{'fraction_non_alphanumeric': 0.03852387729285262, 'fraction_numerical': 0.01502213788741303, 'mean_word_length': 4.098558903557392, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 7, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 11, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Passive decoy state quantum key distribution with practical light sources

Decoy states have been proven to be a very useful method for significantly enhancing the performance of quantum key distribution systems with practical light sources. While active modulation of the intensity of the laser pulses is an effective way of preparing decoy states in principle, in practice passive preparation might be desirable in some scenarios. Typical passive schemes involve parametric down-conversion. More recently, it has been shown that phase randomized weak coherent pulses (WCP) can also be used for the same purpose [M. Curty {\it et al.}, Opt. Lett. {\bf 34}, 3238 (2009).] This proposal requires only linear optics together with a simple threshold photon detector, which shows the practical feasibility of the method. Most importantly, the resulting secret key rate is comparable to the one delivered by an active decoy state setup with an infinite number of decoy settings. In this paper we extend these results, now showing specifically the analysis for other practical scenarios with different light sources and photo-detectors. In particular, we consider sources emitting thermal states, phase randomized WCP, and strong coherent light in combination with several types of photo-detectors, like, for instance, threshold photon detectors, photon number resolving detectors, and classical photo-detectors. Our analysis includes as well the effect that detection inefficiencies and noise in the form of dark counts shown by current threshold detectors might have on the final secret ket rate. Moreover, we provide estimations on the effects that statistical fluctuations due to a finite data size can have in practical implementations.


I. INTRODUCTION
Quantum key distribution (QKD) is the first quantum information task that reaches the commercial market to offer efficient and user-friendly cryptographic systems providing an unprecedented level of security [1]. It allows two distant parties (typically called Alice and Bob) to establish a secure secret key despite the computational and technological power of an eavesdropper (Eve), who interferes with the signals [2]. This secret key is the essential ingredient of the one-time-pad or Vernam cipher [3], the only known encryption method that can deliver information-theoretic secure communications.
Practical implementations of QKD are usually based on the transmission of phase randomized weak coherent pulses (WCP) with typical average photon number of 0.1 or higher [4]. These states can be easily prepared using only standard semiconductor lasers and calibrated attenuators. The main drawback of these systems, however, arises from the fact that some signals may contain more than one photon prepared in the same quantum state. When this effect is combined with the considerable attenuation introduced by the quantum channel (about 0.2 dB/km), it opens an important security loophole. Eve can perform, for instance, the so-called Photon Number Splitting attack on the multi-photon pulses [5]. This at-tack provides her with full information about the part of the key generated with the multi-photon signals, without causing any disturbance in the signal polarization. As a result, it turns out that the standard BB84 protocol [6] with phase randomized WCP can deliver a key generation rate of order O(η 2 ), where η denotes the transmission efficiency of the quantum channel [7,8]. This poor performance contrasts with the one expected from a QKD scheme using a single photon source, where the key generation rate scales linearly with η.
A significant improvement of the achievable secret key rate can be obtained if the original hardware is slightly modified. For instance, one can use the so-called decoy state method [9,10,11,12], which can basically reach the performance of single photon sources. The essential idea behind decoy state QKD with phase randomized WCP is quite simple: Alice varies, independently and randomly, the mean photon number of each signal state she sends to Bob by employing different intensity settings. This is typically realized by means of a variable optical attenuator (VOA) together with a random number generator. Eve does not know a priori the mean photon number of each signal state sent by Alice. This means that her eavesdropping strategy can only depend on the actual photon number of these signals, but not on the particular intensity setting used to generate them. From the measurement results corresponding to different intensity settings, the legitimate users can obtain a better estimation of the behavior of the quantum channel. This fact translates into an enhancement of the resulting secret key rate. The decoy state technique has been successfully implemented in several recent experiments [13], which show the practical feasibility of this method.
While active modulation of the intensity of the pulses suffices to perform decoy state QKD in principle, in practice passive preparation might be desirable in some scenarios. For instance, in those experimental setups operating at high transmission rates. Passive schemes might also be more resistant to side channel attacks than active systems. For example, if the VOA which changes the intensity of Alice's pulses is not properly designed, it may happen that some physical parameters of the pulses emitted by the sender depend on the particular setting selected. This fact could open a security loophole in the active schemes.
Known passive schemes rely typically on the use of a parametric down-conversion (PDC) source together with a photon detector [14,15,16]. The main idea behind these proposals comes from the photon number correlations that exist between the two output modes of a PDC source. By measuring the photon number distribution of one output mode it is possible to infer the photon number statistics of the other mode. In particular, Ref. [14] considers the case where Alice measures one of the output modes by means of a time multiplexed detector (TMD) which provides photon number resolution capabilities [17]; Ref. [15] analyzes the scenario where the detector used by Alice is just a simple threshold detector, while the authors of Ref. [16] generalize the ideas introduced by Mauerer et al. in Ref. [14] to QKD setups using triggered PDC sources. All these schemes nearly reach the performance of a single photon source.
More recently, it has been shown that phase randomized WCP can also be used for the same purpose [18]. That is, one does not need a non-linear optics network preparing entangled states. The crucial requirement of a passive decoy state setup is to obtain correlations between the photon number statistics of different signals; hence it is sufficient that these correlations are classical. The main contribution of Ref. [18] is rather simple: When two phase randomized coherent states interfere at a beam splitter (BS), the photon number statistics of the outcome signals are classically correlated. This effect contrasts with the one expected from the interference of two pure coherent states with fixed phase relation at a BS. In this last case, it is well known that the photon number statistics of the outcome signals is just the product of two Poissonian distributions. Now the idea is similar to that of Refs. [14,15,16]: By measuring one of the two outcome signals of the BS, the conditional photon number distribution of the other signal varies depending on the result obtained [18]. In the asymptotic limit of an infinite long experiment, it turns out that the secret key rate provided by such a passive scheme is similar to the one delivered by an active decoy state setup with infinite decoy settings [18]. A similar result can also be obtained when Alice uses heralded single-photon sources showing non-Poissonian photon number statistics [19].
In this paper we extend the results presented in Ref. [18], now showing specifically the analysis for other practical scenarios with different light sources and photodetectors. In particular, we consider sources emitting thermal states and phase randomized WCP in combination with threshold detectors and photon number resolving (PNR) detectors. In the case of threshold detectors, we include as well the effect that detection inefficiencies and dark counts present in current measurement devices might have on the final secret ket rate. For simplicity, these measurement imperfections were not considered in Ref. [18]. On the other hand, PNR detectors allows us to obtain ultimate lower bounds on the maximal performance that can be expected at all from this kind of passive setups. We also present a passive scheme that employs strong coherent light and does not require the use of single photon detectors, but it can operate with a simpler classical photo-detector. This fact makes this setup specially interesting from an experimental point of view. Finally, we provide an estimation on the effects that statistical fluctuations due to a finite data size can have in practical implementations.
The paper is organized as follows. In Sec. II we review very briefly the concept of decoy state QKD. Next, in Sec. III we present a simple model to characterize the behavior of a typical quantum channel. This model will be relevant later on, when we evaluate the performance of the different passive schemes that we present in the following sections. Our starting point is the basic passive decoy state setup introduced in Ref. [18]. This scheme is explained very briefly in Sec. IV. Then, in Sec. V we analyze its security when Alice uses a source of thermal light. Sec. VI and Sec. VII consider the case where Alice employs a source of coherent light. First, Sec. VI investigates the scenario where the states prepared by Alice are phase randomized WCP. Then, Sec. VII presents a passive decoy state scheme that uses strong coherent light. In Sec. VIII we discuss the effects of statistical fluctuations. Finally, Sec. IX concludes the paper with a summary.

