document: quantum key distribution ( qkd ) is often said to be unconditionally secure @xcite . 
   more precisely , qkd can be proven to be secure against any eavesdropping _ given _ that the users ( alice and bob ) devices satisfy some requirements , which often include mathematical characterization of users devices as well as the assumption that there is no side - channel . 
   this means that no one can break mathematical model of qkd , however in practice , it is very difficult for practical devices to meet the requirements , leading to the breakage of the security of practical qkd systems . actually , some attacks on qkd have been proposed and demonstrated successfully against practical qkd systems @xcite .    to combat the practical attacks , some counter - measures @xcite , including device independent security proof idea @xcite , have been proposed . 
   the device independent security proof is very interesting from the theoretical viewpoint , however it can not apply to practical qkd systems where loopholes in testing bell s inequality @xcite can not be closed . as for the experimental counter - measures , 
   battle - testing of the practical detection unit has attracted many researchers attention @xcite since the most successful practical attack so far is to exploit the imperfections of the detectors . 
   recently , a very simple and very promising idea , which is called a measurement device independent qkd ( mdiqkd ) has been proposed by lo , curty , and qi @xcite . in this scheme 
   , neither alice nor bob performs any measurement , but they only send out quantum signals to a measurement unit ( mu ) . 
   mu is a willing participant of the protocol , and mu can be a network administrator or a relay . 
   however , mu can be untrusted and completely under the control of the eavesdropper ( eve ) . 
   after alice and bob send out signals , they wait for mu s announcement of whether she has obtained the successful detection , and proceed to the standard post - processing of their sifted data , such as error rate estimation , error correction , and privacy amplification . 
   the basic idea of mdiqkd is based on a reversed epr - based qkd protocol @xcite , which is equivalent to epr - based qkd @xcite in the sense of the security , and mdiqkd is remarkable because it removes _ all _ the potential loopholes of the detectors without sacrificing the performance of standard qkd since alice and bob do not detect any quantum signals from eve . moreover , it is shown in @xcite that mdiqkd with infinite number of decoy states and polarization encoding can cover about twice the distance of standard decoyed qkd , which is comparable to epr - based qkd . 
   the only assumption needed in mdiqkd is that the preparation of the quantum signal sources by alice and bob is ( almost ) perfect and carefully characterized . 
   we remark that the characterization of the signal source should be easier than that of the detection unit since the characterization of the detection unit involves the estimation of the response of the devices to unknown input signals sent from eve . 
   with mdiqkd in our hand , we do not need to worry about imperfections of mu any more , and we should focus our attention more to the imperfections of signal sources . 
   one of the important imperfections of the sources is the basis - dependent flaw that stems from the discrepancy of the density matrices corresponding to the two bases in bb84 states . 
   the security of standard bb84 with basis - dependent flaw has been analyzed in @xcite which show that the basis - dependent flaw decreases the achievable distance . 
   thus , in order to investigate the practicality of mdiqkd , we need to generalize the above works to investigate the security of mdiqkd under the imperfection . 
   another problem in mdiqkd is that the first proposal is based on polarization encoding @xcite , however , in some situations where birefringence effect in optical fiber is highly time - dependent , we need to consider mdiqkd with phase encoding rather than polarization encoding . in this paper , we study the above issues simultaneously . 
   we first propose two schemes of the phase encoding mdiqkd , one employs phase locking of two separate laser sources and the other one uses the conversion of phase encoding into polarization encoding . 
   then , we prove the unconditional security of these schemes with basis - dependent flaw by generalizing the quantum coin idea @xcite . based on the security proof , we simulate the key generation rate with realistic parameters , especially we employ a simple model to evaluate the basis - dependent flaw due to the imperfection of the phase modulators . 
   our simulation results imply that the first scheme covers shorter distances and may require less accuracy of the state preparation , while the second scheme can cover much longer distances when we can prepare the state very precisely . 
   we note that in this paper we consider the most general type of attacks allowed by quantum mechanics and establish unconditional security for our protocols . 
   this paper is organized as follows . in sec . 
   [ sec : protocol ] , we give a generic description of mdiqkd protocol , and we propose our schemes in sec . [ sec : phase encoding scheme i ] and sec . 
   [ sec : phase encoding scheme ii ] . 
   then , we prove the unconditional security of our schemes in sec . [ sec : proof ] , and we present some simulation results of the key generation rate based on realistic parameters in sec . [ sec : simulation ] . finally , we summarize this paper in sec . [ 
   sec : summary ] . 
   in this section , we introduce mdiqkd protocol whose description is generic for all the schemes that we will introduce in the following sections . the mdiqkd protocol runs as follows . 
   step ( 1 ) : each of alice and bob prepares a signal pulse and a reference pulse , and each of alice and bob applies phase modulation to the signal pulse , which is randomly chosen from @xmath0 , @xmath1 , @xmath2 , and @xmath3 . here , @xmath4 ( @xmath5 ) defines @xmath6 ( @xmath7)-basis . 
   alice and bob send both pulses through quantum channels to eve who possesses mu . 
   step ( 2 ) : mu performs some measurement , and announces whether the measurement outcome is successful or not . 
   it also broadcasts whether the successful event is the detection of type-0 or type-1 ( the two types of the successful outcomes correspond to two specific bell states @xcite ) . 
   step ( 3 ) : if the measurement outcome is successful , then alice and bob keep their data . 
   otherwise , they discard the data . 
   when the outcome is successful , alice and bob broadcast their bases and they keep the data only when the bases match , which we call sifted key . depending on the type of the successful event and the basis that they used , bob may or may not perform bit - flip on his sifted key . 
   step ( 4 ) : alice and bob repeat ( 1)-(3 ) many times until they have large enough number of the sifted key . 
   step ( 5 ) : they sacrifice a portion of the data as the test bits to estimate the bit error rate and the phase error rate on the remaining data ( code bits ) . 
   step ( 6 ) : if the estimated bit error and phase error rates are too high , then they abort the protocol , otherwise they proceed . 
   step ( 7 ) : alice and bob agree over a public channel on an error correcting code and on a hash function depending on the bit and phase error rate on the code bits . after performing error correction and privacy amplification , they share the key . 
   the role of the mu in eve is to establish a quantum correlation , i.e. , a bell state , between alice and bob to generate the key . 
   if it can establish the strong correlation , then alice and bob can generate the key , and if it can not , then it only results in a high bit error rate to be detected by alice and bob and they abort the protocol . as we will see later , since alice and bob can judge whether they can generate a key or not by only checking the experimental data as well as information on the fidelity between the density matrices in @xmath6- basis and @xmath7-basis , it does not matter who performs the measurement nor what kind of measurement is actually done as long as mu broadcasts whether the measurement outcome was successful together with the information of whether the successful outcome is type-0 or type-1 .    in the security proof 
   , we assume that mu is totally under the control of eve . in practice , however , we should choose an appropriate measurement that establishes the strong correlation under the normal operation , i.e. , the situation without eve who induces the channel losses and noises . in the following sections , we will propose two phase encoding mdiqkd schemes . 
   in this section , we propose an experimental setup for mdiqkd with phase encoding scheme , which is depicted in fig . 
