PQC Security

Reference

PQC algorithms, by country

NIST picks the algorithms. Governments decide who actually has to use them, and by when. Australia already approved ML-KEM and ML-DSA, then set an expiry date on the weaker parameter sets it just approved. New Zealand has approved nothing at all yet, and says so in its own security manual. 32 jurisdictions have taken a documented position, one way or the other, and every entry here links to the regulator's own document.

Want the plain-language definition of an algorithm instead of who requires it? Start with the glossary.

Quantum-resistant algorithms

Being deprecated

Classical algorithms with a documented retirement position from at least one authority in this dataset.

Checked, no algorithm named

Each of these regulators requires an inventory, a migration plan, or a deadline, and each was checked specifically for an algorithm requirement. There isn't one.

  • China

    State Cryptography Administration (SCA) / ICCS

    China has no national algorithm at all yet: its own selection competition is still running. Neither of China's two governing cryptography statutes mentions quantum cryptography, and neither national standards registry (GM/T, GB/T) has a post-quantum entry — both were checked in full. The Institute of Commercial Cryptography Standards' national algorithm-selection competition set a public-key submission deadline of 30 June 2026; that deadline passed with no candidate list or result published, and the competition opened a third track (block ciphers) in September 2026 rather than concluding.

    Notice on soliciting next-generation public-key cryptographic algorithm proposals →
  • Hong Kong

    HKMA

    HKMA's banking-sector whitepaper recommends commissioning a cryptographic inventory ("sometimes referred to as a CBOM") but names no algorithm anywhere outside its appendix glossary of acronym expansions. The document contains no occurrence of "FIPS" at all. Hong Kong's one binding cryptography standard, OGCIO's IT Security Guidelines [G3], sets classical minimums (RSA-2048, AES-128) and mentions no quantum algorithm.

    Whitepaper on Quantum Preparedness of Hong Kong's Banking Sector (July 2026) →
  • Belgium

    Centre for Cybersecurity Belgium (CCB), with the Cyber Security Coalition and Quantum Circle

    Belgium's PQC guidance — an industry white paper the Cyber Security Coalition and Quantum Circle led, with CCB as a named contributor rather than sole author — names algorithm families (ML-KEM, ML-DSA, SLH-DSA, FN-DSA, XMSS, LMS) but assigns no parameter sets and takes no Belgian position: it surveys what NIST and other countries prefer rather than approving a national list.

    Preparing for the Quantum Era: A Practical Guide to Post-Quantum Cryptography (white paper, September 2025) →
  • Israel

    Bank of Israel / INCD

    Bank of Israel's binding directive requires banks to inventory cryptographic assets, recording algorithm name and key length, but names no target algorithm. INCD's national best-practices guidance predates FIPS 203/204/205 by more than two years and instead tells organisations to use "as recommended by NIST at the time" — deferring the choice rather than naming one, and no post-FIPS update has been published.

    Bank of Israel Banking Supervision Department letter (7 January 2025) →
  • European Union

    NIS Cooperation Group

    The EU's own coordinated roadmap states plainly that it "does not contain detailed technical recommendations," and SOG-IS — the EU's Common Criteria cryptographic mechanism catalogue — says in its current version that it "does not provide agreed asymmetric quantum resistant mechanisms." Individual member states publish their own national lists instead; there is no EU-level one.

    Coordinated Implementation Roadmap for the Transition to Post-Quantum Cryptography v1.1 →
  • Ghana

    Bank of Ghana

    Bank of Ghana's binding Cyber and Information Security Directive requires regulated financial institutions to "monitor developments in cryptanalysis and update cryptographic algorithms to remain resilient against evolving threats, including quantum advancements," and requires board sign-off before adopting quantum computing or other emerging technologies. Neither clause names a target algorithm or sets a deadline; "quantum" appears in the document only in that monitoring clause and once in a glossary definition sourced to NIST terminology.

