Post-Quantum Ethereum on the Execution Layer
Ethereum Korea One: Genesis · Day 2 · 2026-09-29 · 31:55 · In Korean
How should Ethereum wallet signatures change in the age of quantum computers? At Ethereum Korea One: Genesis, Yoonhyung Lee of Yonsei University CNL walks through the path to a post-quantum execution layer.
Speakers
- Yoonhyung Lee, CNL Researcher, Yonsei University
About this session
Yoonhyung Lee, a co-author of EIP-7885, starts from the structure of hash-based signatures and explains how post-quantum (PQ) solutions for the execution layer have evolved: from an NTT precompile, to ephemeral keys, to proof aggregation in the mempool. He also shares his own research direction: whether verification costs can be lowered while keeping standard signatures unchanged.
Key takeaways
- Lee stressed that the PQ transition is not about picking one algorithm but a system design problem. Signers care about key generation and backup, the network about public key and signature sizes and their effect on gossip and bandwidth, and verifiers about computation and gas costs. A lattice-based Falcon signature is 666 bytes, while a hash-based SLH-DSA signature is about 7.8KB.
- With stateful signatures like XMSS, if state rolls back through a restored backup or simultaneous signing on several devices, the same one-time key (for example, key 42) can sign two different messages, breaking WOTS security and enabling forgery. That is why XMSS fits the consensus layer, where one device keeps signing, while the execution layer, home to user wallets, needs a different approach.
- The execution-layer answer in Ethereum's roadmap (the Strawmap) has moved from an NTT precompile to ephemeral keys, and then to leanSPHINCS and proof aggregation. EIP-7885, which Lee co-authored, offers NTT operations that multiple lattice schemes can share. On a custom OP Stack testnet, it cut Falcon verification from 1.8M to 479K gas (about 73% less) and brought ML-DSA from about 7.8M to 5.7M gas.
- Ephemeral keys keep the account address while swapping the signing key each time. Because ECDSA exposes the public key to quantum attack while a transaction waits in the mempool, the design switched to FORS, a few-time signature. The remaining limits are the state burden of continually rotating signer commitments and the fact that FORS is not a standard scheme.
- The current direction is EIP-8288 (in-mempool signature and proof aggregation) built on frame transactions (EIP-8141), which are confirmed for Hegotá. Verification frames declare a scheme, data, and verification key as dependencies, proofs are recursively bundled in the mempool, and the builder produces one aggregate proof covering the whole block, so nodes verify a single proof instead of each signature.
- To explain the choice of hash-based schemes, Lee cited Vitalik's answer about minimizing the cryptographic primitives the base layer depends on. Advances in binary-field proving have sharply cut the cost of proving standard hashes like SHA and BLAKE (Flock is about 9x faster than Binius64 per its paper, and a golfing challenge beat the paper by another 3 to 4x). Next, Lee plans to batch-prove the SLH-DSA parameter set with the smallest signatures, unmodified, and measure proving time, memory, verification time, and proof size.
Chapters
- Opening and talk overview
- The PQ transition as a system design problem
- NIST standards: lattice-based vs. hash-based signatures
- How hash-based signatures work and the risk of state rollback
- SLH-DSA, a stateless signature
- The evolving roadmap and the NTT precompile (EIP-7885)
- Ephemeral keys and FORS
- Frame transactions and EIP-8288 mempool aggregation
- Why hash-based: keeping standards as proving improves
- Research direction: proving standard SLH-DSA as is