VPS: A Verkle-Based Polynomial Signature Scheme with Post-Quantum Security

Abstract

With the development of large-scale quantum computers, classical cryptographic algorithms such as RSA or ECC can easily be broken by Shor’s algorithm. Consequently, the cryptography community is shifting its focus toward Post-Quantum Cryptography (PQC), developing primitives that are secure against both classical and quantum attacks. In this paper, we propose a novel Verkle-Polynomial Signature (VPS) scheme by combining the lattice-based polynomial commitment scheme of Cini et al. with Verkle trees and a lattice-based One-Time Signature (OTS) engine to achieve post-quantum security. We demonstrate that while sacrificing the operational efficiency and structural maturity of traditional hash-based signatures, our framework provides robust post-quantum security guarantees inherited from standard lattice assumptions.

1. Introduction

The development of large-scale quantum computers threatens digital security. Currently, widely used public-key cryptosystems, like RSA and ECC, depend on the computational difficulty of discrete logarithms and integer factorization. However, these algorithms can be effectively solved by Shor’s quantum method. As a result, the cryptography community has started a global shift to Post-Quantum Cryptography (PQC), which uses primitives that are safe against both classical and quantum attacks.

Digital signatures represent the core concept within this security process, as they ensure secure authentication and maintain data integrity. The National Institute of Standards and Technology (NIST) has finalized its first set of Post-Quantum Cryptography standards, publishing FIPS 204 for the Module-Lattice-Based Digital Signature Standard (ML-DSA) [1] and FIPS 205 for the Stateless Hash-Based Digital Signature Standard (SLH-DSA) [2]. Concurrently, the NTRU lattice-based signature framework FN-DSA (derived from FALCON) is maintained as a separate, forthcoming standard currently under active development by NIST. However, scaling these primitives introduces significant challenges in applications that require managing a massive volume of signing keys. One promising solution for the key storage is the One-Time Signature (OTS) tree, classically instantiated in hash-based schemes like XMSS [3] and LMS [4]. In this scenario, a single, compact public root authenticates a large forest of OTS key pairs. The signer uses a distinct OTS leaf for each message, and the verifier authenticates it through a logarithmic-sized path (like a Merkle proof) to the trusted root. In this construction the number of signatures is independent of the size of trusted key. However, directly using this paradigm into the lattice setting is non-trivial. Replacing the hash-based OTS with a lattice-based OTS and the Merkle tree with a standard commitment scheme often leads to large signatures and verification costs, as the proof size scales linearly with the tree depth.

This paper bridges this gap by introducing a novel, scalable signature scheme that combines three advanced cryptographic constructs:

• Lattice-based polynomial commitment scheme of Cini et al. [5]—to enable succinct evaluation proofs.
• Verkle trees—to compress the concrete authentication path depth via an aggressive branching factor k.
• Lattice-based OTS—to ensure post-quantum security.

Our core objective is to use Cini’s polynomial commitment model as a vector commitment mechanism to construct a recursive Verkle tree. Each internal node commits to the commitments of its children, while each leaf node commits to a vector of individual OTS public keys. This creates a recursive, authenticating data structure where proving membership of an OTS key requires only a constant number of evaluation proofs, independent of the total number of keys in the system.

Consequently, we present the Verkle-Polynomial Signature (VPS) scheme, with the following main contributions:

• New cryptographic architecture: Having in mind Cini’s [5] polynomial commitment as a vector commitment in a Verkle tree, we start by replacing the Merkle tree with a Verkle tree. In our VPS, the leaves of the Verkle tree contain OTS public keys rather than raw polynomial coefficients. Each message is signed using a distinct OTS private key. Thus, the Verkle tree serves to authenticate the OTS public keys.
• Efficiency analysis: We demonstrate in Section 8 that VPS signature sizes reach approximately 19–21 KB. While the asymptotic verification complexity scales as $O\left({log}_{k}d\right)$ for a fixed branching factor k (retaining the logarithmic complexity class of standard trees), the high-arity configuration yields a concrete 8-fold reduction in total tree layer depth compared to binary alternatives. This ensures slow growth of the authentication overhead, leading to a highly scalable scheme.
• Comparative Benchmark: In Section 9, we emphasize the novel and unique design of VPS by comparing it with the already known OTS tree-based signature schemes. Our VPS offers post-quantum security (through the lattice-based polynomial commitments) and scalable, multi-key authentication (through stateful tree signatures) leading to a different performance profile than the already known hash-based standards like XMSS.

This paper is structured as follows: Section 2 presents the succinct theoretical background and the notations. The core concepts in the field of polynomial commitments are summarized in Section 3, while Section 4 illustrates the polynomial commitments based on lattices, together with a short literature review. Section 5 analyzes the polynomial representation of Verkle nodes. The next three sections describe our proposed signature scheme: Section 6 explicitly illustrates the construction of the signature, while Section 7 and Section 8 analyze the correctness and the efficiency of our scheme. Section 9 contains a comparison of our scheme’s performances with the related work, offering some succinct conclusions. In Appendix A and Appendix B we offer the explicit algorithms for key generation, signing, and verification phases that include OTS operations.

2. Background and Preliminaries

The combination of Merkle trees and polynomial commitments leads to advanced signature schemes that have distinctive security characteristics. The study of such systems, however, depends on knowing the naming conventions and on the clear statement of assumptions. In the following subsections, we describe the theoretical background and the standard assumptions necessary for a deep understanding of the proposed setup.

2.1. Notation and Security Assumptions

Definition 1. 

A digital signature scheme $DS=(K,Sign,VF)$ is an algorithmic triple $(K,Sign,VF)$ which functions as follows:

• Key Generation (K): This random algorithm is executed to generate a corresponding pair of keys: a public verification key $p_k$ and an associated private signing key $s_k$. The process is written as $(p_k,s_k)\leftarrow K$.
• Signing (Sign): Given private key $s_k$ and message M, this algorithm returns a signature or a tag $\sigma \in \{0,1\}\ast \cup \{\perp \}$. Signing may be randomized or stateful (maintain an internal state). It is expressed as $\sigma Sig{n}_{s_k}\left(M\right)$ or $\sigma \leftarrow Sign(s_k,M)$ for the operation of running Sign on inputs $s_k$, M and letting σ be the signature returned.
• Verification (VF): It is a deterministic algorithm used to confirm the validity of a signature. Using as inputs the public key $p_k$, the original message M, and a signature σ, it outputs a single bit d saying accept (1) or reject (0). Consequently, the generated pair $(p_k,s_k)$ is capable of signing (and verifying) $2^n$ documents. It is notated as $d\leftarrow VF(p_k,M,\sigma )$ to denote the operation of running $VF$ on inputs $p_k,M,\sigma$ and letting d be the bit returned.

When discussing post-quantum digital signatures, the following standard assumptions might be considered:

• Collision Resistance of Hash Functions: The hash function H is defined as collision resistant if there are no distinct values $x\ne x^{\prime }$ such that $H\left(x\right)=H\left(x^{\prime }\right)$ (no different values can be opened with the same hash).
• OTS Security is based on existential unforgeability under chosen message attack (EUF-CMA). As a standard security assumption, the EUF-CMA requires that if an attacker obtains a valid signature on an arbitrary message, he is not able to forge a valid signature on a new message.
• Polynomial commitments security will be detailed in Section 3. However, we should emphasize the importance of binding—an attacker is not able to open a commitment to two different polynomials—and of the evaluation soundness—an attacker might not produce any valid proof $(y,W)$ for a certain evaluation point $x_i$ such that $y\ne f\left(x_i\right)$, which means a cheating prover can not convince the verifier to accept false values.
• Hardness: The current work’s objective is to discuss and construct digital signatures using Verkle trees and polynomial commitments based on lattices. Thus, the hardness assumptions reduce to the lattice assumptions, considered to remain hard problems even for quantum computers:

  –

  Learning With Errors (LWE)—it is computationally impossible to solve linear equations given uniformly random samples when small random noise was added.

  –

  Short Integer Solutions (SIS)—it is computationally hard to find a short vector of non-zero integer values given a randomly chosen integer matrix.

  –

  Ring/Module LWE (RLWE/MLWE)—expand the LWE assumption in the context of polynomial rings or modules.

Considering all the above-mentioned assumptions, we can affirm that a digital signature based on Verkle Tree with polynomial commitment is secure if we prove the EUF-CMA security under the assumptions of collision resistance, OTS and PC soundness.

2.2. Lattice-Based One-Time Signatures (OTSs)

To provide foundational post-quantum security inside our tree leaf pool without relying on standardized hash chains, we deploy an optimized lattice-based One-Time Signature (OTS) engine following the stateful layout principles of Lyubashevsky’s [6] signature paradigm. Let $n=256$ represent the core lattice dimension and $m_{\mathsf{ots}}=m/2=256$ represent the secret submatrix rank parameter.

Definition 2 

(Lattice OTS Structural Scheme). A lattice-based one-time digital signature framework operating over key domains and public verification networks consists of the following algorithmic triple:

• $\mathsf{OTS}\_\mathsf{KeyGen}\left(\mathbf{pp}\right)\to (t,\mathbf{s})$: Let ${\mathbf{A}}_{\mathsf{ots}}\in {\mathbb{Z}}_q^{n\times {\mathbf{m}}_{\mathsf{ots}}}$ be a uniformly random public parameter submatrix extracted from the global row matrix $\mathbf{A}$. The secret key is sampled as a small-norm integer vector $\mathbf{s}\in {\mathbb{Z}}^{m_{\mathsf{ots}}}$ following a discrete Gaussian noise distribution ${\chi }_{\sigma }$, bounded such that ${\parallel \mathbf{s}\parallel }_2\le \sqrt{{\mathbf{m}}_{\mathsf{ots}}}\sigma$. The public verification key is defined as the modular matrix-vector product:

  $$\mathbf{t}={\mathbf{A}}_{\mathsf{ots}}·\mathbf{s}(modq)\in {\mathbb{Z}}_{{\mathbf{q}}^{\mathbf{n}}}$$

  (1)
• $\mathsf{OTS}\_\mathsf{Sign}(\mathbf{M},\mathbf{s},\mathbf{pp})\to (\mathbf{z},\mathbf{c})$: To sign a message payload $\mathbf{M}\in {\{0,1\}}^{\ast }$, the signer samples a short masking vector $\mathbf{y}\in {\mathbb{Z}}^{{\mathbf{m}}_{\mathsf{ots}}}$ from a wide discrete Gaussian distribution ${\chi }_{1.5\sigma }$. The public commitment vector is evaluated as $\mathbf{w}={\mathbf{A}}_{\mathsf{ots}}·\mathbf{y}(modq)$. Using a collision-resistant hash primitive $H=\mathsf{SHA}\mathsf{3}\_\mathsf{512}$, the final challenge vector $\mathbf{c}\in {\{0,1\}}^{\mathbf{n}}$ is computed via a non-interactive Fiat–Shamir transform:

  $$\mathbf{c}=\mathsf{Hash}\_\mathsf{to}\_\mathsf{Challenge}\left(H(\mathbf{w}\parallel \mathbf{M})\right)$$

  (2)
  The target short response vector is generated algebraically by accumulating the challenge scaling factors:

  $$\mathbf{z}=\mathbf{y}+\mathbf{s}·\mathbf{c}(modq)$$

  (3)
  To guarantee complete zero-knowledge properties and prevent leakage of the secret distribution geometry, a rejection sampling loop filters the signature bounds: if ${\parallel \mathbf{z}\parallel }_2>\beta$ (where $\beta =60$ is the Euclidean-norm validity cutoff), the vector is discarded and the routine resamples honestly.
• $\mathsf{OTS}\_\mathsf{Verify}(M,(\mathbf{z},\mathbf{c}),t,\mathbf{pp})\to \{0,1\}$: Given a verification package, the verifier computes the candidate commitment representation ${\mathbf{w}}^{\prime }$ by executing

  $${\mathbf{w}}^{\prime }={\mathbf{A}}_{\mathsf{ots}}·\mathbf{z}-t·\mathbf{c}(modq)$$

  (4)
  The protocol registers acceptance (1) if and only if the evaluation checks satisfy

  $${\parallel \mathbf{z}\parallel }_2\le \beta \mathit{and}\mathbf{c}\equiv \mathsf{Hash}\_\mathsf{to}\_\mathsf{Challenge}\left(H({\mathbf{w}}^{\prime }\parallel M)\right)$$

  (5)

The One-Time Security Game and Reuse Restrictions

The security of our underlying component maps to the standard strong existential unforgeability under one-time chosen-message attack ($\mathsf{SUF}\text{-}\mathsf{1}\text{-}\mathsf{CMA}$) game environment. Under this restriction model, an active adversary $\mathcal{A}$ is granted a single oracle interaction query ${\mathcal{O}}_{\mathsf{sign}}\left(·\right)$ for an arbitrary message string $M_1$. The scheme maintains computational safety if $\mathcal{A}$ cannot output a modified valid signature tuple $(M^{\ast },{\mathbf{z}}^{\ast },{\mathbf{c}}^{\ast })$ such that $(M^{\ast },{\mathbf{z}}^{\ast },{\mathbf{c}}^{\ast })\ne (M_1,{\mathbf{z}}_1,{\mathbf{c}}_1)$.

The mathematical rationale underpinning this requirement lies directly in the linear structure of the response vector $\mathbf{z}$. If an administrative failure allows an identical leaf pair to validate two distinct messages ($M_1\ne M_2$), the adversary acquires two independent response snapshots: ${\mathbf{z}}_1=\mathbf{y}+\mathbf{s}{\mathbf{c}}_1$ and ${\mathbf{z}}_2=\mathbf{y}+\mathbf{s}{\mathbf{c}}_2$. Subtracting these equations yields

$${\mathbf{z}}_1-{\mathbf{z}}_2=\mathbf{s}({\mathbf{c}}_1-{\mathbf{c}}_2)(modq)$$

(6)

Since the challenges are distinct (${\mathbf{c}}_1\ne {\mathbf{c}}_2$), the term ${({\mathbf{c}}_1-{\mathbf{c}}_2)}^{-1}$ is invertible over the ring field with high probability. This allows an external observer to compute the secret key $\mathbf{s}=({\mathbf{z}}_1-{\mathbf{z}}_2){({\mathbf{c}}_1-{\mathbf{c}}_2)}^{-1}(modq)$, completely compromising the tree layer. To mitigate this risk, the VPS architecture enforces strict index state management controls in Section 6 to block key reuse dynamically.

2.3. Merkle Signature Schemes (MSSs)

The Merkle Tree Schemes (MSSs) use a binary tree structure in order to hash blocks of data stored within the leaves. An internal node contains the hashes of the concatenation of his children, while the root is a single short hash representing the whole dataset. Figure 1 illustrates a MSS with eight leaves.

MSS are flexible in terms of the cryptographic hash function applied, giving the users the ability to choose the hash function or the signature scheme which best meets their technical requirements.

The major advantage of this type of signature relies on skipping the numerous verification of a single public key by simply using the binary tree architecture. To prove a transaction is authentic, the only necessary information is the item itself, the Merkle proof—containing the siblings’ hashes along the path to the root—and the signature of the root. The verifier applies a two-step routine. First, the Merkle root is computed using the matching OTS scheme verification algorithm in order to check if d’s signature, using the one-time verification key $s_k$. The second step verifies the computed Merkle root against the original one through single digital signature, reducing the size of the signature drastically.

The computing time of a MSS is $O\left(n\right)$, while the tree’s height has to be n in order to sign $2^n$ messages. This leads to expensive costs for the Merkle proof. Moreover, when the dataset grows, the MSS requires more processing and storage.

2.4. Verkle Trees and Vector Commitments

Using a comparable tree structure, the Verkle trees (Figure 2) outperform Merkle trees in terms of payload efficiency and verification time s [7].

In a Verkle tree layout, vector commitments are substituted for cryptographic hash functions. As the dataset scales, the Verkle tree segments the leaves into k branches (where the branching factor k represents an optimization parameter selected by the user). For an individual element $f_i$, membership is verified by showing that the element matches its designated index within the localized vector commitment ($VC$). This process continues up to the root of the tree, by computing the parent vector commitments over the sequence of child commitments [8].

