Imagine you've discovered that a bank vault's combination lock has a pattern — the digits aren't random, they follow a rule. You can now describe the rule, and you can prove the rule exists on tiny toy safes. But the real vault has a combination millions of digits long, and your pattern-matching trick has only been tested on safes with combinations a few hundred digits long. That's where the structural cryptanalysis of Classic McEliece stands right now: real theoretical progress, real pattern discovery, but an enormous gap between what's been demonstrated and what's been claimed extrapolated. The committed claim this paper audits, rather than makes, is this: over 2024-2026, researchers found subexponential and quasi-polynomial distinguishers for binary Goppa codes inside Classic McEliece, recovered keys for public challenges labeled up to 2^54 difficulty, and produced conditional cost estimates of roughly 2^89 to 2^128 for key recovery on the real parameter sets — depending critically on how you charge for memory access. The German BSI responded in September 2026 by advising against new deployments. Fernandez's contribution is to separate the proved results from the conditional estimates from the actual demonstrated recoveries, which is exactly the kind of triage the community needs right now. The paper's core finding is that the cost model — not the algorithm — is now the main source of quantitative uncertainty. There's roughly a 30-bit spread between the cheapest and most expensive model for the same underlying computation. That's the difference between 'broken in practice' and 'still safe by a wide margin.' For the four larger Classic McEliece parameter sets (mceliece460896 and above), every cost model Fernandez considers leaves the conditional estimates far below the targeted security levels. For the smallest set, mceliece348864, the shortfall is on the order of the model spread itself — meaning your answer depends on which cost model you believe. The key algorithms under the microscope are Saarinen's HOVER algorithm and his recovery of the TII-254 challenge, plus Weis's cost study of Holdout/Hermite key recovery. Fernandez gives HOVER a careful version-aware treatment — important because the algorithm has been revised multiple times and critics have targeted specific versions. The structural attacks all rely on large sparse linear-algebra computations, and the central technical question is how to account for memory-access costs in these computations. This isn't a pedantic detail: it's the load-bearing assumption. A crucial integrity point: none of the structural estimates constitute a demonstrated attack on real Classic McEliece parameters. The heuristics underlying the cost estimates have been tested only on instances tens of thousands to hundreds of thousands of times smaller than the actual target. Fernandez is admirably clear about this. The structural estimates are, however, lower than Grover-accelerated information-set decoding for the four larger parameter sets in essentially every model — meaning that even if you're a quantum-computing optimist, the classical structural route now looks more threatening than the quantum one. The practical stakes are high: Classic McEliece is one of the oldest and most studied post-quantum candidates, and it's already deployed or being deployed in real systems. The BSI advisory is the first major standards body to formally advise against new deployments based on these structural results. Whether that's premature depends entirely on which cost model you trust — and that's exactly the kind of judgment call this paper equips you to make. Fernandez closes with open questions rather than conclusions, which is the right move for a paper that is fundamentally an audit rather than an attack. The paper doesn't resolve whether Classic McEliece is broken; it clarifies exactly how much resolution remains and where the uncertainty lives. For practitioners deciding whether to migrate away from Classic McEliece, the honest answer is: the four larger parameter sets have meaningful margin in every model, mceliece348864 is genuinely uncertain, and the demonstrated attacks remain far from the real parameters.