    Cyber and Information Security Directive (CISD, March 2026) →
  • Nigeria

    Nigerian Communications Commission (NCC)

    The NCC's binding framework mandates the outcome without naming the means: "Service providers are required to use PQC to develop, communicate, and enforce quantum-resistant cryptography," with full compliance due 12 months after the framework's issuance. No algorithm — not ML-KEM, not any NIST standard by name — appears anywhere in the 154-page document. It is a mandate to adopt post-quantum cryptography without specifying which post-quantum cryptography.

    Cyber Resilience Framework for the Nigeria Communication Sector (CRF-NCS) v1.0 (February 2026) →
  • United Arab Emirates

    UAE Cyber Security Council / TDRA

    The UAE's National Encryption Policy is described on the government's own u.ae portal as mandating requirements for "key management, post-quantum cryptography, implementation, and ongoing performance monitoring," via a binding Executive Regulation. But the policy PDF itself, hosted on csc.gov.ae, could not be retrieved: the server resets the TLS connection immediately after the handshake begins, confirmed on repeated attempts, and no Wayback Machine snapshot exists. Whether it names specific algorithms or parameter sets is unverified. The UAE's other binding cryptography instrument we could read in full, TDRA's Information Assurance Regulation v1.1, contains zero occurrences of "quantum" across all 188 controls.

    National Encryption Policy (u.ae summary; underlying PDF unreachable) →
  • Russia

    TC 26 (Технический комитет по стандартизации 26) / Rosstandart

    There is no post-quantum GOST standard, and none is scheduled: Russia's national standards registry, checked directly, lists six current GOST R cryptography standards (signature, hash, block ciphers, terminology, an industrial protocol), none quantum-resistant, and the registry contains zero occurrences of the word "quantum." TC 26's Working Group 2.5 on post-quantum mechanisms is active and circulates three candidate algorithms — Shipovnik, Hypericum, Kodieum — but every source naming them is a vendor or trade-press report, never TC 26 or Rosstandart directly, and none has a draft GOST number.

    TC 26, National Standards registry →
  • Czech Republic

    NÚKIB (Národní úřad pro kybernetickou a informační bezpečnost)

    NÚKIB's cited position is an endorsement of the 18-member-state joint EU statement on PQC, not a Czech-authored technical document: it "agrees with the document's conclusions and supports the preparatory steps," naming no algorithm of its own.

    NÚKIB, "EU Member States Warn of the Quantum Threat..." (17 January 2025) →
  • Slovenia

    Urad Vlade Republike Slovenije za informacijsko varnost (URSIV)

    URSIV's PQC FAQ names no algorithm anywhere in its 21 pages — confirmed by full-text search. It relays that the EU's own NIS Cooperation Group PQC working group "keeps no list of recommended hybrid or other PQC algorithms" and instead summarises other countries' differing positions (BSI, the European Commission, NSA CNSA 2.0, Sweden, UK NCSC) without taking an independent Slovenian stance. It does note that classical AES-128 is assessed as only medium quantum risk, with attacks considered impractical "in the near future" — symmetric cryptography is explicitly not prioritised for replacement.

    Načrt Evropske unije za postkvantno kriptografijo: Pogosta vprašanja (May 2026) →
  • Vietnam

    Cục An toàn thông tin (Authority of Information Security), under the Prime Minister's Office

    Decision 125/QĐ-TTg sets research directions — mastering PQC and quantum key distribution, building national standards and legal frameworks, a domestic "Make in Vietnam" cryptography product ecosystem — but names no specific algorithm anywhere. RSA and ECC are named only generically, as the legacy basis under threat, with no key-size threshold or retirement date attached.

    Decision 125/QĐ-TTg (6 July 2026) →
  • New Zealand

    GCSB / NCSC New Zealand

    New Zealand's national security manual says so in its own words: "Currently there are no post-quantum cryptographic systems approved for use in the NZISM." Agencies are told to keep using existing classical algorithms and key lengths until PQC standards are incorporated, with a warning that GCSB "may deprecate or withdraw support for existing classical cryptographic standards" and that agencies should be prepared to transition, "possibly in the next 2-3 years."

