China Unicom PQC Practice (Operator View)
A telecom operator sees post-quantum migration as an engineering problem across silicon, protocols, and a live nationwide network. This page distils the China Unicom Post-Quantum Cryptography White Paper (2025) — its algorithm-selection criteria, hardware/software benchmarks, crypto-agility implementation, and Unicom's own "QKD + PQC fusion" deployment.
How an operator scores PQC algorithms
The white paper builds a three-dimension selection model — security strength, classical-platform performance, and engineering characteristics:
- Security mapping — candidates are pinned to NIST levels (≈ AES-128 / SHA-256 / AES-192 / SHA-384 / AES-256). Lattice schemes' best known attacks remain in the modelled complexity band.
- Compatibility — drop-in deployability matters: firms reported integration taking 30–50% less time than expected; Kyber and Falcon are now close to RSA/ECC on compute efficiency, and the data-transfer-latency gap is shrinking.
- Side-channel resistance is sharply differentiated — lattice schemes (Kyber/Dilithium) are exposed to power analysis but masking can cut DPA success by ~99%; hash signatures (SPHINCS+) are naturally timing-attack resistant but long signatures raise EM leakage; multivariate schemes resist energy fingerprinting but public-key structure invites fault injection. The winning NIST schemes (ML-KEM/ML-DSA) reach practical-grade defence via masking + randomisation + constant-time across SW/HW layers.
The standardised and to-be-standardised portfolio
| Scheme | Type | Role | Standardization status |
|---|---|---|---|
| ML-KEM (Kyber) | Lattice (MLWE) | General KEM — replaces RSA/DH/ECDH key exchange | Standardized (FIPS 203) |
| ML-DSA (Dilithium) | Lattice (MLWE/MSIS, Fiat-Shamir-with-Aborts) | General signatures — replaces RSA/ECDSA/EdDSA | Standardized (FIPS 204) |
| FN-DSA (Falcon) | Lattice (NTRU, short integer solution) | Compact signatures for bandwidth/storage-sensitive paths | Selected; draft FIPS 206, not yet a final standard |
| SLH-DSA (SPHINCS+) | Hash (Merkle, stateless) | Conservative signatures where side-channel resistance is paramount | Standardized (FIPS 205) |
| HQC | Code (Hamming, error-correcting) | KEM backup / algorithm diversity | Selected as an additional KEM for standardization; not yet a final standard |
The paper notes China's domestic lattice proposals Aigis-enc and Aigis-sig — refinements of the Kyber/Dilithium frameworks exploiting asymmetric module-LWE (AMLWE) — which it argues achieve shorter keys and ciphertexts/signatures, positioning them as candidate national standards.
Hardware & software support
Implementation is where an operator lives. The paper surveys full-custom silicon, ARM, and RISC-V:
- Full-custom ASIC/FPGA — heavy optimisation of NTT/INTT, polynomial multiplication, and Keccak; reconfigurable PQC chips (e.g. RePQC, PQPU) supporting multiple domestic and international algorithms; unified Kyber+Dilithium architectures (KaLi, HMDC pipelines); ≈50% area-efficiency gains and ~1.86× speed-ups reported for lattice cores.
- ARM — Cortex-M4 is NIST's recommended IoT evaluation platform; optimisations target modular reduction (Montgomery/Barrett/Plantard), NTT, and Keccak. Cortex-A targets mobile, using NEON and ARM AES instructions.
- RISC-V — HW/SW co-design with loosely- and tightly-coupled accelerators for highly customised PQC.
| Platform | Algorithm | KeyGen | Encaps/Sign | Decaps/Verify |
|---|---|---|---|---|
| Cortex-M4 | Kyber-512 | 369k–499k cc | 448k–634k cc | 409k–597k cc |
| Cortex-M4 | Dilithium2 | 1.6M–2.9M cc | 4.0M–18.5M cc | 1.3M–4.0M cc |
| Cortex-A72 | Kyber-768 | 100k–110k cc | 128k–141k cc | 121k–138k cc |
| Cortex-A72 | Dilithium3 | 534k cc | 1188k cc | 454k cc |
| Cortex-A78 | SPHINCS+-128 | 5043k cc | 117280k cc | 7949k cc |
Selected cycle counts from the white paper's Table 2-2; illustrative, not a benchmark of any specific product.
