I think we are all aware of the CAESAR-competition. Now the aim of this competition is to select a (portfolio of) winner(s) which provide authenticated encryption.
I'll now assume that the results produced by this competition are very good, meaning the cryptanalysis of the next 50+ (!) years won't yield any significant attacks (speed-up no more than $2^{80}$ compared to brute-force). Further it may be assumed that the scheme has 512-bit keys, to reach 256-bit security against quantum-computers.
So far for the assumptions, now to the background:
I recentely read this text by B. Schneier, where it was stated that the laws of thermodynamics disallow a counter to count to more than $2^{200}$, even in an ideal setting (3.2K, dyson sphere, kT for bit-flip,...). So I asked myself the following question as 512-bit seem to fully suffice forever (if we don't harvest the whole universe's energy...)
Now my question:
Besides performance and flexibility, will there ever be the need for 1024-bit symmetric encryption?