Paper 2025/1065 Original: eprint.iacr.org/2025/1065 ↗
High-Order and Cortex-M4 First-Order Implementations of Masked FrodoKEM
Abstract
The key encapsulation mechanism FrodoKEM is a post-quantum algorithm based on plain LWE. While it has not been selected by the NIST for standardization, FrodoKEM shares a lot of similarities with the lattice-based standard ML-KEM and offers strong security assumptions by relying on the unstructured version of the LWE problem. This leads FrodoKEM to be recommended by European agencies ANSSI and BSI as a possible choice to obtain post-quantum security. In this paper, we discuss the practical aspects of incorporating side-channel protections in FrodoKEM by describing a fully masked version of the scheme based on several previous works on LWE-based KEMs. Furthermore, we propose an arbitrary order C implementation based on the reference code and a Cortex-M4 implementation with gadgets specialized at order 1 in low level assembly code that incorporates bespoke modifications to thwart (micro-)architectural leakages. Finally, we validate our order 1 gadgets by performing TVLA on a ChipWhisperer.
Metadata
- Available format(s)
PDF- Category
- Implementation
- Publication info
- Preprint.
- History
- 2026-03-23: last updated
- 2025-06-06: published
- Short URL
- https://ia.cr/2025/1065
- License
- https://creativecommons.org/licenses/by/4.0/
BibTeX
@misc{cryptoeprint:2025/1065,
author = {François Gérard and Morgane Guerreau},
title = {High-Order and Cortex-M4 First-Order Implementations of Masked FrodoKEM},
howpublished = {Cryptology {ePrint} Archive, Paper 2025/1065},
year = {2025},
url = {https://eprint.iacr.org/2025/1065}
}