=C_{1}(1+\sqrt{(C_{2}+C_{4})C_{3}})^{2},\end{array}$
(16)

where $C_{1}=\frac{e^{-2\mu}d}{1-e^{-2\mu\eta}+e^{-2\mu\eta}d}$,
$C_{2}=\frac{e^{-2\nu_{1}}(\nu_{1}-\nu_{2})}{\mu_{2}}$,
$C_{3}=\frac{1}{\nu_{1}e^{-2\nu_{1}}}\sum_{k=1}^{\infty}\frac{\mu^{2k}(k+1)}{\nu_{1}^{2k-1}-\nu_{2}^{2k-1}}$,
$C_{4}=\frac{1}{d}(1-e^{-2\nu_{1}\eta}+e^{-2\nu_{1}\eta}d-\frac{\nu_{1}e^{-2\nu_{1}}}{\nu_{2}e^{-2\nu_{2}}}(1-e^{-2\nu_{2}\eta}+e^{-2\nu_{2}\eta}d))$,
$max(\mu,\leavevmode\nobreak\ \nu_{2})<\nu_{1}$. Note that, we assume each
detector has a dark count probability of $p_{d}$, which amounts to the
effective probability $d=2p_{d}-{p_{d}}^{2}$ from the two detectors. By
considering the channel transmission efficiency, the overall transmissivity
from Alice (Bob) to Charlie’s detection is $\eta$.

Based on the simulation parameters given by [19], we calculate the secure key
rate $R_{TF}$ as a function of secure key rate transmission distance $L$
between Alice and Bob with different loss-independent misalignment error. The
loss-independent misalignment error is the probability that a photon hits the
erroneous detector, which is independent of the transmission distance. In a
practical experimental realization, the loss-independent misalignment error
can be applied to characterize the alignment and stability of the optical
system. We assume a fiber loss of $0.2$ dB/km, a loss-independent misalignment
error of $e_{d}=0.03$, error correction efficiency $f=1.1$, each detector has
a detection efficiency $\eta_{d}=0.3$ and dark count probability
$p_{d}=10^{-8}$. The overall transmissivity from Alice (Bob) to Charlie’s
detection is $\eta=\eta_{d}10^{-0.01L}$. In the asymptotic limit, the counting
rate of Alice and Bob’s signal states $Q_{uu}^{ZZ}$ can be given by

$\begin{array}[]{lll}Q_{uu}^{ZZ}=1-e^{-2\mu\eta}+e^{-2\mu\eta}d,\\\
\end{array}$ (17)

Correspondingly, the error rate in Z basis $E_{\mu\mu}^{ZZ}$ can be given by

$\begin{array}[]{lll}E_{\mu\mu}^{ZZ}=\frac{e_{d}(1-e^{-2\mu\eta})+\frac{e^{-2\mu\eta}d}{2}}{Q_{uu}^{ZZ}}.\\\
\end{array}$ (18)

Based on these simulation parameters and the optimal $b$ values, we calculate
the secure key rate $R_{TF}$ as a function of transmission distance between
Alice and Bob in Figure 1.

(a) The relationship between the transmission distance and the secure key
rate, the blue line is the secure key rate given by [19], the red line is the
secure key rate given by this work, and the green line is the PLOB bound.

(b) The optimal $b$ and success probability of advantage distillation with
different transmission distances. From $0$ km to $411$ km, the optimal $b$
value is $1$ and the success probability of advantage distillation is $1$,
thus we do not need to utilize the AD method in these transmission distances.

Figure 1: Results of TF-QKD protocol with $e_{d}=0.03$.

Comparing with the previous analysis result given by [19], we find that both
of the two analysis results can overcome the PLOB bound
$-\textrm{log}(1-\eta_{d}10^{-0.02L})$, but the maximal secure key
transmission distance can be improved from $420$ km to $470$ km.

By increasing the loss-independent misalignment error to $e_{d}=0.12$, we
calculate the secure key rate in Figure 2.

(a) The relationship between the transmission distance and the secure key
rate, the blue line is the secret key rate given by [19], the red line is the
secure key rate given by this work, and the green line is the PLOB bound.

(b) The relationship between the transmission distance and the optimal $b$
values. From $0$ km to $388$ km, the optimal $b$ value is $2$.

