QianHeng乾珩 PQC Docs Hub量子文档 ✦ Ask AI✦ 问问文档 ⚐ Scan⚐ 扫一扫
/

SM Post-Quantum Migration

China's commercial-cryptography suite has the same quantum exposure as the rest of the world: SM2 and SM9 are asymmetric schemes that Shor's algorithm breaks, while SM3, SM4, and ZUC are only weakened by Grover. A post-quantum replacement for the SM asymmetric layer is needed. China's official answer — the ICCS/SCA 2025 next-generation call — is still in evaluation, so compliance-bound enterprises should bridge the gap with crypto-agility and hybrid deployments.

Why the SM suite is exposed

The quantum threat does not respect national boundaries — it follows the math (see quantum-threat.html). The SM algorithms split into two risk tiers:

AlgorithmTypeQuantum attackStatus
SM2Elliptic-curve public keyShorBroken by a CRQC — needs PQC replacement
SM9Pairing-based identity (IBC)ShorBroken by a CRQC — needs PQC replacement
SM3HashGroverOnly weakened — mitigate with larger output
SM4Block cipher (symmetric)GroverOnly weakened by known generic quantum search; assess whether 128-bit symmetric security suffices for the target risk level, and use higher-strength alternatives or layered designs where required
ZUCStream cipher (symmetric)GroverOnly weakened — use larger variants (ZUC-256)

SM2 and SM9 are the urgent problem. SM2 is a 256-bit elliptic-curve scheme and SM9 is pairing-based identity-based cryptography; both rest on discrete-logarithm hardness, which a cryptographically relevant quantum computer (CRQC) solves efficiently. They fall exactly as RSA and ECC do. SM3, SM4, and ZUC are merely weakened — Grover offers at most a quadratic speedup, addressed by increasing output/key sizes (for example ZUC-256). Per-algorithm detail is in sm-algorithms.html; the Harvest Now, Decrypt Later (HNDL) urgency that makes SM2/SM9 ciphertext a today-problem is covered in harvest-now.html.

China's PQC standardization tracks

There is no finalized Chinese national PQC standard. Two distinct efforts should not be conflated:

  • ICCS / SCA next-generation call (current, official). In February 2025 the 商用密码标准研究院 (ICCS) launched a "新一代商用密码算法征集." This standardization call is organized by ICCS in accordance with the work plan of the cryptography-industry standardization technical committee and feeds into national commercial-cryptography algorithm standard-setting — a global call across public-key, hash, and block-cipher categories, requiring resistance to both classical and quantum attacks. As of 29 June 2026 the public-key submission window has not yet closed and no algorithm has been selected; after the deadline there will still be formal review, publication of candidates, and multiple rounds of evaluation. The current status should be confirmed against official ICCS/SCA announcements.
  • National cryptographic algorithm design competition (historical). The 中国密码学会 (Chinese Association for Cryptologic Research) ran a national cryptographic algorithm design competition — a 2018 call with winners announced in January 2020. This is a separate, earlier track and not the current official standardization effort.

Because the official replacement is still being chosen, betting a deployment on a single not-yet-finalized domestic PQC algorithm is premature. Track ICCS/SCA announcements rather than pre-committing.

The pragmatic path: crypto-agility + hybrid

Compliance-bound enterprises face a gap: 商用密码 compliance requires approved SM algorithms today (see gm-compliance.html), while no domestic PQC standard yet exists to provide quantum resistance. The engineering answer is to combine two well-understood patterns:

  1. Crypto-agility. Architect systems so algorithms can be swapped without re-engineering protocols or rewriting applications. This lets you adopt the ICCS/SCA winner — or a NIST PQC algorithm — when the time comes, without another migration project. See crypto-agility.html.
  2. Hybrid key establishment / signatures. Combine a classical SM layer (SM2 or SM9) with a post-quantum primitive — either a NIST PQC algorithm such as ML-KEM (key encapsulation) or ML-DSA (signatures), or a forthcoming domestic PQC algorithm. A shared secret or signature is valid only if both components hold. Hybrid SM + PQC can, as an engineering matter, preserve the SM algorithm path while adding quantum-resistant protection; but whether it satisfies 密评 or sector-regulatory requirements depends on the specific cryptographic-application design, product qualifications, algorithm-approval status, and the determination of the testing body / competent authority — it cannot automatically be equated with "already compliant." See hybrid.html.
Warning
Hybrid SM + PQC is an engineering pattern, not yet a Chinese regulatory mandate. It is a sound way to bridge the gap, but check that your specific 密评 scope accepts the construction and that the SM layer remains correctly deployed for compliance. Do not present hybrid as a regulatory requirement that does not currently exist.
Note — two distinct tracks
In China-regulated deployments, NIST PQC algorithms (ML-KEM, ML-DSA, etc.) may help with engineering pilots and international interoperability, but commercial-cryptography (商密) compliance depends on SCA / GM/T / GB/T requirements and future domestic PQC approvals. Treat "GM/SM migration" and "NIST PQC migration" as two distinct tracks.

Putting it into a migration plan

Fold the SM asymmetric layer into the same migration workflow you use for RSA/ECC:

  • Inventory every use of SM2 and SM9, alongside RSA/ECC, in a cryptographic bill of materials.
  • Prioritize Shor-vulnerable assets protecting long-lived data — they are the HNDL targets.
  • Pilot crypto-agile, hybrid endpoints so the eventual swap is a configuration change, not a rebuild.

The end-to-end workflow is in migration.html.

Standards & references

Note
The position to hold: SM2/SM9 need a post-quantum replacement for the same reason RSA/ECC do — Shor breaks them all. China's official PQC selection (ICCS/SCA, Feb 2025) is still ongoing with no winners, so the durable strategy is crypto-agility plus hybrid SM + NIST-PQC (or future domestic PQC), which keeps you 商用密码-compliant today while adding quantum resistance.

国密后量子迁移

中国商用密码套件面临的量子风险与全球别无二致：SM2 与 SM9 是会被 Shor 算法攻破的非对称算法，而 SM3、SM4、ZUC 只会被 Grover 算法削弱。商密非对称层需要一个后量子替代方案。中国的官方答案——ICCS/SCA 2025 年新一代征集——仍在征集与评估中，因此受合规约束的企业应以密码敏捷性与混合部署来跨越这段空窗期。

商密套件为何面临风险

量子威胁不分国界——它只认数学（详见 quantum-threat.html）。SM 算法可分为两个风险层级：

算法类型量子攻击状态
SM2椭圆曲线公钥Shor会被 CRQC 攻破——需 PQC 替代
SM9基于配对的标识密码（IBC）Shor会被 CRQC 攻破——需 PQC 替代
SM3杂凑Grover仅被削弱——加大输出长度缓解
SM4分组密码（对称）Grover仅受已知通用量子搜索平方级加速影响；需按目标安全等级评估 128 位对称安全是否足够，必要时采用更高强度替代方案或分层设计
ZUC序列密码（对称）Grover仅被削弱——采用更大变体（ZUC-256）

SM2 与 SM9 是当务之急。SM2 是 256 位椭圆曲线算法，SM9 是基于配对的标识密码，两者均依赖离散对数难题，而具备密码学意义的量子计算机（CRQC）可高效求解，因此它们会像 RSA、ECC 一样被攻破。SM3、SM4、ZUC 仅被削弱——Grover 至多带来平方级加速，通过增大输出长度或密钥长度（例如 ZUC-256）即可应对。逐一算法分析见 sm-algorithms.html；使 SM2/SM9 密文成为当下问题的先收集、后解密（Harvest Now, Decrypt Later, HNDL）紧迫性见 harvest-now.html。

