Since the BB84 protocol was proposed in 1984 [1], quantum key distribution (QKD) has been studied for so many years in both theories and experiments [2–6]. The decoy-state BB84 protocol [7–9] was widely used in the experiments [10–14] and QKD networks [15–17] in which the decoy-state method can ensure the security of QKD with imperfect single-photon sources. Recently, an integrated space-to-ground quantum communication network over 4600 km was demonstrated by applying the decoy-state BB84 protocol [18]. But, in principle, the detectors in the BB84 protocol could be hacked by an eavesdropper due to the imperfections of the detectors [19,20]. Although there are some defense strategies against known attacks, we need a more robust method to protect the security with imperfect detectors.

Based on the virtual entanglement swapping, measurement-device-independent (MDI)-QKD protocol [21,22] can repair all the detection side vulnerabilities. The three-intensity MDI-QKD protocol [23–25] can ensure the security with both imperfect single-photon sources and detectors, but the key rate is pretty low. Many improved schemes were proposed to increase the key rate [26–29]. Among all those, the four-intensity MDI-QKD protocol [29] can improve the key rate by several orders of magnitude and becomes the mainstream of MDI-QKD protocol. The four-intensity MDI-QKD protocol has been applied to the experiments of long-distance MDI-QKD [30], free-space MDI-QKD [31], chip-based MDI-QKD [32–34], high-speed MDI-QKD [35], and so on [36,37]. Based on the four-intensity MDI-QKD protocol [29], we proposed a double-scanning method [38], which can further improve the key rate by up to 280% in typical experiment conditions. The double-scanning method [38] with four-intensity MDI-QKD protocol has been applied in a recent experiment [39].

Recently, based on single-photon interference, twin-field (TF)-QKD [40] was proposed. The TF-QKD can raise the key rate from the linear scale to square root scale of channel transmittance and break the PLOB bound [41], the key rate limit of repeaterless QKD. TF-QKD protocol and its variants [42–45] have been widely studied in theories [46–51] and experiments [52–57]. Specially, sending-or-not-sending (SNS) TF-QKD [42] has been realized in the 428 km field experiment [58], the 511 km field experiment [59], and the 605 km laboratory experiment [60], which are the farthest field experiments and laboratory experiment to date.

One significant technique in TF QKD protocols is phase post-selection, which can reduce the phase-error or bit-error in the interference. In this paper, we propose a modified MDI-QKD protocol with phase post-selection to improve the key rate by reducing the estimated phase-error rate. The paper is arranged as follows. We first introduce the main idea of our modified protocol and prove its security. Then we show some numerical results to compare the modified protocol with other protocols. The paper is ended with concluding remarks.

Based on the decoy-state MDI-QKD protocol, we propose a modified protocol with phase post-selection. We assume Alice and Bob take the weak coherent state (WCS) sources to encode the quantum signals. The state of a WCS pulse with intensity $\mu$ and phase $\theta$ is denoted by $$|e^{i\theta }\sqrt{\mu }⟩=\sum _{m=0}^{\infty }\frac{e^{-\mu /2}{e}^{im\theta }{\sqrt{\mu }}^m}{\sqrt{m!}}|m⟩,$$(1)where $|m⟩$ is the $m$-photon state.

In the $j$th time window, Alice (Bob) sends out a strong reference pulse followed by a signal pulse in state $|e^{i({\theta }_{aj}+{\gamma }_{aj})}\sqrt{{\mu }_a}⟩(|e^{i({\theta }_{bj}+{\gamma }_{bj})}\sqrt{{\mu }_b}⟩)$ to the untrusted third-party Charlie, where ${\gamma }_{aj}$ and ${\gamma }_{bj}$ represent the public phase related to the strong reference pulse, and ${\theta }_{aj}$ and ${\theta }_{bj}$ represent the private phase. The public phases are known to everyone, and the private phases are randomly selected from $[\mathrm{0,2}\pi )$. Some of the private phases are announced in the data post-processing, and the other private phases are never announced in the whole protocol.

