## Appendix A SNS TF-QKD Protocol with AOPP  
We make a review of the SNS protocol with AOPP and the key rate formula [11,19,29] in the following. (1) Preparation and measurement. At any time window \(i\), [PERSON] ([PERSON]) randomly determines whether it is a signal window or a decoy window with probabilities \(p_{z}\) and \(p_{x}=1-p_{z}\). If it is a signal window, [PERSON] ([PERSON]) sends a phase-randomized coherent state with intensity \(\mu_{z}\) and denotes it as 1 (0), or a vacuum state \(|0\rangle\) and denotes it as 0 (1) with probabilities \(p_{21}=1-p_{z0}\) and \(p_{z0}\), seperately. If it is a decoy window, [PERSON] ([PERSON]) sends a phase-randomized coherent state \(|\sqrt{\mu_{a}}e^{i\theta_{A}}\rangle\cdot|\sqrt{\mu_{b}}e^{i\theta_{A}}\rangle\) or \(|0\rangle\) (\(|\sqrt{\mu_{a}}e^{i\theta_{B}}\rangle\), \(|\sqrt{\mu_{b}}e^{i\theta_{B}}\rangle\) or \(|0\rangle\)) with probabilities \(p_{a}\), \(p_{b}\) and \(p_{v}=1-p_{a}-p_{b}\), where \(\mu_{a}<\mu_{b}\). The third party, [PERSON], renamed as [PERSON] is supposed to perform the interferometric measurements on the incoming pulses and announce the results. (2) Different types of time windows. Suppose [PERSON] and [PERSON] repeat the above process \(N\) times, then they announce their signal windows and decoy windows through the public channels. If both [PERSON] and [PERSON] determine a signal window, it is a \(Z\) window. The effective events in \(Z\) windows are defined as the one-detector heralded events no matter which detector clicks. [PERSON] and [PERSON] will get two raw \(n_{I}\)-bit strings \(Z_{A}\) and \(Z_{B}\) according to the effective events in \(Z\) windows. Note that the phase-randomized coherent state of intensity \(\mu\) is equivalent to a probabilistic mixture of different photon-number states \(\sum_{k=0}^{\infty}\frac{e^{-\mu}\mu^{k}}{k! }|k\rangle\langle k|\). Therefore, we can define the \(Z_{1}\) windows as a subset of the \(Z\) windows when only one party determines to send and she (he) actually sends the single-photon state \(|1\rangle\). The bits from the effective \(Z_{1}\) windows are regarded as the untagged bits by the tagged model [56]. Then, the intensity of pulses would be announced to each other expect the intensity in \(Z\) windows. If both commit to a decoy window, it is an \(X\) window. [PERSON] and [PERSON] also announce their phase information \(\theta_{A}\), \(\theta_{B}\) when they choose the same intensity \(\mu_{a}\) in an \(X\) window denoted as an \(X_{a}\) window. And if only one detector clicks in \(X_{a}\) windows with phases satisfying  
\[|\theta_{A}-\theta_{B}-\varphi_{AB}|\leq\Delta/2 \tag{21}\]  
or  
\[|\theta_{A}-\theta_{B}-\pi-\varphi_{AB}|\leq\Delta/2, \tag{22}\]  
it is an effective event. All effective events in \(X_{a}\) windows can be divided into two subsets as \(C_{\Delta^{+}}\) and \(C_{\Delta^{-}}\) according Equations (21) and (22), respectively. And the number of the events in \(C_{\Delta^{+}}\) and \(C_{\Delta^{-}}\) can be defined as \(N_{\Delta^{+}}\) and \(N_{\Delta^{-}}\). Here, \(\varphi_{AB}\) is set properly to obtain a satisfactory key rate which will be different over time due to the phase drift. In the following, we will omit the phase drift without loss of generality and set \(\varphi_{AB}=0\). (3) Parameter estimation. They can estimate parameters, including the bit-flip error rate of the raw bits \(E_{Z}\), the lower bound of untagged bits \(\underline{n}_{1}\) (or the lower bound of the counting rate \(\underline{s}_{1}\) equivalently), and the upper bound of the phase-flip error rate of the untagged bits \(\overline{\varepsilon}_{1}^{ph}\). The bit-flip error rate \(E_{Z}\) can be obtained by error test, \(\underline{s}_{1}\) and \(\overline{\varepsilon}_{1}^{ph}\) can be estimated with the decoy-state method as follows.