Summary of all KEM algorithms in second round of NIST post-quantum non-competition.

1,3,5

Name Problem base IND-CCA PK min PK max SK min SK max CT min CT max Failure rate NIST sec.lvl Patent Transform Comments
BIKE1 Codes (QC-MDPC)
20326 65498 20326 65498 20326 65498 10 ^ -7 1,3,5

BIKE2 Codes (QC-MDPC)
10163 32749

10163 32749 10 ^ -7 1,3,5

fast encryption

smaller public key and ciphertext

BIKE3 Codes (QC-MDPC)
22054 72262 22054 72262 22054 72262 10 ^ -7 1,3,5 yes; may be dropped
fast encryption, key generation at a cost of security
Classic McEliece Codes (Goppa) x 1047319 1357824 13908 14080 226 240
5

  • easy to understand spec
  • 40 years of research
  • possibility to scale up security level
Crystals-Kyber Module -LWE x 736 1440 1632 3168 800 1504 2 ^ -145 (Kyber512) 1,3,5
x
FrodoKEM LWE x 9616 15632 19872 31272 9736 15768
1,3
x
  • Security level
    • C: 143; Q: 103
HQC Codes (hamming quasi-cyclic codes) x 5558 17714 252 566 5622 17778
1,3,5
x
  • pb key ciphertext 2x larger than BIKE
LAC Ring-LWE x 544 1056 1056 2080 736 1472 2 ^ -83 1,2
x
LEDAcrypt Codes (QC-LDPC) x 3480 22704 668 1772 3480 12384
1,2,3,4,5

  • Allows reduction in the required key storage
NewHope Ring-LWE x 928 1824 1888 3680 1120 2208 2 ^ -213 (NewHope512) 1,5
x
NTRU NTRU x 1140
1422
1281

1
SXY
  • To be changed after merger document is out
NTRU Prime NTRU x 1047 1281

1047 1175



  • No decryption failures
  • Readable spec
NTS-KEM Codes (Goppa) x 319488 1419704 9216 19890 128 253
1,3,5 x Patent abandoned, see: hereandhere
ROLLO Codes (quasi-cyclic and LRPC)
3149 (Lake I) 9523 (Locker IX)



Between 2^-64 (locker I) and 2^-128 (locker IX) 1,3,5

  • that's a bit complicated. Submission contains 3 different algorithms - LAKE, Locker and Rank Ouroboros
Round5 KEM General LWR x 445 B 972 B 16 B 32 B 539 1082 Between 2^-78 and 2^-95 1,3,5 yes x Energy (Round5, level 1): KEX: 0.12 mJ (BLE); RF: 0.60 mJ
RQC Codes (rank quasi-cyclic) x








x
SABER Module-LWE x x
SIKE Isogeny x 378 726 434 766 402 766 0 HHK
  • Energy (SIKE/p434): KEX: 33 mJ (BLE); RF: 0.41 mJ
  • SK includes public key
3Bears Integer module-LWE x custom

Some notes