What kind of quantum computer would be required, if it is possible to break such ciphers?

  • $\begingroup$ I assume you're talking about 256-bit keys, not 128-bit or 80-bit? $\endgroup$ – forest May 13 '19 at 2:34

There is no known quantum attack better than the generic Grover attack on Salsa20 and ChaCha, which is inconsequential because it would take $2^{128}$ sequential steps. Even if parallelized $p$ ways to run in marginally less time, a factor of $\sqrt p$ improvement, it would cost more, also by a factor of $\sqrt p$, than the cost to run a quantum computer for $2^{128}$ steps. Even if you were satisfied with breaking the first of $t$ targets for $t \ll p$, you would get only a $\sqrt[4] t$ cost reduction in the best known multi-target attack.

The same is true for AES key recovery, SHA-256 preimage search, etc. More on quantum attacks on various kinds of hash functions.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.