Passive Decoy-State Quantum Key Distribution with Coherent Light

Signal state preparation in quantum key distribution schemes can be realized using either an active or a passive source. Passive sources might be valuable in some scenarios; for instance, in those experimental setups operating at high transmission rates, since no externally driven element is required. Typical passive transmitters involve parametric down-conversion. More recently, it has been shown that phase-randomized coherent pulses also allow passive generation of decoy states and Bennett–Brassard 1984 (BB84) polarization signals, though the combination of both setups in a single passive source is cumbersome. In this paper, we present a complete passive transmitter that prepares decoy-state BB84 signals using coherent light. Our method employs sum-frequency generation together with linear optical components and classical photodetectors. In the asymptotic limit of an infinite long experiment, the resulting secret key rate (per pulse) is comparable to the one delivered by an active decoy-state BB84 setup with an infinite number of decoy settings.


Introduction
Quantum key distribution (QKD) is already a mature technology that can provide cryptographic systems with an unprecedented level of security [1,2]. It aims at the distribution of a secret key between two distant parties (typically called Alice and Bob) despite the technological power of an eavesdropper (Eve) who interferes with the signals. This secret key is the essential ingredient of the one-time-pad or Vernam cipher [3], the only known encryption method that can offer information-theoretic secure communications.
Most practical long-distance implementations of QKD are based on the so-called Bennett-Brassard 1984 (BB84) protocol, introduced by Bennett and Brassard in 1984 [4], in combination with the decoy-state method [5][6][7][8][9][10][11][12][13][14][15][16][17][18]. In a typical quantum optical implementation of this scheme, Alice sends to Bob phase-randomized weak coherent pulses (WCPs) with different mean photon numbers that are selected, independently and randomly, for each signal. These states can be generated using a standard semiconductor laser together with a variable optical attenuator that is controlled by a random number generator (RNG) [19][20][21][22][23]. Each light pulse may be prepared in a different polarization state, which is selected, again independently and randomly for each signal, between two mutually unbiased bases, e.g., either a linear (H [horizontal] or V [vertical]) or a circular (L [left] or R [right]) polarizations basis. For simplicity, we will first consider the case of polarization encoding. Later in this paper, we will also examine phase encoding. For that, two main experimental configurations are typically used. In the first one, Alice employs four laser diodes, one for each possible BB84 signal [24,25]. These lasers are controlled by a RNG that decides each given time which one of the four diodes is triggered. The second configuration utilizes only one laser diode in combination with a polarization modulator [26][27][28][29][30]. This modulator rotates the state of polarization of the signals depending on the output of a RNG. On the receiving side, Bob measures each incoming signal by choosing at random between two polarization analyzers, one for each possible basis. Once the quantum communication phase of the protocol is completed, Alice and Bob use an authenticated public channel to process their data and obtain a secure secret key. Importantly, the security of decoy-state QKD has been obtained both in the asymptotic regime [6,7] and in the case of finite-length keys [31,32].
Alternatively to the active signal state preparation methods described above, Alice may as well employ a passive transmitter to generate decoy-state BB84 signals. This last solution might be desirable in some scenarios; for instance, in those experimental setups operating at high transmission rates, since no RNGs are required in a passive device [33][34][35][36][37][38][39][40][41]. Passive schemes might also be more robust against certain side-channel attacks hidden in the imperfections of some optical components like, for example, optical modulators used in the active sources. If a polarization modulator (or an amplitude or phase modulator) is not properly designed, for example, it may distort some of the physical parameters of the pulses emitted by the sender depending on the particular value of the polarization setting selected. This fact could open a security loophole in the active schemes.
