Satellite quantum communications: Fundamental bounds and practical security

Satellite quantum communications are emerging within the panorama of quantum technologies as a more effective strategy to distribute completely secure keys at very long distances, therefore playing an important role in the architecture of a large-scale quantum network. In this work, we apply and extend recent results in free-space quantum communications to determine the ultimate limits at which secret (and entanglement) bits can be distributed via satellites. Our study is comprehensive of the various practical scenarios, encompassing both downlink and uplink conﬁgurations, with satellites at different altitudes and zenith angles. It includes effects of diffraction, extinction, background noise, and fading, due to pointing errors and atmospheric turbulence (appropriately developed for slant distances). Besides identifying upper bounds, we also discuss lower bounds, i.e., achievable rates for key generation and entanglement distribution. In particular, we study the composable ﬁnite-size secret key rates that are achievable by protocols of continuous variable quantum key distribution, for both downlink and uplink, showing the feasibility of this approach for all conﬁgurations. Finally, we present a study with a sun-synchronous satellite, showing that its key distribution rate is able to outperform a ground chain of ideal quantum repeaters.

An important driving reason behind the development of free-space quantum communications with satellites is the possibility to by-pass fundamental limitations that restrict rates and distances achievable by ground-based fiber communications. It is in fact well known that the amount of secret bits or entanglement bits (ebits) that can be distributed through a lossy communication channel with transmissivity η cannot exceed its secret key capacity − log 2 (1 − η) bits/use, also known as the repeaterless PLOB bound [12]( s e ea l s o Ref. [13] for the very first investigation of the fundamental limits of quantum communication). In a ground-based fiber link, the transmissivity decays exponentially with the distance and so does the communication rate of any protocol for QKD or entanglement distribution.
One strategy to mitigate such a problem is the introduction of quantum repeaters or relays ( [1], Sec. XII). In QKD, the cheapest solution is the use of a chain of trusted nodes between the two end-users. These nodes distribute pairs of keys with their neighbors, whose composition via one-time pad generates a final secret key for the remote users. Here a nontrivial issue is the fact that all the nodes need to be trusted, so that the longer is the chain, the higher is the probability that security could be compromised. An alternative strategy relies in the adoption of nodes able to distribute entanglement, which is then swapped to the remote users. However, this solution is rather expensive because it involves the development of quantum repeaters with long coherence times and distillation capabilities.
In this scenario, satellites open the way for new opportunities. Free-space connection with a satellite may have far less decibels of loss than a long ground-based fiber connection. Furthermore, most satellites are fast-moving objects, therefore able to physically travel between two far locations over the globe. These features have the potential to drastically reduce the complexity of a ground-based quantum network. In fact, a chain of nodes could just be replaced by a single satellite acting as a trusted QKD node or as a distributor of entanglement. In such an exciting new setting, it is crucial to understand the optimal performances allowed by quantum mechanics, and also what practical performances may be achieved with current technology. This work serves for this purpose.
Here we establish the information-theoretic limits of satellite quantum communications and also show their practical security on the basis of state-of-the-art technology. Our study extends the free-space analysis of Ref. [14], there developed for ground-to-ground free-space communications, to the more general setting of ground-satellite communications, where the optical signals travel slant distances with variable altitudes and zenith angles (in uplink or downlink). This scenario involves more general models for the underlying physical processes occurring within the atmosphere (refraction, extinction and turbulence), and different descriptions for the background noise (planetary albedos besides sky brightness). Accounting for these accurate models, we study the ultimate rates for secret key generation and entanglement distribution with a satellite in all scenarios (uplink/downlink, night/day-time operations).
Once we established the ultimate converse rates for secret key and entanglement distribution, we also study lower bounds. In particular, we focus our investigation on the practical rates that are achievable by a coherent-state QKD protocol, suitably modified to account for the fading channel between satellite and ground station, and including the orbital dynamics of the satellite. Our security analysis considers finite-size effects and composable aspects. We show that high-rate ground-satellite QKD with continuous variable (CV) systems [15] is feasible for both downlink and uplink, during night and day.
Finally, we show that the number of secret key bits per day that can be distributed between two stations by a sunsynchronous satellite can be much larger than what achievable by a standard fiber connection between these stations, even when a substantial number of repeaters are employed in the middle and assumed to operate at their capacity level [16]. This analysis proves the potential advantages of satellite links over ground networks and strongly corroborates their role for near-future realization of large-scale quantum communications.

A. Structure of the paper
The paper has two main parts. In the first part, we investigate the fundamental bounds for satellite quantum communications (Sec. II). We start with some basic geometric considerations (Sec. II A) and then we present general upper bounds based on free-space diffraction (Sec. II B). We then increase the complexity of the description by introducing atmospheric extinction and setup inefficiencies (Sec. II C). Next we describe the fading process induced by pointing errors and turbulence (Sec. II D), followed by the corresponding expressions of the loss-limited upper bounds for key and entanglement distribution (Sec. II E). In our next generalization (Sec. II F), we consider the effect of background thermal noise and derive more advanced thermal-loss upper and lower bounds for key and entanglement distribution with the satellite.
Once we have established the ultimate performances, we then study the secret key rates that are achievable in satellite CV-QKD accounting for composable finite-size aspects, fading and orbital dynamics. This is the second part of the paper (Sec. III). We start with an overview of the problem (Sec. III A) and a discussion on the composable security at fixed transmissivity (Sec. III B). Then, we delve into the problem of free-space fading by discussing the use of pilots, post-selection, and a suitable defading technique (Sec. III C). Next we discuss how to perform parameter estimation and we provide the general forms of the composable key rates (Sec. III D). After important observations on the setup noise (Sec. III E), we analyze the performances of the key rates accounting for the orbital dynamics (Secs. III F and III G). Finally, we show how the satellite-based key rates can overcome the performance of a chain of quantum repeaters on the ground (Sec. III H). Section IV is for conclusions.

A. Geometric considerations
Consider a ground station (G), at some relatively low altitude h 0 ≃ 0 above the sea level, and a satellite (S), that is orbiting at some variable altitude h beyond the Kármán line (h 100 km) with a variable zenith angle θ . The latter is the angle between the zenith point at the ground station and the direction of observation pointing at the satellite. It takes positive values between 0 (satellite at the zenith) and π/2 (satellite at the horizon). For a zenith-crossing orbit (studied later in Sec. III G), it may be useful to associate a sign to θ , so that −π/2 represents the "front" horizon and +π/2isthe "back" horizon. (Including the sign does not change the main geometric formulas since θ appears in cosine functions).
Calling R E ≃ 6371 km the approximate radius of the Earth, the slant distance z between the ground station and the satellite can be written as Equivalently, the altitude h of the satellite reads h(z,θ) = R 2 E + z 2 + 2zR E cos θ − R E .
See Appendix A for more details on this geometry, which can be easily extended to the case of non-negligible atmospheric altitudes h 0 for the ground station. (We remark that, while this extension may be useful, in our main text, we investigate the basic scenario of a low-altitude ground station for which h 0 can be considered to be negligible with respect to the typical satellite altitudes.) The formulas above are very good approximations for angles θ 1 (i.e., within about 60 • from the zenith). For larger zenith angles, one needs to consider the apparent angle and the optical-path elongation induced by atmospheric refraction, which become more and more prominent close to the horizon. In such a case, the formulas above undergo some modifications as discussed in Appendix B. In our main text below, we omit this technicality for two reasons: (i) formulas above can still be used to provide (larger) upper bounds in the proximity of the horizon; (ii) when we treat achievable rates (lower bounds), we will restrict our study to the good window θ 1, an assumption which is also justified by the analysis of turbulence carried out later on in the manuscript.
In terms of configurations, we consider both uplink and downlink. In uplink, the ground station is the transmitter (Alice) and the satellite is the receiver (Bob); in downlink, it is the satellite to be the transmitter and the ground station to operate as a receiver. In these two configurations, the effects of free-space diffraction and atmospheric extinction are the same. Different is the case for the fading induced by turbulence (more relevant in uplink) and the thermal noise induced by background sources (with further differences between dayand night-time operations). For the sake of simplicity, we start by accounting for diffraction and extinction only; then, we will introduce the other effects, which need to be treated quite differently with respect to the models that are valid for ground-to-ground free-space communications.

B. Free-space diffraction
We assume that free-space quantum communication is based on a quasi-monochromatic optical mode with temporal duration t and narrow bandwidth λ around a carrier wavelength λ (so that the angular frequency is ω = 2π c/λ and the wave number is k = ω/c = 2π/λ). This model is represented by a Gaussian beam with field spot size w 0 and curvature R 0 [17][18][19][20]. Spot size is sufficiently smaller than the transmitter's aperture so that the latter does not induce relevant diffraction. After free-space propagation for a distance z, the beam is detected by a receiver whose telescope has a circular aperture with radius a R . To fix the ideas, one can assume that the propagation direction is uplink so that the ground station is the transmitter, but the model is completely symmetric and applies to downlink in exactly the same way.
Because of the inevitable free-space diffraction, the waist of the beam will broaden during propagation. After traveling for a distance z, the beam is intercepted by the receiver that will see an increased spot size where z R := π w 2 0 λ −1 is the Rayleigh range. Due to the finite aperture a R of the receiving telescope, only a fraction of the initial beam will be detected, and this fraction is given by the diffraction-induced transmissivity In the far field z ≫ z R , this can be approximated as Using η d with the PLOB bound [12], one finds that the maximum number of secret bits that can be distributed by the most general (adaptive) QKD protocols over the free-space communication channel is upper bounded by [14] In other words, the secret key capacity K of the free-space channel must satisfy K U and, similarly, this bound also holds for the channel's entanglement distribution capacity E K (which is the number of ebits per use of the channel that can be distributed by the most general adaptive protocols of entanglement distribution; see Ref. [12] for exact mathematical definitions). Note that a focused beam (R 0 = z) optimizes the bound in Eq. (6) but, at long distances, optical focusing becomes a very challenging task. For this reason, a better strategy is to just generate a collimated beam (R 0 =∞)soEq. ( (15) which includes the combined effects of diffraction, extinction and quantum efficiency. The upper black curves refer to the satellite at the zenith position (θ = 0), while the lower blue curves refer to the horizon position (θ = π/2). We assume a collimated Gaussian beam with λ = 800 nm and w 0 = 2 0c m ,s ot h a t z R ≃ 160 km (LEO boundary). Then, we assume a R = 40 cm and η eff = 0.4. by assuming We will therefore use the specific case of a collimated Gaussian beam in our numerical investigations. It is also clear that U (z) can be expressed in terms of the altitude h and zenith angle θ of the satellite. In fact, we may replace the function z = z(h,θ)o fE q .( 1)i nE q .( 6)t o get the expression for U (h,θ) = U [z(h,θ)]. The diffractionbound U (h,θ) is numerically investigated in Fig. 1,f o ra collimated Gaussian beam and a typical choice of parameters. In particular, we show this ultimate bound in two extreme angles for the satellite, i.e., zenith position (θ = 0) and horizon (θ = π/2). The reduction of the rate at the horizon is due to the greater slant distance to be traveled by the beam. As mentioned before, in this case the bound is optimistic because the refraction-induced elongation of the optical path is here neglected.

C. Atmospheric extinction
Another important physical process that causes loss in the free-space propagation of an optical beam is atmospheric extinction; this is induced by both aerosol absorption and Rayleigh/Mie scattering. For a free-space communication at fixed altitude h, this effect is described by the simple Beer-Lambert equation where α(h) is the extinction factor ( [21], Ch. 11). This is given by α(h) = α 0 exp(−h/h), where h is expressed in meters,h = 6600 m, and the sea-level value α 0 takes the value ≃ 5 × 10 −6 m −1 at λ = 800 nm ( [22], Sec. III C).
It is clear that the model in Eq. (8) needs to be suitably modified in order to describe free-space optical communications at variable altitudes h. First suppose that the satellite is exactly at the zenith, so that its slant range z is equal to its altitude h. Then, we can easily compute e −α 0h ≃ 0.967 (≃ 0.14 dB).
The value in Eq. (9) is valid for any altitude and is already approximated at h = 30 km, in the middle of the stratosphere, after which the atmospheric density is negligible. For this reason, for any satellite at the zenith position, we can use the estimate η zen atm (∞) ≃ 0.967. Consider now a generic zenith angle θ . Neglecting refraction, we can therefore use the expressions in Eqs. (1) and (2), and write the following expression for the atmospheric transmissivity: where we have introduced the integral function For zenith angles θ 1, one may check that Eq. (10) can be approximated as follows: This approximation is already good at 30 km of altitude and becomes an almost exact formula beyond 100 km. Combining atmospheric extinction with free-space diffraction and the inevitable internal loss η eff affecting the setup of the receiver (due to nonunit quantum efficiency of the detector and other optical imperfections), we can write the total amount of fixed loss of the free-space channel from the generation of the Gaussian beam to its final detection. This is given by where η d (h,θ) = η d [z(h,θ)] and we can assume η eff ≃ 0.4, i.e., about 4 dB (e.g., as in Ref. [23]). Using this transmissivity in the PLOB bound, we get an immediate extension of a result in Ref. [14], i.e., where the last approximation is valid for η tot (h,θ) ≪ 1 which is certainly true in the far field regime z ≫ z R . From Fig. 1, we see that the combined effects of diffraction, extinction and nonideal quantum efficiency decrease (by about one order of magnitude) the ultimate communication bounds that are only based on free-space diffraction. As for U (h,θ), also the value of the upper bound V (h,θ) is overestimated at the horizon due to the fact that refraction has been neglected (see Appendix B for an extension of the bound which includes refraction). The ultimate performances discussed so far will further decrease when we include fading (turbulence/pointing errors) and then background noise.

D. Fading process induced by beam wandering: turbulence and pointing errors
The combined transmissivity η tot in Eq. (13) is constant for a fixed geometry, h and θ , between ground station and satellite. At each time instant, it corresponds to the maximum transmissivity which can be reached by a beam that is perfectly aligned between transmitter and receiver. In a realistic scenario, such alignment is however not maintained and we need to consider a process of beam wandering; this inevitably induces a fading process for the communication channel whose instantaneous transmissivity will fluctuate [24][25][26][27].
Beam wandering is due to random errors in the pointing mechanism of the transmitter and also to the action of atmospheric turbulence on a section of the optical path. These two effects are independent and they sum up. In practice, they have a different weights depending on the configuration. In downlink, pointing error is quite relevant, since on-board optics is limited, while turbulence can be neglected, because it occurs in the final section of the optical path where the beam has been already spread by diffraction. In uplink, pointing error can be reduced, because ground stations may adopt more extensive and sophisticated optics; by contrast, turbulence represents a major effect in this case due to the fact that it affects the beam right after its generation.
In order to treat beam wandering and the corresponding fading process, we assume the regime of weak turbulence, which is appropriate for relatively small zenith angles θ 1.
In this regime, we may separate effects occurring on fast and slow timescales. Turbulent eddies smaller than the beam waist act with a fast dynamics; these tend to broaden the beam, so that the diffraction-limited spot size w d is replaced by a larger "short-term" spot size w st = w st (z,θ), also known as "hot spot." On the other hand, turbulent eddies that are larger than the beam waist act on a much slower time scale [28](of the order of 10-100 ms [29]); these tend to deflect the beam, whose centroid will then wander according to a Gaussian distribution with variance σ 2 TB = σ 2 TB (z,θ). This slow dynamics can be fully resolved and closely followed by a fast detector, e.g., with a realistic bandwidth of the order of 100 MHz. On top of this process, there are pointing errors whose dynamics is also slow and causes an additional Gaussian random walk with variance σ 2 P ≃ (10 −6 z) 2 for a typical 1μrad error at the transmitter. Overall, the wandering of the beam centroid has variance σ 2 = σ 2 TB + σ 2 P . A crucial theoretical step in our treatment is the explicit derivation of w st and σ 2 TB according to turbulence models that are appropriate for satellite communications. As discussed in detail in Appendix C, we start from the Hufnagel-Valley (H-V) model [30,31], which provides the atmospheric profile for the refraction-index structure constant C 2 n (h)( [ 32], Sec. 12.2.1). This altitude-dependent constant measures the strength of the fluctuations in the refraction index caused by spatial variations of temperature and pressure. Assuming this model, we then compute the scintillation index and the Rytov variance. The latter allows us to verify that the angular window θ 1 is compatible with the regime of weak turbulence, which is why we choose this angular window for quantum communication in both uplink and downlink.
From the structure constant C 2 n (h), the wave number k of the beam and the geometry (slant distance z and zenith angle θ ), one can define the spherical-wave coherence length ρ 0 = ρ 0 (z,θ) for uplink (up) and downlink (down). Using the expression for generic z-long propagation [28,33] and accounting for the altitude function h = h(z,θ)inEq. (2), this length takes the form (17) An analysis of ρ down 0 confirms that, within the good angular window and not-too large receiver apertures, downlink communication can be considered to be free of turbulence, so we can set σ 2 TB ≃ 0 and w st ≃ w d . This assumption for downlink is well justified by examining the long-term spot-size of the beam which takes the following form (valid in general conditions of turbulence) [28] A quick calculation of ρ down 0 shows that one has w lt ≃ w d in downlink at satellite altitudes (e.g., at the LEO lower border, the difference in these two standard deviations is basically in the third significative digit). This is equivalent to say that diffraction is the only relevant effect, i.e., we have the collapse σ 2 TB ≃ 0 and w lt ≃ w st ≃ w d . By contrast, for uplink communication, the value of ρ up 0 becomes rather small (of the order of 1 cm at λ = 800 nm), meaning that turbulence is relevant in this scenario. In this case, we can resort to Refs. [28,34] and write analytical formulas for the short-term spot size and the variance of the centroid wandering. For satellite distances one can easily check the validity of Yura's condition for uplink φ := 0.33(ρ up 0 /w 0 ) 1/3 ≪ 1, which allows us to write [34] For satellites in the LEO region and beyond, we can adopt the asymptotic planar approximation where ρ up p bounds the value of ρ up 0 from below at any relevant altitude and any θ 1 (e.g., see the comparison in Fig. 16 of Appendix C). This leads to the simpler expressions where we have set (θ ):= 26.28(I ∞ sec θ ) 6/5 In these formulas, I ∞ takes different values depending on the parameters chosen for the H-V model. In particular, we compute I ∞ ≃ 2.2354 × 10 −12 m 1/3 for the standard H-V 5/7 model ( [32], Sec. 12.2.1), which is good for describing nighttime operation. During the day, turbulence on the ground is higher and we consider a typical day-time version of the H-V model, for which I ∞ ≃ 3.2854 × 10 −12 m 1/3 (see Appendix C for more details). Numerical investigations at λ = 800 nm show that w st exceeds w d by one order of magnitude in uplink, with an almost constant gap in the far field (e.g., see Fig. 17 in Appendix C). Finally, note that we can re-obtain the downlink diffraction-limited values by setting I ∞ = 0i nE q s . ( 23) and (24).

E. Bounds for the satellite fading channels in uplink and downlink
Following the theory of the previous section, it follows that we can adopt a unified approach to treat fading in uplink and downlink. In fact, we may consider the general parameters w st and σ 2 = σ 2 TB + σ 2 P , which can then be simplified for the specific case of downlink, for which we may set w st ≃ w d and σ 2 ≃ σ 2 P . In general, the broader short-term spot size w st decreases the maximum value of the transmissivity. In fact, the diffraction-induced transmissivity η d has to be replaced by the (lower) short-term transmissivity with far-field approximation As a result the combined expression η tot of Eq. (13) has to be replaced by the more general parameter where η st (h,θ):= η st [z(h,θ),θ]usingEq. (1). At any fixed geometry h and θ , the loss parameter η(h,θ) describes the maximum transmissivity that is achievable in the communication through the generally turbulent free-space channel, which corresponds to the case where the incoming beam is perfectly aligned with the receiver's aperture. Note that, more generally, one may assume the case of a constant deflection for the beam; here we omit this technicality for two reasons: we are interested in the optimal rate performance of the communication and such a deflection can anyway be compensated by using adaptive optics.
As a consequence of beam wandering, the actual instantaneous value of the transmissivity will be τ η and this value will depend on how far the beam is deflected from the center of the receiver's aperture. The Gaussian random walk of the beam centroid [35] results in a Weibull distribution for the instantaneous deflection which, in turn, leads to a probability distribution P σ (τ ) for the instantaneous transmissivity. Let us introduce the two functions in terms of the modified Bessel function I n of the first kind with order n = 0, 1. These are useful to introduce the geometry-dependent positive parameters [27] γ (z,θ) = 4η far Using these parameters, we may then write The free-space fading channel E fad can therefore be described by an ensemble {P σ (τ ), E τ } of pure-loss channels E τ whose transmissivity τ is chosen with probability P σ (τ ). From the PLOB bound and the convexity of the relative entropy of entanglement [12], one has that the secret-key capacity of the fading channel E fad is bounded by the average Repeating the steps of Ref. [14], we get where (η, σ ) is defined by the expression Note that, while Eq. (35) has exactly the same analytical form of the free-space bound in Ref. [14], it is here implicitly extended from the setting of ground-based communications to that of satellite communications. In B(η, σ ), the component − log 2 (1 − η) ≃ η/ ln 2 upper bounds the key rate achievable with a perfectly aligned link between ground station and receiver, while (η, σ ) is a correction factor accounting for beam wandering, induced by turbulence and/or pointing errors. In order to investigate this bound for satellite communications, we need to include the necessary geometry and distinguish between downlink and uplink.
By replacing z = z(h,θ) in the formulas of γ , r 0 and the total variance σ 2 , we can express all these parameters in terms of h and θ . We may then use these functionals together with η = η(h,θ)ofEq. (28)inEq. (35), so as to obtain a geometrydependent expression for the bound B = B(h,θ). In Fig. 2,we investigate the behavior of B(h,θ) in uplink and downlink for a satellite at various altitudes h and for zenith angles equal In the various configurations, the lines upper bound the maximum number of secret (and entanglement) bits that can be distributed per use of the channel, considering the combined effects of diffraction, atmospheric extinction, quantum efficiency, pointing error (1 μrad) and atmospheric turbulence (night-/day-time H-V model, only for uplink). As in Fig. 1, we assume a collimated beam with λ = 800 nm and w 0 = 20 cm. Receiver has aperture a R = 40 cm and total efficiency η eff = 0.4. to zero or 1. Besides the effects of free-space diffraction, atmospheric extinction and limited quantum efficiency, the downlink bound B down (h,θ) includes the centroid wandering due to pointing error σ 2 P , while the uplink bound B up (h,θ) also includes turbulence-induced beam spreading (w st ) and wandering (so that σ 2 = σ 2 P + σ 2 TB ). By comparing the zenith-performance of B down in Fig. 2 and that of V in Fig. 1, we can see how the pointing error decreases the rate already from the beginning of the LEO region. Then, by comparing the downlink bound B down with the uplink bound B up in Fig. 2, we see how turbulence induces a further nontrivial decrease, which is about one-two orders of magnitude. Also note that B up is additionally decreased during day time (while B down does not depend on the operation time).
Several important considerations are in order about Eq. (35). The first is that, as long as the free-space fading channel E fad can indeed be described by an ensemble of instantaneous pure-loss channels E τ , i.e., E fad ={P σ (τ ), E τ }, then the bound B in Eq. (35) is also achievable. As discussed in Ref. [14], this bound is achieved by optimal protocols of CV-QKD, either based on the use of quantum memories or employing largely squeezed states to be transmitted in an extremely biased manner. The bound can also be achieved by optimal protocols of entanglement distribution, where distillation is assisted by one-way backward classical communication. The performance of these protocols is equal to the (bosonic) reverse coherent information [13], which achieves − log 2 (1 − τ ) for each E τ . As a result, we may write E = K = B for both the entanglement distribution (E ) and the secret key (K) capacities of the fading channel E fad .
The pure-loss assumption E fad ={P σ (τ ), E τ }, which implies the achievability of the bound B, is appropriate for night-time operation at typical satellite altitudes. Different is the case for day-time operation, where the background noise becomes nontrivial. In this setting, the quantity B in Eq. (35)is still an upper bound but no longer guaranteed to be achievable. In the following (Sec. II F), we will therefore consider a more refined upper bound and a corresponding lower bound in the presence of noise. These two bounds are useful for the study of day-time operation and also clarify the validity of the pureloss assumption for night-time operation.
A final observation regards the potential use of slow detection strategies, so that the wandering of the centroid is not time-resolved but averaged over long acquisition times of the order of 100 ms or more, i.e., beyond the typical timescales associated with turbulence and pointing error. In such a case, the transmissivity of the ground-satellite link has to be averaged over the fading process and is given by where w lt is the long-term spot size of the beam given in Eq. (18). As a result, the upper bound takes the simple form [14] K slow − log 2 (1 − η slow ) 2 ln 2 This detection strategy may be helpful to increase the detection efficiency, but it has the downside to reduce the clock rate and also involves a larger amount of noise to be collected by the receiver.

F. Satellite bounds with background noise
Let us account for the presence of background noise. First of all, it is important to adopt an appropriate model for the input-output number of photons. Calln T the mean number of photons in the beam at the transmitter. For an instantaneous transmissivity τ , the mean number of photons reaching the receiver can be written as wheren is the mean number of thermal photons describing the overall noise affecting the propagation. It is natural to decompose the thermal numbern as follows [14]n wheren B is the background thermal noise collected by the receiver's aperture, whose detector has quantum efficiency η eff and extra setup noisen ex . The noise contribution from the setupn ex is sometimes considered to be trusted. It is assumed to be negligible (n ex ≃ 0) in our numerical investigation of the ultimate bounds since we aim at analyzing optimal/almost-optimal performances. (A realistic estimate ofn ex for a practical receiver setup will be explicitly taken into account in our subsequent analysis of the composable QKD rates.) The value of the background noisen B depends on the operational setting (time of the day/direction of the link), besides features of the receiver, such as its aperture a R , field of view Assuming λ = 1 nm and t = 10 ns for the detector, and fov = 10 −10 sr and a R = 40 cm for the receiving telescope, we compute Ŵ R = 1.6 × 10 −19 m 2 snmsr .
Then, for uplink we may writē where H sun λ is the solar spectral irradiance at the relevant wavelength λ, e.g., H sun λ = 4.61 × 10 18 photons m −2 s −1 nm −1 sr −1 at λ = 800 nm. In the formula above, the dimensionless parameter κ depends on the geometry and albedos of the Earth and the Moon. Its value is κ day ≃ 0.3f o r day-time and κ night ≃ 7.36 × 10 −7 for full-Moon night time (see Appendix D for more details). For downlink, we instead haven where H sky λ is the spectral irradiance of the sky in units of photons m −2 s −1 nm −1 sr −1 .Atλ = 800 nm, its value ranges from 1.9 × 10 13 (full-Moon clear night) to 1.9 × 10 16 (clear day time) and 1.9 × 10 18 (cloudy day time).
A summary of the resulting values for the mean number of photons is provided in Table I. These values confirm that background noise is practically negligible at night time, while it plays an important role for day time. Under general sky conditions, day-time operations need to be described by thermal-loss channels, where loss and fading effects are combined with the thermal bath collected by the field of view of the receiver.

Noise filtering
It is important to observe that these values strongly depend on the filter λ. At 800 nm, the filter λ = 1 nm corresponds to a bandwidth of ν = cλ −2 λ ≃ 470 GHz (here c is the speed of light). This value for the filter is certainly appropriate for GEO satellites, while it may become a bit more challenging for fast-moving satellites in the LEO region where the Doppler shift need to be compensated by adaptive optics [36] (so that the central frequency of the beam is suitably tracked during the flyby of the satellite, with generally different speeds at different zenith angles). However, due to other observations, the value of λ = 1 nm can also be considered TABLE II. Day-time noisen B with a narrow filter λ = 0.1pm (corresponding to Ŵ R = 1.6 × 10 −23 m 2 s nm sr).
to be relatively large, since it can be reduced by employing specific detection techniques at the receiver. In other words, the effective value of ν can be greatly reduced by suitable interferometric measurements at the receiver.
In fact, an important ingredient of CV quantum communications is the local oscillator (LO). In the method of "transmitted LO" (TLO), each signal is multiplexed in polarization with a bright classical LO pulse, carrying phase information. Signal and LO pulse are de-multiplexed at the receiver via a polarizing beam splitter and made to interfere on balanced beam-splitter(s) in a homodyne or heterodyne setup. Alternatively, one can use the method of the "local LO" (LLO) [37]. Here there is the transmission of bright reference pulses regularly interleaved with the signal pulses (time multiplexing). The reference pulses are detected and used to digitally reconstruct the LO at the receiver. Each signal is homodyned/heterodyned by using an independent LO which is then rotated according to the phase reconstruction.
In both cases, the output of homodyne is proportional to √n LOx , wherex is signal's generic quadrature andn LO ≫ 1 is the number of photons of the LO pulse interfering with the signal. Only thermal noise mode-matching with the LO will be detected (together with the signal), while all the other noise will be filtered out. For this reason, the actual filter of the receiver will be limited by the bandwidth of the LO pulses. Compatibly with the time-bandwidth product (which is t ν 0.44 for Gaussian pulses), the bandwidth of the LO can be made very narrow so that very small values of λ are indeed accessible. For t = 10 ns, one can consider ν = 50 MHz, which corresponds to λ = 0.1 pm around 800 nm. Such small bandwidths can certainly be generated by current lasers, whose line-widths can easily go down to 1 KHz (e.g., for continuous-wave lasers).
From this point of view, the value of ν ≃ 470 GHz is pessimistic in the setting of LO-based CV quantum communications. For this reason, we also account for the possibility of receiver designs that may have such ultranarrow filters. An effective filter of λ = 0.1pmis10 −4 narrower than the value considered above in Table I. With such a filter, we have a corresponding 10 −4 suppression of thermal noisen B , implying that its day-time values become almost negligible as reported in Table II (where we do not report the night-time values since they become 10 −10 ). In our following analysis, we therefore include this better regime.
As also noted in Ref. [14], when thermal noise is nonnegligible, there is a general trade-off associated with the receiver aperture a R . If we increase a R we certainly increase the transmissivity of the link according to Eqs. (4) and (26). However, larger values of a R also lead to higher values of background noise collected by the receiver as is also clear from Eqs. (41)- (43). As a result, an optimal value for a R can be determined by optimizing over the rate [or the thermal bound in Eq. (47) of the next sub-section]. In this regard, it is clear that the use of an ultra-narrow filter able to suppress the noise would mitigate this problem and give access to large apertures for the receiver. However, even in total absence of thermal noise, too large apertures would encounter other problems related to enhanced turbulence, in terms of increasing off-axis scintillation and number of short-term speckles (see Appendix C for more details on these effects).

Accounting for the untrusted noise
It is important to observe that the total input-output relation of Eq. (39) from transmitter to receiver is equivalent to the action of a thermal-loss channel E τ,n with transmissivity τ and environmental number of photons From the point of view of the generic quadraturex of the mode (i.e., positionq or momentump), Eq. (39) corresponds to the following transformation: where the additive-noise variable ξ add can be written as ξ add = √ 1 − τê, andê is the quadrature of an environmental mode withn e mean thermal photons. Therefore the overall process can be represented as an effective beam-splitter of transmissivity τ mixing the input mode of the transmitter with an environmental thermal mode. At the output of the beam splitter, one mode is detected by the receiver, while the other mode goes back into the environment.
In the worst-case scenario, one assumes that the eavesdropper (Eve) controls the input environmental mode, assumed to be part of a TMSV state in her hands (which realizes a purification of the channel, unique up to local isometries on the environment). One also assumes that all environmental modes after interaction are stored by Eve in a quantum memory to be subject to an optimal joint measurement. This active strategy is known as collective entangling-cloner attack and represents the most typical collective Gaussian attack [38]. According to Ref. [12], the relative entropy of entanglement suitably computed over the asymptotic Choi matrix of the thermalloss channel E τ,n provides an upper bound for its secret key capacity K. For each instantaneous channel E τ,n describing the satellite link, we have K (E τ,n ) τ,n , where [12] and we have set h(x): For the analysis of the ultimate bounds, we may assume thatn does not depend on τ . Indeed, the external background noisen B does not depend on the transmissivity affecting the signals, since it is noise collected by the field of view of the receiver. Then, in the presence of non-negligible values for the setup noisen ex that may depend on τ , we can always optimizen ex over τ (and, in particular, minimize its value for the study of upper bounds, and maximize it for that of the lower bounds).
Thus we can represent the satellite fading channel in the presence of background noise by means of the channel ensemble E noi fad ={P σ (τ ), E τ,n }. By averaging τ,n over the fading process in τ ,Ref. [14] computed the general free-space upper bound forn η and where the thermal correction T is given by Similarly, one may write the lower bound [14] K which is based on the RCI and can be approximated by ideal implementations of CV-QKD protocols [14,39]. The application of these formulas to the specific satellite models developed above allows us to bound the ultimate rates for key (and entanglement) distribution that are achievable in the presence of background noise.

Maximum ranges
The presence of thermal noise restricts the maximum slant distance for secure key generation to some finite value z max .F r o mE q . ( 47), we see that no key (or entanglement) distribution is possible in correspondence to the entanglement-breaking conditionn = η, which automatically leads to an upper bound for z max . If we assume ideal conditions, where all the effects are negligible with the exception of diffraction and thermal noise, the over-optimistic threshold conditionn = η d would still restricts the range to some finite value. In fact, the latter leads tō where f 0R (z) is the Fresnel number product of the beam and the receiver. Then, using Eqs. (42) and (43), we get the following bounds for the maximum ranges in uplink and downlink: wherewehaveset := π w 0 /(λ λ t fov a R ). It is also clear thatn 1 leads to entanglement breaking, so that no key or entanglement can be distributed when Ŵ R (κH sun λ ) −1 in uplink or Ŵ R 1/H sky λ in downlink. While the conditions in Eq. (52) are particularly simple, tighter bounds on z max can be obtained by directly imposing B(η, σ ) = T (n,η,σ)i nE q . ( 47), and using Eqs. (42) and (43). For typical parameters, the situation is the one depicted in Table III, where we observe that thermal noise represents quite an important limitation for day-time operation. As a matter of fact, day-time uplink does seem to be particularly challenging for satellite QKD. For the regime considered, In order to reach higher altitudes we need to consider better setup parameters. For instance, a faster detector working at 1 GHz (instead of 100 MHz) will reduce Ŵ R and n up B by a factor of 10. As a result, we get a larger bound for the maximum range in day uplink, i.e., z max 340 km, so that LEO altitudes are reached. It is clear that a strong mitigation for this problem comes from the use of ultra-narrow filters λ, so that the amount of background thermal noise entering the detector becomes negligible, even for day-time operation.
With an effective filter of λ = 0.1 pm around 800 nm, daytime ranges are sensibly increased. Night-time values of the bounds go well beyond satellite applications, while the bounds for day-time ranges become large as in Table IV.

Analysis of the thermal-loss bounds
Following our preliminary analysis on the security ranges, we now explicitly study the thermal-loss upper bound in Eq. (47) and the corresponding lower bound in Eq. (50). Because we are here interested in investigating optimal performances, we assume the ideal case of negligible setup noise (n ex ≃ 0, noiseless receiver), even though we allow for nonunit quantum efficiency η eff . We start with the investigation of the optimal rates that are achievable by using a relatively large filter ( λ = 1 nm) in low-noise conditions of night-time downlink/uplink and day-time downlink with clear sky (see Fig. 3).
For night-time downlink/uplink, one can numerically check that the thermal correction T (n,η,σ) is practically negligible, so the thermal-loss upper bound coincides with the loss-limited bound B(η, σ )o fE q . ( 35), with only small deviations at GEO altitudes. Furthermore, as we can see . We account for diffraction, extinction, quantum efficiency, pointing error (1 μrad) and atmospheric turbulence (H-V model). Collimated beam has λ = 800 nm and w 0 = 20 cm. Receiver has a telescope with a R = 40 cm and fov = 10 −10 sr, and a detector with filter λ = 1nm, t = 10 ns, η eff = 0.4andn ex = 0 (no extra setup noise). Therefore the receiver has Ŵ R = 1.6 × 10 −19 m 2 s nm sr and the background thermal photonsn B are those specified in Table I.F ora receiver implementing a narrow filter λ = 0.1 pm, the thermal-loss upper and lower bounds in (a), (b) and (c) collapse and coincide with the corresponding loss-limited bounds at the zenith and 1 radiant (red dashed lines).
Eq. (47) numerically coincides with the lower bound of Eq. (50) at LEO altitudes. This means that, for LEO satellites, the two bounds collapse into the loss-limited bound B(η, σ ) which therefore represents the secret key capacity K (and entanglement-distribution capacity E ) of the satellite channel [40]. Said in other words, for night-time downlink/uplink and LEO altitudes, the free-space fading channel can certainly be approximated by an ensemble of pure-loss channels and we can write the achievability result E ≃ K ≃ B. At higher altitudes in the MEO region, the presence of a gap does not allow us to enforce the pure-loss assumption and claim achievability with respect to the chosen parameters (in particular, for the value λ = 1nm).
For clear-day-time downlink in Fig. 3(c), the gap between the two thermal-loss bounds of Eqs. (47) and (50) already appears in the LEO region, even though at low altitudes (of the order of 160 km) there is a substantial coincidence. We can appreciate how, for increasing altitudes, not only the gap increases but the thermal-loss upper bound also substantially departs from the loss-limited bound B(η, σ ), confirming the relevant role of the background thermal noise in limiting the rate performance for day-time operation.
As expected, the role of the thermal background noise can be strongly mitigated by the use of a narrow filter, e.g., λ = 0.1 pm (as in homodynelike setups at the receiver). In conditions of low background noise, our numerical investigation shows that the use of such a narrow filter enables the parties to achieve the loss-limited bound B at the relevant altitude and zenith angle, expressed by the red dashed lines in Fig. 3. In other words, the thermal-loss upper and lower bounds collapse into the loss-limited bound B at all satellite altitudes, so the remote parties can distribute ebits and secret bits at the capacity value E ≃ K ≃ B. Such a collapse is more limited in conditions of stronger background noise, as typical in cloudy-day-time downlink and day-time uplink, but yet the use of a narrow filter would allow to reach good communication rates in such scenarios as shown in Fig. 4. As we can see from the figure, we can match the loss-limited bound B in all the LEO region for day-time downlink with cloudy sky, and for the first part of LEO in day-time uplink. Extending the achievability of B to all altitudes would require an even narrower filter.
Before concluding this section, it is important to remark that, in the various scenarios studied above, the achievability of the upper bound refers to a satellite at a fixed geometry, i.e., with fixed altitude and zenith angle. This means that we ignore the orbital dynamics or we assume that such a dynamics is much slower than the timescale of the quantum communication, so the channel is used many times before the satellite has substantially moved (fast-clock limit/large repetition rate). However, apart from GEO satellites, the orbital dynamics is relevant and, for realistic clocks, we need to modify the lower bound in order to account for this process. In fact, suppose that the rate in Eq. (50) can approximately be achieved after N pulses. For some realistic clock, such a block of N pulses corresponds to a slice of the orbit over which we identify the worst-case values for h and θ . An achievable rate would certainly be given by Eq. (50) computed over such values, but this rate will no longer match the upper bound in the slice (to be computed on the best-case values for h and θ ). In the following, we will consider the problem of orbital slicing more carefully for the derivation of a composable secret key rate.

III. COMPOSABLE FINITE-SIZE SECURITY FOR SATELLITE CV-QKD
Once we have clarified the ultimate limits for distributing keys (and entanglement) with satellites, we study the rates that are achievable by practical CV-QKD protocols, where we explicitly account for finite-size and composable aspects. We adopt the pilot-based post-selected protocol studied in Ref. [14], here suitably applied and extended to considering the underlying physical models valid for satellite communications.

A. Overview
The idea is to use a coherent-state protocol, where Gaussian-modulated signal pulses (used to encode the 023130-10 Optimal performances in day-light conditions with a narrow filter. As in Fig. 3, we consider the key rate between a ground station and a satellite at various altitudes h. In each configuration, we consider the thermal-loss upper bound B − T of Eq. (47) (solid lines) and the thermal-loss lower bound of Eq. (50) (lower dashed lines), specified for the satellite at the zenith position (black lines) or at 1 radiant (blue lines). We also plot the loss-limited upper bound B of Eq. (35) (red dashed lines). In particular, we consider cloudy-day-time downlink in (a), and day-time uplink in (b). We account for diffraction, extinction, quantum efficiency, pointing error (1 μrad) and atmospheric turbulence (H-V model). Collimated beam has λ = 800 nm and w 0 = 20 cm. Receiver has a telescope with a R = 40 cm and fov = 10 −10 sr, and a detector with narrow filter λ = 0.1p m , t = 10 ns, η eff = 0.4, andn ex = 0 (no extra setup noise). Therefore the receiver has Ŵ R = 1.6 × 10 −23 m 2 snmsrand the background thermal photonsn B are strongly suppressed as in Table II. information) are randomly interleaved with more energetic pilot pulses, that are used to monitor the instantaneous transmissivity of the satellite link in real-time. In this way, the parties are able to allocate the distributed data to slots of transmissivity and to perform classical post-processing slotby-slot. In general, one may divide the interval [0,η]b y introducing a lattice with step δτ, so that we have M = η/δτ slots [τ k ,τ k+1 ] with τ k := (k − 1)δτ and k = 1,...,M. When the kth slot is selected, with probability the corresponding data points are associated to its minimum transmissivity τ k . A more practical post-selection strategy consists of introducing a threshold value η th and only accepting data points with τ>η th , i.e., within the post-selection interval = [η th ,η]. This happens with success probability The data points are then associated with the value of the threshold transmissivity η th . In our work, we adopt this post-selection strategy from Ref. [14], which is more robust, especially in terms of collecting enough statistics for parameter estimation. This approach is different from the clusterization method of Ref. [41] which may instead be affected by poor statistics.
In the next subsections, we first discuss the security of the link for a fixed value of the transmissivity, as if there were no fading and with a satellite in a fixed geometry. Then, we introduce the fading process, for which we use the post-selection strategy above, and we subsequently account for orbital dynamics in the key rate. These derivations will provide realistic rates for satellite quantum communications and will also be used for our comparison with a ground network.

B. Composable key rate at fixed transmissivity
Let us start by considering the link to be a thermal-loss channel E τ,n with fixed transmissivity τ and thermal noisē n e =n/(1 − τ ), wheren may take the form in Eq. (40). In a coherent-state protocol [42,43], the transmitter generates an input mode with generic quadraturex T = x +v, wherev is the vacuum quadrature and x is a Gaussianly modulated variable with variance σ 2 x = μ − 1 (with μ being the variance of the average thermal state generated by the transmitter). At the output of the thermal-loss channel E τ,n , the receiver gets a mode with generic quadraturex R as given in Eq. (45). Assuming that the output is homodyned (randomly inq orp), then the receiver's classical outcome takes the form where z is a random noise variable, distributed according to a Gaussian with zero mean and variance σ 2 z = 2n + 1. If heterodyne is used, then the outcome y (for each of the two quadratures) is affected by thermal noise with larger variance σ 2 z = 2n + 2. Compactly, we may therefore write where ν det = 1 holds for homodyne, and ν det = 2 for heterodyne detection. For fixed τ andn, one computes the mutual information I (x : y|τ,n) which takes simple expressions for the two types of output detections, i.e., In reverse reconciliation, it is easy to compute Eve's Holevo bound χ (E : y|τ,n) with corresponding expressions for χ hom and χ het (see Ref. ( [14], Sec. III C) for details). Therefore one may write the asymptotic key rate against collective Gaussian attacks, which takes the form R asy (τ,n) = βI (x : y|τ,n) − χ (E : y|τ,n), where β ∈ [0, 1] is the reconciliation parameter (here βI corresponds to the effective rate of the code which is employed in the step of error correction).
In an actual practical implementation, there is a number N of transmitted signals, whose m are randomly selected by the parties and used for the estimation of the channel parameters τ andn.Fromm p := mν det pairs of data points {x i , y i } related by Eq. (55), the parties build the following unbiased estimators τ = T 2 and n = ( σ 2 Up to O(m −2 p ), these have variances We can therefore build the worst-case parameters n ′ := n + wσn ≃n + Each of them bounds the corresponding actual value up to an error probability ε pe , with Alternatively, one may write a more robust tail bound which leads to the same expressions as above but with which can be used in the cases where ε pe is very small, e.g., less than 10 −17 ([14], Sec. III D). It is therefore clear that the effect of parameter estimation is to modify the asymptotic rate in Eq. (59)asfollows where n = N − m is the number of signals remaining for key generation. This is valid up to a total error ≃ 2ε pe .TherateR pe takes specific formulas for the homodyne (R hom pe ) and the heterodyne (R het pe ) protocol by using Eqs. (57) and (58) together with corresponding expressions for the Holevo information χ hom and χ het .
Parameter estimation provides the parties with crucial information about the amount of loss and noise present in the channel, so they can apply a suitable code to correct their data. The procedure of error correction is successful with a probability p ec which depends on the rate βI of the code and a pre-established ε-correctness ε cor , which bounds the residual probability that the local strings are different after passing a hashing test. Thus only np ec pulses are successfully error-corrected and further processed into a key. This means that secret-key rate R pe needs to be rescaled by the pre-factor np ec /N. The next step is that of privacy amplification which is also not perfect. This means that there will be some nonzero distance between the final strings (composing the shared key) and an ideal classical-classical-quantum state where the eavesdropper is completely decorrelated from the parties. Such a distance is bounded by some target value of the ε secrecy of the protocol, which is further decomposed as ε sec = ε s + ε h , where ε s is a smoothing parameter ε s and ε h is a hashing parameter. Overall, all these imperfections are composed into a single global parameter which is the ε security of the protocol, and given by ε = 2p ec ε pe + ε cor + ε sec [14].
For a Gaussian-modulated coherent-state protocol [42,43] with success probability p ec and ε security against collective (Gaussian) attacks [38], we may write the composable finitesize key rate [14] R where aep := 4log 2 2 √ d + 1 log 2 18 and d is the size of the alphabet after analog-to-digital conversion of the continuous variables of the parties (typically d = 2 5 for a five-bit digitalization).
For the specific case of the heterodyne protocol, one can extend the security to general coherent attacks by combining Eq. . This test is certainly passed for large enough m et and for typical communication conditions with small values of excess noise (as is the case here, so that we certainly haven R = τn T +n n T at the receiver).
Thus the parties achieve the rate [14] R het where the number of key-generation pulses is now and we have set n := 1 + 2 ln(8/ε) 2n + ln(8/ε) The final security here is ε ′ = K 4 n ε/50.
In a practical implementation, the parties exchange many pulses [45], which are split into n b ≫ 1 blocks of suitable size N for data processing; typically, N = O(10 6 )o rm o r e . Assuming that the channel parameters are stable, one can write Eq. (68) for the generic block, i.e., for N = O(10 6 ). The success probability p ec provides the fraction of blocks that are successfully processed into key generation. Under conditions of stability, parameter estimation can be performed in one-go over the entire set of sacrificed pulses mn b , so that the worst-case estimators are expected to be quite close to the actual values. However, if the channel is not stable, but slowing varying with respect to the time-frame associated with a single block, then parameter estimation has to be done block-by-block and the final rate will be averaged over the blocks. In the following, we will assume that parameter estimation is based over the single-block statistics, so that we encompass the possibility of variability.

C. Pilots, post-selection, lattice allocation, and defading
In a fading scenario where the value of the transmissivity τ fluctuates, as is the case of a free-space quantum communication, it is useful to use bright pilot pulses to track τ so as to create a lattice where signals with almost-equal transmissivity are grouped together. Assume that Alice randomly interleaves her signals with m PL pilots. These are prepared in an energetic coherent-state | √n PL e iπ/4 , withn PL mean photons and fixed π/4 phase, so as to provide components for both q and p measurements. The first moments of the pilots follow Eq. (55), where the magnitude of the noise z is negligible with respect to that of √ τ x. As discussed in Ref. [14], they allow to achieve an almost perfect estimation of the instantaneous value of τ .
The high energy regime is easily accessible using 10 nslong pulses from a 100 mW laser source. At λ = 800 nm, each 1 nJ pulse contains an average of x 2 ≃ 4 × 10 9 photons. Such energy can be used for the TLO multiplexed with each signal or pilot. A fraction of this energy, say x 2 ≃ 10 6 photons can be used for the pilots. Considering ≃ 30 dB loss, i.e., τ ≃ 10 −3 , which is the worst-case scenario in the LEO region (reached in uplink with a 2000-km-high satellite at 1 radiant), we have that >10 6 photons are collected for the LO, and about 10 3 for the pilots. The LO is bright enough to allow for shot-noise limited measurements, and the pilots are also bright enough to provide an almost perfect estimation of τ . It is clear that, in the case of an LLO, the LO is even brighter since it is not even attenuated by the transmission.
On the basis of the pilots, Alice and Bob determine a post-selection interval = [η th ,η] where η is the maximum transmissivity and η th = f th η is computed for some fixed f th < 1. As a result, only a fraction p th of the pulses will be post-selected [cf. Eq. (54)]. Within , they introduce a regular lattice of M bins/slots with step δτ = (η − η th )/M and generic bin/slot k = [τ k ,τ k+1 ], with τ k := η th + (k − 1)δτ and k = 1,...,M. The generic slot k is populated with probability p k computed according to Eq. (53), i.e., it is associated with (an integer approximation of) S k := (N − m PL )p k signals and corresponding ν det S k pairs of data points {x i , y k i }. For a sufficiently small step δτ, these points satisfy the inputoutput relation for a Gaussian noise variable z k whose variance σ 2 z (τ k ) = 2n(τ k ) + ν det generally depends on τ k .
Instead of processing each slot independently from the others (with limited statistics), the parties may adopt a defading procedure mapping all the slots into the first one, with minimum transmissivity η th . To the points in slot k ,B o b applies the classical channel where ξ add is a Gaussian variable with variance equal to ν det . By repeating this mapping for all the slots, Bob creates a new variableỹ wherez is non-Gaussian with variance Using the optimality of Gaussian attacks, Alice and Bob assume thatz is Gaussian, thus overestimating Eve's strategy and underestimating their performance. In this way, the entire defading procedure reduces the initial non-Gaussian fading channel into a worst-case thermal-loss Gaussian channel E η th ,n * with fixed minimum transmissivity η th and thermal number equal ton * .

D. Parameter estimation and composable key rate
Once they have reduced the problem to a worst-case thermal loss channel E η th ,n * , Alice and Bob build the worst-case estimators, η ′ th andn ′ * , for the parameters η th andn * associated with the channel, by using m p p th pairs of data points (coming from mp th sacrificed signals). Each of these worst-case estimators is correct up to an error ε pe , related to the confidence parameter w according to Eq. (65)or (66). See also Ref. ([14], Sec. IV.F).
Note that also the threshold transmissivity η th needs to be estimated, even though this is agreed by the parties via the pilots. In this way, in fact, Alice and Bob can detect and account for Eve's potential strategies that are aimed at discriminating signals and pilots, and then applying different interactions. As a matter of fact, any potential error associated with the slot allocation of the signals (due to Eve's action or coarse-graining imperfections) will be detected and accounted by directly estimating η th over the signals ( [14], Sec. IV.E).
Assume the realistic case where signals and pilots undergo the same interaction with the environment, so that the estimation of η th via the signals confirms the threshold value agreed by the parties using the pilots. (As said above, in the potential presence of signal-pilot discrepancies, our general formalism still applies by generating the corresponding worst-estimators from the signals.) Then, the worst-case estimators satisfy the bounds [14] η ′ th η LB := η th − 2w 2η 2 th + η th σ 2 wc /σ 2 n ′ * n UB :=n wc + w σ 2 wc 2m p p th , where σ 2 wc = 2n wc + ν det is the worst-case value for the total thermal noise. This value upper bounds σ 2 z and is computed by takingn wc n(τ ) for any τ ∈ . In order to computen wc , i.e., maximize the thermal noise over the transmissivity, we need to introduce a practical expression for the setup noise (see the next subsection).
Then, the composable key rate is a direct modification of Eq. (68) and takes the form [14] R with n = N − (m + m PL ) and security ε = 2p ec ε pe + ε cor + ε sec against collective (Gaussian) attacks.
For the heterodyne version of the protocol, we can again extend the security from collective to general attacks by performing a similar modification as in Eq. (71). In this case, the secret-key rate becomes [14] R het where K n is given in Eq. (73) and the total number of keygeneration pulses is now given by Final security is equal to ε ′ = K 4 np th ε/50.

E. Setup noise and observations about the LO
The setup noisen ex strictly depends on what type of LO is used. In fact, in the case of a TLO, there is no phase error, but the electronic noise of the detector becomes nontrivial due to the attenuation that the LO undergoes during its transmission. By contrast, in the case of an LLO, the electronic noise is lower due to the fact that the LO is always bright, independently from the transmissivity; however, there will be some nontrivial phase noise that comes from the imperfect digital reconstruction of the rotating reference frame at the receiver.
The electronic noise can be described by an additive Gaussian channel with associated variance ν el or equivalent number of photonsn el = ν el /2. Its value depends on various quantities, namely the noise equivalent power (NEP) of the amplifiers/photodiodes in the homodyne detectors, the detection bandwidth W , the duration of the LO pulses t LO ,theLO power at the detector P det LO , and the frequency of the light ν.Let us consider the power P LO at which the LO is generated, so that we have P det LO = τ P LO for the TLO and P det LO = P LO for the LLO. Then, let us introduce the parameter (see also Ref. [14]) In our notation, we may writē For a detector with bandwidth W = 100 MHz, we may consider NEP = 6pW/ √ Hz. Then, let us take an LO power P LO = 100 mW. At 800 nm and using LO pulses of duration t LO = 10ns, we get el ≃ 1.45 × 10 −3 for the case of an heterodyne setup (ν det = 2). It is clear the advantage of the LLO in reducing the electronic noise.
Such a reduction of the electronic noise induced by the LLO comes at the price of introducing phase errors. In our notation, we quantify this contribution as follows: where C is the clock of the system and l W is the laser linewidth [14]. In our investigations we have σ 2 x 10 and C = 10 MHz, so a low valuen LLO phase can be reached with a linewidth l W ≃ 1.6 KHz.
Overall, we have that the setup noise for the TLO and LLO takes the following expressions: where we see the different monotonic behavior of these quantities versus the transmissivity τ . In particular, the TLO seems to be preferable for short distances (high values of τ ), while the LLO is better for long distances (low value of τ ). See also Fig. 5.
In order to maximizen ex over the post-selection interval , we therefore computen TLO ex (τ ) at the minimum border value τ = η th , andn LLO ex (τ ) at the maximum border value τ = η. Thus the worst-case value for the setup noise will be given byn wc = η effnB +n ex,wc , where we have set n TLO ex,wc = el /η th ,n LLO ex,wc = el + As already mentioned, an LLO is more convenient for long-distance quantum communications (low values of the transmissivity). In fact, in such a case, the associated phase error decreases to zero, and the total setup noise tends to the constant term el . For this reason, in the following we specifically investigate the performances achievable with an LLO, but we stress that both approaches of TLO and LLO are encompassed by our theory. We also stress that an LLO requires a more sophisticated hardware than that needed by a TLO.
As already mentioned in Sec. II F 1, an important aspect in the use of an LLO is that each pulse (signal or pilot) must be transmitted in the middle of two reference pulses, so that there is a regular interleaving between these bright references and all the other pulses. From the detection of the references, Bob reconstructs Alice's rotating frame and therefore suitably rotates the outcomes he has obtained from the measurements of the signals and the pilots (for which a locally generated LO was employed for the homodyne/heterodyne detection). It is clear that, in this process, the free-space link is half of the time used by the phase-synchronizing references. This means that, in terms of actual throughput (bits/second), there is a factor of 1/2 to account for the LLO. However, it is also true that such a time-multiplexing of the LO enables Alice to use both polarizations for the transmission of the signals, which therefore leads to a compensation of the 1/2 extra factor. We assume this scenario.

F. Key rate analysis with orbital dynamics
With all the ingredients in our hands, we now study the numerical behavior of the composable key rate, accounting not only for the fading process but also for the variability associated with the orbital dynamics of the satellite. In fact, there are two basic reasons why the channel is not stable in satellite communications: One is the inevitable fading process affecting the free-space transmission, which occurs even when the satellite is assumed to be 'frozen' at some fixed altitude and zenith angle; the other is the temporal variation of the zenith angle (and altitude) due to the specific orbit. Even if we assume the satellite to be at some fixed (or approximately fixed) altitude, the variation of the zenith angle is inevitable for all orbits in the LEO and MEO regions.
Assume that the satellite is on an orbit with a constant altitude h, which is an assumption valid for polar orbits and approximately valid for sun-synchronous orbits. Then, during the quantum communication of a block of size N, the satellite performs a corresponding slice of its orbit, spanning a range of different zenith angles. The angular size of this slice depends on various factors, including the clock of the system C and the speed of the satellite (which depends on its altitude h). As a result, we have that the value of the maximum transmissivity η (and that of the threshold transmissivity η th ) sensibly changes during the quantum communication. It is clear that this problem also affects the thermal noisen, due to the general dependence of the setup noisen ex on the instantaneous transmissivity.
There are various strategies to deal with this situation. One strategy is to minimize η LB and maximizen UB over the slice, and then use these values to lower bound the achievable key rate (for an LLO, one could also use a constant maximum value ofn UB , as computed at the Kármán line or at the lower LEO boundary). Another method, which is more practical, is to directly minimize the key rate over the orbital slice. Under typical conditions, the fixed-geometry rate R(h,θ) decreases for increasing θ , i.e., from the zenith towards the horizon. For this reason, we can lower bound the actual rate by taking the value of R(h,θ) at the largest zenith angle θ (for any fixed altitude h). In particular, assume that the slice associated with the block has zenith angles θ 1. We can therefore lower bound the key rate by taking the value R(h,θ = 1). We call this the "one-radiant" key rate [46]. Let us analyze the one-radiant key rates that are achievable by a pilot-guided post-selected heterodyne protocol with LLO at various satellite altitudes for the various configurations. In particular, we choose the protocol parameters specified in Table V. We assume a 1% quota for the pilots [47]. The values of the input modulation μ (i.e.,n T ) and the threshold transmissivity f th (i.e., η th ) are implicitly optimized at each altitude. This is the case for rates under collective attacks (plotted for each configuration). For the study of the general attacks (only done in the best configuration of night-time downlink), we have made the sub-optimal choices of μ = 7 and f th = 0.75. Also note that the security ε ′ versus general attacks depends on the altitude; its maximum value shown in Table V is achieved for the minimum altitude of h = 100 km.
Then, we follow all the physical parameters and theoretical models considered so far, explicitly listed in Table VI. However, we allow for the possibilities of different setups on the basis of the spot-size w 0 and receiver aperture a R . With setup 1, we reproduce the physical conditions adopted for the study of the ultimate bounds presented in Fig. 3 (under the assumption of a narrow filter λ = 0.1pm). The other setups offer a more generous hardware that allows us to improve the key rates in the various configurations.
In Fig. 6, we show the performances that are achievable in downlink with setup 1, which clearly improve when the better setup 2 is considered, with positive key rates in the LEO region. By contrast, we need to assume the expensive setup 3 for enabling uplink, whose key rates appear to be restricted to the sub-LEO region (between 100 and 160 km). Note that, thanks to the narrow homodyne filter, we may achieve positive Eqs. (42)and (43) key rates for day-time operation. In particular, in downlink, the suppression of the background is such that the day-time rate coincides with the night-time rate. For uplink, there is still a gap though, which is due to the effects of the ground-level turbulence on the beam. These effects reduce the transmissivity and are higher during the day. According to our investigation, all the configurations allow for secure quantum communications with a satellite in the LEO/sub-LEO region, even though with different hardware requirements. The homodyne filter largely suppresses the background noise, paving the way for day-light implementations under various weather conditions.

G. Orbital slicing
The one-radiant key rates are pessimistic estimates of what we can actually achieve with a satellite orbiting at an approximately constant altitude. For this reason, we now consider a more accurate treatment where we explicitly account for the fact that different blocks of data correspond to different slices of the orbit within the one-radiant sector. For each slice we consider the corresponding minimum rate, which is achieved at the largest zenith angle along that particular slice. The overall orbital rate is given by an average over the slices.
Before presenting the improved results, we need to make some preliminary considerations about an ideal modus operandi for the ground-satellite link.
In fact, we identify the following ideal conditions. (i) The transit time of the satellite should allow the parties to distribute many quantum data points. (ii) There should be additional time for classical communication and data-processing, in such a way that a secret key is generated before the end of the fly by.
(iii) There should be time for an encrypted communication, exploiting part of the key already distributed.
To satisfy these ideal conditions, it is better to have a satellite that is able to reach small zenith angles. Clearly, an optimal solution is a satellite crossing the zenith point above the ground station (zenith-crossing orbit). For simplicity, assume that its orbit is circular, with constant radius R S = R E + h from the center of the Earth. Examples of circular orbits are polar and near-polar sun-synchronous orbits.
For a zenith-crossing orbit, it is useful to introduce a sign for the zenith angle θ , so that a negative θ corresponds to the zenith angle with respect to a satellite which is arising from the "front" horizon and moving towards the zenith, while a positive θ corresponds to a satellite that has passed the zenith point and it is descending towards the "back" horizon (see Fig. 7).
For a zenith-crossing circular orbit, the slant distance z = z(R S ,α) can be expressed as z(R S ,α) = R 2 E + R 2 S − 2R E R S cos α in terms of R S = R E + h and the orbital angle α (which may also be negative). See also Eq. (A7) and Fig. 12 in Appendix A. Then, we may write the orbital period (in seconds) where μ G = GM E is the standard gravitational parameter, with G = 6.674 × 10 −11 Nm 2 kg −2 being the gravitational constant and M E ≃ 5.972 × 10 24 kg the approximate Earth's mass. As a result, the orbital angle α varies over time t Orbital sectors for a zenith-crossing circular orbit. Zenith angle θ has an associated sign and we identify the front and the back horizons. Quantum communication occurs within the (green) good sector associated with the angular window −1 θ 1 (where the angle is negative on the left, i.e., for a rising satellite). There is a transit time t Q associated with this sector. Total transit time t T is associated with the entire flyby from the front to the back horizon. The right blue sector 1 <θ <π/2 can be used for data processing and key generation. The left blue sector −π/2 <θ <−1 can be used for encrypted communication using a previously generated key (e.g., the satellite may download the key exchanged with another station). In practical scenarios, the satellite is not tracked within 5 • − 10 • of the horizon (depending on the urban setting etc.). In other words, there is an effective "mask" angle θ m (or minimum acceptable elevation above the horizon) for the satellite. In the text, we assume θ m = 10 • .
according to the law where we have implicitly set α = 0 (satellite at the zenith) for t = 0. Correspondingly, the time-varying zenith angle θ = θ (t, h) can be computed from We can divide the orbit in different sectors as depicted in Fig. 7. Assuming that the quantum communication occurs within 1 radiant from the zenith (good sector), we compute a corresponding quantum transit time t Q . Within |θ | π/2, we may certainly invert θ = θ (t, h)i n t ot = t (θ,h). In fact, we may write data points for the heterodyne protocol), we have 20 blocks distributed within the one-radiant window of each passage. Since we assume that the protocol runs with an LLO, we also assume that both polarizations are used for the signals (so that we compensate for the time multiplexing associated with the transmission of the reference pulses). Thus condition (i) above can be met.
In order to realize condition (ii), we exploit the orbital sector after the one-radiant window (see Fig. 7) where a 530 km satellite spends (t T − t Q )/2 ≃ 258 seconds. In particular, accounting for the mask angle θ m = 10 • ,w eh a v e that the satellite is visible for (t E − t Q )/2 ≃ 131 seconds. During this time, the parties can implement the classical procedures of error correction and privacy amplification, e.g., using the high-speed methods of Refs. [48,49]. Ideally, by using optimal LDPC codes over a 1GHz GPU, the processing of ≃ 2 × 10 9 data points may take ≃ 120 seconds [45,50]. Such performances for data processing require an highly performant computing hardware. High speed data processing is achievable because of the relatively high signal-to-noise ratio (so that the number of iterations for syndrome extraction in the error correcting procedure is low). As a matter of fact, for downlink from about 500 km, the total loss is less than 10 dB. Note that there is also a latency time in communications with the satellite, of the order of 1.6 ms at that altitude. However, because the procedures can be implemented with limited sessions of one-way CC, this is negligible.
Finally, there is the condition (iii) which is about having enough time for an encrypted communication between the satellite and the ground station. This session can be used for authentication and/or for downloading the key of another ground station via one-time pad. This step can be implemented during the first sector of the orbit, i.e., at zenith angles −π/2 <θ<−1. In the basic scenario of Fig. 7, this phase is symmetric to that discussed above and the satellite is visible for about 131 seconds, clearly sufficient for the encrypted communication.
Let us now slice the good sector for quantum communication (−1 θ 1) for a zenith-crossing circular orbit. Assume that n bks blocks are transmitted during the flyby. Dividing the quantum transit time t Q by n bks , we get the time δt that is needed for each block to be transmitted. These time  Table V where R(θ )i st h eθ -dependent key rate for the considered altitude. Thus the average orbital rate is equal to where the bound R 1-rad := max{0, R(θ =±1)} is the rate associated with the border values (considered in the previous subsection and Fig. 6). As previously said, for a zenith-crossing circular orbit at h = 530 km, the quantum transit time is about 200 seconds. Therefore we may consider n bks = 20 blocks, where each block of size N = 10 8 corresponds to a transmission time of δt = 10 seconds for a C = 10 MHz clock. This configuration identifies angular slices that are shown in Fig. 9 together with the rate R(θ )ofEq. (82) specified for night-time and day-time downlink. For the angle-dependent rate R(θ ), we assume the protocol parameters in Table V  Here "per use" means per use of the quantum communication channel, occurring within 1 radiant. When we plug a clock C = 10 MHz, we have a rate of R down orb ≃ 307 kbits/s during night time, and R down orb ≃ 304 kbits/s during day time. Accounting for the time of the quantum communication (200 s), each night-time zenith-crossing passage distributes ≃ 6.13 × 10 7 secret bits, while a day-time zenith-crossing passage distributes ≃ 6.08 × 10 7 secret bits. Considering that, within 24 hours, there will also be non-zenith-crossing passages (exploitable for QKD), the above estimates lowerbound the number of bits that can be distributed per day via nightand day-time operation. (Alternatively, in a less-performant hardware, the other passages can be used for data processing by the parties).
Now consider uplink to a satellite in the sub-LEO region. We take h = 103 km, just after the Kármán line. As we have already mentioned, the main reason for the inferior performance in uplink is the nontrivial effect of the atmospheric turbulence, with bigger impact during the day. We consider the rate R(θ )o fE q . ( 82) for the case of a pilotguided post-selected heterodyne protocol with LLO, specified for night-time and day-time uplink. We assume the protocol parameters given in Table V for collective attacks, and the physical parameters in Table VI,w h e r ew ea s s u m et h em o r e demanding setup 3. The values for the modulation μ and the threshold f th are chosen to maximize the lowest rate (R 1-rad ). In particular, we choose μ = 6.5 and f th = 0.74.
Because of the lower altitude, we have a total transit time of just t T ≃ 295 s, an effective transit time of t E ≃ 123 s, and a quantum transit time of t Q ≃ 40 s. The latter allows the parties to distribute 4 blocks of size 10 8 with a clock of C = 10 MHz (and these blocks may be data-processed in ≃ 24 s, which is enough for the last sector of the orbit by assuming highly performant error-correcting codes). The orbital slices associated with the 10 s-long blocks are (99) Both the rate R(θ ) and the slices are shown in Fig. 10.
Using Eqs. (82) and (99) According to our analysis, it is indeed feasible to use CV-QKD protocols to distribute keys with a satellite orbiting in the LEO/sub-LEO region, accounting not only for the fading process due to turbulence and pointing errors, but also for the fast orbital dynamics (which creates additional problems for the transmission of reasonably large block sizes). Our analysis This is plotted versus the zenith angle θ for uplink to a satellite which is in a zenith-crossing circular orbit at h = 103 km. We plot the performance for night (solid) and day (dashed) time. Parameters are specified in Table V for collective attacks, and Table VI for setup 3. In particular, we choose μ = 6.5a n d f th = 0.74. Besides the rates we show the angular lattice generated by the slices of Eq. (99).
shows this possibility not only for the best-considered scenario of night-time downlink, but also for day-time downlink and for the more challenging scenarios of night-and day-time uplink.

H. Satellites versus ground-based repeaters
Once we have computed the secret key rates that are achievable in the most relevant configurations for satellite and ground station, we now show that satellite quantum communications are able to provide a nontrivial advantage with respect to the use of quantum repeaters on the ground, when the aim is to connect two remote end-users that are sufficiently far apart on Earth's surface.
An example of circular orbit is a polar orbit, i.e., with orbital inclination ι = 90 • . However, a more practical scenario is considering a near-polar satellite in sun-synchronous orbit (which is approximately circular). This type of orbit guarantees that the satellite passes over any point on Earth's surface at the same local mean solar time. This clearly implies the possibility of stable conditions for night-time or day-time operation, so that the quantum communication with the satellite occurs at roughly the same time of the night or the day.
For a sun-synchronous satellite at altitude h, the orbital inclination is given by where h 5980 is expressed in km. At h = 530 km, this corresponds to ι ≃ 97.5 • . Because the orbital period is T S ≃ 95 minutes, the satellite performs 15 orbits a day, before returning above the initial point. Note that the Micius satellite is sun-synchronous with ι ≃ 97.4 • and with altitude between 488 and 584 km. At h = 103 km, we have ι ≃ 96 • , T S ≃ 86 minutes and 16 orbits a day. Assume that two ground stations are along the orbital path, so that the satellite crosses both their zenith positions, which happens once per day. We assume the worst-case scenario in which the stations interact with the satellite only during the sections of the orbit where the zenith positions are crossed (of course this assumption can be relaxed and the ground stations could also use other passages that are not zenith-crossing). Also assume that the stations are in similar operational conditions, so that we can simultaneously adopt the results for night time or day time for both of them. Finally, assume that the satellite may have the option to communicate with two stations simultaneously (e.g., using two quantum transmitters or receivers); this is assumed to address the particular case where the stations are close, so that the satellite appears within their one-radiant angular windows roughly at the same time (clearly this is not the case for very distant ground stations).
Start with the satellite at the zenith of the first station (t = 0) and assume that it reaches the zenith of the second station after time t.F o r t T S /2, the distance between the two stations is equal to wherewehaveusedEq.(92) and accounted for Earth's curvature. Then, assume that the two stations are also connected by an optical fiber with standard loss rate of α fib = 0.2dB/km, so that we have a total fiber transmissivity of η fib = 10 −α fib d st /10 . The maximum fiber-based repeater-less rate (bits per use) is given by the PLOB bound R fib =−log 2 (1 − η fib ) [ 12]. Multiplying by the clock C = 10 MHz and the number of seconds in one day # day ≃ 8.6 × 10 4 , we may compute the maximum number of secret bits that can the distributed in one day CR fib # day as a function of the station-to-station ground distance. We also assume the situation where a number N rep 1 of ideal repeaters are inserted along the fiber line, so that we have the fiber-based rate becomes R rep fib =−log 2 (1 − Nrep +1 √ η fib ) [16]. We have a corresponding number of secret bits CR rep fib # day per day. In Fig. 11, we consider the maximum number of secret bits per day (versus ground distance) that can be distributed by a repeaterless fiber link between the stations and also by fiber links assisted by ideal quantum repeaters. Assuming the same clock, we compare these ground-based performances with the secret-bits per day that can be distributed by using a satellite moving between the two stations, the latter operating in the same way with respect to the satellite, i.e., via night/day-time downlink [Eq. (98)] or night/day-time uplink [Eq. (100)].
We can see how a satellite can beat the fiber-based repeaterless bound when the stations are separated by more than 215 km, and how it can achieve the same rate of 30 ideal quantum repeaters when the station-to-station ground separation is about 6675 km. This performance is achievable in downlink no matter if during the day or the night (solid red line in Fig. 11). As expected, in uplink, the performances are worse than downlink (despite the better setup). That being said, via uplink to the satellite, the remote users are still able to beat ground chains of quantum repeaters after similar distances.

IV. CONCLUSIONS
In this work, we have established the ultimate limits and the practical rates that can be achieved in secure quantum communications with satellites, assuming various configurations (downlink/uplink) and operational settings (night or day time). While our study is based on ideas and tools developed in Ref. [14] for free-space quantum communications, it also required a number of nontrivial generalizations in order to account for the slant propagation at variable altitudes and beyond the atmosphere. As a matter of fact, the underlying physical models for atmospheric turbulence and background noise have crucial differences with respect to the models adopted for free-space communications on the ground.
We have started our work by establishing informationtheoretic upper limits to the maximum number of secret bits (and ebits) that can be achieved per use of the satellite link in all scenarios. Our theoretical analysis considers all relevant effects, as due to diffraction, atmospheric extinction, limited efficiency, pointing error, turbulence, thermal background, and setup noise.
In uplink, turbulence is very important because it affects the beam close to the transmitter where the spot size is small. In this case, both pointing error and turbulence effects must be accounted for. By contrast, in downlink, the spot size is already very large when it enters the atmosphere, compared to the typical size of the turbulent eddies. For this reason, turbulence is negligible and the only relevant effect is the pointing error.
A further asymmetry is introduced by the background noise that is induced by sky brightness and planetary albedos (Moon and Earth), even though this background can be greatly suppressed by using narrow frequency filters. Such filters are indeed created by the interferometric process occurring in homodyne-like setups where the signals are mode-matched with a strong local oscillator.
For all configurations, we have studied the numerical behavior of the ultimate key rates when the satellite is at the zenith position or at 1 radiant from the zenith, showing that a large range of altitudes are possible for secure key generation (and entanglement distribution) when we adopt optimal protocols. For the same configurations, we have then studied secret key rates that are achievable in practice by accounting for finite-size effects and composable security. Our analysis therefore addresses the problem of block size, which is particularly relevant for satellite quantum communications (see also Ref. [51] for the setting of discrete-variable QKD).
In our paper, the use of a pilot-guided post-selected heterodyne protocol, combined with a careful consideration for the orbital dynamics, enables the implementation of CV-QKD between station and satellite in all configurations of night-time downlink/uplink and day-time downlink/uplink. It is interesting that all these scenarios represent indeed a viable option for secure quantum communications, whereas only the setting of night-time downlink has been considered in other works [52].
As a further analysis beyond this work, it would be interesting to compare the QKD rates that are achievable by CV protocols with those of discrete-variable protocols in the various configurations of communication with the satellite. Since discrete-variable QKD is more robust for long-distance implementations on the ground, we would expect this approach to be particularly suitable for the far-LEO and MEO regions. By contrast, CV-QKD is generally better for high-rate implementations at shorter ground distances, so it appears an approach specifically suitable for the LEO and sub-LEO regions.
Finally, we have shown that a sun-synchronous satellite, exchanging keys with ground stations, is able to distribute more secret bits per day than a direct fiber-connection between the stations, even if the latter communicate at the ultimate PLOB bound. Remarkably, the satellite is also able to outperform a chain of many ideal quantum repeaters operating between the remote stations. These results are obtained when the distance between the remote stations surpasses certain thresholds, which depend on the hardware available for the satellite together with the adopted configuration (downlink/uplink) and operational setting (night/day time).

ACKNOWLEDGMENTS
The author acknowledges funding from the European Union's Horizon 2020 research and innovation programme under grant agreement No. 820466 (Quantum-Flagship Project CiViQ: "Continuous Variable Quantum Communications").

APPENDIX A: BASIC GEOMETRY FOR SATELLITE COMMUNICATIONS
Here we discuss some geometrical elements about communications with satellites. The slant distance z between a sea-level ground station and a satellite can be connected with other two important parameters. The first one is the (positive) zenith angle θ which is defined as the angle between the vertical direction (zenith) and the pointing direction from the ground station to the satellite. The second one is the altitude 12. Basic geometry for satellite communications. A satellite (S) is at slant distance z from a sea-level ground station (G). The satellite is at zenith angle θ and altitude h over the Earth's surface. Clearly, z = h only at the zenith (θ = 0). The satellite is also at the orbital angle α and orbital radius R S = h + R E ,whereR E is the radius of the Earth. Note that OQ = R E + QG = OS cos α leads to (1) R E + z cos θ = R S cos α. Now, from QS have (2) z sin θ = R S sin α.B y taking the squared in (1) and (2) and using cos 2 α = 1 − sin 2 α,w e derive h 2 + 2R E h − z(z + 2R E cos θ ) = 0 whose positive solution gives Eq. (A1). In a similar way, one can use cos 2 θ = 1 − sin 2 θ and derive Eq. (A7).
h of the satellite, which is defined as the distance from the satellite to the ground (sea-level) orthogonally to the surface of the Earth. Slant distance z, altitude h, and positive zenith angle θ ∈ [0,π/2] can be easily connected by means of simple trigonometric observations. (Note that the following geometric formulas do not change if we include a sign in the zenith angle, so that θ ∈ [−π/2,π/2], as considered for the study with the zenith-crossing orbit in the main text).
It is easy to express the altitude h as a function of z and θ . A simple trigonometric calculus provides where R E ≃ 6371 km is the approximate radius of the Earth (see Fig. 12). In particular, at small angles θ ≃ 0, we can write the simplified "flat-Earth" approximation For θ 1 and relatively small h (of the order of the atmospheric thickness, i.e., 20 km), one finds that h ≃ z cos θ and z ≃ h sec θ represent excellent approximations. It is easy to see that Eq. (A1) can be inverted into which gives the zenith angle θ in terms of z and h (see also Ref. ([53], Ch. 13)). Similarly, the slant range z can be expressed as a simple function of h and θ , i.e., we may write the slant distance functional (see also Ref. [22]) Note that z(h,θ) h sec θ for any h and θ ∈ [0,π/2]. It is easy to verify that the previous formulas can immediately be generalized to the scenario where the ground station is located at some nonzero altitude h 0 . Setting R G := R E + h 0 and R S = R E + h, we may in fact write Another parametrization is in terms of orbital radius R S and the orbital angle α, i.e., the angle between the position of the ground station and the position of the satellite as seen from the center of the Earth. It is immediate to see that This parametrization is useful for circular orbits, where R S is constant. In this case, we can write α = 2πt/T S , where t is time and T S is the orbital period, i.e., the time needed for a complete revolution around the Earth.

APPENDIX B: REFRACTION EFFECTS
In a more refined description, we need to consider atmospheric refraction. Assuming the atmosphere to be modeled as a set of thin uniform slabs provides the same result of an atmosphere modeled as a single uniform slab with surface refractive index n 0 ( [53], Ch. 13, Fig. 13.4). Therefore atmospheric refraction creates an apparent zenith angle θ app satisfying Snell's law where n 0 ≃ 1.00027 is the surface value of the refractive index. We see that the angle of refraction θ := θ − θ app exceeds one degree when the satellite is at the horizon, where θ = π/2 corresponds to θ max app ≃ 1.548 (≃ 88.7 • ). Besides the apparent angle, refraction also increases the optical path by an elongation factor ε elo = ε elo (θ app ).
Replacing θ = θ (θ app ):= arcsin(n 0 sin θ app )inz(h,θ) and multiplying by ε elo , one gets the refracted slant range as a function of the altitude h and the apparent angle θ app . Replacing θ = θ (θ app ) and z = z ref /ε elo (θ app )i nh(z,θ), we get the altitude in terms of the refracted parameters, i.e., With these modifications in hand, we can formulate the refracted version of the atmospheric extinction in Eq. (10)ofthe main text. We need to integrate α(h) = α 0 exp(−h/h) (with α 0 andh given in the main text) using the modified expression for the slant distance Correspondingly, we can modify the bound in Eq. (15)ofthe main text to account for refraction. We obtain (B6) For low transmissivity, which is certainly the case in the far field regime z ≫ z R , we can approximate In Fig. 13, we investigate the effects of refraction on the channel loss. For typical parameters, we see that refraction is negligible within ≃ 1 radiant from the zenith, while it becomes more and more relevant in the proximity of the horizon. For a sea-level ground station communicating with a satellite at h = 780 km and apparent zenith angle θ max app , we compute η ref atm ≃ 7.1dB from Eq. (B4) instead of η atm ≃ 3.4d Bf r o m Eq. (10) of the main text (setting θ = θ max app ). This discrepancy leads to differences between B and its refraction-based version B ref for large angles, i.e., close to the horizon.
Finally, it is worth mentioning that the formula in Eq. (B6) can also be applied to the case where the ground station is at some non-negligible altitude h 0 . In fact, it is sufficient to use Eqs. (A5) and (A6) in all the previous expressions that lead to Eq. (B6).

Weak turbulence
Atmospheric turbulence leads different treatments depending on its strength. From a physical point of view, turbulence effects are due to eddies affecting the traveling beam. In a regime of weak turbulence, one can clearly distinguish the action of small and large turbulent eddies. Those smaller than the beam waist tend to broaden the beam (on a fast time scale), while those larger than the beam waist tend to deflect the beam, randomly but on a slower time scale [28]. As a result, the broadening of the beam can be decomposed into a sum of two contributions, the short-term spot size w 2 st plus the random wandering of the beam centroid with variance σ 2 TB , so that there is a long-term spot size ( [28], Eq. (32)) The slower time scale is of the order of 10-100 ms [29], which means that this dynamics can be resolved by a fast-enough detector.
For long-distance communication, if turbulence becomes stronger, the motion of the centroid becomes negligible (σ 2 TB ≃ 0). At some point, strong beam deformation comes into place as a major effect, and the beam will eventually break up in multiple patches [28,54].
The first step is therefore the correct characterization of the relevant regime of turbulence, which requires the introduction of parameters from the theory of optical propagation through turbulent media. The most important of these parameters is the refraction index structure constant C 2 n [32,55], since this is at the basis of the others and, in particular, the scintillation index [32], that characterizes the strength of turbulence, and the spherical-wave coherence length [28], that directly enters in the expressions of the spot sizes of Eq. (C1).

Refraction index structure constant
The structure constant C 2 n measures the strength of the fluctuations in the refraction index, due to spatial variations of temperature and pressure. We need to consider an adequate model for the structure constant C 2 n (h), so that this quantity can be suitably averaged over different altitudes for up-and down-link communication.
Assuming the Hufnagel-Valley (H-V) model of atmospheric turbulence [30,31], the structure constant reads where h > 0 is expressed in meters, v is the windspeed (m/s) and A is the nominal value of C 2 n (0) at the ground in units m −2/3 (MKS units are implicitly assumed in all these formulas). These parameters depend on the atmospheric conditions and the time of the day.
Similarly to Ref. [29], one can assume the typical nighttime value A = 1.7 × 10 −14 m −2/3 and low-wind v = 21 m/s [56]. This is also known as the H-V 5/7 model ( [32], Sec. 12.2.1). However, during the day, parameter A can be of the order of 2.75 × 10 −14 m −2/3 [57] and, for high-wind conditions, v can be of the order of v = 57 m/s [23]. In our work, we adopt H-V 5/7 as night-time model, and H-V with parameters A = 2.75 × 10 −14 m −2/3 and v = 21 m/s as day-time model. Finally, we may also consider H-V with parameters A = 2.75 × 10 −14 m −2/3 and v = 57 m/s as the worst-case day-time model.
It is important to remark that there are other models for C 2 n (h). These include the VanZandt model [58], with a simplified version proposed by Dewan et al. [59], and the Walters and Kunkel model [60]. For instance, they have been used in Ref. ([22], Appendix D). These other approaches and the H-V model are in good agreement with thermosonde data in Ref. [61](seealsoRef.( [22], Fig. 13)). Here we also consider a simplified version of this model, as originally proposed by Hufnagel and Stanley ([30], Fig. 6). This is given by ( [62], Eq. (3.1)) In Fig. 14, we show the H-V model of Eq. (C2) and the simplified Hufnagel-Stanley model in Eq. (C3) which are in good agreement. We can see that, at higher altitudes, C 2 n starts to decrease exponentially. As a matter of fact, it can be considered to be negligible beyond h max ≃ 20 km. This altitude corresponds to the upper edge of the tropopause, below which most of the mass of the atmosphere is contained. Taking h max as effective thickness of the atmosphere can also be justified by the following argument. Let us treat the atmosphere as a single layer of thickness h and structure constant given by the averageC computed according to the standard H-V 5/7 model. From Fig. 14, we can see how this quantity exponentially departs from the previous models after 15 km. At ≃ 20 km, the difference is about two orders of magnitude.
For a satellite at altitude h and zenith angle θ 1 communicating with a sea-level ground station, the effective section of the atmosphere which is crossed by the beam is given by z atm (θ ) = z(h max ,θ) using the slant functional in Eq. (A4). At one radiant, we have z atm (1) ≃ 37 km, which is of the same order of magnitude of h max . For larger angles, refraction comes into place and one needs to use the elongated slant distance in Eq. (B2). At the horizon, the section becomes large even neglecting the elongation by refraction. In fact, we have z atm (π/2) = h 2 max + 2h max R E ≃ 505 km. still remains reasonably small over the receiver's aperture if this is not too large (condition which is typically satisfied at the satellite). Under the assumption of weak fluctuations, one can use Rytov approximation for the beam field [70], together with the Kolmogorov power-law spectrum [71], and develop a simple formalism for the theory of turbulence.
In a weak-fluctuation theory, the longitudinal scintillation index σ 2 L := σ 2 I (z, 0) can be easily written for both downlink and uplink. For a downlink path from a satellite at altitude h and zenith angle θ 1, this index equals the Rytov variance for a plane wave σ 2 R,plane , i.e. [32,69]  Note that, if we impose C 2 n to be constant in the integral of Eq (C15), then σ 2 Rytov becomes 1.23C 2 n k 7/6 z 11/6 , which is the expression for the Rytov variance that is valid for fixedaltitude z-long propagation.
For an uplink path, we may instead write [72] As noted in Ref. [69], one can approximateμ(h) ≃ μ(h), implying σ 2 L,up ≃ σ 2 Rytov also for uplink. For these reasons the Rytov variance for a plane wave in Eq. (C14) can be used as a measure of the scintillation (in the weak fluctuation regime) and, most importantly, as a parameter to check if the condition of weak turbulence is indeed satisfied, corresponding to σ 2 Rytov < 1. As we can see from Fig. 15, the value of the Rytov variance quickly saturates within the atmosphere and its values are below unity for zenith angles within 1 radiant. It is easy to check that the Rytov variance exceeds 1 for larger zenith angles; for instance, at h = 20 km, we have that σ 2 Rytov > 1forθ 1.2, i.e., beyond 69 • . One can also check that, if we assume not typical but worst-case day-time parameters for the H-V model (i.e., high-wind conditions, see Appendix C2), the Rytov variance tends to values that are below the unity at the zenith (≃ 0.6), but quickly violate the unity for increasing zenith angle, e.g., ≃ 2 already at θ = 1.

Coherence length
Once we have clarified the working regime of weak turbulence, we introduce the spherical-wave coherence length ρ 0 , which directly enters in the explicit expressions of the spot sizes of Eq. (C1). This is related to the well known Fried's parameter r F [62,73], that can be written as r F = 2.088ρ 0 [33], and describes the transverse spatial separation at the receiver over which the field phase correlations decay by 1/e.A tt h e optical frequencies, typical values of ρ 0 or r F are in cm. When this value is particularly large, e.g., of the order of meters, then the effects of turbulence are completely negligible from the point of view of the receiver. In this regard, we will see a stark difference between uplink and downlink.
For wavenumber k and propagation distance z,t h e spherical-wave coherence length is given by ( [28], Eq. (38)) where the explicit functional dependence of C 2 n (ξ ) needs to be specified and depends on the type of propagation. For free-space propagation at a fixed altitude, the value of C 2 n is constant and we have the simple form For uplink communications where the altitude h increases with the beam propagation, we assume the H-V 5/7 model for C 2 n (h) and we write ρ 0 in terms of the slant distance z and the zenith angle θ , by replacing I 0 (z) with the following integral: where h(z,θ)isgiveninEq.(A1). For downlink, the altitude decreases with the propagation. This is accounted by replacing ξ → z − ξ in the structure constant, so we replace I 0 (z) with the following integral: In downlink, the term (1 − ξ/z) 5/3 goes to zero in the region where C 2 n has the higher values (close to the ground). For this reason, the downlink coherence length ρ down 0 becomes large very quickly, for any object beyond the tropopause (≃ 20 km). For instance, consider an object at the slant distance of z = 100 km sending down a beam with wavelength λ = 800 nm. We compute ρ down 0 ≃ 1.8m at the zenith (compared to the uplink value ρ up 0 ≃ 4.2 cm) and ρ down 0 ≃ 68 cm at θ = 1 (compared to ≃ 2.9 cm in uplink). At λ = 1 μm, we compute ρ down 0 ≃ 2.4 m at the zenith, and ρ down 0 ≃ 0.9matθ = 1. Note that these values increase both in distance z and wavelength. In particular, one has ρ 0 ∝ λ 6/5 . It is clear that, within 1 radiant from the zenith (weak scintillation regime), the effect of the atmospheric turbulence is practically negligible in downlink paths. More precisely, this is true as long as the receiver's aperture a R does not become too large (e.g., of the order of 2 meters). In fact, recall that the number of turbulence-induced short-term speckles from a point source is of the order of N s = 1 + (a R /ρ 0 ) 2 [32]. Assuming a R = 40 cm and an object at altitude h = 100 km communicating at λ = 800 nm, we compute N s ≃ 1.05 at the zenith and ≃ 1.35 at θ = 1 radiant. These values are very close to the perfect coherent limit (N s = 1).
Then, consider an increased aperture a R = 1 m and a satellite in the LEO region, so that h 160 km, we compute N s 1.11 at the zenith and 1.82 at θ = 1 radiant. In particular, for a satellite at h = 530 km (as the one studied in the main text), we get N s 1.01 at the zenith and 1.07 at θ = 1 radiant. For these reasons, turbulence-induced beam spreading and wandering are negligible in downlink. This means that long-and short-term spot sizes are both equal to the diffraction-limited spot size, i.e., we can set w lt ≃ w st ≃ w d .
For uplink the situation is completely different, and turbulence effects cannot be neglected even at the zenith position. Before proceeding further, it is important to note some simplifications which can be enforced for zenith angles θ 1 (that are useful for the spot sizes in uplink discussed in the next section). First of all, we may simplify the expression of the slant distance as in Eq. (C10) and write Then, we observe that, for θ 1, any satellite slant distance z is much larger than the thickness of the atmosphere (20 − 37 km). As a result, the term (1 − ξ/z) 5/3 in Eq. (C23)is≃ 1 for all values of ξ falling in the atmosphere, where the quantity C 2 n is non-negligible. For this reason, we can approximate the spherical-wave coherence length ρ up 0 with a plane-wave coherence length ( [28], Eq. (51)), which is given by This planar approximation is numerically investigated in Fig. 16, where we see how ρ up 0 rapidly approaches ρ up p already in the LEO region. These coherence lengths are computed using the exact integrals in Eqs. (C21) and (C25). The secant approximations in Eqs. (C23) and (C26) provide curves that are very close to those based on the exact integrals. As a matter of fact, they practically overlap with them at the zenith position. (Note that, while Fig. 16 is plotted for the night-time H-V model, an equivalent behavior is found for the day-time H-V model, but with different asymptotic values).
It is therefore clear that we can set ρ up 0 ≃ ρ up p and use the integral in Eq. (C26). We can further simplify the formulas above by directly replacing the asymptotic value of the Turbulence is modelled by H-V 5/7 . We compare the spherical-wave coherence length ρ up 0 (upper curve) and its plane-wave approximation ρ up p (lower curve). In (a), we consider the zenith position, while in (b) we consider θ = 1. In both panels, the solid curves are computed with the exact integrals in Eqs. (C21)a n d( C25). The dashed curves are associated with the secant approximations in Eqs. (C23) and (C26). The latter are not shown in (a) because they overlap with the solid curves. Note that ρ up 0 rapidly converges to ρ up p ,a n d the asymptotic (lower bound) value in Eq. (C27) is approximately achieved already in the LEO region, i.e., for h h LEO = 160 km. coherence lengths. In other words, we may extend the integral in Eq. (C26) to infinity, and write

Spot sizes for uplink
Consider a Gaussian beam with wavelength λ, spot size w 0 and curvature radius R 0 , which freely propagates in uplink for a distance z with a zenith angle θ 1, so that we are in the regime of weak turbulence. In particular, we may assume a collimated beam (R 0 =+∞), even though this assumption is not necessary for the following theory. The associated spherical-wave coherence length ρ up 0 is based on the integral in Eq. (C21) which can be closely approximated by Eq. (C27).
We now impose Yura's condition [28,34] 0.33 Using Eq. (C29), it is easy to show that Eq. (C30)i si mplied by w 1/3 0 ≫ 31λ 2/5 , which is compatible with typical satellite communications. For instance, at λ = 800 nm, it means to considering spot sizes w 0 ≫ 1.4 mm. Furthermore, the condition in Eq. (C30) could also be imposed more weakly as ρ up 0 /w 0 < 1, in which case the resulting expressions (discussed below) will be valid with a higher degree of approximation.
The satisfaction of Yura's condition in Eq. (C30) allows us to write the decomposition in Eq. (C1) with analytical expressions for the long-and short-term spot sizes. Specifically, we have the formulas [28,34] where w d is the diffraction-limited field spot size and is given by [34]  As a consequence, the variance associated to the centroid wandering is given by [34] [28], Eq. (37)), changing their notation from intensity spot size (w int ) to field spot size (w = √ 2w int ). See also Refs. [74][75][76][77] for related derivations.
The formulas above undergo a great simplification by explicitly accounting for the asymptotic expression of the coherence length ρ up 0 given in Eq. (C27). Thus, for uplink satellite communications with zenith angle θ 1, we may write the following approximations: where we set a = 26.28I 6/5 ∞ , b = 0.2934I −1/5 ∞ and c = ab ≃ 7.71I ∞ , whose numerical values depend on the specific atmospheric profile (e.g., for the H-V 5/7 model, they become a ≃ 2.75 × 10 −13 , b ≃ 63, and c ≃ 1.72 × 10 −11 ). Then, for the short-term spot size, we may write the following simple expression: For uplink communication with a collimated beam with w 0 = 20 cm and λ = 800 nm, we perform a numerical study in Fig. 17. Here we note that the short-term spot size w st becomes considerably larger than the diffraction-limited spot size w d , and the standard deviation of the centroid wandering σ TB increases from about 0.5 − 1 m at the Kármán line to about 200-300 m at the GEO altitude (≃ 36 000 km), depending on the value of the zenith angle.

APPENDIX D: BACKGROUND NOISE IN SATELLITE COMMUNICATIONS
Let us discuss the basic theoretical models which describe the background noise affecting satellite communications. With good approximation, both the Moon and the Earth can be considered to be Lambertian disks [78,79]. This means that the scattering from their surfaces can be approximated to be uniform (radiance independent from the angle), which in turn implies that the intensity detected by the satellite's receiver strictly depends on its angular field of view fov .
First consider uplink. In day-time operation, the main source of noise comes from the sunlight directly reflected by the Earth towards the satellite. The total amount depends on the solar spectral irradiance H Sun λ at the relevant wavelength λ and the albedo of the Earth (A E ≃ 0.3). During night-time operation, the noise is mainly due to the sunlight reflected by the Moon towards the Earth, and then from the Earth towards the satellite. Therefore this noise also depends on the albedo of the Moon (A M ≃ 0.12), the radius of the Moon (R M ≃ 1.737 × 10 6 m), and the average Earth-Moon distance (d EM ≃ 3.84 × 10 8 m).
Considering these parameters, the mean number of environmental thermal photons impinging on the satellite's receiver with aperture a R and (solid) angular field of view fov , within the time window t and the spectral filter λ, is given by [80]n up B = κH sun λ Ŵ R . Here the parameter Ŵ R = λ t fov a 2 R only depends on the specific features of the receiver, while the dimensionless factor κ is equal to κ day = A E ≃ 0.3 for day-time and to κ night = A E A M R 2 M d −2 EM ≃ 7.36 × 10 −7 for full-Moon night time (roughly 10 −6 of the day-time value).
At the optical regime, the typical values ofn up B are orders of magnitude higher than the photon numbers due to the black-body thermal radiation emitted by the Earth. Recall that the spectral radiance of a black body at temperature T and wavelength λ is given by in terms of number of photons per unit area, time, wavelength, and solid angle (photons m −2 s −1 nm −1 sr −1 ). In the formula above, it is understood that c is the speed of light and k B is the Boltzmann constant. Therefore the total number of photons impinging on the receiver is given byn up body = N (λ, T )Ŵ R . Considering the optical wavelength λ = 800 nm and assuming the average surface temperature of the Earth (T ≃ 288 K), one has N (λ, T ) ≃ 3 × 10 6 photons m −2 s −1 nm −1 sr −1 .F o r a receiver with Ŵ R = 1.6 × 10 −19 m 2 s nm sr, we computē n up body ≃ 4.8 × 10 −13 mean photons, which is clearly negligible with respect to the values ofn up B given in Table I of the  main text. In downlink, the transmitter is the satellite and the receiver is a ground station with aperture a R and angular field of view fov . In this case, the number of environmental photons reaching the receiver within the time window t and the spectral filter λ is given by [23,81]n down B = H sky λ Ŵ R , where H sky λ := πH sky λ /(hω) andH sky λ is the background spectral irradiance of the sky in units W m −2 nm −1 sr −1 . In these units, its value ranges between 1.5 × 10 −6 (full-Moon clear night) to 1.5 × 10 −3 (clear day time) and 1.5 × 10 −1 (cloudy day time) ( [81], Table 1), assuming that the field of view of the receiver does not include the Moon or the Sun [82,83]. At λ = 800 nm, we have π/(hω) ≃ 1.27 × 10 19 W −1 s −1 sr, which means that H sky λ ranges between 1.9 × 10 13 and 1.9 × 10 18 photons m −2 s −1 nm −1 sr −1 . Using the same parameters for the receiver as above (Ŵ R = 1.6 × 10 −19 m 2 s nm sr), we find that n down B ranges between ≃ 3 × 10 −6 and ≃ 0.3 mean photons, which are the values for downlink reported in Table I of the main text.
Let us conclude by noticing that these estimates for the background thermal noise can be made more precise by employing dedicated programs. For instance, a more detailed calculation of sky brightness can be achieved by using software such as MODTRAN [84], LIBRADTRAN [85,86], or 6SV [87].