Resource requirements for efficient quantum communication using all-photonic graph states generated from a few matter qubits

Quantum communication technologies show great promise for applications ranging from the secure transmission of secret messages to distributed quantum computing. Due to fiber losses, long-distance quantum communication requires the use of quantum repeaters, for which there exist quantum memory-based schemes and all-photonic schemes. While all-photonic approaches based on graph states generated from linear optics avoid coherence time issues associated with memories, they outperform repeater-less protocols only at the expense of a prohibitively large overhead in resources. Here, we consider using matter qubits to produce the photonic graph states and analyze in detail the trade-off between resources and performance, as characterized by the achievable secret key rate per matter qubit. We show that fast two-qubit entangling gates between matter qubits and high photon collection and detection efficiencies are the main ingredients needed for the all-photonic protocol to outperform both repeater-less and memory-based schemes.

lem of photonic losses, which significantly reduces the range of quantum information transfer. Even though direct amplification of a quantum state is made impossible due to the no-cloning theorem [11,12], this exponential photon loss can still be overcome through the realization of quantum repeaters (QR) [13,14].
Several QR approaches have been proposed and can be divided into two main categories depending on the method used to propagate quantum information between two adjacent repeater nodes [15]. The first approach proposed, referred to here as a "memory-based" approach, relies on heralded-entanglement generation [16][17][18][19][20][21][22][23][24] between two quantum memories (QM) situated at adjacent repeater nodes. Examples of memory-based schemes are depicted schematically in Figs. 1(a),(b). The heralded entanglement generally succeeds when a detector situated at an intermediate node measures photons emitted by the QMs [25][26][27]. A classical signal carrying the outcome of an entanglement generation attempt must be sent back to the QMs, thus limiting the repetition rate of these protocols. When successful, entanglement swapping transfers the entanglement through these repeater nodes.
The second category of repeater [28][29][30][31][32][33][34] relies on logically-encoded multi-photon states [32,35], resistant both to photonic losses and errors, to transfer quantum information across a network. One particularly promising approach of this type was put forward in Ref. [31], which proposed an all-optical QR protocol based on repeater graph states (RGS). An example of an RGS with logical encoding is shown in Fig. 1(c), while the corresponding communication protocol is summarized in Fig. 1(d) and will be detailed later. Ref. [31] also proposed a method to construct these states probabilistically using single-photon sources, linear optics, and detectors [36]. However, this generation procedure requires about 10 6 singlephoton sources per repeater node to just barely outperform direct fiber transmission [37]. These findings suggest that the RGS protocol may be well beyond the reach of current and near-future technological capabilities. However, it remains unclear whether the RGS protocol can become more feasible if alternative methods to create the states are used. Ref. [38] proposed a deterministic generation procedure to produce a linear graph state using one quantum emitter; this procedure was later demonstrated experimentally [39]. Ref. [40] showed theoretically that emitters that undergo entangling gates can also be used to generate twodimensional cluster states. Refs. [41,42] built on this protocol and demonstrated that entanglement between emitters can be harnessed for the generation of more complex photonic graph states. These ideas have been extended further to general prescriptions and to protocols tailored to specific physical systems [43][44][45][46]. Ref. [41] introduced a protocol for producing an arbitrarysized RGS using only a few matter qubits, thus significantly decreasing the resource overhead required for RGS generation, making it deterministic in principle. Using this generation technique, the RGS protocol only necessitates a few-qubit processor at each repeater node, which would ease its practical implementation compared to other error-correction-based proposals that generally require several hundreds of qubits per repeater node [29,30] (with the notable exception of Ref. [47] which uses techniques introduced in Ref. [41] and requires deterministic spin-photon Bell measurements). Although the RGS protocol with deterministic state generation seems promising, a systematic and detailed evaluation of its performance and resource requirements has not been carried out.
In this paper, we compare the resourceefficiency-characterized by the achievable secret key rate per matter qubit-of this protocol to direct fiber transmission and to QR schemes based on memories and heralded entanglement generation. We first show that the rate per matter qubit has a fundamental upper bound in the case of memory-based QRs. We then review the RGS protocol and how RGSs can be generated using a few matter qubits. We evaluate the performance of this scheme, show that its rate per matter qubit does not have a theoretical upper-bound, and find the conditions under which it outperforms both the repeater-less and the memory-based QR approaches. These conditions depend sensitively on the speed with which two-qubit gates between the matter qubits can be executed and on the collection and detection efficiencies of the photons emitted by these matter qubits.