The working principle of a passive transmitter is rather simple. For example, Alice can use various light sources to produce different signal states that are sent through an optics network. Depending on the particular detection pattern observed in some properly located photodetectors, she can infer which signal states are actually generated. Known passive schemes rely typically on the use of a parametric down-conversion (PDC) source, where Alice and Bob passively and randomly choose which bases to measure each incoming pulse by means of a beamsplitter (BS) [40,41]. Also, Alice can exploit the photon number correlations that exist between the two output modes of a PDC source to passively generate decoy states [34]. More recently, it has been shown that phase-randomized coherent pulses are also suitable for passive preparation of decoy states [37,38] and BB84 polarization signals [42], though the combination of both setups in a single passive source is cumbersome. Intuitively speaking, Refs. [37,38,42] take advantage of the random phase of the different generated pulses to passively prepare states with either distinct photon number statistics but with the same polarization [37,38], or with different polarizations but equal intensities [42]. The preparation of phase-randomized coherent pulses could be achieved, for instance, by strongly modulating the laser diode, taking it below and above threshold [21,22].
In this article, we present a complete passive decoy-state QKD transmitter with coherent light. It shows that it is indeed possible to do state preparation for QKD in an entirely passive way using coherent states, even for BB84 signals in combination with decoy levels. Our method employs sum-frequency generation (SFG) [43][44][45][46] together with linear optical components and classical photodetectors. SFG has already exhibited its usefulness in quantum information [47][48][49][50][51][52] and device-independent QKD [53] at the single-photon level. Here we use it in the conventional non-linear optics paradigm with strong coherent light. This fact might render our proposal particularly valuable from an experimental point of view. In the asymptotic limit of an infinite long experiment, it turns out that the secret key rate (per pulse) provided by such passive scheme is similar to the one delivered by an active decoy-state BB84 setup with infinite decoy settings. Let us emphasize, however, that it is uncertain whether in practice such passive scheme could beat active transmitters or passive solutions based on a PDC source in high-speed QKD in general. Importantly, the answer will depend on various technologies.
The paper is organized as follows. In Section 2 we introduce a passive transmitter that generates decoy-state BB84 polarization signals using coherent light. Then, in Section 3 we evaluate its performance and we obtain a lower bound on the resulting secret key rate in the asymptotic regime. In Section 4 we consider the case where Alice and Bob use phase-encoding, which is more suitable to employ in combination with optical fibers than polarization encoding. Finally, Section 5 concludes the article with a summary. The paper includes as well some Appendixes with additional calculations.

Passive Decoy-State BB84 Transmitter
The basic setup is illustrated in Figure 1. Let us start considering, for simplicity, the interference of two pure coherent states of frequency w 1 , both prepared in +45 • linear polarization and with arbitrary phase relationship, | √ 2µe iθ 1 a 0 ,+45 • and | √ 2µe iθ 2 b 0 ,+45 • , at a 50 : 50 BS. The output states in modes a 1 and b 1 (see Figure 1) are given by Then, we have that the output states in modes c 1 and d 1 have the form If these two states are combined with two coherent states of frequency w 2 , | √ µe iθ 3 a 2 ,+45 • and | √ µe iθ 4 b 2 ,+45 • , in a nonlinear medium using the SFG process, the resulting output states at frequency w 3 = w 1 + w 2 , after the polarization rotation R, can be written as (see Appendix A)  Figure 1. Basic setup of a passive decoy-state BB84 QKD source with polarization encoding using phase-randomized strong coherent pulses. The mean photon number of the signal states ρ i , with i ∈ {1, . . . , 4}, can be chosen very high; for instance, ≈ 10 8 photons. BS denotes a beamsplitter, PBS represents a polarizing beamsplitter in the ±45 • linear polarization basis, such PBS transmits −45 • linear polarization and reflects +45 • linear polarization [54]. These two orthogonal linear polarizations have creation operators . F is an optical filter, R denotes a polarization rotator changing +45 • linear polarization to −45 • linear polarization, |vac represents the vacuum state, and t denotes the transmittance of a BS; it satisfies t 1.
