Practical aspects of measurement-device-independent quantum key distribution

A novel protocol, measurement-device-independent quantum key distribution (MDI-QKD), removes all attacks from the detection system, the most vulnerable part in QKD implementations. In this paper, we present an analysis for practical aspects of MDI-QKD. To evaluate its performance, we study various error sources by developing a general system model. We find that MDI-QKD is highly practical and thus can be easily implemented with standard optical devices. Moreover, we present a simple analytical method with only two (general) decoy states for the finite decoy-state analysis. This method can be used directly by experimentalists to demonstrate MDI-QKD. By combining the system model with the finite decoy-state method, we present a general framework for the optimal choice of the intensities of the signal and decoy states. Furthermore, we consider a common situation, namely asymmetric MDI-QKD, in which the two quantum channels have different transmittances. We investigate its properties and discuss how to optimize its performance. Our work is of interest not only to experiments demonstrating MDI-QKD but also to other non-QKD experiments involving quantum interference.


Introduction
Quantum key distribution (QKD) [1][2][3] enables an unconditionally secure means of distributing secret keys between two spatially separated parties, Alice and Bob. The security of QKD has been rigorously proven based on the laws of quantum mechanics [4]. Nevertheless, owing to the imperfections in real-life implementations, a large gap between its theory and practice remains unfilled. In particular, an eavesdropper (Eve) may exploit these imperfections and launch specific attacks. This is commonly called quantum hacking. The first successful quantum hacking against a commercial QKD system was the time-shift attack [5] based on a proposal in [6]. More recently, the phase-remapping attack [7] and the detector-control attack [8] have been implemented against various practical QKD systems. Also, other attacks have appeared in the literature [9]. These results suggest that quantum hacking is a major problem for the real-life security of QKD.
To close the gap between theory and practice, a natural attempt was to characterize the specific loophole and find a countermeasure. For instance, Yuan, Dynes and Shields proposed an efficient countermeasure against the detector-control attack [10]. Once an attack is known, the prevention is usually uncomplicated. However, unanticipated attacks are most dangerous, as it is impossible to fully characterize real devices and account for all loopholes. Hence, researchers moved to the second approach-(full) device-independent QKD [11]. It requires no specification of the internal functionality of QKD devices and offers nearly perfect security. Its legitimate users (Alice and Bob) can be treated as a quasi black box by assuming no memory attacks [12]. Nevertheless, device-independent QKD is not really practical because it requires near-unity detection efficiency and generates an extremely low key rate [13]. Therefore, to our knowledge, there has been no experimental paper on device-independent QKD.
Fortunately, Lo et al [14] have recently proposed an innovative scheme-measurementdevice-independent QKD (MDI-QKD)-that removes all detector side-channel attacks, the most important security loophole in conventional QKD implementations [5,6,8,9]. As an example of a MDI-QKD scheme (see figure 1), each of Alice and Bob locally prepares phase-randomized signals (this phase randomization process can be realized using a quantum random number generator such as [15]) in the BB84 polarization states [1] and sends them to an untrusted quantum relay, Charles (or Eve). Charles is supposed to perform a Bell state measurement (BSM) and broadcast the measurement result. Since the measurement setting is only used to post-select entanglement (in an equivalent virtual protocol [14]) between Alice and Bob, it can be treated as a true black box. Hence, MDI-QKD is inherently immune to all attacks in the detection system. This is a major achievement as MDI-QKD allows legitimate users to not only perform secure quantum communications with untrusted relays 5 but also out-source the manufacturing of detectors to untrusted manufacturers.
Conceptually, the key insight of MDI-QKD is time reversal. This is in the same spirit as one-way quantum computation [16]. More precisely, MDI-QKD built on the idea of a timereversed Einstein-Podolsky-Rosen (EPR) protocol for QKD [17]. By combining the decoystate method [18] with the time-reversed EPR protocol, MDI-QKD gives both good performance and good security.
