Phase Noise in Real-World Twin-Field Quantum Key Distribution

The impact of noise sources in real-world implementations of twin-ﬁeld quantum key distribution (TF-QKD) protocols is investigated, focusing on phase noise from photon sources and connecting ﬁbers. This work emphasizes the role of laser quality, network topology, ﬁber length, arm balance, and detector performance in determining key rates. Remarkably, it reveals that the leading TF-QKD protocols are similarly aﬀected by phase noise despite diﬀerent mechanisms. This study demonstrates duty cycle improvements of over a factor of two through narrow-linewidth lasers and phase-control techniques, highlighting the potential synergy with high-precision time and frequency distribution services. Ultrastable lasers, evolving toward integration and miniaturization, oﬀer promising solutions for agile TF-QKD implementations on existing networks. Properly addressing phase noise and practical constraints allows for consistent key rate predictions, protocol selection, and layout design, crucial for establishing secure long-haul links for the quantum communication infrastructures under development in several countries.

Quantum Key Distribution (QKD) protocols have the potential to revolutionize the cryptographic environment, with solutions that enable to share keys between distant parties, with security claims guaranteed by the laws of quantum mechanics [1,2], without assumptions on the computational power of the attacker.After almost 40 years of theoretical work, numerous proof of principle experiments and deployment of testbeds [3][4][5][6][7], nowadays the real objective is the integration of this technology in long-distance fiber networks already utilized for classical telecommunication [8][9][10][11][12][13].It is well understood that the range of QKD links is limited by the channel losses, with the link maximum key rate upper limited by the repeaterless secret-key capacity or Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound [14], which is stricter than a previous upper bound result [15].Trusted nodes are used to extend the achievable range, a temporary solution waiting for true quantum repeaters [16] to become deployable in the field.
Twin-Field Quantum Key Distribution (TF-QKD) is a solution that has been proposed few years ago [17] to mitigate the negative impact of channel loss and reach key rates beyond the PLOB bound without the use of a trusted node.TF-QKD is a type of measurement-device-independent QKD (MDI-QKD) [18] in which the parties Alice and Bob encode information in the properties of dim laser pulses that are sent through optical fibers to a central untrusted relay node, Charlie, where they undergo single-photon interference that overcomes security challenges related to real device imperfections [19,20].An important assumption, that makes these protocols more complex to deploy than, e.g., time-bin encoded Bennett-Brassard 1984 (BB84), is that optical pulses need to be phase-coherent when they are generated in distant locations and preserve coherence throughout the propagation to Charlie in spite of vibrations, seismic noise and temperature fluctuations encountered along the path.The first requirement was initially achieved by mutually phase-locking the photon sources in Alice and Bob, distributing reference-phase information through a service fiber link, while the second is addressed by interleaving the QKD signals with bright reference pulses that probe the fiber to detect and compensate its noise and recover stable interference visibility as required for low-error operation [21,22].These approaches become less effective with long-distance links, reducing the actual duty cycle of the QKD transmission.In recent years, other solutions have been proposed [23,24], based on dual wavelength transmission and active stabilization of the QKD lasers and/or connecting fibers.Since the first proposals, many noise cancellation variants have been implemented, trading-off performance with equipment and infrastructural complexity, which is a concern in the quest for realizing deployed and operational QKD networks at reasonable cost.Emerging laser integration technologies [25][26][27] and interferometric techniques for the fiber length stabilization can play a role in this challenge.In addition, strong synergy exists with the concurrent realization of network-integrated services for the distribution of accurate time and ultrastable optical frequencies at a continental scale [28][29][30][31], also in the frame of European initiatives such as the European Quantum Communication Infrastructure (EuroQCI) [32].Recently, TF-QKD has been demonstrated up to very long distances of 800−1000 km [33,34].These impressive results have been obtained by using controlled low-loss fiber spools, high repetition rates, and ultra low-noise cryogenic superconducting singlephoton detectors.In our work, we focus on setups which could be realistically deployed in the near future, partially employing existing infrastructure.
The present work aims at providing a general formalism to model relevant impairments occurring in real-world point-topoint TF-QKD implementations, as well as the impact of practical constraints such as the length imbalance between the arms of the interferometer, the quality of the employed stabilization laser, the adopted network topology and the characteristics of the channel.The results of this analysis are then used to evaluate the performance of different TF-QKD protocols in terms of key rate vs channel loss/length.Relevant information is condensed in a minimal set of parameters that enables tailoring the analysis to other practical cases and is useful in the design and performance optimization of TF-QKD in real-world sce-

