AES-128 is considered weak against quantum computers because Grover's algorithm effectively halves its key length to unacceptable 64 bits.

XTS-AES-128 as described in IEEE 1619-2007 doubles key length to 256 bits by using distinct 128-bit keys for block and tweak encryption, which is sometimes remarked as unnecessary change to the original XEX construction.


Grover's algorithm applied to XTS-AES-128 would attack the double-length 256 bit key, reducing it to 128 bits. Does it mean that the decision to use two keys for XTS-AES-128 made it reasonably resistant against quantum computers?


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.