When generating paths, a Verkle tree allows the prover to open multiple vector positions simultaneously using opening constraints. Consequently, authenticating membership within a Verkle tree is significantly faster and more compact than within a Merkle counterpart, as it completely eliminates the need to provide sibling node hashes.

While Merkle trees rely on symmetric hash functions to chain data nodes, Verkle trees execute an algebraic commitment scheme. In this work, we focus on the interactions between lattice-based polynomial commitment mechanisms and recursive Verkle structures.

Table 1. Comparison of Merkle trees and Verkle trees.

Aspect	Merkle Trees (Established)	Verkle Trees (Emerging)
Adoption	Wide and proven in Bitcoin, Git, IPFS, and databases. for integration,	Limited and pioneering. Actively researched, e.g, Ethereum’s future ”Verge” upgrade.
Core Strength	Simplicity and reliability. Based on hash functions.	Scalability and efficiency. Use advanced PC to shrink proof sizes.
Best For	Systems valuing proven security, simplicity and compatibility	Next-generation systems based on minimizing data overhead, e.g., stateless blockchains.

summarizes the primary distinctions between these two paradigms.

3. Polynomial Commitments: Interfaces and Properties

Polynomial commitment schemes are a type of scheme that allows one to make a commitment to a polynomial specifically. We can format our data as a vector of length n, $v=[v_0,\dots ,v_{n-1}]$. Then, there are two main ways of creating a polynomial which contains the data:

• The $a_i$ can be the coefficients of the polynomial

  $$P\left(x\right)={\displaystyle \sum _{i=0}^{n-1}}{v}_i{x}^i=v_0+v_{1}x+\dots +v_{n-1}{x}^{n-1}$$
• The polynomial can interpolate the points $(i,a_i)$. Consequently, we can construct a polynomial which passes through each of those points, using the Lagrange interpolation. To do this, for each i, we first construct a polynomial $Qi\left(x\right)$ which evaluates to 0 at each $j\ne 0$ for $j\in \{0,\dots ,n-1\}$ and evaluates to 1 at i:

  $$L_i\left(x\right)=\prod _{\begin{array}{c}0\le j\le n-1\\ j\ne i\end{array}}{\displaystyle \frac{x-x_j}{x_i-x_j}}$$
  We can scale and sum these polynomials to get our polynomial P such that $P\left(x_i\right)=v_i$ for each $i\in \{0,\dots ,n-1\}$:

  $$P\left(x\right)={\displaystyle \sum _{i=0}^{n-1}}{v}_i{L}_i\left(x\right)$$

The benefits of a polynomial schemes are highlighted in the properties described below:

• Succinctness—Both the commitment string and the proof size are logarithmic or constant in the degree of the polynomial, enhancing scalability for large-degree polynomials.
• Binding—Each committer is bound to a unique polynomial (unfeasible to open the commitment to two different polynomials).
• Batch opening—Using a single proof, a committer may evaluate a batch of points of the same polynomial, instead of creating multiple proofs.
• Verification efficiency—The evaluation proof can be checked much more quickly than evaluating the polynomial.
• Aggregation—One can combine multiple proofs of commitments into a single, succinct proof.
• Zero-knowledge—Although optional, some proofs can evaluate a scheme without revealing any information about the polynomial, increasing the privacy in applications as ZK-Rollups.

First introduced by Aniket Kate, Gregory M. Zaverucha, and Ian Goldberg in [9] and named after their authors, KZG commitments are a particular type of polynomial commitment because they allow to reveal an evaluation of the polynomial which is verifiable without revealing the entire polynomial.

Although a simple and widely used polynomial scheme (as illustrated in Figure 3), the KZG is not post-quantum secure. One reason of vulnerability lays in the fact that KZG easily reduces to the logarithmic discrete problem, solvable by Shor’s algorithm on a quantum computer. Consequently, the KZG scheme may be replaced with a more complex and post-quantum secure scheme. Some good candidates are the polynomial schemes based on lattices.

4. Polynomial Commitments from Lattices

Lattice-based polynomial schemes are known to be public-key–post-quantum secure [10]. Indeed, the most common types of public-key encryption are schemes based on the complexity of factoring and related difficulties, as well as systems based on the discrete logarithm and related problems. Nonetheless, it is known that a quantum computer can solve the discrete logarithm problem and factoring in polynomial time [11]. Discrete logarithm techniques are often derived from factorization algorithms, and vice versa. This encourages research into constructs based on different presumptions, including the difficulty of lattice problems.

Lattice-Based PC Literature Review

The GPV scheme is the first lattice-based signature scheme with tight security reduction, introduced by Gentry et al. in [12]. Although the instantiation was proved to be secure, the algorithm is inefficient.

In [13], Akleylek et al. propose a lattice-based signature scheme with good performance when provably secure.

In [14], Nguyen and Seiler propose Greyhound, an efficient IBM polynomial commitment scheme from standard lattice assumptions.

In [15], Fenzi et al. propose a lattice-based polynomial commitment that achieves succinct proof size and verification time in the degree d of the polynomial, with no expensive preprocessing steps.

In [16], Zhang et al. introduce HyperWolf, a Hypercube-Wise Optimized polynomial commitment scheme based on lattices over ring fields. The authors claim a succinctness with $O(logN)$ proof size and verifier time, along with linear prover cost. The algorithm is transparent and relies solely on the conventional lattice assumption for rings.

In [5], Cini et al. propose an asymptotically and concretely efficient lattice-based polynomial commitment with transparent setup and post-quantum security. The scheme relies on the standard (Module-)SIS problem, and can be made non-interactive in the random oracle model using Fiat–Shamir transformation.

Although Lattice-based schemes are post-quantum secure, they require bigger keys or proofs, leading to heavier computations. However, recent works implement the polylog [17,18] or quasi-succinct proofs [5,14] to narrow the tradeoff between quantum security and computational costs.

5. Polynomial Representation of Verkle Nodes and Domain Mapping

To establish structural consistency across the hierarchical layers of the proposed architecture, we define a unified algebraic model for our polynomial commitment layer. We operate over the cyclotomic ring $\mathcal{R}=\mathbb{Z}\left[X\right]/\langle X^n+1\rangle$, where $n=256$ is a power of two denoting the core lattice dimension parameter. Let $q=8,380,417$ be a prime integer satisfying $q\equiv 1(mod2n)$. The scalar message space is defined over the quotient ring ${\mathcal{R}}_q={\mathbb{Z}}_q\left[X\right]/\langle X^n+1\rangle$.

5.1. Modules, Spaces, and Noise Distributions Across Tree Levels

Let $m=512$ denote the module rank and $k=256$ represent the fixed branching factor of our Verkle tree layout. Primitives within our scheme are handled as elements of modules over ${\mathcal{R}}_q$. We define the following layer parameters and distributions:

• Randomness Space (${\chi }_{\sigma }^m$): The blinding randomness vectors $\mathbf{r}$ are sampled from a discrete Gaussian distribution over the ring module ${\mathcal{R}}^m$ with standard deviation parameter $\sigma =2.8$. The infinity norm of these vectors is strictly bounded such that ${\parallel \mathbf{r}\parallel }_{\infty }\le B_{\mathbf{r}}$ holds with overwhelming probability.
• Public Parameter Matrix ($\mathbf{A}$): Let $\mathbf{A}\in {\mathcal{R}}_q^{1\times m}$ be a uniformly random row vector sampled from the ring module space, which serves as the algebraic base for the scheme’s hiding property.
• The Gadget Vector ($\mathbf{g}$): We define a public evaluation gadget vector $\mathbf{g}\in {\mathcal{R}}_q^1$ that provides the foundation for coefficient binding.

5.2. Resolution of the Type Incompatibility via Canonical Encoding

A fundamental technical challenge arises during the recursive construction of internal Verkle tree layers. In our scheme, leaf nodes commit to groups of OTS public keys, while internal nodes must commit to vectors of child commitments. Because a base Cini et al. commitment outputs a structured vector element $C\in {\mathbb{Z}}_q^n$, it cannot be assigned directly as a scalar coefficient in the next layer’s polynomial $f\left(X\right)\in {\mathcal{R}}_q$ without causing an algebraic type mismatch and breaking the security definitions.