The eight engineering factors of migration
The paper distils any operator-scale PQC migration into eight technical factors that must be planned for up front:
| Factor | Impact / requirement |
|---|---|
| Bandwidth | Larger keys/sigs inflate traffic and latency — network upgrade & optimisation needed |
| Storage | PQC certs need more storage; plan for extra during the transition |
| Protocols | TLS/SSH etc. must be updated to support PQC key-exchange and signatures |
| App / software upgrade | Software and apps need substantial change for PQC libs and new standards |
| Hardware upgrade | Higher compute demand may require new servers, processors, HSMs, or accelerators |
| Third-party apps & services | Vendors and supply chain must also support PQC — coordination required |
| Standards & guidance | Track new PQC RFCs/standards; keep a compliant, maintained PQC library |
| Regulatory compliance | Meet new PQC mandates; update policy, audit, and maintenance docs |
Crypto-agility, implemented
The paper gives a concrete worked example using Google Tink keysets, where each keyset designates one primary key and rotation proceeds in three steps — retire the oldest key, promote the newest to primary, and inject a freshly generated key (e.g. an ECDSA + Dilithium hybrid) that activates on the next rotation. Because verifiers and signers can hold different keyset versions without breaking, this allows version skew across a heterogeneous estate.
True agility needs support at three layers — protocol (dynamic, integrity-protected suite negotiation), application (an abstracted crypto API and central config so algorithm swaps are transparent to business logic), and hardware (pluggable/upgradable security modules so long-lived industrial gear, smart cards, and HSMs gain the same flexibility). The transition path is staged:
Traditional → Hybrid → Pure PQC
For cloud providers, the paper adds an Encryption-as-a-Service (EaaS) model — delivering a tiered, multi-algorithm offering to different tenants, governed by a policy engine and audit log.
China Unicom's deployment: "comms-crypto fusion"
Unicom's stated strategy is "QKD + PQC in parallel", building quantum-classical deep fusion across cloud, network, edge, and pipe to create an endogenous quantum-safe service capability:
- QKD — security rooted in quantum physics; under idealized models it can provide information-theoretic security for the key-distribution process, but it still needs a classical or PQC authentication layer and is constrained by device implementation, distance, cost, and transmission medium.
- PQC — software/hardware compatible, broadly applicable, the practical complement.
- "Comms-crypto fusion" device — co-developed with Binary Semiconductor, integrating SM (national commercial) and post-quantum algorithms: self-developed high-speed crypto hardware acceleration, 10G bidirectional encryption, ns-level latency, single-session quantum auth + key exchange >10K/s, modular and SM2-extensible. Applied to quantum encrypted calling and quantum dedicated lines; a PQC encrypted handset is in joint development.
Bottlenecks the operator flags
- Risk assessment is hard — crypto is buried across subsystems; locating quantum-vulnerable usage requires a CBOM (you cannot migrate what you cannot see).
- Hot migration without downtime — some PQC interactions break legacy systems (e.g. an oversized Kyber-768 TLS ClientHello can exceed old hardware limits and abort the handshake); algorithm-failure rollback must be supported (recall SIKE, broken a month into NIST Round 4).
- Edge performance vs. power — core operators (modular arithmetic, sampling) must be balanced for area/power/throughput on constrained devices.
- Side-channel-resistant and efficient — prime-modulus lattice schemes are already resource-heavy unprotected; adding protection without killing throughput is an open research direction.
The paper's forward agenda for Chinese enterprises is four coordinated fronts: drive industry PQC standardisation, move PQC from theory to practice (full discovery & assessment by 2028, priority assets by 2031, full migration by 2035 against the NIST horizon), build the enterprise's own PQC capability, and help customers migrate.
Migration Strategy Engine →
The executive-level framework this practice plugs into.
Telecom PQC Overview →
The wider telecom standards picture (3GPP, GSMA).
Performance & Benchmarks →
How PQC algorithm costs compare in practice.
PQC Chips & Hardware →
ASIC/FPGA accelerators and crypto-cards.
Crypto-Agility →
The keyset-rotation and abstraction patterns above.
QKD vs PQC →
The two-track logic behind Unicom's fusion device.
References
- 《2025 中国联通后量子密码白皮书》 (China Unicom Post-Quantum Cryptography White Paper 2025) — China Unicom Research Institute, July 2025.
