Space-borne quantum memories for global quantum communication

Global scale quantum communication links will form the backbone of the quantum internet. However, exponential loss in optical fibres precludes any realistic application beyond few hundred kilometres. Quantum repeaters and space-based systems offer to overcome this limitation. Here, we analyse the use of quantum memory (QM)-equipped satellites for quantum communication focussing on global range repeaters and Measurement-Device-Independent (MDI) QKD. We demonstrate that satellites equipped with QMs provide three orders of magnitude faster entanglement distribution rates than existing protocols based on fibre-based repeaters or space systems without QMs. We analyse how entanglement distribution performance depends on memory characteristics, determine benchmarks to assess performance of different tasks, and propose various architectures for light-matter interfaces. Our work provides a practical roadmap to realise unconditionally secure quantum communications over global distances with current technologies.


I. INTRODUCTION
Quantum technologies such as quantum computing [1,2], communication [3,4] and sensing [5,6] offer improved performance or new capabilities over their classical counterparts. Networking, whether for distributed computation or sensing can greatly enhance their functionality and power. As one of the first applications of quantum communication, quantum key distribution (QKD) has been leading the emergence of quantum information technologies and establishes the foundation for wide-scale quantum networking [7]. In QKD, the security of secret keys shared between two parties are guaranteed by the law of physics and not only through the computational power of an adversary. The last three decades have seen significant progress in QKD enabling technologies including hand-held devices [8], integrated optics fabrication [9], and photon detectors [10].
However, the main limitation to current implementations is the range over which a secure link can be established. Ground based QKD systems are inherently limited by in-fibre optical losses, specifically the key generation rate decreases exponentially with distance. By using cryogenically-cooled superconducting nanowire single-photon detectors (SNSPDs), Boaron et al. have demonstrated secret key distribution of around 6 bit/s at a distance of 405 km [10]. More recent twin-field QKD [11] methods have achieved ∼1 bit/hour over 404 km. Both of these demonstrations have utilised state of the art ultra-low loss optical fibres, with losses around 0.17 dB/km, such value being unlikely to improve significantly in a medium time horizon. * mustafa.guendogan@physik.hu-berlin.de Conventional optical repeaters cannot be used with QKD as quantum information cannot be deterministically cloned [12,13], this is a reason for its security against eavesdropping. Current long-distance fibre QKD links employ "trusted nodes" that effectively relay a secure key between the end points. The trusted nodes are assumed to be safe from malicious parties and are potential points of weakness. Trusted nodes are also unsuitable for the long-range distribution of entanglement, hence the need to overcome the terrestrial limits (∼ 1000 km) of direct quantum transmission.
Moving beyond these limits requires the use of intermediate nodes equipped with quantum memories (QM) or quantum repeaters (QRs) which do not need to be assumed to be free from malicious control ("untrusted"). By exploiting the assistance of QRs to divide the transmission link into smaller segments it is possible to overcome the fundamental rate-loss scaling for direct transmission, though at the expense of many intermediate repeater nodes (one every < 100 km) that could be costly and difficult to construct. Quantum repeaters perform local entanglement swapping operations to distribute entanglement across the whole link [14][15][16][17]. The use of repeater chains naturalise transmission links to arbitrary quantum networks that can be analysed and simulated using deep results from the classical network theory [18]. Current fibre based QRs are still limited to around ∼4000 km [19] beyond which generation of meaningful keyrates (i.e. ∼1 Hz) becomes extremely challenging due to the need for large number of repeater stations. This falls short for a solution to global or intercontinental scale quantum communications.
The use of satellites may also extend QKD beyond the terrestrial direct transmission limit and is a natural approach to join different intercontinental fibre net-arXiv:2006.10636v1 [quant-ph] 18 Jun 2020 works. Terrestrial free-space QKD is ultimately range limited by the Earth's curvature and the method is suitable mainly for intra-and inter-city links [20,21]. In satellite QKD (SatQKD) [22,23], the transmission loss through the vacuum of space is dominated by diffraction that has an inverse square scaling instead of exponential. However, the connection distance for SatQKD is primarily limited by the line-of-sight between satellite and ground station which in turn depends on its orbit unless the satellite acts as a trusted node [24][25][26][27][28][29]. To establish a global quantum network without trusted nodes will require overcoming the above limitations. The use of quantum satellites equipped with quantum memories as quantum repeaters remains relatively unexplored.
In this paper, we develop and characterise new approaches for global QKD using space and ground networks. Our approach exploits satellites equipped with quantum memories to provide free-space optical repeater links to connect two end stations on the ground. We implement memory-assisted measurement-device independent QKD (MA-QKD) protocols [30][31][32] to achieve high rates and device-independent security on board satellites in a line-of-sight setting. The entanglement distribution rate is used as a benchmark to assess the performance of our repeater chain. Our approach overcomes limitations in purely ground-based repeater networks and trusted satellite relays to provide the best rate-loss scaling for quantum communications over planetary scales. Notably, we demonstrate that satellites equipped with QMs provides three orders of magnitude faster entanglement distribution rates over global distances than existing protocols. For connecting ground-based networks, we show that QMs can increase key rates for general line-of-sight distance QKD protocols. Our work provides a practical roadmap towards an implementation of global communication, navigation and positioning, and sensing. We conclude by providing meaningful benchmarks to the performance of QMs for different tasks and propose different architectures for the light-matter interface.

