🔐 Symmetric Crypto

Symmetric Cryptography Quantum Safety

The most misunderstood topic in quantum migration: AES-256 does NOT need to be replaced. AES-128 does. Here is the complete picture.

💡 Key insight: Grover's algorithm gives quantum computers a quadratic speedup against symmetric cryptography — it halves the effective bit security. AES-256 (256 → 128 effective bits) remains safe. AES-128 (128 → 64 effective bits) is marginal for long-term use. No symmetric algorithm is broken by quantum in the way RSA is — they are weakened.

AES-256

✅ Safe. 128-bit quantum security. No migration needed.

AES-128

⚠️ Weakened. 64-bit quantum security. Upgrade for 10+ year data.

SHA-256 / SHA-3

✅ Safe. 128-bit quantum security. No migration needed.

3DES / DES

🚨 Deprecated. Broken classically — migrate immediately.

ChaCha20-Poly1305

✅ Safe. 256-bit key = 128-bit quantum security.

SHA-1 / MD5

🚨 Deprecated. Broken classically — migrate immediately.

How Grover's Algorithm Affects Symmetric Cryptography

Grover's algorithm is a quantum search algorithm that searches an unsorted database of N items in O(√N) time rather than O(N) classically. Applied to symmetric cryptography, it provides a quadratic speedup for brute-force key search.

For a key of size n bits, Grover's algorithm searches all 2ⁿ possible keys in approximately 2^(n/2) quantum operations. This halves the effective bit security — a 256-bit key has 128-bit quantum security, a 128-bit key has 64-bit quantum security.

Why this is not as bad as it sounds

AES-256 is still safe 128-bit quantum security is the current minimum recommendation for long-term data. AES-256 meets this threshold. The only concern is future algorithmic improvements, which currently do not exist for AES.

Symmetric key doubling is the only required fix If you want equivalent quantum security, double your key size: AES-128 → AES-256. This is a simple configuration change, not an algorithm replacement.

AES-256 is already widely deployed Most systems that follow modern standards are already using AES-256. The migration from AES-128 is often already done for other reasons (compliance, best practice).

Grover requires a fault-tolerant quantum computer Unlike Shor's algorithm which can exploit a smaller quantum computer, an effective Grover implementation against AES-256 would require ~6,600 logical qubits — roughly the same scale needed for RSA attacks.

Grover does not break AES — it weakens it Shor's algorithm makes RSA completely worthless. Grover's algorithm makes AES-128 roughly equivalent to the old 64-bit DES in terms of quantum security. Significant weakening, but not a sudden collapse.

Complete Symmetric Algorithm Quantum Safety Table

Algorithm	Key/Output Size	Classical Security	Quantum Security	Status	Action Required
AES-256	256-bit key	256 bits	128 bits	SAFE	None. Preferred for all new implementations.
AES-192	192-bit key	192 bits	96 bits	SAFE	Acceptable. Migrate to AES-256 for highest security requirements.
AES-128	128-bit key	128 bits	64 bits	WEAKENED	Upgrade to AES-256 for data with 10+ year secrecy requirement. Acceptable for short-lived session data.
ChaCha20-Poly1305	256-bit key	256 bits	128 bits	SAFE	None. Strong quantum resistance. Preferred for mobile/embedded contexts.
Salsa20	256-bit key	256 bits	128 bits	SAFE	None.
3DES (Triple DES)	112-bit effective key	112 bits	56 bits	DEPRECATED	Migrate immediately. Broken classically (Sweet32, BEAST). Not a quantum problem — a classical one.
DES	56-bit key	56 bits	28 bits	DEPRECATED	Migrate immediately. Should not exist in any modern system.
RC4	40–2048-bit key	Effectively broken	N/A	DEPRECATED	Migrate immediately. Multiple practical attacks exist classically.
SHA-256	256-bit output	128-bit collision resistance	~128-bit preimage (acceptable)	SAFE	None. Standard for most applications.
SHA-384	384-bit output	192-bit collision resistance	~192-bit preimage	SAFE	Preferred for sensitive long-term applications.
SHA-512	512-bit output	256-bit collision resistance	~256-bit preimage	SAFE	Highest quantum security for hash functions.
SHA-512/256	256-bit output	128-bit collision resistance	~128-bit preimage	SAFE	Good balance — truncated SHA-512 is faster on 64-bit systems than SHA-256.
SHA-3-256	256-bit output	128-bit collision resistance	~128-bit preimage	SAFE	Different construction from SHA-2 — useful as diversity backup.
SHA-3-512	512-bit output	256-bit collision resistance	~256-bit preimage	SAFE	Highest security. Different algorithm family from SHA-2.
SHA-1	160-bit output	Effectively broken	N/A	DEPRECATED	Migrate immediately. SHAttered collision attack (2017). Classic vulnerability — not quantum.
MD5	128-bit output	Effectively broken	N/A	DEPRECATED	Migrate immediately. Collision attack demonstrated 1996.
MD4	128-bit output	Broken	N/A	DEPRECATED	Migrate immediately. Should not exist in any modern system.
BLAKE2b	256/512-bit output	~128–256 bits	~128–256 bits (halved)	SAFE	Good performance with strong security. No migration needed.
BLAKE3	256-bit output	~128 bits	~128 bits	SAFE	Fastest modern hash. Quantum safe at 256-bit output.
HMAC-SHA256	Depends on key	256 bits	128 bits	SAFE	None. Used for message authentication — quantum safe.
HMAC-SHA512	Depends on key	512 bits	256 bits	SAFE	None. Highest security for MACs.
Poly1305 (MAC)	128-bit tag	~128 bits	~64 bits	ACCEPTABLE	Short-lived MACs (TLS records) — acceptable. For long-term authentication codes, prefer HMAC-SHA256.
Argon2id (password)	Variable (cost-based)	Cost function dominates	Cost function dominates	SAFE	Memory-hard functions resist quantum parallelism. No migration needed.
bcrypt (password)	Cost-factor based	Cost function dominates	Cost function dominates	SAFE	None. Memory-hard — resistant to quantum parallelism.
scrypt (password)	Cost-factor based	Cost function dominates	Cost function dominates	SAFE	None.

