# aere-node Post-quantum signature verification precompiles for Hyperledger Besu, as they run on Aere Network mainnet (chain 2800). This repository is meant to be used, not read. It contains the precompile sources, a patch that applies to a named upstream Besu commit, the NIST known-answer vectors, and a script that checks the live chain without asking you to trust anything here. --- ## Scope boundary, stated first and not in a footnote **These precompiles verify post-quantum signatures inside the EVM. Consensus on chain 2800 is classical secp256k1 ECDSA QBFT.** Aere Network does not have post-quantum consensus. Block sealing, validator identity and the QBFT vote messages are all classical elliptic-curve cryptography today, and a cryptographically relevant quantum computer would break them exactly as it would break any other ECDSA chain. What is live and post-quantum is the *verification* capability exposed to the EVM: a contract or an account abstraction wallet on chain 2800 can verify a Falcon, ML-DSA or SLH-DSA signature natively, at precompile cost, today. Two further boundaries in the same spirit: - The on-chain zero-knowledge verifiers used elsewhere in the Aere stack are classical BN254 pairing verifiers. They are Shor-breakable. They are not quantum-safe and are never described as such. - `0x0AE6` and `0x0AE7` are **testnet-only**. They are not on mainnet. The verification script in this repository asserts their absence from mainnet as a falsifiable check, so that a reader can catch us if that ever stops being true. --- ## The precompiles Activated on mainnet chain 2800 at block **9,189,161**. | Address | Algorithm | Standard | Input framing | Output | |---|---|---|---|---| | `0x0AE1` | Falcon-512 verify | NIST Falcon round 3 | `pk \|\| sm` | 32-byte word, 1 accept / 0 reject | | `0x0AE2` | Falcon-1024 verify | NIST Falcon round 3 | `pk \|\| sm` | 32-byte word, 1 accept / 0 reject | | `0x0AE3` | ML-DSA-44 verify | FIPS 204 | `pk \|\| sm` | 32-byte word, 1 accept / 0 reject | | `0x0AE4` | SLH-DSA-SHA2-128s verify | FIPS 205 | `pk \|\| sm` | 32-byte word, 1 accept / 0 reject | | `0x0AE5` | SHAKE256 XOF | FIPS 202 | 32-byte big-endian `outLen` word, then data | `outLen` bytes | `sm` is the NIST signed-message convention: `signature || message`. Not part of this fork but relevant and also live: `0x100` P-256 verify (RIP-7951), which is classical. **Testnet only, not on mainnet:** | Address | Algorithm | Standard | Status | |---|---|---|---| | `0x0AE6` | ML-KEM-768 deterministic encapsulation | FIPS 203 | Built, 25/25 NIST ACVP KAT on an isolated single-validator QBFT testnet | | `0x0AE7` | Falcon HashToPoint (SHAKE256 rejection sampler) | NIST Falcon round 3 | Built, 12/12 KAT on the same isolated testnet | Mainnet activation of either is a governance decision that has not been taken. The Java sources for all seven are in `precompiles/`, and the same sources are what the patches in `patches/` install. --- ## The patch Upstream Hyperledger Besu is roughly a million lines. Our contribution is a few hundred. Publishing a full fork tree would bury the contribution in upstream code and leave you unable to tell our lines from Besu's without diffing it yourself. A patch against a named upstream commit inverts that: the diff *is* the contribution, you fetch the other 99 percent from Hyperledger directly, and when upstream moves we rebase rather than merge a divergent tree forever. Both patches target upstream commit `d2032017bb3b8cb215a97303980a1e4a643f7180`, authored 2026-04-17. That is the same commit named in the artifact running on the validators, `besu-evm-26.7-develop-d203201.jar`. | Patch | Adds | Applies to | |---|---|---| | `patches/0001-aere-pqc-precompiles-mainnet.patch` | `0x0AE1` to `0x0AE5`, the five live on mainnet | pristine upstream `d2032017` | | `patches/0002-aere-pqc-precompiles-testnet.patch` | `0x0AE6` and `0x0AE7`, testnet only | the tree after 0001 | Between them they touch eight files: two upstream files modified (`Address.java` for the address constants, `MainnetPrecompiledContracts.java` for the registry wiring) and six new precompile classes plus one shared Falcon helper. **No build file changes are required.