Performance analysis of inter-satellite round-robin differential-phase-shift quantum key distribution

As the vision of global-scale unconditional information security becomes gradually realized, the importance of inter-satellite quantum communications has been rapidly increasing. The recently proposed round-robin differential-phase-shift (RRDPS) quantum key distribution (QKD) protocol has attracted much attention not only due to its potential high error tolerance, but also due to its distinct feature that the information leakage can be bounded without monitoring signal disturbances. Despite many existing implementations over fiber-optic channels, the feasibility of RRDPS QKD over an inter-satellite channel is still unknown. Moreover, despite the current advances in orbital angular momentum (OAM) encoding and temporal mode (TM) encoding, most of the existing studies on RRDPS QKD are restricted to time-bin encoding. In this work, we remedy this situation by exploring the feasibility of performing RRDPS QKD using OAM encoding and TM encoding over an inter-satellite channel. Our results indicate that OAM encoding is preferable to time-bin encoding only under the circumstances where a low dimension and a large receiver aperture are used. However, we find that TM encoding is the best encoding scheme in RRDPS QKD over an inter-satellite channel. In particular, we show that TM encoding not only leads to the best performance and the largest feasible parameter range, but also, for the first time, enables all the theoretically available advantages of an increased dimension to be realized in the context of RRDPS QKD.


Introduction
Satellite-based quantum key distribution (QKD) has been considered as a promising solution toward global-scale unconditional information security. Although quantum information can be encoded in any of the degrees of freedom (DoF) of a single photon, currently most real-world systems (e.g., [1,2]) utilize polarization encoding, which limits the capacity of such systems due to an intrinsically bounded Hilbert space. There have been unceasing efforts to utilize high-dimensional DoF for quantum encoding. Specifically, the time bin, the orbital angular momentum (OAM), and the temporal mode (TM) of single photons have become three of the most promising candidates. During the past decade, the necessary ingredients, including controlled quantum state generation (see, e.g., [3][4][5]), quantum state manipulation (see, e.g., [6][7][8]), as well as high-efficiency selective measurement (see, e.g., [9][10][11]), for the use of these candidates in high-dimensional quantum information protocols have been extensively studied.
It is well known that QKD protocols of a higher dimension 1 can provide benefits such as a better error tolerance [12]. The use of high-dimensional encoding enables two major classes of high-dimensional QKD protocols. As the natural extension of the conventional BB84 protocol, high-dimensional BB84 protocols can be achieved by encoding more than one bit of information per single photon. Extensive efforts have been devoted toward the use of time bins (e.g., [13,14]), OAM (e.g., [15,16]), and TMs (e.g., [17,18]) of single photons in high-dimensional BB84 protocols. Another class of high-dimensional QKD protocols encodes only one bit of information per single photon, and the benefit of an enhanced error tolerance comes with the reduction in the transmitted information. For example, the protocol of [19] can tolerate an error rate of up to 50% in principle. However, just like most QKD protocols, this protocol requires the monitoring of signal disturbance in order to ensure security. It is intuitive that excessive disturbance monitoring, especially over a noisy quantum channel, may reduce the system efficiency and thus undermine the real-world practicability of a QKD protocol.
As another high-dimensional QKD protocol that conveys one bit per photon, the recently proposed round-robin differential-phase-shift (RRDPS) QKD protocol [20] also provides a high error tolerance (up to 50% in principle). A particularly interesting feature of this protocol is that the information leakage can be bounded regardless of the disturbance that Eve introduces to the quantum signals, making the disturbance monitoring unnecessary for security [20]. RRDPS QKD was originally proposed and has been mostly demonstrated using time-bin encoding with interferometer-based measurement devices over an optical fiber channel (see experiments in, e.g., [21][22][23][24]). Specifically, an RRDPS QKD system that generates a secret key over 50 km and tolerates a 29% bit error rate has been demonstrated with a passive interferometer configuration for measurement in [22]. A feasible distance of 90 km has also been demonstrated in [23] with an active interferometer configuration for measurement. By developing an improved bound on the information leakage, a proof-of-principle experiment has recently demonstrated RRDPS QKD over 140 km [25]. Furthermore, it can be argued that RRDPS QKD is feasible over an optical fiber channel of 200 km [20], and can tolerate a channel error rate close to 50% [26] under typical experimental settings. Despite the excellent scalability provided by the use of time bins, the generation and detection techniques for time-bin encoding usually require active stabilization, presenting a main technical challenge (see discussions in, e.g., [27]).
In principle, the implementation of RRDPS QKD is not restricted to time-bin encoding. Intuitively, the technical challenges associated with time-bin encoding can be eliminated by adopting other encoding schemes that do not require interferometerbased configurations for both state preparation and measurement, and this makes the OAM and TMs two possible candidates. Indeed, OAM-encoded RRDPS QKD over a short Free-Space Optical (FSO) channel has been demonstrated in a proof-of-principle experiment [27]. Although there exists no experimental demonstration of TM-encoded RRDPS QKD so far, the use of TM encoding in RRDPS QKD should also be feasible since the existing devices for TM-encoded quantum information protocols are able to achieve the same functions as their OAM counterparts (see reviews in, e.g., [28][29][30]). OAM-encoded (TM-encoded) RRDPS QKD can utilize the existing enabling technologies for OAM-encoded (TM-encoded) quantum information protocols, providing the advantages of an inherent stability and a high detection efficiency.
Currently, research on RRDPS QKD is still in its infancy. To the best of our knowledge, there exists no theoretical analysis or numerical investigation regarding the feasibility of RRDPS QKD within the context of satellite-based quantum communications. Regarding the use of other encoding schemes, the proof-of-principle experiment on OAM RRDPS QKD in [27] only considered an ideal circumstance with a perfect single-photon source (that does not give any multi-photon emission), no dark count at detectors, and no OAM-dependent channel loss; therefore, the real-world feasibility of OAM RRDPS QKD remains unclear. Furthermore, which encoding scheme achieves the best performance and/or the largest feasible parameter range in satellite-based RRDPS QKD is still unknown.
In this work, we close the above knowledge gaps by exploring the feasibility of performing RRDPS QKD using OAM encoding and TM encoding within the context of satellite-based quantum communications. Specifically, the performances achieved under different system parameter settings are investigated. For simplicity, we mainly focus on the scenario of inter-satellite quantum communications. Our novel contributions are as follows: 1. We extend the current performance analysis for time-bin-encoded RRDPS QKD (in, e.g., [20,25]) to the scenarios where OAM encoding and TM encoding are used, respectively. Specifically, realistic system settings (including weak coherent pulses and nonzero detector dark count probabilities) are jointly considered in our performance analysis. For OAM encoding, the OAM-dependent diffraction loss is also taken into account. 2. We evaluate and compare the performances of inter-satellite RRDPS QKD of different dimensions, achieved with OAM encoding and TM encoding, under different settings of system parameters including beam-waist size, receiver-aperture size, and optical misalignment error. The performance of time-bin-encoded RRDPS QKD, as well as the performance of polarization-encoded 2-dimensional decoystate BB84 QKD, are also evaluated as benchmarks. 3. We further determine the potential improvements, in both the system performance and the feasible parameter range, provided by incorporating the decoy-state method into inter-satellite RRDPS QKD using OAM encoding and TM encoding.
Our main results are as follows: We find that it is feasible to perform RRDPS QKD over an inter-satellite channel using time-bin encoding, OAM encoding, as well as TM encoding. Specifically, we find that OAM encoding can outperform time-bin encoding in RRDPS QKD over an inter-satellite channel of an anticipated length under the circumstances where a low dimension and a large receiver aperture are used. However, the advantage of OAM encoding (over time-bin encoding) rapidly vanishes as the dimension increases and/or the size of receiver aperture decreases. We also find that an increased dimension leads to different consequences when different encoding schemes are used in inter-satellite RRDPS QKD. Interestingly, we find that TM encoding can be superior to both OAM encoding and time-bin encoding in RRDPS QKD over an inter-satellite channel. Specifically, we show that only TM encoding enables all the theoretically available advantages (i.e., a higher secret key rate, a better error tolerance, and a better loss tolerance) provided by an increased dimension in inter-satellite RRDPS QKD.

