# Signature Split Method for a PQC-DSA Compliant with V2V Communication Standards
## 2 Preliminaries
### Crystals-Dilithium  
Crystals-Dilithium [8] employs Fiat-Shamir with an abort method and borrows from nodule-LWE; as a result, it provides a higher level of security than do other ring-LWE-based ciphers. Furthermore, for all security levels, Crystals-Dilithium employs the same ring and modulus. This has an advantage in terms of implementation over other competitors. The polynomial ring used by Dilithium is \(\mathbb{Z}_{q}[X]/(X^{256}+1\), where \(q\) is \(2^{23}-2^{13}+1\), and the parameters are maintained by simply changing the dimension of the public matrix \(\mathbf{A}\) according to the security level. Therefore, the core process of Crystals-Dilithium is the operation to generate the open matrix \(\mathbf{A}\) and polynomial multiplication to generate the LWE-based problem. Similar to the general digital-signature algorithm, the structure of Crystals-Dilithium consists of keygen, sign, and verify processes. Keygen process computes \(\mathbf{b}=\mathbf{A}\mathbf{s}+\mathbf{e}\) via the public matrix \(\mathbf{A}\), secret vector \(\mathbf{s}\), and noise \(\mathbf{e}\), where \(\mathbf{b}\) and \(\mathbf{A}\) are public information and \(\mathbf{s}\) and \(\mathbf{e}\) are secret information. Sign process (Algorithm 1) produces \(\mathbf{w}=\mathbf{A}\mathbf{y}\) via the masking vector \(\mathbf{y}\) and produces \(\mathbf{z}=\mathbf{y}+c\mathbf{s_{1}}\) via the digest \(c\) hashed \(w\) and the message \(M\). A masking vector for polynomial \(\mathbf{y}\) is generated during the signing process, and \(\mathbf{A}\mathbf{y}\) is calculated. In this case, a challenge is generated by hashing the message with \(\mathbf{w_{1}}\), which is the \(\mathbf{A}\mathbf{y}\)'s high-order bit. In the verify process, MakeHint\({}_{q}\) and UseHint\({}_{q}\) are in charge of reconstructing the bits. The public key can be reduced by about 2.5 times using this method at the cost of a slight increase in signature size. Please note that the size of the signature of Crystals-Dilithium is very large because, the elements of the public matrix \(\mathbf{A}\) are polynomials of degree 256 and the size of the public matrix is the lowest case (4, 4). Signature _sig_ of Crystals-Dilithium consists of \(\mathbf{z}\), \(h\), and \(c\). The size of \(\mathbf{z}\) depends on the security level (the size of the public matrix). Packing a polynomial of Crystals-Dilithium has 640 bytes; therefore, the size of \(\mathbf{z}\) is 4 \(\times\) 640, 5 \(\times\) 640, and 7 \(\times\) 640 depending on the security level, respectively, where security level 2, 3, and, 5. \(c\) is the challenge, and its size is 32 bytes as the result of the hash function. \(h\) is hint information, which is a value for identifying the carry generation part by dividing the upper/lower bits of each polynomial coefficient and using only the high-order bits. Hint \(h\) requires 80, 55, and 75 bytes, respectively, depending on security level. Algorithm 2 depicts the Crystals-Dilithium's Verify process. The signature verifier determines whether \(\mathbf{w_{1}^{\prime}}\) is accepted and whether the signature \(\mathbf{z}\) is within the acceptable range.