  We suggest an improved plug-and-play measurement-device-independent (MDI)
continuous-variable quantum key distribution (CVQKD) via the dual-phase
modulation (DPM), aiming to solve an implementation problem with no extra
performance penalty. The synchronous loophole of different lasers from Alice
and Bob can be elegantly eliminated in the plug-and-play configuration, which
gives birth to the convenient implementation when comparing to the
Gaussian-modulated coherent-state protocol. While the local oscillator (LO) can
be locally generated by the trusted part Charlie, the LO-aimed attacks can be
accurately detected in the data post-processing. We derive the security bounds
of the DPM-based MDI-CVQKD against optimal Gaussian collective attacks. Taking
the finite-size effect into account, the secret key rate can be increased due
to the fact that almost all raw keys of the MDI-CVQKD system can be fully
exploited for the final secret key generation without sacrificing raw keys in
parameter estimation. Moreover, we give an experimental concept of the proposed
scheme which can be deemed guideline for final implementation.
