]> Composite FrodoKEM for use in X.509 Public Key Infrastructure ZTE Corp.
China song.xueyan2@zte.com.cn
China Mobile
China chenmeiling@chinamobile.com
LAMPS PQ FrodoKEM X.509 Composite FrodoKEM defines combinations of FrodoKEM with RSA-OAEP, ECDH, X25519, and X448. This document specifies the algorithm definitions, key formats, and certificate conventions for using Composite FrodoKEM in the X.509 Public Key Infrastructure.
Introduction specifies FrodoKEM, a family of quantum-resistant key encapsulation mechanisms (KEMs) based on the Learning With Errors (LWE) problem over unstructured lattices. The detailed algorithm specification, including the KeyGen, Encapsulate, and Decapsulate procedures, is provided in . FrodoKEM offers multiple parameter sets, with the recommended sets for general use including FrodoKEM-976 for NIST security level 3 and FrodoKEM-1344 for NIST security level 5. This document defines Composite FrodoKEM, which combines a FrodoKEM component with a traditional component algorithm (RSA-OAEP, ECDH, X25519, or X448) to produce a hybrid KEM that provides both post- quantum and classical security guarantees. This document specifies the algorithm definitions, key formats, and certificate conventions for using Composite FrodoKEM in the X.509 Public Key Infrastructure . Companion documents define the use of Composite FrodoKEM in specific protocols such as CMS and TLS.
Requirements Language The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.
Composite FrodoKEM
FrodoKEM Component FrodoKEM is a key encapsulation mechanism based on the Learning With Errors (LWE) problem over unstructured lattices. FrodoKEM defines two modes of operation: standard and ephemeral. As introduced in , standard FrodoKEM doubles the length of the seedSE value and incorporates a public random salt value into encapsulation; it MAY be used in any application. Ephemeral FrodoKEM is intended only for applications where the number of ciphertexts generated per public key is small. This document specifies the use of standard FrodoKEM for composite combinations with traditional KEM algorithms. For each FrodoKEM parameter set, defines two implementation variants that differ in the internal pseudorandom function: a SHAKE variant and an AES variant. This document specifies the use of both variants for each parameter set. The parameter sets of standard FrodoKEM used in this document are shown below:
Traditional Component Algorithms The following traditional component algorithms are used with Composite FrodoKEM: RSA-OAEP: RSA encryption scheme with Optimal Asymmetric Encryption Padding. When used as a KEM component, RSA-OAEP generates a random shared secret, encrypts it with the recipient's RSA public key, and transmits the resulting ciphertext. The RSA-OAEP parameters used with Composite FrodoKEM follow the conventions specified in RFC8017. ECDH: Elliptic Curve Diffie-Hellman key agreement using the NIST prime curves. When used as a KEM component, ECDH performs ephemeral-static key agreement and hashes the resulting shared point to produce a shared secret. X25519 and X448: Elliptic Curve Diffie-Hellman key agreement using the Curve25519 and Curve448 Montgomery curves, respectively. These are used as KEMs in a manner analogous to ECDH.
Composite FrodoKEM Construction A Composite FrodoKEM public key is a concatenation of a FrodoKEM public key and a traditional algorithm public key. A Composite FrodoKEM private key is a concatenation of the corresponding private keys. The public key and private key formats are identical for both the SHAKE and AES variants of a given parameter set; the variants are distinguished only by the algorithm identifier (OID). The encapsulation and decapsulation procedures for Composite FrodoKEM invoke the underlying component algorithms independently and then combine the resulting shared secrets using a KEM combiner (see Section 3.4).
Composite FrodoKEM Operations This section defines the key generation, encapsulation, decapsulation, and shared secret combiner algorithms for Composite FrodoKEM.
Key Generation The Composite FrodoKEM key generation algorithm performs the following steps:
Key Encapsulation Mechanism The Composite FrodoKEM encapsulation algorithm performs the following steps:
Key Decapsulation Mechanism The Composite FrodoKEM decapsulation algorithm performs the following steps:
Key Combiner The KEM combiner takes as input the shared secrets and ciphertext from the component algorithms and produces a single composite shared secret. For all Composite FrodoKEM algorithms specified in this document, the combiner is defined as follows: The inclusion of the traditional ciphertext, traditional public key, and Label in the combiner input provides binding between the shared secret and the specific keying material, mitigating risks from partial key compromise. The same combiner is used for both the SHAKE and AES variants of Composite FrodoKEM.