MDI-QKD is highly practical and can be implemented with standard optical components. The source can be a non-perfect single-photon source (together with the decoy-state method), such as an attenuated laser diode emitting weak coherent pulses (WCPs), and the measurement setting can be a simple BSM realized by linear optics. Hence, MDI-QKD has attracted intensive interest in the QKD community. A number of follow-up theoretical works have already been reported in [19][20][21][22][23][24][25]. Meanwhile, experimental attempts on MDI-QKD have also been made by several groups [26][27][28][29]. Nonetheless, before it can be applied in real life, it is important to address a number of practical issues. These include: (i) Modeling the errors: an implementation of MDI-QKD may involve various error sources such as the mode mismatch resulting in a non-perfect Hong-Ou-Mandel (HOM) interference [30]. Thus, the first question is: how will these errors affect the performance of MDI-QKD? 6 Or, what is the physical origin of the quantum bit error rate (QBER) in a practical implementation? (ii) Finite decoy-state protocol and finite-key analysis: as mentioned before, owing to the lack of true single-photon sources [31], QKD implementations typically use laser diodes emitting WCPs [3] and single-photon contributions are estimated by the decoy-state protocol [18]. In addition, a real QKD experiment is completed in finite time, which means that the length of the output keys is finite. Thus, the estimation of relevant parameters suffers from statistical fluctuations. This is called the finite-key effect [32]. Hence, the second question is: how can one design a practical finite decoy-state protocol and perform a finite-key analysis in MDI-QKD? (iii) Choice of intensities: an experimental implementation needs to know the optimal intensities for the signal and decoy states in order to optimize the system performance. Previously, [21,22] have independently discussed the finite decoy-state protocol. However, the high computational cost of the numerical approach proposed in [21], together with the lack of a rigorous discussion of the finite-key effect in both [21,22], makes the optimization of parameters difficult. Thus, the third question is: how can one obtain these optimal intensities? (iv) Asymmetric MDI-QKD: as shown in figure 2, in real life, it is quite common that the two channels connecting Alice and Bob to Charles have different transmittances. We call this situation asymmetric MDI-QKD. Importantly, this asymmetric scenario appeared naturally in a recent proof-of-concept experiment [26], where a tailored length of fiber was intentionally added in the short arm to balance the two channel transmittances. Since an additional loss is introduced into the system, it is unclear whether this solution is optimal. Hence, the final question is: how can one optimize the performance of this asymmetric case? Figure 2. Asymmetric MDI-QKD. The two channels connecting Alice to Charles and Bob to Charles have different transmittances. In real-life MDI-QKD, asymmetry appeared naturally in a recent proof-of-concept experiment [26].
The second question has already been discussed in [21,22,24] and solved in [33]. In this paper, we offer additional discussions on this point and answer the other questions. Our contributions are summarized below.
(i) To better understand the physical origin of the QBER, we propose generic models for various error sources. In particular, we investigate two important error sources-polarization misalignment and mode mismatch. We find that in a polarizationencoding MDI-QKD system [14,28,29], polarization misalignment is the major source contributing to the QBER and mode mismatch (in the time or frequency domain), however, does not appear to be a major problem. These results are shown in section 3. Moreover, we provide a mathematical model to simulate a MDI-QKD system. This model is a useful tool for analyzing experimental results and performing the optimization of parameters. Although this model is proposed to study MDI-QKD, it is also useful for other non-QKD experiments involving quantum interference, such as entanglement swapping [34] and linear optics quantum computing [35]. This result is shown in appendix B. (ii) A previous method to analyze MDI-QKD with a finite number of decoy states assumes that Alice and Bob can prepare a vacuum state [22]. Here, however, we present an analytical approach with two general decoy states, i.e. without the assumption of vacuum. This is particularly important for the practical implementations, as it is usually difficult to create a vacuum state in decoy-state QKD experiments [36,37]. The different intensities are usually generated with an intensity modulator, which has a finite extinction ratio (e.g. around 30 dB). Additionally, we also simulate the expected key rates numerically and thus present an optimized method with two decoy states. Ignoring for the moment the finite-key effect, experimentalists can directly use this method to obtain a rough estimation of the system performance. Section 4 contains the main results for this point. (iii) By combining the system model, the finite decoy-state protocol and the finite-key analysis of [33], we offer a general framework to determine the optimal intensities of the signal and decoy states. Notice that this framework has already been adopted and verified in the experimental demonstration reported in [29]. These results are shown in section 5. (iv) Finally, we model and evaluate the performance of an asymmetric MDI-QKD system. This allows us to study its properties and determine the experimental configuration that maximizes its secret key rate. These results are shown in section 6.

