Feasibility assessment for practical continuous variable quantum key distribution over the satellite-to-Earth channel

1 INTRODUCTION

Quantum key distribution (QKD) provides information-theoretic secure key distribution between two parties. Local data sent by a sender, Alice, is encrypted using a key that is guaranteed by quantum mechanics to be securely shared only with the receiving party, Bob. QKD is mainly implemented using optical technology, making it ideal for secure key distribution over a high bandwidth free-space optical (FSO) link.

In discrete variable (DV) QKD applied over fiber the quantum information is usually encoded in a DV of a single photon (eg, time-bin qubit), with a secure range of order 400 km.¹ However, recently, DV-based QKD using polarization as the DV was demonstrated in a free-space satellite-to-ground channel up to a distance of 1200 km.² In Reference 2, a quantum link was established from the low-Earth-orbit (LEO) Micius satellite to the Xinglong ground station. This exciting development is a major step towards realizing global scale secure quantum communications using low-orbit satellites. Indeed, quantum communication through satellite channels is anticipated to be one of the core technologies enabling the so-called quantum internet.³

However, it is uncertain whether DV or continuous variable (CV) multiphoton technologies (or a combination of CV-DV) will prevail in FSO quantum communication. CV protocols have the advantage of high-rate, efficient, and cost-effective detection (using homodyne and heterodyne detectors) in comparison to the sophisticated and expensive single-photon detectors used for DV protocols. CV-QKD is also perhaps more compatible with current classical wireless communications technologies. Initially, CV-QKD was proposed with discrete and Gaussian encoding of squeezed states.^4-7 Thereafter, Gaussian-modulated CV-QKD with coherent states was soon developed.^8-10

The simplest-to-deploy CV-QKD protocols are the GG02 protocol introduced in 2002 by Grosshans and Grangier using a homodyne detector,^{9, 10} and its heterodyne variant (“the no-switching” protocol).¹¹ These both involve preparation of a coherent state (CS) using Gaussian modulation.^{7, 8} More specifically, the quadratures X and P of the CS are randomly modulated according to a Gaussian distribution.⁸ In this article, we refer to GG02 and the no-switching protocol as the CS-Hom protocol and CS-Het protocol, respectively. We state them as the CS-QKD protocols when we refer to them collectively. The CS-QKD protocols have been successfully deployed in fiber with nonzero quantum keys distributed over distances of order 100 km.^{8, 12, 13}

The question we address in this work is whether the simplest-to-deploy CV-QKD protocols, namely the CS-QKD protocols, will be viable in a real-world LEO satellite-to-Earth channel. Although extensive theoretical work on CV-QKD through terrestrial FSO channels has been done in recent years, for example, References 14-21, the only real-world FSO deployment of any CV-QKD protocol has been over the short distance of 460 m.²² The larger losses due to diffraction over the much longer satellite-to-Earth channel (as well as disparate turbulence effects),²³ render any extrapolation of the results in Reference 22 far from obvious. This is compounded by the fact that Reference 22 deployed a different form of CV-QKD, namely, a CS unidimensional CV-QKD protocol.

Our contributions in this work can be summarized as follows. We identify the most important factors contributing to the total excess noise of the CS-QKD protocols in the satellite-to-Earth channel. We pay particular attention to the noise contributions arising from scintillation and contributions arising from time-of-arrival fluctuations between the transmitted local oscillator (LO) and the quantum signal. Using our determination of the total excess noise we then consider a lower bound on the secure key rates anticipated for the CS-QKD protocols deployed over the satellite-to-Earth channel. We will consider secure rates in the asymptotic signaling limit for both of the CS-QKD protocols, and in the finite key limit for the CS-Het protocol.1

The rest of this work is as follows. In Section 2, we review the security models required for calculating the secret key rate of the CS-QKD protocols in a lossy channel. In Section 3, we introduce the system model of the CS-QKD protocols in the satellite-to-Earth channel, and review well-known contributions to the total excess noise from the channel and detectors. In Section 4, we simulate the relative intensity fluctuations and time-of-arrival fluctuations. In Section 5, we investigate the impact on the secret key rate of each noise term. In Section 6, we discuss the security of the CS-QKD protocols in the satellite-to-Earth channel and discuss alternative protocols. In Section 7, we discuss our work in the context of other CV-QKD protocols. Finally, we conclude and summarize our findings in Section 8.