II. QUANTUM REPEATER AND MEMORY-ASSISTED QKD PROTOCOLS
We first outline two QR protocols for global entanglement distribution followed by MA-QKD protocols in uplink and downlink configurations to increase the keyrates in a quantum communication within the line-of-sight distance of the satellite. Here, QMs are used as quantum storage devices to increase the rate of otherwise probabilistic Bell state measurements (BSMs) that form the backbone of most MDI protocols.

A. Quantum repeaters
QRs can be grouped into different architectures depending on the error correction mechanism employed [17]. Top: Hybrid QND-QR protocol, following [35] with nesting level, n = 1 and segment length, L0. Entangled photon pairs are created by on-board sources (pink stars) and sent to ground stations (I). After a QND detection heralds the arrival of the photons they are loaded to QMs (II). BSM is performed between the memories to extend entanglement between end stations (III). Bottom: New architecture where the QND and QMs are also located on-board an orbiting satellite.
The first generation of QRs rely on the postselection of entanglement, which acts as an entanglement distillation operation. Improved generations of QRs may employ active error correction codes that necessitate shorter link distances and higher number of qubits (50-100, i.e. a quantum computer in the Sycamore scale) per node. Hence, we restrict our attention to the first generation type architectures that employ ensemble-based QMs. The use of atomic ensembles for long-distance communication was first proposed in a seminal paper by Duan, Lukin, Cirac and Zoller [15] also known as the DLCZ protocol. It relies on creating photon-spin wave entanglement through Raman scattering. This protocol has been modified and improved significantly over time [16,33,34]. Nevertheless, entanglement distribution rate with these schemes quickly drops below practically useful levels above few thousand kilometers which renders reaching true global distances a formidable challenge with land-based architectures. A hybrid, satellite-assisted architecture has been proposed for entanglement distribution with useful rates [35] ( Fig. 1, top). It relies on satellites equipped with entangled photon pair sources communicating with the memory nodes located in ground stations. Other than the satellite links the main difference it exhibits with respect to other first generation protocols is that heralding is performed via a quantum non-demolition (QND) measurement. Entanglement is then distributed between the communicating parties via entanglement swapping oper-ations between neighbouring nodes, similar to previous protocols. The authors cited technical challenges, such as launch and operation in space environment, in favour of locating the QMs in ground stations. However, during the 6 years since the proposal, atomic physics experiments have made a leap into space, mainly for atom interferometry and optical clock applications (outlined in Sec. IV B). Thus the feasibility and performance of QR architectures that operate in space should be re-examined in light of these advancements (Fig. 1, bottom).
We consider a constellation with a total of 2 n+1 − 1 satellites, where n is the nesting level that divides the whole communication channel into 2 n segments. There are two types of satellites: one type carries a photon pair source and the other type QND and QM equipment for entanglement swapping (satellites with pink stars and the dashed box in Fig. 1). Such a scheme will have several advantages over the original hybrid protocol. The first and most important is lower loss due to having only two atmospheric channels and the other inter-node links being located in space. The second advantage is that success will depend on the weather conditions only at two ground stations at the two ends of the communication link whereas the original proposal requires all ground stations (including intermediate relay stations) to simultaneously have good weather conditions, which becomes increasingly unlikely as the number of nodes increases. Finally the need for Doppler-shift compensation to ensure indistinguishability of photons in a BSM is greatly reduced due to lower relative inter-node velocities.