   [ setup1 ] . 
   this scheme will be proven to be unconditionally secure , i.e. , secure against the most general type of attacks allowed by quantum mechanics . in this setup , we assume that the intensity of alice s signal ( reference ) pulse matches with that of bob s signal ( reference ) pulse when they enter mu . in order to lock the relative phase , we use strong pulses as the reference pulses . in pl unit in the figure , the relative phase between the two strong pulses is measured in two polarization modes separately . the measurement result is denoted by @xmath8 ( here , the arrow represents two entries that correspond to the two relative phases ) . depending on this information @xmath8 , appropriate phase modulations for two polarization modes 
   are applied to incoming signal pulse from alice . 
   then , alice s and bob s signal pulses are input into the 50/50 beam splitter which is followed by two single - photon threshold detectors . 
   the successful event of type-0 ( type-1 ) in step ( 2 ) is defined as the event where only d0 ( d1 ) clicks . in the case of type-1 successful detection event 
   , bob applies bit flip to his sifted key ( we define the phase relationship of bs in such a way that d1 never clicks when the phases of the two input signal coherent pulses are the same ) .    . 
   then , the phase shift of @xmath8 for each polarization mode is applied to one of the signal pulses , and they will be detected by d0 and d1 after the interference at the 50:50 beam splitter bs . 
   [ setup1 ] ]    roughly speaking , our scheme performs double bb84 @xcite , i.e. , each of alice and bob is sending signals in the bb84 states , without phase randomization @xcite . 
   differences between our scheme and the polarization encoding mdiqkd scheme include that alice and bob do not need to share the reference frame for the polarization mode , since mu performs the feed - forward control of the polarization , and our scheme intrinsically possesses the basis - dependent flaw . 
   to see how this particular setup establishes the quantum correlation under the normal operation , it is convenient to consider an entanglement distribution scheme @xcite , which is mathematically equivalent to the actual protocol . for the simplicity of the discussion 
   , we assume the perfect phase locking for the moment and we only consider the case where both of alice and bob use @xmath6-basis . 
   we skip the discussion for @xmath7-basis , however it holds in a similar manner @xcite . in this case , the actual protocol is equivalently described as follows . 
   first , alice prepares two systems in the following state , which is a purification of the @xmath6-basis density matrix , @xmath9 and sends the second system to mu through the quantum channel . 
   here , @xmath10 and @xmath11 represent coherent states that alice prepares in the actual protocol ( @xmath12 represents the mean photon number or inetensity ) , @xmath13 and @xmath14 are eigenstate of the computational basis ( @xmath6 basis ) , which is related with @xmath7-basis eigenstate through @xmath15 and @xmath16 . for the later convenience , 
   we also define @xmath17-basis states as @xmath18 and @xmath19 . 
   moreover , the subscript of @xmath20 in @xmath21 represents that alice is to measure her qubit along @xmath6-basis , the subscript of @xmath22 in @xmath12 refers to the party who prepares the system , and the superscript @xmath23 represents the relative phase of the superposition . 
   similarly , bob also prepares two systems in a similar state @xmath24 , sends the second system to mu , and performs @xmath6-basis measurement . note that @xmath6-basis measurement by alice and bob can be delayed after eve s announcement of the successful event without losing any generalities in the security analysis , and we assume this delay in what follows . 
   in order to see the joint state of the qubit pair after the announcement , note that the beam splitter converts the joint state @xmath25 into the following state @xmath26 @xmath27 here , for the simplicity of the discussion , we assume that there is no channel losses , we define @xmath28 , and @xmath29 represents the vacuum state . 
   moreover , the subscripts @xmath30 and @xmath31 represent the output ports of the beam splitter . if detector d0 
   ( d1 ) detects photons and the other detector d1 ( d0 ) detects the vacuum state , i.e. , type-0 ( type-1 ) event , it is shown in the appendix a that the joint probability of having type-0 ( type-1 ) successful event and alice and bob share the maximally entangled state @xmath32 ( @xmath33 ) is @xmath34 . 
   we note that since @xmath35 , alice and bob do not always share this state , and with a joint probability of @xmath36 , they have type-0 ( type-1 ) successful event and share the maximally entangled state with the phase error , i.e. , the bit error in @xmath7-basis , as @xmath37 ( @xmath38 ) . 
   note that the bit - flip operation in type-1 successful detection can be equivalently performed by @xmath2 rotation around @xmath17-basis before bob performs @xmath6 basis measurement . 
   in other words , @xmath2 rotation around @xmath17-basis before @xmath6-basis measurement does not change the statistics of the @xmath6-basis measurement followed by the bit - flip . 
   thanks to this property , we can conclude that alice and bob share @xmath32 with probability of @xmath39 and @xmath37 with probability of @xmath40 after the rotation . 
   this means that even if alice and bob are given the successful detection event , they can not be sure whether they share @xmath37 or @xmath32 , however , if they choose a small enough @xmath41 , then the phase error rate ( the rate of the state @xmath37 in the qubit pairs remaining after the successful events or equivalently , the rate of @xmath7-basis bit error among all the shared qubit pairs ) becomes small and they can generate a pure state @xmath32 by phase error correction , which is equivalently done by privacy amplification in the actual protocol @xcite . 
   we note that the above discussion is valid only for the case without noises and losses , and we will prove the security against the most general attack in sec . 
   [ sec : proof ] without relying on the argument given in this section . 
   we remark that in the phase encoding scheme i , it is important that alice and bob know quite well about the four states that they prepare . 
   this may be accomplished by using state tomography with homodyne measurement involving the use of the strong reference pulse @xcite . 
   [ scheme ii ]            in this section , we propose the second experimental setup for mdiqkd with phase encoding scheme . 
   like scheme i , this scheme will also be proven to be unconditionally secure . in this scheme , the coherent pulses that alice and bob 
   send out are exactly the same as those in the standard phase encoding bb84 , i.e. , @xmath42 where subscripts @xmath43 and @xmath44 respectively denote the signal pulse and the reference pulse , @xmath45 is a completely random phase , @xmath46 is randomly chosen from @xmath47 to encode the information . after entering the mu , 
   each pulse pair is converted from a phase coding signal to a polarization coding signal by a phase - to - polarization converter ( see details below ) . 
   we note that thanks to the phase randomization by @xmath45 , the joint state of the signal pulse and the reference pulse is a classical mixture of photon number states .    in fig . 
   [ setup2 ] , we show the schematics of the converter . this converter performs the phase - to - polarization conversion : @xmath48 to @xmath49 , where @xmath50 is a projector that projects the joint system of the signal and reference pulses to a two - dimensional single - photon subspace spanned by @xmath51 where @xmath0 and @xmath52 represent the photon number , and @xmath53 ( @xmath54 ) represents the horizontal ( vertical ) polarization state of a single - photon . to see how it works , 
   let us follow the time evolution of the input state . 
   at the polarization beam splitter ( pbs in fig . 
   [ setup2 ] ) , the signal and reference pulses first split into two polarization modes , h and v , and we throw away the pulses being routed to v mode . 
   then , in h mode , the signal pulse and the reference pulse are routed to different paths by using an optical switch , and we apply @xmath2-rotation only to one of the paths to convert h to v. at this point , we essentially have @xmath55 , where the subscripts of `` @xmath56 '' and `` @xmath57 '' respectively denote the upper path and the lower path . 
   finally , these spatial modes @xmath56 and @xmath57 are combined together by using a polarization beam splitter so that we have @xmath49 in the output port depicted as `` out '' .    in practice , since the birefringence of the quantum channel can be highly time dependent and the polarization state of the input pulses to mu may randomly change with time , i.e. , the input polarization state is a completely mixed state , we can not deterministically distill a pure polarization state , and thus the conversion efficiency can never be perfect . 
   in other words , one may consider the same conversion of the v mode just after the first polarization beam splitter , however it is impossible to combine the resulting polarization pulses from v mode and the one from h mode into a single mode . 
   we assume that mu has two converters , one is for the conversion of alice s pulse and the other one is for bob s pulse , and the two output ports `` out '' are connected to exactly the same bell measurement unit @xcite in the polarization encoding mdiqkd scheme in fig . 
