Practical issues in decoy-state quantum key distribution based on the central limit theorem
A. S. Trushechkin E. O. Kiktenko A. K. Fedorov


APS/123-QED




Steklov Mathematical Institute of Russian Academy of Sciences, Moscow 119991, Russia
National Research Nuclear University MEPhI, Moscow 115409, Russia
Department of Mathematics and Russian Quantum Center, National University of Science and Technology MISiS, Moscow 119049, Russia
Russian Quantum Center, Skolkovo, Moscow 143025, Russia

 
Steklov Mathematical Institute of Russian Academy of Sciences, Moscow 119991, Russia
Bauman Moscow State Technical University, Moscow 105005, Russia
Russian Quantum Center, Skolkovo, Moscow 143025, Russia
QApp, Skolkovo, Moscow 143025, Russia



Department of Mathematics and Russian Quantum Center, National University of Science and Technology MISiS, Moscow 119049, Russia
Russian Quantum Center, Skolkovo, Moscow 143025, Russia
QApp, Skolkovo, Moscow 143025, Russia



Decoy-state quantum key distribution is a standard tool for long-distance quantum communications. 
An important issue in this field is processing the decoy-state statistics taking into account statistical fluctuations (or “finite-key effects”). 
In this work, we propose and analyze an option for decoy statistics processing, which is based on the central limit theorem.
We discuss such practical issues as inclusion of the failure probability of the decoy-states statistical estimates in the total failure probability of a QKD protocol 
and also taking into account the deviations of the binomially distributed random variables used in the estimations from the Gaussian distribution.
The results of numerical simulations show that the obtained estimations are quite tight.
The proposed technique can be used as a part of post-processing procedures for industrial quantum key distribution systems.

Practical issues in decoy-state quantum key distribution 
 based on the central limit theorem
    A.K. Fedorov
    December 30, 2023
=============================================================================================





§ INTRODUCTION


Quantum key distribution (QKD) as the main part of quantum cryptography is known to provide information-theoretic (or unconditional) security of key distribution. 
However, QKD protocols like BB84 assume the employ of single-photon sources <cit.>. In contrast, 
real-life implementations of QKD setups are based on attenuated laser pulses instead of true single photons <cit.>. This 
realization makes QKD vulnerable to various attacks, such as the photon number splitting attack <cit.>. A well-known tool 
for solving this problem is the decoy-state method, which can be considered as a standard technique used in many QKD realizations <cit.>. 
The decoy-state method uses laser pulses with different intensities. 
The intensities are chosen from a certain finite set. 
The choices for the pulses are kept in secret by the legitimate sender (Alice), 
but are publicly announced after the reception of all pulses by the legitimate receiver (Bob).
By analyzing (i) statistics of reception for pulses with different intensities and (ii) error rates for different intensities, 
one can estimate the fraction of single-photon pulses and the error rate for single-photon pulses. 
In particular, this allows detection of the photon number splitting attack <cit.>. 

An important task in the framework of the decoy-state QKD is to take into account statistical fluctuations (so called “finite-key effects”). 
Several methods are proposed in the literature, including those based on the central limit theorem <cit.>, 
Chernoff–Hoefding method <cit.>, 
and improved Chernoff–Hoefding method <cit.>. 

In the present work, we propose and analyze an option for processing decoy-state statistics based on the central limit theorem. 
Namely, we derive expressions for statistical estimations of the fraction of positions (bits) 
in the verified key obtained from single-photon pulses and the error rate in such positions. 
They are further used in calculations of the length of the secret (final) key with a given tolerable failure probability.
We also provide the results of numerical simulations, which show that these estimations are quite tight.
It should be mentioned that the methods based on the central limit theorem are criticized as not sufficiently rigorous <cit.>. 
However, we estimate the deviations from the Gaussian distribution in a rigorous way using the results of Ref. <cit.>. 
Another important practical issue that we discuss is the accurate inclusion of the failure probability of the decoy states statistical estimates into the formula for the total failure probability.
We note that our analysis uses the decoy-state QKD protocol, which is described in Ref. <cit.>.

Our work is organized as follows.
In Sec. <ref>, we describe the basics of the QKD post-processing procedure.
In Sec. <ref>, we present the suggested method for processing of decoy-state statistics based on the central limit theorem.
In Sec. <ref>, we use numerical simulations in order to compare the obtained estimations with theoretical limits of the decoy-state QKD protocol.
In Sec. <ref>, we estimate the deviations of the random variables used in our  processing procedure  from the Gaussian distribution.
We summarize the main results in Sec. <ref>.



