up:: The Mandates MOC
KpqC (South Korea)
KpqC, the Korean Post-Quantum Cryptography competition, is South Korea’s national contest to choose its own post-quantum algorithms, sponsored by the National Intelligence Service (NIS) and run by the KpqC research group together with the National Security Research Institute (NSR). It opened in November 2021, took 16 submissions, cut them to 8 in December 2023, and on January 16, 2025 named four winners: HAETAE and AIMer for digital signatures, and SMAUG-T and NTRU+ for public-key encryption and key establishment. Korea picked its own algorithms alongside the NIST set, and the winners are now moving into Korean Industrial Standards (KS) under a national plan to finish the post-quantum transition by 2035.
Source: National Intelligence Service, “국정원 후원 ‘양자내성암호 국가공모전’, 1라운드 결과 발표” (NIS-sponsored KpqC competition announces Round 1 results), press release, December 7, 2023, nis.go.kr; KpqC research group, “Selected Algorithms from the KpqC Competition Round 2,” January 16, 2025, kpqc.or.kr.
The short version:
- KpqC is Korea’s own post-quantum competition, sponsored by the NIS and organized by the KpqC research group and the NSR, and its lead submitter on every entry had to hold Korean nationality.
- 16 algorithms entered Round 1 in November 2022 (7 encryption or KEM, 9 signature), 8 advanced in December 2023, and 4 won in January 2025.
- The winners are HAETAE (a module-lattice signature), AIMer (a signature built on a symmetric one-way function), SMAUG-T (a module-lattice KEM) and NTRU+ (an NTRU-lattice KEM).
- The two KEMs had been submitted for Korean Industrial Standards by April 2026, and the two signatures are still under review; the organizers warn the algorithms may change during standardization.
- AIMer is the winner under the most active repair: a 2026 attack cut below the claimed security of its AIM2 primitive, and its designers replaced AIM2 with AIM3 in a July 2026 specification.
Think of KpqC as a country commissioning its own set of locks from its own locksmiths while the rest of the world standardizes on one catalog. The locks work on the same physics as everyone else’s, three of the four are cut from the same lattice metal as the NIST set, and they went through the same public lock-picking contest. The difference is who owns the blueprints, who certifies them, and which buildings in Korea will be required to use them.
What is KpqC?
KpqC is two things that share a name. The KpqC research group (양자내성암호연구단) is a standing body of academic, industry, government and research experts, launched in 2021 to build Korea’s domestic post-quantum capability, and the KpqC competition (양자내성암호 국가공모전, the “national post-quantum cryptography competition”) is the 3-year contest that group ran to select Korean algorithms.
- The research group. Its published purpose covers post-quantum research, building the Korean research ecosystem and supporting a nation-wide cryptographic transition. Its head is a center director at the NSR, and its advisory and technical committees draw from KISA, ETRI, the Ministry of National Defense, Samsung SDS, Samsung Research, CryptoLab and 30 Korean universities.
- The goal it states for itself. On closing the competition, the organizers named three objectives: advancing research in Korea’s PQC field, fostering domestic and international technology exchange, and developing Korea’s PQC workforce. The group’s own history describes the four winners as developed “with purely domestic technology” (순수 국내 기술로).
Source: KpqC research group, “연구단 소개: 목적” (About: purpose) and “조직도” (organization), kpqc.or.kr/contents/01_company/sub01.html and kpqc.or.kr/contents/01_company/sub02.html; KpqC research group, “Selected Algorithms from the KpqC Competition Round 2,” January 16, 2025, kpqc.or.kr.
Who ran the KpqC competition?
The NIS sponsored it, and the KpqC research group and the NSR organized it. The NIS press release on the Round 1 result names the NIS as sponsor (후원) and the KpqC research group and the National Security Research Institute as hosts (주관).
That arrangement matters for reading the result. The NIS is Korea’s intelligence service and the NSR is a national-security research institute, so KpqC sits closer to a national-security program than NIST’s process does, where a civilian standards agency runs the evaluation. Round 1 had its own evaluation committee, chaired by Professor Aram Yun of Ewha Womans University.
