\section{Introduction}

It is unequivocal that quantum key distribution (QKD)~\cite{QKDreview1,QKDreview2} needs to bridge the gap between theory and practice. In theory, 
QKD offers perfect security. In practice, 
however, 
it does not, as most practical devices behave differently from the theoretical models assumed in the security proofs. 
As a result, we face 
implementation loopholes, or so-called side-channels, which may be used by adversaries without being detected,
as seen
in recent attacks against certain commercial QKD 
systems~\cite{sidechannelrefs2a, sidechannelrefs1a, sidechannelrefs2b, sidechannelrefs2c, sidechannelrefs1b, sidechannelrefs1c, sidechannelrefs2d, sidechannelrefs2f, sidechannelrefs2e}. 

There are two potential ways to 
guarantee security in the  
realisations of QKD. The first is to 
develop mathematical models that perfectly match the behaviour of physical apparatuses, 
and then incorporate this information into a new security proof. 
While this is plausible in theory, unfortunately it is very hard to realise in practice, if not impossible.  
The second alternative is to design new protocols and develop security proof techniques 
that are 
compatible with a wide class of device 
imperfections. 
This allows us to omit an
accurate characterisation of real apparatuses.
The most well-known example of such a solution is 
(full) device-independent QKD (diQKD)~\cite{diqkdrefsa,diqkdrefsb,diqkdrefsc,diqkdrefsd,diqkdrefse}. Here, the legitimate users of the system 
(typically called Alice and Bob) treat their devices as two quasi ``black boxes", i.e., 
they need to know which elements their boxes contain, but not 
how they fully function~\cite{diqkdrefs2}. 
The security of diQKD relies 
on the violation of a Bell inequality~\cite{bell1,bell2}, which certifies the presence of quantum correlations. 
Despite its beauty, however,
this approach is highly impractical because it
requires a loophole-free Bell test which at the moment is still unavailable~\cite{Pearle1970}. 
Also, its secret key rate at practical distances is very limited~\cite{Gisin2010a,Gisin2010b}.

Very recently, 
a novel approach has been 
introduced, which is fully practical and feasible to implement. 
This scheme is known as 
measurement-device-independent QKD (mdiQKD)~\cite{mdiQKD} and 
offers a clear avenue to bridge
the gap between theory and practice. 
Its feasibility has been 
promptly demonstrated both in laboratories and 
via field-tests~\cite{Rubenok2012a,Rubenok2012b,Rubenok2012c,Rubenok2013a,Zhiyuan:2013}.
It successfully
removes
all (existing and yet to be discovered) detector side-channels~\cite{sidechannelrefs2a,sidechannelrefs2b,sidechannelrefs2c,sidechannelrefs2d,sidechannelrefs2e,sidechannelrefs2f}, 
which, arguably, is the most critical part of most QKD implementations.
Importantly, 
in contrast to diQKD this solution does not require that Alice and Bob perform a loophole-free Bell test; 
it is enough if they prove the presence of entanglement in a quantum state that is effectively distributed between them, 
just like in standard QKD schemes~\cite{curty_prl2004}.
In addition, now Alice and Bob may treat the measurement apparatus
as a true ``black box", which may be fully controlled 
by the adversary. A slight drawback is that
Alice and Bob need to characterise the quantum states 
[e.g., the polarisation degrees of freedom of phase-randomised weak coherent pulses (WCPs)]
that they send through 
the channel. But, as this process can be verified in a protected environment outside the influence of the 
adversary, it is less likely to be a problem. 
For completeness, the readers can refer to~\cite{charles2} where a characterisation of the prepared states is no longer required.

Nevertheless, so far the security of mdiQKD has only been proven 
in the asymptotic regime~\cite{mdiQKD}, which assumes that Alice and Bob have access to an unlimited amount of resources,
or in the finite regime but only against particular types of attacks~\cite{finitea,finiteb}.
In summary, until now, a rigorous security proof of mdiQKD that takes full 
account of the finite size effects~\cite{finite1,finite2,finite3} has appeared to be missing and, for this reason, the 
feasibility of long-distance implementations of mdiQKD within a reasonable time-frame of signal transmission 
has remained undemonstrated.

