Post #1773231

The article does seem to agree that it can be done in 2⁶⁴ time, but it also does some calculations to show that it’s a very long time. And you cannot gain the same speedup from parallelization as in classical algorithms. I do have one concern with the article which is the assumption that quantum gates won’t get faster than 1 microsecond. Quantum gates of that speed may be far away, but what I would regard as a conservative estimate would be for quantum gates to get about as fast as classical gates. There is still a lot of uncertainty about what quantum computing hardware will be feasible. If we want a security margin we have to protect against more powerful quantum computers than we think will happen. AES-128 will probably never be broken by a quantum computer, but I wouldn’t bet my life on it.