- NIST PQC Project · FIPS 203 ML-KEM · FIPS 204 ML-DSA
- Telecom PQC Overview · SM Post-Quantum Migration · Resources
中国联通 PQC 实践 运营商视角
在电信运营商眼里 后量子迁移是一道横跨芯片 协议与全国在网网络的工程题。本页提炼《2025 中国联通后量子密码白皮书》——它的算法选型标准 软硬件性能数据 密码敏捷性落地方式 以及联通自家的"量子—经典深度融合"部署。
运营商如何给 PQC 算法打分
白皮书建立了一个三维选型模型——安全强度 经典平台性能 工程化特性：
- 安全对标——候选算法对标 NIST 安全等级（约等于 AES-128 / SHA-256 / AES-192 / SHA-384 / AES-256）。格密码当前最强攻击仍保持在所建模的复杂度区间内。
- 兼容性——即插即用的可部署性很关键：多家企业反馈集成时间比预期缩短 30%–50%；Kyber 与 Falcon 的计算效率已接近 RSA/ECC 传输时延差距也在收窄。
- 抗侧信道能力高度分化——格密码（Kyber/Dilithium）易受功耗分析 但掩码可将差分功耗分析（DPA）成功率降低约 99%；哈希签名（SPHINCS+）天然抗时序攻击 但长签名增加电磁泄露风险；多变量密码抗能量指纹 但公钥结构易遭故障注入。NIST 胜出算法（ML-KEM/ML-DSA）通过"掩码 + 随机化 + 恒定时间"三重防护 在软 / 硬件层达到实用级防御。
已标准化与拟标准化算法组合
| 算法 | 类型 | 用途 | 标准状态 |
|---|---|---|---|
| ML-KEM（Kyber） | 格（MLWE） | 通用密钥封装 替代 RSA/DH/ECDH 密钥交换 | 已标准化 FIPS 203 |
| ML-DSA（Dilithium） | 格（MLWE/MSIS Fiat-Shamir-with-Aborts） | 通用数字签名 替代 RSA/ECDSA/EdDSA | 已标准化 FIPS 204 |
| FN-DSA（Falcon） | 格（NTRU 短整数解） | 带宽 / 存储敏感路径的紧凑签名 | 已选中 拟 FIPS 206 尚非最终标准 |
| SLH-DSA（SPHINCS+） | 哈希（Merkle 无状态） | 对抗侧信道要求极高场景的保守型签名 | 已标准化 FIPS 205 |
| HQC | 编码（汉明 纠错码） | KEM 备用 / 算法多样性 | 已选中作为额外 KEM 标准化对象 尚非最终标准 |
白皮书指出国内格密码方案 Aigis-enc 与 Aigis-sig——在 Kyber/Dilithium 框架上改良 充分利用非对称模 LWE（AMLWE）——具有更短的公钥与密文 / 签名 有望成为国产标准化算法。
软硬件支持
实现层面才是运营商的主战场。白皮书梳理了全定制芯片 ARM 与 RISC-V：
- 全定制 ASIC/FPGA——重点优化 NTT/INTT 多项式乘法与 Keccak；可重构 PQC 芯片（如 RePQC PQPU）支持国内外多种算法；Kyber+Dilithium 统一架构（KaLi HMDC 流水线）；格核心可实现约 50% 面效比提升与约 1.86 倍加速。
- ARM——Cortex-M4 是 NIST 推荐的物联网评估平台 优化集中在模约简（Montgomery/Barrett/Plantard）NTT 与 Keccak；Cortex-A 面向移动端 利用 NEON 与 ARM AES 指令。
- RISC-V——以松耦合与紧耦合加速器做软硬件协同 实现高度定制化 PQC。
| 平台 | 算法 | 密钥生成 | 封装 / 签名 | 解封 / 验证 |
|---|---|---|---|---|
| Cortex-M4 | Kyber-512 | 369k–499k cc | 448k–634k cc | 409k–597k cc |
| Cortex-M4 | Dilithium2 | 1.6M–2.9M cc | 4.0M–18.5M cc | 1.3M–4.0M cc |
| Cortex-A72 | Kyber-768 | 100k–110k cc | 128k–141k cc | 121k–138k cc |
