AES-128 is considered weak against quantum computers because Grover's algorithm effectively halves its key length to unacceptable 64 bits.

XTS-AES-128 as described in IEEE 1619-2007 doubles key length to 256 bits by using distinct 128-bit keys for block and tweak encryption, which is sometimes remarked as unnecessary change to the original XEX construction.


Grover's algorithm applied to XTS-AES-128 would attack the double-length 256 bit key, reducing it to 128 bits. Does it mean that the decision to use two keys for XTS-AES-128 made it reasonably resistant against quantum computers?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.