Fast post-quantum signature aggregation with lattice SNARKs

What it is

Aerie is an open-source system from a16z crypto and LayerZero Labs that aggregates Falcon-512 and Falcon-1024 signatures into one lattice SNARK. Code is at a16z/aerie. Authors are Alberto Centelles, Quang Dao, Justin Thaler and Mohammadtaghi Badakhshan. The post is a vendor announcement, and its comparisons with Ethereum's hash-based plan are the authors' own.

How it works

Speed comes from two sources. The first is Akita, a lattice polynomial commitment scheme, plus sum-check proving techniques that are highly parallel and suited to GPUs (the benchmarks use no GPU). The second is that Falcon verification needs few hashes. Falcon's hash takes only the message and a salt, so if the aggregate carries each 40-byte salt, the verifier computes the hashes itself and the proof covers only algebraic checks.

A node holding a slot's signatures produces one proof directly, with no recursion. Any node with the same signatures can replace a failed aggregator.

Numbers the summary omits

• Proof size is about 66 KiB, for either 32,768 Falcon-512 or 16,384 Falcon-1024 signatures.
• The salts for 32,768 signatures take about 1.3 MB and dominate the aggregate for large batches. The 42 bytes per signature includes them.
• Single-core proving takes about 8 times standard Falcon verification time and 1.4 times signing time.
• Against Orthus on one core of the same AVX-512 server: proves 1.5x faster, verifies 38x faster, proofs 1.7x smaller.
• Against leanVM on the same machine: about 50,800 versus 1,770 XMSS signatures per second (29x). For stateless hash-based signatures, leanVM's latest published benchmark is about 820 per second (about 60x slower), with keys capped near 127,000 signatures.
• Prior lattice work (PSE's LaBRADOR-based Falcon aggregation) reports about 74 KB for 10,000 signatures, with verification taking seconds.
• Ethereum's Lean Consensus 2026 plan targets 1,000 signatures per second, and each leanVM proof covers about 900 signatures.

Correctness claim

Aerie proves everything a standard Falcon verifier checks, including canonical signature encoding. The post says prior Falcon aggregation work skipped that check, so its aggregates could accept signatures a standard verifier rejects.

What to do

For chains that choose Falcon (the post cites Solana as exploring it and Algorand as having deployed it), this is a candidate aggregation path. Algorand's deterministic Falcon could drop the salts and leave only the 66 KiB proof, with small changes to Aerie's salt and signature handling.

Caveats

• Benchmarks come from an Apple M4 Max laptop and an AVX-512 server, published by the authors.
• The post says Falcon signing is complex, has been hard to fit on hardware wallets, and still needs side-channel hardening. It reports that fixed-point arithmetic (which NIST plans to require in FN-DSA) and an implementation using about 11 kB of RAM for Falcon-512 signing ease the hardware wallet problem.
• ML-DSA support and removing Falcon salts require proving some hashes. These are in progress, and the authors expect lower throughput than 50,000 per second, though still above 1,000.
• The post argues lattices over hash-only designs, citing recursion risk and the need for encryption in private payments. Its full security case is deferred to a future post.