# AIP-13: Post-Quantum Signatures: Falcon and ML-DSA Together, not a Single Lattice Family

## Preamble

| Field | Value |
| --- | --- |
| AIP | 13 |
| Title | Post-Quantum Signatures: Falcon and ML-DSA Together, not a Single Lattice Family |
| Author | Aere Network Foundation |
| Type | Informational |
| Category | (none) |
| Status | Final |
| Created | 2026-07-19 |
| Requires | 4, 7 |
| Supersedes | None |
| Superseded-By | None |
| Ratification | Foundation-ratified (pre-decentralization) |

## Abstract

This AIP records the decision to support multiple post-quantum signature schemes
across two distinct lattice families (Falcon and ML-DSA) plus hash-based schemes,
rather than standardizing on one. It backfills a decision already live on chain
2800. The normative mechanism is in AIP-4 (contract suite) and AIP-7 (precompile
activation); this record captures the decision framing.

## Motivation

Aere verifies post-quantum signatures on-chain at both the contract layer (AIP-4)
and, since block 9,189,161, the native precompile layer (AIP-7). A choice of
scheme family is a bet on a mathematical assumption, and betting on one is a
single point of cryptographic failure.

## Specification

Supported families:

- **Falcon** (Falcon-512, Falcon-1024): NTRU lattices.
- **ML-DSA** (Dilithium2 / ML-DSA-44): module lattices with
  Fiat-Shamir-with-aborts.
- **Hash-based**: SLH-DSA, XMSS, WOTS+.

Live mainnet precompiles occupy `0x0AE1`..`0x0AE5`: Falcon-512 `0x0AE1`,
Falcon-1024 `0x0AE2`, ML-DSA-44 `0x0AE3`, SLH-DSA-SHA2-128s `0x0AE4`, SHAKE256
`0x0AE5` (**measured**, live from block 9,189,161). `0x0AE6` (ML-KEM-768) and
`0x0AE7` (Falcon HashToPoint) are **testnet-only and not live on chain 2800**.

## Rationale

Cryptographic-risk diversification. Supporting both lattice families means a
cryptanalytic break or a standardization flaw in one does not, by itself, remove
Aere's ability to verify post-quantum signatures: accounts and settlement
authorization can migrate to the surviving family. This mirrors the hybrid
`AereHybridAuth` account, which requires both a classical ECDSA and a Falcon-512
signature, so that neither a broken curve nor a broken lattice alone suffices to
forge.

**Alternatives rejected.** Standardizing on a single lattice scheme (ML-DSA alone
as the NIST primary, or Falcon alone for its compact signatures). The cost of
supporting several schemes is more verifier surface to implement, validate, and
eventually audit; that cost is accepted deliberately rather than betting the
network's post-quantum future on a single assumption.

## Backwards Compatibility

None. Additive.

## Security Considerations

**Scope boundary (binding).** This is post-quantum at the signature, account and
application layer only. Consensus remains classical: validators sign secp256k1
QBFT. The zk verification path is also classical (BN254 Groth16, Shor-breakable).
**Aere never claims post-quantum consensus.**

The verifiers and precompiles carry an internal self-audit only. An external
audit is pending before they should secure material value. Their assurance today
rests on bit-for-bit agreement with official NIST KAT and ACVP vectors and on
cross-checks against independent reimplementations.

## Reference Implementation and On-Chain Deployment

Contract suite: AIP-4. Precompile activation and addresses: AIP-7. Chain ID 2800.

## Errata

None.

## Copyright

Released to the public domain (CC0). No rights reserved.