A passive transmitter for quantum key distribution with coherent light

# A passive transmitter for quantum key distribution with coherent light

Marcos Curty, Marc Jofre, Valerio Pruneri, and Morgan W. Mitchell Escuela de Ingeniería de Telecomunicación, Department of Signal Theory and Communications, University of Vigo, Campus Universitario, 36310 Vigo, Pontevedra, Spain
ICFO-Institut de Ciències Fotòniques, Mediterranean Technology Park, 08860 Castelldefels, Barcelona, Spain
ICREA-Institució Catalana de Recerca i Estudis Avanc¸ats, 08010 Barcelona, Spain
July 17, 2019
###### Abstract

Signal state preparation in quantum key distribution schemes can be realized using either an active or a passive source. Passive sources might be valuable in some scenarios; for instance, in those experimental setups operating at high transmission rates, since no externally driven element is required. Typical passive transmitters involve parametric down-conversion. More recently, it has been shown that phase-randomized coherent pulses also allow passive generation of decoy states and Bennett-Brassard 1984 (BB84) polarization signals, though the combination of both setups in a single passive source is cumbersome. In this paper, we present a complete passive transmitter that prepares decoy-state BB84 signals using coherent light. Our method employs sum-frequency generation together with linear optical components and classical photodetectors. In the asymptotic limit of an infinite long experiment, the resulting secret key rate (per pulse) is comparable to the one delivered by an active decoy-state BB84 setup with an infinite number of decoy settings.

## I Introduction

Quantum key distribution (QKD) is already a mature technology that can provide cryptographic systems with an unprecedented level of security qkd (). It aims at the distribution of a secret key between two distant parties (typically called Alice and Bob) despite the technological power of an eavesdropper (Eve) who interferes with the signals. This secret key is the essential ingredient of the one-time-pad or Vernam cipher Vernam (), the only known encryption method that can offer information-theoretic secure communications.

Most practical long-distance implementations of QKD are based on the so-called BB84 protocol, introduced by Bennett and Brassard in 1984 bb84 (), in combination with the decoy-state method decoy (); decoy2 (); decoy2b (); model2 (); decoy_e (). In a typical quantum optical implementation of this scheme, Alice sends to Bob phase-randomized weak coherent pulses (WCPs) with different mean photon numbers that are selected, independently and randomly, for each signal. These states can be generated using a standard semiconductor laser together with a variable optical attenuator that is controlled by a random number generator (RNG) random (). Each light pulse may be prepared in a different polarization state, which is selected, again independently and randomly for each signal, between two mutually unbiased bases, e.g., either a linear (H [horizontal] or V [vertical]) or a circular (L [left] or R [right]) polarizations basis note (). For that, two main experimental configurations are typically used. In the first one, Alice employs four laser diodes, one for each possible BB84 signal 4lasers (). These lasers are controlled by a RNG that decides each given time which one of the four diodes is triggered. The second configuration utilizes only one laser diode in combination with a polarization modulator modulator (). This modulator rotates the state of polarization of the signals depending on the output of a RNG. On the receiving side, Bob measures each incoming signal by choosing at random between two polarization analyzers, one for each possible basis. Once the quantum communication phase of the protocol is completed, Alice and Bob use an authenticated public channel to process their data and obtain a secure secret key. This last procedure, called key distillation, involves, generally, local randomization, error correction to reconcile Alice’s and Bob’s data, and privacy ampliÞcation to decouple their data from Eve post (). A full proof of the security for the decoy-state BB84 QKD protocol with WCPs has been given in Refs. decoy2 (); decoy2b (); model2 ().

