Everyone prices post-quantum migration per signature. In consensus that is the wrong unit, and it is wrong by nearly four orders of magnitude.
A BLS aggregate is 96 bytes whether 1 validator signed it or 900,000 did. ML-DSA-65 is 3,309 bytes, about 34x a BLS signature, and 34x is the number that gets quoted as the cost of migrating.
But the baseline was never one signature per signer. It was one signature, total. No standardized post-quantum scheme aggregates: hash-based schemes offer no algebraic structure to exploit, and the lattice aggregation results that do exist attach to Falcon, not to ML-DSA. Substitute like for like at Ethereum's validator count and a slot that carries about 10 KiB of aggregated votes today carries roughly 90 MB.
So the fix is not a smaller signature. It is to stop asking cryptography to aggregate and ask a proof system instead: prove that all N verified, and the cost goes flat again.
Which inverts the selection criterion. While signatures travel on the wire, smallest wins. Once they are verified inside a proof, size stops deciding and provability starts, and the hash-based schemes, the largest candidates, are the ones sitting in the consensus-layer designs.
The smallest signature was only ever the right answer to a question that aggregation had already answered.
- Everyone prices post-quantum migration per signature. In consensus that is the wrong unit, and it is wrong by nearly four orders of magnitude. A BLS aggregate is 96 bytes whether 1 validator signed it or 900,000 did. ML-DSA-65 is 3,309 bytes, about 34x a BLS signature, and 34x is the number that gets quoted as the cost of migrating. But the baseline was never one signature per signer. It was one signature, total. No standardized post-quantum scheme aggregates: hash-based schemes offer no algebraic structure to exploit, and the lattice aggregation results that do exist attach to Falcon, not to ML-DSA. Substitute like for like at Ethereum's validator count and a slot that carries about 10 KiB of aggregated votes today carries roughly 90 MB. So the fix is not a smaller signature. It is to stop asking cryptography to aggregate and ask a proof system instead: prove that all N verified, and the cost goes flat again. Which inverts the selection criterion. While signatures travel on the wire, smallest wins. Once they are verified inside a proof, size stops deciding and provability starts, and the hash-based schemes, the largest candidates, are the ones sitting in the consensus-layer designs. The smallest signature was only ever the right answer to a question that aggregation had already answered.
Really well put. The graph makes it click instantly. Loved this. Once you see the graph, the whole framing changes.
Once again, very valuable information. 👏💯
