www.nature.

com/npjqi

ARTICLE OPEN

Finite key effects in satellite quantum key distribution

1,2 ✉ 1✉
Jasminder S. Sidhu , Thomas Brougham1,2, Duncan McArthur 1
, Roberto G. Pousa1 and Daniel K. L. Oi

Global quantum communications will enable long-distance secure data transfer, networked distributed quantum information
processing, and other entanglement-enabled technologies. Satellite quantum communication overcomes optical fibre range limitations,
with the first realisations of satellite quantum key distribution (SatQKD) being rapidly developed. However, limited transmission times
between satellite and ground station severely constrains the amount of secret key due to finite-block size effects. Here, we analyse
these effects and the implications for system design and operation, utilising published results from the Micius satellite to construct an
empirically-derived channel and system model for a trusted-node downlink employing efficient Bennett-Brassard 1984 (BB84) weak
coherent pulse decoy states with optimised parameters. We quantify practical SatQKD performance limits and examine the effects of
link efficiency, background light, source quality, and overpass geometries to estimate long-term key generation capacity. Our results
may guide design and analysis of future missions, and establish performance benchmarks for both sources and detectors.
npj Quantum Information (2022)8:18 ; https://doi.org/10.1038/s41534-022-00525-3
1234567890():,;

INTRODUCTION the secret key rate37,38. Analyses based on smooth entropies32

Quantum technologies have the potential to enhance the improve finite-key bounds39 and have been applied to free-space
capability of many applications1 such as sensing2–4, communica- quantum communication experiments40. Recently, tight bounds36
tions5–8, and computation9. Ultimately, a worldwide networked and small block analyses41 further improve key lengths for finite
infrastructure of dedicated quantum technologies, i.e. a quantum signals. Here, we provide a detailed analysis of SatQKD secret key
internet10, could enable distributed quantum sensors11–14, precise generation, which utilises tight finite block statistics in conjunction
timing and navigation15–17, and faster data processing through with system design and operational considerations.
distributed quantum computing18. This will require the establish- As part of our modelling, we implement tight statistical analyses
ment of long distance quantum links at global scale. A for parameter estimation and error correction to determine the
fundamental difficulty is exponential loss in optical fibres, which optimised, finite-block, single-pass secret key length (SKL) for weak
limits direct transmission of quantum photonic signals to < coherent pulse (WCP) efficient BB84 protocols using three signal
1000 km19–22. Quantum repeaters may overcome the direct intensities (two-decoy states). We base our nominal system model
transmission limit but stringent performance requirements render on recent experimental results reported by the Micius satellite42 and
them impractical by themselves for scaling to the intercontinental use a simple scaling method to extrapolate performance to other
ranges needed for global scale-up23. Alternatively, satellite-based SatQKD configurations. The effects of different system parameters
free-space transmission significantly reduces the number of are explored, such as varying system link efficiencies, protocol
ground quantum repeaters required24. choice, background counts, source quality, and overpass geometries.
Satellite-based quantum communication has attracted much We also provide a simple estimation method to determine the
recent research effort23–30 following recent in-orbit demonstra- maximum expected long-term key volume at a particular OGS
tions of its feasibility by the Micius satellite31. For low-Earth orbit latitude. The improvement from combining data from multiple
(LEO) satellites, a particular challenge is the limited time window satellite passes is also examined. Our model and analysis may guide
to establish and maintain a quantum channel with an optical the design and specification of SatQKD systems, highlighting factors
ground station (OGS). For satellite quantum key distribution in the quantum communication link that limit secret key generation
(SatQKD), this constrains the amount of secret key that can be in the regime of high channel loss and limited pass duration.
generated due to two issues. First, the commonly assumed We outline the system model in section ‘System model’,
including overpass geometries and system parameters. Opera-
asymptotic resource assumption is not a good approximation for
tional models and finite block construction are given in section
short received signal blocks. Without an arbitrarily large number of
‘SatQKD Operations’. We describe in section ‘Finite key length
received signals, statistical uncertainties can no longer be ignored
analysis’ our SatQKD finite key analysis and examine the
and the security of the distilled secret key requires careful
dependence of the SKL on different system parameters in
treatment of the statistical fluctuations in estimated
subsequent sections. We conclude with a discussion of our results
parameters32–34. Second, the trade-off between the proportion
in section ‘Discussion’.
of signals used for parameter estimation and key generation
becomes increasingly important to optimise. Further post-
processing operations, such as error correction, reduce the
amount of extractable secret key, with small block lengths leading RESULTS
to additional inefficiencies over the asymptotic limit35,36. System model
Initial SatQKD studies used the observed standard deviation to We consider a satellite in a circular Sun-synchronous orbit (SSO) of
estimate statistical uncertainties and derive correction terms to altitude h = 500 km, similar to the Micius satellite31, performing

1
SUPA Department of Physics, University of Strathclyde, Glasgow G4 0NG, UK. 2These authors contributed equally: Jasminder S. Sidhu, Thomas Brougham.
✉email: [email protected]; [email protected]

Published in partnership with The University of New South Wales

 J.S. Sidhu et al.
2
1234567890():,;

Fig. 1 Satellite-to-ground QKD model. a General satellite overpass geometry for circular orbit of altitude h50. Maximum elevation θmax
reached when satellite—OGS ground track distance is at a minimum, dmin . The smallest θmax , θ max , that generates finite key defines the key-
generation footprint 2dþ min . b Zenith overpass maximises transmission time with lowest average channel loss. Quantum transmission is limited
to above θmin . c Zenith overpass channel loss vs time/elevation (based on ref. 42 data). Link loss varies with range (R−2 diffraction fall-off ) and
the atmospheric optical depth (attenuation and turbulence). Peak link loss ηlink at zenith characterises the system loss performance level,
denoted ηsys
loss . Additional constant losses (independent of range and elevation) are modelled by constant dB offset to the link loss curve, hence
−7
also off-setting ηsys sys
loss . d Modelled sifted key rate and QBER vs time/elevation. Zenith overpass, ηloss ¼ 27 dB, pec = 5 × 10 , and QBERI = 0.5%.
BB84 WCP-DS protocol parameters: fs = 200 MHz, μ1,2,3 = 0.5, 0.08, 0.0, p1,2,3 = 0.72, 0.18, 0.1, with pX = 0.889, 0.9 for the transmitter and
receiver basis bias, respectively, as in ref. 45. Shaded region indicates elevation below θmin ¼ 10 .

downlink QKD to an OGS at night to minimise background light. perform differently. Though the link efficiency in ref. 42 is for the
The elevation and range is calculated as a function of time for entanglement distribution system, not the optimised prepare-
different overpass geometries representing different ground track measure QKD downlink system as reported in ref. 45, it should still
offsets and maximum elevations for the overpass (Fig. 1a). The be representative of downlink efficiencies and sifted key rates
instantaneous link efficiency ηlink is calculated as a function of the achievable with current technologies (Fig. 1d).
elevation θ(t) and range R(t) to generate expected detector count Systems with higher link losses are also considered. The system
statistics. The quantum link is restricted to be above θmin ¼ 10 . loss metric, ηsys
loss , is used to characterise the overall system electro-
The link loss ηlink ¼ 10log10 pd (dB) is determined by the optical efficiency independent of the overpass geometry, and is
probability, pd, that a single photon transmitted by the satellite is defined as the ηloss value at zenith, i.e. the maximum probability of
detected by the OGS. A lower dB value of ηlink represents smaller detecting a single photon sent from the satellite to the OGS.
loss due to better system electro-optical efficiency. This improve- Worse performing systems have a larger associated ηsys loss . The
ment could stem from the use of larger transmit and receive baseline ηsys
loss value considered is 27 dB, which corresponds to the
aperture diameters, better pointing accuracy, lower receiver internal improved Micius system using a 1.2 m diameter OGS receiver at
losses, and higher detector efficiencies. Internal transmitter losses Delingha42. By increasing the value of this metric, we explore the
are not included since they can be countered by adjusting the WCP performance of SatQKD systems with greater fixed losses, e.g.
source to maintain the desired exit aperture intensities37. We also using a smaller OGS, but otherwise similar behaviour to the Micius
do not explicitly consider time-varying transmittance, modelling the system. We consider a maximum ηsys loss value of 40 dB since this
average change in channel loss due only to the change in elevation reflects realistic SatQKD operation using smaller OGS receiver
with time. For discrete variable QKD (DV-QKD) protocols, e.g. BB84, diameters and a reduced pointing accuracy of smaller satellites. If
channel transmissivity fluctuations do not directly impact the secret the time-averaged ground spot is much larger than the OGS
key rate, in contrast to continuous variable QKD where this appears diameter Dr, ηsysloss scales as 20log10 ðDr =Dr Þ (dB) where D r ¼ 1:2 m
0 0