Operational procedures
We first use an ideal circumstance (where all prepared signals contain only one single photon) to illustrate the operational procedures of d-dimensional RRDPS QKD. Specifically, the transmitter (Alice) prepares a single-photon state where s k ∈ {0, 1}, and {|k } d k=1 denotes the set of d standard basis states spanning a d-dimensional Hilbert space H d (which is referred to as the encoding subspace).
Upon receipt of the signal, the receiver (Bob) randomly chooses an integer r such that 1 ≤ r ≤ d − 1. He then measures the phase difference between |m and |m + r (m + r ≤ d). This is equivalent to projecting the incoming signal state onto the state (|m ± |m + r )/ √ 2. It is clear that two single-photon detectors are required to obtain a definitive result.
Equipped with two photon-number-resolving detectors, Bob retains only the events in which a single-photon click occurs at one of his detectors. Whenever this happens, Bob announces the random integers {m, r } and records the measured phase difference as his sifted key bit s B . Alice records s A = s m ⊕ s m+r as her sifted key bit. If Bob receives | without any disturbance, he learns s A without error.
In reality, however, the transmitted signal cannot be guaranteed to contain only one single photon. Furthermore, the eavesdropper (Eve) may also introduce disturbances and information leakage. In this work, we adopt an improved bound on the amount of information leaked to Eve. Specifically, in d-dimensional RRDPS QKD, when the transmitted signal contains n photons Eve's information can be bounded by where nonnegative real parameters {x a } satisfy n+1 a=1 x a = 1 (note that, {x a } are fundamentally determined by Eve's attack -the optimization over them is to ensure Eve obtains the maximum amount of information for a given pair of {n, d}), and ϕ(x, y) = −x log 2 x − y log 2 y + (x + y) log 2 (x + y) [25]. This information bound can be evaluated effectively by solving a numerical optimization problem with (n + 1) nonnegative real parameters. It can be shown that I upper AE (n; d) < 1 for n ≤ d − 2 [25], and following common practice (in, e.g., [31]) we set I upper AE (n; d) = 1 for n ≥ d − 1. It is clear that I upper AE (n; d) does not depend on the signal disturbance caused by Eve; therefore, RRDPS QKD does not require the monitoring of signal disturbance in order to ensure security.

