Classical-quantum dual encoding for laser communications in space

In typical laser communications classical information is encoded by modulating the amplitude of the laser beam and measured via direct detection. We add a layer of security using quantum physics to this standard scheme, applicable to free-space channels. We consider a simultaneous classical-quantum communication scheme where the classical information is encoded in the usual way and the quantum information is encoded as fluctuations of a sub-Poissonian noise-floor. For secret key generation, we consider a continuous-variable quantum key distribution protocol (CVQKD) using a Gaussian ensemble of squeezed states and direct detection. Under the assumption of passive attacks secure key generation and classical communication can proceed simultaneously. Compared with standard CVQKD, which is secure against unrestricted attacks, our added layer of quantum security is simple to implement, robust and does not affect classical data rates. We perform detailed simulations of the performance of the protocol for a free-space atmospheric channel. We analyse security of the CVQKD protocol in the composable finite-size regime.


I. INTRODUCTION
There has been increased interest for modern satellite systems to adopt optical communications, also known as laser communications in space (LCS).The advantages include higher rates, longer distances, increased security because of strong directionality, and lack of frequency license regulations since the radio frequency bands are close to being saturated [1].In typical laser communications, information is encoded by modulating the amplitude of the laser beam and measured via direct detection.
An additional feature of LCS is that the optical channel is also suitable for quantum communications allowing the possibility to combine classical and quantum communications [2].Previous work on this topic has started with quantum communication, which is complex and has poor tolerance to noise, and added classical communication [3].Here, we consider an alternative approach in which we start with a standard classical communication set-up, and then introduce quantum techniques to enhance security.
Specifically, in this work, we incorporate quantum key distribution [4,5] with a standard classical communication setup.Quantum key distribution (QKD) [4][5][6][7] is the most mature and accessible quantum technology.Its goal is to distribute a secret random key between two physically-separated parties.Its unconditional security relies on quantum physics, a promising solution to the vulnerability of current classical cryptosystems to quantum computing.
Encodings of quantum information can be characterised as discrete variable (DV) and continuous variable (CV) [8][9][10][11][12].CV encodings exploit the infinite-dimensional Hilbert space of an oscillator, i.e., they encode information into the CV quadratures of the light, such as amplitude q and phase p * ralph@physics.uq.edu.au which have a continuous spectrum.CV [13] has the advantage of easier state preparation and manipulation [8] as well as being compatible with existing infrastructure [14].Compared with standard CV QKD [15][16][17][18] our layer of quantum security is easy to implement, has robust performance and is directly compatible with LCS.The trade-off is our protocol is only secure against passive attacks, unlike standard CV QKD which is secure against unrestricted eavesdropping attacks [19][20][21][22].Satellite-based quantum communication [23,24] promises global-scale quantum networks by being able to connect any two points on Earth.The dominant source of noise for quantum communication comes in the form of losses [10], for instance, scattering and absorption loss in fibres, beam wandering and scattering in atmospheric links, and beam spreading in free space.Unlike fibre links, the direct line-of-sight link can be monitored by the trusted parties, meaning the eavesdropper (Eve) has limited access to the channel.As a result the only plausible attack on an LCS system is a passive one in which lost light is intercepted by the eavesdropper [25,26].
During a point-to-point quantum communication protocol, quantum correlations exist between all three parties; the sender (Alice), the receiver (Bob), and the potential eavesdropper (Eve).Since information is inevitably leaked to Eve, the correlations between Bob and Eve must be suppressed to maintain security; for example, via privacy amplification.This can only work if Alice and Bob's mutual information is greater than Eve's maximal information with Bob [27].Alternatively, Alice and Bob could use entanglement purification [28,29] or entanglement distillation [30] to suppress Eve's information [8] in an entanglement-based QKD protocol.
In Ref. [31] a different approach was taken whereby they introduced a zero-leakage protocol, with zero information leakage at all times in a pure-loss channel, by encoding quantum information in a particular way.In this protocol the signal is only on one quadrature, although the noise properties of both quadratures are monitored.Ref [32] introduced a symmetric version of this protocol whereby information is encoded on both quadratures.However, this is experimentally more complicated.Ref. [26] investigated the zero-leakage protocol in the context of satellite-based CV QKD, restricting Eve to passive attacks; thus, simplifying generation of a secret key and increasing tolerance to loss and noise, while also eliminating the need for a local oscillator.
In this paper, we show how a satellite-based zero-leakage quantum communication protocol can be combined with a LCS system without affecting the classical data rates.To be consistent with the zero-leakage protocol we restrict to a passive eavesdropper (Eve), who may collect all the light lost but may not perform any active attack.For example we do not allow Eve to intercept and resend Alice's beam as she could be observed in the line of sight.More sophisticated entangling cloner attacks [33] are not allowed as they also require intervention in the line of sight.We make a detailed evaluation of our dual classical/quantum LCS system in the context of a satellite to ground down link.
The rest of this paper is organised as follows.In Section II we specify the protocol in detail and describe its performance under ideal conditions.In Section III we consider the satelliteto-ground communication set-up and investigate atmospheric effects.In Section IV we combine our protocol description with our atmospheric characterization and compute secret key rates in a realistic finite-size regimes.In Section V we conclude.

