What kind of quantum computer would be required, if it is possible to break such ciphers?
$\begingroup$
$\endgroup$
-
$\begingroup$ I assume you're talking about 256-bit keys, not 128-bit or 80-bit? $\endgroup$ – forest May 13 '19 at 2:34
$\begingroup$
$\endgroup$
There is no known quantum attack better than the generic Grover attack on Salsa20 and ChaCha, which is inconsequential because it would take $2^{128}$ sequential steps. Even if parallelized $p$ ways to run in marginally less time, a factor of $\sqrt p$ improvement, it would cost more, also by a factor of $\sqrt p$, than the cost to run a quantum computer for $2^{128}$ steps. Even if you were satisfied with breaking the first of $t$ targets for $t \ll p$, you would get only a $\sqrt[4] t$ cost reduction in the best known multi-target attack.
The same is true for AES key recovery, SHA-256 preimage search, etc. More on quantum attacks on various kinds of hash functions.
answered May 12 '19 at 15:36
