I've been reading lately some contradicting messages with regards to the quantum-safe resistance of AES128. First, there are blog posts by Ericsson people like these ones:
Can quantum attackers break AES-128?
No. NIST estimates that a quantum computer breaking RSA-2048 in a
matter of hours could be built by 2030 for about a billion dollars.
This means that NIST estimates early quantum computers to have a clock
rate of a few MHz. Such a quantum computer (a single 20 MHz quantum
core) running Grover’s algorithm would need 1011 years (a hundred
billion years) to break AES-128. Even a cluster of 109 quantum cores
(the world's largest public classical supercomputer has 107 cores)
with a clock rate of 2 THz would need 106 years (a million years) to
break AES-128.
Considering all this, Grover’s algorithm does not pose any apparent
threat to symmetric cryptography. Some years ago, there was a common
conception that Grover’s algorithm required symmetric key sizes to be
doubled – requiring use of AES-256 instead of AES-128. This is today
considered a misconception – NIST, for example, now states that
AES-128 will likely remain secure for decades to come, despite
Grover’s algorithm [5].
In fact, one of the security levels in the NIST PQC standardization is
equivalent to that of AES-128. This means that NIST thinks it is
relevant to standardize parameters for PQC that are as strong under
quantum attacks as AES-128. There could, of course, be other reasons
why a longer key is needed, such as compliance, and using a longer key
only has a marginal effect on performance.
In summary, our most important symmetric cryptographic tools (AES,
SNOW 3G, SHA2, SHA3 and so on) remain secure against quantum computers
as they are. This also applies to the authentication, key generation,
encryption and integrity in 3G, 4G and 5G that rely purely on
symmetric cryptography.
Sources: here and here
Also, some folks in Cloudfare mention:
This all is a long-winded way of saying that security level 1 seems
solid for the foreseeable future.
source here
And finally, NIST also mentions regarding the evaluation criteria for PQC:
NIST will base its classification on the range of security strengths
offered by the existing NIST standards in symmetric cryptography,
which NIST expects to offer significant resistance to quantum
cryptanalysis. In particular, NIST will define a separate category for each of the > following security requirements (listed in order of increasing strength2):
- Any attack that breaks the relevant security definition must require computational resources comparable to or greater than those required for key search on a block cipher with a 128-bit key (e.g. AES128)
It is worth noting that the security categories based on these reference primitives provide substantially more quantum security than a naïve analysis might suggest. For example, categories 1, 3 and 5 are defined in terms of block ciphers, which can be broken using Grover’s algorithm, with a quadratic quantum speedup. But Grover’s algorithm requires a long-running serial computation, which is difficult to implement in practice. In a realistic attack, one has to run many smaller instances of the algorithm in parallel, which makes the quantum speedup less dramatic.
source: here
So, where is the truth? I had this impression for many years that we will definitely need to double the key sizes in symmetric crypto to remain quantum safe. Is this really a misconception?