| Cortex-A72 | Dilithium3 | 534k cc | 1188k cc | 454k cc |
| Cortex-A78 | SPHINCS+-128 | 5043k cc | 117280k cc | 7949k cc |
取自白皮书表 2-2 的部分时钟周期数据 仅作示意 不代表任何具体产品的基准。
迁移的八个工程要素
白皮书把运营商规模的 PQC 迁移提炼为八个必须前置规划的技术要素：
| 要素 | 影响 / 要求 |
|---|---|
| 带宽 | 密钥 / 签名增大导致流量与时延上升 需网络升级与优化 |
| 存储 | PQC 证书需更多存储 过渡期需规划额外空间 |
| 协议 | TLS/SSH 等须更新以支持 PQC 密钥交换与签名 |
| 应用 / 软件升级 | 软件与应用需大量修改以兼容 PQC 库与新标准 |
| 硬件升级 | 更高算力需求可能需要新服务器 处理器 HSM 或加速器 |
| 第三方应用与服务 | 厂商与供应链也须支持 PQC 需协调推进 |
| 标准与指南 | 跟踪新 PQC RFC / 标准 维护合规可用的 PQC 库 |
| 监管合规 | 满足新 PQC 监管要求 更新政策 审计与维护文档 |
密码敏捷性的落地
白皮书给出一个用 Google Tink 密钥集的具体范例：每个密钥集指定一个主密钥 轮换分三步——移除最旧密钥 将最新密钥设为主密钥 注入一个新生成密钥（如 ECDSA + Dilithium 混合密钥）下次轮换时激活。由于验证方与签名方可以持有不同版本的密钥集而不影响功能 这就允许异构资产之间存在版本差异。
真正的敏捷需要三层支撑——协议层（动态 受完整性保护的套件协商）应用层（抽象化加密 API 与集中配置 使算法替换对业务逻辑无感）硬件层（可插拔 / 可升级安全模块 让长期服役的工业设备 智能卡与 HSM 具备同等灵活性）。过渡路径分阶段推进：
传统 → 混合 → 纯 PQC
面向云服务商 白皮书还补充了加密即服务（EaaS）模式——以分层方式向不同租户提供多元算法 由策略引擎与审计日志统一管控。
中国联通的部署 通密一体
联通明确的策略是"QKD + PQC 技术并举"，在云 网 边 管各层构建量子—经典深度融合 打造量子安全内生服务能力：
- QKD——安全性源于量子物理，在理想模型下可为密钥分发过程提供信息论安全；但仍需经典或 PQC 认证层，并受设备实现、距离、成本与传输媒介约束。
- PQC——软硬件兼容 适用面广 是务实的补充。
- "通密一体"设备——联通联合二进制半导体研发 集成国密与后量子算法：自研高速密码硬件加速 10G 双向加密 ns 级时延 单次量子认证 + 密钥交换 >10K/s 模块化且可扩展 SM2 等算法。已应用于量子加密通话与量子专线 并正合作开发 PQC 加密手机。
运营商点名的瓶颈
- 风险评估困难——密码深埋于各子系统 定位易受量子攻击的使用点必须依靠 CBOM（看不见就无法迁移）。
- 不停机的热迁移——部分 PQC 交互会破坏旧系统（例如过大的 Kyber-768 TLS ClientHello 可能超出旧硬件处理能力而中断握手）；必须支持算法失效回滚（回想 SIKE 进入 NIST 第四轮一个月即被攻破）。
- 边缘性能与功耗平衡——核心算子（模运算 系数生成）须在受限设备上权衡面积 / 功耗 / 吞吐。
- 既抗侧信道又高效——素数模格密码即便无保护也已资源密集 在不牺牲吞吐的前提下加防护仍是开放研究方向。
白皮书为中国企业列出的未来议程是四条协同战线：推动行业 PQC 标准化 推动 PQC 由理论进入实践（对标 NIST 节点 2028 年前完成全面发现与评估 2031 年前聚焦高优先资产 2035 年前完成全体系迁移）构建企业自身 PQC 能力 助力客户迁移。
量子安全迁移战略引擎 →
本实践所嵌入的高管级框架。
电信行业 PQC 总览 →
更宏观的电信标准图景（3GPP GSMA）。
性能基准 →
PQC 算法成本的实测对比。
PQC 芯片与硬件 →
ASIC/FPGA 加速器与密码卡。
密码敏捷性 →
上文的密钥集轮换与抽象化模式。
QKD 与 PQC →
联通融合设备背后的双路线逻辑。
参考
- 《2025 中国联通后量子密码白皮书》——中国联通研究院 2025 年 7 月。
- NIST PQC 项目 · FIPS 203 ML-KEM · FIPS 204 ML-DSA
- 电信行业 PQC 总览 · 国密后量子迁移 · 资源链接