Figure 2: Results of TF-QKD protocol with $e_{d}=0.12$.

We find that our analysis result can overcome the PLOB bound and the maximal
secure key transmission distance can be improved from $345$ km to $443$ km,
but the previous analysis method can not overcome the PLOB bound at any
transmission distance.

By increasing the loss-independent misalignment error to $e_{d}=0.16$, we
calculate the secure key rate in Figure 3.

(a) The relationship between the transmission distance and the secure key
rate, the blue line is the secret key rate given by [19], the red line is the
secure key rate given by this work, and the green line is the PLOB bound.

(b) The relationship between the transmission distance and the optimal $b$
values. From $0$ km to $355$ km, the optimal $b$ value is $2$.

Figure 3: Results of TF-QKD protocol with $e_{d}=0.16$.

We find that our analysis result can still overcome the PLOB bound, and the
maximal secure key transmission distance can be improved from $308$ km to
$428$ km. From the calculation result, we find that the advantage distillation
technology has a better effect on improving the secure key rate when the
misalignment error rate is high.

By increasing the loss-independent misalignment error to $e_{d}=0.48$, we
calculate the secure key rate in Figure 4.

(a) The relationship between the transmission distance and the secure key
rate.

(b) The relationship between the transmission distance and the optimal $b$
values.

Figure 4: Results of TF-QKD protocol with $e_{d}=0.48$.

More surprisingly, we find that our analysis method can still generate
positive secure key, the reason for which is that $E_{\mu\mu}^{XX}$ has no
correlation with $e_{d}$ in the security analysis model. This is quite
different from the BB84-QKD system or the original MDI-QKD system, where all
of the error rate in different bases will be increased by increasing $e_{d}$.
However, in a TF-QKD system, we can prove that the error rate
$E_{\mu\mu}^{XX}$ will be unchanged. By applying the AD method with $b>1$, the
error rate
$\tilde{E}_{uu}^{ZZ}=\frac{{E_{uu}^{ZZ}}^{b}}{{E_{uu}^{ZZ}}^{b}+(1-E_{uu}^{ZZ})^{b}}$
will be smaller than $E_{\mu\mu}^{ZZ}$ at the cost of increasing
$\tilde{\lambda}_{0}$ and $\tilde{\lambda}_{1}$. Thus, if $b$ is large enough,
we can also generate positive secure key rate $R_{TF}$ even if the error
$e_{d}$ is close to $0.5$. From the calculation result, we find that the
secure key rate is very low for high misalignment errors close to $50\%$. In
this situation, the advantage distillation is very interesting from a
theoretical point of view, but it is not feasible in practice.

##  5 Discussion

In a practical TF-QKD system, by combining the AD method with the information-
theoretical security analysis method, we prove that both the maximal
transmission distance and the secure key rate can be sharply improved. More
surprisingly, the numerical simulation results demonstrate that TF-QKD can
generate positive secure key even if the loss-independent misalignment error
is close to $50\%$, thus our analysis method can significantly improve the
performance of a practical TF-QKD system. In the future research, it will be
interesting to experimentally realize the AD method in a practical TF-QKD
system, especially with a high loss-independent misalignment error.

Since the AD method only modifies the classical post-processing step, the
similar advantage distillation technology has been applied in the phase-
matching quantum key distribution [44]. In the future research, it will be
also interesting to analyze security of sending-not-sending TF QKD with
advantage distillation technology [45, 46, 47]. More interestingly, based on
the quantum asymptotic equipartition property [48], the leftover hash lemma
[49] and the Chernoff bound [50, 19], the statistical fluctuation of the bit
error rate and the secure key rate in finite-key length can be efficiently
analyzed in the future research.

Acknowledgements

The authors would like to thank Zhen-Qiang Yin, Rong Wang, Shuang Wang and
Guan-Jie Fan-Yuan for helpful discussions. This work is supported by NSAF
(Grant No. U2130205), National Natural Science Foundation of China (Grant No.
11725524, 62371244) and China Postdoctoral Science Foundation (Grant Nos.
2019T120446, 2018M642281).