The main contributions of this work are twofold. First, in contrast to existing heuristic results on 
mdiQKD, we provide, for the first time, a security proof in the finite-key regime 
that is valid against general attacks, and
satisfies the composability definition~\cite{RennerThesis,MullerQuadeRenner} 
of QKD. Second, we apply large deviation
theory, specifically a multiplicative form of the Chernoff bound~\cite{cher}, to perform the parameter estimation step.
The latter is crucial to demonstrate that a long-distance 
implementation of 
mdiQKD  
(e.g., $150$ km of optical
fiber with $0.2$ dB/km) is feasible
within a reasonable time-frame. To obtain high secret key rates in this scenario, 
it is common to use decoy state techniques~\cite{decoy1,decoy2,decoy3},
both for standard QKD protocols and mdiQKD.
Here a key challenge is to estimate
the transmittance
and the quantum bit error rate (QBER) of the
single-photon component of the signal at the presence of
high losses (e.g., $30$ dB). We show that such an estimation
problem can be solved 
using the Chernoff bound, as it provides good bounds for the parameters above
even in the high-loss regime. We highlight that our results 
can be applied to other QKD protocols
(e.g., the standard decoy state BB84 protocol~\cite{decoy1,decoy2,decoy3}) as well as to general
experiments in quantum information. 

\section{Security Definition}

Prior to stating the protocol, let us quickly review the security framework~\cite{RennerThesis,MullerQuadeRenner} 
 that we are considering here. 
A general QKD protocol (executed by Alice and Bob) generates either a pair of bit strings $S_{\rm A}$ and $S_{\rm B}$, 
or a symbol $\perp$ to indicate the abort of the protocol. In general, the string of Alice, $S_{\rm A}$, can be quantum mechanically 
correlated with a quantum state that is held by the adversary. Mathematically, this situation is described by the classical-quantum state
\begin{eqnarray}
\rho_{\rm AE}=\sum_{s}\proj{s}\otimes \rho_{\rm E}^s, \nonumber
\end{eqnarray}
where $\{\ket{s}\}_s$ denotes an orthonormal basis for Alice's system, and the 
subscript ${\rm E}$ indicates the system of the adversary. 

Ideally, we say that a QKD protocol is secure if it satisfies two conditions, namely the correctness and the secrecy. 
The correctness condition is met if $S_{\rm A}=S_{\rm B}$, i.e., Alice's and Bob's bit strings are identical. 
The secrecy condition is met if $\rho_{\rm AE}=U_{\rm A} \otimes \rho_{\rm E}$, where $U_{\rm A}=\sum_s\frac{1}{|{\mathcal S}|}\proj{s}$ 
is the uniform mixture of all possible values of the bit string $S_{\rm A}$. That is, the system of the adversary is completely decoupled from 
that of Alice. 

Owing to the presence of errors, however, these two conditions can never be perfectly met. 
For example, in the finite-key regime it is impossible to guarantee $S_{\rm A}=S_{\rm B}$ with certainty. 
In practice, this implies that we need to allow for some minuscule errors. That is, we say that a QKD scheme is $\epsilon_{\textrm{cor}}$-correct 
if $\Pr[S_{\rm A} \not= S_{\rm B}] \leq \epsilon_{\textrm{cor}}$, i.e., 
the probability that Alice's and Bob's bit strings are not identical is not greater than $\epsilon_{\textrm{cor}}$.
Similarly, we say that a protocol is $\epsilon_{\textrm{sec}}$-secret if
\begin{eqnarray}
\frac{1}{2}\|\rho_{\rm AE}-U_{\rm A}\otimes\rho_{\rm E}\|_1 \leq \epsilon_{\textrm{sec}}, \nonumber
\end{eqnarray}
where $\|\cdot\|_1$ denotes the trace norm. 
That is, the state $\rho_{\rm AE}$ is $\epsilon_{\textrm{sec}}$-close to the ideal situation described by $U_{\rm A} \otimes \rho_{\rm E}$.
Thereby a QKD protocol is said to be $\epsilon$-secure if it is both $\epsilon_{\textrm{cor}}$-correct and $\epsilon_{\textrm{sec}}$-secret, 
with $\epsilon_{\textrm{cor}}+\epsilon_{\textrm{sec}}\leq\epsilon$. 

