Host function for Falcon (FN-DSA) & LaBRADOR support

[gnosed]

Abstract

Falcon (Fast Fourier lattice-based compact signatures over NTRU) is a lattice-based signature scheme selected by NIST as a standardized post-quantum (PQ) signature scheme. It offers the most compact PQ signatures currently available, with signature sizes of ~666 bytes and public key sizes of ~897 bytes for Falcon-512, meeting NIST Level I security requirements.

While large-scale post-quantum threats may not be imminent, regulatory pressure makes it increasingly important for TradFi actors settling real-world assets (RWAs) on-chain to prepare for the transition and demonstrate PQ readiness.

This discussion outlines a clear path toward adding Falcon as a host function, making it compatible with Soroban Smart Accounts at the application layer, as well as enabling protocol-level integration by extending its functionality with a signature aggregation scheme based on the LaBRADOR proof system. According to the C LaBRADOR implementation and this EthResearch post, this approach enables compact proofs of approximately ~74 kB for aggregating 10,000 Falcon-512 signatures. However, it incurs a proving time of ~6 s and a relatively slow verification time of 2.7 s. In contrast, hash-based signature aggregation can offer faster verification (~108 ms) at the cost of a larger proof sizes (~128–1.7 MB depending on the optimization level of the STARK; custom circuit vs VM).