II. DECOY STATE QKD
In decoy state QKD Alice prepares mixtures of Fock states with different photon number statistics and sends these states to Bob [9,10,11,12]. The photon number distribution of each signal state is chosen, independently and at random, from a set of possible predetermined settings. Let p l n denote the conditional probability that a signal state prepared by Alice contains n photons given that she selected setting l, with l ∈ {0, . . . , m}. For instance, if Alice employs a source of phase randomized WCP then p l n = e −µ l µ n l /n!, and she varies the mean photon number (intensity) µ l of each signal. Assuming that Alice has choosen setting l, such states can be described as where |n denote Fock states with n photons. The gain Q l corresponding to setting l, i.e., the probability that Bob obtains a click in his measurement apparatus when Alice sends him a signal state prepared with setting l, can be written as where Y n denotes the yield of an n-photon signal, i.e., the conditional probability of a detection event on Bob's side given that Alice transmitted an n-photon state. Similarly, the quantum bit error rate (QBER) associated to setting l, that we shall denote as E l , is given by with e n representing the error rate of an n-photon signal. Now the main idea of decoy state QKD is very simple. From the observed data Q l and E l , together with the knowledge of the photon number distributions p l n , Alice and Bob can estimate the value of the unknown parameters Y n and e n just by solving the set of linear equations given by Eqs. (2)-(3). For instance, in the general scenario where Alice employs an infinite number of possible decoy settings then she can estimate any finite number of parameters Y n and e n with arbitrary precision. On the other hand, if Alice and Bob are only interested in the value of a few probabilities (typically Y 0 , Y 1 , and e 1 ), then they can estimate them by means of only a few different decoy settings [10,11,12].
In this paper we shall consider that Alice and Bob treat each decoy setting separately, and they distill secret key from all of them. We use the security analysis presented in Ref. [10], which combines the results provided by Gottesman-Lo-Lütkenhaus-Preskill (GLLP) in Ref. [8] (see also Ref. [20]) with the decoy state method. Specifically, the secret key rate formula can be written as where R l satisfies The parameter q is the efficiency of the protocol (q = 1/2 for the standard BB84 protocol [6], and q ≈ 1 for its efficient version [21]); f (E l ) is the efficiency of the error correction protocol as a function of the error rate E l [22], typically f (E l ) ≥ 1 with Shannon limit f (E l ) = 1; e 1 denotes the single photon error rate; is the binary Shannon entropy function.
To apply the secret key rate formula given by Eq. (5) one needs to solve Eqs. (2)-(3) in order to estimate the quantities Y 0 , Y 1 , and e 1 . For that, we shall use the procedure proposed in Ref. [12]. This method requires that the probabilities p l n satisfy certain conditions. It is important to emphasize, however, that the estimation technique presented in Ref. [12] only constitutes a possible example of a finite setting estimation procedure and no optimality statement is given. In principle, many other estimation methods are also available for this purpose, like, for instance, linear programming tools [23], which might result in a sharper, or for the purpose of QKD better, bounds on the considered probabilities.

