aere-network/aere-research
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

AIP-7 erratum 1 and the PQC precompile draft: withdraw the uncitable 'audited' adjective from the wrapped library (O-006)

Browse Source
This commit is contained in:
Aere Network 2026-09-11 21:34:40 +03:00
parent 16ccb98d34
commit 16ce7e8989
2 changed files with 17 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
aips/AIP-7.md
View File

@ -123,9 +123,9 @@ verifiers are already heavily optimized (hand-written Keccak-f assembly) and the
remaining cost is intrinsic. Only native code removes it, which is the same remaining cost is intrinsic. Only native code removes it, which is the same
reasoning that justified RIP-7951 and EIP-2537 on Ethereum. reasoning that justified RIP-7951 and EIP-2537 on Ethereum.
Wrapping a maintained, audited native library (Bouncy Castle) rather than Wrapping a maintained native library (Bouncy Castle) rather than
hand-rolling the verify keeps the security boundary at a reviewed implementation hand-rolling the verify keeps the security boundary at one widely used
plus a thin parsing adapter. The classloader-isolation boundary exists because Besu implementation plus a thin parsing adapter. The classloader-isolation boundary exists because Besu
bundles an older Bouncy Castle, and a naive classpath addition risks silently bundles an older Bouncy Castle, and a naive classpath addition risks silently
binding the wrong implementation. binding the wrong implementation.
@ -237,3 +237,15 @@ pure-Solidity verifier suite that the precompiles accelerate is documented in AI
## Copyright ## Copyright
Released to the public domain (CC0). No rights reserved. Released to the public domain (CC0). No rights reserved.
## Errata
**Erratum 1 (2026-09-11).** The Rationale originally read "a maintained, audited
native library (Bouncy Castle)" and "a reviewed implementation". Both adjectives are
withdrawn and the sentence now reads "a maintained native library" and "one widely
used implementation". Aere Network ships `bcprov-jdk18on`, which is not a FIPS
validated cryptographic module and for which no published third-party review is known
to us; calling it audited or reviewed asserted more than can be cited. What is citable
is byte-for-byte agreement with the NIST KAT and ACVP vectors in both directions,
recorded in `AERE-NIST-VALIDATION-STATUS.md` section 3.4. Nothing normative in this
AIP changed: the precompiles, addresses, encodings and gas constants are untouched.