II. THE PROTOCOL
The protocol consists of sending classical information and quantum information simultaneously.Both the classical information and quantum information are encoded as amplitude modulations of a bright laser beam.The classical information is encoded as discrete modulations whilst the quantum information is encoded as smaller Gaussian modulations.To optimize capacity we assume the classical and quantum modulations are encoded onto the same frequency side bands.The quantum modulations effectively set the noise floor for the classical modulations.Using squeezing it is arranged that this noise floor is the quantum noise limit (QNL), also known as shot noise.Both quantum and classical signals are read out via direct detection.A diagram of the set-up is shown in Fig. 1.Alice is the sender, Bob is the receiver and Eve is a passive eavesdropper who captures all the lost light.
While any quantum communication encoding can be used to also encode classical information, it is not optimal to let the low amplitude quantum modulations for QKD directly carry the classical signals due to the low signal to noise.Here, we combine using low amplitude quantum signals with the higher amplitude classical signals for efficient transmission of both quantum and classical information.
FIG. 1. Protocol set-up.Alice mixes an amplitude squeezed vacuum state, Xs, (with Vs < 1) and a bright beam with anti-squeezed amplitude fluctuations, Xa, (with Va > 1) on a beamsplitter with transmissivity ε.Classical information, XC , is then encoded on the transmitted beam as shown.Direct detection of the reflected beam reveals Alice's copy of the quantum signal, XA.The transmitted beam travels through the channel which is monitored by Eve who obtains XE. Bob measures the state after the channel with direct detection to obtain his copy of the classical information, X′ B .After determining the classical bit values he can extract his copy of the quantum signal, XB.When the variance of the transmitted ensemble equals the QNL, there is no correlation between XE and XB for a pure-loss channel.