   [ bell m ] @xcite . 
   this bell measurement unit consists of a 50:50 beam splitter , two polarization beam splitters , and four single - photon detectors , which only distinguishes perfectly two out of the four bell states of @xmath38 and @xmath33 . 
   the polarization beam splitters discriminate between @xmath58 and @xmath59 ( note that we choose @xmath60 and @xmath61 modes rather than h and v modes since our computational basis is @xmath60 and @xmath61 ) . 
   suppose that a single - photon enters both from alice and bob . in this case 
   , the click of d0 + and d0- or d1 + and d1- means the detection of @xmath38 , and the click of d0 + and d1- or d0- and d1 + means the detection of @xmath33 ( see fig . 
   [ bell m ] ) . in this scheme , since the use of coherent light induces non - zero bit error rate in @xmath7-basis ( @xmath62-basis ) , we consider to generate the key from @xmath63-basis and we use the data in @xmath7-basis only to estimate the bit error rate in this basis conditioned on that both of alice and bob emit a single - photon , which determines the amount of privacy amplification . by considering a single - photon polarization input both from alice and bob , one can see that bob should not apply the bit flip only when alice and bob use @xmath7-basis and @xmath64 is detected in mu , and bob should apply the bit flip in all the other successful events to share the same bit value . 
   accordingly , the bit error in @xmath6-basis is given by the successful detection event conditioned on that alice and bob s polarization are identical . 
   as for @xmath7-basis , the bit error is @xmath64 detection given the orthogonal polarizations or @xmath65 detection given the identical polarization . 
   assuming completely random input polarization state , our converter successfully converts the single - photon pulse with a probability of @xmath66 . 
   note in the normal experiment that the birefringence effect between alice and the converter and the one between bob and the converter are random and independent , however it only leads to fluctuating coincidence rate of alice s and bob s signals at the bell measurement , but does not affect the qber . 
   moreover , the fluctuation increases the single - photon loss inserted into the bell measurement . 
   especially , the events that the output of the converter for alice is the vacuum and the one for bob is a single - photon , and vice versa would increase compared to the case where we have no birefringence effect . 
   however , this is not a problem since the bell measurement does not output the conclusive events in these cases unless the dark counting occurs . 
   thus , the random and independent polarization fluctuation in the normal experiment is not a problem , and we will simply assume in our simulation in sec . 
   [ simulationii ] that this fluctuation can be modeled just by @xmath66 loss . 
   we emphasize that we do not rely on these assumptions at all when we prove the security , and our security proof applies to any channels and mus .    for the better performance and also for the simplicity of analysis , we assume the use of infinite number of decoy states @xcite to estimate the fraction of the probability of successful event conditioned on that both of alice and bob emit a single - photon . 
   one of the differences in our analysis from the work in @xcite is that we will take into account the imperfection of alice s and bob s source , i.e. , the decay of the fidelity between two density matrices in two bases . 
   we also remark that since the h and v modes are defined locally in mu , alice and bob do not need to share the reference frame for the polarization mode , which is one of the qualitative differences from polarization encoding miqkd scheme @xcite . 
   this section is devoted to the unconditional security proof , i.e. , the security proof against the most general attacks , of our schemes . 
   since both of our schemes are based on bb84 and the basis - dependent flaw in both protocols can be treated in the same manner , we can prove the security in a unified manner . 
   if the states sent by alice and bob were basis independent , i.e. , the density matrices of @xmath6-basis and @xmath7-basis were the same , then the security proof of the original bb84 @xcite could directly apply ( also see @xcite for a bit more detailed discussion of this proof ) , however they are basis dependent in our case . 
   fortunately , security proof of standard bb84 with basis - dependent flaw has already been shown to be secure @xcite , and we generalize this idea to our case where we have basis - dependent flaw from both of alice and bob . in order to do so , we consider a virtual protocol @xcite that alice and bob get together and the basis choices by alice and bob are made via measurement processes on the so - called quantum coin . in this virtual protocol of the phase encoding scheme i , 
   alice and bob prepare joint systems in the state @xcite @xmath67 since just replacing the state , for instance @xmath68 where @xmath52 and @xmath0 in the ket respectively represents the single - photon and the vacuum , is enough to apply the following proof to the phase encoding scheme ii , we discuss only the security of the phase encoding scheme i in what follows . in eq . 
   ( [ coin - joint - state ] ) , the first system denoted by @xmath69 is given to eve just after the preparation , and it informs eve of whether the bases to be used by alice and bob match or not . 
   the second system , denoted by @xmath70 , is a copy of the first system and this system is given to bob who measures this system with @xmath71 basis to know whether alice s and bob s bases match or not . if his measurement outcome is @xmath72 ( @xmath73 ) , then he uses the same ( the other ) basis to be used by alice ( note that no classical communication is needed in order for bob to know alice s basis since alice and bob get together ) . 
   the third system , which is denoted by @xmath22 and we call `` quantum coin '' , is possessed and to be measured by alice along @xmath74 basis to determine her basis choice , and the measurement outcome will be sent to eve after eve broadcasts the measurement outcome at mu . moreover , 
   all the second systems of @xmath75 , @xmath76 , @xmath24 , and @xmath77 are sent to eve . 
   note in this formalism that the information , including classical information and quantum information , available to eve is the same as those in the actual protocol , and the generated key is also the same as the one of the actual protocol since the statistics of alice s and bob s raw data is exactly the same as the one of the actual protocol . 
   thus , we are allowed to work on this virtual protocol for the security proof .    the first system given to eve in eq . 
   ( [ coin - joint - state ] ) allows her to know which coherent pulses contain data in the sifted key and she can post - select only the relevant pulses . 
   thus , without the loss of any generalities of the security proof , we can concentrate only on the post - selected version of the state in eq . 
   ( [ coin - joint - state ] ) as @xmath78    the most important quantity in the proof is the phase error rate in the code bits . the definition of the phase error rate is the rate of bit errors along @xmath7-basis in the sifted key if they had chosen @xmath7-basis as the measurement basis when both of them have sent pulses in @xmath6-basis . if alice and bob have a good estimation of this rate as well as the bit error rate in the sifted key ( the bit error rate in @xmath6-basis given alice and bob have chosen @xmath6-basis for the state preparation ) , they can perform hashing in @xmath7-basis and @xmath6-basis simultaneously @xcite to distill pairs of qubits in the state whose fidelity with respect to the product state of the maximally entangled state @xmath32 is close to @xmath52 .    according to the discussion on the universal composability @xcite , the key distilled via @xmath6-basis measurement on such a state 
   is composably secure and moreover exactly the same key can be generated only by classical means , i.e. , error correction and privacy amplification @xcite . 
   thus , we are left only with the phase error estimation . for the simplicity of the discussion , we assume the large number of successful events @xmath79 so that we neglect all the statistical fluctuations and we are allowed to work on a probability rather than the relative frequency .    the quantity we have to estimate is the bit error along @xmath7-basis , denoted by @xmath80 , given alice and bob send @xmath81 state , which is different from the experimentally available bit error rate along @xmath7-basis given alice and bob send @xmath82 state . 
   intuitively , if the basis - dependent flaw is very small , @xmath80 and @xmath83 should be very close since the states are almost indistinguishable . to make this intuition rigorous 
   , we briefly review the idea by @xcite which applies bloch sphere bound @xcite to the quantum coin . 
   suppose that we randomly choose @xmath17-basis or @xmath6-basis as the measurement basis for each quantum coin . 
   let @xmath84 and @xmath85 be fraction that those quantum coins result in @xmath52 in @xmath17-basis and @xmath6-basis measurement , respectively . what bloch sphere bound , i.e. , eq . 
   ( 13 ) or eq . 
   ( 14 ) in @xcite or eq . 