Key Format
Public Key Format The Composite FrodoKEM public key is a concatenation of the component public keys: CompositeFrodoKEMPublicKey ::= BIT STRING The value of the BIT STRING is: bytes = frodo_pk || trad_pk where frodo_pk is the raw FrodoKEM public key bytes and trad_pk is the traditional algorithm public key in its native encoding. For ECDH and RSA-OAEP components, the trad_pk is encoded according to and , respectively. For X25519 and X448 components, the trad_pk is the 32-octet or 56-octet Montgomery u-coordinate, respectively. When carried in an X.509 SubjectPublicKeyInfo structure , the algorithm field contains the Composite FrodoKEM OID, and the subjectPublicKey field contains the CompositeFrodoKEMPublicKey.
Private Key Format The Composite FrodoKEM private key is a concatenation of the component private keys: CompositeFrodoKEMPrivateKey ::= OCTET STRING The value of the OCTET STRING is: bytes = frodo_sk || trad_sk where frodo_sk is the raw FrodoKEM private key bytes and trad_sk is the traditional algorithm private key in its native encoding. When carried in an Asymmetric Key Package , the privateKeyAlgorithm field is set to the corresponding Composite FrodoKEM algorithm identifier, the privateKey field contains the CompositeFrodoKEMPrivateKey, and the publicKey field contains the CompositeFrodoKEMPublicKey.
Encoding Rules All ASN.1 objects SHALL be encoded using DER on serialization. The deserialization routines do not check for well-formedness of the cryptographic material they are recovering. It is assumed that underlying cryptographic primitives will catch malformed values and raise an appropriate error.
Algorithm Identifiers
Composite FrodoKEM Algorithm Identifiers The following object identifiers are assigned for Composite FrodoKEM algorithms. For each FrodoKEM parameter set and traditional algorithm combination, two variants are defined: a SHAKE variant and an AES variant. The SHAKE variants use FrodoKEM with SHAKE as the internal pseudorandom function; the AES variants use FrodoKEM with AES as the internal pseudorandom function. The two variants are not interoperable and are assigned distinct object identifiers. The parameters field for all Composite FrodoKEM algorithm identifiers MUST be absent.
KEM Combiner Labels For each Composite FrodoKEM algorithm, a KEM Combiner Label is used within the KEM combiner to bind the shared secret to the specific algorithm. The Label is a fixed ASCII string that uniquely identifies the composite algorithm. The Label values are provided in two forms: where the label value is alphanumeric ASCII, they are represented below as strings. Where the label value contains problematic characters, such as backslashes, they are represented directly in hexadecimal to avoid transcription errors. For example, the Label for id-FrodoKEM976-ECDH-P384-SHA3-256 is "FrodoKEM976-P384", the label for id-FrodoKEM976-RSA2048-SHA3-256 is "FrodoKEM976-RSA2048". Because the SHAKE and AES variants have distinct object identifiers, they produce distinct Label values, ensuring that shared secrets derived from the two variants are cryptographically separated.
ASN.1 Module Composite FrodoKEM uses a substantially non-ASN.1 based encoding, as specified in , leading to a smaller overall ASN.1 module. Composite-FrodoKEM-2026 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-composite-frodokem-2026(TBDMOD) } DEFINITIONS IMPLICIT TAGS ::= BEGIN EXPORTS ALL; IMPORTS PUBLIC-KEY, AlgorithmIdentifier{}, SMIME-CAPS FROM AlgorithmInformation-2009 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-algorithmInformation-02(58) } KEM-ALGORITHM FROM KEMAlgorithmInformation-2023 { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) id-mod(0) id-mod-kemAlgorithmInformation-2023(109) } ; -- -- Information Object Classes -- pk-CompositeKEM {OBJECT IDENTIFIER:id} PUBLIC-KEY ::= { IDENTIFIER id -- KEY no ASN.1 wrapping -- PARAMS ARE absent CERT-KEY-USAGE { keyEncipherment } -- PRIVATE-KEY no ASN.1 wrapping -- } kema-CompositeKEM { OBJECT IDENTIFIER:id, PUBLIC-KEY:publicKeyType } KEM-ALGORITHM ::= { IDENTIFIER id -- VALUE no ASN.1 wrapping -- PARAMS ARE absent PUBLIC-KEYS { publicKeyType } SMIME-CAPS { IDENTIFIED BY id } } -- -- SHAKE Variants -- id-FrodoKEM976-RSA2048-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD1 } pk-FrodoKEM976-RSA2048-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-RSA2048-SHA3-256 } kema-FrodoKEM976-RSA2048-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-RSA2048-SHA3-256, pk-FrodoKEM976-RSA2048-SHA3-256 } id-FrodoKEM976-RSA3072-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD2 } pk-FrodoKEM976-RSA3072-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-RSA3072-SHA3-256 } kema-FrodoKEM976-RSA3072-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-RSA3072-SHA3-256, pk-FrodoKEM976-RSA3072-SHA3-256 } id-FrodoKEM976-RSA4096-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD3 } pk-FrodoKEM976-RSA4096-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-RSA4096-SHA3-256 } kema-FrodoKEM976-RSA4096-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-RSA4096-SHA3-256, pk-FrodoKEM976-RSA4096-SHA3-256 } id-FrodoKEM976-X25519-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD4 } pk-FrodoKEM976-X25519-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-X25519-SHA3-256 } kema-FrodoKEM976-X25519-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-X25519-SHA3-256, pk-FrodoKEM976-X25519-SHA3-256 } id-FrodoKEM976-ECDH-P256-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD5 } pk-FrodoKEM976-ECDH-P256-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-ECDH-P256-SHA3-256 } kema-FrodoKEM976-ECDH-P256-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-ECDH-P256-SHA3-256, pk-FrodoKEM976-ECDH-P256-SHA3-256 } id-FrodoKEM976-ECDH-P384-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD6 } pk-FrodoKEM976-ECDH-P384-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-ECDH-P384-SHA3-256 } kema-FrodoKEM976-ECDH-P384-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-ECDH-P384-SHA3-256, pk-FrodoKEM976-ECDH-P384-SHA3-256 } id-FrodoKEM976-ECDH-brainpoolP256r1-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD7 } pk-FrodoKEM976-ECDH-brainpoolP256r1-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-ECDH-brainpoolP256r1-SHA3-256 } kema-FrodoKEM976-ECDH-brainpoolP256r1-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-ECDH-brainpoolP256r1-SHA3-256, pk-FrodoKEM976-ECDH-brainpoolP256r1-SHA3-256 } id-FrodoKEM1344-RSA3072-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD8 } pk-FrodoKEM1344-RSA3072-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-RSA3072-SHA3-256 } kema-FrodoKEM1344-RSA3072-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-RSA3072-SHA3-256, pk-FrodoKEM1344-RSA3072-SHA3-256 } id-FrodoKEM1344-ECDH-P384-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD9 } pk-FrodoKEM1344-ECDH-P384-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-ECDH-P384-SHA3-256 } kema-FrodoKEM1344-ECDH-P384-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-ECDH-P384-SHA3-256, pk-FrodoKEM1344-ECDH-P384-SHA3-256 } id-FrodoKEM1344-ECDH-brainpoolP384r1-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD10 } pk-FrodoKEM1344-ECDH-brainpoolP384r1-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-brainpoolP384r1-P384-SHA3-256 } kema-FrodoKEM1344-ECDH-brainpoolP384r1-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-ECDH-brainpoolP384r1-SHA3-256, pk-FrodoKEM1344-ECDH-brainpoolP384r1-SHA3-256 } id-FrodoKEM1344-X448-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD11 } pk-FrodoKEM1344-X448-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-X448-SHA3-256 } kema-FrodoKEM1344-X448-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-X448-SHA3-256, pk-FrodoKEM1344-X448-SHA3-256 } id-FrodoKEM1344-ECDH-P521-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD12 } pk-FrodoKEM1344-ECDH-P521-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-ECDH-P521-SHA3-256 } kema-FrodoKEM1344-ECDH-P521-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-ECDH-P521-SHA3-256, pk-FrodoKEM1344-ECDH-P521-SHA3-256 } -- -- AES Variants -- id-FrodoKEM976-AES-RSA2048-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD13 } pk-FrodoKEM976-AES-RSA2048-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-AES-RSA2048-SHA3-256 } kema-FrodoKEM976-AES-RSA2048-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-AES-RSA2048-SHA3-256, pk-FrodoKEM976-AES-RSA2048-SHA3-256 } id-FrodoKEM976-AES-RSA3072-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD14 } pk-FrodoKEM976-AES-RSA3072-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-AES-RSA3072-SHA3-256 } kema-FrodoKEM976-AES-RSA3072-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-AES-RSA3072-SHA3-256, pk-FrodoKEM976-AES-RSA3072-SHA3-256 } id-FrodoKEM976-AES-RSA4096-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD15 } pk-FrodoKEM976-AES-RSA4096-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-AES-RSA4096-SHA3-256 } kema-FrodoKEM976-AES-RSA4096-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-AES-RSA4096-SHA3-256, pk-FrodoKEM976-AES-RSA4096-SHA3-256 } id-FrodoKEM976-AES-X25519-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD16 } pk-FrodoKEM976-AES-X25519-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-AES-X25519-SHA3-256 } kema-FrodoKEM976-AES-X25519-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-AES-X25519-SHA3-256, pk-FrodoKEM976-AES-X25519-SHA3-256 } id-FrodoKEM976-AES-ECDH-P256-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD17 } pk-FrodoKEM976-AES-ECDH-P256-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-AES-ECDH-P256-SHA3-256 } kema-FrodoKEM976-AES-ECDH-P256-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-AES-ECDH-P256-SHA3-256, pk-FrodoKEM976-AES-ECDH-P256-SHA3-256 } id-FrodoKEM976-AES-ECDH-P384-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD18 } pk-FrodoKEM976-AES-ECDH-P384-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-AES-ECDH-P384-SHA3-256 } kema-FrodoKEM976-AES-ECDH-P384-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-AES-ECDH-P384-SHA3-256, pk-FrodoKEM976-AES-ECDH-P384-SHA3-256 } id-FrodoKEM976-AES-ECDH-brainpoolP256r1-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD19 } pk-FrodoKEM976-AES-ECDH-brainpoolP256r1-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM976-AES-ECDH-P384-SHA3-256 } kema-FrodoKEM976-AES-ECDH-brainpoolP256r1-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM976-AES-ECDH-brainpoolP256r1-SHA3-256, pk-FrodoKEM976-AES-ECDH-brainpoolP256r1-SHA3-256 } id-FrodoKEM1344-AES-RSA3072-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD20 } pk-FrodoKEM1344-AES-RSA3072-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-AES-RSA3072-SHA3-256 } kema-FrodoKEM1344-AES-RSA3072-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-AES-RSA3072-SHA3-256, pk-FrodoKEM1344-AES-RSA3072-SHA3-256 } id-FrodoKEM1344-AES-ECDH-P384-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD21 } pk-FrodoKEM1344-AES-ECDH-P384-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-AES-ECDH-P384-SHA3-256 } kema-FrodoKEM1344-AES-ECDH-P384-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-AES-ECDH-P384-SHA3-256, pk-FrodoKEM1344-AES-ECDH-P384-SHA3-256 } id-FrodoKEM1344-AES-ECDH-brainpoolP384r1-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD22 } pk-FrodoKEM1344-AES-ECDH-brainpoolP384r1-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-AES-ECDH-brainpoolP384r1-SHA3-256 } kema-FrodoKEM1344-AES-ECDH-brainpoolP384r1-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-AES-ECDH-brainpoolP384r1-SHA3-256, pk-FrodoKEM1344-AES-ECDH-brainpoolP384r1-SHA3-256 } id-FrodoKEM1344-AES-X448-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD23 } pk-FrodoKEM1344-AES-X448-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-AES-X448-SHA3-256 } kema-FrodoKEM1344-AES-X448-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-AES-X448-SHA3-256, pk-FrodoKEM1344-AES-X448-SHA3-256 } id-FrodoKEM1344-AES-ECDH-P521-SHA3-256 OBJECT IDENTIFIER ::= { iso(1) identified-organization(3) dod(6) internet(1) security(5) mechanisms(5) pkix(7) alg(6) TBD24 } pk-FrodoKEM1344-AES-ECDH-P521-SHA3-256 PUBLIC-KEY ::= pk-CompositeKEM { id-FrodoKEM1344-AES-ECDH-P521-SHA3-256 } kema-FrodoKEM1344-AES-ECDH-P521-SHA3-256 KEM-ALGORITHM ::= kema-CompositeKEM { id-FrodoKEM1344-AES-ECDH-P521-SHA3-256, pk-FrodoKEM1344-AES-ECDH-P521-SHA3-256 } END ]]>
Security Considerations The Security Considerations for implementing a composite algorithm defined in apply to this document. Additional security considerations specific to FrodoKEM, including side-channel resistance, fault attack mitigations, and parameter set selection guidance, discussed in and apply to this specification as well.
