# NIST security categories (post quantum)

Here (https://www.safecrypto.eu/pqclounge/round-2-candidates/) are collected all the proposals which passed the first round of NIST Post-Quantum Cryptography Standardisation process. What does the abbreviations in "NIST security categories" column mean? Where can I find a formal definition of them?

• Did you execute a little search? see here at page 16. Mar 4 '19 at 21:31

A copy and paste from page 16 of NIST document Submission Requirements and Evaluation Criteria for the Post-Quantum Cryptography Standardization Process;

1. Any attack that breaks the relevant security definition must require computational resources comparable to or greater than those required for key search on a block cipher with a 128-bit key (e.g. AES128)
2. Any attack that breaks the relevant security definition must require computational resources comparable to or greater than those required for collision search on a 256-bit hash function (e.g. SHA256/ SHA3-256)
3. Any attack that breaks the relevant security definition must require computational resources comparable to or greater than those required for key search on a block cipher with a 192-bit key (e.g. AES192)
4. Any attack that breaks the relevant security definition must require computational resources comparable to or greater than those required for collision search on a 384-bit hash function (e.g. SHA384/ SHA3-384)
5. Any attack that breaks the relevant security definition must require computational resources comparable to or greater than those required for key search on a block cipher with a 256-bit key (e.g. AES 256)
• Unfortunately, the computational resources required to break any of the five listed problems in the Quantum realm isn't nearly as easy to define as it is in the classical realm... Mar 5 '19 at 20:08
• @poncho The document goes into more detail about that, giving information on the quantum gate depth and how e.g. Grover's algorithm will likely be implemented as a number of parallel processes each with a short lifetime in order to deal with quantum decoherence. Of course, that also means that a significant performance hit to Grover's algorithm since it is not easy to parallelize efficiently. Mar 6 '19 at 6:31
• @forest: which is largely my point. On a classical computing, breaking AES-128 with probability 0.5 will take $2^{127}$ AES evaluations, end of story. On a quantum computer, the effort to break AES-128 with probability 0.5 will depend, among other things, the value of MAXDEPTH you assume (the NIST doc does not mandate a specific value), and the circuit depth of a quantum AES circuit (and the Grassl et al value is probably not the best you can do) Mar 6 '19 at 13:09