What kind of quantum computer would be required, if it is possible to break such ciphers?

  • $\begingroup$ I assume you're talking about 256-bit keys, not 128-bit or 80-bit? $\endgroup$
    – forest
    Commented May 13, 2019 at 2:34

1 Answer 1


There is no known quantum attack better than the generic Grover attack on Salsa20 and ChaCha, which is inconsequential because it would take $2^{128}$ sequential steps. Even if parallelized $p$ ways to run in marginally less time, a factor of $\sqrt p$ improvement, it would cost more, also by a factor of $\sqrt p$, than the cost to run a quantum computer for $2^{128}$ steps. Even if you were satisfied with breaking the first of $t$ targets for $t \ll p$, you would get only a $\sqrt[4] t$ cost reduction in the best known multi-target attack.

The same is true for AES key recovery, SHA-256 preimage search, etc. More on quantum attacks on various kinds of hash functions.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.