2
$\begingroup$

AES-128 is considered weak against quantum computers because Grover's algorithm effectively halves its key length to unacceptable 64 bits.

XTS-AES-128 as described in IEEE 1619-2007 doubles key length to 256 bits by using distinct 128-bit keys for block and tweak encryption, which is sometimes remarked as unnecessary change to the original XEX construction.

https://csrc.nist.gov/csrc/media/projects/block-cipher-techniques/documents/bcm/comments/xts/xts_comments-liskov_minematsu.pdf

Grover's algorithm applied to XTS-AES-128 would attack the double-length 256 bit key, reducing it to 128 bits. Does it mean that the decision to use two keys for XTS-AES-128 made it reasonably resistant against quantum computers?

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.