A. Classical part
For the purpose of classical optical communications, the Intensity Modulation (IM) technique (which maps a classical information bit to one of the output intensities of a laser beam), together with the Direct Detection (DD) technique (which directly measures the intensity of the received signal using a photodetector), constitutes the widely-used IM-DD scheme.Despite its low implementational complexity, the IM-DD scheme is not desirable for our purpose mainly due to the IM technique's incompatibility with the quantum part of our protocol.
Instead, in this work we adopt a discrete modulation scheme where every classical information bit is mapped to one of the two real-valued displacements {α, −α} applied to a continuous-wave single-mode laser beam with optical frequency Ω 0 and overall amplitude β >> |α|.This scheme resembles the Binary Phase-Shift Keying (BPSK) modulation scheme since it only encodes information onto one quadrature (i.e., the X quadrature) of the laser beam.Our modulation at a specific sinusoidal modulation frequency, ω, creates an upper sideband and a lower sideband at Ω 0 + ω and Ω 0 − ω, respectively.The component remaining at Ω 0 is known as the carrier, which can be considered as a strong coherent component [34,35].We will show in the following that although our protocol does not use IM for modulation, it can still benefit from a reduced implementational complexity provided by the use of DD for detection.
Traditionally, the extraction of quadrature-encoded information requires a coherent homodyne detection involving the mixing of the signal with an independent Local Oscillator (LO).By independent LO, we mean a bright laser beam that is phase-locked to the signal and typically sent along with the signal via multiplexing.In this work, we eliminate the need for such an independent LO by adopting the DD technique, which effectively measures the X quadrature (i.e., the only quadrature used for information encoding in our scheme) using a photodetector, for signal detection.To see how the DD technique works, we first consider a propagating continuouswave laser beam in a single mode represented by the continuum operator Â: where β is the mean value of the carrier amplitude (taken to be real) and δ Â(t) represents the modulations (including both the discrete classical modulation and the quantum fluctuations) around the mean value.The notation δ emphasises that the modulations are small compared with β (note that ⟨ Â⟩ = β).
The operation of DD using a photodetector is represented by the number operator, N .Linearising the operator by assuming β ≫ 1, we have where δ X(t) = δ Â † (t) + δ Â(t) is the X quadrature operator, and we have neglected the higher-than-first-order terms in the modulations due to the assumption that the fluctuations are small (i.e., the contribution to the expectation value from the higher order terms is negligible).The last line of Eq. ( 2) indicates that the use of DD effectively measures the X quadrature.Eq. ( 2) also explains the counter-intuitive concept of using DD to measure the X quadrature -in the same beam, the small signals (i.e., the modulation-induced fluctuations) beat with the carrier (i.e., the strong coherent component) and can be read out at a particular sideband frequency ω.The technique for side-band readout proceeds as it would for homodyne detection and is described in, e.g., [36,37].According to our Classical-Quantum Dual Encoding protocol, we are interested in the modulations around side-band frequency ω, hence we focus our attention on the evolution of the Fourier space operator X′ Ā(ω) which is the Fourier transform of δ X′ Ā(t), representing the modulations of the field leaving Alice's station.We can write this Fourier space operator as: where ⟨X C ⟩ = ±2α is our discrete classical modulation, and X Ā represents quantum fluctuations.After traversing the channel to Bob this operator evolves to where η is the transmission of the channel and Xv represents vacuum fluctuations that couple in due to the loss.As will be described shortly it is arranged that the variance of the quantum fluctuations of the beam leaving Alice's station are at the QNL, i.e. ⟨ X2 Ā⟩ = V Ā = 1.As a result the signal to noise ratio (i.e. the signal power divided by the noise variance) of the classical signal received by Bob will be , where we have used that the vacuum fluctuations also have unit variance.By choosing α sufficiently large the resulting bit error rate will be small and faithful transmission of the classical signals can be achieved.

B. Quantum part
To generate a key, we need to extract the quantum fluctuations from the combined classical and quantum signal that has been mixed down at our chosen side-band frequency ω.Notice that the carrier power detected by Bob over the signal length will be proportional to ηβ 2 where η is the channel transmission for that particular time-bin (assumed constant over the signal length).Thus η can be measured shot-by-shot.Also, provided α is sufficiently large, we know X C shot-byshot from the sign of the signal displacement.Thus we can extract the quantum signal by subtracting the weighted classical signal via where we have used Eq.3 in going from the first to the second line.Note that the shot-by-shot carrier power also enables us to calibrate the QNL level for each signal.The time bin length should be chosen appropriately; short enough so that the fluctuating power due to the atmosphere is approximately constant over the time bin but long enough to acquire sufficient signal strength.