System model
Here we introduce the typical system model for inter-satellite QKD (illustrated in Fig. 1). Specifically, two communication parities, namely, Alice and Bob are both satellites, and they wish to share secret keys over an inter-satellite optical channel of distance L. We denote the beam-waist radius at the transmitter and the receiveraperture radius as w 0 and r a , respectively. We also denote the mean photon number per signal pulse, the central wavelength, the single-photon transmissivity, the detector dark count probability per signal pulse, and the optical misalignment error of the detection system as μ, λ 0 , η, P dark , and e mis , respectively. Unless otherwise specified, we set w 0 = 15 cm (following [16,18]), λ 0 = 1064 nm (following [16,18]), and P dark = 10 −6 (following [25]).

General assumptions
Unless otherwise specified, our general assumptions are listed as follows: • We assume that weak coherent pulses are used as signal pulses, and we assume that the photon number of the signal pulses follows a Poisson distribution. • We assume that the transmitted signals in both time-bin-encoded RRDPS QKD and TM-encoded RRDPS QKD have the same fundamental Gaussian spatial profile. We assume that the transmitted signals in OAM-encoded RRDPS QKD contain Laguerre-Gaussian (LG) spatial modes with different OAM numbers l and the same radial index p = 0 (for detailed descriptions of these LG modes, one can refer to our previous work [16]). • We assume that both time-bin-encoded RRDPS QKD and OAM-encoded RRDPS QKD use exactly the same Gaussian temporal pulse shape. We assume that TM-encoded RRDPS QKD uses Hermite-Gaussian (HG) temporal modes 2 (for detailed descriptions of these HG modes, one can refer to our previous work [18]). • We assume a unit efficiency for quantum state preparation. We assume that all photon detectors are independent and have the same P dark value. We further assume that all photon detectors have a unit efficiency. 3 • We restrict ourselves to the infinite-key limit, and a reconciliation efficiency of 1.
• We assume that e mis quantifies the collective effect of all types of errors such as system calibration errors, state preparation and measurement errors, channel errors, and all other imperfection-induced errors (e.g., tracking errors). Note that, the channel errors can be generally considered to be very small over an intersatellite channel. 4 • When the decoy-state method is incorporated into RRDPS QKD, we assume that infinite decoy states are used. 5 • When the performance of 2-dimensional decoy-state BB84 QKD is evaluated as a benchmark, we assume that polarization encoding is used. We also assume that Bob uses threshold photon detectors which are independent and have the same specifications (including the P dark value) as in RRDPS QKD. Due to their spatial-mode nature, OAM basis states experience OAM-dependent diffraction during propagation, and such diffraction is more significant for a larger OAM number. As a result, in a specific QKD system the OAM basis state with a larger OAM number acquires a larger Gouy phase and suffers from a higher diffraction loss [32]. These two phenomena can modify the relative phases among the used OAM basis states, rendering OAM QKD over a long-distance FSO channel nonviable [33]. Due to the absence of atmospheric turbulence in space, we assume that the OAM-dependent Gouy phase is perfectly controlled or compensated for. 6 This can be achieved by, e.g., applying a deterministic set of additional OAM-dependent phase patterns to the received signal. For the OAM-dependent diffraction loss, we assume that Bob applies a deterministic set of additional OAM-dependent losses to his received signal in order to equalize (i.e., reduce) the amplitudes of all lower-order OAM basis states to the amplitude of the highest-order OAM basis state in the received signal. 7

Channel loss
Based on our system model and assumptions, here we analyze the channel losses for RRDPS QKD systems utilizing different encoding schemes. Despite adopting the common notation "loss," in calculations we mainly use the single-photon transmissivity η with the relation Loss [dB] = −10 log 10 η.
For d-dimensional RRDPS QKD utilizing OAM encoding, η is given by [ where (· , ·) is the (upper) incomplete Gamma function. The quantity d 2 in the above equation represents the largest OAM number that should be used in d-dimensional OAM RRDPS QKD in order to give the highest transmissivity [18].
For any protocol (including the polarization-encoded 2-dimensional decoy-state BB84 QKD protocol investigated as a benchmark) whose transmitted signals have the fundamental Gaussian spatial profile, η is given by [18,Eq.