I. INTRODUCTION TO TF-QKD
A minimal model of a TF-QKD setup between two parties, Alice and Bob (abbreviated by A and B, respectively, and collectively indicated by they) must take into account sources, channels, phase-coherence, detectors and protocol.See Fig- ure 1a.
• Sources.We consider attenuated laser sources, producing weak coherent states, characterized by intensities   and phases   , which can be both independently modulated in time by them at a certain nominal clock rate  s .Phase noise of the sources is described in Sec.III.
• Channels.We consider optical fibers characterized by total attenuation (loss)  T or, equivalently, total transmittance  = 10 −  T /10 , with  T measured in dB.The total loss  T =  +  + is customarily given by a term proportional to the distance , with (average) attenuation coefficient , plus additional losses  + due to instrumentation.Since in TF-QKD both of them send signals to the auxiliary node Charlie (C), the relevant distances are  A , on the segment AC between Alice and Charlie, and  B , on the segment BC between Bob and Charlie.Without loss of generality, we assume  A ≥  B and define the residual channel length imbalance as Δ =  A −  B .
In order to maximize interference contrast in C, we balance the transmittances of the two segments in C, i.e.  A =  B , by assuming that a variable optical attenuator is introduced by Charlie on the CB segment.Therefore, the total effective transmittance between A and B is  = ( A ) 2 , corresponding to an effective total fiber length 2 A , which is in general larger than • Coherence.Phase coherence between photon pairs generated at distant locations and interfered in Charlie is a peculiar prerequisite of TF-QKD and affects the overall quantum bit error rate (QBER) and transmission duty cycle.As a figure of merit for phase coherence, we introduce the variance of the phase fluctuations  observed at the detector in Charlie,  2  and quantify its contribution to the QBER as [24] where it is assumed that the phase fluctuations are Gaussian distributed.All protocols include dedicated hardware and routines to keep  2  below a certain threshold during the key transmission, possibly introducing some dead-time and reducing the key rate.We model this effect by multiplying estimated key rates by a duty cycle  =  Q /( Q +  PS ), namely the ratio between the maximum uninterrupted time  Q that is used in the quantum part of the key distribution protocol and the total time including the subsequent overhead spent for phase stabilization  PS . 2  and  Q are not independent: lower system phase noise allows for increasing  Q .Conversely,  Q is upper-bounded by the time it takes for the system to reach a significant threshold for  2   .These aspects are treated in Sec.III.
• Detectors.Charlie performs single-photon interference and detection on the two output branches of the interferometer, besides phase stabilization.The security proofs of the TF-QKD protocols guarantee that Charlie can be untrusted [17,36,37], namely his actions can at worst deny QKD operation, but not leak information to an attacker (Eve).Detectors are characterized by efficiency  D ≤ 1, that reduces the channels' transmission to η =  D .Each detector is crucially characterized by dark counts per transmitted signal  DC given by the ratio of the dark count rate  DC and the clock rate  DC =  DC / s .The interferometer is affected by polarization misalignment , which introduces an error   = (sin /2) 2 , whose impact depends on the used protocol.Considerations about the characterization and improvement of detectors are made in detail in Sec.IV.
• Protocols.After the announcement of measurements by Charlie, Alice and Bob perform classical postprocessing, exchanging information via a classical authenticated channel and estimating error rates from a small sample of the bits which are declared.To guarantee unconditional security, they perform error correction, to reconcile the raw bits, and privacy amplification, to remove the information possessed by Eve [38,39].Error correction reduces the key size by an amount  EC  2 (), where  is the total gain of the signals and  is their total bit-flip QBER.
is the binary entropy and  EC is the inefficiency of error correction, that we customarily set to  EC = 1.15 [1,17].The actual amount of privacy amplification is specific to each QKD implementation, as it depends on the detailed security analysis, protocol and parameters values.When the tagging argument [39] and the decoy-state approach [40][41][42] are applied, typically the key length is reduced by an amount n1  2 ( ēph 1 ), where n1 is the estimated lower bound on the rate of single photon signal states at the detector and ēph 1 is the estimated upper bound on the single photon phase error rate.The total gain and single photon gains possibly include sifting factors depending on the specific protocol.Finally, the lower bound for the secure key per transmitted signal R is to be multiplied by the source repetition rate  s and the duty cycle  to obtain the total key rate.
In the absence of quantum repeaters, the upper bound to secure key rate transmission per signal in a channel of total transmission  is the PLOB bound, namely the secret-key capacity of the channel SKC 0 = − log 2 (1−), that scales as 1.44 at large losses [14].In TF-QKD, what matters is the branch with largest loss, corresponding to  A .One has thus a much weaker dependence on the total distance, since  A =  1/2 when the AC and BC losses have been balanced.This enables overcoming the PLOB bound and represents the most relevant achievement introduced by TF-QKD.

II. TF-QKD PROTOCOLS AND ROLE OF LASER PHASE NOISE
In this Section we discuss two established TF-QKD protocols, Sending-or-Not-Sending (SNS) and Curty-Azuma-Lo (CAL).In the original proposal of TF-QKD by Lucamarini et al. [17], it was assumed that Eve cannot perform a Collective Beamsplitter attack, which relies on the knowledge of the global phase.This information is in fact leaked by the original protocol in order to match the phases chosen by Alice and Bob.Provably secure protocols in the assumption of coherent attacks were later introduced, like SNS and CAL, that rely on separating the communication in signal windows and decoy windows, used for precise parameter estimation.Both the SNS (see [36,43,44] for details) and the CAL ( [37,45,46] protocols employ weak coherent states in two complementary groups: phase mixtures and phase-definite states.Before reporting the key rates of the two protocols (and detailing their main steps in Appendix A and B), we generically comment on their reciprocity.Phase mixtures are phase-randomized coherent states of intensity , which are seen by Charlie and Eve as statistical mixtures of number states |⟩ with Poissonian statistics    =  −   /!.Since the intensity is weak, these mixtures mostly correspond to zero or one photon, and the security proofs relate those states to the eigenstates of the Z operator.These states are then said to belong to the Z basis and the corresponding measurement is related to photon counting.In contrast, by phase-definite states we mean coherent states that are to be employed in an interferometric measurement, which requires that a reference global phase is declared (either before or after Charlie's communication).These states are said to refer to the X basis, because they are related to the coherent superposition of zero and one photons in the security proofs.
The SNS protocol uses the Z basis for encoding [36], depending on the decision by Alice and Bob to send a number state or not.The decoy-state approach to phase error estimation is performed via interferometric measurement in the X basis.For applying standard decoy expressions, notice that the global phase is still randomized by Alice and Bob, but can be reconciled after Charlie's communication of measurement outcome.In contrast, in the CAL protocol, the X basis is used for encoding [37], and coherent states with two possible phases with  difference are interfered in Charlie.Complementary, the counting Z basis is used in the decoy-state analysis, without need for reconciling the global phase.Both protocols remove the possible security issue in the original TF-QKD protocol, related to the need of revealing the global phase at each time window.
The secret key per transmitted signal for the original SNS protocol is formulated in Eq.A1 and we report here its formulation when Sending or not sending with actively odd-parity pairing (SNS-AOPP) is used: While the description of the symbols in the equation is postponed to Appendix A, we discuss here the effect of phase fluctuations in the lasers and in the fiber on the error terms, which dominate the behavior of the key rate formula. ′ Z , the bit-flip error rate, is inherently independent of the phase fluctuations, since the encoding in the Z basis is phase-independent, given the previous considerations.The QKD phase error rate ē′ ph 1 , on the other hand, contains terms related to the phase fluctuations, since there the parties perform an interferometric measurement.In the CAL protocol, the secret key per transmitted signal is estimated as Equation B2 of Appendix B, that we report here: In this case, contrary to the SNS protocol, the bit-flip error  , c  d is increased in the presence of phase fluctuations while ē, c  d does not depend on them, since in the Z basis the states used for the decoy analysis are phase-randomized.