as excess noise leading to key reduction43,44. is the reference Delingha OGS diameter.
The ideal overpass corresponds to the satellite traversing the Estimating the effect of transmitter aperture (Dt) is more
OGS zenith (Fig. 1b) giving the longest transmission time with complex since factors other than diffraction, such as pointing
lowest average channel loss. Generally, an overpass will not pass performance and turbulence, also determine the time-averaged
directly overhead but will reach a maximum elevation θmax ð<90 Þ. ground spot size46,47. Micius, with Dt of 180 mm and 300 mm and
We model total losses, including pointing and atmospheric effects, sub-μrad pointing performance, reported 10 μrad beam widths42
using Micius in-orbit measurements (ref. 42 Extended data, Fig. 3b) which suggests the presence of non-diffraction-limited beam
to construct a representative ηlink vs θ curve extrapolating over the spreading effects that may result in a smaller dependence of ηsys loss
entire horizon to horizon passage time (Fig. 1c). The Micius data on Dt. A smaller Dt could result in a smaller increase in ηsys loss than
represent a near ideal scenario since the OGSs are situated in dark given by purely diffractive beam broadening, conversely using a
sky conditions at high altitudes of ~3000 m minimising the effects larger Dt may not significantly improve ηsys loss if pointing and
of atmospheric turbulence and attenuation, other sites may turbulence losses dominate. We refer the reader to detailed

npj Quantum Information (2022) 18 Published in partnership with The University of New South Wales
 J.S. Sidhu et al.
3
assumed parameters. However, the security guarantee for this
Table 1. Baseline SatQKD system parameters. λEC depends on block
procedure requires closer examination.
size and QBERI = 0.5% is consistent with Micius results19.
Here instead, we process overpass data as a single block
Description Parameter Value without segmentation, incorporating finite statistics and uncer-
tainties to maintain high levels of composable security with
Intrinsic QBER QBERI 5 × 10−3  
SKLfinite ¼ SKL nμk ; mμk ; (3)
Afterpulse probability pap 1 × 10−3
Extraneous count probability/pulse pec 5 × 10−7
where fnμk ; mμk g denote agglomerated observed counts without
partitioning into sub-segments (see ‘Methods’ section ‘Finite key
Source rate fs 1 × 108 Hz analysis for decoy-state BB84’). This is more practical for large
Correctness parameter ϵc 10−15 constellations28,53 and OGS numbers, obviating the need to track
Secrecy parameter ϵs 10−9 and store a combinatorially large number of link segments until
Error correction efficiency λEC See text each has attained a sufficiently large block size for asymptotic key
Baseline system loss metric ηsys 27 dB
extraction. Note that we have the freedom of constructing block
loss
sizes in this manner since the security of the distilled finite key
Orbital altitude h 500 km remains unaffected. However, an important requirement in finite
Minimum transmission elevation θmin 10∘ key analyses is the assumption that each block is randomly
We sum detector dark count and background rate in pec. A reported sampled at a constant and uniform rate. This requires both the
background count rate 500–2000 cps per detector (Moon position protocol parameters and the fraction of X to Z bases be kept the
dependent) lower bounds pec by 5 × 10−7 73, assuming a 1 ns coincidence same. We do not make any assumptions on the underlying
window. statistics for each data block, which are not required to be the
same. Instead, we require only information on the count statistics
analyses of atmospheric turbulence48 or extinction49, and more for the entire overpass.
recent works where their effects on SatQKD are considered46,50,51.
We simplify our model by including several quantities in the Finite key length analysis
parameters pec and QBERI. The sum of dark and background light We now quantify SatQKD system performance and SKL generation
count rates, pec, is assumed constant and independent of from different satellite overpasses. We employ the efficient BB84
elevation. The intrinsic quantum bit error rate, QBERI, combines protocol with weak coherent pulses (WCPs)6 for which tight finite-
errors arising from source quality, receiver measurement fidelity, key security bounds have been derived for one34 and two33 decoy
basis misalignment, and polarisation fluctuations52. Baseline states. The performance of one and two-decoy states is similar,
system parameters are summarised in Table 1. however using two decoy states allows better vacuum yield
estimation, useful in high loss operation. We optimise the two-
SatQKD Operations decoy state protocol parameters and the amount of overpass data
used in a block to explore the dependence of the single-pass SKL on
A standard model of SatQKD uses large, fixed, and long-term OGSs
different variables and derive an expected long term key volume.
to establish links with satellites29. A more demanding scenario is
The efficient BB84 protocol54 encodes signals in X and Z bases
where the OGS may only be able to communicate sporadically
with unequal probabilities pX and 1 − pX, respectively. One basis is
with a particular satellite, limiting the amount of data that can be
used exclusively for key generation and the other only for
processed as a single large block, e.g. smaller, mobile OGS
parameter estimation. We choose to use the error rate of the
terminals may be required to generate a key from a limited
announced sifted Z basis to bound leaked information from the
number of passes, possibly only one, due to operational
sifted X basis raw key. Biased basis choice improves the sifting
constraints. In contrast, fibre-based QKD can often assume a
ratio whilst retaining security. In the asymptotic regime, the sifting
stable quantum channel able to be operated continuously until a
ratio tends to 1, versus 0.5 for symmetric basis choice (original
sufficiently large block size is attained. High count rates and large
BB84). This sifting ratio advantage persists in the finite key regime
block sizes, e.g. 1012, are generally more feasible in fibre-
(see section ‘Protocol performance’) resulting in a longer raw
based QKD.
sifted key that reduces parameter estimation uncertainties and
In SatQKD, often the theoretical instantaneous asymptotic key
provides more raw key to distil.
rate R1 ðtÞ is integrated over the overpass to give the continuous
For the two decoy-state WCP BB84 protocol, the sender
secret key length (SKL)28,29,
Z tend randomly transmits one of three intensities μj for j ∈ {1, 2, 3} with
probabilities pj. For the purposes of the security proof, we assume
SKLCont:
1 ¼ R1 ðtÞdt; (1) the intensities satisfy μ1 > μ2 > μ3 = 0. The finite block secret key
t start
length is then given by33,
where the quantum transmission occurs between times tstart and $ %
tend. Data segments from multiple passes with identical statistics 21 2
should be combined to yield an asymptotically large block for ℓ ¼ sX;0 þ sX;1 ð1  hðϕX ÞÞ  λEC  6log2  log2 ; (4)
ϵs ϵc
post-processing. More practically, small blocks, each having similar
statistics, from different passes are combined to give the following where sX,0, sX,1 and ϕX, are the X-basis vacuum yield, single-photon
SKL, yield and phase error rates, respectively. In contrast to fibre-optic
X based systems, the size of the sifted X-basis data block cannot
SKLBlock
1 ¼ RðjÞ
1 Lj ; (2) easily be fixed for satellite-based QKD. Instead the number of
j
pulses N sent per pass is determined by the source repetition rate
where Rj1 is the asymptotic key rate for a small segment j, and Lj and the time available during a satellite overpass. In the
its length. Operationally, this leads to considerable latency asymptotic sample size limit (Eq. (2)), the X and Z basis data
between establishing a first satellite-OGS link and the generation block sizes are straightforwardly determined by N, the pulse
of secret keys after a sufficient number of subsequent overpasses. detection probability (itself a function of time), and the sifting
A less restrictive mode of operation is to combine data from ratio. However, finitely sized samples generate observed statistics
multiple passes without segmenting into data blocks with similar that deviate from asymptotic expectations. Taking this into
statistics, and processing using asymptotically determined or account can significantly reduce the SKL and we employ

Published in partnership with The University of New South Wales npj Quantum Information (2022) 18
 J.S. Sidhu et al.
4
correction terms δXðZÞ;k
±
that relate the expected and observed Elevation (Degrees)
statistics for bases X(Z) with a k-photon state, using the tight 90 52.1 31.1 19.6 12.4 7.2 3.2
107 3.5
multiplicative Chernoff bound36 (see ‘Methods’ ‘Finite key analysis
for decoy-state BB84’ and ref. 55 for software details). 3.0

