# aerenew/pqc-fork - AERE Besu PQC EVM precompiles

Two new native post-quantum precompiles for the AERE Besu PQC fork, built and
KAT-verified on an isolated testnet (2026-07-18). They extend the existing five
(`0x0AE1`..`0x0AE5`). Full write-up: `../docs/PQC-PRECOMPILES-MLKEM-SHAKE-2026-07-18.md`.

| Address | Precompile | KAT |
|---|---|---|
| `0x0AE6` | ML-KEM-768 (FIPS 203) deterministic encapsulation | 25/25 NIST ACVP |
| `0x0AE7` | Falcon HashToPoint (SHAKE256 rejection sampler) | 12/12 (BC vs Python SHAKE256) |

Headline benchmark: native HashToPoint drops a full on-chain Falcon-512 verify from
~9.14M to ~7.19M gas (-21.4%); the HashToPoint step itself drops ~86% (2.28M -> 311k).

## Layout

* `precompiles/*.java` - the two fork EVM precompile classes.
* `besu-pqc-precompiles-mlkem-hashtopoint.patch` - fork -> fork+2 (4 files). Base
  commit `d203201`. Adds the two `Address` constants, registers both in
  `MainnetPrecompiledContracts.populateForFutureEIPs`, and adds the two classes.
* `kat/` - KAT harnesses: NIST ACVP fetch + ML-KEM runner, HashToPoint generator +
  Python SHAKE256 oracle, and a Bouncy-Castle decaps-confirmed ML-KEM backup generator.
* `bench/` - the precompile-backed Falcon verifier variant + gas benchmark (QBFT
  single-node genesis, `make-htp-variant.py`, `bench.py`).
* `vectors/` - the exact vectors used. `results/` - JSON pass counts + gas numbers.
* `setup-fork.sh` / `build-dist.sh` / `run-kats.sh` - reproduce the isolated build.

Solidity view wrapper for `0x0AE6`: `../contracts/contracts/pqc/AereMLKEM768.sol`.

## Reproduce

```
bash setup-fork.sh     # clone besu@d203201, overlay fork EVM layer, add 2 precompiles, emit patch, compile evm
bash build-dist.sh     # ./gradlew installDist (one full build)
bash run-kats.sh        # ML-KEM (NIST ACVP) + HashToPoint (Python cross-check) KATs
bash bench/start-node.sh && python3 bench/bench.py   # Falcon verify gas with/without 0x0AE7
```

## Scope / honesty

BUILT + KAT-verified on an ISOLATED single-validator QBFT testnet only. Mainnet
precompile activation on chain 2800 is founder-gated and out of scope. Live chain,
validators, gold binary, and infra were touched read-only only.