Vietnam Unveils Draft Post-Quantum Crypto Standards

Vietnam has published three draft national standards for post-quantum cryptography, the encryption and signature methods designed to resist attack by future quantum computers. One of them, a digital signature algorithm called HB-PQSign, was developed in Vietnam. The other two, ML-KEM and ML-DSA, are based on international standards. The drafts are open for expert feedback and may change before they are adopted.

What was announced

The Government Cipher Committee, the state body responsible for government cryptography, “announced the draft standards at a workshop in Hanoi on October 17”, the state broadcaster VOV reported.

According to VOV, the three drafts cover:

HB-PQSign, “a post-quantum digital signature algorithm researched and developed in Vietnam”;
ML-KEM, “a key encapsulation mechanism based on an international standard”; and
ML-DSA, “a digital signature algorithm based on the international standard FIPS 204”.

A report by VietNamNet describes HB-PQSign as a hash-based post-quantum signature algorithm, “có sửa đổi” (with modifications), and ML-DSA as a signature scheme based on structured lattices (TSN’s translation from Vietnamese). Neither report gives technical details of HB-PQSign or says what it was modified from, and TSN has not seen any independent security analysis of it.

The Cipher Committee also launched a website at the workshop to collect feedback from scientists, specialists and technology companies on the three drafts, VOV reported. It said the consultation is meant to “help refine the drafts, ensure their quality and bring them closer to leading international standards”. VietNamNet reported that the technical documents have been posted on the websites of the Government Cipher Committee, the Ministry of National Defence and the national standards body. Neither report gives a deadline for comments.

Why Vietnam is doing this

Most encryption used today relies on maths problems that ordinary computers cannot solve in any practical time. A large enough quantum computer could solve some of them, which would break much of today’s public-key encryption and digital signatures. Post-quantum cryptography uses different maths problems that are thought to be hard for both kinds of computer.

The Cipher Committee pointed to the risk of encrypted data “being collected now and decrypted in the future as more powerful computing capabilities become available”, according to VOV. That threat, often called “harvest now, decrypt later”, is why governments are moving before any such quantum computer exists.

The 2026-2035 timetable

According to VOV, “the Prime Minister has approved a scheme to develop a quantum-resistant cryptographic system for 2026-2035”, along with a roadmap for the switch over the same period. “The initial phase will involve reviewing cryptographic systems and assessing potential risks. From 2028, existing cryptographic technologies will gradually be combined with post-quantum cryptography, with the transition scheduled for completion by 2035,” VOV reported.

VietNamNet gives a more detailed set of four milestones (TSN’s translation):

2027: full issue of national technical standards for post-quantum algorithms, products and security devices;
2030: information systems important to national security converted to post-quantum cryptography using a hybrid approach, which combines current and post-quantum methods;
2033: further national standards for post-quantum cryptography and quantum key distribution; and
2035: 100% of information systems important to national security switched to quantum-resistant cryptography.

VietNamNet’s 2035 milestone refers specifically to systems important to national security; VOV describes the 2035 date as the completion of the transition more generally.

Major General Ho Van Huong, deputy head of the Government Cipher Committee, said the roadmap is based on “the principles of caution, coordination and continuity”, VOV reported. In a caption, VOV quoted him as saying the transition “must be cautious, coordinated and uninterrupted”.

Post-quantum cryptography “would serve as the main technological solution for nationwide adoption”, while quantum key distribution (QKD) “would play a complementary role, applied selectively to certain critical communication networks”, according to VOV. QKD uses quantum physics, rather than maths, to share encryption keys.

How the drafts relate to the US standards

Two of the three names match algorithms that the US National Institute of Standards and Technology (NIST) finalised in August 2024. NIST’s announcement lists FIPS 203, “the primary standard for general encryption”, based on the algorithm now called ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism), and FIPS 204, “the primary standard for protecting digital signatures”, based on ML-DSA (Module-Lattice-Based Digital Signature Algorithm). A third NIST standard, FIPS 205, uses a hash-based signature scheme, SLH-DSA, “intended as a backup method in case ML-DSA proves vulnerable”.

VOV says Vietnam’s ML-DSA draft is based on FIPS 204. For ML-KEM, it says only that the draft is “based on an international standard”, without naming it.

Vietnam is one of several governments setting dates for the switch. Germany has set an end-2030 deadline for high-risk systems, and Singapore has published quantum-safe milestones for organisations. In the US, the Government Accountability Office found that no agency was fully prepared, as TSN has reported.

The skills question

Turning the standards into working systems will depend on having enough qualified specialists, according to Lieutenant General Dang Vu Son, a former head of the Cipher Committee, quoted by VOV. Dr Nguyen Quoc Toan, director of the Institute of Cryptography Science and Technology, said the committee aims to build capability across four layers: design and proof, cryptanalysis, secure implementation and hardware, and standardisation and testing, VietNamNet reported.

What we don’t know yet

The final text. These are drafts out for consultation and may change.
How HB-PQSign works. Neither report gives a technical specification or a security analysis.
Who must comply. The reports focus on state and critical systems. They do not say how the standards will apply to private companies.
The consultation deadline and the address of the feedback website.

The Bottom Line

Vietnam has put three draft post-quantum cryptography standards out for comment, mixing two internationally based algorithms with a home-grown signature scheme. Its plan is to start combining current and post-quantum encryption from 2028 and finish the transition by 2035. The drafts may still change.