GB/T, CCS and NACS compared on openness and security

Three meanings of open

Discussions of charging standards tend to treat open as one quality. Three questions are more useful: whether anyone can read the specification and at what cost, who governs the standard and certifies equipment, and how the car and charger communicate. Security and reliability are separate questions again.

On access and cost, GB/T is the more open standard, and the difference is real. On governance, GB/T is state-run while CCS and NACS are industry-run, which is a different model rather than a more or less open one.

Certificates, encryption and the real barriers

A widely shared view holds that CCS is locked down by encryption certificates while GB/T uses simple CAN messages anyone can implement. The first half is inaccurate. Under ISO 15118-2, TLS encryption is required only for Plug and Charge, the feature that lets a car start and pay for a session automatically, and only the charger authenticates itself. Most CCS sessions run without TLS. DIN SPEC 70121, which many US DC fast chargers still use, is widely reported to include no TLS at all.

ISO 15118-20, the newer version that supports bidirectional power transfer, makes mutual TLS 1.3 mandatory for all sessions, according to CharIN and vendor implementation guides. Even so, anyone can build a CCS charger without a PKI certificate. What a manufacturer cannot offer without certificates is Plug and Charge billing. The paywall on the documents and the cost of conformance testing are the real barriers, not the cryptography.

Nor is either side secure as built.

• GB/T 27930-2015 messages are broadcast in plain text with no source or destination addresses. Li and colleagues (Journal of Computer and Communications, 2019) captured 27,655 messages from a real charging session and demonstrated replay attacks. Adding RSA signatures alone did not stop replay; adding nonces did.
• A 2025 preprint by Shi and colleagues describes weak authentication in the GB/T 20234.2 connection-confirmation circuit, which relies on resistor values.
• CCS: the Brokenwire attack (opens an external site) (Köhler and colleagues, University of Oxford, NDSS 2023; preprint 2022) used a wireless signal to abort charging sessions from up to 47 meters with less than 1 watt of power. It exploits the power-line communication shared by DIN SPEC 70121 and ISO 15118 and was tested against multiple production vehicles and chargers.

Certificates matter most for vehicle-to-grid at scale. When thousands of cars export power on command, the commands and the billing must be authenticated or the grid itself is exposed. That is the purpose of ISO 15118-20 and of the US EV public key infrastructure framework that the SAE EVPKI Consortium and the Joint Office of Energy and Transportation announced in December 2024. China has revised its own communication standard: GB/T 27930-2023 replaced the 2015 edition (opens an external site) in April 2024.

What the reliability data shows

In the US, J.D. Power's 2025 public charging study found that 14 percent of EV owners had a visit in which they could not charge, down from 19 percent in 2024, and its 2026 study was reported to show a record low of 12 percent for failed DC fast charging visits. We found no national failure-rate statistic for China. China does have an interoperability test standard, GB/T 34657.1, revised in 2025, and Chinese drivers know handshake failures between cars and chargers well.

Without comparable data we do not claim that GB/T is more reliable. As an engineering judgment, CAN on dedicated pins is electrically simple and tolerant of noise, while power-line communication on the pilot wire is more sensitive to electrical noise and implementation errors.

Where each standard stands

• GB/T: low-cost access to the specification, a very large installed base and simple CAN communication. Against it: separate AC and DC inlets, limits in the 2015 generation, weak built-in security and use confined to mainland China.
• CCS1: mature, with a route to bidirectional power through ISO 15118-20. Against it: a bulky connector, a mixed US reliability record and paid specifications. In North America it is being replaced at the vehicle inlet by J3400 (opens an external site).
• CCS2: Europe's required standard, combining three-phase AC and DC in one inlet. Not used in the US.
• NACS (SAE J3400): a compact single inlet for AC and DC, rated to 1,000 volts under J3400/2, with access to Tesla Superchargers. Adapters are common during the transition, and because the DC communication is the same as CCS, the CCS security issues carry over.
• CHAdeMO: the first standard with bidirectional DC, used for Leaf V2H since about 2012. It has effectively ended in the US; the 2026 Leaf uses NACS for DC charging.
• ChaoJi: designed for very high power with backward compatibility. Few or no production cars use it yet.

What China required of Tesla

A popular claim holds that China forced Tesla to adopt GB/T and to enable vehicle-to-load (V2L). We checked each part against China's national standards database (opens an external site).

V2L in China spread through competition. Most Chinese brands offer it for camping and outages, and Tesla followed the market (opens an external site).

A home charger in New York

In North America the connector question is settled in favor of J3400. The next changes are in communication and security: ISO 15118-20, certificate infrastructure and UL 1741 SC certification for bidirectional AC charging. A charger bought today should accept firmware updates, and the circuit and conduit should be sized so that the next charger can be swapped in without rewiring. We follow that rule on home and commercial installations in NYC and on Long Island, where licensed partner electricians perform the electrical work. Our guide on wiring a renovation for bidirectional charging covers the details.