Finite-Key Analysis for Quantum Key Distribution with Discrete-Phase Randomization

Quantum key distribution (QKD) allows two remote parties to share information-theoretic secret keys. Many QKD protocols assume the phase of encoding state can be continuous randomized from 0 to 2π, which, however, may be questionable in the experiment. This is particularly the case in the recently proposed twin-field (TF) QKD, which has received a lot of attention since it can increase the key rate significantly and even beat some theoretical rate-loss limits. As an intuitive solution, one may introduce discrete-phase randomization instead of continuous randomization. However, a security proof for a QKD protocol with discrete-phase randomization in the finite-key region is still missing. Here, we develop a technique based on conjugate measurement and quantum state distinguishment to analyze the security in this case. Our results show that TF-QKD with a reasonable number of discrete random phases, e.g., 8 phases from {0,π/4,π/2,…,7π/4}, can achieve satisfactory performance. On the other hand, we find the finite-size effects become more notable than before, which implies that more pulses should be emit in this case. More importantly, as a the first proof for TF-QKD with discrete-phase randomization in the finite-key region, our method is also applicable in other QKD protocols.


Introduction
Quantum key distribution (QKD) [1,2], one of the most successful and mature applications in quantum information science, allows for two legitimate parties (Alice and Bob) to share information-theoretic secret keys. In theory, its security has been proved [3][4][5], while experiments towards a higher key rate [6] and longer achievable distance [7][8][9][10] have been demonstrated. Still, some large scale QKD networks are emerging [11][12][13][14]. However, owing to the inherent photon-loss in the channel, it meets a vital bottleneck that limits the communication distance and key generation rate. Specifically, some fundamental rate-loss limits [15,16] impose a restriction on any point-to-point QKD without repeaters. More precisely, the key rate R is bounded by the channel transmission probability η with the linear PLOB bound R = − log 2 (1 − η) [16]. Delightfully, M.Lucamarini et al. made a breakthrough by proposing twin-field (TF) QKD in 2018. The essential idea of TF-QKD is in code mode extracting the key bit from a single-photon click event of the measurement station located in the middle of channel, which happens with a probability proportional to √ η; thus, surpassing the linear PLOB bound becomes possible, and a so-called phase-error rate may be estimated in decoy mode [17][18][19] to monitor security. Driven by this, several

Protocol Description
Indeed, the protocol analyzed here has been depicted in Ref. [43]. For ease of understanding, we illustrate the protocol as follows.
Step 1: Alice (Bob) chooses a label from {"µ", "0", "ν"} with probabilities P µ , P O , P ν , according to the label she (he) chooses, she (he) takes one of the following actions: "µ": she (he) randomly picks an integer l A c (l B c ) from {0, 1, · · · , M − 1} with equal probability 1 M where M is an even integer. This means that the phase 2π is divided into M parts. Then, she (he) randomly chooses a key bit k a (k b ) where k a (k b ) ∈ {0, 1}. Finally, she (he) sends a pulse with a coherent state |e i( l Ac M 2π+πk a ) √ µ (|e i( l Bc M 2π+πk b ) √ µ ). "0": she (he) sends the vacumm state. "ν": she (he) randomly picks an integer l A c and l B c from {0, 1, · · · , M − 1} with equal probability 1 M where M is an even integer. This means that the phase 2π is divided into M parts. Then, she (he) sends a pulse with a coherent state |e i l Ac M 2π √ µ (|e i l Bc M 2π √ µ ). The first case is called code mode, while the other cases are decoy mode.
Step 2: Alice and Bob repeat Step 1 in total of N tot times.
Step 3: After receiving N tot pairs of pulses from Alice and Bob, interfering each pair at a beamsplitter and measuring the two outputs with his single photon detectors (SPDs), an honest Eve announces whether or not each measurement is successful. Here, 'successful' means only one SPD (left SPD or right SPD) clicks in the corresponding measurement, and if so, Eve reports the specific SPD clicked.