## References

  * [1] Charles H. Bennett and Gilles Brassard.  “Quantum cryptography: Public key distribution and coin tossing”.  Theoretical Computer Science 560, 7–11 (2014).
  * [2] Hoi-Kwong Lo and Hoi Fung Chau.  “Unconditional security of quantum key distribution over arbitrarily long distances”.  Science 283, 2050–2056 (1999).
  * [3] Peter W Shor and John Preskill.  “Simple proof of security of the bb84 quantum key distribution protocol”.  Physical Review Letters 85, 441 (2000).
  * [4] Renato Renner.  “Security of quantum key distribution”.  International Journal of Quantum Information 6, 1–127 (2008).
  * [5] Valerio Scarani, Helle Bechmann-Pasquinucci, Nicolas J Cerf, Miloslav Dušek, Norbert Lütkenhaus, and Momtchil Peev.  “The security of practical quantum key distribution”.  Reviews of Modern Physics 81, 1301 (2009).
  * [6] Hong-Wei Li, Shuang Wang, Jing-Zheng Huang, Wei Chen, Zhen-Qiang Yin, Fang-Yi Li, Zheng Zhou, Dong Liu, Yang Zhang, Guang-Can Guo, et al.  “Attacking a practical quantum-key-distribution system with wavelength-dependent beam-splitter and multiwavelength sources”.  Physical Review A 84, 062308 (2011).
  * [7] Lars Lydersen, Carlos Wiechers, Christoffer Wittmann, Dominique Elser, Johannes Skaar, and Vadim Makarov.  “Hacking commercial quantum cryptography systems by tailored bright illumination”.  Nature Photonics 4, 686–689 (2010).
  * [8] Hong-Wei Li, Zheng-Mao Xu, and Qing-Yu Cai.  “Small imperfect randomness restricts security of quantum key distribution”.  Physical Review A 98, 062325 (2018).
  * [9] Samuel L Braunstein and Stefano Pirandola.  “Side-channel-free quantum key distribution”.  Physical Review Letters 108, 130502 (2012).
  * [10] Hoi-Kwong Lo, Marcos Curty, and Bing Qi.  “Measurement-device-independent quantum key distribution”.  Physical Review Letters 108, 130503 (2012).
  * [11] Leong-Chuan Kwek, Lin Cao, Wei Luo, Yunxiang Wang, Shihai Sun, Xiangbin Wang, and Ai Qun Liu.  “Chip-based quantum key distribution”.  AAPPS Bulletin31 (2021).
  * [12] Stefano Pirandola, Riccardo Laurenza, Carlo Ottaviani, and Leonardo Banchi.  “Fundamental limits of repeaterless quantum communications”.  Nature Communications 8, 15043 (2017).
  * [13] Marco Lucamarini, Zhiliang L Yuan, James F Dynes, and Andrew J Shields.  “Overcoming the rate–distance limit of quantum key distribution without quantum repeaters”.  Nature 557, 400–403 (2018).
  * [14] Xiongfeng Ma, Pei Zeng, and Hongyi Zhou.  “Phase-matching quantum key distribution”.  Physical Review X 8, 031043 (2018).
  * [15] Xiang-Bin Wang, Zong-Wen Yu, and Xiao-Long Hu.  “Twin-field quantum key distribution with large misalignment error”.  Physical Review A 98, 062323 (2018).
  * [16] Chaohan Cui, Zhen-Qiang Yin, Rong Wang, Wei Chen, Shuang Wang, Guang-Can Guo, and Zheng-Fu Han.  “Twin-field quantum key distribution without phase postselection”.  Physical Review Applied 11, 034053 (2019).
  * [17] Marcos Curty, Koji Azuma, and Hoi-Kwong Lo.  “Simple security proof of twin-field type quantum key distribution protocol”.  npj Quantum Information 5, 64 (2019).
  * [18] Jie Lin and Norbert Lütkenhaus.  “Simple security analysis of phase-matching measurement-device-independent quantum key distribution”.  Physical Review A 98, 042332 (2018).
