Detecting a Photon-Number Splitting Attack in Decoy-State Measurement-Device-Independent Quantum Key Distribution via Statistical Hypothesis Testing

Abstract

Measurement-device-independent quantum key distribution (MDI-QKD) is innately immune to all detection-side attacks. Due to the limitations of technology, most MDI-QKD protocols use weak coherent photon sources (WCPs), which may suffer from a photon-number splitting (PNS) attack from eavesdroppers. Therefore, the existing MDI-QKD protocols also need the decoy-state method, which can resist PNS attacks very well. However, the existing decoy-state methods do not attend to the existence of PNS attacks, and the secure keys are only generated by single-photon components. In fact, multiphoton pulses can also form secure keys if we can confirm that there is no PNS attack. For simplicity, we only analyze the weaker version of a PNS attack in which a legitimate user’s pulse count rate changes significantly after the attack. In this paper, under the null hypothesis of no PNS attack, we first determine whether there is an attack or not by retrieving the missing information of the existing decoy-state MDI-QKD protocols via statistical hypothesis testing, extract a normal distribution statistic, and provide a detection method and the corresponding Type I error probability. If the result is judged to be an attack, we use the existing decoy-state method to estimate the secure key rate. Otherwise, all pulses with the same basis leading to successful Bell state measurement (BSM) events including both single-photon pulses and multiphoton pulses can be used to generate secure keys, and we give the formula of the secure key rate in this case. Finally, based on actual experimental data from other literature, the associated experimental results (e.g., the significance level is 5%) show the correctness of our method.

1. Introduction

Quantum key distribution (QKD) [1,2,3,4,5,6] is a technique that allows two remote parties (Alice and Bob), to share unconditional secure keys. The unconditional security of the keys are guaranteed by the laws of quantum mechanics [7,8,9,10]. The first ideal QKD protocol is BB84-QKD created by Bennett and Brassard [1], which needs a perfect single-photon source and detectors. However, there is always a large gap between ideal and reality. Due to the imperfection of equipment, the implementation of the QKD suffers double attacks from the source side and detection side. On the one hand, at present, perfect single-photon sources are not available, and weak coherent photon sources (WCPs) after phase randomization are often utilized to replace the single-photon sources. While the photon number of the pulses emitted by WCPs may be more than one, an eavesdropper Eve can launch a photon-number splitting (PNS) attack [11,12,13,14,15]. Specially, a weaker version of a PNS attack is one in which Alice’s or Bob’s pulse count rate changes significantly after the attack [11,12,13,14], and the stronger PNS attack means that both Alice’s and Bob’s pulse count rates remain unchanged after the attack [15]. The difference between these two attacks is the effect on Alice’s and Bob’s pulse count rates. Fortunately, the decoy-state method [16,17,18] proposed later can resist PNS attacks very well.

On the other hand, due to the low detection efficiency of the detectors, Eve can launch attacks against the detectors. Compared with source attacks, there are more attacks from the detection side, such as the detector blinding attack [19,20], dead time attack [21], faked state attack [22,23], and time shift attack [24].People have proposed device-independent quantum key distribution (DI-QKD) [25,26], which can resist all attacks from devices. However, this protocol is highly impractical because it needs close to unity detection efficiency. In 2012, Lo et al. [27] proposed measurement-device-independent quantum key distribution (MDI-QKD), which is also known as the time-inversion version of EPR protocol [28]. In MDI-QKD, Alice and Bob do not need to perform measurement operations, so it can be innately immune to all detection attacks. MDI-QKD combined with the decoy-state method can resist both source attacks and detection attacks; thus, decoy-state MDI-QKD [29,30,31] is one of the most promising QKD protocols, which can provide unconditional secure keys in practical applications.

However, the secure key rate of the existing decoy-state MDI-QKD is not high [32,33]. The decoy-state method defeats the PNS attack through providing a more accurate method to determine the secure key rate. More specifically, the existing decoy-state method can more closely estimate the lower bound of gain and the upper bound of quantum bit error rate (QBER) of single-photon signals, and then the secure key rate can be calculated by the GLLP formula [34]. In essence, the existing decoy-state method does not care about the existence of a PNS attack, and the secure keys are only generated by single-photon components [35]. However, if we can determine that there is no PNS attack on the channel, multiphoton pulses can also generate secure keys. For simplicity, we only analyze the weaker version of PNS attack in which the legitimate user’s pulse count rate changes significantly after the attack. In this case, there is no doubt that using the existing methods to estimate the secure key rate will waste the underlying keys generated from multiphoton pulses and reduce the efficiency.

