Analysis: Quantum computing does not pose a threat to 128-bit symmetric keys, and "post-quantum cryptography" has been misinterpreted with unnecessary panic.

Mars Finance reports that on April 21, cryptography engineer Filippo Valsorda wrote an article arguing that even with the most optimistic development pace, real-world quantum computers cannot crack 128-bit symmetric encryption in the foreseeable future, and that the current “post-quantum cryptography” has led to panic and misreadings. In “Quantum Computers Do Not Threaten 128-bit Symmetric Keys,” he states that quantum computers do not pose a real threat to 128-bit symmetric keys (such as AES-128), and the industry does not need to upgrade key lengths for this reason.

Filippo Valsorda points out that many people worry that quantum computers will “halve” the effective security strength of symmetric keys through the Grover algorithm, causing 128-bit keys to provide only 64 bits of security—this is wrong. The misunderstanding comes from ignoring the key limitations of Grover’s algorithm in real-world attacks. The main problem with Grover’s algorithm is that it cannot effectively parallelize. Its steps must be executed in sequence, and forcing it to run in parallel would sharply increase the total computational cost. Even using an idealized quantum computer, the total computation required to crack an AES-128 key is astronomically large—about 2¹⁰⁴·⁵ operations—far higher than the cost of breaking today’s asymmetric encryption algorithms by billions of times, and completely unrealistic.

At present, U.S. NIST, Germany’s BSI, and other standard-setting bodies as well as quantum cryptography experts have all stated clearly that algorithms such as AES-128 are sufficient to withstand known quantum attacks, and they are used as the benchmark for post-quantum security. In an official Q&A, NIST directly recommends that “AES key lengths should not be doubled to address quantum threats.”

Ultimately, Filippo Valsorda suggests that the only urgent task in the current shift to post-quantum is to replace asymmetric encryption that is vulnerable (such as RSA and ECDSA). Using limited resources to upgrade symmetric keys (e.g., from 128 bits to 256 bits) is unnecessary—it would distract efforts, increase system complexity, and raise coordination costs—so we should focus all our attention on the parts that truly need to be replaced.