Quantum Computers Are Not a Threat to 128-bit Symmetric Keys

Shor's algorithm breaks asymmetric cryptography such as ECDH, RSA, ECDSA, and EdDSA, but it has no effect on symmetric cryptography such as AES and SHA-2/SHA-3 or their key sizes.

The commonly repeated claim that "quantum computers halve symmetric key security" is a misunderstanding of Grover's algorithm. Grover provides a square-root-level speedup for unstructured search, but this gain is greatly diluted once the attack is parallelized.

• Classical brute force can easily be split across many CPUs, but Grover attacks do not distribute linearly in the same way.
• A classical attack breaking a 64-bit key keeps the same total workload even when parallelized, but with a Grover attack, splitting the search space reduces the gain of each instance.
• Even applying Grover to a 128-bit key would in practice require a huge number of quantum circuits and long, stable runtimes.

Even under conservative assumptions, the author calculates that with a quantum hardware gate time of 1µs, an executable depth over 10 years, and applying research on optimized Grover oracles for AES-128, breaking AES-128 would require parallelization on the order of roughly 2^47. This means about 140 trillion quantum circuits would need to run simultaneously.

Also, the DW cost of this attack is estimated at about 2^104.5, which is far more expensive than the recently proposed Shor attack on 256-bit elliptic curves. The article emphasizes that the cost of breaking AES-128 with Grover is extremely larger than the cost of breaking 256-bit ECC with Shor.

Finally, NIST also treats AES-128 as the baseline for post-quantum cryptography, making it clear that what needs to change in the current post-quantum transition is asymmetric cryptography, not symmetric key length.