Postern Labs
MAINNET BETA. Unaudited · k=8 gate now active (hardened from the earlier relaxed k=4) · not a security claim by itself · low hashrate → blocks slow for now · very few nodes, 51%-attackable · not a security · for evaluation — not to protect real secrets yet. Full disclaimer →

Custom mining hardware

Customizing an ASIC for Bloch-SIS-PoW.

What a custom miner (ASIC or FPGA) must accelerate to mine the Bloch-SIS proof-of-work — and how to build one. This is an engineering description of the algorithm, not an endorsement to build hardware.

Read first

  • No economic reason to build one. The coin is not a security and not an asset — no price, no market, no value claim. Do this for research/education only.
  • Parameters are NOT security-validated. At β = q/16 the residual gate is structurally weak by the protocol's own admission; the chain is unaudited and 51%-attackable, and the no-shortcut proof is outstanding. Any consensus parameter can change in a future hard fork and invalidate a fixed-parameter chip.

The PoW

Two gates per candidate.

A valid block carries a SIS witness: a short integer vector s that (1) satisfies a Module-SIS lattice gate and (2) whose block's auxiliary hash beats the difficulty target. Mining searches nonces/seeds for a candidate passing both.

(A, t) = SHAKE256-expand(seed)     # A ∈ Z_q^{m×n},  t ∈ Z_q^m
r = A·s - t   (mod q, centered)    # residual
gate_ok = ||r||∞ < β   on k coefficients        # structural filter (Module-SIS)
work_ok = SHAKE256(header‖s) ≤ target           # cumulative hashcash work
valid   = gate_ok AND work_ok

Security is cumulative SHAKE-256 hashcash work; the lattice gate is a structural filter, not a security claim by itself.

Canonical parameters

Aligned with ML-DSA-65 on purpose.

q = 8 380 417
= 2²³ − 2¹³ + 1 — the ML-DSA-65 / FIPS 204 (Dilithium) prime, chosen so an NTT core can be shared with the signature subsystem. That's the reuse hook: existing Dilithium/Kyber NTT + modular-reduction hardware IP drops straight in.
n = 256, m = 512
Solution dimension and matrix rows (A ∈ Z_q^{m×n}, m = 2n).
β = q/16
Residual ∞-norm bound. Not security-validated — weak by design at this value.
k = 8
Residual coefficients the gate constrains (mainnet, now active; testnet was 4). Each step of k makes valid candidates exponentially rarer (~4096× from k=4 to k=8).

What the chip accelerates

Keccak + 24-bit modular multiply.

  1. SHAKE-256 / Keccak-f[1600] (throughput core) — expands A (≈131k field entries) and t from the seed, and computes the work hash. Standard SHA-3 permutation logic.
  2. Matrix-vector product A·s mod q — 512 dot-products of length 256 over a 24-bit prime. Reuse Dilithium NTT butterflies / a wide MAC array with centered reduction.
  3. Norm gate — k parallel comparators against β; place it early to reject most candidates before the work hash.
  4. Difficulty compare — 256-bit compare of the aux hash to the ASERT-tuned target (~30 s block time, ±4×/step).

The design is compute-bound on Keccak + 24-bit modmul and can keep A on-die (≈384 KiB), which is what makes it ASIC-amenable rather than memory-hard.

Full ASIC customization spec (PDF) ↓ — the pipeline diagram, the practical FPGA-first path, and the honest limits. Reference solver: crates/bloch-sis-pow in the protocol repo (see Run a node). Unaudited; parameters not security-validated.