## Appendix A SNS TF-QKD Protocol with AOPP
Denote \(\rho_{v}=|0\rangle\langle 0|\), \(\rho_{a}=\sum_{k=0}^{\infty}e^{-\mu_{a}}\mu_{k}^{k}/k!|k\rangle\langle k|\) and \(\rho_{b}=\sum_{k=0}^{\infty}e^{-\mu_{b}}\mu_{b}^{k}/k!|k\rangle\langle k|\), where \(\rho_{a}\) and \(\rho_{b}\) are density operators of the phase-randomized coherent states used in \(X\) windows in which the phase is not announced. Let \(N_{a\beta}\) be the number of intnsces when [PERSON] sends state \(\rho_{a}\) and [PERSON] sends state \(\rho_{\beta}\), and \(n_{a\beta}\) be the number of corresponding one-detector heralded events, where \(\alpha\beta\in S=\{vv,va,av,vb,bv\}\). Thus, the counting rate can be defined as \(S_{a\beta}=n_{a\beta}/N_{a\beta}\). And \(\underline{s}_{1}\) can be estimated with the decoy-state method as [30; 66]  
\[\underline{s}_{1}\geq\frac{1}{2\mu_{a}\mu_{b}(\mu_{b}-\mu_{a})}[\mu_{b}^{2}e^{ \mu_{a}}(S_{va}+S_{av})-\mu_{a}^{2}e^{\mu_{b}}(S_{vb}+S_{bv})-2(\mu_{b}^{2}- \mu_{a}^{2})S_{v\beta}]. \tag{23}\]  
Denote the bit-flip errors in \(C_{\Delta^{+}}\) (\(C_{\Delta^{-}}\)) as the effective events when the right (left) detector clicks and its total number as \(n_{\Delta^{+}}^{R}\) (\(n_{\Delta^{-}}^{L}\)). The bit-flip error rate in \(C_{\Delta}=C_{\Delta^{+}}\cup C_{\Delta^{-}}\) can be shown as  
\[T_{\Delta}=\frac{n_{\Delta^{+}}^{R}+n_{\Delta^{-}}^{L}}{N_{\Delta^{+}}+N_{ \Delta^{-}}}. \tag{24}\]  
Therefore \(\overline{\varepsilon}_{1}^{ph}\) can be estimated with the decoy-state method as [11; 30]  
\[\overline{\varepsilon}_{1}^{ph}\leq\frac{T_{\Delta}-1/2e^{-2\mu_{a}}S_{v \beta}}{2\mu_{a}e^{-2\mu_{a}}S_{1}}. \tag{25}\](4) Key rate formula. With these quantities, the final key length can be expressed as [11; 67]  
\[R=2p_{z0}(1-p_{z0})\mu_{z}e^{-\mu_{z}}\underline{s}_{1}[1-H(\overline{e}_{1}^{ ph})]-n_{t}fH(E_{Z})/N. \tag{10}\]  
where \(N_{f}\) is the number of the final bits, \(H(x)=-x\text{log}_{2}x-(1-x)\text{log}_{2}(1-x)\) is the binary entropy function, and \(f\) is the error correction efficiency factor. (5) AOPP method. AOPP method [19; 29] is a pre-error correction process on the raw strings \(Z_{A}\) and \(Z_{B}\), which can improve the direct transmission key rate. In the AOPP method, [PERSON] randomly select two unequal bits as the pairs and will obtain \(n_{p}=\min(n_{t0},n_{t1})\) pairs, where \(n_{t0}\) (\(n_{t1}\)) is the number of the bits 0 (1) in the raw string \(Z_{B}\). There will be only two types of pairs that can survive when [PERSON] makes exactly the same or opposite decision as [PERSON] for two bits. Denote the correspond number as \(n_{vd}\) or \(n_{cc}\), respectively. Therefore, the bit error after the AOPP is shown as  
\[E_{Z}^{\prime}=\frac{n_{vd}}{n_{cc}+n_{vd}}. \tag{11}\]  
The lower bound of the number of the untagged bits is  
\[\underline{n}_{1}^{\prime}=n_{p}\frac{\underline{n}_{1}^{0}}{n_{t0}}\frac{ \underline{n}_{1}^{1}}{n_{t1}}, \tag{12}\]  
where \(\underline{n}_{1}^{0}\) and \(\underline{n}_{1}^{1}\) is the lower bound of the untagged bits when they make the opposite decision and obtain bits 0 and 1, correspondingly. The phase-flip error rate changes into \(\overline{e}^{\prime}_{1}^{ph}=2\overline{e}_{1}^{ph}(1-\overline{e}_{1}^{ ph})\). Besides, the finite-key effects should be considered in the practical systems using the Chernoff bound [68; 69]. The parameters can be estimated as \(n_{1}^{\prime}=\varphi^{L}(\underline{n}_{1}^{\prime})\) and \(e_{1}^{\prime ph}=\varphi^{U}(\underline{n}_{1}^{\prime}\overline{e}_{1}^{ \prime ph})/\underline{n}_{1}^{\prime}\). Finally, the improved key length can be shown as [19; 29; 67]  
\[N_{f}^{\prime}=n_{1}^{\prime}[1-H(e^{\prime ph}_{1})]-n_{t}^{\prime}fH(E_{Z}^ {\prime})-\text{log}_{2}\frac{2}{\varepsilon_{cor}}-2\text{log}_{2}\frac{1}{ \sqrt{2}\varepsilon_{pA}}. \tag{13}\]