Limits and security of free-space quantum communications

The study of free-space quantum communications requires tools from quantum information theory, optics, and turbulence theory. Here we combine these tools to bound the ultimate rates for key and entanglement distribution through a free-space link, where the propagation of quantum systems is generally affected by diffraction, atmospheric extinction, turbulence, pointing errors, and background noise. Besides establishing ultimate limits, we also show that the composable secret-key rate achievable by a suitable (pilot-guided and postselected) coherent-state protocol is sufﬁciently close to these limits, therefore showing the suitability of free-space channels for high-rate quantum key distribution. Our paper provides analytical tools for assessing the composable ﬁnite-size security of coherent-state protocols in general conditions from the standard assumption of a stable communication channel (as is typical in ﬁber-based connections) to the more challenging scenario of a fading channel (as is typical in free-space links).


I. INTRODUCTION
In a future vision where quantum technologies are expected to be developed on a large scale, hybrid and flexible architectures represent a key strategy for their success [1]. Quantum communications will need to involve mixed scenarios where fiber connections, good for fixed ground stations, are merged and interfaced with free-space links, clearly more suitable for mobile devices. Currently, fiber-based implementations are well studied, but free-space quantum channels are clearly underdeveloped from the point of view of theoretical analysis, both in terms of ultimate limits and rigorous security assessment. Indeed, they require a more demanding study due to the presence of many effects, such as diffraction, atmospheric extinction, turbulence effects, pointing errors, etc.
In this paper, we consider all these aspects by combining tools from quantum information theory [2,3], optics [4][5][6][7], and turbulence theory [8][9][10][11]. In this way, we investigate the ultimate limits of free-space quantum communications, establishing upper and lower bounds on the maximum number of secret key bits (and entanglement bits) that can be shared by two remote parties. Such analysis explicitly accounts for the fading nature of the free-space channels together with their typical background noise. Our treatment is mainly developed for the relevant regime of weak turbulence but we also discuss how to extend the results to stronger fluctuations.
Besides investigating the ultimate limits achievable in freespace quantum communications, we also analyze the practical secret-key rates that are achievable in such conditions by continuous-variable (CV) protocols of quantum key distribution (QKD) [12]. To this aim, we develop a general theory for assessing the composable finite-size security of coherent-state protocols [13,14], starting from the standard assumption of a stable communication channel (e.g., as typical in fiber-based connections) to considering the more challenging scenario of a free-space fading channel, whose transmissivity rapidly fluctuates.
In particular, we have designed a coherent-state protocol, aided by pilot pulses and a suitable postselection procedure, which is able to achieve high secret-key rates in conditions of weak turbulence, within one order of magnitude of the ultimate bounds. In this way, we show that generally turbulent free-space channels are indeed able to support high-rate QKD, with immediate consequences for wireless quantum communications.
The paper is structured as follows. In Sec. II, we provide the general bounds and capacities for free-space quantum communications. In Sec. III, we provide a general formulation of composable finite-size security for CV-QKD. In Sec. IV, we extend this formulation to free-space, showing that suitably high key rates can indeed be achieved. Finally, Sec. V is for conclusions. size w 0 [5,6,15,16]. The beam is prepared by the transmitter (whose aperture is sufficiently larger than w 0 ) and directed toward the receiver, whose aperture is circular with radius a R . Due to free-space diffraction, the receiver gets a beam whose spot size is increased to where z R := π w 2 0 λ −1 defines the Rayleigh range. Because the receiver only collects a portion a R of the spread beam, there is a diffraction-induced transmissivity associated with the channel, given by See Appendix A for a brief review on the basic theory of freespace propagation with Gaussian beams. Let us apply the point-to-point repeaterless Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound [17] (x):= − log 2 (1 − x)t oη d , which provides the secret key capacity and the two-way entanglement distribution capacity of the pure loss channel with transmissivity η d . Then, we find that the maximum rate K of secret key bits that can be distributed per transmitted mode through the free-space channel must satisfy ( (See Appendix B for an explicit proof.) Let us stress that, because entanglement bits (or ebits) are a specific type of private bits, this inequality also provides an upper bound for the maximum rate of ebits per mode E K that is achievable by protocols of entanglement distribution. The diffractionlimited bound U (z) is simple, depending only on the ratio between the receiver's aperture a R and the spot size of the beam at the receiver w z . Furthermore, it is not restricted to the far field (z ≫ z R ). We can check that U (z) is maximized by a focused beam (R 0 = z), providing U foc (z) = 2 f 0R / ln 2, where f 0R := [π w 0 a R /(λz)] 2 is the Fresnel number product of the beam and the receiver. However, this solution is typically restricted to short distances. A more robust solution, suitable for any distance, is to employ a collimated beam (R 0 =∞). In such a case, we write the bound This formula is simple but may be too optimistic, not including other important physical aspects of free-space communication. We progressively include them below.

B. Atmospheric extinction and setup efficiency
Besides free-space geometric loss η d due to diffraction, there are other inevitable effects to consider which include atmospheric extinction. In fact, while a Gaussian beam is propagating through the atmosphere, it is subject to both absorption and scattering. For a fixed altitude h above the ground/sea level, the overall atmospheric transmissivity is modeled by the Beer-Lambert extinction equation where z is the path length in the atmosphere, and α(h) = N (h)σ is the extinction factor [7,Chap. 11]. Here N (h)i s the mean number of particles per unit volume at altitude h, and σ = σ abs + σ sca is the total cross section associated with molecular and aerosol absorption (σ abs ) and scattering (σ sca ) [11,Chap. 2]. In general, both Rayleigh and Mie scattering give contributions to σ sca . Assuming a standard model of atmosphere, one can write its mean density at altitude h as [18] N (h) = N 0 exp(−h/h), (6) whereh = 6600 m and N 0 = 2.55 × 10 25 m −3 is the density at sea level. As a result, we may similarly write where α 0 ≃ 5 × 10 −6 m −1 is a good estimate of the extinction factor at sea level for the optical wavelength λ = 800 nm (see also Sec. III.C of Ref. [19]). Besides extinction, there is also a fixed constant contribution associated with the local transmissivities of the setups. At the receiver, we may have nonunit transmissivity η eff as a result of fiber couplings and limited quantum efficiency of the detector. In a realistic implementation, one may reach values of η eff ≃ 0.5 [20,21]. At the transmitter, there may be an additional loss η T due to the diffraction caused by the finite radius a T of its aperture. For the sake of simplicity, in our treatment we assume that a T 2w 0 , so we can safely set η T ≃ 1 (see Appendix A2). Small deviations from this assumption can be considered by explicitly reinserting parameter η T into the model. In our study, we generally assume the worst-case scenario where η eff may cause leaks to a potential eavesdropper (suitable relaxations of this assumption into scenarios of trusted loss/noise for the receiver are discussed afterward).
Atmospheric extinction and setup efficiency cause several modifications to the general diffraction-limited bounds discussed in Sec. II A above. In fact, we need to consider the combined transmissivity η d η atm η eff , which leads to the revised upper bound K − log 2 (1 − η d η atm η eff )( 8 ) where the latter expansion is obtained in the far field, so we can use η d ≃ 2a 2 R /w 2 z ≪ 1 and the linear approximation of the PLOB bound (x) ≃ x/ ln 2.
It is important to remark that the combined transmissivity η d η atm η eff still misses an important aspect: the process of channel fading induced by atmospheric turbulence and pointing errors, a process that was pioneered in seminal works from the late '60s and early '70s [22][23][24].

Broadening and wandering of the beam
Assuming weak turbulence, we can identify physical processes with different timescales [25]. On a fast timescale, we have the broadening of the beam waist due to the interaction with smaller turbulent eddies; for this reason, w z becomes a larger short-term spot size w st . On a slow timescale, we have the deflection of the beam due to the interaction with the larger eddies. This causes the random Gaussian wandering of the beam centroid with variance σ 2 TB . Its dynamics is of the order of 10 − 100 ms [26], which means that it can be resolved by a sufficiently fast detector (e.g., with a realistic bandwidth of 100 MHz). Pointing errors from jitter and imprecise tracking also cause centroid wandering with a slow timescale. For a typical 1 μrad error at the transmitter, it contributes with a variance σ 2 P ≃ (10 −6 z) 2 , so the centroid wanders with total variance σ 2 = σ 2 TB + σ 2 P . The characterization of w st and σ 2 TB needs specific tools from turbulence theory that we introduce below.
For a beam with wave number k = 2π/λ and propagation distance z, one defines the spherical-wave coherence length [25,Eq. (38)], where C 2 n is the refraction index structure constant (measuring the strength of the fluctuations in the refraction index caused by spatial variations of temperature and pressure). Parameter C 2 n is typically described by the Hufnagel-Valley (H-V) model of atmospheric turbulence [27,28] (see Appendix C for details). For an horizontal path, the structure constant takes a fixed value which depends on the specific altitude, besides the time of day and weather conditions. In particular, its value is typically larger during the day, meaning that the effects of turbulence are more pronounced for daytime operation. For slightly slant paths, it is a good approximation to average C 2 n over the various altitudes or, alternatively, to take its highest value along the path, typically at the lowest altitude. (In our following numerical investigations, we assume a horizontal path with h = 30 m.) Then, the regime of weak turbulence can be expressed by the condition z k[min{2a R ,ρ 0 }] 2 (12) or, alternatively, it can be more stringently expressed in terms of the Rytov parameter as σ 2 Rytov = 1.23C 2 n k 7/6 z 11/6 < 1.
For weak turbulence and setting φ := 0.33(ρ 0 /w 0 ) 1/3 ,w e may write the analytical approximations [29]: These analytical expressions are rigorous for φ ≪ 1 and represent very good approximations for ρ 0 /w 0 < 1. For ρ 0 /w 0 1, they need to be replaced by numerical estimates (see Appendix C for details). For ρ 0 /w 0 ≫ 1, σ 2 TB is negligible and w 2 st is equal to the long-term spot size w 2 lt = w 2 z + 2[λz/(πρ 0 )] 2 [25]. Let us also note that, in the limit of negligible turbulence C 2 n → 0, we have ρ 0 →∞. In such a case, Yura's analytical expansions are just replaced by σ TB ≃ 0 and w lt ≃ w st ≃ w z (which all come from the collapse of the FIG. 1. Free-space communication from a transmitter (Tx) to a receiver (Rx) separated by distance z. The transmitter generates a Gaussian beam with spot size w 0 and mean number of photonsn T . The propagation of the beam is affected by diffraction, atmospheric extinction η atm , and turbulence/pointing errors, so its short-term spot-size w st is randomly deflected by r from the aperture center of the receiver, with an associated transmissivity η st (r). The beam is also affected by an additional attenuation, given by the efficiency η eff of the receiver. In total, transmitter and receiver are connected by an instantaneous lossy channel with transmissivity τ (r) = η st (r)η atm η eff as in Eq. (17). Besides loss, we also consider noise. In particular, thermal noisen B is collected by the field of view of the Rx and further noisen ex may be locally generated by setup imperfections. As a result, the detector is hit byn R = τ (r)n T +n mean photons whosē n = η effnB +n ex are due to thermal noise. long-term spot size w 2 lt = w 2 st + σ 2 TB into its diffraction component w 2 z ).

