a16z crypto research has released Aerie, a new system that aggregates quantum-resistant Falcon signatures at speeds practical for Ethereum-scale validator sets.
Proof-of-stake networks rely on signature aggregation to handle large numbers of validators efficiently. Ethereum currently uses BLS signatures to combine roughly 32,000 validator votes per slot into one compact group element.
Solana is moving toward similar aggregation under its Alpenglow upgrade.
BLS works well today because of its algebraic structure, but it is vulnerable to future quantum computers.
Post-quantum alternatives standardized by NIST, including lattice-based schemes, are typically 10 to 100 times larger than elliptic-curve signatures and lack native aggregation.
Without an efficient way to compress them, these larger signatures would inflate blocks, constrain throughput, and raise the cost of running a node.Aerie, developed by researchers from a16z crypto, LayerZero Labs, Carnegie Mellon University, and Imperial College London, addresses this by pairing lattice-based Falcon signatures with lattice-based SNARKs.
Falcon, selected by NIST for standardization (as FN-DSA), is among the most compact post-quantum signature schemes. Aerie builds on the Akita lattice-based polynomial commitment scheme.
By retaining each signature’s short public salt in the aggregate, the verifier can recompute the necessary hashes directly.
The proof itself covers only algebraic relations and norm checks, avoiding the heavy cost of proving large numbers of hash evaluations inside the SNARK.
On an Apple M4 Max laptop using only CPU cores (no GPU), Aerie aggregates 32,768 Falcon-512 signatures—roughly one Ethereum slot’s worth of votes—in 0.65 seconds, for a throughput exceeding 50,000 signatures per second.
A comparable batch of 16,384 Falcon-1024 signatures completes in 0.63 seconds.
The resulting aggregate occupies about 42 bytes per signature (including salts), roughly 16 times smaller than raw Falcon-512 signatures.
Verification of the single proof takes 54 milliseconds on one core, about 10 times faster than checking the individual signatures. Peak memory use stays around 2.1 GiB.
These figures substantially outperform prior Falcon aggregation work such as Orthus on proving speed, verification speed, and proof size, while also enforcing Falcon’s full byte-format requirements.
The approach contrasts with Ethereum’s current leanVM roadmap for post-quantum aggregation, which relies on hash-based signatures and hash-based SNARKs.
Hash-based designs require proving hundreds of hash evaluations per signature, so a single laptop cannot keep pace with a full slot.
Ethereum’s design therefore splits work across multiple provers and recursively merges intermediate proofs.
Aerie produces one proof covering the entire batch with no recursion.
This removes coordination overhead, shortens the critical path within a slot, and allows any node holding the signatures to generate a replacement proof if the original aggregator fails.
Researchers report Aerie achieving roughly 29 times the throughput of leanVM on comparable consensus-signature workloads and even larger gains on certain transaction-signature benchmarks when measured on the same hardware.
By enabling a single ordinary laptop to handle an Ethereum-scale batch directly, Aerie opens a simpler design path for post-quantum consensus.
It also aligns with chains already exploring Falcon, such as Algorand (which has deployed it) and Solana (which has examined it).
The work further notes that lattice techniques will likely remain necessary for private payments and encryption features, even in designs that favor hash-based signatures, because public-key encryption cannot be constructed from hash functions alone in a black-box manner.
Aerie remains research output rather than a deployed protocol upgrade. Full technical details, security reductions, and benchmarks appear in the accompanying paper and blog posts.
