Is AES Safe from Quantum Computers? Grover’s Algorithm Explained

Public-key encryption, such as RSA and ECC, lets strangers set up a shared secret over the internet. Symmetric encryption, such as AES, then uses that shared secret to scramble the actual data quickly. Disk encryption, VPN traffic and the bulk of every secure website connection use symmetric encryption.

Shor’s algorithm breaks public-key encryption. Symmetric encryption faces a different, much weaker quantum attack.

In 1996, Lov Grover found a quantum method for searching through possibilities faster. To guess a key by brute force, an ordinary computer must try, on average, half of all possible keys. Grover’s algorithm needs roughly the square root of that number of steps.

For a 128-bit AES key, that turns about 2¹²⁸ attempts into roughly 2⁶⁴ quantum steps. That sounds dramatic, but those steps must run one after another on an error-corrected quantum computer, and the work can’t be split across many machines nearly as effectively as ordinary brute force.

NIST’s draft transition plan keeps AES-128, AES-192 and AES-256 approved. The NSA’s CNSA 2.0 suite for national security systems requires AES-256 for an extra safety margin. Hash functions such as SHA-256 and SHA-3 are likewise considered safe, with larger output sizes preferred for the highest security.

• ◆Keep using AES; there is no need to replace it.
• ◆Prefer AES-256 for data that must stay secret for decades, or to meet CNSA 2.0.
• ◆Focus your quantum migration effort on public-key cryptography: key exchange and digital signatures.