Step 4: For those rounds Eve announcing successful click, Alice and Bob announce the intensities they chose as well as the values of l A c and l B c . Then, Alice and Bob only retain those successful rounds in which the intensities of the coherent state they sent are same while the in-phase (l A c = l B c ) or anti-phase (|l A c − l B c | = M/2) condition is also met. Let n + 2β (n − 2β ) be the number of the retained rounds when both Alice and Bob chose the same intensity β of the coherent state and the in-phase (anti-phase) is also met. Note that we assume l A c = l B c = 0 always holds in the case of β = 0. Alice and Bob generate their sifted keys from n 2µ = n + 2µ + n − 2µ retained rounds in code mode, thus the length of sifted key bits n bit = n 2µ . Note that if it is an in-phase (anti-phase) round with right (left) SPD clicking, Bob may flip his corresponding sifted key bit.
Step 5: With all of the quantities n 2β = n + 2β + n − 2β , Alice and Bob use linear programming to obtain an upper bound on the number of phase errors(defined later) n U ph with a failure probability no more than ε; then, they can calculate the upper bound e U ph = n U ph /n bit .
Step 6: Step 6 consists of error correction and privacy amplification.
Step 6a: Alice sends H EC bits of syndrome information of her sifted key bits to Bob through an authenticated public channel. Then, Bob uses it to correct errors in his sifted keys. Alice and Bob calculate a hash of their error-corrected keys with a random universal hash function and check whether they are equal. If equal, they continue to the next step; otherwise, they abort the protocol.
Step 6b: Alice and Bob apply the privacy amplification to obtain their final secret keys. If the length of their secret key satisfies l = n bit ( where h(·) denotes the binary Shannon entropy, this protocol must be cor -correct and sec -secret with sec = √ ε + PA . Here, cor ( sec ) represents the protocol is correct (secret) with a failure probability no more than cor ( sec ). Hence, the total security parameter is tolsecure where tol = cor + sec . It is elaborated thoroughly in the widely-used universally composable security framework [45,46].

Security Proof
In this section, we present the security proof of this protocol. The main task of the security proof is to bound the information Eve holds. To accomplish this task, one can calculate a so-called phase-error rate. Firstly, we construct an equivalent virtual protocol, in which Alice and Bob prepare some entangled states between local states and traveling states, but traveling states must have the same density matrices as actual protocol in the channel. The sifted key bits can be seen as the outputs of measurement with Z-basis on local states made by Alice and Bob; then, the so-called phase-error rate is defined as the error rate for the outputs of measurement with the X-basis made by them. According to the complementarity argument [47], the phase-error rate can be used to bound Eve's information on the sifted keys. In the following, we give the virtual protocol and show how to bound the phase-error rate.

Equivalent Virtual Protocol
In our virtual protocol, Alice generates secret keys from the code mode in which she prepares the state Here, the local states of A c are encoded in photon-number states, and Alice can measure A c 's photon-number to learn the phase of sent states. Finally, we can describe the process of state preparation above with a single state, namely, where Alice's additional local ancilla A s is in the photon number states. Similarly, Bob can prepare |ψ B s B c Bb defined analogously to |ψ A s A c Aa . Though Alice (Bob) may measure A s (B s ),A c (B c ), and A(B) after or before Eve announcing her measurement results, Alice (Bob) must announce the measurement results after Eve's announcement then post-select the successful rounds. The following is a detailed illustration of our equivalent virtual protocol.
Step 1: Alice and Bob prepare a gigantic quantum state |Φ = |φ ⊗N tot = (|ψ A s A c Aa ⊗ |ψ B s B c Bb ) ⊗N tot and send all subsystems a and b to Eve through an insecure quantum channel.
Step 2: After performing an arbitrary quantum operation on all subsystems a and b from Alice and Bob, Eve announces whether it has a successful click (only one of her SPDs clicks) or not for each round. For a successful round, Eve continues to announce whether the left SPD clicks or the right SPD clicks. We use M(M) to denote the set of successful (unsuccessful) rounds.
Step 3: For those rounds in which Eve announces success, Alice and Bob jointly measure the subsystem A c (B c ) and A s (B s ) in the photon-number basis to learn whether the intensities of the coherent state they send are same or not and whether it is in-phase or anti-phase. Then, they only retain those rounds where in-phase or anti-phase is met, and they choose the same intensities. Let M s denote the set of those retained rounds, while M f denotes those rounds that are in M but not in M s .
