Composable security for practical quantum key distribution with two way classical communication

We present methods to strictly calculate the finite-key effects in quantum key distribution (QKD) with error rejection through two-way classical communication (TWCC) for the sending-or-not-sending twin-field protocol. Unlike the normal QKD without TWCC, here the probability of tagging or untagging for each two-bit random group is not independent. We rigorously solve this problem by imagining a virtual set of bits where every bit is independent and identical. We show the relationship between the outcome starting from this imagined set containing independent and identical bits and the outcome starting with the real set of non-independent bits. With explicit formulas, we show that simply applying Chernoff bound in the calculation gives correct key rate, but the failure probability changes a little bit.

Here we present such a theory.
Short review and the major problem on finite-key effects with TWCC. The central idea in TWCC is to take bit-flip error rejection through random grouping and parity check which requires two-way classical communication. In the standard TWCC, Alice and Bob shall randomly group their bits of Z basis (coding basis) two by two and obtain many pairs of bits (two-bit groups). They perform parity check on each pair and discard those pairs with different parity values while keeping one bit of any pair with the same parity values of two sides. In this way, the bit-flip error rate will be effectively reduced.
However, if we apply TWCC to the decoy-state method, we need to verify the number of untagged pairs * Corresponding author: xbwang@mail.tsinghua.edu.cn containing two untagged bits. Each bits are not independent on tagging or untagging. A strict treatment of this is needed and here we present such a strict treatment. Our study show that if one simply applies Chernoff bound for this step, the key rate from the calculation is still correct, though the failure probability changes a little bit. Surely, the study for finite key effects of TWCC with strict bounds is crucially important for security of fault tolerant QKD. However, so far study towards this end is rare. Ref. [23] has studied finite key size [15][16][17][18] to bound the phase-flip errors in sending-or-not-sending (SNS) [28] protocol of twin-field (TF) QKD [14] with TWCC [29]. Here,we present a simple and rigorous study for both the upper bound of phase error rate and lower bound for the number of untagged bits after error rejection. With these, we calculate key rate strictly with the composable security.
We associate sifted bits in the real protocol mathematically with a virtual set of independent identical bits. We seek conditions with high probability when the outcome of the virtual set is worse than that of the real bits after error rejection. Based on this idea, we present mathematical formulas pointing directly to the lower bound of the number of untagged bits after error rejection in the real protocol, with an explicitly known small failure probability. Using our method, calculating the number of untagged bits after error rejection in the real bits is transformed to calculating the value with a virtual set containing independent and identical bits, and hence the strict bound values are easily obtained with existing methods, such as the Chernoff bound [30]. This paper is arranged as follows: In Sec. II, we show the theorems on how to make a strict and efficient method to estimate parameter values after error rejection. In Sec. III and Sec. IV, we show how to apply our results to the SNS protocol with the standard TWCC, OPER and AOPP methods. We then take numerical calculations on the SNS protocol with the standard TWCC method and its variants.

II. MATHEMATICAL MODEL WITH WHITE BALLS AND BLACK BALLS
We extract the question into the following mathematical model: Set U contains N balls, some of them are white and some of them are black. There are two kinds of sets. In one type of set, k of them are white and N − k of them are black. In another type of set, every ball has independent and identical probability to be white. After random grouping, at least how many pairs containing two white balls are created with a certain failure probability ? (We assume N to be an even number throughout this paper, and we shall also assume the number of elements of any subset of U to be an even number if we take random grouping to the elements in the subset.) For clarity, we list our important notations first. Notation 2.1 [k, N ]: a set containing N balls, among which there are k white balls and N − k black balls.
Notation 2.2 [p u , N ] iid : a set containing N balls, where every ball has an independent and identical probability p u to be white, and probability 1 − p u to be black. Notation 2.3 n αβ : the observed number of αβ-pairs after random grouping to the corresponding set of balls. The αβ-pair can be a ww-pair that contains two white balls or a wb−pair that contains a white ball and a black ball. We shall study the failure probability of n αβ ≥ n αβ , where n αβ is a specific bound.
Notation 2.4 ε(n αβ |U) : probability that the number of αβ-pairs is less than n αβ after random grouping to balls initially in set U.
