[lamps] Re: Notes on recent developments concerning Classic McEliece (BSI)

[Chase Abbott <[e-mail]>]

The larger takeaway is:

"Classic McEliece should currently no longer be used in new developments or when planning new cryptographic applications. For key agreement, it is advised to use FrodoKEM, ML-KEM or HQC (once the corresponding standard has been published) in accordance with the recommendations of TR-02102-1.

The current recommendation of TR-02102-1 for Classic McEliece is limited to hybrid use."

Good to note that TR-02102-1 will be updated early next year to officially reflect this interim security release.  McEliece will be deprecated with ML-KEM and FrodoKEM taking up all composite KEM requirements until 2031when classical is dropped fully.  This doesn’t really change BSI/ANSSI’s stance:

VS-NfD / Restreint UE, Federal: composite is a strict requirement now
General Commercial IT: Hybrid is strongly recommended, classical permitted until 2031.

Note: If a commercial vendor markets a quantum safe or BSI/ANSSI complaint, they cannot use standalone PQC, Hybrid is a required configuration.

-Chase


From: Peter Gutmann <pgut001=[e-mail]>
Date: Thursday, October 1, 2026 at 21:24
To: LAMPS <[e-mail]>; TLS List <[e-mail]>
Subject: [TLS] Notes on recent developments concerning Classic McEliece (BSI)

CAUTION: This email has been sent from an external source. Do not click links, open attachments, or provide sensitive business information unless you can verify the sender’s legitimacy.


Given the recent discussions I thought this may be relevant:

  Notes on recent developments concerning Classic McEliece

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto/Notes_Classic_McEliece.pdf?__blob=publicationFile&v=2

  "The current situation shows that the recommendation to use post-quantum
  cryptography in hybrid mode has proven its worth".

Peter.
_______________________________________________
TLS mailing list -- [e-mail]
To unsubscribe send an email to [e-mail]