As far as I know, if you just use symmetric AES 256 it shouldn't be a problem for a while. The potential (I repeat that, see Aaronson's post I linked to earlier

As far as I know, if you just use symmetric AES 256 it shouldn't be a problem for a while. The potential (I repeat that, see Aaronson's post I linked to earlier) problem is "just" the use of the public keys. And combining the lower-bit algorithms into the bigger ones is relatively easy, as an example from the 56-bit DES a 3DES with security of around 112 bits was made and (is still) used: https://en.wikipedia.org/wiki/Triple_DES https://en.wikipedia.org/wiki/Triple_DES edit: re: the early collisions with 64-bits etc: If I understand, the problem happens only when the soon-enough rekeying doesn't: https://sweet32.info/ https://sweet32.info/ I agree it's better to avoid these altogether.