Uplink
In a space-based setting, the protocol proposed in Refs. [30,31] relies on communicating parties on the ground using single photon sources with conventional BB84 encoders and sending them up to a satellite that acts as a middle station where they would each be stored in an individual QM. Memories will then be read out upon the successful heralded loading of both. A BSM is then performed on the retrieved photons to extract a key or perform entanglement swapping ( Figure 2). One of the key characteristics of this protocol is its high operating rate as there is no waiting time associated with the heralding signal travelling between the BSM station and the communicating parties. However, this geometry precludes the extension of this protocol into a repeater architecture. A central requirement of this scheme is the heralding of a successful memory loading process. Ref. [31] analyses both direct and indirect heralding scenarios. The directly heralded scheme relies on the QND detection of incoming photons before being loaded into their respective QMs whereas the indirectly heralded scheme requires additional BSMs that herald the entanglement between the individual memories and the respec- [31,32], in the geometry of [23,37]. Green (blue) arrows show uplink (downlink) protocol. Alice and Bob both have standard BB84 encoders. QM: quantum memory, θ: elevation, h: orbital height, L: total ground communication distance.
tive incoming photons. A BSM between the memories is then performed to distill a secret key. The main drawback of the uplink geometry is the additional loss contribution from turbulence that can be as big as 20 dB compared with downlink transmission. Thus bigger receiver apertures in space are required which might be challenging to deploy.

Downlink
The other main MA-QKD protocol we analyze was first proposed in 2014 [32]. Here the direction of travel of the photons is from the middle station to the communicating stations at the two ends. In this configuration each of the QMs in the middle station emit single photons that are entangled with the internal states of the respective memories towards the receiving ends. A BSM will be performed on the memories upon the successful BB84 measurements by the receiving parties. The repetition rate of the protocol is inherently limited by speed of light travel time of classical signals to herald a successful detection by the communicating parties to the middle station where the BSM is performed. This also requires long-lived QMs with storage times in the order of seconds to achieve similar performance to the previous method. An extension of this protocol in which the central pair of QMs are replaced with m pairs of QMs [36] reduces the required storage time.

III. RESULTS
In this section, we present numerical results for achievable entanglement (key) distribution times using spacebased MA-QKD and QR architectures. We compare these results with known results that use ground-based and hybrid schemes. Calculation of the channel losses are given in Appendix A.

