Key Encapsulation Mechanisms

Standardised KEMs, competition candidates and research proposals, with pre-quantum ECDH for reference. Select column headers to sort; use the filters to narrow by programme, scheme, security level, size or speed.

Sizes reflect the latest known specifications (ML-KEM: FIPS 203; HQC: 2025-08-22 draft). For ECDH the “ciphertext” is the ephemeral public key and keygen/encaps/decaps map to the static/ephemeral key generation and the two ECDH derivations. See the signature comparison for signature schemes.

pk size vs. ciphertext size (log–log scale)

Scroll to zoom · drag to pan· tap a point for details

Advanced graph →

Performance note: Keygen / encapsulation / decapsulation timings are from our own benchmarks on a Intel(R) Xeon(R) 6975P-C (ML-KEM and HQC use AVX2; ECDH uses OpenSSL); see the environment details below. Schemes not yet in our harness show sizes only.

		Programmes									Assumption
ECDH	Pre-Quantum	Classic	X25519	Pre-quantum	32	32	64	33.2 µs	62.2 µs	31.8 µs	Elliptic Curves

ECDH	Pre-Quantum	Classic	X448	Pre-quantum	56	56	112	142.2 µs	296.8 µs	157.8 µs	Elliptic Curves

ECDH	Pre-Quantum	Classic	P-256	Pre-quantum	65	65	130	16.3 µs	73.0 µs	59.9 µs	Elliptic Curves

MIKE	Isogenies	Research	fast-I	1	80	80	160	514.4 µs	4.20 ms	3.69 ms	Module isogeny action

MIKE	Isogenies	Research	rigorous-I	1	96	96	192	1.13 ms	9.23 ms	8.10 ms	Module isogeny action

ECDH	Pre-Quantum	Classic	P-384	Pre-quantum	97	97	194	111.5 µs	388.9 µs	269.5 µs	Elliptic Curves

MIKE	Isogenies	Research	fast-III	3	122	122	244	1.68 ms	13.54 ms	11.86 ms	Module isogeny action

MIKE	Isogenies	Research	rigorous-III	3	144	144	288	3.60 ms	28.19 ms	24.59 ms	Module isogeny action

MIKE	Isogenies	Research	fast-V	5	160	160	320	3.48 ms	26.56 ms	23.07 ms	Module isogeny action

MIKE	Isogenies	Research	rigorous-V	5	192	192	384	8.36 ms	62.95 ms	54.62 ms	Module isogeny action

QIMEN-PIKE	Isogenies	NGCC R1	NGCC-1	128-bit	389	602	991	62.16 ms	25.10 ms	40.22 ms	Isogenies

BAT	Lattices	Research	257-512	1	521	473	994	4.59 ms	4.4 µs	19.6 µs	NTRU

CTL Algorithm	Lattices	NGCC R1	CTL-257-512	128-bit	521	473	994	3.61 ms	11.6 µs	55.0 µs	NTRU/RLWR
FLIT	Lattices	NGCC R1	FLIT128	128-bit	615	512	1,127	18.7 µs	22.2 µs	18.3 µs	NTRU

ZEN	Lattices	NGCC R1	ZEN_128	128-bit	615	512	1,127	45.8 µs	34.5 µs	39.2 µs	NTRU/RLWE

PolarLAC	Lattices	NGCC R1	POLARLAC-Light	128-bit	530	608	1,138	31.7 µs	41.2 µs	47.4 µs	MLWE
PolarLAC	Lattices	NGCC R1	POLARLAC-128	128-bit	530	640	1,170	34.6 µs	44.8 µs	51.4 µs	MLWE
Lore	Lattices	NGCC R1	L1	128-bit	610	706	1,316	19.6 µs	33.3 µs	43.1 µs	MLWR
MAMBA-Viper	Lattices	NGCC R1	128	128-bit	608	736	1,344	37.9 µs	59.5 µs	68.2 µs	MLWQ
NEV	Lattices	NGCC R1	R1	128-bit	672	672	1,344	18.2 µs	17.7 µs	12.8 µs	NTRU/RLWE
SMAUG-T	Lattices	KpqC selected	SMAUG-T128	1	672	672	1,344	8.3 µs	6.9 µs	9.5 µs	MLWE / MLWR

YuanYang.KEM	Lattices	NGCC R1	yuanyang-512	128-bit	736	656	1,392	108.9 µs	67.1 µs	75.3 µs	NTRU
NTRU	Lattices	NIST R3	ntruhps2048509	1	699	699	1,398	34.5 µs	10.9 µs	8.3 µs	NTRU