For the received signal pulse pairs, Charlie is assumed to first compensate for the difference in public phases ${\gamma }_{aj}-{\gamma }_{bj}$ and then perform the Bell measurement. In this protocol, we will make post-selection for a set $Q$ of signal pulse pairs in $X$ basis. We make the post-selection according to the difference between the private phases of the pulse pair. The goal of this post-selection is to make the observed error rate in subset $Q$ be small enough so as to make a better estimation for the phase-flip error rate of single-photon pairs in $Z$ basis. For this goal, we need a small positive value $\lambda$ in the following formula: $$1-|\cos ({\theta }_{aj}-{\theta }_{bj})|\le \lambda .$$(2)

As we shall show later, such a post-selection can produce a smaller observed phase-flip error rate for the single-photon pairs if $\lambda$ is small. Before going further, we first show the idea in more details by the example of the four-intensity protocol [29,38].

We shall post-select a subset of pulse pairs $Q$. By using results of all pulse pairs in $X$ basis, we can evaluate the yield of the single-photon pairs, which can be used to obtain the yield of all single-photon pairs and also the yield of the single-photon pairs in set $Q$ only. Then, to calculate the final key rate, we have two options. One is to ignore the subset $Q$ and just calculate the key rate using the standard method of the four-intensity protocol. The other is to use the observed error rate in subset $Q$, then estimate the phase-flip error rate for single-photon pairs in $Z$ basis, and finally calculate the final key rate by this. We will always choose the one that produces the higher key rate. A small $\lambda$ results in a small observed error rate in subset $Q$, but the number of observed error events will also be small, which would cause large statistical fluctuations. Thus, there is a trade-off between the observed error rate and the number of observed error events, and we need to optimize $\lambda$ to achieve the best estimation of the phase-flip error rate.

We take the four-intensity MDI-QKD protocol with phase post-selection to show the whole implementation process.

There are four WCS sources $o,x,y,z$ with different intensities at Alice’s and Bob’s sides, respectively. In $X$ basis, Alice (Bob) uses WCS sources $o_A$, $x_A$, and $y_A$ ($o_B$, $x_B$, and $y_B$) with intensities ${\mu }_{o_A}=0$, ${\mu }_{x_A}$, and ${\mu }_{y_A}$ (${\mu }_{o_B}=0$, ${\mu }_{x_B}$, and ${\mu }_{y_B}$), respectively. In $Z$ basis, Alice (Bob) uses WCS source $z_A$ ($z_B$) with intensity ${\mu }_{z_A}$ (${\mu }_{z_B}$). In the $j$th time window, Alice (Bob) randomly prepares a signal pulse in state $|e^{i({\theta }_{aj}+{\gamma }_{aj})}\sqrt{{\mu }_{{\alpha }_A}}⟩(|e^{i({\theta }_{bj}+{\gamma }_{bj})}\sqrt{{\mu }_{{\beta }_B}}⟩)$ with probability $p_{{\alpha }_A}$ ($p_{{\beta }_B}$) for $\alpha ,\beta =o,x,y,z$, where ${\theta }_{aj}$ and ${\theta }_{bj}$ are randomly selected from $[\mathrm{0,2}\pi )$. The signal pulse is encoded in $X$ basis if $\alpha ,\beta =o,x,y$ and in $Z$ basis if $\alpha ,\beta =z$. Then Alice (Bob) sends out the prepared signal pulse to Charlie. Charlie is assumed to first compensate for the difference in public phases, and then perform the Bell measurement to the received pulse pairs. Charlie announces the outcome to Alice and Bob. If two specific detectors click (for example, two and only two detectors corresponding to different polarizations click in the polarization coding scheme), Alice and Bob take it as an effective event, and Alice and Bob only keep the data of effective events.

To efficiently estimate the difference in public phases of the pulse pairs received in Charlie’s detectors, the method performed in the TF-QKD experiments can be applied here [52–57]. Alice (Bob) encodes the strong reference pulses multiplexed with the signal pulses by modulating a continuous light into pulsed light. The signal pulses are quantum signals with random phases and single photon level intensities, while the strong reference pulses are classical signals with fixed phases and usually more than dozens to hundreds of times stronger than intensity of the signal pulses. Based on the recorded interference results of the strong reference pulses, Charlie can accurately estimate the relative difference in public phases of the received signal pulse pairs.

