# A New Security Proof for Twin-Field Quantum Key Distribution (QKD)
## 5 Evaluation  
We now evaluate the key-rate assuming a lossy channel with detector mismatches and inefficiencies. In particular, each channel will have a transmittance of \(\sqrt{\eta}\). We will assume, for evaluation purposes, that the server is honest, but has faulty devices. Thus, the server will perform the correct measurement; however, the detectors will have a non-zero dark count rate \(p_{d}\) and a non-unit efficiency \(f\). The measurement may also be misaligned in that it may report \"0\" when it should have, ideally, observed \"1\". To evaluate, we require certain expected values for \(N_{c}\) along with the expected noise. Let \(p(0)\) (respectively \(p(1)\)) be the probability that the server sends the message \"0\" (respectively \"1\"). Then, the expected value of \(N_{C}\) is simply \(N(p(0)+p(1))\), where \(N\) is the total number of rounds [PERSON] and [PERSON] perform for the protocol. To find these values under our evaluation setup, we trace the protocol's execution. First, consider the joint state created by [PERSON] and [PERSON]:  
\[\left(\sqrt{q}\left|0,v\right\rangle_{Aa}+\sqrt{1-q}\left|1,p \right\rangle_{Aa}\right)\otimes\left(\sqrt{q}\left|1,v\right\rangle_{Bb}+ \sqrt{1-q}\left|0,p\right\rangle_{Bb}\right)\] \[\cong q\left|0,1,v,v\right\rangle_{ABab}+\left(1-q\right)\left|1,0,p, p\right\rangle_{ABab}+\sqrt{q(1-q)}(\left|0,0,v,p\right\rangle_{ABab}+ \left|1,1,p,v\right\rangle_{ABab}). \tag{32}\]  
The qubits are sent through a lossy channel which, as in [19]. We model a beamsplitter with transmittance \(\sqrt{\eta}\); it is as follows:  
\[BS\left|p\right\rangle =\sqrt{\eta}\left|p\right\rangle+\sqrt{1-\eta}\left|\widetilde{v}\right\rangle\] \[BS\left|v\right\rangle =\left|v\right\rangle.\]  
Note that we introduced a new state \(\left|\widetilde{v}\right\rangle\) to ensure that the above is unitary; however, \(\left|v\right\rangle\) and \(\left|\widetilde{v}\right\rangle\) cannot be distinguished by the parties and will look like a vacuum in either case. The above causes the joint state to evolve into the following:  
\[q\left|01 vv\right\rangle+\left(1-q\right)\left|10\right\rangle \left(\eta\left|pp\right\rangle+\left(1-\eta\right)\left|\widetilde{v} \widetilde{v}\right\rangle+\sqrt{q(1-\eta)}(\left|p\widetilde{v}\right\rangle +\left|\widetilde{v},p\right\rangle)\right)\] \[+\sqrt{q(1-q)}(\left|00\right\rangle(\sqrt{\eta}\left|v,p\right\rangle +\sqrt{1-\eta}\left|v,\widetilde{v}\right\rangle)+\left|11\right\rangle(\sqrt {\eta}\left|p,v\right\rangle+\sqrt{1-\eta}\left|\widetilde{v},v\right\rangle)) \tag{33}\]  
At this point, the system enters the server's measurement device which, before the actual measurement is performed, we model as a unitary operator \(C\), where for any \(x,y\in\{v,\widetilde{v}\}\):  
\[C\left|x,y\right\rangle =\left|x,y\right\rangle\] \[C\left|p,x\right\rangle =\left(\alpha\left|D_{0}\right\rangle+\beta\left|D_{1}\right\rangle \right)\left|x\right\rangle\] \[C\left|x,p\right\rangle =\left(\beta\left|D_{0}\right\rangle-\alpha\left|D_{1}\right\rangle \right)\left|x\right\rangle\] \[C\left|p,p\right\rangle =\left|\psi_{2}\right\rangle\]  
Ideally, \(\alpha=\beta=1/\sqrt{2}\). Note that the additional \(\left|x\right\rangle\) system in the above definitions are used only to ensure unitarity of \(C\) and that the server's subsequent measurement cannot distinguish between \(\left|v\right\rangle\) and \(\left|\widetilde{v}\right\rangle\). Following the application of \(C\), the server will measure the first of the two systems in its control, thereby leading to the reported outcome. Note that, since \(\left|v\right\rangle\) and \(\left|\widetilde{v}\right\rangle\) are technically indistinguishable, both observations are reported simply as a \"vacuum\" by the server.