LayerZero Labs has introduced Aerie, a research system that can aggregate 32,768 quantum-resistant Falcon signatures in 0.65 seconds on an Apple laptop without GPU acceleration. According to the company's October 16 announcement, the system processes Falcon-512 signatures using 16 worker threads and reaches peak memory usage of 2.1 GiB. The researchers report that a second workload comprising 16,384 Falcon-1024 signatures took 0.63 seconds with similar memory requirements, demonstrating the system's scalability across different signature formats. Aerie's speed makes it fast enough that a single laptop can aggregate roughly an Ethereum slot's worth of signatures on its own.
The system's verification performance shows significant improvements over traditional methods. As reported in the accompanying paper, checking the completed Falcon-512 aggregate took 54 milliseconds on one core, compared with 519 milliseconds for checking the signatures individually. With 16 threads, the corresponding figures were 11.6 milliseconds and 42.9 milliseconds. The researchers describe the batch construction as avoiding recursion, removing the need to create intermediate proofs and combine them through successive rounds, while allowing another node to produce replacement proofs if the original aggregator fails. Aerie's verifier computes each signature's hash itself, requiring only 8 times the verification time of standard Falcon verification on a single core.
Aerie retains a short random value, known as a salt, from each signature so that verifiers can calculate associated hashes directly. According to the paper, the standard aggregate for the 32,768-signature Falcon-512 workload is 1,346 KiB, including salts and headers, with the proof component accounting for roughly 66 KiB. The researchers report that the standard aggregate is 42.1 bytes per signature, approximately 16 times smaller than the padded Falcon signatures it replaces. Even with the salts included, the aggregate costs only about 42 bytes per signature, compared to 666 bytes for Falcon-512 signatures and 1,280 bytes for Falcon-1024 signatures. Some deployments avoid the salt cost entirely, as Algorand's deterministic Falcon makes signing deterministic, allowing replacement of the random per-signature salt with a fixed value.
The research compares Aerie favorably against existing systems. According to the paper, Aerie's Falcon-512 proving throughput is 29 times leanVM's XMSS throughput under comparable conditions, with leanVM aggregating 900 XMSS signatures in 0.51 seconds using all cores. However, leanVM proofs verify faster at 5.9 to 6.5 milliseconds on one thread compared to Aerie's 54-millisecond single-thread result. Against Orthus, an earlier Falcon aggregation system, the team reports 1.7 times smaller proofs, 1.5 times faster proof generation, 38 times faster verification, and proofs 1.7 times smaller on the same server. On the same machine, Aerie aggregates 29 times as many signatures per second (about 50,800 versus 1,770) compared to leanVM.
The development addresses critical industry needs as quantum threats approach. According to the paper, Ethereum currently uses BLS signatures to combine roughly 32,000 validator votes into a small signature, but BLS does not withstand quantum attacks. The National Institute of Standards and Technology lists Falcon as undergoing standardization separately from its finalized ML-DSA and SLH-DSA signature standards, with NIST recommending organizations begin migrating vulnerable systems and identifying 2035 as the endpoint for removing quantum-vulnerable algorithms from its standards. Falcon is far easier to deploy than it was even a year ago, with recent research showing how to implement Falcon signing with fixed-point arithmetic instead of floating-point arithmetic, and NIST now planning to require this approach in the FN-DSA standard.
