> It would require a doubling of key lengths to maintain security against quantum Grover search attacks. Grover could in theory reduce a 256-bit cipher like AE

> It would require a doubling of key lengths to maintain security against quantum Grover search attacks. Grover could in theory reduce a 256-bit cipher like AES-256 or ChaCha to a 128-bit cipher. 128 bits is still far beyond what can be brute forced with any sane or practical amount of resources or time. It would mean 128-bit keys would be unsafe, but 256-bit or higher has been recommended for years anyway for reasons beyond QC like birthday attacks. Also keep in mind that this is a theoretical (as in big-O notation) speedup. Real world performance would depend a ton on the speed of the quantum computer. If a QC running Grover's algorithm isn't at least as fast as e.g. a conventional CPU then it might not be much faster in practice than a custom ASIC brute forcing a full strength key. That would make it pretty much an academic demo, not even useful in practice against 128-bit keys.