Secret Key Length (106 bits)

Error syndrome information is publicly announced to perform 106
error correction. The number of bits thus leaked is denoted λEC, 2.5
and is accounted for during privacy amplification. In the finite key

QBER (%)
27 dB
regime, this information leakage has a fundamental upper bound 105 33 dB 2.0
λEC  log jMj, where M characterises the set of syndromes in the 40 dB
information reconciliation stage35. We use an estimate of λEC that 1.5
varies with block size (Eq. (9)). 104
We characterise the reliability and security of the protocol by 1.0
two parameters, ϵc and ϵs. The protocol is ε = ϵc + ϵs-secure if it is
ϵc-correct and ϵs-secret33,56. For the numerical optimisation, we 103 0.5
0 50 100 150 200 250 300 350
take ϵc = 10−15 and ϵs = 10−9. Conditioned on passing the checks Time window (Δt)
in the error-estimation and error-correction verification steps, an
ϵs-secret key of length ℓ can be generated that is secure against Fig. 2 Secret key length and QBER vs transmission duration.
general coherent attacks and is universally composable56. This Zenith overpass with different ηsys loss (solid lines), QBERI = 0.5%, and
pec = 5 × 10−7. Dashed lines represent truncated block QBERs. For
indicates it is not possible for a malicious party to take advantage each Δt, the SKL extractable from received data within −Δt to +Δt is
of changes to any underlying statistics in each data block that may optimised over protocol parameters. For the better ηsys loss values,
arise due to changes in channel losses in SatQKD. increasing Δt beyond 200 s leads to minor SKL improvement. For
In the following sections, we highlight constraints arising from the larger ηsys
loss , including data from low elevations is detrimental to the
quantum communication link and its implications for system design. SKL as seen by an increase in the truncated block averaged QBER.
It is also important to consider the constraints arising from the The non-smooth QBER appears since it is not the objective function
classical communication link. This is particularly important for SatQKD of the optimisation. The shaded region indicates the time when the
operations. We can use our finite key optimiser to provide an estimate satellite elevation is lower than θmin ¼ 10 .
for the number of classical bit transmission required in SatQKD for the
baseline system parameters summarised in Table 1 with ηsys loss ¼40 dB transmitting to an OGS with Dr = 21.3 cm, keeping all other
(see ‘Methods’ section ‘Classical communications for SatQKD’). system parameters the same.
We first consider how the SKL is affected by pec, which includes
Transmission time window optimisation both detector dark counts and background light. For DV-QKD,
A satellite overpass is limited in duration and experiences highly silicon single photon avalanche photodiodes (Si-SPADs) are
varying channel loss, hence the expected count rates and QBER will typically used for visible or near infrared wavelengths and can
change significantly throughout the pass. The received data achieve a dark count rate of a few counts per second with
obtained from lower elevations will have higher QBER compared thermoelectric cooling and temporal filtering58. Superconducting
to signals sent from higher elevations due to greater losses and the nanowire single photon detectors (SNSPDs)59 can offer superior
contribution of extraneous counts. This suggests that the SKL that wavelength sensitivity (particularly beyond 1 μm), dark count rate
could be extracted could be optimised by truncating poorer quality (less than 1 cps), and timing jitter, though at the expense of
data from the beginning and end of the transmission period in greater cost, size, weight, and power (SWaP), owing to the need
some circumstances, despite resulting in a shorter raw block57. for cryogenic operation. Background light, due to light pollution
Our approach is to first fix the transmission duration and optimise and celestial bodies (most notably the Moon) is the main
the protocol parameters to use during the pass, then iterate over the constraint to minimising pec60. We have used a simplified model
window duration to find the highest resulting SKL. We define the which does not include elevation dependent background light
transmission time window to run from −Δt to +Δt, where t = 0 levels (which is highly site dependent). The impact of varying pec
represents the time of highest elevation θmax . For each Δt, we find on the single overpass (solid), two-pass normalised (dashed), and
optimum protocol parameters that maximise the SKL extractable normalised block asymptotic (dotted) finite SKLs (see ‘Methods’
from the data block generated within this transmission window. We section ‘Asymptotic key length per pass’) is shown in Fig. 3a. For
impose a minimum elevation limit that reflects practicalities such as the finite variants, the SKL is determined using Eq. (3), where data
local horizon visibility and system pointing limitations. Here we use from either one (solid lines) or two (dashed lines) zenith
θmin ¼ 10 which for a zenith pass limits 2Δt to less than ~440 s. overpasses are processed as a single block. Multiple-pass SKLs
We show the SKL as a function of Δt for different ηsys are normalised by the number of passes to maintain a fair
loss values in
Fig. 2. For small ηsys comparison with the single pass SKL. For each scenario, while
loss , the QBER at low elevations does not rise greatly
above QBERI and it is better to construct keys from the greatest extraneous counts increase the vacuum yield sX;0 , any addition to
amount of data where Δt reaches the maximum allowed by θmin . the SKL is offset by reductions from worse phase error rates and
Conversely, for large ηsys error correction terms. For example, a factor of 10 increase in pec
loss , utilising only data from near zenith leads results in a 40% net reduction to the SKL for ηsys
to a longer SKL due to the better average QBER countering both the loss ¼ 27 dB. The
effect of extraneous counts is further compounded for large ηsys loss
smaller raw key length and larger statistical uncertainties.
values and can result in zero SKL due to an excessive QBER.
The QBER also suffers from effects such as non-ideal signals,
SKL system parameter dependence satellite-OGS reference frame misalignment, or imperfect projective
We now determine the dependence of the SKL on different measurements by the OGS. We characterise these by an intrinsic
system parameters, including extraneous counts pec, intrinsic system error, QBERI, which is independent of the count rate or
quantum bit errors QBERI, and the source repetition rate fs. The channel loss. Figure 3b illustrates the effect of different QBERI on the
optimised SKL is then determined for different ηsys
loss that model SKL. We observe that the finite key length is not as susceptible to
alternative SatQKD systems that differ from the baseline config- changes in the QBERI as compared with pec. The relative effects of
uration (Table 1) up to ηsys
loss ¼ 42 dB, corresponding to Micius both pec and QBERI on the SKL is illustrated in Fig. 4 (see also

npj Quantum Information (2022) 18 Published in partnership with The University of New South Wales
 J.S. Sidhu et al.
5

Fig. 3 SKL with system loss metric. Fixed system parameters were pap = 10−3, θmin ¼ 10 . In both plots, solid lines represent the optimised
SKL with a single zenith overpass, dashed lines represent the two-pass normalised SKL, and dotted lines represent the normalised block
asymptotic SKL (see ‘Methods’ section ‘Asymptotic key length per pass’). a SKL dependence on pec with QBERI = 0.5%. The maximum pec
represents operation near a full Moon or with severe light pollution. b SKL dependence on QBERI with pec = 5 × 10−7 per pulse.

Protocol parameters that affect the SKL include signal

intensities μj, their probabilities pj, and basis bias pX. The optimum
values of these system parameters generally depend on ηsys loss and
the overpass geometry. The optimal key generation basis choice
probability pX decreases with increasing ηsys loss . As the OGS detects
fewer photons with increasing loss, leading to worse parameter
estimation of sX,0, sX,1 and ϕX due to greater statistical fluctuations,
to compensate we need to collect more Z basis events by
increasing 1 − pX. The reduced number of key generation events is
outweighed by better bounds on the key length parameters. This
implies that the uncertainties in the parameter estimation from
finite statistics dominates the SKL compared with raw key length
when ηsys
loss is large (Supplementary Fig. 3).

