Benchmarking SLH-DSA STARK Aggregation

A bitcoin-dev mailing list post putting numbers on Ethan Heilman's earlier proposal to aggregate a block's post-quantum signatures into a single STARK proof. The pseudonymous author built a proof-of-concept that verifies N SLH-DSA (FIPS 205) signatures inside RISC Zero's zkVM and emits one succinct proof.

The headline results: proof size grows sublinearly (218 KiB for 1 signature, 454 KiB for 512 — versus 3.8 MiB of raw signatures), verification stays constant at ~12–15 ms, but proving costs ~3.1 seconds per signature on a high-end consumer GPU (RTX 5090). At that rate a full block would take over two hours to prove on one GPU, which the author is candid is "too slow as-is" — while noting this is a general-purpose-zkVM upper bound, and sketching three routes to close the gap: a dedicated prover circuit, proving transactions as they enter the mempool so only a final aggregation remains at mining time, and multi-GPU clusters.

The post also weighs NIST-standardized SLH-DSA against a bitcoin-optimized SPHINCS+ variant (roughly 3× fewer hash calls, so cheaper to prove), leaning toward the standard for its vetted implementations and hardware support. The one reply, from Heilman, asks how the numbers change with a STARK-friendlier hash function. The exchange speaks to a concern raised in the original thread: whether proving costs would advantage large miners.