Practical Attestation Technique (PAT)¶
The Practical Attestation Technique (PAT) is a Merkle-based post-quantum signature commitment scheme: it commits a batch of n ML-DSA-44 (Dilithium) signatures to a fixed 100-byte on-chain root, regardless of batch size. The signatures themselves remain in witness data, so the 100-byte proof is a constant-size commitment, not a replacement for the signature payload. PAT is patent pending (Soqucoin Labs Inc.).
The Problem¶
ML-DSA-44 signatures are 2,420 bytes each, 37× larger than Bitcoin's 65-byte ECDSA signatures. A block with 2,000 transactions would require ~4.84 MB for signatures alone, severely impacting throughput, storage, and propagation latency.
No prior system combines post-quantum security with efficient aggregation and consensus-level on-chain verification.
How PAT Works¶
PAT produces a fixed-size 100-byte proof through three innovations:
1. Merkle-Based Signature Commitment¶
Each (signature, public key, message) tuple is committed as a leaf node in a complete binary Merkle tree using domain-separated hashing. This produces a single root hash that commits to all signatures in the batch.
2. Rogue-Key Resistant Public Key Aggregation¶
Public keys are aggregated via collision-resistant hashing, preventing rogue-key substitution attacks where an adversary could forge a valid aggregate. The aggregation is non-linear. Algebraic manipulation is infeasible.
3. Consensus-Level Verification (block attestation)¶
PAT is verified as a block-level attestation. Every block that spends
Dilithium-secured outputs carries a coinbase output committing
SHA3-256(0x02 || proof) over the block's 100-byte batch proof, and every
node recomputes the batch from the block's own data and verifies the
commitment during block validation. The attestation is optional to emit,
verified whenever present, and scheduled to become mandatory at a
consensus-set height.
The signatures themselves are verified natively under witness versions 0
and 1. The OP_CHECKPATAGG opcode (0xfd) remains defined in the script
engine but is non-load-bearing: it is not the validation path and cannot
authorize a spend. Witness v2 outputs are permanently unfundable by
consensus rule, so no value can ever be paid into a PAT commitment. A
commitment can attest that signatures were verified; it cannot substitute
for verifying one.
What the attestation buys operationally: once a block is deeper than the 288-block finality horizon, a node running witness pruning may discard the raw signature data of attested spends while keeping every transaction's base data and the attestation itself. The storage saving of the commitment scheme is realized there, at the node's discretion, without weakening what the network verified.
Proof Structure¶
The PAT proof is exactly 100 bytes, constant regardless of batch size:
| Offset | Size | Field | Description |
|---|---|---|---|
| 0 | 32 | merkle_root |
Root of Merkle tree over (sig, pk, msg) tuples |
| 32 | 32 | pk_agg |
SHA3-256 hash aggregation of all public keys |
| 64 | 32 | msg_root |
SHA3-256 hash of concatenated messages |
| 96 | 4 | count |
Number of signatures (uint32, little-endian) |
On-Chain Footprint¶
The 100-byte proof is a commitment, not a replacement for the signatures. On the chain, witness data carries the full 2,420-byte signatures and every node verifies each one natively; network bandwidth is unchanged by PAT. The reduction is in retained storage: once a block is buried past the 288-block finality horizon, a node running witness pruning may discard the raw signatures while keeping all base transaction data and the attestation. The retained-storage reduction versus keeping raw signatures is roughly constant at ~25× for batches of any meaningful size:
| Batch Size | Retained With Raw Signatures | Retained After Witness Pruning | Reduction |
|---|---|---|---|
| 100 | ~252 KB | ~9.7 KB (base data + attestation) | ~25× |
| 1,024 | ~2.5 MB | ~98 KB (base data + attestation) | ~25× |
The 100-byte root is what is permanently committed at the block level, as a SHA3-256 hash in a coinbase output. The ~25× figure is a storage ratio realized after finality; it is not a bandwidth ratio, and the commitment size alone (constant at 100 bytes) should not be read as the on-chain footprint.
Performance¶
| Operation | Complexity |
|---|---|
| Proof creation | O(n log n) |
| Full verification | O(n) |
| Simple verification | O(1) |
| Proof size | O(1), always 100 bytes |
Security Properties¶
- Post-quantum safe: all operations use SHA3-256 and ML-DSA-44
- Rogue-key resistant: hash-based aggregation prevents key substitution
- Replay resistant: canonical ordering + message binding
- Tamper-evident: independent Merkle root and message root commitments (defense-in-depth)
Patent Status
PAT is patent pending (Soqucoin Labs Inc.). The technique is licensed for use within the Soqucoin blockchain under the MIT license.