Fig. 4 SKL versus pec and QBERI. Single zenith overpass with ηsys SKL and overpass geometry
loss
values: a 27 dB, b 33 dB, c 37 dB, and d 40 dB. The grey region A typical satellite overpass will not go directly over zenith but will
indicates zero SKL. pass within some minimum ground track offset d min of the OGS,
reaching a maximum elevation θmax ð<90 Þ (Fig. 1a). To maximise
Supplementary Fig. 1). The SKL varies greatly along the pec direction, the number of overpass opportunities that can generate a secret
with zero finite key returned for large pec irrespective of key, a SatQKD system should be able to operate with as low a
improvements to QBERI. This indicates that improvements to maximum elevation θmax as possible. The SKL per pass as a
background light suppression and detector dark count over source function of d min is shown in Fig. 5 for different ηsys loss values. As
fidelities and satellite alignment should be prioritised. expected, overpasses with smaller θmax deliver smaller SKLs due to
We can estimate the effect of increasing the source rate fs by shorter transmission times and lower count rates from large
incorporating a correction factor to ηsys average ηlink at lower elevations and longer ranges. The SKL
loss for the current results.
Since the SKL is a function of fnμk ; mμk g, these only depend on the vanishes once θmax is below a critical elevation angle θ max when
integrated product of the source rate and the link efficiency, with the small block size leads to excessive statistical uncertainties or
all other system parameters kept the same. Therefore, a 100 MHz the average QBER becomes too high.
source at a given ηsys We now can estimate the long-term average amount of secret
loss provides the same amount of raw key as a key that can be generated using single overpass blocks with an
1 GHz source with a 10 dB larger system loss metric, e.g.
OGS site situated at a particular latitude. We first integrate the area
corresponding to a three times smaller OGS receiver diameter
under the SKL vs d min curve,
(Supplementary Fig. 2). This approximation, however, neglects Z dþmin
extraneous counts and the resultant instantaneous QBER which is
SKLint ¼ 2 SKLdmin ddmin ; (5)
unaffected by the source rate but does depend on ηsys loss . 0
Nevertheless, the above heuristic holds provided the contribution
where d þ min is the maximum OGS ground track offset that
of pec to QBER is small and thus SKL is mostly constrained by raw generates key. Assuming a sun synchronous orbit, we then
key length and statistical uncertainties. estimate the expected annual key from (neglecting weather),
Practically, the amount of raw key that could be transmitted
during an overpass may be limited by the amount of available SKLint
SKLyear ¼ Nyear
orbits ; (6)
stored random bits, irrespective of increases in fs. Real-time Llat
quantum random number generation can overcome this though where Nyear
orbits is the number of orbits per year, and Llat is the
at the expense of increased SWaP, which is often constrained on longitudinal circumference along the line of latitude at a single
smaller satellites. Even with limits on the amount of raw key OGS location (see Methods section ‘Expected annual SKL’). This
available, increasing fs can still be advantageous by compressing estimate assumes that d min is evenly distributed (unless in an Earth
the transmission into a smaller duration around θmax , which synchronous orbit28) and the OGS is not close to the poles where
decreases the average loss per transmitted block. the orbital inclination (~97°) invalidates the approximation of even

Published in partnership with The University of New South Wales npj Quantum Information (2022) 18
 J.S. Sidhu et al.
6

Fig. 6 Per-pass SKL vs Number of combined overpasses. Secret

key is generated from combined multiple overpass data. Zenith
overpasses with θmin ¼ 10 . System parameter sets
fηloss ; pec ; QBERI g: A = {45.7 dB, 10−7, 0.5%}, B = {44.8 dB, 10−7, 1%},
sys
Fig. 5 SKL vs ground track off-set. pec = 5 × 10−7 and QBERI = and C = {40.5 dB, 5 × 10−7, 1%}.
0.5%. The key generation footprint is given by the maximum d min
with non-zero SKL. Solid lines correspond to imposing θmin ¼ 10
(indicated by dark grey region on the right) and dashed lines to no increasing M, with the largest jump going from M = 1 to 2.
elevation limit. The shaded areas under the curves determine the Averaging over several identical passes does not improve the
expected annual SKL for different ηsys
loss . Imposing θmin ¼ 10 reduces
 underlying block averaged signal parameters such as QBER, hence
the area, and hence the expected annual SKL, by 18.82%, 13.37%, the per-pass SKL improvement is mainly due to smaller estimation
and 3.58% at 27 dB, 30 dB, and 33 dB, respectively. uncertainties from increased sample size, with better error
correction efficiency and reduced λEC also contributing. This
shows that finite statistical fluctuations are the principle limitation
Table 2. Expected annual SKL for different ηsys to the SKL that can be generated with a limited number of
loss . The SKLint values
correspond to the area under each SKL vs d min curve in Fig. 5 with overpasses.
units of bit-metres (bm). Practically, employing multiple passes to improve SKL genera-
tion should be balanced against greater latency and potential
55:9 N
ηsys
loss SKLint SKLyear security vulnerabilities in storing large amounts of raw data for a
longer period between passes. This will depend on the assumed
27 dB 3.74 × 1012 bm 0.9131 Gb security model and anticipated attack surfaces of the encryption
30 dB 1.52 × 1012 bm 0.3720 Gb keys at rest61.
33 dB 5.40 × 1011 bm 0.1318 Gb
37 dB 8.75 × 1010 bm 0.0214 Gb Protocol performance
40 dB 1.13 × 1010 bm 0.0028 Gb The choice of QKD protocol can also significantly affect the SKL
∘
due to finite block size statistics. This is illustrated by comparing
For h = 500 km, Nyear
orbits  5500, and at 55.9 N (latitude of Glasgow) L55:9 N 


2:25 ´ 107 m, the expected annual key volume

two BB84 variants: efficient BB84 (considered thus far)54 and
SKLyear ¼ 2:44 ´ 104 SKLint m1 . We assume θmin ¼ 10 , pec = 5 × 10−7, and standard BB8462. The main difference is the basis choice bias, with
QBERI = 0.5%. standard BB84 choosing both X and Z bases with equal
(symmetric) probability, while efficient BB84 allows biased
(asymmetric) basis choice. Standard BB84 also uses both bases
distribution. In Table 2, we summarise the expected yearly secret to generate key, hence requires parameter estimation of both.
∘
finite key lengths attainable for various ηsys
loss at latitude 55. 9 N. Efficient BB84 uses only one basis for key generation and the other
for parameter estimation. We refer to the two protocols as s-BB84
Multiple satellite passes and a-BB84, respectively.
In general a-BB84 produces higher SKL for all system loss
Disregarding latency of key generation, data from several over-
metrics, can tolerate larger ηsys loss , and operate with lower θmax
passes can be combined to improve SKL generation. Figure 3
(Supplementary Fig. 4). The expected annual SKL (as in section
displays finite and asymptotic SKLs for a single zenith overpass. ‘SKL and overpass geometry’) with a-BB84 and s-BB84 for the
The overpass-normalised asymptotic SKL corresponds to multiple baseline system parameters (Table 1) is obtainable from Fig. 7. For
overpasses where the block sizes used for key rate determination ηsys
loss ¼ 33 dB and 40 dB, a-BB84 generates 70% and 182% times
tend to infinity. Instead of Eq. (2), we aggregate data from more key on average, respectively. The advantage increases with
separate overpasses (with the same geometry and protocol larger ηsys
loss due to several reasons. First, the better sifting ratio of
parameters) into a single processing block without segmented a-BB84 results in more raw bits that also allows for better
instantaneous asymptotic key rates, only assuming asymptotically parameter estimation. Second, a-BB84 uses all events in one basis
ascertained combined block parameters. The process of taking the to estimate the vacuum and single photon yields in the other. In
block size to infinity requires care due to the limited amount of contrast, s-BB84 reveals an optimally sized random sample of
data per pass (see ‘Methods’ section ‘Asymptotic key length per results for each basis to separately estimate signal parameters.
pass’). The per-pass SKL increases significantly as the block Hence only half the revealed results are used for each basis
asymptotic regime is approached. estimation, leading to worse statistical uncertainties.
Systems with zero single-overpass SKL can generate positive A tangential advantage is that a-BB84 requires less classical
key by accumulating signals from several overpasses (Fig. 6). If ℓM communication than s-BB84. In a-BB84 the choice of bits for public
is the total SKL generated from M identical satellite passes, then comparison for QBER estimation is implicit in the basis choice and
ℓM ≥ Mℓ1 with diminishing improvement ℓM+1 − ℓM with automatically revealed during sifting. A minor disadvantage to

npj Quantum Information (2022) 18 Published in partnership with The University of New South Wales
 J.S. Sidhu et al.
7
An immediate extension would include a more comprehensive
time and elevation dependent quantum channel model incorpor-
ating scattering, turbulence, and anisotropic background light
distributions. Site dependent scenarios could include local horizon
limits, light pollution, and seasonal weather effects. We can
constrain the optimisation of the protocol parameters to reflect
additional restrictions on system operations and deployment in
practice. Ultimately, design and optimisation of SatQKD systems
should incorporate orbital modelling of constellations and ground
stations geographic diversity together with cost/performance
trade-off studies.

