UAGuidanceUkraine
SSSCIP's own regulatory work plan documents an in-progress amendment adding a national lattice-based signature standard, DSTU 9212:2023, to Ukraine's list of approved post-quantum-period cryptographic algorithms -- real, dated evidence of active standards work, though the amendment itself was still a planned action, not yet a completed mandate, as of the plan's issue date. Ukraine separately maintains an older lattice-based encryption standard, DSTU 8961:2019 ("Skelya"), documented in independent academic literature though not confirmed directly against SSSCIP's or UkrNDNC's own primary records.
Ukraine's post-quantum cryptography posture is classified as guidance, led by State Service of Special Communications and Information Protection of Ukraine (SSSCIP / Держспецзв'язку). It scores 31/100 on this tracker's rubric, an early-stage or narrowly-scoped rule, and that is not a measure of how secure or advanced the country actually is.
What's verified
SSSCIP's Administration published a signed internal document, "Changes to the Plan of Activity for Preparing Regulatory Act Drafts for 2024," amending its own 2024 work plan. Item 8 of that plan commits the agency to draft an amendment to its own Order No. 687 (27 October 2020) -- the order that lists approved cryptographic algorithms and protocols for licensed information-protection providers -- specifically to add a new national standard for the post-quantum period:
"Проєкт акта розроблятиметься з метою врегулювання питання реалізації у засобах криптографічного захисту інформації, призначених для застосування у постквантовий період, відповідних криптографічних алгоритмів та протоколів за стандартами визначеними в Переліку стандартів та технічних специфікацій, дозволених для реалізації в засобах криптографічного захисту інформації, затвердженим наказом Адміністрації Держспецзв'язку від 27 жовтня 2020 року № 687 та доповнення його новим національним стандартом ДСТУ 9212:2023 «Інформаційні технології. Криптографічний захист інформації. Алгоритм електронного підпису на алгебраїчних решітках із відхилами»"
("The draft act will be developed to regulate the implementation, in cryptographic information-protection tools intended for use in the post-quantum period, of the corresponding cryptographic algorithms and protocols under the standards defined in the List of standards and technical specifications approved for implementation in cryptographic information-protection tools, approved by SSSCIP Administration Order No. 687 of 27 October 2020, and to supplement it with the new national standard DSTU 9212:2023 'Information technologies. Cryptographic protection of information. Electronic signature algorithm on algebraic lattices with errors.'")
DSTU 9212:2023 is a lattice-based digital-signature algorithm standard -- a genuine post-quantum cryptographic primitive by construction (lattice-based signature schemes are one of NIST's own selected PQC families). The plan item, signed by SSSCIP head Yurii Myronenko, set a target quarter (Q2) for the amendment draft.
Separately, Ukraine's national standards body has an earlier standard, DSTU 8961:2019 "Skelya" (ДСТУ 8961:2019 «Скеля»), described consistently across multiple independent Ukrainian academic papers (Kharkiv National University of Radio Electronics, V.N. Karazin Kharkiv National University, NTUU KPI) as an NTRU-Prime-derived asymmetric encryption/key-encapsulation algorithm on algebraic lattices, adopted 21 December 2019 and effective 1 January 2021. Multiple peer-reviewed papers analyze its concrete security (core-SVP hardness, CCA-security proofs) and compare it directly to CRYSTALS-Kyber -- convergent academic citation that a fabricated standard number would be very unlikely to produce.
What we checked and did not find
The Order No. 687 amendment adding DSTU 9212:2023 was, as of this planning document, a scheduled draft with a target quarter -- not yet confirmed as a completed, published amendment. DSTU 8961:2019 "Skelya" could not be independently confirmed directly against SSSCIP's Order No. 687 text or UkrNDNC's own standards catalog (UkrNDNC's search interface is JavaScript-rendered and did not return results to a direct fetch); its existence and characterization rest on convergent secondary academic literature rather than a primary regulatory document, and should be cited accordingly. Neither standard is tied to a cryptographic-inventory or CBOM requirement, and the National Bank of Ukraine has published no PQC-specific circular of its own.
Score rationale
Each axis is scored 0–20 against the primary sources listed on this page. See the methodology for what each axis measures and how scores are derived.
| Axis | Score | Why |
|---|---|---|
| Mandate strength | 5/20 | The document is SSSCIP's own internal regulatory work plan, signed by the agency head, committing the agency to draft an amendment -- a real planned regulatory action, but the amendment itself, which would actually add binding force, was not yet issued as of this plan. |
| Deadline concreteness | 8/20 | The plan item carries a specific target quarter (ІІ квартал, Q2) for completing the draft amendment, a real internal deadline, though it is a deadline for SSSCIP to produce a draft, not a compliance deadline for any regulated entity. |
| Scope of coverage | 8/20 | The underlying licensing framework (Cabinet of Ministers Resolution No. 821 of 2016, as amended by SSSCIP Order No. 687) governs providers licensed to supply cryptographic and technical information-protection services in Ukraine -- a defined regulated sector, not economy-wide. |
| Inventory/CBOM requirement | 0/20 | Neither the plan item nor the standards it amends mention a cryptographic inventory, asset-discovery obligation, or CBOM requirement. |
| Regulatory activity | 10/20 | SSSCIP is Ukraine's named cryptography and information-protection regulator, actively maintaining and amending its list of approved post-quantum-period algorithms via a formal, dated, signed internal work plan -- genuine regulatory activity, even though the specific amendment had not yet been finalized as of the plan's issue date. |
| Total | 31/100 | A blunt sum of the five columns to its left. |
Related regulators
Sector bodies checked independently, not assumed from the primary source above.
- Not yet addressed, a gap to watch
National Bank of Ukraine (NBU)
No NBU circular or supervisory guidance specifically addressing post-quantum cryptography or cryptographic inventory was located.
FAQ: Ukraine and PQC
- Does Ukraine have a post-quantum cryptography (PQC) law?
- No. Nothing published for Ukraine carries statutory force for post-quantum cryptography as of this page's last review. What exists is non-binding guidance, set out with its primary sources below. The lead body is State Service of Special Communications and Information Protection of Ukraine (SSSCIP / Держспецзв'язку).
- What is Ukraine's PQC migration deadline?
- None. No migration deadline has been published for Ukraine by any regulator we checked, including State Service of Special Communications and Information Protection of Ukraine (SSSCIP / Держспецзв'язку).
- Does Ukraine require a Cryptographic Bill of Materials (CBOM)?
- No. No CBOM or cryptographic inventory requirement appears in any of the primary sources listed on this page.