A. Space-based repeater calculations
In this section we analyse and compare two QR architectures, DLCZ and QND-QR in a space-based setting.
The time required to create and distribute an entangled state with the DLCZ protocol is given by [16] where we recall that n is the nesting level that divides the whole communication length L into 2 n links with L 0 length. η d , η t and η m are detection efficiency, channel transmission and memory efficiency, respectively. We define η m = η r × η w with η r (η w ) being the memory read-out (write) efficiency. Lastly, p is the photon pair creation probability and c is the speed of light. Memories should be pumped to create a sufficient rate of photon pairs, i.e. high p but still low enough to minimise double pair emissions that scale as p 2 . This assumes a single-mode memory and thus could be further reduced by using temporally multi-mode memories [38,39].
On the other hand, entanglement distribution time in the QND-QR protocol is given by [35] T Here in addition to the parameters defined above, η q is the QND detection efficiency, R s is the source repetition rate and P avg 0 is the average two-photon transmission. The main difference between calculations presented in this section and in the original hybrid satellite-ground architecture is that only the two end links are satelliteground links whereas all other optical channels are intersatellite links. In Fig. 3 we present entanglement distribution times T DLCZ tot and T QND tot . We assume a nesting level of n = 3 in what follows.
Entanglement distribution time as a function of total ground distance is plotted in Fig. 3a. DLCZ protocols are significantly slower than the QND protocols. The main reason is the long waiting times for the classical heralding signal transmitted between neighbouring nodes. It is expressed with the factor L 0 /c in Eq. 1 and accumulates as the distance, hence the loss, increases. Hybrid groundspace and full-space QND protocols start off within an order of magnitude but the scaling quickly turns against the hybrid protocol as atmospheric loss increases due to the increasingly narrow grazing angle and dominates the diffractive loss. The Space-QND protocol offers 3 orders of magnitude faster entanglement generation rates for global distances.
In Fig. 3b we plot T tot as a function of beam divergence (e −2 beam divergence half-angle, Eq. A2), ∆θ. Diffraction limited beams at optical wavelengths has around 1 µrad divergence for telescope radii of around 20 cm. QND protocols are more sensitive to channel losses since they scale with η −2 t whereas DLCZ schemes follow η −1 scaling. This sensitivity results in ∼4 orders of magnitude slower operation times with an imperfect beam with 10 µrad divergence (similar to MICIUS) with respect to what can be achieved with a diffraction limited beam. The scaling difference between DLCZ and QND protocols results in hybrid-QND scheme having a comparable speed with the multimode DLCZ at large divergences. Although optical links (in the limit of large grazing angle) do not suffer from exponential losses such as in optical fibers, this example shows it is nevertheless crucial to have high quality beams with very small divergence. Lastly, we investigate the effect of the finite memory efficiency on the entanglement distribution time in Fig. 3c. We again see that it is highly crucial to have highly efficient memories. For QND protocols, 50% memory efficiency reduces the operation speed by more than two orders of magnitude when compared to 90% memory efficiencies. Given that satellites only have few minutes of flyby over any target, this difference easily makes the whole protocol impractical.
T tot dictates the minimum required storage time for the QM used in the repeater chain. If we look at Fig. 3a, the full space-based protocol proposed here requires a storage time of around 100 ms for 10 4 km ground distance and a 700 ms storage is required for a distance half the Earth's circumference. On the other hand, the hybrid protocol necessitates ∼ 1.2 s and 9.5 mins for the same distances.
So far we have concentrated on global scale quantum networking via satellite links. In what follows we will analyse the MA-QKD proposals in a shorter range, lineof-sight setting.

B. Results for MA-QKD protocols
For shorter, continental distances one solution is to eliminate the need for QMs by increasing the brightness of the photon sources. However, GHz-rate entangled photon pair generation remains a challenging task [40]. Even with deployment of such fast sources, GHz-bandwidth QMs [41] would be still useful to increase the achieved key rates. In this section we adapt the well-established MA-QKD protocols explained in Sec. II B to a spacebased scenario. We will benchmark the calculated key rates with MA-QKD protocols against the well-known QKD protocol with entangled photons [42,43], known as E91. Figure 4 shows the achievable key rate as a function of ground distance L with i) E91 protocol, i.e. no QM (gray dashed); ii) uplink configuration with protocol presented in Ref. [30,31] (blue) and finally iii) downlink scenario with m = 1 (red) and m = 100 (green) [36]. Parameters used in simulations to generate Fig. 4 are shown in Table I. The model presented here predicts a secret key rate of 0.15 bits/s at 1120 km ground distance with 5.9 MHz repetition rate without memories and this value is consistent with the recently reported value 0.12 bits/s by the MICIUS team [23]. For the simulations discussed here, we assume a repetition rate of 20 MHz that yields around 1 bit/s at 1000 km ground distance. We will use this value to benchmark the performance of MA-QKD schemes in the following sections.

