Systems anchoring data from IoT devices on Ethereum require a path to post-quantum authentication, as field units deployed now will still be operating when quantum computers pose a threat. New research measures the cost of this transition, finding that signing every record costs 8.7 times as much as with current elliptic-curve cryptography, even with a proposed ML-DSA precompile, because the “calldata floor” currently dictates the price, not verification complexity.

When devices sign Merkle roots over 100 records, a standard LMS verifier costs approximately 3,350 gas per record, compared to 245 gas for ECDSA in the same design, and this cost remains unaffected by planned Ethereum repricing changes.

Device-Signed Merkle Roots Reduce IoT Data Costs on Ethereum

Device-signed Merkle roots offer a substantial reduction in data costs when anchoring Internet of Things records on Ethereum, posting between 27.9 and 29.5 bytes of data per record compared to 2,965 bytes for per-record signatures using ML-DSA-44. This efficiency stems from a shift in focus from verifying individual signatures to validating a single signature representing the root of many records, a technique that significantly minimizes on-chain data requirements.

The reduction represents a 40- to 100-fold decrease in data posted to Ethereum, a critical factor for scalability and cost-effectiveness, particularly when using layer-2 rollups. Even in the worst-case scenario, with 4963 gas per record, device-signed roots still offer a viable path toward post-quantum security. The research demonstrates that at k = 1,000 records, the cost drops to 1,791 gas per record when every record hash is published, though this requires more on-chain data.

The choice between signature schemes becomes less critical on rollups where execution costs are low, as the primary expense shifts to the data posted to Ethereum. “For ML-DSA-44, per-record signatures post 2,965 bytes per record against 28–73 bytes with device-signed roots,” the paper states, emphasizing the data volume difference.

A hybrid approach combining ECDSA and ML-DSA-44 incurs an additional 2.5% gas cost, suggesting a potentially practical near-term migration strategy for existing systems seeking to integrate post-quantum security without incurring massive performance penalties. This incremental approach could ease the transition for developers and minimize disruption to existing infrastructure.

ML-DSA, Falcon, SLH-DSA Performance on x86-64 and ARM64

ML-DSA, Falcon and SLH-DSA exhibit distinct performance characteristics on both x86-64 and ARM64 architectures, impacting their suitability for resource-constrained IoT devices anchoring data on Ethereum. Device-side benchmarks reveal that ML-DSA offers fast signing and verification, but requires larger keys and signatures, 1,312 and 2,420 bytes for the ML-DSA-44 variant at NIST security category 2, while Falcon achieves smaller signatures of 656 bytes, though its signing process relies on floating-point Gaussian sampling.

SLH-DSA, a conservative option, necessitates signatures ranging from 7,856 to 17,088 bytes at category 1, demonstrating a trade-off between security level and data transmission overhead. The choice of signature scheme is further complicated by Ethereum’s current execution rules, specifically the EIP-7623 calldata floor and EIP-7825 transaction cap, and the upcoming calldata repricing scheduled for the Glamsterdam upgrade. These factors significantly influence the on-chain costs, with the calldata floor often proving more impactful than verification complexity itself.

The research combines device-side measurements with reproduced costs of open-source Solidity verifiers, alongside a new standard-compliant LMS/HSS verifier for SHA-256 and SHA-256/192, to provide a comprehensive cost analysis. Complete transactions were executed on an Osaka-rule EVM, priced using both current verifiers and proposed precompiles, to model real-world deployment scenarios.

The study highlights that ML-DSA is stateless and simpler to implement on devices, while Falcon, despite its smaller signatures, presents challenges due to its reliance on secure floating-point Gaussian sampling on microcontrollers, and SLH-DSA is a conservative fallback option. “ML-DSA is stateless and simpler on devices,” the research notes, emphasizing its ease of integration into existing IoT ecosystems.

Post-Quantum Signature Sizes Impact Ethereum Calldata Pricing

The cost of securing Internet of Things data on Ethereum with post-quantum cryptography is heavily influenced by signature size, with current execution rules prioritizing calldata costs over verification complexity. This floor, which sets a minimum price for data included in transactions, currently overshadows any potential gas savings from optimized verification processes.

The study details device-side performance of several post-quantum signature schemes, including measurements for ML-DSA, Falcon, SLH-DSA, LMS and XMSS, using Cortex-M4 and x86-64 architectures. The research demonstrates that a hybrid approach, combining ECDSA with ML-DSA-44, introduces an additional 2.5% gas cost, offering a potentially viable path for incremental adoption of post-quantum security.

Ethereum Gas Costs with EIP-7623 and EIP-7825

Employing proposed precompiles, ML-DSA-44 signatures register 1,031 gas per record, a cost offset by only a 2.5% increase when combined with existing ECDSA schemes, suggesting a viable incremental path toward post-quantum security for Ethereum-anchored data. This finding demonstrates that full deployment of post-quantum device authentication is achievable on Ethereum without requiring changes to the core protocol, provided latency requirements for batching and data availability align with specific application needs.