Step 4: For these rounds in M s , Alice (Bob) measures the subsystem A c A s (B c B s ) in Fock basis to learn the phase and intensity of the coherent states she (he) sent . If the result of A s (B s ) is in state |0 A s (|0 B s ), she (he) measures subsystems A(B) in the Z basis to decide her (his) sifted key, respectively; otherwise, she (he) measures subsystem A(B) in the Z basis but does not incorporate these measurement outcomes in her (his) sifted key.
Step 5 to Step 6: Let n 2β be the number of rounds in M s satisfying that both Alice and Bob chose the intensity β. With parameters n 2β , perform the same operations as Step 5 to Step 6, respectively, in the actual protocol given in Section 2.

Estimation of Phase-Error Rate
The essential of security proof is to estimate the upper-bound of the phase-error rate e ph of the sifted keys, i.e., how many same or different outcomes Alice and Bob have if they measure A and B with X-basis hypothetically in the rounds where sifted keys are generated. Specifically, in our protocol, we define the number of the same outcomes they have as n ph , i.e., the number of phase-error events. Provided that e ph = n ph /n 2µ is bounded, one can generate the final secret key with an appropriate tol value as given in Step6.b of the actual protocol.
A detailed proof for how to estimate n ph is present in Appendix A. Here, a sketch of this proof is given.
Though analyzing the equivalent protocol, it is proven that if Alice and Bob both chose intensity β, and in-phase or anti-phase is also met, they actually prepare a mixture τ 2β , which consists of component τ j|2β , j = 0, 1, ..., M − 1. Moreover, each phase-error event is a click by some particular components of that mixture τ 2β , i.e., τ j|2β , j = 0, 2, ..., M − 2. These results imply that where n j|2β denotes the number of rounds in M s , in which Alice and Bob both chose intensity β, but τ 2β is actually τ j|2β . Meanwhile, N 0 is the set of even numbers. Now, the hypothetical value n ph is related to some experimentally observed values. However, just with these equations it is difficult to bound n ph tightly since n j|2β cannot be known directly.
On the other hand, both τ j|2µ and τ j|2ν are very close to Fock-state |j j|. Accordingly, it is intuitive to consider if there are constraints on the gap between n j|2µ and n j|2ν . Then, we developed Lemma A1 (see Appendix A for details) to bound the gap between the yields of two distinct quantum states in a non-asymptotic situation. Applying this lemma, we obtained a series of constraints on n j|2µ and n j|2ν . Finally, combined with Equation (5), an analytical upper bound of n ph (given in the end of the Appendix A) was calculated to find the upper bound of phase-error rate e U ph = n U ph /n 2µ .

Numerical Simulation
In this section, we simulate the final secret key rate with the parameters listed in Table 1. Table 1. List of parameters uesd in the numerical simulations. Here, e m is loss-independent misalignment error rate due to optical imperfect interference, p d is dark counting probability for each SPD, ξ is fiber loss constant, η d denotes detection efficiency of each SPD, f is error-correction inefficiency, and tol denotes the total security coefficient.
It is reasonable to simulate the experimentally observed values n 2µ , n 2ν and n 0 with their mean values. Let Q corr|2β be the probability of only one click from left (right) SPD when both Alice and Bob prepare coherent states with intensity β and a phase difference of 0 (π), and Q err|2β be the probability of only one click from left (right) SPD when both Alice and Bob prepare coherent states with intensity β and phase difference of π (0). Then, we have where η = 10 −0.2L 20 and L is the channel distance between Alice and Bob. Accordingly, in the simulation, we assume n 2β = N tot P 2 β 2(Q corr|2β + Q err|2β )/M for β = µ, ν. Note that n 0 = N tot P 2 O (Q corr|0 + Q err|0 ), n bit = n 2µ and e bit = Q err|2µ /(Q corr|2µ + Q err|2µ ). With these values, setting M = 8 and the failure probability of estimating phase error ε = (6M + 12)ε a = 4 × 10 −20 , one can obtain the upper-bound of phase-error rate e U ph by the linear programming given by (A41) in Appendix A. Moreover, the amount of H EC is H EC = N bit f h(e bit ), cor = 1 × 10 −10 , and PA = 1.6566 × 10 −10 , which leads to a secret key of length l = n bit (1 − h(e U ph )) − H EC − log 2 2 cor − log 2 1 4 2 PA with sec = PA + √ ε and the total security parameter tol = cor + sec = 4.6566 × 10 −10 . Finally, we numerically optimize the intensities and corresponding probabilities to maximize l in the cases of the total number of pulses is N tot = 1 × 10 17 , 1 × 10 14 , 1 × 10 13 , 1 × 10 12 . Note that because this numerical problem is very time-comsuming, these intensities and probabilities are not optimized at each distance. Additionally, we use some typical parameters instead. The simulate results (l/N tot v.s. L) are illustrated below.
