\section{Introduction}

The first protocol of Quantum Key Distribution (QKD) was proposed in 1984 by Bennet and Brassard \cite{BB1984}. Today, commercial fiber-based systems are available with operational distances steadily increasing \cite{Zbinden2018}\cite{Fang2020}. Recently, QKD has also been realized between the Chinese satellite Micius and ground-stations \cite{Micius2017}\cite{Micius2020}. Currently, there are several national initiatives to deploy a QKD network, including terrestrial and space links. In particular, there is an increasing and unprecedented interest in space telecommunication networks; our scenarios of interest as illustrated in Fig. \ref{fig:OWsecrecy_QT}, (this work focuses on the blue link). 

A QKD protocol assumes that two distant legitimate parties, Alice and Bob have at their disposal the following resources: Secure offices, access to an untrusted quantum channel and an authenticated classical public channel, and perfectly random numbers. A potential eavesdropper, Eve, has the complete control of the quantum channel. In particular, she can intercept all quantum states and perform any measurement allowed by quantum mechanics, including entangling the states with some auxiliary system and store them in perfect quantum memories. Moreover, she can send signals to Bob over a lossless channel. Despite this extreme power only limited by the laws of quantum physics, QKD protocols are now well established and furnished with security proofs \cite{Shor2000}\cite{Mayers2001}\cite{Kato2016}\cite{Curty2019}. So the generated keys guarantee together with the encoding using the one-time-pad information theoretically secure communication \cite{Renner2005}\cite{Scarani2009}.  

\begin{figure}[tbh]
\centering
\includegraphics[scale=0.28]{imagesDraft/scenarios_1}
\protect\caption{Our scenarios of interest: celestial mechanics dictates orbit dynamics for legitimate parties and eavesdroppers.} 
\label{fig:OWsecrecy_QT}
\end{figure}

Alternatively, physical-layer-security relies also on information theoretical principles in the sense that Eve has unlimited computing power. However, she has a physical disadvantage with respect to the legitimate users. In particular, Eve can intercept only a fraction of the signal sent by Alice. In 1975,  Wyner first proposed a protocol based on a so-called degraded wiretap channel (for a  classical channel)\cite{Wyner1975}\cite{WynerPoisson}\cite{WynerPoisson-1}. The information leakage to the eavesdropper is determined with an information theoretical measure, which has been strengthened from Wyner's (weak) security to the so called strong security criterion by I.~Csisz\'ar and J.~K\"orner, \cite{Csiszar1978} and Maurer \cite{Maurer1993} until achieving cryptographic semantic security \cite{Bellare2012}.
In a quantum setting, where Alice and Bob use an authenticated quantum channel for (keyless) secure direct communication, the asymptotically achievable rate, the private capacity, subject to the strong security criterion, was determined by Cai, Winter and Yeung in \cite{Cai2004} and Devetak in \cite{Devetak2005}\cite{Devetak2005-1}.

On the one hand, QKD with satellites is extremely challenging due to the small signal strength of the order of one photon per pulse, the high channel loss, delays due to the iterative protocol, and the sensitivity to background noise, which does not allow key exchanges during daytime. On the other hand, eavesdropping without being noticed seems to be very complicated as well in a free-space scenario. So it makes a lot of sense to consider a few reasonable assumptions which limit the power of Eve. Indeed, due to the laws of celestial mechanics a satellite cannot be parked in the line of sight between Alice's satellite and Bob's ground-station (or satellite), which prevents intercept and resend attacks. Eve could  position her satellite very close or eventually attach it to Alice's satellite. This would allow Eve to exploit side channels (e.g. monitoring electronic signals), but this scenario is excluded in QKD which relies by definition on secure offices. Similarly, Eve could place a telescope close to Bob's but again we may introduce an exclusion region under control of Bob, within which Eve cannot install a big telescope. 