III. MODEL FOR THE LASER PHASE NOISE
As discussed in Sec.II, poor phase coherence between photon pairs interfering in Charlie increases the QBER and reduces the final key rate, although its actual impact significantly depends on the used protocol.In this Section, we explicitly derive decoherence effects for most common TF-QKD topologies and quantify the corresponding QBER.
As a relevant metric to quantify decoherence, in Eq. (1) we introduced the phase variance  2  and its relation to   , suggesting its relation to  Q .Indeed, the integration time that is relevant for calculating  2  during the key transmission corresponds to the maximum uninterrupted transmission time  Q .To operationally quantify the relation between   and  Q , we will employ spectral analysis, as it gives more insight into relevant noise processes, simplifies calculations and is directly related to measurable quantities.We then introduce the noise power spectral density of a variable (),   (  ) = F [R ()], i.e. the Fourier transform of its autocorrelation function R (), and will exploit its properties throughout the text [47].According to the Wiener-Kintchine theorem,   can be conveniently expressed in terms of the phase noise power spectral density   (  ): (  ) is dominated by two contributions.Firstly, photons travel along telecommunication fibers, whose index of refraction  and physical length  change due to temperature, seismic and acoustic noise in the surrounding environment.As a consequence, the phase accumulated by photons traveling through them changes over time.A second contribution comes from the fact that the initial phases of twin photons generated in Alice and Bob cannot be perfectly matched, and the way this mismatch maps onto their interference in Charlie strictly depends on the experimental layout.We will now compare the most used topologies, providing relevant models for the various terms.

A. Common-laser
The typical way to ensure mutual phase coherence between Alice and Bob is to send them a common laser radiation, that can be used as a phase-reference to stabilize the local photon sources, so that they copy the phase of incoming light.This topology is depicted in Figure 1b.The reference laser can be conveniently, though not necessarily, hosted by Charlie.Incoming light in Alice and Bob is then a replica of the reference laser phase with additional noise due to propagation in the fiber (we assume that the stabilization of local laser sources to incoming light does not introduce noise).The residual phase noise recorded upon interference in Charlie is (see Appendix E for derivation): (5) where  l,C (  ) is the noise of the reference laser, assumed to be at Charlie, and  F,A (  ) ( F,B (  )) is the noise of the fiber connecting Charlie to Alice (Bob).The first term accounts for self-delayed interference of the reference laser: it vanishes if the propagation delays to Alice and Bob are equal, and progressively grows for larger length mismatches, with characteristic periodical minima at  = /(2Δ),  integer, being  the vacuum speed of light and  = 1.45 the typical fiber refraction index.
Evidently, the quality of the reference laser impacts the residual noise of the interference.In this work, we consider representative cases of commercial, integrated diode lasers as well as state-of-the-art ultrastable lasers.Expressions and coefficients for the laser noise in these configurations are reported in Appendix F, G and Table III.Intermediate values are also possible, depending on the available technology and specific layout constraints.
The second term in Eq. 5 accounts for the fibers noise and depends on the environment where they are placed: metropolitan fibers affected by vehicle traffic and buildings vibrations show larger levels of noise than cables of similar length in country areas or seafloors.Similarly, suspended cables are found to be noisier than buried cables [48].Finally, the fiber noise may exhibit peaks around mechanical resonances of hosting infrastructures.Reasonable scaling rules hold for buried cables, which are the majority of those used for telecommunications on regional areas, under the assumption that the noise is uncorrelated with position and homogeneously distributed along the fiber.In this case, the noise can be assumed to scale linearly with the fiber length  via an empirical coefficient  [49], and its expression includes a faster roll-off above a characteristic cut-off Fourier frequency  ′ c : The multiplication factor 4 for these terms in Eq. 5 considers that noise is highly correlated for the forward and backward paths and adds up coherently.This is the actual scenario for parallel fibers laid in the same cable at Fourier frequencies  ≪ /( A ), /( B ) .In other cases, this factor is reduced to 2 [49] and Eq. 5 provides thus a conservative estimation.Values for  and  ′ c are derived in Appendix G and reported in Table III.
Remarkably, the common laser approach can be conveniently implemented also in a Sagnac interferometer scheme [45,50,51], where two counter-propagating signals are launched from the central in opposite directions along the same fiber loop, reaching A and B, then looping-back to C. This configuration is inherently immune to length mismatches, hence the first term of Eq. 5 can be always neglected.Therefore the Sagnac-loop approach is particularly convenient in the case of multi-user ring networks.Nonetheless, our analysis is mainly focused on a different kind of architecture, specifically to point-to-point schemes, which can offer longer absolute reaches between two distant users when implemented with active phase noise cancellation techniques, as described subsequently.

B. Independent lasers
Another approach is based on independent lasers at the two terminals [36], that are phase-aligned once at the start of the key transmission window and then let evolve freely for a finite amount of time, after which a new realignment is needed.This topology is sketched in Figure 1c.Following the same approach used to derive Eq. 5, the phase noise of the interference signal in Charlie can then be modeled as: where the first and second terms describe the noise of the lasers at the two nodes, and the third and fourth terms indicate the noise of the fibers.In this topology, the fiber noise appears with coefficient 1, because the photon sources in A and B are independent and there is no round-trip of the radiation into connecting fibers (the auxiliary fiber has no role in this topology, besides classical communication services).All relevant parameters are reported in Table III.We note that again the quality of the used laser sources impacts the ultimate performances of the system, and overall higher instability and longer duty cycles could be achieved by employing lasers with superior phase-coherence.
When compared to the case of a common laser, discussed in the previous Section, the independent lasers approach is convenient from the point of view of the fiber network topology, since only a single fiber is required, and a round-trip is not necessary to distribute the reference laser.However, this introduces the drawback of the requirement of two ultrastable lasers, one in A and one in B. Indeed, here the laser quality plays an important role: in Eq. 7 the laser noise terms sum up in Charlie, and they never cancel out as happens in the case of a common laser with balanced arm lengths as derived in Eq. 5.