These two beams are now re-combined at a PBS in the ±45 • linear polarization basis [54]. We obtain that the output state in mode a 3 (see Figure 1) is a coherent state of the form where ζ(θ) = 2µ(1 + cos θ), θ = θ 2 − θ 1 , φ = π + θ 1 + θ 3 + arg (1 + e iθ ), and the Fock states |n ψ are given by with |vac denoting the vacuum state and ψ = θ 4 − θ 3 . Finally, Alice sends the quantum state given by Equation (4) through a BS of transmittance t 1. Then, the output states in modes c 3 and d 3 are given by The analysis of the case where the global phase of each input signal ρ i , with i ∈ {1, . . . , 4}, is randomized and inaccessible to the eavesdropper is now straightforward. It can be solved by just integrating the signals | tζ(θ)e iφ ψ,c 3 and | (1 − t)ζ(θ)e iφ ψ,d 3 given by Equation (6) over all angles θ, φ, and ψ. In particular, we have that the output state σ in this scenario (see Figure 1) can be written as where the intensity γ(θ) is given by γ(θ) = tζ(θ). As already mentioned previously, note that the generation of phase-randomized coherent states can be achieved, for example, by using strong current modulation of the laser diode, well above and below threshold, which ensures a true random phase (unknown to the eavesdropper) for each prepared pulse [21,22]. The weak intensity signal σ in mode c 3 is suitable for QKD and Alice sends it to Bob through the quantum channel. In addition, she uses the strong intensity signal available in mode d 3 to measure both its intensity and polarization. This last measurement can be realized, for example, by means of a passive BB84 detection scheme where the basis choice is performed by a 50 : 50 BS, and on each end there is a PBS and two classical photodetectors. From the different intensities observed in each of these four photodetectors, Alice can determine both the value of the angle ψ and the total intensity of the signal. Note that, by assumption, we have that the intensity of the input states ρ i is very high.
Intuitively speaking, the working principle of the setup illustrated in Figure 1 is quite simple. In a first step, the setup passively generates in mode a 1 coherent states of random amplitude. This is done by combining two coherent states or equal amplitude but random phase at a BS. This part follows the approach proposed in [37,38] to passively prepare decoy states. Then, in a second step, the setup generates signals whose photons are randomly polarized within the X-Z plane of the Bloch sphere. For this, it first prepares two phase-randomized coherent states of the same amplitude in +45 • and −45 • linear polarization, and then interferes them at a PBS. This approach is inspired by the solution introduced in [42]. Indeed, this is the role of the interferometric part of the scheme, where the SFG process is actually used to imprint a random phase to each state. Finally, in a third step, the setup attenuates the generated signals to the single-photon level before they are sent to Bob, and it also determines both the intensity and polarization of the signals prepared.
For simplicity, let us assume for the moment that the polarization measurement is perfect, i.e., for each incoming signal it provides Alice with a precise value for the measured angle ψ, while the intensity measurement only tells her whether the measured intensity is below or above a certain threshold value Λ that satisfies 0 < Λ < 4µ(1 − t). That is, Λ is between the minimal and maximal possible values of the intensity (1 − t)ζ(θ) of the optical pulses in mode d 3 . The first intensity interval, ξ d = [0, Λ], can be associated, for instance, to the generation of a decoy state in output mode c 3 (that we shall denote as σ d ), while the second intensity interval, ξ s = [Λ, 4µ(1−t)], corresponds to the case of preparing a signal state (σ s ). Note, however, that the analysis presented in this section can be straightforwardly adapted to cover as well the case of several intensity intervals ξ i (i.e., the generation of several decoy states). Figure 2 (case A) shows a graphical representation of the intensity (1 − t)ζ(θ) in mode d 3 versus the angle θ, together with the threshold value Λ and the intensity intervals ξ d and ξ s .
The threshold angle θ Λ that satisfies (1 − t)ζ(θ Λ ) = Λ is given by In this simplified scenario, the conditional quantum states that are sent to Bob can be written as where i = {s, d}, and the probabilities p i n are given by Figure 1) versus the angle θ. Λ represents the threshold value of the classical intensity measurement, θ Λ is its associated threshold angle, and ξ d and ξ s denote the resulting intensity intervals. (Case B) Graphical representation of the valid regions for the angle ψ. These regions are marked in gray. They depend on an acceptance parameter Ω ∈ [0, π/4].
