Does quantum computing break AES encryption?
No. Grover's algorithm (1996) halves the effective key length in theory — AES-128 to about 64 bits, AES-256 to about 128 bits — but its search iterations must run one after another, which makes the attack impractical on any foreseeable machine. AES-256 sits inside the NSA's own post-quantum algorithm suite, and the migration NIST kicked off in August 2024 targets RSA and elliptic-curve cryptography, not AES.
Yes, a quadratic speedup exists — established 1996 Grover's algorithm finds a marked item among N with about (pi/4)*sqrt(N) queries, and it is provably optimal for unstructured search — no generic quantum attack can do better. Applied to AES it halves the effective key bits on paper. Crucially the iterations are sequential: each one slightly rotates the state toward the answer, and you cannot skip ahead.
Costed on paper: thousands of logical qubits and astronomically deep serial circuits The standard resource estimate implements the full AES circuit inside Grover's oracle. The qubit counts are modest by attack standards; the killer is depth. The gates are overwhelmingly sequential, so even a perfect machine at optimistic clock speeds would run for geological timescales on AES-128 and beyond-cosmological ones on AES-256.
Grover itself runs on real hardware — at 3-qubit scale The algorithm is real and works as the theory predicts — on databases of eight entries. An AES-128 key search is a search over 2^128 entries with a full cipher evaluation inside every query. Demonstrating the mechanism at toy scale and executing a cryptographic attack are separated by roughly 37 orders of magnitude in search-space size.
No — no quantum attack on any AES key size is remotely practical, and NIST's transition plan leaves AES alone NIST's post-quantum transition guidance deprecates quantum-vulnerable public-key algorithms after 2030 and disallows them after 2035 — AES is not on that list. The practical consensus is that Grover's serial depth requirement, the cost of fault-tolerant AES oracles, and the poor parallelisation together keep even AES-128 out of realistic danger, though new designs are steered toward AES-256 for margin.
Yes — AES-256 is explicitly part of the NSA's quantum-resistant suite When the NSA designed its post-quantum algorithm suite, it replaced RSA and elliptic-curve algorithms but kept AES-256, judging its ~128-bit post-Grover security margin sufficient against any quantum adversary. The organisations most paranoid about quantum attacks still trust AES; they only doubled down on key length. (Archived copy: https://web.archive.org/web/2025/https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF — the primary PDF is bot-gated.)
How does Grover's algorithm actually attack a cipher?
Not by "trying all keys at once". A quantum state can hold amplitude across all 2^128 candidate keys, but measuring it would return one random key — useless. Grover's algorithm works by interference: an oracle circuit (here, a full AES implementation checking a known plaintext-ciphertext pair) flips the phase of the correct key's amplitude, and a diffusion step reflects all amplitudes about their mean, converting that hidden phase mark into slightly more probability on the right answer.
Each oracle-plus-diffusion round rotates the state a tiny, fixed angle toward the solution. You need about (pi/4)*sqrt(N) rounds — roughly 2^64 of them for AES-128 — and they must run in sequence, because each rotation builds on the last. That serial structure, proven optimal for unstructured search, is the detail every scary headline omits.
Why doesn't a quadratic speedup break AES in practice?
Do the arithmetic. AES-128 needs about 2^64 Grover iterations, each containing a full fault-tolerant AES evaluation. Grant an absurdly optimistic 1 microsecond per iteration: 2^64 microseconds is about 585,000 years, on a perfect error-corrected machine that does not exist. AES-256 needs 2^128 iterations — not a number with a timescale.
Parallelism does not rescue the attack: splitting Grover across k machines speeds it up by only sqrt(k), so a million perfect quantum computers cut 585,000 years to about 585. Compare the classical world, where brute force parallelises perfectly and still cannot touch AES-128. Meanwhile the resource estimates put the oracle at thousands of logical qubits — machines that, as covered in the RSA assessment, remain roadmap items.
What would change this answer: not better hardware — the serial-depth wall is algorithmic — but a cryptanalytic breakthrough exploiting AES's internal structure, quantum or classical. Grover is provably the best generic attack, so any real break would have to be a break of AES itself, which four decades of analysis have not produced.
So which encryption actually is at risk from quantum computers?
The asymmetric layer. When a headline says quantum computers will "break encryption", the honest version is: Shor's algorithm breaks RSA and elliptic-curve cryptography — the algorithms that exchange keys and sign things. In a TLS connection, AES encrypts your data, but an RSA or ECDH handshake delivered the AES key. Break the handshake and the AES layer falls with it, without ever attacking AES.
That is why NIST's August 2024 standards replace key exchange (FIPS 203) and signatures (FIPS 204, 205) while both NIST and the NSA keep AES — the NSA's CNSA 2.0 suite simply mandates AES-256 for long-term margin. Sensible guidance for developers: prefer AES-256 in new designs, and spend your actual migration effort where the risk is — see RSA-2048 and Bitcoin.
Classifications follow the QPU137 editorial policy: every applied label carries a date, source, scale, and hardware, or it does not render. Found an error? Report it.