C. Fiber noise cancellation strategies
The most impacting term in Eqs. 5 and 7 is the fiber noise, which imposes the need for periodical phase-realignment, thus reducing the duty cycle .This aspect can be addressed with a passive approach in the Sagnac-loop configuration, where to the first order the fiber noise at low frequencies is common-mode, self-compensating down to a limit that depends on the loop length [45,52].For long-range point-topoint connections, recent proposals [23,24] suggested an alternative, usually referenced to as dual band stabilization, that considerably relaxes the phase-realignment need, allowing to achieve  > 0.9 exploiting high-bandwidth active phase noise cancellation techniques.This approach exploits an auxiliary sensing laser, traveling the same fiber as the single-photon packets, although at a detuned wavelength.Spectral separation techniques as those used in classical wavelength-divisionmultiplexing enable to detect interference signals produced by the sensing laser or the quantum signal on separate detectors with minimal cross-talks.The former is used to detect the fiber noise, while the latter performs the usual key extraction.First demonstrations of this approach were applied to the common-laser setup (the corresponding scheme is depicted in Figure 1d), and subsequently adapted to the independentlaser approach [53].Because there is no need to attenuate the sensing laser to the photon counting regime, its interference signal can be revealed by a classical photodiode with high signal-to-noise ratio (SNR).signal/noise ratio.The measurement and compensation of the differential phase noise between the two arms in C allow to overcome the limit given by the light travel delay, observed in alternative noise cancellation schemes [49,52].As a result, the fiber can be phase-stabilized in real-time and with a high bandwidth, e.g. by applying a suitable correction on an in-line phase or frequency modulator.Experimental demonstrations showed efficient rejection of the fibers noise, down to the limit: where  s and  q are the wavelengths of the sensing laser and quantum key transmission signal respectively, and the suppression factor ( s −  q ) 2 / 2 s is set by the fact that the fibers are stabilized based on the information from the former, while the quantum interference occurs at the latter [24].Other reasons for deviation from the expected behavior may be short fiber paths that are not common between the two lasers (e.g.wavelength-selective couplers), whose fluctuations cannot be perfectly canceled.Advanced correction strategies can further suppress these contributions and ensure virtually endless phase stability [23].Finally, detection noise of the sensing laser interference may represent the ultimate practical limit on very lossy links.This aspect is discussed in Appendix G.
Interestingly, it can be seen that if the sensing laser is phasecoherent to the reference laser, i.e.  r () ≈  s (), the residual reference laser noise is canceled out together with the fiber noise.Phase-coherence between lasers separated by 50 GHz or 100 GHz (the minimum spectral separation that allows optical routing with telecom devices) can be achieved by locking multiple lasers to the same cavity or by phase-modulationsideband locking.This concept has been further developed in [53], that successfully conjugates the independent-lasers approach with the fiber stabilization.

IV. IMPROVING DETECTION SNR
The maximum communication distance is limited by the dark count rate  DC of the Single Photon Detectors (SPDs), i.e. the intrinsic level of noise of the detector in the absence of any signal. DC depends on the kind of single-photon detector used and on the operating conditions.At telecom wavelengths the most common solutions are InGaAs/InP Single Photon Avalanche Diodes (SPADs), with either thermoelectric or Stirling cooling, and Superconductive Nanowire Single Photon Detectors (SNSPDs).More details and less common technologies can be found in [54].SNSPDs can reach dark count rates as low as  DC < 0.01 Hz [55], photon detection efficiency above 90 % [56], sub-3 ps timing jitter [57] and dead-time below 1 ns [58].These interesting properties come at the important cost of requiring cryostats capable to operate in the range 1-4 K, which is costly and adds technical limitations.Commercial solutions are now available that allow high-efficiency detection and quite low dark count level (typically 10 Hz), but SPADs are still generally preferred for in-field applications, accepting lower general performance.Modern SPADs, working in gated mode, present photon detection efficiency around 30 % [59], timing jitter below 70 ps [54] and short dead-times, allowing to reach maximum count rates of more than 500 MHz with experimental devices (see, e.g., [60]).Dark count rates vary considerably depending on the temperature of the sensor.Units that use thermoelectric cooling (around −40 • C) report values of hundreds of counts per second [61] or thousands.More effective Stirling coolers (reaching −100 • C) instead have  DC <100 Hz [62].Depending on the applications, other properties like maximum gating frequency, after-pulsing probability, back-flash probability and area of detection need to be taken into account.In a real world QKD implementation, residual background photons due to the environment could be present in the dark fiber.
It is important to reduce background photons at the same level or below the rate of the dark counts of the detectors.There are several sources of background photons.Photons may leak into the dark fiber from nearby fibers laid in the same cable, possibly hosting data traffic at wavelengths close to those used for the TF-QKD encoding.Moreover, in Sagnac-loop and time-multiplexed protocols, where strong classical signals at the quantum wavelength travel along the same fibers, single and double Rayleigh scattering can represent an important source of background photons [45,63].The implementation of dual-band strategies for phase stabilization allows to strongly suppress these effects [23], since phase stabilization relies on a different wavelength that can be suppressed by spectral filters.Nonetheless, advanced approaches to TF-QKD as those described before pose additional challenges.For instance, photons from the reference laser sent from Charlie to Alice and Bob through a separate fiber in the common-laser scheme (III) can be Rayleigh-scattered and evanescently couple to the fiber dedicated to the quantum transmission.Despite the probability of this process, combined to evanescent coupling, is small, the reference laser power must be carefully attenuated to ensure reliable referencing of slave lasers while keeping the background count rate suitably low.For example, the Rayleigh scattering effect becomes negligible when the power of the reference laser sent from Charlie to Alice and Bob through the respective service fibers is of the order of 20 µW [24].This guarantees sufficient reference signal for locking and regenerating the independent laser in Alice and Bob separated by hundreds of km, before being attenuated to the single photon level and encoded, giving negligible contribution to dark counts.
When dual-band noise detection and cancellation are considered, relevant sources of background photons in the quantum channel are the Amplified Spontaneous Emission (ASE) of employed laser sources and the Spontaneous Raman effect.ASE noise from diode or fiber lasers considerably exceeds the spectral separation of the sensing and quantum lasers in a dual-band transmission.As the two co-propagate in the quantum fiber, efficient filtering would be required at the SPDs in Charlie.Standard Bragg-grating filters employed in classical telecommunications have relevant drops in efficiency outside the range 1300 nm-1600 nm, which may result in background ASE photons to fall on the SPDs and must therefore be complemented by dedicated equipment in TF-QKD setups.Raman scattering of the sensing laser propagating in the quantum fiber generates background photons on a broad spectrum, that extends to the QKD wavelength channel.As such it cannot be efficiently filtered out, and the only mitigation strategy is again a careful adjustment of the launched sensing laser power to meet a condition where the Raman photon background remains negligible with respect to the signal.Instead of focusing on ultra-low-noise detectors, in our analysis we considered two realistic scenarios with different commercial detectors: one using best-in-class InGaAs/InP SPAD, with Stirling cooler and dark count rate from 3 Hz to 60 Hz, corresponding to a quantum efficiency respectively of 10 % and 25 %; the other adopting a lower-noise and more efficient, but still commercially available SNSPDs with dark count rate of 10 Hz and quantum efficiency of 90 %.