Upper bound on rate for memorybased repeater schemes
In this section, we show that there is a theoretical upper bound, R by N QR = L/L 0 − 1 repeater nodes. Quantum memories at adjacent repeater nodes are entangled via a heralded entanglement procedure (see Fig. 1(a)). When a repeater node shares entanglement connections with its two adjacent nodes, entanglement swapping is performed on the two memory qubits within that node to create a direct entanglement connection between memories on the adjacent nodes. This procedure can be repeated until Alice and Bob share an entangled qubit pair.
It is clear that creating an entangled pair between Alice and Bob requires generating an entanglement connection between each adjacent pair of repeaters. This means that the overall protocol rate R (QM ) is limited by the entanglement generation rate T ent −1 between two adjacent repeaters. Here, we use this fact to derive an upper bound on the rate per matter qubit for QR protocols that use quantum memories and heralded entanglement generation.
To determine an upper bound on T ent −1 , we focus for concreteness on the protocol presented in Fig. 1(a), which uses two quantum memories per node. A quantum memory should emit a photon that is maximally entangled with one of its degrees of freedom. Two photons generated at adjacent repeater nodes arrive at the same measurement node situated halfway between the two repeaters, where they are measured in a Bell state basis. Because a photon Bell state measurement using only linear optics succeeds with probability at best 1/2 (without ancillary qubits or QND measurements [48-53]), the overall success probability of the heralded entanglement generation is P ent ≤ 1/2. A classical signal must then inform the repeater nodes of the success or failure of the Bell state measurement. Because the distance from the measurement node to the repeater nodes is L 0 /2, this means that the overall heralded entanglement generation attempt takes total time T trial ≥ L 0 /c. This includes the time L 0 /(2c) for the single-photon transfer from the repeater to the measurement node and also the time L 0 /(2c) for the classical signaling in the opposite direction. Here, we are neglecting the time it takes to prepare and pump the quantum memories. Throughout this protocol, a QM can be maximally entangled with at most one other qubit (either a photon or another QM). Therefore, it cannot emit another spin-entangled pho-ton before receiving the classical signal carrying the information about the success or failure of the Bell measurement, hence limiting the repetition rate of the protocol. To generate an entanglement connection between the two adjacent nodes, the procedure must be repeated on average P −1 ent times. The entanglement generation rate is therefore T ent −1 = P ent /T trial < c/(2L 0 ). We derived this result for a specific heralded entanglement generation protocol but it also holds for all known protocols [25-27] (see Supplementary Materials).
From these results, we can show that the rate per matter qubit (where the number of matter qubits is N m = 2(N QR + 1) = 2L/L 0 ) has a theoretical upper bound, R (QM ) max : This theoretical upper bound also holds if there are more than two QMs at each repeater node (see Fig. 1(b)) as the rate would linearly increase with the number of matter qubits. Therefore, we have derived a general theoretical upper bound for memory-based protocols based on heralded entanglement generation. It is worth noting that the fundamental reason for this upper bound comes from the need for classical signaling in these protocols. Such classical signaling is not required for RGS protocols, enabling them to surpass this limit, as we show below. In the Supplementary Materials, we also show that a tighter bound, R (QM ) max = c/7L, can be obtained for memory-based schemes in which there are two quantum memories per repeater node, and heralded entanglement swapping is used.
2 Rate of the RGS protocol with deterministic graph state generation In this section, we review the RGS protocol as introduced in Ref. [31] and the deterministic generation of RGSs using a few matter qubits as proposed in Ref. [41]. We show how the rate of the RGS protocol depends on various parameters in the case where deterministic state generation methods are used.

RGS protocol and rate
An RGS is a quantum state |G that can conveniently be represented in the form of a graph G = (V, E) with V vertices and E edges. Each vertex corresponds to a photonic qubit prepared in the |+ state, and each edge corresponds to the application of a CZ gate between the two qubits it connects: An example of the graph representing an RGS is shown in Fig. 1(c). These states include 2m inner photonic qubits that are referred to as the first-leaf qubits. All the first-leaf qubits are fully connected to each other and each of them is also connected to one additional qubit, referred to as a second-leaf qubit. The first-leaf qubits are logically-encoded using tree graph states; further details on this are given below.
In an RGS protocol (see Fig. 1(d)), the distance L separating Alice and Bob is also divided into smaller steps L 0 by N QR = L/L 0 −1 source nodes where the RGSs are created. The RGS is divided into two equal parts, each containing m arms, and one part is sent to the left adjacent measurement node and the other to the right. Thus, half of one RGS meets half of another RGS at each measurement node, where each second-leaf qubit from one of the half-RGSs undergoes a Bell measurement with its counterpart from the other half-RGS. Further details about this entanglement swapping procedure at the measurement node are given later, but it is important to note that the RGS protocol does not use quantum memories at all and thus cannot store the information. This implies that an entanglement connection between Alice and Bob should be realized in only one trial with a probability P AB much higher than direct fiber transmission: P AB η t (L). The generation of an entanglement connection between Alice and Bob requires the realization of successful entanglement connections between all the adjacent RGSs. It is important to note that the measurements performed at each measurement node do not require information from other measurement nodes so that, in contrast to memory-based approaches, the RGS protocol does not require any classical signaling while entanglement is being extended through the network. Classical signaling is needed only once at the end of the protocol to Notation Definition L Total distance between Alice and Bob. L 0 Distance between adjacent nodes. N QR Number of repeater nodes. 2m Number of arms of the RGS. b Branching vector of an error-correction Transmission of a fiber of length l (η t (l) = exp(−l/L att )). Single-photon error rate.
with P RGS↔RGS the probability to generate an entanglement connection between two RGSs. The main notations used in this work are defined in Table 1.
A successful entanglement link can be generated if at least one of the Bell measurements at a measurement node succeeds. In that case, the two first-leaf qubits attached to the second-leaf qubits that underwent the successful Bell measurement are measured in the X basis, while the remaining 2m − 2 first-leaf qubits are measured in the Z basis. The X measurements transfer the entanglement connection to the next two adjacent measurement nodes, while the Z measurements disentangle all the excess qubits associated with failed Bell measurements. All these first-leaf qubit measurements must be successful in order to reliably create an entanglement link. Therefore, the probability to successfully create an entanglement link between two RGSs is given by: where P Bell = P ph 2 /2 is the probability of a successful Bell measurement. This depends on P ph = η c η d η t (L 0 /2), which is the probability that a single photon is emitted and collected into the fiber (η c ), is transmitted to the measurement node (η t (L 0 /2)) and detected (η d ). Pr(M X, ) and Pr(M Z, ) are the probabilities that the logical X and Z measurements on the firstleaf qubits succeed. Note that if the first-leaf qubits were not logically encoded, we would have , and it would be impossible to have an advantage over direct fiber transmission. Therefore, the losstolerance of logically-encoded qubits is crucial for this protocol. Next, we review this encoding, which was introduced in Refs. [35] and [31].