In practice, however, it is not necessary that Alice determines the value of ψ accurately and restricts herself to only those events where she actually prepares a perfect BB84 polarization state (i.e., when the angle ψ satisfies ψ ∈ {0, π/2, π, 3π/2}) [42]. Note that the probability associated with these ideal events tends to zero. Instead, it is sufficient if the polarization measurement tells her the value of ψ within a certain interval around the desired ideal values. This situation is illustrated in Figure 2 (case B), where Alice selects some valid regions (marked with gray color in the figure) for the angle ψ [42]. These regions depend on an acceptance parameter Ω ∈ [0, π/4] that we optimize. In particular, whenever the value of ψ lies within any of the valid regions, Alice considers the pulse emitted by the source as a valid signal. Otherwise, the pulse is discarded afterwards during the post-processing phase of the protocol, and it does not contribute to the key rate. The probability that a pulse is accepted, p acc , is given by There is a trade-off on the acceptance parameter Ω. A high acceptance probability p acc favors Ω ≈ 0, but this action also results in an increase of the quantum bit error rate (QBER) of the protocol. A low QBER favors Ω ≈ π/4, but then p acc ≈ 0. Note that in the limit where Ω tends to π/4 we recover the standard decoy-state BB84 protocol.

Lower Bound on the Secret Key Rate
We shall consider that Alice and Bob treat decoy and signal states separately, and they distill secret key from both of them. For that, we use the security analysis presented in [6], which combines the results provided by Gottesman-Lo-Lütkenhaus-Preskill (GLLP) in [55] (see also [56]) with the decoy-state method. It can be shown that the single-photon signals emitted by the passive source illustrated in Figure 1, averaged over the values of Alice's key bit, are basis-independent [42]. This analysis is valid for the asymptotic regime of infinitely long keys. The secret key rate formula can be written as with i = {s, d}. Here p i denotes the probability to generate a state associated to the intensity interval ξ i (i.e., p s = θ Λ /π and p d = 1 − p s ), and The parameter q is the efficiency of the protocol (q = 1/2 for the standard BB84 scheme, and q ≈ 1 for its efficient version [57]); Q i denotes the gain, i.e., the probability that Bob obtains a click in his measurement apparatus when Alice sends him a signal σ i ; f (E i ) represents the efficiency of the error correction protocol as a function of the error rate E i , typically f (E i ) ≥ 1 with Shannon limit f (E i ) = 1 [58]; Y n is the yield of an n-photon signal, i.e., the conditional probability of a detection event on Bob's side given that Alice transmits an n-photon state; e n denotes the error rate of an n-photon signal; and H(x) = −x log 2 (x) − (1 − x) log 2 (1 − x) represents the binary Shannon entropy function.
For simulation purposes, we shall consider a simple channel model in the absence of eavesdropping [6,59]; it consists of a BS whose transmittance depends on the transmission distance and on the loss coefficient of the quantum channel. That is, for simplicity, we neglect any misalignment effect in the channel. Furthermore, we assume that Bob employs an active BB84 detection setup. This model allows us to calculate the observed experimental parameters Q i and E i . These quantities are given in Appendix B. Our results, however, can also be straightforwardly applied to any other channel model or detection setup, as they depend only on the observed gain and QBER.
To evaluate the secret key rate formula given by Equation (13) we need to estimate the yields Y 0 and Y 1 , together with the single-photon error rate e 1 , by solving the following set of linear equations: For that, we shall use the procedure proposed in [38,59]. Moreover, we will assume a random background (i.e., e 0 = 1/2).
This method requires that the probabilities p i n given by Equation (10) satisfy certain conditions that we confirm numerically. The results are included in Appendix C. It is important to emphasize, however, that the estimation technique presented in [38,59] only constitutes a possible example of a finite decoy-state setting estimation procedure. In principle, many other estimation methods are also available for this purpose, such as linear programming tools [60], which might result in sharper, or for the purpose of QKD, better bounds on the considered probabilities. Key generation rate (per pulse) Figure 3. Lower bound on the secret key rate R given by Equation (12) in logarithmic scale for the passive transmitter with two intensity settings illustrated in Figure 1 (green line). For simulation purposes, we consider the following experimental parameters: the dark count rate of Bob's detectors is B = 3.2 × 10 −7 , the overall transmittance of Bob's detection apparatus is η B = 0.045, the loss coefficient of the channel is α = 0.2 dB/km, q = 1/2, and the efficiency of the error correction protocol is f (E i ) = 1.22. We further assume the channel model described in [6,59], where we neglect any misalignment effect. Otherwise, the actual secure distance will be smaller. The inset figure shows the value for the optimized parameters µt (dashed line) and Ω (solid line) in the passive setup. The optimal value for the threshold parameter Λ turns out to be constant with the distance and equal to 2µ(1 − t), i.e., the threshold angle θ Λ satisfies θ Λ = π/2. The black line represents a lower bound on R for an active asymptotic decoy-state BB84 system with infinite decoy settings [6], while the red line shows the case of a passive transmitter with infinite intensity intervals ξ i (see Appendix D).
