How resistant are stream ciphers like Salsa20 or ChaCha in a post-quantum world?

Question

What kind of quantum computer would be required, if it is possible to break such ciphers?

Answer 1

There is no known quantum attack better than the generic Grover attack on Salsa20 and ChaCha, which is inconsequential because it would take $2^{128}$ sequential steps. Even if parallelized $p$ ways to run in marginally less time, a factor of $\sqrt p$ improvement, it would cost more, also by a factor of $\sqrt p$, than the cost to run a quantum computer for $2^{128}$ steps. Even if you were satisfied with breaking the first of $t$ targets for $t \ll p$, you would get only a $\sqrt[4] t$ cost reduction in the best known multi-target attack.

The same is true for AES key recovery, SHA-256 preimage search, etc. More on quantum attacks on various kinds of hash functions.