III. CHANNEL MODEL
In this section we present a simple model to describe the behavior of a typical quantum channel. This model will be relevant later on, when we evaluate the performance of the passive decoy state setups that we present in the following sections. In particular, we shall consider the channel model used in Refs. [10,12]. This model reproduces a normal behavior of a quantum channel, i.e., in the absence of eavesdropping. Note, however, that the results presented in this paper can also be applied to any other quantum channel, as they only depend on the observed gains Q l and error rates E l .

A. Yield
There are two main factors that contribute to the yield of an n-photon signal: The background rate Y 0 , and the signal states sent by Alice. Usually Y 0 is, to a good approximation, independent of the signal detection. This parameter depends mainly on the dark count rate of Bob's detection apparatus, together with other background contributions like, for instance, stray light coming from timing pulses which are not completely filtered out in reception. In the scenario considered, the yields Y n can be expressed as [10,12] where η sys represents the overall transmittance of the system. This quantity can be written as where η channel is the transmittance of the quantum channel, and η Bob denotes the overall transmittance of Bob's detection apparatus. That is, η Bob includes the transmittance of any optical component within Bob's measurement device and the detector efficiency. The parameter η channel can be related with a transmission distance d measured in km for the given QKD scheme as where α represents the loss coefficient of the channel (e.g., an optical fiber) measured in dB/km.

B. Quantum bit error rate
The n-photon error rate e n is given by [10,12] where e d is the probability that a signal hits the wrong detector on Bob's side due to the misalignment in the quantum channel and in his detection setup. For simplicity, here we assume that e d is a constant independent of the distance. Moreover, from now on we shall consider that the background is random, i.e., e 0 = 1/2.

IV. PASSIVE DECOY STATE QKD SETUP
The basic setup is rather simple [18]. It is illustrated in Fig. 1. Suppose two Fock diagonal states interfere at a BS of transmittance t. If the probabilities p n and r n are properly selected, then it turns out that the photon number distributions of the two outcome signals can be classically correlated. By measuring the signal state in mode b, therefore, the conditional photon number statistics of the signal state in mode a vary depending on the result obtained.
In the following sections we analyze the setup represented in Fig. 1 for different light sources and photodetectors. We start by considering a simple source of thermal states. Afterwards, we investigate more practical sources of coherent light.

V. THERMAL LIGHT
Suppose that the signal state ρ which appears in Fig. 1 is a thermal state of mean photon number µ. Such state can be written as and let σ be a vacuum state. In this scenario, the joint probability of having n photons in output mode a and m photons in output mode b (see Fig. 1) has the form That is, depending on the result of Alice's measurement in mode b, the conditional photon number distribution of the signals in mode a varies.
In particular, we have that whenever Alice ignores the result of her measurement, the total probability of finding n photons in mode a can be expressed as Next, we consider the case where Alice uses a threshold detector to measure mode b.

A. Threshold detector
Such a detector can be characterized by a positive operator value measure (POVM) which contains two elements, F vac and F click , given by [24] The parameter η d denotes the detection efficiency of the detector, and ǫ represents its probability of having a dark count. Eq. (14) assumes that ǫ is, to a good approximation, independent of the incoming signals. The outcome of F vac corresponds to "no click" in the detector, while the operator F click gives precisely one detection "click", which means at least one photon is detected. The joint probability for seeing n photons in mode a and no click in the threshold detector, which we shall denote as pc n , has the form with the parameter r given by  Fig. 1): qc n (black) versus q c n (grey) when ρ is given by Eq. (11), and σ is a vacuum state. We use µ = 1 and t = 1/2, and we study two situations: (A) A perfect threshold photon detector, i.e., ǫ = 0 and η d = 1, and (B) ǫ = 3.2 × 10 −7 and η d = 0.12. These last data correspond to the experiment reported by Gobby et al. in Ref. [25].
If the detector produces a click, the joint probability of finding n photons in mode a is given by Figure 2 shows the conditional photon number statistics of the outcome signal in mode a depending on the result of the threshold detector (click and not click): q c n = p c n /(1 − N th ) and qc n = pc n /N th , with B. Lower bound on the secret key rate We consider that Alice and Bob distill secret key both from click and no click events. The calculations to estimate the yields Y 0 and Y 1 , together with the single photon error rate e 1 , are included in Appendix A.
For simulation purposes we use the channel model described in Sec. III. After substituting Eqs. (6)-(9) into the gain and QBER formulas we obtain that the parameters Qc, Ec, Q t , and E t can be written as where The resulting lower bound on the secret key rate is illustrated in Fig. 3 Fig. 1 with two intensity settings. The signal state ρ is given by Eq. (11), and σ is a vacuum state. We consider two possible scenarios: (A) A perfect threshold detector, i.e., ǫ = 0 and η d = 1, and (B) ǫ = 3.2 × 10 −7 and η d = 0.12 [25]. Both cases provide approximately the same final key rate and they cannot be distinguished with the resolution of this figure (dashed line). The solid line represents a lower bound on R when Alice employs a PNR detector instead of a threshold detector (see Appendix B 1).
that q = 1, and f (E c ) = f (Ec) = 1. 22. These data are used as well for simulation purposes in the following sections. We study two different scenarios: (A) A perfect threshold detector, i.e., ǫ = 0 and η d = 1, and (B) ǫ = 3.2 × 10 −7 and η d = 0.12 [25]. In both cases we find that the values of the mean photon number µ and the transmittance t which maximize the secret key rate formula are quite similar and almost constant with the distance. In particular, µ is quite strong (around 200 in the simulation), while t is quite weak (around 10 −3 ). This result is not surprising. When µ ≫ 1 and t ≪ 1, Alice's threshold detector produces a click most of the times. Then, in the few occasions where Alice actually does not see a click in her measurement device, she can be quite confident that the signal state that goes to Bob is quite weak. Note that in this scenario the conditional photon number statistics qc n satisfy qc 0 ≈ 1 and qc n≥1 ≈ 0. Similarly to the one weak decoy state protocol proposed in Ref. [12], this fact allows Alice and Bob to obtain an accurate estimation of Y 1 and e 1 , which results into an enhancement of the achievable secret key rate and distance. The cutoff point where the secret key rate drops down to zero is l ≈ 126 km.
One can improve the resulting secret key rate further by using a passive scheme with more intensity settings. For instance, Alice may employ a PNR detector instead of a threshold detector, or she could use several threshold detectors in combination with beam splitters. In this context, see also Ref. [16]. Figure 3 illustrates also this last scenario, for the case where Alice uses a PNR detector (solid line). As expected, it turns out that now the legitimate users can estimate the actual value of the relevant parameters Y 0 , Y 1 , and e 1 with arbitrary precision (see Appendix B 1). The cutoff point where the secret key rate drops down to zero is l ≈ 147 km. This result shows that the performance of the passive setup represented in Fig. 1 with a threshold detector is already close to the best performance that can be achieved at all with such an scheme and the security analysis provided in Refs. [8,20].

