ISO Adopts Classic McEliece: The 1978 Algorithm That Just Became a Global Quantum-Resistant Standard

Classic McEliece: Origins, Tradeoff, and Standardization Role

Origins (1978)

Robert J. McEliece published the original cryptosystem in 1978, based on the hardness of decoding random binary Goppa codes — a problem that remains NP-hard and is not known to be solvable by quantum computers . Classic McEliece is a direct descendant, using the improved Niederreiter dual variant (syndrome-based) rather than the original codeword-based scheme, but retaining the same core security assumption . It is described as "the oldest public-key encryption scheme still regarded as secure" .

The Key Tradeoff: Massive Public Keys

Classic McEliece's defining weakness — and the reason it was not widely adopted in the 1980s — is its public key size. Keys range from roughly 261 kilobytes to over 1.3 megabytes (e.g., 1,047,319 bytes for one parameter set) . This is orders of magnitude larger than RSA or ECC keys (typically a few hundred bytes), making it unsuitable for constrained environments like IoT devices, smart cards, or TLS handshakes over limited bandwidth.

Its counterbalancing strength is that its security is extraordinarily well-understood. No practical cryptanalytic improvements have been found in over 45 years of study . The security level of the McEliece system has remained remarkably stable, despite dozens of attack attempts .

Role in International Standardization

Classic McEliece is now recognized by multiple standards bodies, each with a slightly different role:

Classic McEliece is positioned as a conservative backup or second line of defense: if the lattice-based schemes that NIST has already standardized (ML-KEM / CRYSTALS-Kyber) are ever broken, code-based cryptography provides a mathematically independent fallback .

Why NIST Did Not Standardize It First

Interestingly, NIST explicitly delayed standardizing Classic McEliece in 2025, writing that "concurrent standardization of Classic McEliece by NIST and ISO risks the creation of incompatible standards" and indicating it would consider a standard based on ISO's work after the ISO process completed . NIST selected a different code-based algorithm, HQC, for standardization, but Classic McEliece remains in the fourth round as a candidate for future consideration .

Recent Developments Accelerating PQC Urgency

The ISO standardization alone would be significant. But it arrives alongside several developments that have compressed the PQC migration window from a vague 2030s issue to a concrete ~3-year deadline.

Google's 2029 Migration Deadline

On March 25, 2026, Google published a blog post by VP of Security Engineering Heather Adkins and Senior Staff Cryptographer Sophie Schmieg titled "Quantum frontiers may be closer than they appear," setting an internal deadline of 2029 to complete PQC migration across all Google systems . This moved Q-Day forward by roughly six years relative to prior industry expectations aligned with NIST's 2035 or NSA's 2031 timelines . Google cited faster-than-expected advances in quantum hardware and error correction as key drivers .

Reduced Qubit Estimates for Breaking Elliptic Curve Cryptography

Google's updated timeline was driven in part by dramatically lowered resource estimates for Shor's algorithm attacks on ECC. New circuit-optimization techniques have reduced the estimated number of physical qubits needed to break 256-bit elliptic curve cryptography from millions to potentially hundreds of thousands . This makes a cryptographically relevant quantum computer feasible sooner than previously assumed.

Cloudflare's Matching Timeline

Cloudflare has publicly aligned with a similar urgency, announcing plans to complete its PQC migration on a timeline that matches Google's 2029 window . Cloudflare has been an early deployer of post-quantum TLS, including the X25519Kyber768 hybrid key agreement, and is accelerating full production deployment.

Harvest-Now-Decrypt-Later (HNDL) Concerns

Google explicitly cited "store-now, decrypt-later" risk as a key driver . Adversaries — including state-level actors — are already collecting encrypted traffic: VPN connections, financial data, state secrets, and cryptocurrency communications. The intention is to decrypt it once a quantum computer becomes available. This means that data encrypted today with RSA or ECC is already at risk, creating urgency to migrate before a quantum break, not after .

June 2026 U.S. Executive Order

In June 2026, the Biden administration issued an executive order mandating that all U.S. federal agencies accelerate migration to post-quantum cryptography, with binding deadlines for inventory, assessment, and transition plans . This builds on the 2022 Quantum Computing Cybersecurity Preparedness Act and the 2024 NIST PQC standards (FIPS 203/204/205), converting voluntary guidelines into federal requirements .

The Convergence: What It Means

The combination of ISO's official standards (Classic McEliece, FrodoKEM), NIST's finalized primary algorithms (ML-KEM, ML-DSA, SLH-DSA), Google's 2029 deadline, falling qubit estimates, Cloudflare's matching timeline, HNDL threats already in motion, and a June 2026 U.S. executive order has fundamentally changed the urgency calculus.

The standards infrastructure is now in place. For most organizations, the remaining challenge is execution at scale: inventorying cryptographic assets, prioritizing high-risk systems (authentication, long-lived data, VPNs), and beginning migration to hybrid or post-quantum algorithms before 2029.

Classic McEliece will not be the algorithm most organizations use for everyday TLS — its key size makes that impractical for most use cases. But for long-term data protection, high-security government communications, and applications where security certainty matters more than bandwidth, the newly standardized 1978 algorithm may be exactly the kind of conservative backup the internet needs.