With this security definition we are able to guarantee that the security of the protocol holds even when combined with other protocols, i.e., 
the protocol is secure in the so-called universally composable framework~\cite{RennerThesis,MullerQuadeRenner}.

\section{Protocol definition}\label{sec_prot}

The setup is illustrated in Fig.~\ref{scheme}.
Alice and Bob use a laser source to generate quantum signals that are diagonal in the Fock basis. 
Instances of such sources include attenuated laser diodes emitting phase-randomised WCPs, triggered spontaneous parametric down-conversion sources, 
and practical single-photon sources. 
Each pulse is prepared in a different BB84 state~\cite{bb84}, which is
selected, for example, uniformly at random from two mutually unbiased bases, 
denoted as $\rm Z$ and $\rm X$. 
The signals are then sent to an untrusted relay Charles, who is supposed to perform 
a Bell state measurement that projects them into a Bell state. 
Also, Alice and Bob apply decoy state techniques~\cite{decoy1,decoy2,decoy3}
to estimate the gain (i.e., the probability that the relay outputs a successful result) 
and the QBER for various input photon-numbers.
\begin{figure}[h]
\begin{center}
 \includegraphics[scale=0.48]{Setup.eps}
 \end{center}
 \caption{A schematic diagram of mdiQKD.
Alice and Bob prepare quantum signals in different BB84 polarisation states~\cite{bb84}
with a polarisation modulator (Pol-M). Also, they use  
an intensity modulator (Decoy-IM) to 
generate decoy states. 
The signals are sent to an untrusted relay Charles, who is supposed to perform 
a Bell state measurement that projects the incoming signals into a Bell state. 
See the main text for details. 
\label{scheme}}
\end{figure} 

Next, Charles announces whether or not his measurements are successful, including the Bell states obtained. 
Alice and Bob keep the data that correspond to these instances and discard the rest. Also, they 
post-select the events where they employ the same basis. Finally, either Alice or Bob 
flips part of her/his bits to correctly correlate them with those of the other. See
Table~\ref{table_protocol} for a detailed description of the different steps of the protocol.
\begin{table}
\begin{description}
\item[1. State Preparation]
Alice and Bob repeat the first four steps of the protocol 
for $i=1,\ldots,N$ till the conditions in the 
Sifting step are met. 	For each $i$, Alice chooses an intensity $a\in\{a_{\rm s}, a_{\rm d_1},\ldots,a_{{\rm d}_n}\}$, 
a basis $\alpha\in\{{\rm Z, X}\}$, and a random bit $r\in\{0,1\}$ with probability
$p_{a,\alpha}/2$. Here $a_{\rm s}$ ($a_{{\rm d}_j}$) is the intensity of the signal (decoy) states.
Next, she generates a 
quantum signal (e.g., a phase-randomised WCP) 
of intensity $a$ prepared in the basis state of $\alpha$ given 
by $r$. Likewise, Bob does the same.

\item[2. Distribution] Alice and Bob send their states to Charles via the quantum channel.

\item[3. Measurement]
If Charles is honest, he measures the signals received with a Bell state measurement. 
In any case, he informs Alice and Bob (via a public channel) of whether or not his measurement was successful. If successful,
he reveals the Bell state obtained. 

\item[4. Sifting]
If Charles reports a successful result, Alice and Bob broadcast (via an authenticated channel) 
their intensity and basis settings.
For each Bell state $k$, we define two groups of sets:
${\mathcal Z}^{a,b}_k$ and ${\mathcal X}^{a,b}_k$. The first (second) one identifies 
signals
 where Charles declared the Bell state $k$ and Alice and Bob selected the
intensities $a$ and $b$ and the basis $\rm Z$
($\rm X$). 
The protocol repeats these steps until 
$|{\mathcal Z}^{a,b}_k|\geq N^{a,b}_k$ and $|{\mathcal X}^{a,b}_k|\geq M^{a,b}_k$
$\forall a, b, k$.  
Next, say Bob flips part of his bits to correctly correlate them with those of Alice
(see Table~\ref{table1}).
Afterwards, they execute the last steps of the protocol for each $k$. 