With these notations, we now present our major mathematical conclusions below. We shall show the proofs in Appendix A.
always holds for whatever non-negative integer n ww provided that k 1 ≥ k 2 ≥ 0.
Result 2.1: If we take random pairing to set [k, N ], we can calculate the lower bound of the number of ww-pairs by the Chernoff bound or any other tail bounds assuming the independent probability of k/N for every ball, with the failure probability multiplied by 2. Mathematically: ( This result shows that we can simply regard the set [k, N ] as the set [p u = k/N, N ] iid in calculating n ww for the input set [k, N ], we only need multiply the failure probability by a factor 2. For set [p u , N ] iid , we can use the existing ways such as the Chernoff bound or the numerical bound calculating the lower bound here because every ball in set [p u , N ] iid is independent and identical. In particular More conveniently, we can relate the failure probability with the standard value from a Binomial distribution B(M, p) where there are M elements and each element has an independent and identical probability p to be "1". If we denote ξ L (x; p, M ) as the probability of obtaining less than x "1" from a binomial distribution set B(M, p), we can formulate Eq.(4) can be written in ǫ = 2ξ L (n ww ; p 2 u , N/2).
A detailed proof for the more general form of Result 2.1, Theorem 1, is given in Appendix A. But here we can show it in a simple way: Proof of Result 2.1: Given the input set [p u = k/N, N ] iid , we denote n w to be the observed number of white balls in set [k/N, N ] iid . We define as the probability for n w ≤ k and P B = nw >kp (n w ) as the probability for n w > k. Herep(n w ), as defined in Eq.(1) is the probability of observing n w white balls in set [k/N, N ] iid . Strictly [31], P A = 1/2 + δ 0 is a bit larger than 1/2 and P B = 1/2 − δ 0 is a bit smaller than 1/2. Define and κ B = nw>kp (n w )ε(n ww |[n w , N ]). Obviously, Applying Lemma 1, we have (10) because no n w inside the summation of Eq.(8) can be larger than k. By Lemma 1, every term ε(n ww |[n w , N ]) inside the summation in the right hand side of Eq.(10) has to respect ε(n ww |[n w , N ]) ≥ ε(n ww |[k, N ]). We have used the definition of P A in Eq.(7) in the second equality above.
Combining Eq.(9) and Eq.(10) we obtain which concludes We have used the fact that P A is a bit larger than 1/2 above. This completes our proof. Surely, if k is the lower bound value rather than the exact value for the number of white balls in set [k, N ], Result 2.1 still holds because of Lemma 1.
Actually, we are not limited to use the specific setting of k/N . We have more general result presented as always holds with whatever non-negative integer k u , n ww , and whatever probability value p u . Here wherep(k) is defined in Eq. (1)

III. TWCC-SNS
As an important variant of twin field QKD [14], the SNS protocol [28] together with its modified protocols [23,29,32,33] have attracted many attentions due to its large noise tolerance and high key rate. Moreover, the SNS protocol has a unique advantage that the traditional decoy-state method directly applies, which makes the finite-key analysis very efficient. The SNS protocol has been experimentally demonstrated in proof-of-principle in Ref. [34], and realized in real optical fiber with the finite-key effects taken into consideration [35,36]. Notably, the SNS protocol has been experimentally demonstrated over 509 km optical fiber [35] which is the longest secure distance of QKD in optical fiber.
Here, applying our mathematical results above, we shall take the strict bound calculation for the finite key effects on the SNS protocol with standard TWCC method (TWCC-SNS) [29] in the post data processing, which can also be applied to other protocols of decoy-state method [6][7][8][37][38][39][40][41][42], obviously. In the standard TWCC-SNS [29], for any pair, if both sides observed the same parity value no matter it is odd or even, we shall take one bit from this pair for final key distillation. We shall directly apply the method above for both the number of un-tagged bits and phase-flip errors after error rejection, as requested for final-key calculation.
After light-pulse transmission, post selection and error test in the protocol, there are n t remaining bits for Zbasis which will be used for the final key distillation. We denote these n t bits by set W . Suppose there are n 1 untagged bits in set W . We denote W u for the set of these n 1 untagged bits. By the decoy-state analysis we can verify the lower of n 1 , say, n 1 . We define the untagged pair as a pair that contains two bits from set W u after random grouping. We also name an untagged pair as a uu pair.