METHODS
Finite key analysis for decoy-state BB84
The Bennett-Brassard 1984 (BB84) quantum key distribution (QKD)
Fig. 7 Protocol effect on SKL vs ground track offset. Shown are protocol is widely implemented owing to its simplicity, overall perfor-
a-BB84 (solid lines) and s-BB84 (dashed lines) with pec = 5 × 10−7, mance and provable security62. However, practical implementations of
QBERI = 0.5%. BB84 depart from the use of idealised single-photon sources. Instead, weak
pulsed laser sources are used given their wide availability and relative ease
a-BB84 is the extra overhead in generating biased basis of implementation. This improves repetition rates over current single
probabilities63, but the advantage of s-BB84 in this regard is photon sources, but leaves the BB84 protocol vulnerable to photon-
relatively small taking into account all the biased probabilities number-splitting (PNS) attacks that exploit the multi-photon pulse fraction
required for both decoy-state variants. present in emitted laser pulses64.
Decoy-state protocols circumvent PNS attacks and improve tolerance to
high channel losses, with minimal modification to BB84 implementations.
DISCUSSION These protocols employ multiple phase randomised coherent states with
differing intensities that replace signal pulses. This modification permits
Important differences with fibre-based QKD mean that small better characterisation of the photon number distribution of transmitted
sample statistical uncertainties have a significant impact on the pulses associated with detection events65, which reliably detect the
performance of satellite QKD. The restricted overpass time of a presence of PNS attacks in the quantum channel. Decoy-state BB84
LEO satellite constrains the amount of sifted key that can be protocols also allow better estimation of the secure fraction of the sifted
established with an optical ground station. Operationally, a secret raw key (vacuum and single photon yields), which makes them a secure
key may need to be generated from a single pass, thus statistical and practical implementation of QKD.
uncertainties will significantly impact performance in practical The security of decoy-state QKD was initially developed assuming the
scenarios. Our study examines the severity of finite-key effects for asymptotic-key regime66,67. For applications with finite statistics, uncer-
tainties in the channel parameters cannot be ignored68–70. Early
representative space-ground quantum channel link efficiencies as approaches in handling these finite key statistics used Gaussian assump-
indicated by the in-orbit demonstration of Micius. tions to bound the difference between the asymptotic and finite results71.
Our results highlight the influence of system and protocol This restricts the security to collective and coherent attacks. Security
parameters on the secret key length that can be generated from a analyses for more general attacks have also been developed72. The
single overpass. For the range of system loss metrics considered multiplicative Chernoff bound39,71 and Hoeffding’s inequality33 can be
(ηsys
loss ¼ 27 to 42 dB), the strongest dependence comes from the
used to bound the fluctuations between the observed values and the true
degree by which extraneous counts (pec) can be suppressed, with expectation value. Recently, a more complete finite-key analysis for decoy-
a much weaker dependence on the intrinsic signal/measurement state based BB84, with composable security, has been presented in ref. 36,
which uses the multiplicative Chernoff bound to derive simple analytic
quality (QBERI) of the system. There is also a minimal effect of
expressions that are tight.
imposing a minimum elevation limit for quantum signal Due to limited transmission times, satellite-based quantum commu-
transmission. This suggests that SatQKD systems should prioritise nications are strongly affected by finite statistics. To model different
background light suppression over higher intrinsic quantum signal SatQKD systems, we improve the analysis in ref. 33 with recent develop-
visibilities or extending transmission closer to the horizon. ments in modelling statistical fluctuations arising from finite statistics. This
The dominance of finite-key effects is highlighted by the improvement leads to a more robust SKL and is imprinted through the
comparison between efficient (asymmetric basis bias) BB84 with finite statistic correction terms δXðZÞ;k
±
, which we define using the inverse
36,71
conventional (symmetric basis bias) BB84. The much greater secret multiplicative Chernoff bound . Specifically, let Y denote a sum of M
key length of efficient BB84 stems from a better sifting ratio and independent Bernoulli samples, which need not be identical. Denote y∞ as
the expectation value of Y, with y the observed value for Y from a single
longer raw key length as well as obviating the need to perform
experimental run. The magnitude of difference between the observed and
parameter estimation for two bases that would further compound expected values depends on the statistics available. To quantify this
the finite statistical uncertainty. This greater performance trans- deviation, we determine the probability that y  y 1 þ δþ Y is less than a
lates into a higher secret key length for a given overpass geometry fixed positive constant ε > 0, and the probability that y  y 1  δ Y is less
and also extends the satellite ground footprint within which secret that ε. This is achieved through setting
key can be established with a ground station. Overall, improve- sffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
qffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi
ments in system performance, whether through better protocols, þ  β β2 (7)
δY ¼ β þ 2βy þ β ; δY ¼ þ 2βy þ ;
2
smaller system loss metrics, or higher source rates, can 2 4
significantly expand expected annual secret key volumes, e.g. a where β ¼ lnð1=εÞ36. Hence, we define the following finite sample size
reduction of 3 dB in the system loss metric from 40 dB to 37 dB data block size
improves the expected annual key volume by a factor of 7.6. k
h i
Should operations allow, secret key extraction efficiency can also
±
nXðZÞ;k ¼ pek nXðZÞ;k ± δn±XðZÞ;k ;
be enhanced by combining data blocks from several passes, k
h i (8)
±
mXðZÞ;k ¼ pe mXðZÞ;k ± δm± XðZÞ;k ;
especially if no secret is possible from a single overpass. k

This preliminary study of SatQKD finite-key effects can be for the number of events and errors respectively in the X(Z) basis. From
extended to remove some simplifications and approximations. this, we define the vacuum and single photon yields, and the phase error

Published in partnership with The University of New South Wales npj Quantum Information (2022) 18
 J.S. Sidhu et al.
8
definition to estimate the information leaked during error correction in the
finite key regime.
These post-processing terms define the attainable finite key, subject to
rigorous statistical analyses. The key length is a function of the basis
encoding probability, pX , the source intensities and their probabilities,
{μj, pj} for j ∈ {1, 2, 3}, and the transmission time window, Δt, used to
construct block data for a satellite pass. Without loss of generality, we set
the second decoy state intensity as the vacuum μ3 = 0. For a defined
SatQKD system, we generate an optimised finite key length by optimising
over the parameter space of the six variables: {pX, μ1, μ2, p1, p2, Δt}. A
baseline for system performance used in this work is detailed in Table 1 in
the main text. This procedure can be generalised for any satellite trajectory.
Fig. 8 illustrates a pseudocode of our numerical optimiser, which is
available as open source software55.

Asymptotic key length per pass

In this section, we provide an operational definition for the asymptotic key
length per pass and explain how it can be determined by adapting the
finite key optimiser. Data is combined from multiple satellite passes.
The optimisation over the protocol parameters is then performed on the
combined results and a secret key is extracted. For the following, we
assume that each satellite pass has the same trajectory. With minimal
modification, this can be extended to varying satellite trajectories for
each pass.
Denoting ℓM as the SKL attained from M satellite passes, we saw in Fig. 6
that ℓM ≠ Mℓ1. We also saw that the improvement to the SKL decreased
with increasing number of satellite passes. This leads to a natural question:
what is the largest attainable SKL per pass? This is given by the asymptotic
secret key length ℓ1 ¼ lim ℓM =M. The key length, ℓM, is found using
M!1
equation (4), and the quantity ℓ∞ is determined by examining the
asymptotic scaling of ℓM/M.
The estimate for the vacuum counts per pass is33,
Fig. 8 Pseudocode for the optimised finite key length. We sX;0
 þ
τ 0 μ2 Γ3 ðnX;3  δX;3 Þ  μ3 Γ2 ðnX;2 þ δX;2 Þ
consider a pulse repetition rate fs, M satellite passes in the plane ¼ ; (10)
offset by angle ξ from the zenith plane, and time dependent losses M μ2  μ3 M
L. An elevation constraint of θmin ¼ 10 imposes realistic local where nX,k is the number of sifted counts in the X-basis, from pulses of
constraints of establishing an optical link between the OGS and intensity k, τ0 is averaged probability that a vacuum state is transmitted by
satellite. The key length is optimised over all protocol parameters the laser, Γk ¼ expðμk Þ=pk and δX;k ±
are correction terms that account for
and a transmission time window Δt over which the raw key is the finite statistics. In ref. , δX;k is derived from Hoeffding’s inequality. A
33 ±

