up:: The Mandates MOC
NGCC (China)
NGCC, the Next-generation Commercial Cryptographic Algorithms Program, is China’s open competition to choose the algorithms that will succeed its current national suite (SM2, SM3, SM4, SM9 and ZUC), run by the Institute of Commercial Cryptography Standards (ICCS) and launched on February 5, 2025 “in response to the threat of quantum computing.” It calls for three kinds of algorithm, public-key, hash and block cipher, and it runs the same way NIST’s post-quantum competition did: submissions from anywhere, published candidates, public attack, and a status report after each round. On September 20, 2026, ICCS published 119 first-round candidates, and nothing has been selected or standardized yet.
Source: ICCS, “Introduction to Next-generation Commercial Cryptographic Algorithms Program (NGCC),” presentation to IETF 125 SAAG, March 2026, datatracker.ietf.org.
The short version:
- NGCC is China’s national competition for next-generation commercial cryptography, run by ICCS, covering public-key, hash and block cipher algorithms, with quantum resistance as the stated first motive.
- ICCS published 119 first-round candidates on September 20, 2026: 34 digital signatures, 41 key encapsulation mechanisms, 9 key exchange schemes and 35 hash functions. The block cipher call comes later.
- They are candidates in round one of an open evaluation. Nothing is a standard, and ICCS says the number of winners will be decided after evaluation.
- Researchers worldwide started attacking the candidates at once, and an independent public tracker logged 195 findings across 89 reports by September 28, 2026, most of them against reference code and some against the underlying designs.
- China is choosing its own algorithms rather than adopting NIST’s, the same decision South Korea made, so a company operating in both markets should expect more than one approved post-quantum suite.
Think of NGCC as 119 new locks bolted to a public wall with a sign inviting anyone to pick them, plus a public logbook where every successful pick gets written up. A lock with no entry in the logbook hasn’t been proven strong; nobody has written up a pick yet. The locks that survive years of that wall are the ones worth installing on a front door.
What is NGCC?
NGCC is a program of the Institute of Commercial Cryptography Standards, the body that drafts and maintains China’s commercial cryptography standards and acts as the secretariat for its national and industry cryptography standards. Under China’s Cryptography Law, “commercial cryptography” means encryption and authentication for information that isn’t a state secret, so it covers the cryptography in ordinary products, networks and services rather than classified systems.
ICCS gave its reasons in its own words: “In response to the threat of quantum computing and to accommodate the evolving demands of emerging technologies such as big data, Internet of Things, cloud computing and artificial intelligence, ICCS plans to call for proposals for public-key cryptographic algorithms, cryptographic hash algorithms and block cipher algorithms.” The stated goal is “to enhance the novelty and diversity of cryptographic algorithms (particularly post-quantum public-key cryptographic algorithms)” and to “facilitate the standardization of the next-generation commercial cryptographic algorithms.”
Source: ICCS, IETF 125 SAAG presentation, March 2026, slides 2, 4 and 5, datatracker.ietf.org.
What does China use today, and what would NGCC replace?
China already runs its own national algorithm suite, and every piece of it is also an international standard. ICCS lists the current system as follows.
| Algorithm | What it does | Chinese national standard | International standard |
|---|---|---|---|
| ZUC | Stream cipher | GB/T 33133-2016 | ISO/IEC 18033-4/AMD1:2020 |
| SM4 | Block cipher | GB/T 32907-2016 | ISO/IEC 18033-3/AMD1:2021 |
| SM2 | Elliptic-curve public-key cryptography | GB/T 32918-2016 | ISO/IEC 14888-3:2018 (signatures) |
| SM3 | Hash function | GB/T 32905-2016 | ISO/IEC 10118-3:2018 |
| SM9 | Identity-based cryptography | GB/T 38635-2020 | ISO/IEC 14888-3:2018 (signatures), ISO/IEC 18033-5/AMD1:2021 (identity-based encryption), ISO/IEC 11770-3:2021 (key exchange) |
SM2 and SM9 are the parts a quantum computer breaks, because both rest on elliptic-curve math that Shor’s algorithm solves, the same way it breaks ECDSA and ECDH. SM3 and SM4 are symmetric and survive with adequate parameters, the same position AES-256 and SHA-2 occupy in the West. That’s why NGCC’s public-key call is the post-quantum core of the program, while the hash and block cipher calls refresh the symmetric side at the same time.