Performance analysis
In this section, we analyze the performance of RRDPS QKD protocols utilizing different encoding schemes in terms of the secret key rate. Specifically, we are interested in the secret key rate in bits per pulse. We also analyze the performance of RRDPS QKD with the decoy-state method incorporated. The performance of polarization-encoded 2-dimensional decoy-state BB84 QKD is also investigated as a benchmark.

Time-bin encoding
When time-bin encoding is used, a projection onto the state (|m ± |m + r ) / √ 2 is generally achieved by a shift-type interferometer with a random delay r (followed by a time-resolved photon detection). For a delay value 1 ≤ r ≤ d − 1, both of Bob's detectors open d − r time windows to detect the incoming signal. Here, we provide an overview regarding the performance analysis of time-bin RRDPS QKD for completeness -details can be found in [25].
The gain (i.e., counting rate) for delay value r (denoted as Q r ) can be calculated as The overall gain is then given by The overall quantum error rate E is given by where Finally, the secret key rate is given by where is the probability that the photon number of the transmitted signal is larger than the threshold photon number v th [20]. In security analyses (see, e.g., [20]), it is assumed that (i) all transmitted signals with a photon number smaller than v th give Eve the information I upper AE (v th ; d), and (ii) all transmitted signals with a photon number larger than v th give Eve the maximum amount of information (i.e., one bit). Note that, the function h 2 (·) in Eq. (9) denotes the binary Shannon entropy, and this function is Note that both μ and v th should be optimized to maximize the secret key rate.

OAM encoding and TM encoding
When OAM encoding or TM encoding is used in RRDPS QKD, an interferometer is usually not needed for signal measurement. A projection onto the state (|m ± |m + r )/ √ 2 can be achieved by carefully designed devices. Such devices include the spatial light modulator for OAM encoding [27], and the quantum pulse gate for TM encoding (see, e.g., [29] for a comprehensive review). Furthermore, a detection efficiency of unity can, in principle, be achieved when carefully designed quantum state sorters are used (see discussions in, e.g., [27]). Note that, unlike the case of time-bin encoding, both of Bob's detectors only need to open one time window to detect the incoming signal; therefore, the overall gain is given by The overall quantum error rate E is given by The secret key rate is given by where is the probability that the photon number of the transmitted signal is larger than v th [20]. Note that both μ and v th should be jointly optimized to maximize the secret key rate.

RRDPS QKD with decoy-state method
In RRDPS QKD, the bound of information leakage can be given as a function of the number of photons contained within the transmitted signal. Recall the assumptions in Sect. 4.1 that (i) all transmitted signals with a photon number smaller than v th give Eve the information I upper AE (v th ; d), and (ii) all transmitted signals with a photon number larger than v th give Eve the maximum amount of information (i.e., one bit). These assumptions may be overly pessimistic. Intuitively, it is natural to introduce the decoy-state method to improve the performance of RRDPS QKD by estimating the yields {Y n } of the transmitted signals with different photon numbers {n} [34]. In this work, we assume that infinite decoy states are used (recall Sect. 3.2), and in the infinitekey limit this means that {Y n } can be estimated accurately. Although incorporating the decoy-state method in RRDPS QKD may require a more complicated setup, 8 this does not change the fact that RRDPS QKD requires no signal disturbance monitoring to ensure security.

Time-bin encoding
Here, we provide an overview regarding the performance analysis of time-bin decoystate RRDPS QKD for completeness -details can be found in [31]. For a delay value 1 ≤ r ≤ d − 1, the yield of an n-photon transmitted signal is given by The mean yield of an n-photon transmitted signal is given by and the overall gain is given by The overall quantum error rate is given by where The secret key rate is then given by Note that, μ should be optimized to maximize the secret key rate.

OAM encoding and TM encoding
When OAM encoding or TM encoding is used in decoy-state RRDPS QKD, the yield of an n-photon transmitted signal is given by and the overall gain is given by The overall quantum error rate is given by where The secret key rate is then given by Note that, μ should be optimized to maximize the secret key rate.

Generalized decoy-state BB84 QKD
It is meaningful to use decoy-state BB84 QKD protocols as a benchmark. Specifically, in this work we adopt the generalized protocol in [35], and we assume the d-detector configuration for d-dimensional decoy-state BB84 QKD. Following [35], the yield of transmitted vacuum signals is given by The overall gain is given by The overall quantum error rate is given by The gain of single-photon transmitted signals is given by The quantum error rate of single-photon transmitted signals is given by The secret key rate is given by where Shannon entropy [35]. For a fair comparison, in Eq. (31) we have set the reconciliation efficiency to 1, and we consider the use of the efficient BB84 protocol following [35]. For the same reason, we also assume infinite decoy states. Note that, μ should be optimized to maximize the secret key rate.