§ QKD POST-PROCESSING PROCEDURE


The operating QKD protocol can be divided into several stages.
On the first quantum stage of a QKD protocol, Alice sends quantum states to Bob, who measures them. 
After the quantum stage Alice and Bob have two binary strings, the so-called raw keys. 
The second stage is the use of post-processing procedures.
Let us recall the basic stages of post processing the raw keys for the BB84 QKD protocol 
(for details, see Refs. <cit.>):




  * Sifting: Alice and Bob announce the bases they used for the preparation and measurement of quantum states and drop the positions with inconsistent bases from the raw keys. 
The resulting keys are called the sifted keys. 
The decoy-states statistics is announced at this stage as well.


  * Information reconciliation, also known as error correction:
This entails removing discrepancies between Alice's and Bob's sifted keys via communication over the authenticated channel 
(for the last issues concerning the adaptation of error-correcting codes for QKD, see Ref. <cit.>).
Often this stage is completed by a verification procedure: one legitimate side send a hash-tag of his or her key to the other side to ensure the coincidence of their keys after the error correction. 
The blocks of the sifted keys which fail the verification test are discarded at this state.
The resulting common key is called the verified key.
 

  * Parameter estimation: 
this is the estimation of the quantum bit error rate (QBER) in the sifted keys. Also, processing the decoy states statistics is performed on this stage.


  * Privacy amplification: 
the possible information obtained by an eavesdropper (Eve) about the keys is reduced to a negligible value
This is achieved by a special contraction of the verified key into a shorter key. 
For such contractions, 2-universal hash functions are used. 
This provides unconditional security against both classical and quantum eavesdroppers <cit.>. 
The resulting key is called the secret key or the final key. 
It is the output of a QKD protocol.



Post-processing procedures require communication between Alice and Bob over a classical channel. 
This channel is not necessarily private (Eve is freely allowed to eavesdrop), but it must be authentic, 
i.e. Eve can neither change the messages sent via this channel nor send her own messages without being detected. 
To provide the authenticity of the classical channel, Alice and Bob uses message authentication codes. 
There are unconditionally secure message authentication codes <cit.>.


Classically, the parameter estimation stage precedes the information reconciliation <cit.>.
The QBER value is estimated by random sampling from the sifted keys (of course, being publicly announced this sample is discarded from the sifted keys). 
In our scheme, following Ref. <cit.>, the QBER value is determined after the information reconciliation and verification stages. 
Clearly, the straightforward comparison of the keys before and after the error correction procedure provides the exact number of corrected errors and corresponding QBER value. 
This allows one to avoid discarding a part of the sifted keys. 
This scheme was also used in the recently suggested symmetric blind information reconciliation method <cit.>. 


The results of the statistical analysis of decoy states are used in the privacy amplification stage to calculate the length of the final key (contraction rate) which provides the required degree of security. For the BB84 protocol, the formula is as follows <cit.>:

    l_ sec=κ̂_1^ l l_ ver[1-h(ê_1^ u)]-leak_ec+5log_2ε_ pa,

where l_ ver is the length of the verified key, 
leak_ec the amount of information (number of bits) about the sifted keys leaked to Eve during the information reconciliation stage,

    h(x)=-xlog_2x-(1-x)log_2(1-x)
 
is the binary entropy function, and ε_ pa is a tolerable failure probability for the privacy amplification stage. 
It can be interpreted as a probability that the privacy amplification stage has not destroyed all of Eve's information on the verified key and, so Eve has partial non-negligible information on the final key.

Further, κ̂_1^ l is a lower bound on the fraction of bits in the verified key obtained from single-photon pulses, 
and ê_1^ u is an upper bound on the fraction of errors in such positions in the sifted keys. 
It is assumed that the bits of the verified keys obtained from multiphoton pulses are known to the eavesdropper. 
The quantity h(ê_1^ u) determines the potential knowledge of the bits obtained from single-photon pulses by the eavesdropper. 
This reflects the essence of QKD: it is impossible to get knowledge of the bits of the sifted key obtained from single-photon pulses without introducing errors in them. 
The estimation κ̂_1^ l and ê_1^ u is the purpose of the decoy statistics analysis, which is given in the next section and is the main subject of the present paper. 
The failure probability for these estimates (the probability that at least one of these estimates is not true) must not be greater than some value ε_ decoy.

If l_ sec given by Eq. (<ref>) is positive, then the secret key distribution is possible. 
If τ is the time needed to generate a verified key with the length l_ ver, 
then the secret key rate can be defined as follows:

    R_ sec=l_ sec/τ.
 


Let us comment on expression (<ref>). 
Essentially, it is taken from Ref. <cit.>, where a rigorous proof of unconditional security of the BB84 protocol is given. 
Strictly speaking, the proof was given for the case when the QBER is estimated by random sampling from the sifted keys (see Remark <ref>). 
However, the scheme when the QBER is estimated after the information reconciliation, simplifies the proof and formulas, since, 
in this case, the QBER is estimated not probabilistically but deterministically. 
Actually, the function ε_ pe(ν) in Theorem 3 in Ref. <cit.>, 
which is the probability that the QBER estimation is incorrect, can be set to zero for all ν.


