From block 17,047,600 an anchor certificate carries two different post-quantum signature families at once: Falcon-512, which is lattice-based, and SLH-DSA-SHA2-128s, which is hash-based.
Why two
The two families rest on different mathematics. If lattice assumptions fall, the hash-based half still holds. If something is found in the hash-based construction, the lattice half still holds. A single family is a single point of cryptanalytic failure, and the whole point of the anchor is to be the part of the chain that survives.
This was only affordable because the certificate is periodic. A certificate in every block would have cost roughly 1.4 TB per node per year for the hash-based half alone. Once the anchor became every 32nd and then every 128th block, both families fit.
The format
| v1 | v2 | |
|---|---|---|
| From block | 13,014,000 | 17,047,600 |
| Domain | AERE-PQ-ANCHOR-1 | AERE-PQ-ANCHOR-2 |
| Encoding | list of [index, falconSignature] | RLP[2, [[scheme, index, signature], …]] |
| Schemes | Falcon-512 only | 1 = Falcon-512, 2 = SLH-DSA-SHA2-128s |
The v2 digest is keccak256(RLP[domain, chainId, parentNumber, parentHash, BYTES(rlp(certificate))]).
The rules that make it a hybrid rather than a mixture
Three, and they are enforced, not conventions.
- The scheme schedule names which schemes are required at a given height, so a node cannot
quietly drop one.
- The minimum seal count applies to each scheme separately. Six Falcon seals and one SLH-DSA
seal is not a valid quorum.
- Every SLH-DSA seal must sit at an index that also carries a valid Falcon seal from the same
validator. Measured over 400 consecutive anchors.
What it cost, measured
A hash-based signature is large and slow, and both showed up on the live chain.
- Header size: an anchor header carries roughly 53 KB more under the hybrid format.
- Block rate: after the first hybrid anchor the chain slowed from 0.56 to 0.76 seconds per block,
and the parent-plus-anchor cycle cost 8.4 seconds instead of 1.
The cause of the slowdown was not the signature but the hash. SLH-DSA performs millions of short hashes, and the SHA-256 implementation in use was pure Java while the platform's own SHA-256 uses hardware instructions. Moving to the platform digest took signing from 2.7 seconds to 0.6 per validator, with byte-identical signatures, proven by cross-verification in both directions.
The general lesson, which we now apply before adding any primitive to a consensus path: measure its cost on that machine with that implementation, and when a primitive looks inexplicably expensive, look at what it hashes rather than what it signs.