There is some initial work investigating the consequences of restricted power for Eve on the performance of QKD links \cite{Shapiro2019}\cite{Shapiro2019-1}\cite{Ling2019}\cite{Fujiwara2018}. However, given their additional, reasonable assumptions, we find exactly the scenario where keyless private communication is possible. This type of secret transmission and its practical comparison with QKD have been studied in \cite{Endo2015}\cite{Endo2016}, however, without  assuming a quantum channel. 

In this paper, we show that physical layer encryption is a reasonable choice for satellite communication over the quantum space channel. In Section II, we introduce the one-way wiretap protocol and identify its asymptotic information-theoretical secure and reliable rate: the private capacity. In Section III, we propose a simple yet accurate channel model using binary modulated coherent states (on-off keying, OOK) and derive and analyze the private capacity for Bob using realistic, state-of-the-art photon counting detectors while the signal reception by Eve being only limited by the laws of physics. Finally, we present numerical results for a realistic scenario taking the performance of the Micius system as a reference and compare it to the fundamental limit for the secret key rate of QKD \cite{PLOB2017}.

\section{Description of the protocol}

Our protocol is based on the one-way wiretap protocol \cite{Wyner1975}\cite{Csiszar1978} where secret bits are channel encoded and sent over $n$ uses of the optical channel. We assume OOK for lighter analytical treatment, but other binary modulations can be used e.g. Binary Phase Shift Keying (BPSK). 

The protocol contains the following steps.
\begin{enumerate}

\item \textbf{Encoding.} Alice, the legitimate information transmitter, sends a stream of secret information bits (any data, video, pictures, etc.) to a stochastic wiretap encoder. Information-theoretically, this encoding is described as Alice selects a codeword $X^n$ to send her secret message $M$. The signal is meant for Bob, but part of it is leaked to the environment represented by the omnipresent Eve. The secrecy depends on the structure of this encoder, 
which is characterized by the rate $R=k/n$ (where $k$ is the number of secret bits), the error probability, $\epsilon_n$, and a security measure, $\delta_n$.

\item \textbf{State Preparation.} For each use of the channel, the legitimate information transmitter (Alice), prepares a coherent state modulated by the random variable $X \in \mathcal{X}=\{0,1\}$, where $X=0$ with probability $q$ and $X=1$ with probability $1-q$. The OOK states transmitted by Alice are the vacuum state, $\ket{\alpha_0} = \ket{0}$, and
\begin{align}
\ket{\alpha_1} &= e^{-\frac{1}{2}|\alpha_1|^2} \sum_{n=0}^{\infty} \frac{\alpha_1^n}{(n!)^{1/2}}\ket{n}.
\end{align}
The probability $q$ is not decided \emph{a priori} as part of the protocol, it needs to be optimized depending on the assumptions at the detection and the physical propagation channel (Section III).

\item \textbf{Measurement.} After $n$ transmissions over the quantized propagating field, Bob receives $B^n$ and Eve $E^n$. Bob estimates his received coherent state after measuring the arriving light and obtains $Y^n$. He disposes of state-of-the-art detectors. Eve may apply the best quantum detection strategy to obtain $Z^n$.

\item \textbf{Decoding.} Bob and Eve send their estimated received states to the decoder. The concrete construction of encoder and decoder are assumed to be publicly known. The  values of $\epsilon_n$ and $\delta_n$ depend on the choice of this code.
 
\end{enumerate}

According to the wiretap theory, even if the eavesdropper is computationally unbounded, the wiretap code ensures that if $R$ is an achievable rate, both $\epsilon_n$ and $\delta_n$ (after decoding) tend to zero for large $n$,
\begin{align}
\lim_{n \rightarrow \infty} \epsilon_n = \lim_{n \rightarrow \infty} \delta_n &= 0,
\end{align}
which means that the error probability and the information leakage towards Eve can be made arbitrarily low. Upper bounds are also known for the speed of convergence rate of leaked information \cite{Hayashi2015}. Hence, the protocol jointly provides information-theoretical reliable and secure communication. The supremum of all such rates is called the private capacity and for the classical-quantum wiretap channel subject to the strong security criterion, has been determined in \cite{Cai2004}\cite{Devetak2005}. The meaning of strong security is that, given a uniform distribution of the message to be transmitted through the channel, the eavesdropper shall obtain no information about it \cite{Maurer1994}. This criterion is the most common security criterion in classical and quantum information theory. The metric of strong security is the amount of mutual information leaked to Eve.

