Post-Quantum Signatures on Ethereum Just Got 6.6× Cheaper

Fireblocks has developed a FIPS 204-compliant ML-DSA-44 signature verifier for Ethereum’s EVM, reducing gas consumption to 1.23 million per verification from the prior 8.09 million baseline. The optimization was achieved through an autonomous research process involving 144 agents over nine days, with costs recouped after fewer than 900 onchain verifications at average 2024 gas prices. The project addresses Ethereum’s shift away from native signature verification, necessitating contract-based post-quantum solutions as the protocol moves to deprecate ECDSA entirely. The verifier reads a 20,545-byte expanded public key, deployed once at approximately 4.1 million gas, with verification costs now significantly lower than previous implementations.

The breakthrough stems from algorithmic and EVM-specific optimizations, including unrolling Keccak-f[1600] permutations into straight-line code with baked-in constants and storing state in four duplicated 64-bit lanes to simulate rotation without dedicated opcodes. These changes reduced the gas cost per permutation from 153,000 to 41,700, with nine permutations totaling 1.38 million to 370,000 gas. Further gains were achieved by packing four 23-bit polynomial coefficients into a single 256-bit word for arithmetic operations, avoiding unnecessary bit shifts and reducing gas overhead during multiplications and reductions.

Additional savings came from restructuring the number-theoretic transform (NTT) used in ML-DSA-44. By processing multiple layers of the 256-point transform on the stack before storing results, the team reduced gas consumption for a forward NTT from 182,000 to 45,700. The signature’s polynomial z, containing 1,024 coefficients stored as 18-bit fields, was also optimized by packing four fields into a single 72-bit word, eliminating redundant byte loads and bounds checks, lowering costs from 940,000 to 86,000 gas.

Memory expansion costs were addressed by avoiding large unpacked data structures. Instead of loading a 128KB expanded key into memory, the team copied rows incrementally into a 5KB scratch space using EXTCODECOPY, reducing peak memory usage from 953KB to 41KB. This cut memory-expansion gas fees from 1.8 million to 7,000. While the code remains unaudited research, the optimizations demonstrate a feasible path for deploying post-quantum signature verification on Ethereum today, pending further security review.