Source: NIS press release, December 7, 2023, nis.go.kr. Corroborated (secondary, vendor): PQShield, “South Korea announces winners of KpqC competition,” January 31, 2025, pqshield.com, which describes the project as “initially launched by the National Intelligence Service (NIS) in collaboration with the National Security Research Institute (NSR).”
How did the KpqC competition work?
KpqC ran as a staged contest with an extra gate at the front: developers first filed a development plan, and only accepted plans could submit an algorithm. The request for proposals was posted on November 25, 2021.
- Development plans. Due February 18, 2022, judged on the algorithm’s excellence and originality, the soundness of its security argument from the underlying hard problem, and the feasibility of the development plan.
- Eligibility. Every developer participated under their legal name, and the lead developer had to be a Korean national. Previously published research was allowed, and co-developers could be from anywhere.
- Round 1 submissions. Due October 31, 2022. Round 1 ran from November 2022 to November 2023, with public comment on the kpqc-bulletin Google group.
- Open review. The NIS says the 16 submissions were posted on the KpqC site and the IACR preprint archive for public verification, and were also analyzed by Tanja Lange’s research group at Eindhoven University of Technology, whose report on all 16 is public.
- Round 2. Ran from April 2024 to November 2024 on 8 candidates, with a second public evaluation report from a team that again included Lange.
- The stated destination. The request for proposals said the selected algorithms would be proposed as validation-target algorithms for KCMVP, Korea’s domestic cryptographic module validation program.
Sources: KpqC research group, “양자내성암호 국가공모전 안내” (competition announcement) with the attached request for proposals, November 25, 2021, kpqc.or.kr; KpqC research group, “1라운드 진행 현황” (Round 1 status), October 25, 2022, kpqc.or.kr; NIS press release, December 7, 2023, nis.go.kr; Cottaar et al., “Report on evaluation of KpqC candidates,” IACR ePrint 2023/1853; Bernstein et al., “Report on evaluation of KpqC Round-2 candidates,” IACR ePrint 2024/2077.
What is the KpqC timeline?
| Date | Milestone |
|---|---|
| 2021 | KpqC research group launched |
| November 25, 2021 | Competition announced, request for proposals published |
| February 18, 2022 | Development plans due |
| October 31, 2022 | Round 1 algorithms due |
| November 2022 to November 2023 | Round 1: 16 candidates (7 KEM or encryption, 9 signature) |
| December 7, 2023 | 8 candidates advance to Round 2 |
| April 2024 to November 2024 | Round 2 |
| January 16, 2025 | Final four announced: HAETAE, AIMer, SMAUG-T, NTRU+ |
| January 30, 2026 | Final specification documents published |
| April 22, 2026 | Notice: KS proposals for SMAUG-T and NTRU+ submitted; HAETAE and AIMer under review |
The 2021 draft schedule put the final result in September 2024, so the selection landed about 4 months late, and the final specifications slipped from December 2025 to January 2026 while the teams prepared their KS proposals.
Sources: KpqC research group, “About: purpose,” kpqc.or.kr; competition notices of November 25, 2021, October 25, 2022, December 7, 2023, January 16, 2025, August 22, 2025, December 29, 2025 and April 22, 2026, kpqc.or.kr competition board; KpqC research group, “KpqC Algorithms,” January 30, 2026, kpqc.or.kr.
Which algorithms competed in each round?
| Round | Signatures | Encryption and KEMs |
|---|---|---|
| Round 1 (16) | AIMer, Enhanced pqsigRM, FIBS, GCKSign, HAETAE, MQ-Sign, NCC-Sign, Peregrine, SOLMAE | IPCC, Layered ROLLO-I, NTRU+, PALOMA, REDOG, SMAUG, TiGER |
| Round 2 (8) | AIMer, HAETAE, MQ-Sign, NCC-Sign | NTRU+, PALOMA, REDOG, SMAUG-T (SMAUG and TiGER merged) |
| Winners (4) | AIMer, HAETAE | NTRU+, SMAUG-T |
The NIS classified the 8 Round 2 candidates as 4 lattice-based, 2 code-based, 1 symmetric-key-based and 1 multivariate. The evaluation committee recommended merging SMAUG and TiGER because the two designs were highly similar, and the merged team entered Round 2 as SMAUG-T. The final four are three lattice schemes and one symmetric-key scheme; both code-based KEMs and the multivariate signature were eliminated in Round 2.