\item[5. Parameter Estimation]
Alice and Bob use $n_k$ random
bits from
${\mathcal Z}^{a_{\rm s},b_{\rm s}}_k$ 
to form the code bit strings
$Z_k$ and $Z'_k$, respectively. The 
remaining 
$R_k$ bits from ${\mathcal Z}^{a_{\rm s},b_{\rm s}}_k$ are used to compute
the error rate
$E^{a_{\rm s},b_{\rm s}}_k=\frac{1}{R_k}\sum_l r_l\oplus r'_l$,
where $r'_l$ are Bob's bits.
If $E^{a_{\rm s},b_{\rm s}}_k>E_{\rm tol}$, Alice and Bob assign an empty string to
$S_k$ and abort steps $6$ and $7$ for this
$k$.
The protocol only aborts if $E^{a_{\rm s},b_{\rm s}}_k>E_{\rm tol}$ $\forall k$.
If $E^{a_{\rm s},b_{\rm s}}_k\leq{}E_{\rm tol}$, Alice and Bob 
use ${\mathcal Z}^{a,b}_k$ and ${\mathcal X}^{a,b}_k$ to
estimate $n_{k,0}$, $n_{k,1}$ and $e_{k,1}$. The parameter $n_{k,0}$ ($n_{k,1}$)
is a lower bound for the number of bits 
in $Z_k$ where Alice (Alice and Bob) sent a vacuum (single-photon) state. 
$e_{k,1}$ is
an upper bound for the single-photon phase error rate. 
If $e_{k,1}>e_{{\rm tol}}$, 
an empty string is assigned to $S_k$ and
steps $6$ and $7$ are aborted for this $k$, and
the protocol only aborts if $e_{k,1}>e_{{\rm tol}}$ $\forall k$.

\item[6. Error Correction] For those $k$ that passed the parameters estimation step,
Bob obtains an estimate ${\hat Z}_k$ 
of $Z_k$ using 
an information reconciliation scheme. For this, Alice sends him
${\rm leak}_{{\rm EC},k}$ bits of error correction data.
Next, Alice computes a hash of $Z_k$ of length $\lceil\log_2(4/\epsilon_{\rm cor})\rceil$ using 
a random universal$_2$ 
hash function, which she sends to Bob together with the hash~\cite{RennerThesis}. 
If ${\rm hash}({\hat Z}_k)\neq {\rm hash}(Z_k)$, Alice and Bob assign an empty string to $S_k$ and abort step $7$ for this $k$. 
The protocol only aborts if 
${\rm hash}({\hat Z}_k)\neq {\rm hash}(Z_k)$
$\forall k$. 

\item[7. Privacy Amplification] If $k$ passed the error correction step,
Alice and Bob apply a random universal$_2$ hash function
to $Z_k$ and ${\hat Z}_k$ to extract two shorter strings of length $\ell_k$~\cite{RennerThesis}.
Alice obtains $S_k$ and Bob 
${\hat S}_k$. 
The concatenation of 
$S_k$ (${\hat S}_k$) form the secret key 
$S_{\rm A}$ ($S_{\rm B}$).

\end{description}
\caption{Protocol Definition.}
\label{table_protocol}
\end{table}
\begin{table}[htb]
  \centering
  \begin{tabular}{ccccc}
  \quad & \multicolumn{4}{c}{Bell state reported by Charles}\\
    \hline\hline
  Alice \& Bob & $\quad \ket{\psi^-}$ \quad & \quad $\ket{\psi^+}$ \quad & \quad $\ket{\phi^-}$ \quad & \ \quad $\ket{\phi^+}$ \ \quad \\
  \hline
  {\rm {\rm Z} basis} & \quad {\rm Bit flip}  \quad & \quad {\rm Bit flip} \quad  & \quad - \quad  & \ \quad\quad - \ \quad\quad  \\
  {\rm {\rm X} basis} & \quad {\rm Bit flip} \quad & \quad - \quad & \quad {\rm Bit flip} \quad &\ \quad\quad - \ \quad\quad \\
  \hline\hline
\end{tabular}
\caption{Post-processing of data in the sifting step. To guarantee that their bit strings are correctly correlated,
say Bob applies a bit flip to part of his data, depending on the Bell state reported by Charles 
and the basis setting selected.  
  }\label{table1}
\end{table} 

Since Charles' measurement is basically used to post-select entanglement 
between Alice and Bob, the security of 
mdiQKD can be proven by using the idea of time reversal. Indeed, mdiQKD builds on the earlier proposals of time-reversed EPR protocols 
by Biham et al.~\cite{biham} and Inamori~\cite{inamori}, and combine them with the decoy state technique. 
The end result is the best of both worlds---high performance and high security. We note on passing that the idea of 
time reversal has also been previously used in other quantum information protocols including one-way quantum computation.

