Why Signature Aggregation Is Key to Scalable PQ Blockchains

Signature size explodes: PQ algorithms like Dilithium and Falcon produce signatures 10-100x larger than ECDSA, making them impossible to verify on-chain at scale.

Aggregation is the only path: The solution is not faster hardware, but cryptographic signature aggregation, which compresses thousands of signatures into a single, verifiable proof.

Current models fail: L2 rollups like Arbitrum and Optimism rely on cheap signature verification; their cost models collapse under PQ signature bloat without aggregation.

Evidence: A single Dilithium2 signature is ~2.5KB; verifying 10,000 in a block consumes ~25MB of calldata, exceeding Ethereum's current block gas limit by orders of magnitude.

Post-quantum signatures are massive. A single Dilithium2 signature is ~2.5KB, dwarfing a 64-byte ECDSA signature. This 40x inflation makes block propagation and state growth untenable for high-throughput chains like Solana or Arbitrum.

Aggregation is a data compression primitive. Protocols like BLS signature aggregation or SNARK-based proof systems (e.g., zkSync's Boojum) compress thousands of signatures into a single, constant-sized verification object. This transforms O(n) growth into O(1).

The alternative is economic failure. Without aggregation, a network's useful throughput is capped by its gossip layer's ability to transmit megabyte-sized blocks. This creates a direct trade-off between security (quantum-resistance) and scalability that only aggregation resolves.

Evidence: StarkWare's SHARP prover aggregates Cairo program executions. A single STARK proof can verify a batch of ~1M transactions, making the per-transaction verification cost negligible and enabling the scale of dYdX.

Post-quantum signatures are massive. A single Dilithium2 signature is ~2.5KB, dwarfing ECDSA's 64 bytes. Without aggregation, a 10,000-validator consensus message becomes 25MB, making networks like Cosmos or Ethereum untenable.

Aggregation compresses, not eliminates, cost. Protocols like BLS or BN254 merge signatures into a single proof, but the verification workload shifts to provers. This creates a new bottleneck at the aggregation layer, trading network bandwidth for compute.

The trade-off is latency for throughput. Real-time aggregation for fast chains like Solana is impossible; signatures must be batched. This introduces a deterministic delay, a core design constraint for any PQ L1 or L2 like Arbitrum.

Evidence: StarkWare's experiments show verifying 1,024 Dilithium signatures natively takes ~1.5 seconds on a server. Aggregation reduces this to ~10ms, but the prover time grows linearly with the batch size, defining the system's scalability ceiling.

Hybrid signatures are mandatory. Pure lattice-based signatures like Dilithium increase block size by 100x, making them unusable for consensus. The only viable path combines a fast classical signature (Ed25519) with a quantum-resistant component, creating a dual-proof system that maintains current throughput.

Aggregation moves off-chain. On-chain verification of PQ signatures remains prohibitive. The solution is a modular aggregation layer, similar to EigenLayer for restaking, where specialized provers batch thousands of signatures into a single proof for the base chain.

This mirrors L2 scaling patterns. Just as rollups move execution off-chain, signature aggregation moves verification off-chain. Projects like Succinct Labs and Avail are building generalized proof aggregation layers that will become critical infrastructure.

The end-state is protocol abstraction. Developers will call a verifySignature function; the underlying system will dynamically route to the most cost-effective hybrid scheme and aggregator network, abstracting cryptographic complexity entirely.