Loss-tolerance with tree graph states
We review how the probabilities Pr(M X, ) and Pr(M Z, ) depend on the single-photon transfer probability P ph and on the shape of the tree graph state used for the logical encoding. Ref. [35] demonstrated that this encoding remains losstolerant as long as P ph is above 50%.
We consider the calculation of the probabilities of successful measurements of the logically encoded qubits in the presence of loss errors on a tree graph state. A tree is characterized by its branching vector Fig. 1(c)), which describes the connectivity between the different levels of the tree. To perform a Z measurement M Z,k on a qubit at level k, it is possible to either perform a direct measurement on this qubit (with success probability P ph ) or, if it fails (with probability 1 − P ph ), perform an indirect measurement (with probability r k ). Thus, the overall success probability of a Z measurement at level k is: To perform an indirect measurement on a qubit (call it A) at level k, one can use the stabilizing property of a graph state [54]. It is possible to deduce the outcome of the Z measurement on A by performing an X measurement on another qubit (B) at level k + 1 and a Z measurement on all the qubits, C i , that are in the neighborhood of B at level k + 2 (see Fig. 2(a)). This works because of the invariance of graph states when they are acted upon by their stabilizers: so we have: A single indirect measurement has a success probability s k . Note, however, that the tree structure allows b k indirect measurement attempts, and only one needs to succeed to indirectly measure a qubit at level k. So the probability that at least one indirect measurement succeeds is with It is thus possible to derive the success probability of a measurement recursively, given that the qubits at the lowest level can only be measured directly: Pr(M Z,n ) = P ph . Logical measurements in the X or Z basis are given by [31]: It is interesting to note that logical encoding with tree graph states can also correct single-qubit errors, as shown in Ref. [31] and described in the Supplementary Materials. This will be used later when we evaluate the sensitivity of the RGS protocol to errors.

Generation of an RGS
The achievable rate between Alice and Bob also depends on the repetition rate of the protocol, which is given by the generation time of the RGS. Because it is impossible to realize deterministic two-qubit gates on photons with linear optics, such a graph state can either be generated probabilistically by the recursive fusion of smaller graphs using linear optics and Bell state measurements as shown in Ref. [31] and [37], or deterministically using a few matter qubits as shown in Ref. [41]. We now review the latter. An arbitrary-sized RGS can be generated deterministically by following a given sequence based on four operations on matter qubits: the emission of a photon maximally entangled with the matter qubit E ph , the Hadamard gate H, measurements in the Pauli bases M X , M Y , M Z and the CZ gate. The generation of an RGS with 2m arms and a tree graph encoding with branching vector b = (b 0 , b 1 , ..., b n ) requires n + 2 matter qubits Q 1 , ..., Q n+2 , and is given by the sequence (see also Fig. 2 and G n+3 = E ph,Q n+2 (11) The overall generation time of an RGS using this procedure is therefore T H and T CZ the times for photon emission, matter qubit measurement, Hadamard and CZ gates, respectively.
In the following, we make the realistic assumption that the CZ gate time T CZ is much longer than the durations of the other operations, and so we set T H = T M = T E ph = 0 for simplicity. With this assumption, the generation time T RGS only depends on the number of CZ gates and their duration: This is for an RGS with 2m arms and a logical tree encoding with branching vector b = (b 0 , ..., b n ). In the following, we will assume a depth-two tree graph state ( b = (b 0 , b 1 )), so that the full RGS can be generated with only three matter qubits (n = 1). The total number of matter qubits in the network is therefore

Performance comparisons
We now evaluate the performance of the RGS protocol when it is generated deterministically by a few matter qubits. We compare our results to the direct fiber transmission limit derived by Ref. [55] and to the memory-based upper bound R (QM ) max = c/4L found in Sec. 1.

