Efficiency of McEliece cryptography (ciphertext expansion)

Most of the sources say McEliece has never gained acceptance because of its large size of private and public keys.

However I have never heard about the size (or length) of its ciphertext. ("Ciphertext expansion".) For example, McEliece offers the linear code of length 1024 and of dimension 524. That means a plaintext of length 524 will be encrypted to a ciphertext of length 1024 and then will be sent. Isn't is also an inefficiency?

migrated from security.stackexchange.comSep 7 '15 at 11:25

This question came from our site for information security professionals.

• you can do the encryption with McEliece indeed really fast. And indeed the ratio $\beta=n/k$ defines the ciphertext expansion you'll observe. IIRC this value usually is $1.25\leq \beta \leq 1.5$. The ciphertext is then of size $n$ and the input of size $k$. – SEJPM Sep 7 '15 at 12:27