SABER	Lattices	NIST R3	LightSaber	1	672	736	1,408	13.8 µs	13.6 µs	11.8 µs	MLWR

COMPASS-KEM	Lattices	NGCC R1	128	128-bit	672	768	1,440	443.3 µs	451.6 µs	460.5 µs	MLWR
QIMEN-PIKE	Isogenies	NGCC R1	NGCC-2	256-bit	592	882	1,474	192.48 ms	72.31 ms	116.66 ms	Isogenies

MORNING-Scabbard	Lattices	NGCC R1	scabbard128	128-bit	736	760	1,496	167.4 µs	168.4 µs	163.7 µs	MLWR
BAG-Piglet	Code-based	NGCC R1	bag_piglet_128	128-bit	522	1,027	1,549	301.7 µs	344.9 µs	1.34 ms	Rank Synd. Dec.

Aigis-Enc+	Lattices	NGCC R1	I	128-bit	656	896	1,552	63.2 µs	71.1 µs	72.0 µs	MLWE

BW-KEM	Lattices	NGCC R1	BW_KEM_C128	128-bit	784	768	1,552	69.0 µs	79.9 µs	95.7 µs	MLWE
ML-KEM	Lattices	FIPS	512	1	800	768	1,568	6.2 µs	6.9 µs	8.2 µs	MLWE
Weaver	Lattices	NGCC R1	WeaverKEM-128	128-bit	752	816	1,568	139.6 µs	151.6 µs	152.6 µs	MLWR
DKEM	Lattices	NGCC R1	128	128-bit	800	800	1,600	40.2 µs	43.7 µs	43.6 µs	MLWE
CheetahKEM	Lattices	NGCC R1	Cheetah128	128-bit	832	864	1,696	69.4 µs	87.4 µs	95.9 µs	RLWE/MLWE

DTRU	Lattices	NGCC R1	648	128-bit	972	729	1,701	78.4 µs	42.0 µs	82.7 µs	NTRU/RLWE

Polar-KEM	Lattices	NGCC R1	PolarKEM-128	128-bit	1,024	768	1,792	46.8 µs	141.6 µs	173.1 µs	Polar-LIP

Rudraksh2	Lattices	NGCC R1	lwekem128	128-bit	880	912	1,792	812.8 µs	812.9 µs	810.6 µs	MLWE
Amoeba	Lattices	NGCC R1	576	128-bit	784	1,047	1,831	100.8 µs	138.2 µs	150.5 µs	RLWE

NTRU	Lattices	NIST R3	ntruhps2048677	3	930	930	1,860	53.0 µs	14.2 µs	11.7 µs	NTRU

Mithril	Lattices	NGCC R1	128	128-bit	944	928	1,872	45.9 µs	45.6 µs	45.7 µs	RR-LWR
NTRU Prime	Lattices	NIST R3	sntrup653	2	994	897	1,891	134.3 µs	14.3 µs	16.3 µs	NTRU

NTRE	Lattices	NGCC R1	128	128-bit	972	972	1,944	26.0 µs	26.5 µs	22.9 µs	R-NTRU/R-LWE
SABER	Lattices	NIST R3	Saber	3	992	1,088	2,080	19.8 µs	20.4 µs	18.4 µs	MLWR

SMAUG-T	Lattices	KpqC selected	SMAUG-T192	3	1,088	992	2,080	11.8 µs	11.3 µs	15.1 µs	MLWE / MLWR

OAEP-NTRU	Lattices	NGCC R1	648	128-bit	1,053	1,085	2,138	20.1 µs	25.1 µs	15.8 µs	NTRU/RLWE

NTRU Prime	Lattices	NIST R3	sntrup761	2	1,158	1,039	2,197	174.3 µs	15.8 µs	17.3 µs	NTRU

BAT	Lattices	Research	769-1024	5	1,230	1,006	2,236	26.75 ms	7.4 µs	38.0 µs	NTRU

CTL Algorithm	Lattices	NGCC R1	CTL-769-1024	256-bit	1,230	1,006	2,236	15.56 ms	16.9 µs	101.6 µs	NTRU/RLWR
FLIT	Lattices	NGCC R1	FLIT256	256-bit	1,229	1,024	2,253	42.6 µs	38.3 µs	33.3 µs	NTRU

ZEN	Lattices	NGCC R1	ZEN_256	256-bit	1,229	1,024	2,253	68.3 µs	40.4 µs	52.7 µs	NTRU/RLWE