As Figure 1 shows, we obtain considerable secret key rates when the total number of pulses is 10 12 , 10 13 ,10 14 or 10 17 . Through numerical simulations, it is confirmed that TF-QKD with discrete-phase randomization has satisfactory performance. On the other hand, it is verified that finite-size effects become more notable here compared with the original protocol with continuous phase randomization; it seems that one has to prepare 10 17 pulses to surpass the PLOB linear bound. This is because the statistical fluctuations in Lemma A1 are proportional to the square root of the total number of emitting pulse N tot , which leads to alarge phase-error rate e ph when n bit is not sufficiently large. Secret key rate (l/N tot ) of fully discrete TF-QKD [43]. In this figure, the key rate corresponding to the total number of pulses N tot is 1 × 10 12 , 1 × 10 13 , 1 × 10 14 , 1 × 10 17 , plotted above. Note that we set M = 8 in the simulation.

Conclusions
In real setups of TF-QKD, continuous randomization is usually realized by actively adding a random signal to a phase modulator. On the other hand, random numbers are generated discretely in most schemes. Therefore, TF-QKD with discrete-phase randomization is more practical. It is necessary to analyze the security of TF-QKD with discrete-phase randomization. Based on conjugate measurement, the security proof of a QKD protocol is to estimate the phase-error rate. Then in case of discrete-phase randomization, a critical step is knowing how to bound the gap between yields of two distinct but very close quantum states in a non-asymptotic situation. To achieve this goal, Lemma A1 is developed to find the upper bound of this gap. With the help of Lemma 1, linear programming is proposed to calculate the phase-error rate, and the key length is then straightforward. Through numerical simulations, it is confirmed that TF-QKD with discrete-phase randomization has satisfactory performance. On the other hand, we also find that more pulses should be prepared to alleviate the finite-size effects than previous protocol.
Moreover, it is worth noting that Lemma A1 is quite useful in a variety of scenarios, not just in the security proof of TF-QKD. For instance, if one considers the BB84 with discrete-phase randomization [48], the Lemma A1 can be utilized to bound the yield of single photon state, so then it is not difficult to give a relevant security proof. To summarize, we give the first security proof for TF-QKD with finite discrete-phase randomization in non-asymptotic scenarios. Although the proof is tailored for TF-QKD, the framework of this proof, i.e. Lemma A1, can be adapted in other protocols.  In this section, we show how to obtain the relation between the hypothetical phaseerror events and some experimental observations.
The main result obtained here is that each key bit is a successful click from a mixed state of τ j|2µ , j = 0, 1, ..., M − 1 prepared by Alice and Bob. More importantly, the number of phase-error events among these key bits corresponds to τ j|2µ , j = 0, 2, ..., M − 2. Therefore, if we denote the length of the raw key by n bit = n 2µ and the number of successful clicks of τ j|2µ by n j|2µ , n bit = n 2µ = ∑ M−1 j=0 n j|2µ , the number of phase-error events n ph = ∑ M−2 j=0,j∈N 0 n j|2µ must hold, where N 0 is the set of even integers. Next, a proof is present to show how to obtain this result.
