# Phase-Matching Quantum Key Distribution with Discrete Phase Randomization
## 3 Attack PM-QKD with Imperfect Phase Randomization  
Considering the extreme case that [PERSON] knows, the exact phases of the signal and decoy states without phase randomization, the PM-QKD protocol will have a serious security loophole. Due to the signal state and the decoy state not being orthogonal, [PERSON] can use USD measurement to distinguish the signal state and the decoy state with the probability \(q<1\). The optimal success probability [41] of USD measurement on each side is \(q_{opt}=1-e^{-\left|\sqrt{\mu}-\sqrt{v}\right|^{2}/4}\), which is obtained by performing positive operator valued measurement. After performing USD measurement, [PERSON] measures the number of photons in the pulse and performs a PNS attack.  
For the sake of simplicity, we neglect the dark count and the misalignment error, and only consider the channel loss. Without attacking, the gains of the signal state and decoy state are  
\[\begin{split} Q_{\mu}&=1-e^{-\eta\mu}\\ Q_{v}&=1-e^{-\eta v}\end{split} \tag{6}\]  
where \(\eta\) is the channel loss.  
Under the PNS attack, the gains of the signal state and decoy state are  
\[\begin{split} Q_{\mu}^{\text{attack}}&=\sum_{j=1}^{ \infty}q_{opt}^{2}Z_{j}^{\mu}e^{-\mu}\frac{\mu^{j}}{j!}\\ Q_{v}^{\text{attack}}&=\sum_{j=1}^{\infty}q_{opt}^ {2}Z_{j}^{v}e^{-v}\frac{v^{j}}{j!}\end{split} \tag{7}\]  
where \(Z_{j}^{\mu}\) and \(Z_{j}^{v}\) represent the probability that [PERSON] forwards \(j\) photons to the signal state and the decoy state, with \(j\) as the sum of the photons on both sides.  
The simplified upper key rate under the PNS attack is bounded by  
\[R^{u}=R_{\text{PNS}}=\sum_{j=1}^{\infty}q_{opt}^{2}Z_{j}^{\mu}e^{-\mu}\frac{ \mu^{j}}{j!}[1-H_{2}(E_{ph})] \tag{8}\]  
The lower key rate of the simplified Equation (5) is bounded by  
\[R_{\text{PM}}^{l}=R_{\text{PM}}=Q_{\mu}[1-H_{2}(E_{ph})] \tag{9}\]  
Combining the USD measurement with PNS attack, the security of final key rate without the phase randomized system is vulnerable. We can optimize \(Z_{j}^{\mu}\) to let \(R_{\text{PM}}^{l}>R^{u}\), especially for long distance communication, due to channel loss is large enough, we can block single photon and release multiple photons. Then, the key rate will be higher than the secure key rate, and information will leak out. Hence, [PERSON]'s goal is to minimize \(R^{u}\).  
It is worth noting that the attack scheme of USD measurement and PNS attack, which requires the quantum non-demolition measurement [42] about the photon numbers, the lossless channel and the ability of controlling detector efficiency, all of these are beyond the current technology. [PERSON] adopts the beam splitting (BS) attack [43] in Reference [8]. We briefly present his results as follows.  
[PERSON] [8] points out, under the BS attack, that the probability of successfully distinguishing the states is \(P_{\rm suc}=1-e^{-(1-\eta)\mu}\). The simplified key rate of PM-QKD is lower bounded by  
\[R_{\rm BS}^{l}=Q_{\mu}e^{-2(1-\eta)\mu} \tag{10}\]  
[PERSON] [8] supposes that the photon number channel model exists in PM-QKD, then Gottesman-Lo-Lutkenhaus-Preskill (GLLP) [26] analysis can be used to obtain the formula  
\[R_{\rm GLLP}=Q_{1|\mu}[1-H_{2}(E_{1|\mu}^{ph})]-Q_{\mu}fH_{2}(E_{\mu}) \tag{11}\]  
where \(Q_{1|\mu}\) is the gain of the single photon signal state, \(E_{1|\mu}^{ph}\) is the phase error rate.  
Due to the yield being \(Y_{j}=1-(1-\eta)^{j}\), the simplified GLLP key rate is lower bounded by  
\[R_{\rm GLLP}^{l}=R_{\rm GLLP}=Q_{1|\mu}=\eta\mu e^{-\mu} \tag{12}\]  
Final results show that, when \(\eta\) is smaller than a certain value, the GLLP formula cannot hold under the BS attack, so the photon number channel model is invalid. Fortunately, the PM formula can defend against BS attack; the precondition is that the intensity must be weaker.