Uplink scenario
The blue curve in Fig. 4 shows the expected key rate obtained with the protocol in Ref. [31]. We assume 15 cm (50 cm) of radius for sender (receiver) telescope, with 10 µrad beam divergence and we omitted the atmospheric turbulence. The memory is assumed to perform with a storage time of 5 ms and 80% combined write-read efficiency. Operation rate is assumed to be 20 MHz and we only consider single-mode memory case as the operation rate is not limited to any classical communication between parties. As can be seen, this protocol offers a speed up over the no-memory protocol up to ∼ 1450 km after which no key could be generated. Figure 5a shows the achievable key rate at a fixed L 0 = 1000 km as a function of memory write efficiency and storage time.It is observed that no meaningful key rate could be achieved with memory dephasing times of < 5 ms, regardless of the memory efficiency. The dependence on the memory efficiency is less dramatic for the uplink protocol. With a relatively modest storage time of 20 ms and a memory write efficiency of around 50%, one can achieve more than an order of magnitude improvement over the no-memory case as summarized  above. However, one should note that this architecture can not be extended to a quantum repeater architecture due to the photon travel direction precluding any entanglement swapping operation between neighbouring links.

Downlink scenario
The operation rate of the downlink protocol is intrinsically limited (for a single-mode memory) by the time the classical signal takes to reach the other party, i.e. R = c/2L LoS , with c being the speed of light and L LoS is the line-of-sight distance between a ground station and the satellite. Hence, this protocol requires long-storage times, in the order of seconds. The parameters are shown in Table I. In Fig. 4 the dotted red curve shows the key rate with a single-mode QM. The achievable key rate is significantly lower than the E91 protocol due to the slower operation speed. The only way to increase the key rate is thus to operate with temporally multimode QMs. The solid red curve shows the key rate that is only possible with a QM that could store 1000 temporal modes. This provides an enhancement of around an order of magnitude between line-of-sight distances of 500-1000 km. Figure 5b shows the achievable key rate as a function of the memory efficiency and dephasing time at a fixed ground distance of 1000 km, with N=1000 temporal mode QM. At such a distance storage times shorter than 5 s would not be sufficient for the protocol to produce any meaningful key rate regardless of the storage efficiency. Likewise, storage efficiency of around 35% is needed in combination with a τ = 10 s to reach a 10 Hz key rate.
We further analysed the extension of this protocol with m = 100 pairs of QMs located in the middle station. Green curve in Fig. 4 shows that storage time of only 100 ms is sufficient instead of the very demanding 7.5 s to reach the same distance with similar keyrates. Fig. 5c shows the performance map of this scheme again at a fixed ground distance of 1000 km. The striking feature here is that the cut-off storage time below which no key could be transmitted is only a few ms.
With these findings in mind, we discuss potential memory types suitable for space missions in the next section.

IV. TOWARDS FIRST POSSIBLE QUANTUM MEMORY EXPERIMENTS IN SPACE
In this section we will overview the existing QM experiments and provide a roadmap towards choosing a proper physical system in light of the findings of the previous section. We focus on ensemble based systems as it would be more straightforward to implement temporally multimode storage needed in the protocols described in this paper (see Appendix A 3). However, we note that the first land-based MA-QKD experiment has been recently performed with a single color center in diamond at ∼mK temperatures [44].