2 SECURITY ANALYSIS OF CS-QKD IN A LOSSY CHANNEL

In our security model of the CS-QKD protocols in the satellite-to-Earth channel, we assume the eavesdropper Eve has full access to the quantum channel and performs the most general (coherent) attack. The general attack is when Eve prepares an optimal global ancilla state, which may not necessarily be separable. Eve can prepare any ancillary states to interact with the signal states and make measurements. In particular, Eve can have access to a quantum memory, which can store the signal states until she learns information during the classical postprocessing. In our security model, we perform the analysis in the entanglement based version of the CS-QKD protocols, even though in deployment we will assume the equivalent prepare and measure schemes.^{24, 25} In deployment, it is straightforward to convert measurements from one scheme to the other.²⁴

Information-theoretic security against the general attack for the CS-QKD protocols was proven in the asymptotic limit where an infinite key was assumed.²⁶ The general attack was proven to reduce to the collective attack using the de Finetti representation theorem for infinite dimensions.²⁷ However, in practice, we need to consider the secret key rate in the finite limit which can only be -secure, where is the probability of failure. Information-theoretic security of the CS-Hom protocol in the finite regime is still an open question. However, by exploiting a new Gaussian de Finetti reduction method, a composable security proof against general attacks for the CS-Het protocol was recently proven.²⁸

2.1 Asymptotic limit

In this section, we review the well-known secret key rates under general attacks in the asymptotic limit (which always provides key rates higher than those obtained under general attacks in the finite limit). We will follow the formalism provided in Reference 29 and references therein. The covariance matrix describing the Gaussian modulated CS sent from Alice (A) to Bob (B) has the form,

()

where is the unity matrix and is the Pauli matrix. For the Gaussian modulated CS-QKD protocols, the coefficients of the covariance matrix are

()

where V_A is Alice's modulation variance of the quadrature operators, V_B is Bob's measured quadrature variance, 0 ≤ T ≤ 1 is the transmissivity of the channel, and is the detector quantum efficiency.2The CS-Hom and CS-Het protocols correspond to and , respectively. The term is defined as all noise terms other than vacuum noise, expressed in vacuum units. In the literature it is common to distinguish between noise, , arising from the detector and noise, , arising from the channel transmission where,²⁹

()

and where is given by

()

Here, is the channel excess noise from various sources and (1 − T)/T is due to channel loss. is given by

()

where is the detector excess noise and is noise due to detector losses.

The secret key rate3against general attacks (in bits/pulse) under reverse reconciliation in the asymptotic limit (infinite key length) is given by References 29-31

()

where I_AB is the mutual information between Alice and Bob, is the reconciliation efficiency, and S_BE is the upper bound to the Holevo information between Eve and Bob. In this work we will only consider reverse reconciliation where Bob sends correction information to Alice who corrects the bit values in the key (derived from her quadrature measurement).³² The mutual information I_AB for the CS-QKD protocol is given by

()

Note that from this point forward, we simplify the nomenclature with , and . Note also, the mutual information becomes

()

and in the limit T → 0, , as expected.

We use the trusted model throughout the article, where Eve can only have access to the channel excess noise . Consequently, in the Holevo information shared between Eve and Bob in (9), we only consider . Eve's information after Bob's measurement is the upper bound on the Holevo information,

()

where S(E) is the von Neumann entropy of Eve's state before the measurement on mode B (Bob's mode) and S(E|B) is conditioned on Bob's measurement outcome. Eve is assumed to purify the transmitted state AB resulting in a pure Gaussian state. It was shown that for a given covariance matrix describing a Gaussian state, Gaussian attacks are the most optimal attacks that minimize the key rates.³³ Therefore, Eve's entropy is

()

where and are the symplectic eigenvalues of the covariance matrix . For CS-QKD protocols, these are given by Reference 29

()

and the entropy S(E|B) is

()

where are the symplectic eigenvalues of the conditional covariance matrix characterizing the state after Bob's measurement. The eigenvalues are given by,

()

where for the CS-Hom protocol C′ and D′ are given by

()

respectively, and for the CS-Het protocol C′ and D′ are given by

()

respectively. Note, for both protocols. Using (6) and (10) to (15), it is then straightforward to calculate the secret key rate in the asymptotic limit.

