AERE PQC Wallet

Post-quantum identity, one front door

A self-contained reference wallet for AERE Network's live post-quantum stack on chain 2800. Generate a NIST Falcon-512 root in your browser, register it with on-chain proof-of-possession, issue revocable agent-DID sessions, and set quantum-durable guardians. Every cryptographic step is the exact @aere/sdk code, bundled inline.

Network
connecting…
Block
…
Registry keys
…
DID sessions
…

setup Owner identity

The address the post-quantum keys bind to. The proof-of-possession challenge commits to it, so the account that pays gas is the owner. Paste your own address, or generate a throwaway demo address for the read-only walkthrough.

1 Falcon-512 root quantum-durable

A NIST Falcon-512 keypair is generated client-side (897-byte public key). In the recommended custody mode the secret is stored only as an AES-256-GCM ciphertext unlocked by your passphrase (PBKDF2-SHA256, 600k iterations), with no seed phrase, and the secret never leaves this device unencrypted.

2 Register with proof-of-possession

Publish the root public key in AerePQCKeyRegistry. The wallet reads your live identity nonce, derives the PoP challenge locally, and cross-checks it against the on-chain view before signing, proving SDK/contract parity live. The Falcon signature is verified locally too, so no gas is wasted on a bad envelope.

3 Agent DID + session key

Open an AereAgentDID rooted in the Falcon key, then issue a short-lived, revocable secp256k1 session key (scope + spend cap + expiry). Issuance is Falcon-PoP-gated; day-to-day actions are a cheap ecrecover. The issuance challenge and action digest are both cross-checked against the live views.

4 Quantum-durable guardians

Set an M-of-N recovery committee where every guardian is a NIST PQC key. A recovery is authorized by 2 distinct guardians PQC-signing a domain-separated challenge, then executes after a 48-hour timelock. The AerePQCSocialRecoveryModule contract and client ship in the repo; the module is not yet deployed to mainnet, so the module address below is a placeholder and only the calldata / challenge are shown.