  We present a passive approach to the security analysis of quantum key
distribution (QKD) with an untrusted source. A complete proof of its
unconditional security is also presented. This scheme has significant
advantages in real-life implementations as it does not require fast optical
switching or a quantum random number generator. The essential idea is to use a
beam splitter to split each input pulse. We show that we can characterize the
source using a cross-estimate technique without active routing of each pulse.
We have derived analytical expressions for the passive estimation scheme.
Moreover, using simulations, we have considered four real-life imperfections:
Additional loss introduced by the "plug & play" structure, inefficiency of the
intensity monitor, noise of the intensity monitor, and statistical fluctuation
introduced by finite data size. Our simulation results show that the passive
estimate of an untrusted source remains useful in practice, despite these four
imperfections. Also, we have performed preliminary experiments, confirming the
utility of our proposal in real-life applications. Our proposal makes it
possible to implement the "plug & play" QKD with the security guaranteed, while
keeping the implementation practical.
