ML-KEM
Lattices · MLWE · csrc.nist.gov(opens in a new tab)
- Programmes
- FIPS
- Status
- FIPS
- Security flags
- None on current sets
Parameter sets
| Parameter set | Level | pk (B) | ct (B) | pk+ct (B) | Keygen | Encaps | Decaps |
|---|---|---|---|---|---|---|---|
| ML-KEM-512 | 1 | 800 | 768 | 1,568 | 6.2 µs | 6.9 µs | 8.2 µs |
| ML-KEM-768 | 3 | 1,184 | 1,088 | 2,272 | 9.3 µs | 10.0 µs | 12.0 µs |
| ML-KEM-1024 | 5 | 1,568 | 1,568 | 3,136 | 12.9 µs | 13.9 µs | 16.6 µs |
Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.
History
- Update
ML-DSA, MAYO and ML-KEM: we moved our builds to the latest upstream code. ML-DSA uses the pq-crystals reference at d35ba3f, with two AVX2 conformance fixes by Gregor Seiler: the stricter infinity-norm check FIPS 204 requires (issue 113) and the rounding of
use_hintwhen the low part is zero (bba9534, reported by Eric Biggers). MAYO uses MAYO-C at 412cb8a, which makes the generic echelon-form routine constant-time; our GFNI/AVX-512 build uses the AVX2 echelon-form code, which this commit does not change. ML-KEM uses mlkem-native v2.0.0. Sizes are unchanged and upstream's known-answer tests pass for every set. We re-benchmarked all three on AWS c8i.4xlarge; the timings do not change beyond run-to-run variation.