  * [19] Kento Maeda, Toshihiko Sasaki, and Masato Koashi.  “Repeaterless quantum key distribution with efficient finite-key analysis overcoming the rate-distance limit”.  Nature Communications 10, 3140 (2019).
  * [20] Guillermo Currás-Lorenzo, Álvaro Navarrete, Koji Azuma, Go Kato, Marcos Curty, and Mohsen Razavi.  “Tight finite-key security for twin-field quantum key distribution”.  npj Quantum Information 7, 22 (2021).
  * [21] Guillermo Currás-Lorenzo, Lewis Wooltorton, and Mohsen Razavi.  “Twin-field quantum key distribution with fully discrete phase randomization”.  Physical Review Applied 15, 014016 (2021).
  * [22] M Minder, M Pittaluga, GL Roberts, M Lucamarini, JF Dynes, ZL Yuan, and AJ Shields.  “Experimental quantum key distribution beyond the repeaterless secret key capacity”.  Nature Photonics 13, 334–338 (2019).
  * [23] Xiaoqing Zhong, Jianyong Hu, Marcos Curty, Li Qian, and Hoi-Kwong Lo.  “Proof-of-principle experimental demonstration of twin-field type quantum key distribution”.  Physical Review Letters 123, 100506 (2019).
  * [24] Yang Liu, Zong-Wen Yu, Weijun Zhang, Jian-Yu Guan, Jiu-Peng Chen, Chi Zhang, Xiao-Long Hu, Hao Li, Cong Jiang, Jin Lin, et al.  “Experimental twin-field quantum key distribution through sending or not sending”.  Physical Review Letters 123, 100505 (2019).
  * [25] Shuang Wang, De-Yong He, Zhen-Qiang Yin, Feng-Yu Lu, Chao-Han Cui, Wei Chen, Zheng Zhou, Guang-Can Guo, and Zheng-Fu Han.  “Beating the fundamental rate-distance limit in a proof-of-principle quantum key distribution system”.  Physical Review X 9, 021046 (2019).
  * [26] Hui Liu, Cong Jiang, Hao-Tao Zhu, Mi Zou, Zong-Wen Yu, Xiao-Long Hu, Hai Xu, Shizhao Ma, Zhiyong Han, Jiu-Peng Chen, Yunqi Dai, Shi-Biao Tang, Weijun Zhang, Hao Li, Lixing You, Zhen Wang, Yong Hua, Hongkun Hu, Hongbo Zhang, Fei Zhou, Qiang Zhang, Xiang-Bin Wang, Teng-Yun Chen, and Jian-Wei Pan.  “Field test of twin-field quantum key distribution through sending-or-not-sending over 428 km”.  Physical Review Letters 126, 250502 (2021).
  * [27] Jiu-Peng Chen, Chi Zhang, Yang Liu, Cong Jiang, Wei-Jun Zhang, Zhi-Yong Han, Shi-Zhao Ma, Xiao-Long Hu, Yu-Huai Li, Hui Liu, Fei Zhou, Hai-Feng Jiang, Teng-Yun Chen, Hao Li, Li-Xing You, Zhen Wang, Xiang-Bin Wang, Qiang Zhang, and Jian-Wei Pan.  “Twin-field quantum key distribution over a 511 km optical fibre linking two distant metropolitan areas”.  Nature Photonics 15, 570–575 (2021).
  * [28] Shuang Wang, Zhen-Qiang Yin, De-Yong He, Wei Chen, Rui-Qiang Wang, Peng Ye, Yao Zhou, Guan-Jie Fan-Yuan, Fang-Xiang Wang, Yong-Gang Zhu, Pavel V Morozov, Alexander V Divochiy, Zheng Zhou, Guang-Can Guo, and Zheng-Fu Han.  “Twin-field quantum key distribution over 830-km fibre”.  Nature Photonics 16, 154–161 (2022).
  * [29] Hua-Lei Yin and Zeng-Bing Chen.  “Coherent-state-based twin-field quantum key distribution”.  Scientific Reports 9, 14918 (2019).
  * [30] Mario Mastriani and Sundaraja Sitharama Iyengar.  “Satellite quantum repeaters for a quantum internet”.  Quantum Engineering 2, e55 (2020).
  * [31] Xiao-Min Hu, Cen-Xiao Huang, Yu-Bo Sheng, Lan Zhou, Bi-Heng Liu, Yu Guo, Chao Zhang, Wen-Bo Xing, Yun-Feng Huang, Chuan-Feng Li, and Guang-Can Guo.  “Long-distance entanglement purification for quantum communication”.  Physical Review Letters 126, 010503 (2021).