In this work, under the null hypothesis of no PNS attack $H_0$, we first retrieve the lost information in the existing decoy-state MDI-QKD, extract a normal distribution statistic, and provide a new method to determine whether there is a PNS attack or not through statistical hypothesis testing. If the result is judged to be an attack, the keys can only be generated from single-photon pulses, and the secure key rate will be estimated by the existing decoy-state method. Otherwise, all pulses with the same basis leading to a successful Bell state measurement (BSM) event including both single-photon pulses and multiphoton pulses can be used to generate keys, and we give the formula of the secure key rate in this case. Furthermore, we use the real experimental data in [36] to verify our method, and the analytical results show that our method is credible (e.g., a significance level of 5%).

The structure of this paper is organized as follows. In Section 2, we briefly review the typical decoy-state MDI-QKD and related notations. In Section 3, we describe our method for detecting the PNS attack in the decoy-state MDI-QKD via statistical hypothesis testing in detail. In Section 4, the correctness of our method is verified with the real experimental data from the existing literature. Finally, we discuss and draw conclusions in Section 5.

2. Three-Intensity Decoy-State MDI-QKD

In this paper, we adopt a typical decoy-state MDI-QKD with polarization encoding [36], which mainly consists of three steps.

(i) Alice generates phase-randomized pulses from WCPs and randomly selects the basis $W\in \{Z,X\}$. That is, $P_Z=P_X=1/2$, where $P_Z$ and $P_X$ are the probabilities of choosing the Z basis and X basis, respectively. Then Alice uses an intensity modulator to modulate the pulses with three different intensities and sends them to Charlie located in the middle. This three intensities are the intensity of signal state ${\mu }_2$, the intensity of decoy state ${\mu }_1$, and the intensity of vacuum state ${\mu }_0$, respectively. Furthermore, the corresponding percentages being emitted are $P_{{\mu }_2}$, $P_{{\mu }_1}$, and $P_{{\mu }_0}$, respectively. Obviously, $P_{{\mu }_2}+P_{{\mu }_1}+P_{{\mu }_0}=1$. At the same time, Bob performs the same procedures as Alice, and the intensities of Bob’s pulses are noted as ${\nu }_2$, ${\nu }_1$, and ${\nu }_0$ for the signal state, decoy state, and vacuum state, respectively. Similarly, the corresponding percentages being emitted are $P_{{\nu }_2}$, $P_{{\nu }_1}$, and $P_{{\nu }_0}$, respectively, where $P_{{\nu }_2}+P_{{\nu }_1}+P_{{\nu }_0}=1$.

(ii) The pulses from Alice and Bob interfere when they reach Charlie. Then Charlie performs a Bell state measurement (BSM) on the interference outcomes and announces the measurement results to Alice and Bob.

(iii) Alice and Bob compare their bases, and determine the secure keys through Charlie’s measurement results. Specifically, if Alice and Bob choose the same basis and Charlie has a successful BSM event at the same time, then this part of the pulses can generate keys. It is important to emphasize that the secure keys are only generated from the signal state with Z basis, and the others are used for parameter estimation.

The secure key rate of the decoy-state MDI-QKD [27,36] is given by

$$R\ge q\{P_{11}^{{\mu }_2{\nu }_2}{Y}_{11}^Z[1-H\left(e_{11}^X\right)]-Q_{{\mu }_2{\nu }_2}^Z{f}_{e}H\left(E_{{\mu }_2{\nu }_2}^Z\right)\}.$$

(1)

In the above equation, $q=P_Z^2{P}_{{\mu }_2}{P}_{{\nu }_2}$ is the probability that Alice and Bob both select the Z basis and both modulate the pulse as signal state. $P_{11}^{{\mu }_2{\nu }_2}={\mu }_2{\nu }_2{e}^{-{\mu }_2-{\nu }_2}$ is the probability that the pulses from Alice’s signal state and Bob’s signal state are both single-photon pulses. $Y_{11}^Z$ and $e_{11}^X$ are the yield of single-photon state with Z basis and the quantum bit error rate (QBER) of single-photon state with X basis. $H\left(x\right)=-x{log}_2\left(x\right)-(1-x){log}_2(1-x)$ is the binary Shannon entropy function. $Q_{{\mu }_2{\nu }_2}^Z$ and $E_{{\mu }_2{\nu }_2}^Z$ are the overall gain and overall QBER of signal state with Z basis, respectively. $f_e>1$ is the error correction efficiency.

