FrodoKEM-640 Security API
Side-channel claim limit. Nothing on this page claims constant-time behaviour or side-channel resistance for any target: the side-channel harness covers nothing (finding A48) and no measurement exists. The Rust and C cores are designed for constant time and unmeasured; managed runtimes (JIT, GC, bounds checks) make no timing claim. Where this page names constant-time or side-channel techniques, in prose or in code, they are design intent or recommendations, not measured properties.
Version: 1.0.0
Last Updated: 2025-01-02
Security Classification: Lattice-Based KEM
Author: MetaMUI Security Team
Overview
FrodoKEM-640 is a conservative lattice-based KEM using standard LWE, providing strong security with larger keys.
- Algorithm Family: Learning With Errors (LWE)
- Security Level: NIST Level 1 (128-bit)
- Key Sizes:
- Public Key: 9616 bytes
- Secret Key: 19888 bytes
- Ciphertext: 9720 bytes
- NIST Round: Round 3 alternate
Security Warnings ⚠️
- Conservative Design: Based on standard LWE problem
- Large Keys: Significantly larger than ML-KEM
- No Structure: Does not use ring/module structure
- High Bandwidth: Not suitable for constrained networks
API Functions
Standard KEM interface with LWE-based construction.
Security Analysis
Threat Model: FrodoKEM-640 Threat Model
The comprehensive threat analysis covers:
- Algorithm-specific attack vectors
- Implementation vulnerabilities
- Side-channel considerations
- Quantum resistance analysis (where applicable)
- Deployment recommendations
For complete security analysis and risk assessment, see the dedicated threat model documentation.