## 4 Security Analysis and Numerical Simulation
### Finite-Size Analysis  
The above asymptotic security analysis is based on the assumption that the number of exchanged signals between Alice and Bob approaches infinity. However, this is not the case in reality: some signals between them are needed for parameter estimation to ensure the accuracy of CV-QKD. Here, we consider a more realistic security analysis, namely the finite-size analysis, where the number of exchanged signals is confined to a finite value [34; 37]. Different from the fact that the modulated variance \(V_{A}\) can be optimized to improve the performance of the protocol, the values of transmittance \(T_{sea}\) and excess noise \(\varepsilon\) need to be estimated. In this part, we mainly analyze the finite-size effects on the parameter estimation procedure and the calculation of the secret key rate, which are based on the assumption that Gaussian collective attacks are optimal. The secret key rate of the discrete-modulated underwater CV-QKD protocol against collective attack in the finite-size case can be written as [38; 39; 40; 41]  
\[K^{f}=\frac{n}{N}(\beta\;I(A:B)-S_{N}^{\epsilon_{\text{PE}}}(E:B)-\Delta(n)), \tag{15}\]  
where \(\frac{n}{N}\) is the ratio of the number of photons used to establish the secret key to the total exchanged signals between [PERSON] and [PERSON]. \(\beta\) is the reconciliation efficiency and \(I(A:B)\) is the mutual information of [PERSON] and [PERSON]. \(S_{N}^{\epsilon_{\text{PE}}}(E:B)\) is the maximum of the Holevo information compatible with the statistics except with probability \(\epsilon_{PE}\) and \(\epsilon_{PE}\) is the failure probability of the parameter estimation process. \(\Delta(n)\) is a function corresponding to the privacy amplification, which can be approximately expressed by  
Figure 10: (Color online.) The compressed variation trend of \(V_{A}\) optimal interval of the eight-state protocol as the transmission distance extends. \(\beta=0.9,\varepsilon=0.005,\eta=0.6,v_{el}=0.01\). \[\Delta(n)=7\sqrt{\frac{log_{2}(2/\widetilde{\epsilon})}{n}}+\frac{2}{n}log_{2}(1/ \epsilon_{PA}), \tag{16}\]  
where \(\widetilde{\epsilon}\) is the smoothing parameter with an optimal value of \(10^{-10}\) in the private amplification processes, and \(\epsilon_{PA}\) is the failure probability of privacy amplification. Comparing Equation (15) with Equation (8), we can find that the coefficient \(\frac{n}{N}\) is added, which is mainly because only \(n\) of the \(N\) total exchanged data are used to generate the key. Considering the effect of finite-size on parameter estimation accuracy, the estimation of the conditional entropy in Equation (15) needs to take the failure probability of the channel parameter estimation into account. Thus, the conditional entropy \(S_{N}(E:B)\) in Equation (8) is replaced by \(S_{N}^{\epsilon_{PE}}(E:B)\). In addition, in the post-processing stage of data, the failure probability of privacy amplification should also be considered, so the function \(\Delta(n)\) related to the privacy amplification is also added in the Equation (18). As can be seen from the above analysis, the sampling estimation may fluctuate in the parameter evaluation process, which will make the evaluation of the secret key rate inaccurate. To ensure the security of the protocol, it is necessary to do the worst estimation to the parameters to minimize the secret key rate. In other words, we need to calculate the maximum value of the Holevo information \(S_{N}^{\epsilon_{PE}}(E:B)\) between Eve and Bob in the case of statistical fluctuation in the parameter estimation. In a practical discrete-modulated underwater CV-QKD system, [PERSON] and [PERSON] select \(m=N-n\) data samples to evaluate the variables \(T_{sea}\) and \(\epsilon\), which satisfy the following model  
\[y=tx+z, \tag{17}\]  
where \(t=\sqrt{T_{sea}}\) and \(z\) satisfies a centered Gaussian distribution with variance \(\sigma^{2}=T_{sea}\epsilon+1\).