Optimizing the RGS protocol
In the following, we show how the RGS protocol parameters can be optimized to maximize the overall rate per matter qubit, R presence of errors, the secret key rate per matter qubit. For the moment, we assume perfect photon collection and detection efficiencies (η c η d = 1) and no single-photon errors ( = 0); we take these effects into account later on. From Eqs. (3), (4), and (13), the achievable rate per matter qubit R (RGS) m of the RGS protocol for a total distance L is inversely proportional to the CZ gate time T CZ , but it depends non-linearly on the separation distance, L 0 , between two RGS nodes and the RGS shape (number of arms 2m and the tree branching vector b = (b 0 , b 1 )). Therefore, for each choice of the total distance L, there is a certain node separation and RGS shape that maximize the achievable rate.
The optimization of the rate per matter qubit for a total distance L = 50L att (≈ 1000 km) is shown in Fig. 3. The position of each point corresponds to a specific RGS shape, the color of the point indicates the node separation L 0 that optimizes the rate for that shape, and the size of the point represents the maximal rate per matter qubit for these parameters. This optimization  converges, allowing us to extract the optimal RGS shape and distance L 0 for this particular choice of the total distance L. The optimization can be repeated for various choices of L, and the extracted optimal parameters are recorded in Table 2.
We compare the RGS protocol to direct fiber transmission in Fig. 4(a). The maximum achievable rate per matter qubit for the RGS protocol, R (RGS) max , is shown as a function of the total distance L/L att . In the case of direct transmission, we show seven different curves corresponding to the achievable rate for seven different values of the single-photon source repetition rate. We see that the RGS protocol outperforms direct transmission with the highest repetition rate for L 30L att . In the same figure, we also show how well the protocol works if we keep the optimized parameters fixed and change the total distance L. To demonstrate this, we fix the RGS parameters and node separation L 0 to the values that optimize the rate for a total distance L tar . We then adjust L away from L tar without changing the RGS parameters or L 0 , and we calculate the new rate for each value of L. In Fig. 4(a), we show the resulting rates as a function of L/L 0 for five different choices of L tar . We see that the RGS protocol continues to work well over a broad range of total distance L when we use parameters that are optimized for a large total distance L tar .
For long distances L in the range 50L att − 200L att , R (RGS) max scales approximately as L −1.27 , and thus the scaling with distance is slightly worse than the upper bound scaling for memorybased schemes, R (QM ) max ∼ L −1 , obtained in Sec. 1. However, contrary to the memory-based schemes, there are no fundamental upper limits on the maximal achievable rate R Figure 4: (a) The maximum achievable secret key rate per matter qubit as a function of the total distance L for the RGS protocol with depth-2 logical tree encoding compared to direct fiber transmission. The dashed red line is the rate for the RGS protocol, with all RGS parameters and L 0 optimized for each value of L. The seven red curves correspond to rates for direct fiber transmission [55] for seven different choices of the single-photon source repetition rate: 10 i T CZ −1 (for i=0,...,6). The solid yellow, green, and blue curves show the performance of the RGS protocol when L is changed while keeping all RGS parameters and L 0 fixed to the optimal values obtained for total distance L tar . (b) Relative difference between the maximum achievable rates of the RGS protocol, R proportional to the CZ gate time, T CZ . If T CZ is sufficiently small, then the RGS protocol should surpass the upper bound of memory-based schemes. This is illustrated in Fig. 4(b), where the red region of the plot indicates the regime where the RGS protocol outperforms memorybased schemes. For distances below 200L att ≈ 4000 km, a gate time T CZ below 6 × 10 −4 t att ≈ 60 ns is sufficiently short to outperform any memory-based scheme. For this range of total distance, the optimal value of the node separation L 0 ranges from 0.15 − 0.19L att ≈ 3 − 3.8 km.

Sensitivity to errors
So far, we have considered the generation of a perfect RGS, which is a pure entangled state of many photons. Generating such a perfect state is not feasible experimentally, and so we need to evaluate the sensitivity of the RGS protocol to errors. To do so, we now consider single-photon loss and single-photon errors in our optimization process.
The single-photon loss (other than the fiber losses) depends on the probability that an emit-ted photon is neither collected into the fiber nor detected; this corresponds to the case where η c η d = 1. Fig. 4(c) shows the optimized rate per matter qubit for different values of η c η d . Similarly, Fig. 4(d) compares the performance of the RGS protocol with the upper bound for memorybased protocols, R (QM ) max , as a function of T CZ and η c η d for a total distance L = 50L att . These results show that the photon losses must be below 15% (η c η d > 85%) in order for the RGS protocol to outperform both the direct fiber transmission and memory-based protocols. This rather stringent requirement is mainly due to the losstolerance of the tree graph state, which only works when the total photon loss (including fiber losses) is below 50%.
Apart from the photon losses, the RGS protocol also depends on other kinds of errors that reduce the fidelity F AB of the final entangled photon pair shared by Alice and Bob. These errors include, but are not limited to, single-photon measurement errors, photon Bell-measurement errors, and depolarization errors. In the present case where the RGS is generated using matter qubits, the limited coherence time of the matter qubits should also limit the fidelity of the entangled photons. For QKD applications, the final secret key rate depends on the total rate R and the fidelity F AB [56,57]: where h is the binary entropy function: In the remainder of this paper, we now use R (RGS) m to refer to the secret key rate per matter qubit, which coincides with the rate per matter qubit in the absence of errors. We model these imperfections by using a single-qubit error probability that affects all the photonic qubits. This model works well for qubit measurement errors as well as depolarization errors. In Ref. [38], it was also shown that decoherence errors on quantum emitters induce only local errors in the emitted cluster state. The detailed derivation of F AB is given in the Supplementary Materials. Fig. 4(e) compares the optimized secret key rate of the RGS protocol against that of direct fiber transmission as a function of the single-qubit error probability and the total distance L. Fig. 4(f) compares the performance of the RGS protocol to the upper bound for memory-based protocols for L = 50L att . We find that the single-qubit error should be below < 10 −4 to outperform both the direct fiber transmission and the memory-based protocol upper bound, R (QM ) max . One might expect a better tolerance to singlequbit errors since they are also corrected by the logical encoding of the 1 st -leaf qubits. This is not the case because the 2 nd -leaf qubits are not logically encoded and thus are very sensitive to errors. The dependence on single-qubit errors is actually similar to the protocols using heralded entanglement generation. It is also possible to use entanglement purification [58][59][60] to improve the fidelity F AB and maximize the secret key rate.
From the maximum single-qubit error rate, we can derive an order-of-magnitude estimate for the coherence time requirements for the matter qubits. To do so, we use two strong assumptions. We first assume that the fidelity F RGS of an RGS depends on the ratio between the generation time T RGS of the RGS and the coherence time T 2 of the matter qubits:  Table 3: State-of-the-art characteristics of candidate quantum emitters. T CZ is the duration of a CZ gate, T 2 is the coherence time, and β is the single-mode photon emission probability. Blue (red) color means that the condition is (not) fulfilled with this system, while orange means that it is theoretically possible but has not been realized experimentally.