When Bob's channel is degradable, the private capacity of the quantum wiretap protocol (with quantum channel and information) is \cite{Devetak2005-1}\cite{Smith2008}\cite{Wilde2018}
\begin{align}
C_P(\mathcal{N}) =  \sup_{\rho_{in}} I_c(\rho_{in},\mathcal{N}), 
\label{PriCapFormula}
\end{align}
where $\rho_{in}$ is the input density matrix and $ I_c(\rho_{in},\mathcal{N})$ is the coherent information defined as 
\begin{align}
I_c(\rho_{in},\mathcal{N})= S(\mathcal{N}_{B}(\rho_{in})-S(\mathcal{N}_{E}(\rho_{in})), 
\end{align} \label{eq:CoherentInfo}
with $S$ the von Neumann entropy. In the next sections we characterize the degradable channel of our practical (energy-constrained) protocol over space links, which we use to derive the private capacity.
\begin{figure}[tbh]
\centering
\includegraphics[scale=0.2]{imagesDraft/WiretapModel1}
\protect\caption{The main channel and the wiretap channel (top) and the information-theoretical representation of the degraded classical-quantum channel (bottom).} 
\label{fig:sysmodel}
\end{figure}

The (physical) description of our protocol is illustrated in Fig. \ref{fig:sysmodel} (top). The figure shows encoded bits modulating coherent states, the quantum channel $\mathcal{N}=(\mathcal{N}_B,\mathcal{N}_E)$, the resulting classical channel after detection $N=(N_B,N_E)$ as well as the information theoretical representation (bottom).


\section{Calculation of the private capacity $C_{P}$}

First, we build a model for the classical-quantum channel of our protocol. The legitimate transmitter, Alice, is on a satellite while the legitimate receiver, Bob, is on Earth. We assume a single-mode free-space quantum bosonic channel (for the wiretap channel in the semi-classical regime see \cite{Hayashi2020}).  The overall efficiency of Bob's channel is $\eta$. The coefficient $\gamma \in (0,1)$ characterizes the channel degradation. Hence, the efficiency of Eve's channel is $\gamma\eta$.


According to step 2 of our protocol, the received states are simply the vacuum, or $\ket{\sqrt{\eta}\alpha_1}$  and $\ket{\sqrt{\eta\gamma}\alpha_1}$ for Bob and Eve respectively. The wiretap channel transition probabilities depend on the coherent states received by Bob and Eve and by their detection strategies. For practical purposes, we assume Bob uses standard single photon detectors, i.e. a threshold detector.
For Bob, we also take into account limited detection efficiency (included in $\eta$, see Appendix \ref{sec:App4}) and noise (dark counts probability $p_{dark}$ and stray light with a Poisson photon number distribution and average $\eta_0\Delta$). The conditional probabilities that Bob detects $y$ given that Alice sent $x$ are illustrated in Fig. 3 with $\epsilon_0=(1-p_{dark})e^{-\eta_o\Delta}$ and $\epsilon_1=(1-p_{dark})e^{-(\eta\mu +\eta_o\Delta)}$, where we have denoted $\mu=|\alpha_1|^2$. 

