Are sufficiently large key sizes enough to deter quantum attacks for symmetric key ciphers such as AES?

  • 3
    $\begingroup$ I did not find a direct duplicate; but this is related, and the top two answers cover it. $\endgroup$ – fgrieu Feb 28 '18 at 7:31
  • $\begingroup$ @fgrieu But I did find a direct dupe. It's missing the generic statement for other symmetric ciphers, but I guess pointing to a generic construct such as Grover's algorithm does the trick. $\endgroup$ – Maarten Bodewes Feb 28 '18 at 10:57

Current understanding of quantum cryptanalysis suggests: Generally, yes.

Symmetric crypto tends not to have any mathematical structure that can be exploited by, e.g., Shor's algorithm, so, absent specific quantum cryptanalysis of a specific primitive (which would be a remarkable publication about the specific primitive), the adversary is limited to the generic Grover's algorithm.

Grover's algorithm searches among $n$ possibilities for a preimage under some fixed function in $O(\sqrt{n})$ sequential qubit operations—for example, it should take about $2^{96}$ qubit operations to find $k$ among the $2^{192}$ possibilities given $f(k)$ where $f\colon k \mapsto \operatorname{AES-192}_k(8432715)$—so the conventional wisdom is that you just need to double your key sizes to attain the same security level against a quantum adversary as you had against a classical adversary.

Even better, a recent estimate with more careful attention to realism of cost models suggests that owing to Grover's poor parallelism in contrast to classical brute force, it doesn't take much to thwart generic quantum attacks in more practical terms—if AES-128 is construed to provide 128-bit security against a classical adversary (which is debatable in the multi-target setting!), even AES-192 should provide 128-bit security against a quantum adversary, for example.


Not the answer you're looking for? Browse other questions tagged or ask your own question.