# Post Quantum Symmetric Cryptography

So I am looking for the most secure method of symmetric key cryptography for long term messaging use between two users. I have heard that most symmetric key algorithms are not absolutely compromised by quantum computers, but rather weakened.

I have read that AES 256 is in fact the weakest, followed by AES 128, and AES 192 being the strongest.

Let us imagine that today quantum computers exist with "good" capacity to break cryptography.

Is AES still the best symmetric key solution as of right now? If not which is? If so then which AES key space is the strongest?

These are many questions which remain unanswered or lack good discussion as there isn't much in regards to post quantum security concerns.

• Do you have a link to where you read that AES-256 is the weakest? – Ella Rose Jan 7 '17 at 23:13
• @EllaRose I think that is a reference to the related key attacks where AES-256 does worst. – SEJPM Jan 7 '17 at 23:27
• @SEJPM you are indeed correct. Ella here is a resource on that: crypto.stackexchange.com/questions/1549/… – Nick Jan 7 '17 at 23:36
• I'm not sure that "AES-256 is in fact the weakest" is an appropriate conclusion to draw from that, especially if the context/threat landscape in question is quantum computing. The requirements for that attack are arguably less realistic then the requirements for performing a quantum attack - what point is there to protecting the key if an attacker can encrypt/decrypt arbitrary blocks? They can decrypt your ciphertexts and make new ciphertexts, which is what the key was supposed to prevent them from doing. Since your threat model is QC, the largest key size is not the least secure. – Ella Rose Jan 8 '17 at 0:35
• AES256 is the strongest AES unless you horribly abuse AES. If you do that, you should fix the way you use AES instead of concluding AES256 is weaker that AES192 or AES128. – CodesInChaos Jan 8 '17 at 10:10

AES-256 is still considered the strongest (and is considered secure) as related key attacks are not particular to analysis with quantum computers.

Related key attacks could happen when AES is used within a construction such as a hash function, where the output of one round is used as a key for the next round.

As far as we know now, quantum computing won't have as much as an impact on most symmetric algorithms as it does on asymmetric cryptography (that usually relies on specific mathematical problems that can be solved using quantum computers).

If you require 256 bits security with quantum computers (why?) you could consider Threefish-512.

• Grover's algorithm is asymptotically optimal[1], the best possible quantum attack is O(sqrt(n)), IE the effective number of bits of the key gets halved. [1] Bennett C.H.; Bernstein E.; Brassard G.; Vazirani U. (1997). "The strengths and weaknesses of quantum computation". SIAM Journal on Computing. 26(5): 1510–1523. – SAI Peregrinus Jan 8 '17 at 2:08
• According to an article on this website it states that quantum computers would have an impact on symmetrical operations and in fact AES, weakening it. – Nick Jan 8 '17 at 2:53
• @Nick "weakening it" does not mean breaking it; The weakness is easily compensated for by doubling the key size. – Ella Rose Jan 8 '17 at 3:10
• I'm not going to up vote an answer just because it makes people feel comfortable with their security. I am looking to build a pragmatic discussion on what actually happens when quantum computers come out and what are the impacts exactly? Not many people seem to be talking about... Is it because we don't know? – Nick Jan 8 '17 at 3:35
• @Nick I am looking to build a pragmatic discussion on what actually happens when… This is a Q&A site, not a discussion platform. Fact is, quantum computers with cryptographic or cryptanalytic abilties simply don’t exist at this moment in time. Due to the lack of practical testing options (which may prove QC to be either effective, or not as effective as expected when it comes to crypto), such discussions are purely theoretical and – in the end – primarily opinion-based. Answers like Maarten’s can only reflect the current status-quo. – e-sushi Jan 8 '17 at 9:20