VI. WEAK COHERENT LIGHT
Suppose now that the signal states ρ and σ which appear in Fig. 1 are two phase randomized WCP emitted by a pulsed laser source. That is, with µ 1 and µ 2 denoting, respectively, the mean photon number of the two signals. In this scenario, the joint probability of having n photons in output mode a and m photons in output mode b can be written as [18] where the parameters υ, γ, and ξ, are given by This result differs from the one expected from the interference of two pure coherent states with fixed phase relation, | √ µ 1 e iφ1 and | √ µ 2 e iφ2 , at a BS of transmittance t. In this last case, p n,m is just the product of two Poissonian distributions. Whenever Alice ignores the result of her measurement in mode b, then the probability of finding n photons in mode a can be expressed as which turns out to be a non-Poissonian probability distribution [18]. Let us now consider the case where Alice uses a threshold detector to measure output mode b.

A. Threshold detector
The analysis is completely analogous to the one presented in Sec. V A. In particular, the joint probability for ε=3.2×10 , η =0.12 Fig. 1): q c n (black) versus qc n (grey) when the signal states ρ and σ are two phase randomized WCP given by Eq. (20). We consider that µ1 = µ2 = 1 and t = 1/2, and we study two situations: (A) A perfect threshold photon detector, i.e., ǫ = 0 and η d = 1 [18], and (B) ǫ = 3.2 × 10 −7 and η d = 0.12. These last data correspond to the experiment reported by Gobby et al. in Ref. [25]. Cases C and D represent q c n (black) versus a Poissonian distribution of the same mean photon number for the two scenarios described above (perfect and imperfect threshold photon detector). seeing n photons in mode a and no click in the threshold detector has now the form On the other hand, if the detector produces a click, the joint probability of finding n photons in mode a is given by Eq. (17). Figure 4 (Cases A and B) shows the conditional photon number statistics of the outcome signal in mode a depending on the result of the detector (click and no click): q c n = p c n /(1 − N w ) and qc n = pc n /N w , with and where I q,z represents the modified Bessel function of the first kind [26]. This function is defined as [26] I q,z = 1 2πi e (z/2)(t+1/t) t −q−1 dt. Figure 4 includes as well a comparison between q c n and a Poissonian distribution of the same mean photon number (Cases C and D). Both distributions, q c n and qc n , are also non-Poissonian.