Incorporating short-term effects and deflection
The first mathematical modification induced by turbulence is that the diffraction-limited transmissivity η d needs to be replaced by a more general expression η st in terms of the short-term waist w st , i.e., where the expansion is valid in the far field (z ≫ z R ). The new loss parameter η := η st η atm η eff (16) represents the maximum value of the link transmissivity when the beam centroid x C is perfectly aligned with the center x R of the receiver's aperture. Because the beam centroid wanders following a Gaussian probability with variance σ 2 , the actual instantaneous value of the transmissivity varies over time and can only be η.This leads to the second modification associated with the fading process: The maximum transmissivity η needs to be replaced by a distribution P 0 (τ ) of instantaneous transmissivities τ η. Here we first connect the instantaneous transmissivity τ to the deflection value r := x C − x R 0; we will then superimpose the random walk in r to describe the fading process affecting τ (discussed in the next subsection).
As also depicted in Fig. 1, for each value of the deflection r, there is an associated transmissivity where η st (r) accounts for the misalignment and reads In the expression above, the factor Q 0 (x, y) is an incomplete Weber integral [30], where the notation I n denotes a modified Bessel function of the first kind with order n. Note that Eq. (18) where γ and r 0 are shape and scale (positive) parameters, given by the following functionals: with n (x):= exp (−2x)I n (2x). As a result, combining Eqs. (17) and (20), we may write

Incorporating beam wandering
Beam wandering is modeled by treating the position of the centroid as a stochastic variable, which can be taken to be Gaussian [32] with variance σ 2 around the center of the receiver's aperture, where σ 2 is the sum of two independent contributions: the variance σ 2 TB due to large-scale turbulence and the variance σ 2 P due to pointing error. In general, one may also assume that the wandering is around an average deflection point at a nonzero distance d from the center of the receiver's aperture. For the sake of simplicity, here we consider the optimal working condition of d = 0, which can always be realized by means of sufficiently fast adaptive optics.
The Gaussian random walk around the receiver's center induces a Weibull distribution for the deflection r, expressed by the zero-mean density function: In turn, the Weibull distribution over r induces a corresponding probability density for τ = τ (r), given by as also discussed in Appendix D.
The random fluctuation of the effective transmissivity τ creates a fading channel from transmitter to receiver that can be described by the ensemble E :={P 0 (τ ), E τ }, where the lossy channel E τ with transmissivity τ is randomly selected with probability density P 0 (τ ). Using the convexity properties of the relative entropy of entanglement (REE) [33][34][35] over an ensemble of channels as in Ref. [17,Eq. (17)], we can bound the secret key capacity of the fading channel E by means of the following average: where (τ ) =−log 2 (1 − τ ) is the PLOB bound associated with the instantaneous channel E τ . The integral in Eq. (26) can be simplified by working with the variable ln(η/τ ) and then solving by parts. In this way, we find that the maximum secret key rate achievable through the free-space channel is bounded by where the correction factor is given by The formula in Eq. (27) is our main result: It bounds the secret key capacity K and the entanglement-distribution capacity E of a free-space lossy channel E affected by diffraction, extinction, setup loss, and fading, the latter being induced by turbulence and pointing errors. We can further simplify the upper bound B(η, σ ) for high loss η ≪ 1. In fact, in such a case, we can reduce the correction and write the approximate bound: Note that the condition η ≪ 1 is not necessarily achieved in the far field, because η = η st η atm η eff and the factors η atm η eff may decrease the overall value of the transmissivity already in the near field. In the far field (z ≫ z R ), we may use both η ≪ 1 and the expansion η st ≃ 2a 2 In our model above, the free-space channel E is an ensemble {P 0 (τ ), E τ } of instantaneous pure-loss channels E τ with probability P 0 (τ ). For all these channels, the upper bound (τ ) is achievable by their (bosonic) reverse coherent information [36,37], which corresponds to the optimal rate of entanglement distribution protocols assisted by one-way classical communication (see Appendix E for details). Averaging over P 0 (τ ) implies that the upper bound in Eq. (27)i s achievable by these entanglement distribution protocols and, therefore, we may write E = K =− log 2 (1 − η), where E K is the entanglement distribution capacity of the link.
In conclusion, as long as we can neglect thermal noise and consider a pure-loss fading process, the bound in Eq. (27) represents both the secret-key and entanglement distribution capacity of the free-space link. In particular, note that the formulas in Eqs. (27) and (29) have a clear structure. They are given by the capacity − log 2 (1 − η) ≃ η/ ln 2 achievable with a perfectly aligned link with no wandering, multiplied by a free-space correction factor which accounts for the wandering effects ( ≃ ).
One can check that, with the assumptions of negligible turbulence and pointing error (σ ≃ 0 and η st ≃ η d ), we have ≃ 1i nE q . ( 28), and Eq. (27) reduces to Eq. (8). If we further assume no atmospheric extinction and unit setup efficiency, Eq. (27) reduces to Eq. (3) which only accounts for free-space diffraction.

D. Thermal noise
The quantity − log 2 (1 − η)inEq. (27) provides an upper bound even in the presence of thermal noise. The reason is because any instantaneous thermal-loss channel E τ,n adding a mean number of photonsn can be written as a decomposition of a pure-loss channel E τ followed by a suitable additive-Gaussian noise channel [3]. Because the PLOB bound is based on the REE, it is monotonic over such decompositions, meaning that its value (τ,n) computed over E τ,n cannot exceed its value (τ ) over E τ . Thus, the loss-based upper bound in Eq. (27) is still valid in the presence of thermal noise (no matter if this noise is trusted or untrusted). However, it is no longer guaranteed to be achievable. For this reason, we derive a tighter upper bound and a corresponding lower bound (technical details about the following derivations are in Appendix F).
Assume that the receiver collects a nontrivial amount of thermal noise which couples into the output mode. The natural source is the brightness of the sky B sky λ which varies between ≃ 1.5 × 10 −6 and ≃ 1.5 × 10 −1 Wm −2 nm −1 sr −1 ,f r o m clear night to cloudy daytime [38] (and assuming that the field of view does not include the moon or the sun). For a receiver with aperture a R , angular field of view fov , and using a detector with time window t and spectral filter λ around λ, the number of background thermal photons per mode is given by [20,38] where h is Planck's constant and c is the speed of light.
As an example, for a 100 MHz detector ( t = 10 ns) with a filter λ = 1 nm around λ = 800 nm, and a telescope with a R = 5 cm and fov = 10 −10 sr, the value ofn B ranges between ≃ 4.75 × 10 −8 photons/mode (at night) and ≃ 4.75 × 10 −3 photons/mode (during a cloudy day). A fraction η effnB of these photons is detected by a receiver with limited efficiency η eff . See Fig. 1.
It is important to note that the number of photons in the natural backgroundn B may be higher than that expected from Eq. (32) as a consequence of the presence of bright sources of light within the field of view of the receiving telescope. Our formalism accounts for such deviations, even though we consider Eq. (32) in our numerical simulations. In general, all the (detected) photons coming from the outside channel must be ascribed to Eve in the worst-case scenario, even though this is an overpessimistic assumption due to the line-of-sight configuration in free-space communication. However, such an assumption must be made because Eve might inject and hide her photons in the background.
Besides the natural background, excess photonsn ex may be created by imperfections in the receiver setup (e.g., due to electronic noise and other errors), so the receiver sees a total ofn = η effnB +n ex thermal photons. Thus, assuming thatn T mean photons are generated at the transmitter and τ is the overall instantaneous transmissivity of the channel, the receiver's detector getsn R = τn T +n mean photons (per mode). See Fig. 1.
The free-space process in Fig. 1 can be described by an overall thermal-loss channel E τ,n with instantaneous transmissivity τ and output thermal noisen. This channel is equivalent to a beam-splitter mixing the signal mode with an input thermal mode withn e :=n(1 − τ ) −1 mean photons. In the worst-case scenario, Eve controls all the input noise and collects all the photons that are leaked from the other output of the beam splitter (which means that she collects photons leaking from both the channel and the receiver setup).
To account for the centroid wandering, we adopt the distribution P 0 (τ ) for the transmissivity τ while keeping the output thermal noisen as a constant. The latter is in fact composed of a fractionn B which is independent from the fading process, while the other contributionn ex can always be assumed to be optimized over such a process (see discussion in Appendix F1 for more details). For this reason, the free-space fading channel can be represented by the ensemble E ={P 0 (τ ), E τ,n }.
For a free-space fading channel E with maximum transmissivity η and thermal noisen η, we compute the following tighter upper bound for the secret key capacity: where the thermal correction T is given by and we have used the entropic function We also compute the following achievable rate (lower bound) for entanglement distribution and, therefore, secret key generation: For negligible noisen, the bounds in Eqs. (33) and (36) collapse to the bound in Eq. (27). By contrast, for strong noisē n = η, the thermal correction in Eq. (34) becomes predominant and we get K 0fromEq. (33). The threshold condition n = η implies the existence of a maximum security distance z max for free-space QKD in the presence of thermal noise. A simple bound on this maximum distance is achieved imposinḡ n = η d , leading to for the case of a collimated beam.

E. Analysis of the ultimate bounds
To study our bounds, we consider different possibilities which depend on the treatment of loss and noise present in the setup of the receiver. In the worst-case scenario assumed so far, we explicitly account for the nonideal values of the receiver parameters η eff andn ex , assuming that Eve may access that leakage and control that noise. This setting can be used to bound the performance of all protocols where both leakage and local noise in the receiving setup are considered to be untrusted. We may then consider the case where the local noisen ex is set to zero, i.e., a noiseless receiver. This setting can be used to bound all protocols where such local noise is considered to be trusted (trusted-noise scenario). Finally, we may also consider the optimal case ofn ex = 0 and η eff = 1, i.e., an ideal lossless and noiseless receiver. This can be used to bound all those protocols where local noise and limited efficiency of the receiver are both considered to be trusted (trusted-loss-and-noise scenario).
Numerical behavior of the bounds is shown in Fig. 2. For the chosen parameters, the condition of weak turbulence σ 2 Rytov < 1 limits day-time distance to a range of z 1km. As we can see from Fig. 2(a), there is a clear gap between the ultimate loss-based upper bound of Eq. (27) and the two thermal bounds in Eqs. (33) and (36). This is created by the presence of thermal noisen. During the night, when the background contributionn B is negligible, it is the presence of untrusted setup noisen ex to create the gap in the performances [see solid lines in Fig. 2(a)]. During the day, there is a higher turbulence on the ground as quantified by the higher value of the structure constant C 2 n ; mainly for this reason, we have a degradation of all the day-time rates with respect to their nighttime counterparts [compare dashed with solid lines in Fig. 2(a)]. For the thermal bounds, this degradation is slightly increased due to the additional contribution of the thermal backgroundn B , which is non-negligible during the day.
In the case of a noiseless receiver as in Fig. 2(b), thermal noise is only coming from the external backgroundn B .F o r nighttime operation, this background is negligible and the two thermal bounds in Eqs. (33) and (36) collapse into the loss bound of Eq. (27), which therefore represents the secret key capacity (and entanglement distribution capacity) of the nighttime link [see red solid line in Fig. 2(b)]. However, during the day, the external backgroundn B is not negligible and this creates a small gap in the performance, so there is no collapse of the thermal bounds [black and blue dashed lines in Fig. 2 Fig. 2(b)]. In the case of an ideal (lossless and noiseless) receiver, we have basically the same situation but with higher rates, as shown in Fig. 2(c).

(b)] into the upper loss-based bound [red dashed line in
An interesting observation for daytime operation is the trade-off between Eq. (15), where a R increases the transmissivity, and Eq. (32), where a R increases thermal noise. For this reason, the optimal performance is achieved when the receiver's aperture a R takes an intermediate value. For instance, consider the case of an ideal receiver and let us study the behavior of the two thermal bounds in Eqs. (33) and (36) as a function of a R at some fixed distance, say z = 1 km. As we can see from Fig. 3, we find an optimal working point at around a R ≃ 10 cm for the specific regime considered. This is true as long as the other parameters of the receiver are fixed, such as its field of view fov which intervenes in Eq. (32). Note that the field of view does not directly depend on a R ,but FIG. 3. For daytime and fixed distance z = 1 km, we plot the thermal bounds in Eqs. (33)and (36) as a function of the receiver's aperture a R . We assume an ideal receiver (n ex = 0a n dη eff = 1). Other parameters are as in Fig. 2. decreases with the focal length of the receiver's telescope f and increases with the area of the detector a. For instance, for a rectilinear optical system focused at ∞, it is easy to check that the angle of view satisfies 1/2 fov ≃ 2arctan( √ a/2 f ), which is also a good approximation for a spherical optical system.

Noise filtering
It is important to note that the behavior of the thermal bounds is strongly dependent on the filter λ. So far, numerical investigations have assumed a value of λ = 1nm, which is the value of the narrow-band filter typically considered in studies with discrete variables. At 800 nm, the value λ = 1 nm corresponds to a relatively large bandwidth of ν = cλ −2 λ ≃ 470 GHz. However, in the setting of CVs, much narrower filters are possible by exploiting suitable interferometric procedures at the receiver, so the effective value of ν becomes equivalent to the bandwidth of the transmitted pulses.
An important ingredients in experiments with CV systems is the local oscillator (LO). They are typically performed with a transmitted LO (TLO), where each quantum signal is multiplexed in polarization with an associated LO and both are sent to the receiver. At the receiver, signal and LO are demultiplexed via a polarizing beam splitter and made interfered on a beam splitter before detection (in a homodyne or heterodyne setup). Alternatively, CV experiments may be performed with a local local oscillator (LLO), where quantum signals are interleaved with strong reference pulses, the latter being used by the receiver to reconstruct the LO locally (with some imperfection [39,40]).
It is important to note that, in a homodyne measurement, the output of the detector is proportional to √n LOx , wherex is the generic quadrature of the signal andn LO is the number of photons from the LO. The value ofn LO can be very high. In fact, considering 10-ns-long pulses from a 100-mW laser at λ = 800 nm, we have that each pulse containsn LO ≃ 4 × 10 9 photons. Even if we pessimistically assume 20 dB of loss (τ ≃ 10 −2 ), we see that about O(10 7 ) photons reach the receiver.
Thanks to the large prefactor √n LO , only the contribution of thermal noise mode-matching with the LO will survive in the output. This means that the interferometric process introduces an effective filter which is given by the bandwidth ν of the LO. Compatibly with the time-bandwidth product t ν 0.44 (for Gaussian pulses), one can make ν very small. As an example, for a 10-ns pulse, we may consider ν = 50 MHz corresponding to just λ = 0.1 pm around 800 nm; this filter is four orders of magnitude narrower than the one considered above. With respect to λ = 1 nm, such a narrow filter realizes a corresponding 10 −4 suppression of the background noisen B , which therefore becomes negligible (daytime noise becomesn B ≃ 10 −7 ). As a result, the detector would only experience locally generated noise, i.e.,n ≃n ex .
From the point of view of the rates, with a narrow filter λ = 0.1pm, we have an increase of the daytime thermal bounds in Fig. 2. In particular, for a noiseless setup (n ex = 0) we haven ≃ 0. In this case, the daytime thermal bounds computed from Eqs. (33) and (36) collapse into the daytime loss bound given by Eq. (27), which therefore becomes the secret-key capacity (and entanglement distribution capacity) of the daytime link. This means that the black and blue dashed lines in Fig. 2(b) collapse into the upper red dashed line. The same happens in Fig. 2(c) which refers to a lossless and noiseless setup, but with higher rates.
It is worth stressing that, if we optimize over the receiver to make the total thermal noisen negligible (as a result of a noiseless setupn ex ≃ 0 and noise filteringn B ≃ 0), then the loss bound of Eq. (27) is achievable no matter what the external conditions are (nighttime or daytime). It is also clear that this bound can be further optimized by assuming no pointing error at the transmitter and unit quantum efficiency at the receiver. The result of these optimizations (implicit in our formula) provides a bound/capacity which uniquely depends on the external free-space channel between the two remote parties (affected by diffraction, extinction, and turbulence).

