  Decoy-state quantum key distribution (QKD) is a standard technique in current
quantum cryptographic implementations. Unfortunately, existing experiments have
two important drawbacks: the state preparation is assumed to be perfect without
errors and the employed security proofs do not fully consider the finite-key
effects for general attacks. These two drawbacks mean that existing experiments
are not guaranteed to be secure in practice. Here, we perform an experiment
that for the first time shows secure QKD with imperfect state preparations over
long distances and achieves rigorous finite-key security bounds for decoy-state
QKD against coherent attacks in the universally composable framework. We
quantify the source flaws experimentally and demonstrate a QKD implementation
that is tolerant to channel loss despite the source flaws. Our implementation
considers more real-world problems than most previous experiments and our
theory can be applied to general QKD systems. These features constitute a step
towards secure QKD with imperfect devices.