Preliminary
The secure key rate of MDI-QKD in the asymptotic case (i.e. assuming an infinite number of decoy states and signals) is given by [14] R P 1,1 where Y 1,1 Z and e 1,1 X are, respectively, the yield (i.e. the probability that Charles declares a successful event) in the rectilinear (Z ) basis and the error rate in the diagonal (X ) basis given that both Alice and Bob send single-photon states (P 1,1 Z denotes this probability in the Z basis); H 2 is the binary entropy function given by ; Q Z and E Z denote, respectively, the gain and QBER in the Z basis and f e 1 is the error correction inefficiency function. Here we use the Z basis for key generation and the X basis for testing only [38]. In practice, Q Z and E Z are directly measured in the experiment, while Y 1,1 Z and e 1,1 X can be estimated using the finite decoy-state method. Next, we introduce some additional notations. We consider one signal state and two weak decoy states for the finite decoy-state protocol. The parameter µ is the intensity (i.e. the mean photon number per optical pulse) of the signal state 7 . ν and ω are the intensities of the two decoy states, which satisfy µ > ν > ω 0. The sets {µ a , ν a , ω a } and {µ b , ν b , ω b } contain, respectively, Alice's and Bob's intensities. The sets {µ } denote the optimal intensities that maximize the key rate. L ac and t a (L bc and t b ) denote the channel distance and transmittance from Alice (Bob) to Charles. In the case of a fiber-based system, t a = 10 −αL ac /10 with α denoting the channel loss coefficient (α ≈ 0.2 dB km −1 for a standard telecom fiber). η d is the detector efficiency and Y 0 is the background rate that includes detector dark counts and other background contributions. The parameters e d , e t and e m denote, respectively, the errors associated with the polarization misalignment, the time-jitter and the total mode mismatch (see definitions below).

Practical error sources
In this section, we consider the original MDI-QKD setting [14], i.e. the symmetric case with t a = t b . The asymmetric case will be discussed in section 6. To model the practical error sources, we focus on the fiber-based polarization-encoding MDI-QKD system proposed in [14] and demonstrated in [28,29]. Notice, however, that with some modifications, our analysis can also be applied to other implementations such as free-space transmission, the phase-encoding scheme and the time-bin-encoding scheme. See also [20,25], respectively, for models of phaseencoding and time-bin-encoding schemes.
A comprehensive list of practical error sources is as follows 8 .
(ii) Mode mismatch including time-jitter, spectral mismatch and pulse-shape mismatch.
(iii) Fluctuations of the intensities (modulated by Alice and Bob) at the source.
(v) Asymmetry of the beam splitter (BS).
Here, we primarily analyze the first two error sources, i.e. polarization misalignment and mode mismatch. The other error sources present minor contributions to the QBER in practice, and are discussed in appendix A.

Polarization misalignment
Polarization misalignment (or rotation) is one of the most significant factors contributing to the QBER in not only the polarization-encoding BB84 system [1] but also the polarizationencoding MDI-QKD system. Since MDI-QKD requires two transmitting channels and one BSM (instead of one channel and a simple measurement as in the BB84 protocol), it is cumbersome to model its polarization misalignment. Here, we solve this problem by proposing a simple model in figure 1. One of the polarization BSs (PBSs) (PBS2 in figure 1) is defined as the fundamental measurement basis 9 . Three unitary operators, {U 1 , U 2 , U 3 }, are considered to model the polarization misalignment of each channel [35]. The operator U 1 (U 2 ) represents the misalignment of Alice's (Bob's) channel transmission, while U 3 models the misalignment of the other measurement setting, PBS1.
For simplicity, we consider a simplified model with a two-dimensional unitary matrix 10 (see section I.A. of [35]) where k = 1, 2, 3 and θ k (polarization-rotation angle) is in the range of [−π,π ]. For each value of k, we define the polarization misalignment error e k = sin 2 θ k and the total error e d = 3 k=1 e k . Note that e d is equivalent to the systematic QBER in a polarization-encoding BB84 system.
From the model of figure 1, we can analyze the effect of polarization misalignment by evaluating the secure key rate given by equation (1). See appendix B for details. By using the practical parameters listed in table 1, we perform a numerical simulation of the asymptotic key rates for different values of polarization misalignment, e d . The result is shown in figure 3. In this simulation, we temporarily ignore mode mismatch (i.e., set e m = 0 in table 1) and make two practical assumptions for the polarization misalignment: (a) each polarization-rotation angle, θ k , follows a Gaussian distribution with a standard deviation of θ std k = arcsin( √ e k ); and (b) the probability distribution of e k is selected as e 1 = e 2 = 0.475e d and e 3 = 0.05e d . 11 Figure 3 shows 9 Although we use PBS2 as the reference basis, the method is also applicable to other reference bases such as PBS1. 10 That is, if we denote the two incoming modes in the horizontal and vertical polarization by the creation operators a † h and a † v , and the outgoing modes by b † h and b † v , then the unitary operator yields an evolution of the form This unitary matrix is a simple form rather than the general one (see section I.A in [35]). Nonetheless, we believe that the result for a more general unitary transformation will be similar to our simulation results. 11 Two remarks for the distribution of the three unitary operators: (a) we assume that the two channel transmissions, i.e. U 1 and U 2 , introduce much larger polarization misalignments than the other measurement basis, U 3 (PBS1 in figure 1), because PBS1 is located in Charles's local station and can be carefully aligned (in principle). Hence, we choose e 1 = e 2 = 0.475e d and e 3 = 0.05e d . (b) Notice that the simulation result is more or less independent of the distribution of e k . Table 1. List of practical parameters for all numerical simulations. These experimental parameters, including the detection efficiency η d , the total misalignment error e d and the background rate Y 0 , are from the 144 km QKD experiment reported in [39]. Since two SPDs are used in [39], the background rate of each SPD here is roughly half of the value there. We assume that the four SPDs in MDI-QKD (see figure 1) have identical η d and Y 0 . The parameter e m is the total mode mismatch that is quantified from the experimental values of Tang et al [29].
14.5% 1.5% 6.02 × 10 −6 1.16 2%   figure 1, we incorporate the polarization misalignment into the derivation of the asymptotic key rate given by equation (1). We find that MDI-QKD is robust against practical errors due to polarization misalignment. that a polarization-encoding system can tolerate up to about 6.7% polarization misalignment at 0 km, while at 120 km it can only tolerate up to 5% misalignment. It also shows that MDI-QKD is moderately robust to errors due to polarization misalignment.