After Alice and Bob repeat the above process for $N$ times and Charlie announces all the outcomes, they (Alice and Bob) acquire a series of data. Then, Alice and Bob first announce the intensity of the pulse corresponding to each effective event. For the effective events that both Alice and Bob take the $x$ sources, they then announce the private phases ${\theta }_{aj}$ and ${\theta }_{bj}$. The private phases of other effective events are never announced. We denote $\alpha \beta$ as the pulse pair source if Alice takes the $\alpha$ source and Bob takes the $\beta$ source for $\alpha ,\beta =o,x,y,z$. We use the following criteria for the effective events of the $xx$ source to make post-selection for the subset $Q$: $$1-|\cos ({\theta }_{aj}-{\theta }_{bj})|\le \lambda .$$(3)With all those data, we can calculate the final key rate $R$. The calculation method is shown in Section 4.

Since only the private phases of the effective events of the $xx$ source are revealed in this protocol, we only need to consider the security of those parts. For simplicity, we first consider the following virtual protocol.

For virtual protocol, to each pulse pair of the $\mathit{xx}$ source, only Alice and Bob know the value ${\delta }_j={\theta }_{aj}-{\theta }_{bj}$, but they do not know the phase values ${\theta }_{aj},{\theta }_{bj},{\gamma }_{aj},{\gamma }_{bj}$. Here we choose the region $-\pi <{\delta }_j\le \pi$ in our discussion. Therefore, the density operator of a signal pulse pair from any subset from whatever post-selection strategies that satisfy Eq. (3) can be written as $$\rho =\frac{1}{4\pi }{\int }_0^{2\pi }\mathrm{d}{\theta }_{aj}[\mathrm{\Omega }({\delta }_i)+\mathrm{\Omega }({\delta }_i+\pi )],$$(4)where we have used the notation $$\begin{gathered} \mathrm{\Omega }({\delta }_i)=|e^{i({\theta }_{aj}+{\gamma }_{aj})}\sqrt{{\mu }_{x_A}}⟩⟨e^{i({\theta }_{aj}+{\gamma }_{aj})}\sqrt{{\mu }_{x_A}}| \\ \otimes |e^{i({\theta }_{aj}+{\gamma }_{bj}-{\delta }_i)}\sqrt{{\mu }_{x_B}}⟩⟨e^{i({\theta }_{aj}+{\gamma }_{bj}-{\delta }_i)}\sqrt{{\mu }_{x_B}}|. \end{gathered}$$(5)

Doing the integration in Eq. (4), we find that the density operator can be decomposed in the following convex form: $$\rho =c_{11}|11⟩⟨11|+(1-c_{11}){\rho }^{\prime },$$(6)where $c_{11}={\mu }_{ax}{\mu }_{bx}{e}^{-{\mu }_{ax}-{\mu }_{bx}}$ and $1-c_{11}$ are positive values and ${\rho }^{\prime }$ is a density operator, which is $(\rho -c_{11}|11⟩⟨11|)/(-c_{11})$.

Hence, we have Lemma 1. For a pulse pair from any post-selected subset $Q$, it can be regarded as the classical mixture of a single-photon pair with probability $c_{11}$ and another density operator with probability $1-c_{11}$.

Obviously, even Alice and Bob know the values of ${\theta }_{aj}$ and ${\theta }_{bj}$, but they never use the information of values of ${\theta }_{aj}$ and ${\theta }_{bj}$; a pulse pair from subset $Q$ can still be regarded as the classical mixture of a single-photon pair with probability $c_{11}$ and another density operator with probability $1-c_{11}$. We define $Q_{11}$ as the set of single-photon pulse pairs from Q. Since in the distribution process no one can tell the difference between the pulse pairs from $Q_{11}$ and the ideal single-photon pulse pairs in $X$ basis, we have the following. (1) The yield of single-photon pulse pairs calculated from all effective events caused by pulse pairs in $X$ basis is asymptotically equal to the yield of single-photon pulse pairs from set $Q$. (2) The bit-flip error rate of the effective events of single-photon pulse pairs from $Q$ is asymptotically equal to the phase-flip error rate of all those effective events caused by single-photon pairs prepared in $Z$ basis.

In the real protocol, Alice and Bob cannot know the values of each ${\delta }_j$ of the pulse pair from $xx$ source before the private phases are announced. But if they announce the private phases through a secret channel that cannot be eavesdropped by anyone else, the above discussion still holds. In the following, we shall prove that the security of Alice and Bob’s announcing the private phases through a private channel is equivalent to that of announcing the private phases through a public channel.