Following the symbols in [49], let us consider the evolution of the gigantic quantum state |Φ = |φ ⊗N tot = (|ψ A s A c Aa ⊗ |ψ B s B c Bb ) ⊗N tot sent to Eve. After Step 2, where Eve performs her measurement on the subsystem ab, the initial quantum state is transformed tô M eve |Φ , whereM eve denotes the measurement operator of Eve. After measurement, Eve announces whether the measurement outcome is successful or not for each round. rounds finally. Before they measure the subsystem AB to generate their sifted key in Step 3, the unnormalized quantum state is given bŷ Next, in Step 4, Alice and Bob measure the subsystem A s , B s A c , B c and A, B for all rounds in M s , one by one. We use α ∈ {1, · · · , M s } to denote the different rounds in M s and ξ α to denote the measurement outcome of the α-th subsystem. What is more, M α is used to denote the associated operator. Hence, the unnormalized state before the measurement of the α-th rounds in M s is Because we are only interested in the reduced state of the α-th round in M s , we trace out the other rounds which we denote by α and obtain Next, to derive the number of phase error, we expand the quantum stateÔ s |φ aŝ and |φ ν (A7) To summarize, each key bit can be viewed as an event in which Eve announces a successful click conditioned by Alice and prepares |φ µ and measures AB with Z-basis . Since the measurement on AB made by Alice and Bob can be delayed after Eve's announcement of a successful click, the phase error can be estimated by Alice and Bob measuring AB with X-basis rather than Z-basis. To obtain the phase error of this part, we rewrite |φ µ under X-bases of AB as and θ l = l M 2π. For the purpose of clarification, we define some quantum states below: |e iθ 2µ ab = ∞ ∑ j=0 e ijθ P j|2µ |j ab (A11) and |e iθ 2µ ab,even = where |j ab = ∑ j i=0 j! 2 j i!(j−i)! |i a |j − i b and N 0 is the set of even numbers. Indeed, |j is a quantum state satisfying that the total photon-number of a and b is j. Moreover, another similar quantum state is defined below: where |j ab,even = ∑ j i=0 (−1) i j! 2 j i!(j−i)! |i a |j − i b . With these definitions, we can write the quantum states |ψ l µ,AaBb and |ψ l µ,AaBb in a more simplified way, namely |ψ l µ,AaBb = 1 2 (| + + AB (|e iθ l 2µ ab,even + |e iθ l 2µ ab,even ) + | − − AB (|e iθ l 2µ ab,even − |e iθ l 2µ ab,even ) + | + − AB (· · · ) + | − + AB (· · · )) (A15) and |ψ l µ,AaBb = 1 2 (| + + AB (|e iθ l 2µ ab,even + |e iθ l 2µ ab,even ) − | − − AB (|e iθ l 2µ ab,even − |e iθ l 2µ ab,even ) Obviously, the measurement outcome of | + + AB and | − − AB can be defined as phaseerror event. Recall the whole density matrix |φ µ φ| given in Equation (A8); we can obtain the ab part corresponding to the phase-error event, According to Equations (2.5)-(2.7) of Ref [48],ρ µ,ph can be rewritten aŝ whereP j|2µ = ∑ ∞ n=0 P j+Mn|2µ , P j|2µ is the the probability of finding j photons in a Poisson source with mean photon-number 2µ, |j 2µ = ∑ ∞ n=0 √ P j+Mn|2µ P j|2µ |j + Mn ab and |j 2µ = |j + Mn ab , and τ j|2µ = 1 2 |j 2µ ab j 2µ | + 1 2 |j 2µ ab j 2µ |.