\section{Security analysis}\label{sec_proof}

We now present one main result of our paper. It states that the protocol introduced above is both 
$\epsilon_{\textrm{cor}}$-correct and $\epsilon_{\textrm{sec}}$-secret, given that the length $\ell$ of the secret key 
$S_{\rm A}$
is selected appropriately for a given set of observed values. See 
Table~\ref{table_protocol} 
for the definition of the different parameters that we consider in this section.

The correctness of the protocol is guaranteed by its error correction step, where, 
for each possible Bell state $k$, 
Alice sends
a hash of $Z_k$ to Bob, who compares it with the hash of ${\hat Z}_k$. If both 
hash values are equal, the protocol gives $S_k={\hat S}_k$ except with error
probability $\epsilon_{\textrm{cor}}/4$. If ${\rm hash}({\hat Z}_k)\neq {\rm hash}(Z_k)$, it outputs the empty string
(i.e., the protocol is trivially correct). Moreover, if the protocol aborts, the result is 
$\perp$, i.e.,
it is also correct. This guarantees that $S_{\rm A}=S_{\rm B}$ except with 
error probability less or equal than $\epsilon_{\textrm{cor}}$. 
Alternatively to this method, Alice and Bob may also guarantee the
correctness of the protocol by exploiting 
properties of the error correcting code employed \cite{lut}. 

If the length $\ell_k$ of each bit string $S_k$, which forms the secret key $S_{\rm A}$, satisfies
\begin{equation}\label{klength}
\ell_k \leq n_{k,0}+n_{k,1}\left[1-h\left(e_{k,1}\right)\right]-{\rm leak}_{{\rm EC},k}-\log_2\frac{8}{\epsilon_{\rm cor}}
-2\log_2\frac{2}{\varepsilon'_k\hat{\varepsilon}_k}-2\log_2\frac{1}{2\varepsilon_{k,\tn{PA}}}, 
\end{equation}
the protocol is $\epsilon_{\rm sec}$-secret, with 
$\epsilon_{\rm sec}=\sum_k \epsilon_{k,{\rm sec}}$ and $\epsilon_{k,{\rm sec}}=
2(\varepsilon'_k+2\varepsilon_{k,e}+\hat{\varepsilon}_k)+\varepsilon_{k,\tn{b}}+\varepsilon_{k,0} 
+\varepsilon_{k,1}+\varepsilon_{k,\tn{PA}}$. In Eq.~(\ref{klength}), $h(x)=-x\log_2{(x)}-(1-x)\log_2{(1-x)}$ is the binary Shannon entropy, and
the parameters $\varepsilon_{k,0} $, $\varepsilon_{k,1}$, and $\varepsilon_{k,e}$ quantify, respectively,
the probability that the estimation of the terms $n_{k,0}$,  $n_{k,1}$ and $e_{k,1}$ is 
incorrect. A sketch of the proof of Eq.~(\ref{klength}) can be found in Appendix~\ref{secre}.
There it is also explained the meaning of all the epsilons contained in the term 
$\epsilon_{k,{\rm sec}}$, which we omit here for simplicity.
In the asymptotic limit of very large data blocks, 
the terms reducing the length of $S_{\rm A}$
due to statistical fluctuations may be neglected, and thus $\ell$
  satisfies $\ell\leq\sum_k\max{\{n_{k,0}+n_{k,1}\left[1-h\left(e_{k,1}\right)\right]-{\rm leak}_{{\rm EC},k},0\}}$, 
as previously obtained in \cite{mdiQKD}. That is, 
$n_{k,0}$ and $n_{k,1}$ provide a positive contribution 
to the secret key rate, while $n_{k,1}h\left(e_{k,1}\right)$ and 
${\rm leak}_{{\rm EC},k}$ reduce it. 
The term $n_{k,1}h\left(e_{k,1}\right)$ corresponds to the information 
removed from $Z_k$ in the privacy amplification step of the protocol, while ${\rm leak}_{{\rm EC},k}$ is the 
information revealed by Alice in the error correction step. 

