FrodoKEM
Lattices · LWE · frodokem.org(opens in a new tab)
- Status
- ISO standard
- Security flags
- None on current sets
Parameter sets
| Parameter set | Level | pk (B) | ct (B) | pk+ct (B) | Keygen | Encaps | Decaps |
|---|---|---|---|---|---|---|---|
| FrodoKEM-640-AES Note | 1 | 9,616 | 9,752 | 19,368 | 252.2 µs | 279.1 µs | 269.1 µs |
| FrodoKEM-640-SHAKE Note | 1 | 9,616 | 9,752 | 19,368 | 540.3 µs | 574.1 µs | 559.2 µs |
| FrodoKEM-976-AES Note | 3 | 15,632 | 15,792 | 31,424 | 488.4 µs | 525.6 µs | 500.4 µs |
| FrodoKEM-976-SHAKE Note | 3 | 15,632 | 15,792 | 31,424 | 1.12 ms | 1.17 ms | 1.15 ms |
| FrodoKEM-1344-AES Note | 5 | 21,520 | 21,696 | 43,216 | 854.1 µs | 887.1 µs | 856.6 µs |
| FrodoKEM-1344-SHAKE Note | 5 | 21,520 | 21,696 | 43,216 | 1.98 ms | 2.04 ms | 2.00 ms |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
Security flags
- Note (all parameter sets): Conservative plain-LWE KEM (no algebraic ring structure). Sizes are the standard (ISO) FrodoKEM with the salt countermeasure — ciphertexts are slightly larger than older round-3 tables. Both AES128 and SHAKE128 matrix-A generation are shown; sizes are identical, only timings differ.
History
- added to site Update
ISO/IEC 18033-2:2006/Amd 2:2026, published in June 2026, standardises FrodoKEM and Classic McEliece (the latter without mceliece348864). Both are now shown as ISO standards, and the ISO programme as completed.