Mandatory establishment of quantum security systems in November... Which companies offer KCMVP modules equipped with non-validated PQC algorithms?

[Financial News] With the amendment to the Quantum Technology Industry Act, which mandates the establishment of quantum security systems for the government, local governments, and public institutions, set to take effect on November 20, attention is focused on companies that have equipped cryptographic modules validated under the Korea Cryptographic Module Validation Program (KCMVP) with Post-Quantum Cryptography (PQC) as a non-validated algorithm.
According to the relevant industry on the 15th, the amendment passed the plenary session of the National Assembly of the Republic of Korea on April 23, was approved by the State Council of South Korea on May 12, and was promulgated on the 19th of the same month. It will take effect six months later, on November 20.
Article 18-2 of the amended Act mandates that central administrative agencies, local governments, and public institutions establish quantum security systems, such as Post-Quantum Cryptography (PQC) or Quantum Key Distribution (QKD), in accordance with technical guidelines from the Ministry of Science and ICT and the National Intelligence Service (NIS). Detailed standards, including applicable systems and implementation schedules, are to be determined by enforcement decrees and enforcement rules. As of 2026, there are 342 public institutions, and the number of entities subject to this requirement exceeds 600 when central administrative agencies and local governments are included.
Security products for public institutions utilize cryptographic modules validated under the National Intelligence Service's Korea Cryptographic Module Validation Program (KCMVP). However, since the PQC algorithm is not currently included among the cryptographic algorithms subject to KCMVP validation, even if PQC is installed in a cryptographic module that has received KCMVP validation, the PQC function itself has not been validated under KCMVP.
According to recent media reports and data compiled on August 10, companies that have incorporated PQC as a non-validated algorithm into KCMVP cryptographic modules include Hancom WITH Inc. (IQNUS Crypto v1.0 · January 13, 2025), XGate (PQC Hybrid Cryptographic Module · April 21, 2026), and ITCENPNS CO., LTD. (EdgeCrypto v4.2 · July 29, 2026).
This means that while these cryptographic modules have received KCMVP validation, the integrated PQC function falls outside the scope of validation. Consequently, it is understood that there are currently no products in Korea whose PQC algorithm itself has received KCMVP validation. In the future, whether PQC is included among the cryptographic algorithms subject to national KCMVP validation and how related certification and procurement standards are established are expected to be key variables for market expansion.
It is not that there is a lack of technological assets. According to the Ministry of Intellectual Property, Korea ranked first in the world with 101 patent applications filed through the five IP offices (IP5) related to core technologies for PQC standards from 1997 to June 2024, more than double the 48 applications filed by the second-ranked United States. Korea has also secured four proprietary algorithms through a national competition.
"Algorithm development, commercial module implementation, and national validation are separate barriers," said an industry official. "There may be a significant time lag between securing patents and technology and actually producing validated products and entering public procurement."


[email protected] Kim Kyung-ah Reporter