The resulting lower bound on the secret key rate with two intensity settings is illustrated in Figure 3 (green line). In our simulation we employ the following experimental parameters: the dark count rate of Bob's detectors is B = 3.2×10 −7 , the overall transmittance of Bob's detection apparatus is η B = 0.045, and the loss coefficient of the channel is α = 0.2 dB/km. We further assume that q = 1/2, and f (E i ) = 1.22. With this configuration, it turns out that the optimal value of the parameter µt decreases with increasing distance, while the optimal value of the parameter Ω increases with the distance. A similar behavior was also observed in the passive BB84 transmitter (without decoy states) proposed in [42]. In particular, µt diminishes from ≈ 0.175 to ≈ 0.125, while Ω augments from ≈ 0.393 to ≈ 0.7. At long distances the gain of the protocol is very low and, therefore, it is important to keep both the multi-photon probability of the source (related with the parameter µt) and the intrinsic error rate of the signals sent by Alice (related with the parameter Ω) also low. Figure 3 includes as well an inset plot with the optimized parameters µt (dashed line) and Ω (solid line). The optimal value for the parameter Λ turns out to be constant with the distance; it is given by Λ = 2µ(1 − t), i.e., the threshold angle θ Λ is equal to π/2. This figure also shows a lower bound on the secret key rate for the cases of an active decoy-state BB84 system with infinite decoy settings (black line) [6], and a passive transmitter with infinite intensity intervals ξ i (red line). The cutoff points where the secret key rate drops down to zero are ≈ 181 km (passive setup with two intensity settings), ≈ 183 km (passive setup with infinite intensity settings), and ≈ 192 km (active transmitter with infinite decoy settings). From the results shown in Figure 3 we see that the performance of the passive transmitter presented in Section 2, with only two intensity settings, is similar to that of an active asymptotic setup, thus showing the practical interest of the passive scheme. The relatively small difference between the achievable secret key rates in both scenarios is due to two main factors: (a) the intrinsic error rate of the signals accepted by Alice, which is zero only in the case of an active source; and (b) the probability p acc to accept a pulse emitted by the source, which is p acc < 1 in the passive setup and p acc = 1 in the active scheme. For instance, we have that for most distances Ω ≈ 0.393, which implies p acc ≈ 0.5. This fact reduces the key rate on logarithmic scale of the passive transmitter by a factor of log 10 p acc ≈ 0.3. The additional factor of ≈ 0.45 that can be observed in Figure 3 arises mainly from the intrinsic error rate of the signals.

Phase Encoding
Similar ideas to the ones presented in Section 2 can also be used in other implementations of the decoy-state BB84 protocol with a different signal encoding. For instance, in those QKD experiments based on phase encoding, which is more suitable to use with optical fibers than polarization encoding, which is particularly relevant in the context of free-space QKD [1,2].
The basic setup is illustrated in Figure 4.  Figure 4. Basic setup of a passive decoy-state BB84 QKD source with phase encoding. The delay introduced by one arm of the interferometer is equal to half the time difference ∆t between two consecutive pulses.

