Chinese PQC Vendors & Case Studies

A growing cluster of Chinese cryptography vendors is building post-quantum (PQC) capability — crypto cards and HSMs, gateways, PKI and key-management platforms — and pairing it with industry pilots in government, finance, and power. This page synthesizes the vendor and case-study material from the 安全牛 (Aqniu) 2025 technical guide into a concise English snapshot. It is a complement to our domestic-policy overview in china-overview.html and the algorithm picture in sm-pqc.html.

How China's PQC industry is taking shape

China's PQC push is driven by a 政产学研 (government–industry–academia–research) collaboration model, sharpened after NIST finalized FIPS 203/204/205 in 2024. National algorithm standards are still being formed: SCA's commercial-cryptography research institute opened a "next-generation" algorithm call in early 2025, still in evaluation, so vendors today build on internationally standardized PQC (ML-KEM, ML-DSA, SLH-DSA) while also tracking follow-on standardization candidates such as FN-DSA/Falcon and HQC, and keeping domestic SM compatibility. Two features stand out: hardware + software co-design (PQC pushed down into crypto chips and cards, not just libraries), and a strong preference for hybrid / dual-algorithm deployment plus QKD integration to ease migration. See hybrid.html and qkd-vs-pqc.html for those approaches in depth.

Representative vendors

东进技术 (Dongjin)

Dongjin offers a full-stack PQC migration product system spanning crypto cards, HSMs, crypto gateways, and a key-management platform, aiming for a smooth hardware-to-application upgrade. The design uses a layered, dual-mode architecture: hardware provides quantum-safe compute, gateways run a hybrid encryption mode (classical + NIST PQC on the link), and protocol negotiation (e.g. a TLS 1.3 extension) auto-selects the best cipher suite during the transition. Its PQC crypto card co-locates domestic high-performance chips for both PQC and classical algorithms over PCIe, with an algorithm-upgrade module for over-the-air updates. As a unified communications + cryptography company, Dongjin's strength is audio/video and data-in-transit security.

格尔软件 (Koal Software)

A listed cryptography vendor, Koal has pursued both QKD and PQC tracks since 2018, partnering with QKD makers (问天量子, 九州量子) and universities (Fudan, SJTU). In June 2024 it released a full quantum-safe product solution covering quantum-safe PKI/CA, key management, gateways, HSMs, VPN, and sign/verify servers. Its stack implements NIST algorithms plus domestic PQC candidates (CTRU/CNTR, LMS-SM3/HSS-SM3) and layers PQC into both international protocols (TLS, IPsec IKE, SSH, CMS) and Chinese commercial protocols (TLCP, GM IPsec VPN, SCEP, ACME). Its PQC authentication gateway was an early product to pass CTTL verification testing.

吉大正元 (Jit / JLU-Zhengyuan)

Jit ships a broad PQC line: a post-quantum PKI system (decoupled crypto engine / key / certificate modules, X.509v3-compliant, with a PQC dual-certificate option), a TLS 1.3 hybrid key-agreement component (plug-in negotiation, NIST curves mixed with ML-KEM), a hash-based (multi-layer Merkle tree) PQC signature system, plus PQC crypto cards and HSMs. Its crypto card integrates ML-KEM/ML-DSA alongside domestic LMS/HSS-SM3 signatures; its HSM supports the full PQC set (ML-KEM, ML-DSA, FN-DSA, SLH-DSA, XMSS/XMSSMT, LMS) while staying compatible with SM1/2/3/4. The 元密 integrated appliance packages all this into a one-stop, virtualized platform.

三未信安 (Sansec)

Sansec takes a silicon-first approach, treating high-speed implementation and crypto chips as the research core and achieving full-chain coverage: PQC chips, cards, HSMs, security gateways, PQC UKey, PQC IC cards, KMS, and a PQC certificate-authority system. It published a 2024 PQC technology & application white paper. Beyond NIST ML-DSA/ML-KEM/SLH-DSA/FN-DSA, its products also support domestic candidates (Aigis-enc, Aigis-sig, LAC.PKE, CTRU/CNTR, LMS-SM3/HSS-SM3). Dedicated chip-level optimization and multi-core / high-speed PCIe design give it strong throughput, and a modular architecture keeps algorithm agility for future standard changes.

