# How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

What kind of quantum computer would be required, if it is possible to break such ciphers?

• I assume you're talking about 256-bit keys, not 128-bit or 80-bit? – forest May 13 at 2:34

There is no known quantum attack better than the generic Grover attack on Salsa20 and ChaCha, which is inconsequential because it would take $$2^{128}$$ sequential steps. Even if parallelized $$p$$ ways to run in marginally less time, a factor of $$\sqrt p$$ improvement, it would cost more, also by a factor of $$\sqrt p$$, than the cost to run a quantum computer for $$2^{128}$$ steps. Even if you were satisfied with breaking the first of $$t$$ targets for $$t \ll p$$, you would get only a $$\sqrt[4] t$$ cost reduction in the best known multi-target attack.