For ease of understanding, we can easily interpret the formula ofρ µ,ph . It is easy to see thatρ µ,ph is a mixture of τ j|2µ , which consists of photon-number state |j + Mn ab , n = 0, 1, 2, ..., and the probability of finding j + Mn photons is proportional to P j+Mn|2µ . Let τ even|2µ be the normalizedρ µ,ph ; then, a phase-error event for a key bit is equivalent to a successful click announced by Eve on the condition that a mixture τ even|2µ = ∑ M−2 j=0,j∈N 0P j|2µ τ j|2µ / P even|2µ prepared by Alice and Bob, and the probability of preparing such a mixture is obviously P 2 µ P even|2µ 2/M. To find a way to estimate the number of phase errors, we can give the density matrices Alice and Bob prepared in code mode and decoy mode. If we trace out ABA c B c of the quantum state |φ µ φ|, i.e., regardless of whether the measurement outcome on AB is phase error or not, we haveρ We define τ 2µ = ∑ M−1 j=0P j|2µ τ j|2µ as the normalizedρ µ . The generation of a key bit is equivalent to a successful click announced by Eve conditioned on the premise that a mixture τ 2µ = ∑ M−1 j=0P j|2µ τ j|2µ is prepared by Alice and Bob, and the probability of preparing such a mixture is obviously P 2 µ 2/M. Now we are approaching a main result of above derivations. In the N tot rounds, Alice and Bob prepare τ 2µ with the probability P 2 µ 2/M; the number of its successful rounds is denoted by n 2µ . Of course, the key bits are generated in these rounds, thus n 2µ = n bit . Since τ 2µ is a mixture of τ j|2µ , j = 0, 1..., , M − 1, the n 2µ successful clicks are the sum of clicks by τ j|2µ , j = 0, 1, ..., M − 1. Then, n 2µ = ∑ M−1 j=0 n j|2µ holds evidently, in which n j|2µ is the number of successful clicks by τ j|2µ . Recall that the phase errors for these events are from clicks by τ even|2µ ; one can assert that the number of phase-error events n ph = ∑ M−2 j=0,j∈N 0 n j|2µ must hold. This is a main result we have so far.

Appendix A.2. The Upper Bound of the Number of Phase-Error Events
We have proved that n ph = ∑ M−2 j=0,j∈N 0 n j|2µ with the constraint n 2µ = ∑ M−1 j=0 n j|2µ . Obviously, this is not sufficient for estimating n ph tightly. Here, we resort to decoy states to obtain more constraints to bound n ph .
Similarly with the analysis of clicks byρ µ = Tr ABA c B c (|φ µ φ|), a successful click from decoy mode with intensity ν means that Alice and Bob preparê Accordingly, we also have n 2ν = ∑ M−1 j=0 n j|2ν . Here, n 2ν and n j|2ν are defined analogously to n 2µ and n j|2µ , respectively. Intuitively, n j|2µ and n j|2µ are the numbers of successful clicks for τ j|2µ and τ j|2ν respectively. Typically, µ < ν << 1 is satisfied; then both τ j|2µ and τ j|2ν are very close to the photon-number state |j ab . This implies that the gap between n j|2µ and n j|2ν can be bounded, and then we may estimate n ph = ∑ M−2 j=0,j∈N 0 n j|2µ . Indeed, with the result in appendix B of ref [48], the gap between n j|2µ and n j|2ν in the asymptotic case can be obtained. Here, we develop Lemma A1 to bound this gap in finite-key situations.
Lemma A1. If Alice prepares N tot pairs of particles A and B with the quantum state (∑ i √ P i |i A |φ i B ) ⊗N tot where i|j = δ ij , | φ i |φ j | = F ij and she sends the B part in each pair to Eve. For every round, Eve announces if the measurement is successful or unsuccessful, which is denoted by M = 1 or M = 0, respectively. Then, Alice measures the subsystem A with projectors {|i i|, i = 0, 1, 2, ...} to which quantum state she sent for the pairs that Eve announced M = 1. Let n i denote the number of yields for the quantum state |i . If P i > P j , we have that the constraints between n i and n j , say, holds with a failure probability 2ε 0 + 2ε 1 + 2ε 2 , where Proof. Since we are only interested in the statistics of n i and n j , it is not restrictive to rewrite the quantum state (∑ i √ P i |i A |φ i B ) ⊗N tot as Here, we virtually define √ P i |i A = P i − P j |i A + P j |i A and i |i A = 0, which do not change the density matrix of B; thus, have no impact on Eve's operation and statistics of n i and n j . Let n i (n i ) denote the number of detection for the quantum state |i A (|i A ) when Eve announces a successful measurement. Apparently, we know that n i = n i + n i .
Let us focus on the state { 2P j 1 √ 2 (|i A |φ i B + |j A |φ j B )} ⊗N tot , by which the relation between n i and n j can be analyzed. The essential idea is reinterpreting the detection of B to a game of Eve guessing which states |φ i B or |φ j B Alice prepared for all of the N tot trials. Specifically, we consider a virtual experiment illustrated below.
