\documentclass[12pt, twoside, draft]{article}

\newcommand{\citeny}[1]{\citename{#1}~\citeyear{#1}}

% Setup TikZ
\usepackage{tikz}
\usetikzlibrary{arrows}
\tikzstyle{block}=[draw opacity=0.7,line width=1cm]

\usepackage{graphicx}
\usepackage{amsmath, amsthm, amsfonts}
% \usepackage[numbers]{natbib}
\usepackage{algorithm, algorithmic}
\usepackage{placeins}
\usepackage{rotating}
\usepackage{booktabs}
\usepackage{multirow} 
\usepackage[font=small,labelfont=bf,tableposition=top]{caption}
\usepackage{xfrac}
\usepackage{relsize}
\usepackage{mathrsfs}
\setcounter{secnumdepth}{5}
\usepackage{lineno}
\usepackage{soul}
\usepackage[text={16cm,23cm},centering]{geometry}

\setlength{\parskip}{1.2ex}
\setlength{\parindent}{0em}
\clubpenalty = 100
\widowpenalty = 100
% \renewcommand{\baselinestretch}{1.5}
\newcommand{\ans}[1]{\textcolor{blue} #1}

\begin{document}

{\bf Reply to referee reports}\\[2ex]

Dear Editor,

first, we would like to thank all reviewers for their careful reading of the manuscript, and the constructive remarks to improve it. In the following, we address the points raised by the reviewers.

\section*{Reviewer 1}
1.  I argue that in order to be accepted the manuscript should include a theoretical analysis on a simple protocol level, to increase accuracy of corresponding scientific debate.
This analysis should cover the prototypical BB84 protocol as well as the particular implementations described in the manuscript.


We thank the reviewer for the suggestion and add in a simple security analysis section in the paper to improve clarity of the discussion.\\[2ex]




\section*{Reviewer 2}
1. “When the single photon detector is under a blinding attack, it is insensitive to low intensity light fields used for quantum key distribution.” This does not apply to the aftergate attack, which is one of the well-known detector manipulation attack.

We thank the reviewer for pointing out this problem. We agree that our method can not directly countermeasure the aftergate attack. To make it more accurate, we change the detector manipulating attack to detector blinding attack in the main content. We believe the detector-blinding attack is the most critical vulnerability of a QKD system using non-MDI protocols. Our paper provides a method that only uses a cheap LED  to close the loophole on the single photon detector with the simplest circuit (including SNSPDs, which are likely to be free running). \\[2ex]

2. In QKD certification, Eve is assumed to know all parameters about the setup of Alice and Bob, including the amplitude of the test blinding field. When we consider a blinding attack, the detector enters the linear range due to the blinding, but if we apply too much energy, it becomes saturated. In this case, Eve can set the blinding field so that the Eve blinding+manipulation signal triggers a click, but the Eve blinding+test blinding+manipulation signal is in the saturation region and cannot pass the comparator in the detector. This means that this countermeasure cannot be considered reliable.

ANS: We agree with the reviewer. Theoretically, the fake state response on the detector with extra blinding power should be different. However, to implement the optical blinding, we do not need to send in microWatts of CW light to drive the detector into the linear mode. Instead, we only need to send in a few hundred picoWatts of CW light to make sure all this avalanching signal is less than the comparator threshold to blind the detector, which makes the reverse bias voltage almost unchanged. Thus, the extra blinding power does not significantly change the fake state signal caused by a strong pulse laser. Moreover, in an actual implementation, we can easily combine more than one scheme proposed in our paper to countermeasure the attack.\\[2ex]

A diff file is attached.

\end{document}