V. RESULTS FOR THE SIMULATION OF REALISTIC KEY RATES
Having discussed in the previous Sections the main experimental parameters that characterize the standard operation of the TF-QKD setup, in this Section we evaluate their impact on the expected key rates, focusing on the role of phase noise and of detector performance.We consider various configurations that are possible for a TF-QKD layout, characterized by either common or independent sources, which are stabilized or not, with or without fiber stabilization, and with varying detector performance.For each combination, we calculate the phase noise and corresponding variance  2  (Eq.4).We fix an upper limit to tolerated phase fluctuations of   = 0.2 rad, that leads to   = 0.01 (Eq.1), which is a standard conservative value.The integration time  Q at which this threshold is achieved determines the duty cycle , which is then used to evaluate the key rate.Notice that the duty cycle saturates to unity for integration times  Q ≫  PS and that anyway  Q ≳ 1 s is probably unrealistic due to general realignment processes that are nevertheless to be performed.In particular, polarization drift given by fiber birefringence and thermal effects introduce polarization mismatch errors that must be corrected periodically.Experimental experience and literature show that these effects occurs on slow timescales, and polarization re-alignment procedures at low rates of a few Hz are typically sufficient [53,64].Due to frequency drifts of the free-running local oscillators used to clock encoders and decoders, typically time re-synchronization routines must be performed periodically every few seconds to maintain the required synchronization between the nodes.Our approach of fixing the phase error threshold could be relaxed, in a more refined approach, by optimizing  Q and   to maximize the key rate for each protocol and distances separately.
In Figure 2 we report the isolines matching   = 0.2 rad as a function of  Q and fiber length mismatch Δ =  A −  B at which such threshold is reached.As a reference, the length of the shorter interferometer arm  is considered constant and equal to  B = 100 km.We observe that the most favorable configuration, with  Q exceeding 1 s, is reached with the configuration of a common cavity-stabilized laser, with fiber stabilization (panel b, solid line).This configuration is mostly insensitive to fiber length mismatch, over any reasonable range.On the contrary, if an unstabilized free-running laser is considered (dashed line), the mismatch causes  Q to drop rapidly below 100 µs for Δ greater than a few hundred meters.This distance represents the crossover to a regime where the integrated laser noise exceeds the given phase noise threshold, and scales as the coherence length of the laser.The analogous configurations without fiber stabilization (panel a) show similar behaviors, although the highest  Q values are lower by more than 3 orders of magnitude due to fiber noise.Finally, as expected, the configurations with independent laser sources (panel c) do not show any dependence on the fiber length mismatch.In particular, the configurations with freerunning independent laser sources (dashed lines) correspond to very low  Q values.Conversely, when ultrastable lasers are considered, we observe a significant increase in  Q , similar to  2, whose key rates are evaluated in Figures 3 and 4. They are characterized by source and fiber configurations and the length mismatch Δ.
the common laser case.Details of this analysis are described in Appendix H.
To study the impact of these parameters on key rate, we now restrict our attention on the seven realistic scenarios listed in Table I, representing specific configurations and values of Δ, and we mark them as stars in Figure 2. Since with just few hundred meters mismatch the impact of unstabilized laser source noise is significant [53], in scenarios 3-7 we set a representative significant length mismatch Δ = 2.5 km, while for scenarios 1 and 2 we model a negligible mismatch of Δ = 20 m.Even in the most favorable configurations,  Q was limited to 100 ms to conservatively account for general realignment processes (polarization, time re-synchronization) required beyond this limit.Based on these scenarios, we simulate the key rates of the CAL and SNS-AOPP protocols, assuming a phase-synchronization overhead of  PS = 1ms [24].As a reference, we consider a "realistic" PLOB bound, where the transmission is effectively multiplied by the same detection efficiency  D employed in the simulations of the other protocols, and we also evaluate the key rate for the phase-based efficient BB84 protocol endowed with decoy states [40-42, 65, 66].The latter employs the same decoy parameter estimation and channel and detector models as described in Appendix A and summarized in Appendix C, however assuming no role for phase noise.The parameters used in the simulations are described in Appendix D. To analyze the impact of detector performance, we reproduce the scenarios considering either SNSPDs or SPADs, as described in Sec.IV.
Because of similar values of  Q , some of the seven scenarios of Table I result in the same or very similar key rates, therefore we group them in four representative panels of Figure 3, where best performing representative SNSPDs are considered.These results show that unstabilized fibers are usually the largest contribution to decoherence and limit  Q to less than 1 ms (Scenarios 1 and 4, panel a, and scenario 6, panel d), except for the case when unstable lasers are used and no care is taken to match the optical paths' length.In this case, the residual self-delayed laser noise limits  Q to about 50 µs (Scenario 3, panel c).Using fiber and laser stabilization, either with a single common (Scenario 5, panel b) or a pair of lasers (Scenario 7, panel b), ensures  Q > 100 ms even in the presence of a large unbalance in the interferometer arms, with corresponding duty cycles approaching 100 % and no impact on the QBER.The only unstabilized laser scenario matching 5 and 7 common laser, no fiber stabilization 0.2 rad 0.2 rad ultrastable laser free-running laser with fiber stab.no fiber stab.FIG. 2. Level curves at constant phase standard deviation   , calculated in the space of fiber length mismatch Δ and integration time  Q , for each possible combination of laser source configuration and fiber stabilization, at fixed shorter arm  B = 100 km.The corresponding   maps are reported in Figure 8.The numbered points represent the specific scenarios of Table I, which are considered in the simulations.in panel b is scenario 2, only because there is negligible length mismatch and the dominant noise is taken care of by fiber stabilization.In all scenarios, a prepare-and-measure approach features worse key rates than TF-QKD, for losses significantly larger than those typical of metropolitan networks.In Figure 4, the same scenarios are considered, but the detectors are best-in-class SPADs, as representative of more standard in-field setups.Quite generically, the increased dark count rate reduces the maximum reachable distance, while the lower efficiency reduces the key rates for any distance.Besides these very noticeable differences with respect to Figure 3, the considerations that we made pertaining to the role of phase noise are unaffected.
In the simulations shown here and in Appendix A, B, we recall that we make the assumption that asymmetric channels are treated by adding losses  + in the channel with higher transmittance.Optimized protocols have been proposed for both SNS [67] and CAL [68] [21, 69] for such asymmetric case.The intensities of the signals and decoy intensities at the two transmitters, among the other parameters, are independently optimized, achieving a higher key rate than with adding losses.We point out that these approaches only solve the problem of mismatched intensities at Charlie.Fiber length mismatches will still introduce problems related to distributed laser coherence, as discussed in detail in Sec.III, requiring the addition of fiber spools.Usually the need of fiber spools can be avoided in the case of Sagnac fiber-loop networks [50,51,69], where the length unbalances are intrinsically compensated.Conversely, the mismatch effects are evident when using free-running lasers in point-to-point schemes, where the fiber lengths should be matched at the order of 100 m to obtain an optimal transmission window.Although being feasible in laboratory, this can represent an important limit to implement TF-QKD in realistic networks, where the fibers and the communication nodes are deployed according to different criteria, typically interconnecting inhabited towns along existing infrastructures and depending on the territory topology.This way, the unbalance between nodes is typically of several km, which in principle can be compensated with the addition of dedicated fiber spools, possibly in the service channels.Balancing the interferometer arm lengths by using fiber spools needs preliminary calibrations, requires additional hardware to be installed at the telecom shelters, and limits the flexibility in terms of possible dynamic network reconfiguration.All these factors pose constraints to the fiber providers, which are not negligible in production environments.Our results show that such requirements can be strongly relaxed by taking advantage of the reduced phase noise resulting from ultrastable lasers and fiber noise cancellation techniques, improving the applicability of TF-QKD to realistic network scenarios.