Alice prepares the quantum state { 2P j 1 √ 2 (|i A |φ i B + |j A |φ j B )} ⊗N tot ; then, she sends the B part to Eve. Eve measures each B she received. If she obtains a successful measurement, she will announce M = 1. Otherwise, she will announce M = 0. Up to now, there is no difference from the previous protocol. A critical step is that for any trial that Eve announces M = 0, Alice flips corresponding M with probability 1 2 . Finally, Alice measures all partials A locally. It is obvious that if Alice prepares two quantum states |φ i and |φ j at random, the maximal probability of Eve guessing correctly which state is prepared is With the flip operation, we can apply this maximal probability to our analysis below. In this case, we reinterpret that M = 1 (M = 0) means that Eve guessed the quantum state Alice prepared is |φ i (|φ j ), which justifies the lossless assumption. Note that this does not compromise security because as an adversary, Eve can guess in this way. In other words, we can now treat this virtual experiment as a game where Eve tries to guess whether Alice is preparing |φ i or |φ j . For each of all the trials in such a game, it is well known that Eve's maximal probability of guessing correctly is 1+ 1−F 2 ij 2 . Now, we are ready to find the relation between n i and n j by calculating how many trials in which Eve's guessing is correct. First, n i means that announcing M = 1 at first and Alice also preparing |φ i B , which of course leads to guessing correctly. Then, let N i (N j ) denote Alice preparing the state |φ i (|φ j ), which implies that N i + N j ≈ N tot 2P j . As a result, there are (N i + N j − n i − n j ) trials in which Eve announces M = 0 at first and then a random flipping operation on M follows; for every such trial, the probability of guessing correctly is obviously 1/2. Further considering the potential statistical fluctuations made by the random flipping, with a failure probability of ε 1 , the number of Eve guessing correctly in the N i + N j trials is no larger than where δ 1 = δ(N i + N j − n i − n j , 1 2 , ε 1 ) is the upper bound of the statistical fluctuation made by the random flipping of the (N i + N j − n i − n j ) trials. We let ε 1 be the probability of the amount of successful detection of quantum state |i reach n i . Hence the probability that we get the quantity denoted by Eq (A24) is ε 2 1 . On the other hand, in the N i + N j trials of guessing |φ i and |φ j prepared by Alice at random, the probability of Eve guessing correctly is no larger than [50], because the fidelity of |φ i and |φ j is F ij , Hence, one can assert that when ε 2 1 ≤ ε 2 0 , In this case, we let ε 1 = ε 0 . Hence, one can assert that with a failure probability ε 0 , . Note that because in such a guessing game, conditioned on other trials , the probability of guessing correctly for any fixed trial cannot be larger than , this lemma is applied to any attack . Furthermore, the probability of guessing correctly reaches its maximum, which equals a constant; then, the assumpution of iid holds and the Bernoulli distribution is applied to this case. However, since it is hard to calculate the statistical fluctuation, we use the Chernoff bound δ 2 to approximate it [51].
According to Equation (A25), we can obtain an upper bound of n i − n j with a failure probability ε 0 , say Similarly, if we redefine the guessing correctly as M = 1 corresponding to |φ j and M = 0 corresponding to |φ i , we have that Combining Equation (A26) and Equation (A27), we are clear that holds with a failure probability 2ε 0 . For simplicity's sake, we enlarge the R.H.S of Equation (A28). Concretely, we replace 2δ Note that these bounds of statistical fluctuations can be derived by the Chernoff bound [52]. Similarly, because of the probability that Alice sends the quantum state 1 √ 2 (|i A |φ i B + |j A |φ j B ) is 2P j , using the well-known Chernoff bound [52], we know that Combing Equation (A29) and Equation (A30), we know that holds with a failure probability 2ε 0 + 2ε 1 , where N 1 = 2N tot P j + δ(N tot , 2P j , ε 1 ) and N 2 = 2N tot P j − δ(N tot , 2P j , ε 1 ) Finally, to derive the relation between n i and n j , we have to consider the relations between n i and n i . It is easy to know that n i = P j P i n i on average since there is no way for Eve to distinguish |i and |i . Hence, using the Chernoff bound [52] again, we know that Combining Equation (A31) and Equation (A32), we can obtain the inequality Equation (A21).
In conclusion, we complete the proof.