C. Global average quantum state
We now analyse the generation and evolution of the quantum signal as shown diagrammatically in Fig. 1.As shown, Alice begins with two phase-locked beams, one of which has super-Poissonian amplitude noise, ⟨ X2 a ⟩ = V a > 1, and the other has sub-Poissonian amplitude noise, ⟨ X2 s ⟩ = V s < 1.One of the beams has a bright carrier -it does not matter which but we will assume here that it is the super-Poissonian beam.The sub-Poissonian, or squeezed beam is intrinsically quantum, however the noise on the super-Poissonian beam could either be quantum, e.g.anti-squeezing or amplified spontaneous emission, or it could be induced via classical modulations.The most important thing is that the noise has a Gaussian distribution.Alice mixes her two beams on a beamsplitter, retaining the reflected beam which she directly measures and sending the transmitted beam (after imposing the classical signal) through the channel to Bob.Eve intercepts all the lost light.We can then write the evolution of the quan-tum parts of the amplitude quadrature operators as where ε is the transmissivity of Alice's beamsplitter, η is the transmissivity of the channel, XA , XB , and XE are the X-quadrature operators for Alice, Bob, and Eve, respectively, and Xs and Xa are the X-quadrature operators for the squeezed (sub-Poissonian) and antisqueezed (super-Poissonian) beams, respectively.
For zero information leakage we require that the modulation Alice prepares to send to Bob has the same variance as the vacuum state (i.e. the QNL).That is, we require For the modulation to be QNL we need Then, That is, there are correlations in the q quadrature between Alice and Bob, but there are no correlations in the q quadrature between Eve and Bob.This means the Holevo information χ EB = 0.The Holevo information, χ EB , represents the maximum information that Eve can extract from her signal about Bob's measurements.Since ⟨ XE XB ⟩ = 0, Eve's system is not correlated with Bob's system in the X quadrature.
Given no information leakage to Eve about Bob's measurement results we will find we only need Alice and Bob's covariance matrix.Alice and Bob's covariance matrix is as follows: where Here we have allowed for a fluctuating channel transmission as expected for an atmospheric channel, where and Var( √ η) = ⟨η⟩−η f , and where ⟨η⟩ = ηmax 0 ηp(η) dη and ⟨ √ η⟩ = ηmax 0 √ ηp(η) dη.Notice that given the no information leakage condition (Eq.10) we find b q = 1, so the fluctuating channel transmission does not add noise to the quantum amplitude correlations.

D. Asymptotic Secret key rate
The secret key protocol we propose is an adaption of CV-QKD with reverse reconciliation [33], using the no leakage protocol [31] and a passive eavesdropper [26].In the reverse reconciliation protocol Alice guesses the value of Bob's quadrature measurement outcomes based on her own outcomes.They then perform a reconciliation protocol which corrects errors in Alice's guesses at the cost of shortening the data string.In the limit of an infinitely long string this process does not leak any information to the eavesdropper -this is called the asymptotic limit.The asymptotic secret key rate with reverse reconciliation is [27] where β is the reverse reconciliation efficiency, I AB is Alice and Bob's mutual information, and χ EB is a bound on Eve's maximal information given by the Holevo Bound.For the no leakage protocol with a passive eavesdropper we have χ EB = 0 and so K asym.= βI AB .The best possible performance of our key protocol will be in this asymptotic limit, with ideal reconciliation (β = 1), strong squeezing (V s << 1) and ideal detectors.Under these conditions we have I AB = 1 2 log 2 aq aq−c 2 q /bq .Substituting the values in this limit we find the highest achievable rate of the zero-leakage protocol is In order to include the effects of finite data block lengths a more sophisticated analysis is required, as will be introduced in Section IV.

III. FREE-SPACE OPTICAL PROPAGATION AND ATMOSPHERIC EFFECTS
In this section, we model realistic satellite-to-Earth channels via numerical simulations.In the following section we will use these results and realistic efficiencies and data block lengths to verify the feasibility and evaluate the performance of our proposed scheme.