VI. CONCLUSION
TF-QKD is one of the most promising candidate solutions for extending the range of real implementation of QKD in fiber.Here, we have discussed the impact of the dominant noise sources in TF-QKD protocols when implemented in realworld conditions, providing a significant contribution toward their in-field use.We provided an open and unified framework for the modeling of major noise sources and the estimation of key rates, and we specifically addressed the phase noise of the photon sources and connecting fibers, showing how implementation aspects such as the quality of the used lasers, the adopted topology, the fiber length and unbalance in the two arms play a role in the final key rate and duty cycle.Interestingly, we observed that both the CAL and SNS protocols are impacted by phase noise in a similar way, although the relevant parameters enter the process via different mechanisms.We also highlighted the role of detector performance in significantly affecting the maximum achievable distance.We showed as well how the overall key rate can be improved by a factor ≳ 2 using narrow-linewidth lasers and phase-control techniques as those developed to compare remote optical clocks on continental scales.With best-in-class but realistically deployable setups, we show that distances up to 500 km can be considered.Synergy with the concurrent development of high-precision time/frequency distribution services [28] is thus advisable, to lower the cost of deployment and achieve optimal usage of TF-QKD equipment.Ultrastable lasers are nowadays found on the market in plug-and-play, compact and portable setup, and the technology is rapidly evolving towards further integration and miniaturization.We envisage these to be fruitfully combined with advanced phase-stabilization procedures [53], towards an efficient and flexible TF-QKD implementation strategy on existing networks.These approaches would also allow to relax the constrains to the fiber network operators, hence facilitating the adoption of TF-QKD on a larger and operative scale.A critical application will be the establishment of long-haul links in the upcoming European Quantum Communication Infrastructure [32], aiming at securely connecting distant quantum metropolitan area networks.Very recently, new MDI-QKD protocols such as mode-pairing QKD were proposed, that although first-order insensitive on laser and fiber noise, may still benefit from their active stabilization [53].Also, we prospect that our considerations can be useful in the implementation of continuous-variable QKD [70,71], where similar challenges are encountered.
Proper handling of the phase noise and practical constraints of a given real-world network enables to consistently predict the expected key rate of a TF-QKD link and choose the optimal protocol, layout design and operating parameters depending on the network topology, available infrastructure and target performance.The code for the reproduction of the figures of this study, and for the estimation of key rates with varying setup and protocol parameters, is openly available at Ref. [35].
rate and then a highlight on how to include errors coming from phase instability in the channel.After its first proposal [36], it attracted significant interest, with several works improving its security in practical cases (see, e.g., [43]), increasing the achievable range [44] and comparing it with other TF-QKD solutions [22,23].
It can be partitioned in the following steps: • at each time slot, the parties commit to a Signal window with probability  Z or to a Decoy window with probability  X = 1 −  Z .
• if Alice (Bob) chooses Signal, with probability , she (he) decides sending and fixes a bit value 1 (0).With probability (1−) she (he) decides not-sending and fixes a bit value 0 (1); • if sending was chosen, they send a phase-randomized weak coherent state | √  Z ⟩ exp( ′ ), with intensity  Z and phase  ′ (never disclosed); • following the decision of not-sending, they send out the vacuum state (or, more generally, a phase-randomized coherent state with very small intensity  0 ).Notice that sending or not sending determines the bit value, not the intensity, phase or photon number; • if they chose Decoy, they send out a phase-randomized coherent state with intensity randomly chosen from a predetermined set | √   ⟩ exp( ′ ),  = 1, 2, 3....Note that the phase values in the decoy windows will be disclosed after the end of the whole transmission session, in order to reconcile the phase slices and estimate the phase error rate; • Afterwards, they classify the time windows in the following way: • Z window: they both chose Signal; • Z window: Z window in which only one sends; • Z1 window: Z window in which a single-photon state is sent.This may contribute to the key rate; •   window: they both chose Decoy, and the same decoy intensity   ; • effective window: Charlie announces only one detector click.Only these cases may contribute to building the final key.Double-click and zero-click events are discarded and they therefore contribute to the bit-flip QBER; • Key distillation starts by the declaration by Charlie of the  t effective Z windows; • they publicly choose a small sample of effective Z windows, which will have to be discarded (asymptotically this is negligible), for estimating the bit-flip error rate  Z = ( NN +  SS )/ t .For this sample, they indeed disclose whether they both chose sending (rate  SS / t ) or both not-sending (rate  NN / t ); • estimate number of untagged bits: only effective Z windows.Indeed multiphoton signals must be considered tagged (attacked by Eve).Their number cannot be measured.Their lower bound n1 , and the upper bound ēph 1 of their phase error, can be estimated using decoy states, in particular using effective   windows (see Appendix C).
The secret key per transmitted signal with unity duty cycle can be estimated with the following expression [44] Asymptotically we let the sifting factor  2 Z = 1, however notice that the decoy measurements might be inefficient with large enough phase errors or losses, or short keys, so that it could be unrealistic to fix  X ≈ 0.
In order to keep under control the bit-flip error rate, small values of the sending probability  must be chosen (a few percent).Error rejection techniques [44] can be applied before the parameter estimation stage to reduce the bit-flip errors, allowing the use of larger values of .The steps can be organized as follows: • First of all, one can take into account in the key rate expression that the bit-flip error rates for bits 0 and 1 are intrinsically different in this protocol.
• Afterwards, the parties perform synchronized random pairing of their raw key bits.Then, they compare the parity of the pairs, discarding pairs with different parity and keeping the first bit of pairs with the same parity.The effect is a rejection of a fraction of bit-flip errors, at the cost of a cut in the length of the raw key.
• By scrutinizing the residual bit-flip error rate of the survived bits, it turns out that it is still high for evenparity pairs.One can keep just the odd-parity pairs, the number of which will be on average  odd =  0  1 /( 0 +  1 ), where  0 ( 1 ) represent the number of 0s (1s) in the raw key string of Bob.
• SNS-AOPP: the last evolution consists in substituting the random pairing with actively pairing the bits in oddparity pairs.In this case, the number of odd-parity pairs will increase to  AOPP odd = min( 1 ,  0 ).Also in this case, only the first bit in each pair is kept.The final key rate can be estimated as Eq. 2, where  t is the length of the string after AOPP, of which  ′ 1 are untagged, while ē′ ℎ 1 and  ′ Z are the phase and bit-flip error rate after AOPP.Complete expressions can be found in [44].
• First of all, Alice (Bob) chooses with probability  X the X basis (key generation) and with probability  Z = 1 −  X the Z basis (control).In the time slots in which her (his) choice was the X basis, she (he) draws a random bit  A ( B ).Then, she (he) prepares an optical pulse  () in the coherent state |⟩  () for  A = 0 ( B = 0) or |−⟩  () for  A = 1 ( B = 1).In the time slots in which her (his) choice is the Z basis, she (he) prepares an optical pulse  () in a phase-randomized coherent state ρ, A ( ρ, B ) where the amplitude  A ( B ) is chosen from a set  = {  }  of real non-negative numbers   ≥ 0, according to a probability distribution   A (  B ).
• Alice and Bob transmit the optical pulses  and  over channels with transmittance √  towards the middle node C and synchronize their arrival.
• Node C interferes the incoming optical pulses  and  on a 50:50 beamsplitter.The output ports are coupled to two threshold detectors,  c and  d , associated respectively to constructive and destructive interference.
• C announces publicly the measurement outcomes  The protocol requires a common phase reference between Alice and Bob for the key generation basis.Local phase randomization is applied in the  basis, allowing the application of the decoy-state technique to infer the contribution of vacuum, single-photon and multi-photon events.For the security proof, the authors invoke a "complementarity" relation between the phase and the photon number of a bosonic mode.The details can be found in [37].
The final secret key per time slot can be lower bounded by the following expression, summing the contribution from the single-click events ( c = 1,  d = 0) and ( c = 0 ,  d = 1) where In the expression above,  XX ( c ,  d ) represents the total gain when Alice and Bob choose the  basis,  , c  d is the bit error rate in the X basis, while ē, c  d is the upper bound on the phase error rate.The estimation of these quantities is detailed in the following paragraphs.
The total gain for the generation events can be expressed as The second expression is obtained by modeling the channel for simulations, see supplementary information of [37] for details.The model consists in a loss √ , a phase mismatch   and a polarization mismatch , giving rise to the parameters  =
The bit error rate can also be estimated by the channel model as The phase error rate requires a more involved analysis.Following Eqs. 10 to 15 of [37] and its supplementary material, one can obtain the following expression for the upper bound on the error in the  basis ē, c  d ≤ 1 Only the pZZ gains for low number of photons (defined in the set S  ), while the other probabilities are trivially upperbounded by 1 and are included in the term Δ  .In [37] a numerical method to estimate the pZZ gains for a finite number of decoy intensities is reported.In [46], instead, these quantities are estimated analytically for two, three and four decoy intensities.Since one can show that realistic implementations with 3 or 4 decoy intensities are almost optimal, in this work the gains are analytically estimated assuming an infinite number of decoy intensities, following the supplementary material of [37].Similarly to the simulations in [37], the sets are chosen as S 0 = {(0, 0), (0, 1), (1, 0), (1, 1)} and S 1 = (0, 0) and the bounds may be improved by adding more terms in the estimation.It turns out that the phase error rate is independent of the phase mismatch, while it has an important effect on the bit error rate.To keep the phase error rate low enough, small values of the signal intensity must be chosen, around 0.02.
In the SNS protocol, on the other hand, small values of the sending probability are chosen to lower the error rate, leading to comparable effects on the key rate.