Suppose there are n uu untagged pairs after random grouping to all bits in set W . Regarding bits in set W u as the white balls in our Result 2.1, we can immediately lower bound the number of uu pair n uu by except for a probability ǫ twcc , where ξ L is defined in Eq.(5) We use notation U for the set of these n uu pairs, and notation V for those 2n uu untagged bits which form these n uu untagged pairs in set U . Suppose there are m ve phase errors in set V . As shown below in Remark 3.1, set V is a random subset of set W u . Therefore the upper bound value m ve can be faithfully and efficiently estimated by decoy-state analysis.
Since there is no bit-flip error for untagged bits in SNS protocol, so all those n uu untagged pairs will pass the parity check for sure and they will contribute n uu bits after discarding one bit in each pair. Our task now is to faithfully upper bound the phase-flip error rate of n uu survived untagged bits after error rejection.
There are two kinds of untagged pairs: a phase-error pair that contains one phase error only and a perfect pair that either contains 0 phase error or 2 phase errors. As shown in the prior art works [24,25], a phase error pair will produce a bit with one phase-error for sure after error rejection and the perfect pairs will not produce any phase error after error rejection step.
Given the number of phase errors m ve in set V , we have the following equation for the number of phase-error pairs where n Ie is the number of phase-error pairs and n ee is the number of pairs containing two errors. The formula above is based on the simple fact: those n ee pairs containing two phase errors have consumed 2n ee phase errors in set V , each of the remaining m ve phase errors will only be paired with a perfect bit. Immediately we have If we use this strict bound, we don't have to consider any statistical fluctuation at this step, because this is the worst-case result already, whose failure probability is 0. Though we have no way to know the exact value of m ve , we can upper bound it by m ve ≤m ve by decoy state analysis, given that set V is a random subset of set W u as shown below. Remark 3.1: We consider the following game: Clare initially keeps those bits in set W u and Bob keeps all the other bits. Clare randomly permutes all those bits privately and after that he places each bit inside a sealed envelope and passes all envelopes to Bob. Bob is not allowed to use any bit information inside the envelope. Under such a condition, in whatever way Bob may take( including the way that he uses additional bits kept by himself), he has no way to produce a subset of W u that is not a random subset of W u . Therefore, subset V above can only be a random subset of W u . The mathematical conclusion does not depend on who takes random permutation or whether to place the bits inside envelopes. It simply means that, if initially all bits in set W u are randomly permuted, no mater who creates the randomness, any subset of bits must be a random subset of W u provided that bits in the subset are chosen in a way independent of bit value or phase error information of any bits.
Numerical simulation shows that satisfactory key rate can be obtained by the simple and strict bound of Eq. (18).
Consequently, we can calculate the final key rate (per sent pulse) of SNS protocol [28] with standard TWCC by formula where N tol is the total number of pulse pairs sent by Alice and Bob, and n t1 , n t2 , n t3 are number of survived bits from different kinds of pairs,ē Ap =m ve /n uu is the upper bound of phase-flip error rate for those survived untagged bits after error rejection. They are distinguished by a pair containing one bit value 1 and one bit value 0, a pair containing two bit value 0, and a pair containing two bit value 1. E 1 , E 2 , E 3 are bit-flip errors of each pair. Tailing is the additional cost for security with finite size as shown in Ref. [19,21].
With the key rate formula (19), the protocol is ε tol = ε cor + ε sec -secure [18,19] where ε e is the failure probability of the estimation of phaseflip error rate, ε n1 is the failure probability of the estimation of the number of untagged bits in Eq. (19), ε cor is the failure probability of error correction, ε P A is the failure probability of privacy amplification, andε is the coefficient while using the chain rules of max-and minentropy [21].

IV. ODD-PARITY ERROR REJECTION AND ACTIVELY ODD-PARITY PAIRING
By the similar idea, we can strictly take the effects of finite data size to calculate the key rate of SNS protocol by other TWCC method such as the odd-parity error rejection (OPER) and the actively odd-parity pairing (AOPP) [23,29] which can further improve the key rate significantly.

A. More mathematical results with white balls and black balls
We need some additional mathematical results. The details of the proof are shown in Appendix A.
Result 4.1: After random pairing to balls in set [k, N ] that contains N balls, the following inequality always holds provided that k ≤ N/2 and p u = k/N . Here functional ξ L is defined in Eq.(5).