A. System Model
As a specific example, we consider the satellite-to-Earth communication setup shown in Fig. 2 -it should be noted that our system is not restricted to such an arrangement.In this work, the ground-station altitude is denoted as h 0 , the satellite zenith angle at the ground station is denoted as θ z , and the satellite altitude at θ z = 0 is denoted as H.The channel distance can then be given by L = (H − h 0 )/ cos θ z .We assume a restricted eavesdropping scenario where the channel is monitored [25], and hence Eve is passive and not able to perform an active attack [38].However, as indicated in Fig. 2, we allow Eve to capture all the lost light.
The random inhomogeneities (i.e., turbulent eddies) within the Earth's turbulent atmosphere (which can be seen as a random medium) give rise to small random refractive index fluctuations (i.e., optical turbulence) that cause continuous phase modulations on an optical beam, imposing amplitude and phase distortions on the optical beam as it propagates through an atmospheric channel.Specifically, the family of turbulent eddies whose sizes are bounded above by the outer scale L 0 and below by the inner scale l 0 constitutes the inertial subrange [39].It is commonly assumed that atmospheric turbulence satisfies where R = [x, y, z] T is the three-dimensional position vector, n(R) denotes the the refractive index at R, and δn(R) = n(R) − ⟨n(R)⟩ denotes the small refractive index fluctuations [39].Under the paraxial approximation and the assumptions in Eq. ( 22), the propagation of a monochromatic optical beam ψ(R) through the turbulent atmosphere is governed by the stochastic parabolic equation [39] where In this work, we assume that all the transmitted optical beams are in the fundamental Gaussian mode.The general form of a Gaussian beam propagating along the z axis is give by where r = [x, y] T denotes the two-dimensional position vector in the transverse plane, w(z) = w 0 1 + (z/z R ) 2 , w 0 is the beam-waist radius, z R = πw 2 0 /λ is the Rayleigh range, λ is the (central) optical wavelength, and ϕ(r, z) zR with k = 2π/λ being the optical wavenumber.Although our scheme is, in principle, robust against the random phase distortions (recall that no local oscillator is required in our direct detection setup -the wavefront matching between the local oscillator and the signal beam is not required), turbulence-induced effects related to amplitude distortions can still negatively affect the performance of our scheme.Indeed, these effects (e.g., beam wandering, beamshape deformation, beam broadening, and intensity scintillation) can introduce substantial losses in real-world scenarios where a finite-sized aperture is used at the receiver [39].Due to the random nature of atmospheric turbulence, such losses are also randomly fluctuating, giving rise to non-Gaussian excess noise and thus further degrading the system performance (see discussions in e.g., [40,41]).
We adopt the standard notation "loss" for visualization purposes; however, in our calculations, we always use the transmissivity η (with the relation Loss [dB] = −10 log 10 η) to maintain consistency with our analyses in the previous sections.Assuming the transmitted beam is denoted by ψ G (r, 0) and the received beam is denoted by ψ Rx (r, L), the (fluctuating) transmissivity is given by where L denotes the channel distance, and A denotes the aperture area at the receiver.Note that we assume a circular receiver aperture whose radius is r a in this work.
B. Satellite-to-Earth atmospheric channel

Turbulence characterization
The optical turbulence within the Earth's atmosphere must first be appropriately characterized.In this work, we adopt the widely used Hufnagel-Valley (HV) model to determine the structure parameter C 2 n (h) that describes the strength of the optical turbulence within a satellite-based atmospheric channel.The HV model expresses C 2 n (h) as the following function of altitude h [39].
where A is the ground-level turbulence strength in m −2/3 , and v rms is the root-mean-square (rms) wind speed in m/s.The rms wind speed is given by where V (h) is the altitude-dependent wind speed profile.In this paper we adopt the Bufton wind profile [39] V where V g is the ground-level wind speed.
Utilizing the structure parameter profile of the Earth's atmosphere, we adopt the scintillation index σ 2 I (which is the normalized variance of intensity) and the Fried parameter r 0 (which quantifies the coherence length of turbulence-induced phase errors in the transverse plane) to quantify the effect of atmospheric turbulence on a propagating beam.For satelliteto-Earth channels, the scintillation index is given by [39] with σ 2 R being the Rytov variance, (30) For satellite-to-Earth channels, the Fried parameter is given by [39] The rate at which atmospheric turbulence changes with time is commonly quantified by the Greenwood frequency [42,43] Correspondingly, the time interval over which atmospheric turbulence remains essentially unchanged can be quantified by the atmospheric coherence time [43]

