Post-Quantum Precompiles
ML-KEM, ML-DSA, SLH-DSA, threshold lattice, and PQ rollup verification
Post-quantum precompiles provide NIST-standardized cryptographic operations at native EVM speed, protecting against future quantum computing threats.
Precompile Addresses
The authoritative PQ block is the LP-4200 0x012200 range. (The earlier 0x0300/0x0600 quasar stubs were retired in favor of this block.)
| Address | Name | Standard | Description |
|---|---|---|---|
0x012201 | ML-KEM | FIPS 203 | Module-LWE key encapsulation |
0x012202 | ML-DSA | FIPS 204 | Single-party lattice signature |
0x012203 | SLH-DSA | FIPS 205 | Hash-based (stateless) signature |
0x012204 | Pulsar | FIPS 204 byte-equal | Module-LWE threshold signature |
0x012205 | P3Q | -- | Rollup-commit PQ verifier; kind-byte dispatch to Pulsar/Corona/Magnetar (NOT a STARK, NOT general consensus PQ) |
0x012206 | Corona | -- | Ring-LWE threshold signature |
0x012207 | Magnetar | FIPS 205 byte-equal | SLH-DSA threshold signature |
0x012208 | HQC | -- | Code-based KEM (family-disjoint backup) |
0x012220 | STARK-FRI | -- | Strict-PQ STARK / FRI / SHAKE verifier |
P3Q (0x012205) is the rollup-commit verifier — see /go-live; STARK-FRI (0x012220) is the trustless STARK verifier.
ML-DSA (FIPS 204)
Lattice-based digital signatures. Three security levels:
| Parameter Set | Security Level | Signature Size | Public Key |
|---|---|---|---|
| ML-DSA-44 | NIST Level 2 | 2,420 bytes | 1,312 bytes |
| ML-DSA-65 | NIST Level 3 | 3,309 bytes | 1,952 bytes |
| ML-DSA-87 | NIST Level 5 | 4,627 bytes | 2,592 bytes |
Lux uses ML-DSA-65 (192-bit security) by default.
ML-KEM (FIPS 203)
Lattice-based key encapsulation mechanism for establishing shared secrets.
| Parameter Set | Security Level | Ciphertext | Public Key |
|---|---|---|---|
| ML-KEM-512 | NIST Level 1 | 768 bytes | 800 bytes |
| ML-KEM-768 | NIST Level 3 | 1,088 bytes | 1,184 bytes |
| ML-KEM-1024 | NIST Level 5 | 1,568 bytes | 1,568 bytes |
SLH-DSA (FIPS 205)
Stateless hash-based signatures. Conservative choice -- security relies only on hash function properties.
| Parameter Set | Security | Signature Size |
|---|---|---|
| SLH-DSA-SHA2-128f | NIST Level 1 | 17,088 bytes |
| SLH-DSA-SHA2-192f | NIST Level 3 | 35,664 bytes |
| SLH-DSA-SHA2-256f | NIST Level 5 | 49,856 bytes |
Hybrid (PQ Identity page, 0x2220-0x2221)
Classical+post-quantum hybrids live on the PQ-identity page, NOT at 0x0610. The hybrid-KEM precompile is at 0x...2221 (X25519+Kyber, LP-2221); hybrid signing is described conceptually on the 0x2220 PQ-identity page.
| Slot | Scheme | Classical | Post-Quantum |
|---|---|---|---|
0x...2220 | Hybrid ECDSA+ML-DSA (PQ identity) | secp256k1 | ML-DSA |
0x...2221 | Hybrid KEM (LP-2221) | X25519 | ML-KEM (Kyber) |
Both halves must verify for the hybrid to pass. Graceful degradation is not supported -- this is intentional for maximum security.