In a QKD security proof, any confidence interval must guarantee that its coverage is above its nominal value, a property known as exactness in the literature of statistical inference. As shown in [39], in the hypergeometric setting, the exact one-sided intervals that arise from the Clopper-Pearson method are length minimizing and thus optimal. Conversely, any tighter one-sided interval is necessarily not exact and thus unsuitable for QKD.

In this Letter, we contemplate the equality sign following the criterion of [8]. With this criterion, “0” and “1” do not provide trivial confidence bounds on the population parameter, forcing us to take the looser values given in Eqs. (2) and (3).

For instance, it is straightforward to show that setting $\epsilon >\exp \{-[9(N-n)n/4(2n+N)]\}$ suffices to assure that ${\mathrm{\Gamma }}_{n,\epsilon }^{{+}^{\prime }}(p^{\mathrm{th}})\ge n/N$ for all $p^{\mathrm{th}}<1/2$. This condition on $\epsilon$ is unrestrictive for all practical purposes.

The statistic ${\mathcal{CP}}_{N,n,\epsilon }^{+}(\widehat{p})$ we introduce here does not exactly match—but is trivially determined by—the one presented in [37, 38]. Precisely, they are related by a “one-unit shift.” The discrepancy arises because we contemplate the equality sign in the bounds, requesting $\mathrm{Pr}[{\mathcal{CP}}_{N,n,\epsilon }^{+}(\widehat{p})\le p]\le \epsilon$ rather than $\mathrm{Pr}[{\mathcal{CP}}_{N,n,\epsilon }^{+}(\widehat{p})<p]\le \epsilon$.

One can speedup the computation of ${\mathcal{CP}}_{N,n,\epsilon }^{+}(x)$ by exploring the complementary set of potential $p$’s (namely, $\{p\ge x|\mathrm{Pr}[\widehat{p}\le x|p]>\epsilon \}$), by carefully selecting the starting $p$ for the iterations (e.g., based on existing analytical bounds), or by applying a binary search or an interpolation algorithm.

Precisely, computing the CMF to a precision beyond the $\lceil {\log }_{10}({\epsilon }^{-1})\rceil$th digit suffices.

A novelty of our protocol with respect to [30] is that, in the PE step, the parties evaluate suitable decoy-state bounds for the single-photon security parameters (e.g., the number of single-photon counts and their phase-error rate). If these bounds do not fulfill predetermined acceptance thresholds, the protocol aborts. Otherwise, a fixed-length output key matching the acceptance thresholds is extracted. Furthermore, a finer-grained PE test is devised when considering the tool of [33], in order to adapt this tool to the decoy-state setting [9].

Note that we use different variables for the correctable QBER in the BBM92 and the BB84 protocols, respectively given by $p^{\text{th}}$ and ${\theta }^{\mathrm{th}}$. For consistency, ${\theta }^{\mathrm{th}}$ is set to the expected QBER of the considered channel model.

The total number of error terms contributing to ${\epsilon }_{\mathrm{PE}}$ varies depending on the random sampling tool under consideration [9].