Slow detection
So far, we have considered the situation where the detector of the receiver is fast enough to resolve the wandering of the centroid. In general, this dynamics has two components: on the one hand, there are the fluctuations induced by atmospheric turbulence, with a timescale of the order of 10-100 ms; on the other hand, there is pointing error (from jitter and imprecise tracking) that fluctuates over a slightly slower timescale, of the order of 0.1−1 s. For detection, we can therefore identify three different regimes: (i) fast detectors able to resolve all the dynamics above; (ii) intermediate detectors, able to solve part of the dynamics, i.e., pointing-error wandering but not turbulence-induced fluctuations; and (iii) slow detectors, not able to resolve any of the wandering dynamics. For instance, the latter situation may occur when the measurement time is intentionally increased with the aim of increasing the detection efficiency. In all cases, we assume that the pulses have a temporal length perfectly matching the bandwidth of the detector.
In the case of an intermediate detector (ii), we integrate over the fast fading process induced by turbulence. As a result, we have an overall fading channel which is only generated by the pointing error, and whose instantaneous transmissivity is now determined by the long-term spot size w 2 lt = w 2 st + σ 2 TB . Let us set Then we may write the upper bound where of Eq. (28) has to be computed over η int and σ P (with parameters r 0 and γ to be computed over η lt and η far lt ). Similarly, the thermal upper bound takes the form Basically, we obtain the modified formulas by setting σ 2 TB ≃ 0 and replacing w st with the long-term spot size w lt in the bounds of Eqs. (27), (33), and (36).
Assuming a slower detector (iii), we need to integrate over the entire fading process induced by turbulence and pointing error. Instead of a fading channel, we now have an average lossy channel with transmissivity η tot which is determined by the long-term spot size w 2 lt = w 2 st + σ 2 TB together with the variance of the pointing error σ 2 P , besides η atm and η eff . In other words, we have [41] As a result, the upper bound in Eq. (27) simplifies to Similarly, the thermal upper bound of Eq. (33) becomes forn η tot , and is equal to zero otherwise. Note that this formula is a direct modification of Ref. [17,Eq. (23)].
It is important to note that, to fairly compare Eqs. (40), (41), (44), and (45) with the previous fast-detection bounds, we need to account for the clock of the system. In fact, in such a comparison, one should explicitly account for the integration time which smooths the fluctuations but also reduces the final rate (or throughput) in terms of bits per second. In fact, given a rate K in terms of bits/use, we need to plug a clock C (uses/second) which depends on the bandwidth of the detector and the repetition rate of the source. The effective rate (bits/second) would then be CK. For instance, using a detector with bandwidth W = 100 MHz, we may work with 10-ns pulses and use a clock of C = W/3 ≃ 3.3 × 10 7 uses (pulses) per second. If we assume a slow detector (and corresponding longer pulses) with a detection time of 100 ms, we then have a clock of about 3.3 uses per second, leading to an orders-of-magnitude lower rate in terms of bits per second. Furthermore, long detection times also lead to higher background noise, which may become a major problem for daytime.

Intermediate and strong turbulence
The previous bounds for slow detection can be stated for increasing levels of turbulence. From a physical point of view, stronger values of turbulence can be associated with an increasingly-faster averaging process so that the receiver loses the ability to resolve the fading dynamics. The effect is similar to having an increasingly slower detector. However, besides this averaging process, there is also the appearance of scintillation effects and other effects of beam deformation, so the transition from weak to stronger regimes of turbulence cannot be described in simple mathematical terms. That being said, the concept of long-term spot size is robust and applies to the various regimes of turbulence, from weak to strong [25, Sec. III A]. In fact, even when the beam is broken up in multiple patches, the long-term spot size provides the mean-square radius of the region containing the patches.
In virtue of these considerations, we may rely on the robustness of the notion of long-term spot size to extend our upper bounds beyond the weak (σ 2 Rytov < 1) and the weakintermediate (σ 2 Rytov ≃ 1) regimes of turbulence (see also Appendix C for a discussion of these regimes in terms of the ratio ρ 0 /w 0 ). At intermediate-strong turbulence (σ 2 Rytov > 1), the variance σ 2 TB becomes relatively small, while the shortterm spot size w st tends to approximate the long-term value w lt . If the pointing error is non-negligible, then we may write the upper bounds in Eqs. (40) and (41). However, if pointing error σ 2 P is also negligible (with respect to w 2 lt ), then we directly consider the upper bounds in Eqs. (44) and (45). For high values of turbulence (σ 2 Rytov ≫ 1), we may certainly assume σ 2 P ≃ σ 2 TB ≪ w 2 lt , and write the upper bounds in Eqs. (44) and (45) for the strong-turbulence secret-key capacity K strong . Because these bounds do not come from an operational reduction of the detection time, the value C of the system of clock can be high here.

III. COMPOSABLE SECURITY AND KEY RATES FOR CV-QKD
In this part of the paper, we study practical rates for freespace CV-QKD, therefore providing state-of-the-art lower bounds for the free-space secret key capacities discussed in Sec. II. In this specific section, we first develop a general and simplified theory of composable security that applies to CV-QKD protocols with a stable channel (fixed transmissivity), as is the typical case in fiber-based implementations or even certain free-space links where turbulence and other fading effects are negligible. This theory is the basis for the next section, Sec. IV, where we extend it to the case of CV-QKD protocols over a fading channel (variable transmissivity) as is the general case of free-space links affected by pointing errors and turbulence. The latter is a more difficult scenario but with interesting implications for both ground-and satellite-based communications [42][43][44][45][46][47][48][49].

A. Description of the protocol
Let us study a Gaussian-modulated coherent-state protocol with a fixed transmissivity between Alice (the transmitter) and Bob (the receiver) [12]. The general scenario is the one depicted Fig. 4. Alice encodes classical information in a bosonic mode by preparing a coherent state |α whose amplitude α is modulated according to a complex Gaussian distribution with zero mean and variance μ − 1. Note that we may write α = (q + ip)/2, where x = q or p is the mean value of the generic quadrature operatorx =q orp with [q,p] = 2i [3]. Therefore, the generic quadrature of the mode can be decomposed asx =x 0 + x, wherex 0 corresponds to vacuum noise and the displacement x is a real Gaussian variable with zero mean and variance σ 2 x = μ − 1. The coherent state containsn T =|α| 2 mean number of photons and it is transmitted through a channel with transmissivity η ch and environmental noisen b =n B (1 − η ch ) −1 , so that n B thermal photons are injected in the channel. (In terms of the free-space configuration of Fig. 1, parameter η ch corresponds to the instantaneous value η atm η st (r), andn B is the thermal background.) The output state is then measured by a receiver FIG. 4. General description of the protocol and worst-case eavesdropping scenario. Alice's modulated coherent state |α , withn T mean photons, is subject to channel loss η ch and background noisē n B , before entering the receiver with quantum efficiency η eff and setup noisen ex . Bob's detectsn R = τn T +n mean photons, where τ = η ch η eff is the total transmissivity of the link andn = η effnB +n ex is the total number of thermal photons. The input-output relation for the quadratures is given by Eq. (48). In the worst-case scenario, Eve collects all the leakage and controls all thermal noise. This is equivalent to assume that she replaces the channel with a beam splitter with transmissivity τ and thermal inputn e =n/(1 − τ ). The latter is part of a TMSV state in her hands, whose output is stored in a quantum memory.
with limited efficiency η eff and affected by thermal noise, such to addn ex extra mean photons. As a result, the final (ideal) detection is reached byn R = τn T +n mean photons, where τ = η ch η eff is the total transmissivity and n = η effnB +n ex (47) is the total number of thermal photons. See Fig. 4. The final detection is either a randomly switched measurement ofq orp (homodyne) or a joint measurement ofq andp (heterodyne). In both cases, there is an outcome y corresponding to Alice's classical input x. A single pair (x, y) per mode is generated by the homodyne protocol [14], while two pairs per mode are generated by the heterodyne protocol [13]. For both protocols, we may compactly write the input-output relation where the noise variable is given by Herex b is the quadrature of the background thermal mode,x v is the quadrature of a setup vacuum mode, ξ ex is a Gaussian variable with variance 2n ex , and ξ det is an additional variable whose variance depends on the specific type of final detection, i.e., we have var(ξ det ) = 0 for homodyne, and var(ξ det ) = 1 for heterodyne. It is useful to introduce the quantum duty, ν det to pay by the detector, which is ν det = 1 for homodyne (due to the vacuum noise in the state) and ν det = 2 for heterodyne (which is increased due to the simultaneous measurements of the two conjugate quadratures). Thus, in total, the noise variable z has variance Alice and Bob's mutual information I (x : y)i st h es a m e in direct reconciliation (Bob inferring x from y) and reverse reconciliation (Alice inferring y from x). This is easy to compute under ideal postprocessing techniques able to reach the Shannon capacity of the additive-noise Gaussian channel. In fact, from var(y) = τσ 2 x + σ 2 z and var(y|x) = σ 2 z , one derives where χ := σ 2 z /τ is the equivalent noise, given by In particular, note that the first term in Eq. (52) is the specific contribution of the channel to the excess noise: For the homodyne and heterodyne protocols, we may explicitly write Before proceeding with the security analysis and the derivation of the asymptotic key rate, it is important to clarify the most relevant noise contributions that are present in the setup noisen ex . In our paper, we assume the worst-case scenario where this noise is considered to be untrusted, even though it may be estimated or calibrated by the parties. This robust approach allows us to lower bound the performances that are achievable by CV-QKD in general, including those situations where some of the setup noise is considered to be trusted (as might be the case for some tolerable level of electronic noise).

B. Practical observations on the receiver setup
Here we discuss the contributions to the setup noise, that m a yb eb r o k e nu pa sn ex =n LO +n el +n other , wheren LO are thermal photons generated by imperfection in the LO (phase errors),n el is electronic noise, andn other is any other uncharacterized and independent noise source that might appear in the setup (that we numerically neglect here). In general, the setup noisen ex will depend on the channel transmissivity. Below we start by describingn LO which has a different behavior depending on the type of LO. Afterward, we discuss the expression ofn el .