B. OPER-SNS
We name the SNS protocol [28] with OPER [23,29] in the post data processing as OPER-SNS. Again, we need bound values of two quantities after error rejection: the number of survived untagged bits from odd parity pairs and their phase error rate.
We can upper bound the number of phase errors in those survived untagged bits after OPER, and denote the upper bound number asM oper . This can be done by the zigzag approach [23] basing on the quantum de Finetti theorem [16,43]. For completeness, we also present the details of Zigzag approach in Appendix C of this work, in a readable way.
The number of survived untagged bits after OPER is just the number of odd parity untagged pairs n oper . Its lower bound n oper can be calculated by applying Result 4.1, with the input of values n t , n 01 , n 10 before TWCC. Here n t is the total number of effective bits in Z basis, n 01 , n 10 are lower bounds number of untagged bits with bit value 0 and 1 respectively.
Since in the zigzag approach, we only need the survived n uu untagged pairs after random grouping the n t bit that containing n 1 untagged bits. We only need to study those n uu untagged pairs in the calculation of n oper , too. Consider set Y containing those 2n uu bits that formed those n uu untagged pairs, among which there are at least n ′ 01 untagged bits 0 and n ′ 10 untagged bits 1. Let n min = min(n ′ 01 , n ′ 10 ). Relating n min to the number of white balls in Result 4.1, we have n oper ≥ n oper with a failure probability ǫ oper and The calculation details of n ′ 01 and n ′ 10 are shown in the Appendix D.
We can then calculate the key rate by: Here e ′ ph =M oper /n oper is the upper bound of the phaseflip error rate after OPER, n ot is the number of survived bits after OPER, and E OZ is the bit-flip error rate after OPER. Moreover, the result can be even better if we take active odd parity pairing which will produce more odd-parity pairs.

C. AOPP-SNS
We name the SNS protocol [28] with AOPP [23,29] in the post data processing as AOPP-SNS. In the AOPP, we shall take odd-parity grouping actively so that we can obtain more odd-parity pairs than the OPER does. We divide the odd-parity pairs in AOPP into g subsets so that the number of pairs in each subsets is smaller than the number of odd-parity pairs in OPER. The final key distillation taken on each subset has no difference from that taken in an OPER using partial of its odd-parity pairs. For simplicity, we shall only use two equal subsets here. Say, if we can obtain 2ñ g odd-parity pairs by AOPP, we divide these into two subsets, each containing n g pairs. We consider the following steps: 1) Take random grouping to bits in set W one by one, we stop grouping at the timeñ g pairs of odd-parity pairs are obtained. Supposeñ t bits are used in the random grouping whenñ g odd-parity pairs are created. Thisñ t is an observed number and therefore we don't have to consider the statistical fluctuation in our calculation. We shall simply useñ t =ñ g n 2 t 2N0N1 in our numerical simulation. 2) Take AOPP to the n t bits in set W . We obtain 2ñ g pairs and divide them into two equal subsets. Each subset containsñ g odd parity pairs which could have come from OPER. We can calculate the key rate of exch subset by the formula of Eq. (23) of OPER, in the case that we only use tildeñ t bits there.

V. NUMERICAL SIMULATION
We use the linear model to simulate the observed values with certain experiment devices and certain source parameters [21]. We assume symmetric channel and source parameters between Alice and Bob. The decoy state analysis can be used to calculate the lower bound of the number of untagged bits and the upper bound of their corresponding phase-flip error rate before TWCC. The details of decoy state analysis are shown in the Appendix B. The details of how to use data before OPER to estimate the phase errors after OPER are shown in the Appendix C. By setting the failure probability while calculating the effect of statistical fluctuation as 10 −20 , and other failure probabilities as 10 −20 , too, we achieve a security level of 1.39 × 10 −9 , 2.33 × 10 −9 and 4.66 × 10 −9 in the standard TWCC, OPER and AOPP, respectively.   Table. I. We find that with TWCC, the key rate of the SNS protocol of TF-QKD in a large distance range can by far exceed the PLOB bound [44] as a benchmark of key rate of QKD established by Pirandola, Laurenza, Ottaviani, and Banchi [44]. The absolute PLOB bound and the relative PLOB bound are the bound with whatever devices and the practical bound assuming the limited detection efficiency, respectively [44]. Figure 1 shows that in the case of finite-key size, the TWCC method can improve the maximum distance of the SNS protocol of TF-QKD by 50 km, and greatly improve the key rate at long distances. The furthest distance of those three improved method: the standard TWCC, OPER and AOPP, are the same, but in almost all distances, the key rates of AOPP method are the highest.