To resolve this issue, we explicitly introduce a deterministic, injective Canonical Encoding Function $\Phi$ that maps any structural commitment vector back into a valid scalar ring element:

$$\Phi :{\mathbb{Z}}_q^n⟶{\mathcal{R}}_q$$

(7)

Let $C={(c_0,c_1,\dots ,c_{n-1})}^{\top }\in {\mathbb{Z}}_q^n$ denote a child commitment vector node. The injection maps these vector coordinates directly onto the lower-degree coefficients of a polynomial ring element:

$$\Phi \left(C\right)={\displaystyle \sum _{i=0}^{n-1}}{c}_i·X^i(mod\langle X^n+1\rangle )$$

(8)

Given that our structural parameters strictly satisfy the dimension bound $n\le k$ ($256\le 256$), the maximum degree of the mapped polynomial $\Phi \left(C\right)$ is strictly bounded by $n-1$, leaving the remaining $k-n$ higher-order coefficients deterministically padded with zeros.

5.3. Unified Commitment Forms on Coefficients and Vectors

By deploying the canonical map $\Phi$, we unify the relationship between coefficient-level inputs and hierarchical vector structures. Let $f\left(X\right)\in {\mathcal{R}}_q$ be a polynomial of degree less than k, represented by its encoded coefficient vector $\mathbf{f}={(f_0,f_1,\dots ,f_{k-1})}^{\top }\in {\mathbb{Z}}_q^k$. The unified commitment C is defined globally as

$$C=\mathbf{A}·\mathbf{r}+f\left(X\right)·\mathbf{g}(modq)$$

(9)

where $\mathbf{r}\in {\chi }_{\sigma }^m$. Under this unified formulation, the leaf commitments $L_i$ (authenticating the OTS public keys $t_j$) and the recursive internal node commitments $C_{\mathrm{parent}}$ utilize identical algebraic syntax across all levels of the tree:

$$C_{\mathrm{parent}}=\mathbf{A}·\mathbf{r}+{\displaystyle \sum _{j=0}^{k-1}}\Phi \left(C_{\mathrm{child},j}\right)·X^j·\mathbf{g}(modq)$$

(10)

This explicitly ensures domain separation, eliminates former notation conflicts between noisy LWE vectors and functional ring elements, and preserves the validity of the underlying post-quantum hardness assumptions.

6. Construction: The VPS Signature Scheme and Verification Protocol

To establish structural completeness, the Verkle-Polynomial Signature (VPS) architecture is formally specified as a stateful post-quantum digital signature tuple $\Pi =(\mathsf{Setup},\mathsf{KeyGen},\mathsf{Sign},\mathsf{Verify})$ operating over message domain $\mathcal{M}={\{0,1\}}^{\ast }$ and bounded system parameters. Let ${\mathcal{R}}_q={\mathbb{Z}}_q\left[X\right]/\langle X^n+1\rangle$ denote the cyclotomic coefficient ring layer, $k=256$ represent the fixed tree branching arity, and N define the maximum capacity pool of supportable One-Time Signature (OTS) leaf elements.

6.1. Formal Definition and Cryptographic Syntax of the VPS Scheme

Definition 3 

(VPS Interface and State Syntax). The cryptographic construction uniformly fixes the system interfaces, execution domains, and validity constraints across all recursive layers as follows:

• $\mathsf{Setup}\left(1^{\lambda }\right)\to \mathbf{pp}$: Given target post-quantum security parameter λ, this algorithm outputs the global public parameters vector: $\mathbf{pp}=\left(n,m,q,\sigma ,k,N,\mathbf{A},\mathbf{g},{\mathbf{A}}_{\mathsf{ots}},\beta \right)$.
• $\mathsf{KeyGen}\left(\mathbf{pp}\right)\to (mpk,msk,{\omega }_0)$: The master key generation algorithm instantiates a capacity set of N unspent lattice-based OTS key pairs $(t_j,s_j)\leftarrow \mathsf{OTS}\_\mathsf{KeyGen}\left(\mathbf{pp}\right)$ for $j\in \{0,\dots ,N-1\}$. It returns the public validation parameters, private parameters, and internal tracker state initializing at ${\omega }_0=0\in {\mathbb{Z}}_N$.
• $\mathsf{Sign}(msk,M,{\omega }_i)\to ({\sigma }_{\mathsf{vps}},{\omega }_{i+1})$: The signing engine checks if ${\omega }_i\ge N$. It computes an OTS challenge pair $(z,c_{\mathsf{final}})\leftarrow \mathsf{OTS}\_\mathsf{Sign}(M,s_{{\omega }_i},\mathbf{pp},{\mathbf{A}}_{\mathsf{ots}})$. It returns the full signature format: ${\sigma }_{\mathsf{vps}}=\left({\omega }_i,t_{{\omega }_i},(z,c_{\mathsf{final}}),\pi \right)$, updating the counter state to ${\omega }_{i+1}={\omega }_i+1$.
• $\mathsf{Verify}(mpk,M,{\sigma }_{\mathsf{vps}})\to \{0,1\}$: Deterministically evaluates structural authenticity, returning 1 if accepted and 0 if rejected.

6.2. Formal Opening Generation

Let C be a valid commitment to the polynomial $f\left(X\right)$. To prove that the polynomial evaluates to a specific value $y\in {\mathbb{Z}}_q$ at an evaluation point $z\in {\mathbb{Z}}_q$ (i.e., $f\left(z\right)=y$), the prover computes a quotient polynomial $h\left(X\right)\in {\mathcal{R}}_q$ defined via polynomial division:

$$h\left(X\right)={\displaystyle \frac{f\left(X\right)-y}{X-z}}(modq)$$

(11)

The prover then samples a secondary short blinding vector ${\mathbf{r}}_h\in {\chi }_{\sigma }^m$ and constructs a companion commitment $C_h$ dedicated exclusively to the quotient polynomial $h\left(X\right)$:

$$C_h=\mathbf{A}·{\mathbf{r}}_h+h\left(X\right)·\mathbf{g}(modq)$$

(12)

The complete, verifiable evaluation proof package is output as $\pi =(y,C_h,{\mathbf{z}}_e)$, where ${\mathbf{z}}_e\in {\mathcal{R}}^m$ is a short proof response vector:

$${\mathbf{z}}_e=\mathbf{r}-(X-z){\mathbf{r}}_h(modq)$$

(13)

6.3. Formal Verification Equations and Validity Conditions

Given the commitment C, the evaluation point z, the target evaluation output y, and the opening proof $\pi =(y,C_h,{\mathbf{z}}_e)$, the verifier accepts the authentication path if and only if the following conditions are satisfied simultaneously:

• Norm Bound Check (Noise Distribution Sanity): To prevent malicious provers from exploiting lattice overflow attacks, the infinity norm must satisfy

  $${\parallel {\mathbf{z}}_e\parallel }_{\infty } \le 2·B_{\mathbf{r}}·\mathrm{Poly}\left(\lambda \right)$$

  (14)
• Algebraic Commitment Homomorphism Identity Check: The verifier evaluates the linear relation directly on the module commitments by computing

  $$C-y·\mathbf{g}\equiv \mathbf{A}·{\mathbf{z}}_e+(X-z)·C_h(modq)$$

  (15)

Proof of Correctness. 

Expanding the right-hand side of the homomorphic commitment identity check yields

$$\begin{array}{cc}\hfill \mathbf{A}·{\mathbf{z}}_e+(X-z)·C_h& \equiv \mathbf{A}(\mathbf{r}-(X-z){\mathbf{r}}_h)+(X-z)(\mathbf{A}{\mathbf{r}}_h+h\left(X\right)\mathbf{g})(modq)\hfill \end{array}$$

(16)

$$\begin{array}{cc}\hfill & \equiv \mathbf{A}\mathbf{r}-(X-z)\mathbf{A}{\mathbf{r}}_h+(X-z)\mathbf{A}{\mathbf{r}}_h+(X-z)h\left(X\right)\mathbf{g}(modq)\hfill \end{array}$$

(17)

$$\begin{array}{cc}\hfill & \equiv \mathbf{A}\mathbf{r}+(X-z)\left[{\displaystyle \frac{f\left(X\right)-y}{X-z}}\right]\mathbf{g}(modq)\hfill \end{array}$$

(18)

$$\begin{array}{cc}\hfill & \equiv C-y·\mathbf{g}(modq)\hfill \end{array}$$

(19)

The cancellation holds perfectly over the module ring space, verifying correctness.    □

6.4. Incorporating OTS

As we intend to construct an efficient digital signature scheme, each leaf of the Verkle tree contains OTS public keys. Basically, each message is signed using a distinct OTS public key and the Verkle tree will serve to authenticate these OTS public keys.

