Key Takeaways
- • a16z crypto released Aerie, a signature aggregation system that uses lattice-based SNARKs to aggregate lattice-based (Falcon) post-quantum signatures, according to the primary article dated 2026-10-16.
- • On an Apple M4 Max laptop without GPU acceleration, Aerie aggregates 32,768 Falcon-512 signatures in 0.65 seconds, or over 50,000 signatures per second, versus the 1,000 per second target in the Lean Consensus team's 2026 plan.
- • Aerie produces proofs of about 66 KiB regardless of batch size, with roughly 42 bytes per signature in the aggregate, about 16x smaller than Falcon-512 and nearly 30x smaller than Falcon-1024 signatures.
- • Verification takes 54 milliseconds on one core, 10x faster than checking signatures individually, and a single node can produce the proof without recursion, simplifying aggregation and recovery.
- • The authors argue that privacy and post-quantum goals on Ethereum's roadmap ultimately depend on lattice cryptography, since hash-only systems cannot provide public-key encryption.
Summary
A general-purpose post-quantum signature aggregation approach has been a bottleneck for proof-of-stake chains. According to a16z crypto, Ethereum aggregates BLS signatures, but no known post-quantum scheme aggregates the same way, and post-quantum signatures are 10 to 100 times larger than current elliptic-curve signatures. Without aggregation, these signatures would bloat blocks and raise node operating costs. The prevailing SNARK-based approach, central to Ethereum's roadmap, pairs hash-based signatures with hash-based SNARKs, which is slow to prove and requires recursively merging proofs from many provers.
a16z crypto's Aerie takes the opposite path, aggregating lattice-based signatures with lattice-based SNARKs. It supports both Falcon-512 and Falcon-1024, which NIST has selected for standardization. The article reports that Aerie's speed comes from Akita, a lattice-based polynomial commitment scheme built with LayerZero Labs, along with sum-check-based proving techniques developed on the way to Lattice Jolt. Lattice signature verification also involves few hash evaluations, whereas hash-based signatures require hundreds per signature, and hashing typically adds over 100x overhead in proofs.
Because a single proof covers a full slot, the design removes intermediate proofs and recursion. According to the article, this leaves more time per slot for vote collection and block propagation, broadens participation in aggregation, and lets any node holding the same signatures produce a replacement proof if an aggregator fails. The article argues that recursion is intricate, bug-prone, and lacks established security even in the random oracle model. Ethereum's current leanVM design covers about 900 signatures per proof.
The authors acknowledge Falcon's trade-offs, including complex floating-point signing and historically difficult hardware wallet deployment. They note that fixed-point implementations are being researched, that NIST plans to require this approach in the FN-DSA standard, and that a new implementation cuts Falcon-512 signing to about 11 kB of RAM. Planned extensions include ML-DSA support, proving Falcon's salts within the SNARK, and hybrid lattice and elliptic-curve signatures; the authors expect these may not reach 50,000 signatures per second but should retain headroom over Ethereum's 1,000 per second target.
The article also makes a privacy argument, noting that the Ethereum Foundation's draft strawmap includes a private L1 with shielded transfers alongside a hash-based post-quantum L1, goals the authors describe as in tension. Citing Impagliazzo and Rudich, they argue public-key encryption cannot be built from hash functions in a black-box way, and that ML-KEM is NIST's primary post-quantum encryption standard. The authors conclude that avoiding lattices does not remove the reliance on them. Aerie's proof is about 66 KiB, comparable to PSE's LaBRADOR-based benchmark of about 74 KB for 10,000 signatures, though that verification takes seconds.
a16z crypto's Aerie takes the opposite path, aggregating lattice-based signatures with lattice-based SNARKs. It supports both Falcon-512 and Falcon-1024, which NIST has selected for standardization. The article reports that Aerie's speed comes from Akita, a lattice-based polynomial commitment scheme built with LayerZero Labs, along with sum-check-based proving techniques developed on the way to Lattice Jolt. Lattice signature verification also involves few hash evaluations, whereas hash-based signatures require hundreds per signature, and hashing typically adds over 100x overhead in proofs.
Because a single proof covers a full slot, the design removes intermediate proofs and recursion. According to the article, this leaves more time per slot for vote collection and block propagation, broadens participation in aggregation, and lets any node holding the same signatures produce a replacement proof if an aggregator fails. The article argues that recursion is intricate, bug-prone, and lacks established security even in the random oracle model. Ethereum's current leanVM design covers about 900 signatures per proof.
The authors acknowledge Falcon's trade-offs, including complex floating-point signing and historically difficult hardware wallet deployment. They note that fixed-point implementations are being researched, that NIST plans to require this approach in the FN-DSA standard, and that a new implementation cuts Falcon-512 signing to about 11 kB of RAM. Planned extensions include ML-DSA support, proving Falcon's salts within the SNARK, and hybrid lattice and elliptic-curve signatures; the authors expect these may not reach 50,000 signatures per second but should retain headroom over Ethereum's 1,000 per second target.
The article also makes a privacy argument, noting that the Ethereum Foundation's draft strawmap includes a private L1 with shielded transfers alongside a hash-based post-quantum L1, goals the authors describe as in tension. Citing Impagliazzo and Rudich, they argue public-key encryption cannot be built from hash functions in a black-box way, and that ML-KEM is NIST's primary post-quantum encryption standard. The authors conclude that avoiding lattices does not remove the reliance on them. Aerie's proof is about 66 KiB, comparable to PSE's LaBRADOR-based benchmark of about 74 KB for 10,000 signatures, though that verification takes seconds.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.