In the calculation of standard TWCC of Figure 1, we use the Eq. (18) to estimate the phase errors after error rejection. In Figure 2, we compare the key rates of standard TWCC with Eq. (17) and Eq. (18). The simulation results show that the key rates of those two method are almost the same in all distances.  Table. I. The absolute PLOB bound and the relative PLOB bound are the bound with whatever devices and the practical bound assuming the limited detection efficiency, respectively.

VI. CONCLUSION
In TWCC, the probability of tagging or untagging for each two-bit random groups are not independent. We rigorously solve this problem by imagining a virtual set of bits where every bit is independent and identical. We show that we can naively regard the bits in the real set to be independent and identical and get the bound values by applying Chernoff bound, with the failure probability multiplied 2. We also show how to apply our mathematical results to the SNS protocol with several TWCC methods. Numerical results show that the TWCC method can improve the maximum distance of the SNS protocol of TF-QKD by 50 km, and greatly improve the key rate at long distances. The proof of Lemma 1 is very simple. Since we take the grouping randomly, the outcome probability distribution over numbers of white-white pairs or other kind of pairs is independent of the initial positions of white balls or black balls before grouping, it only depends on the initial number of white balls. Suppose k 1 − k 2 = ∆ ≥ 0. If we randomly label any ∆ white balls in set W 1 and change them into ∆ black balls, we shall obtain a set equivalent to set W 2 for the random grouping process. Also, we may choose to obtain the random grouping result of set W 2 by this: we start with set W 1 , randomly label ∆ white balls before grouping. After grouping, we change those ∆ white balls initially labelled into the black. This shows that by whatever grouping method, a ww pair corresponding to the initial set W 2 is always a ww pair corresponding to the initial set W 1 , but the reverse is not necessarily. This means by whatever grouping method, if the outcome corresponding to initial set W 2 satisfies the condition n ww ≥ n ww , the outcome corresponding to initial set W 1 must also satisfy the same condition. This completes Lemma 1 from the ergodic viewpoint of probability.
According to Notation 2.2, set [p u , N ] iid can be regarded as the probability distribution over set [k, N ]. Explicitly, the probability on [k, N ] is: We shall use this in our proofs of Theorems.

The proof of Theorem 1
Starting from the failure probability for n ww ≥ n ww with the virtual set [p u , N ] iid , we have We have used Lemma 1 in the second inequality above. This ends the proof of Theorem 1.
For the binomial distribution B(M, p), np is its median if M p is a integer. Thus by setting p u = k u /N and combining with Lemma 1, we immediately transform Theorem 1 to Result 2.1.

The proof of Result 4.1
To proof Result 4.1, we first introduce the following lemma and theorem.
always hold for whatever non-negative integer n wb provided that 0 ≤ k 2 ≤ k 1 ≤ N/2; We shall prove Lemma 2 in two cases. For the case 0 ≤ k 2 < n wb ≤ k 1 ≤ N/2, it is easy to check hold for any n e and k that satisfied 2n e + 1 < 2k ≤ n − 1, then we obviously have ε(n wb + 1|W 2 ) ≥ ε(n wb |W 1 ). Our task now is reduced to prove Eqs. (A4) and (A5). Denote P (2l) 2k as the probability that there are 2l wbpairs after performing random grouping to set [2k, 2n], and we have where C b a is the number of combinations and A b a is the number of arrangements. It is easy to check that where x 2 = 2n e + 1 2n − (2k + 1) P (2n e + 1) 2k+1 .
With Lemma 2,we have always holds with whatever nature number n wb , k u ≤ N 2 and whatever probability value p u . Here where P = 2p u (1 − p u ) and According to the definition of ε(n wb + 1|[p u , N ] iid ), we have Here we use Lemma 2 for the second inequality. This ends the proof of Theorem 2. For the binomial distribution B(M, p), M p is its median if M p is a integer. Thus by setting p u = k u /N and combining with Lemma 2, we immediately transform Theorem 2 to Result 4.1.