    New Zealand Information Security Manual (NZISM) v3.9, §2.4 "Preparation for Post-Quantum Cryptography" (November 2025) →
  • Norway

    NSM (Nasjonal sikkerhetsmyndighet)

    NSM's migration guide explicitly recommends waiting: "Det er anbefalt å avvente standardiserte løsninger fremfor å gjennomføre forhastede anskaffelser av kvantesikker kryptografi" (it is recommended to await standardised solutions rather than making rushed procurements of quantum-safe cryptography). It states NSM will publish a recommended-algorithm list at a dedicated URL in future, but that page currently carries no algorithm table — only the same general overview already cited on Norway's country page.

    NSM, "Kvantemigrasjon – veileder" (10 October 2023, updated 11 October 2023) →

Where countries diverge

The clearest disagreement across everything researched here is hybrid deployment. France requires it as a condition of security-visa certification; Germany's BSI recommends it almost universally, exempting only hash-based signatures; the Netherlands mandates a specific hybrid-AND construction and warns explicitly against hybrid-OR downgrade attacks. The US NSA takes the opposite position for National Security Systems: it "will not require NSS developers to use hybrid certified products for security purposes," reasoning that "spending limited resources to add cryptographic complexity can at times weaken security rather than improve it." The UK's NCSC recommends hybrid only "as an interim measure," expecting a later move to PQC-only. Spain conditions the requirement on the primitive: mandatory for lattice-based signatures, unnecessary for hash-based ones.

Australia is the outlier on parameter-set strength. Its Information Security Manual approves ML-KEM-768 and ML-DSA-65 today, then says plainly that neither "will be approved beyond 2030": the date most jurisdictions use only to retire RSA and ECC, applied here to a post-quantum algorithm Australia itself just approved. Japan moved second: CRYPTREC added ML-KEM to its ciphers list for the first time in March 2026, though the matching signature slot is still an explicit placeholder, "under consideration." New Zealand and Norway are the most candid about not being there yet. New Zealand's own security manual states, in full, "there are currently no post-quantum cryptographic systems approved."

Several of the most-searched jurisdictions on this tracker have named no algorithm at all. The European Union's own coordinated roadmap says it "does not contain detailed technical recommendations," and SOG-IS, the EU's Common Criteria cryptographic mechanism catalogue, says in its current version that it "does not provide agreed asymmetric quantum resistant mechanisms." Belgium, Hong Kong, Israel, Switzerland, and Taiwan's own government all defer to NIST instead of publishing a national list. China's algorithm-selection competition has now run past its own submission deadline without a result.

FAQ: PQC algorithms by country

Which post-quantum algorithm do most countries recommend?
ML-KEM (FIPS 203, formerly CRYSTALS-Kyber) is the key-encapsulation mechanism every jurisdiction in this dataset that names an algorithm at all recommends as the default, alongside ML-DSA (FIPS 204) for signatures. Parameter-set preferences and hybrid requirements vary by country — see each algorithm’s page for the sourced detail.
Does the EU have its own approved post-quantum algorithm list?
No. The EU's NIS Cooperation Group roadmap states directly that it "does not contain detailed technical recommendations," and SOG-IS, the EU's Common Criteria cryptographic mechanism catalogue, states in its own current version that it "does not provide agreed asymmetric quantum resistant mechanisms." Individual EU member states — Germany, France, the Netherlands, Spain, Italy — publish their own national lists instead.
Do countries agree on whether post-quantum algorithms should be deployed in hybrid mode?
No, and the disagreement is sharp. France requires hybrid deployment (classical plus post-quantum) as a condition of its security-visa certification, and Germany's BSI recommends it near-universally. The US NSA takes the opposite position for National Security Systems, stating it "will not require NSS developers to use hybrid certified products for security purposes" and that added complexity "can at times weaken security rather than improve it." The UK's NCSC sits in between, recommending hybrid only as an interim measure.

An algorithm gets its own page once at least 3 countries have taken a position on it. Below that, it stays listed above rather than getting a page with nothing in it.