Next-generation commercial cryptographic algorithms (NGCC)

China's open call for post-quantum public-key algorithms and hash functions, run by the Institute of Commercial Cryptography Standards (ICCS). Algorithms already standardised by NIST were not eligible. This site tracks the signatures and KEMs only.

Organiser: ICCS, Beijing
Region: China
Stage: Round 1, since 20 Sep 2026
Signatures: 34 candidates
KEMs: 41 candidates
Not tracked: 9 key exchange, 35 hash functions

Timeline

Programme launched

5 Feb 2025
Call for proposals

9 Oct 2025
Submissions closed

30 Jun 2026
Round 1: 119 candidates

Current · 20 Sep 2026
Round 2: not announced

Security levels

NGCC sets its targets in bits of classical security, each with a minimum quantum security. NIST categories are defined by comparison with brute-force attacks on AES and SHA, so the two scales do not line up. This site shows each scheme on its own programme's scale and does not convert between them.

NGCC target	Classical (bits)	Quantum (bits)	Status
128-bit	128	≥ 80	Required
256-bit	256	≥ 128	Required
384-bit	384	—	Optional
512-bit	512	≥ 256	Required

Even the lowest NGCC target asks for 128-bit classical security; the 512-bit target is beyond any NIST category.

Published findings

Worst recorded finding per candidate, from our data. Full reports: ngcc.dev(opens in a new tab).

Signatures · 34 candidates

20 broken scheme
11 implementation findings only
0 security warnings only
3 nothing recorded
34 with a published findings report

KEMs · 41 candidates

10 broken scheme
18 implementation findings only
0 security warnings only
13 nothing recorded
41 with a published findings report

Design findings concern the specified scheme; implementation findings concern the submitted code. Many design findings cap only the 256- or 512-bit parameter sets, so a candidate with a design finding may still meet its 128-bit target. Findings were published by Markku-Juhani O. Saarinen's evaluation effort and outside researchers; each report credits its authors. Our summaries are in our own words.

Round 1 candidates

pk size vs. sig size (log–log scale)

Scroll to zoom · drag to pan· tap a point for details

		Programmes								Assumption
Aigis-Sig+	Lattices	NGCC R1	Aigis-Sig+-I	128-bit	928	2,015	2,943	400.8 µs	128.1 µs	MLWE/MSIS

BiT	Lattices	NGCC R1	BiT-128	128-bit	1,048	1,504	2,552	324.8 µs	95.0 µs	MLWE/MSIS

CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-160s	128-bit	40	9,460	9,500	2.37 s	5.89 ms	Hash-based

CEDRUS+C	Symmetric	NGCC R1	CEDRUSC-160f	128-bit	40	19,812	19,852	141.75 ms	4.33 ms	Hash-based

CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-160s	128-bit	40	10,300	10,340	2.16 s	5.34 ms	Hash-based

CEDRUSɑ	Symmetric	NGCC R1	CEDRUSALPHA-160f	128-bit	40	19,420	19,460	158.54 ms	4.94 ms	Hash-based

Chinith	Symmetric	NGCC R1	sm4th_d3_128f_loose	128-bit	32	6,724	6,756	4.23 ms	3.88 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_d3_128f_tight	128-bit	32	11,864	11,896	4.83 ms	4.39 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_d3_128s_loose	128-bit	32	5,056	5,088	30.23 ms	26.84 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_d3_128s_tight	128-bit	32	9,176	9,208	33.67 ms	30.77 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_em_d2_128f_loose	128-bit	32	4,932	4,964	3.88 ms	3.68 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_em_d2_128f_tight	128-bit	32	9,450	9,482	4.05 ms	3.81 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_em_d2_128s_loose	128-bit	32	3,818	3,850	28.65 ms	26.13 ms	Block-cipher OWF

Chinith	Symmetric	NGCC R1	sm4th_em_d2_128s_tight	128-bit	32	7,556	7,588	31.31 ms	29.39 ms	Block-cipher OWF

COMPASS-SIG	Lattices	NGCC R1	COMPASS-SIG-128	128-bit	1,664	2,080	3,744	663.5 µs	382.0 µs	MLWE/Shell-MISIS
CS	Lattices	NGCC R1	CS-128	128-bit	976	1,548	2,524	722.0 µs	154.4 µs	MLWE/MSIS

DARTS	Lattices	NGCC R1	DARTS128	128-bit	1,120	1,449	2,569	3.00 ms	79.9 µs	MLWE/MSIS

DOVE	Multivariate	NGCC R1	dove_classic_128	128-bit	191,646	136	191,782	212.3 µs	346.8 µs	UOV
DOVE	Multivariate	NGCC R1	dove_pkc_skc_128	128-bit	43,576	136	43,712	2.48 ms	2.22 ms	UOV
Facto-DSA	Other	NGCC R1	Facto-DSA-128	128-bit	40,040	40	40,080	283.1 µs	245.3 µs	Cubic factorisation

FlexTree	Symmetric	NGCC R1	Flextree-160s	128-bit	40	9,580	9,620	2.31 s	6.03 ms	Hash-based

FlexTree	Symmetric	NGCC R1	Flextree-160f	128-bit	40	18,672	18,712	153.26 ms	4.37 ms	Hash-based

Galas	Symmetric	NGCC R1	Galas-160S	128-bit	40	4,812	4,852	574.00 ms	408.55 ms	Gala OWF

Galas	Symmetric	NGCC R1	Galas-160F	128-bit	40	5,964	6,004	441.12 ms	285.33 ms	Gala OWF