Local oscillator (TLO and LLO)
To encode and decode information with the quadratures of a bosonic mode, the reference frames of the transmitter and receiver need to be phase locked. There are two possible ways to achieve this: either via a TLO or an LLO. In the experimental practice, the use of a TLO is the simplest solution. One the one hand, it introduces negligible phase errorn TLO ≃ 0 and guarantees that the spatial modes of the signal and LO pulses are the same, so the mode matching is ideal at the receiver. On the other hand, the fact that the LO transmitted together with the signal means that it may also be the subject of attacks. This problem can be mitigated by real-time monitoring of the LO intensity and properties, so as to match the values expected by the parties [12].
The other solution of a LLO excludes channel attacks against the LO but inevitably introduces nontrivial phase errors in the receiver setup. These phase errors provide a contribution to the excess noise equal to where C is the clock and l W is the laser linewidth. This formula is derived from Ref. [39] assuming that signal pulses and LO reference pulses are generated with the same coherence time τ coh ≃ (π l W ) −1 . More generally, in Eq. (56) one needs to consider the average linewidth (l signal W + l LO W )/2, but we omit this technicality here.
From the formula, it is clear that the noise decreases for higher clocks and narrower linewidths. In general, this approach requires better hardware than the TLO. In our analysis, we have σ 2 x 10, so a reasonably low value ε LLO 0.02 can be reached by C = 5 MHz and l W ≃ 1.6 KHz or, alternatively, by C = 100 MHz and l W ≃ 32 KHz (e.g., together with a 1 GHz homodyne receiver for detecting 0.1C −1 ≃ 1 ns pulses [50]). In other words, very good cw-lasers and detectors are needed. Refined analyses suggest that highly performant amplitude modulators are also required to avoid the introduction of other noise contributions [40,51].
To account for the LLO in our theoretical treatment, we recall that Alice and Bob's mutual information takes the form in Eq. (51) where the equivalent noise χ is broken down as in Eq. (52), i.e., we write where ε ch := 2n B /η ch is channel's excess noise. The introduction of the LLO contribution consists of making the replacement χ → χ + ε LLO in the formula above. Because this type of noise is within the local setup of the receiver, we make it a contribution ton ex by writinḡ Some observations are in order. The basic implementation of LLO considers the regular alternation between signal pulses and LO reference pulses. In such a setting, one may argue that the actual rate per second (throughput) is halved with respect to the TLO. However, it is worth noting that this factor 1/2 may be compensated if the signals are encoded in both polarizations for each channel use (not possible for a TLO due to its multiplexing in polarization). Another observation is about the use of homodyne or heterodyne at the receiver. Because of the regular signal-reference alternation, the receiver may use a dedicated heterodyne detector for the LO references and another detector for the signals (heterodyne or randomly switched homodyne). However, if the receiver is limited to a single homodyne detector, then the transmitter can send two LO reference pulses with orthogonal polarizations and rotated by π/2 in phase space. At the receiver, these pulses can be demultiplexed, delayed, and sequentially homodyned to give the complete phase information.

Electronic noise
One of the typical and unavoidable sources of noise within the setup of the receiver is electronic noise, with associated variance ν el or equivalent number of photonsn el = ν el /2. This depends on the noise equivalent power (NEP) of the amplifiers and photodiodes to be used in the homodyne detectors, besides the detection bandwidth W , the duration of the LO pulses t LO , the LO power at the detector P det LO , and the frequency of the light ν. In fact, one can write the formula [52,53] At W = 100 MHz, we may consider NEP = 6pW/ √ Hz. Then, assuming ν ≃ 3.75 × 10 14 Hz (λ = 800 nm) and t LO = 10ns, we may write ν el = 1.45 × 10 −4 ν det /P det LO .I na TLO setup, we have P det LO = τ P LO , where P LO is the initial LO power at the transmitter. Setting P LO = 100 mW, we derive where the bound is taken by assuming the worst-case scenario of heterodyne detection (ν det = 2). As we can see from Eq. (60), the noise is small at short ranges but may become non-trivial at long distances, e.g., ν el 0.29 at 20 dB, i.e., for τ = 10 −2 .
In the case of an LLO setup, where the LO pulse is locally generated, we have P det LO = P LO in Eq. (59). This means that ν el becomes independent from the transmissivity and its value can be very low. In our numerical example, Eq. (60) is replaced by ν el 2.9 × 10 −3 . Thus, the LLO setup provides an advantage with respect to the TLO in terms of reduced electronic noise (to be balanced with the negative effect of introducing phase errors).

Setup noise versus channel transmissivity
As we see from the discussion above, the setup noisen ex also depends on the transmissivity of the channel τ , due to the fact that the value of τ is relevant for both the LO power and the (attenuated) modulation of the signals at the receiver. Let us make the notation more compact by introducing the term Then, the setup noisen ex has different monotonicity in τ depending on the use of a TLO or an LLO. In fact, we can write the following: showing thatn TLO ex is decreasing in τ , whilen LLO ex is increasing.

C. Asymptotic key rate
Once we have clarified the various contributions to thermal noise, we proceed with the security analysis assuming that the various imperfections of the receiver are untrusted, both in terms of setup noisen ex and quantum efficiency η eff . Thus, our approach assumes the worst-case scenario where Eve not only perturbs the outside channel (with transmissivity η ch and background noisen B ), but also collects the fraction 1 − η eff of photons leaked by the receiver, and potentially tampers with its setup noisen ex (which might be exploited to insert Trojan-horse photons). As already said before, this is a conservative approach which allows us to lower bound the performance of CV-QKD and to remove the exploitation of potential loopholes in the practical devices.
In the worst-case scenario, Alice and Bob ascribe the entirety of loss τ = η ch η eff and thermal noisen = η effnB +n ex to Eve. See Fig. 4. In other words, Eve is assumed to have the total control of the environmental dilation of the thermal-loss channel E τ,n that is observed by the parties and leading to the input-output relation of Eq. (48). Such a dilation corresponds to a beam splitter of transmissivity τ that mixes each signal mode with an environmental mode carryingn e =n/(1 − τ ) thermal photons, which is in turn part of a two-mode squeezed vacuum (TMSV) state prepared by Eve. For each incoming signal, a fresh TMSV state is prepared and used in the interaction. After interaction, the signal output of the beam splitter is released to Bob, while the environmental output is stored in a quantum memory, to be jointly measured by Eve at the end of the protocol. This is a collective entangling-cloner attack which is the most practical and relevant collective Gaussian attack [54].
In this scenario, let us compute Eve's Holevo information, i.e., the maximum amount of information that she can steal per use of the channel. It is convenient to work in the entanglement-based representation, where Alice's Gaussianmodulated coherent states with variance σ 2 x = μ − 1a r e realized by heterodyning the idler mode A of a TMSV state [3] with covariance matrix (CM) where I := diag(1, 1) and Z := diag(1, −1). After the action of the thermal-loss channel on the transmitted mode A ′ ,w e have that Alice and Bob share a zero-mean Gaussian state with CM Because the total output state ρ ABE of Alice A,BobB and Eve E = EE ′ is a pure state, we can compute Eve's Holevo bound from Alice's and Bob's von Neumann entropies S(···). In reverse reconciliation, Eve's Holevo bound with respect to Bob's variable y is given by where S(E) = S(AB) comes from the total purity, and S(E|y) = S(A|y) comes from the fact that Bob's measurement is a rank-1 projection (homodyne/heterodyne), so that Alice and Eve's conditional state ρ AE|y is pure.
It is easy to compute the entropies above starting from Alice and Bob's output CM V AB . Let us call ν ± the two symplectic eigenvalues of V AB . Then, we may write (66) where H (x) is defined using Eq. (35). The value of S(A|y)is given by computing H (x) over the symplectic eigenvalue of the conditional CM V A|y , whose explicit expression depends on the type of detection.
Let us set := diag(1, 0). For the homodyne protocol, Alice's CM conditioned on Bob's outcome y is [3,55,56] V hom and its symplectic eigenvalue is given by For the heterodyne protocol, we have instead [3,55,56] V het with symplectic eigenvalue As a result, we have For a realistic reconciliation efficiency β ∈ [0, 1], accounting for the fact that data processing may not reach the Shannon limit, we write the asymptotic key rate where the explicit expressions for the homodyne protocol [14] (R hom asy ) and the heterodyne protocol [13]( R het asy ) derive from the corresponding expressions for the mutual information I hom and I het [cf. Eqs. (54) and (55)] and the Holevo bound χ hom and χ het [cf. Eqs. (71) and (72)]. In an experimental implementation, the term βI in Eq. (73) is determined by the empirical entropy associated with the key and the specific code used for error correction.
It is important to observe that the rate in Eq. (73) can be computed by Alice and Bob once they know the values of the total transmissivity τ and the total thermal noisen.I na practical setting, the values of τ andn are not known but must be evaluated during the protocol via a dedicated procedure of parameter estimation. Because a realistic protocol runs for a finite number of times, this estimation is not perfect and decreases the rate.
Up to an error probability ε pe , Alice and Bob derive worst-case estimators τ ′ ≃ τ − f (τ,n) andn ′ ≃n + g(n), for suitable monotonic functions f and g (both increasing inn). Thus, they use τ ′ andn ′ to compute the parameter-estimationbased version of the rate Below we clarify the explicit expressions for f and g.

D. Details of parameter estimation
Here we go into the fine details of parameter estimation, also clarifying the explicit forms of the functions f and g that are used above. For implementing this step of the protocol, Alice and Bob jointly choose a random subset of m channel uses. By publicly comparing the corresponding input-output values, they estimate the relevant channel parameters (τ andn) whose knowledge is crucial for applying the most appropriate procedures of error correction and privacy amplification.

Estimators
Alice and Bob randomly choose m signals whose encoding x and decoding y are publicly disclosed. This means that the parties compare m p := ν det m pairs of values {x i , y i } m p i=1 related by Eq. (48). These pairs are m for the homodyne protocol and 2m for the heterodyne protocol. Under the assumption of a collective Gaussian attack, they are Gaussian as well as independent and identically distributed (iid).
From the m p disclosed pairs, the parties construct an esti-matorT of T := √ τ as follows [57,58] T := which is Gaussianly distributed for sufficiently large m p . Equivalently, one may writê where C xy estimates the covariance C xy := xy = √ τσ 2 x . It is easy to check thatT is unbiased since we have For the variance, we may compute where we use that x i y i are iid (var = var), the fact that the noise has zero mean z =0 and, finally, that x 4 =3σ 4 x for a zero-mean Gaussian variable.
Note that Eq. (78) is in line with the derivation of Ref. [57], while Ref. [58] resorts to a further approximation that would lead to the removal of the term 2τ/m p in the expression above.
Here we follow the most conservative choice (approach of Ref. [57]) which implies a larger uncertainty for the value of the transmissivity.
For the variance of the thermal noise σ 2 z , Alice and Bob build an estimator: For large m p , the variable Y z := m p σ 2 z /σ 2 z follows a chi-square distribution χ 2 (m p ) with m p degrees of freedom (mean value m p and variance 2m p ), so we have Equivalently, they can build the estimator for the thermal numbern defined by with mean value n ≃n and variance Because the number of degrees of freedom is typically very large, the chi-square distribution χ 2 (m p ) can also be approximated by a Gaussian distribution with the same mean value and variance. As a result, the estimators σ 2 z and n can be considered to be asymptotically Gaussian.
It is important to observe that, from an experimental point of view, the variances in Eqs. (78), (79), (82), and (84) can be computed by using the estimatorsT and σ 2 z on the right-hand sides of the equations.

Worst-case estimators
From the estimators, Alice and Bob construct suitable worst-case estimators by assuming a certain number w of confidence intervals, for some acceptable error probability ε pe . For the square-root transmissivity, they build The probability ε pe that the actual value T is less than T ′ is given by where CND (x) = [1 + erf (x/ √ 2)]/2 is the cumulative of the standard normal distribution. Equivalently, for a given value of ε pe , one derives From Eq. (85), one can immediately construct the worstcase estimator for the transmissivity τ by taking the square τ ′ = (T ′ ) 2 so we obtain Equivalently, this is derived by writing τ ′ :=τ − wσ τ and then usingτ ≃ τ together with σ τ from Eq. (79). Because σ 2 z and n are asymptotically Gaussian, Alice and Bob can build corresponding worst-case estimators for which they connect the number w of confidence intervals with the error probability ε pe according to Eq. (87). In particular, they build the worst-case estimator for the thermal numbern ′ := n + wσn, where w is such that ε pe = prob(n >n ′ ). We easily computen As a result, up to an error probability ε pe = ε pe (w), Alice and Bob are able to bound the actual values of τ andn with the worst-case estimators in Eqs. (88) and (89). In the notation of Sec. III C, this means that we have τ ′ ≃ τ − f (τ,n) and Note that ε pe is here defined for each basic parameter to be estimated, so the total error associated with the two parameters τ andn is given by ε pe (1 − ε pe ) + (1 − ε pe )ε pe + ε 2 pe ≃ 2ε pe . Also note that, for the typical choice ε pe = 2 −33 ≃ 10 −10 ,we have w ≃ 6.34.

Tail bounds
When the value of ε pe is chosen to be very low ( 10 −17 ), the approach above creates divergences (w →∞). In this case, we must resort to suitable tail bounds. Let us start by analyzing the estimation of the thermal noise. For the central chi-square variable Y z ∼ χ 2 (m p ), we may write the following tail bound [59, Lemma 1]: for any x. Let us combine the latter with Eq. (83). With probability e −x , the estimator n satisfies or, equivalently, the actual valuen satisfies Let us set x = ln(1/ε pe ). Then, with probability ε pe ,we haven n + σn 2ln(1/ε pe ).