   ( a1 ) in @xcite , tells us in our case is that no matter how the correlations among the quantum coins are and no matter what the state for the quantum coins is , thanks to the randomly chosen bases , the following inequality holds with probability exponentially close to @xmath52 in @xmath79 , @xmath86 by applying this bound separately to the quantum coins that are conditional on having phase errors and to those that are conditional on having no phase error , and furthermore by combining those inequalities using bayes s rule , we have @xmath87 here , @xmath88 is equivalent to the probability that the measurement outcome of the quantum coin along @xmath6-basis is @xmath14 given the successful event in mu . 
   note that this probability can be enhanced by eve who chooses carefully the pulses , and eve could attribute all the loss events to the quantum coins being in the state @xmath13 . 
   thus , we have an upper bound of @xmath88 in the worst case scenario as @xmath89 and @xmath90 where @xmath91 is the frequency of the successful event . 
   note that we have not used the explicit form of @xmath92 and @xmath93 , where @xmath94 , in the derivation of eqs . 
   ( [ phase error bound ] ) , ( [ fdelta ] ) , and ( [ delta ] ) , and the important point is that the state @xmath92 and @xmath93 are the purification of alice s and bob s density matrices for both bases . 
   since there always exists purification states of @xmath95 and @xmath96 , which are respectively denoted by @xmath97 and @xmath98 , such that @xmath99 , @xmath100 can be rewritten by @xmath101/2\ , , \label{fiddelta}\end{aligned}\ ] ] where @xmath102 represents alice s density matrix of @xmath6 basis and all the other density matrices are defined by the same manner . 
   our expression of @xmath100 has the product of two fidelities , while the standard bb84 with basis - dependent flaw in @xcite has only one fidelity ( the fidelity between alice s density matrices in @xmath6 and @xmath7 bases ) . 
   the two products may lead to poor performance of our schemes compared to that of standard qkd in terms of the achievable distances , however our schemes have the huge advantage over the standard qkd that there is no side - channel in the detectors . 
   finally , the key generation rate @xmath103 , given @xmath6-basis , in the asymptotic limit of large @xmath79 is given by @xmath104 where @xmath105 is the bit error rate in @xmath6-basis , @xmath106 is the inefficiency of the error correcting code , and @xmath107 . 
   we can trivially obtain the key generation rate for @xmath7-basis just by interchanging @xmath6-basis in all the discussions above to @xmath7-basis . 
   we remark in our security proof that we have assumed nothing about what kind of measurement mu conducts but that it announces whether it detects the successful event and the type of the event ( this announcement allows us to calculate @xmath108 and the error rates ) . 
   thus , mu can be assumed to be totally under the control of eve . 
   in the following subsections , we show some examples of the key generation rate of each of our schemes assuming typical experimental parameters taken from gobby - yuan - shields ( gys ) experiment @xcite unless otherwise stated . 
   moreover , we assume that the imperfect phase modulation is the main source of the decay of the fidelity between the density matrices in two bases , and we evaluate the effect of this imperfection on the key generation rate .      in the phase encoding scheme 
   i , the important quantity for the security @xmath100 can be expressed as @xmath109\ , . 
   \label{delta11}\end{aligned}\ ] ] note that this quantity is dependent on the intensity of alice s and bob s sources . as we have mentioned in sec . 
   iii , this quantity may be estimated relatively easily via tomography involving homodyne measurement .    ) of @xmath110 and @xmath111 . dashed line : ( a ) mu is at bob s side , i.e. , @xmath112 
   . solid line : ( b ) mu is just in the middle between alice and bob . 
   the lines achieving the longer distances correspond to @xmath110 of @xmath113 . 
   see also the main text for the explanation . 
   [ fig : key33 ] ]    ) that outputs fig . 
   [ fig : key33 ] as a function of the distance between alice and bob . 
   [ fig : intensity33 ] ]    to simulate the resulting key generation rate , we assume that the bit error stems from the dark counting as well as alignment errors due to imperfect phase locking or imperfect optical components . the alignment error is assumed to be proportional to the probability of having a correct click caused only by the optical detection not by the dark counting . 
   moreover , we make assumptions that all the detectors have the same characteristics for the simplicity of the analysis , and alice and bob choose the intensities of the signal lights in such a way that the intensities of the incoming pulses to mu are the same . finally , we assume the quantum inefficiency of the detectors to be part of the losses in the quantum channels . 
   with all the assumptions , we may express the resulting experimental parameters as @xmath114(1-p_{\rm dark})\nonumber\\ & + & ( 1-p_{\rm dark})e^{-2\alpha_{\rm in}}p_{\rm dark}\nonumber\\ \gamma_{\rm suc}&=&\gamma_{\rm suc}^{(x)}+\gamma_{\rm suc}^{(y)}\nonumber\\ \delta_x&=&\delta_y=\big[e_{\rm ali}(1-p_{\rm dark})^2(1-e^{-2\alpha_{\rm in}})\nonumber\\ & + & ( 1-p_{\rm dark})e^{-2\alpha_{\rm in}}p_{\rm dark}\big]/\gamma_{\rm suc}^{(x)}\nonumber\\ \alpha_{\rm in}&\equiv&\alpha_{a}\eta_{a}=\alpha_{b}\eta_{b}\nonumber\\ \eta_{a}&=&\eta_{{\rm det } , a}10^{-\xi_{a } l_{a}/10}\nonumber\\ \eta_{b}&=&\eta_{{\rm det } , b}10^{-\xi_{b } l_{b}/10}\ , . \label{ex data i}\end{aligned}\ ] ] here , @xmath115 is the dark count rate of the detector , @xmath113 is the alignment error rate , @xmath116 is alice s ( bob s ) overall transmission rate , @xmath117 ( @xmath118 ) is the quantum efficiency of alice s ( bob s ) detector , @xmath119 is alice s ( bob s ) channel transmission rate , and @xmath120 ( @xmath121 ) is the distance between alice ( bob ) and mu . 
   the first term and the second term in @xmath122 or @xmath123 respectively represent the alignment error , which is assumed to be proportional to the probability of having correct bit value due to the detection of the light , and errors due to dark counting ( one detector clicks due to the dark counting while the other one does not ) . 
   we take the following parameters from gys experiment @xcite : @xmath124 , @xmath125 , @xmath126 ( db / km ) , @xmath127 , and @xmath128 , and we simulate the key generation rate as a function of the distance between alice and bob in fig . 
   [ fig : key33 ] . in the figure 
   , we consider two settings : ( a ) mu is at bob s side , i.e. , @xmath112 ( b ) mu is just in the middle between alice and bob . 
   the reason why we consider these setting is that the basis - dependent flaw is dependent on intensities that alice and bob employ , and it is not trivial where we should place mu for the better performance . 
   since mdiqkd polarization encoding scheme without basis - dependent flaw achieves almost twice the distance of bb84 @xcite , we may expect that the setting ( b ) could achieve almost twice the distance of bb84 without phase randomization that achieves about 13 ( km ) @xcite with the same experimental parameters . 
   the simulation result , however , does not follow this intuition since we have the basis - dependent flaw not only from alice s side but also from bob s side . 
   thus , the advantage that we obtain from putting mu between alice and bob is overwhelmed by the double basis - dependent flaw . in each setting , we have optimized the intensity of the coherent pulses @xmath12 for each distance ( see fig . 
   [ fig : intensity33 ] ) .    in order to explain why the optimal @xmath129 is so small 
   , note that scheme i intrinsically suffers from the basis - dependent flaw due to eq . 
   ( [ delta11 ] ) . 
   this means that if we use relatively large @xmath129 , then we can not generate the key due to the flaw . 
   actually , when we set @xmath130 , which is a typical order of the amplitude for decoy bb84 , one can see that the upper bound of the phase error rate is @xmath131 even in the zero distance , i.e. , @xmath132 , and we have no chance to generate the key with this amplitude . 
   thus , alice and bob have to reduce the intensities in order to suppress the basis - dependent flaw . 
   also , as the distance gets larger and the losses get increased , alice and bob have to use weaker pulses since larger losses can be exploited by eve to enhance the basis - dependent flaw according to eq . 