The second main contribution of this work is an estimation method to obtain the 
relevant parameters $n_{k,0}$,  $n_{k,1}$ and $e_{k,1}$ needed to evaluate the key rate formula above, 
when Alice and Bob send Charles a finite number $N$ of signals and use a finite number of decoy states. 
We solve this problem using techniques
in large deviation theory. 
More specifically, we employ
the Chernoff bound~\cite{cher}. 
It is important to note that standard techniques such as Azuma's
inequality~\cite{azuma} do not give very good bounds here. This is because this result does not consider the properties of the 
a priori distribution. Therefore, it is far from optimal for situations such as high loss or a highly bias coin flip, 
which are relevant in long-distance QKD. In contrast,
the Chernoff bound takes advantage of the property of
the distribution and provides good bounds
even in a high-loss regime. 

More precisely, 
we show that the estimation of $n_{k,0}$,
$n_{k,1}$ and $e_{k,1}$
can be 
formulated as
a linear program, 
which
 can be solved efficiently 
in polynomial time and gives the exact optimum even for large dimensions \cite{lpr}. 
Importantly, this general method is valid for any finite number of decoy states used by Alice and Bob, and
for any photon-number distribution of their signals. Also, for the typical 
scenario where 
Alice and Bob send phase-randomised WCPs together with two decoy states each, we
solve analytically the linear program, and obtain analytical
expressions for the parameters above, which can be used directly in 
an experiment. A sketch of the estimation method is given in Appendix~\ref{sketch}. For a detailed
analysis of both estimation techniques we refer to the Appendices~\ref{ap_anal} and~\ref{ap_numer}. 

\section{Discussion}

In this section we analyse the behaviour of the secret key rate 
provided in Eq.~(\ref{klength}).
In our simulation, 
we consider that Alice and Bob encode their bits in the 
polarisation degrees of freedom of phase-randomised WCPs. 
Also, we assume 
that Charles uses the linear optics quantum relay 
illustrated in Fig.~\ref{fig_relay},
which is able to 
identify 
two of the four Bell states. 
With this setup, a successful Bell state measurement 
corresponds to the observation of precisely two detectors 
(associated to orthogonal polarisations) being triggered.
Note, however, that the results presented in this paper can be 
applied to other 
types of coding schemes like, for instance, 
phase or time-bin coding~\cite{QKDreview1,QKDreview2}, 
and to
any quantum operation that Charles may perform, 
as they solely depend on the measurement results that he announces. 
\begin{figure}[t]
\centerline{\includegraphics[width=0.24\textwidth]{Setup_Charles.eps}}
\vspace{-0.2cm}
\caption{A schematic diagram of Charles' measurement device.
The signals from Alice and Bob interfere at a $50:50$ beam splitter (BS),
which has on each end a polarising beam splitter (PBS) that projects
the incoming photons into either horizontal ($H$) or
vertical ($V$) polarisation states. A click in the single-photon
detectors $D_{1H}$ and 
$D_{2V}$, or in $D_{1V}$ and $D_{2H}$, indicates a projection
into the Bell state $\ket{\psi^{-}}=1/\sqrt{2}(\ket{HV}-\ket{VH})$, 
while a click in $D_{1H}$ and $D_{1V}$, or in 
$D_{2H}$ and $D_{2V}$, implies a projection into the Bell state 
$\ket{\psi^{+}}=1/\sqrt{2}(\ket{HV}+\ket{VH})$.
}\label{fig_relay}
\end{figure}