E. Finite-size composable key rate
So far, we have considered the effect of parameter estimation on the key rate, so that its expression takes the form R pe in Eq. (74), where the worst-case estimators τ ′ andn ′ are computed according to Eqs. (88) and (89) with a confidence parameter w as in Eq. (87)[orEq.(96) for smaller values of ε pe ]. Now we further develop the security analysis and derive a formula for the composable key rate of a coherent-state protocol that is valid under conditions of stability for the quantum channel (no fading). From this point of view, the results of this section provides the basic tool for the composable security analysis of a CV-QKD protocol that is implemented over a stable channel, as is typical in fiber-based implementations.
Assume that the parties exchange N signals over the quantum channel. Because m are publicly sacrificed for parameter estimation, there are remaining n = N − m signals to be used for key generation. Besides parameter estimation, any realistic QKD implementation needs to consider error correction and privacy amplification, which also come with their own imperfections. First, there is a probability of successful error correction p ec which is less than 1, so only an average of np ec signals are processed into a key. This means that final secret-key rate will be rescaled by the prefactor: Various imperfections arise in the finite-size scenario, which are summarized in the overall ε security of the protocol with additive contributions from parameter estimation, error correction and privacy amplification. Besides ε pe , the protocol has an associated ε correctness ε cor (which bounds the residual probability that the strings are different after passing error correction) and an associated ε-secrecy ε sec (which bounds the distance between the final key and an ideal output classicalquantum (CQ) state that is completely decoupled from the eavesdropper). More technically, one writes ε sec = ε s + ε h , where ε s is a smoothing parameter and ε h is a hashing parameter. All these parameters are set to be small (e.g., 2 −33 ≃ 10 −10 ) and provide the overall security parameter: Note that p ec explicitly multiplies ε pe due to the fact that error correction occurs after parameter estimation. Also note the factor of 2 before ε pe , which accounts for the estimation of two basic channel parameters. For a Gaussian-modulated coherent-state protocol [13,14] with success probability p ec and ε security against collective (Gaussian) attacks [54], we write the following composable key rate in terms of secret bits per use of the channel (see Appendix G for its proof): where R pe is given in Eq. (74) and with d representing the size of the effective alphabet after analog-to-digital conversion of sender's and receiver's CVs (quadrature encodings and outcomes). Note that one typically chooses a five-bit digitalization (d = 2 5 = 32), so that there is a negligible discrepancy between the information quantities computed over discretized and CVs. In ground-based QKD experiments, the total number of data points (signals/uses of the channel) can be of the order of 10 12 [62]. Thus, data points are split in blocks of suitable size for data processing, typically of the order of 10 6 − 10 7 points. The success probability p ec represents the frequency with which a block is successfully processed into key generation and this can also be written as p ec = 1 − FER, where FER is known as the frame error rate.

F. Key rate under general coherent attacks
TherateinEq.(105) is derived for collective attacks and, in particular, collective Gaussian attacks, since the Gaussian assumption is adopted for parameter estimation. This level of security can be extended to general coherent attacks under certain symmetries for the protocol, which are satisfied by the no-switching protocol based on the heterodyne detection [13]. In particular, by combining our rate in Eq. (105)withsomeof the tools from Ref. [63], we derive a simple formula for the composable finite-size key rate under general attacks.
Suppose that the coherent-state protocol P is ε-secure with finite-size rate R under collective Gaussian attacks, and P can be symmetrized with respect to a Fock-space representation of the group of unitary matrices. This symmetrization is equivalent to apply an identical random orthogonal matrix to the classical CVs of the two parties (encodings and outcomes) [63], which is certainly possible for the heterodyne-based protocol [13]. Let us denote byP the symmetrized protocol.
Then, let us assume that the remote parties perform an energy test T on m et randomly chosen pairs of modes. This test is based on two thresholds, d T for the transmitter, and d R for the receiver. For each pair, they measure the number of photons in their local modes and they average these quantities over their m et measurements, so as to compute the local mean number of photons. If these energies are below the thresholds, the test is passed (with probability p et ); otherwise the protocol aborts. Now assume that d T is larger than the mean number of thermal photonsn T = (μ − 1)/2 associated with the average thermal state generated by the transmitter. Working with implies that the test is almost certainly successful (p et ≃ 1) for sufficiently large values of m et .A l s o note that, for a lossy channel with reasonably small excess noise, the receiver will get an average number of photons which is clearly less than that of the transmitter, which means that a successful value for d R can be chosen to be equal to d T . (In our numerical investigations, we set d R = d T ≃n T .) By taking the local dimensions large enough we have p et ≃ 1 and the overall success of the protocol remains unchanged, i.e., we have p ec p et ≃ p ec . Then, the parties go ahead with the symmetrized protocolP which will now use n = N −m modes for key generation, wherem := m + m et . This already introduces a modification in Eq. (105), where the effective number n of modes for key generation will be reduced in the rate, so that the prefactor of Eq. (103) becomes By setting m et = f et n for some factor f et < 1, the total number of key generation signals takes the form The second modification consists of an additional step of privacy amplification which reduces the final number of secret key bits by the following amount [63]: where Accounting for the two modifications above, we have that the key rate R het of Eq. (105), specified for the heterodyne protocol [13], becomes the following: where R het pe is R pe of Eq. (74) for the heterodyne protocol. The rate established in Eq. (113)isvalidforasymmetrized coherent-state protocolP with heterodyne detection [13], which is now secure against general coherent attacks, with modified epsilon security equal to [63] ε ′ = K 4 n ε/50, and probability of success p ec ≃ p ec p et . Note that, because K n ≃ O(n), we need to start with a very small value for ε so that the final epsilon-security ε ′ remains well below 1 and the term n in Eq. (113) does not explode. In particular, this means that ε pe needs to be very small (e.g., ≃ 10 −43 ) and the corresponding confidence parameter w must be computed from Eq. (96).

A. Preliminary considerations
Here we extend the previous theory (Sec. III) to account for the channel fluctuations that generally affect free-space quantum communications. We consider free-space fading where the transmissivity τ is not stable but varies over a time scale of the order of 100 ms or similar. Because of this issue, the first important physical condition is that the setups need to have system clocks and detectors that are suitably fast to collect enough statistics while the value of τ fluctuates.
In a general fading process, the instantaneous transmissivity τ between transmitter and receiver follows a probability distribution P 0 (τ ), which takes the specific expression in Eq. (25) when the physical aspects of the free-space communication are taken into account. The probability that τ falls in a small interval [τ, τ + δτ] is given by p δ = p(τ, τ + δτ ), where we define This means that only a small fraction p δ m of the signals can be used for estimating this value of τ . (From now on, when we write a postselected quantity like p δ m, we implicitly mean an integer approximation of it.) As we can see from Eq. (79), the error variance σ 2 τ in the estimation of τ scales as O(m −1 ). Here this becomes O[(p δ m) −1 ], with the problem of leading to insufficient statistics. We can overcome this issue by introducing energetic pilot pulses specifically dedicated to track the instantaneous transmissivity of the channel so that we can create suitable bins for collecting signals with almost equal transmissivity. These bins are then subject to a suitable postprocessing that we call defading.
Another preliminary consideration is about noise filtering. As already mentioned in Sec. II E 1, one can effectively narrow the frequency filter of the receiver to match the bandwidth of the LO, thanks to the interferometric process occurring in the homodyne/heterodyne setup. Thus, instead of being limited to a physical filter of 1 nm around 800 nm at the receiver's aperture, the detector imposes a much narrower filter of 0.1 pm, by interfering the signal with the 10-ns-long and 50-GHz-wide pulse of the LO, close to the time-bandwidth product. Such a process is secure as long as the projection of the homodyne detectors does not create correlations with the frequencies outside the bandwidth of the LO, since these extra frequencies could be used as Trojan-horse modes. In realistic implementations, such cross talk is/can be made negligible. As a result, thanks to the use of the LO (as TLO or LLO), the parties are able to suppress the external background noise (down ton B ≃ 10 −7 in daylight conditions with typical parameters). For this reason, one can make the numerical approximationn B ≪ 1,n ≃n ex . (116)

B. Loss tracking via random pilots
For free-space parameter estimation, the parties sacrifice not only m signal pulses (as before in Sec. III) but also additional m P energetic pilot pulses. The m P pilots are specifically used for the quasiperfect estimation of the (generally variable) transmissivity τ , so as to track its instantaneous value. In this way, the parties can create a lattice of suitably narrow bins of transmissivity for signal classification (discussed in the next subsection).
The pilots are prepared in exactly the same coherent state |n 1/2 P e iπ/4 and randomly transmitted during the quantum communication. In a TLO setup, both signals and pilots are multiplexed with their LOs. As previously discussed, the LO can be very bright, with mean number of photonsn LO of the order 10 7 at the receiver even after 20 dB of loss (this is for 10-ns-long pulses from a 100-mW laser at λ = 800 nm). This means that relatively-energetic pilots can be generated with just a 10 −4 fraction of the LO energy (so thatn P ≃ 10 3 photons are collected by the receiver). In this way, the pilots are bright enough to provide an excellent estimate of τ , while the LO remains so much brighter that the measurements of the pilots will still be shot-noise limited. In an LLO setup, the reference pulses for the local LO reconstruction are transmitted at the odd uses of the channel, while the pilots are randomly interleaved with the signals at the even uses of the channel.
In a small fading interval δτ,w eh a v ep δ m P pilots to be used for the estimation of τ . From these pilots, the parties derive p δ m P ν det pairs {x i , y i } of sampling variables x i = √ 2n P and y i = √ τ x i + z i . They then build the estimator with mean √ τ and variance σ 2 z /(2n P p δ m P ν det ). The latter variance goes to zero for suitably largen P , so the parties achieve a practically perfect estimate of τ already for m P ≃ O (1). In other words, we may considerT P = √ τ , meaning that the parties can perform real-time tracking of the transmissivity τ with negligible error.

C. Postselection interval and lattice allocation
While monitoring the transmissivity τ with the pilots, the parties only keep the data points exchanged within an agreed postselection interval := [τ min ,τ max ], with associated probability p = p(τ min ,τ max ) as computed from Eq. (115). Thus, from a total of N exchanged pulses, only a portion S := (N − m P )p of signals is selected for further processing. The interval is chosen so that S ≫ 1, leading to sufficient statistics for parameter estimation. The parties may choose τ max = η := η st η atm η eff , which is the maximum value achievable by a perfectly aligned beam, and then take τ min = f th η for a threshold value f th ∈ (0, 1).
Within the postselection interval , Alice and Bob introduce a regular lattice with step δτ so that there are a number of transmissivity slots/bins k := [τ k ,τ k+1 ] with τ k := τ min + (k − 1)δτ,f o rk = 1,...,M and M = (τ max − τ min )/δτ .I n this coarse graining of the transmissivity, each slot k is populated with probability p k = p(τ k ,τ k+1 ) according to the fading distribution in Eq. (115). This means that slot k has S k := (N − m P )p k signals to be used for parameter estimation and key generation. For a sufficiently narrow slot, these signals provide ν det S k pairs of points {x i , y i } that satisfy the input-output relation where z k = z(τ k ) is a noise variable [cf. Eq. (48)] with variance A potential strategy consists of processing each slot k independently from the others, by performing parameter estimation over a corresponding set of sacrificed signals, and then going through the next steps of data processing. This approach is based on the fact that we can consider the transmissivity τ k and the noise-variance σ 2 z (τ k ) to be approximately constant for all data points in the same slot (so there is a well-defined thermal-loss channel associated with it). In turn, this means that we can directly apply the procedures of Sec. III valid for a stable quantum channel. As a result, each slot k will provide aslotrateR k with corresponding epsilon security ε k . The total finite-size key rate of the link is the average of R k over the slots, i.e.,R with total security ε = M k=1 p k ε k . Because this solution may suffer from insufficient statistics in the various slots, we adopt the procedure of the following subsection.

