91 lines
3.4 KiB
Markdown
91 lines
3.4 KiB
Markdown
# AIP-13: Post-Quantum Signatures: Falcon and ML-DSA Together, not a Single Lattice Family
|
|
|
|
## Preamble
|
|
|
|
| Field | Value |
|
|
| --- | --- |
|
|
| AIP | 13 |
|
|
| Title | Post-Quantum Signatures: Falcon and ML-DSA Together, not a Single Lattice Family |
|
|
| Author | Aere Network Foundation |
|
|
| Type | Informational |
|
|
| Category | (none) |
|
|
| Status | Final |
|
|
| Created | 2026-07-19 |
|
|
| Requires | 4, 7 |
|
|
| Supersedes | None |
|
|
| Superseded-By | None |
|
|
| Ratification | Foundation-ratified (pre-decentralization) |
|
|
|
|
## Abstract
|
|
|
|
This AIP records the decision to support multiple post-quantum signature schemes
|
|
across two distinct lattice families (Falcon and ML-DSA) plus hash-based schemes,
|
|
rather than standardizing on one. It backfills a decision already live on chain
|
|
2800. The normative mechanism is in AIP-4 (contract suite) and AIP-7 (precompile
|
|
activation); this record captures the decision framing.
|
|
|
|
## Motivation
|
|
|
|
Aere verifies post-quantum signatures on-chain at both the contract layer (AIP-4)
|
|
and, since block 9,189,161, the native precompile layer (AIP-7). A choice of
|
|
scheme family is a bet on a mathematical assumption, and betting on one is a
|
|
single point of cryptographic failure.
|
|
|
|
## Specification
|
|
|
|
Supported families:
|
|
|
|
- **Falcon** (Falcon-512, Falcon-1024): NTRU lattices.
|
|
- **ML-DSA** (Dilithium2 / ML-DSA-44): module lattices with
|
|
Fiat-Shamir-with-aborts.
|
|
- **Hash-based**: SLH-DSA, XMSS, WOTS+.
|
|
|
|
Live mainnet precompiles occupy `0x0AE1`..`0x0AE5`: Falcon-512 `0x0AE1`,
|
|
Falcon-1024 `0x0AE2`, ML-DSA-44 `0x0AE3`, SLH-DSA-SHA2-128s `0x0AE4`, SHAKE256
|
|
`0x0AE5` (**measured**, live from block 9,189,161). `0x0AE6` (ML-KEM-768) and
|
|
`0x0AE7` (Falcon HashToPoint) are **testnet-only and not live on chain 2800**.
|
|
|
|
## Rationale
|
|
|
|
Cryptographic-risk diversification. Supporting both lattice families means a
|
|
cryptanalytic break or a standardization flaw in one does not, by itself, remove
|
|
Aere's ability to verify post-quantum signatures: accounts and settlement
|
|
authorization can migrate to the surviving family. This mirrors the hybrid
|
|
`AereHybridAuth` account, which requires both a classical ECDSA and a Falcon-512
|
|
signature, so that neither a broken curve nor a broken lattice alone suffices to
|
|
forge.
|
|
|
|
**Alternatives rejected.** Standardizing on a single lattice scheme (ML-DSA alone
|
|
as the NIST primary, or Falcon alone for its compact signatures). The cost of
|
|
supporting several schemes is more verifier surface to implement, validate, and
|
|
eventually audit; that cost is accepted deliberately rather than betting the
|
|
network's post-quantum future on a single assumption.
|
|
|
|
## Backwards Compatibility
|
|
|
|
None. Additive.
|
|
|
|
## Security Considerations
|
|
|
|
**Scope boundary (binding).** This is post-quantum at the signature, account and
|
|
application layer only. Consensus remains classical: validators sign secp256k1
|
|
QBFT. The zk verification path is also classical (BN254 Groth16, Shor-breakable).
|
|
**Aere never claims post-quantum consensus.**
|
|
|
|
The verifiers and precompiles carry an internal self-audit only. An external
|
|
audit is pending before they should secure material value. Their assurance today
|
|
rests on bit-for-bit agreement with official NIST KAT and ACVP vectors and on
|
|
cross-checks against independent reimplementations.
|
|
|
|
## Reference Implementation and On-Chain Deployment
|
|
|
|
Contract suite: AIP-4. Precompile activation and addresses: AIP-7. Chain ID 2800.
|
|
|
|
## Errata
|
|
|
|
None.
|
|
|
|
## Copyright
|
|
|
|
Released to the public domain (CC0). No rights reserved.
|