Sources: KpqC research group, “KpqC Competition Round 1,” kpqc.or.kr/competition.html; “KpqC Competition Round 2,” kpqc.or.kr/competition_02.html; NIS press release, December 7, 2023, attachment table of the 8 Round 2 algorithms and their underlying problems, nis.go.kr.
What are HAETAE, AIMer, SMAUG-T and NTRU+?
- HAETAE is a module-lattice signature in the same Fiat-Shamir-with-aborts family as ML-DSA (Dilithium). It swaps Dilithium’s rejection step for a bimodal distribution with uniform sampling over hyperballs, which its designers say makes signatures 29% to 39% smaller than Dilithium’s and verification keys 20% to 25% smaller. Falcon-1024 still has signatures under half the size of HAETAE’s top parameter set.
- AIMer is a signature whose security rests only on a symmetric primitive. It proves knowledge of a secret input to a one-way function using the MPC-in-the-head technique (a customized BN++ proof system, made non-interactive with the Fiat-Shamir Transform), with the one-way function AIM as the thing being inverted. Keys are tiny and signatures are large.
- SMAUG-T is a module-lattice KEM that bases its secret-key security on Module-LWE and delivers the ephemeral key through the cheaper Module Learning-with-Rounding problem, using sparse secrets. Its designers report ciphertexts up to 14% and public keys up to 19% smaller than Kyber’s.
- NTRU+ is a KEM in the NTRU family built on two new generic transforms, one to reach worst-case correctness and a Fujisaki-Okamoto variant to reach chosen-ciphertext security without re-encryption, over NTT-friendly rings. Its designers report bandwidth slightly above Kyber’s at comparable security and faster key generation, encapsulation and decapsulation.
| Winner | Job | Hard problem | Public key (bytes) | Signature or ciphertext (bytes) |
|---|---|---|---|---|
| HAETAE-120 (level 2) | Signature | Module lattice | 992 | 1,474 |
| HAETAE-180 (level 3) | Signature | Module lattice | 1,472 | 2,349 |
| HAETAE-260 (level 5) | Signature | Module lattice | 2,080 | 2,948 |
| AIMer-128s (KpqC final, AIM2) | Signature | Symmetric one-way function (AIM2) | 32 | 4,160 |
| AIMer-128s (v3.0, AIM3) | Signature | Symmetric one-way function (AIM3) | 32 | 4,704 |
| SMAUG-T Mode 1 (level 1) | KEM | Module-LWE plus Module-LWR | 672 | 672 |
| SMAUG-T Mode 3 (level 3) | KEM | Module-LWE plus Module-LWR | 1,088 | 992 |
| SMAUG-T Mode 5 (level 5) | KEM | Module-LWE plus Module-LWR | 1,440 | 1,376 |
| NTRU+768 | KEM | NTRU lattice | 1,152 | 1,152 |
| NTRU+1152 | KEM | NTRU lattice | 1,728 | 1,728 |
Levels are the NIST security categories each design targets. Every size and comparison here is the designers’ own figure.
Sources: HAETAE team, “HAETAE: Shorter Lattice-Based Fiat-Shamir Signatures,” KpqC final specification, January 2026, Table 3 and §1.2, kpqc.or.kr PDF, and Cheon et al., IACR ePrint 2023/624 (CHES 2024); AIMer team, KpqC final specification, January 30, 2026, Table 8, kpqc.or.kr PDF, and “The AIMer Signature Scheme, Version 3.0,” July 31, 2026, Table 6, aimer-signature.org; Kim et al., “AIM: Symmetric Primitive for Shorter Signatures with Stronger Security,” IACR ePrint 2022/1387 (ACM CCS 2023); SMAUG-T team, KpqC final specification, Table 1 and introduction, kpqc.or.kr PDF, and the SMAUG-T site, kpqc.cryptolab.co.kr; Park and Kim, “NTRU+: Compact Construction of NTRU Using Simple Encoding Method,” KpqC final specification, January 30, 2026, Tables 6 and 7, kpqc.or.kr PDF, and IACR ePrint 2022/1664 (IEEE TIFS 2023).
