{
  "slug": "frodokem",
  "name": "FrodoKEM",
  "aka": "Frodo",
  "kind": "Key-encapsulation mechanism (KEM)",
  "family": "Lattice (plain LWE, unstructured)",
  "standard": "ISO/IEC 18033-2 amendment in progress; not selected by NIST",
  "standard_url": "https://frodokem.org/",
  "body": "ISO/IEC JTC 1/SC 27 (in progress); recommended by BSI (Germany) and ANSSI (France)",
  "date": "Dropped from NIST process after Round 3 (2022-07); ISO/IEC work ongoing",
  "status": "Not a NIST standard; ISO/IEC process ongoing",
  "summary": "FrodoKEM is a conservative lattice KEM based on unstructured LWE, avoiding the algebraic structure of ML-KEM. NIST did not advance it past Round 3 for performance reasons, but BSI and ANSSI recommend it and it is being standardized under ISO/IEC 18033-2. It is relevant for European regulated deployments.",
  "parameter_sets": [
    {
      "name": "FrodoKEM-640",
      "category": 1,
      "pk": 9616,
      "sk": 19888,
      "ct_or_sig": 9720
    },
    {
      "name": "FrodoKEM-976",
      "category": 3,
      "pk": 15632,
      "sk": 31296,
      "ct_or_sig": 15744
    },
    {
      "name": "FrodoKEM-1344",
      "category": 5,
      "pk": 21520,
      "sk": 43088,
      "ct_or_sig": 21632
    }
  ],
  "size_label": "Ciphertext",
  "deployments": [
    "European government and regulated deployments; available in liboqs"
  ],
  "audit_focus": [
    "Matrix generation from seed (AES vs SHAKE variants) and its performance/side-channel profile",
    "Constant-time sampling from the rounded-Gaussian table",
    "Ephemeral-only (eFrodoKEM) vs static-key variants and the implicit rejection differences between them"
  ],
  "references": [
    [
      "FrodoKEM project",
      "https://frodokem.org/"
    ]
  ],
  "url": "https://pqaudit.org/algorithms/frodokem/",
  "updated": "2026-09-12"
}