4
research/aip-draft-pqc-precompiles.md
View File

@ -24,7 +24,7 @@ requires: EIP-7825 (per-transaction gas cap), RIP-7951 (P-256 precompile precede
This proposal specifies a family of native precompiled contracts for the AERE EVM (chain ID 2800) that accelerate post-quantum (PQC) signature verification. The AERE application layer already runs full, spec-complete PQC verifiers written in pure Solidity: Falcon-512, Falcon-1024, ML-DSA-44 (Dilithium2), SLH-DSA-SHA2-128s (SPHINCS+), XMSS-SHA2_10_256, and WOTS+. The dominant cost inside every one of these verifiers is `SHAKE256` / `Keccak-f[1600]` streaming, followed by lattice ring arithmetic. Two of the schemes, Falcon-1024 and ML-DSA-44, exceed the EIP-7825 per-transaction gas cap of 16,777,216 when run as a state-changing `verifyAndRecord` transaction, so they are usable today only as `eth_call` views. This proposal specifies a family of native precompiled contracts for the AERE EVM (chain ID 2800) that accelerate post-quantum (PQC) signature verification. The AERE application layer already runs full, spec-complete PQC verifiers written in pure Solidity: Falcon-512, Falcon-1024, ML-DSA-44 (Dilithium2), SLH-DSA-SHA2-128s (SPHINCS+), XMSS-SHA2_10_256, and WOTS+. The dominant cost inside every one of these verifiers is `SHAKE256` / `Keccak-f[1600]` streaming, followed by lattice ring arithmetic. Two of the schemes, Falcon-1024 and ML-DSA-44, exceed the EIP-7825 per-transaction gas cap of 16,777,216 when run as a state-changing `verifyAndRecord` transaction, so they are usable today only as `eth_call` views.
This document specifies, at minimum, (1) a `SHAKE256` precompile and (2) a `Falcon-512` verify precompile, plus optional `Falcon-1024`, `ML-DSA-44`, and `SLH-DSA-SHA2-128s` verify precompiles. Each precompile has a fixed reserved address, a self-describing length-prefixed input encoding, a single-byte output (`0x01` valid, `0x00` cryptographically invalid) with a revert on malformed input, and a gas-cost model. The precompiles wrap an audited native implementation (Bouncy Castle) inside the Besu client. They were implemented and KAT-validated on an isolated Besu 26.4.0 scratch fork (chain 28099); all NIST KAT vectors including negatives pass; and they are now LIVE on AERE mainnet 2800, activated at block 9,189,161 (2026-07-12) as the AerePQC hard fork, a coordinated client-only activation with no re-genesis (recorded in AIP-7). The as-shipped precompiles live at the address band `0x0AE1`..`0x0AE5`. With the precompiles live, a full Falcon-1024 verify-and-record transaction measures 145,496 gas (0.87% of the cap) and ML-DSA-44 measures 351,050 gas (2.09%), both well within the per-transaction cap. This document specifies, at minimum, (1) a `SHAKE256` precompile and (2) a `Falcon-512` verify precompile, plus optional `Falcon-1024`, `ML-DSA-44`, and `SLH-DSA-SHA2-128s` verify precompiles. Each precompile has a fixed reserved address, a self-describing length-prefixed input encoding, a single-byte output (`0x01` valid, `0x00` cryptographically invalid) with a revert on malformed input, and a gas-cost model. The precompiles wrap a maintained native implementation (Bouncy Castle) inside the Besu client; Aere Network makes no audit claim about that library, see Security Considerations. They were implemented and KAT-validated on an isolated Besu 26.4.0 scratch fork (chain 28099); all NIST KAT vectors including negatives pass; and they are now LIVE on AERE mainnet 2800, activated at block 9,189,161 (2026-07-12) as the AerePQC hard fork, a coordinated client-only activation with no re-genesis (recorded in AIP-7). The as-shipped precompiles live at the address band `0x0AE1`..`0x0AE5`. With the precompiles live, a full Falcon-1024 verify-and-record transaction measures 145,496 gas (0.87% of the cap) and ML-DSA-44 measures 351,050 gas (2.09%), both well within the per-transaction cap.
## Motivation ## Motivation
@ -333,7 +333,7 @@ The two schemes that were view-only in pure Solidity now record on-chain with wi
## Security Considerations ## Security Considerations
**Wrap audited implementations.** The precompiles MUST wrap a maintained, audited native cryptographic library (Bouncy Castle). AERE MUST NOT hand-roll the native PQC verify. The Solidity verifiers are the differential oracle, not the security boundary; the security boundary is the wrapped native library plus the parsing adapter. **Wrap a maintained native implementation; do not hand-roll.** The precompiles MUST wrap a maintained native cryptographic library (Bouncy Castle). AERE MUST NOT hand-roll the native PQC verify. AERE cannot cite an audit of the library it ships, `bcprov-jdk18on`: it is not a FIPS validated cryptographic module and no published third-party review of it is known to us (corrected 2026-09-11; the earlier wording of this paragraph called it audited). What is citable is byte-for-byte agreement with the NIST KAT and ACVP vectors in both directions, recorded in `AERE-NIST-VALIDATION-STATUS.md` section 3.4. The Solidity verifiers are the differential oracle, not the security boundary; the security boundary is the wrapped native library plus the parsing adapter.
**External audit before securing material value.** These precompiles MUST be externally audited before they secure material value on mainnet. AERE has an internal self-audit only; it has not had an external audit of its contracts or client changes yet. The precompiles are now live on mainnet 2800 (block 9,189,161) but MUST be treated as unaudited and used only where a failure is not financially material until an external audit lands. **External audit before securing material value.** These precompiles MUST be externally audited before they secure material value on mainnet. AERE has an internal self-audit only; it has not had an external audit of its contracts or client changes yet. The precompiles are now live on mainnet 2800 (block 9,189,161) but MUST be treated as unaudited and used only where a failure is not financially material until an external audit lands.