How large are the keys in the McEliece cryptosystem?

The McEliece cryptosystem uses large matrices for its public and private keys, which has historically been considered one of its main disadvantages. For a standard selection of parameters, the public key is 512 kilobits long. Recent attacks and quantum computing considerations require adjusting these parameters, leading to even larger keys and ciphertexts to compensate.

What we know

• For a standard selection of parameters in the McEliece cryptosystem, the public key is 512 kilobits long. [2]
• One of the main disadvantages of the McEliece cryptosystem as an asymmetric algorithm is that both the private and public keys consist of large matrices. [1, 2]
• Mitigating key-recovery attacks requires adjusting parameters, which demands larger keys and ciphertexts. [2]
• For quantum computing, key sizes must be increased by a factor of four due to improvements in information set decoding. [2] · medium confidence

Still open

• The precise impact of key-recovery attacks found in 2026 on long-term parameter choices remains an evolving consideration for implementations requiring larger keys.

Where to go next

• how it workedWhy are McEliece public and private keys so large?
• compared withWhat are the advantages of McEliece over RSA?
• whoHow did Robert McEliece develop the cryptosystem in 1978?
• a case in pointHow does the Niederreiter variant modify the McEliece scheme?
• the bigger pictureHow does public-key cryptography utilize key pairs?
• an unexpected connectionHow does error correction relate to public-key encryption?The McEliece cryptosystem builds its private key around an error-correcting code designed to correct a specific number of errors.

Sources

• [1]McEliece cryptosystem (Wikidata Q1042583) · CC0 1.0
• [2]McEliece cryptosystem · CC BY-SA 4.0
• [3]Public-key cryptography · CC BY-SA 4.0
• [4]Niederreiter cryptosystem · CC BY-SA 4.0
• [5]RSA cryptosystem · CC BY-SA 4.0