Appendix C: Decoy state expressions
For completeness, we report here the expressions for the error estimates in the three-decoy-state approach [40][41][42], that we used both in the phase-encoded BB84 calculations and for the phase error in the SNS protocol.
The gain for each laser intensity  = , ,  and effective transmission η is: The corresponding total QBER is modeled as where   and   are the optical and the phase noise errors, respectively, as defined in the main text.For the phase-encoded BB84 protocol, which has only a single channel of length  A +  B along which interfering photons are separated only by few ns, we assume   = 0. Assuming that intensity  =  is matched to the relevant signal intensity and that  >  > , then the lower bounds for the zero and single-photon yield are given by Ȳ0 = so that the single-photon lower bound for the gain and upper bound for the phase error are estimated by In case of the phase-encoded BB84 model, the key rate expression that we use is with duty cycle asymptotically set to  = 1 in the efficient imbalanced basis selection setting.Common parameters employed in the simulations are reported in Table II and discussed here.A representative attenuation coefficient  = 0.2 dB km −1 is chosen, considering that the typical attenuation in real-field can exceed 0.25 dB km −1 , while new-generation laboratory fibers reach 0.16 dB km −1 [22,34].As a best-in-class commercial SNSPD, we consider dark count rate  SNSPD  [22].Intensities for the sending and not sending choices in the SNS-AOPP protocol are set to  Z = /2 and  0 = /2, respectively, while intensity for the Alice signal in BB84 corresponds to , and signal intensity in the CAL protocol is set to the value optimized in [45].
of the laser.The linewidth of these lasers is typically of the order of 1 kHz to 100 kHz and the coherence time is <100 µs, even though performances of commercially-available solutions are continuously improving [72,73].Narrow-linewidth lasers can grant superior phase-coherence between successive realignments.They can be realized in several ways, e.g.nanofabrication [26,27], delay-line stabilization [74] or external high-finesse cavity stabilization [25,75,76].We provide coefficients for the latter approach as it is the one with best performances today.The interested reader can refer to the literature for the optimal compromise in terms of size, weight and power vs performances.
The noise of a cavity-stabilized laser  l,stab (  ) depends on the local cavity noise  cavity (  ) at low Fourier frequencies, and on the intrinsic noise of the used laser source  l,free (  ) (Eq.F1) at high Fourier frequencies, via the gain function  (  ) that regulates the control loop response: The cavity noise is usually parametrized by: with coefficients that depend on the cavity material, geometry and passive isolation, and on technical noise [25,75,76].Typical coefficients for a compact, portable cavity system, that appears suited for the considered application, are reported in Table III.The loop function model follows general concepts of control theory, and includes considerations on the bandwidth allowed by all sub-system.The overall loop function can be described by a complex function in the Laplace space: which includes a second-order integrator to provide high gain at low frequencies, a single integrator stage emerging at a corner frequency , with  the loop bandwidth and  < 1, and is ultimately limited by the finite response of the system, featuring at least one pole at frequency , with  > 1.The parameters ,  determine the exact positions of the knees in the loop response (zero and pole respectively) relatively to the loop bandwidth,  0 = (2) 2 (1 + )/(1 + ).All of these terms are fine-tuned empirically to maximize the noise rejection and adapt to possible poles present in the subsystems transfer function, but good design values are  ≈ 0.1 and  ≈ 10.
Appendix G: Derivation of model coefficients Figure 5 (blue) shows the experimentally measured power spectral density of a <10 kHz-linewidth planar waveguide extended-cavity diode laser in a butterfly package (PLANEX by RIO Inc., see also [72,73,77,78] for other laser types), and the noise of the same laser when stabilized to an external 5 cm-long Fabry-Perot cavity with Finesse exceeding 100'000 (orange).Darker shades represent instances of the respective models according to Eqs.F1 and F2 for the coefficients shown in Table III.The spur observed at about 30 kHz both on the free-running and stabilized laser (in the latter case, reduced by a factor corresponding to the stabilization loop efficiency at this frequency) is not considered by the model and is attributed to an electrical disturbance on our diode laser current driver.Especially on the stabilized laser below 1 kHz, noise peaks are found at specific frequencies: they are due to residual acoustic and seismic solicitations of the resonator and do not significantly affect the results.
Deriving a unique estimate for the fiber noise on a generic layout is more complicated, as the  coefficient primarily depends on the environment where the fiber is housed [48].In general, field noise levels exceed those of spooled fibers with equal length [49], but up to a factor 10 variation is observed between the various installations (compare, e.g.values in [24,49,[79][80][81][82][83][84]).As a reference, Figure 6 (blue) shows the measured noise of a 114 km fiber traveled in a round-trip [24].The fiber was deployed on an intercity haul running parallel a highway for the majority of its part.The corresponding model is obtained from Eq. 6 with a coefficient  = 44 rad 2 Hz km −1 .In the figure, the modeled noise is multiplied by a factor of 4 to account for the fact that the fiber noise is measured in a round-trip.
Fiber noise in a stabilized condition is well explained by Eq. 8 below 1 kHz of Fourier frequency, according to the fact that we stabilized the fiber at  s = 1543.33nm and observed the effect at  q = 1542.14nm.To explain the experimental observations at higher frequency, we also include a white phase noise detection floor of the form  detection (  ) =  0  ′′ c /(  +  ′′ c ) 2 , with coefficient  0 = 1 × 10 −8 rad 2 Hz −1 corresponding to a typical SNR of 80 dB rad 2 Hz −1 for the sensing laser interference, upper-limited at a cutoff frequency of  ′′ c = 200 kHz.
Appendix H: Derivation of the integration time for scenarios shown in Sec.V Figure 7 reports the full maps of   (  ) and   , calculated for each combination of laser source configuration and fiber stabilization, which were discussed in Sec.V.The contour lines that were plotted in Figure 2 were extracted from these maps, and the characteristic scenarios are represented as numbered points.In panels a and e, the strong apparent dependence of  Q on Δ is related to the laser coherence length, as discussed for Figure 2. Notice that, in Scenario 3, laser noise always dominates the total noise (See Figure 8, panel 3 on the right).
Figure 8 shows the phase noise contributions of laser(s) and fibers, as well as their combined effect, for the seven scenarios of Sec.V. Panels on the right indicate the corresponding phase standard error as a function of  Q derived from Eq. 4 and the threshold corresponding to a phase-misalignment QBER   = 1 % as derived from Eq. 1.For evaluating the fiber noise we considered the shortest interferometer arm to be of length  B =100 km, and included length mismatches as indicated in Table I.We assume the fiber noise contributed by arms A and B to be equal in magnitude, with coefficients derived from Table III, but uncorrelated.Similarly, for scenarios 6 and 7 we assumed local lasers noise to be equal in magnitude but uncorrelated.