According to [37,38], the overall gain $Q_{{\mu }_k{\nu }_l}^W$ $(W\in \{X,Z\left\}\right)$ and the overall QBER $E_{{\mu }_k{\nu }_l}^W$ $(W\in \{X,Z\left\}\right)$ can be obtained by the following equations,

$$\begin{array}{cc}\hfill Q_{{\mu }_k{\nu }_l}^X& =2y^2[1+2y^2-4y{I}_0\left(x\right)+I_0\left(2x\right)],\hfill \\ \hfill E_{{\mu }_k{\nu }_l}^X{Q}_{{\mu }_k{\nu }_l}^X& =e_0{Q}_{{\mu }_k{\nu }_l}^X-2(e_0-e_d)y^2[I_0\left(2x\right)-1],\hfill \\ \hfill Q_{{\mu }_k{\nu }_l}^Z& =Q_C+Q_E,\hfill \\ \hfill E_{{\mu }_k{\nu }_l}^Z{Q}_{{\mu }_k{\nu }_l}^Z& =e_d{Q}_C+(1-e_d)Q_E.\hfill \end{array}$$

(2)

where

$$\begin{array}{cc}\hfill Q_C& =2{(1-p_d)}^2{e}^{-{\mu }^{\prime }/2}[1-(1-p_d)e^{-{\eta }_a{\mu }_k/2}]\times [1-(1-p_d)e^{-{\eta }_b{\nu }_l/2}],\hfill \\ \hfill Q_E& =2p_d{(1-p_d)}^2{e}^{-{\mu }^{\prime }/2}[I_0\left(2x\right)-(1-p_d)e^{-{\mu }^{\prime }/2}].\hfill \end{array}$$

(3)

In the above equations, ${\mu }_k$ and ${\nu }_l$, $k,l\in \{0,1,2\}$, are the intensities of pulses emitted by Alice and Bob, respectively. $I_0\left(x\right)$ is the modified Bessel function of the first kind. $e_0$ is the error rate of background. $e_d$ is the misalignment-error probability. $p_d$ is the dark count rate. ${\eta }_a$ and ${\eta }_b$ are the transmission efficiencies of Alice and Bob, respectively. In addition,

$$\begin{array}{cc}\hfill x& =\sqrt{{\eta }_a{\mu }_k{\eta }_b{\nu }_l}/2,\hfill \\ \hfill y& =(1-p_d)e^{-{\mu }^{\prime }/4},\hfill \\ \hfill {\mu }^{\prime }& ={\eta }_a{\mu }_k+{\eta }_b{\nu }_l,\hfill \\ \hfill {\eta }_a& ={\eta }_d{10}^{-\frac{\delta L_{ac}+\theta }{10}},\hfill \\ \hfill {\eta }_b& ={\eta }_d{10}^{-\frac{\delta L_{bc}+\theta }{10}},\hfill \end{array}$$

(4)

where ${\eta }_d$ is the quantum efficiency of detectors, $\delta$ is the loss coefficient measured in dB/km, $L_{ac}$ $\left(L_{bc}\right)$ is the distance in km from Alice (Bob) to Charlie, and $\theta$ is the insertion loss in Charlie’s measurement setup in dB. Without Eve’s intervention, based on Equations (2)–(4), the yield and the QBER of single-photon pulses when Alice and Bob select the same basis X or Z are, respectively, given by

$$\begin{array}{cc}\hfill Y_{11}^X& =Y_{11}^Z={(1-p_d)}^2[\frac{{\eta }_a{\eta }_b}{2}+(2{\eta }_a+2{\eta }_b-3{\eta }_a{\eta }_b)p_d+4(1-{\eta }_a)(1-{\eta }_b)p_d^2],\hfill \\ \hfill e_{11}^X{Y}_{11}^X& =e_0{Y}_{11}^X-(e_0-e_d){(1-p_d)}^2\frac{{\eta }_a{\eta }_b}{2},\hfill \\ \hfill e_{11}^Z{Y}_{11}^Z& =e_0{Y}_{11}^Z-(e_0-e_d){(1-p_d)}^2(1-p_d)\frac{{\eta }_a{\eta }_b}{2}.\hfill \end{array}$$