Source: ICCS, IETF 125 SAAG presentation, March 2026, slide 3 (“Current Commercial Cryptographic Algorithm System”), datatracker.ietf.org.
How does the NGCC competition work?
The process has four published steps: a call, an initial examination that decides which proposals enter round one, rounds of evaluation with a status report after each, and a winners list. ICCS “established expert groups responsible for the technical work,” evaluates candidates “in terms of security, performance, features and etc.,” and says “innovation in theories and structures is expected.” It invited public review, with mailing lists for comment, and encouraged international cooperation in algorithm design, so submitters could come from anywhere.
Two details matter for anyone reading the results. ICCS says “the specific number of finalists will be determined upon comprehensive consideration of the solicitation and evaluation,” so there’s no fixed count of winners. And it reserves the right to modify winning algorithms and their implementations, which is normal in standardization: NIST made changes to CRYSTALS-Kyber between its selection and the final FIPS 203, and the standard lists them.
Source: NIST, FIPS 203, August 2024, §1.3 “Differences From the CRYSTALS-Kyber Submission,” csrc.nist.gov; ICCS, IETF 125 SAAG presentation, March 2026, slides 6 and 11, datatracker.ietf.org; ICCS, “Notice on Soliciting Proposals for Next-Generation Public Key Cryptography Algorithms,” October 9, 2025, niccs.org.cn.
What is the NGCC timeline?
| Date | Step |
|---|---|
| February 5, 2025 | ICCS announces the program and opens a global comment period on the draft submission requirements and evaluation criteria |
| October 9, 2025 | Formal calls for public-key and hash algorithm proposals, with final requirements and evaluation criteria |
| March 2026 | ICCS presents the program to the IETF’s Security Area Advisory Group (IETF 125) |
| May 1, 2026 | Submission window closes to new proposals; existing ones can still be updated |
| June 30, 2026 | Deadline, 24:00 Beijing time |
| September 20, 2026 | 119 round-one candidates published |
| Later | Block cipher call; further rounds, status reports, and a winners list, with no dates published yet |
Source: ICCS, “Notice on Soliciting Proposals for Next-Generation Public Key Cryptography Algorithms,” October 9, 2025, niccs.org.cn, which sets the deadline at “北京时间2026年6月30日24时” (June 30, 2026, 24:00 Beijing time); ICCS, IETF 125 SAAG presentation, March 2026, slides 7 to 10; ICCS, Round 1 candidates, niccs.org.cn, whose candidate listings carry a September 20, 2026 release timestamp.
What are the 119 first-round candidates?
| Category | Round-one candidates |
|---|---|
| Digital signatures | 34 |
| Key encapsulation mechanisms (KEMs) | 41 |
| Key exchange | 9 |
| Public-key total | 84 |
| Hash functions | 35 |
| All categories | 119 |
For scale, NIST’s competition accepted 69 first-round candidates in December 2017, all of them public-key. NGCC’s 84 public-key candidates alone outnumber that, and the 35 hash functions sit on top. The designs span the familiar post-quantum families, lattice, code-based, multivariate and hash-based among them, so NGCC is testing a wide field rather than a single bet.
Source: ICCS, Round 1 candidates listing, niccs.org.cn, category counts read from the listing’s channel data (34, 41 and 9 public-key, totaling 84, plus 35 hash); NIST, “Round 1 Submissions,” csrc.nist.gov.
What happened when the candidates went public?
Researchers started attacking them within hours. The independent tracker ngcc.dev, maintained by Markku-Juhani O. Saarinen of Tampere University, logs every published attack report against a candidate with a reproduction, a credit and a category. By September 28, 2026 it listed “195 active findings across 89 reports: 87 implementation, 79 design, 29 side-channel; 4 withdrawn records.”