Eve instead performs an optimal quantum detection. For the single observation, this leads to the optimal error probability $\epsilon^*$, which can be calculated as \cite[Lemma 3.1]{Hayashi2006}\cite{Audenaert2007}\cite{Audenaert2008}, 
\begin{align}
\epsilon^* &=\min_{0 \leq  \Pi \leq \mathbf{1}} [ q\Tr (\mathbf{1} - \Pi)\rho_1 + (1-q)\Tr \Pi \rho_0 )] \\
&= \frac{1}{2}-\frac{1}{2}\norm{q\rho_1 - (1-q) \rho_0}_1,
\end{align} \label{eq:minPe}
where $\norm{}_1$ stands for trace norm. In the binary source scenario, this bound is achieved by the Holevo-Helstrom projector 
\cite{Helstrom1976}\cite{Holevo1978}, for which several practical implemetations have been proposed such as the Kennedy receiver \cite{Kennedy1973}, the Dolinar receiver \cite{Dolinar1973} or the Sasaki-Hirota receiver \cite{Takeoka2008}\cite{Tsujino2011}. The optimal error probability of Eve resulting from (5), becomes
\begin{align}
\epsilon^*(\gamma)=(1-\sqrt{1-4q(1-q)e^{-\eta\gamma \mu}})/2. 
\end{align}


\begin{figure}
\centering
\includegraphics[width=3.3in]{imagesDraft/Channels}
\caption{Probabilistic detection models assumed for Bob and Eve to obtain $Y$ and $Z$, respectively.}
\label{fig:Degradation}
\end{figure}

The private capacity for our wiretap channel model coincides with the classical secrecy capacity and is defined as
\begingroup
\small
\begin{align}
C_P(\gamma)&= \max_q \{ I(X;Y) - I(X;Z | \gamma ) \},
\label{eq:PrivateRate}
\end{align}
\endgroup
where $I(X,Y)$ is the Shannon mutual information of Alice using a state-of-the-art photon counting detector and $I(X;Z | \gamma )$ is the maximum Shannon mutual information that Eve can physically detect. For our setting as presented in Section IV, a uniform input probability (i.e. $q=0.5$) is very close to optimum (see Appendix \ref{sec:App0}), and we have
\begingroup
\small
\begin{align}
C_P(\gamma)&= \left[h(\epsilon^*(\gamma)) + h\left(\frac{\epsilon_0+\epsilon_1}{2}\right) - \frac{h(\epsilon_1)+h(\epsilon_0)}{2} - 1\right]_+,
\end{align}
\endgroup

where $[]_+$ means the positive part and we have used the notation $h()$ as the binary Shannon entropy. If we now restrict Eve only by the laws of quantum electrodynamics, we obtain the Devetak-Winters rate \cite{DW2005} for our protocol

\begin{align}
R_{DW} (\gamma)
& = I(X,Y)  - \mathcal{\chi}(X;E|\gamma),
\end{align}
where $I(X;Y)$ is the Shannon mutual information of Alice's choice for input probability and measured by a
state-of-the-art photon counting detector. The quantity $\mathcal{\chi}(X;E|\gamma)$ is the Holevo bound for the eavesdropper. Denoting $\epsilon(\gamma)=\bra{0}\ket{\sqrt{\eta\gamma}\alpha_1}$, for uniform priors (i.e. $q=0.5$) it is easy to show

\begingroup
\small
\begin{align}
R_{DW} (\gamma)
&= \left[h\left(\frac{\epsilon_0+\epsilon_1}{2}\right) - \frac{h(\epsilon_1)+h(\epsilon_0)}{2} - h\left(\frac{1+\epsilon(\gamma)}{2}\right) \right]_+,
\label{eq:DWPrivateRate}
\end{align}
\endgroup

The numerical calculation is shown in Fig. \ref{fig:Copt}. We observe that the private rate in \eqref{eq:PrivateRate} is as high as 0.68 for $\gamma = 0.1$ (with little sensitivity to noise, see Appendix  \ref{sec:App1}). And even for adverse channel conditions ($\gamma$ close to 1) there is a positive secrecy rate for reasonable noise (e.g.up to $\gamma = 0.6$ for $\Delta = 10^{-4}$), however we will show below that in practice is best to aim for $\gamma < 0.1$. For comparison, we have also plotted \eqref{eq:DWPrivateRate} for $\gamma=0.1$. We observe a substantial decrease, which is also affected by noise, however, we still get significant positive rates. In the following, we assume the realistic setting of Eve using Helstrom detection.