   ( [ fdelta ] ) , and they can reduce the intensities until it reaches the cut - off value where the detection of the weak pulses is overwhelmed by the dark counts .    in the above simulation , we have assumed that alice and bob can prepare states very accurately , however in reality , they can only prepare approximate states due to the imperfection of the sources . 
   this imperfection gives more basis - dependent flaw , and in order to estimate the effect of this imperfection , we assume that the fidelity between the two actually prepared density matrices in two bases is approximated by the fidelity between the following density matrices ( see appendix b for the detail ) @xmath133 and @xmath134 where we assume an imperfect phase modulator whose degree of the phase modulation error is proportional to the target phase modulation value , and @xmath135 represents the imperfection of the phase modulation that is related with the extinction ratio @xmath136 as @xmath137 in this equation , we assume that the non - zero extinction ratio is only due to the imperfection of the phase modulators . since imperfect phase modulation results in the same effect as the alignment errors , i.e. , the pulses are routed to a wrong output port , we assume that the alignment error rate is increased with this imperfection . thus , in the simulation accommodating the imperfection of the phase modulation , we replace @xmath113 with @xmath138 . here , we have used a pessimistic assumption that the effect of the phase modulation becomes @xmath139-times higher than before since each of alice and bob has one phase modulator and mu has two phase modulators for the phase shift of two polarization modes ( note from eq . 
   ( [ mimperfect phase modulator ] ) that @xmath136 is approximately proportional to @xmath140 , thus 4 times degradation in terms of the accuracy of the phase modulation results in @xmath139-times degradation in terms of the extinction ratio ) . 
   we also remark that in practice , it is more likely that the phase encoding errors are independent , in which case a factor of 4 will suffice and the key rate will actually be higher than what is presented in our paper . on the other hand , we have to use the following @xmath100 when we consider the security : @xmath141/2\,.\end{aligned}\ ] ]    in figs . 
   [ fig : keyimpferfectpmi ] and [ fig : intensityimpferfectpmi ] , we plot the key generation rate and the corresponding optimal alice s mean photon numbers ( @xmath12 ) as a function of the distance between alice and bob . in the figures , we define @xmath142 that satisfies @xmath143 as @xmath144 , where @xmath145 is the typical order of @xmath136 in some experiments @xcite . 
   we have confirmed that we can not generate the key when @xmath145 . 
   however , we can see in the figures that if the accuracy of the phase modulation is increased three times or five times , i.e. , @xmath146 and @xmath147 , then we can generate the key . like the case in fig . 
   [ fig : intensity33 ] , the small optimal mean photon number can be intuitively understood by the arguments that we have already made in this section .    in order to investigate the feasibility of the phase encoding scheme i with the current technologies , we replace @xmath125 , @xmath127 , and @xmath128 with @xmath148 , @xmath149 @xcite , and @xmath150 @xcite . 
   we see in fig . [ 
   fig : keyimpferfectpminew ] that the key generation is possible over much longer distances with those parameters assuming the precise control of the intensities of the laser source . 
   we also show the corresponding optimal mean photon number @xmath129 in fig . 
   [ fig : intensityimpferfectpminew ] . 
   we note that thanks to the higher quantum efficiency , the success probability becomes higher , following that alice and bob can use larger mean photon number @xmath129 compared to those in figs . 
   [ fig : intensityimpferfectpmi ] and [ fig : intensityimpferfectpminew ] .    ) of @xmath110 and imperfect phase modulators . 
   @xmath151 represents the typical amount of the phase modulation error , and we plot the key rate for smaller imperfection of @xmath152 and @xmath153 . dashed line : mu is at bob s side , i.e. , @xmath112 . 
   solid line : mu is just in the middle between alice and bob.[fig : keyimpferfectpmi ] ]    ) that outputs fig . 
   [ fig : keyimpferfectpmi ] as a function of the distance between alice and bob . 
   [ fig : intensityimpferfectpmi ] ]     with @xmath148 , @xmath149 @xcite , and @xmath151 . dashed line : 
   mu is at bob s side , i.e. , @xmath112 . 
   solid line : mu is just in the middle between alice and bob.[fig : keyimpferfectpminew ] ]    ) that outputs fig . 
   [ fig : keyimpferfectpminew ] as a function of the distance between alice and bob . 
   [ fig : intensityimpferfectpminew ] ]      in the phase encoding scheme ii , note that we can generate the key only from the successful detection event in mu given both of alice and bob send out a single - photon since if either or both of alice and bob emit more than one photon , then eve can employ the so - called photon number splitting attack @xcite . 
   thus , the important quantities to estimate are @xmath154 , @xmath155 , @xmath105 , @xmath156 , which respectively represents gain in @xmath6-basis given both of alice and bob emit a single - photon , the phase error rate given alice and bob emit a single - photon , overall bit error rate in @xmath6-basis , and overall gain in @xmath6-basis . to estimate these quantities stemming from the simultaneous single - photon emission , 
   we assume the use of infinite number of decoy states for the simplicity of analysis @xcite . 
   another important quantity in our study is the fidelity @xmath157 ( @xmath158 ) between alice s ( bob s ) @xmath6-basis and @xmath7-basis density matrices of only single - photon component , _ not _ whole optical modes . 
   if this fidelity is given , then we have @xmath159 for the simplicity of the discussion , we consider the case of @xmath160 in our simulation . 
   the estimation of the fidelity only in the single - photon part is very important , however to the best of our knowledge we do not know any experiment directly measuring this quantity . 
   this measurement may require photon number resolving detectors and very accurate interferometers . 
   thus , we again assume that the degradation of the fidelity is only due to the imperfect phase modulation given by eq . 
   ( [ mimperfect phase modulator ] ) , and we presume that the fidelity of the two density matrices between the two bases is approximated by the fidelity between the following density matrices ( see appendix b for the detail ) @xmath161\nonumber\\ 
   \rho_{y}^{(1)}&=&\frac{1}{2}\big[{\hat p}\left(\frac{{\left| 0_z \right\rangle}+i e^{i|\delta|/2}{\left| 1_z \right\rangle}}{\sqrt{2}}\right)\nonumber\\ & + & { \hat p}\left(\frac{{\left| 0_z \right\rangle}-i e^{-i|\delta|/2}{\left| 1_z \right\rangle}}{\sqrt{2}}\right)\big]\,.\end{aligned}\ ] ] with these parameters , we can express the key generation rate given alice and bob use @xmath6-basis as @xcite @xmath162-f(\delta_{x})q_{x}h(\delta_{x})\,,\end{aligned}\ ] ] where @xmath163 is the @xmath164 version of @xmath80 in eq . 
