A conservative quantum-safe key exchange that avoids extra structure, at the cost of bigger keys.
The idea: The same idea as ML-KEM, noisy equations hiding a key, but with plain random matrices instead of compact polynomials. That makes keys more than ten times bigger and drops the extra bet that the polynomial structure gives attackers no shortcut.
Why it matters: A safe fallback if structured lattices ever weaken.
On the map: plain LWE: survives a structure break
A conservative key encapsulation scheme built on plain LWE, with no ring or module structure[1]. Keys are larger (about 10 to 20 KB), but it survives even if structured lattices turn out to be exploitable.
Recommended by Germany's BSI[2] and standardized by ISO in 2026 (ISO/IEC 18033-2 Amd 2).
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.