B. Lower bound on the secret key rate
To apply the secret key rate formula given by Eq. (5), with l ∈ {c,c}, we need to estimate the quantities Y 0 , Y 1 , and e 1 . For that, we follow the same procedure explained in Appendix A. This method requires that p t n and pc n satisfy certain conditions that we confirmed numerically. As a result, it turns out that the bounds given by Eqs. (A10)-(A16) are also valid in this scenario.
The only relevant statistics to evaluate Eqs. (A10)-(A16) are p t n and pc n , with n = 0, 1, 2. These probabilities can be obtained by solving Eqs. (23)- (24). They are given in Appendix C. Note that p c n can be directly calculated from these two statistics by means of Eq. (17). After substituting Eqs. (6)-(9) into the gain and QBER formulas we obtain with the parameter ω given by The resulting lower bound on the secret key rate is illustrated in Fig. 5. We assume that t = 1/2, i.e., we consider a simple 50 : 50 BS. Again, we study two different situations: (A) ǫ = 0 and η d = 1 [18], and (B) ǫ = 3.2 × 10 −7 and η d = 0.12 [25]. In both cases the optimal values of the intensities µ 1 and µ 2 are almost constant with the distance. One of them is quite weak (around 10 −4 ), while the other one is around 0.5. The reason for this result can be understood as follows. When the intensity of one of the signals is really weak, the output photon number distributions in mode a are always close to a Poissonian distribution (for click and no click events). This distribution is narrower than the one arising when both µ 1 and µ 2 are of the same order of magnitude. In this case, a better estimation of Y 1 and e 1 can be derived, and this fact translates into a higher secret key rate. It must be emphasized, however, that from an experimental point of view this solution might not be optimal. Specially, since in this scenario the two output distributions p c n and pc n might be too close to each other for being distinguished in practice. This effect could be specially relevant when one considers statistical fluctuations due to finite data size (see Sec. VIII). For instance, small fluctuations in a practical system could overwhelm the tiny difference between the decoy state and the signal state in this case. Figure 5 includes as well the secret key rate of an active asymptotic decoy state QKD system with infinite decoy settings [10]. The cutoff points where the secret key rate drops down to zero are l ≈ 128 km (passive setup with two intensity settings) and l ≈ 147 km (active asymptotic setup). From these results we see  Fig. 1 with two intensity settings. The signal states ρ and σ are two phase randomized WCP given by Eq. (20). The transmittance of the BS is t = 1/2. We consider two possible scenarios: (A) ǫ = 0 and η d = 1 [18] (i.e., a perfect threshold photon detector), and (B) ǫ = 3.2 × 10 −7 and η d = 0.12 [25]. Both cases provide approximately the same final key rate and they cannot be distinguished with the resolution of this figure (dashed line). The solid line represents a lower bound on R for an active asymptotic decoy state system with infinite decoy settings [10]. This last result coincides approximately with the case where Alice employs a PNR detector (see Appendix B 2), and the secret key rate is both scenarios cannot be distinguished with the resolution of this figure. that the performance of the passive scheme with a threshold detector is comparable to the active one, thus showing the practical interest of the passive setup. Like in Sec. V, one can improve the performance of the passive scheme further by using more intensity settings. The case where Alice uses a PNR detector is analyzed in Appendix B 2. The result is also shown in Fig. 5. It reproduces approximately the behavior of the asymptotic active setup and the secret key rate is both scenarios cannot be distinguished with the resolution of this figure (solid line). This result is not surprising, since in both situations (passive and active) we apply Eq. (5) with the actual values of the parameters Y 0 , Y 1 , and e 1 . The only difference between these two setups arises from the photon number distribution of the signal states that go to Bob. In particular, while in the passive scheme the relevant statistics are given by Eq. (B9), in the active setup these statistics have the form given by Eq. (B12).

C. Alternative implementation scheme
The passive setup illustrated in Fig. 1 requires that Alice employs two independent sources of signal states. This fact might become specially relevant when she uses phase randomized WCP, since in this situation none of the signal states entering the BS can be the vacuum state. Otherwise, the photon number distributions of the output signals in mode a and mode b would be statistically independent. Alternatively to the passive scheme shown in Fig. 1, Alice could as well employ, for instance, the scheme illustrated in Fig. 6. This setup has only one laser diode, but follows a similar spirit like the original scheme in Fig. 1, where a photo-detector is used to measure the output signals in mode b. It includes, however, an intensity modulator (IM) to block either all the even or all the odd pulses in mode a. This requires, therefore, an active control of the functioning of the IM, but note that no random number generator is needed here. The main reason for blocking half of the pulses in mode a is to suppress possible correlations between them. That is, the action of the IM guarantees that the signal states that go to Bob are tensor product of mixtures of Fock states. Then, one can directly apply the security analysis provided in Refs. [8,10,20]. Thanks to the one-pulse delay introduced by one arm of the interferometer, together with a proper selection of the transmittance t 1 , it can be shown that both setups in Fig. 1 and Fig. 6 are completely equivalent, except from the resulting secret key rate. More precisely, the secret key rate in the active scheme is half the one of the passive setup, since half of the pulses are now discarded.

VII. STRONG COHERENT LIGHT
Let us now consider the passive decoy state setup illustrated in Fig. 7. This scheme presents two main differences with respect to the passive system analyzed in Sec. VI. In particular, the mean photon number (intensity) of the signal states ρ and σ is now very high; for instance, ≈ 10 8 photons. This fact allows Alice to use a simple classical photo-detector to measure the pulses in mode b, which makes this scheme specially suited for experimental implementations. Moreover, it has an additional BS of transmittance t 2 to attenuate the signal states in mode a and bring them to the QKD regimen.
Due to the high intensity of the input signal states ρ and σ, we can describe the action of the first BS in  by means of a classical model. Specifically, let I 1 (I 2 ) represent the intensity of the input states ρ (σ), and let I a (θ) [I b (θ)] be the intensity of the output pulses in mode a (b). Here the angle θ is just a function of the relative phase between the two input states. It is given by where φ 1 (φ 2 ) denotes the phase of the signal ρ (σ). Like in Sec. VI, we assume that these phases are uniformly distributed between 0 and 2π for each pair of input states. This can be achieved, for instance, if Alice uses two pulsed laser sources to prepare the signals ρ and σ. With this notation, we have that I a (θ) and I b (θ) can be expressed as I a (θ) = t 1 I 1 + r 1 I 2 + 2 t 1 r 1 I 1 I 2 cos θ, I b (θ) = r 1 I 1 + t 1 I 2 − 2 t 1 r 1 I 1 I 2 cos θ, where t 1 denotes the transmittance of the BS, and r 1 = 1 − t 1 .