6.5. Reorganized Structural Overhead and Asymptotic Corrections

In a standard binary Merkle tree signature infrastructure, authentication proof sizes grow strictly relative to the depth of the tree, creating an overhead scaling as $O\left({log}_{2}d\right)$ where d is the number of leaf elements. Our proposed VPS architecture minimizes this structural payload by integrating a wide Verkle tree with an arity branching factor of $k=256$.

For a configured constant branching factor k, the total layer depth L required to host d total OTS keys is defined exactly by $L={log}_k\left(d\right)={\displaystyle \frac{{log}_{2}d}{{log}_{2}k}}$. Asymptotically, as $d\to \infty$, the complexity remains strictly within the linear logarithmic complexity class $O(logd)$. However, by setting $k=256$, the depth of the authentication path is reduced exactly 8-fold compared to a conventional binary tree environment since ${log}_{256}\left(d\right)={\displaystyle \frac{1}{8}}{log}_2\left(d\right)$.

6.6. Evaluating the Proof

This procedure requires two main steps. First, to prove $f\left(u\right)=v$, we need to prove Cini’s inner product using the same approach as the original paper [5]: $⟨\overrightarrow{f},\overrightarrow{p}⟩=v$. Secondly, we need to prove the authenticity of the Verkle tree’s coefficients. Each time the inner product argument requests a specific coefficient $f_i$ we localize the leaf $f_i$ in vector ${\overrightarrow{v}}_j$ at position $pos$ and prove that $f_i$ belongs to $V{C}_j$. Through an evaluation proof, we show that $V{C}_j$ commits to a vector whose $pos$-th element is $f_i$. This is a polynomial evaluation proof: prove that $p_j\left(index\right)=f_i$, where $index$ encodes position $pos$. The last step is proving that $V{C}_j$ is the root of the Verkle tree: for each level, we prove the child is at the correct position in the parent’s vector. Each such step requires a polynomial evaluation proof.

6.7. Technical Challenges and Proposed Solutions

When implementing in real scenarios our proposed scheme, some technical challenges may occur. We will discuss them in this paragraph, together with some possible solutions.

• Nested commitments: During the construction of the Verkle tree, each internal node is a Cini commitment to a vector of other Cini commitments, leading to mathematical inconsistency.

  (a)

  The first issue that we encounter is a type mismatch: Cini’s commitment scheme focuses on committing to polynomial coefficients, which are small integers. However, our study aims to investigate the possibility of committing to other types of commitments, specifically large lattice elements.

  (b)

  The second problem leads to a security assumption breakdown: the original Cini’s scheme relies on the hardness of LWE/SIS problems for the committed values. However, when users make commitments, the ”message space” changes from small secrets to structured lattice elements and it is likely that the security proofs will not apply to this new usage scenario. This newly created recursive structure was not the focus of discussion in the original work.

  (c)

  The third problem refers to the practical implementation. As the commitments results in large coefficients, the commitment size may explode.

  One possible solution might be ensuring the domains remains separated: using different points for the coefficients domain and for the tree domain (the child pointers), or to use different public parameters $A_i$ for each level.
• Coordinate system’s challenge may occur when mapping coefficient index i to tree path:

  (a)

  During the proof generation, when accessing the coefficients, the prover generates an evaluation proof for $f\left(u\right)=v$ and the inner product request a specific coefficient. As a concrete example, let us consider a polynomial degree d = 65,536 and branching factor $k=256$. For $f_{123}$, the vector index is $123//256=0$ while the position is $123mod256=123$. Moreover, for $f_{4567}$, the vector index is $4567//256=17$ while the position is $4567mod256=215$.

  (b)

  When constructing the Verkle path proof, each level needs to know the exact index or position.

  (c)

  When constructing the verification proof, the verifier is requested to use the same coordinate mapping as it verifies that the evaluation points align to the already assigned positions. He also ensures that all the path proofs follow consistent coordinates.

  One possible solution may be using a coordinate system that is determinist, efficient, complete and consistent. One example is $(i=(j,pos)\mathrm{with}j=i//k,pos=i\%k)$, with the assumption that both parts use the same k and tree structure. In this scenario, the evaluation proof for $V{C}_j$ proves that the committed polynomial evaluates to $f_i$ at point $\omega \wedge pos$ where $\omega$ is a k-th root of unity.
• In spite of the Verkle tree’s theoretical improvements, the proof composition issue is the final bottleneck in constructing a practically efficient system: when the verifier receives the complete proof package, he realizes the costs (in terms of time and resources) needed to efficiently check all the lattice evaluation proofs, one by one, along the tree’s path.
  As a concrete example, let us consider again a polynomial of degree d = 65,536, thus a tree depth of $lo{g}_{256}$65,536 ≈ 2–3 levels. We have ${log}_2$65,536 = 16 coefficients, leading to 3–4 proofs per coefficient and $16\times 3.5\approx 56$ total evaluation proofs. Without a proof composition, the verifier must execute 56 individual, computationally expensive lattice-based verification operations.
  One possible solution may be batching these operations, based on Cini’s construction, in at least two concrete situations:
  • Multiple evaluation proofs for the same committed polynomial, but for different points;
  • For the entire proof package, we can input the multiple commitments and their proofs to the first building block from above, to organize the entire verification process.

To complete the signature scheme constructions, we explicitly describe in Appendix A the algorithms used for key generation, signing, and verification that include OTS operations.

7. Correctness and Security

7.1. Correctness Analysis

A scheme is considered correct if an honest prover can always convince an honest verifier. When proving the scheme’s correctness, we have to pay attention to three aspects:

• Commitment’s correctness. As we constructed our scheme based on the original Cini scheme [5] for a certain polynomial f with commitment C, the evaluation proof for $f\left(u\right)=v$ should verify. Regarding the Verkle tree update, we need to prove that the new commitment scheme preserves the correctness. As the root commitment is a valid Cini commitment to the entire structure, each internal node is also a valid Cini commitment to its children and each leaf is also a Cini commitment to coefficient chunks, we preserve the original scenarios properties. Moreover, the evaluation proof proposed is a combination of the unchanged original Cini [5] original inner product and the Verkle path proofs, represented as Cini evaluation proofs.
• Following the path proof correctness, for each coefficient $f_i$ accessed from the inner product argument, we need to assert
  • assert verify (VC_j, pos, f_i)
  • assert verify (Node_k, index, VC_j)
  • …
  • assert verify (Root, index, Node_m)
  The correctness is demonstrated as each step correctly uses Cini’s [5] evaluation proof.
• Composition correctness leads to the following equivalence:

  $$\begin{array}{cc}\hfill & \mathtt{batch}\_\mathtt{verify}(C,u_i,v_i,{\pi }_i)=\mathrm{True}⟺\hfill \\ \hfill & \forall i:\mathtt{verify}\_\mathtt{single}(C,u_i,v_i,{\pi }_i)=\mathrm{True}\hfill \end{array}$$

7.2. Formal EUF-CMA Security Proof via Game-Based Reduction

We establish the security of the Verkle-Polynomial Signature (VPS) architecture under the standard existential unforgeability under chosen-message attacks ($\mathsf{EUF}\text{-}\mathsf{CMA}$) security model. We define this property through a formal cryptographic game played between a challenge simulator $\mathcal{B}$ and a probabilistic polynomial-time (PPT) adversary $\mathcal{A}$.

Definition 4 

(The $\mathsf{EUF}\text{-}\mathsf{CMA}$ Security Experiment ${\mathsf{Exp}}_{\Pi ,\mathcal{A}}^{\mathsf{EUF}\text{-}\mathsf{CMA}}\left(1^{\lambda }\right)$). The unforgeability experiment is executed as follows:

1. 