Matter qubit
The coefficient 3 corresponds to the number of matter qubits that degrade the RGS fidelity. We also assume that the errors are homogeneously distributed over the N ph photons of an RGS, such that F RGS = (1− ) N ph . With these assumptions, the coherence time should satisfy T 2 ≥ 2500T CZ .

Discussion
In the previous section, we derived a set of requirements that need to be fulfilled in order for the RGS protocol to have a clear advantage over both memory-based QRs and repeater-less protocols: It is important to note that these bounds were obtained using RGSs with a depth-2 logical tree encoding. We may expect an increase in the rate per matter qubit if deeper trees were used but the improvement would certainly not be large as T RGS grows quickly with tree depth. Checking this directly is challenging because the process of optimizing the RGS protocol becomes significantly more complex. We leave this intensive numerical analysis to future work. Table 3 shows the current state-of-the-art for three candidate systems that can be used to generate RGSs. So far, the characteristics of the current systems are not good enough yet to exceed the memory-based resource-efficient upper bound R (QM ) max . The main limitation comes from long two-qubit gate times, since fast gates are critical for the performance of the RGS protocol. Currently, most of the two-qubit gates that have been experimentally demonstrated are slow because they rely on local interactions, such as the hyperfine coupling, which are generally weak. Efficient light-matter interfaces using cavities can also be used to realize deterministic, photonmediated CZ gates between two matter qubits. The crucial advantage of this technique is that it only requires optical interactions, which are intrinsically much faster than hyperfine interactions. Progress in the experimental realization of strong spin-dependent phase shifts has been made recently [23, [71][72][73]. The second condition (ii) will also be easier to achieve if the CZ gate time is reduced.
The third condition (iii) requires the efficient collection of single photons emitted by a single quantum emitter. The collection of single photons needs to be facilitated by increasing the emission of photons into a single optical mode. This is generally realized using waveguides or cavities with single-mode emission probabilities β that can reach 99.7% [64]. This single mode should then be efficiently coupled to a singlemode fiber. Finally, superconducting photon detectors can be used to achieve high detection efficiencies [74].
In conclusion, we have identified the main requirements that must be met in order for allphotonic repeater protocols based on deterministically generated graph states to outperform memory-based protocols. We did this by finding the graph state structures that maximize the secret key rate and by comparing this to an upper bound on the rate for memory-based schemes that we derived. We found that two-qubit gate times and the efficient collection and detection of emitted photons are the most important factors in determining whether the all-photonic approach is superior to memory-based ones. An interesting future direction would be to improve the protocol for the emitter-based generation of photonic graph states by incorporating atom-photon CZ gates [43,75], which would both simplify the procedure and decrease gate times, and thus enhance the performance of deterministic, all-photonic re-peaters.