2.2 Finite key size effects

We now consider the practical security of the CS-QKD protocols using finite-size analysis. We will assume the small finite processing errors associated with the Gaussian modulation of the CSs can be ignored. We do note, however, that an information-theoretic validation of this assumption does not yet exist.³⁴ In the security analysis, we consider the Gaussian collective attacks with -security that was first introduced in References 35, 36 and extended to general attacks in References 28, 37-39. In the infinite limit, the knowledge of the relevant parameters are exact, but in the finite limit, the parameters are estimated with a finite precision. This precision is related to the probability the true values are not inside the confidence interval calculated from the parameter estimation procedure.^{35, 36} In the finite limit, the secret key rate in bits/pulse is given by References 37,38

()

where is the total failure probability of the protocol, is the upper bound of the Holevo information taking into consideration the finite precision of the parameter estimation, N is the total number of symbols sent, and n = N − n_e, where n_e is the number of symbols used for parameter estimation. is given by References 37, 38

()

where d is the discretization parameter4and is a smoothing parameter corresponding to the speed of convergence of the smooth min-entropy. In the finite-size regime, one is limited to -security where , where is the failure probability of the privacy amplification procedure, and is the failure probability of the error correction. The parameters and can be optimized computationally.³⁵

To account for the finite statistics and obtain the value of , the previous covariance matrix (2) for Alice and Bob becomes,^{35, 36}

()

where T_min and are the minimum and maximum values of T and , respectively.

The confidence intervals for T and can be calculated from known distributions of the estimators5 and to obtain the lower value of the T interval given by References 35, 36,

()

and the higher value of the interval given by,

()

where satisfies and erf(x) is the error function defined as . From a theoretical perspective and what we do in this work, we can set the expectation values of the estimators to

()

Using these values, we can compute T_min and . To determine in (16) for the CS-Het protocol, we use these values in Equations (9)-(13) and (15) (ie, setting T = T_min and in Equations (3)-(5)). The mutual information I_AB in (16) is calculated as done before in (7) using T and . Putting all this together, to calculate the secret key rate with finite size effects in (16), we make use of the aforementioned quantities , I_AB, and in (17).

In going from optimal Gaussian collective attacks to general attacks, only the CS-Het protocol is -secure against general attacks with , where²⁸

()

where d_A and d_B are the average photon numbers of Alice and Bob's modes, respectively, and k is the number of modes.²⁸ However, and thus . We choose and number of symbols used for parameter estimation6 n_e = n = 10¹² which can be obtained in minutes for a source pulse rate of 100 MHz. To obtain the secret key rate under general attacks, it is enough to analyze the security against Gaussian collective attacks with and .²⁸

3 SATELLITE-TO-EARTH CS-QKD

We present our system model in Figure 1. Essentially, a Gaussian modulated CS is prepared on the satellite (Alice) and measured at the ground station (Bob) using homodyne or heterodyne detection. At Alice's location in a LEO satellite at altitude H, a strong laser source generates a CS which is divided by an asymmetrical beamsplitter into the LO and the signal path. The laser source generates pulses at central frequency of width and a repetition rate f_rep. The laser beam is collimated by a transmitter aperture of diameter D_T. The amplitude and phase corresponding to X and P quadratures in the signal path are Gaussian modulated with the Gaussian distribution centered at ⟨X⟩ = ⟨P⟩ = 0 with variance V_A.

The LO is then multiplexed with the signal (in a different polarization mode) and sent to Bob. Both the LO and signal are received by an aperture of diameter D_R. Using the LO, Bob monitors the transmissivity T which has a probability density function PDF P_AB(T) of the channel. The PDF is integrated up to a maximum possible value of T = T_max. In general, the form of this PDF is a function of many atmospheric parameters, the transceiver apertures, and the distance between the transceivers. In the uplink (Earth-to-satellite) deep fades in the transmissivity can be anticipated, largely due to beam wander and beam deformation.⁴⁰ In this work, we adopt settings where the losses in the satellite-to-Earth channel are dominated by diffraction effects alone. That is, we assume the transmissivity is a constant. As we discuss later, reasonable receiver/transmitter apertures render such an assumption reasonable in the downlink channel.7However, it is worth noting here that additional support for a constant transmissivity in the downlink comes from the phase-screen simulations of Reference 41, which show highly peaked transmissivity PDFs.8

In the CS-Hom protocol, Bob randomly chooses to either measure the quadratures X or P with the homodyne detector and later announces to Alice which quadrature he measured. In the CS-Het protocol, Bob measures both X and P using two detectors at the output of a balanced beamsplitter.

