On September 20, 2026, China's Institute of Commercial Cryptography Standards (ICCS) published 119 round-one candidates for its Next-generation Commercial Cryptographic Algorithms (NGCC) programme: 34 signature schemes, 41 key encapsulation mechanisms (KEMs), 9 key exchanges and 35 hash functions. None is a standard yet, and no migration deadline has been announced. The programme invites the world's cryptographers to attack the candidates in public, and they did so within days.
The case for a national standard
The strongest argument for Beijing's approach is sovereignty. Cryptographic standards are trust anchors. A country that adopts another state's primitives has to trust that state's process, its funding and its intelligence agencies. NIST itself is a US government body, and its post-quantum standards, FIPS 203, 204 and 205, were published on August 13, 2024. China's Cryptography Law, adopted on October 26, 2019 and in force since January 1, 2020, already assigns the development of commercial cryptography standards to the State Council's standardization authority and the national cryptography administration (Article 22). A China-specific suite follows from that statute. Many governments, including some US allies, have asked whether they should depend on a single foreign standards pipeline. Seen that way, running a competition is a reasonable response.
The process is the interesting part
What distinguishes NGCC from earlier Chinese cryptography is how open it is. The SM2, SM3 and SM4 family was developed with far less public scrutiny. NGCC copies the template NIST used for AES, SHA-3 and its post-quantum project, which began with a call for proposals in 2016-2017. ICCS opened a global call for proposals in February 2025 and welcomed submissions from researchers worldwide. The official NICCS site carries algorithm proposal and evaluation sections. We could not confirm the full candidate list there, so the 119-candidate breakdown rests on secondary reporting and the independent tracker described below.
Public cryptanalysis arrived almost at once. An independent tracker, ngcc.dev, run by Markku-Juhani O. Saarinen of Tampere University and not affiliated with NICCS, logs findings against the candidates. His ePrint paper reports that in the first seven days researchers documented 191 active findings across 89 candidates, and that 78 were rated Critical. Many of the Critical findings are universal forgeries, key recovery attacks and hash collisions. The same paper says an AI-assisted workflow discovered, verified and disclosed 110 of the issues. Counts differ between snapshots, because findings are added and revised as the tracker updates, so we use the paper's figures.
This is how an open competition is supposed to work. A candidate that fails in week one is eliminated cheaply, before anyone deploys it. Open attack is the best available quality control for cryptography, and the volume of breaks tells us the process is being taken seriously by outside researchers. It does not show that the candidates are weak as a class. Round one is meant to be noisy, and many findings are implementation bugs in submitted code. Neither the tracker nor the paper reports how many of the 191 findings are design flaws versus code bugs, so we cannot say how much of the break rate is fatal to the underlying schemes.
Where the real policy risk lies
A transparent contest does not remove the main cost, which is fragmentation. If China standardises its own KEMs and signatures while the rest of the world deploys NIST's, multinational firms face dual implementations, dual certification and larger attack surface. The Cryptography Law says commercial cryptography products affecting national welfare or public interest must pass testing and certification, and that those used to protect critical information are subject to security assessments under the Cybersecurity Law. If Chinese certification eventually requires NGCC algorithms, foreign vendors would need to ship them. Chinese vendors could face the mirror-image problem abroad.
The law does contain pro-market language. Article 21 calls for equal treatment of commercial cryptography entities, including foreign-invested firms, in an open, competitive and orderly market, and says import and export must not endanger national security. Whether those commitments survive contact with a mandatory national algorithm list is the thing to watch. Nothing in the current announcement sets a mandate. No candidate is a standard and no deadline exists.
What proportionate policy looks like
The sensible response from governments and firms is neither alarm nor dismissal.
- Treat NGCC as a research input, not a compliance event. With no standard and no deadline, there is nothing to migrate to. Companies should track the tracker, not rewrite roadmaps.
- Keep the open process open. Security is served when foreign researchers can publish breaks without penalty. Any later restriction on publishing findings would be the clearest signal that the contest has turned into a closed one.
- Push for crypto-agility rather than a standards war. Hybrid schemes and algorithm negotiation let products support several suites. Mandating one national suite works against that.
- Avoid retaliation. Western rules that ban products on the basis of their cryptographic suite would repeat the fragmentation they criticise, and would punish users rather than states.
The pro-innovation reading is that more competing, publicly attacked designs make cryptography stronger. Rivals have already shown that the NGCC pool contains weak candidates, which is a feature of the contest. The danger would be a mandate that locks hardware and software into a single national suite before the cryptanalysis has settled, and that has not happened yet.
The opposing view deserves a fair hearing as well. Sceptics say a state-run process cannot be fully trusted regardless of how open its first round is, because the final selection and the certification regime stay in government hands. That concern is legitimate and cannot be resolved today. It can be tested over the coming rounds: do the published attacks change which candidates advance, and are the evaluation reports public?