4 ms·
The current academic consensus is that AES-256 is quantum resistant, as even with Grover's algorithm the attack would still require 2^128 bits of work. Generall
by pseudo0 5y ago
The current academic consensus is that AES-256 is quantum resistant, as even with Grover's algorithm the attack would still require 2^128 bits of work. Generally symmetric encryption schemes are impacted to a much lesser extent than public key cryptosystems, with larger key sizes sufficing to ensure quantum resistance. I'd be quite surprised if Apple weren't using AES-256 already.
- eurasiantiger 5y agoThey are using AES-128. https://support.apple.com/en-us/HT202303 https://support.apple.com/en-us/HT202303
- pseudo0 5y agoA minimum of AES-128, which could mean 100% AES-128 or 1% AES-128 from old iOS devices that haven't been updated in years. And even AES-128 would require doing a 2^64 exhaust on a quantum computer, which would be quite a remarkable feat.
- eurasiantiger 5y agoMore likely it’s all AES-128 since that is natively supported by energy-efficient TPM chips, while -256 isn’t.