China PQC & Commercial Cryptography
China operates its own national cryptographic standards — the ShangMi (商密, "commercial cryptography") suite — administered independently of NIST. Like RSA and ECC, the public-key members of this suite are vulnerable to quantum attack, so Chinese enterprises in banking, power, and Web3 face the same migration imperative as the rest of the world, with the added requirement of staying compliant with domestic regulation.
The 商密 (ShangMi) ecosystem
China maintains a sovereign suite of cryptographic algorithms, collectively the SM (ShangMi) family, defined primarily in Chinese commercial-cryptography industry standards (GM/T), with some algorithms also reflected in national (GB/T) or ISO/IEC standards. These are NIST-independent: designed domestically and issued as GM/T standards through the Cryptography Industry Standardization Technical Committee (密标委); equivalent GB/T information-security versions are handled by TC260. Several have since been adopted into ISO/IEC standards. The core members are SM2 (elliptic-curve public-key), SM3 (hash), SM4 (block cipher), SM9 (identity-based cryptography), and ZUC (祖冲之, a stream cipher used in 4G/5G). See sm-algorithms.html for the per-algorithm breakdown.
Regulation and governance
Commercial cryptography in China is governed by the State Cryptography Administration (国家密码管理局, SCA) and the regulatory framework established by the Cryptography Law of the People's Republic of China (effective on 2020-01-01). SCA oversees algorithm standardization, product certification, and the conditions under which cryptography may be used in critical information infrastructure. For regulated sectors — finance, energy, government — using approved 商密 algorithms is frequently a compliance requirement, not merely a technical choice.
Recent rules tighten this framework for critical information infrastructure (CII): GM/T 0133-2024 (关键信息基础设施密码应用要求, "cryptographic application requirements for CII", effective 1 Jul 2025) and the 《关键信息基础设施商用密码使用管理规定》 (Provisions on the Use of Commercial Cryptography in Critical Information Infrastructure; SCA/CAC/MPS Order No. 5, promulgated 27 Jun 2025, effective 1 Aug 2025). These are crypto-compliance mandates — they do not set fixed PQC-migration deadlines.
Quantum impact on the SM suite
The quantum threat to China's algorithms follows exactly the same logic as it does for international standards (see quantum-threat.html):
- SM2 and SM9 are broken by Shor's algorithm. SM2 is a 256-bit elliptic-curve scheme and SM9 is a pairing-based identity scheme — both rest on the hardness of discrete logarithms, which a cryptographically relevant quantum computer (CRQC) solves efficiently. They fall just as RSA and ECC do.
- SM3, SM4, and ZUC are hash/symmetric primitives — they are not broken outright by Shor's algorithm the way SM2/SM9 are. The quantum impact shows up mainly as a reduced security margin from Grover search and related quantum-collision algorithms; the mitigation direction is to adopt larger keys, output sizes, or higher-security-level variants, mirroring the AES and SHA-2 story. In terms of idealized Grover search complexity, SM4's 128-bit key gives an abstract security margin that can be approximated as halved — a conservative security-level estimate, not a claim that a real quantum attack is already feasible, but longer-term deployments should still plan around that.
China's PQC efforts
China is pursuing its own post-quantum standardization through two distinct tracks. The earlier track was the CACR (中国密码学会, Chinese Association for Cryptologic Research) national PQC competition: a call in 2018 with winners announced in January 2020. Earlier academic proposals from Chinese researchers — for example lattice-based schemes such as Aigis and LAC — informed that research base, but they are not finalized national standards.
The current, official track is run by the 商用密码标准研究院 (ICCS), which organizes the relevant standardization solicitation in line with the work arrangements of the Cryptography Industry Standardization Technical Committee. In February 2025 ICCS launched a "新一代商用密码算法征集" (next-generation commercial cryptographic algorithms call) — a global solicitation across public-key, hash, and block-cipher categories, requiring resistance to both classical and quantum attacks. This is distinct from the CACR competition above.