The total failure probability of the QKD system is the sum of the failure probabilities of each component: 
verification, authentication, privacy amplification, and statistical estimations of κ̂_1^ l and ê_1^ u:

    ε_ qkd=ε_ ver+ε_ aut+ε_ pa+ε_ decoy.

Here ε_ ver is the probability that verification hash tags of Alice and Bob coincide, whereas their keys after the information reconciliation do not, 
and ε_ aut is the probability that message authentication codes do not detect Eve's interference into the classical channel.

The meaning of the total failure probability ε_ qkd is as follows: 
the key generated by the QKD protocol is indistinguishable from the perfectly secure key in any possible context (any possible application of this key) 
with the exception probability at most ε_ qkd (see Ref. <cit.>).


More precisely, ε_ qkd is the trace distance between the actual joint classical-quantum state of Alice, Bob, and Eve  and the ideal one, 
which corresponds to the case when Alice and Bob either have aborted the protocol or Alice's and Bob's keys coincide and are completely uncorrelated with Eve's state. 
But ε_ qkd as a failure probability, the real state coincides with the ideal with the probability of at least 1-ε_ qkd <cit.>. 
The derivation of formula (<ref>) is given in the Appendix.






§ DECOY-STATE STATISTICS PROCESSING


Let us describe the estimations of κ̂_1^ l and ê_1^ u used in Eq. (<ref>). 
Here we adopt a finite-key version of the decoy statistics analysis described in Ref. <cit.>. 
Namely, in each round Alice sends to Bob a fixed number N pulses. 
Each pulse has the “signal intensity” μ>0 with the probability p_μ, 
or the “decoy intensity” ν>0 with the probability p_ν, 
or the “vacuum intensity” λ≥0 with the probability p_λ=1-p_μ-p_ν. 
We note that the intensity of the “vacuum state” λ is close to zero, but not exactly zero due to the technical reasons.
In our consideration we assume  λ=0.01.
In fact, the “vacuum intensity” is the second decoy intensity. 
It is required that λ<ν/2 and λ+ν<μ. 
Signal pulses are used to establish the raw key (and then the sifted, verified, and secret keys), whereas decoy pulses are used to estimate κ̂_1^ l and ê_1^ u.

Let N be the total number of pulses sent by Alice, N_μ,N_ν, and N_λ be the numbers of signal, decoy, and vacuum pulses sent by Alice 
(generally, they do not coincide with p_μ N, p_ν N, and p_λ N due to statistical fluctuations, but, of course, N_μ+N_ν+N_λ=N),
and n_μ,n_ν,n_λ be the numbers of the corresponding pulses registered by Bob.
Further, let Q_μ the probability that a signal pulse is registered by Bob,
Q_ν and Q_λ the corresponding probabilities for decoy and vacuum pulses, 
and Q_1 be  the joint probability that a pulse contains a single photon and that it is registered. 
Then

    θ_1=Q_1/Q_μ

is the probability that a bit in the sifted (as well as verified) key is obtained from a single-photon pulse. 
Finally, let κ_1 be the actual fraction of bits in the verified key obtained from single-photon pulses (it may differ from θ_1 due to statistical fluctuations). 

We note that the random variables N_α (α∈{μ,ν,λ}) and l_ verκ_1 are binomially distributed. 
Indeed, each of N pulses is, for example, a signal pulse with the probability p_μ independently of other pulses, and the number of the signal pulses N_μ is not fixed (random). 
Another probability distribution widely used in QKD is the hypergeometric distribution arising from sampling without replacement. 
Here (like, e.g., in Ref. <cit.>) we do not use sampling without replacement, 
but use the independent random choice scheme giving rise to the binomial distribution for the number of choices of a certain alternative (type of pulse).
 
If a random variable X follows the binomial distribution with the number of experiments n and the success probability in one experiment p, then we will write X∼ Bi(n,p). 
Then N_α∼ Bi(N,p_α) and l_ verκ_1∼ Bi(l_ ver,θ_1). If the value of N_α is known and fixed (i.e., if we treat it as non-random), 
then n_α are also binomially distributed: n_α∼ Bi(N_α,Q_α). 
Indeed, each pulse of a given type is detected with the probability Q_α independently of other pulses of this type.

In order to estimate κ_1 from below, we should estimate θ_1 from below. To do this, we should estimate Q_1 from below and Q_μ from above.

According to Ref. <cit.>, the lower bound for Q_1 is as follows:

    Q_1   ≥μ e^-μ/ν(1-ν/μ)-λ(1-λ/μ)×
       ×[Q_ν e^ν-Q_λ e^λ-ν^2-λ^2/μ^2(Q_μ e^μ-Y_0^ l)],

where

    Y_0^ l=max{ν Q_λ e^λ-λ Q_ν e^ν/ν-λ,0}

is the lower bound for the probability that Bob obtains a click event provided that the pulse contains no photons. 
The estimates of Q_μ,Q_ν and Q_λ are given by:

    Q̂_α=n_α/N_α,   α=μ,ν,λ.

