The oldest quantum-safe encryption (1978): tiny encrypted messages, huge public keys.
The idea: Take an error-correcting code you can decode fast (a Goppa code) and disguise it so it looks like a random code: the disguised version is the public key. To encrypt, turn the message into a codeword with the public key and deliberately add a few random errors. Removing errors from a random-looking code is hopeless for an eavesdropper, but you know the hidden structure, so you can undo the disguise, correct the errors and read the message. The hidden structure is the trapdoor.
Why it matters: Long a conservative favorite. New attacks shook confidence in 2026.
On the map: ⚠ BSI (Sept 2026): not for new designs, hybrid use still OK
The oldest post-quantum public-key encryption (1978)[1]. Its public keys are huge, roughly 260 KB to 1.3 MB[2], but ciphertexts are tiny. ISO standardized it in June 2026 (ISO/IEC 18033-2 Amd 2)[3], and some VPNs use it in hybrid with ML-KEM (Mullvad, for example)[4].
Its security now looks weaker than assumed: 2025-26 structural attacks on the hidden Goppa code structure claim key recovery well below its target security level[5, 6], though none is practical yet. In a note dated 29 September 2026 Germany's BSI, which had recommended it since 2020, advised not to use it in new developments[3]. Existing hybrid deployments still keep at least the security of the classical half.
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.