Contrary to popular superstition, AES 128 is just fine in a post-quantum world

As concerns about the potential dangers posed by quantum computing to essential encryption methods rise, cryptography expert Filippo Valsorda aims to clarify a persistent misconception: AES 128 remains robust in a world increasingly influenced by quantum technology. AES 128, the most prevalent version of the Advanced Encryption Standard, has been in use since its formal adoption by NIST in 2001. Although the standard includes options for 192- and 256-bit key sizes, AES 128 is favored for its balance between computational efficiency and security. Its impressive track record spans over three decades, with no known vulnerabilities detected, and the only feasible method for breaching it is through brute-force attacks. With an astronomical number of potential key combinations—approximately 3.4 x 10^38—attempting such an attack would require about 9 billion years, even utilizing all Bitcoin mining resources projected for 2026. However, over the last ten years, public faith in AES 128 has waned. Some amateur cryptographers and mathematicians have manipulated equations linked to Grover’s algorithm, declaring that once a cryptographically relevant quantum computer (CRQC) is developed, the effective strength of AES 128 would be reduced to 264 bits. This claim suggests that, should the assertions hold true, the same Bitcoin mining power could crack AES 128 in under a second. It’s essential to note that this comparison is largely theoretical; a CRQC is unlikely to operate clusters of Bitcoin ASICs effectively or handle the workload in the manner these assumptions imply. In response to the misunderstandings surrounding AES 128, Valsorda recently published a blog post entitled "Quantum Computers Are Not a Threat to 128-bit Symmetric Keys," where he expresses his frustration over the misconceptions that have arisen in the public discourse.