China’s Institute of Commercial Cryptography Standards (ICCS) published 119 first-round candidates for its Next-generation Commercial Cryptographic Algorithms Program (NGCC) on September 20, 2026. By 07:33 UTC on September 23, researchers had posted 104 findings against 65 of the candidates on ngcc.dev, a review site run by Markku-Juhani O. Saarinen, a professor of practice at Tampere University in Finland.
ICCS listed 34 digital signature schemes, 41 key encapsulation mechanisms (KEMs), and nine key-exchange protocols in its public-key list, along with 35 hash functions in a separate list. A KEM is a method for two parties to establish a shared secret key over an open network. A hash function is a calculation that turns an input of any length into a short output of fixed length.
In the first three days of public review, researchers posted attacks on five of the 119 designs, none of which has been standardized or deployed. ICCS excluded algorithms already standardized elsewhere, so ML-KEM (CRYSTALS-Kyber), ML-DSA (CRYSTALS-Dilithium), and NIST’s other post-quantum standards are not among the candidates.
The NGCC program
ICCS launched NGCC on February 5, 2025, under the direction of China’s Cryptography Standardization Technical Committee. It cited the threat of quantum computing and said it would consider the finalists for standardization.
ICCS issued its calls for public-key and hash proposals on October 9, 2025, and set a submission deadline of June 30, 2026. NGCC’s algorithms are intended for commercial cryptography. Under China’s 2019 Cryptography Law, that category is used to protect information that does not involve state secrets.
In its submission requirements for public-key algorithms, ICCS set mandatory classical security levels of 128, 256, and 512 bits, paired with minimum strengths against quantum attack of 80, 128, and 256 bits. ICCS defines n-bit strength to mean that the best known attack costs at least 2ⁿ operations.
ICCS required English-language specifications, a reference implementation in ISO C, an optimized implementation, and known-answer test vectors, fixed inputs with expected outputs for checking an implementation. It published every candidate’s submission package and runs open forums for the public-key and hash candidates. ICCS wrote that “the public review is an important reference for the algorithm evaluation.”
Three days of findings
Saarinen lists each finding with the candidate, a severity rating, a status, the researcher credited, and the affected parameter sets, the versions of a scheme at different sizes and security levels. He posts reproduction steps for each finding on the site and keeps the build and test tools needed to follow them in a public GitHub repository. His site says it is not affiliated with NICCS.
Saarinen posted 53 findings on September 21, mostly bugs in submitted code. On September 22, 13 other researchers and groups added 38 findings, 27 of them in the designs themselves.
By September 23, Saarinen had written 64 findings and credited AI assistance on every one. Researchers first posted 22 of the 104 findings on ICCS’s own forums.
Bugs in submitted code
In the UVW signature scheme’s reference and optimized code, a wrapper function around the verification step computed the result and then reported success regardless. In all three parameter sets, the code therefore accepted every signature. In the Aigis-Enc+ KEM, a faulty safeguard against tampered ciphertexts, called implicit rejection, returned the original shared secret for 5,632 of 7,168 single-bit changes to a ciphertext in one test of its Aigis-enc1 parameter set.
Attacks on five designs
On September 22, Tianyuan Xie reported on ICCS’s public-key forum that one signature from the Tins scheme reveals the complete signing witness, the secret the signer uses. With that signature and binary Gaussian elimination on at most 1,044 unknowns, a standard linear-algebra step, an attacker can sign arbitrary messages in all three Tins parameter sets.
A researcher posting as MingLLuo, who disclosed AI assistance, showed in a GitHub issue that an attacker can derive an equivalent signing trapdoor from a Facto-DSA-128 public key in seconds. A signing trapdoor is secret data that lets its holder sign as the key owner. According to ngcc.dev, the same method does not work against the scheme’s 256-bit and 512-bit parameter sets.
Tsinghua Hash Lab reported on ICCS’s hash forum that it could make MoFang’s round keys cancel by choosing a particular difference between two messages. Round keys are values that a hash function such as MoFang mixes into its internal state at each repeated step, or round. The lab used the method to produce collisions, two different inputs with the same hash output, in the full algorithm for all six MoFang instances.
Cryptanalysts001, of the Institute of Software at the Chinese Academy of Sciences, and Tsinghua Hash Lab each found a way to merge two Neulaser states after one round and produce collisions in all three variants. Six Institute of Software researchers also submitted a preprint on seven NGCC hash functions to the IACR ePrint archive on September 22. In it, they reported collisions for both MoFang and Neulaser.
Mikhail Kudinov showed that a FlexTree-160s verifier written to the scheme’s specification would skip two encoding checks. Against such a verifier, he estimated that a forgery would take about 1.5 trillion units of computational work. The submitters’ own verifier performs both checks.
Later rounds
In its call for public-key proposals, ICCS set no dates beyond the June 30 submission deadline. ICCS wrote in its submission requirements that it would require hardware implementations in later evaluation rounds. It also plans to replace the placeholder hash functions it supplied for testing with new hash functions in later rounds.
Update, November 12, 2026: The Tins team confirmed the attack and withdrew its scheme on September 25. By November 11, ngcc.dev listed 441 active findings across 112 candidate reports.