Those three categories fail in different ways, and the difference matters more than the total:
- Implementation findings are bugs in the submitted reference code: the math may be sound while the code doesn’t do what the specification says. A fixed version of the code fixes them. This is the implementation lane every post-quantum deployment lives in.
- Design findings are weaknesses in the algorithm itself. They range from practical breaks, where a signature leaks the key or two inputs hash to the same output, down to claim-level problems, such as schemes advertising 512-bit strength whose construction caps them at 256 bits, a number that’s still far beyond reach.
- Side-channel findings are code that leaks secrets through timing or memory access, the class covered in Side-Channel and Fault Attacks on PQC.
The breakers include Chinese institutions. Researchers at the Institute of Software, Chinese Academy of Sciences, posted a structural analysis of 7 of the submitted hash functions to the IACR ePrint archive on September 22, 2 days after publication, and Chinese university labs appear in the tracker’s credits alongside researchers from Europe and elsewhere. Many of the findings were produced with AI coding agents in the loop, which the tracker records per finding.
Source: ngcc.dev, “Reports,” accessed September 28, 2026, ngcc.dev; Yuan et al., “Structural Analysis of Seven Hash Functions Submitted to the NGCC,” IACR ePrint 2026/2152, received September 22, 2026, eprint.iacr.org.
Does a finding mean the algorithm is broken?
Not in the way a headline implies. A finding against reference code says the submitted software is wrong, and the design may survive with corrected code. A claim-level design finding says the advertised strength was overstated while the real strength stays enormous. Only a practical design break, one that recovers keys or forges signatures on the scheme as specified, removes a candidate, and those were a minority of the first week’s reports.
The reverse error is just as common. ngcc.dev states it plainly: a candidate with no report “means no vulnerability finding has been published here. It does not mean the candidate has been found secure.” A quiet candidate has had less attention, and security comes from years of attack surviving, which round one can’t supply in a week.
This is the competition working. NIST’s process lost candidates the same way, including Rainbow and SIKE, and The SIKE Break took a Round 4 candidate down in about 10 minutes on a single processor core. Weak entries dying early, in public, is the whole reason the survivors earn trust.
Source: ngcc.dev, “Reports,” accessed September 28, 2026, ngcc.dev.
Why does China run its own competition instead of adopting NIST’s standards?
ICCS’s stated reasons are the quantum threat, new technology demands, and “novelty and diversity” in cryptographic design. National algorithm suites are also long-standing Chinese policy: the SM algorithms already serve as the domestic commercial standard, so a post-quantum successor chosen through a domestic process continues an existing arrangement.
China isn’t alone. South Korea’s KpqC competition chose its own four winners in January 2025, and the history of Dual_EC_DRBG, a NIST-published random number generator removed in 2014 after public concern about how its constants were chosen, is the usual example raised in favor of a country controlling its own selection, though neither ICCS nor Korea’s program has published it as a reason. The counterweight is fragmentation: each national suite is another set of algorithms that multinational products must implement, validate and keep patched.
| NIST PQC | KpqC (South Korea) | NGCC (China) | |
|---|---|---|---|
| Run by | NIST | National Intelligence Service with the National Security Research Institute | Institute of Commercial Cryptography Standards |
| Launched | December 2016 call | 2021 | February 5, 2025 |
| Round-one candidates | 69 (public-key only) | See the KpqC note | 119 (84 public-key, 35 hash) |
| Status | ML-KEM, ML-DSA and SLH-DSA final in August 2024; HQC selected 2025 | Winners named January 2025 | Round one, opened September 20, 2026 |
Source: ICCS, IETF 125 SAAG presentation, March 2026, slide 5, datatracker.ietf.org; NIST, “Post-Quantum Cryptography Standardization,” csrc.nist.gov; PQShield, “South Korea announces winners of KpqC competition,” January 2025, pqshield.com, a vendor summary used here for the winners and dates.
