## 3 Lower Bound on the Secret Key Rate  
We shall consider that Alice and Bob treat decoy and signal states separately, and they distill secret key from both of them. For that, we use the security analysis presented in [6], which combines the results provided by Gottesman-Lo-Lutkenhaus-Preskill (GLLP) in [55] (see also [56]) with the decoy-state method. It can be shown that the single-photon signals emitted by the passive source illustrated in Figure 1, averaged over the values of Alice's key bit, are basis-independent [42]. This analysis is valid for the asymptotic regime of infinitely long keys. The secret key rate formula can be written as  
\[R\geq\sum_{i}p_{i}\max\{R^{i},0\}, \tag{12}\]  
with \(i=\{s,d\}\). Here \(p_{i}\) denotes the probability to generate a state associated to the intensity interval \(\xi_{i}\) (_i.e._, \(p_{s}=\theta_{\Lambda}/\pi\) and \(p_{d}=1-p_{s}\)), and  
\[R^{i}\geq qp_{\rm acc}\big{\{}-Q^{i}f(E^{i})H(E^{i})+p_{1}^{i}Y_{1}[1-H(e_{1}) ]+p_{0}^{i}Y_{0}\big{\}}. \tag{13}\]  
The parameter \(q\) is the efficiency of the protocol (\(q=1/2\) for the standard BB84 scheme, and \(q\approx 1\) for its efficient version [57]); \(Q^{i}\) denotes the gain, _i.e._, the probability that [PERSON] obtains a click in his measurement apparatus when [PERSON] sends him a signal \(\sigma_{i}\); \(f(E^{i})\) represents the efficiency of the error correction protocol as a function of the error rate \(E^{i}\), typically \(f(E^{i})\geq 1\) with Shannon limit \(f(E^{i})=1\)[58]; \(Y_{n}\) is the yield of an \(n\)-photon signal, _i.e._, the conditional probability of a detection event on [PERSON]'s side given that [PERSON] transmits an \(n\)-photon state; \(e_{n}\) denotes the error rate of an \(n\)-photon signal; and \(H(x)=-x\log_{2}{(x)}-(1-x)\log_{2}{(1-x)}\) represents the binary Shannon entropy function. For simulation purposes, we shall consider a simple channel model in the absence of eavesdropping [6, 59]; it consists of a BS whose transmittance depends on the transmission distance and on the loss coefficient of the quantum channel. That is, for simplicity, we neglect any misalignment effect in the channel. Furthermore, we assume that [PERSON] employs an active BB84 detection setup. This model allows us to calculate the observed experimental parameters \(Q^{i}\) and \(E^{i}\). These quantities are given in Appendix B. Our results, however, can also be straightforwardly applied to any other channel model or detection setup, as they depend only on the observed gain and QBER. To evaluate the secret key rate formula given by Equation (13) we need to estimate the yields \(Y_{0}\) and \(Y_{1}\), together with the single-photon error rate \(e_{1}\), by solving the following set of linear equations:  
\[Q^{i}=\sum_{n=0}^{\infty}p_{n}^{i}Y_{n},\quad{\rm and}\quad Q^{i}E^{i}=\sum_{ n=0}^{\infty}p_{n}^{i}Y_{n}e_{n}. \tag{14}\]  
For that, we shall use the procedure proposed in [38, 59]. Moreover, we will assume a random background (_i.e._, \(e_{0}=1/2\)). This method requires that the probabilities \(p_{n}^{i}\) given by Equation (10) satisfy certain conditions that we confirm numerically. The results are included in Appendix C. It is important to emphasize, however, that the estimation technique presented in [38, 59] only constitutes a possible example of a finite decoy-state setting estimation procedure. In principle, many other estimation methods are also available for this purpose, such as linear programming tools [60], which might result in sharper, or for the purpose of QKD, better bounds on the considered probabilities. The resulting lower bound on the secret key rate with two intensity settings is illustrated in Figure 3 (green line). In our simulation we employ the following experimental parameters: the dark count rate of [PERSON]'s detectors is \(\epsilon_{\rm B}=3.2\times 10^{-7}\), the overall transmittance of [PERSON]'s detection apparatus is \(\eta_{\rm B}=0.045\), and the loss coefficient of the channel is \(\alpha=0.2\) dB/km. We further assume that \(q=1/2\), and \(f(E^{i})=1.22\).