What did public cryptanalysis find during KpqC?
The open review did what open review is for: it broke or dented several candidates, including two that went on to win in revised form. The pattern is the same one NIST’s competition produced with Rainbow and SIKE.
- MQ-Sign. Aulbach, Samardjiska and Trimoska showed that 3 of MQ-Sign’s 4 variants, the ones using sparse secret polynomials to shrink keys, were insecure: a polynomial-time key recovery on two of them ran in under 7 seconds at security level V, and the third fell to a forgery below its claimed security. Only the plain UOV variant survived. MQ-Sign advanced to Round 2 and did not win.
- NTRU+. Lee, Lee, Ryu and Park published a classical chosen-ciphertext attack in 2023 that recovered the session key and showed that “all the suggested parameters of NTRU+ do not satisfy the claimed security,” and they proposed a modification. NTRU+ entered Round 2 as version 2.0 in February 2024 and won.
- REDOG. Pellegrini and Vorstermans published the “Pad Thai” message-recovery attack on REDOG, the rank-metric code-based KEM, in 2024. REDOG did not win.
- AIMer. The AIM one-way function was first weakened by a fast exhaustive-search attack that its own designers say degraded security by up to 12 bits, which led to AIM2 in AIMer version 2.0. Then Biryukov, García Fernández and Udovenko’s “Magic Pot” attack, published at EUROCRYPT 2026, showed AIM2 “is not secure up to the claimed level,” and practically breakable in reused-key and related-key misuse settings. The designers responded with AIMer version 3.0, dated July 31, 2026, which replaces AIM2 with a new primitive, AIM3.
- A further AIMer preprint, not yet peer reviewed. On September 27, 2026, a preprint described a forgery on AIMer version 2.0 that it says works “on arbitrary messages with probability one,” by exploiting S-box inputs of zero. AIMer 3.0 rejects zero S-box inputs at key generation, and whether that closes the attack is still an open question.
So the AIMer specification the KpqC site published as final in January 2026 uses AIM2, while the designers’ current version uses AIM3. The KpqC group’s April 2026 notice sends readers to each algorithm’s own homepage for the latest specification, because the algorithms may change during standardization.
Sources: Aulbach, Samardjiska and Trimoska, “Practical key-recovery attack on MQ-Sign,” IACR ePrint 2023/432; Lee, Lee, Ryu and Park, “A Novel CCA Attack for NTRU+ KEM,” IACR ePrint 2023/1188; NTRU+ team, news log, ntruplus.org; Pellegrini and Vorstermans, “Analysis of REDOG: The Pad Thai Attack,” IACR ePrint 2024/1967; Biryukov, García Fernández and Udovenko, “Magic Pot: Cryptanalysis of full AIM2,” IACR ePrint 2026/903 (EUROCRYPT 2026); AIMer team, “The AIMer Signature Scheme, Version 3.0,” §1 and change log, aimer-signature.org; Liu et al., “Practical Null-Branch Witness Attacks on In-the-Head Signatures,” preprint, IACR ePrint 2026/2235; KpqC research group, “KpqC 알고리즘 표준화 관련 안내” (standardization notice), April 22, 2026, kpqc.or.kr.
What is South Korea’s post-quantum standardization and migration timeline?
Two tracks run in parallel: the KpqC algorithms moving into national standards, and a government-wide migration plan with a 2035 endpoint.
| Date | Track | Milestone |
|---|---|---|
| July 12, 2023 | Migration | NIS and the Ministry of Science and ICT, with other ministries, announce the pan-national PQC transition master plan |
| By 2024 | Migration | Detailed action plans in 6 areas, including technology acquisition, institutional reform and procedures (as reported) |
| By 2030 | Migration | A pan-national transition task force builds the implementation base (as reported) |
| By 2035 | Migration | Transition of the national cryptographic system to post-quantum cryptography |
| December 2025 | Standards | Winning teams preparing KS proposals |
| April 22, 2026 | Standards | Notice: KS proposals for SMAUG-T and NTRU+ submitted; HAETAE and AIMer under review for later proposal |
The NIS itself states the core commitment: in July 2023 it and the relevant ministries set a master plan, including a mid-to-long-term roadmap, to transition the national cryptographic system to post-quantum cryptography by 2035, and the KpqC winners feed into standardization under that roadmap. The intermediate 2024 and 2030 milestones come from Korean trade-press reporting of the announcement, since the full plan document isn’t posted publicly.