\begin{figure}[tbh]
\centering
\includegraphics[scale=0.2]{imagesDraft/FinalFigure_1}
\protect\caption{Private capacity of OOK for $\gamma=0.1$ and $\gamma=0.6$ ($p_{dark} \approx 0$, $\eta_o=1$  $\Delta=10^{-4}.$) For comparison, also the numerical values of $R_{DW}$ for $\gamma=0.1$. }
\label{fig:Copt}
\end{figure}


\section{The Micius satellite: a concrete example of an orbit-earth optical link}

As a realistic physical scenario, we use as a reference the recent experiment of QKD with the Chinese LEO satellite Micius \cite{Micius2017}\cite{Micius2020}. The geometry is shown in Fig. \ref{fig:Geometry}. The satellite has an orbit of about 500 km above the earth surface and exchanges keys over distances up to 1200 km if the satellite is close to the horizon. The transmitter is equipped with 300 mm Cassegrain telescope featuring a far field divergence $\theta_{div}$ of 10 $\mu$rad (full angle at $ 1/e^2$). The receiver at groundstation has a telescope with a diameter $D_R$ of 1m. 

\begin{figure}[tbh]
\centering
\includegraphics[scale=0.4]{imagesDraft/Geometry}
\protect\caption{Geometry for the secure and reliable communication of our wiretap protocol showing the exclusion radius $r_E$.} 
\label{fig:Geometry}
\end{figure}

We can approximate the fraction of the light collected by Bob, the free space loss $\eta^B_{f}$, as the ratio of the telescope area and the footprint area
\begin{equation}
\eta^B_{f}=\frac{A_{R}}{A_{F}}=\dfrac{\pi (D_R/2)^2}{\pi (D_F/2)^2}=\frac{D_R^2}{\theta_{div}^2d^2_B},
\label{eq:BobBudget}
\end{equation}
with $$D_F \approx \theta_{div}  d$$
where  $d_B$ is the distance between transmitter and receiver. 

The number of photons detected by Bob is given by 
$\eta \mu =\eta^B_{f}\eta_{b} \mu,$ where  $\eta_{b}$ is the total additional loss of Bob depending on the experimental situation. In the Micius experiment those are atmospheric turbulence 3-8 dB ($\eta_{atm}$), pointing errors ($\eta_p$) $<$ 3 dB, overall optical loss ($\eta_o$) from telescope input lens to detector 7.4 dB detector, detector efficiency $\eta_{det}$  50 \% (3 dB) (see Appendix \ref{sec:App4}). In the following we calculate with a loss $\eta_b$ of 20 dB (1\%). 

For Eve we calculate $\eta^E_{f}$ as in (\ref{eq:BobBudget}) but we add a factor taking into account the light intensity outside the exclusion angle supposing a Gaussian angular distribution of the beam as 

\begin{equation}
\eta^E_f=\frac{(D^E_R)^2}{\theta_{div}^2d_E^2} e^{-2(\frac{2\theta_E}{\theta_{div}})^2}.
\end{equation}

Then, the number of photons detected by Eve becomes simply $\eta^E_f \mu=\gamma \eta \mu$, as we assume no additional loss for Eve. Hence, for fixed antenna sizes we can easily calculate $\gamma$ as 

\begingroup
\small
\begin{align}
\gamma(d_B, d_E,\eta_b, \theta_E, \theta_{div})
&=\dfrac{1}{\eta_b}\Big( \frac{d_B}{d_E} \Big)^2\Big( \frac{D^E_R}{D^B_R} \Big)^2 e^{-2(\frac{2\theta_E}{\theta_{div}})^2}.
\label{eq:physgamma1}
\end{align}
\endgroup

