Algorithms
What is FrodoKEM?
Plain Learning-with-Errors KEM without the algebraic structure of ML-KEM. Larger but conservative - selected by BSI (German government) for high-assurance applications.
Decision context
Why FrodoKEM matters
FrodoKEM uses comparatively unstructured learning-with-errors constructions, providing design diversity from module-lattice KEMs such as ML-KEM. The trade-off is substantially larger keys and ciphertexts, which can materially affect network, device, certificate, storage, and performance constraints.
How to evaluate FrodoKEM
Measure the selected AES or SHAKE parameter set on the actual client, server and intermediary path. Verify vectors, invalid-ciphertext handling and memory limits. Record the external standard or policy that makes FrodoKEM relevant; do not infer broad compliance from one national agency recommendation.
Algorithms
Algorithms evidence boundary
Algorithm names alone do not establish security or deployment readiness. Parameter set, implementation, key and signature sizes, execution boundary, validation status, and failure behaviour all matter. Buyers should distinguish a standardized primitive from a product path that has independently demonstrated that primitive in production.
Deep dive
FrodoKEM on QNSI
Plain Learning With Errors (LWE) KEM - same lattice family as ML-KEM but without the additional ring or module structure. Larger keys and ciphertexts but built on the most conservative lattice assumption.
For parameter sets, key and signature sizes, NIST ACVP conformance status, and when to use it, see the full FrodoKEM algorithm reference.
FAQ
Common questions
What is FrodoKEM?
Plain Learning-with-Errors KEM without the algebraic structure of ML-KEM. Larger but conservative - selected by BSI (German government) for high-assurance applications.
Why does FrodoKEM matter?
FrodoKEM uses comparatively unstructured learning-with-errors constructions, providing design diversity from module-lattice KEMs such as ML-KEM. The trade-off is substantially larger keys and ciphertexts, which can materially affect network, device, certificate, storage, and performance constraints.
How should FrodoKEM be evaluated?
Measure the selected AES or SHAKE parameter set on the actual client, server and intermediary path. Verify vectors, invalid-ciphertext handling and memory limits. Record the external standard or policy that makes FrodoKEM relevant; do not infer broad compliance from one national agency recommendation.
More