# Why doesn't “Classic McEliece” need scrambling?

The original McEliece scheme uses two random matrices S and P to scramble the generator matrix and uses $$\mathsf S·\mathsf G·\mathsf P$$ as the public key. The Niederreiter variant also does about the same thing.

However, in the Classic McEliece proposal (based on Niederreiter in spite of its name), they don't do any of that. They are giving lots of details as to why the two other modifications by Niederreiter (msg is the error instead of codeword, transmitting the Generator matrix in systematic form) don't reduce security, but they don't detail why the can just remove this scrambling. Why can they? (Can they?)

References:

So, instead of the recovered permuted error vector $$\sigma(e)$$ ( $$e$$ is the plaintext, in Niederreiter and Classic McEliece) needing to be scrambled by the opponent to get the unpermuted error vector $$e$$, the recovery of the correct error vector (for the party holding the private key) is checked by hashing the recovered error vector $$e'$$ and comparing to the hashed value $$h(e)$$ included in the plaintext.
The opponent's additional work factor is now the work required to find a hash preimage of the right length (which may or may not be the right $$e$$).