Mode mismatch
We primarily use the model of mode mismatch in time domain, called time-jitter 12 , to discuss our method. This model is shown in  Alice's state is defined as the reference basis, while Bob's state is a superposition of Alice's fundamental mode |T a and the orthogonal mode |T a (see equation (3)).
where |T a is the orthogonal time mode of |T a , β = √ e t , α = √ 1 − e t , and e t is defined as the time-jitter that represents the probability of Alice's state not overlapping with that of Bob 13 .
This model is a very general method that can be used to study the mode mismatch problem in other domains for a variety of quantum optics experiments involving quantum interference. For instance, a similar discussion can be applied to the spectral (wavelength) mismatch if we write equation (3) in the frequency domain. One can also refer to [40] for a general discussion about the spectral mismatch. Considering equation (3) in the form of Alice's and Bob's pulse shapes, we can also analyze the pulse-shape mismatch. Here we define the total mode mismatch in all domains as e m .
Next, let us discuss how e m affects the key rate given by equation (1). As illustrated in figure 1, the overlapping modes between Alice's and Bob's pulses experience a HOM interference at the BS, while the non-overlapping modes transmit through the BS without interference. Assuming that η d Y 0 and ignoring the polarization misalignment for the moment, we find that the mode mismatch only affects the gains and the error rates in the X basis rather than those in the Z basis 14 . Hence, in equation (1), e m mainly affects e 1,1 X . In practice, e 1,1 X can be estimated from the finite decoy-state protocol, i.e. from the gains (Q X ) and QBERs (E X ) in the X basis. Similar to the analysis of the polarization misalignment in section 3.1, we can incorporate e m into the derivations of Q X and E X following the method of appendix B. 15 Using the parameters of table 1, we simulate the asymptotic key rates for different values of e m . The results are shown in figure 5. In this simulation, we temporarily ignore polarization misalignment (i.e. we set e d = 0) and only focus on mode mismatch. At 0 km, we find that the system can tolerate up to 80% mode mismatch and at 120 km, the tolerable value is about 50%. Mode mismatch e m Asymptotic key rate (per pulse) 0km 60km 120km Figure 5. Mode mismatch tolerance. In the asymptotic case, a polarizationencoding MDI-QKD system can tolerate up to 80% mode mismatch at 0 km. Mode mismatch does not appear to be a major problem in a polarizationencoding implementation of MDI-QKD.
Hence, a polarization-encoding MDI-QKD system is less sensitive to mode mismatch than to polarization misalignment 16 . Notice also that we have quantified the value of e m (see table 1) by using the experimental parameters from [29] and find that e m is usually small in practice (e.g. below 5%). Therefore, mode mismatch does not appear to be a major problem in a MDI-QKD implementation.