  * [32] Gui-Lu Long, Dong Pan, Yu-Bo Sheng, Qikun Xue, Jianhua Lu, and Lajos Hanzo.  “An evolutionary pathway for the quantum internet relying on secure classical repeaters”.  IEEE Network 36, 82–88 (2022).
  * [33] Ueli M Maurer.  “Secret key agreement by public discussion from common information”.  IEEE Transactions on Information Theory 39, 733–742 (1993).
  * [34] Barbara Kraus, Cyril Branciard, and Renato Renner.  “Security of quantum-key-distribution protocols using two-way classical communication or weak coherent pulses”.  Physical Review A 75, 012316 (2007).
  * [35] Joonwoo Bae and Antonio Acín.  “Key distillation from quantum channels using two-way communication protocols”.  Physical Review A 75, 012334 (2007).
  * [36] Gláucia Murta, Filip Rozpędek, Jérémy Ribeiro, David Elkouss, and Stephanie Wehner.  “Key rates for quantum key distribution protocols with asymmetric noise”.  Physical Review A 101, 062321 (2020).
  * [37] Ernest Y.-Z. Tan, Charles C.-W. Lim, and Renato Renner.  “Advantage distillation for device-independent quantum key distribution”.  Physical Review Letters 124, 020502 (2020).
  * [38] Dagmar Bruß.  “Optimal eavesdropping in quantum cryptography with six states”.  Physical Review Letters 81, 3018 (1998).
  * [39] Won-Young Hwang.  “Quantum key distribution with high loss: toward global secure communication”.  Physical Review Letters 91, 057901 (2003).
  * [40] Xiang-Bin Wang.  “Beating the photon-number-splitting attack in practical quantum cryptography”.  Physical Review Letters 94, 230503 (2005).
  * [41] Hoi-Kwong Lo, Xiongfeng Ma, and Kai Chen.  “Decoy state quantum key distribution”.  Physical Review Letters 94, 230504 (2005).
  * [42] Hong-Wei Li, Chun-Mei Zhang, Mu-Sheng Jiang, and Qing-Yu Cai.  “Improving the performance of practical decoy-state quantum key distribution with advantage distillation technology”.  Communications Physics 5, 53 (2022).
  * [43] Daniel Gottesman and Hoi-Kwong Lo.  “Proof of security of quantum key distribution with two-way classical communications”.  IEEE Transactions on Information Theory 49, 457–475 (2003).
  * [44] Rui-Qiang Wang, Chun-Mei Zhang, Zhen-Qiang Yin, Hong-Wei Li, Shuang Wang, Wei Chen, Guang-Can Guo, and Zheng-Fu Han.  “Phase-matching quantum key distribution with advantage distillation”.  New Journal of Physics 24, 073049 (2022).
  * [45] Zong-Wen Yu, Xiao-Long Hu, Cong Jiang, Hai Xu, and Xiang-Bin Wang.  “Sending-or-not-sending twin-field quantum key distribution in practice”.  Scientific Reports 9, 3080 (2019).
  * [46] Hai Xu, Zong-Wen Yu, Cong Jiang, Xiao-Long Hu, and Xiang-Bin Wang.  “Sending-or-not-sending twin-field quantum key distribution: Breaking the direct transmission key rate”.  Physical Review A 101, 042330 (2020).
  * [47] Xiao-Long Hu, Cong Jiang, Zong-Wen Yu, and Xiang-Bin Wang.  “Sending-or-not-sending twin-field protocol for quantum key distribution with asymmetric source parameters”.  Physical Review A 100, 062337 (2019).
  * [48] Marco Tomamichel.  “A framework for non-asymptotic quantum information theory”.  Doctoral thesis.  ETH Zürich.  Zürich (2012).
  * [49] Jaikumar Radhakrishnan and Amnon Ta-Shma.  “Bounds for dispersers, extractors, and depth-two superconcentrators”.  SIAM Journal on Discrete Mathematics 13, 2–24 (2000).
  * [50] Wassily Hoeffding.  “Probability inequalities for sums of bounded random variables”.  Journal of the American Statistical Association 58, 13–30 (1963).