Why is 128-bit considered “medium term” security?

Why is 128-bit encryption considered good enough for medium term security only? How is expected to be eventually broken? Quantum computing or brute force attack?

• Can you reference where you saw this? Was it talking about block ciphers, hash functions, something else? – mikeazo Apr 14 '16 at 2:07
• Likely suite B or discussion informed by suite B. – Thomas M. DuBuisson Apr 14 '16 at 5:36

Because in the long term it is expected that mankind will be able to carry out $2^{128}$ operations because it's not physically as impossible as $2^{256}$ operations.
Assuming quantum computers work at a speed comparable to classical computers nowadays, they can break 128-bit encryption using $2^{64}$ operations (Grover's algorithm) which is considered feasible in the long-term, of course this should be considered additional to classical brute-force which may also be feasible at some point.