Numerical results
In all figures, we use abbreviations in the figure legends for concise reasons. Specifically, in the figure legends we refer to time-bin encoding, TM encoding, OAM encoding, RRDPS QKD (without incorporating the decoy-state method), and RRDPS QKD (with the decoy-state method incorporated) as TB, OAM, TM, RRDPS, and DS RRDPS, respectively. Note that, the figure legend [d = 2, Benchmark] represents polarization-encoded 2-dimensional decoy-state BB84 QKD protocol. When plotting QKD performances against the receiver-aperture radius r a , for a certain beam-waist radius w 0 we consider r a values ranging from w 0 to 1 m.

L = 200 km, w 0 = 15 cm
In Fig. 2, we plot the performances of inter-satellite RRDPS QKD at L = 200 km. Both the performances achieved without (Fig. 2a, c, e) and with (Fig. 2b, d, f) the decoy-state method incorporated are plotted. In each sub-figure, the performances achieved by different encoding schemes (i.e., time-bin encoding, OAM encoding, and TM encoding) using one of the three typical dimensions (i.e., d = 8, d = 16, and d = 32) are plotted against two system parameters (i.e., optical misalignment error e mis and receiver-aperture radius r a ). The performance of 2-dimensional decoy-state BB84 QKD is also plotted as a benchmark. From all sub-figures of Fig. 2, we first observe that the QKD performance is reduced as e mis increases and/or r a decreases, and a larger r a value improves the error tolerance (especially when OAM encoding is used). We also observe that time-bin encoding and TM encoding both enable RRDPS QKD to achieve a better error tolerance than 2-dimensional decoy-state BB84 QKD (whose maximum tolerable error is ∼ 11%) over the inter-satellite channel even when the smallest r a value (i.e., r a = 15 cm) is used. However, when OAM encoding is used, a much larger r a value is needed for RRDPS QKD to outperform 2-dimensional decoy-state BB84 QKD in terms of error tolerance over the inter-satellite channel. This observation can be explained by the fact that, under the same r a value OAM-encoded RRDPS QKD suffers from an OAM-dependent diffraction loss that can be much higher than the loss experienced by time-bin-encoded or TM-encoded RRDPS QKD.
Comparing Fig. 2(a, b), (c, d), and (e, f), we clearly observe that incorporating the decoy-state method in RRDPS QKD improves the secret key rate, error tolerance, and the feasible r a range over the inter-satellite channel when any of the encoding schemes is used. For example, incorporating the decoy-state method in RRDPS QKD reduces the minimum r a value necessary for OAM RRDPS QKD to outperform 2-dimensional decoy-state BB84 QKD in terms of error tolerance over the inter-satellite channel.
From all sub-figures of Fig. 2, we further observe that OAM encoding can outperform time-bin encoding under certain circumstances. Specifically, for d = 8 and d = 16, OAM encoding outperforms time-bin encoding when r a is sufficiently large. However, OAM encoding quickly becomes nonviable as r a becomes smaller due to the rapidly increasing OAM-dependent diffraction loss. Furthermore, for d = 32 OAM encoding leads to a very small feasible parameter range and hardly achieves any advantage over time-bin encoding due to the significant OAM-dependent diffraction loss for a large OAM number. Such observations indicate that OAM encoding may be preferable to time-bin encoding in inter-satellite RRDPS QKD only when r a is sufficiently large and/or the dimension d is sufficiently low. Interestingly, from all sub-figures of Fig. 2 we find that TM encoding provides the best performance, the best error tolerance, and the largest feasible r a range. This indicates that TM encoding is preferable to both OAM encoding and time-bin encoding in inter-satellite RRDPS QKD.  (Fig. 2a, c, e) and with (Fig. 2b, d, f) the decoy-state method incorporated are plotted. In each subfigure, the performances achieved by different encoding schemes (i.e., time-bin encoding, OAM encoding, and TM encoding) using one of the three typical dimensions (i.e., d = 8, d = 16, and d = 32) are plotted against two system parameters (i.e., optical misalignment error e mis and receiver-aperture radius r a ). The performance of 2-dimensional decoy-state BB84 QKD is also plotted as a benchmark Since a higher dimension d essentially reduces the information leakage to Eve, it is intuitive to think that increasing the dimension d should provide improvements to RRDPS QKD over the inter-satellite channel. Although the system performances achieved with different dimensions are plotted in the sub-figures of Fig. 2, the consequences of increasing the dimension d in inter-satellite RRDPS QKD are not explicitly illustrated in these sub-figures. To remedy this situation, in Fig. 3 we re-plot the performances of inter-satellite RRDPS QKD at L = 200 km presented in Fig. 2. Specifically, in each sub-figure the performances achieved by one of the three encoding schemes (i.e., time-bin encoding, OAM encoding, and TM encoding) using all three typical dimensions (i.e., d = 8, d = 16, and d = 32) are plotted together against two system parameters (i.e., optical misalignment error e mis and receiver-aperture radius r a ) for a better comparison. Both the performances achieved without (Fig. 3a, c, e) and with (Fig. 3b, d, f) the decoy-state method incorporated are plotted. The performance of 2-dimensional decoy-state BB84 QKD is also plotted as a benchmark.
From the sub-figures of Fig. 3, we can clearly see that increasing the dimension d leads to different consequences when different encoding schemes are used in intersatellite RRDPS QKD. Specifically, when time-bin encoding (see Fig. 3a, b) or TM encoding (see Fig. 3e, f) is used, an increased dimension d generally improves the error tolerance of inter-satellite RRDPS QKD. 9 However, an increase dimension d can reduce the secret key rate of time-bin-encoded inter-satellite RRDPS QKD when e mis is sufficiently low and r a is sufficiently large. This can be explained by the fact that ddimensional time-bin-encoded RRDPS QKD utilizes d sequential pulses to generate one single bit (also recall the 1/d scaling factor in Eq. 9). Figure 3c, d indicates that things are more complicated when OAM encoding is used. Specifically, without using the decoy-state method, increasing the dimension from d = 8 to d = 16 improves the error tolerance and reduces the feasible r a range at the same time. A further increase in dimension from d = 16 to d = 32 reduces both the error tolerance and the feasible r a range when OAM encoding is used. Furthermore, an increased dimension d also leads to a lower QKD performance when e mis is sufficiently low. After using the decoy-state method, increasing the dimension d seems to always improve the error tolerance; however, doing so will still cause a reduced feasible r a range and a lower secret key rate. These observations are all due to the increased OAM-dependent diffraction loss when a higher dimension is used.