GreatWall	Symmetric	NGCC R1	GreatWall192f	128-bit	50	8,012	8,062	2.82 ms	3.64 ms	Pylon OWF
GreatWall	Symmetric	NGCC R1	GreatWall192s	128-bit	50	6,804	6,854	11.22 ms	26.07 ms	Pylon OWF
Lynxer	Symmetric	NGCC R1	Lynxer-160s	128-bit	40	4,607	4,647	19.81 ms	16.94 ms	Lynx OWF
Lynxer	Symmetric	NGCC R1	Lynxer-160f	128-bit	40	5,801	5,841	2.64 ms	2.38 ms	Lynx OWF
MORNING-ATLAS	Lattices	NGCC R1	lwrdsa128	128-bit	1,328	2,081	3,409	1.25 ms	685.5 µs	MLWR/MSIS

Octarine	Lattices	NGCC R1	Octarine-128	128-bit	1,344	2,564	3,908	317.1 µs	138.4 µs	RR-LWR/RR-MSIS
OPS-DSA	Lattices	NGCC R1	OPSsig-128	128-bit	2,560	4,349	6,909	371.9 µs	263.2 µs	MLWE/MSIS

Origami	Multivariate	NGCC R1	Origami-128	128-bit	2,996	116	3,112	7.76 ms	6.95 ms	Multivariate Quadratic

Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-192s	128-bit	48	13,332	13,380	230.52 ms	4.00 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SHAKE-192f	128-bit	48	30,766	30,814	56.15 ms	1.57 ms	Hash-based
Phoenix	Symmetric	NGCC R1	Phoenix-SM3-192s	128-bit	48	13,332	13,380	3.02 s	10.40 ms	Hash-based

Phoenix	Symmetric	NGCC R1	Phoenix-SM3-192f	128-bit	48	30,766	30,814	152.71 ms	4.10 ms	Hash-based

Qing Luan	MPCitH	NGCC R1	QingLuan-128	128-bit	77	18,720	18,797	4.11 ms	1.85 ms	Restricted Synd. Dec.
ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-160s	128-bit	121	5,307	5,428	21.96 ms	17.18 ms	Regular Synd. Dec.
ReSolveD-ɑ	MPCitH	NGCC R1	ReSolveD-alpha-160f	128-bit	121	6,851	6,972	4.42 ms	2.33 ms	Regular Synd. Dec.
Rhyme	Lattices	NGCC R1	Rhyme-SM3-128	128-bit	800	5,156	5,956	933.2 µs	119.6 µs	GA-MLWE/MSIS

Rhyme	Lattices	NGCC R1	Rhyme-SHAKE-128	128-bit	800	5,156	5,956	556.4 µs	49.2 µs	GA-MLWE/MSIS

Shuttle	Lattices	NGCC R1	SHUTTLE-128	128-bit	1,264	1,183	2,447	193.5 µs	77.7 µs	MLWE/MSIS

Sigurd	MPCitH	NGCC R1	Sigurd128	128-bit	112	62,868	62,980	9.77 ms	3.96 ms	Regular Synd. Dec.

SQIsign2D-push1/2	Isogenies	NGCC R1	SQIsign2D-lvl2	128-bit	96	218	314	312.83 ms	63.21 ms	Isogenies
SQIsign2D2	Isogenies	NGCC R1	SQISign2Dsquare-Level2-eff	128-bit	80	248	328	31.24 ms	6.30 ms	Isogenies

SQIsign2D2	Isogenies	NGCC R1	SQISign2Dsquare-Level2-sec	128-bit	84	260	344	37.50 ms	7.24 ms	Isogenies

SQIsignTriangle	Isogenies	NGCC R1	SQIsignTriangle_lvl2	128-bit	81	255	336	54.85 ms	11.76 ms	Isogenies

SYDO	MPCitH	NGCC R1	sydo_160s	128-bit	80	5,428	5,508	21.39 ms	18.98 ms	Regular Synd. Dec.
SYDO	MPCitH	NGCC R1	sydo_160f	128-bit	80	6,724	6,804	4.14 ms	3.97 ms	Regular Synd. Dec.
Tins	MPCitH	NGCC R1	Tins128	128-bit	55	3,896	3,951	DNF(Benchmark did not finish (valid signature rejected))	DNF(Benchmark did not finish (valid signature rejected))	NSBC

TRINE	Other	NGCC R1	TRINE-128-Balanced	128-bit	16,004	3,156	19,160	7.84 s	5.28 s	Trilinear Form Equiv.

TRINE	Other	NGCC R1	TRINE-128-ShortSig	128-bit	63,920	1,652	65,572	3.83 s	1.55 s	Trilinear Form Equiv.

TSUOV	Multivariate	NGCC R1	TSUOV_128	128-bit	779	896	1,675	3.07 ms	2.91 ms	UOV

UVW signature	Code-based	NGCC R1	UVW-128	128-bit	5,897,612	1,244	5,898,856	2.83 s	94.18 ms	Synd. Dec. over F3

VDOO	Multivariate	NGCC R1	VDOO-128	128-bit	330,855	85	330,940	51.19 ms	628.7 µs	UOV-type MQ

YuanYang.DSA	Lattices	NGCC R1	yuanyang-512	128-bit	738	561	1,299	1.29 ms	53.7 µs	NTRU/NTRU-SIS

56 parameter sets

Legend pre-quantumbroken schemeimplementation findingssecurity warningnote value estimated from cycle counts at 2.5 GHz — not yet benchmarked timeout / DNF benchmark did not finish (too slow / failed) no code: no implementation to benchmark Select an icon for details

Open in the signature comparison →