D. Defading
The parties can process their data to eliminate the fading and create an overall stable channel at the cost of using the minimum transmissivity within the post-selection interval. This procedure of defading is one of the possible strategies and is used to provide an achievable lower bound for the secret key rate.
In this procedure, Bob maps all his ν det S k data points y k from the generic k th slot k to the first slot 1 in the post-selection interval, by using the following downlift transformation where z ′k is a Gaussian noise variable with variance var(z ′k ) = σ 2 z (τ k )τ min /τ k . See also Fig. 5. While Eq. (121) is certainly a valid postprocessing of data, it is not guaranteed that the entire input-output transformation x → y ′k can be made equivalent to the action of a quantum channel (which is a useful condition for our theoretical treatment). This is due to the noise reduction induced by the rescaling τ min /τ k 1, which means that var(z ′k ) might become <ν det , violating the minimum noise associated with the final quantum measurement.
This problem is solved if Bob applies a classical Gaussian channel y ′k → y ′′k := y ′k + ξ k add with additive noise var(ξ k add ) = (1 − τ min /τ k )ν det . In this way, Bob generates where z ′′k is a Gaussian variable with variance We see that the transformation y k → y ′′k is a slotdependent beam-splitter channel C k performed over the data, with transmissivity ι k := τ min /τ k and environmental noise variance equal to ν det . Equivalently, this can be represented by a virtual beam splitter directly applied to the pulses allocated to slot k followed by the measurement. In other words, Alice and Bob's input-output relation x → y ′′k is equivalent to the action of a composite Gaussian channel F k := C k • E k , where E k is a thermal-loss channel with transmissivity τ k and thermal numbern(τ k ), followed by Bob's measurement.
Assuming that the transformation y k → y ′′k is performed for all the M slots of the interval, Bob creates a new variable y ′′ which satisfies where z ′′ is non-Gaussian. Since x → y → y ′′ is a Markov chain, Bob's postprocessing can only decrease the mutual information I (x : y ′′ ) I (x : y). The noise variable z ′′ can be written as an ensemble {π k , z ′′k }, with the independent element z ′′k being selected with probability π k = p k /p .Thus,it has zero mean and variance: Overall, the transformation of Eq. (124) is equivalently obtained by measuring the output of a non-Gaussian channel F, which is described by the ensemble {π k , F k } and assumed to be completely controlled by Eve. Due to the optimality of collective Gaussian attacks for Gaussian-modulated coherent-state protocols, the parties may assume the worst-case scenario where the non-Gaussian channel F is replaced by a thermal-loss Gaussian channel E τ min ,n G with the same transmissivity τ min and thermal number, so that it has noise variance σ 2 G = 2n G + ν det equal to σ 2 z ′′ of Eq. (125). This means that the noise variable z ′′ in Eq. (124) can be replaced by a Gaussian variable z G , and the total inputoutput relation is assumed to be Thus, we lower bound Alice and Bob's performance by considering the postprocessed variables {x, y ′′ } connected by the input-output relation of Eq. (127), after defading and assuming a Gaussian attack (Gaussianification). This leads to the asymptotic key rate, which can be computed from Eq. (73). The explicit expressions for the mutual information I and the Holevo bound χ are given in Secs. III A and III C for the homodyne (R hom asy ) and heterodyne protocols (R het asy ) [64]. Because we have reduced the fading process to a stable thermal-loss channel E τ min ,n G , we can exploit the methodology of Sec. III. In particular, we can apply the tools of Sec. III D to compute the estimators and worst-case estimators for τ min andn G , to be employed in the key rate.

E. Estimating the channel parameters
In the parameter estimation step, Alice and Bob sacrifice some of their signals to estimate the actual values of the minimum transmissivity τ min = T 2 min and the Gaussian noise σ 2 G (orn G ) up to an acceptable error probability. Note that, in general, the actual value of τ min might be different from what determined via the pilots, which means that its estimation via the signals is needed. In fact, Eve might try to use a QND measurement to distinguish between pilots and signals. After such QND measurement (with loss τ k ), Eve may apply an additional measurement (with lossτ ) only to the signals. This means that, after defading, the input-output relation of Eq. (127) would becomeỹ ′′ = √τ min x +z G , with lower transmissivityτ min :=ττ min and generally higher noisẽ z G .
Because parameter estimation is performed over a subset of the signals, the parties will detect these discrepancies with respect to the pilots. Most importantly, they will derive the corresponding estimators for the lower transmissivityτ min and the different noise levels to be used in the calculation of their secret key. Of course, Eve might be more disruptive over the signals so their transmissivity might be sensibly different from that of the corresponding pilots, but the point is that any such a perturbation will be anyway detected and estimated by the parties. If the discrepancy between pilots and signals is too strong, the noise level detected by the parties becomes too high for secure communication (denial of service). In the following, we make the realistic assumption that Eve acts universally over pilots and signals, soτ min = τ min . However, we point out that this is only a simplification, not a limitation of the approach whose application toτ min = τ min is immediate.
To create their estimators, the parties sacrifice mp signals from those they have postselected. This corresponds to m := ν det mp pairs of data points {x, y ′′ }, and we can also write m = M k=1 m k , where m k := ν det mp k is the contribution coming from the generic slot k . In writing mp ,w e implicitly assume that m is the equivalent number of signals that would have been sacrificed by the parties in the absence of postselection. This notation is theoretically useful to describe scenarios where the same protocol (with fixed m)i si m p l emented over different distances over which the value of p can be optimized.
For the square-root transmissivity, Alice and Bob build the estimator: It is easy to check that this is unbiased (i.e., its mean is ≃ T min ) and its variance is given by Let us build an estimator for the variance σ 2 G of the thermal noise z G . This is given by where Y k is distributed according to a χ 2 distribution with m k degrees of freedom. It is easy to check that the estimator is unbiased, i.e., we have Then, for the variance, we compute Equivalently, in terms of number of thermal photonsn G := (σ 2 G − ν det )/2, we write the estimator which is unbiased n G ≃n G with var( n G ) = var( σ 2 G )/4. It is important to note that all the mean values and variances above are computable by the parties by replacing estimators on the right-hand sides of the formulas. In fact, onceT min and σ 2 G have been computed, these can be replaced in Eq. (135) to provide var(T min ). To compute var( σ 2 G ), the parties need to derive estimators of σ 2 k , i.e., whose squares go in Eq. (140).

F. Worst-case estimators and bounds
According to Eq. (127), Alice and Bob's postprocessed data is generated by a thermal-loss channel E τ min ,n G with transmissivity τ min and thermal numbern G . For the transmissivity and the thermal number, we write the worst-case estimators n ′ G := n G + w var( n G ), where the confidence parameter w is connected to the error ε pe according to Eqs. (87)or(96). For the sake of the theoretical analysis, it is useful to introduce bounds for τ ′ min andn ′ G . Consider the worst-case noise variance σ 2 wc = 2n wc + ν det such that σ 2 wc σ 2 k for any slot k. Then, we may write var(T min ) 2τ min + σ 2 wc /σ 2 n G n wc , var( n G ) (2n wc + ν det ) 2 2m . (146) As a result, we have the bounds Let us now evaluate the worst-case thermal numbern wc to be used in the bounds above. We writē wheren ex,wc :=n ex (τ wc ) n ex (τ ) is computed over the worst-case value τ wc . The latter may be chosen to be τ wc = τ min for the TLO and τ wc = τ max for the LLO (due to the fact thatn ex (τ ) has different monotonicity in τ , as discussed in Sec. III B 3). In other words, forn ex,wc , we may consider the two estimatesn TLO ex,wc ≃ el /τ min , where el is the electronic noise term in Eq. (61). In our numerical investigations, we assume the bounds τ LB andn UB in Eqs. (147) and (148), which take different expressions for TLO and LLO depending on Eqs. (150) and (151). Since each of these worst-case estimators is correct up to an error ε pe , the total error affecting the procedure of parameter estimation is ≃ 2ε pe .

G. Composable key rate for free-space CV-QKD
Let us summarize the scenario. Alice and Bob perform a Gaussian-modulated coherent-state (homodyne or heterodyne) protocol with variance σ 2 x = μ − 1 over a free-space channel with instantaneous transmissivity η ch and background thermal noisen B . The receiver has setup efficiency η eff and setup noisen ex , so the total thermal noise isn = η effnB +n ex . The overall instantaneous transmissivity from Alice to Bob is given by τ = η ch η eff and it fluctuates following a fading distribution P 0 (τ )a si nE q . ( 25). Becausen ex =n ex (τ )( s e e Sec. III B 3), we also have thermal-noise fluctuationsn = n(τ ). The physical scenario is depicted in Fig. 1, and also modelled in Fig. 4 for each fixed value of the transmissivity.
Alice sends to Bob a total of N pulses which are multiplexed with an LO in polarization (TLO) or in time (LLO). Note that in terms of throughput (bits/sec), given by the rate (bits/use) times the clock C (uses/sec), one should account for the additional uses of the link associated with the LO. Thus, there is a factor of 1/2 for the LLO, unless this is compensated by using two polarizations for the quantum signals (see Sec. III B 1).
Within the total set of N pulses, there are m P pilots that are prepared in a bright coherent state and are randomly interleaved with the N − m P signal pulses. Thanks to these pilots, the parties monitor the instantaneous transmissivity τ and they create a postselection interval := [τ min ,τ max ], where τ max = η := η st η atm η eff is the maximum value achievable and τ min = f th η for some threshold value f th ∈ (0, 1). The interval postselects a portion S = (N − m P )p of the signals, where the probability p = p(τ min ,τ max )i sg i v e ni n Eq. (115). Then, the interval is further divided into a lattice of M slots with small step δτ, in such a way that each slot k := [τ k ,τ k+1 ] collects signals with almost-equal transmissivity τ ≃ τ k := τ min + (k − 1)δτ.
The postselected S signals provide ν det S pairs of data points {x i , y i } where x is Alice's generic quadrature encoding and y is Bob's corresponding decoding. The outcomes {y i } are all mapped into the first slot 1 with minimum transmissivity τ min , by means of the de-fading channel y → y ′′ described in Sec. IV D. As a result, Alice and Bob's data points satisfy the input-output relation y ′′ = √ τ min x + z G of Eq. (127), which is equivalent to a thermal-loss channel E τ min ,n G with transmissivity τ min and thermal numbern G , so that σ 2 G = 2n G + ν det . Alice and Bob sacrifice mp signals to derive worst-case estimators τ ′ min andn ′ G according to Eqs. (143) and (144), where the confidence parameter w is determined by the error ε pe according to Eqs. (87)o r( 96). These estimators are used to compute the asymptotic key rate affected by parameter estimation where R asy is given in Eq. (128). For the theoretical analysis, we consider the further lower bound R pe R LB := R asy (τ LB ,n UB ), which is based on τ LB andn UB from Eqs. (147) and (148). The signals remaining for key generation are np , where n = N − (m + m P ). Thus, after parameter estimation, the parties process their np ν det key generation points {x i , y ′′ i } via the procedures of error correction and privacy amplification. Depending on the reconciliation parameter β (related to the rate of the error-correcting code) and the correctness ε cor (related to the probability of residual errors in Alice's and Bob's corrected strings), the step of error correction has an associated success probability p ec to promote the block of points to the next step of privacy amplification. The latter procedure is ideal (i.e., decouples Eve) up to an error quantified by the secrecy parameter ε sec = ε s + ε h , in turn decomposed into a smoothing (ε s ) and a hashing parameter (ε h ). After privacy amplification, an average number of np p ec signals contribute to the final key, leading to an overall factor np p ec /N in front of the rate.
The composable finite-size key rate associated with the post-selection interval is bounded by where the two terms aep and are given in Eqs. (106) and (107) for some value log 2 d of digitalization. This rate is ε secure against collective Gaussian attacks, where ε = 2p ec ε pe + ε cor + ε sec . The expression of the key rate in Eq. (154) can be specified for the homodyne/heterodyne protocol and for the two types of LO (TLO/LLO).
For the heterodyne protocol, we can extend the key rate to composable finite-size security against general coherent attacks (see Sec. III F). This is done by adopting a suitable symmetrization and including energy tests, both operations to be performed on the data points {x i , y ′′ i }. The number of energy tests is set to be p m et , where m et = f et n for some factor f et < 1. Thus, the final key generation signals will be np p ec with The composable key rate is bounded as follows: where the extra term n is defined as in Eq. (110) and is expressed in terms of K n of Eq. (111), for which we choose the dimensions d R = d T ≃n T = σ 2 x /2 (in such a way that the energy test succeeds with probability p et ≃ 1).
Note that the key rate R het gen is secure up to an epsilon security ε ′ = K 4 np ε/50. This means that, to get ε ′ ≃ 10 −10 against general attacks, we need to start from a security of ε ≃ 10 −43 against collective Gaussian attacks. In turn, this also implies ε pe ≃ 10 −43 , meaning that we need to use Eq. (96)f o rt h e worst-case estimators.