A. Warm vapour systems
Photon storage in the long-lived ground states of alkaline vapors at room temperature is particularly appealing, as it requires neither complex cooling mechanisms nor large magnetic fields. This makes such memories ideal for field applications in remote environments, e.g. under sea or in space. The performance of warm vapor memories has been continuously improved since the first demonstrations of memories based on electromagnetically induced transparency (EIT) in the 2000s. In recent years, the development of quantum memory implementations in alkaline vapor have gained remarkable momentum: (1) A vapor cell memory reached a storage time of τ = 1 s by using spin-orientation degrees of freedom and anti-relaxation coatings [45]. (2) The efficiency of a room temperature EIT-like memory was pushed beyond 80% [41]. (3) EITlike quantum memories with ∼ 1 GHz bandwidths were developed [46]. These could in principle be extended to the storage of multiple signals in individually addressable sub-cells, as realized in cold atomic ensembles [47]. Besides ground state EIT memory, another promising vapor cell memory concept is the storage of photonic quantum information in highly excited atomic orbitals. These orbitals are relatively long lived, allowing for storage times on the order of 100 ns. The fast ladder memory scheme is based on two-photon off-resonant cascaded absorption [48,49]. This scheme allows for the virtually noise-free storage with acceptance bandwidths in the GHz regime, but it needs to be further developed to allow for the comparable long storage times required by long-distance quantum communications.

B. Laser-cooled atomic ensembles
Laser-cooled atomic systems are well-established platforms for quantum information storage. High efficiency [50], temporal [39] and spatial multimode storage [47] have been performed among many other experiments in the last years. There has been a growing interest in deploying cold-atom experiments in space for more than a decade. This is driven by a combination of desire for access to longer periods of microgravity for fundamental research, and the deployment of instruments such as optical clocks on satellites for future global positioning concepts. Cold atom ensembles and Bose-Einstein condensates have already been created on orbiting platforms including Tiangong-2 [51] and the ISS [52,53].

BECCAL: Cold atom experiment on board ISS
In the context of these platforms, BECCAL is of particular interest due to the variety of experiments it is designed to perform. These experiments include the possibility of conducting initial demonstrations of optical memories in space. In short, BECCAL [54] will be capable of producing 3D-MOTs of 2 × 10 9 87 Rb atoms, 1 × 10 9 85 Rb atoms, 8 × 10 8 39 K atoms, 4 × 10 8 41 K atoms, and 1 × 10 7 40 K atoms in single species operation, it will also be possible to obtain single species BECs of 1 × 10 6 87 Rb atoms, or 1 × 10 5 41 K atoms. Atoms can also be confined in a 1064 nm dipole trap with a waist of 100 µm and a tunable potential depth of 0.01 µK to 5 µK. Quantum coherences of longer than 5 s are planned. Due to the absence of gravity, atomic samples can be used without additional, gravity compensating, trapping potentials. Within BECCAL, the possibility for optical memory experiments is mediated via the detection scheme. Absorption detection is performed via two perpendicular axes to allow the gathering of three dimensional information about atom clouds. Via a distribution and switching system, it is possible to deliver light addressing the D2-lines of rubidium and potassium in a variety of pulse schemes (the 5 2 S 1/2 → 5 2 P 3/2 and 4 2 S 1/2 → 4 2 P 3/2 transitions in Rb and K respectively). One can deliver 'cooling' and 'repump' frequencies (i.e. F=2 → F'=3 and F=1 → F'=2 respectively for 87 Rb) simultaneously or consecutively on a single axis, or in a crossed beam arrangement with cooling on one axis and repump on the other. Each frequency can be switched independently in less than 1 µs. These flexible conditions will facilitate storage techniques such as EIT in a microgravity environment thus being a pathfinder and demonstrator for the technology discussed in this paper.

