# NIST security categories (post quantum)

Here (https://www.safecrypto.eu/pqclounge/round-2-candidates/) are collected all the proposals which passed the first round of NIST Post-Quantum Cryptography Standardisation process. What does the abbreviations in "NIST security categories" column mean? Where can I find a formal definition of them?

• Did you execute a little search? see here at page 16. Mar 4 '19 at 21:31

• @forest: which is largely my point. On a classical computing, breaking AES-128 with probability 0.5 will take $2^{127}$ AES evaluations, end of story. On a quantum computer, the effort to break AES-128 with probability 0.5 will depend, among other things, the value of MAXDEPTH you assume (the NIST doc does not mandate a specific value), and the circuit depth of a quantum AES circuit (and the Grassl et al value is probably not the best you can do) Mar 6 '19 at 13:09