H. Numerical simulations
In our numerical investigations, we consider the heterodyne protocol for which we study the free-space composable key rate under collective and coherent attacks, assuming the two types of LO. The free-space model is the same as in Sec. II and depicted in Fig. 1. We consider the z propagation of a collimated Gaussian beam which is subject to diffraction, atmospheric extinction η atm [as quantified by the Beer-Lambert equation of Eq. (5)], pointing error σ 2 P ≃ (10 −6 z) 2 (for an e r r o ro f1 μrad at the transmitter), and Rytov-Yura weak turbulence (σ 2 Rytov < 1) under the H-V model of atmosphere (see Appendix C). Turbulence leads to beam broadening, with short-term transmissivity η st , and centroid wandering, with variance σ 2 TB . Including the setup efficiency η eff ,w eh a v e a maximum transmissivity η := η st η atm η eff when the beam is perfectly aligned. The overall wandering, with variance σ 2 = σ 2 P + σ 2 TB , leads to the distribution P 0 (τ )o fE q .( 25) for the instantaneous transmissivity τ of the link. Thermal background follows the description of Sec. II D for cloudy daytime conditions (but suppressed by the homodyne filter). In particular, we assume the physical parameters listed in Table I.
The steps of the protocol are those explained in the previous subsection, where Alice and Bob assume a postselection interval := [τ min ,τ max ] with τ max = η and τ min = f th η for some threshold value f th ∈ (0, 1). In particular, we choose the parameters listed in Table II. As we can see from Fig. 6(a), the composable key rates against collective attacks are sufficiently high, even though these values actually represent lower bounds to what achievable by Alice and Bob. As a matter of fact, in most of the weak-turbulence range, these rates are within one order of magnitude of the ultimate loss-based upper bound of Eq. (27)  which is plotted as red dashed line in Fig. 2(a), computed for daytime and the same physical parameters considered here. In Fig. 6(a), we study the rates that are achievable with the TLO and the LLO. In one setting (solid curves), we fix the value of the threshold parameter for postselection f th to 84% and we also fix the value of the input Gaussian modulation (μ = 20 for TLO and μ = 8.4 for LLO). These values are chosen to maximize the rates at the maximum distance z = 1066 m but they are not the optimal choices for the other distances. In another approach, we maximize the rates over f th and μ at each distance, finding substantially improved performances (dashed lines). In Fig. 6(b), we plot the composable key rates achievable against general attacks assuming no optimization in f th and μ. On the one hand, these rates are not far from the corresponding results against collective attacks. On the other hand, the choice of parameters in Table II may be far more challenging for this general case (e.g., in terms of β and p ec for such a low value of ε cor ). Also note that the final epsilon security FIG. 6. Composable secret-key rates (bits/use) versus distance (m) for free-space QKD in the regime of weak turbulence and for cloudy daytime operation. We consider a coherent-state protocol with heterodyne detection, pilot-guided and operated in postselection as described in the main text. Physical and protocol parameters are listed in Tables I and II. (a) We plot the secret key rate of Eq. (154) assuming a TLO (black curves) and an LLO (blue curves). In particular, we plot the performances at fixed postselection threshold f th = 0.84 and fixed input modulation, μ = 20 for TLO and μ = 8.4 for LLO (solid curves). These are chosen to optimize the rates at the maximum distance (z = 1066 m). We compare these performances with those achievable by optimizing the rates over μ and f th at each distance (dashed curves). (b) We plot the rate of Eq. (156) against general attacks for TLO (black line) and LLO (blue line). These performances are not optimized and refer to fixed threshold f th = 0.84 and input modulation (μ = 20 for TLO and μ = 8.4f o r LLO). ε ′ depends on the distance. For the parameters chosen, this ranges from ≃ 1.38 × 10 −11 for the LLO at z = 1066 m and ≃ 1.32 × 10 −9 for the TLO at z = 200 m.
A final important observation (already mentioned before but here relevant to stress) is that the rates shown in Fig. 6 refer to bits per use of the quantum communication channel, without accounting for the transmission of the LO reference pulses. If we include the clock of the system (uses/second) and compute the throughput of the communication (bits/second), then we need to include the uses of the link dedicated to the LO. Thus, for the LLO, we should halve the final rate (with respect to the TLO) due to the time multiplexing of the LO. However, it is also true that, with the LLO, one could use both polarizations in the transmission of the signals, so the factor of 1/2 in the final rate can be fully compensated.

V. CONCLUSIONS
In conclusion, we have established the ultimate bounds for free-space quantum communications under general conditions of diffraction, atmospheric extinction, pointing errors, turbulence, and background thermal noise. We first developed the theory for the regime of weak turbulence, crucial for free space ground-communications in a relatively short range, and then extended the results to the case of stronger turbulence. In the short range, we have then derived achievable and composable key rates for free-space CV-QKD, proving that these rates are sufficiently close to the ultimate limits. This shows the robustness and suitability of free-space channels for implementing high-rate quantum-secured communications.
The achievable rates are derived by first formulating a general theory of composable finite-size security for Gaussian-modulated coherent-state protocols under conditions of channel stability, then extending this theory to considering fading (non Gaussian) channels, which can be dealt via the introduction of pilot modes and suitable postprocessing techniques. In this way, we have been able to handle the difficult step of parameter estimation and to reduce the problem to the easier framework of a stable Gaussian channel. Fully assessing the practical security of CV-QKD in strong turbulent channels is an interesting future direction of investigation.
In conclusion, our paper not only established the ultimate limits and benchmarks for free-space quantum communications but also provided a comprehensive machinery for studying the composable finite-size security of CV-QKD protocols both in stable conditions (e.g., in standard fiber-based connections) and unstable conditions (i.e., in free-space links subject to fading effects).

ACKNOWLEDGMENT
The author acknowledges funding from the European Union's Horizon 2020 research and innovation program under Grant Agreement No. 820466 (Quantum-Flagship Project CiViQ: Continuous Variable Quantum Communications).
Any realistic transmitter involves an aperture with finite radius a T . This means that the Gaussian profile of the beam could be truncated outside that radius causing diffraction. However, if the aperture a T is sufficiently larger than w 0 , diffraction becomes negligible.
Assume that the transmitter has a plane exit pupil A 0 of area A 0 while the receiver has an entrance pupil A z of area A z . We consider the quasimonochromatic approximation where the transmitter excites planar modes within a narrow band of frequencies, centered around the carrier (angular) frequency ω, and the receiver only detects planar modes within this bandwidth. We then consider the usual scalar approximation (i.e., a single and uniform polarization) and the paraxial wave approximation (so that the transverse components of the wave vector are negligible at the receiver).
Let us write x := (x, y) ∈ A 0 to be the transverse coordinates at the transmitter and x ′ := (x ′ , y ′ ) ∈ A z those at the receiver. The electric field at the transmitter can then be expressed as [65] where k (x) l (t ) are orthonormal spatiotemporal modes defined over A 0 and 0 t t max , with t max being the time duration of the transmitter's signal. These modes have corresponding annihilation operatorsâ k,l . Thanks to this normal-mode decomposition, one can express the electric field at the receiver, which is given by [65] for modes defined over A z and 0 t − c −1 z t max . Above, e k,l are the annihilation operators associated with environmental modes impinging on the pupil of the receiver, which are generally described by thermal states. Free-space diffraction-limited quantum communication can therefore be completed described by the input-output relationsâ which correspond to a collection of thermal-loss channels (beam-splitter transformations with thermal environment). It is important to note that which is equal the Fresnel number product n f of the two pupils [65,Eq. (37)]. In the far-field regime (n f ≪ 1), only one mode is effectively transmitted from transmitter to receiver, with transmissivity η far ≃ n f .
For circular apertures A 0 = π a 2 T and A z = π a 2 R , we therefore have From Eq. (A26), we see that we obtain the far-field collimated-beam transmissivity in Eq. (A20) by setting a T = √ 2w 0 ≃ 1.41w 0 . In other words, by choosing such a value for the transmitter's aperture, we may neglect its far-field contribution to diffraction from the point of view of the transmissivity (otherwise a T = w 0 would cause a 3dB loss). That being said, the choice a T = √ 2w 0 may still be too generous because the profile of the Gaussian beam could be affected in the far field by non-negligible intensity ripples and peak intensity reductions.
To preserve the Gaussian profile with excellent approximation, a more conservative choice is a T 2w 0 , e.g., a T ≃ 2.3w 0 [5,Sec. 17.1]. Let us write Eq. (A16)a tz = 0f o rt h e transmitter's aperture a T . Then, we see that the total power passing through the transmitter is given by P 0 (1 − e −2a 2 T /w 2 0 ). If we choose a T 2w 0 , then 99.97% of P 0 is transmitted. This estimate provides an idea of the extremely small perturbation that such a large aperture (a T 2w 0 ) causes to the Gaussian beam.

APPENDIX B: DIFFRACTION-LIMITED FREE-SPACE BOUNDS
Quantum mechanically, the propagation of the Gaussian beam from transmitter to receiver can be represented by a single mode whose annihilation operatorâ at the transmitter undergoes the following input-output Bogoliubov transformation:â whereb is the annihilation operator of the signal mode at the receiver andê is the annihilation operator of an environmental mode impinging on the receiver and coupling with the output signal mode. Modeê is generally described by a thermal state whose mean number of photonsn e depends on various factors. Its typical values largely vary between nighttime and daytime operations, weather conditions, etc. The basic process described in Eq. (B1) is also known as single-mode thermal-loss channel [3], here denoted by En e η d . (Note that, in the main text and other parts of these Appendices, we use the different notation E η d ,n to indicate a thermal-loss channel with transmissivity η d andn e =n/(1 − η d ), implying thatn thermal photons are added to its output).
To give a universal upper bound which is valid in every condition, we neglect thermal noise, so that Eq. (B1) describes a pure-loss channel E η d :â → √ η dâ + √ 1 − η dv , where the environmental modev is associated with a vacuum state. Thermal noise can be neglected from an informationtheoretical point of view, because an upper bound on a pure-loss channel would automatically be an upper bound on a thermal-loss channel. In fact, a thermal-loss channel En e η d as in Eq. (B1) is equivalent to a composition of a pure-loss channel E η d followed by an additive-noise Gaussian channel where the variable ξ is taken with noise variance ξ 2 =n e , so that Because we have En e η d = A ξ η d • E η d , we may apply data processing for any functional that is decreasing under completely positive trace-preserving (CPTP) maps. This is a property which can be exploited for the REE.
Given two states ρ and σ , their relative entropy is defined by S(ρ||σ ):= Tr[ρ(log 2 ρ − log 2 σ )]. Then, the REE of a bipartite state ρ AB is defined by where SEP is the set of separable states. Now we observe that the relative entropy is monotonic under the same CPTP map N applied to both its arguments, i.e., S[N (ρ)||N (σ )] S(ρ||σ ). This allows one to show that, for any bipartite state ρ AB , we may also write In fact, it is quite easy to check that where (1) exploits the fact that I ⊗ N (σ AB ) represent a subset of all possible separable states, and (2) exploits the monotonicity of the relative entropy under the CPTP map I ⊗ N . The ultimate rates at which two remote parties can generate a key (secret key capacity K), or distribute entanglement (two-way assisted entanglement distribution capacity E ,also denoted by D 2 ), or teleport/transfer quantum states (two-way assisted quantum capacity Q 2 ) at the two ends of a bosonic single-mode Gaussian channel G are all limited by the following REE bound [17]: where μ AB is a TMSV state with variance μ, i.e., (μ − 1)/2 mean number of photons in each mode.
For any composition of Gaussian channels, we can combine Eq. (B6) with the data processing inequality in Eq. (B4). In particular, for the secret key capacity of a thermal-loss channel En e η d , we may write where is the PLOB bound [17]. For η d ≃ 0, we have the approximation (η d ) ≃ η d / ln 2 = 1.44η d (bits per channel use). (B9) Consider now free-space line-of-sight quantum communication at wavelength λ, between a transmitter, generating a Gaussian beam with spot size w 0 and curvature radius R 0 , and a remote receiver, with aperture radius a R at slant distance z. The corresponding expression for the diffraction-induced transmissivity η d is explicitly given in Eq. (A18). By replacing it in the PLOB bound (η d ), we see that the maximum rate for QKD and, therefore, any other form of quantum communication, is bounded by where w z is the spot-size function of Eq. (A9). More explicitly, we may write From Eq. (B11), we see that the bound is maximized by a focused beam (z = R 0 ). In such a case, we derive where f 0R is the Fresnel number product associated to the beam and the receiver, as in Eq. (A21). Instead, for a collimated beam (R 0 =+∞), the upper bound simplifies to the following expression: ≃ U foc (z), in the far field. (B14)

