Post #1773230

2026-04-20 20:39 UTC

@dangoodin @filippo Some people think that quantum computers can decrypt messages encrypted with AES-128. They think this because there is a thing called Grover's Algorithm that appears to make searching for 128-bit things doable in 64-bit time. However, that's not the case for AES-128 messages, and Filippo explains why.

Replies (1)

@kasperd@westergaard.social 2026-04-21 11:49

The article does seem to agree that it can be done in 2⁶⁴ time, but it also does some calculations to show that it’s a very long time. And you cannot gain the same speedup from parallelization as in classical algorithms. I do have one concern with the article which is the assumption that quantum gates won’t get faster than 1 microsecond. Quantum gates of that speed may be far away, but what I would regard as a conservative estimate would be for quantum gates to get about as fast as classical gates. There is still a lot of uncertainty about what quantum computing hardware will be feasible. If we want a security margin we have to protect against more powerful quantum computers than we think will happen. AES-128 will probably never be broken by a quantum computer, but I wouldn’t bet my life on it.

Open ##1773231