ML-KEM	Lattices	FIPS	768	3	1,184	1,088	2,272	9.3 µs	10.0 µs	12.0 µs	MLWE
NTRU	Lattices	NIST R3	ntruhrss701	1	1,138	1,138	2,276	50.5 µs	10.0 µs	12.8 µs	NTRU

NTRU+	Lattices	KpqC selected	NTRU+768	1	1,152	1,152	2,304	7.4 µs	9.2 µs	6.3 µs	NTRU

PolarLAC	Lattices	NGCC R1	POLARLAC-256	256-bit	1,060	1,280	2,340	57.5 µs	80.6 µs	95.1 µs	MLWE
NTRU	Lattices	NIST R3	ntruhps4096821	5	1,230	1,230	2,460	74.4 µs	16.1 µs	15.3 µs	NTRU

Lore	Lattices	NGCC R1	L2	256-bit	1,186	1,282	2,468	42.7 µs	64.6 µs	104.6 µs	MLWR
NTRU Prime	Lattices	NIST R3	sntrup857	3	1,322	1,184	2,506	217.1 µs	19.0 µs	22.1 µs	NTRU

NTRU+	Lattices	KpqC selected	NTRU+864	3	1,296	1,296	2,592	8.1 µs	10.5 µs	7.5 µs	NTRU

NEV	Lattices	NGCC R1	R2	256-bit	1,344	1,344	2,688	27.0 µs	28.6 µs	20.3 µs	NTRU/RLWE
COMPASS-KEM	Lattices	NGCC R1	256	256-bit	1,312	1,472	2,784	1.72 ms	1.73 ms	1.75 ms	MLWR
MAMBA-Viper	Lattices	NGCC R1	256	256-bit	1,312	1,472	2,784	120.3 µs	155.5 µs	164.4 µs	MLWQ
SABER	Lattices	NIST R3	FireSaber	5	1,312	1,472	2,784	27.4 µs	28.7 µs	26.9 µs	MLWR

DTRU	Lattices	NGCC R1	1024	256-bit	1,536	1,280	2,816	84.8 µs	57.0 µs	111.8 µs	NTRU/RLWE

SMAUG-T	Lattices	KpqC selected	SMAUG-T256	5	1,440	1,376	2,816	14.5 µs	14.1 µs	19.1 µs	MLWE / MLWR

Weaver	Lattices	NGCC R1	WeaverKEM-256	256-bit	1,312	1,536	2,848	198.9 µs	213.1 µs	212.8 µs	MLWR
NTRU Prime	Lattices	NIST R3	sntrup953	4	1,505	1,349	2,854	262.2 µs	20.0 µs	22.8 µs	NTRU

YuanYang.KEM	Lattices	NGCC R1	yuanyang-1024	256-bit	1,568	1,344	2,912	315.9 µs	107.5 µs	126.9 µs	NTRU
QIMEN-PIKE	Isogenies	NGCC R1	NGCC-3	512-bit	1,198	1,746	2,944	1.66 s	681.62 ms	1.08 s	Isogenies

Aigis-Enc+	Lattices	NGCC R1	II	256-bit	1,312	1,664	2,976	96.6 µs	115.0 µs	117.5 µs	MLWE

LoongKEM	Lattices	NGCC R1	Loong128	128-bit	1,472	1,512	2,984	1.62 ms	1.63 ms	1.64 ms	LWE

BW-KEM	Lattices	NGCC R1	BW_KEM_C256	256-bit	1,568	1,440	3,008	172.4 µs	185.8 µs	213.1 µs	MLWE
NTRU Prime	Lattices	NIST R3	sntrup1013	4	1,623	1,455	3,078	310.9 µs	20.7 µs	23.4 µs	NTRU

BIKE-MLThre	Code-based	NGCC R1	BIKE_MLThre-128	128-bit	1,541	1,573	3,114	361.32 ms	3.60 ms	23.49 ms	QC-MDPC

ML-KEM	Lattices	FIPS	1024	5	1,568	1,568	3,136	12.9 µs	13.9 µs	16.6 µs	MLWE
DKEM	Lattices	NGCC R1	256	256-bit	1,568	1,600	3,168	121.5 µs	123.9 µs	124.1 µs	MLWE
BRA	Code-based	NGCC R1	128	128-bit	1,078	2,092	3,170	153.0 µs	268.9 µs	832.8 µs	Rank Synd. Dec.

MORNING-Scabbard	Lattices	NGCC R1	scabbard256	256-bit	1,616	1,648	3,264	291.9 µs	306.2 µs	316.6 µs	MLWR
Mithril	Lattices	NGCC R1	256	256-bit	1,648	1,680	3,328	77.1 µs	77.7 µs	79.3 µs	RR-LWR
Polar-KEM	Lattices	NGCC R1	PolarKEM-256	256-bit	2,048	1,280	3,328	90.7 µs	176.2 µs	239.9 µs	Polar-LIP

CheetahKEM	Lattices	NGCC R1	Cheetah256	256-bit	1,648	1,728	3,376	180.6 µs	201.8 µs	219.3 µs	RLWE/MLWE

NTRU+	Lattices	KpqC selected	NTRU+1152	5	1,728	1,728	3,456	11.8 µs	13.2 µs	9.2 µs	NTRU

Amoeba	Lattices	NGCC R1	1152	256-bit	1,648	1,833	3,481	159.4 µs	210.2 µs	235.1 µs	RLWE

Rudraksh2	Lattices	NGCC R1	lwekem256	256-bit	1,760	1,728	3,488	1.62 ms	1.62 ms	1.61 ms	MLWE
NTRE	Lattices	NGCC R1	256	256-bit	1,944	1,944	3,888	38.5 µs	40.4 µs	32.4 µs	R-NTRU/R-LWE
NTRU Prime	Lattices	NIST R3	sntrup1277	5	2,067	1,847	3,914	445.7 µs	27.6 µs	27.4 µs	NTRU

Lore	Lattices	NGCC R1	L3	384-bit	1,954	2,114	4,068	84.9 µs	118.8 µs	154.1 µs	MLWR

DTRU	Lattices	NGCC R1	1536	384-bit	2,304	1,920	4,224	104.7 µs	94.3 µs	180.3 µs	NTRU/RLWE

ZEN	Lattices	NGCC R1	ZEN_512	512-bit	2,458	2,048	4,506	191.6 µs	108.4 µs	139.0 µs	NTRU/RLWE

BW-KEM	Lattices	NGCC R1	BW_KEM_C384	384-bit	2,368	2,176	4,544	no code(No implementation in the submission package)	no code(No implementation in the submission package)	no code(No implementation in the submission package)	MLWE
COMPASS-KEM	Lattices	NGCC R1	384	384-bit	2,144	2,432	4,576	981.4 µs	981.3 µs	987.1 µs	MLWR

BAG-Piglet	Code-based	NGCC R1	bag_piglet_256	256-bit	1,573	3,097	4,670	733.3 µs	1.05 ms	4.76 ms	Rank Synd. Dec.

OAEP-NTRU	Lattices	NGCC R1	1296	256-bit	2,430	2,494	4,924	53.8 µs	82.1 µs	46.7 µs	NTRU/RLWE

BRA	Code-based	NGCC R1	256	256-bit	1,735	3,406	5,141	253.2 µs	448.7 µs	1.39 ms	Rank Synd. Dec.

MAMBA-Viper	Lattices	NGCC R1	384	384-bit	2,496	2,656	5,152	343.8 µs	397.7 µs	404.9 µs	MLWQ

Amoeba	Lattices	NGCC R1	1728	384-bit	2,440	2,769	5,209	236.5 µs	315.3 µs	355.0 µs	RLWE

CTL Algorithm	Lattices	NGCC R1	CTL-3329-2048	512-bit	3,009	2,353	5,362	490.98 ms	53.7 µs	14.31 ms	NTRU/RLWR

FLIT	Lattices	NGCC R1	FLIT512	512-bit	3,072	2,304	5,376	190.9 µs	157.6 µs	134.1 µs	NTRU

NEV	Lattices	NGCC R1	R3	512-bit	2,688	2,688	5,376	71.9 µs	86.9 µs	54.2 µs	NTRU/RLWE
PolarLAC	Lattices	NGCC R1	POLARLAC-512-Star	512-bit	2,522	2,970	5,492	214.9 µs	290.9 µs	343.4 µs	MLWE
CheetahKEM	Lattices	NGCC R1	Cheetah384	384-bit	2,704	2,832	5,536	584.4 µs	617.2 µs	660.6 µs	RLWE/MLWE

BAG-Loong	Code-based	NGCC R1	128	128-bit	2,500	3,071	5,571	13.64 ms	14.13 ms	24.88 ms	Rank Synd. Dec.

DTRU	Lattices	NGCC R1	2048	512-bit	3,072	2,560	5,632	193.8 µs	126.9 µs	244.4 µs	NTRU/RLWE

BRQC	Code-based	NGCC R1	128	128-bit	1,954	3,844	5,798	173.6 µs	332.4 µs	965.8 µs	Rank Synd. Dec.