As of this writing the ICCS call is in the evaluation phase — no winners or standards have been selected. There is no finalized "national PQC standard" to name yet; claims to the contrary should be treated with caution. Enterprises should track ICCS/SCA announcements while building on what is already standardized internationally.
What Chinese enterprises should do
Banking, power, and Web3 organizations operating in China face a dual-track requirement: maintain 商密 compliance and prepare for the post-quantum transition. Practical guidance:
- Inventory now. Build a cryptographic bill of materials covering both SM and international algorithms. You cannot migrate what you cannot see.
- Prioritize Shor-vulnerable assets. SM2, SM9, RSA, and ECC protecting long-lived data are the urgent targets — Harvest Now, Decrypt Later (HNDL) applies to 商密 ciphertext too.
- Adopt crypto-agility. Architect systems so algorithms can be swapped without re-engineering, allowing you to track both the ICCS/SCA outcome and the NIST FIPS standards.
- Use hybrid where possible. Combining a classical and a post-quantum primitive hedges against immaturity in either track.
- Align with both regimes. Where international standards (see standards.html) and domestic regulation must both be satisfied, design for composability rather than choosing one and excluding the other.
In China-regulated deployments, NIST PQC algorithms may be useful for engineering pilots and international interoperability, but commercial-cryptography compliance depends on SCA, GM/T, GB/T requirements, and future domestic PQC approvals. NIST PQC migration and Chinese commercial-cryptography migration should be treated as related but distinct tracks.
For the concrete migration workflow, continue to migration.html.
Standards & references
- ICCS / SCA — 新一代商用密码算法征集 (next-generation commercial cryptographic algorithms call), Feb 2025; evaluation phase, no winners yet.
- CACR — national PQC competition (2018 call → winners announced Jan 2020); separate, earlier track.
- GM/T 0133-2024 — 关键信息基础设施密码应用要求 (cryptographic application requirements for CII), effective 1 Jul 2025.
- 《关键信息基础设施商用密码使用管理规定》 (Provisions on the Use of Commercial Cryptography in CII) — SCA/CAC/MPS Order No. 5, effective 1 Aug 2025.
中国后量子密码与商用密码