The private phases of the pulse pairs from $Z$ basis are never announced; thus, those pulse pairs are the classical mixture of Fock states. To calculate the final key rate, we need to know the lower bound of the number of the effective events caused by single-photon pairs from $Z$ basis $\underset{\_}{n_{11}}$ and the upper bound of its corresponding phase-flip error rate $\overline{e^{\mathrm{ph}}}$. Note the values of $\underset{\_}{n_{11}}$ and $\overline{e^{\mathrm{ph}}}$ are objective facts, which do not change by any outside information when the quantum distribution process of the protocol is done and Charlie has announced all detection outcomes. This is to say, after Alice and Bob know this fact, they can announce the private phases of all pulse pairs from $xx$ source, and this does not affect the security of the protocol. We suppose Alice and Bob get the values of $\underset{\_}{n_{11}}$ and $\overline{e^{\mathrm{ph}}}$ through a secret channel, and get the lower bound of the number of the effective events caused by single photon pairs from $Z$ basis ${\underset{\_}{n_{11}}}^{\prime }$ and the upper bound of its corresponding phase-flip error rate ${\overline{e^{\mathrm{ph}}}}^{\prime }$ through a public channel. Since all observed values are the same in the case of secret channel and public channel, we have $\underset{\_}{n_{11}}={\underset{\_}{n_{11}}}^{\prime }$ and $\overline{e^{\mathrm{ph}}}={\overline{e^{\mathrm{ph}}}}^{\prime }$. This ends the proof.

The phase post-selection method can be combined with both the single-scanning method [29] and the double-scanning method [38] of the four-intensity MDI-QKD protocol. Here we take the phase post-selection method combined with the double-scanning method as an example to show the calculation method of the final key rate. The method can be easily generalized to the case of combining with the single-scanning method.

As discussed in Section 3, the phase post-selection does not affect the security; thus, the density matrix of the pulse pairs from source $xx$ can still be regarded as the classical mixture of Fock states. We denote the density matrix of source $\alpha \beta =oo,ox,xo,oy,yo,xy,yx,xx,yy,zz$ by $${\rho }_{\alpha \beta }=\sum _{m=0}^{\infty }\sum _{n=0}^{\infty }{a}_m^{\alpha }{b}_n^{\beta }|mn⟩⟨mn|,$$(7)where $$a_m^{\alpha }=\frac{{\mu }_{{\alpha }_A}^m{e}^{-{\mu }_{{\alpha }_A}}}{m!},b_n^{\beta }=\frac{{\mu }_{{\beta }_B}^n{e}^{-{\mu }_{{\beta }_B}}}{n!},$$(8)and we denote the total number of instances of source $\alpha \beta =oo,ox,xo,oy,yo,xy,yx,xx,yy,zz$ by $N_{\alpha \beta }$ with $$N_{\alpha \beta }=p_{{\alpha }_A}{p}_{{\beta }_B}N.$$(9)

According to the data in $X$ basis, Alice and Bob get the observed value of the number of effective events of source $\alpha \beta$, $n_{\alpha \beta }$. We denote the expected value of $n_{\alpha \beta }$ by $⟨n_{\alpha \beta }⟩$. With Chernoff bound [61], we can estimate the expected value according to the observed value. We denote the estimated lower and upper bounds of the expected value by the superscripts $L$ and $U$, respectively. Besides, we denote the number of wrong effective events of source $xx$ as $m_{xx}$ whose corresponding expected value is $⟨m_{xx}⟩$.

With Eqs. (4)–(6), we can get the density matrix of the pulse pairs from set $Q$, $${\rho }_Q=c_{11}|11⟩⟨11|+(1-c_{11}){\rho }^{\prime },$$(10)where $c_{11}={\mu }_{ax}{\mu }_{bx}{e}^{-{\mu }_{ax}-{\mu }_{bx}}=a_1^x{b}_1^x$ and $1-c_{11}$ are positive values and ${\rho }^{\prime }$ is a density operator, which is $(\rho -c_{11}|11⟩⟨11|)/(1-c_{11})$. The criteria of the correct effective event and the wrong effective event of the pulse pair in the set $Q$ are the same as those of the source $xx$. We denote the observed number of wrong effective events in set $Q$ by $m_Q$ and its corresponding expected value by $⟨m_Q⟩$.

