Germany’s Federal Office for Information Security (BSI) advised on October 1, 2026, against using Classic McEliece in new developments or when planning new cryptographic applications. In an English note and a German press release, the agency cited significant progress in the cryptanalysis of the post-quantum scheme and said the progress indicates a substantially lower security level than previously assumed.
Classic McEliece is a key-encapsulation mechanism (KEM), a method two parties use to agree on a secret key over an open network. The scheme is based on a public-key system that Robert McEliece proposed in 1978, in which the public key is a disguised version of an error-correcting code known as a binary Goppa code. Its public keys range from about 261 kilobytes to 1.36 megabytes across five main parameter sets.
No one has publicly recovered a key for any real Classic McEliece parameter set, but BSI now advises against new uses after three research groups estimated key-recovery costs below the security level claimed for every parameter set.
BSI said no practical attack is currently possible against the parameter sets it recommends in its Technical Guideline TR-02102-1. The agency has listed Classic McEliece in that guideline since 2020 and has always recommended it only in combination with a classical key-agreement scheme. BSI said such hybrids are still at least as secure as the classical scheme.
BSI said it is still evaluating the findings and expects to revise the guideline’s Classic McEliece entries in its next edition, planned for early 2027. It also said the urgency of migrating to post-quantum cryptography is unchanged. Tobias Hemmert announced the advice on NIST’s pqc-forum mailing list on behalf of BSI’s cryptography division.
BSI said the lattice-based schemes FrodoKEM and ML-KEM, formerly CRYSTALS-Kyber, are not affected and should be preferred over Classic McEliece. ML-KEM is NIST’s main standard for key encapsulation. BSI said HQC, a code-based scheme that NIST selected in March 2025 as a backup to ML-KEM, is also unaffected and will be recommended once a standard is available.
Three cost estimates
In a paper received by the IACR Cryptology ePrint Archive on August 7, Ashrujit Ghoshal of IIT Madras, Yuval Ishai of Technion and AWS, and Aayush Jain and Nuozhou Sun of Carnegie Mellon University described a method for telling Classic McEliece public keys apart from random matrices. The archive posts papers before peer review. BSI issued its advice less than two months later.
In an August 27 revision, Ghoshal’s group added details of a key-recovery algorithm that relies on heuristic, or unproven, assumptions. They estimated its cost at 2¹³⁰ to 2¹⁴⁹ bit operations across the five parameter sets, counting each elementary logic step as one operation. Hemmert and a BSI colleague had posted an earlier method for distinguishing the keys in September 2025.
Markku-Juhani O. Saarinen of Tampere University estimated the cost of a version of the same attack at about 2¹²⁷ to 2¹⁴⁵ bit operations, figures he called conditional. Stephen A. Weis of Anthropic put the cost at 2⁹⁴ to 2¹⁰² in an analysis submitted on September 11.
NIST benchmarks three of its five post-quantum security categories against key search on the AES cipher. It estimates an AES-128 key search, the Category 1 benchmark, at 2¹⁴³ classical gate operations and an AES-256 key search, for Category 5, at 2²⁷².
The Classic McEliece team claims Category 5 for its three largest parameter sets, with one set at Category 3 and the smallest at Category 1. For the smallest set, Ghoshal’s group, Saarinen, and Weis put key recovery at about 2¹³⁰, 2¹²⁷, and 2⁹⁴, against the benchmark of 2¹⁴³. On this scale, an exponent that is 10 lower means about 1,000 times less work.
What has been demonstrated
None of the three groups’ headline figures includes a charge for memory or for moving data. Weis also estimated the cost with memory charged the way the Classic McEliece team’s security guide does, at 2¹¹⁰ to 2¹²⁸, still below the claimed level for every parameter set. Of his own estimate, he wrote, “None of this is close to practical.”
Researchers have recovered keys end to end only for toy-sized codes. In June, Hemmert reported solving 32 of the Technology Innovation Institute’s McEliece challenges, small instances with codes as long as 512. Weis and Saarinen solved the two highest-rated instances, with codes of length 214 and 223. The smallest Classic McEliece parameter set uses a code of length 3,488.
The Classic McEliece team responded to the original method from Ghoshal’s group in a statement posted on August 21 by team member Daniel J. Bernstein. “These fast detection algorithms are not attacks against the standard security goals of public-key encryption,” the team wrote.
Writing for himself on September 30, Bernstein answered no when asked whether the attacks in three of the preprints, including those by Ghoshal’s group and Weis, are feasible, adding “not even against the smallest Classic McEliece parameter set.” He wrote that “the bit-operation counts ignore massive communication costs and a massive expense for parallelization” and that he still considers ML-KEM riskier than McEliece.
Deployments and standards
Mullvad VPN has paired Classic McEliece with ML-KEM in its quantum-resistant tunnels, on by default in its desktop apps since January 2025. The team’s ISO page lists four base parameter sets that ISO standardized in June 2026. The smallest set, mceliece348864, is not among them. NIST advanced Classic McEliece to the fourth round of its standardization process but selected only HQC from that round.
The new attacks are classical algorithms that need no quantum computer. BSI said further improvements to the attacks are possible and to be expected.
Update, November 12, 2026: Weis revised his estimate on October 6 to 2⁸⁹ to 2⁹⁸ bit operations per run, or 2¹⁰⁷ to 2¹¹⁷ under the memory-cost model he called his best estimate. Kirill Vedenev of CryptoPro and Southern Federal University estimated about 2⁹⁰ to 2⁹⁹ in an October 7 revision. No key for a real parameter set had been publicly recovered by November 12.