acquired. The correction terms δXðZÞ;k

±
for bases X(Z) and the higher SKL is attained by instead deriving these correction terms from the
intensities μk are determined from the multiplicative Chernoff multiplicative Chernoff 36
pffiffiffiffiffibound . The asymptotic scaling of these correc-
bound that account for finite statistics36. tion terms are Oð nX Þ. This scaling is independent of whether the
Hoeffding and Chernoff bounds are used. Thispscaling ffiffiffiffi implies that the
scaling with the number of satellite passes is Oð MÞ. Hence, δX;k
pffiffiffiffi
±
=M scales
rate of single-photon events using ref. 33 (see also pseudocode 1 in Fig. 8) Oð1= MÞ and thus tends to zero as M → ∞. The finite statistics correction
that determines the finite key length. terms thus go to zero, as expected.
An important step in any QKD protocol is error correction. This Since each satellite pass is assumed to have the same orbit, the total
necessitates classical communication, of λEC bits, which are assumed number of counts accumulated nX;k is equal to M times the corresponding
ð1Þ
known to Eve. This must be taken account of in the privacy amplification number of counts for a single pass, nX;k . From this, we obtain
stage. While λEC is known for practical implementations of the protocol, it sX;0 τ0  
ð1Þ ð1Þ
must be estimated for the finite key optimisation. An overly conservative lim ¼ μ2 Γ3 nX;3  μ3 Γ2 nX;2 ¼ s1X;0 ; (11)
M!1 M μ2  μ3
estimate would yield no key in a region of the parameter space where one
should be viable. Conversely, an overly optimistic value for λEC leads to where s1X;0 is the asymptotic estimate of the vacuum counts for a single
spurious results. This highlights the importance of choosing a good pass, which we define formally in the next paragraph. By following a similar
estimate. It is standard to model the channel as a bit-flip channel33,35. This process for each term in ℓM/M, we obtain
leads to λEC ¼ fEC nX h2 ðQÞ, where Q is the QBER and fEC the reconciliation   1
ℓ1 ¼ bs1 X;0 þ sX;1 1  hðϕX Þ  λ EC c;
1 1
(12)
factor. The value for fEC is chosen slightly above unity, e.g. 1.16. The use of
a constant reconciliation factor is a simple way of accounting for where ϕ1 X ¼ ν Z;1 =sZ;1 is the phase error rate, sX;1 , sZ;1 and νZ;1 are the single
1 1 1 1 1
inefficiency in the error correction protocol. This approach is normally pass asymptotic estimates for: the single photon counts in the X basis, the
sufficient when determining the optimal secret key length. However, for Z basis, and the single photon errors in the Z basis, respectively.
satellite QKD, one operates with high losses that are at the limit of where The asymptotic quantities: ν1 1 1
Z;1 , sX;0 and sXðZÞ;1 , correspond to averaging
one can extract a key. As such, it is beneficial to use a more refined the single pass quantities over infinitely many passes. More formally, let
estimate of λEC. u 2 fϕX ; νZ;1 ; sXðZÞ;0 ; sXðZÞ;1 ; λEC g, and let u(M) denote the quantity estimated
A better estimate for λEC is given in ref. 35. In this approach, the using the full data from M passes. The asymptotic quantity is then defined
correction to nX hðQÞ depends on the data block size. In particular, as
h i
λEC ¼ nX hðQÞ þ nX ð1  QÞ log ð1QÞ Q uðMÞ
  h i u1 ¼ lim : (13)
(9) M!1 M
 F 1 ðϵc ; nX ; 1  Q; Þ  1 log ð1QÞ
Q

 12 logðnX Þ  logð1=ϵc Þ; A refined estimate of λEC and its upper bound on the asymptotic
behaviour is provided in ref. 35. From this, we determine that
−1 ð1Þ
where nX is the data block size, Q is the QBER and F is the inverse of the λ1
EC ¼ nX hðQÞ, where Q is the QBER for a single pass. When running
cumulative distribution function of the binomial distribution. We utilise this the finite key optimiser for the asymptotic key length per pass, we define

npj Quantum Information (2022) 18 Published in partnership with The University of New South Wales
 J.S. Sidhu et al.
9
ð1Þ
λ1EC ¼ 1:16nX hðQÞ, which accounts for inefficient error correction even in
the asymptotic limit.
Rather than looking at the key length per pass, it is also common to
consider the key rate, i.e. the number of secret key bits per transmitted
pulse. Let N be the total number of pulses transmitted by the satellite
during a single pass. The key rate for M passes is just SKRM = ℓM/(MN). In
the limit of infinitely many passes, the asymptotic key rate is given by
SKR∞ = ℓ∞/N.
Notice that our analysis of the asymptotic secret key rate, SKR∞ differs
from the route often taken in the literature. Specifically, the asymptotic key
rate can be determined as a function of different elevation angles. The
data is then combined according to Eq. (1). While such an approach is
possible if we extract keys for each angle of elevation, it is not appropriate
for the current analysis, where we group all the data for a pass and then
extract a key from the combined data.

Classical communications for SatQKD

In traditional fibre-based QKD, the cost of classical communications is
often overlooked given the availability of the internet backbone. However,
in SatQKD classical radio communications is often constrained due to
restrictions in antenna size and power, and thus could possibly represent a
bottleneck in the reconciliation process. Fig. 9 Satellite key generation footprint. We consider a satellite in
We estimate the classical communication capacity required for secret SSO with inclination 98°. The width of the striped purple arrow
key generation in SatQKD. Using the baseline system parameters from underneath the satellite orbit in the longitudinal direction defines
Micius summarised in Table 1, we consider a system loss metric of the operational key generation footprint for a SatQKD system. For a
ηsys
loss ¼ 40 dB for a zenith pass. For BB84 there are five stages requiring four near polar orbit, the density of satellite overpasses over high latitude
distinct rounds of classical communication between the satellite (Alice) locations is larger and hence the annual SKL is enhanced.
and the OGS (Bob) to process a block:
1. Alice to Bob: Prior to any classical transmission, Alice first encodes Expected annual SKL
information in the polarisation basis of WCPs that are transmitted to We can estimate the expected annual secret key length from SKL vs
Bob. Based on our finite key optimiser, the optimal time window for ground track offset relation. Consider a satellite in sun synchronous orbit
ηsys (SSO) at an inclination of ~98∘. For OGS latitudes below 60∘, this can be
loss ¼ 40 dB is a total of 200 s centred at zenith (Δt = 100 s) with
signal parameters of μ1 = 0.697364, p1 = 0.738668, μ2 = 0.159325, approximated by a polar orbit (Fig. 9). The precession period of a SSO is
p2 = 0.189355, μ3 = 0, p3 = 0.0720, and a basis encoding probability one year, during which time the satellite makes ~5500 orbits.
PX = 0.725313. This results in the expected detections by Bob of The striped purple ground path below the satellite is the key generation
nX ¼ 536038 and nZ ¼ 203006 in the X and Z bases, respectively. footprint. As the Earth rotates daily under the orbit of the satellite, the key
2. Bob to Alice: Bob needs to report to Alice the time-slot positions and generation footprint intercepts the line of latitude uniformly on average
basis values for each detection event. To specify a time-slot position throughout the year. Note, this is under the assumption that the orbital
requires a maximum of dlog2 ð2Δtf s Þe ¼ 36 bits with a naïve period is not rationally related to the length of the solar day, i.e. not for a
encoding. Bob detected nB ¼ nX þ nZ ¼ 739044 events and uses simultaneous SSO and Earth synchronous orbit. Since at low latitudes the
36 + 1 bits per event in his bit string which is < 27 Mb. distance around the line of latitude is greater than for higher latitudes, the
3. Alice to Bob: Alice confirms to Bob the time-slot of the detected key generation footprint represents a smaller fraction of the longitudinal
events for which the bases matched. She also transmits along with circumference. Hence, on average, the satellite is more likely to pass close
each reconciled event the intensity of the pulse (2 bits), and if sent to the OGS at higher latitudes.
in the Z basis (1 bit), the sent bit value. After basis reconciliation
there are on average nX = 388795, nZ = 55763 events in the X and Z
bases, respectively. Alice reports nA = nX + nZ = 444558 events and DATA AVAILABILITY
uses at most 36 + 2 + 1 bits per event in her bit string which results The data that support the findings of this study are available from the corresponding
in < 20 Mb data to be downlinked. authors upon reasonable request.
4. Bob to Alice: Bob now calculates the phase and bit error rates using
Alice’s reconciliation data and then transmits to Alice the
parameters for the error correction code to use, e.g. which pre- CODE AVAILABILITY
agreed set of low density parity check (LDPC) codes to use, as well
The code that supports the findings of this study has been released as open source
as the dimensions of the privacy amplification matrix, which require
software with documentation in ref. 55.
bit strings of size ≪ 1 kb.
5. Alice to Bob: Alice calculates the specified error correction
syndromes and transmits the results to Bob who then performs Received: 7 May 2021; Accepted: 15 December 2021;
the error correction on his side. We estimate the amount of
syndrome data to be transmitted by the amount of leaked
information, λEC = 55360 bits, hence Alice sends < 60 kb down to
Bob in this step.
The total classical communication required in the above steps is less REFERENCES
than 50 Mb (6.25 MB), of which ~27 Mb is uplinked and ~20 Mb is 1. Dowling, J. P. & Milburn, G. J. Quantum technology: the second quantum revo-
downlinked. lution. Philos. Trans. R. Soc. A 361, 1655 (2003).
Note for the classical communication exchange in satellite QKD, steps 2. Proctor, T. J., Knott, P. A. & Dunningham, J. A. Multiparameter estimation in
two and three can start as soon as Bob starts receiving counts. However, networked quantum sensors. Phys. Rev. Lett. 120, 080501 (2018).
steps four and five can only occur after Bob receives the final counts that 3. Sidhu, J. S., Ouyang, Y., Campbell, E. T. & Kok, P. Tight bounds on the simulta-
make up the block, but the amount of data in these steps is minimal. This neous estimation of incompatible parameters. Phys. Rev. X 11, 011028 (2021a).
indicates that the bulk of the classical communication exchange can occur 4. Sidhu, J. S. & Kok, P. Geometric perspective on quantum parameter estimation.
in parallel to the quantum transmission. AVS Quantum Sci. 2, 014701 (2020).