(5)

3. Statistical Hypothesis Testing

In this section, we introduce a new method to detect the PNS attack in the decoy-state MDI-QKD via statistical hypothesis testing. It is important to emphasize that the PNS attacks mentioned here and below refer to the weaker version of PNS attack. Then we analyze the Type I error of the test; that is, mistaking no PNS attack when there is a PNS attack. Generally speaking, our method first puts forward a null hypothesis and alternative hypothesis based on the theory of statistical hypothesis testing. Then, the test statistic is constructed according to the null hypothesis and other conditions. Furthermore, the specific values of the statistics can be obtained by using the parameters and experimental data. After the significance level is given, we can infer whether there is PNS attack in the channel with a certain probability. The details are as follows.

(i) Identify null and alternative hypothesis. Let us consider the hypothesis testing problem of the null hypothesis $H_0$: there is no PNS attack on the channel and the alternative hypothesis $H_1$: there is a PNS attack on the channel.

(ii) Construct the test statistic. We need a test statistic to conduct the hypothesis testing. In what follows, the distribution of the test statistic is derived under the null hypothesis $H_0$. Let us further consider Alice’s and Bob’s pulses emission process and Charlie’s BSM event. When Alice and Bob send pulses with the same basis, the BSM event outcomes at Charlie only include two cases, successful or failed. Therefore, the above process can be regarded as a Bernoulli trial. Note that $Q_{{\mu }_k{\nu }_l}^W$ is the probability that Charlie obtains a successful BSM event provided that Alice and Bob emit pulses with the intensities ${\mu }_k$ and ${\nu }_l$ and select the basis W. Suppose the total number of pulses emitted by Alice (Bob) is $N_{data}$, then the number of pulses is $P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}$ when Alice’s and Bob’s intensities with W basis are ${\mu }_k$ and ${\nu }_l$, respectively. In the above equation, $P_W$ is the probability that Alice (Bob) chooses the $W\in \{X,Z\}$ basis, $P_{{\mu }_k{\nu }_l}=P_{{\mu }_k}{P}_{{\nu }_l}$ is the probability that Alice and Bob choose the intensities ${\mu }_k$ and ${\nu }_l$, respectively. At this point, the number of successful BSM events that Charlie obtained is denoted as $n_{{\mu }_k{\nu }_l}^W$. Then, $n_{{\mu }_k{\nu }_l}^W$ has the binomial distribution with parameters $(P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data},Q_{{\mu }_k{\nu }_l}^W)$, for short,

$$n_{{\mu }_k{\nu }_l}^W\sim B(P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data},Q_{{\mu }_k{\nu }_l}^W).$$

(6)

According to [36], we find $N_{data}$ is so large (typically ${10}^{10}\sim {10}^{11}$), $Q_{{\mu }_k{\nu }_l}^W$ is close to ${10}^{-8}\sim {10}^{-5}$. Generally, the selections of basis and intensity are random. In other words, $P_Z=P_X=1/2$, $P_{{\mu }_k}=P_{{\nu }_l}=1/3$ where $k,l\in \{0,1,2\}$. Thus, we have $P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}{Q}_{{\mu }_k{\nu }_l}^W>P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}(1-Q_{{\mu }_k{\nu }_l}^W)\ge 5$. By the law of large numbers and the central limit theorem, when $P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}{Q}_{{\mu }_k{\nu }_l}^W\ge 5$ and $P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}(1-Q_{{\mu }_k{\nu }_l}^W)\ge 5$, the binomial distribution with parameters $(P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data},Q_{{\mu }_k{\nu }_l}^W)$ can be approximately regarded as the normal distribution with mean $P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}{Q}_{{\mu }_k{\nu }_l}^W$ and variance $P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}(1-Q_{{\mu }_k{\nu }_l}^W)$, given by

$$n_{{\mu }_k{\nu }_l}^W\sim N(P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}{Q}_{{\mu }_k{\nu }_l}^W,P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}(1-Q_{{\mu }_k{\nu }_l}^W)).$$

(7)

