Protecting symmetric crypto against quantum computers in the future requires doubling the key length. AFAIK that's the main reason for 256 bit symmetric crypto

Protecting symmetric crypto against quantum computers in the future requires doubling the key length. AFAIK that's the main reason for 256 bit symmetric crypto today. Protecting commonly deployed asymmetric crypto against quantum computers [1] in the future is AFAIK impossible. Shor's algorithm and the ecc/dlp variants turn factoring, dlp, and ecc dlp, into BQP problems. Key lengths to protect against quantum attacks would render rsa, ecdsa, dh, and ecdh much too computationally expensive. There are some alternatives like NTRU (lattice-based crypto) but none are in wide use, and patents don't help that situation. [1] real quantum computers... there is still plenty of skepticism about the capability of d-wave's devices. http://www.scottaaronson.com/blog/?p=954 http://www.scottaaronson.com/blog/?p=954