Key Takeaways
- • LayerZero Labs introduced Aerie, a research system that aggregates 32,768 Falcon-512 signatures in 0.65 seconds on an Apple M4 Max laptop without GPU acceleration, using 16 worker threads and peaking at 2.1 GiB of memory.
- • The standard Aerie aggregate totals 1,346 KiB for the 32,768-signature workload, or 42.1 bytes per signature, roughly 16 times smaller than the padded Falcon signatures it replaces; a shared-salt variant could reduce this to about 66 KiB but depends on a separate signing policy that the paper says it does not establish compliance with.
- • Against Orthus, an earlier Falcon aggregation system, the team reports 1.5 times faster proof generation, 38 times faster verification and 1.7 times smaller proofs on the same server, though the paper notes Orthus omits signature-format checks that Aerie performs.
- • Compared with leanVM, Ethereum's hash-based aggregation work, Aerie reports faster proof generation, while leanVM proofs verified faster (5.9 to 6.5 milliseconds on one thread versus Aerie's 54 milliseconds).
- • The research addresses a problem for proof-of-stake chains such as Ethereum, which uses BLS to combine roughly 32,000 validator votes; BLS is not quantum-resistant, and NIST lists Falcon as still undergoing standardization, separate from its finalized ML-DSA standard.
Summary
LayerZero Labs has introduced Aerie, a research system that its developers say can aggregate 32,768 quantum-resistant Falcon-512 signatures in 0.65 seconds on an Apple laptop without GPU acceleration, according to the company's October 16 announcement. The work involves researchers from LayerZero, a16z crypto research, Carnegie Mellon University and Imperial College London, and builds on the Akita cryptographic proof system. The accompanying paper frames the project around proof-of-stake blockchains, where validators sign messages that other participants must verify. According to the paper, Ethereum currently uses BLS signatures to combine roughly 32,000 validator votes into a compact signature, but BLS does not withstand quantum attacks, and the post-quantum alternatives selected by US standards officials lack equivalent built-in aggregation.
In benchmarks on an Apple M4 Max, Aerie processed the Falcon-512 batch using 16 worker threads with peak memory of 2.1 GiB. A workload of 16,384 Falcon-1024 signatures took 0.63 seconds with similar memory requirements. The paper reports that proof generation for either workload took roughly 4.3 seconds on a single thread. Checking the completed Falcon-512 aggregate took 54 milliseconds on one core, compared with 519 milliseconds to check the signatures individually; with 16 threads, the figures were 11.6 milliseconds and 42.9 milliseconds. The authors state that "one proof covers the whole batch, with no recursion," removing the need for intermediate proofs, and say another node holding the signatures could produce a replacement proof if the original aggregator fails.
Aerie retains a salt from each signature so the verifier can compute the associated hashes directly. For the 32,768-signature Falcon-512 workload, the standard aggregate is 1,346 KiB including salts and headers, with the proof component accounting for about 66 KiB. The authors put the standard aggregate at 42.1 bytes per signature, roughly 16 times smaller than the padded Falcon signatures it replaces, excluding public keys and messages. A shared-salt design could bring the complete aggregate to about 66 KiB, but the paper says this depends on a separate signing policy and security assumptions and does not establish compliance with that policy.
The paper compares Aerie with leanVM, part of Ethereum's hash-based aggregation work. In Section 6.3, the authors report that leanVM aggregated 900 XMSS signatures in 0.51 seconds using all cores on the same M4 Max, and place Aerie's Falcon-512 proving throughput at 29 times leanVM's XMSS throughput under those conditions. LeanVM's proofs verified faster, the researchers note. Against Orthus, the team reports 1.5 times faster proof generation, 38 times faster verification and 1.7 times smaller proofs.
The standards context is separate from the Ethereum work. The National Institute of Standards and Technology lists ML-DSA and SLH-DSA among digital-signature standards finalized in August 2024, and identifies Falcon as selected for ongoing standardization. NIST recommends organizations begin migrating vulnerable systems and identifies 2035 as the endpoint for removing quantum-vulnerable algorithms. LayerZero says ML-DSA aggregation works inside Aerie, but exact performance figures and implementation details remain pending.
In benchmarks on an Apple M4 Max, Aerie processed the Falcon-512 batch using 16 worker threads with peak memory of 2.1 GiB. A workload of 16,384 Falcon-1024 signatures took 0.63 seconds with similar memory requirements. The paper reports that proof generation for either workload took roughly 4.3 seconds on a single thread. Checking the completed Falcon-512 aggregate took 54 milliseconds on one core, compared with 519 milliseconds to check the signatures individually; with 16 threads, the figures were 11.6 milliseconds and 42.9 milliseconds. The authors state that "one proof covers the whole batch, with no recursion," removing the need for intermediate proofs, and say another node holding the signatures could produce a replacement proof if the original aggregator fails.
Aerie retains a salt from each signature so the verifier can compute the associated hashes directly. For the 32,768-signature Falcon-512 workload, the standard aggregate is 1,346 KiB including salts and headers, with the proof component accounting for about 66 KiB. The authors put the standard aggregate at 42.1 bytes per signature, roughly 16 times smaller than the padded Falcon signatures it replaces, excluding public keys and messages. A shared-salt design could bring the complete aggregate to about 66 KiB, but the paper says this depends on a separate signing policy and security assumptions and does not establish compliance with that policy.
The paper compares Aerie with leanVM, part of Ethereum's hash-based aggregation work. In Section 6.3, the authors report that leanVM aggregated 900 XMSS signatures in 0.51 seconds using all cores on the same M4 Max, and place Aerie's Falcon-512 proving throughput at 29 times leanVM's XMSS throughput under those conditions. LeanVM's proofs verified faster, the researchers note. Against Orthus, the team reports 1.5 times faster proof generation, 38 times faster verification and 1.7 times smaller proofs.
The standards context is separate from the Ethereum work. The National Institute of Standards and Technology lists ML-DSA and SLH-DSA among digital-signature standards finalized in August 2024, and identifies Falcon as selected for ongoing standardization. NIST recommends organizations begin migrating vulnerable systems and identifies 2035 as the endpoint for removing quantum-vulnerable algorithms. LayerZero says ML-DSA aggregation works inside Aerie, but exact performance figures and implementation details remain pending.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.