As shown in Ref. [38], if $\frac{{\mu }_{y_B}}{{\mu }_{x_B}}\le \frac{{\mu }_{y_A}}{{\mu }_{x_A}}$, the lower bound of the expected value of the yield of the single-photon pulse pairs is $${⟨s_{11}⟩}^L=\frac{{⟨S_{+}⟩}^L+\frac{a_1^y{b}_2^y}{N_{xx}}\mathcal{M}-{⟨S_{-}⟩}^U-a_1^y{b}_2^y\mathcal{H}}{a_1^x{a}_1^y(b_1^x{b}_2^y-b_2^x{b}_1^y)},$$(11)where $$⟨S_{+}⟩=\frac{a_1^y{b}_2^y}{N_{xx}}⟨{\overline{m}}_{xx}⟩+\frac{a_1^x{b}_2^x{a}_0^y}{N_{oy}}⟨n_{oy}⟩+\frac{a_1^x{b}_2^x{b}_0^y}{N_{yo}}⟨n_{yo}⟩,$$(12)$$⟨S_{-}⟩=\frac{a_1^x{b}_2^x}{N_{yy}}⟨n_{yy}⟩+\frac{a_1^x{b}_2^x{a}_0^y{b}_0^y}{N_{oo}}⟨n_{oo}⟩,$$(13)$$\mathcal{H}=\frac{a_0^x}{N_{ox}}⟨n_{ox}⟩+\frac{b_0^x}{N_{xo}}⟨n_{xo}⟩-\frac{a_0^x{b}_0^x}{N_{oo}}⟨n_{oo}⟩,$$(14)$⟨{\overline{m}}_{xx}⟩=⟨n_{xx}⟩-⟨m_{xx}⟩$, and $\mathcal{M}=⟨m_{xx}⟩$. Applying the joint constraint method [28,38], we can get the lower bound of $⟨S_{+}⟩$, ${⟨S_{+}⟩}^L$, the upper bound of $⟨S_{-}⟩$, ${⟨S_{-}⟩}^U$, and the lower and upper bounds of $\mathcal{H}$, ${\mathcal{H}}^L$, and ${\mathcal{H}}^U$. Applying the Chernoff bound, we can get the lower and upper bounds of $\mathcal{M}$, ${\mathcal{M}}^L$, and ${\mathcal{M}}^U$. For the case $\frac{{\mu }_{y_B}}{{\mu }_{x_B}}>\frac{{\mu }_{y_A}}{{\mu }_{x_A}}$, we can get similar formulas.

The upper bound of the expected value of the phase-flip error rate of the single-photon pairs from $Z$ basis is $${⟨e_{11}⟩}^U=\frac{\mathcal{M}/N_{xx}-\mathcal{H}/2}{a_1^x{b}_1^x{⟨s_{11}⟩}^L}.$$(15)

As discussed in Section 3, we can use the observed value in set $Q$ to get ${⟨e_{11}⟩}^U$. Let $\mathrm{\Delta }\in [0,\pi ]$ satisfy $$\cos \frac{\mathrm{\Delta }}{2}=1-\lambda ,$$(16)where $\lambda$ is defined in Eq. (2). With Eq. (10), it is easy to check that $${⟨e_{11}⟩}^{\prime U}=\frac{\frac{⟨m_Q⟩}{\mathrm{\Delta }/\pi N_{xx}}}{a_1^x{b}_1^x{⟨s_{11}⟩}^L}.$$(17)

Since both Eqs. (15) and (17) are the upper bounds of the expected value of the phase-flip error rate, we can always use the smaller one to be the estimated upper bound. This is to say, for each group $(\mathcal{H},\mathcal{M})$, we apply Eq. (11) to calculate ${⟨s_{11}⟩}^L$, and we have $${⟨e_{11}^{\mathrm{ph}}⟩}^U=\min (\frac{\mathcal{M}/N_{xx}-\mathcal{H}/2}{a_1^x{b}_1^x{⟨s_{11}⟩}^L},\frac{\frac{⟨m_Q⟩}{\mathrm{\Delta }/\pi N_{xx}}}{a_1^x{b}_1^x{⟨s_{11}⟩}^L}).$$(18)