Here and in the following the notation without a “hat” denotes a true value of a probability (a parameter in the binomial distribution), 
while the notation with a “hat” denotes its statistical estimate (i.e., a random variable).

Due to the central limit theorem, 
the distribution of the random variable Q̂_α is well approximated by the normal distribution with the mean Q_α and standard deviation √(Q_α(1-Q_α)/N_α). 
If we denote 

    φ=Φ^-1(1-ε_ decoy/a),

where Φ^-1 is the quantile function for the standard normal distribution and a is some constant to be specified, then

    P[Q_α-Q̂_α≥φ√(Q_α(1-Q_α)/N_α)]≤ε_ decoy/a.

This gives lower and upper bounds on Q_α:

    Q̂_α^ u,l=Q̂_α±φ√(Q̂_α(1-Q̂_α)/N_α).

Each bound is satisfied with the probability not less than 1-ε_ decoy/a. 
We will need the upper bound on Q_μ and two-sided bounds on Q_ν and Q_λ. 
These five bounds are simultaneously satisfied with the probability not less than 1-5ε_ decoy/a. 
Substitution of these bounds into Eq. (<ref>) yields:

    Q_1≥μ e^-μ/ν(1-ν/μ)-λ(1-λ/μ)×
       ×[Q̂^ l_ν e^ν-Q̂^ u_λ e^λ-ν^2-λ^2/μ^2(Q̂^ u_μ e^μ-Ŷ_0^ l)]≡Q̂_1^ l,

where

    Ŷ_0^ l=max{νQ̂^ l_λ e^λ-λQ̂^ u_ν e^ν/ν-λ,0}.

Thus, we arrive at the following expression: 

    θ_1≥Q̂^ l_1/Q̂^ u_μ=θ̂_1^ l

with the probability not less than 1-5ε_ decoy/a. 
The actual fraction κ_1 is estimated from below as 

    κ_1≥θ_1-φ√(θ_1(1-θ_1)/l_ ver).

with the probability not less than 1-ε_ decoy/a, or,

    κ_1≥θ̂^ l_1-
    	φ√(θ̂^ l_1(1-θ̂^ l_1)/l_ ver)≡κ̂_1^ l.

with the probability not less than 1-6ε_ decoy/a. 
We have obtained one of two estimates participating in Eq. (<ref>). 

Let us now find an upper bound for the error rate of the single-photon states. 
Though the formulas of these bounds are known (see Ref. <cit.>), the use of the binomial distribution should be analyzed in more detail. 
If Eve performs a coherent attack, then the errors in different positions of the keys cannot be treated as independent events. 
However, we are going to show that we can still use the binomial distribution. 

Let n_i and e_i denote the number of bits in the verified key obtained from the i-photon pulses and  the error rate in the i-photon states, respectively 
(i.e., n_ie_i is the number of errors in the bits obtained from the i-photon pulses). 
Also let e_μ denotes the total error rate (QBER) for signal pulses. 
Then

    l_ ver e_μ   =   ∑_i=0^∞ n_ie_i≤ e_0n_0+e_1n_1, 
    
    	e_1    ≤   l_ ver e_μ-e_0n_0/n_1=
    	e_μ-e_0n_0/l_ ver/κ_1,

where we have used n_1=κ_1l_ ver, by definition of κ_1. 
Obviously, the probability of error for a vacuum pulse is 1/2 for both natural noise and Eve's attack. 
Indeed, if there is no eavesdropping, then only dark counts can cause the click event on the Bob's side. 
If the Bob's detectors are identical, then they have equal probabilities of a click. 
Moreover, if they are memoryless (after a certain dead time), then the error events in vacuum pulses are independent from each other. 
Now consider the case of the presence of Eve. She has no way of knowing about the bit sent by Alice since the pulse contains no photons. 
The only thing she can do is to send her own pulse. 
But since she does not know the Alice's bit, her bit can be either correct or not with equal probabilities and independently of the correctness of other bits. 
Hence, e_0n_0∼ Bi(n_0,1/2) for a fixed n_0. But n_0 is also a binomially distributed random variable. 
For each of N_μ signal pulses, the joint probability that a signal pulse contains zero photons, 
the basis choices of Alice and Bob coincide, and Bob has a click event is e^-μY_0/2 [see Eq. (<ref>)]. 
Hence, n_0∼ Bi(N_μ,e^-μY_0/2), e_0n_0∼ Bi(N_μ,e^-μY_0/4),

    e_0n_0   ≥N_μ e^-μY_0^ l/4-
    	φ√(N_μe^-μY_0^ l/4(1-e^-μY_0^ l/4))
       ≡υ,

and

    e_1 ≤e_μ-υ/l_ ver/κ̂_1^ l≡ê_1^ u

with the probability not less than 1-ε_ decoy/a. 

