Classic McEliece (McEliece (Goppa codes))

Type

Key-encapsulation mechanism (KEM)

Family

Code-based (binary Goppa codes)

Standard

ISO/IEC standardization in progress; not selected by NIST

Standardized by

ISO/IEC JTC 1/SC 27 (in progress); recommended by BSI (Germany) TR-02102-1

Date

NIST fourth round concluded 2025-03-11 without selecting it

Status

Not a NIST standard; ISO/IEC process ongoing

Last reviewed 2026-09-12 by the PQC Audit Index editors.

Parameter sets and sizes (bytes)

NIST security categories: 1 ≈ AES-128, 2 ≈ SHA-256 collision, 3 ≈ AES-192, 5 ≈ AES-256.

Where Classic McEliece is deployed

• Mullvad VPN and some WireGuard-based products
• German and EU government contexts under BSI TR-02102-1

What an audit of Classic McEliece checks

• Constant-time Goppa decoding (Berlekamp-Massey) and the Benes network for secret permutation
• Handling of the ~1 MB public key: memory safety, transport, caching
• Key generation failure handling and rejection sampling

See the full post-quantum cryptography audit checklist.

Who audits Classic McEliece implementations

Firms with a cryptography practice that review Classic McEliece implementations and protocol integrations, in the order this index lists them:

1. zkSecurity — Cryptography audits: post-quantum, zero-knowledge proofs, MPC, FHE, TEEs
2. Trail of Bits — Software assurance with a dedicated cryptography practice
3. NCC Group (Cryptography Services) — Large security consultancy with a specialist Cryptography Services team
4. Cryspen — Formally verified cryptography and high-assurance post-quantum implementations
5. Kudelski Security — Cryptography audits and quantum-readiness assessments
6. Quarkslab — Reverse engineering, cryptography, and secure implementation research
7. Least Authority — Security audits of cryptographic protocols and privacy-preserving systems
8. Galois — Formal verification of cryptographic code
9. atsec information security — FIPS 140-3 and CAVP validation laboratory
10. Riscure (Keysight) — Side-channel and fault-injection evaluation of hardware implementations
11. Cure53 — Penetration testing and code audits of open-source and web software
12. X41 D-Sec — Source-code audits of open-source security and cryptographic software

Primary sources

• Classic McEliece project
• BSI TR-02102-1 Cryptographic Mechanisms

Machine-readable: data.json · summary.txt