The prototypical quantum attack for symmetric crypto is Grover's algorithm [https://en.wikipedia.org/wiki/Grover%27s_algorithm https://en.wikipedia.org/wiki/Gro

The prototypical quantum attack for symmetric crypto is Grover's algorithm [https://en.wikipedia.org/wiki/Grover%27s_algorithm https://en.wikipedia.org/wiki/Grover%27s_algorithm] which finds "the unique input to a black box function that produces a particular output value". Whereas a classical computer would need to check an average of N/2 values (where N is the size of the domain), Grover's takes O(sqrt(N)). When you're measuring "bits of security", you say N=2^k, so a classical computer would take O(2^k) and Grover's would take O(sqrt(2^k)) = O(2^(k/2)), or a reduction from k bits of security from a classical adversary to k/2 bits of security from a quantum adversary. Hence the wisdom that AES-256 is approximately as secure post-quantum as AES-128 is to classical methods.