Sources: NIS press release, December 7, 2023, nis.go.kr, for the July 2023 master plan and the 2035 target; Boan News, “양자 대전환 시대 대비, 관계부처 합동 마스터플랜 발표,” July 12, 2023, boannews.com (secondary, trade press), for the 2024 and 2030 milestones; KpqC research group notices of December 29, 2025 and April 22, 2026, kpqc.or.kr competition board.
Why did South Korea run its own competition instead of adopting NIST’s?
Korea’s own statements give the reasons: building domestic research capacity and workforce, owning algorithms developed “with purely domestic technology,” and feeding KCMVP, the national module validation program the request for proposals names as the destination. The Korean-nationality rule for lead submitters follows from that goal.
Korea didn’t run KpqC in isolation from NIST. AIMer and HAETAE were both submitted to NIST’s additional-signatures on-ramp in 2023, and neither advanced to that process’s second round in October 2024. Round 2’s public evaluation report was co-written by researchers including Daniel J. Bernstein and Tanja Lange.
Some observers read national competitions through the lens of Dual_EC_DRBG, the NIST-published random number generator at the center of backdoor allegations, as a case for owning your own algorithms. Korea’s published reasons for KpqC are capacity and sovereignty, and its announcements don’t cite that episode.
Sources: KpqC research group, “About: purpose,” kpqc.or.kr; KpqC request for proposals, November 25, 2021, kpqc.or.kr; NIST, “Round 1 Additional Signatures,” csrc.nist.gov, and “Round 2 Additional Signatures,” csrc.nist.gov; Bernstein et al., IACR ePrint 2024/2077.
How does KpqC compare to the NIST competition and China’s NGCC?
KpqC is the smallest and most restricted of the three national-scale contests, and the first of the two non-U.S. contests to pick winners.
| Dimension | NIST PQC (U.S.) | KpqC (South Korea) | NGCC (China) |
|---|---|---|---|
| Run by | NIST, a civilian standards agency | KpqC research group and NSR, sponsored by the NIS | Institute of Commercial Cryptography Standards (ICCS) |
| Launched | Call for proposals, December 20, 2016 | Announcement, November 25, 2021 | Announcement, February 5, 2025 |
| Who could lead a submission | Anyone | Korean nationals only | Open call; ICCS encourages international cooperation in design |
| Scope | Public-key: KEMs and signatures | Public-key: KEMs and signatures | Public-key, hash functions, and later block ciphers |
| Round 1 field | 69 accepted candidates | 16 candidates | Candidates published September 20, 2026 |
| Status (September 2026) | FIPS 203, 204, 205 final; FN-DSA and HQC in drafting | 4 winners; 2 KEMs submitted for KS | Round 1 |
The through-line is diversity. A multinational that operates in the U.S., Korea and China is heading toward three approved post-quantum suites, and that turns crypto-agility into a hard requirement.
Sources: NIST, “Post-Quantum Cryptography Standardization,” csrc.nist.gov; NIST IR 8240, csrc.nist.gov/pubs/ir/8240/final; KpqC request for proposals, kpqc.or.kr; ICCS, “Introduction to Next-generation Commercial Cryptographic Algorithms Program (NGCC),” IETF 125 SAAG, March 2026, datatracker.ietf.org; ICCS, Round 1 candidates, niccs.org.cn.
Does KpqC apply to my organization?
Today, KpqC binds nobody directly. It’s a competition result, and the binding instruments that will carry it are still in progress: KS proposals for the two KEMs had gone in by April 2026, the signatures haven’t been proposed yet, and the request for proposals names KCMVP as the intended route into validated cryptographic modules.