Method of numerical simulations
In this work, the implementation of our numerical simulation largely follows our previous work [44] (see, e.g., the appendix of [44] for more discussions).Specifically, we numerically solve Eq. ( 23) using the split-step method [45] (also referred to as phase screen simulations) in order to faithfully capture the effects imposed by the optical turbulence on an optical beam propagating within the Earth's atmosphere.The main idea of this method is to model an atmospheric channel using a set of slabs with a random phase screen located in the midway of each slab.Two vacuum propagations with one random phase modulation in between are repeatedly performed until the beam reaches the receiver.
The implementation of our phase screen simulations requires careful configuration and optimization based on the evaluation of the scintillation index (recall Eq. ( 29)) and the Fried parameter (recall Eq. ( 31)) for both the whole channel and each individual slab.In order to characterize the atmospheric turbulence within the j th slab, both the scintillation index (denoted as σ 2 Ij ) and the Fried parameters (denoted as r 0j ) have to be evaluated locally for the turbulent atmosphere within that slab.For the actuate modelling of the atmospheric channel, we set the width of each slab based on the two conditions (i.e., σ 2 Ij < 0.1 and σ 2 Ij < 0.1σ 2 I ) described in [46].After determining the widths of the slabs, we use a wellknown Fast-Fourier-Transform (FFT)-based spectral-domain algorithm [47] to generate (random realizations of) the phase screen for each slab using its corresponding phase Power Spectral Density (PSD) function.In this algorithm, the generation of each individual phase screen starts with the spectraldomain generation of a uniform square grid of random complex numbers sampled from a complex Gaussian distribution whose real and imaginary parts each have zero mean and equal variances with zero cross-covariances.This grid of random numbers is further weighted by the corresponding phase Power Spectral Density (PSD) function of the atmospheric turbulence within the corresponding slab.A FFT is then performed to transform this spectral-domain grid of weighted random complex numbers into a spatial-domain grid of random phase values (corresponding to an array of sample points of the phase screen) with the same statistics as the turbulenceinduced phase variations within the corresponding slab.In this work, we adopt the widely-used modified von Karman model for the the atmospheric turbulence, giving the following phase PSD function for the j th slab where f is the magnitude of the two-dimensional spatial frequency vector in the transverse plane in cycles/m, f 0 = 1/L outer , and f m = 0.9422/l inner [45].
For the free-space propagation, we utilize a physical optical propagation library named PROPER, whose routines implement FFT-based angular-spectrum and Fresnel-approximation methods to propagate a wavefront in near-field and far-field conditions, respectively [48].As a fully numerical approach to solving the stochastic parabolic equation, despite its computationally intensive nature, the split-step method can take into account most of the important effects (e.g., beam wandering, beam broadening, and scintillation) in atmospheric optical propagation.Although this method can also be adopted to characterize the temporal profile of the turbulence (i.e., the temporal turbulent fluctuations within one coherence time τ 0 ), we notice that such a temporal profile characterization is not required within the scope of this work since an atmospheric channel can be considered constant for a large number of sequential signal pulses (more discussions will be provided in Sec.III D).The split-step method has been widely used to study the problem of atmospheric optical propagation under various channel conditions, providing quantitative agreement with both analytical results (e.g., [49,50]) and real-world experimental data (e.g., [51]).More technical details regarding the implementation of our numerical simulations can be found in [44,[50][51][52] and the references therein.

C. Simulation settings
We restrict ourselves to the case of a low-Earth-orbit (LEO) satellite with a satellite altitude H = 500 km, and we consider zenith angles θ z ranging from 0 • to 60 • .For the atmospheric parameters, we follow previous works (e.g., [44,52]) and set A = 9.6 × 10 −14 m −2/3 , L outer = 5 m, and l inner = 1 cm.For the wind speed profile, we set V g = 3 m/s, giving a value of v rms = 21 m/s.For the optical parameters, we set λ = 1064 nm, and we set the beam-waist radius to w 0 = 15 cm.Particularly, our setting of the 1064 nm wavelength is due to the existence of high-quality sources of squeezed light at this wavelength (see, e.g., [53]).This wavelength also falls within the atmospheric transmission window and is currently one of the most widely used operating wavelengths in real-world space-based optical communication systems (see comprehensive review papers, e.g., [54]).For real-world implementations, we consider three reasonable receiver aperture radii, namely, r a = 15 cm, r a = 30 cm, and r a = 50 cm, at the ground station.We further fix the ground-station altitude to h 0 = 0 m.In our numerical simulations, we generate 10000 independent realizations of the satellite-to-Earth channel under each simulation setting.Our simulation parameters are listed in Table I.
Although the existence of pointing errors can lead to an additional loss penalty in a real-world system, the resulting loss penalty can be significantly reduced by the use of state-of-theart tracking techniques.Indeed, via the use of feedback-based tracking techniques, the loss penalty resulting from pointing errors over a 1200 km satellite-to-Earth channel is estimated FIG. 3. Fluctuating loss within a 0.5 s time period over a satelliteto-Earth channel.The atmospheric coherence time is found to be τ0 = 2.29 ms.Note that the channel loss is assumed to be constant within the atmospheric coherence time.
to be smaller than 3 dB (which is lower than the turbulenceinduced loss and much lower than the diffraction loss) in a well-known real-world demonstration of satellite-to-Earth QKD [55].Therefore, in this work we ignore the pointingerror-induced loss as we expect that including such a loss will not significantly change any of our observations.

