SMAUG-T

Lattices · MLWE / MLWR · kpqc.cryptolab.co.kr(opens in a new tab)

Programmes: KpqC selected
Status: KpqC standard
Security flags: None on current sets

Parameter sets

Parameter sets of SMAUG-T
Parameter set	Level	pk (B)	ct (B)	pk+ct (B)	Keygen	Encaps	Decaps
SMAUG-T128 Recommended Note	1	672	672	1,344	8.3 µs	6.9 µs	9.5 µs
SMAUG-T192 Recommended Note	3	1,088	992	2,080	11.8 µs	11.3 µs	15.1 µs
SMAUG-T256 Recommended Note	5	1,440	1,376	2,816	14.5 µs	14.1 µs	19.1 µs
TiMER Note	1	672	608	1,280	8.3 µs	6.8 µs	9.6 µs

Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.

Security flags

Note (all parameter sets): Module-LWE/LWR KEM (CryptoLab) selected as a final algorithm in Korea's KpqC competition, merged with TiGER during round 2. Uses a sparse secret and the Fujisaki-Okamoto transform over an MLWE/MLWR IND-CPA PKE, in the style of Kyber/Saber.

History

14 Oct 2026 added to site 10 Nov 2026 Update

Added alternative and additional parameter sets for which official code exists; the main sets are marked, so the Recommended filter hides the new ones. SLH-DSA: the three SHAKE sets of the NIST SP 800-230 initial public draft (13 April 2026), SHAKE-128-24, SHAKE-192-24 and SHAKE-256-24, limited to 2²⁴ signatures per key, with 3,856, 7,752 and 14,944-byte signatures (Table 1). The draft is not final. We build them from the experimental SP 800-230 support in slhdsa-c PR #51 (not yet merged). The code of the FIPS 205 sets in our benchmark moved to that commit too; compared with before it adds a signature-length check in verification and larger stack buffers, and the algorithms are unchanged. Without a cached hypertree, key generation and each signature rebuild a 2²¹–2²²-leaf tree and take minutes. SDitH: the six v3.0 instances with cipher-based grinding (specification Table 5, *-cipherpow), from the v3.0.0 code we already benchmark; the L1 and L3 fast instances have 4,643 and 10,452-byte signatures, the others match the main instances. SMAUG-T: TiMER, the additional level-1 parameter set of the v4.0 specification (672-byte public key, 608-byte ciphertext), from its AVX2 implementation in the SMAUG-T code we already benchmark. Timings for the new sets follow from our next benchmark run. Mirath-v, Mirath KeyGen2 and RYDE-v are not added because their code has not been published.
2 Jul 2026 Update

Added SMAUG-T (finalist algorithm selected in Korea's KpqC competition) to the KEMs comparison page, with benchmarked keygen/encaps/decaps timings for SMAUG-T128, SMAUG-T192, and SMAUG-T256.
16 Jan 2025 added to site 10 Nov 2026 Milestone

KpqC announced its final algorithms: AIMer and HAETAE (signatures), NTRU+ and SMAUG-T (KEMs). AIMer was then at v2.1.

Full timeline →