Fast post-quantum signature aggregation with lattice SNARKs
a16z crypto’s report examines fast, post‑quantum signature aggregation using lattice‑based SNARKs (Aerie) and finds it can process over 50,000 Falcon signatures per second on a laptop. The approach yields tiny proofs and far outperforms hash‑based aggregation designs.
Points clés
- Aerie aggregates 32,768 Falcon‑512 signatures in 0.65 s, >50,000 signatures per second on a single laptop.
- Proof size stays constant at ≈66 KiB regardless of batch size, with per‑signature cost ≈42 bytes.
- It is 29× faster than Ethereum’s planned leanVM hash‑based aggregation (≈1,770 sig/s).
- No recursion is needed, reducing complexity and improving security guarantees.
- Falcon’s hardware‑wallet challenges are being mitigated by recent fixed‑point implementations.
- Proof size
- ≈66 KiB
- Bytes per signature
- ≈42 B
- Falcon‑512 size
- ≈666 B
- Aerie50 800 signatures/s
- LeanVM1 770 signatures/s
- Target1 000 signatures/s
The problem of post‑quantum aggregation
Most proof‑of‑stake blockchains rely on aggregating validator signatures to keep block sizes manageable. While BLS signatures enable this today, they are not quantum‑resistant, and post‑quantum signatures are typically 10‑100× larger, threatening throughput and node costs. a16z crypto asks whether lattice‑based SNARKs can provide fast, compact aggregation for post‑quantum signatures.
Aerie’s design and performance
The team introduces Aerie, which aggregates Falcon lattice signatures using lattice‑based SNARKs. On an Apple M4 Max laptop (no GPU), Aerie processes 32,768 Falcon‑512 signatures in 0.65 seconds—over 50,000 signatures per second—far exceeding the Lean Consensus team’s 2026 target of 1,000 sig/s. Each signature contributes only about 42 bytes to the aggregate, roughly 16× smaller than a raw Falcon‑512 signature (≈666 bytes) and 30× smaller than Falcon‑1024 (≈1,280 bytes). The resulting proof is a constant ≈66 KiB, and verification takes just 54 ms on a single core, ten times faster than naïvely checking each signature.
Simplicity versus recursion
Ethereum’s current roadmap aggregates hash‑based signatures via recursive SNARKs, covering only ~900 signatures per proof and requiring multiple rounds. Recursion adds bug surface, coordination overhead, and security uncertainty because each step proves statements about the hash function itself. Aerie eliminates recursion entirely: a node can produce one proof for an entire slot, freeing time for vote collection and allowing any node with the same signatures to recreate a proof if the original aggregator fails.
Caveats and ecosystem readiness
Falcon’s signing algorithm is complex and historically hard to fit on hardware wallets due to floating‑point arithmetic and memory demands. However, recent research shows fixed‑point implementations and RAM reductions to ≈11 kB, easing deployment. a16z crypto notes that hash‑based schemes like SPHINCS‑ variants remain impractically slow on hardware wallets (47 s to >6 min per signature). Chains that accept Falcon’s trade‑offs—Solana, Algorand—could immediately benefit from Aerie’s speed.
Implications for readers
If post‑quantum blockchains adopt lattice signatures and Aerie‑style aggregation, they can maintain high throughput while preparing for quantum threats. The performance gap (≈50,800 sig/s vs. ≈1,770 sig/s for leanVM) suggests that lattice‑based designs may become the default for both consensus and execution layers, especially as hardware‑wallet support improves. Nonetheless, developers should monitor ongoing work on side‑channel hardening and hybrid schemes that pair lattice and elliptic‑curve signatures for defense‑in‑depth.
Overall, the report argues that embracing lattices offers a clearer path to secure, efficient, and privacy‑compatible blockchain designs than clinging to hash‑only constructions.