Contrary to popular superstition, AES 128 is just fine in a post-quantum world
Cryptography experts have debunked the widespread misconception that quantum computers will render AES-128 encryption obsolete, clarifying that Grover's algorithm cannot effectively parallelize attacks against 128-bit symmetric keys the way classical computers can. The actual security cost of quantum attacks on AES-128 remains around 2^104 operations—well beyond practical threat levels—meaning organizations do not need to prematurely migrate to AES-256, allowing IT teams to focus resources on actual post-quantum cryptography transitions where they are genuinely necessary. This consensus, backed by NIST, German security agencies, and leading cryptographers, provides strategic clarity for enterprise encryption strategies and helps prevent costly and unnecessary security infrastructure overhauls.
With growing focus on the existential threat quantum computing poses to some of the most crucial and widely used forms of encryption, cryptography engineer Filippo Valsorda wants to make one thing absolutely clear: Contrary to popular mythology that refuses to die, AES 128 is perfectly fine in a post-quantum world. AES 128 is the most widely used variety of the Advanced Encryption Standard, a block cipher suite formally adopted by NIST in 2001. While the specification allows 192- and 256-bit key sizes, AES 128 was widely considered to be the preferred one because it meets the sweet spot between computational resources required to use it and the security it offers. With no known vulnerabilities in its 30-year history, a brute-force attack is the only known way to break it. With 2128 or 3.4 x 1038 possible key combinations, such an attack would take about 9 billion years using the entire Bitcoin mining resources as of 2026. It boils down to parallelization Over the past decade, something interesting happened to all that public confidence. Amateur cryptographers and mathematicians twisted a series of equations known as Grover’s algorithm to declare the death of AES 128 once a cryptographically relevant quantum computer (CRQC) came into being. They said a CRQC would halve the effective strength to just 264, a small enough supply that—if true—would allow the same Bitcoin mining resources to brute force it in less than a second (the comparison is purely for illustration purposes; a CRQC almost certainly couldn’t run clusters of Bitcoin ASICs and more importantly couldn’t parallelize the workload as the amateurs assume).Read full article Comments
