Classic McEliece team: new attack still slower than known methods

A new paper claims quasipolynomial algorithms against Classic McEliece, a code-based scheme long considered among the more conservative options in post-quantum cryptography. The Classic McEliece team says its preliminary analysis shows the attack remains slower than standard attacks for every proposed parameter set.

Ashrujit Ghoshal, Yuval Ishai, Aayush Jain, and Nuozhou Sun posted eprint 2026/1630 describing a provable quasipolynomial-time distinguisher for Classic McEliece public keys and a heuristic quasipolynomial decryption method. Demi Marie Obenour brought the paper to the NIST PQC forum, noting that the claimed distinguisher complexity sits below security level 1 for all Classic McEliece parameter sets. The attack is still impractical today. Parameter changes that blunt it would drive ciphertext size quadratic in the security parameter, which would undercut much of the scheme's remaining practical edge over alternatives such as HQC or BIKE.

Writing for the Classic McEliece team, D. J. Bernstein stated that "preliminary analysis indicates that the attack in eprint 2026/1630 is slower than standard attacks for every Classic McEliece parameter set." For the mceliece6960119 parameters the team estimates linear algebra on vectors of length roughly 2^116.8, or about 2^265.6 bit operations under the paper's sparse-linear-algebra cost model, before even accounting for the need to move a comparable volume of data through more than 2^116 bits of memory.

Those figures already rest on assumptions that favor the attacker, including binary-field arithmetic and effective shortening at arbitrary positions. The team has not finished checking whether the paper's probability conjectures and numerical conditions hold, and it takes no position yet on their validity. Further review is under way.