  Quantum key distribution (QKD) promises provably secure communications. In
order to improve the secret key rate, combining a biased basis choice with the
decoy-state method is proposed. Concomitantly, there is a basis-independent
detection efficiency condition, which usually cannot be satisfied in a
practical system, such as the time-phase encoding. Fortunately, this flaw has
been recently removed theoretically and experimentally using the fact that the
expected yields of single-photon states prepared in two bases stay the same for
a given measurement basis. However, the security proofs do not fully consider
the finite-key effects for general attacks. In this work, we provide the
rigorous finite-key security bounds for four-intensity decoy-state BB84 QKD
against coherent attacks in the universally composable framework. Furthermore,
we build a time-phase encoding system with 200 MHz clocked to implement this
protocol, in which the real-time secret key rate is more than 60 kbps over 50
km single-mode fiber.