The exposure is prospective and concentrated. A multinational that sells cryptographic products or systems into Korean government and public-sector procurement is the most likely to meet a KpqC algorithm as a requirement, because KS standards and KCMVP validation are the routes the organizers have named. Everyone else meets KpqC indirectly, through Korean partners, suppliers and customers adopting it under the 2035 national plan.
Sources: KpqC research group, April 22, 2026 standardization notice, kpqc.or.kr; KpqC request for proposals, kpqc.or.kr; NIS press release, December 7, 2023, nis.go.kr.
Common misconceptions
- “South Korea adopted the NIST algorithms.” Korea ran its own competition and picked four Korean-led designs. It’s the opposite of Japan, whose CRYPTREC guideline adopts the NIST set.
- “The KpqC winners are already Korean standards.” They’re candidates in standardization. The two KEMs had been submitted for KS by April 2026, the two signatures were still under review, and the organizers say the algorithms may change along the way.
- “KpqC used exotic math nobody else trusts.” Three of the four winners are lattice schemes closely related to what NIST standardized: HAETAE to ML-DSA, SMAUG-T to ML-KEM, and NTRU+ to the NTRU family that was a NIST finalist. AIMer is the outlier, built on a symmetric one-way function.
- “A winner is finished.” AIMer changed its core primitive twice after entering the competition, the second time in July 2026 after an attack published at EUROCRYPT 2026. Track the designers’ current version, which has moved past the one on the competition site.
- “KpqC was a closed national process.” Entries were posted to the IACR preprint archive, analyzed by international researchers including Tanja Lange’s group at Eindhoven, and broken in public. The nationality rule limited who could submit, and anyone could attack.
Questions people ask
What algorithms won KpqC? HAETAE and AIMer for digital signatures, and SMAUG-T and NTRU+ for public-key encryption and key establishment, announced January 16, 2025. HAETAE, SMAUG-T and NTRU+ are lattice-based; AIMer rests on a symmetric one-way function.
Who ran KpqC? The National Intelligence Service sponsored it, and the KpqC research group and the National Security Research Institute organized it. The research group launched in 2021 and draws its members from Korean academia, industry, government and research institutes.
How many algorithms entered KpqC? 16 in Round 1 (7 encryption or KEM, 9 signature), 8 in Round 2 after the December 7, 2023 cut, and 4 winners. SMAUG and TiGER merged into SMAUG-T between rounds.
Is KpqC the same as NIST’s competition? It borrowed the open, multi-round, attack-in-public model, but it ran on Korean terms: a Korean-national lead submitter on every entry, NIS sponsorship, and winners headed for Korean Industrial Standards and KCMVP instead of FIPS.
Are the KpqC algorithms secure? They survived two rounds of public analysis, and the lattice winners rest on the same families as the NIST standards. AIMer’s primitive has been attacked and replaced twice, so its current AIM3 version is younger than the competition that selected it, and it’s the one to watch.
What is South Korea’s post-quantum deadline? 2035, set in the July 2023 master plan announced by the NIS and the Ministry of Science and ICT with other ministries. That aligns Korea with the 2035 horizon in the U.S. NSM-10 and in Japan’s plan.
Go deeper
The contests it sits beside: The NIST PQC Competition · NIST Additional Digital Signature Schemes · NGCC (China)
The standards Korea chose not to adopt as-is: FIPS 203 (ML-KEM) · FIPS 204 (ML-DSA) · FIPS 205 (SLH-DSA) · FIPS 206 (FN-DSA)
The math under the winners: Lattice-Based Cryptography · Module Learning With Errors (Module-LWE) · Learning With Rounding (LWR) · NTRU · Zero-Knowledge Proofs · Symmetric-Key Cryptography
Other national authorities: CRYPTREC (Japan) · BSI · the full mandates map
Why several suites at once: Cryptographic Monoculture · Crypto-Agility · Hybrid Cryptography · Dual_EC_DRBG
Everything here is the map, given freely. When your team needs Korea’s KpqC algorithms and its 2035 plan sequenced against your own systems alongside the NIST suite you already run, that’s the work I do.
Last verified 2026-09-28 · Maintained by Addie LaMarr, LaMarr Labs.