   ( [ key rate ] ) .    to simulate the resulting key generation rate , 
   the bit errors are assumed to stem from multi - photon component , the dark counting , and the misalignment that is assumed to be proportional to the probability of obtaining the correct bit values only due to the detection by optical pulses . 
   like before , we also assume that all the detectors have the same characteristics , alice and bob choose the intensities of the signal lights in such a way that the intensities of the incoming pulses to mu are the same , and all the quantum inefficiencies of the detectors can be attributed to part of the losses in the quantum channel . 
   finally , alice s and bob s coherent light sources are assumed to be phase randomized , and the imperfect phase modulation is represented by the increase of the alignment error rate . with these assumptions , we may have the following resulting experimental parameters    @xmath165\nonumber\\ & + & w^{(2,1)}+w^{(2,0)}\nonumber\\ \delta_{x}^{(1,1)}&=&\big\{4\alpha_{a}\alpha_{b}\eta_{a}\eta_{b}e^{-2(\alpha_{a}+\alpha_{b})}p_{\rm dark}(1-p_{\rm dark})^2/2\nonumber\\ & + & 2(e_{\rm ali}+4\eta_{\rm ex})\alpha_{a}\alpha_{b}\eta_{a}\eta_{b}e^{-2(\alpha_{a}+\alpha_{b})}(1-p_{\rm dark})^2\nonumber\\ & + & ( w^{(2,1)}+w^{(2,0)})/2\big\}/q^{(1,1)}_{x}\nonumber\\ q^{(1,1)}_{y}&=&q^{(1,1)}_{x}\nonumber\\ \delta^{(1,1)}_{y}&=&\delta^{(1,1)}_{x}\nonumber\\ w^{(2,1)}&\equiv&8\alpha_{a}\alpha_{b}e^{-2(\alpha_{a}+\alpha_{b})}\big[\eta_{a}(1-\eta_{b})+(1-\eta_{a})\eta_{b}\big]\nonumber\\ & \times&p_{\rm dark}(1-p_{\rm dark})^2\nonumber\\ w^{(2,0)}&\equiv&16\alpha_{a}\alpha_{b}(1-\eta_{a})(1-\eta_{b})e^{-2(\alpha_{a}+\alpha_{b})}\nonumber\\ & \times&p_{\rm dark}^2(1-p_{\rm dark})^2\nonumber\\ q_{x}&=&2\left[1-(1-p_{\rm dark})e^{-\alpha_{\rm in}}\right]^2(1-p_{\rm dark})^2e^{-2\alpha_{\rm in}}+v \nonumber\\ \delta_{x}&=&v+(e_{\rm ali}+4\eta_{\rm ex})2\left(1-e^{-\alpha_{\rm in}}\right)^2 \nonumber\\ & \times&(1-p_{\rm dark})^2e^{-2\alpha_{\rm in}}\nonumber\\ v&\equiv&\frac{p_{\rm dark}(1-p_{\rm dark})}{2\pi}\nonumber\\ & \times&\int_{0}^{2\pi}d\theta\big[1-(1-p_{\rm dark})e^{-\alpha_{\rm in}|1+e^{i\theta}|^2}\big ] \nonumber\\ & \times&\big[(1-p_{\rm dark})e^{-\alpha_{\rm in}|1-e^{i\theta}|^2}\big]\nonumber\\ & + & \frac{p_{\rm dark}(1-p_{\rm dark})}{2\pi}\nonumber\\ & \times&\int_{0}^{2\pi}d\theta\big[1-(1-p_{\rm dark})e^{-\alpha_{\rm in}|1-e^{i\theta}|^2}\big ] \nonumber\\ & \times&\big[(1-p_{\rm dark})e^{-\alpha_{\rm in}|1+e^{i\theta}|^2}\big]\nonumber\\ \alpha_{\rm in}&\equiv&\alpha_{a}\eta_{a}=\alpha_{b}\eta_{b}\nonumber\\ \eta_{a}&=&\eta_{{\rm det } , a}10^{-\xi_{a } l_{a}/10}/2\nonumber\\ \eta_{b}&=&\eta_{{\rm det } , b}10^{-\xi_{b } l_{b}/10}/2\ , \label{exp - data - ii}\end{aligned}\ ] ]    note that @xmath12 ( @xmath166 ) represents each of the intensity of alice s ( bob s ) signal light and the reference light , _ not _ the total intensity of them , and @xmath167 and @xmath168 are divided by @xmath169 since the conversion efficiency of our converter is @xmath66 . 
   @xmath170 in @xmath171 again comes from the pessimistic assumption that each of alice s and bob s phase modulator is imperfect , and @xmath172 ( @xmath173 ) represents the probability of the event where both of alice and bob emit a single - photon and only one ( zero ) photon is detected but the successful detection event is obtained due to the dark counting . on the other hand , the quantity that quantifies the basis - dependent flaw @xmath88 in the present case is upper bounded by @xmath174\nonumber\\ q^{(1,1)}&\equiv&(q^{(1,1)}_{x}+q^{(1,1)}_{y})/2\end{aligned}\ ] ] where @xmath175 is the probability that mu receives a single - photon both from alice and 
   bob simultaneously conditioned on that each of alice and bob sends out a single - photon . 
   we remark that @xmath100 in this scheme is only dependent on the accuracy of the phase modulation . 
   this is different from scheme i where the manipulation of the intensities of the pulses can affect the basis - dependent flaw .    in the simulation 
   , we again assume gys experimental parameters and we consider two settings : ( a ) mu is at bob s side and ( b ) mu is just in the middle between alice and bob . 
   note that @xmath100 is independent of @xmath12 and @xmath166 in the phase encoding scheme ii case .    in fig . 
   [ f1 ] , we plot the key generation rates of ( a ) and ( b ) for @xmath176 , @xmath177 , @xmath178 , @xmath179 ( recall from eq . 
   ( [ mimperfect phase modulator ] ) that @xmath180 that corresponds to the typical extinction ratio of @xmath181 ) , which respectively correspond to @xmath182 , @xmath183 , @xmath184 , and @xmath185 , and the achievable distances of ( a ) and ( b ) increase with the improvement of the accuracy , i.e. , with the decrease of @xmath135 . 
   we have confirmed that no key can be distilled in ( a ) and ( b ) when @xmath186 . 
   the figure shows that the achievable distance drops significantly with the degradation of the accuracy of the phase modulator , and the main reason of this fast decay is that @xmath88 is approximated by @xmath187 and this dominator decreases exponentially with the increase of the distance . 
   we also plot the corresponding optimal @xmath129 in fig . 
   notice that the mean photon number increases in some regime in some cases of ( a ) , and recall that this increase does not change @xmath100 . 
   if we increased the intensity in scheme i with the distance , then we would have more basis - dependent flaw , resulting in shortening of the achievable distance . 
   this may be an intuitive reason why we see no such increase in figs . 
   [ fig : intensity33 ] , [ fig : intensityimpferfectpmi ] , and 9 .    like in the phase encoding scheme i 
   , we investigate the feasibility of the phase encoding scheme ii with the current technologies by replacing @xmath125 , @xmath127 , and @xmath128 with @xmath148 , @xmath149 @xcite , and @xmath150 @xcite . with this upgrade 
   , we have confirmed the impossibility of the key generation , however if we double the quantum efficiency of the detector or equivalently , if we assume the polarization encoding so that the factor of @xmath131 , which is introduced by the phase - to - polarization converter , is removed both from @xmath167 and @xmath168 in eq . 
   ( [ exp - data - ii ] ) , then we can generate the key , which is shown in fig . [ f1new ] ( also see fig . 
   finally , we note that our simulation is essentially the same as the polarization coding since the fact that we use phase encoding is only reflected by the dominator of 2 in @xmath188 and @xmath189 in eq . 
   ( [ exp - data - ii ] ) . 
   thus , the behavior of the key generation rate against the degradation of the state preparation is the same also in polarization based mdiqkd . 
   also note that even in the standard bb84 , @xmath88 decays exponentially with increasing distance . 
   thus , we conclude that very precise state preparation is very crucial in the security of not only mdiqkd but also in standard qkd 
   . we also note that our estimation of the fidelity might be too pessimistic since we have assumed that the degradation of the extinction ratio is only due to imperfect phase modulation . in reality 
   , the imperfection of mach - zehnder interferometer and other imperfections should contribute to the degradation , and the fidelity should be closer to @xmath52 than the one based on our model .    . 
   solid line : ( b ) mu is just in the middle between alice and bob . 
   we plot the key generation rates of each case when @xmath176 , @xmath177 , @xmath178 , @xmath179 where @xmath135 is proportional to the amount of the phase modulation error , and for each case of ( a ) and ( b ) the key generation rates monotonously increase with the decrease of @xmath135 . 