3.1 Noise components

As shown in (3), we separated the noise due to the channel and the detector . Bob's variance9 V_B of the quadrature operator in (2) using the definitions in (4) and (5) is

()

where we define the total excess noise as

()

The channel excess noise10is References 24, 42, 43

()

where the contributions above are the time-of-arrival fluctuations , relative intensity noise (RIN) due to the atmosphere , background noise , modulation noise , RIN of the LO , and RIN of the signal . We refer the reader to Table 1 for a description of these noise components. We note that the time-of-arrival fluctuations and RIN due to the atmosphere, , have not been determined in the satellite-to-Earth channel. An analysis of these two excess noise components is discussed in the following section.

TABLE 1. Noise components of the total excess noise of CS-QKD the satellite-to-Earth channel

	Channel excess noise component	Description
	Time-of-arrival fluctuations	is the noise component due to the differential modifications between signal and LO pulses in the satellite-to-Earth channel. Predictions for this noise component in a terrestrial free-space channel were made in Reference 51, but not for the satellite-to-Earth channel. We will quantify this noise component in the following section.
	RIN of LO due to atmosphere	is the noise component due to the scintillation caused by atmospheric fluctuations. We will quantify this noise in the following section.
	RIN of the LO	The noise term is due to the power fluctuations of the laser before modulation. This noise component is an intrinsic noise that depends on the parameters of the laser.24
	Modulation noise	The noise term is due to the voltage fluctuations in the modulation of the coherent state at Alice.42 The signal generator translates bit information to a voltage which is amplified to drive the modulator.24 The phase of the quadrature is proportional to the applied voltage. Subsequently, the voltage deviation introduced by the signal generator introduces modulation noise.
	Background noise	Part of the channel excess noise for the satellite-to-Earth channel is photon leakage from the background to the quantum signal and LO.43
	RIN of the signal	Excess noise due to power fluctuations of the laser translates to the RIN of the signal . This noise component is proportional to the absolute power variance for a given optical bandwidth of the signal laser.24 In comparison to the RIN of the LO due to the laser, the RIN of the signal is considerably smaller.24
	Detector excess noise component
vel	Electronic noise	The term vel is electronic noise that is due to other noise sources of the detector including thermal noise and clock jitter affecting the detector. Shot-noise-limited homodyne measurement requires sufficient LO power to reduce the effect of the electronic noise by increasing the signal-to-noise ratio.24, 46
	Analogue-digital converter (ADC) quantization noise	is due to digitizing the output voltage, required by all CV-QKD systems.24, 44, 45 This noise term can be suppressed by increasing the number of bits.
	Pulse overlap	The finite response time of the balanced homodyne/heterodyne detector causes an electrical pulse overlap .47 Large peak powers for shorter pulses can saturate the diodes, causing a nonlinear response. This can be suppressed by ensuring , where is the pulse width.
	LO fluctuations during subtraction	The incomplete subtraction of the output signals by the homodyne/heterodyne detector introduces the noise component .24, 47
	Leakage noise	Part of the total excess noise is the photon leakage from the LO to the signal when the signal is multiplexed with the LO.46, 47 This term largely depends on the system design. However, in the polarization-frequency-multiplexing scheme, this is, assumed negligible.48

• Abbreviations: CS, coherent state; CV, continuous variable; LO, local oscillator; QKD, quantum key distribution; RIN, relative intensity noise.

Similarly, the detector excess noise11is References 24, 44-48

()

where the noise contributions listed are the electronic noise v_el, analogue-digital converter noise , detector overlap , LO subtraction noise , and LO-to-signal leakage . We refer the reader to Table 1 for a fuller description of these noise components.

4 NOISE SIMULATIONS

In the following section, we use the atmospheric channel to determine the channel excess noise contributions from the intensity fluctuations of the LO and the time-of-arrival fluctuations between the LO and signal. Typical values from the literature of each noise contribution (as well as our calculations) are summarized in Table 2.

TABLE 2. Excess noise break-down affecting satellite-to-Earth CS-QKD during daylight

Parameter				Reference
		Channel excess noise	0.0186;0.0126
		Time-of-arrival fluctuations	0.006	This article
		RIN of LO due to atmosphere	0.01;0.004	This article
		Relative intensity noise of LO	0.0018	24
		Modulation noise	0.0005	42
		Background noise	0.0002	43
		Relative intensity noise of signal	<0.0001	24
		Detector noise	0.0133
	vel	Electronic noise	0.013	46, 47
		Analogue-digital converter noise	0.0002	44, 45
		Detector overlap	<0.0001	47
		LO subtraction noise	<0.0001	24, 47
		LO to signal leakage	<0.0001	46-48

• Abbreviations: ADC, analogue-digital converter; CS, coherent state; LO, local oscillator; QKD, quantum key distribution; RIN, relative intensity noise.

