From https://csrc.nist.gov/CSRC/media/Projects/post-quantum-cryptography/documents/round-3/official-comments/Classic-McEliece-round3-official-comment.pdf

The 8192128 parameter set is bigger, but the 6960119 and 6688128 parameter sets include an extra defense explained in the submission. People paranoid enough to imagine 2^306 vs. 2^270 making a difference should also be paranoid enough to imagine this defense making a difference.

I looked in the Classic McEliece round 1, round 2, and round 3 submissions but I was not able to find any defense applying to 6960119 and 6688128 but not 8192128. The only sections which seem kinda relevant to me are 4.3 and 8.3 in the round 3 submission https://classic.mceliece.org/nist/mceliece-20201010.pdf but I am not able to understand their effect (and they do not mention both 6960119 and 6688128).


1 Answer 1


The defense is explained on page 22:

Sendrier’s “support splitting” algorithm quickly finds $\alpha_1, \cdots, \alpha_n$ given $g$ provided that $n = q$. More generally, whether or not $n = q$, support splitting finds $\alpha_1, \cdots, \alpha_n$ given $g$ and given the set $\{\alpha_1, \cdots, \alpha_n\}$. (This can be viewed as a reason to keep $n$ somewhat smaller than $q$, since then there are many possibilities for the set, along with many possibilities for $g$; most of our proposed parameter sets provide this extra defense.)

6960 and 6688 are both smaller than 8192.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.