Thus, all statistical estimates are satisfied with the probability not less than 1-7ε_ decoy/a. Since they must be satisfied with the probability not less than 1-ε_ decoy, we set a=7.



§ SIMULATION RESULTS


We then consider realization of the described procedure on the realistic “plug-and-play” QKD setup <cit.> 
and compare the obtained results with theoretical limitations.
The parameters of the QKD setup implementation are as follows: 
number of pulses in train 5×10^4, 
repetition rate of pulses in train 300 MHz, 
storage line length 17 km,
detectors efficiency 10%, 
detectors dead time 1 μ s, 
dark count probability 3×10^-7, 
additional losses on Bob's side 5 dB, 
fiber attenuation coefficient 0.2 dB/km, 
and interference visibility 97%.

The parameters of the post-processing procedure are as follows: 

    ε_ ver=ε_ aut=ε_ pa=ε_ decoy=10^-12.

The information leakage on the procedure of error correction and verification are <cit.>: 

    leak_ec=f_ ech(e_μ),    f_ ec=1.15.

The length of processed block l_ ver is limited by the value of 16 Mbits or the length of sifted key accumulated after 30 min of the operation of the QKD setup.
We use the differential evolution method for numerical optimization of signal and decoy intensities (μ and ν) together with their generation probabilities (p_μ and p_ν).
The “vacuum intensity” is fixed at the level λ=0.01, and its generation probability is given by p_λ=1-p_μ-p_ν.
The results are presented in Fig. <ref> and Fig. <ref>.

We then compare the results given by our approach with the theoretic limit, 
where we neglect statistical fluctuations and assume that we know the exact values of κ_1 and e_1
(i.e., there is no need in statistical estimates and decoy states, p_μ=1, p_ν=p_λ=0).
In the theoretical limit, the secret key rate is given by the expression: 

    R_ sec^*=R_ sift{κ_1[1-h(e_1)]-f_ ech(e_μ)},

where R_ sift is the sifted key rate. 
The quantities R_ sift, κ_1, e_1, and e_μ in Eq. (<ref>) depend on the intensity of signal pulses (μ^* for the theoretical limit case).
These quantities are obtained from the numerical optimization of the intensities for various communication distances.

The results of the comparison of our approach and theoretical limit are presented in Fig. <ref>.
In Fig. <ref>(a) it is shown that the proposed approach rather closely approximates the theoretical limit on distances up to 100–120 km.
The optimal operating of post-processing procedures on such distances is important, in particular, for inter-city QKD for future quantum networks.

We note that the sifted key rate in the theoretic limit is higher due to higher optimal signal intensity [Fig. <ref>(b)] and absence of decoy states.
Also note that the optimal fraction of decoy states in the proposed approach is relatively small and is about 5% for distances less than 100 km [see Fig. <ref>(c)].





§ DEVIATIONS FROM THE GAUSSIAN DISTRIBUTION


In the discussed approach the statistical fluctuations are treated in the framework of the central limit theorem, i.e. we assume that the binomially distributed random variables 
(the fraction of positions obtained by single-photon pulses κ_1 and the error rate in these positions e_1) are well approximated by the Gaussian distribution. 
This approach is criticized as not sufficiently rigorous <cit.>, in contrast to other approaches which are more rigorous but give slightly worse estimates.  
Now we are going to estimate deviations from the Gaussian distribution.

Let X∼ Bi(n,p). 
Then according to Ref. <cit.>:

    C_n,p(k)≤[X≤ k]≤ C_n,p(k+1),

where C_n,p(0)=(1-p)^n, C_n,p(n)=1-p^n, and

    C_n,p(k)=Φ( sgn( kn-p)√(2nH( kn,p)))

for k=1,…,n-1,

    Φ(x)=1/√(2π)∫_-∞^x e^-t^2/2dt,


    H(x,p)=xlnx/p+(1-x)ln1-x/1-p,

and sgn(x)=x/|x| for x≠0 and sgn(0)=0. 

If k=np+φ√(np(1-p)), then it is straightforward to show using Taylor's theorem (for n→∞) that


    C_n,p(k)=Φ(φ)-
    	φ^2(1-2p)e^-φ^2/2/6√(2π np(1-p))+O(1n),
          C_n,p(k+1)=Φ(φ)-
    	φ^2(1-2p)e^-φ^2/2/6√(2π np(1-p))
                     +e^-φ^2/2/√(2π np(1-p))+O(1n).


We see that the deviations from the Gaussian distribution become significant for small n or p close to 0 or 1.

In Equations (<ref>), (<ref>), and (<ref>) we took φ such that

    Φ(φ)=1-ε_ decoy/7

[see Eq. (<ref>)] for ε_ decoy=10^-12, i.e., φ≈7.30. But the precise value ε'_ decoy of the failure probability is given by

    [X≤ np+φ√(np(1-p))]=1-ε'_ decoy/7.