4.1 Relative intensity—LO

We follow the procedure presented in Reference 24 to derive the contribution to the channel excess noise from the variations in the intensity of the LO, in the context of the satellite-to-Earth channel. At Bob, the signal and LO are mixed on a balanced beamsplitter. Photo-detectors at the outputs measure the intensity and are subtracted to obtain the quadrature measurement. The difference in the number operator describes this measurement

()

where is the coherent amplitude and is the phase of the quadrature measurement. It is clear that oscillations in the amplitude of the LO will introduce an additional excess noise to the protocol. Assuming for simplicity we intend to measure the quadrature (). Then the difference in number operator is reduced to . Since the fluctuations in intensity and the quadratures are independent random variables, then the variance of the difference in number operator is proportional to the variance of both LO and quadrature operator,

()

()

since and is determined by the intensity fluctuations of the LO and V_A denotes the variance of the quadrature without considering the effects of the variation of intensity in the LO (ie, Alice's modulation variance). To derive the variance in the measurement of the quadrature considering all the effects, we rewrite assuming a constant intensity LO with amplitude , and that the RIN in the quadrature measurement is characterized by the variance .

()

where is the total variance including V_A and the variance of the quadrature operator due to the RIN of the LO. Comparing both (29) and (30) we get

()

Finally, the resulting noise component is

()

We identify two main sources in the fluctuations of the intensity of the LO. One is the fluctuations inherent to the laser when it is generated and the second is the fluctuations caused by the atmospheric fading channel. Since these two random effects are independent, then the noise component due to intensity fluctuations of the LO becomes the sum of the two contributions . In Reference 24 the noise term12due to the fluctuations of the laser is derived and given for a realistic setup with commonly available lasers. The contribution to the total excess noise is . In Table 2, is shown for a modulation variance of V_A = 5.

Analyzing , we note that the intensity of the LO is measured over the aperture used by the receiver. That is, we consider the total power P over the aperture surface ,

()

where I(x,y) is the irradiance of the LO expressed in Cartesian coordinates with the aperture centered at (x,y) = (0,0). In (32), the term is the normalized intensity variance known as the scintillation index . We can quantify the scintillation index averaged over the aperture surface with diameter D_R

()

Then the noise component can be rewritten as

()

The value of can be obtained for weak atmospheric turbulence by using the atmospheric models presented in the Appendix, and calculating the first- and second-order statistical moments of the irradiance.⁴⁹ The result is

()

where is the wavenumber of the laser frequency (c is the speed of light), is the zenith angle, H is the altitude of the satellite at zenith angle , h₀ = 0 km is the altitude of the receiver ground station, and is the refractive index structure of the atmosphere (see Appendix). In Figure 2, we present the values of for different receiver aperture diameters and zenith angles. We see the importance of using a large aperture in the receiver, since not only is it essential for increasing the transmissivity of the channel but also to reduce the fluctuations on intensity which translates to excess noise. The values of are calculated for the receiver aperture diameter D_R = 1 m and D_R = 3 m at and altitude H = 500 km are given in Table 2. These are and 0.004, respectively. For the rest of this article, unless otherwise specified, we use the former value for D_R = 1 m.

4.2 Time-of-arrival fluctuations

Now we derive the pulse deformations due to transmission through the satellite-to-Earth channel, used in the calculation of the time-of-arrival fluctuations of our Table 2. In Reference 50 an analysis based on the mutual coherence function (MCF) is made, where the two-frequency MCF is defined by the average of all ensemble of pulses (see Equations (11)-(28) in Reference 50). The MCF represents the product of the FSO fields and the turbulence factor based on the first and second-order Rytov approximation. Since LEO satellites are positioned at a high enough altitude we can treat the propagation of the wave as in the far-field regime. In this regime the wave as seen by the receiver corresponds to a plane wave.

