The company LayerZero Labs has unveiled the research system Aerie, capable of processing 32 768 quantum-attack-resistant Falcon signatures in 0.65 seconds on an Apple laptop without using a graphics processor.
In its October 16 announcement, LayerZero said the project, built on the Akita cryptographic proof system, involves researchers from its own team, a16z crypto research, Carnegie Mellon University, and Imperial College London.
The accompanying paper presents a way to combine thousands of digital signatures into a single proof of their validity. The authors build their concept around a problem facing Proof-of-Stake blockchains, where validators sign messages confirming the state of the network, and other participants must verify those signatures.
According to the paper, Ethereum currently uses BLS signatures to aggregate roughly 32 000 validator votes into a small signature. BLS is not resistant to quantum attacks, and the post-quantum alternatives selected by U.S. standardization experts do not have the same built-in aggregation capability.
Aerie cuts proof preparation time to under one second
In tests on an Apple M4 Max conducted by the development team, Aerie processed a Falcon-512 data batch using 16 worker threads and reached peak memory usage of 2.1 GiB. A second workload, comprising 16 384 Falcon-1024 signatures, took 0.63 seconds under similar memory requirements.
The researchers describe Falcon-1024 as the more secure variant, with larger signatures and greater computational power than Falcon-512. Their paper reports that generating a proof for either of these tasks took approximately 4.3 seconds when running on a single thread.
According to the benchmark results table, verifying the completed Falcon-512 aggregate took 54 milliseconds on a single core, compared with 519 milliseconds to verify the individual signatures. Using 16 threads, the corresponding figures were 11.6 milliseconds and 42.9 milliseconds.
The paper describes the process in plain terms.
"One proof covers the entire set of proofs, with no recursion".
According to the authors, forgoing recursion eliminates the need to create intermediate proofs and combine them in successive rounds. Their design allows another node holding the signatures to produce a replacement proof if the original aggregator fails.
Smaller test instances still contain signature data
As the researchers explain, Aerie retains a short random value known as a salt from each signature so that the verifier can directly compute the corresponding hashes. The proof performs the remaining mathematical checks, using Akita to support the construction.
The paper reports that for the Falcon-512 workload comprising 32 768 signatures, the total data volume is 1346 KiB, including salts and headers. The proof component takes up approximately 66 KiB, with most of the remaining data accounted for by the stored salts.
The authors estimated the size of a standard aggregated signature at 42.1 bytes, roughly 16 times smaller than the size of the padded Falcon signatures it replaces. The size measurements do not include the public keys and messages, which are provided to the verifier separately.
According to the paper, using a shared salt could reduce the total size to approximately 66 KiB, but this estimate depends on the individual signing policy and security assumptions. The researchers explicitly state that this size estimate does not confirm compliance with that policy.
Compared with Orthus, an earlier Falcon aggregation system, the team reports a 1.5-fold speedup in proof generation, a 38-fold speedup in verification, and a 1.7-fold reduction in proof size on the same server. The paper notes that the Orthus workload lacks the signature format checks that Aerie performs.
Read also:
