Advanced Graph
← BackCustomise axes to compare KEMs on any combination of size and performance dimensions.
Filters ▼
pk size vs. ct size (log–log scale)
X axis
Y axis
Shape = family · tap point for details
Scroll to zoom · drag to pan
| Scheme | Category | Status | Parameter Set | Level | pk (B) | ct (B) | pk+ct (B) ▲ | Keygen | Encaps | Decaps | Assumption |
|---|---|---|---|---|---|---|---|---|---|---|---|
| ECDH | Pre-Quantum | Classic | X25519 | N/A | 32 | 32 | 64 | 35.9 µs | 68.1 µs | 32.6 µs | Elliptic Curves |
| ECDH | Pre-Quantum | Classic | X448 | N/A | 56 | 56 | 112 | 216.6 µs | 405.1 µs | 183.0 µs | Elliptic Curves |
| ECDH | Pre-Quantum | Classic | P-256 | N/A | 65 | 65 | 130 | 23.8 µs | 117.1 µs | 96.6 µs | Elliptic Curves |
| ECDH | Pre-Quantum | Classic | P-384 | N/A | 97 | 97 | 194 | 800.6 µs | 1.60 ms | 805.4 µs | Elliptic Curves |
| BAT | Lattices | Academic | 257-512 | 1 | 521 | 473 | 994 | 5.72 ms | 3.8 µs | 23.0 µs | NTRU |
| SMAUG-T | Lattices | KpqC standard | SMAUG-T128 | 1 | 672 | 672 | 1,344 | 12.8 µs | 8.7 µs | 12.9 µs | MLWE / MLWR |
| NTRU | Lattices | R3 finalist | ntruhps2048509 | 1 | 699 | 699 | 1,398 | 38.4 µs | 9.6 µs | 7.8 µs | NTRU |
| SABER | Lattices | R3 finalist | LightSaber | 1 | 672 | 736 | 1,408 | 15.6 µs | 15.2 µs | 13.5 µs | Module Learning With Rounding (MLWR) |
| ML-KEM | Lattices | FIPS | 512 | 1 | 800 | 768 | 1,568 | 7.1 µs | 8.3 µs | 10.4 µs | MLWE |
| NTRU | Lattices | R3 finalist | ntruhps2048677 | 3 | 930 | 930 | 1,860 | 68.2 µs | 13.7 µs | 12.1 µs | NTRU |
| NTRU Prime | Lattices | R3 alternate | sntrup653 | 2 | 994 | 897 | 1,891 | 207.8 µs | 16.7 µs | 19.4 µs | NTRU |
| SABER | Lattices | R3 finalist | Saber | 3 | 992 | 1,088 | 2,080 | 25.6 µs | 26.3 µs | 24.1 µs | Module Learning With Rounding (MLWR) |
| SMAUG-T | Lattices | KpqC standard | SMAUG-T192 | 3 | 1,088 | 992 | 2,080 | 15.8 µs | 13.5 µs | 18.4 µs | MLWE / MLWR |
| NTRU Prime | Lattices | R3 alternate | sntrup761 | 2 | 1,158 | 1,039 | 2,197 | 338.8 µs | 23.5 µs | 26.0 µs | NTRU |
| BAT | Lattices | Academic | 769-1024 | 5 | 1,230 | 1,006 | 2,236 | 28.53 ms | 8.7 µs | 50.3 µs | NTRU |
| ML-KEM | Lattices | FIPS | 768 | 3 | 1,184 | 1,088 | 2,272 | 11.8 µs | 12.8 µs | 16.0 µs | MLWE |
| NTRU | Lattices | R3 finalist | ntruhrss701 | 1 | 1,138 | 1,138 | 2,276 | 68.0 µs | 9.1 µs | 13.6 µs | NTRU |
| NTRU+ | Lattices | KpqC standard | NTRU+768 | 1 | 1,152 | 1,152 | 2,304 | 11.2 µs | 14.2 µs | 9.2 µs | NTRU |
| NTRU | Lattices | R3 finalist | ntruhps4096821 | 5 | 1,230 | 1,230 | 2,460 | 97.7 µs | 16.5 µs | 16.3 µs | NTRU |
| NTRU Prime | Lattices | R3 alternate | sntrup857 | 3 | 1,322 | 1,184 | 2,506 | 415.5 µs | 26.9 µs | 32.1 µs | NTRU |
| NTRU+ | Lattices | KpqC standard | NTRU+864 | 3 | 1,296 | 1,296 | 2,592 | 12.4 µs | 16.5 µs | 11.1 µs | NTRU |
| SABER | Lattices | R3 finalist | FireSaber | 5 | 1,312 | 1,472 | 2,784 | 36.4 µs | 38.2 µs | 36.2 µs | Module Learning With Rounding (MLWR) |
| SMAUG-T | Lattices | KpqC standard | SMAUG-T256 | 5 | 1,440 | 1,376 | 2,816 | 21.2 µs | 18.4 µs | 25.1 µs | MLWE / MLWR |
| NTRU Prime | Lattices | R3 alternate | sntrup953 | 4 | 1,505 | 1,349 | 2,854 | 392.0 µs | 23.0 µs | 26.2 µs | NTRU |
| NTRU Prime | Lattices | R3 alternate | sntrup1013 | 4 | 1,623 | 1,455 | 3,078 | 444.0 µs | 23.4 µs | 26.2 µs | NTRU |
| ML-KEM | Lattices | FIPS | 1024 | 5 | 1,568 | 1,568 | 3,136 | 17.4 µs | 18.8 µs | 23.3 µs | MLWE |
| NTRU+ | Lattices | KpqC standard | NTRU+1152 | 5 | 1,728 | 1,728 | 3,456 | 14.7 µs | 17.3 µs | 11.6 µs | NTRU |
| NTRU Prime | Lattices | R3 alternate | sntrup1277 | 5 | 2,067 | 1,847 | 3,914 | 677.8 µs | 30.7 µs | 34.3 µs | NTRU |
| HQC | Code-based | Std pending | 128 | 1 | 2,241 | 4,433 | 6,674 | 28.8 µs | 54.7 µs | 124.7 µs | Quasi-Cyclic Syndrome Decoding |
| HQC | Code-based | Std pending | 192 | 3 | 4,514 | 8,978 | 13,492 | 67.8 µs | 125.1 µs | 252.6 µs | Quasi-Cyclic Syndrome Decoding |
| FrodoKEM | Lattices | ISO | 640-AES | 1 | 9,616 | 9,752 | 19,368 | 315.2 µs | 378.1 µs | 373.1 µs | LWE |
| FrodoKEM | Lattices | ISO | 640-SHAKE | 1 | 9,616 | 9,752 | 19,368 | 1.03 ms | 1.09 ms | 1.09 ms | LWE |
| HQC | Code-based | Std pending | 256 | 5 | 7,237 | 14,421 | 21,658 | 131.3 µs | 250.2 µs | 485.3 µs | Quasi-Cyclic Syndrome Decoding |
| FrodoKEM | Lattices | ISO | 976-AES | 3 | 15,632 | 15,792 | 31,424 | 694.0 µs | 779.6 µs | 771.2 µs | LWE |
| FrodoKEM | Lattices | ISO | 976-SHAKE | 3 | 15,632 | 15,792 | 31,424 | 2.24 ms | 2.33 ms | 2.32 ms | LWE |
| FrodoKEM | Lattices | ISO | 1344-AES | 5 | 21,520 | 21,696 | 43,216 | 1.03 ms | 1.13 ms | 1.11 ms | LWE |
| FrodoKEM | Lattices | ISO | 1344-SHAKE | 5 | 21,520 | 21,696 | 43,216 | 3.93 ms | 4.07 ms | 4.05 ms | LWE |
| Classic McEliece | Code-based | ISO | mceliece348864 | 1 | 261,120 | 96 | 261,216 | 16.96 ms | 11.4 µs | 39.2 µs | Syndrome Decoding (binary Goppa) |
| Classic McEliece | Code-based | ISO | mceliece460896 | 3 | 524,160 | 156 | 524,316 | 53.13 ms | 28.9 µs | 90.7 µs | Syndrome Decoding (binary Goppa) |
| Classic McEliece | Code-based | ISO | mceliece6688128 | 5 | 1,044,992 | 208 | 1,045,200 | 127.11 ms | 58.7 µs | 117.3 µs | Syndrome Decoding (binary Goppa) |
| Classic McEliece | Code-based | ISO | mceliece6960119 | 5 | 1,047,319 | 194 | 1,047,513 | 133.96 ms | 55.5 µs | 103.3 µs | Syndrome Decoding (binary Goppa) |
| Classic McEliece | Code-based | ISO | mceliece8192128 | 5 | 1,357,824 | 208 | 1,358,032 | 129.49 ms | 70.4 µs | 107.5 µs | Syndrome Decoding (binary Goppa) |
42 parameter sets
Legend: 💣 pre-quantum (classical security only) · 🧨 broken · ⚠️ security warning · ℹ️ note · value estimated from cycle counts · tap icons for details