Does NGCC apply to my organization?
Not yet, because nothing has been selected. ICCS’s materials to date describe the aim to “facilitate the standardization” of the winners and publish no mandate, deadline or migration requirement tied to them. The practical reading for a company with operations or customers in China is a planning one: the SM suite is today’s Chinese commercial standard, NGCC’s winners are the likely successors on the public-key side, and a product line that already carries SM2 alongside RSA and ECDSA should expect to carry an NGCC algorithm alongside ML-KEM and ML-DSA later.
That’s a crypto-agility question more than a compliance one. Systems that can add an algorithm through configuration absorb a second national suite cheaply; systems with algorithms hard-coded pay for every jurisdiction separately.
Common misconceptions
- “China published its own post-quantum standards.” It published competition candidates. Nothing has been selected, and ICCS hasn’t fixed how many winners there will be.
- “All of China’s post-quantum algorithms were broken in a day.” The tracker logged findings against a subset of candidates, most of them code bugs, and it states that a candidate with no finding hasn’t been shown secure either. Round one is working as designed.
- “A bug in the reference code means the algorithm is broken.” Implementation findings are fixed by fixing the code. Only a practical design break removes a candidate.
- “China uses NIST’s algorithms.” China’s commercial standard is its own SM suite, and NGCC is choosing a domestic successor through a domestic process.
- “The breaks prove Chinese cryptography is weak.” Many of the breakers are Chinese institutions, and weak first-round entries died the same way in NIST’s process. Open attack is how any competition sorts its field.
Questions people ask
What is NGCC? NGCC, the Next-generation Commercial Cryptographic Algorithms Program, is an open competition run by China’s Institute of Commercial Cryptography Standards to select new public-key, hash and block cipher algorithms, launched February 5, 2025 with resistance to quantum computing as its first stated motive.
How many algorithms entered NGCC? 119 round-one candidates were published on September 20, 2026: 34 digital signatures, 41 key encapsulation mechanisms, 9 key exchange schemes and 35 hash functions. A block cipher call is planned separately.
Has China standardized any post-quantum algorithm through NGCC? No. As of September 2026 the program is in its first evaluation round, and ICCS will publish status reports after each round before naming winners.
Who can submit to or attack NGCC candidates? Anyone. ICCS issued a global call, encouraged international cooperation in design, and invited public review, and researchers from China, Europe and elsewhere began publishing attacks as soon as the candidates were posted.
Where can I see the attacks on NGCC candidates? The independent tracker ngcc.dev logs published findings with reproductions and credits, and IACR ePrint carries the longer papers. ICCS publishes the candidates themselves on niccs.org.cn.
Why doesn’t China just use ML-KEM and ML-DSA? China already runs a national commercial suite (SM2, SM3, SM4, SM9 and ZUC), and ICCS frames NGCC as the next generation of that system, with diversity of designs as a stated goal. South Korea made the same choice with KpqC.
Will NGCC algorithms be mandatory in China? ICCS’s published materials describe standardizing the winners and state no mandate or deadline so far. Companies selling into China should track the program and keep their systems able to add an algorithm without a redesign.
Were AI tools used to attack the NGCC candidates? Yes, for many of the published findings, which the tracker records per report. The practical design breaks and the AI-assisted findings overlap only partly, so the credit on each report is the place to check who found what and how.
Go deeper
The competition model it follows: The NIST PQC Competition · NIST Additional Digital Signature Schemes · The SIKE Break
Other national programs: KpqC (South Korea) · CRYPTREC (Japan) · BSI · ANSSI
Why trust in a standard’s origin matters: Dual_EC_DRBG
Where candidates fail: Attacking Post-Quantum Cryptography · PQC Implementation Pitfalls · Side-Channel and Fault Attacks on PQC · Multivariate Cryptography
Everything here is the map, given freely. When your products have to carry more than one national post-quantum suite and still ship on schedule, that’s the work I do.
Last verified 2026-09-28 · Maintained by Addie LaMarr, LaMarr Labs.