Finite decoy-state protocol with two general decoy states
In a MDI-QKD implementation, by performing the measurements for the different intensities used by Alice and Bob, we can obtain [14] where q a (q b ) denotes Alice's (Bob's) intensity setting, Q ) denotes the gain (QBER) in the Z (X ) basis with the intensity pair {q a , q b }, and Y n,m Z (e n,m X ) denotes the yield (error rate) given that Alice and Bob send respectively an n-photon and m-photon pulse. Here the goal of the finite decoy-state protocol is to estimate Y 1,1 Z and e 1,1 X (used to generate a secure key) from  (7) for the other case. Ignoring the finite-key effect, these results can be directly used by experimentalists to obtain an estimation of the expected system performance.
the set of linear equations given by equations (4) and (5) using different intensity settings 17 . More specifically, we estimate a lower bound for Y 1,1 Z and an upper bound for e 1,1 X . We denote these two bounds, respectively, as Y 1,1 Z ,L and e 1,1 X,U . The general approach for the finite decoy-state protocol has been discussed in [33]. In this section, however, we present a much simpler analytical method with only two decoy states. The final results are summarized in table 2. They can be directly used by experimentalists (without knowing the details of Curty et al [33]) to obtain a rough estimation of the expected system performance. Notice that our notations are different from [33] in that we primarily estimate the probabilities in the case of an infinite number of signals, while [33] focuses on the estimation of counts by incorporating the finite-key effect. Now, let us start to discuss this two decoy-state protocol. As mentioned before, the intensities of the signal and decoy states satisfy µ > ν > ω and our protocol is applicable to either ω = 0 or ω = 0. The key method to estimate Y 1,1 Z ,L from equation (4) can be divided into two steps: (i) Cancel out the terms Y 0m Z and Y n0 Z using Gaussian elimination. (ii) Cancel out either the term Y 12 Z or Y 21 Z depending on the intensity values selected in the first step.
For the first step, we choose intensity pairs from {µ a , ω a , µ b , ω b } and {ν a , ω a , ν b , ω b }, 18 and generate two quantities Q M1 Z and Q M2 Z given by 17 For one signal state and two decoy states (q a ∈ {µ a , ν a , ω a } and q b ∈ {µ b , ν b , ω b }), Y 1,1 Z and e 1,1 X can be estimated from the linear equations for nine intensity pairs. 18 According to Curty et al [33], it is also possible for other two combinations of intensities: (i) choosing intensity pairs from {µ a , ν a , µ b , ν b } and {ν a , ω a , ν b , ω b }, substituting ω with ν for Q M2 Z in equation (6) and then performing similar calculations; (ii) choosing intensity pairs from {µ a , ν a , µ b , ν b } and {µ a , ω a , µ b , ω b }, substituting ω with ν for Q M2 Z and substituting ν with µ for Q M1 Z in equation (6) and performing similar calculations. Here we numerically found that the optimal intensity choice is to choose from {µ a , ω a , µ b , ω b } and {ν a , ω a , ν b , ω b }.
To cancel out Y 12 Z or Y 21 Z , we consider two cases.
Case 2. ( µ a +ω a ν a +ω a > µ b +ω b ν b +ω b ) we cancel out Y 21 Z using the same method as in case 1 and derive Y 1,1 Similarly, the strategy to estimate e 1,1 X,U from equation (5) requires to cancel out Y 0,m X e 0,m X and Y n,0 X e n,0 X . Thus, we choose intensity pairs from {ν a , ω a , ν b , ω b } 19 and derive e 1,1 X,L can be estimated using a similar method to that for Y 1,1 Z ,L . 20 The final equations are summarized in table 2.

