## 2 Security of CV QKD  
We address satellite-based implementation of Gaussian CV QKD protocols [18] using coherent or squeezed states of light as shown in Figure 1a. We describe the quantum states of light in a given mode of electromagnetic radiation using two complementary observables, namely quadratures, being analogues of position and momentum operators of a single particle, and expressed through mode's quantum operators as \(\hat{x}=\hat{a}^{\dagger}+\hat{a}\) and \(\hat{p}=i[\hat{a}^{\dagger}-\hat{a}]\). The sender [PERSON] prepares coherent or squeezed states using respectively a laser source or an optical parametric oscillator [19] and modulates the states by applying quadrature displacements, governed by independent zero-centered Gaussian distributions, by using quadrature modulators. This way [PERSON] prepares the states described by the quadratures \(\hat{x}_{A}=\hat{x}_{S}+\hat{x}_{M}\) and \(\hat{p}_{A}=\hat{p}_{S}+\hat{p}_{M}\), where \(\hat{x}_{S}\) and \(\hat{p}_{S}\) with variances \(Var(\hat{x}_{S})=V_{S}\) and \(Var(\hat{p}_{S})=1/V_{S}\) (we define variance of an operator \(\hat{r}\) with zero mean value as \(Var(\hat{r})=\langle\hat{r}^{2}\rangle\)) are the quadrature values of the signal (so that either \(V_{S}=1\) for coherent states or with no loss of generality we assume \(x-\)quadrature squeezed states with \(V_{S}<1\)). \(\hat{x}_{M}\) and \(\hat{p}_{M}\) with \(Var(\hat{x}_{M})=Var(\hat{p}_{M})=V_{M}\) are the displacements known to [PERSON], which constitute her classical data contributing to the final secret key. The signal then travels through a generally noisy and lossy quantum channel, which can be optimally [20; 21] represented as a Gaussian channel resulting in the output state described by the quadratures \(\hat{x}_{B}=\sqrt{\eta}\hat{x}_{A}+\sqrt{1-\eta}\hat{x}_{0}+\hat{x}_{N}\), where \(\eta\) is the channel transmittance, \(\hat{x}_{0}\) with \(Var(\hat{x}_{0})=1\) is the variance of the vacuum noise concerned with the channel attenuation, and \(\hat{x}_{N}\) is the contribution from the excess noise on the channel output with \(Var(\hat{x}_{N})=\epsilon\), similarly for \(p-\)quadrature with the same \(\eta\) and \(\epsilon\), as the free-space channel is typically phase-insensitive. Trusted parties use a beacon laser for signal acquiring, tracing and pointing, as well as for timing synchronization [22]. The receiving side Bob is performing homodyne detection on the incoming mode by measuring \(\hat{x}_{B}\) or \(\hat{p}_{B}\) (bases have to be randomly switched between in order to fully characterize channel loss and excess noise). Preferably such measurement is made using locally generated local oscillator [23; 24], that despite additional noise contribution from signal wavefront aberration [25] and phase noise due to relative phase drift [26; 27; 28], allows for one to avoid phase reference pulse attenuation in a strongly lossy satellite link and provides enhanced security of the protocol by ruling out the attacks on the local oscillator. After accumulating a certain amount of data points \(N\) from state preparation and measurement, parties use \(N-n\) of these to estimate the channel parameters \(\eta\) and \(\epsilon\), from which the security of the protocol can be assessed as described below. The remaining \(n\) points are processed using error correction and privacy amplification algorithms [4] in order to obtain the resulting provably secure key which can then be used for classical encryption. The ratio \(n/N\) can be optimized [29], here for simplicity we assume it to be \(1/2\) (which is close to optimal except for the low repetition rates) and resulting estimates to be perfectly accurate i.e., with infinitesimal confidence intervals (or already being pessimistic lower bounds complying with a given probability of failure of the channel estimation procedure).