C. Rare-earth ion doped crystals (REIDs)
REIDs are another major platform to realize QMs in the context of quantum communication. Some of the recent advances include but are not limited to; demonstration of quantum correlations between long-lived hyperfine states and telecom photons [55], storage of bright pulses up to a minute long duration [56] and demonstrating 6-hour coherence time [57]. The other research front in REID field is the miniaturization of these experiments. Waveguide geometries [58,59] offer an enhanced compactness. The storage bandwidth is usually limited to a few MHz due to narrow hyperfine level separation however recent electronic-nuclear hybrid storage protocols would open up possibilities of storing large bandwidth photons in the long-lived spin states [60], this would enable higher operation rates, R s . Combination of compactness, high-bandwidth storage capability together with high efficiency and long storage times would place REID systems at the forefront of QM systems for space applications. On top of material considerations, REIDs are also suitable for temporally multimode storage [38,61,62]. REIDs could be a promising candidate to realize a space-based QR With the development of miniature, space-compatible cryostats [63].

V. CONCLUSIONS
Quantum cryptography is the framework behind novel entanglement distribution protocols and security proofs. It has rapidly developed from simple lab demonstrations to in-field applications. However, developing and implementing robust QKD protocols over global transmission lengths remains an open challenge. The use of both ground and satellite based quantum repeater networks provide the most promising solution to extend quantum communications to global scales.
In this work, we provide the first theoretical analysis towards this goal [64]. Our proposal uses satellites equipped with quantum memories in low Earth orbit that implement measurement-device independent QKD. We benchmark entanglement distribution times achieved through our architecture with existing protocols to find an improvement of ∼3 orders of magnitude over global scales. With the majority of optical links now in space, a major strength of our scheme is its increased robustness against atmospheric losses. We demonstrate that quantum memories can enhance secret key rates in general line-of-sight QKD protocols using practical devices that would be available in the near future. Our work provides a practical roadmap towards the implementation of quantum memories for space based fundamental physics experiments and paves the way to a promising realisation of a global networked quantum communications infrastructure.
Our work leads to further interesting research questions. It would be interesting to explore the effects of different satellite orbits (geostationary and medium Earth orbit), orbital dynamics, and constellation designs on entanglement distribution times. This naturally leads to the question of engineering efficient satellites network topologies, where quantum memories with even modest coherence times can effect profound gains to entanglement rates [65]. Moreover, it would be interesting to explore the practical effects of finite block sizes on the key rate [66], for example effects owing to a transmission time window between satellites and ground stations.

VI. ACKNOWLEDGEMENTS
MG and MK acknowledge the support by the German Space Agency DLR with funds provided by the Federal Ministry of Economics and Technology (BMWi) under grant numbers 50WM1958 (OPTIMO), 50WM2055 (OPTIMO-2), which made this work possible. VH acknowledge the support by the German Space Agency DLR with funds provided by the Federal Ministry of Economics and Technology (BMWi) under grant number 50WP1702 (BECCAL).
DKLO is supported by the EPSRC Researcher in Residence programme (EP/T517288/1). JSS, LM, and DKLO acknowledge the travel support by the EU COST action QTSpace (CA15220), and LM acknowledges the travel support by Scottish Universities Physics Alliance SUPA (LC17683). Funding was provided by the UK Space Agency through the National Space Technology Programme (NSTP3-FT-063 "Quantum Research Cube-Sat", NSTP Fast Track "System Integration & Testing of a CubeSat WCP QKD Payload to TRL5"), EP-SRC Quantum Technology Hub in Quantum Communication Partnership Resource (EP/M013472/1) and Phase 2 (EP/T001011/1), and Innovate UK (EP/S000364/1).
MG acknowledges Guillermo Currás Lorenzo for double-checking the code for MA-QKD calculations and pointing to few minor errors at an early stage of the work.
Appendix A

