Does quantum computing break AES encryption?
No. A quantum computer cannot break AES, and no machine anyone has planned could either. In theory, Grover's algorithm (1996) cuts a key's strength in half, so AES-128 acts like a 64-bit key and AES-256 like a 128-bit key. But the attack's steps must run one after another, so even at a hopeful one step per microsecond, AES-128 would take about 585,000 years. That is why the NSA still trusts AES-256, and why the upgrade NIST started in August 2024 replaces RSA and elliptic-curve code, not AES.
Yes — a quadratic (square-root) speedup exists, known since 1996 Grover's algorithm finds one marked item among N items in about (pi/4)*sqrt(N) checks. It is proven to be the best possible way to search a list with no structure to exploit, so no general quantum attack can do better. Used on AES, it halves the key's effective length on paper. The key detail: the steps run one after another. Each step turns the state a little closer to the answer, and you cannot skip ahead.
Costed on paper: thousands of logical qubits and extremely long chains of steps that must run in order The standard cost estimate builds the whole AES cipher inside Grover's oracle (the part that checks a guess). The qubit counts are modest for an attack. The real problem is depth: how many steps must run in a row. Almost all the gates run in sequence. So even a perfect machine at hopeful clock speeds would run for geological timescales on AES-128, and for longer than the age of the universe on AES-256.
Grover itself runs on real hardware — at 3-qubit scale The algorithm is real, and it works the way the theory predicts — on lists of eight items. An AES-128 key search is a search over 2^128 items, with a full cipher check inside every step. Showing the idea at toy size and running a real attack are about 37 orders of magnitude apart in search size (2^128 ÷ 8 is about 4 × 10^37).
No — no quantum attack on any AES key size is remotely practical, and NIST's transition plan leaves AES alone NIST's guidance for moving to post-quantum cryptography phases out the public-key algorithms that quantum computers could break. They are deprecated after 2030 and disallowed after 2035. AES is not on that list. Experts broadly agree on three reasons: Grover's steps must run in sequence, an error-corrected AES oracle is very costly, and the attack splits poorly across machines. Together these keep even AES-128 out of realistic danger. New designs are still steered toward AES-256 for extra safety margin.
Yes — AES-256 is explicitly part of the NSA's quantum-resistant suite When the NSA designed its post-quantum algorithm suite, it replaced RSA and elliptic-curve algorithms but kept AES-256. It judged that AES-256's roughly 128-bit strength after Grover is enough against any quantum attacker. The groups most worried about quantum attacks still trust AES. They only chose longer keys. (Archived copy: https://web.archive.org/web/2025/https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF — the primary PDF blocks automated downloads.)
How does Grover's algorithm actually attack a cipher?
First, a few words. Encryption scrambles a message so only someone with the right key can read it. A key is a secret number. AES is a cipher, a scrambling recipe. It protects most of the data on your phone and on the web. An AES-128 key is 128 bits long. A bit is a single 0 or 1.
Picture a combination lock with 128 switches. Each switch is up or down. Every extra switch doubles the number of combinations. So 128 switches give 2^128 combinations. That is about 340 followed by 36 zeros. A thief who tries one combination at a time will never finish.
A quantum computer does not "try all keys at once". Its qubits (quantum bits) hold a spread of numbers called amplitudes, one for each possible key. An amplitude says how strongly the machine leans toward that answer. If you measured right away, you would get one random key. That is useless.
Grover's algorithm uses interference instead. Interference is how waves add up or cancel out, like ripples in a pool. Each round has two steps. First, an oracle flips the sign of the right key's amplitude. Here the oracle is a full AES circuit. It checks each key against a known message and its scrambled version. Second, a diffusion step flips every amplitude around the average. Together, the two steps move a little more probability onto the right key.
Each round turns the state by a tiny, fixed angle toward the answer. For N keys you need about (π/4) × √N rounds. For AES-128 that is roughly 2^64 rounds. They must run one after another, because each turn builds on the last. You cannot skip ahead. Math proves that no general quantum search does better. Unlike a thief at a lock, the machine never checks keys one by one. It nudges all the amplitudes together, a little each round. Scary headlines leave out the one-after-another part.
Why doesn't a quadratic speedup break AES in practice?
A quadratic speedup means the work shrinks to its square root. If a normal search takes 100 tries, a quadratic speedup needs about 10. That sounds huge. So let's do the arithmetic for AES-128.
AES-128 needs about 2^64 Grover rounds. Each round holds a full, error-corrected AES check. Be very generous and say one round takes 1 microsecond, a millionth of a second.
- Step 1: 2^64 is about 18 billion billion (1.8 × 10^19).
- Step 2: that many microseconds is about 1.8 × 10^13 seconds.
- Step 3: a year has about 31.6 million seconds (3.16 × 10^7).
- Step 4: 1.8 × 10^13 ÷ 3.16 × 10^7 ≈ 585,000.
That is about 585,000 years, on a perfect error-corrected machine that does not exist. AES-256 needs 2^128 rounds. No timescale even fits that number.
Can you split the work across many machines? Not well. With k quantum computers, Grover only gets √k times faster. A million perfect machines give √1,000,000 = 1,000 times the speed. That cuts 585,000 years to about 585. Ordinary computers split work far better, and they still cannot brute-force AES-128. Meanwhile, the cost estimates say the AES check alone needs thousands of logical qubits. A logical qubit is one reliable qubit built from many error-prone ones. As the RSA page explains, machines like that are still only on roadmaps.
What would change this answer? Not better hardware. The one-after-another wall comes from the math of the algorithm. Grover is proven to be the best general search. So a real break would need a flaw inside AES itself, found by a quantum or an ordinary computer. More than 25 years of study have not found one.
So which encryption actually is at risk from quantum computers?
The risk is in a different layer, called public-key cryptography. These are the tools that let two strangers agree on a secret key and sign messages. RSA and elliptic-curve cryptography are the common ones. On a large enough quantum computer, Shor's algorithm could break both.
Here is how the layers fit together. When your browser opens a secure (TLS) connection, AES scrambles your data. But first, an RSA or ECDH handshake delivers the AES key. Think of a locked box (AES) and a courier who hands over its key (the handshake). Fool the courier and you get the key. You never have to pick the lock. The example has a limit: the courier is math, not a person. Shor's algorithm works out the secret from public numbers.
That is why NIST's August 2024 standards replace key exchange (FIPS 203) and signatures (FIPS 204 and 205). Both NIST and the NSA keep AES. The NSA's CNSA 2.0 suite simply requires AES-256 for extra margin. Good advice for developers: use AES-256 in new designs. Then spend your real upgrade effort where the risk is. See RSA-2048 and Bitcoin.
Classifications follow the QPU137 editorial policy: every applied label carries a date, source, scale, and hardware, or it does not render. Found an error? Report it.