For $d_B=d_E= 1200~km$ and $\theta_E=r_E/d$, for the Micius system parameters and assuming a very large eavesdropper's receiving antenna $D^E_R$ of 2 m and a small exclusion radius  $r_E=12.5$m we obtain: 
$$\gamma = 0.07<0.1$$
For the reminder, we fix the exclusion radius such that $\gamma <0.1$. Indeed, this value seems to be a good choice as it leads to high secret capacities $>$ 0.6 (see Fig. \ref{fig:Copt}), little sensitivity to noise and signal fluctuations for reasonable exclusion radii as discussed in Appendix \ref{sec:App1}. This sensitivity is driven by the distinguishability of the coherent states at Eve's Holevo-Helstrom detector as shown in Appendix \ref{sec:App5}, the lower the $\gamma$ the less sensitivity of the distinguishability to signal dynamics.


\section{Private rates for different practical settings and comparison with QKD} 




\renewcommand{\arraystretch}{1.8}
\begin{table*}[ht]
\centering
\resizebox{\textwidth}{!}{
\begin{tabular}{|c|c|c|c|c|c|c|c|}
\hline 
\multirow{2}{*}{Configuration } & \multirow{2}{*}{Distance [km]} & \multirow{2}{*}{Channel loss ($\eta^B_f$)} & \multicolumn{2}{c|}{QKD (night) $\Delta = 10^{-7}$} & \multicolumn{3}{c|}{Wiretap channel (day) $\Delta = 10^{-4}$} \\ \cline{4-8} 
 &  &  & Micius & PLOB ($\eta_b = 1$) & exlusion radius $r_E$ [m] & gamma &  private rate \\ 
\hline 
LEO & 500 - 1200 & 22dB & $<$ 10kHz & 10MHz & 12.5 & 0.1 & 700MHz \\ 
\hline 
MEO & 10000 & 40dB & - & 100kHz & 100 & 0.1 & 700MHz \\ 
\hline 
GEO & 36000 & 52dB  & - & 6kHz & 340 & 0.1 & 700MHz \\ 
\hline 
\end{tabular}}
\caption{Comparison of the achievable secret key rates for QKD and the private rates for the wiretap channel presented in this work. The values are extrapolated from experimental data from the Micius satellite [4] for  $\eta^B_f=22dB$ (@1200 km) and $\eta_b = 20dB$ (except for the theoretical PLOB bound with $\eta_b=1$). The exclusion radii $r_E$ for $\gamma=0.1$ are calculated based on the Micius beam parameters. Note that for Micius and PLOB we consider nighttime operation, in contrast to the case of the wiretap channel where daytime operation is possible.} 
\end{table*}

We can now calculate the private capacity for different geometrical configuration, supposing that Alice and Bob have a satellite and a ground station equivalent to the Micius experiment. We consider OOK with a clock rate of 1GHz. With a time window of 1 ns, state of the art single photon detectors feature a $p_{dark} < 10^{-7}$, so detector noise has no significant effect on the secret capacity.  Table 1 in \cite{Er-lon2005} indicates the expected number of noise photons for different collection angles, filter bandwidths and temporal windows. Based on that an average number $\Delta$ of $10^{-4}$ and $10^{-7}$ is an achievable value for clear daytime sky, and a full moon clear night, respectively. During a cloudy day, one could expect a $\Delta$ of $10^{-2}$, and still positive private rates (this is under the assumption that transmission of the channel is affected in the same way for Bob and Eve). See Figure \ref{fig:PvsG} for the sensitivity to noise.  

