BSI advises against Classic McEliece in new systems after advances in its cryptanalysis

Germany’s Federal Office for Information Security (BSI) recommends no longer using Classic McEliece in new developments or when planning new cryptographic applications. It says so in a technical note dated 29 September, following a series of 2026 papers that have made attacks on this post-quantum key agreement mechanism much cheaper. The BSI had recommended it since 2020.

Classic McEliece is a post-quantum cryptography (PQC) mechanism based on error-correcting codes. It reached the fourth round of the NIST standardisation process, and ISO/IEC standardised it in June 2026. It has very small ciphertexts and very large public keys, so it is rarely used, mainly in settings with long-lived static keys.

What has changed

Its security rests on the fact that, from the public key alone, the structure of the secret code, a binary Goppa code, cannot be reconstructed. Until recently, the best attack of this kind against the smallest parameters had an estimated cost of more than 2³⁰⁰⁰ operations, far above the minimum of 120 bits of security required by the BSI technical guideline TR-02102-1. Several papers published in recent months, one of them by researchers at the BSI itself, have changed that:

• A distinguisher, which separates Goppa codes from random codes, at a cost of between 2¹²⁰ and 2¹²⁴ operations for the parameters the BSI recommends, and a heuristic key-recovery algorithm at between 2¹⁴⁰ and 2¹⁴⁸, according to its authors.
• An improvement on that work which, according to its author, recovers the key with between 2⁹⁹ and 2¹⁰² operations for the same parameters, below the required level.
• An adaptation of the same approach that has solved a specific key-recovery challenge set by the Technology Innovation Institute.

What the BSI recommends

• For key agreement, other mechanisms: FrodoKEM, ML-KEM or, once its standard is published, HQC.
• Existing deployments, in hybrid mode. The guideline only recommended Classic McEliece combined with a classical mechanism, so that both would have to be broken. As using classical mechanisms on their own remains recommended until the end of 2031, that hybrid keeps at least the security of the classical one.
• Review in 2027. The recommendation will be reviewed in the next version of TR-02102-1, expected in early 2027.

What changes for decision-makers

For those who do not use Classic McEliece, nothing changes in the timeline: the BSI maintains its urgent recommendation to complete the migration to post-quantum cryptography for key agreement by 2031 at the latest. Anyone who has it in a new design should replace it. The general lesson is the one the agency itself draws: hybrid mode has done its job, because the weakening of one mechanism does not leave the system exposed, and advances in cryptanalysis can never be ruled out, so crypto-agility has to be built into the migration from the start. HQC, although also code-based, is not affected, and the BSI sees it as an important alternative to lattice-based mechanisms.