Organisations in 177 ISO member states can adopt the post-quantum cipher
Classic McEliece has been added to ISO/IEC 18033-2, the International Organisation for Standardisation standard for asymmetric ciphers. As a result, organisations in all 177 ISO member states can deploy the algorithm through a global standard built for interoperability and robust implementation.
That step makes Classic McEliece the first post-quantum cryptography algorithm to achieve global standardisation. Post-Quantum, a UK cyber security company, pioneered it with prominent cryptographers and offers it on an open source basis.
Pressure to upgrade encryption has grown because a sufficiently mature quantum computer could break much of current public-key encryption with Shor’s algorithm. Security specialists often call that event Q-Day.
Another risk is Harvest Now, Decrypt Later, or HNDL. In that model, attackers steal encrypted data now and decrypt it after quantum systems become strong enough.
Google recently used artificial intelligence to optimise Shor’s algorithm, cutting the number of physical qubits needed to break current encryption. Following that work, prominent experts estimated that current encryption may be broken within the next three years.
Classic McEliece is a code-based system built on Professor Robert McEliece’s cryptosystem from 1978. It uses error correcting codes to protect communications against both classical and quantum computer attacks.
Governments already back the algorithm in some countries. Germany’s BSI and its Dutch counterpart both recommend Classic McEliece because of its security credentials.
Possible uses include quantum-safe virtual private networks between users and infrastructure such as data centres. Other uses include protecting healthcare data, intellectual property, government secrets, mobile messaging, connected devices such as drones, and identity systems that secure passwords and biometric identifiers.
STV Group airborne deployment
Post-Quantum also moved the technology into defence hardware through a partnership with Czech defence manufacturer STV Group. That programme delivered what the briefing described as the first airborne deployment of Classic McEliece.
The work produced battlefield-ready quantum-safe drones designed for DDIL conditions. DDIL stands for Denied, Degraded, Intermittent and Limited environments.
Rikky Hasan, chief executive of Post-Quantum, said organisations should move from planning to implementation: “Every major organisation should now have progressed beyond planning to active implementation of quantum-safe encryption. ISO standardisation means Classic McEliece can be implemented more easily and consistently by governments and enterprises across the world.”
ISO approved the addition after a successful vote by independent technical experts from its member states. Since the algorithm now sits inside ISO/IEC 18033-2, public and private sector buyers have a recognised cross-border route to adopt it.