We use experimental parameters from~\cite{param}.
But, whereas~\cite{param} considers a free-space channel,
we assume
a fiber-based channel with a loss of $0.2$ dB/km. 
The detection efficiency of the 
relay (i.e., the transmittance of its optical components together with the efficiency of its 
detectors)
is $14.5\%$, and the 
background count rate is $6.02\times{}10^{-6}$. 
Moreover, we use a rather generic channel model 
that includes an intrinsic error rate which
simulates the misalignment and instability of the optical system.
This is done by placing a unitary rotation in both input arms of the $50:50$ beam splitter, 
and another unitary rotation in one of its output arms \cite{feihu}. 
In addition, 
we 
fix the security bound to
$\epsilon=10^{-10}$.
\begin{figure}[t]
\centerline{\includegraphics[width=0.44\textwidth]{Rate_vs_distance_wasymptotic.eps}}
\vspace{-0.2cm}
\caption{Expected key rate as function of the distance. Secret key rate $\ell/N$ in logarithmic scale for the 
protocol introduced in section~\ref{sec_prot} with phase-randomised WCPs as a
function of the distance. The solid lines correspond to different values for the total number of signals $N$
sent by Alice and Bob. The overall misalignment 
in the channel is $1.5\%$, 
and the security bound $\epsilon=10^{-10}$. 
For simulation purposes we consider the following experimental 
parameters~\cite{param}: the loss coefficient of the channel is 
$0.2$ dB/km, the detection efficiency of the relay is $14.5\%$, 
and the 
background count rate is $6.02\times{}10^{-6}$. 
Our results show clearly that even with a realistic finite size of data, 
say $N=10^{12}$ to $10^{14}$, it is possible to 
achieve secure mdiQKD at long distances.
In comparison, the dotted line represents a lower bound on the 
secret key rate for the asymptotic case where Alice and Bob send 
Charles
infinite signals and use an infinite number of decoy settings. 
}\label{fig1}
\end{figure}
\begin{figure}[t]
\centerline{\includegraphics[width=0.44\textwidth]{figc.eps}}
\vspace{-0.2cm}
\caption{Expected key rate as function of the block size. The plot shows the secret key rate $\ell/N$ in logarithmic scale
as a function of the total number of signals $N$
sent by Alice and Bob in the limit of zero distance. The security bound $\epsilon=10^{-10}$. 
The solid lines correspond to different values for the intrinsic error 
rate due to the misalignment and instability of the optical system.
The horizontal dotted lines show the asymptotic rates.
The experimental parameters are the ones described in the 
caption of Fig.~\ref{fig1}.
Our results show that, even for a finite size of signals sent 
by Alice and Bob, mdiQKD is robust to intrinsic errors due to basis 
misalignment and instability of the optical system.}\label{fig2}
\end{figure}
 
The results are shown in Figs.~\ref{fig1}-\ref{fig2} for the situation where Alice and Bob use two decoy states each. 
In this scenario, 
we obtain 
the 
parameters $n_{k,0}$, $n_{k,1}$ and $e_{k,1}$ using the analytical estimation procedure introduced above 
(see Appendix~\ref{ap_anal} for more details).
The first figure illustrates the secret key rate (per pulse) $\ell/N$ as a function of the distance
between Alice and Bob 
for different values of the total number of signals $N$ sent. 
We fix $\epsilon_{\rm cor}=10^{-15}$; this corresponds to a realistic
hash tag size in practice \cite{RennerThesis}. 
Also, we fix
the intensity of the weakest 
decoy states to $a_{\rm d_2}=b_{\rm d_2}=5\times10^{-4}$, since, in practice, is 
difficult to generate a vacuum state due to imperfect extinction. This value for $a_{\rm d_2}$ and $b_{\rm d_2}$ can be easily achieved with 
a standard intensity modulator. 
Moreover, for simplicity, we assume an 
error correction leakage that is a fixed fraction of the sifted key length $n_k$, i.e.,
${\rm leak}_{{\rm EC},k}=n_k\zeta{}h(E_k^{a_{\rm s},b_{\rm s}})$, 
with $\zeta=1.16$ and 
where 
$h(\cdot)$
is again the binary Shannon entropy \cite{finite1}.
In a realistic scenario, however, the value of $\zeta$ typically depends on the 
value of $n_k$, and when $n_k< 10^5$ the parameter 
$\zeta$ may be bigger than $1.16$. 
For a given distance, we optimise numerically $\ell/N$ over all the 
free parameters of the protocol. This includes the intensities 
$a_{\rm s}, a_{\rm d_1}, b_{\rm s}$ and $b_{\rm d_1}$,
the probability 
distributions $p_{a,\alpha}$ and $p_{b,\beta}$
in the state preparation step, the parameters 
$N_k^{a,b}$ and $M_k^{a,b}$ in the sifting step, the term
$n_k$ in the parameter estimation step,
and the different epsilons contained in $\epsilon_{\rm sec}$. 
Our simulation result shows clearly that mdiQKD is feasible
with current technology and does not
require high efficiency detectors for its implementation.
If Alice and Bob use laser diodes operating at $1$ GHz repetition rate,
and each of them sends $N=10^{13}$ signals,
we find, for instance, that they can distribute a 
$1$ Mb secret key over a $75$ km fiber link in less than $3$ hours. 
This scenario corresponds to the
red line shown in Fig.~\ref{fig1}. 
Notice that, at telecom wavelengths, standard InGaAs detectors have
modest detection efficiency of about $15\%$. Since mdiQKD requires
two-fold coincidence rather than single-detection events, as is the case in the
standard decoy state protocol, the key rate of mdiQKD is
lower than that of the standard decoy state scheme. However,
with high-efficiency detectors such as silicon detectors~\cite{det1}
in $800$nm or high-efficiency SSPDs~\cite{det2}, the key rate of
mdiQKD can be made comparable to that of the standard decoy state protocol.

