Today we're sharing new research from LayerZero Labs, a16z crypto research, Carnegie Mellon University, and Imperial College London introducing Aerie, a new system for aggregating post-quantum cryptographic signatures.
Built using Akita, the lattice-based polynomial commitment scheme we recently introduced, Aerie can aggregate 32,000 Falcon signatures in just 0.65 seconds on a MacBook Pro, without GPU acceleration. This achieves an unprecedented 8x overhead over native execution (single-thread to single-thread), among workloads of practical importance.
We also have aggregation of ML-DSA signatures, NIST’s standardized default, working at high performance inside of Aerie, with exact performance and implementation details pending.
Our research demonstrates a significant advance in the performance of post-quantum signature aggregation, a critical requirement for blockchains preparing for a world in which quantum computers can break today's cryptographic standards.
The challenge of post-quantum signature aggregation
Every blockchain relies on cryptographic signatures to verify transactions and establish consensus.
In proof-of-stake systems, thousands of validators sign messages to attest to the state of the network. Rather than verifying each signature individually, blockchains can aggregate them into a single object that proves their collective validity.
Today, this is commonly accomplished using BLS signatures, which support efficient aggregation. However, BLS signatures are not resistant to quantum attacks.
Post-quantum cryptography presents a new challenge. The signature schemes being standardized to replace today's cryptography do not support the same native aggregation mechanisms.
One promising candidate is Falcon, a lattice-based signature scheme selected by NIST for standardization as FN-DSA. Falcon produces the smallest signatures among NIST's selected post-quantum signature schemes, making it particularly attractive for blockchains where bandwidth and storage are constrained.
However, efficiently aggregating thousands of Falcon signatures has remained difficult. Prior work such as Orthus requires seconds to verify the aggregated proof, even longer than verifying the signature batch itself.
Introducing Aerie
Aerie addresses this problem using a new lattice-based proof system built on Akita. The starting observation is simple, and dates back to the work of Aardal et al (CRYPTO 2024). Rather than proving the expensive hash computations normally associated with signature verification, we can expose the public salt portion, let the verifier compute all the hashes, and the prover only needs to prove polynomial-ring and norm equations. Instantiating this template efficiently, especially with efficient verification, remained an open question.
Aerie breaks this efficiency barrier with a specialized protocol for Falcon signature aggregation. The protocol combines new techniques in structured projections with Akita's high-performance polynomial commitments. In benchmarks conducted on an Apple M4 Max laptop, using 16 CPU cores without GPU acceleration, Aerie achieved:
- 32,768 Falcon-512 signatures aggregated in 0.65 seconds.
- 16,384 Falcon-1024 signatures aggregated in 0.63 seconds.
- 2.1 GiB of peak memory usage for either workload.
- 10x faster verification than checking 32,768 Falcon-512 signatures individually on a single CPU core.
Aerie also substantially improves upon previous approaches to Falcon aggregation. In comparisons conducted on the same server hardware, Aerie proved 32,768 signatures 1.5x faster than Orthus, a recent lattice-based aggregation system, while verifying them 38x faster, and having 1.7x smaller proof. Aerie also proves the full canonical signature encoding, unlike Orthus.
These results demonstrate that large-scale post-quantum signature aggregation can be performed in under a second on consumer hardware.
A new path for post-quantum consensus
Ethereum is actively developing its own approach to post-quantum signature aggregation through leanVM, focusing on hash-based signatures.
In benchmarks conducted on the same Apple M4 Max hardware, leanVM aggregated approximately 1,600 leanXMSS signatures per second. Aerie achieved approximately 46,000 Falcon-512 signatures per second.
Aerie prioritizes proving speed and efficiency, demonstrating the advantages available when designing a specialized system around lattice-based cryptography.
The result is a path toward low-latency post-quantum consensus without requiring specialized proving hardware.
Building for a post-quantum world
Our goal with Akita was to build a new cryptographic primitive that could accelerate post-quantum proving across the industry. Aerie is an early demonstration of that potential.
By combining Akita with a purpose-built proof system for Falcon signatures, researchers have demonstrated that tens of thousands of post-quantum signatures can be aggregated in under a second on consumer hardware.
As the industry prepares for a post-quantum future, Aerie demonstrates that post-quantum security and high performance do not have to be mutually exclusive.