  The security of quantum key distribution (QKD) is severely threatened by
discrepancies between realistic devices and theoretical assumptions. Recently,
a significant framework called the reference technique was proposed to provide
security against arbitrary source flaws under current technology such as state
preparation flaws, side channels caused by mode dependencies, the Trojan horse
atttacks and pulse correlations. Here, we adopt the reference technique to
prove security of an efficient four-phase measurement-device-independent QKD
using laser pulses against potential source imperfections. We present a
characterization of source flaws and connect them to experiments, together with
a finite-key analysis against coherent attacks. In addition, we demonstrate the
feasibility of our protocol through a proof-of-principle experimental
implementation and achieve a secure key rate of 253 bps with a 20 dB channel
loss. Compared with previous QKD protocols with imperfect devices, our study
considerably improves both the secure key rate and the transmission distance,
and shows application potential in the practical deployment of secure QKD with
device imperfections.
