Key Encapsulation Mechanisms

A standalone comparison of public-key and ciphertext sizes for KEMs — not tied to any NIST competition round. Click column headers to sort; use the filters to narrow down.

Sizes reflect the latest known specifications (ML-KEM: FIPS 203; HQC: 2025-08-22 draft). For ECDH the “ciphertext” is the ephemeral public key and keygen/encaps/decaps map to the static/ephemeral key generation and the two ECDH derivations. See the signatures comparison for the NIST on-ramp signature schemes.

Filters ▼

pk size vs. ciphertext size (log–log scale)

Shape = family · tap point for details

Scroll to zoom · drag to pan

Advanced graph →

Performance note: Keygen / encapsulation / decapsulation timings are from our own benchmarks on a Intel(R) Xeon(R) Platinum 8488C (ML-KEM and HQC use AVX2; ECDH uses OpenSSL) — see the environment details below.

											Assumption
ECDH	Pre-Quantum	Classic	X25519	N/A	32	32	64	35.8 µs	67.9 µs	34.6 µs	Elliptic Curves
ECDH	Pre-Quantum	Classic	X448	N/A	56	56	112	146.4 µs	328.8 µs	183.6 µs	Elliptic Curves
ECDH	Pre-Quantum	Classic	P-256	N/A	65	65	130	17.1 µs	79.6 µs	65.5 µs	Elliptic Curves
MIKE	Isogenies	Research proposal	fast-I	1	80	80	160	588.8 µs	4.76 ms	4.17 ms	Module isogeny action
MIKE	Isogenies	Research proposal	rigorous-I	1	96	96	192	1.31 ms	10.73 ms	9.44 ms	Module isogeny action
ECDH	Pre-Quantum	Classic	P-384	N/A	97	97	194	136.3 µs	472.4 µs	326.4 µs	Elliptic Curves
MIKE	Isogenies	Research proposal	fast-III	3	122	122	244	1.93 ms	15.42 ms	13.51 ms	Module isogeny action
MIKE	Isogenies	Research proposal	rigorous-III	3	144	144	288	4.19 ms	32.71 ms	28.54 ms	Module isogeny action
MIKE	Isogenies	Research proposal	fast-V	5	160	160	320	4.04 ms	30.91 ms	26.87 ms	Module isogeny action
MIKE	Isogenies	Research proposal	rigorous-V	5	192	192	384	9.33 ms	71.07 ms	61.77 ms	Module isogeny action
BAT	Lattices	Academic	257-512	1	521	473	994	5.17 ms	5.1 µs	22.4 µs	NTRU
SMAUG-T	Lattices	KpqC standard	SMAUG-T128	1	672	672	1,344	9.1 µs	7.7 µs	10.5 µs	MLWE / MLWR
NTRU	Lattices	R3 finalist	ntruhps2048509	1	699	699	1,398	42.2 µs	12.7 µs	10.3 µs	NTRU
SABER	Lattices	R3 finalist	LightSaber	1	672	736	1,408	16.2 µs	15.7 µs	13.7 µs	Module Learning With Rounding (MLWR)
ML-KEM	Lattices	FIPS	512	1	800	768	1,568	7.7 µs	8.6 µs	10.1 µs	MLWE
NTRU	Lattices	R3 finalist	ntruhps2048677	3	930	930	1,860	65.4 µs	16.4 µs	13.8 µs	NTRU
NTRU Prime	Lattices	R3 alternate	sntrup653	2	994	897	1,891	175.4 µs	15.6 µs	16.1 µs	NTRU
SABER	Lattices	R3 finalist	Saber	3	992	1,088	2,080	22.3 µs	22.8 µs	20.9 µs	Module Learning With Rounding (MLWR)
SMAUG-T	Lattices	KpqC standard	SMAUG-T192	3	1,088	992	2,080	13.1 µs	12.6 µs	16.8 µs	MLWE / MLWR
NTRU Prime	Lattices	R3 alternate	sntrup761	2	1,158	1,039	2,197	233.9 µs	17.7 µs	17.2 µs	NTRU
BAT	Lattices	Academic	769-1024	5	1,230	1,006	2,236	28.63 ms	8.8 µs	44.8 µs	NTRU
ML-KEM	Lattices	FIPS	768	3	1,184	1,088	2,272	11.5 µs	12.4 µs	14.6 µs	MLWE
NTRU	Lattices	R3 finalist	ntruhrss701	1	1,138	1,138	2,276	59.4 µs	10.3 µs	14.4 µs	NTRU
NTRU+	Lattices	KpqC standard	NTRU+768	1	1,152	1,152	2,304	8.3 µs	10.2 µs	7.0 µs	NTRU
NTRU	Lattices	R3 finalist	ntruhps4096821	5	1,230	1,230	2,460	90.0 µs	18.8 µs	17.7 µs	NTRU
NTRU Prime	Lattices	R3 alternate	sntrup857	3	1,322	1,184	2,506	301.7 µs	21.0 µs	23.0 µs	NTRU
NTRU+	Lattices	KpqC standard	NTRU+864	3	1,296	1,296	2,592	8.9 µs	11.5 µs	8.2 µs	NTRU
SABER	Lattices	R3 finalist	FireSaber	5	1,312	1,472	2,784	30.2 µs	31.4 µs	30.0 µs	Module Learning With Rounding (MLWR)
SMAUG-T	Lattices	KpqC standard	SMAUG-T256	5	1,440	1,376	2,816	16.1 µs	15.8 µs	21.3 µs	MLWE / MLWR
NTRU Prime	Lattices	R3 alternate	sntrup953	4	1,505	1,349	2,854	399.6 µs	25.4 µs	26.8 µs	NTRU
NTRU Prime	Lattices	R3 alternate	sntrup1013	4	1,623	1,455	3,078	475.9 µs	27.2 µs	27.3 µs	NTRU
ML-KEM	Lattices	FIPS	1024	5	1,568	1,568	3,136	16.4 µs	17.6 µs	20.8 µs	MLWE
NTRU+	Lattices	KpqC standard	NTRU+1152	5	1,728	1,728	3,456	13.0 µs	14.8 µs	10.1 µs	NTRU
NTRU Prime	Lattices	R3 alternate	sntrup1277	5	2,067	1,847	3,914	695.7 µs	34.3 µs	37.0 µs	NTRU
HQC	Code-based	Std pending	128	1	2,241	4,433	6,674	21.3 µs	40.6 µs	90.7 µs	Quasi-Cyclic Syndrome Decoding
HQC	Code-based	Std pending	192	3	4,514	8,978	13,492	52.2 µs	102.2 µs	206.3 µs	Quasi-Cyclic Syndrome Decoding
FrodoKEM	Lattices	ISO	640-AES	1	9,616	9,752	19,368	263.0 µs	313.5 µs	312.1 µs	LWE
FrodoKEM	Lattices	ISO	640-SHAKE	1	9,616	9,752	19,368	673.6 µs	720.0 µs	718.6 µs	LWE
HQC	Code-based	Std pending	256	5	7,237	14,421	21,658	103.5 µs	209.6 µs	406.8 µs	Quasi-Cyclic Syndrome Decoding
FrodoKEM	Lattices	ISO	976-AES	3	15,632	15,792	31,424	532.0 µs	588.2 µs	574.2 µs	LWE
FrodoKEM	Lattices	ISO	976-SHAKE	3	15,632	15,792	31,424	1.40 ms	1.45 ms	1.44 ms	LWE
FrodoKEM	Lattices	ISO	1344-AES	5	21,520	21,696	43,216	949.2 µs	1.02 ms	1.02 ms	LWE
FrodoKEM	Lattices	ISO	1344-SHAKE	5	21,520	21,696	43,216	2.39 ms	2.48 ms	2.45 ms	LWE
Classic McEliece	Code-based	ISO	mceliece348864	1	261,120	96	261,216	12.45 ms	11.0 µs	37.2 µs	Syndrome Decoding (binary Goppa)
Classic McEliece	Code-based	ISO	mceliece460896	3	524,160	156	524,316	50.50 ms	28.5 µs	82.8 µs	Syndrome Decoding (binary Goppa)
Classic McEliece	Code-based	ISO	mceliece6688128	5	1,044,992	208	1,045,200	102.49 ms	87.4 µs	115.2 µs	Syndrome Decoding (binary Goppa)
Classic McEliece	Code-based	ISO	mceliece6960119	5	1,047,319	194	1,047,513	89.56 ms	104.4 µs	110.6 µs	Syndrome Decoding (binary Goppa)
Classic McEliece	Code-based	ISO	mceliece8192128	5	1,357,824	208	1,358,032	99.47 ms	147.9 µs	122.7 µs	Syndrome Decoding (binary Goppa)