A. Classical threshold detector
For simplicity, we shall consider that Alice uses a perfect classical threshold detector to measure the pulses in mode b. For each incoming signal, this device tells her whether its intensity is below or above a certain threshold value I M that satisfies I b (π) > I M > I b (0). That is, the value of I M is between the minimal and maximal possible values of the intensity of the pulses in mode b. Note, however, that the analysis presented in this section can be straightforwardly adapted to cover also the case of an imperfect classical threshold detector, or a classical photo-detector with several threshold settings. Figure 8 shows a graphical representation of I b (θ) versus the angle θ, together with the threshold value I M . The angle θ th which satisfies I b (θ th ) = I M is given by θ th = arccos r 1 I 1 + t 1 I 2 − I M 2 √ t 1 r 1 I 1 I 2 .
(31)  Fig. 7) versus the angle θ. IM represents the threshold value of the classical threshold detector, and θ th is its associated threshold angle.
Whenever the classical threshold detector provides Alice with an intensity value below I M , it turns out that the unnormalized signal states in mode c can be expressed as This means, in particular, that the joint probability of finding n photons in mode c and an intensity value below I M in mode b is given by Similarly, we find that p >IM n can be written as

B. Lower bound on the secret key rate
Again, to apply the secret key rate formula given by Eq. (5), with l ∈ {< I M , > I M }, we need to estimate the quantities Y 0 , Y 1 , and e 1 . Once more, we follow the procedure explained in Appendix A. We confirmed numerically that the probabilities p <IM n and p >IM n satisfy the conditions required to use this technique. As a result, it turns out that the bounds given by Eqs. (A10)-(A16) are also valid in this scenario.
For simplicity, we impose I 1 = I 2 = I M ≡ I. This means that θ th = π/2. The relevant statistics p <IM n and p >IM n , with n = 0, 1, 2, are calculated in Appendix D. After substituting Eqs. (6)-(9) into the gain and QBER formulas we obtain where the parameter κ is given by and L q,z represents the modified Struve function [27] defined by Eq. (D2). The resulting lower bound on the secret key rate is illustrated in Fig. 10. We study two different situations: (A) We impose t 1 = 1/2, i.e., we consider a simple 50 : 50 BS, and we optimize the parameter κ, and (B) we optimize both quantities, t 1 and κ. In both scenarios the optimal values of the parameters are almost constant with the distance. In the first case κ is around 0.2, while in the second case we obtain that t 1 and κ are, respectively, around 0.06 and 0.25. The cutoff point where the secret key rate drops down to zero is l ≈ 132 km both in case A and B. These results seem to indicate that this passive scheme can offer a better performance than the passive setups analyzed in Sec. V and in Sec. VI with a threshold photon detector. This fact arises mainly from the probability distributions p <IM n and p >IM n , which, in this scenario, approach a Poissonian distribution when t 2 is sufficiently small. Again, one can improve the performance of this system even further just by using more threshold settings in the classical threshold detector. Moreover, from an experimental point of view, this configutation might be more feasible than using PNR detectors.
To conclude this section, let us mention that, like in Sec. VI C, Alice could as well employ, for instance, the alternative active scheme illustrated in Fig. 11. This setup has only one pulsed laser source, but includes an intensity modulator (IM) to block either all the even or all the odd pulses in mode c. The argumentation here goes exactly the same like in Sec. VI C and we omit it for simplicity. The resulting secret key rate in the active scheme is half the one of the passive setup.

VIII. STATISTICAL FLUCTUATIONS
In this section, we discuss briefly the effect that finite data size in real life experiments might have on the final secret key rate. For that, we follow the statistical fluctuation analysis presented in Ref. [12]. This procedure is based on standard error analysis. That is, we shall assume that all the variables which are measured in the experiment each fluctuates around its asymptotic value.
Our main objective here is to obtain a lower bound on the secret key rate formula given by Eq. (5) under statistical fluctuations. For that, we realize the following four assumptions: 1. Alice and Bob know the photon number statistics of the source well and we do not consider their fluctuations directly. Intuitively speaking, these fluctuations are included in the parameters measuring the gains and QBERs.
2. Alice and Bob use a real upper bound on the single photon error rate e 1 , thus no fluctuations have to be considered for this parameter. In particular, we use the fact that the number of errors within the single photon states cannot be greater than the total number of errors.
3. Alice and Bob use a standard error analysis procedure to deal with the fluctuations of the variables which are measured.
To illustrate our results, we focus on the passive decoy state setup introduced in Sec. VI. Note, however, that a similar analysis can also be applied to the other passive schemes presented in this paper.

A. Active decoy state QKD
In order to make a fair comparison between the active and the passive decoy state QKD setups with two intensity settings, from now on we shall consider an active scheme with only one decoy state [12]. In this last case, the quantities Y 1 and e 1 can be bounded as where µ (ν) denotes the mean photon number of a signal (decoy) state, Q µ (Q ν ) and E µ (E ν ) represent, respectively, its associated gain and QBER, and Y 0 is a free parameter. Using the channel model described in Sec. III, we find that these parameters can be written as If we now apply a standard error analysis to these quantities we obtain that their deviations from the theoretical values are given by where N µ (N ν ) denotes the number of signal (weak decoy) pulses sent by Alice, and u α represents the number standard deviations from the central values. That is, the total number of pulses emitted by the source is just given by N = N µ + N ν . Roughly speaking, this means, for instance, that the gain of the signal states lies in the interval Q µ ± ∆ Qµ except with small probability, and similarly for the other quantities defined in Eq. (39). For example, if we select u α = 10, then the corresponding confidence interval is 1 − 1.5 × 10 −23 , which we use later on for simulation purposes. For simplicity, here we have assumed that Alice and Bob use the standard BB84 protocol, i.e., they keep only half of their raw bits (due to the basis sift). This is the reason for the factor 2 which appears in the last two expressions of Eq. (40). In this context, see also Ref. [28] for a discussion on the optimal value of the parameter q.

