QShield
Gas Cost Benchmarks
Quantitative analysis of post-quantum signature costs on QShield L2
Key Finding
Session Key transactions (version 0x03) achieve 80-98% cost reduction compared to full hybrid PQC signatures, bringing per-transaction costs to parity with standard ECDSA-only L2 transactions.
Cost Comparison: Hybrid vs Session Key vs ECDSA
| Metric | Hybrid (0x01) | Session Key (0x03) | Standard ECDSA |
|---|---|---|---|
| Signature size | 3,375 bytes | 66 bytes | 65 bytes |
| Signature components | version(1) + ECDSA(65) + ML-DSA(3,309) | version(1) + ECDSA(65) | ECDSA(65) |
| L2 execution gas | ~53,700 | ~8,200 | ~3,000 |
| DA cost (EIP-4844 Blob) | ~$0.04 | ~$0.001 | ~$0.001 |
| DA cost (Celestia) | ~$0.004 | ~$0.0001 | ~$0.0001 |
| Total cost (Blob) | ~$0.05 | ~$0.002 | ~$0.001 |
| Total cost (Celestia) | ~$0.005 | ~$0.0003 | ~$0.0001 |
| Quantum resistance | Full (ECDSA + ML-DSA) | Inherited (via registration) | None |
| Confirmation time | 2 sec (L2 block) | 2 sec | 2 sec |
Signature Size Comparison
L2 Execution Gas Comparison
Detailed Gas Breakdown
Hybrid Verification (version 0x01)
| Step | Operation | Gas |
|---|---|---|
| 1 | Version byte parsing | ~200 |
| 2 | ECDSA.recover(userOpHash, ecdsaSig) — OZ ECDSA | 3,000 |
| 3 | EXTCODEHASH(keyBlob) == keyBlobHash | 2,600 (cold) |
| 4 | EXTCODESIZE(keyBlob) == 1953 | 100 (warm) |
| 5 | EXTCODECOPY(keyBlob, offset=1, len=1952) | 2,783 |
| 6 | staticcall(0x0101, pubkey|hash|sig) — ML-DSA-65 | 45,000 |
| Total | ~53,700 |
Session Key Verification (version 0x03)
| Step | Operation | Gas |
|---|---|---|
| 1 | Version byte parsing | ~200 |
| 2 | ECDSA.recover(userOpHash, ecdsaSig) — OZ ECDSA | 3,000 |
| 3 | sessionKeys[recovered] Slot 0 (time + maxValue) | 2,100 (cold) |
| 4 | sessionKeys[recovered] Slot 1 (whitelistRoot) | 2,100 (cold) |
| 5 | Whitelist hash comparison (calldata only) | ~500 |
| Total | ~7,900–10,500 |
Why Session Keys are cheap
Session Key TX (0x03) skips the PQC precompile call entirely. The ML-DSA-65 verification (45,000 gas) and EXTCODECOPY (2,783 gas) are only needed during Session Key registration (a hybrid 0x01 TX). Daily transactions use only ECDSA + 2 storage reads.
Data Availability Cost Analysis
On L2, user cost is dominated by DA cost (posting signature data to L1 or alt-DA), not L2 execution gas. Signature size is the critical factor.
| DA Method | Cost per byte | Hybrid (3,375 B) | Session Key (66 B) | Reduction |
|---|---|---|---|---|
| L1 Calldata | ~16 gas/byte | ~$0.50 | ~$0.01 | -98% |
| EIP-4844 Blob | ~1 gas/byte | ~$0.04 | ~$0.001 | -97.5% |
| Celestia Alt-DA | ~0.1 gas/byte | ~$0.004 | ~$0.0001 | -97.5% |
Public Key Storage: SSTORE2 vs Solidity Storage
ML-DSA-65 public keys are 1,952 bytes. Storing them in standard Solidity storage would require 61 slots. SSTORE2 deploys the key as contract bytecode instead.
| Metric | Solidity Storage (v3.3) | SSTORE2/KeyBlob (v3.4+) | Improvement |
|---|---|---|---|
| Init cost | 1,220,000 gas (61 SSTORE) | ~462,000 gas (CREATE2 + 2 slots) | -62% |
| Read cost per TX | 130,200 gas (62 SLOAD cold) | ~5,800 gas (EXTCODECOPY) | -96% |
| TX verification total | ~178,000 gas | ~54,000 gas | -70% |
| Storage slots | 64 (3 + 61 data) | 3 (owner + keyBlob + keyBlobHash) | -95% |
ML-DSA-65 Precompile Performance
The ML-DSA-65 verification runs as a native Go precompile at address 0x0101, using Cloudflare CIRCL sign/mldsa/mldsa65.