Published in partnership with The University of New South Wales npj Quantum Information (2022) 18
 J.S. Sidhu et al.
10
5. Scarani, V. et al. The security of practical quantum key distribution. Rev. Mod. Phys. 41. Lim, C. C.-W., Xu, F., Pan, J.-W. & Ekert, A. Security analysis of quantum key
81, 1301 (2009). distribution with small block length and its application to quantum space
6. Pirandola, S. et al. Advances in quantum cryptography. Adv. Opt. Photon. 12, 1012 communications. Phys. Rev. Lett. 126, 100501 (2021).
(2020). 42. Yin, J. et al. Entanglement-based secure quantum cryptography over 1,120
7. Sidhu, J. S., Izumi, S., Neergaard-Nielsen, J. S., Lupo, C. & Andersen, U. L. Quantum kilometres. Nature 582, 501 (2020b).
receiver for phase-shift keying at the single-photon level. PRX Quantum 2, 010332 43. Usenko, V. C. et al. Entanglement of Gaussian states and the applicability to
(2021). quantum key distribution over fading channels. N. J. Phys. 14, 093048 (2012).
8. Sidhu, J. S., Bullock, M. S., Guha, S. & Lupo, C. Unambiguous discrimination of 44. Hosseinidehaj, N., Walk, N. & Ralph, T. C. Composable finite-size effects in free-
coherent states. arXiv:quant-ph/2109.00008. Preprint at https://arxiv.org/abs/ space continuous-variable quantum-key-distribution systems. Phys. Rev. A 103,
2109.00008 (2021). 012605 (2021).
9. Knill, E., Laflamme, R. & Milburn, G. J. A scheme for effcient quantum computation 45. Chen, Y.-A. et al. An integrated space-to-ground quantum communication net-
with linear optics. Nature 409, 46 (2001). work over 4,600 kilometres. Nature 589, 214 (2021).
10. Wehner, S., Elkouss, D. & Hanson, R. Quantum internet: a vision for the road 46. Liorni, C., Kampermann, H. & Bruß, D. Satellite-based links for quantum key dis-
ahead. Science 362, 6412 (2018). tribution: beam effects and weather dependence. N. J. Phys. 21, 093055 (2019).
11. Humphreys, P. C., Barbieri, M., Datta, A. & Walmsley, I. A. Quantum enhanced 47. Vasylyev, D., Semenov, A. & Vogel, W. Atmospheric quantum channels with weak
multiple phase estimation. Phys. Rev. Lett. 111, 070403 (2013). and strong turbulence. Phys. Rev. Lett. 117, 090501 (2016).
12. Kómár, P. et al. A quantum network of clocks. Nat. Phys. 10, 582 (2014). 48. Andrews, L. C. & Phillips, R. L. Laser Beam Propagation Through Random Media
13. Polino, E. et al. Experimental multiphase estimation on a chip. Optica 6, 288 (2019). (SPIE Press, 2005) .
14. Guo, X. et al. Distributed quantum sensing in a continuous-variable entangled 49. Berk, A. et al. MODTRAN6: a major upgrade of the MODTRAN radiative transfer
network. Nat. Phys. 16, 281 (2020). code. In Proc. SPIE, Vol. 9088 (2014).
15. Ilo-Okeke, E. O., Tessler, L., Dowling, J. P. & Byrnes, T. Remote quantum clock 50. Vasylyev, D., Vogel, W. & Moll, F. Satellite-mediated quantum atmospheric links.
synchronization without synchronized clocks. NPJ Quantum Inf. 4, 40 (2018). Phys. Rev. A 99, 053830 (2019).
16. Jozsa, R., Abrams, D. S., Dowling, J. P. & Williams, C. P. Quantum clock synchro- 51. Pirandola, S. Satellite quantum communications: fundamental bounds and
nization based on shared prior entanglement. Phys. Rev. Lett. 85, 2010 (2000). practical security. Phys. Rev. Res. 3, 023130 (2021).
17. Qian, T., Bringewatt, J., Boettcher, I., Bienias, P. & Gorshkov, A. V. Optimal mea- 52. Toyoshima, M. et al. Polarization measurements through space-to-ground
surement of field properties with quantum sensor networks. Phys. Rev. A 103, atmospheric propagation paths by using a highly polarized laser source in
L030601 (2021). space. Opt. Express 17, 22333 (2009).
18. Fitzsimons, J. F. Private quantum computation: an introduction to blind quantum 53. Vergoossen, T., Loarte, S., Bedington, R., Kuiper, H. & Ling, A. Modelling of satellite
computing and related protocols. NPJ Quantum Inf. 3, 23 (2017). constellations for trusted node QKD networks. Acta Astronautica 173, 164 (2020).
19. Yin, H.-L. et al. Measurement-device-independent quantum key distribution over 54. Lo, H.-K., Chau, H. F. & Ardehali, M. Efficient quantum key distribution scheme and
a 404 km optical fiber. Phys. Rev. Lett. 117, 190501 (2016). a proof of its unconditional security. J. Cryptol. 18, 133 (2005a).
20. Boaron, A. et al. Secure quantum key distribution over 421 km of optical fiber. 55. Sidhu, J. S., Brougham, T., McArthur, D., Pousa, R. G. & Oi, D. K. L. Satellite quantum
Phys. Rev. Lett. 121, 190502 (2018). modelling & analysis software version 1.0: Documentation.arXiv:2109.01686.
21. Boaron, A. et al. Progress on quantum key distribution using ultralow loss fiber. Preprint at https://arxiv.org/abs/2109.01686 (2021).
book Optical Fiber Communication Conference. J. Opt. Soc. Am. M4A-5 (2020). 56. Renner, R. Security of Quantum Key Distribution. Ph.D. thesis. Swiss Federal
22. Chen, J.-P. et al. Sending-or-not-sending with independent lasers: secure twin- Institute of Technology, Zurich. arXiv:quant-ph/0512258. Preprint at https://arxiv.
field quantum key distribution over 509 km. Phys. Rev. Lett. 124, 070501 (2020). org/abs/quant-ph/0512258 (2006).
23. Sidhu, J. S. et al. Advances in space quantum communications. IET Quantum 57. Wang, W., Xu, F. & Lo, H.-K. Prefixed-threshold real-time selection method in free-
Commun. 2, 182–217 (2021). space quantum key distribution. Phys. Rev. A 97, 032337 (2018).
24. Gündoğan, M. et al. Proposal for space-borne quantum memories for global 58. Ceccarelli, F. et al. Recent advances and future perspectives of single-photon
quantum networking. npj Quantum Inf. 7, 128 (2021). avalanche diodes for quantum photonics applications. Adv. Quantum Technol. 4,
25. Hughes, R. et al. Quantum cryptography for secure free-space communications. 2000102 (2021).
Proc. SPIE 3615, 98 (1999). 59. Holzman, I. & Ivry, Y. Superconducting nanowires for single-photon detection:
26. Kurtsiefer, C. et al. A step towards global key distribution. Nature 419, 450 (2002). progress, challenges, and opportunities. Adv. Quantum Technol. 2, 1800058
27. Oi, D. K. L. et al. Cubesat quantum communications mission. EPJ Quantum (2019).
Technol. 4, 6 (2017). 60. Er-long, M. et al. Background noise of satellite-to-ground quantum key distribu-
28. Mazzarella, L. et al. QUARC: quantum research cubesat—a constellation for tion. N. J. Phys. 7, 215 (2005).
quantum communication. Cryptography 4, 7 (2020). 61. Alléaume, R. Implementation security of quantum cryptography: Introduction,
29. Polnik, M. et al. Scheduling of space to ground quantum key distribution. EPJ challenges, solutions. ETSI White Pap. 27, 28 (2018).
Quantum Technol. 7, 3 (2020). 62. Bennett, C. H. & Brassard, G. Quantum cryptography: Public key distribution and
30. Villar, A. et al. Entanglement demonstration on board a nano-satellite. Optica 7, coin tossing. Proc. IEEE Int. Conf. Comput., Syst. & Signal Process., 175 (1984).
734 (2020). 63. Gryszka, K. From biased coin to any discrete distribution. Period. Math. Hung. 83,
31. Jianwei, P. Progress of the quantum experiment science satellite (QUESS) Micius 71 (2020).
project. Chin. J. Space Sci. 38, 604 (2018). 64. Brassard, G., Lütkenhaus, N., Mor, T. & Sanders, B. C. Limitations on practical
32. Tomamichel, M., Lim, C. C. W., Gisin, N. & Renner, R. Tight finite-key analysis for quantum cryptography. Phys. Rev. Lett. 85, 1330 (2000).
quantum cryptography. Nat. Commun. 3, 634 (2012). 65. Hwang, W.-Y. Quantum key distribution with high loss: toward global secure
33. Lim, C. C. W., Curty, M., Walenta, N., Xu, F. & Zbinden, H. Concise security bounds communication. Phys. Rev. Lett. 91, 057901 (2003).
for practical decoy-state quantum key distribution. Phys. Rev. A 89, 022307 (2014). 66. Wang, X.-B. Beating the photon-number-splitting attack in practical quantum
34. Rusca, D., Boaron, A., Grünenfelder, F., Martin, A. & Zbinden, H. Finite-key analysis cryptography. Phys. Rev. Lett. 94, 230503 (2005).
for the 1-decoy state QKD protocol. Appl. Phys. Lett. 112, 171104 (2018). 67. Lo, H.-K., Ma, X. & Chen, K. Decoy state quantum key distribution. Phys. Rev. Lett.
35. Tomamichel, M., Martinez-Mateo, J., Pacher, C. & Elkouss, D. Fundamental finite 94, 230504 (2005).
key limits for one-way information reconciliation in quantum key distribution. 68. Ma, X., Qi, B., Zhao, Y. & Lo, H.-K. Practical decoy state for quantum key dis-
Quantum Inf. Process. 16, 280 (2017). tribution. Phys. Rev. A 72, 012326 (2005).
36. Yin, H.-L. et al. Tight security bounds for decoy-state quantum key distribution. 69. Hasegawa, J., Hayashi, M., Hiroshima, T. & Tomita, A. Security analysis of decoy
Sci. Rep. 10, 14312 (2020a). state quantum key distribution incorporating finite statistics. arXiv:quant-ph/
37. Bourgoin, J.-P. et al. A comprehensive design and performance analysis of low 0707.3541. Preprint at https://arxiv.org/abs/0707.3541 (2007).
earth orbit satellite quantum communication. N. J. Phys. 15, 023006 (2013). 70. Cai, R. Y. Q. & Scarani, V. Finite-key analysis for practical implementations of
38. Bourgoin, J.-P. et al. Experimental quantum key distribution with simulated quantum key distribution. N. J. Phys. 11, 045024 (2009).
ground-to-satellite photon losses and processing limitations. Phys. Rev. A 92, 71. Zhang, Z., Zhao, Q., Razavi, M. & Ma, X. Improved key-rate bounds for practical
052339 (2015). decoy-state quantum-key-distribution systems. Phys. Rev. A 95, 012333 (2017).
39. Curty, M. et al. Finite-key analysis for measurement-device-independent quantum 72. Hayashi, M. & Nakayama, R. Security analysis of the decoy method with the
key distribution. Nat. Commun. 5, 3732 (2014). Bennett–Brassard 1984 protocol for finite key lengths. N. J. Phys. 16, 063009
40. Bacco, D., Canale, M., Laurenti, N., Vallone, G. & Villoresi, P. Experimental quantum (2014).
key distribution with finite-key security analysis for noisy channels. Nat. Commun. 73. Yin, J. et al. Satellite-based entanglement distribution over 1200 kilometers. Sci-
4, 1 (2013). ence 356, 1140 (2017).

