FrodoKEM

Conservative KEM built on plain unstructured LWE, deliberately avoiding the algebraic shortcuts that make ML-KEM fast.

Core Principles & Analysis

• Uses no ring or module structure, so an algebraic attack on structured lattices would leave it standing.
• Recommended by European agencies including Germany's BSI and France's ANSSI for high-assurance use.
• Roughly 10× slower and 10× larger than ML-KEM — the measurable price of fewer assumptions.

Specifications & Metrics

• FAMILY: Lattice (plain LWE)
• STATUS: ISO standardization track
• YEAR: 2016