Eqs. (<ref>) can be used to estimate the difference between the precise value ε'_ decoy and the required value ε_ decoy. 

Let us consider the worst-case scenarios for estimates (<ref>), (<ref>), and (<ref>). 
In Eq. (<ref>), the minimal possible N_α is N_λ∼ 10^8 (when the length is close to zero) and all Q̂_α are at least of the order 10^-7 
(they are bounded from below by dark count probability with a dead time corrections). 
The substitution of these worst-case parameters n=10^8 and p=10^-7 to Eq. (<ref>) gives

    ε'_ decoy-ε_ decoy≈ 2·10^-15≪ε_ decoy=10^-12.
 
In Eq. (<ref>), the worst-case parameters are n=l_ ver=10^5 and p=θ_1≈0.47 (corresponding to the maximal length 155 km):

    ε'_ decoy-ε_ decoy≈ 1.5·10^-16≪ε_ decoy=10^-12.
 
In Eq. (<ref>), we always have Y_0^ l=0, so, in fact, we do not perform the statistical estimation and use a trivial estimate n_0e_0≥0.  
We see that the precise value ε'_ decoy may exceed the required value ε_ decoy only by a negligible quantity. 
The higher-order corrections to the Gaussian distribution with respect to n^-1/2 are even smaller. 
Thus, for practical parameters one can use the proposed formulas based on the Gaussian distribution.

Derivation of a general procedure for decoy state statistics processing based on rigorous formula (<ref>) will be a subject for a subsequent work.



§ CONCLUDING REMARKS


We have presented a sort of the decoy state statistics processing. 
The final formulas are (<ref>) and (<ref>), which give the statistical estimates used in the formula for the length of the final secret key (<ref>).

Also we claim that the failure probability ε_ decoy for the decoy states statistical estimates should be treated as an additional term in the total failure probability 
ε_ qkd in Eq. (<ref>). 
Usually, one simply puts ε_ decoy=ε_ pa and not treat it as an additional term in the total failure probability. 
From the point of view of the rigorous theory, this is not correct: formula (<ref>) provides the failure probability at most ε_ pa only for true single-photon sources or, 
at least, when we can estimate κ̂_1^ l and ê_1^ u with certainty. 
If we cannot estimate these quantities with certainty, the failure probability of the estimate should be included as an additional term in the the total failure probability of the QKD system. 
The appendix is devoted to the rigorous derivation of Eq. (<ref>) for the total failure probability.

Finally, we have shown that, for practical parameters, 
deviations of the binomially distributed random variables used in the decoy states statistics processing from the Gaussian distribution can be neglected.

The suggested option for the decoy-state processing is implemented in the proof-of-principle realization of the post-processing procedure for industrial QKD systems <cit.>, 
which is freely available under GNU general public license (GPL) <cit.>.
This procedure is used in the modular QKD setup described in Ref. <cit.>. 



§ ACKNOWLEDGMENTS


We are grateful to Y.V. Kurochkin, A.S. Sokolov, and A.V. Miller for useful discussions. 
The work of A.S.T. and E.O.K. was supported by the grant of the President of the Russian Federation (project MK-2815.2017.1).
A.K.F. is supported by the RFBR grant (17-08-00742).







§ APPENDIX. DERIVATION OF THE FORMULA FOR THE FAILURE PROBABILITY


This section is devoted to the derivation of formula (<ref>). 
According to the results of Ref. <cit.>:

    ε_ qkd=ε_ corr+ε_ sec,

where ε_ corr and ε_ sec stand for correctness (coincidence of Alice's and Bob's final keys) and secrecy (ignorance of Eve about the final key), respectively. 
Namely, ε_ corr is the probability that Alice's and Bob's keys do not coincide, 
but the protocol was not aborted, and ε_ sec is the trace distance between the actual joint classical-quantum state of Alice and Eve and the ideal one. In our case, 

    ε_ corr=ε_ ver+ε_ aut,

i.e., the Alice's and Bob's final keys coincide in the case of coincidence of their verification hash tags and their authentication hash tags
(otherwise Eve could interfere into their communication and fake the verification tags). 
So, the failure probability for correctness is the sum of failure probabilities of the verification and authentication.

Further, in the case of single-photon sources, ε_ sec=ε_ pa (see, Ref. <cit.>). 
In this case we can estimate κ̂_1^ l and ê_1^ u in Eq. (<ref>) with certainty.
If we cannot estimate these quantities with certainty, the failure probability of the estimate should be included as an additional term in the  total failure probability of the QKD system:

    ε_ sec=ε_ pa+ε_ decoy.