npj Quantum Information (2022) 18 Published in partnership with The University of New South Wales
 J.S. Sidhu et al.
11
ACKNOWLEDGEMENTS ADDITIONAL INFORMATION
We acknowledge support from the UK NQTP and the Quantum Technology Hub in Supplementary information The online version contains supplementary material
Quantum Communications (EPSRC Grant Ref: EP/T001011/1), the UK Space Agency available at https://doi.org/10.1038/s41534-022-00525-3.
(NSTP3-FT-063, NSTP3-FT2-065, NSIP ROKS Payload Flight Model), the Innovate UK
project ReFQ (Project number: 78161), and QTSPACE (COST CA15220). D.O. is an Correspondence and requests for materials should be addressed to Jasminder S.
EPSRC Researchers in Residence at the Satellite Applications Catapult (EPSRC Grant Sidhu or Daniel K. L. Oi.
Ref: EP/T517288/1). D.O. and T.B. acknowledge support from the Innovate UK project
Reprints and permission information is available at http://www.nature.com/
AirQKD (Project number: 45364). D.O. and D.M. acknowledge support from the
reprints
Innovate UK project ViSatQT (Project number: 43037). R.P. acknowledges support
from the EPSRC Research Excellence Award (REA) Studentship. The authors thank
Publisher’s note Springer Nature remains neutral with regard to jurisdictional claims
J. Rarity, D. Lowndes, S. K. Joshi, E. Hastings, P. Zhang, and L. Mazzarella for insightful
in published maps and institutional affiliations.
discussions. D.O. also acknowledges discussion with S. Mohapatra, Craft Prospect Ltd.,
and support from the EPSRC Impact Acceleration Account.

Open Access This article is licensed under a Creative Commons

Attribution 4.0 International License, which permits use, sharing,
AUTHOR CONTRIBUTIONS
adaptation, distribution and reproduction in any medium or format, as long as you give
D.O. conceived, obtained funding for, and initiated the research. J.S.S. and T.B. appropriate credit to the original author(s) and the source, provide a link to the Creative
developed the finite key optimiser and performed the simulations with additional Commons license, and indicate if changes were made. The images or other third party
assistance from D.Mc.A. R.G.P. conducted background literature reviews. J.S.S., T.B., material in this article are included in the article’s Creative Commons license, unless
and D.O. wrote an initial draft with inputs and feedback from all authors. All authors indicated otherwise in a credit line to the material. If material is not included in the
contributed equally in selecting relevant literature, final editing, and proofreading of article’s Creative Commons license and your intended use is not permitted by statutory
the manuscript. J.S.S. and T.B. contributed equally to the paper. regulation or exceeds the permitted use, you will need to obtain permission directly
from the copyright holder. To view a copy of this license, visit http://creativecommons.
org/licenses/by/4.0/.

COMPETING INTERESTS
The authors declare no competing interests. © The Author(s) 2022

Published in partnership with The University of New South Wales npj Quantum Information (2022) 18