Bounds for memory-based repeater protocols
As discussed in the main text, the rate of a memory-based quantum repeater based on heralded entanglement generation is limited by the rate T QM −1 at which a given memory qubit can be reused. T QM is given by the sum of the average time required for generating entanglement T ent and the time during which the entanglement is stored T store . T ent is given by T trial /P ent , where T trial is the time required for a heralded entanglement generation attempt, and P ent is the probability that an attempt is successful. Let's consider three heralded entanglement procedures [25-27]: • In Ref.
[25], T trial = L 0 /c, and the probability is P ent ∝ e −L 0 /(2Latt) . However, the protocol needs to be implemented in a regime where the probability to emit a photon is very small to avoid two-photon emission, which degrades the entanglement fidelity. Consequently, P ent 1/2.
Thus in all these cases, if we consider small values of L 0 L att , we have: This limitation can be understood from the fact that the photonic qubit and the classical signal need to travel back and forth either to a measurement node (twice the distance L 0 /2) or to the next QR (twice the distance L 0 ). If the photon travels to a quantum repeater, it is possible to deterministically entangle the QM and the photon, so the entanglement probability is only bounded by the photonic losses. If the photon travels to an intermediate node, the entanglement generation procedure uses linear optics and has a success probability that cannot reach more than 1/2 (unless ancillary photonic qubits are used, but this requires another quantum emitter to produce them [51-53]). From this limitation, we find the upper bound R (QM ) max ≥ max(R/N m ) in the case of QR protocols with two QMs. In this case, the rate R is limited by T QM −1 ≤ T ent −1 = c/(2L 0 ). The number of matter qubits is given by twice the number of repeaters plus Alice and Bob's matter qubits, thus N m = 2(N QR + 1) = 2L/L 0 , therefore: In the case of multiplexed repeaters, by multiplying the number of memories per repeater by N , the entangling rate between two repeaters is bounded by N c/(2L 0 ), but the number of matter qubits is now N m = 2N L/L 0 , so that the total rate is still bounded by R In the case of memory-based schemes using heralded entanglement and 2 QMs per QR, it is possible to find a stricter upper bound. To derive this bound, consider two repeater nodes labeled 1 and 2. Node 1 contains two memory qubits QM1 and QM1 , while node 2 contains QM2 and QM2 . Suppose that we succeed in entangling QM1 and QM2 via a Bell measurement at an intermediate measurement node. How long do we have to maintain this entanglement before further entanglement swappings at neighboring nodes free up QM1 and QM2, allowing them to be re-used for creating the next Bell pair to be shared between Alice and Bob? The answer to this question is what we called T store above, the average amount of time we have to store the entanglement. The upper bound on the rate is then T QM −1 , where T QM = T ent + T store . We obtained a bound for T ent above and used this to derive the bound on the rate given in Eq. (18). There, we neglected the role of T store . Here, we reinstate this quantity to obtain a stricter bound.
To determine T store , we first note that the entanglement between QM1 and QM2 needs to be maintained until QM1 and QM2 become entangled with memory qubits on other nodes. Once this happens, the entanglement can then be swapped, leaving QM1 and QM2 completely disentangled and ready for re-use. Of course, QM1 and QM2 could already be entangled with other nodes by the time QM1 and QM2 become entangled. Thus, there are four equally probable cases to consider: • If QM1 and QM2 are already connected to other nodes, we immediately swap the entanglement and thus do not wait any longer. In this case T case1 store = 0.
• If one QM (either QM1 or QM2 ) is already connected to other nodes, we need to wait an average time of T ent for the second QM to become entangled as well. In this case, T case2 store = T case3 store = T ent .
• If neither QM1 or QM2 are connected, we need to wait for both to become connected. In this case, T case4 store = 3−2Pent 2−Pent × T ent .
The expression for T case4 store above requires some explanation. It comes from the fact that both QM1 and QM2 become successfully entangled with other nodes after n attempts with probability The average storage time in this case then depends on the average number of attempts needed before entanglement is successfully created and on the time T trial each attempt takes: This implies that the overall average storage time is The upper bound on the rate per matter qubit is therefore where we set T ent → 2L 0 /c and N m = 2L/L 0 as appropriate for the memory-based scheme. If we set P ent → 1 [76], this becomes Classical signaling does not limit the repetition rate of the RGS protocol In this section, we show that classical signaling does not limit the repetition rate of the RGS protocol. This is important to consider because some of the X and Z measurements that are performed on the RGS will, depending on the measurement outcomes, leave the remaining photons in a state that is only locally equivalent to a graph state. In this case, additional single-qubit gates must be applied to bring the state to a proper graph state before the next measurements are performed. Otherwise, the bases for these subsequent measurements will be effectively rotated, and the measurements will not modify the state in the intended way. In the following, we show that the extra single-qubit gates only need to be applied on qubits located at the same measurement node where the measurements on which they depend occur. Thus, classical communication between nodes is not needed. The only exception to this occurs at the very end of the protocol, when we are left with a linear cluster state in which the two end qubits are those of Alice and Bob. The final step is to turn this state into a Bell pair shared by Alice and Bob by performing X measurements on the inner qubits of the linear cluster state. Afterward, Alice and Bob's qubits form a Bell pair whose Pauli frame depends on the X measurement outcomes. This information therefore needs to be transferred to them using classical signaling. However, the protocol can be repeated before this classical signal is received and thus, the classical signaling does not limit the repetition rate. The latter is only limited by the generation time of RGSs.
Recursive construction of a repeater graph state.
We denote the RGS with k arms by |RGS k . For the purposes of this argument, we allow k to be either odd or even. We want to define this quantum state recursively. As illustrated in Fig. 5(a), we can make this state by starting with an RGS with k − 1 arms and then adding one new 1 st -leaf qubit and one new 2 nd -leaf qubit by applying CZ gates between these two new qubits and between the new 1 st -leaf qubit and all the existing 1 st -leaf qubits in |RGS k−1 . In other words, we can start from a 2-qubit cluster state and |RGS k−1 in a product state: Here, k 1 and k 2 denote the 1 st -leaf qubit and the 2 nd -leaf qubit from the k th arm. We ignore the normalization factors troughout this section. The remaining step is to apply CZ gates between k 1 and all the 1 st -leaf qubits in |RGS k−1 , which yields where we have introduced the notation Here, Z i j is the Pauli Z operator applied to the j th -leaf qubit of the i th arm of the RGS. Note that if the RGS has a logical tree encoding, then instead of attaching a 2-qubit cluster state to |RGS k−1 , we need to attach a star graph with b 0 arms (in the case of a depth-two tree), where b 0 is the first branching parameter of the tree. To create |RGS k , each arm of the star graph needs to connect to every 1 st -leaf qubit of |RGS k−1 ; this requires a total of b 0 (k − 1) CZ gates. The resulting RGS can still be decomposed as in Eq. (24), but we need to replace |0 k 1 by a sum over all the even-parity bit strings on b 0 qubits, and |1 k 1 needs to be replaced by all the odd-parity bit strings on b 0 qubits. In what follows, we will continue to use Eq. (24) with the understanding that the k 1 qubit states need to be replaced in this manner if a logical tree encoding is included. This does not otherwise alter the analysis below.