D. Channel loss statistics
Before presenting our main results, we first provide a visualization of the channel loss statistics (predicted from our numerical simulations) over a satellite-to-Earth channel.
To illustrate the time-dependent fluctuation of channel loss, in Fig. 3 we first plot the fluctuating loss over a satellite-to-Earth channel (θ z = 60 • and r a = 15 cm) within a 0.5 s time period.It should be noted that Fig. 3 presents the channel loss fluctuation as a step function, with step size being the atmospheric coherence time τ 0 -this is because the channel loss can be considered constant within the time interval specified by τ 0 .Specifically, the atmospheric coherence time under this setting is found to be τ 0 = 2.29 ms.Given that the coherence timescale of an atmospheric channel is on the order of milliseconds (see, e.g., [39]) and that a pulsed source with a 100 MHz repetition rate (which corresponds to a pulse period of 0.01 µs) is readily available, the channel can be considered constant for a large number (∼ 10 5 ) of sequential signal pulses.
In Fig. 4, we plot the Probability Density Function (PDF) of the channel loss, achieved with different r a values under different θ z values, over a satellite-to-Earth channel.From this figure, we can observe that both the average channel loss (indicated by the center of a PDF curve) and the fluctuation of channel loss (indicated by the spread of a PDF curve) decrease as the receiver aperture radius r a increases.The former observation is intuitive since a larger receiver aperture can capture a larger portion of the beam on the ground.The latter observation is due to the well-known effect of aperture averaging in free-space optical communications -the level of power fluctuation decreases as the receiver aperture size increases (more details can be found in many good textbooks, e.g., [39]).It can be also seen that under each setting, the distribution of channel loss is approximately centered at diffraction loss, and the spread of distribution (which indicates the fluctuation of channel loss) is generally minimal.Such observations indicate that diffraction loss (a deterministic loss) is the dominant source of loss over a satellite-to-Earth channel.Indeed, it is well known that beam wandering, which is the major source of turbulence-induced channel loss fluctuations, is negligible in a satellite-to-Earth channel (see, e.g., [39,50,55,56]).This phenomenon is because an optical beam transmitted from a satellite becomes very large when it enters the Earth's atmosphere, and the turbulence-induced effects are imposed on the optical beam only in the last segment of its propagation (note that the effective thickness of the atmosphere is only around 6 km -see, e.g., [57]).
In Fig. 5, we plot the mean channel loss, achieved with different r a values under different θ z values, over a satellite-to-Earth channel.The results in this figure are consistent with those in Fig. 3 and provide a quantitative representation of the mean channel loss and the channel loss fluctuation over a satellite-to-Earth channel.

IV. SECRET KEY RATE RESULTS
The composable, finite length secret key rate is reduced from the asymptotic rate due to finite size effects on the entropy, leaking of information through the public classical reconciliation of the raw key and the sacrifice of data bits in estimating the signal to noise (SNR) of the quantum signal.For our protocol it is given by [26] which is ϵ-secure [58,59] where ϵ = 2ϵ sm + ε + ϵ PE + ϵ cor .
Here ϵ sm is the entropy smoothing parameter and ϵ cor and ϵ PE are the maximum failure probabilities for the error correction and parameter estimation, respectively.For our protocol, Eve obtains no information from the optical communication hence parameter estimation is unnecessary and we can set ϵ PE = 0.
In addition ε is required by the left over Hash lemma.As before, β is the reverse reconciliation efficiency and I AB is Alice and Bob's mutual information.The block size is N and N ′ is the length of Bob's string after the SNR estimation.Also, , where d is the discretisation parameter used by Bob to extract key values.Alice and Bob's mutual information is where η B is the efficiency of Bob's detector, and v = 1+ The finite-size secret key rate is shown in Fig. 6.We use state-of-the-art parameters for our calculations [60] with the caveat that these parameters, in particular the reconciliation efficiency, may be difficult to realize in the field.The parameter are: security parameter ϵ = 10 −9 ; the discretisation parameter d = 5; Bob's detector efficiency η B = 0.61; electronic noise ν B = 0.12; reconciliation efficiency β = 0.98; and block size N = 10 10 , half of which is used for parameter estimation.These calculations use simulated transmissivity data (10000 realisations) as discussed in III D. With the simulated data and parameters outlined in the caption of Fig. 6, we obtain positive secret key rate for 30 and 50 cm receiver aperture radius sizes, and key for 15 cm receiver radius size but not for large zenith angles.Turbulence has little impact on the key rate.In Fig. 6, we also plot the capacity (red) and the ideal asymptotic key rate (Eq.21) (blue) for comparison.The capacity (i.e. the ultimate limit given by the two-way (classically-assisted) quantum capacity of the pure-loss channel [61]) and the asymptotic key rate are both plotted using loss parameters for the 50 cm aperture radius.
We can estimate that for larger block sizes, say N = 10 14 uplink becomes possible since the maximum amount of tolerable loss is then about 40 dB.