** Bouncy Castle `bcprov-jdk18on` 1.83 is already on the `evm` module's compile classpath as an `api` dependency of `crypto:algorithms`, and `jakarta.validation-api` is a global subproject dependency. Patch 0001 also repoints `populateForFutureEIPs` from `populateForCancun` to `populateForOsaka`, so the fork carries the full Osaka precompile set. That is a real behaviour change beyond the five precompiles and is called out here rather than left to be discovered in the diff. ### Apply it yourself ``` git clone --filter=blob:none https://github.com/hyperledger/besu.git cd besu git checkout d2032017bb3b8cb215a97303980a1e4a643f7180 git apply --check /path/to/aere-node/patches/0001-aere-pqc-precompiles-mainnet.patch git apply /path/to/aere-node/patches/0001-aere-pqc-precompiles-mainnet.patch ``` Add `0002` the same way if you want the testnet pair as well. Both are `git format-patch` output, so `git am` works too and carries the commit message. **Verified, 2026-07-20.** Both patches were applied to a freshly fetched, byte-clean checkout of `d2032017` in a scratch directory. `git apply --check` and `git apply` each returned exit 0 for both patches, and the resulting files are byte-identical to the sources in `precompiles/`. > A note on how that verification earned its place. An earlier draft of patch 0001 also returned > exit 0 from `git apply --check`, and it was still wrong: it registered a helper class, > `AereFalconSupport`, that it never added, so it applied cleanly and then failed to compile. A patch > that applies is not a patch that builds. That is why the next section exists. --- ## Build ``` ./gradlew :evm:compileJava # the module this patch touches ./gradlew installDist # full node distribution, in build/install/besu/ ``` Requires JDK 21. Commit `d2032017` sits on the development line after the 26.4.0 release, which is the newest heading in that commit's `CHANGELOG.md`. The artifact running on the validators is named `besu-evm-26.7-develop-d203201.jar`; treat the commit hash, not the version string, as the identifier that matters. Note that upstream has since moved from `hyperledger/besu` to `besu-eth/besu`. GitHub redirects the old URL, so the clone command above still resolves, and it was the exact command used for the verification below. **Verified, 2026-07-20.** `./gradlew --no-daemon :evm:compileJava` was run on the pristine `d2032017` checkout with both patches applied, on JDK 21.0.11. It exited 0. Ten class files were emitted for the seven precompiles and the Falcon helper, including the nested `InternalVerifier` classes of `MLDSA44PrecompiledContract` and `SLHDSA128sPrecompiledContract`. The only compiler notes were pre-existing upstream deprecation warnings in `datatypes/.../Log.java`, unrelated to this patch. `./gradlew installDist` produces the full node distribution but was **not run here**, so this repository does not claim it. A reader who wants the whole node builds it themselves with the command above; the module this patch actually touches is `:evm`, and that is what was compiled. ### One rough edge, stated rather than hidden `./gradlew build` will stop at Besu's formatter gate. `:evm:spotlessJavaCheck` and `:datatypes:spotlessJavaCheck` both exit 1 on our files. The violations are entirely cosmetic and fall into three groups: Javadoc rewrapped at a different column, the seven `AERE_*` address constants in `Address.java` exceeding the 100-column limit on one line, and Besu's license-header rule wanting `Copyright contributors to Besu` where our files say `Copyright contributors to the AERE Network`. Nothing there changes behaviour, and `:evm:compileJava` passes as reported above. We have not reformatted, for two reasons. Running `spotlessApply` would rewrite our copyright attribution to Besu's, which would be wrong on files we wrote. And the sources in this repository are byte-identical to the sources that built the artifact running on the validators; reformatting them for a cleaner `gradlew build` would trade that property away for cosmetics. To build past it: ``` ./gradlew installDist -x spotlessJavaCheck ``` Or run `./gradlew spotlessApply` first if you would rather have upstream formatting and do