  Quantum key distribution (QKD) can theoretically achieve the Holy Grail of
cryptography, information-theoretic security against eavesdropping. However, in
practice, discrepancies between the mathematical models assumed in security
proofs and the actual functioning of the devices used in implementations
prevent it from reaching this goal. Device-independent QKD is currently not a
satisfactory solution to this problem, as its performance is extremely poor and
most of its security proofs assume that the user devices leak absolutely no
information to the outside. On the other hand, measurement-device-independent
(MDI) QKD can guarantee security with arbitrarily flawed receivers while
achieving high performance, and the remaining challenge is ensuring its
security in the presence of source imperfections. So far, all efforts in this
regard have come at a price; some proofs are suitable only for particular
source imperfections, while others severely compromise the system's
performance, i.e., its communication speed and distance. Here, we overcome
these crucial problems by presenting a security proof in the finite-key regime
against coherent attacks that can incorporate general encoding imperfections
and side channels while achieving much higher performances than previous
approaches. Moreover, our proof requires minimal state characterization, which
facilitates its application to real-life implementations.