TRIKE	Code-based	NGCC R1	2	128-bit	1,980	3,928	5,908	19.81 ms	1.91 ms	11.20 ms	QC-MDPC
MORNING-Scabbard	Lattices	NGCC R1	scabbard512	512-bit	2,880	3,072	5,952	837.8 µs	891.1 µs	867.1 µs	MLWR
BW-KEM	Lattices	NGCC R1	BW_KEM_C512	512-bit	3,136	2,944	6,080	603.4 µs	623.3 µs	717.4 µs	MLWE
Lore	Lattices	NGCC R1	L4	512-bit	2,914	3,170	6,084	145.8 µs	202.9 µs	280.2 µs	MLWR

COMPASS-KEM	Lattices	NGCC R1	512	512-bit	2,848	3,264	6,112	1.73 ms	1.73 ms	1.74 ms	MLWR

TriQ-KEM	Code-based	NGCC R1	128	128-bit	2,054	4,086	6,140	137.8 µs	149.3 µs	191.7 µs	QCSD
Aigis-Enc+	Lattices	NGCC R1	III	512-bit	2,624	3,584	6,208	217.9 µs	257.3 µs	270.9 µs	MLWE

YuanYang.KEM	Lattices	NGCC R1	yuanyang-2048	512-bit	3,328	2,880	6,208	444.3 µs	206.8 µs	248.8 µs	NTRU

Weaver	Lattices	NGCC R1	WeaverKEM-512	512-bit	2,880	3,392	6,272	733.6 µs	829.7 µs	854.5 µs	MLWR
Polar-KEM	Lattices	NGCC R1	PolarKEM-512	512-bit	4,096	2,304	6,400	178.1 µs	344.9 µs	473.2 µs	Polar-LIP

DKEM	Lattices	NGCC R1	512	512-bit	3,392	3,136	6,528	499.8 µs	510.5 µs	514.5 µs	MLWE
Mithril	Lattices	NGCC R1	512	512-bit	3,056	3,504	6,560	159.4 µs	163.7 µs	173.1 µs	RR-LWR
QUBE	Code-based	NGCC R1	128	128-bit	3,294	3,287	6,581	144.6 µs	158.2 µs	258.5 µs	QCSD

MAMBA-Viper	Lattices	NGCC R1	512	512-bit	3,200	3,456	6,656	553.5 µs	620.2 µs	631.3 µs	MLWQ

HQC	Code-based	Std pending	128	1	2,241	4,433	6,674	19.0 µs	35.7 µs	87.5 µs	QCSD

LoongKEM	Lattices	NGCC R1	Loong256	256-bit	3,248	3,520	6,768	3.95 ms	3.97 ms	4.00 ms	LWE

NTRE	Lattices	NGCC R1	512	512-bit	3,456	3,456	6,912	63.4 µs	82.8 µs	69.0 µs	R-NTRU/R-LWE

Rudraksh2	Lattices	NGCC R1	lwekem512	512-bit	3,392	3,552	6,944	5.38 ms	5.37 ms	5.38 ms	MLWE
HARE	Code-based	NGCC R1	128-kr	128-bit	2,629	4,688	7,317	82.0 µs	354.3 µs	576.0 µs	QCSD
Amoeba	Lattices	NGCC R1	2304	512-bit	3,520	3,914	7,434	304.0 µs	412.7 µs	467.7 µs	RLWE

CheetahKEM	Lattices	NGCC R1	Cheetah512	512-bit	3,600	4,032	7,632	946.0 µs	977.1 µs	1.04 ms	RLWE/MLWE

BAG-Piglet	Code-based	NGCC R1	bag_piglet_384	384-bit	2,778	5,475	8,253	2.47 ms	2.86 ms	11.40 ms	Rank Synd. Dec.

NSS-HQC	Code-based	NGCC R1	HQC-128	128-bit	3,713	5,185	8,898	8.97 ms	16.31 ms	30.36 ms	QCSD
Mito	Code-based	NGCC R1	1-E-128	128-bit	3,720	5,512	9,232	2.28 ms	3.76 ms	5.30 ms	QCSD
Mito	Code-based	NGCC R1	1-128	128-bit	3,908	5,796	9,704	2.45 ms	4.05 ms	5.72 ms	QCSD
OAEP-NTRU	Lattices	NGCC R1	2592	512-bit	4,860	4,988	9,848	121.8 µs	236.4 µs	165.3 µs	NTRU/RLWE

BRQC	Code-based	NGCC R1	256	256-bit	3,345	6,626	9,971	492.0 µs	782.0 µs	3.27 ms	Rank Synd. Dec.