AES Encryption Modes — Quantum Considerations

The mode of operation matters beyond just key size. Some modes have additional quantum vulnerabilities due to nonce reuse or authentication tag weaknesses.

Mode	Authentication	Nonce Safety	Quantum Status	Recommendation
AES-256-GCM	AEAD — authenticated	Nonce reuse breaks confidentiality AND authenticity	Safe with AES-256 key. Nonce reuse is a critical classical vulnerability — use random 96-bit nonces.	Preferred for most applications. Use AES-256, not AES-128-GCM.
AES-256-GCM-SIV	AEAD — nonce-misuse resistant	Nonce reuse safe (confidentiality preserved)	Safer than standard GCM in high-volume systems where nonce uniqueness is hard to guarantee.	Preferred when nonce uniqueness cannot be guaranteed (e.g., distributed systems).
AES-256-CCM	AEAD — authenticated	Nonce must be unique	Safe with AES-256. Used in constrained environments (IoT, 802.11i).	Acceptable for constrained environments. Prefer GCM in general.
AES-256-CBC	No authentication	IV reuse leaks plaintext	Safe with AES-256 but no authentication. Must pair with HMAC.	Use only with HMAC-SHA256. Prefer AEAD modes (GCM) for simplicity.
AES-256-CTR	No authentication	Nonce reuse breaks confidentiality	Safe for confidentiality. No authentication.	Pair with HMAC. Prefer GCM for AEAD.
AES-128-GCM	AEAD	Nonce reuse critical	Weakened. 64-bit quantum security on key.	Upgrade to AES-256-GCM for long-term data.
AES-256-ECB	None	N/A — deterministic	Safe key size but ECB leaks patterns in data.	Never use ECB. Deterministic encryption reveals patterns across blocks.
ChaCha20-Poly1305	AEAD	Nonce reuse breaks both	Safe. 256-bit key, 128-bit quantum security.	Preferred for mobile, embedded, and non-AES-NI environments.

What Actually Needs Action

🚨 Migrate Immediately (Classical vulnerabilities — not waiting for quantum)

→ SHA-1 — SHAttered collision attack (2017). Remove from TLS, code signing, DNSSEC, anything.

→ MD5 — Broken since 1996. Should not exist anywhere.

→ 3DES — Sweet32 birthday attack. Deprecated in TLS 1.3. Remove from all TLS, SSH, and VPN configs.

→ DES — Broken for decades. If it exists in your environment, it is a serious finding regardless of quantum.

→ RC4 — Multiple practical attacks. Disabled by default in all modern browsers and servers.

⚠️ Upgrade for Long-Term Data (AES-128 → AES-256)

→ Any AES-128 protecting data that must remain secret for 10+ years — upgrade to AES-256.

→ This includes database encryption, backup encryption, long-term archive encryption.

→ For short-lived session data (TLS session, ephemeral chat), AES-128 is still acceptable.

→ Most cloud providers default to AES-256 — check your legacy and on-premises systems.

✅ No Action Required (Quantum-safe at current key sizes)

→ AES-256 in any modern mode (GCM, CCM, GCM-SIV) — safe against quantum computing.

→ ChaCha20-Poly1305 — 256-bit key, 128-bit quantum security, safe.

→ SHA-256, SHA-384, SHA-512, SHA-3 — all safe with adequate quantum security.

→ HMAC-SHA256 and above — safe for all current uses.

→ Argon2, bcrypt, scrypt — memory-hard functions resist quantum parallelism.

→ BLAKE2, BLAKE3 — safe at 256-bit and above output sizes.