L = 200 km, w 0 = 5 cm
Until now we have been setting the beam-waist radius to w 0 = 15 cm following our previous works [16,18]. Despite not being unreasonably large, such a beam-waist radius is in fact larger than most of the used values in the existing implementations of satellite-based QKD. For example, the Micius quantum satellite features a 300mm-aperture (in diameter) telescope that provides a near-diffraction-limited far-field divergence of ∼ 10 μrad at ∼ 850 nm [2]. Using this information, a beam-waist radius w Micius 0 ≈ 5.5 cm (which is much smaller than our current setting w 0 = 15 cm) can be derived. In fact, our choice of a larger beam-waist radius essentially reduces the beam diffraction, making OAM-based quantum information protocol more feasible. 9 Note that, an increased dimension d also improves the feasible r a range when time-bin encoding or TM encoding is used. However, this cannot be clearly observed in Figs. 2 and 3 since both time-bin-encoded and TM-encoded inter-satellite RRDPS QKD achieves positive secret key rates even under the smallest r a value. This is essentially due to the fact that the minimum loss (η min TM or η min TB ) at L = 200 km is not large enough. The feasibility of time-bin-encoded and TM-encoded inter-satellite RRDPS QKD in the high-loss regime is presented in Fig. 5.  Fig. 3 A re-plot of the performances of inter-satellite RRDPS QKD at L = 200 km presented in Fig. 2. Specifically, in each sub-figure the performances achieved by one of the three encoding schemes (i.e., timebin encoding, OAM encoding, and TM encoding) using all three typical dimensions (i.e., d = 8, d = 16, and d = 32) are plotted together against two system parameters (i.e., optical misalignment error e mis and receiver-aperture radius r a ) for a better comparison. Both the performances achieved without (Fig. 3a, c, e) and with (Fig. 3b, d, f) the decoy-state method incorporated are plotted. The performance of 2-dimensional decoy-state BB84 QKD is also plotted as a benchmark To determine the feasibility of inter-satellite RRDPS QKD utilizing the existing operational platforms (e.g., the Micius quantum satellite), we adopt all settings of Fig. 3 except we change the beam-waist radius to w 0 = 5 cm to mimic the setting of the Micius quantum satellite. In Fig. 4, we plot the performances of inter-satellite RRDPS QKD at L = 200 km with w 0 = 5 cm. In each sub-figure, the performances achieved by one of the three encoding schemes (i.e., time-bin encoding, OAM encoding, and TM encoding) using all three typical dimensions (i.e., d = 8, d = 16, and d = 32) are plotted together against two system parameters (i.e., optical misalignment error e mis and receiver-aperture radius r a ). Both the performances achieved without (Fig. 4a, c, e) and with (Fig. 4b, d, f) the decoy-state method incorporated are plotted. The performance of 2-dimensional decoy-state BB84 QKD is also plotted as a benchmark.
From Fig. 4, we find that most of the observations made from Fig. 3 still hold. Comparing the sub-figures of Figs. 4 and 3 one by one, we can clearly see that the use of a smaller w 0 value reduces the QKD performance due to a higher diffraction loss. In terms of error tolerance and feasible r a range, we observe that time-bin encoding is more affected than TM encoding, and RRDPS QKD without incorporating the decoy-state method is more affected than RRDPS QKD with the decoy-state method incorporated. As expected, the results in Fig. 4c, d clearly indicate the detrimental impact imposed on OAM-encoded inter-satellite RRDPS QKD by a smaller w 0 value. Specifically, a very small feasible r a range can be achieved by OAM encoding even for d = 8, and no positive secret key rate can be achieved by OAM encoding for d = 16 and d = 32. This is due to the significant OAM-dependent diffraction loss caused by a smaller w 0 value. In order to utilize OAM encoding in inter-satellite RRDPS QKD, a larger beam-waist radius w 0 must be used.