FIG. 3 .
FIG.3.Simulated key rates of the BB84, SNS-AOPP and CAL protocols in the scenarios described in TableI, with varying total loss and considering SNSPDs.A reference PLOB bound with effective attenuation is plotted.Panel a (b) reports simulations of scenario 1 (2), which are graphically indistinguishable from those of scenario 4 (5, 7).

•
c and  d corresponding to detectors  c and  d .A click event is indicated by   = 0 and a no-click event by   = 1, with  = c, d.The raw key is generated by Alice and Bob concatenating the bits  A and  B ( A and  B ⊕ 1) when node C announces  c = 1 and  d = 0 ( c = 0 and  d = 1) and Alice and Bob chose the  basis.

DC = 10
Hz, corresponding to dark counts per signal  SNSPD DC =  SNSPD DC / s = 10 −8 , with efficiency  SNSPD D = 90 % and nominal source clock rate  s = 1 GHz.As a more common best-in-class commercial SPAD, we consider dark count rate  SPAD DC = 50 Hz, corresponding to dark counts per signal  SPAD DC = 5 × 10 −8 , with efficiency  SPAD D = 25 %.The total intensities for the three decoy states , ,  used in the SNS-AOPP and phase-encoded BB84 protocols are taken from Ref.

TABLE I .
Considered scenarios, marked as stars in Figure

TABLE II .
Parameters of key rate simulation.