# A New Security Proof for Twin-Field Quantum Key Distribution (QKD)
## 4 New Security Proof
Then, using Theorem 1, we construct the ideal states \(\{\ket{\phi^{c,r,t}}\}\), such that for every \(r,c\), the following holds:  
\[\ket{\phi^{c,r,t}}\in\text{span}(\mathcal{G}_{t})\otimes\mathcal{H}_{E}=\text{ span}\bigg{\{}\ket{\phi_{i}}\ :\ i\in\mathcal{A}_{4}^{N_{c}}\text{ and }\frac{1}{m_{c}}\#_{1,3}(i_{t})\sim_{\delta}\frac{1}{n_{c}}\#_{1,3}(i_{-t}) \bigg{\}}\otimes\mathcal{H}_{E} \tag{26}\]  
Also,  
\[\frac{1}{2}\bigg{|}\sum_{t}P_{T}(t)\ket{t}\bra{t}\otimes\ket{\phi^{c,r}}\bra{ \phi^{c,r}}-\sum_{t}P_{T}(t)\ket{t}\bra{t}\otimes\ket{\phi^{c,r,t}}\bra{\phi^{ c,r,t}}\bigg{|}\bigg{|}\leq\sqrt{\epsilon_{\delta}^{cl}}. \tag{27}\]  
Now, using the sampling strategy discussed earlier, with error probability shown in Equation (19), and choosing \(\delta\) as in Equation (23), we have \(\sqrt{\epsilon_{\delta}^{cl}}\leq\epsilon\). The above is true for any \(r\) and \(c\); based on the triangle inequality, for every \(c\), we have the following:  
\[\frac{1}{2}\bigg{|}\bigg{|}\sum_{r}p(r)\sum_{t}\ket{t}\bra{t} \otimes\ket{\psi^{c,r}}\bra{\psi^{c,r}}-\sum_{r}p(r)\sum_{t}\ket{t}\bra{t} \otimes\ket{\phi^{c,r,t}}\bra{\phi^{c,r,t}}\bigg{|}\bigg{|}\] \[\leq \frac{1}{2}\sum_{r}p(r)\bigg{|}\bigg{|}\sum_{t}P_{T}(t)\ket{t} \bra{t}\otimes\ket{\phi^{c,r}}\bra{\phi^{c,r}}-\sum_{t}P_{T}(t)\ket{t}\bra{t} \otimes\ket{\phi^{c,r,t}}\bra{\phi^{c,r,t}}\bigg{|}\bigg{|}\leq\epsilon. \tag{28}\]  
Let \(X_{0}=\ket{++}\bra{++}+\ket{--}\bra{--}\) be the POVM element measuring [PERSON] and [PERSON]'s qubit in the \(X\) basis and reporting the same result (i.e., no error); let \(X_{1}=I-X_{0}\) be the same, but when [PERSON] and [PERSON]'s outcomes are different (i.e., an \(X\) basis error). Note that \(X_{1}\ket{\phi_{i}}=0\) whenever \(j=0,2\). Thus, \(X_{1}\) can only be observed if \(j=1,3\) (see Equation (4)). After choosing \(t\) and measuring using POVM \(\{X_{0},X_{1}\}\), resulting in outcome \(q_{X}\in\{0,1\}^{m_{c}}\), it is clear from Equation (26), that the post-measured state must collapse to one that may be written in the following form:  
\[\ket{\phi_{q_{X}}^{c,r,t}}=\sum_{ \begin{subarray}{c}i\in\mathcal{A}_{4}^{n_{c }}\\ \#_{1,3}(i)=\#_{1}(q_{X})\end{subarray} }p(i)P\left(\sum_{ \begin{subarray}{c}j \in\mathcal{A}_{4}^{n_{c}}\\ \frac{1}{\kappa}\#_{1,3}(j)\sim_{\delta}\frac{1}{\kappa}\#_{1,3}(i)\end{subarray}  }\ket{\phi_{j}}\ket{\widetilde{E}_{j|i}}\right). \tag{29}\]  
[PERSON] and [PERSON] subsequently measure their remaining particles in the \(Z\) basis leading to their raw keys. The resulting density operator is denoted with \(\sigma_{AE}^{c,r,t}\). Using Lemma 2, along with Equation (8), we have the following:  
\[H_{\infty}(A|E)_{\sigma^{c,r,t}}\geq n_{c}(1-h(\#_{1}(q_{X})+\delta_{c})). \tag{30}\]  
Lemma 1 and Equation (28) completes the proof. The actual key-rate of the TF-QKD protocol then follows immediately and is stated in the corollary below:  
Corollary 1: _Let \(\epsilon>0\) be given. Then, except with probability \(\epsilon_{fail}=2\epsilon^{1/3}\), if the key-length of the TF-QKD protocol is set to_  
\[\ell=n_{c}(1-h(Q_{X}+\delta_{c}))-\texttt{{\it leak}}_{EC}-2\log_{2}\frac{1}{c} \tag{31}\]  
_where \(\texttt{{\it leak}}_{EC}\) is the information leaked during error correction, the final resulting key is \(\epsilon_{PA}\)-secure, for \(\epsilon_{PA}=9\epsilon+4\epsilon^{1/3}\)._  
Proof: This follows immediately from Theorem 2 and Equation (7). We note that our key-rate above agrees asymptotically with the prior work in [19] for \(\Pi\)-Total and so our new proof above is simply an alternative method and not one that necessarily obtains higher results.