After standardization, we obtain a random variable $U_{{\mu }_k{\nu }_l}^W$, which obeys the standard normal distribution; that is,

$$U_{{\mu }_k{\nu }_l}^W=\frac{n_{{\mu }_k{\nu }_l}^W-P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}{Q}_{{\mu }_k{\nu }_l}^W}{\sqrt{P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}(1-Q_{{\mu }_k{\nu }_l}^W)}}\sim N(0,1).$$

(8)

Considering the additivity of normal distribution, we obtain a random variable involving all possibilities of $U_{{\mu }_k{\nu }_l}^W$ where $W\in \{X,Z\}$, $k,l\in \{0,1,2\}$, which also obeys the normal distribution. There are eighteen cases of $U_{{\mu }_k{\nu }_l}^W$ considering that the pair of intensity is nine cases and the selection of basis is two cases. Note that we only consider the same basis for Alice and Bob, that is, both Z basis or both X basis. After standardization, we obtain a new random variable V that obeys the standard normal distribution, which can be written as

$$V=\frac{1}{\sqrt{18}}\sum _{W\in \{Z,X\},k,l\in \{0,1,2\}}\frac{n_{{\mu }_k{\nu }_l}^W-P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}{Q}_{{\mu }_k{\nu }_l}^W}{\sqrt{P_W^2{P}_{{\mu }_k{\nu }_l}{N}_{data}(1-Q_{{\mu }_k{\nu }_l}^W)}}\sim N(0,1).$$

(9)

Furthermore, $\mathrm{\Phi }\left(v\right)$ is the distribution function of V, given by

$$\mathrm{\Phi }\left(v\right)=\frac{1}{\sqrt{2\pi }}{\int }_{-\infty }^v{e}^{-\frac{t^2}{2}}\mathrm{d}t,-\infty <vs.<\infty ,$$

(10)

where v is the value of V and is just the test statistic that we find.

(iii) Find the value of the test statistic. We set the parameters $N_{data}$, $e_d$, $e_0$, $p_d$, $L_{ac}$, $L_{bc}$, $\delta$, $\theta$, $P_Z$, $P_X$, ${\mu }_k$, ${\nu }_l$, $P_{{\mu }_k}$, and $P_{{\nu }_l}$, where $k,l\in \{0,1,2\}$, and we calculate the theoretical value of $Q_{{\mu }_k{\nu }_l}^W$ according to Equations (2)–(4). We record $n_{{\mu }_k{\nu }_l}^W$ where $k,l\in \{0,1,2\}$, $W\in \{X,Z\}$. We substitute the above data into Equation (9) and obtain the value of the test statistic v.

(iv) Choose a significance level. We need to determine a significance level $\alpha$ (typically 0.05) for the test. In terms of the null hypothesis $H_0$ of the test, we deduce that the test is a two-tailed hypothesis testing. Given $\alpha$, the rejection region is $\left|vs.\right|>v_{[1-\alpha /2]}$ where $v_{[1-\alpha /2]}$ can be obtained by Equation (10). More precisely, the variables $-v_{[1-\alpha /2]}$ and $v_{[1-\alpha /2]}$ refer to the boundary values between the rejection region and the acceptance region for the test. Let the left side of Equation (10) be equal to $\alpha /2$; the upper limit of the integral will be $-v_{[1-\alpha /2]}$. According to the symmetry of the probability density function of normal distribution, $v_{[1-\alpha /2]}$ can be obtained.

(v) Make a decision. Compare the test statistic v with the critical values $v_{[1-\alpha /2]}$ and $-v_{[1-\alpha /2]}$. If $v>v_{[1-\alpha /2]}$ or $v<-v_{[1-\alpha /2]}$, we will reject $H_0$ and accept $H_1$. This means that we believe there is a PNS attack on the channel. Otherwise, we fail to reject $H_0$. That is to say, we consider there is no PNS attack on the channel. Note that the significance level of the test $\alpha$ is just the Type I error probability of the test, namely, the probability of mistaking no PNS attack for having a PNS attack. Let $\beta$ denote the Type II error probability of the test, to be precise, the probability of mistaking having a PNS attack for no PNS attack. Note that $\beta$ is usually difficult to solve in most situations. Furthermore, determining the value of $\beta$ requires more information about the aggression behavior.