V. CONCLUSION
We have considered a typical optical classical communication scheme based on amplitude modulation and direct detection, and incorporated a simultaneous CV QKD protocol.With the assumption of a passive Eve, we predict positive finite size secret key rates for realistic downlink freespace channels without affecting the SNR of the classical data.Given a classically monitored channel active eavesdropper attacks are deemed unrealistic, so the security of the secret key is strong.No optical local oscillator is required for our protocol.
Our scheme requires the injection of squeezed light at the sender and efficient, low noise photo-detection at the receiver in order to enable encoding and read out of a quantum signal with a QNL variance.The purest current sources of squeezing are inefficient and so could add significantly to the local energy budget of the satellite.However, as the squeezing is only needed on one quadrature, purity is not a major issue, and so in principle a high efficiency squeezed laser [62] might be used as the source (i.e.Xs in Fig. 1), adding very little to the local energy budget.
In principle, given a passive Eve, a super-QNL encoding variance is possible, avoiding the need for squeezing.However, there are the following significant advantages to using a QNL encoding: (i) greater range and higher key rate for the QKD; (ii) the classical signals always have a QNL noise floor; (iii) the atmospheric fluctuation noise is cancelled; and (iv) there is reduced computational overhead and increased efficiency in the reconciliation protocol due to the zero information leakage of raw key information to Eve.We believe our system features the minimum addition of quantum resources needed to combine classical communication and QKD in a system with practical performance and good compatibility with existing satellite-based communication infrastructure.As such we expect it may play a role in next generation LCS systems.

FIG. 5 .
FIG. 5. Mean channel loss achieved with different ra values under different θz values over a satellite-to-Earth channel.Error bars represent one standard deviation.
Satellite-to-Earth QKD link with a passive Eve.Classical and quantum information is encoded into a beam of light sent from the satellite (Alice) to the ground station (Bob).The channel is modelled as a free-space optical channel with the satellite at zenith angle θz (deg), as shown.We model this downlink scenario as a concrete example, but our system is suitable for uplink or inter-satellite communications as well.

TABLE I .
Simulation parameters.× 10 −14 m −2/3 5 m 1 cm 3 m/s 21 m/s 1064 nm 15 cm 0 m 500 km 0 • to 60 • {15 cm, 30 cm, 50 cm} FIG. 4. PDF of the channel loss achieved with different ra values under different θz values over a satellite-to-Earth channel.The PDF curves are generated by fitting a kernel probability distribution to our discrete simulation data on channel loss using the fitdist function provided by MATLAB.
[61]6.Finite-size secret key rate (bits/use) as a function of zenith angle (deg) for the squeezed-state protocol, secure against passive individual and collective attacks, with 6 dB and 10 dB of squeezing as shown.The beam-waist radius is set to 15 cm.The parameters are security parameter ϵ = 10 −9 , the discretisation parameter d = 5, Bob's detector efficiency ηB = 0.61, electronic noise νB = 0.12, reconciliation efficiency β = 0.98, and block size N = 10 10 , half of which is used for parameter estimation.The transmissivity data are simulated for 15 cm, 30 cm, and 50 cm receiver aperture radius size s, as outlined in III D. The highest achievable rate of any QKD protocol (the quantum capacity or PLOB bound)[61]and the highest achievable rate of our squeezed state protocol are also plotted (in red and blue, respectively, assuming a 50 cm aperture).Rates are simulated at discrete intervals only shown by points in the figure.Lines are added to guide the eye.
v B 1−η Bwith v B the electronic noise of the detectors.