Bell state measurement
Let's now consider the effect of a Bell measurement on 2 nd -leaf qubits from two different RGSs. We suppose that one of these qubits resides in arm k of one RGS, and the other in arm k of the other RGS.
To analyze this measurement, we expand the two-RGS product state using the recursive definition of an RGS shown above:

(26)
We want to perform a Bell state measurement on qubits k 2 and k 2 . After the Bell measurement, we want to obtain the state: which corresponds to the state represented in Fig. 5(b) where an edge replaces a pair of 2 nd -leaf qubits shared by two RGSs.
The Bell state measurements are realized in the basis: These are not the standard Bell states but are related to them by a Hadamard gate on the second qubit. By applying such a Hadamard gate, a standard Bell state analyzer can be used. Using this basis for the 2 nd -leaf qubits k 2 and k 2 , we can rewrite the state before the Bell measurement as (29) Suppose that we can resolve only the two states |ψ ± with a linear optics Bell state analyzer. Depending on the measurement outcomes, the state becomes: Thus, we find that if the outcome is ψ + (respectively |ψ − ) we need to apply a Z rotation on qubit k 1 (on qubits k 1 and k 1 ) to recover the desired state. Note that this qubit is at the measurement node where we perform the Bell measurement.

Z measurements
If the measurement fails or if one Bell measurement has already succeeded, we need to perform Z measurements on 1 st -leaf qubits to disconnect them and their associated 2 nd -leaf qubits from the graph. Depending on the outcomes of these measurements, the resulting state is one of four possible states: Note that if a Bell measurement has already succeeded, then each of the above outcomes needs to be acted upon by a CZ gate on the two 1 st -leaf qubits associated with the successful measurement. We leave this possible CZ gate implicit in the following. Ideally, we want to recover |RGS k−1 ⊗ RGS k−1 .
Therefore, we need to be able to convert a state RGS k−1 into |RGS k−1 by performing measurements only on qubits present in the measurement node. Let's consider any other arm l of the RGS that is present at the same measurement node and rewrite the state as By applying Z gates on all the 1 st -leaf qubits, we also have: A comparison of these two results leads to the identity: By applying local rotations of qubits situated at the same measurement node, it is therefore possible to recover the desired state. The last two Z measurements on the two qubits denoted k 1 and k 1 requires special care as the only two other qubits, l 1 and l 1 , positioned at this measurement node, are the one which connect the two RGSs (if a Bell measurement has succeeded) and should undergo an X measurement. In that case, it is still possible to use l 1 and l 1 to recover the desired graph state by performing single-qubit rotations that depends on the measurement outcomes of k 1 and k 1 : where I i denotes the identity on qubit i.

X measurements and classical signaling
If at least one Bell measurement succeeds at each measurement node and if all the required Z measurements succeed, we are left with a linear cluster state with two 1 st -leaf qubits at each measurement node (see Fig. 5(c)). The next step is to perform X measurements on these qubits. Performing X measurements on two connected qubits of a graph state has the effect of connecting each qubit in the neighborhood of the first qubit to all the qubits in the neighborhood of the second one [35]. Therefore, after the X measurements of all the qubits at each measurement node, the two remaining qubits shared by Alice and Bob are in a maximally entangled state. More precisely, this state is equivalent to a Bell pair up to local qubit rotations. It is important to note that all the X measurements can be performed independently of each other. Although the state can deviate from a proper graph state depending on the measurement outcomes, it is straightforward to show that the state only differs by at most local Z gates. This can effectively convert some of the X measurements to Y measurements, but both types of measurements have a similar effect on the state, and a Bell pair is still obtained once all the measurements are completed. However, the precise state depends on all the measurement outcomes of each X measurement. This information needs to be sent via a classical channel to Alice and Bob to recover the desired state. This classical signal does not limit the repetition rate of the protocol, which can either be used for quantum teleportation of quantum states or for QKD. Indeed, for quantum teleportation, two quantum memories situated at Alice's and Bob's nodes can be used to store the Bell pair while waiting for the classical signal to arrive. In that case, the protocol can still be repeated at a high rate as long as there are enough quantum memories at Alice's and Bob's nodes to store the states that are already transferred. It is still the case that the protocol does not require quantum memories at the nodes inside the network, which is a clear resource improvement compared to the memory-based approach. For QKD, Alice's and Bob's qubits can be measured in a random basis upon arrival at their nodes, and they don't need to be stored in quantum memories until the classical signaling is received. The classical signaling is still required to recover the Pauli frame of the measured qubits and to check if Alice's and Bob's qubits were measured in compatible basis for QKD.

