  In practical quantum key distribution, weak coherent state is often used and
the channel transmittance can be very small therefore the protocol could be
totally insecure under the photon-number-splitting attack. We propose an
efficient method to verify the upper bound of the fraction of counts caused by
multi-photon pluses transmitted from Alice to Bob, given whatever type of Eve's
action. The protocol simply uses two coherent states for the signal pulses and
vacuum for decoy pulse. Our verified upper bound is sufficiently tight for QKD
with very lossy channel, in both asymptotic case and non-asymptotic case. The
coherent states with mean photon number from 0.2 to 0.5 can be used in
practical quantum cryptography. We show that so far our protocol is the $only$
decoy-state protocol that really works for currently existing set-ups.