Given the clock rate and the maximum private capacity from Fig. \ref{fig:Copt}, we obtain a private rate of $680Mb/s$ for a $\gamma=0.1$. This value is the same for any channel efficiency $\eta$ as long as the received power $\eta\mu $ is optimized. We can compare these rates with the key rates obtained by QKD in the Micius experiment and a potential perfect quantum communication scheme. Indeed, Pirandola et. al. showed recently \cite{PLOB2017} that there is an upper bound of the achievable secret key rate of a QKD protocol for a given channel transmission $\eta$
\begin{align}
R_{QKD,\infty}(\eta)= -\log_2(1 - \eta).
\end{align}




Table I presents all these rates for LEO, MEO and GEO satellites. As expected, the private capacity of a wiretap channel outperforms QKD dramatically in terms of rate and most importantly in terms of resistance against noise. 

Certainly, if the eavesdropper is restricted also the performance of QKD can be improved substantially. As a comparison, we estimate the theoretically achievable secret key rate for QKD following Appendix B in \cite{Shapiro2019}, choosing the parameters such that they are equivalent to our assumptions, notably $\Delta=10^{-4}$ and $\gamma=0.1$. We obtain a similar rate of 360 Mbits/s. However, keyless private communication is arguably easier to implement in practice, in particular it doesn't need two way communication for reconciliation.


There is also a scheme called Quantum Secure Direct Communication \cite{Qi2019}, which combines quantum communication and the possibility to detect the presence of an eavesdropper with encoding like for the wiretap channel. However, since this scheme is impractical, we don't consider it in this comparison. 

Finally, some practical remarks. The necessary lasers power in order to reach the optimal signal strength of about 4 photons in average is about 15 mW and 15$\mu$W for the GEO and the LEO setting, respectively, and therefore it is no limitation. However, due to the high signal strength, a GHz repetition rate implies high detection rates at Bob's, which are still a challenge for single photon detectors \cite{matthieu20}.


\section{Discussion and Conclusions} 

We have shown the feasibility, practicality and performance of unconditionally secure links for space and show the required exclusion radius. A protection area is needed for any kind of secure communication, including QKD. In this paper, we discussed a downlink, however, similarly, we could also consider an uplink and estimate the channel degradation $\gamma$ for reasonable assumptions on Eve's satellites. 
 
Our protocol is certainly susceptible of jamming attacks, but so are QKD protocols. However, while our protocol cannot protect the communication from jamming and active attacks, it can be used in coordination with security mechanisms in communication layers above the physical layer to provide the satellite system availability, integrity and confidentiality. 


Given these boundary conditions, we have demonstrated that physical layer encryption can provide information theoretically secure communication also in the presence of Eve only limited by the laws of quantum physics. As for the wiretap codes, explicit constructions are available that can provide the strong security. Well known constructions are based either on coset codes with random codeword choice within a coset \cite{Thangaraj2007}\cite{Klinc2011} or concatenation of encryption functions (e.g. hashing) with conventional capacity-achieving codes \cite{Tyagi2015}\cite{Hayashi2020} (e.g. low-density parity code (LDPC), polar code or Reed Muller codes). 


The achievable private rates are considerably higher than the QKD rates for an unrestricted Eve. Moreover, direct private communication is also possible close to illuminated cities and even during daytime in contrast to QKD. 
Moreover, given the low rates, the secret keys generated by QKD will in practice not be used in combination with the one-time-pad but with symmetric encryption systems like Advanced Encryption Standard (AES). This means that the legitimate users have to choose between trusting physical security including exclusion areas around Alice and Bob (which is arguably needed for QKD as well) or the computational security of encryption algorithms. 
 
Overall, physical layer encryption seems to be a reasonable choice for satellite communication.   



\begin{acknowledgments}
We would like to acknowledge Antonio Ac\'in, Andreas Winter, Masahito Hayashi, Christoph Wildfeuer and Mikael Afzelius for useful discussions. D.R. acknowledges the support of European Union’s Horizon 2020 program under the Marie Skłodowska-Curie project QCALL (No. GA 675662).
\end{acknowledgments}