Alternatively to the active signal state preparation methods described above, Alice may as well employ a passive transmitter to generate decoy-state BB84 signal states. This last solution might be desirable in some scenarios; for instance, in those experimental setups operating at high transmission rates, since no RNGs are required in a passive device rarity (); passive1 (); passive2 (); passive3 (); passive4 (); passiveEB (). Passive schemes could also be more robust against side-channel attacks hidden in the imperfections of the optical components than active sources. The working principle of a passive transmitter is rather simple. For example, Alice can use various light sources to produce different signal states that are sent through an optics network. Depending on the detection pattern observed in some properly located photodetectors, she can infer which signal states are actually generated. Known passive schemes rely typically on the use of a parametric down-conversion (PDC) source, where Alice and Bob passively and randomly choose which bases to measure each incoming pulse by means of a beamsplitter (BS) passiveEB (). Also, Alice can exploit the photon number correlations that exist between the two output modes of a PDC source to passively generate decoy states passive1 (). More recently, it has been shown that phase-randomized coherent pulses are also suitable for passive preparation of decoy states passive2 (); passive3 () and BB84 polarization signals curty (), though the combination of both setups in a single passive source is cumbersome. Intuitively speaking, Refs. passive2 (); passive3 (); curty () take advantage of the random phase of the different incoming pulses to passively generate states with either distinct photon number statistics but with the same polarization passive2 (); passive3 (), or with different polarizations but equal intensities curty ().

In this article, we present a complete passive transmitter for QKD that can prepare decoy-state BB84 signal states using coherent light. Our method employs sum-frequency generation (SFG) sfg1 (); kumar () together with linear optical components and classical photodetectors. SFG has already exhibited its usefulness in quantum information sfg2 () and device-independent QKD sfg3 () at the single-photon level. Here we use it in the conventional non-linear optics paradigm with strong coherent light. This fact might render our proposal particularly valuable from an experimental point of view. In the asymptotic limit of an infinite long experiment, it turns out that the secret key rate (per pulse) provided by such passive scheme is similar to the one delivered by an active decoy-state BB84 setup with infinite decoy settings.

The paper is organized as follows. In Sec. II we introduce a passive transmitter that generates decoy-state BB84 polarization signal states using coherent light. Then, in Sec. III we evaluate its performance and we obtain a lower bound on the resulting secret key rate. In Sec. IV we consider the case where Alice and Bob use phase-encoding, which is more suitable to employ in combination with optical fibers than polarization encoding. Finally, Sec. V concludes the article with a summary. The paper includes as well some Appendixes with additional calculations.

## Ii Passive decoy-state BB84 transmitter

The basic setup is illustrated in Fig. 1.

Let us start considering, for simplicity, the interference of two pure coherent states of frequency , both prepared in linear polarization and with arbitrary phase relationship, and , at a BS. The output states in modes and are given by

 |√μ(eiθ1+eiθ2)⟩a1,+45∘⊗|√μ(eiθ1−eiθ2)⟩b1,+45∘. (1)

Then, we have that the output states in modes and have the form

 |√μ2(eiθ1+eiθ2)⟩c1,+45∘⊗|√μ2(eiθ1+eiθ2)⟩d1,+45∘. (2)

If these two states are combined with two coherent states of frequency , and , in a nonlinear medium using the SFG process, the resulting output states at frequency , after the polarization rotation , can be written as (see Appendix A)

 |−√μeiθ3(eiθ1+eiθ2)√2⟩c2,+45∘⊗|−√μeiθ4(eiθ1+eiθ2)√2⟩d2,−45∘. (3)

These two beams are now re-combined at a PBS in the linear polarization basis note_last (). We obtain that the output state in mode (see Fig. 1) is a coherent state of the form

 |√ζ(θ)eiϕ⟩ψ,a3=e−ζ(θ)/2∞∑n=0(√ζ(θ)eiϕ)n√n!|nψ⟩, (4)

where , , , and the Fock states are given by

 |nψ⟩=[1√2(a†+45∘+eiψa†−45∘)]n√n!|vac⟩, (5)

with denoting the vacuum state and . Finally, Alice sends the quantum state given by Eq. (4) through a BS of transmittance . Then, the output states in modes and are given by

 |√tζ(θ)eiϕ⟩ψ,c3⊗|√(1−t)ζ(θ)eiϕ⟩ψ,d3. (6)

The analysis of the case where the global phase of each input signal , with , is randomized and inaccessible to the eavesdropper is now straightforward. It can be solved by just integrating the signals and given by Eq. (6) over all angles , and . In particular, we have that the output state in this scenario (see Fig. 1) can be written as

 σ = 1(2π)3∭ϕ,θ,ψ|√tζ(θ)eiϕ⟩ψ,c3⟨√tζ(θ)eiϕ| dϕdθdψ (7) = 1(2π)2∫θe−γ(θ)∞∑n=0γ(θ)nn!∫ψ|nψ⟩% ⟨nψ| dθdψ,

where the intensity is given by .

The weak intensity signal in mode is suitable for QKD and Alice sends it to Bob through the quantum channel. Also, she uses the strong intensity signal available in mode to measure both its intensity and polarization. This last measurement can be realized, for example, by means of a passive BB84 detection scheme where the basis choice is performed by a BS, and on each end there is a PBS and two classical photodetectors. From the different intensities observed in each of these four photodetectors, Alice can determine both the value of the angle and the total intensity of the signal. Note that, by assumption, we have that the intensity of the input states is very high.

For simplicity, let us assume for the moment that the polarization measurement is perfect, i.e., for each incoming signal it provides Alice with a precise value for the measured angle , while the intensity measurement only tells her whether the measured intensity is below or above a certain threshold value that satisfies . That is, is between the minimal and maximal possible values of the intensity of the optical pulses in mode . The first intensity interval, , can be associated, for instance, to the generation of a decoy state in output mode (that we shall denote as ), while the second intensity interval, , corresponds to the case of preparing a signal state (). Note, however, that the analysis presented in this section can be straightforwardly adapted to cover as well the case of several intensity intervals (i.e., the generation of several decoy states). Figure 2 (case A) shows a graphical representation of the intensity in mode versus the angle , together with the threshold value and the intensity intervals and .

The threshold angle that satisfies is given by

 θΛ=arccos(Λ2μ(1−t)−1). (8)

In this simplified scenario, the conditional quantum states that are sent to Bob can be written as

 σi,ψ=∞∑n=0pin|nψ⟩⟨nψ|, (9)

where , and the probabilities are given by

 psn = 1θΛ∫θΛ0e−γ(θ)γ(θ)nn! dθ, pdn = 1π−θΛ∫πθΛe−γ(θ)γ(θ)nn! dθ. (10)

In practice, however, it is not necessary that Alice determines the value of accurately and restricts herself to only those events where she actually prepares a perfect BB84 polarization state (i.e., when the angle satisfies ) curty (). Note that the probability associated with these ideal events tends to zero. Instead, it is sufficient if the polarization measurement tells her the value of within a certain interval around the desired ideal values. This situation is illustrated in Fig. 2 (case B), where Alice selects some valid regions (marked with gray color in the figure) for the angle curty (). These regions depend on an acceptance parameter that we optimize. In particular, whenever the value of lies within any of the valid regions, Alice considers the pulse emitted by the source as a valid signal. Otherwise, the pulse is discarded afterwards during the post-processing phase of the protocol, and it does not contribute to the key rate. The probability that a pulse is accepted, , is given by

 pacc=1−4Ωπ. (11)

There is a trade-off on the acceptance parameter . A high acceptance probability favors , but this action also results in an increase of the quantum bit error rate (QBER) of the protocol. A low QBER favors , but then . Note that in the limit where tends to we recover the standard decoy-state BB84 protocol.

## Iii Lower bound on the secret key rate

We shall consider that Alice and Bob treat decoy and signal states separately, and they distill secret key from both of them. For that, we use the security analysis presented in Ref. decoy2 (), which combines the results provided by Gottesman-Lo-Lütkenhaus-Preskill (GLLP) in Ref. sec_bb84b () (see also Ref. hkl ()) with the decoy-state method notetor (). The secret key rate formula can be written as

 R≥∑ipi max{Ri,0}, (12)

with . Here denotes the probability to generate a state associated to the intensity interval (i.e., and ), and

 Ri ≥ qpacc{−Qif(Ei)H(Ei)+pi1Y1[1−H(e1)] (13) + pi0Y0}.

The parameter is the efficiency of the protocol ( for the standard BB84 scheme, and for its efficient version eff ()); denotes the gain, i.e., the probability that Bob obtains a click in his measurement apparatus when Alice sends him a signal ; represents the efficiency of the error correction protocol as a function of the error rate , typically with Shannon limit gb (); is the yield of an -photon signal, i.e., the conditional probability of a detection event on Bob’s side given that Alice transmits an -photon state; denotes the error rate of an -photon signal; and represents the binary Shannon entropy function.

For simulation purposes, we shall consider a simple channel model in the absence of eavesdropping decoy2 (); model2 (); it just consists of a BS whose transmittance depends on the transmission distance and the loss coefficient of the quantum channel. That is, for simplicity, we neglect any misalignment effect in the channel. Furthermore, we assume that Bob employs an active BB84 detection setup. This model allows us to calculate the observed experimental parameters and . These quantities are given in Appendix B. Our results, however, can also be straightforwardly applied to any other quantum channel or detection setup, as they depend only on the observed gain and QBER.

To evaluate the secret key rate formula given by Eq. (13) we need to estimate the yields and , together with the single-photon error rate , by solving the following set of linear equations:

 Qi=∞∑n=0pinYn,andQiEi=∞∑n=0pinYnen. (14)

For that, we shall use the procedure proposed in Refs. model2 (); passive3 (). Moreover, we will assume a random background (i.e., ). This method requires that the probabilities given by Eq. (II) satisfy certain conditions that we confirm numerically. The results are included in Appendix C. It is important to emphasize, however, that the estimation technique presented in Refs. model2 (); passive3 () only constitutes a possible example of a finite setting estimation procedure. In principle, many other estimation methods are also available for this purpose, such as linear programming tools linear (), which might result in sharper, or for the purpose of QKD, better bounds on the considered probabilities.

The resulting lower bound on the secret key rate with two intensity settings is illustrated in Fig. 3 (green line).

In our simulation we employ the following experimental parameters: the dark count rate of Bob’s detectors is , the overall transmittance of Bob’s detection apparatus is , and the loss coefficient of the channel is dB/km. We further assume that , and . With this configuration, it turns out that the optimal value of the parameter decreases with increasing distance, while the optimal value of the parameter increases with the distance. A similar behavior was also observed in the passive BB84 transmitter (without decoy states) proposed in Ref. curty (). In particular, diminishes from to , while augments from to . At long distances the gain of the protocol is very low and, therefore, it is important to keep both the multi-photon probability of the source (related with the parameter ) and the intrinsic error rate of the signals sent by Alice (related with the parameter ) also low. Figure 3 includes as well an inset plot with the optimized parameters (dashed line) and (solid line). The optimal value for the parameter turns out to be constant with the distance; it is given by , i.e., the threshold angle is equal to . This figure also shows a lower bound on the secret key rate for the cases of an active decoy-state BB84 system with infinite decoy settings (black line) decoy2 (), and a passive transmitter with infinite intensity intervals (red line). The cutoff points where the secret key rate drops down to zero are km (passive setup with two intensity settings), km (passive setup with infinite intensity settings), and km (active transmitter with infinite decoy settings). From the results shown in Fig. 3 we see that the performance of the passive transmitter presented in Sec. II, with only two intensity settings, is similar to that of an active asymptotic setup, thus showing the practical interest of the passive scheme. The relatively small difference between the achievable secret key rates in both scenarios is due to two main factors: (a) the intrinsic error rate of the signals accepted by Alice, which is zero only in the case of an active source, and (b) the probability to accept a pulse emitted by the source, which is in the passive setup and in the active scheme. For instance, we have that for most distances , which implies . This fact reduces the key rate on logarithmic scale of the passive transmitter by a factor of . The additional factor of that can be observed in Fig. 3 arises mainly from the intrinsic error rate of the signals.

## Iv Phase encoding

Similar ideas to the ones presented in Sec. II can also be used in other implementations of the decoy-state BB84 protocol with a different signal encoding. For instance, in those QKD experiments based on phase encoding, which is more suitable to use with optical fibers than polarization encoding, which is particularly relevant in the context of free-space QKD qkd ().

The basic setup is illustrated in Fig. 4.

Again, for simplicity, let us consider first the case where the input signals , with , are pure coherent states with arbitrary phase relationship: and (of frequency ), and and (of frequency ). Let denote the time difference between two consecutive pulses generated by the sources. Then, from Sec. II we have that the signals in modes and at time instances and can be written as

 |√ζ(θ)2eiϕ⟩tc2,+45∘⊗|√ζ(θ)2eiϕ′⟩t+Δt/2d2,+45∘, (15)

where . Similarly, we find that the quantum states in modes and are given by, respectively,

 |√γ(θ)2eiϕ⟩tc3,+45∘ ⊗ |√γ(θ)2eiϕ′⟩% t+Δt/2c3,+45∘, |√ζ(θ)2eiϕ⟩td3,+45∘ ⊗ |√ζ(θ)2eiϕ′⟩t+Δt/2d3,+45∘. (16)

The case of phase-randomized strong coherent pulses is completely analogous to that of Sec. II and we omit it here for simplicity; it results in an uniform distribution for the angles , , and for both pairs of pulses given by Eq. (IV). The strong signals in mode are used to measure both their phases, relative to some local reference phase, and their intensities by means of an intensity and phase measurement, while Alice sends the weak signals in mode to Bob. Again, just like in the passive source with polarization encoding shown in Fig. 1, Alice can now select some valid regions for the measured phases and also distinguish between different intensity settings. Then, we have that the analysis and results presented in Sec. III also apply straightforwardly to this scenario.

## V Conclusion

In this paper, we have introduced a complete passive transmitter for QKD that can prepare decoy-state Bennett-Brassard 1984 signal states using coherent light. Our method employs sum-frequency generation together with linear optical components and classical photodetectors, and constitutes an alternative to those active sources that are typically used in current experimental realizations of QKD. In the asymptotic limit of an infinite long experiment, we have proven that such passive scheme can provide a secret key rate (per pulse) similar to the one delivered by an active decoy-state BB84 setup with infinite decoy settings, thus showing the practical interest of the passive scheme.

The main focus of this paper has been polarization-based realizations of the BB84 protocol, which are particularly relevant for free-space QKD. However, we have also shown that similar ideas can as well be applied to other practical scenarios with different signal encodings, like, for instance, those QKD experiments based on phase encoding, which are more suitable for use in combination with optical fibers.

## Vi Acknowledgments

We thank F. Steinlechner for helpful discussions. M.C. thanks the University of Toronto for hospitality and support during his stay in this institution. This work was supported by Xunta de Galicia, Spain (grant No. INCITE08PXIB322257PR), by ERDF funds under the project Consolidation of Research Units 2008/075, and by the Ministerio de Educación y Ciencia, Spain (grants TEC2010-14832, FIS2007-60179, FIS2008-01051 and Consolider Ingenio CSD2006-00019).

## Appendix A Sum-frequency generation

For completeness, in this Appendix we include the calculations to derive Eq. (3) in Sec. II. Our starting point are the input states to one of the two SFG processes used in the passive transmitter illustrated in Fig. 1: and . Such process is described by the Hamiltonian , where represents the creation operator for the light wave at frequency kumar (). The parameter is a coupling constant that is proportional to the second-order susceptibility of the nonlinear material, and H.c. denotes a Hermitian conjugate. When the pump mode at frequency is kept strong and undepleted, then this mode can be typically treated classically as a complex number. With this assumption, we have that the effective Hamiltonian above can now be written as . Using the Heisenberg equation of motion, it is straightforward to obtain the following coupled-mode equations:

 dc1dt=−χ√μe−iθ3c2,dc2dt=χ√μeiθ3c1, (17)

which can be solved in terms of initial values at to yield

 c1(t) = c1(0)cos(√μχt)−e−iθ3c2(0)sin(√μχt) c2(t) = c2(0)cos(√μχt)+eiθ3c1(0)sin(√μχt). (18)

At the point of complete conversion, , we obtain

 c†1(tc)=−eiθ3c†2(0),c†2(tc)=e−iθ3c†1(0). (19)

That is, at time we find that the resulting output state at frequency from the SFG process is given by

 |−√μ2eiθ3(eiθ1+eiθ2)⟩c2,+45∘. (20)

## Appendix B Gain and QBER

In this Appendix, we obtain a mathematical expression for the observed gains and error rates , with , for the passive QKD transmitter with two intensity settings introduced in Sec. II. For that, we employ the typical channel model in the absence of eavesdropping decoy2 (); model2 (); it just consists of a BS of transmittance , where denotes the loss coefficient of the channel measured in dB/km and is the transmission distance. Moreover, for simplicity, we consider that Bob employs an active BB84 detection setup with two threshold detectors.

The action of Bob’s measurement device can be described by two positive operator value measures (POVMs), one for each of the two BB84 polarization bases , with denoting a linear polarization basis and a circular polarization basis. Each POVM contains four elements: , , , and . The first one corresponds to the case of no click in the detectors, the following two POVM operators give precisely one detection click, and the last one, , gives rise to both detectors being triggered. These operators can be written as curty ()

 Gβvac = [1−ϵB(2−ϵB)]Fβvac, Gβ0 = (1−ϵB)ϵBFβvac+(1−ϵB)Fβ0, Gβ1 = (1−ϵB)ϵBFβvac+(1−ϵB)Fβ1, Gβdc = \openone−Gβvac−Gβ0−Gβ1. (21)

Here we assume that the background rate is, to a good approximation, independent of the signal detection. Moreover, for easiness of notation, we consider only a background contribution coming from the dark count rate of Bob’s detectors and we neglect other background contributions like, for instance, stray light arising from timing pulses which are not completely filtered out in reception. The operators , , , and have the form

 Fβvac = ∞∑n,m=0(1−ηsys)n+m|n,m⟩β⟨n,m|, Fβ0 = ∞∑n,m=0[1−(1−ηsys)n](1−ηsys)m|n,m⟩β⟨n,m|, Fβ1 = ∞∑n,m=0[1−(1−ηsys)m](1−ηsys)n|n,m⟩β⟨n,m|, Fβdc = ∞∑n,m=0[1−(1−ηsys)n][1−(1−ηsys)m] (22) × |n,m⟩β⟨n,m|,

with . The signals () represent the state which has photons in the horizontal (circular left) polarization mode and photons in the vertical (circular right) polarization mode. The parameter denotes the overall transmittance of the system. This quantity can be written as , where is the overall transmittance of Bob’s detection apparatus, i.e., it includes the transmittance of any optical component within Bob’s measurement device together with the efficiency of his detectors.

In the scenario considered, it turns out that the gains are independent of the actual polarization of the signals given by Eq. (9) and the basis used to measure them. We obtain

 Qi = 1−Tr(Gβvacσi,ψ) (23) = 1−(1−ϵB)2piπ∫θξie−ηsysγ(θ) dθ,

where , , , and .

When , which is the value that maximizes the secret key rate formula given by Eq. (12), we have that the gains can be written as

 Qs = 1−(1−ϵB)2A−(ηsysζ), Qd = 1−(1−ϵB)2A+(ηsysζ), (24)

where , and

 A±(x)=e−x[I0,x±L0,x]. (25)

Here represents the modified Bessel function of the first kind, and denotes the modified Struve function. These functions are defined as Bessel ()

 Iq,z = 12πi∮e(z/2)(t+1/t)t−q−1dt, (26) Lq,z = zq2q−1√πΓq+1/2∫π/20sinh(zcosθ)sinθ2qdθ.

The error rates depend on the value of the angle . By symmetry, we can restrict ourselves to evaluate the QBER in only one of the valid regions for . Note that is the same in all of them. For instance, let us consider the case where (which corresponds to the horizontal polarization interval), and let denote the error rate of a signal in that region. This quantity can be written as

 Eiψ=1QiTr[(Gl1+12Gldc)σi,ψ]. (27)

Here we have considered the typical initial post-processing step in the BB84 protocol, where double-click events are not discarded by Bob, but are randomly assigned to single-click events. Equation (27) can be further simplified as

 Eiψ = 12Qi{ϵB(ϵB−1)fi0,ψ+[2+ϵB(ϵB−3)]fi1,ψ (28) + (1−ϵB)2fidc,ψ+ϵB(2−ϵB)},

where . After a short calculation, we obtain

 fi0,ψ = 1piπ∫θξie−ηsysγ(θ)[−1+e12ηsysγ(θ)(1+cosψ)] dθ, fi1,ψ = 1piπ∫θξie−ηsysγ(θ)[−1+e12ηsysγ(θ)(1−cosψ)] dθ, fidc,ψ = 1+1piπ∫θξie−ηsysγ(θ)−e−12ηsysγ(θ)(1−cosψ) (29) − e−12ηsysγ(θ)(1+cosψ) dθ.

When , these expressions can be simplified as

 fs0,ψ = −A−(ηsysζ)+A−[κ+(ψ)], (30) fd0,ψ = −A+(ηsysζ)+A+[κ+(ψ)], fs1,ψ = −A−(ηsysζ)+A−[κ−(ψ)], fd1,ψ = −A+(ηsysζ)+A+[κ−(ψ)], fsdc,ψ = 1+A−(ηsysζ)−A−[ϵ+(ψ)]−A−[ϵ−(ψ)], fddc,ψ = 1+A+(ηsysζ)−A+[ϵ+(ψ)]−A+[ϵ−(ψ)],

where the parameters and have the form

 κ±(ψ) = ηsysζ[1−(1±cosψ)/2], ϵ±(ψ) = ηsysζ(1±cosψ)/2. (31)

The quantum bit error rates are then given by

 Ei=2π−4Ω∫π4−Ω7π4+ΩEiψdψ. (32)

Combining Eqs. (28)-(30-32), we find that

 Es = 12Qs{1−(1−ϵB)2A−(ηsysζ)+2π−4Ω∫π4−Ω7π4+ΩϵB(ϵB−1)A−[κ+(ψ)]+[2+ϵB(ϵB−3)]A−[κ−(ψ)] − (1−ϵB)2[A−[ϵ+(ψ)]+A−[ϵ−(ψ)]]dψ},

and

 Ed = 12Qd{1−(1−ϵB)2A+(ηsysζ)+2π−4Ω∫π4−Ω7π4+ΩϵB(ϵB−1)A+[κ+(ψ)]+[2+ϵB(ϵB−3)]A+[κ−(ψ)] (34) − (1−ϵB)2[A+[ϵ+(ψ)]+A+[ϵ−(ψ)]]dψ},

and we solve these equations numerically.

## Appendix C Estimation procedure

The secret key rate formula given by Eq. (13) can be lower bounded by

 Ri≥qpacc{−Qif(Ei)H(Ei)+(pi1Y1+pi0Y0)[1−H(eU1)]}, (35)

where denotes an upper bound on the single-photon error rate . Hence, for our purposes, it is enough to obtain a lower bound on the quantities for all , together with . For that, we can directly use the results obtained in Ref. passive3 (), which we include in this Appendix for completeness. The probabilities given by Eq. (II) need to satisfy certain conditions that we confirm numerically. In particular, we have that

 pi1Y1+pi0Y0 ≥ max{pi1(pd2Qs−ps2Qd)pd2ps1−ps2pd1 (36) + [pi0−pi1pd2ps0−ps2pd0pd2ps1−ps2pd1]YU0,0},

where denotes an upper bound on the background rate given by

 Y0≤YU0=min{EdQdpd0e0,EsQsps0e0,1}, (37)

with . The single-photon error rate can be upper bounded as

 e1≤eU1 = min{EdQd−pd0YL0e0pd1YL1,EsQs−ps0YL0e0ps1YL1, (38) ps0EdQd−pd0EsQs(pd1ps0−ps1pd0)YL1},

where and represent, respectively, a lower bound on the yield and the background rate . These quantities are given by

 Y1≥YL1=max{pd2Qs−ps2Qd−(pd2ps0−ps2pd0)YU0pd2ps1−ps2pd1,0}, (39)

and

 Y0≥YL0=max{pd1Qs−ps1Qdpd1ps0−ps1pd0,0}. (40)

To evaluate these expressions we need the statistics for . Using Eq. (II), and assuming again , we obtain

 ps0 = A−(ζ), (41) ps1 = ζ[A−(ζ)−e−ζ(I1,ζ−L−1,ζ)], ps2 = ζ2{ζA−(ζ)+e−ζ[2π(1−ζ23)+(1−2ζ)(I1,ζ − L−1,ζ)+ζ(I2,ζ−L2,ζ)]},

and

 pd0 = A+(ζ), (42) pd1 = ζ[A+(ζ)−e−ζ(I1,ζ+L−1,