APPENDIX C: ATMOSPHERIC TURBULENCE
A crucial parameter in the study of atmospheric turbulence is the refraction index structure constant C 2 n [10,11]. This measures the strength of the fluctuations in the refraction index, due to spatial variations of temperature and pressure. There are several models which provide C 2 n with a functional expression in terms of the altitude h in meters above sea level. The most known is the H-V model [27,28], where v is the wind speed (m/s) and A ≃ C 2 n (0). Assuming high-altitude low-wind v = 21 m/s and the ground-level nighttime value A = 1.7 × 10 −14 m −2/3 , one has the H-V 5 [20]. In our paper, we assume v = 21 m/s, the day value A ≃ 2.75 × 10 −14 m −2/3 , and an altitude of h = 30 m, so C 2 n ≃ 2.06 × 10 −14 m −2/3 . The structure constant is at the basis of other important parameters such as the scintillation index [10] and the Rytov variance [66], which is given by The condition σ 2 Rytov < 1 corresponds to the regime of weak turbulence, where scintillation (i.e., random fluctuations of the intensity) can be considered to be negligible, and the mean intensity of the beam can still be approximated by a Gaussian spatial profile. An alternative condition was considered by Yura [29] and Fante [25] in terms of the spherical-wave coherence length ρ 0 , which is closely related to the Fried's parameter [67,68]. For a fixed (or mean) value of the structure constant C 2 n , this length is expressed by Then, weak turbulence corresponds to the condition We note that, in our numerical investigations, Eq. (C2) turns out to be more stringent than the condition in Eq. (C4). In fact, for the regime of daytime parameters considered in Fig. 2 of themaintext,σ 2 Rytov < 1 leads to z 1066 m, while Eq. (C4) implies z 1657 m.
In the regime of weak turbulence, we may distinguish the actions of small and large turbulent eddies: Those smaller than the beam waist act on a fast timescale and broaden the waist; those larger than the beam waist act on a slow timescale (10 − 100 ms) and randomly deflect the beam [25]. The overall action can be decomposed in the sum of two contributions, the broadening of the diffraction-limited beam waist w z into the short-term spot size w st , and the random wandering of the beam centroid with variance σ 2 TB . Averaging over all the dynamics, one has the long-term spot size [25,Eq. (32)]: If we assume the validity of Yura's condition [25,29], then we can write decomposition in Eq. (C5) where the longand short-term spot sizes take the following forms [25,29](see also Refs. [69][70][71][72]): and we may also expand As a result, for the variance of centroid wandering, we derive the following expression [29]: Note that, while the expression in Eq. (C7) of the long-term spot size w 2 lt is valid under general conditions [25,Eq. (37)], Yura's short-term expressions in Eqs. (C8) and (C10)a r e rigorous in the limit φ ≪ 1. These short-term expressions can also be considered good approximations for ρ 0 /w 0 < 1, i.e., for φ<0. 33. In the regime of daytime parameters considered for Fig. 2 of the main text, we have that φ<0.33 implies a minimum distance z 200 m. (In other words, our numerical investigation in that figure meets the sweet spot provided by the range 200 z 1066, where turbulence is weak and Yura's analytical expansions are approximately correct.) When φ passes its threshold (i.e., ρ 0 /w 0 1), the expansions in Eqs. (C8) and (C10) become imprecise and the correct value of w 2 st needs to be numerically derived from the 1/e point of the spherical-wave short-term mutual coherence function (see Ref. [29]). Alternatively, one can exploit Eqs. 41(a), (41b), and Fig. 3 (37)], changing their notation from intensity spot size (w I ) to field spot size (w = √ 2w I ). In Ref. [25], instead of (1 − φ) 2 , we find Despite being slightly different, its expansion for ρ 0 /w 0 ≪ 1 is the same as in Eq. (C9). As a result, the centroid wandering is characterized by the same variance σ 2 TB as in Eq. (C10), which is equivalent to Eq. (40) of Ref. [25]. Also note that Yura's expressions take different forms in terms of the Fried's parameter ρ F = 2.088ρ 0 [73]. In fact, one may also write [71,72]

APPENDIX D: RANDOM WALK OF THE BEAM CENTROID
Consider a random walk of the beam centroid x C around an average point x P at distance d from the center of the receiver x R , following a Gaussian distribution with variance σ 2 . The distribution for the instantaneous deflection distance r = x C − x R 0 will be Rician with parameters d and σ , i.e., which is the inverse of Eq. (23) of the main text, one can easily compute the probability distribution for the deflected transmissivity: Explicitly, this takes the following form: and zero otherwise. The latter equation can also be derived by combining Ref. [31,Eq. (8)], there written for the transmittance coefficient √ τ , with the probability density of the squared variable . Also note that the distribution in Eq. (D4) can be bounded exploiting the inequality I 0 (x) cosh(x) exp(x)validforanyx 0. For x = 0, the equality holds, while for x > 0 the upper bound comes from the fact that we may write I n (x) < x n 2 n n! cosh(x)forn = 0, 1, ... which can be easily proven starting from Ref. [74,Eq. (6.25)]. After simple algebra, we therefore find Assuming zero mean deflection (d = 0), Eq. (D4) simplifies to P 0 (τ )i nE q . ( 25) of the main text. The probability distribution P 0 (τ ) describes the statistics of the fading channel by providing the instantaneous value of the deflected transmissivity τ for the case where the average position of the beam centroid is aligned with the center of the receiver's aperture.

APPENDIX E: ACHIEVABILITY OF THE LOSS-BASED BOUNDS
As long as the instantaneous (short-term) quantum channels can be approximated to pure-loss channels E τ , the upper bound in Eq. (27) of the main text is an achievable rate for secret key generation and entanglement distribution. In fact, the PLOB upper bound (τ ) =−log 2 (1 − τ ) of each E τ is achievable, i.e., there are optimal protocols whose rates saturate this ultimate limit for all the relevant capacities, so we have Q 2 (E τ ) = D 2 (E τ ) = K (E τ ) = (τ ). In fact, a pure-loss channel is known to be distillable [17], which means that the upper bound (τ ), based on the REE, is achievable by a protocol of entanglement distribution, so that D 2 (E τ ) = (τ ). In particular, it is sufficient to consider a protocol where the entanglement is distributed and then distilled with the help of a single round of feedback classical communication [37]. This protocol may achieve a rate that is at least the reverse coherent information of the channel I RCI (E τ ) =−log 2 (1 − τ ) [36]. Once this entanglement has been distilled, it can also be used to transmit qubits via teleportation or to generate secret keys.
If we are interested in QKD only, then there are different asymptotic ways to reach the PLOB upper bound, i.e., the secret key capacity K of the pure-loss channel. This is certainly possible by using a QKD protocol equipped with a quantum memory as discussed in Ref. [17]. An alternative method is to use a strongly biased QKD protocol with squeezed states [75]. Suppose that, with probability p, the transmitter prepares a position-squeezed state with CM diag(μ −1 ,μ). With probability 1 − p, it instead prepares a momentum-squeezed state with CM diag(μ, μ −1 ). In each case, the mean value of the squeezed quadrature is Gaussianly modulated with variance μ − μ −1 , so that the average output state is an isotropic thermal state with variance μ = 2n T + 1, wheren T is the mean number of photons. These states are sent through the link and measured at the receiver by a homodyne detector switching between position and momentum with the same probability distribution of the transmitter. Finally, the parties perform a sifting process where they only select their matching choices of the quadrature, which happens with frequency Assume that the communication is long enough (asymptotic limit of infinite signals exchanged) so that the parties access many times the instantaneous pure-loss channel E τ for some τ (within some small resolution δτ). For large μ, we can compute the following mutual information between transmitter and receiver: Assuming reverse reconciliation, where the variable to be inferred is the outcome of the receiver, we have that the eavesdropper's information cannot exceed the Holevo bound The asymptotic (conditional) rate is equal to For an unbiased protocol (p = 1/2), we have R sq (1/2,τ) = (τ )/2. In the limit of a completely biased protocol (p → 1), we instead find R sq (1 − ,τ) → (τ ).
It is clear that this is the same performance that could be achieved by an equivalent entanglement-based protocol where the transmitter sends the B-modes of TMSV states (with large variance μ), keeps their A modes in a quantum memory, and finally homodynes the A modes once the receiver classically communicates which detection was in the position quadrature and which was in the momentum one [17,36].
Let us now account for the fading process, according to which the instantaneous transmissivity τ occurs with probability density P 0 (τ ). In a coarse-graining description of the process, one has a large number of instantaneous channels with transmissivities contained in slots [0,δτ], [δτ, 2δτ],...[(k − 1)δτ, kδτ],... up to a maximum value η, given by η st η eff η atm . Each slot is used a large (virtually infinite) number of times. Therefore, we can take a suitable joint limit for small δτ, and approximate the weighted sum of rates with an integral. For the case of the squeezed-state protocol, we write the average rate: R sq (p) = η 0 dτ P 0 (τ )R sq (p,τ). (E4) In the biased limit p → 1 − , we have that the achievable rate of the fading channel {P 0 (τ ), E τ } is which coincides with the upper bound of Eq. (27)ofthemain text. In other words, this bound is asymptotically achievable by this ideal QKD protocol. It is clear that the squeezed-state protocol just represents a theoretical tool to demonstrate the achievability of the bound but it is not realizable with current technology. Consider now the protocol of Ref. [14], where the transmitter Gaussianly modulates coherent states and the receiver performs homodyne detection switching between the two quadratures. In the large modulation limit, one computes the instantaneous rate R coh (τ ) = (τ )/2, so we have the average value achieving half of the bound.

Thermal-noise model
During daytime operation, background thermal noise may become nontrivial. For this reason, we need to suitably modify the description of the free-space channel and derive more appropriate bounds. In the presence of non-negligible noise, an instantaneous (short-term) quantum channel can be approximated by an overall thermal-loss channel E τ,n between transmitter and receiver. More precisely, assume thatn T is the mean number of photons in the mode generated by the transmitter. Then, the mean number of photonsn R reaching the receiver's detector is given by the input-output relation n T →n R = τn T +n, where τ is the instantaneous transmissivity, andn = η effnB + n ex is the channel's thermal number, given by the detected environmental photons η effnB plus extra photonsn ex added by the receiver's setup. To understand Eq. (F1), see also Fig. 1 of the main text. The instantaneous channel E τ,n can equivalently be described by a beam splitter with transmissivity τ mixing an input mode with an environmental mode with mean number of photonsn e =n/(1 − τ ). Channel's transmissivity τ varies between 0 and a maximum value η according to the probability density P 0 (τ ) determined by turbulence and pointing error. The mean number of thermal photonsn can be assumed to be constant by assuming a suitably stabilized receiver setup (with negligible fluctuations inn ex ) and stable conditions for the external background (so that the photons collected within the field of view are approximately constant). If this assumption is not met, then we can always maken constant by maximizing it over τ (worst-case scenario, suitable for the lower bound) or minimizing it over τ (best-case scenario, suitable for the upper bound). For this reason, we can always model the freespace fading channel E as an ensemble {P 0 (τ ), E τ,n }, whose elements have variable τ but constantn.

Upper and lower bounds
Given the asymptotic rate R(E τ,n ) associated with a generic instantaneous channel E τ,n , the asymptotic rate of the freespace link E is given by the average R = η 0 dτ P 0 (τ )R(E τ,n ). (F2) This rate is asymptotically achievable if the fading dynamics is perfectly resolved by detectors and a large (virtually infinite) number of signals are allocated to each infinitesimal slot [τ, τ + dτ ]. It also assumes that the adaptive optics completely eliminates any average offset d of the beam's centroid [otherwise P 0 is replaced by the more general distribution in Eq. (D4)]. Because the instantaneous channel is a thermal-loss channel E τ,n , we do not know its two-way assisted capacities D 2 (E τ,n ) = Q 2 (E τ,n ) K (E τ,n ) and we are limited to consider upper and lower bounds. The secret key capacity is upperbounded by the thermal-loss version of the PLOB bound K (E τ,n ) (τ,n), given by forn τ , while (τ,n) = 0f o rn τ . In the previous formula, the entropic quantity h is defined as in Eq. (35), i.e., we have h(x) := (x + 1) log 2 (x + 1) − x log 2 x.

(F17)
Replacing these expressions in Eq. (F2) provides asymptotically achievable QKD rates for the free-space link. In particular note that, for smalln, we can expand and write the following rate for the link: In conclusion, according to our derivations, the optimal rates for entanglement distribution and key generation in the presence of background thermal noise can be bounded by the following sandwich relation: B(η, σ ) − h n 1 − η R B(η, σ ) − T (n,η,σ). (F20) One can check that these inequalities collapse to single lossbased bound R ≃ B(η, σ ) for small thermal numbersn (e.g., compatible with night-time operation).
Consider a projector := x∈ |x C x| defined over a reduced alphabet ⊆ℵ for the classical system C.A l s o consider two CQ states, ρ ∈ S = (H CQ ) and ρ * ∈ S (H CQ ), the latter with normalization where E is a CPTP map (quantum channel) acting on system Q, and is a non-normalized entangled state defined over the orthonormal set of states {|x }. The latter is a basis for C and a set for Q ′ , which is assumed to have d Q ′ d. It is easy to see that This leads to Taking the log, we obtain Eq. (G35). For the projected states, σ and σ * , and their probabilities, p and p * , we may write the following inequalities (proven below): In fact, consider the normalized state ρ * N := N −1 ρ * with p * = Tr( ρ * N ). Recall that the trace distance between two normalized states ρ and ρ * N is equal to the maximum Kolmogorov distance between the probability distributions generated by the application of a POVM. Considering the (generally nonoptimal) POVM { k }={ , I − },w em a y write ρ − ρ * N 1 k |Tr( k ρ) − Tr( k ρ * N )| = 2|p − p * |.
(G42) Using the result above and the triangle inequality, we get where we have used the triangle inequality for the trace distance (here applied to Hermitian operators). It is easy to show that the term in Eq. (G48) can be bounded as follows: