Feasibility of satellite-to-ground continuous-variable quantum key distribution

Establishing secure communication links at a global scale is a major potential application of quantum information science but also extremely challenging for the underlying technology. Although milestone experiments using satellite-to-ground links and exploiting singe-photon encoding for implementing quantum key distribution have shown recently that this goal is achievable, it is still necessary to further investigate practical solutions compatible with classical optical communication systems. Here, we examine the feasibility of establishing secret keys in a satellite-to-ground downlink configuration using continuous-variable encoding, which can be implemented using standard telecommunication components certified for space environment and able to operate at high symbol rates. Considering a realistic channel model and state-of-the-art technology, and exploiting an orbit subdivision technique for mitigating fluctuations in the transmission efficiency, we find positive secret key rates for a low-Earth-orbit scenario, whereas finite-size effects can be a limiting factor for higher orbits. Our analysis determines regions of values for important experimental parameters where secret key exchange is possible and can be used as a guideline for experimental efforts in this direction.


INTRODUCTION
Quantum key distribution (QKD) exploits the fundamental principles of physics to exchange cryptographic keys between two parties. It can guarantee information-theoretic security, in the sense that the security of the protocol does not depend on the complexity of some mathematical problem and hence the computational power of a possible adversary does not have to be bounded. QKD represents today one of the most successful applications of quantum information 1,2 .
The rapid evolution in QKD implementations has resulted in extending the communication range from few centimeters of the first test to several hundreds of kilometers obtained with modern technology [3][4][5][6] . However, this evolution in ground-based implementations faces a fundamental limitation related to the attenuation of the quantum signal in optical fibers, which increases exponentially with the distance. With this scaling law, covering several thousands of kilometers, as required for the realization of an intercontinental QKD link, would be impossible even with the most advanced technology, if only repeaterless architectures are considered 7 . Quantum repeaters [8][9][10][11][12] , whose functioning relies on entanglement distribution and in most cases on quantum memories, might solve the problem of extending the communication range. However, despite progress in the field 13,14 , the technology is still far from being applicable to intercontinental quantum communication.
To overcome this limitation, a possible solution is the use of orbiting terminals to distribute cryptographic keys among ground stations. Studies investigating the feasibility of quantum communication using satellites have been ongoing for a decade [15][16][17][18][19][20][21] , but a milestone was reached in 2017 with the first complete satellite-to-ground QKD implementations realized with the Chinese satellite Micius 22,23 . Later the same year, QKD from satellite was also implemented by means of a small payload onboard of the Tiangong-2 space laboratory 24 . Soon after these demonstrations, the Micius satellite was used for the realization of the first intercontinental quantum-secured communication 25 , thus opening the era of satellite QKD.
Although these results represent a major step in the field, several issues still need to be addressed for the realization of a global QKD network based on satellite communication. In this framework, an important aspect is related to the development of high-performance space-qualified terminals that will allow for stable, high-throughput QKD links from a constellation of satellites to a network of ground stations. To this end, a possible breakthrough may come from the implementation of continuous-variable QKD protocols (CV-QKD) [26][27][28][29] . These protocols have the main advantage of using standard telecommunication components, such as IQ or amplitude and phase modulators for state preparation and coherent receivers for state detection, thus allowing to exploit the heritage of classical optical communication both in terms of high-speed components and of their space qualification. The possibility of free-space and satellite CV-QKD has been investigated theoretically [30][31][32][33] and some preliminary experimental studies have been performed on signal transmission along free-space and satellite-to-ground links 34,35 . Moreover, recent studies have summarized the main characteristics of a satellitebased CV-QKD link 36 and have provided the secret key rate for some specific scenarios, which however do not include crucial link aspects, such as beam divergence, satellite pointing error, satellite motion, and finite-size effects [37][38][39] . Therefore, whether this technology can be used for secret key generation in a realistic satellite-based scenario remains an open question.
Here, we present a feasibility study of satellite-to-ground CV-QKD, taking into consideration state-of-the-art technology for the quantum state generation, transmission, and detection, a realistic channel model and various orbit configurations. Our analysis follows the trusted node approach, where the satellite establishes a separate QKD link with each ground station and hence has access to the keys 22,25 , rather than the untrusted one, where entangled photons are provided by the satellite to the ground stations, which subsequently establish the secret key 40 . Furthermore, we calculate the secret key rate in the downlink scenario, where the emitter is on the satellite and the receiver on the ground, as it is more favorable for the optical signal transmission. The receiver uses a coherent detector with a free running local oscillator (local LO) and reference symbols (pilots) are transmitted for phase recovery. A schematic diagram of the configuration we are considering is shown in Fig. 1.
Adopting a technique based on orbit subdivision to mitigate the effects of transmission fluctuations, we find that continuousvariable technology is a viable option for satellite QKD on low-Earth orbits and identify experimental parameter regions that allow for secret key exchange. For higher orbits, the key generation is affected by finite-size effects due to the limited number of symbols exchanged in a single satellite pass for such high-loss channels. These may be mitigated by achieving higher transmission rates or by considering multiple satellite passes.

RESULTS
In our study, we first provide a general model of the satellite-toground transmission channel, taking into account the beam propagation as well as the satellite orbit. We then examine the effect of channel fluctuations in CV-QKD and derive an equation for the secret key rate over generic fading channels. We subsequently use this equation for estimating the key rate in the case of downlink transmission, both in the asymptotic limit and considering finite-size effects.
Channel model We start our analysis by investigating the statistical properties of the satellite-to-ground transmission channel, which are critical for the assessment of the possibility to establish a QKD link in this configuration. In the downlink scenario that we are considering here, the beam travels from the satellite to the ground station and undergoes the disturbance and loss effects owing to the atmosphere at the end of its path, resulting in a more favorable situation for key generation with respect to an uplink configuration 41 . Indeed, in downlink most of the beam propagation occurs in vacuum, where the beam maintains its diffraction limit properties, whereas the turbulent atmosphere is encountered only during the last ≃20 km of its path. On the contrary, for uplink the wavefront is distorted at the beginning of its path, resulting in a stronger impact on the beam propagation.
There are several disturbance effects that occur during beam propagation, which can be classified as systematic or of random nature.
The systematic effects are theoretically predictable physical processes that perturb and attenuate the signal, and they include the refraction of the beam in the different atmospheric layers and the extinction of light owing to absorption or scattering by air molecules or aerosols. The former is owing to the variation in the optical refractive index of the atmosphere as a function of altitude and it causes the light to deviate from a straight line, resulting in an elongation of its physical path. Reference 42 provides a detailed calculation of the elongation factor-the ratio of the total length of the beam trajectory to the geometric path length-as a function of the apparent elevation angle of the satellite, i.e., the angle with respect to the horizon at which the satellite appears owing to refraction and which differs from the real elevation angle. In this work, we restrict our analysis to elevation angles above 20 degrees, where the elongation factor remains close to 1 and therefore this effect can be neglected (see Fig. 1). The latter effect, namely extinction owing to absorption and scattering, depends on the link length and on the molecule and aerosol distribution model 42 . It also strongly depends on the sky condition and the transmission wavelength. For elevation angles above 20 degrees, the atmospheric transmission efficiency τ atm scales as: (1) where θ zen is the zenith angle and τ zen is the transmission efficiency at zenith 43 . The estimation of the zenith transmission efficiency relies on the MODTRAN code 44 , a widely used atmospheric transmittance and radiance simulator. Considering a 1550 nm wavelength, mid-latitude summer atmospheric model with visibility of 23 km (corresponding to clear sky condition), the MODTRAN web app calculator gives τ zen = 0.91 for both rural and urban aerosol models 45 . We remark that the main parameter that affects the transmission efficiency is the sky visibility; in particular, we find τ zen = 0.85, 0.75, 0.53 for a 10, 5, 2 km visibility, respectively.
In addition to such systematic effects, random variations in the atmospheric temperature lead to fluctuations in the refractive index that have the statistical properties of turbulent scalar fields. The most important consequence of this atmospheric turbulence are intensity fluctuations (scintillation), beam wandering and beam broadening, which induce fading, namely fluctuations in the received optical power and hence in the transmissivity of the channel. The strength of these effects also depends on the altitude and hence on the elevation angle, as discussed in detail in ref. 42 . The atmospheric turbulence is also responsible for the deformation of the beam profile. This is crucial, especially in the context of CV-QKD, where mode matching between the received signal and the phase reference (LO) is important for the coherent detection 35 . To avoid mode mismatch, we assume the use of single-mode fibers as spatial-mode filters of the incoming beam, together with an advanced adaptive optics system 46 to improve the coupling efficiency of the incoming light into the single-mode fiber core. Acting as a spatial-mode filter, the coupling to a singlemode fiber removes components of the signal that would not interact with the LO and contribute to the detected signal. This filtering hence reduces the noise in the detection apparatus and Fig. 1 Schematic diagram of the CV-QKD communication scheme analyzed in this work. A fixed ground station (Bob) follows the trajectory of a satellite (Alice), equipped with a tracking system, passing over its zenith point. An adaptive optics (AO) system is required in order to correct the wavefront distortions due to the atmosphere and maximize the signal to noise ratio at the receiver. The exact implementation of this system is beyond the scope of this work. The parameters θ p , θ d are explained in the text.
also facilitates the use of components like integrated coherent receivers, which are typically available as commercial off-the-shelf and standardized devices. We remark that recent advances in this field have experimentally demonstrated a coupling efficiency in a single-mode fiber exceeding 50% for a large aperture telescope 47 .
Besides turbulence effects, the beam propagation is affected by wandering owing to the pointing error of the satellite. This is characterized by the angle θ p , which is defined as the standard deviation of the angle between the direction of the center of the beam and the imaginary line joining the emitter and receiver telescopes, so that in the case of no pointing error we would have θ p = 0 μrad. A pointing error of the order of 1 μrad has been obtained in low-Earth-orbit (LEO) satellite-to-ground communication links 22 . This is used as a nominal value in our analysis. Similarly, the divergence of the beam is characterized by the angle θ d , for which we use the nominal value of 10 μrad, which has been demonstrated with a 300 mm aperture telescope on-board of the Micius satellite.
We are now ready to analyze the statistical properties of our channel, which will be necessary for assessing the effect of fading on the CV-QKD link, under the above assumptions. To do this, we follow the approach of ref. 30 and calculate the probability distribution of the transmission efficiency (PDTE), as it characterizes completely the statistics of the quantum channel for a given satellite orbit. Indeed, the transmission of coherent states of light through the atmosphere can be modeled by the input/ output relation of the annihilation operators,â out=in . The transformation should preserve the commutation relation, so that we can write: whereĉ are environmental modes and T is the transmission coefficient (with the transmission efficiency being τ = T 2 ). Within this model, we can obtain the P-function characterizing the statistics of the quantum state; it is then possible to show that the PDTE is sufficient to characterize the state at the receiving telescope 30 . In the following, we first calculate the probability distribution obtained at a fixed distance between the satellite and the ground station, and then we take into account the satellite's orbit to compute the total probability distribution, i.e., the PDTE of the entire orbit.
We start by considering a fixed distance R between the satellite and the ground station. The overall transmission efficiency can be divided into a fixed and a time-varying term. We estimate the fixed attenuation term to be 3.8 dB, including 3 dB of losses for fiber coupling and an additional 0.8 dB for taking into account the fact that we are only considering the main peak of the Airy diffraction pattern. As discussed previously, the main dynamic effects affecting the transmission in our analysis are the pointing error of the satellite and the divergence of the beam, characterized by the angles θ p and θ d , respectively.
Following ref. 30 , to calculate the PDTE we first consider the deflection distance, r, and its standard deviation, σ r . As shown in Fig. 2a, r is the instantaneous distance between the center of the receiving telescope and the center of the beam. Its standard deviation depends on the pointing and on the atmospheric turbulence as: In the weak turbulence regime, the variance of the beam center owing to turbulence is given by σ 2 turb ' 1:919 C 2 n z 3 ð2W 0 Þ À1=3 and depends on the distance traveled by the beam in the atmosphere, z, and on the beam waist when entering the atmosphere, W 0 . For stronger turbulence, this expression represents an upper bound, as σ 2 turb saturates and an increase of the path length or turbulence strength will not increase its value 48 . The parameter C 2 n is the refractive index structure parameter that characterizes the strength of the atmospheric turbulence. In case of moderate turbulence and considering a wavelength of 1550 nm, we have C 2 n ' 10 À15 À 10 À14 m À2=3 , which gives σ 2 turb ≲ 10 À4 m 2 << ðRθ p Þ 2 ' 10 À1 m 2 , corresponding to a pointing error of ≃ 1 μrad and a satellite altitude of 300 km. This justifies the approximation in the right hand side of Eq. (3) for all satellite altitudes above 300 km.
Under this approximation, the probability distribution of the deflection distance follows the Weibull distribution: An example of this distribution is shown in Fig. 2c. Given now a distance r, the transmission coefficient can be obtained from geometrical considerations. An approximate but sufficiently accurate analytic relation between r and T can be calculated as 30 : T 0 is the maximum transmission coefficient possible, and S and λ are the scale and shape parameters, respectively, given by: where I n is the n-th order modified Bessel function. All three are given functions of the beam waist on the ground, W = Rθ d > 4 m for satellites above 400 km, and of the telescope aperture radius, a, here considered 0.75 m. Hence, we can write T 0 = T 0 (W, a), λ = λ(W, a), and S = S(W, a). The relation between T and r/a for these values is shown in Fig. 2b.
We can then substitute Eq. (5) into Eq. (4) and use the chain rule to obtain the probability distribution of the transmission coefficient, PDTC. The PDTE is obtained from the PDTC using the chain rule with τ = T 2 . Fig. 2d gives an example of the characterization of an atmospheric channel of fixed distance following our model for the same parameters as discussed above.
We now obtain the PDTE for the entire satellite pass. In our analysis, we consider circular orbits that are passing at the zenith of the ground station (which is assumed not to move during the pass). We can write the radius of such orbits as R O = R E + h s , were R E is the Earth's radius and h s the satellite's altitude with respect to the ground. The angular velocity of the satellite is where M T is the Earth's mass and G is the gravitational constant. The distance between the satellite and the ground station during the satellite's visibility time, that we denote R(t), then reads: We then proceed as follows: • The orbit is divided into a set of points defined by the position of the satellite at a certain time, R(t i ) (i runs with the number of points), given by the orbital equation, Eq. (8).
• For each one of these points, both the PDTE(R(t i )) and the time difference between consecutive points of the orbit, denoted Δt i = t i − t i−1 , are computed. The PDTE(R(t i )) includes as a multiplicative factor the atmospheric transmission efficiency, Eq. (1), for the elevation angle corresponding to R(t i ). The value PDTE(R(t i )) ⋅ Δt i gives the distribution of the times with different transmission efficiencies inside the computed interval.
• Therefore, if we sum PDTE ⋅ Δt i overall the points we obtain the final distribution for the time spent by the satellite with a certain transmission efficiency τ. Indeed, we are mimicking the integral over the flight time: where the flight time, FT, is the normalization factor. Because we are considering circular orbits, we can label each orbit with its altitude, which is the minimum distance of the orbit, coinciding with the moment at which the satellite is exactly above the ground station. For such orbits and following the procedure described above, we show in Fig. 3 the PDTE for three different orbits of increasing altitude for a telescope with aperture radius a = 0.75 m. We remark that for higher orbits the variance of the distribution decreases. As described in the following, this fact has an impact on the noise introduced in time-varying channels. We note that the conclusions that we have drawn for the downlink characterization are in agreement with the recent analysis of ref. 49 . Interestingly however the authors there use the elliptical model rather than the circular one, which means that the ellipticity does not affect the probability distributions. For completeness, we also show in Fig. 4 the average attenuation encountered in a pass as a function of the satellite altitude.
Key rate estimation Let us now describe the procedure we follow to estimate the key rate over a fading channel in the asymptotic regime, i.e., when no finite-size effects are taken into account. For this estimation, we consider the no-switching CV-QKD protocol 50 in its prepare and measure version (PM). Alice starts by sampling 2N real random variables X 1 , . . ., X 2N according to a Gaussian distribution with variance V A , that is, X k $ N ð0; V A Þ and prepares the corresponding N coherent states α 1 j i; :::; α N j i, where α k ¼ X 2kÀ1 þ iX 2k 2 C. Each of these states is sent through the quantum channel to Bob, who performs measurements in both quadratures simultaneously (heterodyne detection) 1 . For the kth use of the channel, he obtains two results Y 2k−1 and Y 2k which are supposed to be correlated to X 2k−1 and X 2k . The string Y = (Y 1 , …Y 2N ) forms the raw key since we consider the reverse reconciliation setting 51 , which is advantageous in case of low transmission efficiency. Note that in a practical protocol, Bob will discretize his data, for instance, by dividing the real axis into bins of small width. Asymptotic values are obtained in the limit N → ∞.
The standard formula to compute the asymptotic value of the secret key rate, in the case of reverse reconciliation, is the so-called Devetak-Winter bound 52 : where βI AB quantifies the correlations between Alice and Bob's data (here, the imperfect efficiency of the error correction procedure is taken into account thanks to parameter β ≤ 1) and χ BE quantifies how much information the adversary holds about the raw key corresponding to Bob's string. The Devetak-Winter bound is valid against collective attacks and remains true even against general attacks for QKD protocols with sufficient symmetry, including for the no-switching protocol, more precisely when de Finetti reductions are applicable [53][54][55] .
In order to assess the performance of a protocol for a given quantum channel, one simply needs to estimate the value of βI AB and χ BE . For the first term, as we are dealing with the reverse reconciliation scenario, one should provide a model of the classical channel {Y k → X k } as well as an error correction procedure allowing Alice to recover the value of Y k from her observations and from additional side information sent by Bob. In order to obtain χ BE , one should similarly model the parameter estimation procedure and compute the expected value that Alice and Bob would observe for our specific channel model. Although these computations are fairly standard in the case of a fixed Gaussian channel with constant transmission efficiency and excess noise, the situation becomes more subtle in the case of a fading quantum channel and indeed conflicting results have appeared in the literature 56,57 (see Methods for details).
Here, we find it useful to recall the derivation of the asymptotic secret key rate from the non-asymptotic case. According to refs. 55,58 , the protocol we are considering is secure against general attacks, even in the finite-size regime, and the asymptotic secret key rate is given by HðY ðNÞ Þ À leak ðNÞ EC À f ðΓ ðNÞ Þ: In this expression, H(Y (N) ) refers to the empirical entropy of the string Y (N) and the superscript N is explicitly written to emphasize that each of these quantities depends on the block length. As we are only interested in the asymptotic behavior of the secret key rate, we neglect discretization effects here. The quantity leak ðNÞ EC is the number of bits that are leaked in the error correction procedure during which Bob sends some side information to Alice to help her guess the value of Y. The term f(Γ (N) ) quantifies the information available to Eve and will be described later.
The advantage of Eq. (11) is that it tells us how to compute βI AB and χ BE in the Devetak-Winter bound, namely Let us first consider the first term. Here we model the quantum channel between Alice and Bob as a phase-insensitive noisy bosonic channel with transmission efficiency given by a random variable τ k ∈ [0, 1], whose probability distribution is the one calculated previously. The channel noise will be treated with the so-called excess noise, ξ, whose full derivation will be given in the following. We will additionally model the imperfections in Bob's detectors by two parameters: their detection efficiency η and the electronic noise ν el . In particular, this implies that the random variables X k corresponding to Alice's inputs and Y k for Bob's measurement results satisfy: where T k is the overall transmission coefficient for the kth channel use, T 2 k ¼ τ k , and Z k $ N ð0; σ 2 Þ is a Gaussian noise of variance σ 2 assumed to be constant.
In order to compute the key rate of Eq. (11), it is important to understand how fast the fading process is. The main idea here is that this process, whose timescale is typically of the order of 1-10 ms owing to atmospheric turbulence, is much faster than the time needed to distill a secret key, which in our case corresponds to a complete satellite pass. In other words, the channel transmission coefficient fluctuates significantly over N uses of the channel, but this coefficient is relatively stable over consecutive uses of the channel, which occur with ns separation. As a consequence, Alice and Bob can exploit classical signals to roughly monitor the current transmission value of the channel and adapt their error correction procedure accordingly. This implies notably that for the error correction procedure, we can assume that Alice and Bob know (approximately) the value of T k . This allows them to use good error-correcting techniques developed for the fading channel where the fading process T k is known to the receiver. In particular, the Gaussian modulation permits to achieve the capacity of this channel up to a reconciliation efficiency factor β and one expects 59 where E[⋅] is the expectation with respect to the fading process.
Here and in the following, we write T instead of T k and replace averages of the form 1 N P N k¼1 by the expectation E for simplicity. Note that since the log function is concave, the value we find for βI AB is smaller than the one computed for a channel with a fixed transmittance E[T 2 ]. To numerically compute the value of Eq. (14), it is possible to use the expressions given in Ref. 60 for a fixedtransmission channel, and take their expection value.
Let us now turn to the second term of Eq. (11), namely f(Γ (N) ), which quantifies the information available to Eve. More precisely, Γ (N) is a worst case estimate of the (average) covariance matrix of the state Alice and Bob would share in the entanglement-based version of the protocol and the function f is defined as f ðΓÞ ¼ gðν 1 Þ þ gðν 2 Þ À gðν 3 Þ À gðν 4 Þ; (15) where g is the entropy function gðzÞ ¼ zþ1 2 log 2 zþ1 2 À zÀ1 2 log 2 zÀ1 2 , ν 1 and ν 2 are the symplectic eigenvalues of Γ (N) and ν 3 and ν 4 are the symplectic eigenvalues of the matrix describing Eve's system conditional on Bob's measurement outcome 61 . The interpretation of the function f is that it coincides with the Holevo information between the raw key and Eve's quantum memory computed for a Gaussian state ρ G ABE with covariance matrix coinciding with Γ (N) on Alice and Bob's systems.
In order to compute the covariance matrix Γ (N) that Alice and Bob would infer from their data, we note first that for a fixed transmittance value T, the covariance matrix of the bipartite quantum state they would hold in the entanglement-based version of the protocol reads with V = V A + 1, 1 2 = diag(1, 1) and σ Z = diag(1, − 1). As observed in ref. 56 , when the fluctuation of the transmission efficiency is considered, the resulting state is a mixture of the individual fixed-transmission states, giving an overall covariance D. Dequal et al. matrix equal to Γ (N) = E[Γ(T)], that is: h (17) If we compare the covariance terms in Eqs. (16) and (17), we can identify an effective transmission for the fading channel equal to E [T] 2 . In particular, the variance of Bob's system can be written This extra noise will be detrimental to the performance of the QKD system unless VarðTÞ ( 1 VÀ1 . By re-writing the fading case as a fixed case with an effective transmission efficiency and excess noise, it is possible to use the equations reported in ref. 60 for calculating the eigenvalues in Eq. (15).
To summarize, by putting together the two terms of Eq. (11), our expression for the secret key rate in the presence of fading becomes:

Simulation results
We are now ready to use the results derived above to estimate the expected key rate achievable for a satellite-to-ground CV-QKD link under our assumptions. To properly account for the expected noise, we include in our modeling the noise contribution related to the phase recovery between the signals generated by Alice and measured by Bob. The technique that we consider here has been proposed in refs. 62,63 and consists in sending periodic reference symbols (pilots) along with the quantum signal. At the receiver side, Bob uses a free running LO, which must be tuned to compensate for the Doppler frequency shift introduced by the satellite motion, to measure both the pilot and the quantum signals, in a so-called "local" LO configuration. As described in the Methods section, two noise contributions arise from this technique, which are due to laser instability and shot noise. We remark that at telecom wavelength, the Doppler shift ranges from several GHz for LEO to several hundreds of MHz for MEO 64 . This problem is well known in classical laser communication and several solutions have been proposed, such as optical 65 or digital 66 phase-locked loops. An alternative solution could come from precise orbit determination (POD) based on additional satellite payloads, such as retroreflectors, GPS receivers or DORIS antennas. With these techniques, it is possible to achieve an a posteriori determination of the satellite velocity with a precision of <1 mm/s, which would correspond to a residual frequency shift of <1 kHz 67,68 . Moreover, in the case of "local" LO CV-QKD, an alternative solution is to exploit the pilots to measure the residual Doppler shift. In fact, by using ephemeris data, it is possible to precompensate the Doppler shift with an a priori residual error of tens of MHz, much smaller than the pilot repetition rate. Under these conditions, it would be possible to retrieve the residual Doppler shift by analyzing the trend of the pilot phase. This possible Doppler correction technique will need further experimental investigation, which is however outside the scope of this work.
The overall excess noise ξ, here referred to as the channel input, is given by the above-mentioned contributions, the fading noise, described in the previous section, and an additional fixed contribution owing to experimental imperfections, ξ fix , which includes also other possible errors in the phase correction.
The main experimental parameters that influence the key rate generation are summarized in Table 1, together with their reference values. The reference values considered for the ground station and the satellite are similar to those reported in ref. 22 and represent a high-performance satellite optical communication system. A detailed analysis of the effect of individual parameters on the key rate is given in the Methods. Regarding the signal variance V A , for each satellite altitude and for each set of parameters we choose the value that maximizes the key rate. These values are in general between 2 and 4 shot noise units (S.N. U.), depending on the configuration. Fig. 5 shows the fading noise given by the PDTE that we obtain for orbits going from 400 km to 22,000 km. As we see, an increase of the noise is present for LEO. This is due to the fact that in such orbits the variation of the slant range is more pronounced, thus, introducing a higher variance on τ (as we observe in Fig. 3). Moreover, it is worth noting that when the pointing error is much smaller than the beam divergence, the fading effect is mainly due to the variation on the satellite distance.  To reduce the effect of fading excess noise, a natural strategy is to reduce the variance of the fading process. This can be achieved as follows: Alice and Bob can approximately monitor the value of the transmission efficiency of the channel seen by the quantum symbols τ k by multiplexing in some degree of freedom an intense optical signal that serves as beacon and experiences a transmission efficiency τ b . An intensity detection of the beacon at Bob's, sampled at rates higher than the atmospheric coherence time (typically~1 kHz), can provide an accurate estimation of the channel transmittance evolution with time τ b (t). This information can be used to classify the detected quantum symbols in groups as a function of the expected transmittance so that for each group g the PDTE is reduced to a transmittance interval PDTE(g) for which the contribution of the fading is less detrimental. The CV-QKD protocol can be performed independently for each of these groups to obtain a secret key rate per symbol K fad (PDTE(g)) and an aggregated secret key rate per symbol of A similar idea has been proposed in ref. 33 , however here we propose to use a beacon signal to estimate the instantaneous channel transmission efficiency, instead of relying on the quantum data. This allows for a more precise estimation, also for a fastfading process. The classical beacon does not transport information related to the quantum signal and K fad (PDTE(g)) is obtained using only the quantum symbols. For this reason, if the signal is tampered within order to falsify the group classification (alter the correlation between τ k and τ b ) only a denial of service would be experienced, as the secret key rate would be reduced, as the manipulated group would suffer higher fading and more excess noise would be estimated.
In order to reduce the effect of fading, narrow PDTE intervals are desirable, but this can magnify finite-size effects, since the number of symbols per group will be reduced. This compromise between PDTE interval width and the number of symbols per group can be taken into account in order to optimize the division of the PDTE so that K agg is maximal for a given PDTE and orbit duration. Technical restrictions such as the resolution available for determining τ b can also play a role in the ideal division of the PDTE in groups.
In our analysis, we have chosen a uniform division of the PDTE and we do not treat the problem of the PDTE division optimization. We divided the whole range of transmission values in equally spaced intervals, going from a single group (corresponding to analyzing the data altogether) to 100 intervals (i.e., close to the asymptotic limit). The results are reported in Fig. 6 for a satellite at 400 km and for three values of fixed excess noise. We note that without channel subdivision no key would be possible for a 400 km orbit. To analyze the effect of the channel subdivision for all the orbits, we selected subdivisions of 3, 10, and 100 intervals for all the satellite altitudes. As shown in Fig. 7, the division of the channel transmission efficiency in 10 groups gives a total rate close to the asymptotic limit for all satellite altitudes. We underline that for this simulation the same values of beam divergence and pointing error have been used in all cases, to emphasize the impact of the orbit altitude on the key generation rate. However, owing to the different satellite size and environmental disturbance, MEO satellites could in general reach better performance in terms of beam quality.
Finite-size analysis We complete our analysis by considering the issue of finite-size effects on the estimation of parameters. It is worth noting that in satellite communication the maximum amount of time for transmission is given by the orbital parameters and can range from a few minutes to hours, depending on the satellite altitude.
Moreover, as discussed previously an optimization is required if we consider the subdivision of the channel transmission efficiency for reducing the fading noise. A denser subdivision will decrease the fading noise, but will result in less populated groups, thus, making the finite-size effects more detrimental.
Here, we consider the uncertainty of the parameter estimation owing to the limited statistics. As described in ref. 69 , it is possible to account for this effect by considering a lower bound on the and an upper bound of the parameter σ 2 = 1 + τξ: where m is the number of symbols used for parameter estimation and z ϵPE=2 is a parameter related to the failing probability of the parameter estimation ϵ PE . Here we consider ϵ PE = 10 −10 , which gives z ϵPE=2 ¼ ffiffi ffi 2 p erf À1 ð1 À ϵ PE Þ ¼ 6:5, where erf À1 is the inverse error function. We consider the situation in which half of the symbols are used for parameter estimation and the orbit is divided into 10 intervals. This choice is not optimized and should be tailored to a specific experimental setup, however such optimization is beyond the scope of this work. Key rate (bits/symbol) x 10 -3 fix =1% fix =3% fix =5% Fig. 6 Asymptotic key rate vs group factor. Secret key rate for channel subdivision from 1 to 100 equally spaced intervals for a 400 km altitude satellite. The fixed excess noise, ξ fix , is, in S.N.U, 1 % (red), 3% (blue) and 5% (green), respectively. The results for the given parameters are shown in Fig. 8 and highlight how the finite-size effects have a remarkable impact on higher orbits, effectively precluding CV-QKD operation beyond 2000 km when the key distillation is performed on a single satellite pass. For lower orbits, below 800 km, the effect is only limited to a drop in the key rate. The finite-size effects could be reduced by increasing the transmission rate and optimizing the orbit subdivision, as well as accumulating multiple satellite passes.

DISCUSSION
In this work, we analyzed the feasibility of CV-QKD from satellite to a ground station. By modeling the transmission channel along a complete circular orbit, it has been possible to obtain the PDTE of the quantum channel, from which we derived the secret key generation rate both in the asymptotic case and when finite-size effects are considered in the parameter estimation. To cope with channel fluctuations, typical of the satellite signal transmission, we proposed a method of data analysis based on orbit subdivision and proved its effectiveness in improving secret key generation. The analysis provides an estimate of the expected key rate of satellite-to-ground CV-QKD and allows to constraint of the experimental parameters for its realization. The obtained results show that coherent state modulation and detection is a viable option for quantum communication with LEO satellites. The communication with higher orbits, achievable in the asymptotic limit, can be affected by finite-size effects if the transmission rate is low or the orbit subdivision is not optimized. We note however that by merging multiple satellite passes, or with the implementation of higher repetition rate systems, it would be possible to extend the communication range beyond 2000 km. Further work is required for the comparison of the key rates achievable with continuous and discrete variable encodings in different communication scenarios.

Parameter analysis
Here, we analyze the dependence of the secret key rate on several parameters, to obtain a better insight into which parameters affect the most the overall performance. To reduce the complexity of this multiparameter analysis, we consider here the key rate that can be obtained if the instantaneous value of the transmission efficiency is known. This case occurs when a sufficient number of symbols is exchanged within the timescale of the channel fluctuation (typically of the order of few ms) and it upper bounds the rate given by Eq. (19). Such a situation is unrealistic in practice, however, it will give us a reference for estimating the efficiency of the realistic scenario.
In this scenario, the key rate can be calculated as a weighted average, considering as weight the PDTE calculated from our channel model analysis: The parameters will be changed one by one, keeping the others to their reference values, expressed in Table 1. The color code reflects the value of the fixed excess noise and is the same used in the main text: red, blue, and green for ξ fix = 1, 3, 5% (in S.N.U.), respectively.
In Fig. 9, we vary the electronic noise of the detectors from 0.01 to 0.1 S.N.U. We notice that even with one order of magnitude increase in noise, the key rate is almost unaffected for all cases. This is mainly due to the fact that in this analysis we consider the so-called "trusted" or "calibrated" scenario, in which the electronic noise is known to Bob via a constant calibration and cannot be exploited by Eve.
The second effect considered is the energy of the reference symbols used for phase recovery. We will illustrate the problem considering a simple phase estimation scheme operating at 1 Gsymbol/s with alternating signal and reference symbols. The time between two such symbols, Δt = 1 ns, gives rise to a noise contribution ξ t = V A 2πΔtΔf, where Δf ' 1 πτc ¼ 10 kHz is the linewidth of the two lasers and τ c their coherence time (assumed equal for Alice and Bob). On the other hand, the phase measurement is affected by shot noise, introducing a noise of ξ sn ¼ VA 2ηnref , where n ref ¼ Eref τ Ephoton is the total number of photons collected, E ref is the energy of the reference symbols and E photon is the photon energy. The effects for different reference symbol energies are shown in Fig. 10. Although the effect for LEO satellites is negligible for energies above 10 pJ, for higher orbits stronger values of the reference are required to avoid any detrimental effect owing to the phase alignment uncertainty, which might impose Fig. 8 Finite-size vs asymptotic key rate. Comparison of the key rate for LEO between the asymptotic regime (solid line) and considering finite-size effects (dashed line), which have been calculated for a symbol rate of 1 Gsymbol/s. The fixed excess noise, ξ fix , is 1% (red), 3% (blue) 5% (green).  restrictions in the dynamic range of the modulators, as the optimal variance V A decreases as attenuation increases. Next, we consider the impact of the downlink beam characteristics, namely the pointing error and the beam divergence, on the final key rate. As expected, these values have a strong impact in all the configurations shown in Fig. 11, underlying the importance of a high-quality beam propagation for satellite CV-QKD.
Finally, we analyze the impact of atmospheric transmission efficiency, as given by Eq. (1). In particular, we calculate the key rate for visibility of 5 km and 2 km, corresponding to haze and mist conditions, respectively. In these two cases the atmospheric transmission efficiency at zenith, τ zen , is, respectively, 0.75 and 0.53. The results, reported in Fig. 12, show that the key rate is affected slightly by haze condition, but drops significantly for mist condition.
Previous treatment of fading in the literature Reference 57 considers two scenarios: slow fading where the transmission efficiency fluctuates at a slower rate than the key establishment rate, and fast fading where the transmission value fluctuates significantly during a single key extraction procedure. The second scenario is similar to ours, but the expression of the authors for the secret key rate differs since they obtain K fastfading ¼ βI A B η min À Z dτP τ χðE; yÞ; where the transmission efficiency τ = T 2 is uniformly distributed with distribution P τ over some interval ½τ min ; τ max . In other words, they take the most pessimistic value of I AB (corresponding to the lowest transmission value) and consider the average of the Holevo information between Eve and the raw key, over the possible fading values. In contrast, we agree with the estimate for the Holevo information from ref. 56 but take a more conservative value for the mutual information I AB since their value is computed for a Gaussian modulation that would yield the same covariance matrix. We have instead argued that one needs to carefully consider the classical channel mapping Y to X (in the reverse reconciliation procedure). This is a fading channel where one can take advantage of the pilot signals to get a rough estimate of the fading coefficient. This implies that one can approximate the capacity of that channel with the average of the capacities of an AWGN channel over the value of the fading parameter.

DATA AVAILABILITY
The authors declare that no data were produced or used for this study. Fig. 11 Impact of the beam quality on key rate. Comparison of secret key rate for different values of pointing error, θ p , and divergence angle, θ d at the three excess noise values.