B. The background Y0
The bounds given by Eq. (38) depend on the unknown parameter Y 0 . When a vacuum decoy state is applied, the value of Y 0 can be estimated. Alternatively, one can also derive a lower bound on Y 1 and an upper bound on e 1 which do not depend on Y 0 . Specifically, from Eqs. (2)-(3) we obtain that The gains Q µ and Q ν , together with the QBERs E µ and E ν , are directly measured in the experiment, and their statistical fluctuations are given by Eq. (40). On the other hand, we have that with the parameter B given by Combining Eqs. (41)-(42) we find The quantities A and B can be obtained directly from the variables measured in the experiment. Moreover, if one considers the secret key rate formula given by Eq. (5) as a function of the free parameter e 1 , then one should select an upper bound on e 1 , which gives a value (may not be a bound) for Y 1 as where the equation for e U 1 comes from solving the two inequalities given by Eqs. (41)-(42).
Again, using a standard error analysis procedure, we find that the deviations of the parameters A and B from their theoretical values can be written as where the coefficients c 1 and c 2 have the form and the deviations of the gains and the QBERs are given by Eq. (40). For simplicity, we assume now that A and B are statistically independent. Thus, the statistical deviation of the crucial term Y 1 [1 − H 2 (e 1 )] in the secret key formula can be written as In all passive setups the transmittance of the BS is t = 1/2 and we use ǫ = 0. Furthermore, we pick the data size (total number of pulses emitted by Alice) to be N = 6 × 10 9 . The confidence interval for statistical fluctuations is ten standard deviations (i.e., 1 − 1.5 × 10 −23 ).
From Eqs. (40), (46) and (48) one can directly calculate the final secret key rate with statistical fluctuations for an active decoy state setup with only one decoy state [12]. The result is illustrated in Fig. 12 (dashed line). Here we use again the experimental data reported by Gobby et al. in Ref. [25]. Moreover, we pick the data size (total number of pulses emitted by Alice) to be N = 6 × 10 9 . We calculate the optimal values of µ and ν for each fiber length numerically. It turns out that both parameters are almost constant with the distance. One of them is weak (it varies between 0.03 and 0.06), while the other is around 0.48. This figure includes as well the resulting secret key rate for the same setup without considering statistical fluctuations (thick solid line). The cutoff points where the secret key rate drops down to zero are l ≈ 129.5 km (active setup with statistical fluctuations) and l ≈ 147 km (active setup without considering statistical fluctuations). From these results we see that the performance of this active scheme is quite robust against statistical fluctuations.

C. Passive decoy state QKD
The analysis is completely analogous to the previous section. Specifically, we find that the parameters A and B are now given by while Eq. (45) is still valid in this scenario. The deviations of A and B have the form On the other hand, the deviations of the gains and the QBERs can now be written as where Nc denotes the number of pulses where Alice obtained no click in her threshold detector, and N is the total number of pulses emitted by the source. The deviation of the term Y 1 [1 − H 2 (e 1 )] is again given by Eq. (48). The secret key rate for the passive decoy state scheme with WCP introduced in Sec. VI with two intensity settings and considering statistical fluctuations is illustrated in Fig. 12. We assume that t = 1/2, i.e., we consider a simple 50 : 50 BS, and ǫ = 0. The data size is equal to the one of the previous section, i.e., N = 6 × 10 9 . We study two different situations depending on the efficiency of Alice's threshold detector: η d = 1 (thin solid line), and η d = 0.4 (dash-dotted line). In both cases the optimal values of the intensities µ 1 and µ 2 are almost constant with the distance. One of them is weak (it varies between 0.1 and 0.17), while the other is around 0.5. Figure 12 includes as well the resulting secret key rate for the same setup with η d = 1 and without considering statistical fluctuations (dotted line). The cutoff points where the secret key rate drops down to zero are l ≈ 53 km (passive setup with statistical fluctuations and η d = 0.4), l ≈ 80 km (passive setup with statistical fluctuations and η d = 1), and l ≈ 128 km (passive setup without considering statistical fluctuations, see Sec. VI). From these results we see that the performance of the passive schemes introduced in Sec. VI (with statistical fluctuations) depends on the actual value of the efficiency η d . In particular, when Alice's detector efficiency is low, the photon number statistics of the signal states that go to Bob (conditioned on Alice's detection) become close to each other. This effect becomes specially relevant when one considers statistical fluctuations due to finite data size. In this last case, small fluctuations can easily cover the difference between the signal states associated, respectively, to click and no click events on Alice's threshold detector. As a result, the achievable secret key rate and distance decrease.