In the far-field regime corresponding to the Fresnel parameter where W₀ is the beam-waist, L is the total distance travelled by the pulse, and c is the speed of light. The beam-waist is determined by the transmitter aperture diameter which is a fundamental system parameter, as it dominates over many of the effects occurring during optical propagation. The temporal mean intensity in the far-field regime is obtained by averaging over the bandwidth of the MCF at the same radial position and time. From Reference 50, the result is

where t′ is the time, r the radial coordinate over the wavefront of the pulse, is the initial pulse width, and the broadened pulse width is

()

and where is the following integral (which we evaluate numerically),

()

Here, where L₀ and l₀ denote the outer and inner scales, respectively. The inner and outer scales are introduced alongside the atmospheric model described in the Appendix. Any optical pulse sent thought through the atmosphere, will incur deformations due to variations of the refractive index of atmospheric turbulence. To fully analyse the pulse deformations we consider two effects; the broadening of the pulse, and the changes on the time-of-arrival of the pulse. Both of these effects are characterized by the value of . First, the broadening of the pulse will cause an attenuation of the average light intensity of the received signal by a factor of .⁵¹ In Figure 3, we show the ratio as a function of for the satellite-to-Earth channel with the parameters specified above. We see that the pulse broadening becomes considerable only for pulse widths . However, for a pulse width  ps commonly used in CV-QKD systems consistent with a 100 MHz repetition rate,⁴⁶ the pulse broadening effect is negligible.

The second and more relevant effect is the variation of the time-of-arrival t_a at the detector between the signal and the LO pulses. As shown in Reference 52, the statistical properties of the time-of-arrival are obtained from the temporal statistical moments of the complex envelope describing the pulse. The analysis shows that the time-of-arrival mean and variance equal ⟨t_a⟩ = L/c and , respectively. In satellite-to-Earth CS-QKD, the fluctuations of the time-of-arrival caused by the atmospheric channel contribute to the total excess noise as an additional amount⁵¹

()

where is the timing correlation coefficient between LO and the signal. We set the correlation coefficient between signal and LO to as in Reference 51. The noise component due to time-of-arrival fluctuations (39) increases with the pulse width . In Table 2, we determine the value for this noise component to be for a pulse width of  ps and central frequency  THz (corresponding to a wavelength of 1550 nm).

The LO generated by Alice must have sufficient intensity at Bob such that he can perform a heterodyne/homodyne measurement. Typically, 10⁸ photons per pulse are required at Bob's side. With a 100 MHz pulse repetition rate and pulse width of 130 ps, the required LO average power for a 20 dB channel loss (a typical loss considered here) at Alice's side is 130 mW (at 1550 nm). We have chosen the repetition rate to coincide with current detector technology.⁴⁶ There are readily available coherent laser sources with these specifications. We assume the ground station has a state-of-the-art homodyne detector as in Reference 47.

In Figure 4, we compare the noise components contribution for daylight operation. As T gets smaller, the term in (24) would dominate, but for the purpose of this figure, we compare each noise component on equal footing by setting T = 1 and . In this figure, we adopt the following values for the noise components. The electronic noise v_el = 0.013 is the dominant noise component. The next dominant noise component is the RIN due to the atmosphere. For the purpose of the noise analysis, we assume the realistic scenario, where the satellite zenith angle is (which is sufficient for a 2 − 3 minutes flyby²), a transmitter aperture diameter of D_T = 0.3 m and a receiver aperture diameter of D_R = 1 m with an altitude H = 500 km, implying a RIN of .

The next dominant noise component is the time-of-arrival fluctuations. We set the correlation coefficient between signal and LO to as in Reference 51. Figure 3 suggests that for pulse widths ps, the pulse broadening due to weak turbulence is negligible and . Thus, the excess noise due to time-of-arrival fluctuations is . As expected, this noise component doesn't depend on the receiver aperture diameter.

Furthermore, is 6% of the total excess noise. ADC noise is negligible (1%) as part of the detector noise component. All other noises , , and are less than 1% of the total excess noise with the exception of the modulation noise which is 2%.²⁴ Therefore, the predicted channel excess noise is and the detector excess noise .

5 SECRET KEY RATES OF SATELLITE-TO-EARTH CS-QKD

In Figure 5, we calculate the secret key rate in the asymptotic limit against the transmissivity T for both CS-Hom and CS-Het protocols using the parameters in Table 3. Unless otherwise specified, for the rest of the article, we use the parameters in Table 3. The transmissivity on the x-axis is converted to units of dB using the formula . We compare the channel excess noises of and that of our specified satellite-to-Earth channel. For the chosen parameter values, corresponding to a realistic experimental scenario, the difference in the secret key rate between CS-Hom and CS-Het is only evident at low loss in which the CS-Het protocol performs marginally better. The modulation variance V_A is an adjustable parameter that can be optimized to maximize the secret key rate with the total excess noise and transmissivity.²⁴ However, in atmospheric channels the transmissivity can fluctuate (although here we assume not) and the optimal value of V_A at one time may not be the optimal value at another time. Unless the goal is to maximize the secret key rate each run, additional resources to optimize V_A are not necessary. In our system, we choose a value of V_A = 5 which is in the range of optimality for the values of transmissivity in the satellite-to-Earth channel.