A mathematical fact justifying expression Eq. (<ref>) is as follows. 
Consider two classical-quantum states:

    ρ_XY   =∑_x∈𝒳 p_x|x⟩⟨x|⊗ρ_Y|x,
    σ_XY   =∑_x∈𝒳 p_x|x⟩⟨x|⊗σ_Y|x,

where 𝒳 is a finite set, p_x are probabilities. 
Let, further, Ω⊂ X (event), Ω=𝒳\Ω, p(Ω)=∑_x∈Ωp_x,  

    ρ_XE|Ω   =1/p(Ω)∑_x∈Ω p_x|x⟩⟨x|⊗ρ_E|x,
    	
    σ_XE|Ω   =1/p(Ω)∑_x∈Ω p_x|x⟩⟨x|⊗σ_E|x,


    ρ_XE   =p(Ω)ρ_XE|Ω+(1-p(Ω))ρ_XE|Ω,
    	
    σ_XE   =p(Ω)σ_XE|Ω+(1-p(Ω))σ_XE|Ω,


    D(ρ_XE|Ω,σ_XE|Ω)≤ε_1,

where D is the trace distance (for details, see Refs. <cit.>) and p(Ω)≥1-ε_2. 
Then

    D(ρ_XE,σ_XE)   =
    	p(Ω)D(ρ_XE|Ω,σ_XE|Ω)
       +
    	(1-p(Ω))D(ρ_XE|Ω,σ_XE|Ω)
       ≤(1-ε_2)ε_1+ε_2
       ≤ε_1+ε_2,

where we have used that the trace distance does not exceed unity. 
In our case 𝒳 is the set of all pairs (κ_1,e_1), Ω is the subset corresponding to the event 

    (κ_1≥κ̂_1^ l and e_1≤ê_1^ u),

ε_1=ε_ pa, ε_2=ε_ decoy, 
(<ref>) is the trace distance between the actual and the ideal final states of the protocol conditioned on the event that the statistical estimates of κ_1 and e_1 are true, 
and, finally, (<ref>) is the total trace distance between the actual and the ideal final states of the protocol.


In Ref. <cit.>, another formula relating the failure probability and trace distance is used: 
if ε is the failure probability, then the trace distance between the actual and the ideal state is bounded from above by √(ε(2-ε)), 
instead of linear formulas (<ref>) and (<ref>). 
The reason is the difference between the techniques of security proofs. 
In Ref. <cit.>, entanglement-distillation technique was assumed. 
Its final result is expressed in terms of fidelity F(ρ,σ) between the actual joint state of Alice, Bob, 
and Eve ρ and the ideal one σ. If F(ρ,σ)≥1-ε, then the trace distance is bounded by

    D(ρ,σ)≤√(1-F(ρ,σ)^2)≤√(ε(2-ε)).

In contrast, proofs of Refs. <cit.> are information-theoretic and their results are direct bounds on the trace distance 
(the leftover hash lemma is essentially the main ingredient yielding such a If we cannot estimatebound).


99
BB84
C.H. Bennet and G. Brassard,
https://researcher.watson.ibm.com/researcher/files/us-bennetc/BB84highest.pdf
in Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing Bangalore, India (IEEE, New York, 1984), p. 175.

Gisin
N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden,
http://dx.doi.org/10.1103/RevModPhys.74.145Rev. Mod. Phys. 74, 145 (2002).

Scarani
V. Scarani, H. Bechmann-Pasquinucci, N.J. Cerf, M. Dusek, N. Lütkenhaus, and M. Peev,
http://dx.doi.org/10.1103/RevModPhys.81.1301Rev. Mod. Phys. 81, 1301 (2009).

LoRev
H.-K. Lo, M. Curty, and K. Tamaki,
https://dx.doi.org/10.1038/nphoton.2014.149Nat. Photonics 8, 595 (2014).

LoRev2
E. Diamanti, H.-K. Lo, and Z. Yuan, 
https://dx.doi.org/10.1038/npjqi.2016.25npj Quant. Inf. 2, 16025 (2016).

Huttner
B. Huttner, N. Imoto, N. Gisin, and T. Mor,
http://dx.doi.org/10.1103/PhysRevA.51.1863Phys. Rev. A 51, 1863 (1995).

Brassard
G. Brassard, N. Lütkenhaus, T. Mor, and B.C. Sanders,
http://dx.doi.org/10.1103/PhysRevLett.85.1330Phys. Rev. Lett. 85, 1330 (2000).

Decoy01
W.-Y. Hwang, 
https://doi.org/10.1103/PhysRevLett.91.057901Phys. Rev. Lett. 91, 057901 (2003).

Decoy02
H.-K. Lo, X. Ma, and K. Chen, 
https://doi.org/10.1103/PhysRevLett.94.230504Phys. Rev. Lett. 94, 230504 (2005).

Decoy03
X.-B. Wang, 
http://dx.doi.org/10.1103/PhysRevLett.85.1330Phys. Rev. Lett. 94, 230503 (2005).