The optimality of TM encoding
It can be seen from Fig. 2 that TM encoding outperforms both OAM encoding and time-bin encoding in terms of the secret key rate, the error tolerance, and the feasible r a range. Interestingly, both Figs. 3 and 4 also indicate that TM encoding (see Figs. 3e, f and 4e, f) is the only encoding scheme that gives a higher secret key rate, a better error tolerance, and a larger feasible r a range at the same time when the dimension d increases. These observations indicate that TM encoding is superior to both OAM encoding and time-bin encoding in RRDPS QKD over an inter-satellite channel.

Performance against loss
In Figs. 2, 3, and 4, we have observed that both time-bin-encoded and TM-encoded RRDPS QKD achieved positive secret key rate over an L = 200 km inter-satellite channel even when the smallest receiver-aperture size is used. Although such an observation indicates that both time-bin encoding and TM encoding are promising paradigms for RRDPS QKD over a typical inter-satellite channel, none of the results in Figs. 2, 3, or 4 provide full information regarding the loss tolerance of time-bin- Fig. 4 The performances of inter-satellite RRDPS QKD at L = 200 km. Here we set the beam-waist radius to w 0 = 5 cm in order to mimic the setting of the Micius quantum satellite [2]. In each sub-figure, the performances achieved by one of the three encoding schemes (i.e., time-bin encoding, OAM encoding, and TM encoding) using all three typical dimensions (i.e., d = 8, d = 16, and d = 32) are plotted together against two system parameters (i.e., optical misalignment error e mis and receiver-aperture radius r a ). Both the performances achieved without (Fig. 4a, c, e) and with (Fig. 4b, d, f) the decoy-state method incorporated are plotted. The performance of 2-dimensional decoy-state BB84 QKD is also plotted as a benchmark encoded and TM-encoded RRDPS QKD 10 . Specifically, some important questions yet to be answered are as follows.
1. Which encoding scheme gives the best loss tolerance in RRDPS QKD? 2. How does an increased dimension d affect the loss tolerance of time-bin-encoded and TM-encoded RRDPS QKD? 3. Can RRDPS QKD outperform 2-dimensional decoy-state BB84 QKD in terms of loss tolerance over an inter-satellite channel?
To answer all these questions, in Fig. 5 we plot the performances of inter-satellite RRDPS QKD achieved without (Fig. 5a, c, e) and with (Fig. 5b, d, f) the decoystate method incorporated. In each sub-figure, the performances achieved by time-bin encoding and TM encoding using one of the three typical dimensions (i.e., d = 8, d = 16, and d = 32) are plotted together against the optical misalignment error e mis and the total loss (in dB). The performance of 2-dimensional decoy-state BB84 QKD is also plotted as a benchmark.
From Fig. 5, we first clearly see that both time-bin encoding and TM encoding enable RRDPS QKD (of all considered dimensions) to outperform 2-dimensional decoy-state BB84 QKD in terms of error tolerance within their respective acceptable loss ranges. We also see that an increased dimension d improves the loss tolerance of RRDPS QKD when time-bin encoding or TM encoding is used. Specifically, without using the decoy-state method (see Fig. 5a, c, e), TM-encoded RRDPS QKD requires d = 32 to achieve a level of loss tolerance similar to that of 2-dimensional decoystate BB84 QKD (see Fig. 5e). However, it seems that such a level of loss tolerance cannot be achieved by time-bin-encoded RRDPS QKD even for d = 32 (also see Fig. 5e). Comparing Fig. 5(a, b), (c, d), and (e, f), we clearly observe that incorporating the decoy-state method in RRDPS QKD improves both error tolerance and loss tolerance when time-bin encoding or TM encoding is used. Specifically, after incorporating the decoy-state method (see Fig. 5b, d, f), time-bin-encoded RRDPS QKD can achieve a level of loss tolerance similar to (although still slightly worse than) that of 2-dimensional decoy-state BB84 QKD. On the other hand, TM-encoded decoy-state RRDPS QKD only requires d = 8 to outperform 2-dimensional decoy-state BB84 QKD in terms of loss tolerance (see Fig. 5b).
Interestingly, from all the sub-figures of Fig. 5 we clearly observe that TM encoding outperforms time-bin encoding in terms of secret key rate, error tolerance, as well as Fig. 5 Performances of inter-satellite RRDPS QKD achieved without (Fig. 5a, c, e) and with (Fig. 5b, d, f) the decoy-state method incorporated. In each sub-figure, the performances achieved by time-bin encoding and TM encoding using one of the three typical dimensions (i.e., d = 8, d = 16, and d = 32) are plotted together against optical misalignment error e mis and total loss (in dB). The performance of 2-dimensional decoy-state BB84 QKD is also plotted as a benchmark loss tolerance in RRDPS QKD of all considered dimensions. This observation holds regardless of whether the decoy-state method is incorporated. It is also clear that TM encoding is the only one encoding method that enables all the theoretically available advantages (i.e., a higher secret key rate, a better error tolerance, and a better loss tolerance) provided by an increased dimension in RRDPS QKD at the same time.

