Conservative lattice-based KEM (not a NIST standard), recommended by BSI and encouraged by ANSSI for high-security use.
At a glance
| Quantum risk | Quantum-resistant |
|---|
| Used for | Key establishment |
|---|
| Post-quantum algorithm | Yes |
|---|
Variants and security strength
| Variant | Classical security (bits) |
|---|
| FrodoKEM-976 | 192 |
| FrodoKEM-1344 | 256 |
Positions and deadlines by authority
| Authority | Position | Effective | Scope | Details |
|---|
| BSI | Recommended | in force | all variants | In hybrid combination. |
| ANSSI | Acceptable | in force | all variants | Encouraged as a conservative option for high-security applications. |
Sources
- BSI TR-02102-1 — Cryptographic Mechanisms: Recommendations and Key Lengths (Version 2026-01) · BSI
- ANSSI views on the Post-Quantum Cryptography transition (2023 follow-up) · ANSSI (guidance)
Catalog version 2026-09-28. Every position links to its primary source; draft documents are labelled as such.