If the result is judged to be a PNS attack, the secure key rate in this case can be estimated by Equation (1). Otherwise, all pulses with the Z basis leading to a successful BSM event including both single-photon pulses and multiphoton pulses can be used to generate the keys. Furthermore, the secure key rate formula Equation (1) becomes

$$R\ge q{Q}_{{\mu }_2{\nu }_2}^Z[1-f_{e}H\left(E_{{\mu }_2{\nu }_2}^Z\right)-H\left(E_{{\mu }_2{\nu }_2}^Z\right)].$$

(11)

By comparing Equation (11) with Equation (1), we can easily find the secure key rate has been highly improved when the judgment result is no PNS attack. This is mainly due to the contribution of multiphoton components.

4. Results and Analysis

In the preceding section, we showed the details of our detection method. Now, we move forward to the corresponding experiments based on the aforementioned method and analyze the experimental results. Generally speaking, the real experimental data were substituted into the formulas in Section 3 to verify the correctness of our method. The experimental parameters were from real experiments [36]. Specially, the experimenters in [36] adopted a symmetric scheme; that is, all parameters of Alice and Bob were identical and optimized. The relevant experimental parameters used in [36] and this paper are shown in

Table 1. Experimental parameters used in this paper. Data from Phys. Rev. Lett. 2014, 112, 190503.

${\mathit{\mu }}_2\left({\mathit{\nu }}_2\right)$	${\mathit{\mu }}_1\left({\mathit{\nu }}_1\right)$	${\mathit{\mu }}_0\left({\mathit{\nu }}_0\right)$	${\mathit{P}}_{{\mathit{\mu }}_2}\left({\mathit{P}}_{{\mathit{\nu }}_2}\right)$	${\mathit{P}}_{{\mathit{\mu }}_1}\left({\mathit{P}}_{{\mathit{\nu }}_1}\right)$	${\mathit{P}}_{{\mathit{\mu }}_0}\left({\mathit{P}}_{{\mathit{\nu }}_0}\right)$	${\mathit{P}}_{\mathit{Z}}\left({\mathit{P}}_{\mathit{X}}\right)$
0.3	0.1	0.01	0.2	0.45	0.35	0.5
${\mathit{N}}_{\mathit{data}}$	${\mathit{e}}_{\mathit{d}}$	${\mathit{e}}_{\mathbf{0}}$	${\mathit{p}}_{\mathit{d}}$	${\mathit{L}}_{\mathit{ac}}\left({\mathit{L}}_{\mathit{bc}}\right)$	$\mathit{\delta }$	$\mathit{\theta }$
$1.69\times {10}^{11}$	0.01	0.5	$5\times {10}^{-5}$	5	0.2	0.8

.

Based on the above parameters, we can obtain the values of $Q_{{\mu }_k{\nu }_l}^W$, as shown in

Table 2. The values of $Q_{{\mu }_k{\nu }_l}^W(\times {10}^{-4})$ with intensities ${\mu }_k\in \{{\mu }_2,{\mu }_1,{\mu }_0\}$ and ${\nu }_l\in \{{\nu }_2,{\nu }_1,{\nu }_0\}$ based on $W\in \{X,Z\}$. Reprinted/adapted with permission from Ref. [36], 2014, American Physical Society.

		Z			X
	${\mathit{\mu }}_{\mathit{k}}$	${\mathit{\mu }}_{\mathbf{2}}$	${\mathit{\mu }}_{\mathbf{1}}$	${\mathit{\mu }}_{\mathbf{0}}$	${\mathit{\mu }}_{\mathbf{2}}$	${\mathit{\mu }}_{\mathbf{1}}$	${\mathit{\mu }}_{\mathbf{0}}$
${\mathit{\nu }}_{\mathit{l}}$
${\nu }_2$		0.4643	0.1596	0.0215	0.9086	0.4074	0.2449
${\nu }_1$		0.1596	0.0539	0.0066	0.4074	0.1039	0.0319
${\nu }_0$		0.0215	0.0066	0.0007	0.2449	0.0319	0.0012

. Note that Table 2 in this paper is exactly the same as Table I in the Supplementary Materials of [36]. We record the values of $n_{{\mu }_k{\nu }_l}^W$, as shown in

Table 3. The values of $n_{{\mu }_k{\nu }_l}^W(\times {10}^4)$ with intensities ${\mu }_k\in \{{\mu }_2,{\mu }_1,{\mu }_0\}$ and ${\nu }_l\in \{{\nu }_2,{\nu }_1,{\nu }_0\}$ based on $W\in \{X,Z\}$.