信安世纪 (Infosec Technologies)

Infosec concentrates on PQC migration research across the network, transport, and application layers, then productizes it as a service platform. Its hybrid post-quantum key-agreement and two-party Dilithium co-signature schemes won a third prize at the 2024 "金融密码杯" national contest and hold granted patents. Notable building blocks include a hybrid KEM that mixes a classical SM2 shared secret with a Kyber-encapsulated secret through a KDF (forward-secure, no large PKI rework), and KEMTLCP — an authenticated-KEM variant of the TLCP protocol that avoids costly PQC signatures for identity authentication. Its PQC service platform serves finance, government, telecom, and enterprise customers with unified encrypt/sign/certificate services.

Application case studies

Government extranet pilot — 东进技术

For a city government extranet carrying campus and city-wide video-surveillance traffic, Dongjin deployed PQC IPsec gateways combined with QKD: QKD-supplied keys replaced the classical IPsec keys, and the link ran a hybrid mode mixing classical and NIST PQC algorithms, with embedded modules and lightweight gateways encrypting video transparently at the terminals. The pilot reached roughly 10 Gbps tunnel throughput and lifted the key-refresh cadence from hourly to per-minute, giving end-to-end protection that satisfies both 国密 and 标密 dual-compliance.

银河证券 anti-quantum pilot — 格尔软件

To bring quantum-safe cryptography into the securities/futures industry, Koal designed a four-layer scheme (crypto hardware, infrastructure, security support, business application) on a "PQC + SSL VPN" hybrid model, plus a new anti-quantum PKI to re-anchor the trust chain. Three flexible deployment options (typical / complete / transitional) let the pilot reuse existing 国密 software while adding PQC, and the migration blueprint was found to be reusable for other PQC pilots.

QKD-based key distribution — 吉大正元

A large state-owned financial institution centrally generates symmetric keys and distributes them to provincial/municipal branches over 国密 digital-envelope and TLCP channels. Working with China Telecom Quantum, Jit used a QKD network so the central KMS protects symmetric keys with quantum-distributed keys before delivery — solving how to securely distribute symmetric keys against future quantum attack. The approach is replicable to other institutions with similar needs.

PQC in the power industry — 三未信安

For a power enterprise that had already completed cryptography upgrades and crypto-compliance assessment at its dispatch center and several plants, Sansec introduced PQC algorithms and protocols on top of existing capability: PQC-supporting crypto hardware plus a virtualized PQC cloud crypto-resource platform letting the grid run PQC and classical algorithms side by side. Run as a migration pilot with rolling, iterative tuning, it addressed a 卡脖子 ("chokepoint") gap for critical energy infrastructure and produced reusable experience for the wider energy sector.

Financial institution PQC migration practice — 信安世纪

A large financial institution wove PQC into its PKI (CA) backbone — issuing PQC-capable certificates and using lattice-based key exchange and anti-quantum hash signatures, with a hybrid (dual) certificate mechanism for a smooth transition. Infosec built a validation environment (sign/verify server, crypto control, HSM, UKey) and ran the migration across typical business systems, confirming feasibility and performance with low business disruption and a controlled, smooth cutover from classical to post-quantum algorithms. For the general migration workflow, see industry-scenarios.html.

Standards & references

• 安全牛《后量子密码安全能力构建技术指南（2025版）》(Aqniu, "Technical Guide to Building Post-Quantum Cryptographic Security Capabilities, 2025 edition") — primary source; vendor and case material above is synthesized and rewritten, not reproduced.
• SCA — State Cryptography Administration, https://www.oscca.gov.cn/ (algorithm standardization and commercial-cryptography regulation).
• china-overview.html — China PQC & commercial-cryptography policy overview.
• sm-pqc.html — the SM suite under quantum threat and domestic PQC efforts.
• Resources — full standards register