# Are sufficiently large key sizes enough to deter quantum attacks for symmetric key ciphers? [duplicate]

Are sufficiently large key sizes enough to deter quantum attacks for symmetric key ciphers such as AES?

## marked as duplicate by Maarten Bodewes♦, e-sushiMar 1 '18 at 13:56

Grover's algorithm searches among $n$ possibilities for a preimage under some fixed function in $O(\sqrt{n})$ sequential qubit operations—for example, it should take about $2^{96}$ qubit operations to find $k$ among the $2^{192}$ possibilities given $f(k)$ where $f\colon k \mapsto \operatorname{AES-192}_k(8432715)$—so the conventional wisdom is that you just need to double your key sizes to attain the same security level against a quantum adversary as you had against a classical adversary.