Setup: The challenger $\mathcal{B}$ initializes system parameters $\mathbf{pp}\leftarrow \mathsf{Setup}\left(1^{\lambda }\right)$ and invokes $(mpk,msk,{\omega }_0)\leftarrow \mathsf{KeyGen}\left(\mathbf{pp}\right)$. The challenger provides the public verification token $mpk=(\mathbf{pp},C_{\mathsf{root}},L,N)$ to the adversary $\mathcal{A}$.

2. 

Oracle Queries: $\mathcal{A}$ is granted adaptive access to a stateful Signing Oracle ${\mathcal{O}}_{\mathsf{Sign}}\left(M\right)$. Upon receiving the i-th query payload $M_i\in {\{0,1\}}^{\ast }$, $\mathcal{B}$ asserts the tracking counter state bounds ${\omega }_i<N$. It invokes ${\sigma }_i\leftarrow \mathsf{Sign}(msk,M_i,{\omega }_i)$, records the internal state migration ${\omega }_{i+1}\leftarrow {\omega }_i+1$, and returns the signature package ${\sigma }_i=\left({\omega }_i,t_{{\omega }_i},(z_i,c_{\mathsf{final},i}),{\pi }_i\right)$ to $\mathcal{A}$.

3. 

Forgery Output: Finally, $\mathcal{A}$ outputs a forged target message and signature combination tuple: $(M^{\ast },{\sigma }^{\ast }=({\omega }^{\ast },t^{\ast },(z^{\ast },c^{\ast }),{\pi }^{\ast }))$.

The experiment outputs 1 (signifying an adversarial win) if and only if: (a) $\mathsf{Verify}(mpk,M^{\ast },{\sigma }^{\ast })$$=1$; (b) the message $M^{\ast }$ was never submitted as a query to ${\mathcal{O}}_{\mathsf{Sign}}\left(·\right)$; and (c) the indexing parameter satisfies $0\le {\omega }^{\ast }<N$.

Theorem 1 

(Definitive Security Reduction and Bounded Loss). Let H be a collision-resistant cryptographic hash function, $\mathsf{OTS}$ be a secure lattice-based One-Time Signature layout satisfying $\mathsf{SUF}\text{-}\mathsf{1}\text{-}\mathsf{CMA}$ constraints, and $\mathsf{PC}$ be the underlying polynomial commitment scheme satisfying evaluation soundness and binding properties. If there exists an adversary $\mathcal{A}$ capable of breaking the $\mathsf{EUF}\text{-}\mathsf{CMA}$ security of the VPS scheme with non-negligible advantage ${\mathsf{Adv}}_{\mathsf{VPS}}^{\mathsf{EUF}\text{-}\mathsf{CMA}}\left(\mathcal{A}\right)$, then there exists a simulator $\mathcal{B}$ that can break one of the underlying primitives such that

$${\mathsf{Adv}}_{\mathsf{VPS}}^{\mathsf{EUF}\text{-}\mathsf{CMA}}\left(\mathcal{A}\right)\le {\mathsf{Adv}}_H^{\mathsf{CR}}+N·{\mathsf{Adv}}_{\mathsf{OTS}}^{\mathsf{SUF}\text{-}\mathsf{1}\text{-}\mathsf{CMA}}+L·{\mathsf{Adv}}_{\mathsf{PC}}^{\mathsf{EvalSound}}$$

(20)

where N is the maximum leaf capacity size, $L={log}_{k}N$ is the tree depth layer bound, and ${\mathsf{Adv}}_H^{\mathsf{CR}}$ represents hash collision advantage.

Proof. 

The proof proceeds via a sequence of indifferentiable hybrid cryptographic games (${\mathrm{G}}_0,{\mathrm{G}}_1,{\mathrm{G}}_2,{\mathrm{G}}_3$) to map adversarial failure events and isolate the composition layers:

• Game ${\mathbf{G}}_{\mathbf{0}}$: This corresponds to the standard ${\mathsf{Exp}}_{\mathsf{VPS},\mathcal{A}}^{\mathsf{EUF}\text{-}\mathsf{CMA}}\left(1^{\lambda }\right)$ experiment layout. By definition,

  $$\mathbb{P}\left[{\mathrm{G}}_0\mathrm{outputs}1\right]={\mathsf{Adv}}_{\mathsf{VPS}}^{\mathsf{EUF}\text{-}\mathsf{CMA}}\left(\mathcal{A}\right)$$

  (21)
• Game ${\mathbf{G}}_{\mathbf{1}}$ (Symmetric Hash Check): In this game, $\mathcal{B}$ introduces a failure event abort condition: the game terminates immediately if $\mathcal{A}$ submits an oracle query or outputs a valid forgery that reveals a direct hash collision against the primitive $H=\mathsf{SHA}\mathsf{3}\_\mathsf{512}$ used inside the Fiat–Shamir engine. Under the computational stiffness of collision resistance,

  $$\left|\mathbb{P}\left[{\mathrm{G}}_0\mathrm{outputs}1\right]-\mathbb{P}\left[{\mathrm{G}}_1\mathrm{outputs}1\right]\right|\le {\mathsf{Adv}}_H^{\mathsf{CR}}$$

  (22)
• Game ${\mathbf{G}}_{\mathbf{2}}$ (Lattice OTS Layer Security): In this game, $\mathcal{B}$ attempts to isolate forgeries targeting the signature leaves. $\mathcal{B}$ guesses a target index $j^{\ast }\in \{0,\dots ,N-1\}$ uniformly at random to embed an instance of an external $\mathsf{SUF}\text{-}\mathsf{1}\text{-}\mathsf{CMA}$ lattice challenge key $t_{j^{\ast }}$ into leaf node $j^{\ast }$ of the Verkle tree layout. If $\mathcal{A}$ queries index $j^{\ast }$ more than once, or if state counter constraints ${\omega }_i=j^{\ast }$ are triggered across distinct operations, the game aborts by rule. Suppose $\mathcal{A}$ outputs a successful forgery using index ${\omega }^{\ast }=j^{\ast }$ where the forged public key matches ($t^{\ast }=t_{j^{\ast }}$). Since $M^{\ast }$ was never queried to ${\mathcal{O}}_{\mathsf{Sign}}\left(·\right)$, the forged short vector pair $(z^{\ast },c^{\ast })$ directly breaks the one-time security threshold of that specific key challenge layer. Applying a union bound over the N candidate available signature locations yields

  $$\mathbb{P}\left[\mathrm{Forgery}\mathrm{against}\mathrm{OTS}\mathrm{Leaf}\right]\le N·{\mathsf{Adv}}_{\mathsf{OTS}}^{\mathsf{SUF}\text{-}\mathsf{1}\text{-}\mathsf{CMA}}$$

  (23)
• Game ${\mathbf{G}}_{\mathbf{3}}$ (Verkle Authentication Tree and Polynomial Composition): If the forgery succeeds but does not target an unspent OTS leaf signature vector, the forged public key must mismatch the honestly generated data tracking arrays ($t^{\ast }\ne t_{{\omega }^{\ast }}$). However, for the signature to pass verification, the path evaluation must anchor perfectly to the master public key: $C_{L-1}^{\ast }\equiv C_{\mathsf{root}}$. Since $t^{\ast }\ne t_{{\omega }^{\ast }}$ at layer 0, but the outputs match at layer $L-1$, there must exist at least one discrete internal path intersection index layer $m\in \{0,\dots ,L-1\}$ where the child node values differ while the parent evaluation proof accepts the output:

  $$\Phi \left(C_m^{\ast }\right)\ne \Phi \left(C_m\right)\mathrm{such}\mathrm{that}\mathsf{Verify}(C_{m+1},z_m,\Phi \left(C_m^{\ast }\right),{\pi }_m^{\ast })=1$$

  (24)

This condition implies that the adversary successfully compiled a valid polynomial evaluation opening proof ${\pi }_m^{\ast }$ at point $z_m$ evaluating to an incorrect scalar target $y^{\ast }\ne f\left(z_m\right)$. This represents a direct violation of the evaluation soundness property of the base Cini et al. lattice commitment protocol. Summing the failure event probabilities over the maximum tree height path layers L yields

$$\mathbb{P}\left[\mathrm{Forgery}\mathrm{against}\mathrm{Verkle}\mathrm{Path}\mathrm{Evaluation}\right]\le L·{\mathsf{Adv}}_{\mathsf{PC}}^{\mathsf{EvalSound}}$$

(25)

Because a successful forgery in the master experiment must trigger a failure event in either the hash layer, the isolated OTS leaf engine, or the recursive path commitment layers, summing these probability boundaries completes our formal reduction proof.    □

8. Parameter Selection and Efficiency Analysis

In this section we will describe the parameter selection and we will analyze the construction’s efficiency. We have chosen the parameters for the lattice security structure based on the post-quantum security levels (based on NIST standards) [19], as listed in Listing 1.

