PQ Transaction Signatures #006
Transcript
- Simon ZKNOX
2²⁴ :-)
- Kenneth
Where can I access all these and try them ?
- Antonio Sanso
- Kenneth
❤️
- Kenneth
May I also have the repo url if they are open sourced
- Simon ZKNOX
This is the cost of the precompile without the call data, right? A Falcon signature is 666B which means at least 10k additional gas in practice?
- Giulio
- Giulio
- Oleg Lodygensky
Is there any work to standardize PQWallet. There are different paths, different algorithms and I think it would be interesting to have (1) a discovery mechanism so that an endpoint would publish its requirements and features (used library (OQS?); available algorithms etc.) And (2) a « standardized » API. e.g /createwallet, /signtx etc
- Giulio
I think signing time is not important
- Simon ZKNOX
Agreed with this! You trade verification cost against number of hash for the signer :-)
- Lumi | Wonderland
Reacted to "Agreed with this! ..." with ❤️
- Simon ZKNOX
Replying to "I think signing ti..." On a HW wallet, it does if signing takes 10 min 🤡
- Giulio
Replying to "I think signing time..." nvm
- Simon ZKNOX
Reacted to "Agreed with this! ..." with 🧉
- Yannick Seurin (Ledger)
KeyGen for SLH-DSA-128s (2^64 sigs) is currently 50sec
- Simon ZKNOX
but this will increase with a 2²⁴ version
- Yannick Seurin (Ledger)
Indeed, will need to test it
- Simon ZKNOX
Reacted to "Indeed, will need ..." with 👍
- Oleg Lodygensky
no
- Oleg Lodygensky
maybe Hadrien Croubois ( ? )
- Oleg Lodygensky
he works at OpenZeppelin
- Oleg Lodygensky
yes
- Matteo Vicari
Certora
- Oleg Lodygensky
I will ask him
- Matteo Vicari
We have pretty interesting updates coming soon on the ephemeral keys design, including specs, hopefully ready for the next call!
- Giulio
It’s dangerous if someone makes a tx that hangs in the txpool for days. Can happen with high congestion
- Giulio
I had a tx pending for 3 days back in 2021
- Gottfried Herold
I am also concerned about Ephemeral keys + censorship (essentially, if your transaction is refused from inclusion, attackers have more time)
- Matteo Vena
It depends on the context. Ephemeral keys for example are currently enough for rollups with private sequencers
- Nico C
Hello everyone sry being late
- Simon ZKNOX
No it was a bit different
- Simon ZKNOX
the link is here if you are interested: https://www.youtube.com/watch?v=FW5gkC9TwRg Deploy and send a tx using PQ sig in clear-signing :-)
- Nico C
Will do !
- Alexandre Roque
In the ephemeral key setting you still need to publish the pub keys map in advance, no? what impedes a CQRC to revert a couple of pub keys and then front run when the time is right? It seems to work if we assume the user will rotate often and in a short time-frame
- Matteo Vicari
Replying to "In the ephemeral key..." The hash of public key , like and address
- Simon ZKNOX
It's mostly the same as before, but we showed the ledger integration. I don't think it makes sense to do a demo here as it was mostly already presented
- Gottfried Herold
Re: only using Ephemeral keys for low-value transactions: IIUC, what matters is the value of the account, not the value of the transaction.
- Alexandre Roque
Reacted to "The hash of public k..." with 👍
- Alexandre Roque
Reacted to "Re: only using Ephem..." with 👍
- Yannick Seurin (Ledger)
I was thinking of https://github.com/Verified-zkEVM/VCV-io (@Nico C you're probably aware of it)
- Yannick Seurin (Ledger)
For hash-based sigs there has been work in EasyCrypt: https://eprint.iacr.org/2026/134
- Nico C
Reacted to "I was thinking of ..." with 👍
- Lumi | Wonderland
Thank you everyone! 🤍
- Alexandre Roque
Thanks!
- Ottie | Wonderland
Thanks!
- Simon ZKNOX
Thanks, see you!
Call summary
Targets
- •Two weeks - Next PQTS breakout with Matteo's ephemeral key updates - 00:50:18
Decisions
- •Lesson learned: NTT/LEGO abstraction approach doesn't work for PQ signatures - 00:14:36
- •Solidity contracts for PQ verification must be formally verified, not precompiles - 00:43:06
Highlights
- Strategy Discussion:
- ·Proposed dual approach: ephemeral keys for low-value, Dilithium for high-value transactions - 00:32:23
- ·Ephemeral key security concerns: censorship attacks and long mempool times - 00:36:10
- ·Formal verification critical for Solidity-based PQ signature contracts - 00:42:48
- Hardware Constraints:
- ·NIST SLHDSA-24: ~6 minutes signing time on Ledger hardware wallet - 00:27:18
- ·New NIST parameters still impractical: millions of hashes needed per signature - 00:38:25
- ·Custom Keccak-based parameters achieve 100-1000x faster signing than NIST proposal - 00:39:14
- Protocol Developments:
- ·Frame transaction/native AA no longer headliner for Hegotá fork - 00:04:01
- ·NIST released limited-use SLHDSA parameters: 2^24 signatures, ~3-4KB size - 00:04:36
- Implementation Updates:
- ·Daisugi testnet live: Erigon node with Falcon/Dilithium/ephemeral ECDSA support - 00:06:52
- ·NTT/LEGO approach requires scheme-specific precompiles; abstraction doesn't work well - 00:14:21
- ·Direct precompiles much lower gas than NTT, especially Dilithium (~100k difference) - 00:17:41
Action Items
- •Nico C - Publish EVM-friendly SLHDSA parameter research with Keccak instantiation - 00:40:02
- •Ethereum Foundation representatives - Send NIST feedback at tomorrow's workshop on hash function crypto-agility - 00:41:23
- •Simon ZKNOX (future call) - Present full Dilithium ledger integration round-trip demo - 00:50:43
Key decisions
Frame transaction/native AA no longer headliner for Hegotá fork
headlinerFrame transaction and native Account Abstraction were removed as headliner features for the Hegotá fork.Daisugi testnet live: Erigon node with Falcon/Dilithium/ephemeral ECDSA support
DaisugiThe Daisugi testnet was launched featuring Erigon nodes with support for Falcon, Dilithium, and ephemeral ECDSA.Lesson learned: NTT/LEGO abstraction approach doesn't work for PQ signatures
The NTT/LEGO approach was found to require scheme-specific precompiles, making abstraction ineffective for Post-Quantum signatures.Solidity contracts for PQ verification must be formally verified, not precompiles
The group decided that Solidity contracts used for PQ verification require formal verification rather than relying on precompiles.
AI Disclaimer: Some content or metadata on EIPsInsight may be AI-inferred or automatically compiled. If you find any discrepancy, please contact us at dev@avarch.org.