With the Chernoff bound, we can get the real value of the lower bound of the yield of the single-photon pulse pairs from source $zz$, $s_{11,Z}^L$, and its corresponding upper bound of the phase-flip error rate, $e_{11}^{\text{ph},U}$, $$s_{11,Z}^L=\frac{O^L(N_{zz}{a}_1^z{b}_1^z{⟨s_{11}⟩}^L)}{N_{zz}{a}_1^z{b}_1^z},$$(19)$$e_{11}^{\text{ph},U}=\frac{O^U(N_{zz}{a}_1^z{b}_1^z{s}_{11,Z}^L{⟨e_{11}^{\mathrm{ph}}⟩}^U)}{N_{zz}{a}_1^z{b}_1^z{s}_{11,Z}^L},$$(20)where $O^U(Y)$ and $O^L(Y)$ are defined in Eqs. (A5) and (A6).

Then we have $$\begin{gathered} R(\mathcal{H},\mathcal{M})=p_{z_A}{p}_{z_B}\{a_1^z{b}_1^z{s}_{11,Z}^L[1-h(e_{11}^{\text{ph},U})]-f{S}_{zz}h(E_{zz})\} \\ -\frac{1}{N}({\log }_2\frac{8}{{\epsilon }_{\mathrm{cor}}}+2{\log }_2\frac{2}{{\epsilon }^{\prime }\widehat{\epsilon }}+2{\log }_2\frac{1}{2{\epsilon }_{\mathrm{PA}}}), \end{gathered}$$(21)where $S_{zz}=n_{zz}/N_{zz}$ is the yield of the pulse pairs from source $zz$; $E_{zz}$ is the bit-flip error rate of the effective event in source $zz$; $h(x)=-x{\log }_2(x)-(1-x){\log }_2(1-x)$ is the Shannon entropy; ${\epsilon }_{\mathrm{cor}}$ is the failure probability of error correction; ${\epsilon }_{\mathrm{PA}}$ is the failure probability of privacy amplification; and ${\epsilon }^{\prime }$ and $\widehat{\epsilon }$ are the coefficients while using the chain rules of smooth min- and max-entropy. Finally, by scanning $(\mathcal{H},\mathcal{M})$, we can get the final key rate, $$R=\underset{\frac{\mathcal{H}\in [{\mathcal{H}}^L,{\mathcal{H}}^U],}{\mathcal{M}\in [{\mathcal{M}}^L,{\mathcal{M}}^U]}}{\min }R(\mathcal{H},\mathcal{M}).$$(22)

We shall show the advantage of phase post-selection through the numerical simulation results. Similar to prior art works, we take linear model for channel transmittance [21,62] for the provably observed values of $n_{\alpha \beta }$ and $m_{\alpha \beta }$ in our simulation. The simulation method of $m_Q$ is shown in Appendix B. The experiment parameters are listed in Table 1. In the optimization of the phase post-selection combined with the double-scanning method, except for the source parameters, $\lambda$ is also a parameter to be optimized.Table 1.

List of Experimental Parameters Used in Numerical Simulations^a

In the global parameter optimization process, if we directly scan $(\mathcal{H},\mathcal{M})$ in their range to calculate the key rate, it would be pretty time-consuming. We propose an accelerated method that can reduce the running time of the optimized program from several days to less than half an hour.

The accelerated method can reduce the scanning parameters from two to one. To clearly show this, we denote $T_Q=\frac{⟨m_Q⟩}{\mathrm{\Delta }/\pi N_{xx}}$, $T^L={\mathcal{M}}^L/N_{xx}-{\mathcal{H}}^U/2$, $T^U={\mathcal{M}}^U/N_{xx}-{\mathcal{H}}^L/2$, and $t_{11}=\mathcal{M}/N_{xx}-\mathcal{H}/2$.

If $T_Q\le T^L$, then no matter what values $(\mathcal{H},\mathcal{M})$ take, the worst case of the key rate must be achieved when $\mathcal{H}={\mathcal{H}}^U,\mathcal{M}={\mathcal{M}}^L$.