		Z			X
	${\mathit{\mu }}_{\mathit{k}}$	${\mathit{\mu }}_{\mathbf{2}}$	${\mathit{\mu }}_{\mathbf{1}}$	${\mathit{\mu }}_{\mathbf{0}}$	${\mathit{\mu }}_{\mathbf{2}}$	${\mathit{\mu }}_{\mathbf{1}}$	${\mathit{\mu }}_{\mathbf{0}}$
${\mathit{\nu }}_{\mathit{l}}$
${\nu }_2$		787.5	270.4	38.03	1526	692.9	429.3
${\nu }_1$		262.0	89.74	11.83	670.9	172.4	52.73
${\nu }_0$		36.17	11.32	1.521	415.7	53.57	2.366

. Note that the data in Table 3 can be deduced from Table I in the Main Text of [36]. According to the above data and Equation (8), all values of $U_{{\mu }_k{\nu }_l}^W$ can be obtained, as shown in

Table 4. The values of $U_{{\mu }_k{\nu }_l}^W$ with intensities ${\mu }_k\in \{{\mu }_2,{\mu }_1,{\mu }_0\}$ and ${\nu }_l\in \{{\nu }_2,{\nu }_1,{\nu }_0\}$ based on $W\in \{X,Z\}$.

		Z			X
	${\mathit{\mu }}_{\mathit{k}}$	${\mathit{\mu }}_{\mathbf{2}}$	${\mathit{\mu }}_{\mathbf{1}}$	${\mathit{\mu }}_{\mathbf{0}}$	${\mathit{\mu }}_{\mathbf{2}}$	${\mathit{\mu }}_{\mathbf{1}}$	${\mathit{\mu }}_{\mathbf{0}}$
${\mathit{\nu }}_{\mathit{l}}$
${\nu }_2$		1.026	0.6174	3.709	2.415	2.512	10.00
${\nu }_1$		−7.100	−3.187	4.016	−10.05	−5.452	−3.197
${\nu }_0$		−0.3709	1.004	5.438	1.209	−0.9135	4.154

.

The schematic diagram of statistical hypothesis testing is illustrated in Figure 1. After calculation, we obtained the value of the test statistic $v=0.236$. Given the significance level of the test $\alpha =0.05$, the critical values were $v_{[1-\alpha /2]}=1.96$ and $-v_{[1-\alpha /2]}=-1.96$. Since $-1.96<0.236<1.96$, the test statistic did not fall inside the rejection region, and we failed to reject $H_0$. In other words, we inferred that there was no PNS attack on the channel, and the corresponding Type I error probability was less than $5\%$. According to [36], there was indeed no PNS attack in the experiment, which verifies the correctness of our method. Thus, both single-photon and multiphoton components can be used to generate keys in this case. At this time, the secure key rate can be estimated through Equation (11).

5. Conclusions and Discussion

In summary, we first recovered the lost information of the existing decoy-state method when detecting the weaker version of a PNS attack in the decoy-state MDI-QKD and extracted a normal distribution statistic via statistical hypothesis testing. Based on this information, we proposed a new method to detect the weaker version of a PNS attack. Most importantly, the error probability of detection was precisely calculated by our method, and we also gave the calculation. Finally, according to the judgment result, the corresponding secure key rate was provided. In particular, compared with the existing decoy-state MDI-QKD protocols, the secure key rate with our method has been highly improved if the judgment result is no weak PNS attack. Meanwhile, the associated experimental results also verified the correctness of our method.

Nevertheless, all judgment results in this paper were obtained under the condition that the null hypothesis was no weak version of a PNS attack. In other words, we assume that the gain of signal or decoy state will change significantly after the PNS attack. However, we can do nothing about the stronger PNS attack, which retains the gain of signal and decoy state, such as a partial PNS attack [15], because the premise of the derivation no longer holds, and the Type II error probability of our method in this case will be poor even close to unity. For this reason, compared with the existing decoy-state method [29,30,31] to directly estimate the secure key rate, our method is not ready for practical application now; however, we provide a new direction to improve the secure key rate and efficiency.