diff --git a/crypto_kem/frodokem1344aes/clean/kem.c b/crypto_kem/frodokem1344aes/clean/kem.c
index 58274ee4..8faaf005 100644
--- a/crypto_kem/frodokem1344aes/clean/kem.c
+++ b/crypto_kem/frodokem1344aes/clean/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM1344AES_CLEAN_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem1344aes/opt/kem.c b/crypto_kem/frodokem1344aes/opt/kem.c
index f5d73a2d..f00af9c4 100644
--- a/crypto_kem/frodokem1344aes/opt/kem.c
+++ b/crypto_kem/frodokem1344aes/opt/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM1344AES_OPT_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, c
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem1344shake/clean/kem.c b/crypto_kem/frodokem1344shake/clean/kem.c
index b018e262..9e4bd8b5 100644
--- a/crypto_kem/frodokem1344shake/clean/kem.c
+++ b/crypto_kem/frodokem1344shake/clean/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM1344SHAKE_CLEAN_crypto_kem_dec(uint8_t *ss, const uint8_t *c
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem1344shake/opt/kem.c b/crypto_kem/frodokem1344shake/opt/kem.c
index 2e9fd712..d4022d58 100644
--- a/crypto_kem/frodokem1344shake/opt/kem.c
+++ b/crypto_kem/frodokem1344shake/opt/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM1344SHAKE_OPT_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem640aes/clean/kem.c b/crypto_kem/frodokem640aes/clean/kem.c
index 9edf1226..75b38eb0 100644
--- a/crypto_kem/frodokem640aes/clean/kem.c
+++ b/crypto_kem/frodokem640aes/clean/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM640AES_CLEAN_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem640aes/opt/kem.c b/crypto_kem/frodokem640aes/opt/kem.c
index e11cc4d1..587fd86b 100644
--- a/crypto_kem/frodokem640aes/opt/kem.c
+++ b/crypto_kem/frodokem640aes/opt/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM640AES_OPT_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, co
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem640shake/clean/kem.c b/crypto_kem/frodokem640shake/clean/kem.c
index 2604a9ef..b9c42351 100644
--- a/crypto_kem/frodokem640shake/clean/kem.c
+++ b/crypto_kem/frodokem640shake/clean/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM640SHAKE_CLEAN_crypto_kem_dec(uint8_t *ss, const uint8_t *ct
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem640shake/opt/kem.c b/crypto_kem/frodokem640shake/opt/kem.c
index c3ba675a..606e5544 100644
--- a/crypto_kem/frodokem640shake/opt/kem.c
+++ b/crypto_kem/frodokem640shake/opt/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM640SHAKE_OPT_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem976aes/clean/kem.c b/crypto_kem/frodokem976aes/clean/kem.c
index 8c0987a8..4173ba37 100644
--- a/crypto_kem/frodokem976aes/clean/kem.c
+++ b/crypto_kem/frodokem976aes/clean/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM976AES_CLEAN_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem976aes/opt/kem.c b/crypto_kem/frodokem976aes/opt/kem.c
index ccf44465..52b00bee 100644
--- a/crypto_kem/frodokem976aes/opt/kem.c
+++ b/crypto_kem/frodokem976aes/opt/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM976AES_OPT_crypto_kem_dec(uint8_t *ss, const uint8_t *ct, co
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem976shake/clean/kem.c b/crypto_kem/frodokem976shake/clean/kem.c
index 70c30dee..1b70711c 100644
--- a/crypto_kem/frodokem976shake/clean/kem.c
+++ b/crypto_kem/frodokem976shake/clean/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM976SHAKE_CLEAN_crypto_kem_dec(uint8_t *ss, const uint8_t *ct
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu
diff --git a/crypto_kem/frodokem976shake/opt/kem.c b/crypto_kem/frodokem976shake/opt/kem.c
index b5d3337f..5156b787 100644
--- a/crypto_kem/frodokem976shake/opt/kem.c
+++ b/crypto_kem/frodokem976shake/opt/kem.c
@@ -172,7 +172,7 @@ int PQCLEAN_FRODOKEM976SHAKE_OPT_crypto_kem_dec(uint8_t *ss, const uint8_t *ct,
     uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES];       // contains secret data
 
     for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) {
-        S[i] = sk_S[2*i] | (sk_S[2*i+1] << 8);
+        S[i] = sk_S[2 * i] | (sk_S[2 * i + 1] << 8);
     }
 
     // Compute W = C - Bp*S (mod q), and decode the randomness mu