If $T_Q>T^L$, then for each certain $t_{11}\in [T^L,T^{U\prime }]$, where $T^{U\prime }=\min (T_Q,T^U)$, the worst case of the key rate is achieved when ${⟨s_{11}⟩}^L$ is the smallest. With the simplest linear programming method, we can easily know that when $\mathcal{H}=H(t_{11})$, ${⟨s_{11}⟩}^L$ is the smallest, and $$H(t_{11})=\{\begin{array}{ll}{\mathcal{H}}^U,& t_{11}+{\mathcal{H}}^U/2\le {\mathcal{M}}^U/N_{xx},\\ 2({\mathcal{M}}^U/N_{xx}-t_{11}),& t_{11}+{\mathcal{H}}^U/2>{\mathcal{M}}^U/N_{xx}\mathrm{.}\end{array}$$(23)Then for each certain $t_{11}\in [T^L,T^{U\prime }]$, we have $${⟨s_{11}⟩}^L=\frac{{⟨S_{+}⟩}^L+a_1^y{b}_2^y[t_{11}-H(t_{11})/2]-{⟨S_{-}⟩}^U}{a_1^x{a}_1^y(b_1^x{b}_2^y-b_2^x{b}_1^y)},$$(24)$${⟨e_{11}^{\mathrm{ph}}⟩}^U=\frac{t_{11}}{a_1^x{b}_1^x{⟨s_{11}⟩}^L}.$$(25)When we substitute ${⟨s_{11}⟩}^L$ and ${⟨e_{11}^{\mathrm{ph}}⟩}^U$ into Eqs. (19)–(21), we can get $R(t_{11})$. Finally, by scanning $t_{11}$ in $[T^L,T^{U\prime }]$, we can get the final key rate, which is $$R=\underset{t_{11}\in [T^L,T^{U\prime }]}{\min }R(t_{11}).$$(26)

If $T_Q\ge T^U$, the above method is obviously correct. But for the case $T^L<T_Q<T^U$, we need to prove that the worst case of the key rate cannot be achieved in the range $(T^Q,T^U]$.

We denote $T^Q\le t_{11}^w<t_{11}^v\le T^U$. It is easy to check $H(t_{11}^w)\ge H(t_{11}^v)$; thus, we have ${⟨s_{11}⟩}^L(t_{11}^w)<{⟨s_{11}⟩}^L(t_{11}^v)$. With Eq. (18), we have $$\begin{gathered} {⟨e_{11}^{\mathrm{ph}}⟩}^U(t_{11}^w)=\frac{T^Q}{a_1^x{b}_1^x{⟨s_{11}⟩}^L(t_{11}^w)} \\ >{⟨e_{11}^{\mathrm{ph}}⟩}^U(t_{11}^v)=\frac{T^Q}{a_1^x{b}_1^x{⟨s_{11}⟩}^L(t_{11}^v)}. \end{gathered}$$(27)Thus, we have $R(t_{11}^w)<R(t_{11}^v)$, which means the worst case of the key rate cannot be achieved in the range $(T^Q,T^U]$. This ends the proof.

Except for the symmetric model, the method introduced in this work can be directly applied to the asymmetric channels by simply removing the constraints $p_{{\alpha }_A}=p_{{\alpha }_B}$ and ${\mu }_{{\alpha }_A}={\mu }_{{\alpha }_B}$. Figures 3 and 4 are the comparison of the key rates with this work and the former methods [29,38] under the asymmetric channels. In the metro QKD network, the distance of QKD is usually less than 50 km, and the maximum possible asymmetry is about 20 km. Thus, we set $L_{AC}-L_{BC}=20\mathrm{km}$. The other experiment parameters of Fig. 3 are the same as those of Fig. 1, and the other experiment parameters of Fig. 4 are the same as those of Fig. 2. The results show that the method of this work can obviously improve the key rates under the asymmetric channels.

Compared with the former works of MDI-QKD, the method of this work can obviously improve the key rates. But if the infinite decoy-states and infinite-key are considered, both this work and former works can accurately estimate the phase-flip error rate and the counting rate of single-photons, and thus they have similar performances in cases that are limited by the PLOB bound [5,41].

Based on the technique of the single-photon interference, we propose a modified MDI-QKD protocol with phase post-selection. We prove the security of the announcement of the private phases of the pulse pairs from $xx$ source. We also show how to apply the phase post-selection method to the double-scanning four-intensity MDI-QKD protocol. The numerical results show that the phase post-selection method can significantly improve the key rate at all distances. In principle, our method can be directly applied to free-space MDI-QKD. But due to the atmospheric turbulence or moving sites (such as the satellite), the channel is always unstable and changes rapidly, and how to efficiently apply our method to free space will be further studied in future works.