中国的 PQC 标准化路线

目前尚无已定稿的中国国家 PQC 标准。两项不同的工作不应混为一谈：

  • ICCS/SCA 新一代征集（当前的官方路线）。2025 年 2 月，商用密码标准研究院（ICCS）启动了新一代商用密码算法征集。当前标准化征集路径由商用密码标准研究院（ICCS）按照密码行业标准化技术委员会工作安排组织开展，并服务于国家商用密码算法标准制定——这是一次面向全球、覆盖公钥、杂凑、分组密码各类别的征集，要求同时抵御经典攻击与量子攻击。截至 2026 年 6 月 29 日，公钥算法提案提交期尚未结束，尚无获选算法；提交截止后还将经历形式审查、候选公布和多轮评估。后续状态应以 ICCS/SCA 官方公告为准。
  • 全国密码算法设计竞赛（历史路线）。中国密码学会曾于 2018 年发起一次全国密码算法设计竞赛，2020 年 1 月公布获胜算法（其中含格基等公钥算法）。这是一条独立的早期路线，并非当前的官方标准化工作。

由于官方替代方案仍在遴选，将部署押注于某个尚未定稿的国产 PQC 算法为时过早。应跟踪 ICCS/SCA 的公告，而非提前锁定。

务实路径 密码敏捷性加混合

受合规约束的企业面临一道空窗：商用密码合规要求当下就使用经批准的 SM 算法（见 gm-compliance.html），而尚无国产 PQC 标准可提供抗量子能力。工程上的解法是结合两种成熟的模式：

  1. 密码敏捷性。将系统设计成可在不重构协议、不改写应用的前提下替换算法。如此一来，待 ICCS/SCA 的获胜算法——或某个 NIST PQC 算法——就绪时，无需再启动一轮迁移工程即可采用。详见 crypto-agility.html。
  2. 混合密钥协商与签名。将经典 SM 层（SM2 或 SM9）与一个后量子原语相结合——既可选 NIST PQC 算法如 ML-KEM（密钥封装）或 ML-DSA（签名），也可选未来的国产 PQC 算法。共享密钥或签名只有在两个组件都成立时才有效。混合 SM + PQC 可以在工程上同时保留商密算法路径并引入抗量子保护；但其是否满足密评或行业监管要求，取决于具体密码应用方案、产品资质、算法批准状态和测评机构/主管部门认定，不能自动等同于“已合规”。详见 hybrid.html。
警告
混合 SM + PQC 是一种工程模式，目前尚非中国的监管强制要求。它是跨越空窗期的稳妥做法，但仍需确认你具体的密评范围接受该构造，且 SM 层为满足合规而被正确部署。不要把混合方案说成一项当前并不存在的监管要求。
说明 两条独立轨道
在中国受监管的部署中，NIST PQC 算法（ML-KEM、ML-DSA 等）有助于工程试点与国际互操作，但商密合规取决于 SCA / GM/T / GB/T 要求以及未来国内 PQC 的审批。应将"国密迁移"与"NIST PQC 迁移"视为两条独立轨道。

纳入迁移计划

把商密非对称层纳入你用于 RSA/ECC 的同一套迁移流程：

  • 盘点每一处 SM2 与 SM9 的使用，连同 RSA/ECC 一起记入密码物料清单。
  • 优先处理保护长生命周期数据的可被 Shor 攻破资产——它们正是 HNDL 的目标。
  • 试点具备密码敏捷性的混合端点，让最终切换成为一次配置变更而非重建。

端到端流程见 migration.html。

标准与参考

说明
应当坚持的判断：SM2/SM9 需要后量子替代的原因与 RSA/ECC 完全相同——Shor 可将它们一并攻破。中国的官方 PQC 遴选（ICCS/SCA，2025 年 2 月）仍在进行，尚无获胜者，因此可持续的策略是密码敏捷性加混合 SM + NIST-PQC（或未来的国产 PQC），既能在当下保持商用密码合规，又能补上抗量子能力。
⚑ Report an error⚑ 纠错与校正