| Approach | Gas Cost | Source | Verdict |
|---|---|---|---|
| Pure Solidity ML-DSA | ~30,000,000 | Tetration Lab / Quasar | Block limit exceeded |
| ZKNOX FALCON NTT | ~1,500,000 | ZKNOX ETHFALCON | Expensive |
| Go precompile ML-DSA-65 | ~45,000 | QShield (15x ecrecover) | Practical |
Precompile Input/Output Specification
| Parameter | Value |
|---|---|
| Address | 0x0101 |
| Input format | pubkey[1952] || msgHash[32] || sig[3309] |
| Input size | 5,293 bytes (fixed) |
| Output (success) | uint256(1) — 32 bytes |
| Output (failure) | uint256(0) — 32 bytes |
| Gas cost | 45,000 (initial, adjustable post-benchmark) |
| Standard | NIST FIPS 204 (ML-DSA-65, Security Level 3) |
| Library | Cloudflare CIRCL v1.6.3 (sign/mldsa/mldsa65) |
Real-World User Cost Model
The typical QShield user flow minimizes high-cost PQC operations:
| Action | Frequency | Signature | Cost (Blob) | Cost (Celestia) |
|---|---|---|---|---|
| Account creation | Once | Hybrid (0x01) | ~$0.50 | ~$0.05 |
| Session Key registration | As needed | Hybrid (0x01) | ~$0.05 | ~$0.005 |
| Daily transactions | Hundreds–thousands | Session Key (0x03) | ~$0.002 | ~$0.0003 |
| High-value transfers | Rare | Hybrid (0x01) | ~$0.05 | ~$0.005 |
Bottom line
For a user who creates 1 account, registers 1 session key, and executes 100 transactions per month: total monthly cost is ~$0.75 (Blob) or ~$0.08 (Celestia). Without session keys, the same user would pay ~$5.50 (Blob) or ~$0.55 (Celestia) — a 7x cost reduction.
Methodology
Test Environment
- Chain: QShield L2 Testnet (Chain ID 42069)
- Stack: Custom op-geth with ML-DSA-65 precompile at 0x0101
- Crypto library: Cloudflare CIRCL v1.6.3 (
sign/mldsa/mldsa65) - Smart contracts: Foundry-based test suite with gas reporting (
forge test --gas-report) - EVM version: Cancun (EIP-4844 enabled)
- EntryPoint: ERC-4337 v0.7 at
0x0000000071727De22E5E9d8BAf0edAc6f37da032
Gas Measurement Method
- L2 execution gas: Measured via
forge test --gas-reportandgasleft()checkpoints in Foundry tests. Cold storage access assumed for first reads (EIP-2929). - DA cost: Calculated as
signature_bytes × cost_per_byte. Blob cost uses EIP-4844 pricing model. Celestia cost uses published Celestia fee schedule. - Precompile gas (45,000): Set at approximately 15× ecrecover (3,000 gas), with DoS safety margin. Adjustable after mainnet benchmarking.
- USD conversion: Based on ETH price of $2,500 and gas price of 0.01 gwei (typical L2 conditions). Actual costs vary with network conditions.
Reproducibility
All gas measurements can be reproduced using the QShield contracts test suite:
# Clone and build
git clone https://github.com/superlabs-x/qshield-l2
cd qshield-l2/contracts
# Install dependencies
forge install
# Run gas comparison tests
forge test --gas-report -vvv --match-test "testGas_"
# Run specific benchmarks
forge test --gas-report --match-test "testGas_SessionKey_vs_Hybrid"
forge test --gas-report --match-test "testGas_SSTORE2_vs_StorageRead"Assumptions and Limitations
- Gas costs are estimates based on EVM opcode pricing (Berlin/Cancun). Actual costs may vary ±10% depending on state access patterns.
- DA costs fluctuate with L1 gas prices and blob market conditions. Values shown are representative of typical Q1 2026 pricing.
- The 45,000 gas precompile cost is an initial conservative estimate. Production benchmarks will refine this value.
- Session Key security depends on the initial hybrid registration. The quantum resistance is "inherited" — if the session key ECDSA is compromised, the attacker is limited by
maxValue,whitelist, andvalidUntilconstraints.