Paper 2025/1065
High-Order and Cortex-M4 First-Order Implementations of Masked FrodoKEM
Abstract
The key encapsulation mechanism FrodoKEM is a post-quantum algorithm based on plain LWE. While it has not been selected by the NIST for standardization, FrodoKEM shares a lot of similarities with the lattice-based standard ML-KEM and offers strong security assumptions by relying on the unstructured version of the LWE problem. This leads FrodoKEM to be recommended by European agencies ANSSI and BSI as a possible choice to obtain post-quantum security. In this paper, we discuss the practical aspects of incorporating side-channel protections in FrodoKEM by describing a fully masked version of the scheme based on several previous works on LWE-based KEMs. Furthermore, we propose an arbitrary order C implementation based on the reference code and a Cortex-M4 implementation with gadgets specialized at order 1 in low level assembly code that incorporates bespoke modifications to thwart (micro-)architectural leakages. Finally, we validate our order 1 gadgets by performing TVLA on a ChipWhisperer.
Metadata
- Available format(s)
-
PDF
- Category
- Implementation
- Publication info
- Published elsewhere. CASCADE 2026
- Keywords
- FrodoSCAKEMMaskingCortex-M4
- Contact author(s)
-
francois gerard @ unibw de
morgane guerreau @ gmail com - History
- 2026-03-23: revised
- 2025-06-06: received
- See all versions
- Short URL
- https://ia.cr/2025/1065
- License
-
CC BY
BibTeX
@misc{cryptoeprint:2025/1065,
author = {François Gérard and Morgane Guerreau},
title = {High-Order and Cortex-M4 First-Order Implementations of Masked {FrodoKEM}},
howpublished = {Cryptology {ePrint} Archive, Paper 2025/1065},
year = {2025},
url = {https://eprint.iacr.org/2025/1065}
}