BIKE-MLThre	Code-based	NGCC R1	BIKE_MLThre-256	256-bit	5,122	5,154	10,276	4.16 s	22.60 ms	116.14 ms	QC-MDPC

MAMBA-Frost	Lattices	NGCC R1	128	128-bit	5,152	5,192	10,344	366.9 µs	513.1 µs	605.0 µs	LWE

BRA	Code-based	NGCC R1	512	512-bit	3,573	7,082	10,655	422.0 µs	753.8 µs	2.34 ms	Rank Synd. Dec.

C-Multi-UR-AG	Code-based	NGCC R1	CMultiURAG-128	128-bit	3,866	7,332	11,198	446.3 µs	746.7 µs	1.86 ms	Rank Synd. Dec.

Mito	Code-based	NGCC R1	2-E-128	128-bit	5,192	6,440	11,632	3.39 ms	4.86 ms	6.46 ms	QCSD
Scloud+	Lattices	NGCC R1	Scloudplus-128	128-bit	6,096	6,160	12,256	934.4 µs	969.2 µs	902.1 µs	LWE
BAG-Piglet	Code-based	NGCC R1	bag_piglet_512	512-bit	4,158	8,204	12,362	15.46 ms	13.18 ms	46.67 ms	Rank Synd. Dec.

LoongKEM	Lattices	NGCC R1	Loong384	384-bit	6,444	6,680	13,124	12.90 ms	12.95 ms	13.03 ms	LWE

TRIKE	Code-based	NGCC R1	5	256-bit	4,453	8,874	13,327	196.31 ms	18.33 ms	48.08 ms	QC-MDPC
HQC	Code-based	Std pending	192	3	4,514	8,978	13,492	42.8 µs	81.6 µs	191.0 µs	QCSD

BAG-Loong	Code-based	NGCC R1	256	256-bit	6,597	8,400	14,997	36.09 ms	31.23 ms	60.97 ms	Rank Synd. Dec.

NSS-HQC	Code-based	NGCC R1	HQC-256	256-bit	6,844	9,084	15,928	26.62 ms	47.99 ms	82.81 ms	QCSD

HARE	Code-based	NGCC R1	256-kr	256-bit	6,580	11,790	18,370	249.7 µs	966.2 µs	1.66 ms	QCSD
TriQ-KEM	Code-based	NGCC R1	256	256-bit	6,328	12,472	18,800	309.4 µs	481.6 µs	675.5 µs	QCSD
FrodoKEM	Lattices	NIST R3ISO	640-AES	1	9,616	9,752	19,368	252.2 µs	279.1 µs	269.1 µs	LWE

FrodoKEM	Lattices	NIST R3ISO	640-SHAKE	1	9,616	9,752	19,368	540.3 µs	574.1 µs	559.2 µs	LWE

BRQC	Code-based	NGCC R1	512	512-bit	6,562	13,060	19,622	912.5 µs	1.46 ms	7.64 ms	Rank Synd. Dec.

Mito	Code-based	NGCC R1	1-E-256	256-bit	8,130	12,130	20,260	7.54 ms	12.53 ms	17.70 ms	QCSD
QUBE	Code-based	NGCC R1	256	256-bit	10,446	10,423	20,869	653.0 µs	672.8 µs	1.20 ms	QCSD

Mito	Code-based	NGCC R1	1-256	256-bit	8,522	12,714	21,236	7.41 ms	12.33 ms	17.43 ms	QCSD
LoongKEM	Lattices	NGCC R1	Loong512	512-bit	10,640	10,848	21,488	20.97 ms	20.72 ms	20.86 ms	LWE

HQC	Code-based	Std pending	256	5	7,237	14,421	21,658	83.9 µs	162.6 µs	377.6 µs	QCSD

Mito	Code-based	NGCC R1	2-E-256	256-bit	10,828	13,484	24,312	10.60 ms	15.30 ms	20.26 ms	QCSD
C-Multi-UR-AG	Code-based	NGCC R1	CMultiURAG-256	256-bit	10,780	15,304	26,084	951.8 µs	1.52 ms	3.74 ms	Rank Synd. Dec.

TRIKE	Code-based	NGCC R1	7	384-bit	8,776	17,488	26,264	642.79 ms	54.36 ms	138.18 ms	QC-MDPC
BAG-Loong	Code-based	NGCC R1	384	384-bit	12,152	15,112	27,264	82.60 ms	63.37 ms	125.09 ms	Rank Synd. Dec.