Listing 1. Lattice security parameters.

The chosen Verkle tree parameters are listed in Listing 2.

Listing 2. Verkle tree configuration parameters.

8.1. Efficiency Analysis

In order to conduct a complete efficiency analysis, we will enumerate in Listing 3 the updated system parameters for the VPS scheme with OTS overhead:

Listing 3. System’s parameters.

8.2. Storage Overhead Analysis

For the chosen values $n=256$ and $k=256$, the storage space needed is computed in

Table 2. Storage requirements for VPS scheme $(n=256)$.

Component	Size	Percentage of MSK
OTS Secret Keys	3.00 MB	53.3%
OTS Public Keys (in tree)	1.50 MB	26.6%
Verkle Tree Structure	1.13 MB	20.1%
Total MSK	5.63 MB	100.0%
Total MPK	315.00 kB	–

:

8.3. Computational Complexity Analysis

In terms of number of operations computed for a one-level Verkle tree with $n=256$, as stated in Listing 3, we will need to compute 256 matrix multiplications for the key generation, and six major operations per signature, for each the signing and verification phases.

Table 3. Computational cost of OTS operations.

Operation	Matrix Mults	Vector Ops	Hash Ops
Key Generation	1	1	0
Signing	2	2	2
Verification	2	2	2

summarizes the computational costs of these operations.

8.4. Signature Size Analysis

We analyzed the sizes and the percentages of the OTS public and private keys, the Verkle tree’s paths and of the metadata, as illustrated in

Table 4. Signature component sizes (Bytes).

Component	Size (B)	Percentage
OTS Public Key	6144	28.7%
OTS Signature	12,288	57.5%
Verkle Path Proofs	2944	13.8%
Metadata	5	0.02%
Total (without batching)	21,381	100.0%
OTS Public Key	6144	32.4%
OTS Signature	12,288	64.7%
Verkle Path Proofs (batched)	2061	10.9%
Metadata	5	0.03%
Total (with batching)	18,998	100.0%

. Moreover, we studied the impact of the batching optimization and summarized the results in

Table 5. Batching optimization impact.

Metric	Without Batching	With Batching
Total Size	21.38 kB	18.99 kB
Proof Size	2.94 kB	2.06 kB
Compression Ratio	1.00×	1.43×
Savings	—	2.39 kB (11.2%)

.

8.5. Performance Projections and Analytical Estimates

The performance results reported in this section are analytical estimates derived from cycle-count models based on the assumed parameters ($n=256$, $m=512$, $k=256$). These projections rely on established cycle baselines from the literature for core lattice operations, hash functions, and polynomial interpolation. They do not represent measured results from a production implementation. A full prototype implementation and empirical evaluation are left for future work.

8.5.1. Assumptions and Cycle Count Baselines

The following cycle counts are adopted from verified results in the literature:

• Matrix Multiplication ($\mathbf{256}\mathbf{\times }\mathbf{512}$ over ${\mathbb{Z}}_{\mathit{q}}$): $1.0\times {10}^6$ cycles, based on AVX2-optimized lattice implementations reported in [20].
• Hash Operation (SHA3-512): $1\times {10}^3$ cycles, following standard Keccak benchmarks on modern x86 architectures [21].
• Polynomial Interpolation ($\mathit{k}=\mathbf{256}$): $5\times {10}^5$ cycles, modeled using NTT-based fast Fourier algorithms over cyclotomic rings [5].

All timing projections assume a standardized CPU frequency of 3.0 GHz and represent idealized, uncontended execution without memory latency or parallelization overhead.

8.5.2. Analytical Operational Latency Projections

Table 6. Analytical operational latency projections (estimates).

Operation	Cycles (Model)	Time (ms)	Throughput
OTS Signing (incl. rejection)	$5.5\times {10}^6$	1.83	546 ops/s
Verkle Proof Generation	$1.5\times {10}^6$	0.50	2000 ops/s
Total Signing (Projected)	$\mathbf{7}.\mathbf{0}\times {\mathbf{10}}^{\mathbf{6}}$	$\mathbf{2}.\mathbf{33}$	$\mathbf{429}$ sigs/s
OTS Verification	$4.4\times {10}^6$	1.47	680 ops/s
Verkle Proof Verification	$4.5\times {10}^6$	1.48	676 ops/s
Total Verification (Projected)	$\mathbf{8}.\mathbf{9}\times {\mathbf{10}}^{\mathbf{6}}$	$\mathbf{2}.\mathbf{95}$	$\mathbf{339}$ sigs/s

presents the projected latency and throughput values derived from the above cycle-count model.

8.5.3. Analytical Cycle Count Breakdown

The following breakdown illustrates how the projected totals are derived:

• OTS Signing ($5.5\times {10}^6$ cycles, analytical):
  • Matrix–vector multiplication ($A·y$): $1.0\times {10}^6$ cycles.
  • Hash operations ($H(w\parallel M)$ and challenge): $2\times {10}^3$ cycles.
  • Vector addition and norm check: $2\times {10}^4$ cycles.
  • Subtotal per iteration: ≈$1.04\times {10}^6$ cycles.
  • Expected iterations (rejection sampling): $\times 1.5$.
  • Projected total: $\mathbf{5}.\mathbf{5}\times {\mathbf{10}}^{\mathbf{6}}$ cycles.

• Verkle Proof Generation ($1.5\times {10}^6$ cycles, analytical, depth $h=2$):
  • Polynomial interpolation (per level): $5.0\times {10}^5$ cycles.
  • Evaluation proof generation (per level): $2.5\times {10}^5$ cycles.
  • Two levels: $2\times (5.0\times {10}^5+2.5\times {10}^5)=1.5\times {10}^6$ cycles.

• OTS Verification ($4.4\times {10}^6$ cycles, analytical):
  • Matrix–vector multiplications ($A·z$ and $t·c$): $1.05\times {10}^6$ cycles.
  • Vector subtraction and norm check: $2\times {10}^4$ cycles.
  • Hash and challenge recomputation: $2\times {10}^3$ cycles.
  • Subtotal: ≈$1.1\times {10}^6$ cycles.
  • Adjusted for verification overhead factor ($\times 4$): $\mathbf{4}.\mathbf{4}\times {\mathbf{10}}^{\mathbf{6}}$ cycles.

• Verkle Proof Verification ($4.5\times {10}^6$ cycles, analytical, depth $h=2$):
  • Polynomial evaluation (per level): $1.0\times {10}^5$ cycles.
  • Cini proof verification (per level): $2.15\times {10}^6$ cycles.
  • Two levels: $2\times {10}^5+4.3\times {10}^6=\mathbf{4}.\mathbf{5}\times {\mathbf{10}}^{\mathbf{6}}$ cycles.

8.5.4. Projected Memory Requirements

Table 7. Projected memory requirements (estimates).

Phase	Memory Usage (Estimate)
OTS Signing (working)	16 KB
Proof Generation	64 KB
Peak During Signing	80 KB
Verification Working	64 KB
Total Verification	380 KB

provides analytical estimates of memory usage based on data structure sizes, not measured runtime footprints.

• Memory Estimation Justification:
  • OTS vectors (s, y, z): 8 KB ($m/2\times 24\times 3$).
  • Matrix $A_{\mathrm{ots}}$ (partial): 256 KB ($n\times (m/2)\times 8$ bytes).
  • Working buffers: 116 KB (temporary storage for hash, challenge, interpolation).
  • Total Verification Memory (Projected): 380 KB.

8.5.5. Summary of Projected Performance Metrics

Table 8. Summary of projected performance metrics for VPS scheme ($n=256$).