中国拥有独立于 NIST 的国家密码标准体系，即商密（ShangMi，SM）算法套件。与 RSA、ECC 一样，该套件中的公钥算法同样无法抵御量子攻击，因此中国金融、电力、Web3 等行业的企业面临着与全球相同的迁移压力，同时还需满足国内监管的合规要求。
商密生态体系
中国建立了自主可控的密码算法套件，统称 SM（商密）系列，主要由中国商用密码行业标准（GM/T）定义，部分算法也进入 GB/T 或 ISO/IEC 标准体系。这套体系独立于 NIST：算法为国内自主设计，GM/T 系列由密码行业标准化技术委员会（密标委）归口发布；对应的 GB/T 信息安全等同版本则由 TC260 归口。其中部分已被 ISO/IEC 采纳为国际标准。核心成员包括 SM2（椭圆曲线公钥）、SM3（杂凑算法）、SM4（分组密码）、SM9（标识密码）以及 ZUC（祖冲之序列密码，用于 4G/5G）。逐一算法分析详见 sm-algorithms.html。
监管与治理
中国商用密码由国家密码管理局（SCA）主管，并遵循《中华人民共和国密码法》（2020-01-01 施行）确立的监管框架。国家密码管理局负责算法标准化、产品认证以及密码在关键信息基础设施中的使用条件。对于金融、能源、政务等受监管行业而言，使用经批准的商密算法往往是一项合规要求，而非单纯的技术选择。
近期规则进一步收紧了关键信息基础设施（CII）的相关框架：GM/T 0133-2024（关键信息基础设施密码应用要求，2025 年 7 月 1 日起施行）以及《关键信息基础设施商用密码使用管理规定》（国家密码管理局 国家互联网信息办公室 公安部令第 5 号 2025 年 6 月 27 日公布 2025 年 8 月 1 日起施行）。这些属于密码合规要求，并未设定固定的 PQC 迁移时限。
量子计算对商密套件的影响
量子计算对中国密码算法的威胁逻辑与国际标准完全一致（参见 quantum-threat.html）：
- SM2 与 SM9 会被 Shor 算法攻破。SM2 是 256 位椭圆曲线方案，SM9 是基于双线性对的标识密码方案，二者的安全性均建立在离散对数难题之上，而具备密码学攻击能力的量子计算机（CRQC）能够高效求解此类问题。它们与 RSA、ECC 一样会被攻破。
- SM3、SM4、ZUC 属于杂凑/对称原语，不会像 SM2/SM9 那样被 Shor 算法直接攻破。量子攻击主要体现为 Grover 搜索及相关量子碰撞算法带来的安全裕度下降；缓解方向是采用更大的密钥、输出长度或更高安全级别变体，这与 AES、SHA-2 的情况如出一辙。从理想化 Grover 搜索复杂度看，SM4 的 128 位密钥的抽象安全裕度可近似折半；这是一种保守安全级别估计，不等于现实量子攻击已经可行，但长期部署仍需就此提前规划。
中国的后量子密码进展
中国正通过两条不同路径推进自主的后量子密码标准化。较早的一条是 CACR（中国密码学会）组织的国家级后量子密码竞赛：2018 年发起征集，2020 年 1 月公布获选方案。此前中国研究者提出的学术方案，例如基于格的 Aigis 与 LAC，为这一研究基础提供了支撑，但它们并非已定稿的国家标准。
当前的官方路径由商用密码标准研究院（ICCS）按密码行业标准化技术委员会的工作安排组织相关标准化征集。2025 年 2 月，ICCS 启动了"新一代商用密码算法征集"，这是一项面向公钥、杂凑、分组密码各类别的全球征集，要求同时抵御经典攻击与量子攻击。该征集与上述 CACR 竞赛是两件不同的事。
截至本文撰写时，ICCS 征集仍处于评估阶段——尚未选出获选方案或形成标准。目前尚无可指名的已定稿国家后量子标准，对相反说法应保持谨慎。企业应持续关注 ICCS 与国家密码管理局的官方公告，同时在国际已成标准的基础上开展建设。
中国企业应当如何应对
在中国运营的银行、电力、Web3 机构面临双轨要求：既要保持商密合规，又要为后量子迁移做好准备。实操建议如下：
- 立即开展盘点。建立涵盖商密与国际算法的密码物料清单。看不见的资产无从迁移。
- 优先处理易受 Shor 攻击的资产。保护长生命周期数据的 SM2、SM9、RSA、ECC 是当务之急，先收集、后解密（Harvest Now, Decrypt Later, HNDL）攻击同样适用于商密密文。
- 构建密码敏捷性。系统设计应支持算法热替换而无需重构，以便同时跟进 ICCS/SCA 的遴选结果与 NIST 的 FIPS 标准。
- 尽可能采用混合模式。将经典算法与后量子算法组合，可对冲任一路线尚不成熟的风险。
- 兼顾两套体系。当国际标准（参见 standards.html）与国内监管都须满足时，应按可组合的思路设计，而非二选一。
在中国监管场景中，NIST PQC 算法可用于工程试点和国际互操作探索，但商用密码合规仍取决于国家密码管理局、GM/T、GB/T 要求以及未来国内 PQC 算法审批。NIST PQC 迁移与中国商密迁移应视为相关但不同的两条轨道。
具体的迁移流程请继续阅读 migration.html。
标准与参考
- ICCS / SCA 新一代商用密码算法征集——2025 年 2 月启动，目前处于评估阶段，尚无获选方案。
- CACR 国家级后量子密码竞赛——2018 年征集，2020 年 1 月公布获选，属较早的独立路径。
- GM/T 0133-2024《关键信息基础设施密码应用要求》——2025 年 7 月 1 日起施行。
- 《关键信息基础设施商用密码使用管理规定》（国家密码管理局、国家互联网信息办公室、公安部令第 5 号）——2025 年 8 月 1 日起施行。