Classic McEliece

Parameter sets

Wall-clock times vary between runs and machines (CPU frequency scaling, other tenants on cloud VMs); cycle counts are the steadier basis for comparison.

Security flags

• Broken (mceliece348864): Heuristic key recovery, building on the distinguisher of Ghoshal, Ishai, Jain and Sun, costs 2^107 to 2^117 bit operations once memory is charged (Weis), below the 2^143 of category 1. Saarinen's itemised count gives 2^127. No key of a Classic McEliece parameter set has been recovered. Bernstein argues that counts of bit operations ignore the cost of moving data, which dominates these attacks. No estimate in that model has been published.
• Note (all parameter sets): Code-based KEM. Public keys are enormous (255 KB–1.3 MB) but ciphertexts are tiny. Key generation is variable-time and slow. The five base parameter sets are shown; libmceliece also offers f (fast-keygen), pc and pcf variants. Standardised in ISO/IEC 18033-2:2006/Amd 2:2026 (June 2026), which includes the 460896, 6688128, 6960119 and 8192128 families (with f, pc and pcf variants) but not mceliece348864; also a NIST round-4 candidate.
• Broken (mceliece460896): Heuristic key recovery, building on the distinguisher of Ghoshal, Ishai, Jain and Sun, costs 2^114 to 2^125 bit operations once memory is charged (Weis), below the 2^207 of category 3. Saarinen's itemised count gives 2^145. No key of a Classic McEliece parameter set has been recovered.
• Broken (mceliece6688128, mceliece8192128): Heuristic key recovery, building on the distinguisher of Ghoshal, Ishai, Jain and Sun, costs 2^117 to 2^128 bit operations once memory is charged (Weis), below the 2^272 of category 5. Saarinen's itemised count gives 2^137. No key of a Classic McEliece parameter set has been recovered.
• Broken (mceliece6960119): Heuristic key recovery, building on the distinguisher of Ghoshal, Ishai, Jain and Sun, costs 2^116 to 2^127 bit operations once memory is charged (Weis), below the 2^272 of category 5. Saarinen's itemised count gives 2^137. No key of a Classic McEliece parameter set has been recovered.

History

1. 14 Oct 2026 added to site 10 Nov 2026 Update

   ISO/IEC 18033-2:2006/Amd 2:2026, published in June 2026, standardises FrodoKEM and Classic McEliece (the latter without mceliece348864). Both are now shown as ISO standards, and the ISO programme as completed.

2. 7 Aug 2026 added to site 10 Nov 2026 Attack

   Ghoshal, Ishai, Jain and Sun distinguish Classic McEliece public keys from random matrices in quasipolynomial time and give a heuristic key-recovery attack of similar cost (ePrint 2026/1630; key recovery added on 27 August). Vedenev (ePrint 2026/1747), Saarinen (ePrint 2026/1786) and Weis (ePrint 2026/1984) estimate the concrete cost of key recovery. Across the five parameter sets, Weis counts 2^89 to 2^98 bit operations without a memory charge, 2^107 to 2^117 with a square-root memory charge, and 2^117 to 2^128 with the memory charge of the Classic McEliece security guide. Saarinen's itemised count, which excludes memory traffic, gives 2^127 to 2^145. Every estimate lies below the claimed category of every set (2^143 for category 1, 2^207 for category 3, 2^272 for category 5), so all sets are now flagged broken. The estimates rest on heuristic assumptions tested on small keys. Saarinen recovered the key of the TII-254 challenge code (m = 8, t = 12, n = 223; ePrint 2026/1986), but no key of a Classic McEliece parameter set has been recovered. Bernstein argues that counts of bit operations ignore the cost of moving data, which dominates these attacks. No estimate in that model has been published.

Full timeline →