Fixed moduli keep lattice PQC simple across security levels

Standardized lattice post-quantum schemes including FrodoKEM, ML-KEM, and ML-DSA reuse the same modulus q (and, for the module schemes, the same underlying ring) across parameter sets, varying mainly module rank. The choice favors simpler multi-level implementations over pure performance or security tuning.

Demi Obenour raised the issue on the NIST PQC forum, arguing the approach looks suboptimal for KEMs. Holding decryption failure rates down forces narrower error distributions as dimension grows, which can demand larger n and may push instances into regimes more exposed to newer attacks. Varying n, q, ring size, rank, and error widths independently would seem better from a pure crypto view, she wrote, unless implementation cost is the real constraint.

Greg Maxwell answered that code generation is less of a barrier than it once was, but any implementation that must support several levels still needs efficient software and hardware for each size. That cost cannot be removed. Parameter decisions are driven by the most constrained deployments: flash-limited embedded devices and silicon area for accelerators. Desktop-class platforms could absorb far higher overhead and larger safety margins; the limited ones cannot.

Mike Hamburg sketched the hardware trade-offs. A power-of-two modulus (as in SABER or FrodoKEM) lets silicon sized for the largest set handle smaller ones by ignoring high bits or zeroing low ones, eases masking conversions, and favors low area, though it forgoes NTT speed in favor of Karatsuba-style methods. Special modulus families, extra ciphertext bits, or modest error-correcting codes can blunt noise growth, but each adds area or side-channel surface. NTT wins on speed; power-of-two wins on area. There is no free lunch, only partial reuse.

The exchange shows why the standardized schemes accept fixed parameters: multi-level practicality on constrained platforms outweighs fine-grained lattice tuning.