Decoy04
X. Ma, B. Qi, Y. Zhao, and H.-K. Lo,
https://doi.org/10.1103/PhysRevA.72.012326Phys. Rev. A 72, 012326 (2005).

Curty1
M. Curty, F. Xu, W. Cui, C.C.W. Lim, K. Tamaki, and H.-K. Lo, 
https://doi.org/10.1038/ncomms4732Nat. Commun. 5, 3732 (2014).

Curty2
C.C.W. Lim, M. Curty, N. Walenta, F. Xu, and H. Zbinden, 
https://doi.org/10.1103/PhysRevA.89.022307Phys. Rev. A 89, 022307 (2014).

Ma
Z. Zhang, Q. Zhao, M. Razavi, and X. Ma,
https://doi.org/10.1103/PhysRevA.95.012333Phys. Rev. A 95, 012333 (2017).

ZubkovSerov
A.M. Zubkov and A.A. Serov,
https://doi.org/10.1137/S0040585X97986138Theory Probab. Appl. 57, 539 (2013); http://arxiv.org/abs/1207.3838arXiv:1207.3838.

SECOQC
M. Peev et al., 
http://dx.doi.org/10.1088/1367-2630/11/7/075001New J. Phys. 11, 075001 (2009).

Gisin2
N. Walenta, A. Burg, D. Caselunghe, J. Constantin, N. Gisin, O. Guinnard, R. Houlmann, P. Junod, B. Korzh, N. Kulesza, M. Legré, 
C.C.W. Lim, T. Lunghi, L. Monat, C. Portmann, M. Soucarros, P. Trinkler, G. Trolliet, F. Vannel, and H. Zbinden,
http://dx.doi.org/10.1088/1367-2630/16/1/013047New J. Phys. 16 013047 (2014).

Fedorov
E.O. Kiktenko, A.S. Trushechkin, Y.V. Kurochkin, and A.K. Fedorov,
http://dx.doi.org/10.1088/1742-6596/741/1/012081J. Phys. Conf. Ser. 741, 012081 (2016).

Kiktenko2
E.O. Kiktenko, A.S. Trushechkin, C.C.W. Lim, Y.V. Kurochkin, and A.K. Fedorov,
https://arxiv.org/abs/1612.03673arXiv:1612.03673.

ComposPA
R. Renner and R. König,
http://dx.doi.org/10.1007/978-3-540-30576-7_22Lect. Notes Comp. Sci. 3378, 407 (2005).

WegCar
M.N. Wegman and J.L. Carter,
http://dx.doi.org/10.1016/0022-0000(81)90033-7J. Comp. Syst. Sci. 22, 265 (1981).

Krawczyk
H. Krawczyk,
http://dx.doi.org/10.1007/3-540-48658-5_15Lect. Notes Comp. Sci. 839, 129 (1994).

Krawczyk2
H. Krawczyk, 
http://dx.doi.org/10.1007/3-540-49264-X_24Lect. Notes Comp. Sci. 921, 301 (1995).

Tomamichel
M. Tomamichel and A. Leverrier,
http://arxiv.org/abs/1506.08458arXiv:1506.08458.

TomRenner
M. Tomamichel, C.C.W. Lim, N. Gisin, and R. Renner,
http://dx.doi.org/10.1038/ncomms1631Nat. Commun. 3, 634 (2012).

Compos
M. Ben-Or, M. Horodecki, D.W. Leung, D. Mayers, and J. Oppenheim,
http://dx.doi.org/10.1007/978-3-540-30576-7_21Lect. Notes Comp. Sci. 3378, 386 (2005).

Sokolov
A.S. Sokolov, A.V. Miller, A.A. Kanapin, V.E. Rodimin, A.V. Losev, A.S. Trushechkin, E.O. Kiktenko, A.K. Fedorov, V.L. Kurochkin, Y.V. Kurochkin,
https://arxiv.org/abs/1612.04168arXiv:1612.04168.

Code
E.O. Kiktenko, A.S. Trushechkin, M.N. Anufriev, N.O. Pozhar, and A.K. Fedorov,
Post-processing procedure for quantum key distribution systems (source code), https://dx.doi.org/10.5281/zenodo.200365.

Portmann
C. Portmann and R. Renner, 
https://arxiv.org/abs/1409.3525arXiv:1409.3525.

Fung
C.-H.F. Fung, X. Ma, and H.F. Chau, 
https://doi.org/110.1103/PhysRevA.81.012318Phys. Rev. A 81, 012318 (2010).

Renner
R. Renner, 
https://dx.doi.org/10.1142/S0219749908003256Int. J. Quantum Inform. 6, 1 (2008);
Security of Quantum Key Distribution,
PhD thesis, ETH Zurich; 
https://arxiv.org/abs/quant-ph/0512258arXiv:0512258 (2005).