48 parameter sets

Legend: 💣 pre-quantum (classical security only) · 🧨 broken · ⚠️ security warning · ℹ️ note · value estimated from cycle counts · tap icons for details

Benchmark environment

Date 6 October 2026

CPU Intel(R) Xeon(R) Platinum 8488C — 16 cores, 2 threads/core, MHz max, governor: unknown, turbo: unknown

OS Ubuntu 26.04.1 LTS (kernel 7.0.0-1014-aws)

Compiler cc (Ubuntu 15.2.0-16ubuntu1) 15.2.0

OpenSSL OpenSSL 3.5.5 27 Jan 2026 (Library: OpenSSL 3.5.5 27 Jan 2026)

Method KEM keygen/encapsulation/decapsulation. Median over 1000 iterations (fewer for slow schemes). Cycle counter: rdpmc CPU_CYCLES (real core cycles, user-space). Wall clock: clock_gettime(CLOCK_MONOTONIC). Benchmark thread pinned to one core.

Implementation sources ▸

bat pornin/BAT@8280af7c
frodo Microsoft/PQCrypto-LWEKE@7a4e7219
hqc https://gitlab.com/pqc-hqc/hqc@161cd4fd
mceliece lib.mceliece.org/libmceliece-20260622.tar.gz
mike tensor-mike/mike_c@6057473e
mlkem pq-code-package/mlkem-native@2d1cc90f
ntru jschanck/ntru@6d96ed37
ntruplus ntruplus/ntruplus@f4507621
ntruprime libntruprime.cr.yp.to/libntruprime-20241021.tar.gz
saber KULeuven-COSIC/SABER@f7f39e4d
smaugt hmchoe0528/SMAUG-T_public@2c039df2

Benchmark data licensed under CC-BY-4.0 — Thom Wiggers / PQShield