  The Bennett-Brassard 1984 (BB84) protocol is the most widely implemented
quantum key distribution (QKD) scheme. However, despite enormous theoretical
and experimental efforts in the past decades, the security of this protocol
with imperfect sources has not yet been rigorously established. In this work,
we address this shortcoming and prove the security of the BB84 protocol in the
presence of multiple source imperfections, including state preparation flaws
and side channels, such as Trojan-horse attacks, mode dependencies and
classical correlations between the emitted pulses. To do so, we consider a
modified BB84 protocol that exploits the basis mismatched events, which are
often discarded in standard security analyses of this scheme; and employ the
reference technique, a powerful mathematical tool to accommodate source
imperfections in the security analysis of QKD. Moreover, we compare the
achievable secret-key rate of the modified BB84 protocol with that of the
three-state loss-tolerant protocol, and show that the addition of a fourth
state, while redundant in ideal conditions, significantly improves the
estimation of the leaked information in the presence of source imperfections,
resulting in a better performance. This work demonstrates the relevance of the
BB84 protocol in guaranteeing implementation security, taking us a step further
towards closing the existing gap between theory and practice of QKD.
