Post-quantum: Germany's BSI advises against Classic McEliece after a series of attacks

On October 1, 2026, the German Federal Office for Information Security (BSI) recommended no longer using the post-quantum algorithm Classic McEliece for new developments. Since August, several cryptanalysis papers have sharply lowered estimates of its security. The agency states that no practical attack exists to date. The signal still matters: the BSI had recommended this key exchange mechanism since 2020, in combination with a classical algorithm.

What has happened since August

Classic McEliece is a key encapsulation mechanism (KEM) based on error-correcting codes, here binary Goppa codes. It derives from a system proposed in 1978 and was seen as a very conservative choice, despite its very large public keys. The US NIST has not standardized it: in March 2025, it selected HQC as a backup algorithm.

On August 7, four researchers filed a paper on the IACR ePrint archive. They are Ashrujit Ghoshal (IIT Madras), Yuval Ishai (Technion and AWS), and Aayush Jain and Nuozhou Sun (Carnegie Mellon University). They describe a near-polynomial-time "distinguisher," that is, an algorithm able to tell a McEliece public key from a random matrix. According to them, the method applies to all the parameter sets considered by NIST. They also derive heuristic attacks from it, including one that recovers the key.

Other researchers then estimated the cost of these key-recovery attacks:

• Kirill Vedenev (CryptoPro and Southern Federal University, Russia) puts it between 2^89.9 and 2^98.6 bit operations. He says he has solved several reduced-size McEliece challenges.
• Markku-Juhani Saarinen (Tampere University) obtains conditional estimates ranging from 2^126.77 to 2^145.22. All fall below NIST's reference threshold for the claimed security category.
• Stephen Weis (Anthropic) estimates a run at between 2⁸⁹ and 2⁹⁸ operations. He reaches 2¹¹⁷ to 2¹²⁸ if memory is counted according to the rule in the Classic McEliece security guide. With the same rule, generic decoding costs from 2¹⁵⁹ to 2³¹⁶.

These figures are still very far from a feasible attack. No full-size key has been broken, and the estimates rest on assumptions verified only on small keys. These papers are also preprints, not yet peer reviewed. Even so, they place the algorithm below the security level it claims.

What the BSI says exactly

According to the BSI, the parameter sets in its technical guideline TR-02102-1 do not yet allow a practical attack. The agency nonetheless considers further progress possible, even expected. It recommends preferring ML-KEM and FrodoKEM, which are not affected, then HQC once its standard is published. It points out that a hybrid combination retains at least the security of the classical algorithm used alongside Classic McEliece. The BSI will rewrite its positions on McEliece in the next version of the guideline, expected in early 2027. It adds that the migration to post-quantum cryptography remains just as urgent.

ML-KEM (FIPS 203), the NIST-standardized and most widely deployed algorithm, is not affected by this work.

What to do

• Take inventory: check whether Classic McEliece is used in your organization or by your vendors (VPNs, messaging apps, cryptographic libraries). According to PostQuantum.com, the Mullvad VPN uses it by default in its desktop apps, in a hybrid with ML-KEM.
• Handle standalone uses first: a McEliece deployment used with no other algorithm alongside it is the most exposed case.
• Do not rush to remove hybrid deployments: plan their replacement on a controlled schedule.
• For new projects: choose ML-KEM, in hybrid mode.
• Invest in cryptographic agility: you need to be able to switch algorithms without rebuilding everything.