Intensity & Phase monitor
Again, for simplicity, let us consider first the case where the input signals ρ i , with i ∈ {1, . . . , 4}, are pure coherent states with arbitrary phase relationship: | √ 2µe iθ 1 a 0 ,+45 • and | √ 2µe iθ 2 b 0 ,+45 • (of frequency w 1 ), and | √ µe iθ 3 a 2 ,+45 • and | √ µe iθ 4 b 2 ,+45 • (of frequency w 2 ). Let ∆t denote the time difference between two consecutive pulses generated by the sources. Then, from Section 2 we have that the signals in modes c 2 and d 2 at time instances t and t + ∆t/2 can be written as where φ = φ + θ 4 − θ 3 . Similarly, we find that the quantum states in modes c 3 and d 3 are given by, respectively, The case of phase-randomized strong coherent pulses is completely analogous to that of Section 2 and we omit it here for simplicity; it results in an uniform distribution for the angles θ, φ, and φ for both pairs of pulses given by Equation (16). The strong signals in mode d 3 are used to measure both their phases, relative to some local reference phase, and their intensities by means of an intensity and phase measurement, while Alice sends the weak signals in mode c 3 to Bob. Again, just like in the passive source with polarization encoding shown in Figure 1, Alice can now select some valid regions for the measured phases and also distinguish between different intensity settings. Then, we have that the analysis and results presented in Section 3 also apply straightforwardly to this scenario.

Conclusions
In this paper, we have introduced a complete passive transmitter for QKD that can prepare decoy-state Bennett-Brassard 1984 signal states using coherent light. Our method employs sum-frequency generation together with linear optical components and classical photodetectors. In the asymptotic limit of an infinite long experiment, we have proven that such passive scheme can provide a secret key rate (per pulse) lower but comparable to the one delivered by an active decoy-state BB84 setup with infinite decoy settings. In practice, however, it is uncertain if the passive scheme will be able to beat active transmitters or passive solutions based on PDC sources in general; the answer will depend on various technologies [63,64].
The main focus of this paper has been polarization-based realizations of the BB84 protocol, which are particularly relevant for free-space QKD. However, we have also shown that similar ideas can as well be applied to other practical scenarios with different signal encodings, like, for instance, those QKD experiments based on phase encoding, which are more suitable for use in combination with optical fibers.

Author Contributions
All authors contributed extensively to the work presented in this paper. All authors have read and approved the final manuscript.

A. Sum-Frequency Generation
For completeness, in this Appendix we include the calculations to derive Equation (3) in Section 2. Our starting point are the input states to one of the two SFG processes used in the passive transmitter illustrated in Figure 1: | µ 2 (e iθ 1 + e iθ 2 ) c 1 ,+45 • and | √ µe iθ 3 a 2 ,+45 • . Such process is described by the Hamiltonian H = ihχ(c 1 a 2 c † 2 − H.c.), where c † 2 represents the creation operator for the light wave at frequency w 3 = w 1 + w 2 [45]. The parameter χ is a coupling constant that is proportional to the second-order susceptibility χ (2) of the nonlinear material, and H.c. denotes a Hermitian conjugate. When the pump mode at frequency w 2 is kept strong and undepleted, then this mode can be typically treated classically as a complex number. With this assumption, we have that the effective Hamiltonian above can now be written as . Using the Heisenberg equation of motion, it is straightforward to obtain the following coupled-mode equations: which can be solved in terms of initial values at t = 0 to yield At the point of complete conversion, t c = π/(2 √ µχ), we obtain That is, at time t c we find that the resulting output state at frequency w 3 from the SFG process is given by

B. Gain and QBER
In this Appendix, we obtain a mathematical expression for the observed gains Q i and error rates E i , with i ∈ {s, d}, for the passive QKD transmitter with two intensity settings introduced in Section 2. For that, we employ the typical channel model in the absence of eavesdropping [6,59]; it just consists of a BS of transmittance η channel = 10 − αd 10 , where α denotes the loss coefficient of the channel measured in dB/km and d is the transmission distance. Moreover, for simplicity, we consider that Bob employs an active BB84 detection setup with two threshold detectors.
