LayerZero Labs has introduced Aerie, a research system that its developers say can aggregate 32,768 quantum-resistant Falcon signatures in 0.65 seconds on an Apple laptop without GPU acceleration.
Summary
- 32,768 Falcon-512 signatures were aggregated in 0.65 seconds using 16 worker threads.
- Aerie’s standard aggregate includes retained signature data, with a smaller shared-salt version requiring extra conditions.
- The researchers report faster proof generation than leanVM, while leanVM’s proofs verified faster.
- NIST lists Falcon as undergoing standardization, separately from its finalized ML-DSA signature standard.
LayerZero’s Oct. 16 announcement identifies researchers from its own team, a16z crypto research, Carnegie Mellon University, and Imperial College London as contributors to the project, which builds on the Akita cryptographic proof system.
The accompanying paper presents a way to combine thousands of digital signatures into one proof of their validity. Its authors frame the work around a problem facing proof-of-stake blockchains, where validators sign messages confirming the network’s state and other participants must check those signatures.
According to the paper, Ethereum currently uses BLS signatures to combine roughly 32,000 validator votes into a small signature. BLS does not withstand quantum attacks, while the post-quantum alternatives selected by US standards officials lack the same built-in aggregation capability.
Aerie cuts proof generation below one second
In the team’s Apple M4 Max benchmarks, Aerie processed the Falcon-512 batch using 16 worker threads and reached peak memory usage of 2.1 GiB. A second workload, comprising 16,384 Falcon-1024 signatures, took 0.63 seconds with similar memory requirements.
The researchers describe Falcon-1024 as the higher-security option, with larger signatures and more computation than Falcon-512. Their paper reports that producing a proof for either workload took roughly 4.3 seconds when restricted to one thread.
Checking the completed Falcon-512 aggregate took 54 milliseconds on one core, according to the benchmark table, compared with 519 milliseconds for checking the signatures individually. With 16 threads, the corresponding figures were 11.6 milliseconds and 42.9 milliseconds.
The paper describes the batch construction in direct terms.
“One proof covers the whole batch, with no recursion.”
According to the authors, avoiding recursion removes the need to create intermediate proofs and combine them through successive rounds. Their design allows another node holding the signatures to produce a replacement proof if the original aggregator fails.
Smaller proofs still carry signature data
Aerie retains a short random value, known as a salt, from each signature so that the verifier can calculate the associated hashes directly, the researchers explain. The proof handles the remaining mathematical checks, using Akita to support the construction.
For the 32,768-signature Falcon-512 workload, the paper reports an aggregate of 1,346 KiB, including salts and headers. Its proof component accounts for roughly 66 KiB, while the retained salts make up most of the remaining data.
The authors put the standard aggregate at 42.1 bytes per signature, approximately 16 times smaller than the padded Falcon signatures it replaces. Their size measurements exclude public keys and messages supplied separately to the verifier.
A shared salt could bring the complete aggregate down to approximately 66 KiB, according to the paper, but that estimate depends on a separate signing policy and security assumptions. The researchers explicitly state that the size estimate does not establish compliance with that policy.
Against Orthus, an earlier Falcon aggregation system, the team reports 1.5 times faster proof generation, 38 times faster verification, and proofs 1.7 times smaller on the same server. The paper qualifies that comparison by explaining that Orthus’s workload omits signature-format checks that Aerie performs.
Ethereum comparison involves different signature designs
The paper compares Aerie with leanVM, part of Ethereum’s hash-based aggregation work. As crypto.news previously reported, Ethereum researchers have been developing proof infrastructure to compress large post-quantum signatures for use on the network.
In Section 6.3, the Aerie authors report running leanVM on the same M4 Max and aggregating 900 XMSS signatures in 0.51 seconds using all cores. Their comparison puts Aerie’s Falcon-512 proving throughput at 29 times leanVM’s XMSS throughput under those conditions.
The researchers report a trade-off on verification. LeanVM proofs verified in 5.9 to 6.5 milliseconds on one thread in the cited configurations, faster than Aerie’s 54-millisecond single-thread result for its 32,768-signature batch.
Separate Ethereum work addresses how validators could adopt new signatures. An August draft proposed a post-quantum-ready deposit contract with variable-length cryptographic data and a mechanism to retire new BLS deposits.
The proposal’s GitHub record remains a draft submission. Its description identifies an irreversible BLS retirement mode, while discussion records show outstanding technical feedback and review requirements.
In its Sept. 7 priorities document, the Ethereum Foundation’s Protocol Cluster set a December 2029 quantum-resistance target covering execution, consensus and data. The Foundation called a quantum threat arriving in 2030 a deliberately aggressive planning assumption, with outside experts expected to help reassess progress beginning in January 2027.
US standards distinguish Falcon from finalized alternatives
The National Institute of Standards and Technology lists ML-DSA and SLH-DSA among the digital-signature standards finalized in August 2024. Its current program overview identifies Falcon as selected for ongoing standardization, a separate status from those completed standards.
NIST recommends that organizations begin migrating vulnerable systems and identifies 2035 as the endpoint for removing quantum-vulnerable algorithms from its standards, with high-risk systems transitioning earlier.
LayerZero says ML-DSA aggregation is working inside Aerie, but exact performance figures and implementation details remain pending in its announcement.