Quantum link modelling and channel losses
An important requirement for the estimation of the performance of a space-based quantum communication systems is the precise modelling of the optical loss and source of noise of the channel as they both decreases the secret key rate. The former by making the transmitted quantum states less distinguishable by the receiver, and thus decreasing the overall detection rate, and the latter by increasing the Quantum Bit Error Rate (QBER).
Diffraction losses: the dominant source of loss is diffraction which for a Gaussian mode of initial beam waist ω 0 and wavelength λ travelling a distance d is given by [67]: Where ω d is the accumulated beam waist at distance d from the source and D R is the receiver aperture. As one can see, diffraction losses can be mitigated by increasing the receiver aperture but this could be unfeasible due to payload constraints. However, one should note that that diffraction losses scales quadratically with the link distance (for d πω 2 0 /λ) contrary to the exponential scaling for a fiber link with the length of the fibre. The divergence ∆θ of an imperfect Gaussian beam is characterized by its M 2 value through the following relation: Atmospheric losses: Atmosphere constituents cause absorption and scattering of the optical signal, those effects depends on the signal wavelength. The atmospheric loss that includes absorption as function of elevation angle of θ is given by [26]: Here η π/2 atm is the transmissivity at Zenith and can be computed from a given model for the atmospheric absorption γ(r; λ) as: where h is the altitude of the satellite. The value of η π/2 atm can also being found using dedicated software such as MODTRAN [68], at 780 nm the Zenith transmissivity is about 80%.
Pointing losses: Vibration and mechanical stress due, for example to thermal dilation, cause error in the point and further loss. By assuming that the distribution for pointing error angle follows is a Gaussian with zero mean and σ point standard deviation, this loss contribution can be modelled as [69]: for a diffraction limited beam at optical wavelength a point error of 1 µrad causes decrease of the transmittance of about 10 %. Fig. 6 shows the channel losses when we only consider the diffractive losses and atmospheric absorption. Beam tracking errors are not included. We assume a transmitting (receiver) telescope radius of 0.15 m (0.5 m) and a low-earth orbit with h = 400 km. Fig. 6a shows that atmospheric loss becomes dominant at large distances with decreasing grazing angle. Fig. 6b shows inter-satellite losses where only diffractive losses are considered. The bigger source of noise for the current setting are given by the detectors dark counts and stray light.
Dark counts: For a Silicon based APD the dark count rate is estimated to be around 10 counts/s, such value could be improved by several orders of magnitude by using SNSPDs. In this article we assumed p d = 10 −6 for a ∼ 1 µs detection window which corresponds to few Hz dark count rate.
Stray Light: The sources of stray light are divided in natural sources, such the moon and the stars, and the artificial one, the so called sky glow, produced buy the diffusion of light from human activities. Stray light can be decreased by spectral and time filtering. The number of stray counts in an acquisition window is given by [70]: where H sky is the total sky brightness and ∆λ the spectral bandwidth typical of which are in the nm region. It is worth noting that, in the optical domain, the number of stray photons can vary of several orders of magnitude according to the sky condition, e.g. the presence of the Moon [70].

Keyrate calculations
For numerical calculations of the secret key rate, we consider a pair of quantum memories that send entangled photons to their respective end users as illustrated in Fig. 2. The performance of this memory-assisted protocol is assessed in terms of the secret key rate achievable by the BB84 cryptographic protocol. The secret keyrate for this is lower bounded by [31,32] where Y is the probability per channel use that both Alice and Bob's measurements and the Bell state measurement was successful, e X (e Z ) is the QBER in the X (Z) basis, f is the error correction inefficiency and h(e) is the binary entropy function defined via h(e) = −e log 2 e − (1 − e) log 2 (1 − e). Details of how Y and the individual errors are calculated can be found in Refs. [31,36].

Temporal multimode considerations
Our scheme relies on QMs to absorb many photons in a temporal multimode manner [35]. The number of required modes depends on the brightness (R s ) and efficiency (η s ) of the source and the maximum transmission of the channel (η tr,max ) and is given by The protocol requires a temporal multimode storage of N = 365 for the calculations presented in Fig. 3a.