# A New Security Proof for Twin-Field Quantum Key Distribution (QKD)
## 3 Protocol  
We now describe the specific TF-QKD protocol, introduced in [19], which we will be analyzing. A single round of the quantum communication stage consists of the following operations:  
1. [PERSON] prepares an entangled quantum state of the form: \[\left|\psi_{a}\right\rangle=\sqrt{q}\left|0,v\right\rangle_{Aa}+\sqrt{1-q} \left|1,p\right\rangle_{Aa}\] where the \(A\) register is a private qubit memory, while the \(a\) register consists of a single photon in either the vacuum state \(\left|v\right\rangle_{a}\) or a non-vacuum state \(\left|p\right\rangle_{a}\). This register will be transmitted to a central server. Finally, \(q\) is a publicly known parameter chosen by [PERSON] and [PERSON] which will be optimized later. 2. Similarly, [PERSON] creates the state: \[\left|\psi_{b}\right\rangle=\sqrt{q}\left|1,v\right\rangle_{Bb}+\sqrt{1-q} \left|0,p\right\rangle_{Bb}.\] The \(A\) and \(B\) registers are kept private, while the \(a\) and \(b\) registers are sent to a central server. 3. The central server routes the incoming \(ab\) registers through a 50:50 beam splitter with two detectors, \(D_{0}\) and \(D_{1}\). The outcome of the detectors are reported to [PERSON] and [PERSON]. The possible outcomes are \"0\" (meaning detector \(D_{0}\) clicked); \"1\" (meaning detector \(D_{1}\) clicked); \"\(vac\)\" (meaning no detector clicked); and \"_other_\" (meaning any other outcome, such as both detectors clicking). 4. If the server reported \"\(vac\)\" or \"\(other\)\", [PERSON] and [PERSON] discard this round and their private qubits. If the server reported \"1\", [PERSON] applies a Pauli \(Z\) gate to his private ancilla, thereby flipping the phase of the \(\left|1\right\rangle_{B}\) state. 5. If the server reported either \"0\" or \"1\", [PERSON] and [PERSON] should now hold a Bell state \(\left|\phi_{0}^{0}\right\rangle_{AB}\). They will measure their private qubits in either the \(Z\) or the \(X\) basis. Some of the \(Z\) and \(X\) measurements will be used to test the fidelity of the state; the remaining \(Z\) basis states will be used for key distillation. We note that there is a simple change to the above protocol which turns it into an equivalent prepare-and-measure protocol where [PERSON] and [PERSON] do not need to measure or hold private memories. For more details on that, the reader is referred to the original paper [19]. To see why the above protocol works, consider a single round. At the beginning, [PERSON] and [PERSON] create the joint state:  
\[\left|\psi_{0}\right\rangle =(\sqrt{q}\left|0,v\right\rangle_{Aa}+\sqrt{1-q}\left|1,p\right\rangle _{A,a})\otimes(\sqrt{q}\left|1,v\right\rangle_{Bb}+\sqrt{1-q}\left|0,p\right\rangle _{Bb})\] \[\cong q\left|0,1,v,v\right\rangle_{ABab}+\sqrt{q(1-q)}(\left|0,0,v,p\right\rangle_{ABab}+\left|1,1,p,v\right\rangle_{ABab})+(1-q)\left|1,0,p,p \right\rangle_{ABab}. \tag{20}\]  
At this point, the \(ab\) registers are sent through a 50:50 beam splitter. We denote the output modes of the BS as \(D_{0}\) and \(D_{1}\). We simply denote the action of this splitter (up to phase rotation) as follows:  
\[BS\left|v,v\right\rangle_{ab}=\left|v\right\rangle_{01}\]\[BS\left|p,v\right\rangle_{ab} =\frac{1}{\sqrt{2}}(\left|D_{0}\right\rangle_{01}+\left|D_{1} \right\rangle_{01})\] \[BS\left|v,p\right\rangle_{ab} =\frac{1}{\sqrt{2}}(\left|D_{0}\right\rangle_{01}-\left|D_{1} \right\rangle_{01})\] \[BS\left|p,p\right\rangle_{ab} =\left|\psi_{2}\right\rangle_{01}\]  
where \(\left|\psi_{2}\right\rangle_{01}\) is the state resulting from the action of the beam splitter upon the receipt of two photons, one from [PERSON] and one from [PERSON]; the exact description of this state is not important for the following discussion.