Posts  / #POST-211180
REDDIT

Why was Classic McEliece Rejected for ML-KEM?

F
Aug 24, 2025 · 15:20

I have learnt that Classic McEliece made it to round 3 of NIST but was rejected

in favor of Kyber for ML-KEM.

McEliece was introduced in 1978--around the same time as RSA and remains resistant to classical and post-quantum cryptanalysis to this day.

I am just asking for a quick summary on why Classic McEliece was rejected.

The NIST Classic McEliece page says that it was may lead to the creation of "incompatible standards".

What were the detailed reasons for NIST's rejection.