Optimal choice of intensities
In this section, we develop a general framework to choose the optimal intensity values for the signal and decoy states. This framework is shown in figure 6, and is composed of four steps.
(i) Quantify the parameters and errors of the system. For simulation purposes, we will consider the parameters shown in table 1. (ii) Model the system using the techniques presented in section 3. A complete model for a polarization-encoding MDI-QKD can be found in appendix B. (iii) Implement the finite decoy-state protocol. For this, we will consider the analytical method with two decoy states introduced in section 4. In the simulation, for the weakest decoy state ω, we set its minimum value at 5 × 10 −4 (per pulse) 21 . (iv) Apply the finite-key analysis. Here, we employ the rigorous finite-key analysis of [33] and consider a total number of signals N = 10 14 22 together with a security bound of = 10 −10 . 19 Similar to the estimation of Y 11 Z L according to Curty et al [33], it is also possible for other two combinations, i.e. {µ a , ν a , µ b , ν b } or {µ a , ω a , µ b , ω b }. We numerically found that the optimal choice is to choose from {ν a , ω a , ν b , ω b }. 20 In theory Y 11 X = Y 11 Z . Thus we can decide to implement the standard decoy-state method only in the Z basis and estimate Y 11 X from Y 11 Z while in the X basis we only implement the decoy states instead of the signal state. The advantage of such an implementation is to increase the key rate. See also [22] for a similar discussion. 21 We assume that the intensity of the signal state is about 0.5 and the maximum extinction ratio of a practical intensity modulator is around 30 dB [36,37]. Thus, the lowest intensity that can be modulated is 5 × 10 −4 . 22 The number of signals in the X (or Z ) basis and the distribution of the signals over the signal and decoy states are both optimized numerically to maximize the key rate. Step 1 is to quantify the parameters and errors of the system (see table 1 for some representative values).
Step 2 is to model the system, i.e. derive the gain and QBER by incorporating the practical error sources (see appendix B for the case of a polarization based system).
Step 3 is to implement the finite decoy-state protocol (see section 4).
Step 4 is to apply the finite-key analysis [33].
Step 5 is to perform the numerical optimization to get the optimal intensities as well as other parameters such as the optimal selection for the probabilities of different intensity settings.
(v) Perform the numerical optimization. In our simulation, we use a MATLAB program to maximize the secure key rate and thus obtain the optimal parameters under different channel transmittances.
Based on this framework, the optimal intensities that maximize the key rate at different transmission distances are shown in figure 7. Notice also that our approach has already been applied to the experimental demonstration reported in [29], where the polarization misalignment is around 0.7% and the total mode mismatch is below 2%. Owing to the low operation rate there, the value of ω is set to 0.01. The optimal intensities in this scenario are µ

Asymmetric measurement-device-independent quantum key distribution (MDI-QKD)
A schematic diagram of the asymmetric MDI-QKD is shown in figure 2. Note that this asymmetric scenario appeared naturally in a recent field-test experiment performed in Calgary [26]. Another concrete illustration can be found at the Tokyo QKD network [41], in which the asymmetric case occurs if Koganei-1 (Alice) and Koganei-3 (Bob) use Koganei-2 (Charles) as the quantum relay to perform MDI-QKD, where the two fiber links are, respectively, 90 and 1 km. Here we define a parameter x to quantify the ratio of the two channel transmittances, i.e. x = t a /t b . In the Calgary's system, x = 0.752, while in the Tokyo QKD network x = 0.017. Here we use the method described in section 4 for the finite decoy-state protocol and that of Curty et al [33] for the finite-key analysis. For this, we consider a total number of signals N = 10 14 together with a security bound of = 10 −10 . The non-smooth behaviors in the figure are mainly due to the lack of numerical accuracy.

Problem identification
The main question here is how to choose the optimal intensities in this asymmetric situation. In the asymptotic case, these optimal intensities refer to the two signal states µ with both in O(1). If we ignore the system imperfections such as background counts and other practical errors, the error rates (e 1,1 X and E Z in equation (1)) will be zero, while P 1,1 Z Y 1,1 Z can be maximized with µ opt a = µ opt b = 1 (see appendix B.1 for the details). However, in practice, it is inevitable to have some practical errors such as the polarization misalignment discussed above. A relatively large intensity in the short channel will significantly increase the QBER due to the misalignment. Moreover, owing to the intensity mismatch on Charles's side (µ opt a t a = µ opt b t b ), the quantum interference known as the HOM dip, will be imperfect. As a consequence, this option leads to a relatively large QBER, which decreases the key rate due to the cost of error correction.
To minimize the QBER, a second option is to choose µ opt a t a = µ opt b t b regardless of x. We denote this situation as the symmetric choice (indicated by symmetry in figure 8 and table 3). An equivalent implementation scheme for this option is to add a tailored length of fiber in the local station of the sender with the short channel transmission (i.e. Bob in figure 2) in order to balance the two channel transmittances. In fact, such a scheme was recently implemented in a proof-of-principle MDI-QKD experiment [26]. However, when x is far from 1, to satisfy µ a t a = µ b t b , either µ a or µ b needs to be relatively small. Hence, we cannot derive good bounds for P 1,1 Z Y 1,1 Z and e 1,1 X . In particular, the increase of e 1,1 X results in the decrease of the key rate due to the cost of privacy amplification.  figure), we set µ a t a = µ b t b , while in the optimal choice (optimum in figure), we non-trivially determine the optimal intensities by numerical simulation. The red curves are evaluated by the two decoy-state protocol (section 4) combined with the finite-key analysis of Curty et al [33]. Note that in each curve, all the intensities of the signal and decoy states are optimized by maximizing the key rate. On average, the key rate with the optimal choice is around 80% larger than that with the symmetric choice in both asymptotic and two decoy-state cases. Table 3. Optimal intensities of an asymmetric MDI-QKD system. The channel mismatch is fixed at x = 0.1 and thus L ac = {50, 60, 70 km}. In the asymptotic case, the ratio µ In summary, we find that both of the above two options are sub-optimal. We present the optimal choice below.