TABLE 3. System parameters

DR	H				VA
1 m	500 km	60o	0.95	0.95	5	130 ps	1550 nm	0.0186	0.0133

In Figure 6, we calculate the secret key rate in the finite case against the transmissivity T. As seen in Figure 6 for the CS-Het protocol, the loss that can be tolerated (compared with the asymptotic limit) is less in the finite-size regime for n = 10¹⁰ and n = 10¹². In this same figure, we compare the key rates for collective and general attacks using the failure probability and (), respectively. It is evident that the general attack does not tolerate as much loss. Note it is straightforward to convert all key rate into units of bits/s by multiplying by the laser pulse repetition frequency.13

In Table 4, the individual impact of each noise term on the secret key rate under collective Gaussian attacks is shown14 in the finite-size regime with n = 10¹². The background noise during daylight is approximately 1% of the total excess noise for 1550 nm light (0.0002).⁴³ In DV-QKD, background noise from daylight can be mitigated using small spatial filtering coupled with advanced adaptive optics.⁵⁴ It was noted in Reference 3 that optical systems used in CV-QKD could also use small spectral bandwidth. Consequently, the background noise can be filtered, allowing for daylight operation. Daylight CV technology was demonstrated in Reference 55, but there are no corresponding studies for CV-QKD.

TABLE 4. Individual impact of each noise term on secret key rate under collective Gaussian attacks relative to ideal case of no noise with K in the finite-size regime (ie, the ratio for no impact and for maximum impact)

Parameter	Description	Value	@ 10 dB	@ 20 dB	@ 30 dB
	Channel excess noise	0.0186	0.75	0.63	0.00
	Time-of-arrival fluctuations	0.006	0.91	0.87	0.00
	Relative intensity noise due to atmosphere	0.01	0.85	0.79	0.00
	Background noise	0.0002	1.00	1.00	0.93
	Detector efficiency	0.95	0.95	0.95	0.95
vel	Electronic noise	0.013	0.99	0.99	0.81

• Note: Other parameter values: n = 10¹², , modulation variance V_A = 5 and reconciliation efficiency .
• Abbreviation: RIN, relative intensity noise.

We find that the background noise component during daylight in CS-QKD in the satellite-to-Earth channel has a negligible impact on the secret key rate, in agreement with Reference 43. For night-time operation, the secret key rate would be unchanged with . Thus, the secret key rate in Figure 6 is a lower bound, and night-time operation would improve the key rates, but is not essential.

We consider how increasing the size of the receiver aperture improves the secret key rates under general attacks. For a larger receiver aperture of D_R = 3 m, we obtain a smaller channel excess noise of and detector excess noise of . At the transmissivity T = 15 dB, a secret key rate of 2.6 × 10⁻³ bits/pulse is attained under general attacks for this larger receiver aperture. T = 15 dB is readily achievable in the satellite-to-Earth channel using this larger receiver aperture. For example, for the transmitter aperture of D_T = 0.3 m at transceiver separation 1200 km the beam width at the ground is 12 m (and a diffraction-limited divergence of 10 rad), giving a diffraction loss of 22 dB for receiver aperture D_R = 1 m (see discussion below for Micius). Extrapolating from these parameters, the receiver aperture diameter of D_R = 2.3 m gives a diffraction loss of 15 dB. For this receiver aperture of D_R = 2.3 m, the channel excess noise is and a secret key rate of 2.4 × 10⁻³ bits/pulse is attained under general attacks.

We consider how the secret key rate changes with the system parameters in Table 3. For example, doubling the pulse period to  ps, will give a channel excess noise of . However, the secret key rate is barely changed (ie, 1.0 × 10⁻³ bits/pulse). We also find that from V_A = 2 to V_A = 8, the result doesn't significantly change. Hence, this main result is not sensitive to the parameters we have chosen for the figures.

As we grew close to the completion of our study, two other works appeared; one³⁹ that can be made applicable to satellite-to-Earth channels and one⁵⁶ directly applicable to these channels. Different from our study, these latter works had a focus on the large-scale fading effects on the QKD key rates, and different excess noise contributions. They, therefore, apply to different system models than the diffraction-only loss models we explored here. However, collectively the works of References 39, 56 and ours illustrate clearly that CV-QKD in the satellite-to-Earth channel is feasible.