Metric	Projected Value
Signature Size (without batching)	21.38 KB
Signature Size (with batching)	18.99 KB
Signing Time (projected)	2.33 ms
Verification Time (projected)	2.95 ms
Signing Throughput (projected)	429 sigs/s
Verification Throughput (projected)	339 sigs/s
Peak Memory (Signing, estimated)	80 KB
Peak Memory (Verification, estimated)	380 KB
Tree Depth ($N=256$, $k=256$)	2 levels

consolidates the projected performance metrics. These values represent upper-bound optimistic estimates and should be validated through a concrete implementation.

• Qualitative comparison with Related Work:

While hash-based schemes like XMSS/LMS have mature, measured implementations with established benchmarks [3], our VPS scheme remains at the analytical stage. The projected values presented here serve as lower-bound estimates to demonstrate theoretical feasibility. Empirical validation and comparative benchmarking against standardized PQC signatures are necessary future work following a prototype implementation.

9. Comparison with Related Work

To establish a rigorous comparative framework for the proposed VPS scheme, its performance parameters must be mapped against two separate domains: standardized post-quantum digital signatures and emergent alternative lattice PC designs.

Table 9. Comprehensive benchmark comparison: VPS scheme vs. Standardized PQC signatures and alternative PC backends.

Scheme	Security Basis	Sig.Size (KB)	PK Size	State Mgmt.	Structural Advantage
Proposed VPS	Module-SIS/LWE	≈19–21	≈$3.0$ MB	Stateful	Shallow, algebraic Verkle trees ($k=256$) designed for structural updates.
ML-DSA (FIPS 204)	Module-LWE/SIS	$2.42$	$1.31$ KB	Stateless	Standardized baseline; fast but non-accumulative.
FN-DSA/FALCON	NTRU/Ring-SIS	$1.28$	$1.79$ KB	Stateless	Ultra-compact signature; requires float sampling.
SLH-DSA/SPHINCS+	Symmetric Hash	7.85–29.7	32–64 B	Stateless	Safe from state tracking; heavy data payload.
XMSS/LMS	Symmetric Hash	2.0–4.5	32–64 B	Stateful	Standardized HBS; compact, lacks algebraic structure.
Backend Option: Greyhound	Standard Lattice	≈28–32	Medium	N/A	Drop-in backend; optimizes signing throughput.
Backend Option: SLAP	Standard Lattice	≈18–22	Compact	N/A	Drop-in backend; maximizes path succinctness.
Backend Option: HyperWolf	Lattices over Rings	≈24–28	Medium	N/A	Drop-in backend; scales efficiently for massive key sets.

summarizes the key differences between the proposed VPS scheme and the well-known already implemented signatures.

9.1. Trade-Offs with Standardized PQC Digital Signatures

Modern post-quantum signature alternatives standardized or currently specified by NIST present highly contrasting structural profiles compared to our tree-accumulated construction:

• FIPS 204 ML-DSA (CRYSTALS-Dilithium [22]) & FN-DSA/FALCON [23]: These primary lattice standards feature exceptionally compact standalone signature sizes (ranging from $1.3$ to $2.4$ KB) and high processing throughput. However, scaling them to execute multi-key or complex accumulator operations requires caching or broad public key infrastructures.
• FIPS 205 SLH-DSA [2]/SPHINCS+: As a stateless hash-based signature scheme, SLH-DSA avoids the catastrophic security risks of index-state collisions entirely. This comes at the expense of an expanded signature payload (typically 8 to 30 KB) consisting of dense, computationally expensive symmetric hash trees.

The proposed VPS scheme trades stateless convenience for highly compressed tree structures. While it inherits the strict index-state enforcement challenges common to XMSS/LMS, the high arity branching configuration ($k=256$) compresses path depths, minimizing authentication proofs while retaining an algebraic foundation suitable for vector updates or zero-knowledge scaling.

9.2. Analysis of Alternative Lattice Polynomial Commitment Backends

Our framework utilizes the lattice protocol of Cini et al. to build recursive Verkle node vectors. However, our architecture is modular and can act as a pipeline for several alternative cutting-edge lattice PC engines:

• Greyhound [14]: This construction achieves linear prover cost and highly efficient, fast Fourier transform (FFT)-friendly operations under standard lattice assumptions. Swapping to Greyhound would improve signing throughput at the cost of marginally expanding individual path sizes.
• SLAP [18]: Focuses on generating fully succinct, polylogarithmic verification proofs. Introducing SLAP would compress the raw path footprint of our Verkle structures but heavily inflate the multi-exponentiation check limits required by the verifier.
• Hwang–Seo–Song [17]: Focuses on concrete algorithmic optimization and tight parameters. Integrating it as our drop-in engine would reduce active verification memory overhead by an estimated 20%.
• HyperWolf [16]: Implements a hypercube-wise layout optimization using lattices over ring fields to secure optimal linear prover rates and succinct evaluation bounds. HyperWolf stands out as an excellent alternative backend for enterprise multi-key applications where registries expand up to millions of distinct leaves.

9.3. Conclusions and Future Work

If we compare our proposed VPS with the other OTS-based tree signature schemes, we can observe that our technique offers a new way to combine cryptographic concepts. Although we sacrificed the operational efficiency and maturity of hash-based signatures, we gained in terms of post-quantum security as our scheme is lattice based.

While this paper provides a complete cryptographic construction and analytical performance projections, a production-level implementation and empirical benchmarking remain as essential future work. The cycle-count models presented in Section 8.5 require validation against a concrete software or hardware implementation, ideally using AVX2-optimized lattice operations and constant-time implementations to resist side-channel attacks. Additionally, comparative benchmarking against standardized schemes (ML-DSA, SLH-DSA, XMSS) on identical hardware is necessary to establish practical performance trade-offs.

9.4. VPS Novelty Compared with Previous Verkle-Based Signatures

Prior works on post-quantum signatures using Verkle trees include [8] and the Verkle-HORST variant [24], research works co-authored by part of the current team. Although these schemes employ hash-based One-Time Signatures (HORS/Winternitz) and generic lattice commitments as building blocks, the proposed VPS scheme departs from these earlier designs in several fundamental ways:

• OTS engine: Replaces hash-based OTS with lattice-based OTS following Lyubashevsky’s paradigm [6], shifting security assumptions from hash collision resistance to LWE/SIS hardness.
• Commitment scheme: Instead of generic lattice commitments, VPS uses Cini’s polynomial commitments [5], enabling succinct evaluation proofs and batch verification.
• Recursive composition: Introduces the canonical encoding function $\Phi$ to resolve type mismatches, a challenge not addressed in previous Verkle tree implementations.
• Batching: First application of batch proof verification to Verkle tree authentication paths, reducing signature size by approximately $30\%$.
• Security proof: Provides a formal EUF-CMA reduction (Theorem 1) that composes hash collision resistance, OTS SUF-1-CMA, and PC evaluation soundness—a new result for Verkle-based signatures.

While the Verkle tree structure itself is conceptually reused from earlier works, all cryptographic components have been replaced with lattice-based alternatives, and the security analysis has been extended accordingly.

Table 10. Comparison of contributions: proposed VPS vs. prior Verkle-based signature schemes.

Aspect	Iavich et al. [8]/Verkle-HORST [24]	Proposed VPS	Novelty
Tree structure	Verkle tree	Verkle tree	Reused
Branching factor	Variable (2–64)	Fixed $k=256$	New analysis
OTS primitive	Hash-based (HORS/Winternitz)	Lattice-based (Lyubashevsky)	New
OTS security basis	Hash collision resistance	LWE/SIS hardness	Changed assumption
Commitment scheme	Generic lattice	Cini polynomial commitments [5]	New
Type encoding	Not applicable	Canonical encoding $\Phi$ (Equation (7))	New
Recursive composition	Not supported	Unified syntax (Equation (10))	New
Proof verification	Sequential per-level	Batched multi-point	New
Proof batching	Not used	30% size reduction	New
EUF-CMA reduction	Not provided	Theorem 1	New
Security bound	Not provided	Equation (20)	New
Security assumptions	Hash + generic lattice	LWE/SIS + Module-SIS	Changed
Signature size	≈3.2 KB	≈19–21 KB	Trade-off
Implementation maturity	Prototype stage	Analytical projections	Future work

summarizes the key differences between the proposed VPS scheme and prior Verkle-based signature schemes, highlighting the novel contributions of this work.