The action of Bob's measurement device can be described by two positive operator value measures (POVMs), one for each of the two BB84 polarization bases β ∈ {l, c}, with l denoting a linear polarization basis and c a circular polarization basis. Each POVM contains four elements: G β vac , G β 0 , G β 1 , and G β dc . The first one corresponds to the case of no click in the detectors, the following two POVM operators give precisely one detection click, and the last one, G β dc , gives rise to both detectors being triggered. These operators can be written as [42] Here we assume that the background rate is, to a good approximation, independent of the signal detection. Moreover, for easiness of notation, we consider only a background contribution coming from the dark count rate B of Bob's detectors and we neglect other background contributions like, for instance, stray light arising from timing pulses which are not completely filtered out in reception. The operators F β vac , F β 0 , F β 1 , and F β dc have the form (1 − η sys ) n+m |n, m β n, m|, with β ∈ {l, c}. The signals |n, m l (|n, m c ) represent the state which has n photons in the horizontal (circular left) polarization mode and m photons in the vertical (circular right) polarization mode. The parameter η sys denotes the overall transmittance of the system. This quantity can be written as η sys = η B η channel , where η B is the overall transmittance of Bob's detection apparatus, i.e., it includes the transmittance of any optical component within Bob's measurement device together with the efficiency of his detectors. In the scenario considered, it turns out that the gains Q i are independent of the actual polarization of the signals σ i,ψ given by Equation (9) and the basis β used to measure them. We obtain where p s = θ Λ /π, p d = 1 − p s , θ ξs = [0, θ Λ ], and θ ξ d = [θ Λ , π]. When θ Λ = π/2, which is the value that maximizes the secret key rate formula given by Equation (12), we have that the gains Q i can be written as where ζ = 2µt, and A ± (x) = e −x I 0,x ± L 0,x .
Here I q,z represents the modified Bessel function of the first kind, and L q,z denotes the modified Struve function. These functions are defined as [61,62] The error rates E i depend on the value of the angle ψ. By symmetry, we can restrict ourselves to evaluate the QBER in only one of the valid regions for ψ. Note that is the same in all of them. For instance, let us consider the case where ψ ∈ [7π/4 + Ω, π/4 − Ω] (which corresponds to the horizontal polarization interval), and let E i ψ denote the error rate of a signal σ i,ψ in that region. This quantity can be written as Here we have considered the typical initial post-processing step in the BB84 protocol, where double-click events are not discarded by Bob, but are randomly assigned to single-click events. Equation (27) can be further simplified as where f i j,ψ = Tr F l j σ i i,ψ . After a short calculation, we obtain when θ Λ = π/2, these expressions can be simplified as where the parameters κ ± (ψ) and ± (ψ) have the form The quantum bit error rates E i are then given by Combining Equations (28) and (30)- (32), we find that and and we solve these equations numerically.

C. Estimation procedure
The secret key rate formula given by Equation (13) can be lower bounded by where e U 1 denotes an upper bound on the single-photon error rate e 1 . Hence, for our purposes, it is enough to obtain a lower bound on the quantities p i 1 Y 1 + p i 0 Y 0 for all i ∈ {s, d}, together with e U 1 . For that, we can directly use the results obtained in [38], which we include in this Appendix for completeness. The probabilities p i n given by Equation (10) need to satisfy certain conditions that we confirm numerically. In particular, we have that where Y U 0 denotes an upper bound on the background rate Y 0 given by with e 0 = 1/2. The single-photon error rate e 1 can be upper bounded as where Y L 1 and Y L 0 represent, respectively, a lower bound on the yield Y 1 and the background rate Y 0 . These quantities are given by and To evaluate these expressions we need the statistics p i n for n = 0, 1, 2. Using Equation (10), and assuming again θ Λ = π/2, we obtain

D. Asymptotic Passive Decoy-State BB84 Transmitter
To evaluate the secret key rate formula given by Equation (12) in this scenario, we consider that p s ≈ 1, and we assume that Alice and Bob can estimate the relevant parameters Y 0 , Y 1 , and e 1 perfectly. Moreover, we use the channel and detection models introduced in Appendix B. In this situation, it turns out that the yields Y 0 and Y 1 are given by Y 0 = B (2 − B ) and Y 1 = 1 − (1 − Y 0 )(1 − η sys ).
The single-photon error rate e 1 can be calculated using Equations (28)-(32) with σ i,ψ = |1 ψ 1 ψ |. After a short calculation, we obtain The resulting lower bound on the secret key rate is illustrated in Figure 3 (red line) for the optimized parameters ζ and Ω.