   , i.e. , with the improvement of the phase modulation . the key rates of ( a ) and ( b ) when @xmath190 are almost superposed . see also the main text for the explanation . 
   [ f1 ] ]    ) that outputs fig . 
   the bold lines correspond to ( a ) . 
   see also the main text for the explanation . 
   [ f2 ] ]    , @xmath191 , and @xmath151 . 
   note that we double @xmath192 compared to the one of @xcite , or we effectively consider the polarization encoding @xcite . 
   dashed line : ( a ) mu is at bob s side , i.e. , @xmath112 . solid line : ( b ) mu is just in the middle between alice and bob . 
   the key rates are almost superposed . 
   see also the main text for the explanation . 
   [ f1new ] ]    ) that outputs fig . 
   [ f1new ] . 
   the bold lines correspond to ( a ) . 
   see also the main text for the explanation . 
   [ f2new ] ] 
   in summary , we have proposed two phase encoding mdiqkd schemes . 
   the first scheme is based on the phase locking technique and the other one is based on the conversion of the pulses in the standard phase encoding bb84 to polarization modes . 
   we proved the security of the first scheme , which intrinsically possesses basis - dependent flaw , as well as the second scheme with the assumption of the basis - dependent flaw in the single - photon part of the pulses . 
   based on the security proof , we also evaluate the effect of imperfect state preparation , and especially we focus our attention to the imperfect phase modulation . 
   while the first scheme can cover relatively short distances of the key generation , this scheme has an advantage that the basis - dependent flaw can be controlled by the intensities of the pulses . 
   thanks to this property , we have confirmed based on a simple model that 3 or 5 times of the improvement in the accuracy of the phase modulation is enough to generate the key . moreover , we have confirmed that the key generation is possible even without these improvements if we implement this scheme by using the up - to - date technologies and the control of intensities of the laser source is precise . on the other hand , it is not so clear to us how accurate we can lock the phase of two spatially separated laser sources , which is important for the performance of scheme i. our result still implies that scheme i can tolerate up to some extent of the imperfect phase locking errors , which should be basically the same as the misalignment errors , but further analysis of the accuracy from the experimental viewpoint is necessary . we leave this problem for the future studies . 
   -basis when @xmath176 , @xmath193 , @xmath194 where @xmath135 is the amount of the phase modulation error . 
   [ sf1 ] ]    ) that outputs fig . 
   [ sf2 ] ]    the second scheme can cover much longer distances when the fidelity of the _ single - photon components _ of @xmath7-basis and @xmath6-basis density matrices is perfect or extremely close to perfect . when we consider 
   the slight degradations of the fidelity , however , we found that the achievable distances drop significantly . 
   this suggests that we need a photon source with a very high fidelity , and very accurate estimation of the fidelity of the single - photon subspace is also indispensable .    in our estimation of the imperfection of the phase modulation 
   , we simply assume that the degradation of the extinction ratio is only due to imperfect phase modulation , which might be too pessimistic , and the imperfection of mach - zehnder interferometer and other imperfections contribute to the degradation . 
   thus , the actual fidelity between the density matrices of the single - photon part in two bases might be very close to 1 , which should be experimentally confirmed for the secure communication . 
   we note that the use of the passive device to prepare the state @xcite may be a promising way for the very accurate state preparation . 
   we remark that the accurate preparation of the state is very important not only in mdiqkd but also in standard qkd where eve can enhance the imbalance of the quantum coin exponentially with the increase of the distance . to see this point , we respectively plot in fig . 
   [ sf1 ] and fig . 
   [ sf2 ] the key generation rate of standard bb84 with infinite decoy states in @xmath6-basis and its optimal mean photon number assuming @xmath148 , @xmath195 @xcite , @xmath150 , @xmath124 , and @xmath126 . 
   again , @xmath196 is the typical value of the phase modulation error , and we see in the figure that the degradation of the phase modulator in terms of the accuracy significantly decreases the achievable distance of secure key generation . 
   one notices that standard decoy bb84 is more robust against the degradation since the probability that the measurement outcome of the quantum coin along @xmath6-basis is @xmath14 given the successful detection of the signal by bob is written as @xmath197 rather than @xmath198 . on the other hand 
   , one has to remember that we trust the operation of bob s detectors in this simulation , which may not hold in practice . 
   finally , we neglect the effect of the fluctuation of the intensity and the center frequency of the laser light in our study , which we will analyze in the future works . in summary , 
   our work highlights the importance of very accurate preparation of the states to avoid basis - dependent flaws . 
   we thank x. ma , m. curty , k. azuma , t. yamamoto , r. namiki , t. honjo , h. takesue , y. tokunaga , and especially g. kato for enlightening discussions . 
   part of this research was conducted when k. t and c - h . 
   f. f visited the university of toronto , and they express their sincere gratitude for all the supports and hospitalities that they received during their visit . 
   this research is in part supported by the project `` secure photonic network technology '' as part of `` the project uqcc '' by the national institute of information and communications technology ( nict ) of japan , in part by the japan society for the promotion of science ( jsps ) through its funding program for world - leading innovative r@xmath199d on science and technology ( first program ) " , in part by rgc grant no . 
   700709p of the hksar government , and also in part by nserc , canada research chair program , canadian institute for advanced research ( cifar ) and quantumworks . 
   in this appendix , we give a detailed calculation about how scheme i works when there is no channel losses and noises . in order to calculate the joint probability that alice and bob obtain type-0 successful event , where only the detector d0 clicks , and they share the maximally entangled state @xmath32 
   , we introduce a projector @xmath200 that corresponds to type-0 successful event . here 
   , @xmath201 represents the non - vacuum state . 
   the state after alice and bob have the type-0 successful event @xmath202 ( see eq . 
   ( [ normal schi ] ) for the definition of @xmath26 ) can be expressed by @xmath203 here , @xmath204 is an identity operator on @xmath205 and @xmath206 , @xmath207 and @xmath208 are complex numbers , and @xmath209 and @xmath210 are orthonormal bases , which are related with each other through @xmath211 by a direct calculation , one can show that latexmath:[\ ] ] here , @xmath240 , @xmath241 , and @xmath242 , and @xmath243 is defined by @xmath244 where @xmath245 is a purification of @xmath246 , which is the state that alice actually prepares for the bit value @xmath247 in basis @xmath248 , and @xmath249 is alice s qubit system . 
   one can choose any purification for @xmath245 , and in particular it should be chosen in such a way that it maximizes the inner product in eq . 
   ( c2 ) or ( c3 ) . 
   one can similarly define @xmath250 , and @xmath46 is introduced via considering a joint state involving the quantum coin as @xmath251 due to this change , the figures for the key generation rate have to be revised . as the examples of revised figures , we show the revised version of figs . 8 , 9 , 12 , and 13 , which are the most important figures for our main conclusions to hold . 
   notice that there are only minor changes in figs . 8 and 9 and 
   the changes in figs . 
   12 and 13 are relatively big 
   . however , the big changes do not affect the validity of the main conclusions in our paper , which is the importance of the state preparation in mdiqkd and the fact that our schemes can generate the key with the practical channel mode that we have assumed .              for the derivation of eq . 
   ( [ 0 ] ) , we invoke koashi s proof @xcite . 
   to apply koashi s proof , it is important to ensure that i ) one of the two parties holds a virtual * qubit * ( rather than a higher dimensional system ) and ii ) the fictitious measurements performed on the virtual qubit have to form * conjugate * observables . 
   therefore , it is not valid to consider fidelity alone ( which allows arbitrary purifications that may not satisfy the conjugate observables requirement ) . 
   fortunately , it turns out to be easy to modify our equation to satisfy the above two requirements .    since the difference between eq . 