For the symmetric SNS protocol, saying p az = p bz , p a0 = p b0 , µ az = µ bz and so on, the constraint (B1) is automatically satisfied. After they repeat the above process for N times, they acquire a series of data. For a time window that both them decide a signal window, it is a Z window. The one-detector heralded events in Z windows are effective events, and the corresponding bits of those effective events formed the n t -bit raw key strings, which are used to extract the final keys. For a time window that both them decide send out a pulse with intensities µ a1 and µ b1 respectively, and their phases satisfy where λ is a small positive number, it is an X window. The one-detector heralded events in X windows are effective events. And for an effective event in the X window, if cos (θ a1 − θ b1 ) > 0 and Charlie announces a click of right or cos (θ a1 − θ b1 ) < 0 and Charlie announces a click of left, it is defined as an error effective event. The effective events in X windows are used to estimate the phase-flip error rate. And λ would be taken as an optimized parameter to get the best estimation of phase-flip error rate. We denote the vacuum source, the WCS source with intensity µ a1 , µ a2 , and µ az (µ b1 , µ b2 , and µ bz ) of Alice (Bob) by ao, ax, ay and az (bo, bx, by, and bz). We simplify the symbols of two pulse sources aκ, bζ(κ, ζ = o, x, y as κζ. We denote the number of pulse pairs of source κζ sent out in the whole protocol by N κζ , and the total number of one-detector heralded events of source κζ by n κζ . We define the counting rate of source κζ by S κζ = n κζ /N κζ , and the corresponding expected value by S κζ . The Chernoff bound can be used to estimate the lower and upper bound of the expected values according to their observed values.
Then we can use the decoy-state method to calculate the lower bounds of the expected values of the counting rate of single-photon states |01 01| and |10 10|, which are [33] Then we can get the lower bound of the expected value of the counting rate of untagged photons and the lower bounds of the expected values of the the untagged bits n 1 , untagged bits 1, n 10 , and untagged bits 0, n 01 With Chernoff bound, we can estimate the lower bounds of the number of untagged bits 1, n 10 , and untagged bits 0, n 01 n 10 = ϕ L ( n 10 ), n 01 = ϕ L ( n 01 ), n 1 = n 01 + n 10 , (B9) where ϕ L (x) are the lower bound while using Chernoff bound to estimate the real value according to the expected value.
We denote the number of total pulses sent out in the X windows by N X , and the number of error effective events by m X , then we have the error counting rate of X windows Then we have where T X is the expected value of T X . Here we have used the fact that the expected value of the error rate of vacuum pulses are always 1 2 . Finally, by using Chernoff bound [30], we can get the upper bound of the number of phase-flip errors before TWCC.
Appendix C: Zigzag approach to phase error after OPER Here we review the main idea of the zigzag approach [23] on how to calculate the phase-error rate after OPER, with finite data size.
Suppose they have n t effective bits in Z basis, where N u of them are untagged bits before OPER. After random pairing, there are n uu untagged pairs, formed by M = 2n uu untagged bits. Given the lower bound number of untagged bits in Z basis, n uu can be lower bounded by our Result 2.1.
For clarity, we image to replace those N u untagged bits by N u virtual bipartite entangled single-photons shared by Alice and Bob. However, since there is no bit flip error, each photon lives in a two-dimensional space only. We shall simple call this bipartite entangled single photons by qubits.
Consider those M = 2n uu qubits that form the n uu untagged pairs. Before random pairing, they are a random subset of set from all those N u untagged qubits (recall our Remark 3.1). Therefore we can apply the quantum de Finetti theorem [16,43].
Main idea: We shall consider the mathematical properties of density operator of those M qubits, ρ. According to the quantum de Finetti theorem, there exists another density operatorρ which has a very small trace distance with ρ. We name thisρ as the associate state of ρ. Among the M qubits for stateρ, there are M − r qubits in classical mixture of states where every qubit is identical. We denote set I D for these M − r qubits. Without any loss of generallity, the density operator of qubits in set I D can be weitten in the following form: where σ p is a qubit density operator that has robability p taking a phase error and f (p) is the probability distribution on phase-error probability p. The above form of stateρ ′ means that every qubit is in a certain idependent and identical state σ p , and there is a probability distribution for all possible σ p . Although we are not able to calculate the upper bound of phase error after OPER with the input state ρ, we can upper bound the number of phase errors after OPER with the associate stateρ. This also upper bounds the number of phase errors with input ρ, with a small failure probability since the trace distance of state ρ andρ is very small. 1) For state ρ, the number of phase errors m e is upper bounded bym e , i.e.