IX. CONCLUSION
In this paper we have extended the results presented in Ref. [18], now showing specifically the analysis for other practical scenarios with different light sources and photodetectors. In particular, we have considered sources emitting thermal states and phase randomized WCP in combination with threshold detectors and photon number resolving (PNR) detectors. In the case of threshold detectors, we have included as well the effect that detection inefficiencies and dark counts present in current measurement devices might have on the final secret ket rate. For simplicity, these measurement imperfections were not considered in the original proposal. On the other hand, PNR detectors have allowed us to obtain ultimate lower bounds on the maximal performance that can be expected at all from this kind of passive setups. We have also presented a passive scheme that employs strong coherent light and does not require the use of single photon detectors, but it can operate with a simpler classical photo-detector. This fact makes this setup specially interesting from an experimental point of view. Finally, we have provided an estimation on the effects that statistical fluctuations due to a finite data size can have in practical implementations.
since, as we have seen above, p t 2 pc 1 − pc 2 p t 1 ≥ 0. After a short calculation, it turns out that Eq. (A7) can be further simplified to both for l = c and l =c. Finally, from the definition of the probabilities p t n and pc n given by Eqs. (13)-(15), we find that which is greater or equal than zero for all n ≤ 1, and negative otherwise. Note that the first term on the r.h.s. of Eq. (A9) is always greater or equal than zero, and the sign of the second term depends on the value of n, since r ≥ 1 + µt ≥ 1.
We obtain, therefore, that for all l ∈ {c,c}, and where Y u 0 denotes an upper bound on the background rate Y 0 . This parameter can be calculated from Eq.(3). In particular, we have that and similarly for the product QcEc. We find

Upper bound on e1
For this, we proceed as follows: where the inequality condition comes from the fact that p t n pc 0 − pc n p t 0 = (1 − ǫ)(µt) n (1 + µt)r 1 (1 + µt) n − 1 r n ≥ 0, (A14) for all n ≥ 1. From Eq. (A13) we obtain, therefore, that e 1 is upper bounded by (pc where Y L 1 is given by Eq. (A5) with the parameter Y 0 replaced by Y u 0 . On the other hand, note that Eq.(3) also provides a simple upper bound on e 1 . Specifically, and similarly for the product QcEc. Putting all these conditions together, we find that where Y L 0 represents a lower bound on the background rate Y 0 . To calculate this parameter we use the following inequality: since, as we have seen above, p t 1 pc n − pc 1 p t n ≤ 0 for all n ≥ 2. From Eq. (A17) we obtain, therefore, that In this Appendix we study the case where Alice uses a perfect PNR detector to measure the signal states in mode b. The main goal of this analysis is to obtain an ultimate lower bound on the secret key rate that can be achieved at all with the passive decoy state setups introduced in Sec. V and Sec. VI, in combination with the security analysis provided in Refs. [8,20].
A perfect PNR detector can be characterized by a POVM which contains an infinite number of elements, with m = 0, 1, . . . , ∞. The outcome of F m corresponds to the detection of m photons in mode b.

Thermal light
Let us begin by considering the passive scheme analyzed in Sec. V with Alice using a PNR detector. Whenever she finds m photons in mode b, then the joint probability distribution of having n photons in mode a is just when Alice uses a PNR detector, ρ is given by Eq. (11), and σ is a vacuum state: p 0 n (black), p 1 n (grey), and p 2 n (white). We consider that µ = 1, t = 1/2, and n ≤ 5.
given by Eq. (12). Figure 13 shows the conditional photon number statistics in mode a given that mode b contains exactly m photons: p m n = p n,m /N m , with In this scenario, it turns out that Alice and Bob can always estimate any finite number of yields Y n and error rates e n with arbitrary precision. In particular, they can obtain the actual values of the parameters Y 0 , Y 1 , and e 1 . To see this, let Q m denote the overall gain of the signal states sent to Bob when mode b contains exactly m photons, and let the parameters X m and V n be defined as (B3) With this notation, and using the definition of p n,m given by Eq. (12), we find that Eq. (2) can be rewritten as That is, the coefficient matrix of the system of linear equations given by Eq. (B4) for all possible values of m is a symmetric Pascal matrix [29]. This matrix has determinant equal to one and, therefore, in principle can always be inverted [29]. Then, from the knowledge of the coefficients V n , the legitimate users can directly obtain the values of the yields Y n by means of Eq. (B3). A similar argument can also be used to show that Alice and Bob can obtain as well the values of e n . After substituting Eqs. : Conditional photon number distribution in mode a when Alice uses a PNR detector: p 0 n (black), p 1 n (grey), and p 2 n (white). The signal states ρ and σ in Fig. 1 are two phase randomized WCP given by Eq. (20). We consider that µ1 = µ2 = 1, t = 1/2, and n ≤ 5.
In order to evaluate Eq. (5) we need to find the probabilities p 0,m and p 1,m for all m. From Eq. (12) we have that these parameters can be expressed as (B6) The resulting lower bound on the secret key rate is illustrated in Fig. 3 (solid line). The optimal values of the parameters µ and t are quite constant with the distance. Specifically, in this figure we choose µ around 18.5 and t around 0.02.

Weak coherent light
Let us now consider the passive scheme illustrated in Sec. VI with Alice using a PNR detector. Whenever her detector finds m photons in mode b, the joint probability distribution of having n photons in mode a is given by Eq. (21). Figure 14 shows the conditional photon number statistics in mode a given that mode b contains exactly m photons: p m n = p n,m /N m , with To show that the experimental observations associated to different outcomes of the PNR detector allow Alice and Bob to obtain the values of the parameters Y 0 , Y 1 , and e 1 with arbitrary precision, one could follow the same procedure explained in Appendix B 1. That is, one could try to prove that the determinant of the coefficient matrices associated to the systems of linear equations given by Eqs.
(2)-(3) is different from zero also in this scenario. For simplicity, here we have confirmed this statement only numerically.