IANA Considerations
PKIX Module Identifier Registry IANA is requested to allocate a value from the "SMI Security for PKIX Module Identifier" registry for the ASN.1 module defined in Section 6. SMI Security for PKIX Module Identifier
Decimal Description References
TBDMOD id-mod-composite-frodokem-2026 This Document
PKIX Algorithm Registry IANA is requested to allocate values from the "SMI Security for PKIX Algorithm" registry (1.3.6.1.5.5.7.6) for the Composite FrodoKEM algorithm identifiers listed in Section 5.1. SMI Security for PKIX Algorithm
Decimal Description References
TBD1 id-FrodoKEM976-RSA2048-SHA3-256 This Document
TBD2 id-FrodoKEM976-RSA3072-SHA3-256 This Document
TBD3 id-FrodoKEM976-RSA4096-SHA3-256 This Document
TBD4 id-FrodoKEM976-X25519-SHA3-256 This Document
TBD5 id-FrodoKEM976-ECDH-P256-SHA3-256 This Document
TBD6 id-FrodoKEM976-ECDH-P384-SHA3-256 This Document
TBD7 id-FrodoKEM976-ECDH-brainpoolP256r1-SHA3-256 This Document
TBD8 id-FrodoKEM1344-RSA3072-SHA3-256 This Document
TBD9 id-FrodoKEM1344-ECDH-P384-SHA3-256 This Document
TBD10 id-FrodoKEM1344-ECDH-brainpoolP384r1-SHA3-256 This Document
TBD11 id-FrodoKEM1344-X448-SHA3-256 This Document
TBD12 id-FrodoKEM1344-ECDH-P521-SHA3-256 This Document
TBD13 id-FrodoKEM976-AES-RSA2048-SHA3-256 This Document
TBD14 id-FrodoKEM976-AES-RSA3072-SHA3-256 This Document
TBD15 id-FrodoKEM976-AES-RSA4096-SHA3-256 This Document
TBD16 id-FrodoKEM976-AES-X25519-SHA3-256 This Document
TBD17 id-FrodoKEM976-AES-ECDH-P256-SHA3-256 This Document
TBD18 id-FrodoKEM976-AES-ECDH-P384-SHA3-256 This Document
TBD19 id-FrodoKEM976-AES-ECDH-brainpoolP256r1-SHA3-256 This Document
TBD20 id-FrodoKEM1344-AES-RSA3072-SHA3-256 This Document
TBD21 id-FrodoKEM1344-AES-ECDH-P384-SHA3-256 This Document
TBD22 id-FrodoKEM1344-AES-ECDH-brainpoolP384r1-SHA3-256 This Document
TBD23 id-FrodoKEM1344-AES-X448-SHA3-256 This Document
TBD24 id-FrodoKEM1344-AES-ECDH-P521-SHA3-256 This Document
References Normative References Informative References FrodoKEM: key encapsulation from learning with errors Microsoft NXP Semiconductors ISO/IEC 18033-2:2006/Amd 2:2026 Information technology - Security techniques - Encryption algorithms - Part 2: Asymmetric ciphers, Amendment 2 ISO Composite ML-KEM for use in X.509 Public Key Infrastructure Entrust Limited Entrust Limited OpenCA Labs Bundesdruckerei GmbH Cisco Systems This document defines combinations of US NIST ML-KEM in hybrid with traditional algorithms RSA-OAEP, ECDH, X25519, and X448. These combinations are tailored to meet security best practices and regulatory guidelines. Composite ML-KEM is applicable in any application that uses X.509 or PKIX data structures that accept ML- KEM, but where the operator wants extra protection against breaks or catastrophic bugs in ML-KEM. Security Considerations for FrodoKEM Microsoft NXP Semiconductors Federal Office for Information Security University of Waterloo ISO standardized FrodoKEM in June 2026 [ISO18033-2-AMD2]. This document provides security guidance for FrodoKEM for use in protocols. It explains what security claims protocol designers may rely on, what assumptions and conditions are required, what parameter sets are in scope, and what implementors need to do to use FrodoKEM safely. The scope follows the current FrodoKEM Internet-Draft [I-D.FrodoKEM]. Internet X.509 Public Key Infrastructure - Algorithm Identifiers for FrodoKEM ELVIS-PLUS FrodoKEM is an unstructured lattice-based Key Encapsulation Mechanism (KEM). Compared to ML-KEM, FrodoKEM is considered as having more conservative design. This document specifies the conventions for using FrodoKEM in X.509 Public Key Infrastructure. The conventions for the subject public keys and private keys are also specified.