FrodoKEM	Lattices	NIST R3ISO	976-AES	3	15,632	15,792	31,424	488.4 µs	525.6 µs	500.4 µs	LWE

FrodoKEM	Lattices	NIST R3ISO	976-SHAKE	3	15,632	15,792	31,424	1.12 ms	1.17 ms	1.15 ms	LWE

MAMBA-Frost	Lattices	NGCC R1	256	256-bit	16,776	15,552	32,328	1.57 ms	2.01 ms	2.11 ms	LWE

NSS-HQC	Code-based	NGCC R1	HQC-384	384-bit	15,371	18,571	33,942	89.70 ms	161.92 ms	264.07 ms	QCSD

Scloud+	Lattices	NGCC R1	Scloudplus-256	256-bit	16,296	17,925	34,221	3.58 ms	3.72 ms	3.56 ms	LWE
TriQ-KEM	Code-based	NGCC R1	384	384-bit	12,255	24,335	36,590	656.4 µs	1.01 ms	1.56 ms	QCSD
HARE	Code-based	NGCC R1	384-kr	384-bit	13,157	23,693	36,850	656.2 µs	2.30 ms	3.75 ms	QCSD
BIKE-MLThre	Code-based	NGCC R1	BIKE_MLThre-512	512-bit	18,751	18,815	37,566	53.32 s	174.81 ms	829.13 ms	QC-MDPC

BAG-Loong	Code-based	NGCC R1	512	512-bit	19,043	21,660	40,703	139.37 ms	92.72 ms	181.28 ms	Rank Synd. Dec.

QUBE	Code-based	NGCC R1	384	384-bit	20,738	20,633	41,371	1.54 ms	1.60 ms	2.81 ms	QCSD

TRIKE	Code-based	NGCC R1	9	512-bit	14,320	28,576	42,896	812.38 ms	55.18 ms	266.64 ms	QC-MDPC
FrodoKEM	Lattices	NIST R3ISO	1344-AES	5	21,520	21,696	43,216	854.1 µs	887.1 µs	856.6 µs	LWE

FrodoKEM	Lattices	NIST R3ISO	1344-SHAKE	5	21,520	21,696	43,216	1.98 ms	2.04 ms	2.00 ms	LWE

NSS-HQC	Code-based	NGCC R1	HQC-512	512-bit	27,302	31,462	58,764	211.89 ms	387.48 ms	615.97 ms	QCSD

TriQ-KEM	Code-based	NGCC R1	512	512-bit	19,768	39,320	59,088	1.80 ms	2.78 ms	3.95 ms	QCSD
HARE	Code-based	NGCC R1	512-kr	512-bit	21,812	39,294	61,106	1.68 ms	4.59 ms	7.56 ms	QCSD
MAMBA-Frost	Lattices	NGCC R1	384	384-bit	25,096	37,736	62,832	2.75 ms	4.57 ms	4.97 ms	LWE

Mito	Code-based	NGCC R1	1-E-512	512-bit	25,674	38,442	64,116	43.10 ms	71.81 ms	101.06 ms	QCSD
Mito	Code-based	NGCC R1	1-512	512-bit	26,630	39,878	66,508	45.29 ms	75.48 ms	106.25 ms	QCSD
Scloud+	Lattices	NGCC R1	Scloudplus-384	384-bit	33,296	33,600	66,896	7.17 ms	7.38 ms	7.04 ms	LWE
QUBE	Code-based	NGCC R1	512	512-bit	34,028	33,846	67,874	4.38 ms	4.44 ms	6.57 ms	QCSD

C-Multi-UR-AG	Code-based	NGCC R1	CMultiURAG-512	512-bit	28,866	40,926	69,792	4.15 ms	5.86 ms	16.09 ms	Rank Synd. Dec.

Mito	Code-based	NGCC R1	2-E-512	512-bit	32,712	40,840	73,552	65.17 ms	94.23 ms	123.95 ms	QCSD
Scloud+	Lattices	NGCC R1	Scloudplus-512	512-bit	48,016	48,320	96,336	14.62 ms	14.84 ms	14.41 ms	LWE
MAMBA-Frost	Lattices	NGCC R1	512	512-bit	36,432	72,944	109,376	4.91 ms	9.29 ms	10.21 ms	LWE

QCTM	Code-based	NGCC R1	QCTM128	128-bit	167,987	640	168,627	2.46 s	563.1 µs	1.98 ms	QC twisted Goppa SD
UVW KEM	Code-based	NGCC R1	UVW-KEM-128	128-bit	208,013	1,032	209,045	196.84 ms	192.0 µs	428.08 ms	SD, (U+V,U+W) code distinguishing