Conclusions
Inter-satellite quantum communications have been considered as a crucial enabler of global-scale unconditional information security. The use of RRDPS QKD within the context of inter-satellite quantum communications not only provides a high error tolerance, but also potentially leads to a higher system efficiency and an improved real-world practicability due to the elimination of the need for signal disturbance monitoring. The use of novel (and increasingly mature) OAM encoding and TM encoding schemes eliminates the technical challenges associated with signal measurement in time-bin encoding (which is the default encoding scheme for RRDPS QKD), further improving the practical feasibility of RRDPS QKD. In this work, we explored the feasibility of performing inter-satellite RRDPS QKD utilizing OAM encoding and TM encoding schemes. We found that utilizing the OAM and TMs of single photons in RRDPS QKD is indeed feasible over a typical inter-satellite channel.
First, we extended the current performance analyses for time-bin-encoded RRDPS QKD (over a fiber-optic channel) to the scenarios where OAM encoding and TM encoding are used over an inter-satellite channel. We then evaluated and compared the performances of inter-satellite RRDPS QKD, of different dimension, achieved with OAM encoding and TM encoding, under different settings of system parameters. We also evaluated the performances of time-bin-encoded RRDPS QKD and polarizationencoded 2-dimensional decoy-state BB84 QKD as benchmarks. We further determined the potential improvements provided by incorporating the decoy-state method into inter-satellite RRDPS QKD using OAM encoding and TM encoding.
Our results indicated that OAM encoding is preferable to time-bin encoding only under the circumstances where a low dimension and a large receiver aperture are used. However, we found that TM encoding is the best encoding scheme in RRDPS QKD over an inter-satellite channel. In particular, we showed that TM encoding not only leads to the best performance and the largest feasible parameter range, but also, for the first time, enables all the theoretically available advantages of an increased dimension to be realized in the context of RRDPS QKD. Our results provide valuable insights into the practical implementation of high-error-tolerance low-overhead inter-satellite quantum communications utilizing currently available technologies.
The practical implementation of time-bin-encoded RRDPS QKD relies on the realization of a single-photon variable-delay interferometer for signal measurement. Since an interferometer is extremely susceptible to environmental disturbances, temperature fluctuations, and satellite-motion-induced Doppler shift, an active real-time stabilization system is usually needed. The active stabilization of fixed-delay interferometers for satellite-based quantum communications has been demonstrated (see, e.g., [37]). However, the practical implementation of time-bin-encoded RRDPS QKD of dimension d requires d (different) actively selectable delay paths in the variable-delay interferometer, and the simultaneous stabilization of all the delay paths has been considered a greater challenge (see discussions in, e.g., [38]). Although OAM encoding and TM encoding do not require an active interferometer-stabilization system (since no interferometer is needed), it should be pointed out that these encoding schemes also have their own technical challenges in practice. The well-known challenges regarding the real-world implementation of an OAM-encoded system include the alignment sen-sitivity and physical size of the OAM quantum state sorter. One promising solution for this is a compact OAM quantum state sorter whose optical elements are integrated into a miniaturized optical platform with the help of advanced fabrication technologies (see demonstrations in, e.g., [39]). For TM encoding, the timing requirements may be very stringent due to the reliance on the spectral-temporal orthogonality of TMs. Considering the use of quantum pulse gates (based on the time-dependent nonlinear interaction between signal and pump pulses) for signal measurement, the synchronization of a TM-encoded system may be non-trivially dependent on the relative satellite motion. Such a timing challenge may be overcome by using weak coherent pilot pulses, which can serve as a timing reference and a pump pulse at the same time (see discussions in, e.g., [28]). It should be noted that the use of quantum pulse gates in TM encoding also requires arbitrary pulse shaping (of the pump pulse) and temperature stabilization (for the nonlinear crystal), and these requirements may add complexity to the design of a quantum satellite.
Funding Open Access funding enabled and organized by CAUL and its Member Institutions.

Data availibility
The data that support the findings of this study are available from the authors upon reasonable request.
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.