RustCrypto Frodo-KEM
A pure Rust implementation of FrodoKEM and eFrodoKEM as specified in ISO/IEC 18033-2:2006/Amd 2:2026.
FrodoKEM was an alternate candidate in round 3 of the NIST Post-Quantum Cryptography Standardization Project and is now standardized by ISO.
This crate implements the Frodo.KeyGen, Frodo.Encaps, and Frodo.Decaps
mathematical functions from Clause 14 of ISO/IEC 18033-2:2006/Amd 2:2026 for
all twelve parameter sets listed below.
Algorithmic conformance is checked against all 1,200 known-answer tests from the FrodoKEM team's official reference implementation: 100 cases for each standard and ephemeral AES and SHAKE parameter set. The tests verify deterministic key generation, encapsulation, and decapsulation outputs. Additional tests exercise implicit rejection of modified ciphertexts, parameter sizes, and serialization.
Based on a clause-by-clause implementation review and the complete official KAT suite, this crate conforms to the FrodoKEM algorithms and parameter sets specified by Clause 14 of ISO/IEC 18033-2:2006/Amd 2:2026.
This conformance assessment has not been independently verified by a third party. The crate has not received ISO certification, an accredited conformance assessment, or an independent security audit. See the detailed conformance review for the evidence and limitations behind the claim.
This crate has been tested against the test vectors provided by the FrodoKEM team and for interoperability with Open Quantum Safe's liboqs.
The implementation contained in this crate has never been independently audited!
USE AT YOUR OWN RISK!
This crate provides the following FrodoKEM algorithms:
- FrodoKEM-640-AES ✅
- FrodoKEM-976-AES ✅
- FrodoKEM-1344-AES ✅
- FrodoKEM-640-SHAKE ✅
- FrodoKEM-976-SHAKE ✅
- FrodoKEM-1344-SHAKE ✅
- eFrodoKEM-640-AES ✅
- eFrodoKEM-976-AES ✅
- eFrodoKEM-1344-AES ✅
- eFrodoKEM-640-SHAKE ✅
- eFrodoKEM-976-SHAKE ✅
- eFrodoKEM-1344-SHAKE ✅
eFrodoKEM is intended only for applications that guarantee a small number of ciphertexts per public key (for example, at most 28). Prefer standard FrodoKEM unless that usage restriction is enforced by the application.
When in doubt use the FrodoKEM algorithm variants.
To speed up AES, there are a few options available:
RUSTFLAGS="--cfg aes_armv8" cargo build --releaseensures that the ARMv8 AES instructions are used if available.frodo-kem = { version = "0.3", features = ["openssl"] }uses theopensslcrate for AES.
By default, the aes feature auto-detects the best AES implementation for your platform
for x86 and x86_64,
but not on ARMv8 where it defaults to the software implementation as of this writing.
To enable the ARMv8 AES instructions, the aes_armv8 feature is enabled in the .cargo/config file in this crate.
Enabling openssl and aesni provides the fastest Aes algorithms.
openssl tends to be faster than the aes rust crate implementation by about 10-15% on Armv8.
Shake auto detects the best implementation for your platform or like AES you can enable openssl for it also.
On Armv8, the rust shake implementation is faster than the openssl implementation by about 22-25%.
This crate has been tested against the following serde compatible formats:
- serde_bare
- postcard
- serde_cbor
- serde_json
- serde_yaml
- toml
MSRV increases are not considered breaking changes and can happen in patch releases.
The crate MSRV accounts for all supported targets and crate feature combinations, excluding explicitly unstable features.
Licensed under
at your option.
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.