The second figure illustrates $\ell/N$ as a function of $N$ for different 
values of the misalignment in the limit of zero distance. 
For comparison, this figure also includes the asymptotic secret key rate 
when Alice and Bob send an infinite number of signals and
use an infinite number of decoy states \cite{mdiQKD}. 
Our results show that significant secret key rates are already possible with
$10^{11}$ signals, given that the error rate is not too large. 

\section{Conclusion}

We have proved the security of 
mdiQKD in the finite-key regime against general attacks. 
This is the only known
fully practical QKD protocol that offers an avenue to bridge the 
gap between theory and practice in QKD implementations. 
Importantly, our results clearly demonstrate that even with practical 
signals [e.g., phase-randomised weak coherent pulses (WCPs)] and 
a finite size of data (say $10^{12}$ to $10^{14}$ signals) it is possible to 
perform secure mdiQKD over long distances (up to about $150$ km). 

To achieve high secret key 
rates in such high-loss regime, it is typical 
both for standard QKD schemes and
mdiQKD
to use decoy state techniques. A main challenge in this scenario is to obtain tight bounds 
for the gain and quantum bit error rate (QBER) of the single-photon components
sent by Alice and Bob. We have shown that this estimation problem can be successfully 
solved using techniques in large deviation theory, more precisely, 
the Chernoff bound. This result takes advantage of the property of the 
distribution, and thus provides good bounds for the relevant 
parameters even in the presence of high losses, as is the case in QKD realisations. 

Using the Chernoff bound we have rewritten the problem of
estimating the gain and QBER of the single-photon signals 
as a linear program, 
which
 can be solved efficiently 
in polynomial time. This general method is valid for any finite number of decoy states, and
for any photon-number distribution of the signals. It can be used, 
for instance, with
laser diodes emitting phase-randomised WCPs, triggered spontaneous parametric 
down-conversion sources, 
and practical single-photon sources. 
Also, for the common
scenario where 
Alice and Bob send phase-randomised WCPs together with two decoy states each, we
have obtained tight analytical bounds for the quantities above. These results apply 
to different types of coding schemes like, for example, 
polarisation, phase or time-bin coding.

\section{Acknowledgements}

We thank Xiongfeng Ma and Johan L\"ofberg for valuable comments
and stimulating discussions, and 
Lina M. Eriksson
for comments on the writing and presentation of the paper. 
F. Xu. thanks the Paul Biringer Graduate Scholarship for financial support.
We
acknowledge support from the European Regional Development Fund (ERDF),
the Galician Regional Government (projects CN2012/279 and CN 2012/260,
``Consolidation of Research Units: AtlantTIC"), 
NSERC, the CRC program, 
the
National Centre of Competence in Research QSIT, 
the Swiss NanoTera project QCRYPT, the FP7 Marie-Curie IAAP
QCERT project, and CHIST-ERA project DIQIP.
K.T. acknowledges support from the project ``Secure photonic network technology''
as part of ``The project UQCC'' by the National
Institute of Information and Communications Technology
(NICT) of Japan, and from the Japan Society for
the Promotion of Science (JSPS) through its Funding
Program for World-Leading Innovative R\&D on Science
and Technology (FIRST Program).