Summary of results
The optimal choice (indicated by optimum in figure 8 and table 3) that maximizes the key rate can be determined from numerical optimizations. Here we perform such optimizations and also analyze the properties of asymmetric MDI-QKD. Our main results are: (i) In the asymptotic case, the optimal choice for µ a and µ b does not always satisfy µ opt a t a = µ (ii) In an asymmetric system with x = 0.1 (50 km length difference for two standard fiber links), the advantage of the optimal choice is shown in figure 8, where the key rate with the optimal choice is around 80% larger than that with the symmetric choice in both asymptotic and practical cases 23 . We remark that when x is far from 1, this advantage is more significant. For instance, with x = 0.01 (100 km length difference), the key rate with the optimal choice is about 150% larger than that with the symmetric choice. (iii) In the asymptotic case, at a short distance where background counts can be ignored: µ opt a and µ opt b are only determined by x instead of t a or t b (see the optimal intensities in table 3 and theorem 1 in appendix C); assuming a fixed x, µ opt a and µ opt b can be analytically derived and the optimal key rate is quadratically proportional to t b (see appendix C).
Finally, notice that the channel transmittance ratio in Calgary's asymmetric system is near 1 (x = 0.752), hence the optimal choice can slightly improve the key rate compared to the symmetric choice (around 2% improvement). However, in Tokyo's asymmetric system (x = 0.017), the optimal choice can significantly improve the key rate by over 130%.

Discussion and conclusion
A key assumption in MDI-QKD [14] is that Alice and Bob trust their devices for the state preparation, i.e. they can generate ideal quantum states in the BB84 protocol. One approach to remove this assumption is to quantify the imperfections in the state preparation part and thus include them into the security proofs [19]. We believe that this assumption is practical because Alice's and Bob's quantum states are prepared by themselves and thus can be experimentally verified in a fully protected laboratory environment outside of Eve's interference. For instance, based on an earlier proposal [42], Lim et al [43] have introduced another interesting scheme in which each of Alice and Bob uses an entangled photon source (instead of WCPs) and quantifies the state-preparation imperfections via random sampling. That is, Alice and Bob randomly sample parts of their prepared states and perform a local Bell test on these samples. Such a scheme is very promising, as it is in principle a fully device-independent approach. It can be applied in short-distance communications.
In conclusion, we have presented an analysis for practical aspects of MDI-QKD. To understand the physical origin of the QBER, we have investigated various practical error sources by developing a general system model. In a polarization-encoding MDI-QKD system, polarization misalignment is the major source contributing to the QBER. Hence, in practice, an efficient polarization management scheme such as polarization feedback control [28,44] can significantly improve the polarization stabilization and thus generate a higher key rate. We have also discussed a simple analytical method for the finite decoy-state analysis, which can be directly used by experimentalists to demonstrate MDI-QKD. In addition, by combining the system model with the finite decoy-state method, we have presented a general framework for the optimal intensities of the signal and decoy states. Furthermore, we have studied the properties of the asymmetric MDI-QKD protocol and discussed how to optimize its performance. Our work is relevant to both QKD and general experiments on quantum interference. Wavelength dependence of a fiber-based beam splitter. If the laser wavelength is 1542 nm [29], the BS ratio is 0.5007, which introduces negligible QBER (below 0.01%) in a typical MDI-QKD system. efficiency η d and a background rate Y 0 . Note, however, that if this condition is not satisfied (i.e. there is some detection efficiency mismatch) our system model can be adapted to take care also of this case.
All the simulations reported in the main text already consider a background rate of Y 0 = 6.02 × 10 −6 (see table 1). Figure A.1 simulates more general cases of the asymptotic key rates at different background count rates. At 0 km, the MDI-QKD system can tolerate up to 10 −3 (per pulse) background counts.
We define the following notations:

B.2.1. Derivation of Q H H Z .
First, both Alice and Bob encode their states in the H mode (symmetric to V mode). We assume that U 1 and U 2 (see equation (2)) rotate the polarization in the same direction, i.e. θ 1 θ 2 > 0. The discussion regarding rotation in the opposite direction (i.e. θ 1 θ 2 < 0) is in B.2.4.
In Charles's laboratory, after the BS and PBS (see figure 1), the optical intensities received by each SPD are given by Here, to simplify equation (B.2.1), we ignore background counts, i.e. Y 0 = 0, and use a second order approximation (as both β and γ are typically on the order of 0.01) such that then, equation (B.2.1) can be estimated as  V (H)). We also assume θ 1 θ 2 > 0. At Charles's side, the optical intensities received by each SPD are given by The detection probability of each SPD is described by equation (B.8) Therefore, Q H V Z is given by To simplify equation (B.8) we once again ignore the background counts and take a second order approximation. Equation (B.8) can be estimated as and Q H V Z is given by  (1). If we ignore background counts and take the second order approximation from equations (B.6), (B.10), Q Z and E Z can be written as 4Q Z . (B.13)

B.2.4. Q Z and E Z with opposite rotation angle.
When U 1 and U 2 rotate the polarization in the opposite direction, i.e. θ 1 θ 2 < 0, equation (B.2) changes to Proof. when Y 0 is ignored, e 1,1 X and P 1,1 Y 1,1 Z are given by (see equation (B.1)) , If we take the second order approximation, Q Z and E Z are estimated as (see equation (B.13)) , ] .
(C.1) By combining the above two equations with equation (1), the overall key rate can be written as where E Z is given by equation (C.1) and is also a function of (x, µ a , µ b ). Therefore, optimizing R est is equivalent to maximizing G(x, µ a , µ b ) and the optimal values, µ opt a and µ opt b , are only determined by x. Under a fixed x, the optimal key rate is quadratically proportional to t b . For a given x, the maximization of G(x, µ a , µ b ) can be done by calculating the derivatives over µ a and µ b and verified using the Jacobian matrix.

C.2. Properties of asymmetric MDI-QKD
We numerically study the properties of an asymmetric MDI-QKD system. In our simulations below, the asymptotic key rate, denoted by R rig , is rigorously calculated from the key rate formula given by equation (1) in which each term is shown in appendix B. R est denotes the estimated key rate from equation (C.2). The practical parameters are listed in table 1. We used the method of Curty et al [33] for the finite-key analysis.
Firstly, figure C.1 simulates the key rates of R rig and R est at different channel lengths. For short distances (i.e. total length L ac + L bc < 100 km), the overlap between R est and R rig demonstrates the accuracy of our estimation model of equation (C.2). Therefore, in the short distance range, we could focus on R est to understand the behaviors of the key rate. Moreover, from the curve of L bc = 1 m, we have that this asymmetric system can tolerate up to x = 0.004 (120 km length difference for standard fiber links).
Secondly Asymptotic key rates of R rig and R est . R rig and R est denote, respectively, the rigorous key rate (equation (1)) and the estimated key rate (equation (C.2)). At short distances, the overlap between R rig and R est demonstrates the accuracy of our estimation model, while at long distances, background counts affect its accuracy. An asymmetric system can tolerate a maximal channel mismatch of x = 0.004 (120 km length difference for two standard fiber links).   (see table 3 for some representative values). The weakest decoy state ω is set to 5 × 10 −4 . (i) Solid curves are the asymptotic keys: at short distances (L bc +L ac < 120 km), the maximal G(x, µ a , µ b ) is fixed with a fixed x (see equation (C.3)). Taking the logarithm with base 10 of R est and writing t b = 10 −αL bc , equation (C.2) can be expressed as log 10 R est = −2αL bc + log 10 η 2 d G(x, µ a , µ b ) 2 . (C.4) Hence, the scaling behavior between the logarithm (base 10) of the key rate and the channel distance is linear, which can be seen in the figure. Here, α = 0.2 dB km −1 (standard fiber link) results in a slope of −0.4. (ii) Dotted curves are the two decoy-state key rates with the finite-key analysis: we consider a total number of signals N = 10 14 and a security bound of = 10 −10 ; for the dotted curve with x = 0.1, the optimal intensities satisfy µ a /µ b ≈ ν a /ν b ≈ 7, which means that the ratios for the optimal µ and ν are roughly the same and this ratio is mainly determined by x. Even taking the finite-key effect into account, the system can still tolerate a total fiber link of 110 km.