not mind the header rewrite. Registration happens in `MainnetPrecompiledContracts.populateForFutureEIPs`, which is why the precompiles are gated by fork activation rather than present from genesis. --- ## Check the result against the live chain You do not need our source, our binary or our word for this part. The five precompiles are addressable on public mainnet RPC. Point NIST's own published test vectors at them and read what comes back. ``` node scripts/verify-live-precompiles.mjs ``` Requires Node 18 or later. It sends only `eth_call`, `eth_chainId`, `eth_blockNumber` and `eth_getCode`. It sends no transaction, signs nothing and holds no key. Override the endpoint with `AERE_RPC=https://rpc2.aere.network` for a second, independently served view of the chain. Thirteen checks run, and every signature check is paired with a negative control. A precompile that simply returned "valid" for all input would pass the positive check and fail the tampered one. **Output of the run staged with this README (MEASURED, 2026-07-20):** ``` RPC: https://rpc.aere.network chainId: 0xaf0 (2800) block: 0xa13c28 (10566696) PASS 0x0AE5 SHAKE256(abc) outLen=32 vs FIPS 202 PASS 0x0AE5 SHAKE256(empty) outLen=32 vs FIPS 202 PASS 0x0AE5 SHAKE256(abc) outLen=64 (true XOF squeeze) PASS 0x0AE1 Falcon-512 official NIST KAT vector 0 ACCEPTS PASS 0x0AE1 Falcon-512 tampered signed-message REJECTS (negative control) PASS 0x0AE2 Falcon-1024 official NIST KAT vector 0 ACCEPTS PASS 0x0AE2 Falcon-1024 tampered signed-message REJECTS (negative control) PASS 0x0AE3 ML-DSA-44 ACVP tc108 expectedPass=true PASS 0x0AE3 ML-DSA-44 ACVP tc106 expectedPass=false PASS 0x0AE4 SLH-DSA-128s ACVP tc422 expectedPass=true PASS 0x0AE4 SLH-DSA-128s ACVP tc421 expectedPass=false PASS 0x0AE6 ML-KEM-768 is NOT live on mainnet 2800 (docs say testnet-only) PASS 0x0AE7 Falcon HashToPoint is NOT live on mainnet 2800 (docs say testnet-only) 13/13 checks passed ``` The script prints expected and actual bytes for every check, which the summary above elides. The vectors it uses are in `vectors/`: official NIST Falcon KAT vector 0 for both parameter sets, and NIST ACVP fixtures for ML-DSA-44 and SLH-DSA-SHA2-128s. Chaining the three sections gives the property this repository is for. The patch applies to an upstream commit you fetch from Hyperledger. The result compiles. The compiled precompiles answer the NIST vectors the same way the addresses on chain 2800 answer them. --- ## Correction, 2026-07-20 An earlier version of this README stated that the Java sources for the five precompiles live on mainnet were unrecoverable, and it built its whole structure around that gap. **That was wrong**, and the correction is kept here rather than quietly edited away. All five exist, complete, on the infrastructure host, alongside five full Besu source trees and a backup tarball. The earlier search looked in `/root` and at shallow depths under `/opt`, and never opened the directory named after the thing it was looking for. They are the real sources, not a lookalike. Three independent checks support that: they declare exactly the live addresses `0x0AE1` through `0x0AE5`; the tree sits on upstream Besu commit `d2032017`, the same commit named in the shipped artifact `besu-evm-26.7-develop-d203201.jar`; and the source timestamps precede the jar build, as they must. The lesson is worth more than the scare. A negative result about your own infrastructure is only as good as the paths that were searched, and here "I did not find it" was reported as "it does not exist". Every search of that kind on this project now has to state where it looked. --- ## What is deliberately not here No validator keys, no node keys, no enode URLs, no `static-nodes.json`, no operational configuration, no server addresses. Aere Network publishes its code and not its keys, which is the same line Linux draws. A secret scanner gates every file in this directory before it is pushed anywhere. Genesis and chain configuration for joining chain 2800 as a full node are a separate concern from this repository and are documented with the network's node operator material. --- ## License Apache 2.0, matching upstream Hyperledger Besu. See `LICENSE`.