2 ms·

Not quite correct. Grover's Algorithm is provably asymptotically optimal for quantum attacks. That is, you'll never do better with just a quantum computer than

Not quite correct. Grover's Algorithm is provably asymptotically optimal for quantum attacks. That is, you'll never do better with just a quantum computer than Grover's will, unless you can also do better without the quantum computer. (One caveat is that Grover's has substantial low-order terms, and one could come up with an algorithm having the same big-O complexity but better practical efficiency. But they don't seem to be claiming that.) It's not known that there are no classical attacks on AES. Just that a lot of people have looked quite hard for over 20 years and haven't found anything useful. Terra hasn't provided any evidence of their attacks. Lots of claims, no proof. That doesn't inspire any trust in their claims, especially since proof would be easy. They claim to have found a way to "invert" MD5, which probably means a second preimage attack. If they had that, they could release data which hashes to an all-zero output. If they were ethical and telling the truth, they'd provide proof. If they were unethical and telling the truth, they'd generalize it to find second-preimages on double SHA256, and have a vastly more efficient way to mine bitcoin (and/or forge bitcoin transactions) and make a bunch of money instead of or before putting out a press release. Neither of these things (or anything similar) has happened, so they're almost certainly lying.

AnimalMuppet 6y ago
If I understand correctly, Grover's Algorithm is a brute-force guesser, which in quantum works much better than in classical. Grover's Algorithm is provably asymtotically optimal for brute-force quantum attacks. Which is great... for that class of attack. Now, you correctly point out that there are no new classical attacks on AES. So what this would have to be (if true) is a new class of attack that has some quantum-only step, but is different from a Grover-style black-box-output-guessing attack. As you said, that's if it's true...

AnimalMuppet 6y ago

If I understand correctly, Grover's Algorithm is a brute-force guesser, which in quantum works much better than in classical. Grover's Algorithm is provably asymtotically optimal for brute-force quantum attacks. Which is great... for that class of attack. Now, you correctly point out that there are no new classical attacks on AES. So what this would have to be (if true) is a new class of attack that has some quantum-only step, but is different from a Grover-style black-box-output-guessing attack. As you said, that's if it's true...