Classic McEliece (McEliece (Goppa codes)): standard, dates, parameters, and audit checklist
================================================================================

Classic McEliece is the oldest post-quantum KEM design (1978) and the most conservative. NIST did not select it in the fourth round (2025-03-11) because of its very large public keys, but Germany's BSI recommends it in TR-02102-1 and it is being standardized through ISO/IEC. It matters for audits because European and defense customers deploy it.

Standard: ISO/IEC standardization in progress; not selected by NIST
Standardized by: ISO/IEC JTC 1/SC 27 (in progress); recommended by BSI (Germany) TR-02102-1
Date: NIST fourth round concluded 2025-03-11 without selecting it
Status: Not a NIST standard; ISO/IEC process ongoing
Family: Code-based (binary Goppa codes)
Parameter sets: mceliece348864 (cat 1, pk 261120 B, ciphertext 96 B); mceliece460896 (cat 3, pk 524160 B, ciphertext 156 B); mceliece6688128 (cat 5, pk 1044992 B, ciphertext 208 B)
Audit focus: Constant-time Goppa decoding (Berlekamp-Massey) and the Benes network for secret permutation | Handling of the ~1 MB public key: memory safety, transport, caching | Key generation failure handling and rejection sampling
Auditors: zkSecurity, Trail of Bits, NCC Group (Cryptography Services), Cryspen, Kudelski Security, Quarkslab, Least Authority, Galois, atsec information security, Riscure (Keysight), Cure53, X41 D-Sec
Sources: https://classic.mceliece.org/ | https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr02102/tr02102_node.html

Source page: https://pqaudit.org/algorithms/classic-mceliece/
Compiled by: PQC Audit Index editors (https://pqaudit.org/about/)
Last reviewed: 2026-09-12