Recently a new quantum key distribution protocol using coherent and thermal states was proposed. In this work this kind of two-layer QKD protocol is formalized and its security against the most common attacks, including external control and Trojan horse attacks, is discussed.