Classic McEliece	Code-based	NIST R4ISO	mceliece348864	1	261,120	96	261,216	10.56 ms	8.8 µs	27.1 µs	Syndrome Decoding (binary Goppa)

HEP-QC	Code-based	NGCC R1	1	128-bit	285,889	4,433	290,322	63.06 ms	3.55 ms	61.33 ms	QCSD

Classic McEliece	Code-based	NIST R4ISO	mceliece460896	3	524,160	156	524,316	31.89 ms	15.7 µs	59.4 µs	Syndrome Decoding (binary Goppa)

QCTM	Code-based	NGCC R1	QCTM256	256-bit	595,662	1,153	596,815	10.68 s	538.0 µs	4.56 ms	QC twisted Goppa SD
UVW KEM	Code-based	NGCC R1	UVW-KEM-256	256-bit	911,645	2,199	913,844	1.52 s	588.3 µs	2.97 s	SD, (U+V,U+W) code distinguishing

Classic McEliece	Code-based	NIST R4ISO	mceliece6688128	5	1,044,992	208	1,045,200	76.38 ms	35.6 µs	79.9 µs	Syndrome Decoding (binary Goppa)

Classic McEliece	Code-based	NIST R4ISO	mceliece6960119	5	1,047,319	194	1,047,513	47.61 ms	37.6 µs	77.4 µs	Syndrome Decoding (binary Goppa)

Classic McEliece	Code-based	NIST R4ISO	mceliece8192128	5	1,357,824	208	1,358,032	72.60 ms	52.5 µs	80.1 µs	Syndrome Decoding (binary Goppa)

HEP-QC	Code-based	NGCC R1	5	256-bit	1,852,485	14,421	1,866,906	235.79 ms	23.07 ms	214.49 ms	QCSD

QCTM	Code-based	NGCC R1	QCTM512	512-bit	2,374,727	2,264	2,376,991	218.76 s	4.61 ms	15.99 ms	QC twisted Goppa SD

UVW KEM	Code-based	NGCC R1	UVW-KEM-512	512-bit	4,001,850	4,820	4,006,670	11.98 s	4.71 ms	19.61 s	SD, (U+V,U+W) code distinguishing

HEP-QC	Code-based	NGCC R1	7	512-bit	12,644,449	49,297	12,693,746	1.26 s	155.20 ms	831.15 ms	QCSD

195 parameter sets

Legend pre-quantumbroken schemeimplementation findingssecurity warningnote value estimated from cycle counts at 2.5 GHz — not yet benchmarked timeout / DNF benchmark did not finish (too slow / failed) no code: no implementation to benchmark Select an icon for details

Benchmark environments (2)

Timings come from more than one run; each parameter set's timing cells name their run in the tooltip on its scheme page.

Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.

2026-11-12-c8i.4xlarge

Date 12 November 2026

Machine EC2 c8i.4xlarge

CPU Intel(R) Xeon(R) 6975P-C — 16 cores, 2 threads/core, MHz max, governor: unknown, turbo: unknown

OS Ubuntu 26.04.1 LTS (kernel 7.0.0-1016-aws)

Compiler cc (Ubuntu 15.2.0-16ubuntu1) 15.2.0

OpenSSL OpenSSL 3.5.5 27 Jan 2026 (Library: OpenSSL 3.5.5 27 Jan 2026)

Method KEM keygen/encapsulation/decapsulation. Median over 1000 iterations (fewer for slow schemes). Cycle counter: rdpmc CPU_CYCLES (real core cycles, user-space). Wall clock: clock_gettime(CLOCK_MONOTONIC). Benchmark thread pinned to one core.

Implementation sources ▸

2026-10-16-c8i.4xlarge

Date 16 October 2026

Machine EC2 c8i.4xlarge

CPU Intel(R) Xeon(R) 6975P-C — 16 cores, 2 threads/core, MHz max, governor: unknown, turbo: unknown

OS Ubuntu 26.04.1 LTS (kernel 7.0.0-1014-aws)

Compiler cc (Ubuntu 15.2.0-16ubuntu1) 15.2.0

OpenSSL OpenSSL 3.5.5 27 Jan 2026 (Library: OpenSSL 3.5.5 27 Jan 2026)

Implementation sources ▸

Benchmark data licensed under CC-BY-4.0(opens in a new tab) — Thom Wiggers / PQShield