The actual meaningful quantum attacks on modern cryptography all target the asymmetric key exchange algorithms, and make them practically attachable (assuming t

The actual meaningful quantum attacks on modern cryptography all target the asymmetric key exchange algorithms, and make them practically attachable (assuming the standard “big enough” and “with low enough noise” constraints). Grover’s algorithm is essentially just a square root improvement on the search complexity for finding the symmetric key. That means the search complexity remains exponential and the encryption is still secure - we might want to increase the key size[1], but that is all that is needed. The attacks on asymmetric ciphers mean increasing the key size isn’t a meaningful solution. [1] currently under classical attack aes128 is “secure”, and assuming no algorithmic weakness being discovered will remain so for a while. However most modern protocols have increased to 256 but keys already as a pre-emotive defense against increasing classical computing capacity. Grover’s algorithm logically reduces the strength of a 256 bit key to 128 bits, but doing so requires quantum computers which so far seem to have some fundamental performance limits that leads me to not being overly concerned. I’d be more concerned about a quantum attack on aes128 as complexity on the order of 2^64 becomes much more plausibly broken.