However, the economic viability of signing every individual IoT record with a post-quantum signature remains challenging even with precompiles, as the EIP-7623 calldata floor dictates the price per signature byte. Analysis reveals that the scheduled repricing under the Glamsterdam upgrade will exacerbate this issue, increasing the cost of individual signatures.

The study modeled the impact of EIP-8037 and EIP-8038, which will increase the cost of on-chain key storage, registration, and per-batch root writes, finding that the break-even point for cost-effectiveness shifts accordingly. Researchers also examined the potential of Data Receipt Blobs (DR-B) to reduce costs, estimating that full blobs could add approximately 2 gas per leaf, scaling to 82 gas for a 100-leaf batch, dependent on market pricing.

A shift toward device-signed Merkle roots offers a more promising solution, reducing costs significantly when devices sign roots encompassing over 100 records. Under these conditions, post-quantum authentication can achieve approximately 1,000 gas per record with precompiles and stored keys, or a few thousand gas using a standard LMS verifier available for immediate implementation.

Critically, the cost associated with this standard LMS verifier remains unaffected by the upcoming Ethereum repricing changes, offering a stable and predictable cost structure for developers. “Signing Merkle roots on the device changes this,” the research notes, highlighting the potential for optimization through this approach. The released harness allows for recalculation of these costs as Ethereum’s execution rules evolve, ensuring ongoing accuracy and adaptability.

LMS/HSS Verifier Implementation for SHA-256/SHA-256-192

Signing every record costs 8.7 times as much as ECDSA even with an ML-DSA precompile, because the calldata floor rather than verification sets the price. When each device signs a Merkle root over 100 records, a standard LMS verifier available today costs about 3,350 gas per record, compared to 245 gas for ECDSA in the same design, and it is unaffected by the scheduled repricing, which raises floor-bound designs by up to 1.9 times.

End-to-End Costs: PQ Signatures vs. ECDSA on Ethereum

This allows for potential near-term migration strategies for existing applications without requiring immediate protocol changes, as demonstrated by recent analysis of signature costs on the Ethereum blockchain. The work focuses on the economic feasibility of securing IoT data with post-quantum cryptography, specifically examining the impact of Ethereum’s gas costs and upcoming upgrades on various signature schemes. This finding is surprising given that precompiles are generally expected to significantly reduce computational costs, highlighting the current dominance of data storage costs over processing costs in Ethereum transactions.

This suggests that using existing LMS verifiers presents a significant current cost barrier for post-quantum security, as the cost is not mitigated by planned Ethereum improvements. “Device-signed roots make post-quantum authentication of IoT records deployable on Ethereum today,” the study notes, indicating that the architecture can function with current infrastructure.

Impact of Glamsterdam Upgrade on Post-Quantum Authentication

The Ethereum Glamsterdam upgrade will raise the calldata floor, impacting the economic viability of post-quantum (PQ) authentication schemes for Internet of Things (IoT) devices. Analysis demonstrates that even with the implementation of a precompile, signing every individual record remains costly due to this floor, exceeding the price of equivalent elliptic-curve digital signature algorithm (ECDSA) signatures by a factor of 8.7. While the calldata floor currently dictates the cost of individual signatures, the impact of the Glamsterdam upgrade extends to batching strategies like signing Merkle roots.

However, a hybrid approach combining ECDSA and ML-DSA signatures offers a potential near-term migration path. Implementing this scheme incurs an additional gas cost of only 2.5%.

Proposed ML-DSA and Falcon Precompiles Lower Verification Gas

Proposed ML-DSA and Falcon precompiles offer a pathway to lower verification gas costs, achieving 1,031 gas per record for ML-DSA-44 when implemented, according to the research. This figure, however, represents a substantial cost relative to existing cryptographic methods, as signing every record still requires 8.7 times more gas than ECDSA even with the precompile in place. The primary driver of this cost is not verification complexity, but the Ethereum calldata floor, which dictates the price of signature processing.

The researchers reproduced costs of open-source Solidity verifiers and tested them on an Osaka-rule EVM, alongside the proposed precompiles, to arrive at these figures. “Post-quantum device authentication is therefore deployable on Ethereum without protocol changes, provided that the latency of batching and the data-availability properties of the chosen variant fit the application.”

👉 More information
🗞 Post-Quantum Authentication of IoT Data on Ethereum: Signatures, the Calldata Floor, and Device-Signed Merkle Roots
✍️ Ming-Fong Sie (Master Program in Intelligent Computing and Big Data, Chung Yuan Christian University, Taoyuan, Taiwan)
🧠 ArXiv: http://arxiv.org/abs/2611.08108v1

More like this