Here in our numerical calculation simulation, we have taken p e =m e M−r as the upper bound of phase-flip error rate of set I D . As shown in the end of this subsection, the failure probability for inequality (C6) ǫ 4 is bounded by 5) Number of phase errors after OPER. Define a pair containing two qubits from set I D as an DD-pair. With step 4), we can regard every qubit in set I D has independent and identical probability p to be a phase error with constraint p ≤ p e . Taking the worst case p = p e we can upper bound m s , the number of phase error odd-parity DD-pairs by with a failure probability at most ǫ 5 , where m s is the number of phase errors after OPER and upper bounded bym s . To explicitly calculatem s , we need use the parity check operator given in Ref. [23]. In the M -qubit associate stateρ, there are r qubits not beloning set I D .
Consider the worst case for those r bits not in set I D in random pairing in OPER : they paticipate in r odd-parity pairs and each pair produces a phase error in its survived bit. We conclude the final equation for the number of phase-error untagged odd-parity pairs after OPER: 6) Eq.(C9) also makes the upper bound of phase errors m odd of survived bits from odd-parity pairs with input of state ρ, m odd ≤m s + r. (C10) with failure probability ǫ 6 . Since all operations are done in Z basis, it makes no difference if each side does the local measurement in the beginning. In this case, it is just a protocol taking random pairing on classical bits. In a protocol with pre-shared single-photon entangled states, the number of odd parity pairs are directly observed. In a real protocol with coherent states from each sides, the the lower bound of number of odd parity untagged pairs can be verified by the decoy-state method and the results in this paper.
All those ǫ i are computable. ǫ 1 is done by phase error estimation in the decoy-state method. ǫ 2 is determined by the size of the whole set of untagged bits in Z basis and the value M , number of untagged bits for those n uu untagged pairs after random pairing. Lower bound M can be verified by Result 2.1. ǫ 3 is determined by ǫ 1 and ǫ 2 while ǫ 4 is upper bounded by 2ǫ 3 in Eq.(C7). ǫ 5 is the failure probability of a binomial distribution as shown in Ref. [23]. ǫ 6 is determined by ǫ 5 and the trace distance between ρ andρ.
Proof of Eq.(C7): Consider Eq.(C1), the failure probability ǫ 4 for inequality (C6) is To upper bound this ǫ 4 , we introduce a notation first first: Notation C. 1 We denote P(m e |Ω) for the probability that the (M − r)-qubit state Ω produce more thanm e phase-flip errors. Given this, for the state of qubits in set I D , we can formulate Recall that set Y containing 2n uu bits that formed n uu survived untagged pairs after OPER. Bits in set Y are randomly chosen from the initial n 1 untagged bits which containing n 01 untagged bits 0 and n 01 untagged bits 0 before OPER. Thus n ′ 01 and n ′ 10 , the numbers of untagged bits 0 and untagged bits 1 in set Y satisfy the hypergeometric distribution Hy(n 01 , n 1 , 2n uu ) and Hy(n 10 , n 1 , 2n uu ) respectively, where Hy(K, N, n) is the hypergeometric distribution that perform n draws, without replacement, from a finite population of size N that contains K target objects. With the tail bounds of hypergeometric distribution [45], we have n ′ 01 = 2n uu ( and n ′ 10 = 2n uu ( where ξ h is the failure probability. It is easy to check the worst case of n oper is achieved in the lower bounds of n ′ 01 or n ′ 10 . Let n min = min(n ′ 01 , n ′ 10 ). If n min = n ′ 01 , relate bits 0 in set Y to white balls and bits 1 to black balls, and if n min = n ′ 10 , relate bits 1 in set Y to white balls and bits 0 to black balls, we have n oper ≥ n oper with a failure probability ǫ oper and ǫ oper = 2ξ L (n oper ; n min n uu (1 − n min 2n uu ), n uu ) (D3)