Error correction using tree graph states
In the main text, we have shown that logical encoding with tree graph states allows measuring a qubit with a probability Pr(M Z, ) or Pr(M X, ) that is higher than the single-photon measurement probability P ph . We now show that the logical encoding based on tree graphs also increases the tolerance of the RGS protocol to single-qubit errors. Indeed, if m k indirect measurements are performed on a qubit at level k in the tree, it is possible to use a majority vote of the measurements to reduce the effect of errors. Suppose that all b k of the possible indirect measurements are performed, where b k is the k th branching parameter of the tree. The probability that exactly m k of these measurements succeed (perhaps with errors) is where s k is the probability that a single indirect measurement succeeds. The average error after b k indirect measurement attempts at level k is: where e I k |m k is the average error in the case of m k successful measurements, and r k is the probability that at least one indirect measurement succeeds. For m k indirect measurements, an error still occurs in the majority vote if more than half of the indirect measurements (m k /2) are faulty. Thus, if m k is odd: where e I k |1 is the average error of a single indirect measurement. If m k is even, we have: The sum goes only up to m k −1 because we can randomly remove one result to return to the odd-number case and re-use the above formula for the probability.
The single indirect Z measurement error e I k |1 of a qubit A at level k depends on the error of the X measurement of qubit B at level k + 1 (which we take to be a constant error probability ) and on the errors of the b k+1 measurements on the qubits at level k + 2, denoted C i in Fig. 2(a). These can either be direct (with error ) or indirect (with error e I k+2 ). Let n k be the number of qubits that are only measured directly (with error ) while b k+1 − n k qubits are measured indirectly (with error e I k+2 ). e I k |1 is thus given by: where e n k is the error in the case of n k direct qubit measurements, and Pr(I Z,k |M Z,k ) = Pr(I Z,k )Pr(M Z,k |I Z,k ) Pr(M Z,k ) = r k Pr(M Z,k ) .
Here, I Z,k denotes a successful indirect Z measurement of a photon at level k and thus Pr(I Z,k ) is what is called r k in the main text. Therefore, Pr(I Z,k |M Z,k ) is the probability that a photon at level k was successfully measured indirectly (I Z,k ) given that it has been successfully measured (M Z,k ). Note that a photon can be both successfully directly and indirectly measured. In that case, we keep the indirect measurement outcome which should have a smaller error e I k compared to the intrinsic single qubit error , thanks to the error correction. The only remaining quantity to determine is the error e n k . The X measurement on qubit B and the n k direct Z measurements on the qubits C i are performed with error , while the remaining b k+1 − n k indirect Z measurements are performed with error e I k+2 . Note that the indirect measurement outcome is given by the net parity of all the X and Z measurement outcomes. Thus, the indirect measurement can still yield the correct outcome even if there are errors in the X and Z measurements, provided there are an even number of errors so that the parity remains unchanged. Only an odd number of errors causes the indirect measurement to fail. Thus: In this equation, we take into account the fact that only odd numbers of measurement errors contribute to e n k by restricting the second sum to only values of i + j = 1 [2]. This is different than what was obtained in Ref. [31], perhaps due to additional approximations in that reference.
As shown in Fig. 6(a), the logical Z measurement M Z, succeeds if all the 1 st -level qubits are measured directly or indirectly in the Z basis. The logical X measurement M X, succeeds if any of the 1 st level qubits is measured in the X basis and all its corresponding 2 nd level qubits are successfully measured in the Z basis either directly or indirectly, as shown in Ref. [31]. To understand this, let's denote by L the logical qubit that is connected to a set A = {A 1 , A 2 , ...} of other qubits, represented by the green area in Fig. 6(b). Because X L Z A = X L ⊗ i Z A i is a stabilizer of the RGS at the logical level, the logical X measurement of qubit L, M X, , has the same outcome as Z A , i.e. the parity of the product of all Z measurements on the qubits in A. At the physical level, the logical qubit is encoded with a tree graph state where we consider a first-level qubit B and its set of neighbor qubits in the tree C(B). X B Z C(B) Z A is a stabilizer of the RGS at the physical level and thus X B Z C(B) (represented by either of the light blue areas in Fig. 6(b)) has the same parity as Z A and therefore constitutes an X measurement of the logical qubit L. The parity of the Z measurements on the qubits in the green area is the same as the logical M X, measurement on the logical qubit (purple) and is the same as the parity measurement on the two light blue areas (where measurement bases are indicated next to each qubit).
The logical X and Z errors are thus given by: The derivation ofē Z follows the same idea as e I k |1 (for "k = −1") except that no X measurements are needed here.

Fidelity of the full protocol
We have used the results already derived in the supplementary materials of Ref. [31] to calculate the global fidelity of the generated entangled pair of photons shared by Alice and Bob. The total fidelity F AB is given by with