# Are sufficiently large key sizes enough to deter quantum attacks for symmetric key ciphers? [duplicate]

Are sufficiently large key sizes enough to deter quantum attacks for symmetric key ciphers such as AES?

• I did not find a direct duplicate; but this is related, and the top two answers cover it. – fgrieu Feb 28 '18 at 7:31
• @fgrieu But I did find a direct dupe. It's missing the generic statement for other symmetric ciphers, but I guess pointing to a generic construct such as Grover's algorithm does the trick. – Maarten Bodewes Feb 28 '18 at 10:57

Grover's algorithm searches among $n$ possibilities for a preimage under some fixed function in $O(\sqrt{n})$ sequential qubit operations—for example, it should take about $2^{96}$ qubit operations to find $k$ among the $2^{192}$ possibilities given $f(k)$ where $f\colon k \mapsto \operatorname{AES-192}_k(8432715)$—so the conventional wisdom is that you just need to double your key sizes to attain the same security level against a quantum adversary as you had against a classical adversary.