Although our focus has been to demonstrate the viability of the CS-QKD protocols in satellite-to-Earth channel, it is perhaps interesting to compare our results directly with Micius. In our calculations of the secret key rates, we have assumed that transmissivity is constant.15That is, transmissivity fluctuations due to atmospheric turbulence and beam-wandering are assumed small in comparison to diffraction losses.⁵⁷ As just mentioned above, in the Micius satellite QKD experiment, the satellite-to-Earth channel loss due to diffraction was 22 dB at a maximum distance of 1200 km with a transmitter aperture of D_T = 0.3 m, a far-field divergence of 10  and receiver aperture of D_R = 1 m.² Additional loss occurred via atmospheric absorption and turbulence (3 to 8 dB), and loss due to pointing error (<3 dB). This gave an average total loss of 30 ± 3 dB. In calculations of the Micius QKD key rate, the failure probability was set to which gave a key rate of 1.38 × 10⁻⁵ bits/pulse. In comparison, for our CS-Het protocol at the same security setting and same losses we find zero key rate under general attacks. It is only for losses less than 25 dB that we find nonzero rates under general attacks. We do caution, however, that direct comparisons of these two very different technologies (DV vs CV) are limited in value because the security assumptions are different. We also point out the Micius security analysis disregards information leakage due to side-channel imperfections.² Other assumptions underpinning the Micius key rate are discussed in Reference 58. However, to be fair, we have also overlooked some assumptions that underpin our CV-QKD analysis. The most important of these are in regard to the LO—an issue we discuss next.

6 LO HACKING

7 DISCUSSION

In our work, we have deliberately focused on the feasibility of the simplest-to-deploy CS-QKD protocols over the satellite-to-Earth channel for which composable security is known. The reason for choosing the simplest-to-deploy CS-QKD protocols was twofold. First, early CV-based satellites will certainly deploy one of these protocols, if not both. Second, if the easiest-to-deploy protocols were shown to lead to close-to-zero key rates then more sophisticated protocols (with likely lower key rates) would likely be not interesting.

Our work largely focused on the on CS-Het protocol for which composable security in the finite key limit (ie, a deployable scenario) is known. However, it is worth mentioning that other CV-QKD protocols exist for which composable security in the finite limit is also known, such as two-mode squeezed state CV-QKD protocol.⁷¹ These other protocols in the finite-key setting are generally either more difficult to deploy or have lower expected key rates, relative to CS-Het.

An approach to preventing side-channel attacks against detectors is available via CV measurement device-independent (CV MDI-QKD) protocols. These types of CV-QKD protocols allow for untrusted devices that act as relays. Interestingly, formal proofs of security in the finite regime are known for CV MDI-QKD.^{38, 72, 73} An improvement to this protocol, the coherent-state-based “Twin-Field” (TF)-QKD protocol (an extension of Reference 74), has been recently proposed, for example, References 75, 76 and proof-of-principle experiments carried out in optical fiber.⁷⁷ Information-theoretic security in the finite regime for CS TF-QKD has also been proposed.⁷⁸ However, we do note that in scenarios where the untrusted relay is a satellite being served in the uplink, both MDI-QKD and TF-QKD will suffer losses substantially larger than the downlink losses. Phase referencing between the uplink signals sent from Alice and Bob (and authentication of each pulse so referenced—at the cost of key consumption), and phase compensation of the signals traversing the different FSO uplink channels, must also be included. All these issues will reduce the final key rate.

8 CONCLUSION

In this work, we investigated the feasibility of the simplest-to-deploy CV-QKD protocols, the CS-QKD protocols, over the satellite-to-Earth channel. We reviewed the security of these two protocols, as well as the components of the total excess noise most relevant to the satellite-to-Earth channel. Through new calculations we then determined that the most important sources of noise in our protocols over the satellite-to-Earth channel was the RIN due to the atmosphere, and the time-of-arrival fluctuations between the signal and LO. We next focused on the CS-QKD protocol with heterodyne detection in the deployable setting of a finite key regime. Given reasonable transceiver aperture sizes, and assuming diffraction as the only source of loss, we found that reasonable QKD key rates under general attacks can be anticipated. We, therefore, concluded that CV-QKD with information-theoretic security in the satellite-to-Earth channel is entirely feasible. In closing, we noted our information-theoretic security assumes that the LO is secured from manipulation by an adversary. Future useful work in this area could include formal security proofs of finite-limit CS-QKD with homodyne detection, and formal proofs of security under LO (or reference pulse) attacks.