   ( c2 ) and eq . 
   ( c3 ) comes from whether we consider alice s virtual qubit or bob s virtual qubit , we focus only on eq . 
   ( c2 ) and the same argument holds for eq . 
   ( c3 ) . in koashi s 
   proof , the security is guaranteed via two alternative tasks , ( i ) agreement on x ( key distillation basis ) and ( ii ) alice s or bob s preparation of an eigenstate of y , the conjugate basis of x , with use of an extra communication channel . the problem with the original ( i.e. uncorrected ) version of eq . 
   ( 9 ) is the following . 
   if we use the uncorrected version of eq . 
   ( 9 ) in our paper , then the use of the fidelity means that the real part in eq . 
   ( c2 ) is equivalent to @xmath252 with the maximization over _ all possible _ local unitary operators @xmath253 . in this case , if alice performs a measurement along x basis , then it violates the correspondence between her sending state @xmath246 and her qubit state @xmath254 in general , and thus , in the uncorrected version of eq . 
   ( 9 ) in our paper , the argument based on the fidelity does not guarantee the security of the protocol . 
   in contrast , with the corrected version of eq . 
   ( 9 ) in our paper , since the maximization over @xmath46 and @xmath255 in eq . 
   ( c2 ) preserves the relationship between alice s sending state and her qubit state as well as the conjugate relationship between x and y , we can apply koashi s proof for the security argument of the protocol . 
   b. qi , c .- h . 
   f. fung , h .- k . 
   lo and x. ma , quant . 
   73 - 82 ( 2007 ) , y. zhao , c .- h . 
   f. fung , b. qi , c. chen and h .- k . 
   lo , phys . 
   a 78 , 042333 ( 2008 ) , c .- h . 
   f. fung , b. qi , k. tamaki and h .- k . 
   lo , phys . 
   a 75 , 032314 ( 2007 ) , f. xu , b. qi and h .- k . 
   lo , new j. phys . 
   12 , 113026 ( 2010 ) . 
   l. lydersen , c. wiechers , c. wittmann , d. elser , j. skaar and v. makarov , nature photonics 4 , pp . 
   686 - 689 ( 2010 ) , z. l. yuan , j. f. dynes and a. j. shields , nature photonics 4 , pp . 
   800 - 801 ( 2010 ) , l. lydersen , c. wiechers , c. wittmann , d. elser , j. skaar and v. makarov , nature photonics 4 , 801 ( 2010 ) , i. gerhardt , q. liu , a. lamas - linares , j. skaar , c. kurtsiefer and v. makarov , nature comm . 2 , 349 ( 2011 ) , l. lydersen , m. k. akhlaghi , a. h. majedi , j. skaar and v. makarov , arxiv : 1106.2396 . 
   f. fung , k. tamaki , b. qi , h .- k . 
   lo and x. ma , quant . 
   inf . comp . 
   9 , 131 ( 2009 ) , l. lydersen , j. skaar , quant . 
   inf . comp . * 10 * , 0060 ( 2010 ) ,  . 
   mary , l. lydersen , j. skaar , phys . 
   a * 82 * , 032337 ( 2010 ) . 
   d. mayers and a. c .- c . 
   yao , in proceedings of the 39th annual symposium on foundations of computer science ( focs98 ) , ( ieee computer society , washington , dc , 1998 ) , p. 503 
   , a. acin , n. brunner , n. gisin , s. massar , s. pironio , and v. scarani , phys . 
   lett . * 98 * , 230501 ( 2007 ) . 
   the definition of the four bell state is as follows . 
   @xmath257=\frac{1}{\sqrt{2}}[{\left| 0_x \right\rangle}_{a1}{\left| 0_x \right\rangle}_{b1}-{\left| 1_x \right\rangle}_{a1}{\left| 1_x \right\rangle}_{b1}]$ ] , @xmath258=\frac{1}{\sqrt{2}}[{\left| 0_x \right\rangle}_{a1}{\left| 1_x \right\rangle}_{b1}+{\left| 
   1_x \right\rangle}_{a1}{\left| 0_x \right\rangle}_{b1}]$ ] , @xmath259=\frac{1}{\sqrt{2}}[{\left| 0_x \right\rangle}_{a1}{\left| 0_x \right\rangle}_{b1}+{\left| 
   1_x \right\rangle}_{a1}{\left| 1_x \right\rangle}_{b1}]$ ] , and @xmath260 . 
   one of the most simplest proofs is shor - preskill s proof @xcite . 
   the intuition of this proof is as follows . 
   note that if alice and bob share some pairs of @xmath32 , ( i.e. , alice has one half of each pair and bob has the other half ) , then they can generate a secure key by performing @xmath6-basis measurement . 
   the reason of the security is that this state is a pure state , which means that this state has no correlations with the third system including eve s system . 
   due to the intervention by eve , alice and bob do not share this pure state in general , but instead they share noisy pairs . 
   the basic idea of the proof is to consider the distillation of @xmath32 from the noisy pairs . 
   for the distillation , note that @xmath32 is only one qubit pair state that has no bit errors in @xmath6-basis ( we call this error as the bit error ) and has no bit errors in @xmath7-basis ( we call this error as the phase error ) . 
   it is known that if alice and bob employ the so - called css code ( calderbank - shor - steane code ) @xcite , then the noisy pairs are projected to a classical mixture of the four bell states , i.e. , @xmath32 , @xmath37 ( @xmath32 with the phase error ) , @xmath33 ( @xmath32 with the bit error ) , and @xmath38 ( @xmath32 with both the phase and bit errors ) . 
   moreover , if alice and bob choose a correct css code , which can be achieved by random sampling procedure , then css code can detect the position of the erroneous pair with high probability . 
   thus , by performing bit and phase flip operation depending on the detected error positions , alice and bob can distill some qubit pairs that are very close in fidelity to the product state of @xmath32 . 
   in general , implementation of the above scheme requires a quantum computer . 
   fortunately , shor - preskill showed that the bit error detection and bit flip operation can be done classically , and the phase error detection and phase flip operation need not be done , but exactly the same key can be obtained by the privacy amplification , so that we do not need to possess a quantum computer for the key distillation . 
   r. renner , and r. koenig , proc . of tcc 2005 , lncs , springer , vol . 
   * 3378 * ( 2005 ) , m. ben - or , and dominic mayers , arxiv : quant - ph/0409062 , m. ben - or , michal horodecki , d. w. leung , d. mayers , j. oppenheim , theory of cryptography : second theory of cryptography conference , tcc 2005 , j.kilian ( ed . ) 
   springer verlag 2005 , vol . * 3378 * of lecture notes in computer science , pp . 
   386 - 406 .
summary: in this paper , we study the unconditional security of the so - called measurement device independent quantum key distribution ( mdiqkd ) with the basis - dependent flaw in the context of phase encoding schemes . 
   we propose two schemes for the phase encoding , the first one employs a phase locking technique with the use of non - phase - randomized coherent pulses , and the second one uses conversion of standard bb84 phase encoding pulses into polarization modes . 
   we prove the unconditional security of these schemes and we also simulate the key generation rate based on simple device models that accommodate imperfections . 
   our simulation results show the feasibility of these schemes with current technologies and highlight the importance of the state preparation with good fidelity between the density matrices in the two bases . 
   since the basis - dependent flaw is a problem not only for mdiqkd but also for standard qkd , our work highlights the importance of an accurate signal source in practical qkd systems . 
   + * note : we include the erratum of this paper in appendix c. the correction does not affect the validity of the main conclusions reported in the paper , which is the importance of the state preparation in mdiqkd and the fact that our schemes can generate the key with the practical channel mode that we have assumed . *