McEliece hides a special, easy-to-decode code inside a public key that should look completely random. New attacks in 2025-26 are starting to see through the disguise.
The idea: McEliece's security relies on a disguise: the public key should look like a random code, hiding that it's really a special Goppa code with a fast decoder. If attackers can recognize the disguise, they can start rebuilding the decoder. In 2025-26 researchers found ways to see through it at costs that are still far from practical, but well below the target security.
Why it matters: This is why Germany's cybersecurity agency now advises against McEliece for new systems.
On the map: ⚠ weakened 2025-26: structural attacks claim key recovery at 2^99-2^148, not practical yet (BSI note, Sept 2026)
McEliece hides a structured, efficiently decodable binary Goppa code behind a scrambled public key. Security needs that public key to be indistinguishable from a random code. Otherwise attackers could exploit the hidden structure.
For decades the best attacks ignored this structure: the only known way to find it cost over 2^3000 operations[1], while many other code families proposed for McEliece were broken outright (for example Sidelnikov and Shestakov's 1992 attack on generalized Reed-Solomon codes)[2].
That changed in 2025-26. A run of papers found ways to tell Goppa codes apart from random codes and to recover keys[3, 4, 5, 6]. Germany's BSI summarized the claimed key-recovery costs for its recommended parameters as 2^140 to 2^148 operations for the heuristic attack of Ghoshal, Ishai, Jain and Sun[4], down to about 2^99 to 2^102 in Weis's improvement. A later revision of Weis's paper puts one run of the attack at 2^89 to 2^98 bit operations if memory is free, or 2^107 to 2^117 if memory access is charged[7]. None is practical yet and the estimates are still under review, but in a note dated 29 September 2026 (announced 1 October) BSI advised against Classic McEliece for new designs[1]. The underlying decoding problem is not affected.
If any of these breaks, this breaks too.
If this breaks, these break with it.