  Quantum key distribution promises unconditionally secure communications.
However, as practical devices tend to deviate from their specifications, the
security of some practical systems is no longer valid. In particular, an
adversary can exploit imperfect detectors to learn a large part of the secret
key, even though the security proof claims otherwise. Recently, a practical
approach---measurement-device-independent quantum key distribution---has been
proposed to solve this problem. However, so far its security has only been
fully proven under the assumption that the legitimate users of the system have
unlimited resources. Here we fill this gap and provide a rigorous security
proof against general attacks in the finite-key regime. This is obtained by
applying large deviation theory, specifically the Chernoff bound, to perform
parameter estimation. For the first time we demonstrate the feasibility of
long-distance implementations of measurement-device-independent quantum key
distribution within a reasonable time-frame of signal transmission.
